v0.7.0 — Webhook high availability and security hardening

This release adds high-availability support for the webhook server, hardens the manager's security context to the Kubernetes restricted pod security standard, and migrates resource metrics to the ResourceMetricsPolicy CRD.

What's new

• Webhook high availability — a new config/components/high-availability Kustomize component runs two manager replicas with a PodDisruptionBudget (minAvailable: 1) and topology spread constraints to keep replicas on separate nodes, eliminating the availability gap during pod restarts or node maintenance. Consumers that want a single replica simply omit the component from their overlay. (#92)
• Restricted pod security context — the manager now runs with seccompProfile: RuntimeDefault, runAsUser/runAsGroup: 65532 (matching the distroless nonroot user), and readOnlyRootFilesystem: true, satisfying the Kubernetes restricted pod security standard. (#92)
• RBAC names prefixed with compute- — all ClusterRole and ClusterRoleBinding names now carry the compute- prefix to prevent collisions with other controllers in the same cluster. (#92)
• Deployment renamed to compute-manager — the manager Deployment is renamed from compute to compute-manager to avoid ambiguity with the broader system name. (#92)
• Resource metrics migrated to ResourceMetricsPolicy — replaces the ConfigMap-based CustomResourceStateMetrics configuration with a ResourceMetricsPolicy CRD. All condition types and all network interfaces on multi-homed instances are now tracked automatically without manual config changes. (#87)
• Discovery context annotations — all three CRDs (Workload, WorkloadDeployment, Instance) now carry discovery.miloapis.com/parent-contexts: Project annotations so they appear in API discovery when clients query within a Project context. (#86)

Note

No CRD schema changes. Existing Workload, WorkloadDeployment, and Instance resources keep working without any conversion.

v0.6.0 — Renamed to compute

This release renames the project from workload-operator to compute and tidies up the install bundle. Existing custom resources keep working with no migration.

Important

This is a breaking release. If you depend on this project, you'll need to update three things at the same time:

• Go imports: go.datum.net/workload-operator → go.datum.net/compute
• Container image: ghcr.io/datum-cloud/workload-operator → ghcr.io/datum-cloud/compute
• Install bundle: ghcr.io/datum-cloud/workload-operator-kustomize → ghcr.io/datum-cloud/compute-kustomize, and the canonical install path inside the bundle is now overlays/single-cluster/

What's new

• Renamed to compute so the project name matches the API group it actually owns. The repo, Go module, container image, and install bundle all moved to compute. (#83)
• Install bundle reorganized into clear base/, components/, and overlays/ directories so it's obvious at a glance what's a building block, what's a reusable add-on, and what's a top-level install. (#84)
• Admission webhooks are now optional. If you don't need them, you can omit the webhook server from your config and the manager runs without one instead of crashing because a serving certificate is missing. (#83)
• Multi-arch container images — now published for both linux/amd64 and linux/arm64. (#82)
• Metrics endpoint permissions fixed — the metrics service now ships with the right RBAC out of the box. (#79)

Note

No CRD changes. The compute.datumapis.com API group is unchanged, so existing Workload, WorkloadDeployment, and Instance resources keep working without any conversion. Leader election state also carries over cleanly across the upgrade.

v0.5.0

What's Changed

• feat: use project from extra by @zachsmith1 in #66

New Contributors

• @zachsmith1 made their first contribution in #66

Full Changelog: v0.4.0...v0.5.0

v0.4.0

What's Changed

• chore(deps): update datum-cloud/actions action to v1.4.0 by @renovate[bot] in #38
• chore(deps): update golangci/golangci-lint-action action to v8 by @renovate[bot] in #41
• feat: Direct lifecycle control of instances by @joshlreese in #51
• Move to Milo multi-cluster provider by @scotwells in #54
• Milo IAM resources by @scotwells in #56
• chore: use tagged milo release by @scotwells in #61

Full Changelog: v0.3.2...v0.4.0

v0.3.2

What's Changed

• Adjustments to Kustomize manifests to support deploying in multicluster mode.
• Updated the Datum multicluster provider to support field indexing.
• Added an api-docs command to the Makefile which uses crdoc to generate basic CRD reference documentation.

Full Changelog: v0.3.1...v0.3.2

v0.3.1

What's Changed

• Adjust the resource-metrics kustomization to be a Component and not a Kustomization. by @joshlreese in #47

Full Changelog: v0.3.0...v0.3.1

v0.3.0

What's Changed

• Leverage the multicluster-runtime library to enable the operator to manage resources from many control planes. by @joshlreese in #43

Full Changelog: v0.2.0...v0.3.0

v0.2.0 - Deployment Manifests

What's Changed

• Publish workload operator kustomize to OCI Repository by @OscarLlamas6 in #28
• chore(deps): update golang docker tag to v1.24 by @renovate in #13
• Package updates by @joshlreese in #33
• fix(deps): update module github.com/google/go-cmp to v0.7.0 by @renovate in #16
• fix(deps): update module github.com/onsi/ginkgo/v2 to v2.23.4 by @renovate in #17
• fix(deps): update module github.com/onsi/gomega to v1.37.0 by @renovate in #18
• fix(deps): update module google.golang.org/protobuf to v1.36.6 by @renovate in #21
• fix(deps): update module sigs.k8s.io/controller-runtime to v0.20.4 by @renovate in #22
• chore(deps): update dependency go to ~1.24.0 by @renovate in #24
• Bump golang.org/x/net from 0.30.0 to 0.36.0 in the go_modules group across 1 directory by @dependabot in #25
• fix(deps): update module golang.org/x/crypto to v0.37.0 by @renovate in #36
• fix(deps): update module github.com/stretchr/testify to v1.10.0 by @renovate in #35
• Bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules group across 1 directory by @dependabot in #34
• chore(deps): update datum-cloud/actions action to v1.2.0 by @renovate in #32
• Workload operator publish artifacts adjustments by @OscarLlamas6 in #29
• chore: output error from mutating resource by @scotwells in #31
• Add resource metrics by @scotwells in #27

New Contributors

• @OscarLlamas6 made their first contribution in #28

Full Changelog: v0.1.0...v0.2.0

v0.1.0 - Deploy Workloads

What's Changed

• Initialize project with kubebuilder init. by @joshlreese in #1
• Initial commit of Datum Compute APIs. by @joshlreese in #2
• Initial implementation of workload placement controller, scheduler, and workload validation by @joshlreese in #3
• Wire in CityCodes from ClusterProfiles during workload validation. by @joshlreese in #4
• Merge POC branch into main by @joshlreese in #5
• Bump golang.org/x/crypto from 0.28.0 to 0.31.0 in the go_modules group across 1 directory by @dependabot in #7
• Add labels to WorkloadDeployment and Instance resources to support filtering. by @joshlreese in #9
• Configure Renovate by @renovate in #6
• chore: automate software builds by @scotwells in #11
• fix(deps): update module sigs.k8s.io/gateway-api to v1.2.1 by @renovate in #12
• bug: Wire through annotations and labels from the desired deployment by @joshlreese in #23

New Contributors

• @joshlreese made their first contribution in #1
• @dependabot made their first contribution in #7
• @renovate made their first contribution in #6
• @scotwells made their first contribution in #11

Full Changelog: https://github.com/datum-cloud/workload-operator/commits/v0.1.0