chore: bump to v2.5.0

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "restate-operator"
-version = "2.4.0"
+version = "2.5.0"
 authors = ["restate.dev"]
 edition = "2024"
 rust-version = "1.92"

charts/restate-operator-helm/Chart.yaml

@@ -2,4 +2,4 @@ apiVersion: v2
 name: restate-operator-helm
 description: An operator for Restate clusters
 type: application
-version: "2.4.0"
+version: "2.5.0"

release-notes/v2.5.0.md

@@ -0,0 +1,125 @@
+# Restate Operator v2.5.0 Release Notes
+
+## Highlights
+
+- **Custom pod annotations and labels** — RestateCluster now supports `spec.compute.annotations` and `spec.compute.labels`, enabling integrations that require pod-level metadata (GKE ComputeClass, Vault agent injection, Prometheus scraping, etc.).
+- **Default canary image changed to `alpine:3.21`** — Fixes `trustedCaCerts` (introduced in v2.4.0), which required a CA bundle that the previous `busybox:uclibc` default did not ship.
+- **Default tunnel client image bumped to `0.6.0`** — Picks up the latest restate-cloud-tunnel-client release for new RestateCloudEnvironment deployments.
+
+## New Features
+
+### Custom pod annotations and labels
+
+Added `spec.compute.annotations` and `spec.compute.labels` to the RestateCluster
+CRD. Both fields are propagated to the Restate StatefulSet pod template.
+
+User-specified annotations and labels are merged with any the operator sets
+internally (e.g. for Workload Identity, trusted CA certs). In case of conflict,
+operator-managed values take precedence.
+
+This unblocks integrations that rely on pod-level metadata, including GKE
+ComputeClass scheduling (`cloud.google.com/compute-class`), Vault agent
+injection, Datadog, Prometheus scraping, and custom scheduling constraints.
+
+**Impact on Users:**
+- Existing deployments: No impact, both fields are optional.
+- New deployments: Can now set annotations and labels for integrations that
+  require them on the pod template.
+
+**Usage:**
+
+```yaml
+spec:
+  compute:
+    annotations:
+      cloud.google.com/compute-class: "restate-workload"
+    labels:
+      team: "platform"
+```
+
+*Related: Issue [#45](https://github.com/restatedev/restate-operator/issues/45), PR [#119](https://github.com/restatedev/restate-operator/pull/119)*
+
+---
+
+## Bug Fixes
+
+### Default canary image now ships a CA bundle
+
+The default `canaryImage` has changed from `busybox:uclibc` to `alpine:3.21`.
+
+The `trustedCaCerts` feature added in v2.4.0 uses an init container (the canary
+image) to concatenate system CA certificates with custom trusted CAs. The init
+container reads the system CA bundle from `/etc/ssl/certs/ca-certificates.crt`,
+but `busybox:uclibc` does not ship a CA bundle at that path, causing the init
+container to fail with:
+
+```
+cat: can't open '/etc/ssl/certs/ca-certificates.crt': No such file or directory
+```
+
+This made `trustedCaCerts` non-functional with the default canary image.
+
+**Impact on Users:**
+- **Existing deployments using `trustedCaCerts`**: Will work after upgrading. If
+  you previously worked around this by setting `canaryImage` to an image with a
+  CA bundle, you can remove that override.
+- **Existing deployments not using `trustedCaCerts`**: No impact. The canary
+  image is also used for Pod Identity and Workload Identity canary jobs, which
+  do not depend on the CA bundle and will continue to work with `alpine:3.21`.
+- **Custom `canaryImage` overrides**: If you use a custom canary image, ensure
+  it includes a CA bundle at `/etc/ssl/certs/ca-certificates.crt` if you plan to
+  use `trustedCaCerts`.
+
+**Migration Guidance:**
+No action required. The default will change automatically on upgrade.
+
+If you override `canaryImage` in your Helm values and want to use
+`trustedCaCerts`, ensure your image includes a CA certificate bundle:
+
+```yaml
+# Image must have /etc/ssl/certs/ca-certificates.crt and provide cat, grep, wget
+canaryImage: my-registry.example.com/alpine:3.21
+```
+
+*Related: PR [#116](https://github.com/restatedev/restate-operator/pull/116)*
+
+---
+
+## Improvements
+
+### Default tunnel client image bumped to 0.6.0
+
+The default `tunnelClientDefaultImage` has been updated from
+`ghcr.io/restatedev/restate-cloud-tunnel-client:0.5.0` to `0.6.0`. This applies
+to new RestateCloudEnvironment deployments that don't explicitly override the
+tunnel client image.
+
+**Impact on Users:**
+- Existing deployments pinning their own tunnel client image: no impact.
+- Deployments relying on the operator default: will pick up `0.6.0` on the next
+  reconcile after upgrade.
+
+Override via the `--tunnel-client-default-image` CLI flag or the
+`OPERATOR_TUNNEL_CLIENT_DEFAULT_IMAGE` environment variable (settable through
+the chart's generic `env` value) if you need to pin a specific version.
+
+*Related: PR [#118](https://github.com/restatedev/restate-operator/pull/118)*
+
+---
+
+## Upgrading
+
+**CRD Update Required**: Helm does not automatically upgrade CRDs. After
+upgrading the operator, you **must** manually apply the updated CRDs:
+
+```bash
+kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.5.0/restateclusters.yaml
+kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.5.0/restatedeployments.yaml
+kubectl apply --server-side -f https://github.com/restatedev/restate-operator/releases/download/v2.5.0/restatecloudenvironments.yaml
+```
+
+Then upgrade the operator via Helm:
+
+```bash
+helm upgrade restate-operator restatedev/restate-operator --version 2.5.0
+```