sean/minio-resource-operator
Watch
1
0
Fork
You've already forked minio-resource-operator
 0
Code Issues Pull requests Projects Releases 14 Packages Wiki Activity
14 releases 106 tags
  • v0.3.18 044238d7ea

    Release 1 Build Stable

    binjovi-bot released this 2026-09-09 16:23:14 +00:00 | 0 commits to trunk since this release

    Downloads
  • v0.3.17 ce3e7a21db

    Release 1 Build Stable

    binjovi-bot released this 2026-09-09 15:59:29 +00:00 | 1 commits to trunk since this release

    • #43 Use scoped build caches for minio-resource-operator (ce3e7a21db)
    Downloads
  • v0.3.16 7bcafdfb69

    Release 1 Build Stable

    binjovi-bot released this 2026-09-02 05:53:38 +00:00 | 4 commits to trunk since this release

    Downloads
  • v0.3.15 7ec203a532

    v0.3.15 Stable

    pipeline-bot released this 2026-08-07 17:24:56 +00:00 | 9 commits to trunk since this release

    Changes

    • docs(agents): require ASD-STE100 Simplified Technical English (PR #39) — sean, c273eb093b63c73254311087f2d223e485978a3d
    • docs: rewrite documentation to ASD-STE100 (PR #40) — sean, 7ec203a532fefa306c053d8f9c7e2d163480733b
    Downloads
  • v0.3.14 5e2cc40484

    v0.3.14 Stable

    pipeline-bot released this 2026-08-06 10:05:29 +00:00 | 11 commits to trunk since this release

    Changes

    • fix(security): bind custom MinIO credentials to namespace (PR #38) — sean, 5e2cc40484ead5594775fa4f62a16248c77c85b5
    Downloads
  • v0.3.13 b7dc3df041

    v0.3.13 Stable

    pipeline-bot released this 2026-07-28 15:18:46 +00:00 | 12 commits to trunk since this release

    • Sort ILM filter tag keys so the lifecycle document stops churning. buildILMFilter's <And> branch built an ordered []lifecycle.Tag by ranging spec.filter.tags, a map[string]string — and Go randomizes map iteration, so the <And><Tag> children came out in a different order on nearly every call. The ILM apply path has no drift-skip gate (unlike MinioServiceAccount, which short-circuits on Status.AppliedPolicyHash), so it calls SetBucketLifecycle unconditionally on every reconcile including the 5-minute resync: a multi-tag filter therefore PUT a different XML document to MinIO every pass and emitted a spurious Updated event claiming a change that never happened — endlessly, with zero spec edits. Keys are now sorted before the slice is built (matching the existing buildOpenIDKV discipline). Regression tests (F97) pin both the built slice and the marshaled wire bytes as byte-identical across 100 builds.

    Included changes (v0.3.12 -> v0.3.13)

    • 3f7175c24dca fix(ilm): sort filter tag keys so the lifecycle document stops churning
    Downloads
  • v0.3.12 0a1bcc129f

    v0.3.12 Stable

    pipeline-bot released this 2026-07-28 07:37:54 +00:00 | 14 commits to trunk since this release

    Fixed

    • Key the MinIO client cache on identity, not just endpoint. Factory cached
      clients by endpoint alone while resolving and then discarding the root
      credentials, so two resources naming one endpoint through different root
      Secrets — the reference's namespace defaults to the resource's own — shared
      whichever client won the race, and the operator performed one namespace's IAM
      writes as another namespace's identity. The same bug kept serving a client
      built from a superseded password after a root Secret rotation, for the life of
      the process. The key now covers endpoint, region, TLS, and a hash of the
      resolved credentials. MinioRef was newly exposed on the
      MinioServiceAccount/MinioUser specs in 0.3.11, which widened the reach.
    • Make SetDefaultClient actually thread-safe. Client is a two-word struct,
      so the unsynchronized write was not atomic and a concurrent reader could
      observe an Admin from the new credentials beside an S3 from the old. The
      comment claimed safety on the grounds that readers "don't hold locks while
      using the client", which is the condition that creates the race rather than one
      that avoids it. Reads and writes now share an RWMutex.

    Included changes (v0.3.11 -> v0.3.12)

    • 8105d6304e7a fix(client): key the client cache on identity, not just endpoint
    Downloads
  • v0.3.11 ed0462a2e9

    v0.3.11 Stable

    pipeline-bot released this 2026-07-24 12:31:19 +00:00 | 17 commits to trunk since this release

    Fixed

    • Run installed Admin and S3 operations inside the circuit breaker instead of
      counting only the in-memory delegate lookup. Typed network failures and
      operation deadlines now trip the breaker and fail fast after the configured
      threshold, and the half-open transition now admits exactly one concurrent
      probe.
    • Exercise the served shared-harness and circuit-breaker metric families in
      the Kind suite. The scrape Pod now uses a digest-pinned curl image and its
      projected service-account token at runtime, so bearer credentials are no
      longer embedded in the Pod spec or verbose logs.
    • Remove the unused pre-shared-harness metrics implementation and tests; those
      metric names were never registered by the manager.
    • Use Go's any-error Athens|direct proxy fallback in both image builds.
      In-cluster builds still prefer Athens, while local/isolated e2e builds no
      longer fail when the cluster-only Athens DNS name is unreachable.
    • Build and validate with the rebuild-durable fleet Go 1.26.5 builder from
      Codeberg. Its single-architecture build host avoids expanding Docker Hub's
      multi-platform Go index through Zot while carrying current stdlib fixes; a
      test now keeps the compile and release-test builder references identical,
      platform-explicit, and digest-pinned.
    • Make make deploy restore its temporary manager-image override on both
      success and failure, so live and e2e deploys no longer dirty the checkout.

    Included changes (v0.3.10 -> v0.3.11)

    • 5d6b4ec7f8d7 test(build): lock reviewed fleet builder digest
    • c9bee5b13760 test(build): pin fleet builder contract
    • 578ab6c3f0c3 build: pull fleet Go builder from Codeberg
    • cebc6ef2ab11 build: use fleet Go 1.26.5 image
    • 4c002ff3e08b test(e2e): exercise metrics and API conversion lifecycle
    • 96b0b9a7a438 fix(minioclient): measure remote failures in breaker
    Downloads
  • v0.3.10 fdfaa0f568

    v0.3.10 Stable

    pipeline-bot released this 2026-07-24 02:17:07 +00:00 | 26 commits to trunk since this release

    Fixed

    • Rewrite the cert-manager CA injection annotation on every conversion CRD to
      the deployed serving Certificate. v1alpha1 API requests previously failed
      TLS verification because the rendered CRDs retained Kubebuilder's
      system/serving-cert placeholder.
    • Gate the install bundle and cluster smoke test on both admission and
      conversion CA wiring so a healthy validating webhook cannot mask a broken
      version-conversion path.

    Included changes (v0.3.9 -> v0.3.10)

    • c2b360c449ad fix(webhook): wire conversion CRD trust bundles
    Downloads
  • v0.3.9 3bb849c2a6

    v0.3.9 Stable

    pipeline-bot released this 2026-07-24 01:33:13 +00:00 | 30 commits to trunk since this release

    Changed

    • Split the user and service-account convergence paths into explicit lifecycle
      phases and clear the full static-analysis backlog so controller behavior is
      easier to review and extend.
    • Emit Kubernetes Events through the current events.k8s.io recorder API across
      every controller while retaining compatibility with the shared harness.

    Fixed

    • Preserve spec.minioRef across v1alpha1/v1beta1 conversion for every
      top-level resource, cross-namespace spec.bucketRef.namespace for every
      bucket subresource, and credential spec.secret.extraData; the v1beta1
      storage schema previously omitted or discarded these fields.
    • Make MinioServiceAccount rotation retries converge MinIO on the candidate
      key already published to the managed Secret. A durable, non-secret status
      checkpoint prevents transient UpdateServiceAccount(NewSecretKey) failures
      from minting a different key and churning consumers on every retry.

    Security

    • Update vulnerable Prometheus, OpenTelemetry, x/net, and x/text
      dependencies to their patched release floors.
    • Build with digest-pinned Go 1.25.12, which includes the crypto/tls fix for
      GO-2026-5856, and use cryptographic entropy for reconcile-backoff jitter.

    Included changes (v0.3.8 -> v0.3.9)

    • 3a04236d04d1 build: align CI with patched Go toolchain
    • f1389773914f fix(operator): harden reconciliation and storage contracts
    Downloads