From 35ebc247d1be632ca32f7c451bd13e89973ebdda Mon Sep 17 00:00:00 2001 From: Luke Bond Date: Wed, 15 Apr 2026 21:38:30 +0100 Subject: [PATCH] chore: bump to v2.5.0 --- Cargo.lock | 2 +- Cargo.toml | 2 +- charts/restate-operator-helm/Chart.yaml | 2 +- .../45-pod-annotations-and-labels.md | 37 ------ .../unreleased/fix-canary-image-ca-bundle.md | 40 ------ release-notes/v2.5.0.md | 125 ++++++++++++++++++ 6 files changed, 128 insertions(+), 80 deletions(-) delete mode 100644 release-notes/unreleased/45-pod-annotations-and-labels.md delete mode 100644 release-notes/unreleased/fix-canary-image-ca-bundle.md create mode 100644 release-notes/v2.5.0.md diff --git a/Cargo.lock b/Cargo.lock index 5196beb..1b72032 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2353,7 +2353,7 @@ dependencies = [ [[package]] name = "restate-operator" -version = "2.4.0" +version = "2.5.0" dependencies = [ "actix-web", "anyhow", diff --git a/Cargo.toml b/Cargo.toml index 0be7994..38e84c1 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "restate-operator" -version = "2.4.0" +version = "2.5.0" authors = ["restate.dev"] edition = "2024" rust-version = "1.92" diff --git a/charts/restate-operator-helm/Chart.yaml b/charts/restate-operator-helm/Chart.yaml index a15f300..8fabd8b 100644 --- a/charts/restate-operator-helm/Chart.yaml +++ b/charts/restate-operator-helm/Chart.yaml @@ -2,4 +2,4 @@ apiVersion: v2 name: restate-operator-helm description: An operator for Restate clusters type: application -version: "2.4.0" +version: "2.5.0" diff --git a/release-notes/unreleased/45-pod-annotations-and-labels.md b/release-notes/unreleased/45-pod-annotations-and-labels.md deleted file mode 100644 index e788c66..0000000 --- a/release-notes/unreleased/45-pod-annotations-and-labels.md +++ /dev/null @@ -1,37 +0,0 @@ -# Release Notes for Issue #45: Add support for custom pod annotations and labels - -## New Feature - -### What Changed -Added `spec.compute.annotations` and `spec.compute.labels` fields to the -RestateCluster CRD, allowing users to set custom annotations and labels on the -Restate StatefulSet pod template. - -User-specified annotations and labels are merged with any that the operator sets -internally (e.g. for workload identity, trusted CA certs). In case of conflict, -operator-managed values take precedence. - -### Why This Matters -Enables integrations that require pod-level metadata, such as GKE ComputeClass -scheduling (`cloud.google.com/compute-class`), Vault agent injection, Datadog, -Prometheus scraping, and custom scheduling constraints. - -### Impact on Users -- Existing deployments: No impact, both fields are optional -- New deployments: Can now set annotations and labels for integrations that - require them on the pod template - -### Migration Guidance -No migration required. To use the new fields: - -```yaml -spec: - compute: - annotations: - cloud.google.com/compute-class: "restate-workload" - labels: - team: "platform" -``` - -### Related Issues -- Issue #45: Add support for custom annotations on StatefulSet diff --git a/release-notes/unreleased/fix-canary-image-ca-bundle.md b/release-notes/unreleased/fix-canary-image-ca-bundle.md deleted file mode 100644 index 3da35b0..0000000 --- a/release-notes/unreleased/fix-canary-image-ca-bundle.md +++ /dev/null @@ -1,40 +0,0 @@ -# Release Notes: Fix canary image missing CA bundle - -## Bug Fix - -### What Changed -The default `canaryImage` has been changed from `busybox:uclibc` to `alpine:3.21`. - -### Why This Matters -The `trustedCaCerts` feature uses an init container (the canary image) to concatenate -system CA certificates with custom trusted CAs. The init container reads the system CA -bundle from `/etc/ssl/certs/ca-certificates.crt`, but `busybox:uclibc` does not ship a -CA bundle at that path, causing the init container to fail with: - -``` -cat: can't open '/etc/ssl/certs/ca-certificates.crt': No such file or directory -``` - -This made `trustedCaCerts` non-functional with the default canary image. - -### Impact on Users -- **Existing deployments using `trustedCaCerts`**: Will work after upgrading. If you - previously worked around this by setting `canaryImage` to an image with a CA bundle, - you can remove that override. -- **Existing deployments not using `trustedCaCerts`**: No impact. The canary image is - also used for Pod Identity and Workload Identity canary jobs, which do not depend on - the CA bundle and will continue to work with `alpine:3.21`. -- **Custom `canaryImage` overrides**: If you use a custom canary image, ensure it - includes a CA bundle at `/etc/ssl/certs/ca-certificates.crt` if you plan to use - `trustedCaCerts`. - -### Migration Guidance -No action required. The default will change automatically on upgrade. - -If you override `canaryImage` in your Helm values and want to use `trustedCaCerts`, -ensure your image includes a CA certificate bundle: - -```yaml -# Image must have /etc/ssl/certs/ca-certificates.crt and provide cat, grep, wget -canaryImage: my-registry.example.com/alpine:3.21 -``` diff --git a/release-notes/v2.5.0.md b/release-notes/v2.5.0.md new file mode 100644 index 0000000..a081cb9 --- /dev/null +++ b/release-notes/v2.5.0.md @@ -0,0 +1,125 @@ +# Restate Operator v2.5.0 Release Notes + +## Highlights + +- **Custom pod annotations and labels** — RestateCluster now supports `spec.compute.annotations` and `spec.compute.labels`, enabling integrations that require pod-level metadata (GKE ComputeClass, Vault agent injection, Prometheus scraping, etc.). +- **Default canary image changed to `alpine:3.21`** — Fixes `trustedCaCerts` (introduced in v2.4.0), which required a CA bundle that the previous `busybox:uclibc` default did not ship. +- **Default tunnel client image bumped to `0.6.0`** — Picks up the latest restate-cloud-tunnel-client release for new RestateCloudEnvironment deployments. + +## New Features + +### Custom pod annotations and labels + +Added `spec.compute.annotations` and `spec.compute.labels` to the RestateCluster +CRD. Both fields are propagated to the Restate StatefulSet pod template. + +User-specified annotations and labels are merged with any the operator sets +internally (e.g. for Workload Identity, trusted CA certs). In case of conflict, +operator-managed values take precedence. + +This unblocks integrations that rely on pod-level metadata, including GKE +ComputeClass scheduling (`cloud.google.com/compute-class`), Vault agent +injection, Datadog, Prometheus scraping, and custom scheduling constraints. + +**Impact on Users:** +- Existing deployments: No impact, both fields are optional. +- New deployments: Can now set annotations and labels for integrations that + require them on the pod template. + +**Usage:** + +```yaml +spec: + compute: + annotations: + cloud.google.com/compute-class: "restate-workload" + labels: + team: "platform" +``` + +*Related: Issue [#45](https://github.com/restatedev/restate-operator/issues/45), PR [#119](https://github.com/restatedev/restate-operator/pull/119)* + +--- + +## Bug Fixes + +### Default canary image now ships a CA bundle + +The default `canaryImage` has changed from `busybox:uclibc` to `alpine:3.21`. + +The `trustedCaCerts` feature added in v2.4.0 uses an init container (the canary +image) to concatenate system CA certificates with custom trusted CAs. The init +container reads the system CA bundle from `/etc/ssl/certs/ca-certificates.crt`, +but `busybox:uclibc` does not ship a CA bundle at that path, causing the init +container to fail with: + +``` +cat: can't open '/etc/ssl/certs/ca-certificates.crt': No such file or directory +``` + +This made `trustedCaCerts` non-functional with the default canary image. + +**Impact on Users:** +- **Existing deployments using `trustedCaCerts`**: Will work after upgrading. If + you previously worked around this by setting `canaryImage` to an image with a + CA bundle, you can remove that override. +- **Existing deployments not using `trustedCaCerts`**: No impact. The canary + image is also used for Pod Identity and Workload Identity canary jobs, which + do not depend on the CA bundle and will continue to work with `alpine:3.21`. +- **Custom `canaryImage` overrides**: If you use a custom canary image, ensure + it includes a CA bundle at `/etc/ssl/certs/ca-certificates.crt` if you plan to + use `trustedCaCerts`. + +**Migration Guidance:** +No action required. The default will change automatically on upgrade. + +If you override `canaryImage` in your Helm values and want to use +`trustedCaCerts`, ensure your image includes a CA certificate bundle: + +```yaml +# Image must have /etc/ssl/certs/ca-certificates.crt and provide cat, grep, wget +canaryImage: my-registry.example.com/alpine:3.21 +``` + +*Related: PR [#116](https://github.com/restatedev/restate-operator/pull/116)* + +--- + +## Improvements + +### Default tunnel client image bumped to 0.6.0 + +The default `tunnelClientDefaultImage` has been updated from +`ghcr.io/restatedev/restate-cloud-tunnel-client:0.5.0` to `0.6.0`. This applies +to new RestateCloudEnvironment deployments that don't explicitly override the +tunnel client image. + +**Impact on Users:** +- Existing deployments pinning their own tunnel client image: no impact. +- Deployments relying on the operator default: will pick up `0.6.0` on the next + reconcile after upgrade. + +Override via the `--tunnel-client-default-image` CLI flag or the +`OPERATOR_TUNNEL_CLIENT_DEFAULT_IMAGE` environment variable (settable through +the chart's generic `env` value) if you need to pin a specific version. + +*Related: PR [#118](https://github.com/restatedev/restate-operator/pull/118)* + +--- + +## Upgrading + +**CRD Update Required**: Helm does not automatically upgrade CRDs. After +upgrading the operator, you **must** manually apply the updated CRDs: + +```bash +kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.5.0/restateclusters.yaml +kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.5.0/restatedeployments.yaml +kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.5.0/restatecloudenvironments.yaml +``` + +Then upgrade the operator via Helm: + +```bash +helm upgrade restate-operator restatedev/restate-operator --version 2.5.0 +```