v1.9.0

Install with kubectl

kubectl apply --server-side -f https://github.com/authzed/spicedb-operator/releases/download/v1.9.0/bundle.yaml

Include or modify this release in your own kustomize bundle

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - https://github.com/authzed/spicedb-operator/config?ref=v1.9.0
images:
  - name: ghcr.io/authzed/spicedb-operator
    newTag: v1.9.0

Install with kustomizer

Release manifests can be found at oci://ghcr.io/authzed/spicedb-operator-manifests:v1.9.0 and can be installed or inspected with kustomizer:

kustomizer apply inventory spicedb-operator --artifact oci://ghcr.io/authzed/spicedb-operator-manifests:v1.9.0

Docker Images

This release's image is available at:

• authzed/spicedb-operator:v1.9.0
• quay.io/authzed/spicedb-operator:v1.9.0
• ghcr.io/authzed/spicedb-operator:v1.9.0

What's Changed

• Build from distroless/base:nonroot by @jawnsy in #242
• Bump alpine from 3.18.0 to 3.18.2 by @dependabot in #214
• fix discord link in CONTRIBUTING.md by @ecordell in #241
• move e2e into its own go module and remove the runtime dependency on controller-runtime by @ecordell in #243
• Add security context for SpiceDB Operator by @jawnsy in #238
• CONTRIBUTING: sync format, legal details by @jzelinskie in #244
• Add resource requests and limits to operator by @jawnsy in #248

New Contributors

• @jawnsy made their first contribution in #242

Full Changelog: v1.8.0...v1.9.0

v1.8.0

Highlights

⬆️ The update graph now includes SpiceDB v1.23.1
🤘 More metadata is now available in SpiceDB pods managed with the operator, including the pod name, labels, and annotations.
🛑 Error states from pods are now bubbled up onto the status block of the SpiceDBCluster

Install with kubectl

kubectl apply --server-side -f https://github.com/authzed/spicedb-operator/releases/download/v1.8.0/bundle.yaml

Include or modify this release in your own kustomize bundle

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - https://github.com/authzed/spicedb-operator/config?ref=v1.8.0
images:
  - name: ghcr.io/authzed/spicedb-operator
    newTag: v1.8.0

Install with kustomizer

Release manifests can be found at oci://ghcr.io/authzed/spicedb-operator-manifests:v1.8.0 and can be installed or inspected with kustomizer:

kustomizer apply inventory spicedb-operator --artifact oci://ghcr.io/authzed/spicedb-operator-manifests:v1.8.0

Docker Images

This release's image is available at:

• authzed/spicedb-operator:v1.8.0
• quay.io/authzed/spicedb-operator:v1.8.0
• ghcr.io/authzed/spicedb-operator:v1.8.0

What's Changed

• graph: add helpers for cloning channels and removing nodes by @ecordell in #213
• Set termination log path by default by @ecordell in #218
• Report the newest pod error in the status by @ecordell in #219
• Set SPICEDB_POD_NAME environment variable using the downward API by @bison in #220
• Support and test switching channels by @ecordell in #222
• update base image and gRPC health probe by @vroldanbet in #223
• Project labels and annotations into pod volumes by @ecordell in #221
• report errors even after an initial successful rollout by @ecordell in #224
• Fix array patching by @ecordell in #226
• fixes an array patching bug when there are multiple patches by @ecordell in #227
• remove migrating failed condition after a successful migration run by @ecordell in #228
• move tools into the magefile go module by @ecordell in #229
• add v1.23.1 to the update graph by @ecordell in #233

Full Changelog: v1.7.0...v1.8.0

v1.7.0

Highlights

• v1.22 is now available in the update graph
• Startup pod errors are now bubbled up and reported in a condition on the SpiceDBCluster status.

Install with kubectl

kubectl apply --server-side -f https://github.com/authzed/spicedb-operator/releases/download/v1.7.0/bundle.yaml

Include or modify this release in your own kustomize bundle

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - https://github.com/authzed/spicedb-operator/config?ref=v1.7.0
images:
  - name: ghcr.io/authzed/spicedb-operator
    newTag: v1.7.0

Install with kustomizer

Release manifests can be found at oci://ghcr.io/authzed/spicedb-operator-manifests:v1.7.0 and can be installed or inspected with kustomizer:

kustomizer apply inventory spicedb-operator --artifact oci://ghcr.io/authzed/spicedb-operator-manifests:v1.7.0

Docker Images

This release's image is available at:

• authzed/spicedb-operator:v1.7.0
• quay.io/authzed/spicedb-operator:v1.7.0
• ghcr.io/authzed/spicedb-operator:v1.7.0

What's Changed

• add a label to the graph update test by @ecordell in #204
• bump the spanner emulator to 1.5.4 by @ecordell in #205
• Set min connections low for tests by @ecordell in #206
• Set min connections low for tests by @ecordell in #207
• increase timeout when waiting for spicedb pods to be ready by @ecordell in #208
• Bump alpine from 3.17.3 to 3.18.0 by @dependabot in #209
• add v1.22 to the update graph by @ecordell in #211
• Report pod errors on the spicedbcluster status by @ecordell in #212

Full Changelog: v1.6.0...v1.7.0

v1.6.0

What's Changed

• chore: Fix documentation for ClusterStatus.CurrentVersion by @gauthamchandra in #193
• e2e: label database tests with their database by @ecordell in #192
• config/rbac: Add edit and view ClusterRoles for aggregation by @bison in #194
• Use stable name for SpiceDB containers by @bison in #196
• support patches with the old container name by @ecordell in #198
• Specify sets of edges with semver ranges; add 1.21.0 to the graph by @ecordell in #199

New Contributors

• @gauthamchandra made their first contribution in #193

Full Changelog: v1.5.0...v1.6.0

Install with kubectl

kubectl apply --server-side -f https://github.com/authzed/spicedb-operator/releases/download/v1.6.0/bundle.yaml

Include or modify this release in your own kustomize bundle

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - https://github.com/authzed/spicedb-operator/config?ref=v1.6.0
images:
  - name: ghcr.io/authzed/spicedb-operator
    newTag: v1.6.0

Install with kustomizer

Release manifests can be found at oci://ghcr.io/authzed/spicedb-operator-manifests:v1.6.0 and can be installed or inspected with kustomizer:

kustomizer apply inventory spicedb-operator --artifact oci://ghcr.io/authzed/spicedb-operator-manifests:v1.6.0

Docker Images

This release's image is available at:

• authzed/spicedb-operator:v1.6.0
• quay.io/authzed/spicedb-operator:v1.6.0
• ghcr.io/authzed/spicedb-operator:v1.6.0

v1.5.0

Highlights

Adds SpiceDB v1.19.1 to the update graph.

What's Changed

• e2e: add a "graph" label to update graph tests by @ecordell in #181
• Bump alpine from 3.17.2 to 3.17.3 by @dependabot in #175
• Bump k8s.io/cli-runtime from 0.26.2 to 0.26.3 by @dependabot in #179
• Bump k8s.io/kubectl from 0.26.2 to 0.26.3 by @dependabot in #177
• Bump k8s.io/component-base from 0.26.2 to 0.26.3 by @dependabot in #178
• allow passing extra config to graph tests by @ecordell in #183
• adds v1.19.1 by @vroldanbet in #191

Full Changelog: v1.4.0...v1.5.0

Install with kubectl

kubectl apply --server-side -f https://github.com/authzed/spicedb-operator/releases/download/v1.5.0/bundle.yaml

Include or modify this release in your own kustomize bundle

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - https://github.com/authzed/spicedb-operator/config?ref=v1.5.0
images:
  - name: ghcr.io/authzed/spicedb-operator
    newTag: v1.5.0

Install with kustomizer

Release manifests can be found at oci://ghcr.io/authzed/spicedb-operator-manifests:v1.5.0 and can be installed or inspected with kustomizer:

kustomizer apply inventory spicedb-operator --artifact oci://ghcr.io/authzed/spicedb-operator-manifests:v1.5.0

Docker Images

This release's image is available at:

• authzed/spicedb-operator:v1.5.0
• quay.io/authzed/spicedb-operator:v1.5.0
• ghcr.io/authzed/spicedb-operator:v1.5.0

v1.4.0

What's Changed

• add v1.18.0 to update graphs by @ecordell in #172
• Bump github.com/stretchr/testify from 1.8.0 to 1.8.2 by @dependabot in #167
• Bump k8s.io/kubectl from 0.26.0 to 0.26.2 by @dependabot in #166

Full Changelog: v1.3.0...v1.4.0

Install with kubectl

kubectl apply --server-side -f https://github.com/authzed/spicedb-operator/releases/download/v1.4.0/bundle.yaml

Include or modify this release in your own kustomize bundle

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - https://github.com/authzed/spicedb-operator/config?ref=v1.4.0
images:
  - name: ghcr.io/authzed/spicedb-operator
    newTag: v1.4.0

Install with kustomizer

Release manifests can be found at oci://ghcr.io/authzed/spicedb-operator-manifests:v1.4.0 and can be installed or inspected with kustomizer:

kustomizer apply inventory spicedb-operator --artifact oci://ghcr.io/authzed/spicedb-operator-manifests:v1.4.0

Docker Images

This release's image is available at:

• authzed/spicedb-operator:v1.4.0
• quay.io/authzed/spicedb-operator:v1.4.0
• ghcr.io/authzed/spicedb-operator:v1.4.0

v1.3.0

Highlights

• Use spec.config. dispatchEnabled to completely disable dispatch for a cluster
• v1.17.0 of SpiceDB is available in the built-in update graph

What's Changed

• add a flag for disabling dispatch by @ecordell in #161
• Add spicedb v1.17.0 to update graphs by @ecordell in #169
• Bump github.com/spf13/afero from 1.9.2 to 1.9.4 by @dependabot in #164
• Bump golang from 1.19-alpine3.16 to 1.20-alpine3.16 by @dependabot in #162

Full Changelog: v1.2.0...v1.3.0

Install with kubectl

kubectl apply --server-side -f https://github.com/authzed/spicedb-operator/releases/download/v1.3.0/bundle.yaml

Include or modify this release in your own kustomize bundle

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - https://github.com/authzed/spicedb-operator/config?ref=v1.3.0
images:
  - name: ghcr.io/authzed/spicedb-operator
    newTag: v1.3.0

Install with kustomizer

Release manifests can be found at oci://ghcr.io/authzed/spicedb-operator-manifests:v1.3.0 and can be installed or inspected with kustomizer:

kustomizer apply inventory spicedb-operator --artifact oci://ghcr.io/authzed/spicedb-operator-manifests:v1.3.0

Docker Images

This release's image is available at:

• authzed/spicedb-operator:v1.3.0
• quay.io/authzed/spicedb-operator:v1.3.0
• ghcr.io/authzed/spicedb-operator:v1.3.0

v1.2.0

Customize SpiceDB Deployments

This release of the spicedb-operator includes new features for customizing the way the operator deploys and manages SpiceDB clusters.

A new patches field is available on the SpiceDBCluster that allows flexible customization of the resources the operator creates with Strategic Merge Patch patches or with JSON6902 patch operations.

The status field of the SpiceDBCluster will indicate if there are issues applying patches to the generated resources.

Examples

Strategic Merge Patch:

apiVersion: authzed.com/v1alpha1
kind: SpiceDBCluster
metadata:
  name: dev
spec:
  config:
    datastoreEngine: memory
  secretName: dev-spicedb-config
  patches:
  - kind: Deployment
    patch:
      metadata:
        labels:
          added: via-patch 
      spec:
         template:
           metadata:
             labels: 
               added: pod-label-via-patch

Explicit JSON6902 Patch:

apiVersion: authzed.com/v1alpha1
kind: SpiceDBCluster
metadata:
  name: dev
spec:
  config:
    datastoreEngine: memory
  secretName: dev-spicedb-config
  patches:
  - kind: Deployment
    patch:
      op: add
      path: /metadata/labels
      value: 
        added: via-patch

You can specify multiple patches for the same object (later in the list are applied over top of earlier in the list):

apiVersion: authzed.com/v1alpha1
kind: SpiceDBCluster
metadata:
  name: dev
spec:
  config:
    datastoreEngine: memory
  secretName: dev-spicedb-config
  patches:
  - kind: Deployment
    patch:
      op: add
      path: /metadata/labels
      value:
        added: via-patch
  - kind: Deployment
    patch:
      metadata:
        labels:
          added-2: via-patch-2

Wildcard * can be used to apply a patch to all resources:

apiVersion: authzed.com/v1alpha1
kind: SpiceDBCluster
metadata:
  name: dev
spec:
  config:
    datastoreEngine: memory
  secretName: dev-spicedb-config
  patches:
  - kind: '*'
    patch:
      op: add
      path: /metadata/labels
      value:
        added: via-wildcard-patch

Memory Update Graph

Although the memory datastore has no need for migrations or automated updates, this release includes an update graph for the memory datastore. You can now use the memory datastore for testing with the same UX as the other datastores.

extraPodAnnotations and extraPodLabels now apply to the migration pods too

You could already add extra annotations and labels to SpiceDB pods, but now they can be added to migration jobs as well. Thanks to @thomasklein94 for the addition!

What's Changed

• Add v1.16.2 to update graphs by @ecordell in #144
• support merge_group event types in GHA by @ecordell in #149
• feat: add extraPodAnnotations on migrations jobs by @thomasklein94 in #147
• Allow clients to specify arbitrary overrides of operator-managed resources by @ecordell in #135
• Bump alpine from 3.17.0 to 3.17.2 by @dependabot in #148
• Bump github.com/spf13/cobra from 1.4.0 to 1.6.1 by @dependabot in #101
• Don't report telemetry from e2e test clusters by @ecordell in #153
• Add update graph for memory datastore by @ecordell in #152
• configurable graph files for tests by @ecordell in #154
• fix: multiple patches modifying arrays with pre-existing values by @ecordell in #156
• Respect StrategicMergePatch metadata when patching by @ecordell in #159

New Contributors

• @thomasklein94 made their first contribution in #147

Full Changelog: v1.1.2...v1.2.0

Install with kubectl

kubectl apply --server-side -f https://github.com/authzed/spicedb-operator/releases/download/v1.2.0/bundle.yaml

Include or modify this release in your own kustomize bundle

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - https://github.com/authzed/spicedb-operator/config?ref=v1.2.0
images:
  - name: ghcr.io/authzed/spicedb-operator
    newTag: v1.2.0

Install with kustomizer

Release manifests can be found at oci://ghcr.io/authzed/spicedb-operator-manifests:v1.2.0 and can be installed or inspected with kustomizer:

kustomizer apply inventory spicedb-operator --artifact oci://ghcr.io/authzed/spicedb-operator-manifests:v1.2.0

Docker Images

This release's image is available at:

• authzed/spicedb-operator:v1.2.0
• quay.io/authzed/spicedb-operator:v1.2.0
• ghcr.io/authzed/spicedb-operator:v1.2.0

v1.1.2

What's Changed

• Removes race condition on secret detection (Fixes #145) by @ecordell in #142
• update to a more recent CRDB version in e2e tests by @vroldanbet in #141
• Revamp e2e tests by @ecordell in #142

Full Changelog: v1.1.1...v1.1.2

Install with kubectl

kubectl apply --server-side -f https://github.com/authzed/spicedb-operator/releases/download/v1.1.2/bundle.yaml

Include or modify this release in your own kustomize bundle

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - https://github.com/authzed/spicedb-operator/config?ref=v1.1.2
images:
  - name: ghcr.io/authzed/spicedb-operator
    newTag: v1.1.2

Install with kustomizer

Release manifests can be found at oci://ghcr.io/authzed/spicedb-operator-manifests:v1.1.2 and can be installed or inspected with kustomizer:

kustomizer apply inventory spicedb-operator --artifact oci://ghcr.io/authzed/spicedb-operator-manifests:v1.1.2

Docker Images

This release's image is available at:

• authzed/spicedb-operator:v1.1.2
• quay.io/authzed/spicedb-operator:v1.1.2
• ghcr.io/authzed/spicedb-operator:v1.1.2

v1.1.1

This is a patch release for 1.1.0 with fixes to the update channels for postgres.

What's Changed

• install kustomizer in release workflow by @ecordell in #133
• update readme to include update channels by @ecordell in #134
• fix migration for postgres v1.14.0-v1.16.1 by @ecordell in #140

Full Changelog: v1.1.0...v1.1.1

Install with kubectl

kubectl apply --server-side -f https://github.com/authzed/spicedb-operator/releases/download/v1.1.1/bundle.yaml

Include or modify this release in your own kustomize bundle

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - https://github.com/authzed/spicedb-operator/config?ref=v1.1.1
images:
  - name: ghcr.io/authzed/spicedb-operator
    newTag: v1.1.1

Install with kustomizer

Release manifests can be found at oci://ghcr.io/authzed/spicedb-operator-manifests:v1.1.1 and can be installed or inspected with kustomizer:

kustomizer apply inventory spicedb-operator --artifact oci://ghcr.io/authzed/spicedb-operator-manifests:v1.1.1

Docker Images

This release's image is available at:

• authzed/spicedb-operator:v1.1.1
• quay.io/authzed/spicedb-operator:v1.1.1
• ghcr.io/authzed/spicedb-operator:v1.1.1