What's Changed

• feat(shard): Add audit policy options by @MisterMX in #141
• docs: update local setup with etcd helm chart by @gman0 in #180
• Update CONTRIBUTING.md by @KevinGimbel in #184
• add initial, basic AGENTS.md by @xrstf in #177
• Update & release prep by @mjudeikis in #188

New Contributors

• @MisterMX made their first contribution in #141
• @KevinGimbel made their first contribution in #184

Full Changelog: v0.5.1...v0.6.0

What's Changed

• [release-0.5] Update kcp version by @mjudeikis in #191

Full Changelog: v0.5.1...v0.5.2

What's Changed

• fix --cache-kubeconfig for shards by @xrstf in #165
• Let front-proxy verify against non-fp client CA by @ntnn in #178

Full Changelog: v0.5.0...v0.5.1

What's Changed

• Provision RBAC for Kubeconfigs inside kcp by @xrstf in #91
• extend sample manifests to reflect external access by @mandelsoft in #138
• Remove obsolete Makefile targets from target dependency lists by @mandelsoft in #137
• Configuration Bundle by @mjudeikis in #135
• Update to kcp 0.30 by @mjudeikis in #143
• Clean old rbac by @mjudeikis in #136
• Restore RBAC by @xrstf in #146
• Use Docker registry mirror if available by @xrstf in #147
• Fix defaulting LATEST by @ntnn in #152
• Implement cleanup of leftover resources after Shard CR gets deleted by @iakmc in #142
• Improve reconciled resources by @xrstf in #149
• bump cert-manager to latest version in examples/scripts by @xrstf in #150
• prevent Go from printing 'command-line arguments' after building by @xrstf in #154
• Implement cache servers by @xrstf in #144
• fix local-cluster-admin kubeconfigs for shards not pointing to the shards by @xrstf in #156
• Fix metrics by @xrstf in #159
• bump golangci-lint by @xrstf in #162
• lowercase kcp everywhere by @xrstf in #166
• Add revision labels to PodTemplates in order to automatically rotate Deployments by @xrstf in #161
• Extend sample manifests with explanation for ServiceAccount support by @mandelsoft in #168
• Add caBundle as backendCA for frontProxy Path ConfigMap by @BergCyrill in #148
• bump OTEL dependencies (CVE-2026-24051) by @xrstf in #169
• Added support for external etcd to CacheServer by @gman0 in #170
• Update kcp to 0.30.1 by @mjudeikis in #175

New Contributors

• @mandelsoft made their first contribution in #138
• @ntnn made their first contribution in #152
• @iakmc made their first contribution in #142
• @gman0 made their first contribution in #170

Full Changelog: v0.4.1...v0.5.0

Changes

• #172: [CVE-2026-24051] Bump opentelemetry SDK to v1.41.0

What's Changed

• add kubeconfig object status details when trying to list objects by @olamilekan000 in #120
• update to Go 1.24.11, update actions by @xrstf in #127
• update default kcp version to 0.29, add 0.28-based e2e test by @xrstf in #126
• fix compatibility table in readme by @xrstf in #129
• Replace download-tool.sh with µget by @xrstf in #128
• Handle caBundleSecretRef in the shard controller by @BergCyrill in #132
• add kcp operator custom metrics by @olamilekan000 in #121
• fix panic when resource requests and limit are added to frontproxy by @olamilekan000 in #133

New Contributors

• @BergCyrill made their first contribution in #132

Full Changelog: v0.3.0...v0.4.0

The team behind the kcp-operator is happy to announce the availability of version 0.3.0. This release is focussing on bringing the operator closer to production readiness by allowing to configure more advanced PKIs and tweak the kcp components in a more fine-grained matter.

Changes since 0.2.0

Features

• #115: Add extraArgs to (Root)Shard and FrontProxy spec to allow additional customizations (by @mjudeikis)
• #109: Add spec.caBundleSecretRef to enable users to provide additional CA trust for shards and front-proxy (by @mjudeikis)
• #108: Allow to override issuer when configuring CertificateTemplate on shards (by @mjudeikis)
• #107: Allow to customize (Root)Shard baseURL by setting it to spec.shardBaseURL (by @mjudeikis)
• #116: Add logging settings to (Root)Shards and FrontProxy to control the logging verbosity (by @olamilekan000 & @xrstf)

Deprecations

• #113: Deprecate FrontProxySpec.ExternalHostname in favor of structured External configuration with support for separate internal/external hostnames and ports (by @mjudeikis)

Misc

• #114: kcp-operator is built with Go 1.24.9 (by @embik)
• #97: Update default kcp version to v0.28.3 (by @embik)

Changes since v0.2.0

Features

• #98: Update default kcp tag to v0.28.3 (by @embik)

The team behind the kcp-operator is happy to announce the availability of version 0.2.0. This brings with it support for kcp 0.28 and a bunch of bugfixes. Every user is encouraged to upgrade to this new release.

Changes since 0.1.0

Features

• #93: Update default kcp version to 0.28.1 (by @xrstf)
• #87: The kcp-operator now deploys an internal front-proxy for each RootShard. This proxy must not be exposed to the internet and is only meant to be used by the kcp-operator itself to provision resources inside workspaces. (by @xrstf)
• #89: Add the ability to configure a custom CA for the OIDC issuer as described in the --oidc-ca-file flag (by @aaronschweig)
• #72: Set up necessary logical-cluster-admin kubeconfigs for additional shards (by @embik)
• #68: Add OIDC configuration support for all components (by @mjudeikis)
• #83: The serving cert for front-proxies now includes the namespaced (serviceName.namespace) fully-qualified (serviceName.namespace.svc.cluster.local) names of the front-proxy Service (by @xrstf)
• #81: Set --service-account-lookup=false on shards and root shards to allow cross-shard ServiceAcount tokens (by @mjudeikis)
• #78: Validation has been added to prevent misconfiguration of FrontProxy authN methods (by @embik)
• #74: Do not set --service-account-key-file on front-proxy to allow individual shards to authenticate tokens (by @embik)

Bugfixes

• #92: Fix etcd TLS configuration breaking shard reconciling (by @xrstf)
• #88: Fix an issue where volumes have not been properly set for authorization webhooks (by @nexus49)
• #75: Fix ServiceAccount resolution & authentication in sharded model (by @mjudeikis)

Misc

• #85: Remove Ginkgo from unit tests, use fakeclient instead of envtest (by @xrstf)

Initial release.