Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

4.9.0 (2025-08-06)

Features

• default platform storage class (#2376) (2f661f9)

Bug Fixes

• prometheus-operator storageclass (#2410) (6c08492)

4.8.0 (2025-07-31)

Features

• add Prometheus monitoring configuration for database resources (#2317) (1ede9d0)
• add support for deleting Tekton-managed pods and enhance Istio … (#2287) (41560c1)
• adding harbor ORCS support (#2385) (97eca95)
• adding knative ORCS support (#2357) (23d46e0)
• adding KnativeServing CR ORCS support (#2260) (9871159)
• adding ORCS support for tekton tasks (#2387) (74ed32d)
• apl-operator clean error messages (#2290) (3b53e6b)
• enabling ORCS by default (#2337) (afde740)
• making linode provider an ORCS dependency (#2380) (cb7d265)
• nickname as username for gitea (#2303) (d39d9ac)
• reverting ORCS migration for upgraded clusters (#2381) (1ac4b86)
• set custom repository and use selectors on argocd applications (#2286) (8f0cc6b)
• updating tekton registry (#2339) (a2b1488)

Bug Fixes

• enhance commit and push operations with quiet mode and error han… (#2304) (8107c42)
• net-istio-webhook image override (#2382) (b28798e)
• reattempt on first installation failure (#2310) (59a513d)
• remove version tag of Keycloak (#2319) (76d6e25)
• rendering keycloak release (#2390) (88ffe4b)
• set database connections to 32 for Gitea, Harbor and KC (#2311) (47173b2)
• specify branch in git pull to ensure correct updates from origin (#2301) (a43a164)
• typo for kyverno prometheus label (#2309) (ebdfbff)
• update home url for the apl chart (#2347) (2e3d389)
• velero linode plugin image (#2345) (b0f56ca)

Code Refactoring

• remove deprecated otomi-pipelines references (#2312) (b9e7de0)

CI

• add CloudFirewall rule for prometheus-node-exporter (#2324) (f1eed4e)
• adding ORCS support to the apl installer job and dev github action (#2379) (94c63d8)
• oauth2-proxy chart source (#2285) (b9f555f)
• pin commit hash in ArgoCD target revision (#2307) (fde66ba)
• workflow_dispatch with useORCS set tu true (#2300) (01c2955)

Others

• chart-deps: upgrade oauth2 proxy to 7.12.18 and fix session interruption (#2288) (8ff04ae)
• deps: bump @apidevtools/json-schema-ref-parser from 13.0.1 to 14.0.2 (#2295) (3b6e68a)
• deps: bump dotenv from 16.5.0 to 17.0.0 (#2296) (fd6610c)
• deps: bump jest and @types/jest (#2297) (cdf27bd)
• deps: bump ncipollo/release-action from 1.16.0 to 1.18.0 in the github-actions-dependencies group (#2294) (2a724b4)
• deps: bump the npm-dependencies group with 12 updates (#2318) (6760d28)
• deps: bump the npm-dependencies group with 8 updates (#2293) (9ab1317)
• deps: bump the npm-dependencies group with 9 updates (#2343) (2dfd8c0)
• post release changelog v4.7.0 (#2289) (64defcc)
• update helm version to 3.18.4 (#2338) (7431a3e)
• update readme image (#2302) (56d54a5)

4.7.0 (2025-06-26)

Features

• add argocd prometheus rules (#2262) (822cc2b)
• add ensure git ops directories to apply-as-apps (#2211) (a033abb)
• add post-install cleanup job (#2207) (84fd5ab)
• APL-672 adding ORCS support (#2203) (57b802d)
• compatibility k8s version v1.33 (#2107) (29c92ce)
• deploy manifest using apl-operator instead of using Tekton (#2151) (bb1623d)
• detect and restart pods with old istio-proxy version (#2232) (373408f)
• implement restart functionality for otomi-api deployment (#2272) (ed2b8a7)
• optimize the order of deploying manifests during the initial installation (#2250) (109943a)
• replace clusterrole for secrets with namespaced role and removed ingress update clusterrole (#2163) (bc22632)
• upgrade Gitea to recent release (#2085) (8267993)
• upgrade k8s/client-node and node 22 (#2204) (b09b0f3)
• upgrade Keycloak to recent release and deprovision operator (#2078) (9e84b9f)

Bug Fixes

• actually check for difference between files (#2164) (eaf03aa)
• add default values to apl-operator (#2251) (67c3dd2)
• added v1.33 to the supportedK8sVersions.json file (#2159) (b6e761f)
• adjust Gitea backup service account (#2187) (18dc630)
• always deploy tekton and apl related namespaces (#2284) (2058097)
• annotate Gitea volume (#2158) (3c2dc50)
• APL-851 knative service url rendering (#2214) (c0d37e6)
• barman compatibility with non-aws object storage (#2221) (98e5ed7)
• create gitea-db-secret before database exists (#2279) (b4ae09d)
• create initial credential secret before the message shows up (#2226) (5650905)
• handle error when retrieving git log for empty repository (#2257) (b497184)
• include ingress-nginx apps in values (#2132) (6141f21)
• incompatibility between helm and helm-secrets (#2215) (d5df084)
• knative-operator templating (#2236) (826a394)
• only run coverage report on changes in src (#2202) (1e6cad4)
• perform cleanup after installation within job (#2235) (658254e)
• pre-upgrade script, username, and installation order for Keycloak (#2128) (219a594)
• prerelease versions in upgrade check (#2246) (54fe687)
• prerelease versions in upgrade check (#2248) (ccb22b7)
• quote sensitive values in Helm templates (#2150) (214bd5d)
• removed apl docs links from apps (#2245) (c09c727)
• restart otomiApi deploy after 4.7.0 upgrade (#2280) (044a662)
• restore istiod configuration (#2177) (82f7af7)
• sealed secrets sample file (#2201) (78583dd)
• set default k8s version 1.32 (#2156) (d12707a)
• set default k8s version to 1.33 for gh workflows (#2220) (70a4a98)
• skip runtime upgrades during intial install and pre-release on same patch (#2278) (c360dac)
• small fixes in go templates (#2157) (9c818e8)
• status code evaluation from k8s client (#2225) (340f7b6)
• suppress output during cleanup of ClusterRoleBinding (#2252) (61bc164)
• team grafana password (#2168) (44e5238)
• tekton-triggers-webhook image (#2258) (a8f51d3)
• update apply state (#2231) (377ca60)
• update helmfile template version in migration script for apl-operator (#2261) (a465450)
• update istio proxy image tag for ORCS (#2281) (375054b)
• use single-instance cache for Gitea (#2208) (f6bdf74)

CI

• enhance dependabot configuration for auto-approval and grouping… (#2271) (6523159)
• install Cloud Firewall Controller for LKE cluster (#2137) (9111015)
• read gitea-credentials from cluster (#2171) (588a480)
• remove pre-commit hook (#2186) (30fa367)
• restart dev apl-operator after main branch update (#2178) (29fb155)
• update apps.yaml with charts (#2270) (e1bba4f)

Others

• add code owners (#2141) (2dd59af)
• added .editorconfig (#2209) (71de040)
• chart-deps: update harbor to version 1.17.1 (#2190) (270b467)
• chart-deps: update ingress-nginx to version 4.11.6 (#2165) (95156b3)
• chart-deps: Upgrade Kiali Operator (#2176) (8220f96)
• chart-deps: upgrade Knative Operator to 1.18.1 (#2181) (9ec688e)
• deps: bump actions/checkout from 3 to 4 (#2122) (7d9d239)
• deps: bump the npm-dependencies group with 18 updates (#2277) (2ee5d81)
• deps: update dependencies, replace ts-node with tsx, add new eslint file (#2125) (29e22ab)
• deps: upgrade argocd to v3.0.3 (#2175) (f782fcb)
• follow db default version of platform (#2197) (c924925)
• Helmfile v1 compatibility [TOOLS][MINOR] (#2136) (515ceca)
• set versions to main (#2127) (9c73f65)
• update SECURITY.md (f5d0464)
• update the displayed versions (#2152) (4bac5c5)
• update versions (71e8eca)
• Upgrade CloudnativePG Operator (#2183) (48369f4)
• upgrade Istio and deprovision istio operator (#2155) (b8a1c94)
• Upgrade Keycloak to latest release (#2174) (f5f68a0)
• Upgrade to Istio 1.26.1 (#2210) (2d978ee)
• v4.6.0 changelog anf package*.json update [ci skip] (#2182) (ca23641)

4.6.0 (2025-05-27)

Features

• compatibility k8s version v1.33 (#2107) (9bd46c9)
• upgrade Gitea to recent release (#2085) (8267993)
• upgrade Keycloak to recent release and deprovision operator (#2078) (9e84b9f)

Bug Fixes

• added v1.33 to the supportedK8sVersions.json file (#2159) (9809d45)
• annotate Gitea volume (#2158) (731e810)
• include ingress-nginx apps in values (#2132) (6141f21)
• pre-upgrade script, username, and installation order for Keycloak (#2128) (219a594)
• quote sensitive values in Helm templates (#2150) (214bd5d)

Others

• add code owners (#2141) (2dd59af)
• deps: bump actions/checkout from 3 to 4 (#2122) (7d9d239)
• deps: update dependencies, replace ts-node with tsx, add new eslint file (#2125) (29e22ab)
• set versions to main (#2127) (9c73f65)
• update the displayed versions (#2152) (4bac5c5)
• versions: updating apl projects versions (be18652)

4.5.0 (2025-05-06)

Features

• add argocd sync waves to ensure tasks and pipelines are created in the right order (#2117) (9ac4dcc)
• add gitea repo public url as env (#2034) (332fdcb)
• allow gitea-operator to list pods in Gitea namespace (#2106) (2062488)
• argocd to check repo every 15s (#2075) (81578f6)
• auto creation of webhooks in gitea for builds (#1971) (b5338af)
• CNPG recovery options (#1926) (98d8bfe)
• improve gitops compatibility by defining new file structure (#1930) (8e15923)
• new build page (#2026) (7bee88b)
• rely solely on metadata name (#2040) (0f89b2b)
• service page using new components (#1996) (f3b5745)
• split up team policies to single file (#2057) (33d68ff)
• static team settings page (#2024) (b6c66b1)
• switching to linode-block-storage as default for tekton builds (#2101) (776f3c4)
• update api and console versions (#2019) (793df47)
• updated ingress_nginx helm chart to v4.11.5 (#2011) (4d81a61)
• updated keycloak operator and gitea values (#2008) (ebda118)
• use internal service for traffic between apl-api and gitea (#2016) (775e307)

Bug Fixes

• 5xx errors (#2025) (85f474f)
• alert values (#2077) (053077b)
• always deploy ingress for team core apps (#2110) (5121cad)
• commit and push (#2066) (d358c38)
• correct values order (#2074) (d92a543)
• decrypt after updated structure encryption (#2082) (9be7903)
• dont run team-tasks on "ci_skip" commits (#2103) (8e129bd)
• ensure sealedsecrets and workloadValues directories exist (#2069) (ac1b191)
• get envDir path from the function argument (#2004) (8341059)
• log complete error of ajv validation (#2065) (1420a40)
• move operator rbac to chart (#2093) (790b99f)
• obtaining the apl version from values repo (#2003) (242a42e)
• only encrypt secret files if not encrypted (#2086) (920ef83)
• process resource quota as list (#2055) (3a344b4)
• pull before pushing to gitea in commitAndPush func (#2063) (96003c8)
• rabbitmq out of sync in argocd (#2018) (c4ed6dd)
• remove coverage annotations (#2050) (0eab891)
• remove resourcequota and limitrange limits (#2115) (73fdd55)
• render build git-credentials only if secretName specified (#2062) (ffdfa3e)
• replace username and password from git related logs (#2037) (94b056f)
• selfservice defaults (#2104) (5e60e9e)
• set resource limits to enforce resource defaults for containers (#2100) (41d316a)
• set team defaults (#2095) (6f7d447)
• team access to loki logs (#2116) (c39bc9b)
• team-ns build templates for git credentials (#2068) (8716f15)
• updated keycloak init container version rendering (#2108) (ce8f4f0)

Others

• chart-deps: update external-dns to version 8.7.8 (#2015) (3bb0b16)
• deps: bump @types/lodash from 4.17.13 to 4.17.16 (#2041) (3143105)
• deps: bump @types/retry from 0.12.2 to 0.12.5 (#1915) (f8aa45a)
• deps: bump debug and @types/debug (#1913) (a2a5b79)
• deps: bump ncipollo/release-action from 1.15.0 to 1.16.0 (#1972) (54b2960)
• deps: bump ts-node-dev from 1.1.8 to 2.0.0 (#1914) (7a586c1)
• set api version 4.1.1 (#2036) (e186417)
• update .env.sample (#2017) (22cc2f5)
• update api version (#2030) (a6254b2)
• update pull request template (#2046) (e58f39d)
• update task version (#2022) (7b3ce79)
• update versions (#2043) (fb4340f)

Tests

• add build fixtures (#2067) (c0f4765)

CI

• added automatic deployment to dev for commits to main (#2047) (a0a4623)
• added checkout step to deploy-to-dev job (#2048) (ea0722b)
• added pr-autoupdate job (#2053) (b731a85)
• added release candidate pipelines (#2076) (54d4727)
• fix compare.sh script (#2045) (b299c9f)
• fixed git config order (#2096) (4305ef1)
• path of workload values in installation profiles (#2028) (d8e3552)
• update manifest kind in fixtures (#2029) (830b5b2)
• update test fixtures (#2039) (5e1dc9c)
• updated github token to bot token (#2099) (4258f87)
• updated trigger_dev.sh clone directory (#2049) (aa419a9)
• updated workflow to use a PAT instead of the default GITHUB_TOKEN (#2088) (f098b49)
• using BOT_EMAIL and BOT_USERNAME variables (#2094) (b9bb9dc)
• using node 20 (#2092) (ed24a18)

4.4.0 (2025-03-14)

Features

• add coderepository schema & fixtures (#1945) (0382ee1)
• added semantic-release gh-actions (#1933) (8b379fa)
• added upgrade script for secrets (#1967) (86b8ae0)
• api endpoint (#1982) (24b45e9)
• Add self-service option for admins to add external helm charts to the catalog (#1979) (fb993e1)
• create service accounts for gitea organizations (#1929) (40a3d20)
• deploy sealed secrets from the values repo (#1924) (f70c855)
• update versions.yaml (#1989) (69224d6)

Bug Fixes

• check for helm secrets version and update it (#1927) (b74377c)
• checking if gitea is ready in git-clone tasks (#1936) (a3dfb4a)
• falco dashboard title (#1928) (d0fb19c)
• generate password with special characters (#1938) (f16ce6b)
• ignoreDifferences for apps created by team-admin (#1995) (80e260e)
• removed git error which can expose credentials (#1944) (4c00fa1)
• unique admin password for gitea (#1910) (a2f1349)
• unique admin password for gitea (#1940) (eea8299)
• workload with validatingwebhookcfg (#1942) (70d6aee)

Reverts

• fix - unique admin password for gitea (#1939) (7d8bf90)

CI

• add charts and alias (#1931) (57c74ec)
• added alias for rabbitmq operator (#1966) (c557cbf)
• added more linode types to the integration workflow (#1976) (2c6e084)
• update chart index and improve checks (#1963) (0ee8cd2)
• update chart references (#1937) (fea5c4c)
• update workflow to support k8s 1.32 and wait for kubeconfig (#1943) (ab7b631)

Others

• chart-deps: update cert-manager to version v1.17.1 (#1941) (e634d34)
• chart-deps: update harbor to version 1.16.2 (#1903) (af1a3a0)
• chart-deps: update rabbitmq-cluster-operator to version 3.20.1 (#1969) (d3f8a2f)
• deps: bump helm/chart-releaser-action from 1.6.0 to 1.7.0 (#1901) (d759673)
• deps: bump ncipollo/release-action from 1.14.0 to 1.15.0 (#1893) (abdee3d)
• tasks version to 3.7.0 (#1977) (cfa5608)
• updated api and console versions (#1999) (753e480)
• versions (#1970) (40ef843)

4.3.0 (2025-02-10)

Features

• add coverage to github ci (#1920) (232bb48)
• add support for Kubernetes 1.32 (#1894) (9b1e19c)
• added more charts to the chart-index (#1900) (061d372)
• updating teams defaults (#1909) (6dc29db)
• fix decrypt (#1922) (ea3badf)
• fix open redirect vulnerability (#1899) (f180cc9)
• increase Gitea timeout (#1921) (21a0691)
• lowering DBs cpu resources (#1891) (07ba2b9)

Bug Fixes

• added team networkpolicies to the team-ns values gotemplate (#1902) (51300a5)
• bootstrap team password (#1917) (b5ac229)
• encryption (#1919) (3773a29)
• package-lock (#1923) (4d488b7)
• team network policies (#1904) (9b5ee85)
• update message (#1889) (152dcd2)
• update session settings for Gitea (#1908) (0b639bb)
• use emptydir for Gitea backup volume on custom provider (#1898) (80ebd93)

Others

• chart-deps: update cert-manager to version v1.16.2 (#1874) (bfeb0a0)
• chart-deps: update cert-manager to version v1.16.3 (#1896) (7d78be9)
• chart-deps: update cloudnative-pg to version 0.23.0 (#1880) (84748ed)
• chart-deps: update harbor to version 1.16.1 (#1892) (75fc895)
• chart-deps: update promtail to version 6.16.6 (#1877) (bada051)
• chart-deps: update sealed-secrets to version 2.17.1 (#1897) (e3f074a)
• deps: bump actions/checkout from 3 to 4 (#1869) (ea9e397)
• deps: bump actions/setup-node from 3 to 4 (#1868) (d13e48c)
• deps: bump linode/apl-tools from v2.8.6 to v2.8.7 (#1870) (21dcaf9)
• update changelog (#1890) (2c0e39f)
• update console and api to latest release (#1932) (0fab990)
• update task version to 3.6.0 (#1895) (5e07fd0)
• update task version to 3.6.1 (#1916) (9e1b61f)
• updated trivy-operator helm chart registry (#1905) (6cb6017)

Full Changelog: https://github.com/linode/apl-core/compare/v4.8.0...v4.9.0