Skip to content

Changelog

All notable changes to this project are documented below. This project uses Semantic Versioning and Conventional Commits. This page is generated from the repository CHANGELOG.md.

All notable changes to the Fleet Management Operator will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

1.0.1 (2026-08-10)

Bug Fixes

  • chart: stop wearing Grafana's logo, and point home at the docs (fa537a1)
  • ci: restore package-name so the pending release PR is still recognised (7f084c3)
  • ci: tag releases v1.0.0, not fleet-management-operator-v1.0.0 (b80f64d)
  • deps: refresh all Go dependencies in one pass (#56) (9cb8b52)
  • renovate: add gomodTidy to postUpdateOptions (0d5dee4)

1.0.0 (2026-08-10)

Features

  • 01-01: enhance FleetAPIError with PipelineID, IsTransient, and Unwrap (d0311d6)
  • 02-01: add error classification helpers for controller (810d123)
  • 03-01: add formatConditionMessage, loggerFor helpers and condition transition logging (70ffa77)
  • 04-01: add K8s manifests for mock API and E2E test fixtures (2d970c0)
  • 04-01: create mock Fleet Management API server (bbd89f1)
  • 04-02: deploy mock API in E2E suite before controller (36f6326)
  • 04-03: add GitHub Actions E2E workflow (5b6c182)
  • add Collector / RemoteAttributePolicy / ExternalAttributeSync management (3cf0961)
  • add CollectorDiscovery auto-mirror controller (e312be7)
  • add PipelineDiscovery CRD to import existing Fleet pipelines as Pipeline CRs (a0b329a)
  • add TenantPolicy CRD with opt-in K8s RBAC tenancy enforcement (963d836)
  • api,tenant: Batch C — tenant policy correctness, plus D9 webhook markers (669ef67)
  • api: add CEL structural validation rules and matcher cap documentation (bd2c33a)
  • api: add CollectorStatus observed fields (76ea46c)
  • api: add SourceTypeGrafana enum value (c09090a)
  • api: add TenantPolicyStatus subresource and status reconciler (544cceb)
  • api: declare Collector.spec.id immutability via CEL schema rule (7ec6fa3)
  • api: mark namespaced CRDs as scope=Namespaced (5e84845)
  • chart: add webhook Service+VWC, PrometheusRule, Grafana dashboard templates (WH-01,02,DOC-01,02) (f0ab707)
  • controller: add read-only reconcile path for pipelines (49f2b87)
  • controller: mirror collector Fleet fields into status (4f4f4b7)
  • controllers: add per-controller MaxConcurrentReconciles (PERF-04, PERF-03) (d9ba8ef)
  • controllers: per-target rate limiter on ExternalAttributeSync (E19) (6bd5351)
  • crd,ci: add Grafana source type, collector observed fields, and read-only pipeline support (e8d5ab8)
  • discovery: set read-only annotation instead of spec.paused (e1b7181)
  • docgen: add hack/docgen tool for auto-generating docs (74baa2a)
  • fleetclient: add GetPipeline and Grafana source mapping (637a1ed)
  • fleetclient: make rate-limiter rate and burst configurable (2e8aaf5)
  • helm: expose fleet-api-rps and fleet-api-burst as Helm values (7124397)
  • mint release-please token from the OpenBao broker (11a4328)
  • mockapi: implement GetPipeline on mock server (9a47c06)
  • mockapi: rewrite using connect-go proto handlers (a4945a0)
  • obs: add Fleet API request metrics and rate-limiter wait histogram (OBS-01, OBS-02) (66c177b)
  • obs: merge sync-age histogram, owned-key and discovery-list gauges (OBS-03, OBS-04, OBS-05) (4212caa)
  • obs: OpenTelemetry tracing for Fleet API calls, noop by default (OBS-07) (8cab61e)
  • obs: OpenTelemetry tracing for Fleet API calls, noop by default (OBS-07) (efeb46e)
  • obs: reconcile-outcome counters; fix event emission gaps (OBS-06, OBS-08) (31cb4a2)
  • obs: sync-age histogram; owned-key and discovery-list-size gauges (OBS-03, OBS-04, OBS-05) (e33b588)
  • pipeline: opt-in namespace-scoped Fleet naming with safe auto-migration (#8) (#14) (7439ae4)
  • rbac,docs: opt-in user roles + security trust-model doc (WS1) (bf9bd89)
  • samples: add description comments to sample CRs (eb17a27)
  • security: label-scopeable Secret cache + optional cluster-wide secret drop (WS3) (13a92b3)
  • security: SSRF dial-time hardening for EAS HTTP source (WS2) (82a993d)
  • security: SubjectAccessReview + TenantPolicy coverage for discovery CRDs (WS4) (fcbd631)
  • webhook: validate Pipeline spec.name (#8, Phase 1) (#11) (6b89fda)
  • webhook: validate source type and Grafana read-only rule (080730b)
  • wire TenantPolicy enforcement into manager, webhooks, and Helm (5ba4566)

Bug Fixes

  • 01-01: handle io.ReadAll errors in client HTTP response handling (a25776d)
  • 02-01: preserve original error in updateStatusError and prevent 404 recursion (71fbafd)
  • 02: revise plan 02-01 based on checker feedback (20b98c5)
  • add safe event emission helpers to prevent nil pointer dereference in tests (0968f5a)
  • api: add RemoteAttributePolicy.status.matchedCount and fix printer column (01237cf)
  • api: harden custom resource validation (03659c5)
  • chart,docs: Chart.yaml metadata, CHANGELOG template, install troubleshooting (HELM-10, DOC-06,07, SEC-03) (71c61f6)
  • chart: Batch A — install-blocking helm-chart defects (4f50569)
  • chart: close edge-case install bugs surfaced by the parallel audit (51ef7f7)
  • chart: consolidate duplicate webhook sections in values.yaml (55f6e28)
  • ci: give release-please a packages block so it can cut a release (c7faf2c)
  • ci: stop the release PR failing its own chart-docs check (e39ab38)
  • ci: unblock codegen deepcopy generation + clear pre-existing lint (#13) (a4ba44a)
  • cmd: lowercase Fleet URL error messages (518fcb0)
  • controller: harden Pipeline deletion against read-only and forged-ID deletes (#4) (b610cfe)
  • controller: improve reconcile safety (c65b053)
  • controllers: Batch B — silent correctness regressions in PERF-03 and no-op short-circuits (82dae03)
  • deploy: harden operator packaging (1950191)
  • docs: make the generators emit what the docs site needs (2b54038)
  • docs: shorten the invalid-samples link past the 120-char lll limit (f5d1374)
  • fleetclient: OTel semconv keys; rate-limit wait observed on cancel (55c2252)
  • helm: memory limits, metrics security, logging, security defaults, chart polish (HELM-01..13, SEC-02..04) (c6ddaa1)
  • helm: wire all new deployment flags and declare container ports (HELM-02,03,04,06,09) (238d29d)
  • helm: wire leader-election lease flags; production log defaults (HELM-02, HELM-06, UPG-02) (e9ee9b8)
  • main: TenantPolicy webhook always-on; OTEL resource error logged; drop unused metrics cert flags (380ddc4)
  • obs,main: Batch D — OTEL footguns, fleet client interceptors, manager lifecycle (cc5f10a)
  • sec: pin Dockerfile base to digest; add image.digest Helm value (SEC-01) (885570b)
  • sec: pin Dockerfile base to digest; add image.digest Helm value (SEC-01) (716c15c)
  • security: register RemoteAttributePolicy webhook when collector controller is enabled (#7) (6fef595)
  • sources: SQL connection leak; sanitize URL credentials in error messages (8727e6d)
  • test: enable race detector in test target (TEST-01) (e7a1e4a)
  • upg: Hub conversion markers; change-class policy table in versioning doc (UPG-01, UPG-06) (614eb96)
  • upg: Hub conversion markers; change-class policy table in versioning doc (UPG-01, UPG-06) (2fca785)
  • webhook port as Helm value + startup cert validation; HTTP conn pool close (WH-04, UPG-03) (4b54bf0)
  • webhook port as Helm value + startup cert validation; HTTP conn pool close (WH-04, UPG-03) (542a48c)
  • webhook: set timeoutSeconds: 5 on all webhook entries (WH-02) (51de5f1)
  • webhook: validate the incoming object, not the empty receiver (Collector, CollectorDiscovery) (4edeca3)

Performance Improvements

  • selective Collector watch handler via matcher-key IndexField (PERF-03) (a56ae7e)
  • selective Collector watch handler via matcher-key IndexField (PERF-03) (065e546)
  • status: cap CollectorDiscovery.status.conflicts at 100 (PERF-06) (75a3dbe)
  • status: cap ExternalAttributeSync.ownedKeys at 1000, add no-op short-circuit (PERF-01) (c801c66)
  • status: cap RemoteAttributePolicy.matchedCollectorIDs at 1000 (PERF-01) (62cf4a3)

Unreleased

Added

  • TenantPolicy CRD with opt-in Kubernetes RBAC tenancy enforcement, plus its status reconciler (Ready / Valid conditions, boundSubjectCount).
  • Collector, RemoteAttributePolicy, ExternalAttributeSync, and CollectorDiscovery CRDs, controllers, and admission webhooks (all default-off; opt in per controller).
  • External source plugins for ExternalAttributeSync: HTTP (bearer / basic auth) and SQL (postgres via lib/pq, mysql via go-sql-driver/mysql). Both kinds ship in this release; the factory in cmd/main.go dispatches on spec.source.kind.
  • CEL-based structural validation on CRD schemas: Collector.spec.id immutability, matcher caps, configType-vs-contents constraints.
  • API versioning and graduation policy doc, plus a cross-CRD condition type/reason registry.
  • Helm chart templates: webhook Service, ValidatingWebhookConfiguration, cert-manager Certificate, PodDisruptionBudget, ServiceMonitor, PrometheusRule with operator alerts, and an embedded Grafana dashboard ConfigMap (DOC-01/02, WH-01/02).
  • Operator metrics: Fleet API request counters and rate-limiter wait histogram (OBS-01/02); reconcile-outcome counters (OBS-06); sync-age histogram, owned-key gauge, discovery-list-size gauge (OBS-03/04/05); OpenTelemetry tracing for Fleet API calls, noop by default (OBS-07).
  • Per-target rate limiter for ExternalAttributeSync sources (E19): two syncs pointing at the same upstream (HTTP host or SQL secret) share a token bucket via --controller-sync-target-rate and --controller-sync-target-burst. Default off.
  • Per-controller MaxConcurrentReconciles (policy=4, sync=4, discovery=1) with --controller-{policy,sync,discovery}-max-concurrent flags and matching Helm values (PERF-04). Pipeline and Collector remain at 1 by design.
  • Selective Collector watch handler indexed by matcher key (PERF-03): policy changes now wake only the matching Collectors instead of every Collector.
  • Helm chart values exposing fleetManagement.apiRatePerSecond and fleetManagement.apiBurst (configurable Fleet API rate limit / burst).
  • Helm chart values exposing image.digest, webhook.port, leader-election lease tunables, and probe / security tunables (HELM-02/03/04/06/09).
  • Production-readiness audit scorecard (docs/superpowers/audits/) and full troubleshooting guide / per-alert runbooks / webhook setup guide (DOC-03/04/05).
  • Sample manifests: annotated invalid-CR examples for onboarding.
  • Renovate configuration for dependency updates.
  • Auto-generated chart README via helm-docs (make chart-docs, make chart-docs-check).

Changed

  • Memory defaults raised to limits=2Gi / requests=512Mi (HELM-01); 128Mi default was insufficient at 30k-Collector informer-cache footprint and would OOMKill. Sizing matrix in values.yaml.
  • Liveness probe initialDelaySeconds raised so pods are not killed during initial cache warm-up at 30k CRs (HELM-08).
  • Production logging defaults: structured JSON output, info level (Development: false).
  • Fleet API HTTP client now closes its connection pool on shutdown (UPG-03); webhook port is a Helm value with startup cert validation (WH-04).
  • Webhook entries set timeoutSeconds: 5 (WH-02).
  • RemoteAttributePolicy.status.matchedCollectorIDs capped at 1000 with matchedCount field (PERF-01); ExternalAttributeSync.status.ownedKeys capped at 1000 with no-op short-circuit; CollectorDiscovery.status.conflicts capped at 100 (PERF-06).
  • CLAUDE.md: documented REC reconciler invariants, per-target sync rate limiter, per-controller event reasons, and updated SQL plugin to "currently shipped" (was Phase-3-only stub).

Fixed

  • Validating webhooks for Collector and CollectorDiscovery now validate the incoming obj, not the empty receiver. Previously, the framework's empty *Collector{} / *CollectorDiscovery{} receiver was being validated, so every admission request trivially passed (WH-05 follow-up).
  • PERF-03 silent correctness regressions and no-op short-circuit gaps fixed (Batch B).
  • TenantPolicy correctness, including D9 webhook markers (Batch C).
  • Install-blocking Helm chart defects (Batch A): consolidated duplicate webhook sections, fixed RBAC/template inconsistencies.
  • Fleet client interceptor / manager lifecycle / OTEL footguns (Batch D).
  • Conflict-policy reconcile path now treats ctrl.Result.Requeue=true from status-conflict as cache lag (no error, no exponential backoff).
  • 404 from Fleet API on Pipeline / Collector deletion is treated as success.
  • Helm chart: leader-election lease flags wired; production log defaults applied; container ports declared on Deployment; metrics endpoint properly bound (HELM-02/04/06).
  • Chart README: regenerated from values.yaml (helm-docs); previous manual table claimed limits.memory: 128Mi, drift since HELM-01 fix.
  • Documentation: deployment / Secret / webhook-Service names now match the actual chart-rendered names; memory-limit references updated to reflect the 2Gi default.
  • Test: graceful-shutdown test now drives a real PipelineReconciler to verify context propagation through the full reconciler → client → interceptor chain (E1, replaces tautological stub).
  • Lint: make lint from 44 issues to 0 (modernize/prealloc/errcheck/unused cleanups; no behaviour change).

Security

  • Container image base pinned to digest; added image.digest Helm value (SEC-01).
  • Pod and container security context hardened: non-root, read-only root FS, dropped capabilities, restricted seccomp profile (SEC-02/03/04).
  • Race detector enabled in make test target (TEST-01).

Upgrade Notes

  • Helm value renames: fleet-management-credentials Secret is now <release>-credentials (default fleet-management-operator-credentials). Existing self-managed Secrets continue to work via fleetManagement.existingSecret.name.
  • Webhook Service is now <release>-webhook (was <release>-webhook-service).
  • New CRDs (Collector, RemoteAttributePolicy, ExternalAttributeSync, CollectorDiscovery, TenantPolicy) install with the chart; controllers remain disabled until you set controllers.<name>.enabled: true.
  • controllers.collectorDiscovery.enabled: true requires controllers.collector.enabled: true; the manager refuses to start otherwise.

0.1.0 - YYYY-MM-DD

Added

  • Initial release of Fleet Management Operator
  • Pipeline CRD for managing Fleet Management pipelines
  • Support for Alloy and OpenTelemetry Collector configurations
  • Multi-architecture Docker images (linux/amd64, linux/arm64)
  • Helm chart for easy deployment
  • Source tracking (Git, Terraform, Kubernetes)
  • Finalizer support for proper cleanup
  • Status conditions following Kubernetes conventions
  • Metrics endpoint on port 8080
  • Leader election for high availability