Update docker.io/rustfs/operator Docker tag to v0.0.8

v0.0.8

Compare Source

What's Changed

• ci: run docker jobs on dind-sm-standard-2 runners by @​majinghe in #​267

Full Changelog: https://github.com/rustfs/operator/compare/0.0.7...0.0.8

v0.0.7

Compare Source

What's Changed

• fix: retry provisioning and add IPv6, bucket policy, hostUsers by @​loverustfs in #​233
• feat(console): align UI and responsive navigation by @​GatewayJ in #​234
• fix: reconcile private bucket policies and IP family changes by @​GatewayJ in #​235
• fix: reject single-disk pools in multi-pool tenants by @​GatewayJ in #​236
• change self host runner info by @​majinghe in #​244
• feat(cosi): foundation admin client + CAS grant ownership by @​BenjaminFuentesEviden in #​219
• feat(helm): deploy the RustFS COSI driver via cosiDriver.enabled by @​BenjaminFuentesEviden in #​246
• chore(deps): bump actions/download-artifact from 7.0.0 to 8.0.1 by @​dependabot[bot] in #​237
• chore(deps): bump azure/setup-helm from 4.3.0 to 5.0.1 by @​dependabot[bot] in #​238
• chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.1 by @​dependabot[bot] in #​241
• chore(deps): bump pnpm/action-setup from 4 to 6 by @​dependabot[bot] in #​239
• chore(deps): bump actions/setup-node from 5 to 7 by @​dependabot[bot] in #​240
• chore(deps): bump actions/checkout from 4 to 7 by @​dependabot[bot] in #​247
• feat(provisioning): manage bucket lifecycle rules by @​GatewayJ in #​250
• feat(helm): provision built-in Grafana dashboards by @​GatewayJ in #​253
• feat: reconcile bucket versioning and object lock by @​GatewayJ in #​260
• feat: add custom CA and additional volume support by @​GatewayJ in #​258
• feat: add tenant chart and Kubernetes networking examples by @​GatewayJ in #​262
• docs: update license copyright to RustFS, Inc. by @​overtrue in #​263
• ci: update workflow runners to dind-sm-standard-4 and sm-standard-2 in 59e75d3

New Contributors

• @​BenjaminFuentesEviden made their first contribution in #​219

Container Images

• The release image tag is 0.0.7. The publishing workflow also updates latest.
• Release source commit: 59e75d32f2badf4e2fa237127a20e417659582a1.

Full Changelog: https://github.com/rustfs/operator/compare/0.0.6...0.0.7

v0.0.6

Compare Source

Added

• Restricted Pod Security defaults for generated RustFS workloads.
• Configurable Kubernetes cluster DNS domains and generated TLS SAN coverage.
• Kubernetes STS support with PolicyBinding authorization and managed or external TLS.
• OpenShift installation support that delegates UID and FSGroup selection to SCC admission.
• Tenant credential, RPC authentication, KMS, certificate, and provisioning lifecycle validation.

Changed

• Removed legacy Tenant workload Roles and RoleBindings and disabled automatic ServiceAccount token
  mounting for generated RustFS workloads.
• Changed sts.tls.auto from true to false; installations must now provide the STS TLS Secret
  unless Operator-managed certificate generation is explicitly enabled.
• Restricted Console to one replica with a Recreate deployment strategy because sessions are
  process-local. Console restarts and session Secret rotation invalidate active sessions.
• Tightened validation for credentials, security contexts, public TLS SANs, pool volume counts, and
  immutable PVC template fields.
• Required an explicit runtime-image acknowledgement when a Tenant overrides the default RustFS
  image.
• Defaulted chart-managed Operator and Console images to the immutable chart appVersion instead
  of the mutable latest tag.

Fixed

• Made repeated blocked status updates idempotent and hardened leader-election loss handling.
• Tolerated transient node lookup failures while preserving Pod cleanup safety.
• Protected existing RustFS users during provisioning reconciliation.
• Corrected monitoring responses wrapped by the RustFS API.
• Corrected STS SigV4 query encoding, bounded session duration, and rotated managed TLS certificates.
• Revoked Console sessions on logout and prevented pool volume-count overflow.
• Added finalizer RBAC required by Kubernetes and OpenShift admission.

Security

• Applied authentication to an explicit protected Console API router instead of relying on a
  fail-open path allowlist.
• Added admission limits for unauthenticated Console login and STS requests.
• Required cryptographically strong Console session keys and rejected empty credential Secrets.
• Bounded generated TLS SAN work and HTTP metrics label cardinality.

Upgrade notes

Apply CRDs before upgrading the controller

Helm does not upgrade CRDs already installed from a chart's crds/ directory. Apply both packaged
CRDs before the Helm upgrade:

kubectl apply --server-side --force-conflicts \
  --field-manager=rustfs-operator-crd-upgrade \
  -f deploy/rustfs-operator/crds/tenant-crd.yaml
kubectl apply --server-side --force-conflicts \
  --field-manager=rustfs-operator-crd-upgrade \
  -f deploy/rustfs-operator/crds/policybinding-crd.yaml

Review Tenant Kubernetes API access

The Operator removes legacy Tenant workload RBAC and renders
automountServiceAccountToken: false. Standard RustFS workloads do not need Kubernetes API access.
Custom sidecars or scripts that do need it must use a user-owned ServiceAccount, least-privilege
RBAC, and an explicit projected token. This migration changes the StatefulSet Pod template and
causes a rolling restart.

Choose the STS TLS owner

The new default is sts.tls.auto=false. Pre-create the configured STS TLS Secret with tls.crt,
tls.key, and ca.crt, or explicitly preserve the previous behavior with:

sts:
  tls:
    auto: true

Plan Console session interruption

The Console now uses one replica and a Recreate rollout. Plan for a brief Console interruption;
users must authenticate again after a restart or session Secret rotation. Tenant data-plane traffic
is unaffected.

Rollback considerations

• Back up Tenant resources, Helm values, and the installed CRDs before upgrading.
• Do not downgrade CRDs automatically; keep the newer schema unless compatibility with the older
  controller has been verified.
• An older Operator may recreate legacy Tenant RBAC and revert the ServiceAccount token setting,
  causing another Tenant rollout and restoring broader Kubernetes API access.
• Pin Operator and RustFS images independently, then verify Tenant readiness and S3 read/write data
  before and after any rollback.