v0.0.10

Phase 6 operator release — adds ApplicationInstance.spec.mode: placeholder for per-cluster cluster-ops sentinel instances (Option B from the hub design). Upgrade the operator (CRDs + controller) before enabling placeholder mode from the control plane — the server emits spec.mode: placeholder only after operator v0.0.10+ is installed.

Container image: docker.io/vworkspace/vworkspace-operator:v0.0.10

Install

Helm (operator + CRDs + RBAC):

helm upgrade --install vworkspace-operator \
  https://github.com/vworkspace-io/vworkspace-operator/releases/download/v0.0.10/vworkspace-operator-0.0.10.tgz \
  --version 0.0.10 \
  -n vworkspace-system \
  --create-namespace

kubectl (no Helm — apply CRDs first):

kubectl apply -f https://github.com/vworkspace-io/vworkspace-operator/releases/download/v0.0.10/crds.yaml
kubectl apply -f https://github.com/vworkspace-io/vworkspace-operator/releases/download/v0.0.10/operator.yaml
kubectl -n vworkspace-system wait --for=condition=Available \
  deployment/vworkspace-operator --timeout=300s

Install guide: docs/install/helm.md

Release assets

File	Purpose
vworkspace-operator-0.0.10.tgz	Helm chart (operator, CRDs, RBAC)
crds.yaml	CRDs only — for kubectl or GitOps bootstrap
operator.yaml	Namespace + operator Deployment (CRDs excluded)
SHA256SUMS	Checksums for the files above

What's changed

Added

• ApplicationInstanceSpec.mode enum (managed default | placeholder). Placeholder instances reach Ready=True (Reason=Placeholder) without Helm; they advertise infra capability annotations (ops.vworkspace.io/runcommand, runbook, …) as the targetRef for cluster-scoped Operations. Reconciler skips EnsureRelease/DeleteRelease; webhook rejects chart/values/release on placeholders and blocks managed→placeholder transitions when a Helm release may exist (#77, hub P6-T001).
• ADR 0006 — ApplicationInstance placeholder mode.

Upgrade note

Apply CRDs first, then roll the operator Deployment:

kubectl apply -f https://github.com/vworkspace-io/vworkspace-operator/releases/download/v0.0.10/crds.yaml
helm upgrade vworkspace-operator \
  https://github.com/vworkspace-io/vworkspace-operator/releases/download/v0.0.10/vworkspace-operator-0.0.10.tgz \
  --version 0.0.10 -n vworkspace-system --reuse-values --set image.tag=v0.0.10

Existing ApplicationInstance objects without spec.mode continue to reconcile as managed (CRD default).

Full changelog: CHANGELOG.md

v0.0.9

Bugfix release — makes cluster registration idempotent so a transient status-write conflict during a successful registration no longer pins the Cluster to Error. Surfaced during Rancher real-cluster validation.

Container image: docker.io/vworkspace/vworkspace-operator:v0.0.9

Install

Helm (operator + CRDs + RBAC):

helm upgrade --install vworkspace-operator \
  https://github.com/vworkspace-io/vworkspace-operator/releases/download/v0.0.9/vworkspace-operator-0.0.9.tgz \
  --version 0.0.9 \
  -n vworkspace-system \
  --create-namespace

kubectl (no Helm — apply CRDs first):

kubectl apply -f https://github.com/vworkspace-io/vworkspace-operator/releases/download/v0.0.9/crds.yaml
kubectl apply -f https://github.com/vworkspace-io/vworkspace-operator/releases/download/v0.0.9/operator.yaml
kubectl -n vworkspace-system wait --for=condition=Available \
  deployment/vworkspace-operator --timeout=300s

Install guide: docs/install/helm.md

Release assets

File	Purpose
vworkspace-operator-0.0.9.tgz	Helm chart (operator, CRDs, RBAC)
crds.yaml	CRDs only — for kubectl or GitOps bootstrap
operator.yaml	Namespace + operator Deployment (CRDs excluded)
SHA256SUMS	Checksums for the files above

What's changed

Fixed

• Cluster registration is now idempotent against existing bootstrap credentials. The reconciler treats a present, valid vworkspace-agent-credentials Secret as proof of registration and no longer re-exchanges the spent one-time token, and the post-registration status write retries on optimistic-concurrency conflicts. Previously a transient the object has been modified conflict during a successful registration left status.phase unset, so the next reconcile re-exchanged the consumed token and pinned the Cluster to Error (RegistrationTokenInvalid) until a new token was issued. A 401 with credentials already present is now treated as benign. Surfaced during Rancher real-cluster validation; tracked under hub golden-path task P4-T001.
• CI: suppress the SA1019 staticcheck deprecation warning on the cluster-controller event recorder so golangci-lint passes on main (#75).

Full changelog: CHANGELOG.md

v0.0.8

Helm chart and kubectl manifests for v0.0.8. Container image: docker.io/vworkspace/vworkspace-operator:v0.0.8.

Container image: docker.io/vworkspace/vworkspace-operator:v0.0.8

Install

Helm (operator + CRDs + RBAC):

helm upgrade --install vworkspace-operator \
  https://github.com/vworkspace-io/vworkspace-operator/releases/download/v0.0.8/vworkspace-operator-0.0.8.tgz \
  --version 0.0.8 \
  -n vworkspace-system \
  --create-namespace

kubectl (no Helm — apply CRDs first):

kubectl apply -f https://github.com/vworkspace-io/vworkspace-operator/releases/download/v0.0.8/crds.yaml
kubectl apply -f https://github.com/vworkspace-io/vworkspace-operator/releases/download/v0.0.8/operator.yaml
kubectl -n vworkspace-system wait --for=condition=Available \
  deployment/vworkspace-operator --timeout=300s

Install guide: docs/install/helm.md

Release assets

File	Purpose
vworkspace-operator-0.0.8.tgz	Helm chart (operator, CRDs, RBAC)
crds.yaml	CRDs only — for kubectl or GitOps bootstrap
operator.yaml	Namespace + operator Deployment (CRDs excluded)
SHA256SUMS	Checksums for the files above

What's changed

See the full changelog for this release.

Full changelog: CHANGELOG.md

v0.0.7

Phase 2 pre-release — first GitHub Release with installable Helm chart and kubectl manifests. Container image: docker.io/vworkspace/vworkspace-operator:v0.0.7.

Install

Helm (operator + CRDs + RBAC):

helm upgrade --install vworkspace-operator \
  https://github.com/vworkspace-io/vworkspace-operator/releases/download/v0.0.7/vworkspace-operator-0.0.7.tgz \
  --version 0.0.7 \
  -n vworkspace-system \
  --create-namespace

kubectl (no Helm — apply CRDs first):

kubectl apply -f https://github.com/vworkspace-io/vworkspace-operator/releases/download/v0.0.7/crds.yaml
kubectl apply -f https://github.com/vworkspace-io/vworkspace-operator/releases/download/v0.0.7/operator.yaml
kubectl -n vworkspace-system wait --for=condition=Available \
  deployment/vworkspace-operator --timeout=300s

Full install guide: docs/install/helm.md

Release assets

File	Purpose
vworkspace-operator-0.0.7.tgz	Helm chart (operator, CRDs, RBAC)
crds.yaml	CRDs only — for kubectl or GitOps bootstrap
operator.yaml	Namespace + operator Deployment (CRDs excluded)
SHA256SUMS	Checksums for the files above

What's changed

Added

• Helm chart release artifacts on GitHub Releases: packaged .tgz, crds.yaml, operator.yaml, and SHA256SUMS (via hack/package-release.sh and CI release job on v* tags).
• Operation engines: job, workflow, and helmHookJob runtime materialization and status polling in the operation reconciler.
• Operation admission: typed concurrency conflict matrix and vws1 approval-claim HMAC verification.
• Built-in restore.velero template marks RequiresApproval; reconciler blocks with AwaitingApproval until a valid claim is present.
• CI: Cursor Agent automated PR code review workflow.

Changed

• CI: Cursor code review fails the workflow when Findings include critical, major, or minor.
• CI: code review uses PR head SHA in comments, caps previous-review history, fails the job on agent errors.

Full changelog: CHANGELOG.md