sean/kratos-identity-operator
Watch
1
0
Fork
You've already forked kratos-identity-operator
 0
Code Issues Pull requests Projects Releases 14 Packages Wiki Activity
14 releases 25 tags
  • v0.5.17 cb6f0c220b

    v0.5.17 Stable

    pipeline-bot released this 2026-07-24 09:39:55 +00:00 | 0 commits to main since this release

    Fixed

    • Verify schema, active state, and canonicalized traits on every steady-state
      identity read so out-of-band Kratos edits are repaired without re-writing an
      unchanged password on the next pass.
    • Reject ambiguous credential-identifier lookups instead of silently adopting
      the first returned identity, and preserve HTTP status in typed client errors
      so invalid configuration stops retrying while conflicts, throttling, and
      outages continue through controller backoff.
    • Upgrade both build/validation toolchains to Go 1.26.5 and the
      x/net/x/text dependency family to patched versions identified by
      govulncheck; make standalone Athens defaults fail over on any proxy error.

    Included changes (v0.5.16 -> v0.5.17)

    • 0e5740415a78 build: align validation toolchain and Athens fallback
    • 148ce5459439 fix(identity): repair remote drift and classify API errors
    Downloads
  • v0.5.16 d7dc4b6b6b

    v0.5.16 Stable

    pipeline-bot released this 2026-07-23 17:25:43 +00:00 | 5 commits to main since this release

    Security

    • Require every KratosIdentity to use the exact namespace-local Admin API
      endpoint (http://kratos-admin.<namespace>.svc.cluster.local:4434). This
      prevents a CR author from redirecting the controller's Secret-backed password
      submission to an arbitrary or cross-tenant HTTP endpoint.
    • Path-escape Kratos-returned identity IDs before update and delete requests so
      a malformed or compromised response cannot alter the Admin API path.

    Changed

    • Fail safely instead of panicking when the reconciler HTTP client is not
      configured.
    • Clear the repository's lint and gosec backlog (unchecked response closes,
      mock response writes, and stale controller-runtime assertions); both strict
      full-repository gates now report zero issues.

    Included changes (v0.5.15 -> v0.5.16)

    • 6b8737bc5354 fix(controller): constrain Kratos admin requests
    Downloads
  • v0.5.15 43c88869b8

    v0.5.15 Stable

    pipeline-bot released this 2026-07-21 09:32:41 +00:00 | 9 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.5.14 -> v0.5.15)

    • 05151a7b434c chore: remove confirmed-dead code (dead-code hunt)
    Downloads
  • v0.5.14 5a24d168bb

    v0.5.14 Stable

    pipeline-bot released this 2026-07-17 11:10:50 +00:00 | 13 commits to main since this release

    Changed

    • Bump libseanfarm-operator v0.4.11 -> v0.4.12 (lib-autobump: rides the shared-library release train; the envtest release gate validates the suite against it on the next ship).
    • Adopt the lib's canonical operator.mk scaffolding: the Makefile's shared
      dev-loop targets (manifests/generate/fmt/vet/test/lint*) and the whole
      Dependencies section (tool pins + installers, go.mod-derived envtest
      versions) are replaced by a vendored operator.mk include (re-synced by the
      lib-bump autoland); the project Makefile keeps only repo-specific targets
      (docker-*, build-installer, deploy/install, e2e). make test no longer
      copies cover.out to coverage.txt (nothing consumed it).
    • Adopt libseanfarm-operator v0.4.12 httpkit/reconcile helpers: local
      errorBodyExcerpt/maxErrorBodyExcerpt -> httpkit.ErrorExcerpt (same 512-byte
      bound, now structurally tied to the lib's condition-message limit), local
      maxResponseBodySize bounded reads -> httpkit.BoundedRead/httpkit.MaxResponseBytes
      (same 1 MiB), and getPasswordFromSecret -> reconcile.SecretValue (identical
      value+resourceVersion contract; the ObservedSecretResourceVersion convention is
      unchanged — the secret-not-found error now includes the namespace).

    Included changes (v0.5.13 -> v0.5.14)

    • 59c4521e3944 chore(scaffolding): adopt operator.mk + httpkit helpers (lib v0.4.12)
    • b6f76db276be chore(deps): bump libseanfarm-operator v0.4.11 -> v0.4.12 (lib-autobump)
    Downloads
  • v0.5.13 b48bf7ccba

    v0.5.13 Stable

    pipeline-bot released this 2026-07-16 16:15:40 +00:00 | 19 commits to main since this release

    Changed

    • Bump libseanfarm-operator v0.4.10 -> v0.4.11 (lib-autobump: rides the shared-library release train; the envtest release gate validates the suite against it on the next ship).
    • Adopt libseanfarm-operator v0.4.11 reconcile.Metrics for the GENERIC metric
      families: the hand-rolled reconcile-total/duration, status-update, and Kratos
      API-call counters/histograms in internal/controller/metrics.go are deleted;
      the lib records them via Config.Metrics/MetricsController (harness) and
      Metrics.RecordCall (kratosclient.go). Dashboard-facing changes:
      kratosidentity_reconcile_total gains a controller label (now
      {controller,result}) and kratosidentity_reconcile_duration_seconds is now
      labeled {controller} (drops result); kratosidentity_api_calls_total{controller,operation,status}
      replaces kratosidentity_kratos_api_calls_total{operation,status} (prefix
      rename) and kratosidentity_api_call_duration_seconds{controller,operation}
      replaces kratosidentity_kratos_api_duration_seconds{operation,status};
      kratosidentity_status_update_total gains {controller};
      kratosidentity_status_update_failures_total is removed (its only emission,
      reason="update_error" from the status-write hook, duplicated the generic
      kratosidentity_status_update_total{result="error"} the lib now records).
      The kratos-DOMAIN metrics stay local and unchanged: the kratosidentity_phase
      gauge keeps its exact deletion-transition bookkeeping (decrement exactly once
      on the transition into Deleting — the r5 negative-gauge fix), plus
      orphaned-recovery, deletion-email-lookup, and password-update-failure counters.

    Included changes (v0.5.12 -> v0.5.13)

    • c1c21b67249e chore(metrics): adopt libseanfarm reconcile.Metrics (generic families); keep the phase gauge local
    • b1792376c29d chore(deps): bump libseanfarm-operator v0.4.10 -> v0.4.11 (lib-autobump)
    Downloads
  • v0.5.12 8b9acd9f7c

    v0.5.12 Stable

    pipeline-bot released this 2026-07-15 18:14:24 +00:00 | 25 commits to main since this release

    Fixed

    • The ginkgo envtest controller suite RUNS now. It was gated behind
      ENABLE_ENVTEST=1, which make test never sets — so the 16-spec suite was
      silently skipped locally AND in the pipeline-test-envtest release gate (the exact
      red-suite-behind-a-green-row class the gate exists to close). Un-skipping surfaced
      rot fixed in the same change: second-granularity test-namespace names colliding
      with Terminating namespaces, seven specs asserting the pre-harness error contract
      (nil error + dead RequeueAfter=30s) instead of propagate-for-backoff, one spec
      still documenting the status-lost delete leak as a "known bug" that R5 fixed, and
      two specs whose users were missing from the password fixture. 16/16 green.

    Changed

    • Bump libseanfarm-operator v0.4.9 -> v0.4.10 and dedup onto reconcile/testkit:
      deleted the all-skip ObservedGeneration documentation file, 3 skip-stub integration
      tests, 2 self-asserting unit tests, and the 6-subtest secretwatch permutation suite
      (lib coverage; one thin extractor-wiring test remains); collapsed the generic
      harness trio into TestMirrorStatusHook (kratos's legacy Ready/Phase mirror,
      incl. the phaseFailed branch); envtest bring-up rides testkit.StartEnvtest
      (gaining bin/k8s discovery this repo never had). Makefile pins unified with
      siblings: ENVTEST_VERSION/ENVTEST_K8S_VERSION now derived from go.mod (drops
      the stale hardcoded release-0.19 / 1.35.0), golangci-lint v1.54.2 -> v2.8.0.

    Included changes (v0.5.11 -> v0.5.12)

    • 0b58af6245c7 fix(test): un-skip the envtest suite + dedup onto reconcile/testkit (lib v0.4.10)
    Downloads
  • v0.5.11 f3bd6a894c

    v0.5.11 Stable

    pipeline-bot released this 2026-07-15 16:13:58 +00:00 | 29 commits to main since this release

    Changed

    • Bump libseanfarm-operator v0.4.7 -> v0.4.9: picks up the six shared-harness fixes from
      the R5 bug-hunt (dry-run delete no longer touches the remote, Degraded message truncation,
      Progressing cleared on failure, dry-run clears stale Degraded/Progressing, empty
      Ready=False reason defaults to NotReady instead of a silently-swallowed 422,
      dry-run converge now runs MirrorStatus).

    Included changes (v0.5.10 -> v0.5.11)

    • b2ab700a45a1 fix(deps): bump libseanfarm-operator v0.4.7 -> v0.4.9
    Downloads
  • v0.5.10 ae4a1117b7

    v0.5.10 Stable

    pipeline-bot released this 2026-07-15 13:33:48 +00:00 | 33 commits to main since this release

    Fixed

    • Delete no longer drops the finalizer (leaking a live identity + credential) when it lost the
      identity ID and cannot resolve one by email.       A (nil, nil) email lookup is ambiguous — the
      identity may be genuinely gone, or not yet email-indexed (a racing create's index lag), or the
      schema is non-email (email is never the lookup key). Under HoldUntilSuccess the CR now HOLDS the
      finalizer for a bounded grace (2 min from the deletion timestamp), retrying so a lagging index can
      surface a just-created identity, and only gives up afterward rather than wedging Terminating
      forever. (Deletes that still hold the recorded ID are unaffected — they delete directly.)
    • Steady-state fast path no longer rubber-stamps a different identity Ready. If identity X (the
      one we manage) is deleted out of band and a new identity Y is created under the same email, the
      fast path adopted Y as Ready without re-asserting the spec's managed password/traits. It now
      short-circuits only when the email's identity is still our recorded ID; otherwise it falls through
      to the full converge so updateIdentity re-asserts.
    • Legacy status.ready/status.phase mirror is cleared on a held deletion. Under
      HoldUntilSuccess a failing delete keeps the CR alive; the mirror no longer reports Ready=true
      (with a stale Ready print column) while the CR is stuck Terminating + Degraded.

    Included changes (v0.5.9 -> v0.5.10)

    • 18fe8517dd57 fix(kratos): r5 cluster — delete cred-leak, adopt-guard, held-deletion mirror (3 fixes)
    Downloads
  • v0.5.9 9c0d8c0885

    v0.5.9 Stable

    pipeline-bot released this 2026-07-14 15:03:40 +00:00 | 37 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.5.8 -> v0.5.9)

    • 2ab2a6851344 fix(kratos): hold the finalizer on transient delete errors (was leaking live credentials)
    Downloads
  • v0.5.8 ff2edfcb23

    v0.5.8 Stable

    pipeline-bot released this 2026-07-13 18:49:13 +00:00 | 41 commits to main since this release

    Fixed

    • spec.email is now immutable (XValidation: self == oldSelf). Email is the sole Kratos
      lookup key, so editing it previously orphaned the old identity — which still carries a live
      password credential — and minted a duplicate under the new address. The apiserver now rejects the
      edit; change the address by deleting and recreating the KratosIdentity.
    • Guard against a double-create across the post-create observability window. When a create
      succeeded but the identity was not yet observable via the credential-identifier index, Converge
      persisted Status.IdentityID and returned Progressing; the next requeue re-ran getIdentity(email),
      found nothing, and fired a second createIdentity — 409-wedging a healthy CR under identifier
      uniqueness, or minting orphaned duplicates otherwise. Converge now disambiguates by the persisted ID
      (new getIdentityByID, GET /admin/identities/{id}): if the ID still resolves it adopts the identity
      (idempotent update); it only recreates when the ID is truly gone. New TestGetIdentityByID covers the
      200/404/5xx contract (a 5xx must hold, not recreate).

    Included changes (v0.5.7 -> v0.5.8)

    • 0028836eeb12 fix(kratos): immutable spec.email + guard against post-create double-create
    Downloads