• v0.3.9 3bb849c2a6

    v0.3.9 Stable

    pipeline-bot released this 2026-07-24 01:33:13 +00:00 | 13 commits to main since this release

    Changed

    • Split the user and service-account convergence paths into explicit lifecycle
      phases and clear the full static-analysis backlog so controller behavior is
      easier to review and extend.
    • Emit Kubernetes Events through the current events.k8s.io recorder API across
      every controller while retaining compatibility with the shared harness.

    Fixed

    • Preserve spec.minioRef across v1alpha1/v1beta1 conversion for every
      top-level resource, cross-namespace spec.bucketRef.namespace for every
      bucket subresource, and credential spec.secret.extraData; the v1beta1
      storage schema previously omitted or discarded these fields.
    • Make MinioServiceAccount rotation retries converge MinIO on the candidate
      key already published to the managed Secret. A durable, non-secret status
      checkpoint prevents transient UpdateServiceAccount(NewSecretKey) failures
      from minting a different key and churning consumers on every retry.

    Security

    • Update vulnerable Prometheus, OpenTelemetry, x/net, and x/text
      dependencies to their patched release floors.
    • Build with digest-pinned Go 1.25.12, which includes the crypto/tls fix for
      GO-2026-5856, and use cryptographic entropy for reconcile-backoff jitter.

    Included changes (v0.3.8 -> v0.3.9)

    • 3a04236d04d1 build: align CI with patched Go toolchain
    • f1389773914f fix(operator): harden reconciliation and storage contracts
    Downloads