[wasabii]

Summary

API version

• v1 is introduced as the storage version. Every kind is served at seq.k8s.datalust.co/v1 with exactly the v1alpha1 schema. v1alpha1 stays served but deprecated, so kubectl warns whenever it's used.
• No conversion webhook is needed. Because the schemas are identical, the CRDs use conversion: None: the API server converts by relabelling apiVersion, and existing objects carry over untouched.
• The operator works in v1 throughout. The V1alpha1* classes are renamed to V1*. The legacy finalizer shims keep their names, since their names are the finalizer identifiers. New tests check that the two versions can't drift apart.

Security

• ApiKey permission flags are enforced. Before, any namespace allowed to create ApiKeys could assign itself System or Organization. Defaults now follow sensitivity: Ingest and Public are allowed unless denied, and everything else must be granted. A key asking for too much is refused whole, and its existing key in Seq is left untouched.
• Secret references to other namespaces are refused. These are remote.auth on Instances and secretRef on ApiKeys. Before, the operator followed them with its cluster-wide access.
• SSO secrets are kept out of Instance status. Status shows <set> instead of the value. Secrets can now also come from a Secret via clientSecretRef / clientKeyRef; the plain-text fields are deprecated.
• Admin passwords are generated with RandomNumberGenerator. They previously used Random.Shared, which isn't a secure source.

Bugs

• deployment.envFrom no longer crashes every reconcile.
• Signals are in the default Instance permissions. Before, a Signal was refused even in the Instance's own namespace unless spec.permissions was set.
• A failed create no longer leaves a duplicate in Seq. If the operator creates an object in Seq but can't record its id, it now removes the new object before retrying.
• Deletions no longer hang when the Instance is gone or being deleted. They used to block deletion of the resource, and of any namespace containing it, forever.
• The operator recognises its own ApiKey (<instance>-operator).
• The StatefulSet's serviceName names the Service instead of the ServiceAccount. This only applies to new StatefulSets, because the field is immutable.

Docs

• The README is rewritten, with examples checked against the generated CRDs, and has an Upgrading section for each behaviour change.

Upgrade impact

The README's Upgrading section covers each change. On the labs cluster nothing needs to change:

• The cross-namespace ApiKeys there ask for Ingest only.
• None of them reference a Secret in another namespace.
• No SSO is configured.

Testing

• The full dist build passes. It regenerates the CRDs, which come out with v1 stored, v1alpha1 served and deprecated, identical schemas, and conversion: None. It also renders the chart.
• 33/33 tests pass.
• A server-side dry run of the new CRDs against the labs cluster is accepted. That cluster currently stores v1alpha1 only.
• Not deployed to a cluster.