sean/kratos-identity-operator
Watch
1
0
Fork
You've already forked kratos-identity-operator
 0
Code Issues Pull requests Projects Releases 14 Packages Wiki Activity
14 releases 25 tags
  • v0.5.8 ff2edfcb23

    v0.5.8 Stable

    pipeline-bot released this 2026-07-13 18:49:13 +00:00 | 41 commits to main since this release

    Fixed

    • spec.email is now immutable (XValidation: self == oldSelf). Email is the sole Kratos
      lookup key, so editing it previously orphaned the old identity — which still carries a live
      password credential — and minted a duplicate under the new address. The apiserver now rejects the
      edit; change the address by deleting and recreating the KratosIdentity.
    • Guard against a double-create across the post-create observability window. When a create
      succeeded but the identity was not yet observable via the credential-identifier index, Converge
      persisted Status.IdentityID and returned Progressing; the next requeue re-ran getIdentity(email),
      found nothing, and fired a second createIdentity — 409-wedging a healthy CR under identifier
      uniqueness, or minting orphaned duplicates otherwise. Converge now disambiguates by the persisted ID
      (new getIdentityByID, GET /admin/identities/{id}): if the ID still resolves it adopts the identity
      (idempotent update); it only recreates when the ID is truly gone. New TestGetIdentityByID covers the
      200/404/5xx contract (a 5xx must hold, not recreate).

    Included changes (v0.5.7 -> v0.5.8)

    • 0028836eeb12 fix(kratos): immutable spec.email + guard against post-create double-create
    Downloads