chore(release): v0.37.0 (#1143)

Author: vmyroslav

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## [MAJOR.MINOR.PATCH] - YYYY-MM-DD
 
+## v0.37.0 - 2026-04-09
+
 - Add `ServiceUser` field `accessControl`, type `object`: AccessControl configures service-specific access control rules for the user.
 When this block is present, the operator manages the full access-control scope it contains
 - Add `OpenSearchACLConfig` to manage OpenSearch ACL

charts/aiven-operator-crds/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: aiven-operator-crds
 description: A Helm chart to deploy the aiven operator custom resource definitions
 type: application
-version: v0.36.0
-appVersion: v0.36.0
+version: v0.37.0
+appVersion: v0.37.0
 maintainers:
   - name: byashimov
     url: https://www.aiven.io

charts/aiven-operator/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: aiven-operator
 description: A Helm chart to deploy the aiven operator
 type: application
-version: v0.36.0
-appVersion: v0.36.0
+version: v0.37.0
+appVersion: v0.37.0
 maintainers:
   - name: byashimov
     url: https://www.aiven.io

docs/docs/changelog.md

@@ -1,6 +1,15 @@
 # Changelog
 
 
+## v0.37.0 - 2026-04-09
+
+- Add `ServiceUser` field `accessControl`, type `object`: AccessControl configures service-specific access control rules for the user.
+When this block is present, the operator manages the full access-control scope it contains
+- Add `OpenSearchACLConfig` to manage OpenSearch ACL
+- **BREAKING**: Removed `ClickhouseUser`/`ServiceUser` field `connInfoSecretSource.namespace`, type `string`: cross-namespace
+  secret references are no longer supported. The source secret must be in the same namespace as the resource.
+  This fixes a potential confused deputy vulnerability where the operator could be exploited to exfiltrate secrets from other namespaces.
+
 ## v0.36.0 - 2026-03-05
 
 - `KafkaTopic`: continuous reconciliation now automatically re-creates topics that are deleted directly in Aiven (outside Kubernetes).

tests/opensearchaclconfig_test.go

@@ -199,7 +199,7 @@ spec:
         - index: metrics*
           permission: write
 `,
-			errSnippet: "duplicate",
+			err: "duplicate",
 		},
 		{
 			name: "missing rules denied",