Skip to content

Changelog

All notable changes to this project are documented in this file.

The format is based on Keep a Changelog.

Unreleased

1.0.0-rc.1 - 2026-09-22

Added

  • SpillwayProfile is now served at spillway.kroy.io/v1 (storage version). v1alpha1 remains served with a deprecation warning and is removed no earlier than 1.2.0. The schema is identical, so no conversion webhook is needed. hack/migrate-storage-version.sh rewrites stored objects and trims the CRD's stored versions.
  • A 1.x compatibility promise in the README: annotations, the v1 CRD, controller flags, Helm values, replica markers, and metric names are stable for the whole 1.x line.
  • Documentation site rebuilt with Material for MkDocs from markdown under docs/, replacing the single-page landing site. The changelog page is the same file as CHANGELOG.md.

Changed

  • Examples and documentation use apiVersion: spillway.kroy.io/v1.

0.6.0 - 2026-09-21

Changed

  • All GitHub Actions moved to Node 24 releases (Node 20 runtime deprecated); every action remains pinned by commit SHA.

Added

  • CHANGELOG.md, backfilled from v0.3.0.
  • make bump VERSION=X.Y.Z is now the single writer for the release version (chart, Kustomize image tag, README, website, changelog); CI fails if any reference disagrees with Chart.yaml.
  • The SpillwayProfile CRD and its DeepCopy methods are generated by controller-gen (pinned as a Go tool dependency) from the Go types; the Helm chart's CRD is derived from the generated file by hack/sync-crd.sh. CI fails if either is stale. The CRD gains a swp short name and tighter validation on targetSelector operators and status conditions; nothing was loosened.
  • Release artifacts are now signed with Sigstore cosign (keyless, GitHub OIDC): container image and Helm chart by digest, checksums.txt with a bundle. SPDX SBOMs for the image (per architecture) and the source tree are attached to each GitHub release, and the image SBOMs are attested. Verification commands are in SECURITY.md.

0.5.1 - 2026-09-21

Fixed

  • Granted the controller create/patch RBAC on events.k8s.io Events. 0.5.0 moved event emission to the events.k8s.io API but the ClusterRole still only allowed core events, so ReplicationSucceeded/ReplicationFailed events were silently rejected; replication itself was unaffected. The e2e suite now asserts that an event is recorded on the source object.

0.5.0 - 2026-09-21

Added

  • SpillwayProfile spec validation: sources requires at least one entry, kind is restricted to Secret/ConfigMap, name is required, and includeKeys/excludeKeys are mutually exclusive (enforced via CRD schema and CEL rules). Validation failures are surfaced as status conditions and a new spillway_replication_outcomes_total{kind,mode,outcome} metric.
  • CI now runs envtest against a real API server (instead of skipping) and adds a kind-based end-to-end job that upgrades from the previously released Helm chart, installs fresh, runs functional checks, and uninstalls.

Changed

  • Upgraded controller-runtime to v0.25.1 and Kubernetes client libraries to v0.37.0. Documented the supported Kubernetes version range: 1.35 through 1.37.
  • Event emission moved from the deprecated core Event API to events.k8s.io (via GetEventRecorder).
  • CRD types now register through runtime.NewSchemeBuilder instead of the deprecated scheme.Builder.
  • SECURITY.md supported-versions table now lists the 0.4.x and 0.5.x lines.

0.4.4 - 2026-04-13

Fixed

  • Helm chart now renders controller boolean CLI flags (--leader-elect, --require-namespace-consent, --allow-force-adopt) as explicit true/false strings instead of relying on Go template's default boolean formatting.
  • ArtifactHub OCI metadata is now pushed to the chart package path GHCR actually accepts.

0.4.3 - 2026-04-13

Fixed

  • Granted the SpillwayProfile RBAC (update/patch on spillwayprofiles) needed for finalizer and status updates; profile reconciliation across namespaces could fail without it.
  • Partial kubernetes.io/tls Secret projections are now coerced to Opaque replicas when include-keys/exclude-keys drop tls.crt or tls.key, instead of producing an invalid TLS-typed Secret missing a required key.

Added

  • Helm chart README for ArtifactHub.

0.4.2 - 2026-03-14

Security

  • Upgraded the Go toolchain 1.24 → 1.26.1, resolving CVE-2026-27142 (MEDIUM), CVE-2026-25679 (MEDIUM), and CVE-2026-27139 (LOW) in the standard library.

0.4.1 - 2026-03-14

Security

  • Upgraded the Go toolchain 1.22 → 1.24, resolving CVE-2025-68121 (CRITICAL) and five HIGH-severity standard library CVEs (CVE-2025-58183, CVE-2025-61726, CVE-2025-61728, CVE-2025-61729, CVE-2025-47907).
  • Upgraded golang.org/x/oauth2 0.12.0 → 0.27.0, resolving CVE-2025-22868 (HIGH).
  • Upgraded golang.org/x/net 0.23.0 → 0.38.0 and refreshed x/sys, x/term, x/text, resolving additional MEDIUM-severity CVEs.

0.4.0 - 2026-03-14

Added

  • golangci-lint CI job (errcheck, staticcheck, gocritic, misspell, ineffassign, unused).
  • Security CI job running govulncheck and a Trivy filesystem scan; fails the build on CRITICAL or HIGH severity CVEs.

Changed

  • Helm chart: startup probe enabled by default (failureThreshold: 30, periodSeconds: 10), giving leader-election up to five minutes before liveness checks intervene.
  • Helm chart: pod anti-affinity enabled by default (preferred, kubernetes.io/hostname topology key) so replicas spread across nodes without blocking single-node clusters.

0.3.4 - 2026-03-15

Added

  • Enterprise/SOC 2 authorization model: deny-by-default namespace consent via --require-namespace-consent, a configurable protected-namespace denylist via --protected-namespaces (default kube-system), force-adopt gated behind --allow-force-adopt (disabled by default), and an annotation denylist via --annotation-deny-prefixes that blocks kubectl/Helm/Argo CD/Flux annotation prefixes from propagating to replicas.
  • Structured audit log entries for every create, update, delete, conflict, cleanup, TTL expiry, consent denial, and force-adopt denial, including source kind/namespace/name, target namespace, and reason.
  • Kyverno admission policy examples (examples/admission-policies/kyverno/) restricting replication annotations, SpillwayProfile creation, and wildcard namespace targeting.
  • Optional NetworkPolicy egress rules via the networkPolicy.egressEnabled / networkPolicy.egress Helm values.

Changed

  • Website redesigned with an animated namespace-replication diagram and an editorial single-page layout.

Security

  • SECURITY.md no longer claims images are "signed via the release workflow"; it now documents the actual image verification guidance and the new authorization controls.

0.3.3 - 2026-03-13

Fixed

  • Profile reconciliation now enforces per-source namespace consent and refuses to overwrite objects it doesn't manage or that are already managed by annotation-based replication.

Changed

  • The default NetworkPolicy now limits metrics ingress to same-namespace pods; additional scrapers can be allowed via the networkPolicy.ingress value.
  • --orphan-audit-interval is now a real controller flag and Helm value instead of inert metadata.

0.3.2 - 2026-03-13

Added

  • SpillwayProfile status conditions Ready and SourcesAvailable, set on every reconcile.
  • OrphanAuditInterval: when set, periodically scans for managed replicas whose source no longer exists and deletes them.
  • Smoke test coverage for force-adopt, ownership conflicts, namespace consent, and profile conditions.

Changed

  • Reconcile logic extracted into a shared generic path (reconcileObject[T]); the Secret and ConfigMap controllers no longer duplicate the same ~250 lines of logic.
  • accept-from namespace-consent annotation rewritten to use the documented Kind/namespace/name format with per-segment wildcard matching.

Fixed

  • The ArtifactHub metadata push step in the release workflow no longer blocks release creation on a non-critical GHCR permission error.
  • TTL expiry now tolerates a 5-second grace period for clock skew between nodes.
  • The expired-namespaces annotation is pruned of namespaces that no longer exist.

0.3.1 - 2026-02-28

Changed

  • Replica TTL semantics corrected: expired replicas are now permanently deleted rather than recreated. Expired namespaces are tracked in a new spillway.kroy.io/expired-namespaces annotation on the source; removing replica-ttl clears the record and resumes replication.

Added

  • Example manifests under examples/: key projection, TTL replicas, label-selector targeting, namespace consent, and basic/advanced/consent-aware SpillwayProfile usage.

0.3.0 - 2026-02-28

Added

  • SpillwayProfile CRD (spillway.kroy.io/v1alpha1): declaratively replicate Secrets and ConfigMaps from a profile namespace to any number of target namespaces without annotating the source objects, with per-source key filtering, namespace label selectors, exclusion lists, and status reporting.
  • Key projection: include-keys / exclude-keys annotations (and matching SpillwayProfile fields) whitelist or blacklist which data keys reach replicas.
  • Replica TTL: the replica-ttl annotation stamps expires-at on replicas at creation; expired replicas are removed on the next reconcile.
  • Namespace consent: the accept-from annotation on a target Namespace restricts which source namespaces or objects may replicate into it. Namespaces without the annotation keep the previous, backward-compatible behavior of accepting all sources.

Changed

  • Reconcile cleanup now uses an indexed, bounded List instead of scanning all objects cluster-wide, improving scalability on clusters with many replicas.
  • RBAC updated for the spillwayprofiles resource in both the Kustomize manifests and the Helm chart; the release pipeline and Helm chart defaults now use appVersion-derived image tags.