v0.6.0

v0.6.0 introduces TLS API improvements, ACL observability, and several correctness fixes - thank you to everyone who contributed to this release!

Breaking

ValkeyCluster TLS certificate path restructured

spec.networking.tls.certificate is replaced by spec.networking.tls.certificates.server. The secretName field is now required (minimum 1 character) when TLS is set. This is phase 1 of the spec.networking.tls tree (#377, closes #376, part of #360).

# before (v0.5.0)
spec:
  networking:
    tls:
      certificate:
        secretName: valkey-tls

# after (v0.6.0)
spec:
  networking:
    tls:
      certificates:
        server:
          secretName: valkey-tls

We immediately dropped support for the old spec.networking.tls.certificate structure, so upgrading CRDs against a live cluster will cause the secretName to be lost. You can perform these steps to avoid that:

1. Stop the operator running v0.5.0
2. Deploy the v0.6.0 CRDs
3. Deploy the migrated ValkeyCluster CRs (from spec.networking.tls.certificate to spec.networking.tls.certificates.server)
4. Start operator running v0.6.0

Upgrade notes

Upgrading triggers a rolling restart

The pod template changes on upgrade, so all pods will be rolled — one node at a time, replicas first, with proactive failover ahead of primaries. What changes the template:

• The controller-internal serverConfigHash annotation is now computed differently (#381)
• The default metrics exporter image is updated to v1.88.0 (#361), for clusters that do not pin exporter.image

Features

ACL revision tracking (#382, closes #369)

ACLApplied now tracks permission-only edits, not just user/password changes. A disabled sentinel user (_operator_acl_revision) in the aclfile makes the condition honest for all ACL mutations.

ACL apply failures surfaced on cluster status (#400, closes #396)

A failed ACL apply was only visible on the ValkeyNode. The ValkeyCluster now sets Degraded/ACLApplyFailed naming the affected nodes, so kubectl get valkeycluster shows the problem. Ready stays True since the data path is unaffected.

ACL commands validation (#398, closes #395)

commands.allow and commands.deny are now validated at admission. The previous CRD markers were malformed and generated no validation. Entries must be the bare command, category, or subcommand form (get, @read, client|setname); the operator adds the +/- sign itself.

Fixes

Proactive failover no longer triggers on no-op upgrades (#402, closes #401)

Spec changes that rendered an identical pod template (e.g. bool-to-pointer conversion) were misread as a roll and triggered a CLUSTER FAILOVER per shard primary. Now decided by comparing template hashes against WorkloadRevision.

Exporter sidecar preserved on partial overrides (#397, closes #394)

Setting image, resources, args, or securityContext on spec.exporter without explicitly setting enabled silently dropped the metrics sidecar. Now only an explicit enabled: false disables it.

Skip reconciliation during deletion (#374, closes #364)

Deleting a ValkeyCluster caused the operator to recreate resources in a loop. The reconciler now exits when DeletionTimestamp is set.

Default metrics exporter updated (#361)

Updated to v1.88.0.

What's Changed

• ci: build multi-arch images natively to avoid QEMU emulation by @bjosv in #366
• CI: cache Go build outputs and drop redundant go mod tidy by @bjosv in #372
• fix: skip reconciliation while ValkeyCluster is being deleted by @jdheyburn in #374
• refactor!: TLS API restructure by @jdheyburn in #377
• refactor: Remove serverConfigHash from ValkeyNode by @jdheyburn in #381
• test(e2e): assert cluster teardown against the cluster the spec deletes by @melancholictheory in #379
• ci: remove unnecessary disk space reclaim from publish workflow by @bjosv in #384
• feat: gate ACLApplied on an ACL revision user so permission edits are honest by @melancholictheory in #382
• fix: default exporter.enabled to true so partial overrides keep the sidecar by @bcfmtolgahan in #397
• chore: update default metrics exporter version v1.88.0 by @sandeepkunusoth in #361
• fix: surface a failed ACL apply on the cluster status by @melancholictheory in #400
• fix: generate the commands.allow/deny pattern and widen it to what Valkey accepts by @bcfmtolgahan in #398
• test(e2e): cluster re-forms after a full simultaneous pod restart by @matka12 in #380
• fix: use workloadRevision for determining proactive failover by @jdheyburn in #402
• doc: Fix wrong tech call meeting time in README by @skillpoint-dev in #412

New Contributors

• @bcfmtolgahan made their first contribution in #397
• @skillpoint-dev made their first contribution in #412

Full Changelog: v0.5.0...v0.6.0