)]}' { "log": [ { "commit": "ec628f701ba0e4a08b850846db4b56a90a19d314", "tree": "aa324c89430a6e7a265bedfb0050e106c5e48f76", "parents": [ "642bbd498c48c55375e71f28b7b937996f3e7edf" ], "author": { "name": "Matteo Merli", "email": "mmerli@apache.org", "time": "Tue Oct 13 10:58:59 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 10:58:59 2026 -0700" }, "message": "Restrict network access to Oxia and support TLS between Oxia processes (#727)\n\n* Restrict network access to Oxia and support TLS between Oxia processes\n\n- The \u003crelease\u003e-pulsar-oxia Service only exposes the public endpoint.\n The Pulsar components connect through the headless\n \u003crelease\u003e-pulsar-oxia-svc Service, which keeps every port, and the\n PodMonitors scrape the pods directly.\n\n- New NetworkPolicy (oxia.networkPolicy, enabled by default). The\n internal endpoints of the Oxia servers and the coordinator, and the\n coordinator\u0027s admin endpoint, only accept the Oxia pods of the release.\n The public and metrics endpoints stay open. The allowed sources are\n configurable with oxia.networkPolicy.{public,metrics,internal}.from.\n\n- tls.oxia (with tls.enabled) now takes effect. cert-manager issues a\n certificate for the Oxia servers, which the servers and the coordinator\n mount. The servers\u0027 internal endpoint, replication and the\n coordinator\u0027s calls use TLS, optionally mTLS (tls.oxia.clientAuth).\n The public endpoint stays plaintext, since the Oxia Java client only\n trusts the JVM\u0027s default CA certificates. With TLS on, the server\n probes use the public endpoint, because \"oxia health\" only speaks\n plaintext.\n\n- CI: an \"Oxia TLS\" scenario, the Oxia certificate in the SAN mode\n checks, and the NetworkPolicy and Oxia mTLS in the all-values render.\n\n* Keep the release\u0027s pods allowed on the Oxia public port when public.from is set\n\nA non-empty oxia.networkPolicy.public.from replaced the open rule, so the\nrelease\u0027s own brokers, bookies, proxies and jobs lost access to the\nmetadata store unless the list also selected them. The rule now always\nincludes the release\u0027s pods, like the internal rule does." }, { "commit": "642bbd498c48c55375e71f28b7b937996f3e7edf", "tree": "65382546034c1f5db5af486e0c6cc2402b065396", "parents": [ "71150b417dfeba712577fe9686e7047e3424983f" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Oct 12 06:16:17 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 06:16:17 2026 -0700" }, "message": "Upgrade Oxia to 0.16.11 (#726)\n\nOxia 0.16.11 fixes data servers that could stay NOT_SERVING after a\ncoordinator restart and rejects a data server configuration where\n--wal-dir and --data-dir are the same directory. The chart already uses\nseparate directories (/data/wal and /data/db), so no migration is needed.\n\nRelease notes: https://github.com/oxia-db/oxia/releases/tag/v0.16.11" }, { "commit": "71150b417dfeba712577fe9686e7047e3424983f", "tree": "aab76216733f9954173c94b23a923819c86592aa", "parents": [ "ed631516315790e3eda3adf9bb88d77f9fcc92bd" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Tue Oct 06 12:51:37 2026 -0700" }, "committer": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Tue Oct 06 12:51:37 2026 -0700" }, "message": "Chart: Bump version to 4.8.0\n" }, { "commit": "ed631516315790e3eda3adf9bb88d77f9fcc92bd", "tree": "dbda24d78d8a5b394855722f56435bd168cd1053", "parents": [ "71ea070940f7eb45ea2bb6c25105f4aee76d6521" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Tue Oct 06 14:44:31 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 22:44:31 2026 +0300" }, "message": "Support externally managed TLS certificates for all components (#724)\n\n* Support externally managed TLS certificates for all components\n\nDocument how to use publicly trusted and externally managed TLS\ncertificates with the chart (#721):\n\n- Add `createCert` to the broker, bookie, zookeeper, autorecovery,\n toolset and standalone TLS settings, as the proxy and function worker\n already have, so that all the certificate Secrets can be provided\n externally. Only an explicit `createCert: false` disables the\n certificate, so values without the key, such as reused values from an\n earlier release, keep creating it.\n- Don\u0027t require the unused tls-combined.pem key in the proxy Secret, so\n that a publicly trusted certificate Secret can be used for the proxy.\n- Document in values.yaml why publicly trusted certificates can\u0027t be\n used between the components (cluster-internal names, and the removal\n of the clientAuth extended key usage from public certificates), the\n recommended setup with a public certificate for the proxy only, the\n required keys and key format of externally managed certificate Secrets\n (PKCS#8 and tls-combined.pem for ZooKeeper TLS), and the purpose of\n certs.issuers.ca.secretName.\n- Explain in the certs.issuers.ca.secretName error message what the\n Secret must contain.\n\n* Document the broker certificate requirements for direct client access" }, { "commit": "71ea070940f7eb45ea2bb6c25105f4aee76d6521", "tree": "ddfee4ba1d0f52a839184d2ff27d70799dab64be", "parents": [ "90d4446fa1daef7488d9b18a5c238e7c631f6e9e" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Tue Oct 06 12:13:07 2026 -0700" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Tue Oct 06 12:13:07 2026 -0700" }, "message": "Improve the 4.8.0 upgrade instructions in README.md\n\n- Order the 4.8.0 upgrade notes by impact: the Pulsar 5.0.0 default and\n the missing apachepulsar/pulsar-all image first, then the Pulsar Manager\n removal and the X.509 certificate subject change.\n- Explain how to keep the offloaders and connectors when pinning Pulsar\n 4.x, since the chart now defaults to the apachepulsar/pulsar image.\n- Cover the other changes since 4.7.0: the internal CA private key\n rotation policy, PodMonitor and HPA resources for disabled components,\n autorecovery probes, the scheduling settings of the sts-cleanup hook\n Jobs, the Oxia upgrade and the bookie-init ZooKeeper TLS fix.\n- List the new options: pod and container security contexts, node\n affinity, job.podAnnotations and tls.common.sanMode.\n- Fix grammar and typos, and use a shields.io badge for DeepWiki since\n the deepwiki.com badge doesn\u0027t render correctly.\n" }, { "commit": "90d4446fa1daef7488d9b18a5c238e7c631f6e9e", "tree": "8e9819110e9680a603936f66ac31da297823685b", "parents": [ "0abec6505d3c9911bc49df29a1b2ffa4f4419abb" ], "author": { "name": "Robert Moucha", "email": "robert.moucha@gooddata.com", "time": "Tue Oct 06 21:07:45 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 22:07:45 2026 +0300" }, "message": "Add configurable pod and container securityContext, including readOnlyRootFilesystem support (#715)\n\n* feat(chart): configurable pod and container securityContext\n\nAdds two global values, `podSecurityContext` and `containerSecurityContext`,\napplied to every pod and every container the chart itself renders, including\ninitContainers and the init/cleanup Jobs. Each is merged with a matching\nper-component override that wins on a per-key basis:\n\n podSecurityContext \u003c- \u003ccomponent\u003e.securityContext\n containerSecurityContext \u003c- \u003ccomponent\u003e.containerSecurityContext\n\nBefore this change the chart exposed a pod-level securityContext for only\nzookeeper, bookkeeper, broker and oxia.server, and had no container-level\nsecurityContext support at all, so allowPrivilegeEscalation, capabilities,\nseccompProfile and readOnlyRootFilesystem were not settable at any value.\nClusters running a restrictive pod security policy (Pod Security Admission,\nOPA Gatekeeper, Kyverno) had no supported way to make the chart conform.\n\nThe merge uses mergeOverwrite rather than merge, because merge treats zero\nvalues in its destination as absent and would silently discard a\nper-component `fsGroup: 0` or `allowPrivilegeEscalation: false`.\n\nContainers supplied through `\u003ccomponent\u003e.initContainers`,\n`oxia.coordinator.extraContainers` and `dekaf.deployment.extraContainers` are\nraw passthrough and are not merged with these settings; the README says so.\n\nBoth globals default to empty, so rendered output is unchanged apart from two\nthings:\n\n- The zookeeper and broker sts-cleanup upgrade-hook Jobs gain pod template\n labels via pulsar.template.labels. They were the only pod templates in the\n chart without them, so .Values.labels never reached their pods.\n\n- Three Jobs (bookkeeper cluster-initialize and the two sts-cleanup hooks)\n now render the `fsGroup: 0` of the component they belong to. Those pods\n mount only ConfigMaps, Secrets and the service account token, so this has\n no effect on volume ownership. It is not entirely inert everywhere:\n fsGroup is an admission input for OpenShift SCCs.\n\nThe autorecovery StatefulSet gains liveness, readiness and startup probes,\nall disabled by default, so this adds a knob rather than behaviour. It had\nnone and no values knob to add them. The daemon does not start BookKeeper\u0027s\nHTTP service, so the probes target the Prometheus stats endpoint on\nautorecovery.ports.http -- the same endpoint the PodMonitor already scrapes.\nThey default to off because that endpoint comes from the image\u0027s BookKeeper\nstats provider rather than from anything the chart configures: a cluster\noverriding statsProviderClass or prometheusStatsHttpPort through\nautorecovery.configData would otherwise get a restart loop from liveness, or\na permanently unready pod stalling the rollout from readiness.\n\nEvery probe value is read with `dig`, because `autorecovery.probe` is a new\nkey: under `helm upgrade --reuse-values` the new chart\u0027s defaults are not\ncoalesced in, so the map is absent and a direct dereference aborts the\nrender for every existing release.\n\n`fsGroup` is applied as a supplementary group, so `runAsGroup` does not need\nto match it. The docs say so rather than the opposite.\n\nAdds two worked examples. examples/values-psa-restricted.yaml targets the\nKubernetes `restricted` Pod Security Standard and deliberately leaves the\nper-component `fsGroup: 0` defaults alone, since `restricted` places no\nconstraint on fsGroup, fsGroupChangePolicy or supplementalGroups.\nexamples/values-restricted-group-ranges.yaml covers the narrower case of a\npolicy that constrains group IDs to a numeric range -- Gatekeeper\u0027s\nPodSecurityPolicy-derived K8sPSPAllowedUsers, an equivalent Kyverno policy,\nor an OpenShift SCC -- and overrides fsGroup on the four components that\nship it, with a warning about the recursive volume ownership change.\n\nBoth examples set `runAsUser` explicitly rather than relying on the images\u0027\nown USER, because not every image the chart runs has one: the zookeeper and\nbroker sts-cleanup pre-upgrade hooks use alpine/k8s, which has no USER\ndirective and runs as UID 0. With runAsNonRoot and no runAsUser the kubelet\nrefuses those pods (\"container has runAsNonRoot and image will run as root\"),\nand because they are pre-upgrade hooks that blocks `helm upgrade` outright.\nkubectl in that image was verified to work as UID 10000.\n\nBoth examples also disable the bundled monitoring stack, because these values\ndo not reach subchart templates: prometheus-node-exporter requires\nhostNetwork, hostPID and hostPath, Grafana chowns its data directory as root,\nand some of the stack\u0027s workloads set no seccompProfile. Left enabled its\npods are rejected on admission while Pulsar itself comes up fine. With it\ndisabled, the whole rendered release is admitted by a namespace enforcing\n`restricted` with no violations.\n\nValidated with helm lint and kubeconform (k8s 1.25/1.31/1.36) against the\ndefault values, every .ci/clusters/* config, and .ci/templates-all-values.yaml.\n\nAlso verified on a 4-node kind cluster (k8s 1.36.1) and on EKS 1.34 with the\nAWS EBS CSI driver, upgrading in place from published 4.7.0. Moving fsGroup\nfrom 0 to 10000 triggers the recursive relabel and preserves data: a\n5000-message unacked backlog was consumed intact afterwards, with identical\nstorageSize and no pod restarts.\n\n* feat(chart): support readOnlyRootFilesystem\n\nSetting `containerSecurityContext.readOnlyRootFilesystem: true` previously rendered\nbut did not run: the Pulsar images rewrite their configuration under /pulsar/conf on\nstartup (bin/apply-config-from-env.py), write logs under /pulsar/logs, and the JVM\nand functions worker use /tmp.\n\nThe chart now mounts an emptyDir over each path in the new `emptyDirVolumes` list on\nevery container and initContainer of the component, and prepends a copy-pulsar-conf\ninitContainer that seeds the entries marked `seedFromImage` from the image, because an\nemptyDir starts empty and apply-config-from-env.py edits files that must already\nexist. The default list describes the Pulsar images:\n\n emptyDirVolumes:\n - path: /pulsar/conf\n seedFromImage: true\n - path: /pulsar/logs\n sizeLimit: 1Gi\n - path: /tmp\n sizeLimit: 1Gi\n\nA list rather than a boolean, so that an existing deployment is not broken by a\nmountPath the chart cannot know about: an entry whose path the component already\nmounts through extraVolumeMounts is dropped, since a duplicate mountPath is rejected\noutright by the API server. `sizeLimit` is set because an uncapped emptyDir can fill a\nnode\u0027s ephemeral storage and get pods evicted.\n\nThis could not be done from values alone. Values-supplied `\u003ccomponent\u003e.initContainers`\nare appended after the built-in ones, so a seeding container cannot run first, and\nonly autorecovery exposes initContainersExtraVolumeMounts, so the built-in init\ncontainers elsewhere could not be given the conf volume. broker/wait-bookkeeper-ready\nin particular runs apply-config-from-env.py and would fail.\n\nThe volumes are driven by the effective container securityContext, using the same\nglobal/per-component merge as `pulsar.containerSecurityContext`, so one global setting\ncovers the whole release and a component that overrides readOnlyRootFilesystem back to\nfalse also loses the volumes. `\u003ccomponent\u003e.emptyDirVolumes` replaces the list it would\notherwise inherit; `[]` opts a component out entirely, for users who would rather\ndeclare the mounts themselves through extraVolumes/extraVolumeMounts.\n\nResolution is `--reuse-values` safe. The helper carries a copy of the values.yaml\ndefault and distinguishes an absent key from an explicit `[]` with `hasKey`, because\n`helm upgrade --reuse-values` does not coalesce in a new chart\u0027s defaults: the key is\nsimply absent there, and treating that as an empty list would render a read-only root\nfilesystem with none of the volumes that make it work.\n\nComponents that do not run a Pulsar image must not receive that Pulsar-shaped list --\nthe seed step would try to copy a /pulsar/conf that does not exist in their images --\nso they carry their own default at the call site rather than in values.yaml, which\nkeeps them correct when the key is absent. Measured by running each image read-only:\n\n * oxia server and coordinator get /tmp. Oxia keeps its own state under the data\n directory -- WAL, Pebble SSTables and snapshots all live there, and an incoming\n snapshot is written straight into the db path rather than staged elsewhere -- and\n /tmp stayed empty through 260MB of write load per server, compaction, and a full\n snapshot install into a wiped follower, measured with a writable /tmp mounted so\n that any use of it would have been visible. Neither Pebble nor hashicorp/raft\n references os.TempDir outside their tests. It is provided regardless: the cost is\n one emptyDir, and a dependency or a later oxia version falling back to\n os.TempDir() would otherwise take the metadata store down under load rather than\n at startup.\n * dekaf needs /tmp; without it the JVM fails with\n java.nio.file.FileSystemException: /tmp/dekaf...: Read-only file system.\n * the sts-cleanup pre-upgrade hooks run kubectl from alpine/k8s, which needs nothing\n writable, and are left outside the mechanism because the values key they would\n read is shared with a Pulsar-image workload.\n\nThe pulsar_manager StatefulSet cannot support it. Beyond /run/postgresql and /tmp the\napachepulsar/pulsar-manager image needs /var/log/nginx, /var/lib/nginx and\n/run/nginx.pid, and writes a supervisord socket into /pulsar-manager, its own install\ndirectory, which an emptyDir cannot cover without hiding the application. Enabling\nboth now fails the render with a message naming the reason and the opt-out, rather\nthan producing a pod that never becomes ready. Note that opting it out also opts out\nits cluster-initialize Job, which shares the pulsar_manager securityContext even\nthough it runs a Pulsar image and would otherwise work.\n\nA path is rejected at render time rather than at apply time when it is relative,\ncarries an unknown key (`seedFromimage` would otherwise silently leave the conf\ndirectory unseeded), collides with another entry, reduces to the same volume name as\nanother entry (/pulsar/logs and /pulsar-logs both give pulsar-logs), or is long enough\nto exceed the 63-character limit on a Kubernetes name.\n\nThe bookkeeper StatefulSet emitted `initContainers:` only when waitMetadataTimeout was\ngreater than zero. It is now emitted whenever anything needs it -- waitMetadataTimeout,\nthis feature, cacerts, or user-supplied bookkeeper.initContainers -- with\nverify-clusterid still gated on the timeout. Besides being required here, this fixes a\nlatent bug that predates this change: with `bookkeeper.waitMetadataTimeout: 0` and\n`bookkeeper.initContainers` set, the user\u0027s init containers were emitted without their\nparent key and the template failed to parse.\n\nSince readOnlyRootFilesystem is unset by default, rendered output is unchanged.\nVerified against the previous commit for the default values, all 19 .ci/clusters/*\nconfigs, .ci/values-common.yaml and .ci/templates-all-values.yaml, comparing only the\nparent chart\u0027s documents (the bundled victoria-metrics-k8s-stack regenerates its\nself-signed webhook certificates on every helm invocation).\n\nWith it enabled, 51 clean kubeconform runs across k8s 1.25/1.31/1.36 over 17 value\nsets covering TLS, JWT, standalone, oxia, dekaf, all components, and three\n--reuse-values shapes. Verified at runtime on EKS 1.34 by installing without it and\nthen running `helm upgrade --reuse-values --set\ncontainerSecurityContext.readOnlyRootFilesystem\u003dtrue`: every StatefulSet gains the\nseed container and the volumes, copy-pulsar-conf completes first, the seeded conf is\nrewritten by apply-config-from-env.py, and 200 messages produced before the upgrade\nare consumed after it with no read-only filesystem errors in any container. oxia and\ndekaf were confirmed read-only at runtime with the volumes above and nothing else.\n\nLogs on an emptyDir do not survive pod replacement, which is noted in values.yaml and\nthe README.\n\n---------\n\nCo-authored-by: Lari Hotari \u003clhotari@apache.org\u003e" }, { "commit": "0abec6505d3c9911bc49df29a1b2ffa4f4419abb", "tree": "b403b9cd65edb17898f17073b4e106054f9a16f9", "parents": [ "317d491afc20c3869ef4989b6657cb91d4a7b3a6" ], "author": { "name": "gulecroc", "email": "gu.lecroc@gmail.com", "time": "Tue Oct 06 20:52:43 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 21:52:43 2026 +0300" }, "message": "Configure certificates subject (#714)\n\n* configure certs subject\n\n* list others certs subject properties\n\n* add X.509 certificate subject upgrade doc\n\n---------\n\nCo-authored-by: glecroc \u003cguillaume.lecroc@cnp.fr\u003e\nCo-authored-by: Lari Hotari \u003clhotari@apache.org\u003e" }, { "commit": "317d491afc20c3869ef4989b6657cb91d4a7b3a6", "tree": "f36a3ab81786e465b692726f843f29da677bb954", "parents": [ "72cbd61c2567a774027ac7b706e18d9c1aa8605b" ], "author": { "name": "Shaun Becker", "email": "smbecker@gmail.com", "time": "Tue Oct 06 14:50:46 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 21:50:46 2026 +0300" }, "message": "Add nodeAffinity support to all scheduled workloads (#711)\n\n* Add nodeAffinity\n\n* Add nodeAffinity to standalone deployment and JWT init job\n\nExtends the nodeAffinity support from #349 (issue #247) to the two\nworkloads that were not covered by the original change:\n\n- standalone-deployment.yaml: adds a fully-guarded affinity block so\n .Values.standalone.affinity.node_affinity places the standalone pod,\n matching the existing guarded nodeSelector/tolerations style.\n- jwt-secret-init.yaml: broadens the affinity guard so nodeAffinity can\n be set independently of podAntiAffinity, mirroring the statefulset\n layout (nodeAffinity then podAntiAffinity). Existing anti-affinity\n behavior is preserved.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* Document node_affinity in values.yaml affinity blocks\n\nAdds a commented node_affinity example alongside the existing\nanti_affinity documentation for every component whose template\nconsumes it: zookeeper, bookkeeper, autorecovery, broker, proxy,\nstandalone, and the JWT generateSecrets job. Kept commented so the\ndefault (no node affinity) behavior is unchanged.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* Add nodeAffinity to function_worker and oxia-server statefulsets\n\nExtends nodeAffinity coverage to the two remaining scheduled workloads\nwith affinity blocks. Both already emit a static affinity: key with a\nconditional podAntiAffinity, so the nodeAffinity block follows the same\nlayout as the other statefulsets. values.yaml documents a commented\nnode_affinity example for each. Default behavior is unchanged.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* Add nodeAffinity to broker and zookeeper upgrade jobs\n\nThe pre-upgrade StatefulSet cleanup jobs had no scheduling constraints.\nAdd a guarded nodeAffinity block reusing the existing\nbroker.affinity.node_affinity / zookeeper.affinity.node_affinity\nvalues so these transient pods honor the same node placement as the\nworkloads they manage. Default behavior (no affinity) is unchanged.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* Align broker/zookeeper cleanup jobs with component scheduling\n\nThe pre-upgrade StatefulSet cleanup jobs previously ran with a bare pod\nspec. Bring them in line with their StatefulSets so they schedule the\nsame way: imagePullSecrets, nodeSelector, priorityClassName,\ntolerations, topologySpreadConstraints, and the full affinity block\n(nodeAffinity + podAntiAffinity), plus the container imagePullPolicy.\nAll blocks are guarded, so default behavior is unchanged except that\nthe jobs now honor the component\u0027s existing scheduling settings.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* Add nodeAffinity to toolset statefulset\n\nThe toolset statefulset already supported nodeSelector, priorityClassName,\ntolerations, and topologySpreadConstraints but had no affinity block. Add a\nguarded nodeAffinity block keyed on toolset.affinity.node_affinity, with a\nnil-safe guard since toolset has no affinity map by default. The toolset\nruns a single replica, so pod anti-affinity is not applicable and only\nnode_affinity is supported. Default behavior is unchanged.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* Pass nodeAffinity through as native Kubernetes syntax\n\nReplaces the bespoke `affinity.node_affinity.matchExpression` schema with a\nraw `affinity.nodeAffinity` passthrough rendered via `toYaml | nindent`.\n\nThe custom schema modelled exactly one nodeSelectorTerm holding exactly one\nmatchExpression, always under requiredDuringSchedulingIgnoredDuringExecution.\nIt could not express a weighted preferredDuringSchedulingIgnoredDuringExecution,\nmultiple terms (OR), multiple expressions within a term (AND), or matchFields --\nall common for node pinning. It also interpolated `key` and `values` unquoted,\nso any label value YAML reads as a scalar (`true`, `123`, `on`) rendered with\nthe wrong type and was rejected by the API; `--set-string` was no workaround\nbecause the template output re-introduced the type. That made `Gt`/`Lt`\nunusable entirely, since they require numeric-looking strings.\n\nNative syntax removes the whole class of problem: users write real YAML, so\nquoting is theirs to control, and every affinity feature is reachable. It also\nmatches the convention of every adjacent scheduling knob in this chart\n(nodeSelector, tolerations, topologySpreadConstraints are all toYaml\npassthroughs), and replaces 12 lines of template per component with 3.\n\nNothing was released with the old shape, so there is no compatibility break.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* Drop pod anti-affinity from the sts-cleanup hooks\n\nCommit 6f1ffb3 gave the broker and zookeeper sts-cleanup Jobs the same\npodAntiAffinity block as their component StatefulSets. The guard is\n`and .Values.affinity.anti_affinity .Values.\u003ccomponent\u003e.affinity.anti_affinity`\nand both default to true, so it guarded nothing: `helm template` with no values\noverridden at all differed from master in exactly these two Jobs.\n\nFor zookeeper that is a broken upgrade. `zookeeper.affinity.type` defaults to\nrequiredDuringSchedulingIgnoredDuringExecution and `zookeeper.replicaCount` to\n3, so on a 3-node cluster the same required rule that spreads the 3 ZK pods\none-per-node also excludes every hostname for the hook pod. The Job carries\n`helm.sh/hook: pre-upgrade`, so it stays Pending, the hook never completes, and\n`helm upgrade` blocks until timeout and fails. The broker Job escaped only\nbecause `broker.affinity.type` happens to default to preferred.\n\nThese are short-lived single-shot pods that run kubectl. Spreading them across\nnodes buys nothing, so they get node affinity (which is opt-in and reflects\nwhere the operator wants Pulsar to run at all) and no pod anti-affinity.\n\nVerified: `helm template test charts/pulsar` on default values now has zero\nscheduling-related differences against master, and neither Job renders\npodAntiAffinity even with `affinity.anti_affinity\u003dtrue`.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* Add nodeAffinity to the remaining six pod templates\n\nSix of the chart\u0027s 18 pod-producing templates had no node affinity support, so\n\"all scheduled workloads\" was not accurate. All six already honour nodeSelector\nand tolerations, so all six are workloads an operator can already place --\nnode affinity was simply missing.\n\n bookkeeper-cluster-initialize.yaml pulsar_metadata.affinity.nodeAffinity\n pulsar-cluster-initialize.yaml pulsar_metadata.affinity.nodeAffinity\n pulsar-manager-cluster-initialize.yaml pulsar_metadata.affinity.nodeAffinity\n dekaf-deployment.yaml dekaf.deployment.affinity.nodeAffinity\n oxia-coordinator-deployment.yaml oxia.coordinator.affinity.nodeAffinity\n pulsar-manager-statefulset.yaml pulsar_manager.affinity.nodeAffinity\n\nThe three init Jobs share pulsar_metadata, matching how they already share its\nnodeSelector and tolerations. The other three components had no affinity block\nin values.yaml at all, so one is added carrying nodeAffinity only -- they have\nno pod anti-affinity to configure.\n\nAccess is written nil-safe -- `(.Values.x.affinity).nodeAffinity` -- so an\nexplicit `affinity: null` in a user\u0027s values file is not a nil dereference.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* Cover nodeAffinity in CI values and document it in the README\n\n.ci/templates-all-values.yaml gets a nodeAffinity on every component, using a\ndeliberately awkward value -- two nodeSelectorTerms, several matchExpressions\nper term, matchFields, and required plus preferred together -- so the CI sweep\nexercises the `toYaml | nindent` passthrough against a deeply nested\nmulti-element value, which is what that file exists to do. The patch1 overlay\nswaps in a two-entry weighted preferred list, and carries the function worker,\nwhose StatefulSet only renders under that overlay.\n\nREADME gains a node-pinning example next to the existing anti-affinity note,\nsince pinning to a dedicated node pool is the case issue #247 asked for.\n\nVerified: helm lint clean; kubeconform -strict passes on k8s 1.25/1.31/1.36\nacross default values and all 19 .ci/clusters configs, with and without node\naffinity set on every component (120 combinations), plus both\ntemplates-all-values renders at 1.36.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n\n* Cover standalone nodeAffinity in CI\n\nThe all-values runs keep standalone disabled, so standalone-deployment.yaml\u0027s\nnodeAffinity passthrough was the only one CI never rendered. Set it in\nvalues-standalone.yaml, which is both kubeconform-validated and installed on\nkind, using terms that every kind node satisfies.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Monica Magoni \u003cmonica.magoni@comelit.it\u003e\nCo-authored-by: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\nCo-authored-by: Lari Hotari \u003clhotari@apache.org\u003e" }, { "commit": "72cbd61c2567a774027ac7b706e18d9c1aa8605b", "tree": "a41c7f14d40a6e082e5209aa3bd7297451fe65e9", "parents": [ "c996fa2f013d0a1f57c54f1fe75385a7a6595a68" ], "author": { "name": "gulecroc", "email": "gu.lecroc@gmail.com", "time": "Tue Oct 06 20:50:27 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 21:50:27 2026 +0300" }, "message": "Certificates SANs FQDN (#713)\n\n* add sanMode to configure certs dns names\n\n* add sanMode fqdn autoscaling\n\n* sanMode none wording\n\n* fix certs fqdn when component name is renamed\n\n* re-work + add tests\n\n* doc sanMode modification need pod restart\n\n* Use headless service names for function worker and standalone FQDN SANs\n\nIn fqdn mode, the function worker per-pod SANs used the ClusterIP\nservice name, but the function worker StatefulSet publishes pod DNS\nrecords under its headless service. The standalone pod\u0027s advertised\nname (\u003ccomponent\u003e.\u003cstandalone headless service\u003e) wasn\u0027t included at all.\n\nBuild the per-pod names from the headless service for function_worker\nand standalone, and add the standalone pod\u0027s FQDN in fqdn mode.\nWildcard and none mode output is unchanged.\n\n---------\n\nCo-authored-by: glecroc \u003cguillaume.lecroc@cnp.fr\u003e\nCo-authored-by: Lari Hotari \u003clhotari@apache.org\u003e" }, { "commit": "c996fa2f013d0a1f57c54f1fe75385a7a6595a68", "tree": "14a54626ca9ae2d7762b375e8f035c258fcc641a", "parents": [ "edaa7d6e4986b53a27bc795ce38daa50c13d1793" ], "author": { "name": "Robert Moucha", "email": "robert.moucha@gooddata.com", "time": "Tue Oct 06 20:48:16 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 21:48:16 2026 +0300" }, "message": "fix: don\u0027t render PodMonitor and HPA for disabled components (#717)\n\nThe PodMonitor (or VMPodScrape) for proxy, broker, bookkeeper and\nautorecovery was guarded only by `\u003ccomponent\u003e.podMonitor.enabled`, which\ndefaults to true, so it was rendered even when the component itself was\ndisabled via `components.*\u003dfalse`. This left scrape configs whose\nselectors match no pods: harmless to Prometheus, but permanent drift in\nGitOps setups and empty targets in dashboards.\n\n`proxy-hpa.yaml` and `broker-hpa.yaml` had the same missing guard. That\ncase is rarer, since it also requires `autoscaling.enabled\u003dtrue`, but the\nresult is worse: the HPA targets a StatefulSet that was never created, so\nthe controller sits at ScalingActive\u003dFalse / FailedGetScale and emits\nwarning events continuously.\n\nAdd the missing `components.*` condition to all six templates, keeping\nthe existing `standalone.enabled` checks. This matches what the zookeeper,\nfunction-worker and oxia pod monitors already do, and what every other\ntemplate belonging to these components already does.\n\nFixes #716\n\nCo-authored-by: Lari Hotari \u003clhotari@apache.org\u003e" }, { "commit": "edaa7d6e4986b53a27bc795ce38daa50c13d1793", "tree": "630a1b2f963d4cf3f8060b410632118be2dada3b", "parents": [ "6157a6b8b363b1dfb09b3e2c2ad1c61435001b05" ], "author": { "name": "Federico Laurianti", "email": "laurianti@gmail.com", "time": "Tue Oct 06 20:47:57 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 21:47:57 2026 +0300" }, "message": "Add job.podAnnotations for the pods created by the chart\u0027s Jobs (#722)\n\n* Add job.podAnnotations for the pods created by the chart\u0027s Jobs\n\n* Render job.podAnnotations in the all-values CI render\n\n---------\n\nCo-authored-by: Lari Hotari \u003clhotari@apache.org\u003e" }, { "commit": "6157a6b8b363b1dfb09b3e2c2ad1c61435001b05", "tree": "0f90f21dbf66a77e96c60eb3ef33296fa7fcbd2f", "parents": [ "b4cb947c000191d9825f50e029a2f601d33e7982" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Tue Oct 06 12:58:39 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 20:58:39 2026 +0300" }, "message": "Upgrade default Apache Pulsar version to 5.0.0 (#723)" }, { "commit": "b4cb947c000191d9825f50e029a2f601d33e7982", "tree": "7542f4f873f63e272c5fc32d2f76b1f275915854", "parents": [ "e5ebe7eacc1e8f3247421b5f418155727c151ae9" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Tue Oct 06 12:57:11 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 06 20:57:11 2026 +0300" }, "message": "[improve][ci] Upgrade approved actions, check the ASF allowlist and fix the cert-manager version in CI (#720)" }, { "commit": "e5ebe7eacc1e8f3247421b5f418155727c151ae9", "tree": "1e53ee871901ef41ef1a983d9b62e4f6d995b7b8", "parents": [ "6053d295e037f050cbd41675a53b7b8ce66baf2d" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Fri Oct 02 18:47:13 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 03 02:47:13 2026 +0300" }, "message": "Remove Pulsar Manager support from the chart (#718)\n\nPulsar Manager is no longer maintained and isn\u0027t supported by this Helm chart.\nPlease see https://github.com/apache/pulsar-manager#apache-pulsar-manager-no-longer-maintained\nand https://pulsar.apache.org/docs/administration-ui/ for replacements.\nThe Pulsar Helm chart supports Dekaf as a replacement.\n\nDrop the component from the chart and fail fast with a migration message\nwhen it is still enabled so that the removal is explicit instead of silently\ndropping deployed resources.\n\nRemoved:\n- the pulsar-manager StatefulSet, Services, ConfigMap, Ingress, admin Secret\n and the pulsar-manager-init Job templates\n- the `pulsar_manager` values section, `images.pulsar_manager`,\n `components.pulsar_manager` and the `auth.superUsers.manager` role\n- the Pulsar Manager CI job, values files and helm.sh test function\n\nAdded `pulsar-manager-removed-validation.yaml`, which fails the render when\n`components.pulsar_manager` is truthy and points users at Dekaf, the supported\nweb UI in this chart.\n\nREADME.md documents the removal under \"Upgrading to Helm chart version 4.8.0\",\nincluding that the `components.pulsar_manager` key must be removed or set to\nfalse before upgrading, and how to migrate to Dekaf." }, { "commit": "6053d295e037f050cbd41675a53b7b8ce66baf2d", "tree": "5ba58ccf883ba1db68515a37de8986bf9f59f512", "parents": [ "328846044c8e1df50399c28bc63887696b6d58dc" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Sep 07 17:52:17 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 07 07:52:17 2026 -0700" }, "message": "Upgrade to Oxia 0.16.10 (#719)" }, { "commit": "328846044c8e1df50399c28bc63887696b6d58dc", "tree": "d05c1644907256a2fade0ad125657576ea358c2e", "parents": [ "44a31f22f1dd20863864f985970c4b9c9a7eaade" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Fri Jul 17 01:19:02 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 17 01:19:02 2026 +0300" }, "message": "Test with k8s 1.36.1 and certmanager 1.21.0 in CI (#710)" }, { "commit": "44a31f22f1dd20863864f985970c4b9c9a7eaade", "tree": "fdee4fa2a0ae7d76143e7ee3e8302b9a2000b980", "parents": [ "914bccfbd5a0be7a272d5ad767b39c5cbcf840b5" ], "author": { "name": "Dejan Zele Pejchev", "email": "pejcev.dejan@gmail.com", "time": "Wed Jul 15 11:33:57 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 15 12:33:57 2026 +0300" }, "message": "Keep the internal CA private key across renewals with cert-manager 1.18+ (#709)\n\nSigned-off-by: Dejan Zele Pejchev \u003cpejcev.dejan@gmail.com\u003e" }, { "commit": "914bccfbd5a0be7a272d5ad767b39c5cbcf840b5", "tree": "7fd1f2523216fa4b73a32a53b7e7c24f2385a6f6", "parents": [ "de7be31eade0ca0868a9286ab9ccbb1ec39f2d14" ], "author": { "name": "ptemarvelde", "email": "45282601+ptemarvelde@users.noreply.github.com", "time": "Fri Jul 10 15:42:51 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 10 16:42:51 2026 +0300" }, "message": "Use pulsar.zookeeper.connect template in bookkeeper cluster initialize command. (#707)\n\nUsed pulsar.fullname appended with zookeeper name before which does not account for TLS port numbers." }, { "commit": "de7be31eade0ca0868a9286ab9ccbb1ec39f2d14", "tree": "e8f80db64de5aff7819324e8248ad87bc40f1445", "parents": [ "8f5259dcd501de803e52098ce1aaac15f88c82a2" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Tue Jul 07 14:03:30 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Tue Jul 07 14:03:30 2026 +0300" }, "message": "Chart: Bump version to 4.7.0\n" }, { "commit": "8f5259dcd501de803e52098ce1aaac15f88c82a2", "tree": "dbbc13ab22bd63a135222e8fefe27a6fc533c95b", "parents": [ "1966092393ab5d8fdbdd431832fc464e66702e5d" ], "author": { "name": "yusufdaud-anaplan", "email": "yusuf.daud@anaplan.com", "time": "Tue Jul 07 12:02:00 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jul 07 14:02:00 2026 +0300" }, "message": "fix: omit empty broker clusterIP to avoid GitOps drift (#702)" }, { "commit": "1966092393ab5d8fdbdd431832fc464e66702e5d", "tree": "6361532070302cd0a0f1f437f94d6517934ab1d0", "parents": [ "2c515fce41303440d416fdd8c8da0337d3fcb1c2" ], "author": { "name": "yusufdaud-anaplan", "email": "yusuf.daud@anaplan.com", "time": "Tue Jul 07 11:33:48 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jul 07 13:33:48 2026 +0300" }, "message": "fix: always use policy/v1 for PodDisruptionBudget templates (#703)" }, { "commit": "2c515fce41303440d416fdd8c8da0337d3fcb1c2", "tree": "c1e6d2aa4631a8483cfc42a0b3b7f487d7253bd9", "parents": [ "29f357cdccdbf9b1c9f10a81bdc16af60d3d1b08" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Tue Jul 07 00:48:39 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jul 07 00:48:39 2026 +0300" }, "message": "Use Pulsar 4.0.12 image by default (#704)" }, { "commit": "29f357cdccdbf9b1c9f10a81bdc16af60d3d1b08", "tree": "0960abf2047a87c73d3440523609fdf285b077a7", "parents": [ "d5624a8d46bcbb62ebc1c39ed7f8fe092256944b" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Jul 06 16:45:54 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 06 16:45:54 2026 +0300" }, "message": "Improve CI stability: make kubeconform schema validation resilient to transient download failures (#705)\n\nThe chart-testing lint job intermittently fails when kubeconform cannot\ndownload schemas from raw.githubusercontent.com (throttling of GitHub\nActions runners). Each kubeconform invocation re-downloaded the same\nschemas, ~21 values files x 10 k8s versions per run.\n\n- cache downloaded schemas with kubeconform\u0027s -cache option so each\n schema is downloaded at most once per run\n- persist the schema cache across runs with actions/cache\n- retry kubeconform up to 5 times when the failure is a schema download\n error; cached schemas are not re-downloaded on retry, and genuine\n validation failures fail immediately without retrying\n- render helm template output to a file so validation can be retried\n without re-running helm" }, { "commit": "d5624a8d46bcbb62ebc1c39ed7f8fe092256944b", "tree": "d674888cba2d0c3d7ab0ccd121ed4bbf41f9e22c", "parents": [ "653bb7513bef91612bea470bfa7ad22947656562" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Sat Jun 27 00:05:32 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jun 27 00:05:32 2026 +0300" }, "message": "Add standalone function-worker component (split the worker out of the broker) (#698)" }, { "commit": "653bb7513bef91612bea470bfa7ad22947656562", "tree": "9f0cafd32e2240e5bcaa9f462d35d5b77a824bdc", "parents": [ "f76de2e3efffb56beb99a8819587771f3864d673" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Thu Jun 25 23:36:30 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 25 23:36:30 2026 +0300" }, "message": "Add CI scenario: Pulsar v5 with Oxia and Pulsar Functions (#699)" }, { "commit": "f76de2e3efffb56beb99a8819587771f3864d673", "tree": "5592f2a2eae4ab7bb0f0eb5c899b27b408b0ea78", "parents": [ "a34b236df9546e52945f5abe672dff3aa3b39b07" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Thu Jun 25 22:57:31 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 25 22:57:31 2026 +0300" }, "message": "Add broker FileSystemPackagesStorage support for Functions on Oxia (#697)" }, { "commit": "a34b236df9546e52945f5abe672dff3aa3b39b07", "tree": "34ec49ddf3477f8a6f7ef3565655178039cf8d90", "parents": [ "4b0b4836adff5b94b05f8af9b677e7577599dc55" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Wed Jun 24 15:53:02 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 24 15:53:02 2026 +0300" }, "message": "Oxia: add oxia.server.walSyncData to optionally disable WAL fsync (#696)\n\nAdd an `oxia.server.walSyncData` value (default \"true\"). When the key is\npresent and set to false, the oxia server StatefulSet passes\n`--wal-sync-data\u003dfalse` so WAL data is not fsynced to disk after each write.\n\nThe flag is only emitted when the key exists and is explicitly false (string\nor boolean), so sync data cannot be turned off accidentally by an unset or\ndefault value. The flag name matches the oxia 0.16.7 CLI (`--wal-sync-data`,\na pflag boolean, hence the `\u003dfalse` form).\n\nAlso enable it in examples/values-disable-fsync.yaml and document it there and\nin examples/README.md alongside the BookKeeper and ZooKeeper fsync toggles." }, { "commit": "4b0b4836adff5b94b05f8af9b677e7577599dc55", "tree": "86177f546ab3eb4b6599cb15d81c338d7f44e350", "parents": [ "bcdbeef817520c0c68aa0b34d4689cbc169d2e00" ], "author": { "name": "Máté Tallósi", "email": "22976308+tallosim@users.noreply.github.com", "time": "Wed Jun 24 14:39:09 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jun 24 15:39:09 2026 +0300" }, "message": "Fix authentication examples, by enabling JWT. (#695)" }, { "commit": "bcdbeef817520c0c68aa0b34d4689cbc169d2e00", "tree": "86177f546ab3eb4b6599cb15d81c338d7f44e350", "parents": [ "3d7ae323ea7ba37f8195097902000d18c7f5af4d" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 15:12:33 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 15:13:51 2026 +0300" }, "message": "Examples: update README for fsync/disk-cleanup examples and testing removal\n\n- Add a row for the new values-disable-fsync.yaml example.\n- Drop the values-testing.yaml row (the file was removed) and the now-dead\n cross-reference to it from the faster-disk-cleanup row.\n- Expand the values-faster-disk-cleanup.yaml description to match the broader\n set of BookKeeper GC/compaction, disk-utilization and journal settings.\n- Note the single-node Oxia sizing now included in values-one-node.yaml.\n" }, { "commit": "3d7ae323ea7ba37f8195097902000d18c7f5af4d", "tree": "a26bee270d98b5f96fa59d45b33bca6792cca580", "parents": [ "d28440fb5ac7b5d1358e68042fffba1d595f1d3d" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 15:09:04 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 15:13:51 2026 +0300" }, "message": "Add example for disabling fsync\n" }, { "commit": "d28440fb5ac7b5d1358e68042fffba1d595f1d3d", "tree": "318f8dd488b24c9dc98fef5b12192948ef246917", "parents": [ "0b15145e369cb57aa0d7409c65a6a3eae9fd6982" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 14:58:47 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 15:13:51 2026 +0300" }, "message": "Remove tuning for oxia in values-one-node.yaml\n" }, { "commit": "0b15145e369cb57aa0d7409c65a6a3eae9fd6982", "tree": "c41367562e145e774e937789b4426c0c9689c483", "parents": [ "fce2efd7f4d7a732216d624b3d8bcfde9de998d1" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 14:58:32 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 15:13:51 2026 +0300" }, "message": "remove values-testing.yaml\n" }, { "commit": "fce2efd7f4d7a732216d624b3d8bcfde9de998d1", "tree": "6756bbb92393c602414505bd72218debe9eb2bd0", "parents": [ "626bcecc53363506b6ad13eed8e08f996f8b0f18" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 14:26:08 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 15:13:51 2026 +0300" }, "message": "Add example of faster disk cleanup\n" }, { "commit": "626bcecc53363506b6ad13eed8e08f996f8b0f18", "tree": "7a31597556abdf17d94e6d4d2c2e63715ad96af6", "parents": [ "576d2af4c0f8a8618911de39356c78c1a6279191" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 14:14:37 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 14:14:37 2026 +0300" }, "message": "Add one node oxia settings\n" }, { "commit": "576d2af4c0f8a8618911de39356c78c1a6279191", "tree": "5f3681a5c98dc1ebf4855ac5790499c505627ae1", "parents": [ "6cf249672ceb550e361ac7b9492a477f278c5ac1" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 14:13:08 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 14:13:08 2026 +0300" }, "message": "Add comment to correct location\n" }, { "commit": "6cf249672ceb550e361ac7b9492a477f278c5ac1", "tree": "cefe5c5033bbcbb9c1c6552a8cda9eb30daed8e3", "parents": [ "5e534870fe3327100c3ce89363020c03f32a9201" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 14:11:22 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 14:11:22 2026 +0300" }, "message": "Docs: align top-level README with examples/README and fix fence bug\n\n- Reference `helm show values` and the examples/ directory from the configure\n step, matching the examples README.\n- Note that example files are composable and document the merge-values.sh\n helper in the \"Customize the deployment\" section.\n- Point the Dekaf section at the example values files that enable it.\n- Fix an unclosed ```yaml fence in the disable-monitoring section that made the\n rest of that section render as one code block.\n" }, { "commit": "5e534870fe3327100c3ce89363020c03f32a9201", "tree": "3c4d232a50043fe08845bb5f5cec460435e4545f", "parents": [ "541ef90c9e046614732a98cbb694fd6ee4397504" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 14:07:25 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 14:07:25 2026 +0300" }, "message": "Examples: sync README descriptions with values-oxia and values-testing\n\nReflect two changes that landed after the descriptions were written:\n- values-oxia.yaml now disables Pulsar Functions (BookKeeper package storage\n still requires ZooKeeper).\n- values-testing.yaml no longer sets a Grafana admin password.\n" }, { "commit": "541ef90c9e046614732a98cbb694fd6ee4397504", "tree": "d8878b869d61261a19ca5c3bfc42a2a46b6e6f60", "parents": [ "74d43c91c99846412c3485015ed313868aa374b8" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 14:03:19 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 14:03:19 2026 +0300" }, "message": "Remove password from values-testing\n" }, { "commit": "74d43c91c99846412c3485015ed313868aa374b8", "tree": "3ddcbb30b5bab62278a85cae3e089dfc0a7de4c3", "parents": [ "b97508adf12defb779f86f5ba22b19fade3331b5" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 14:01:20 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 14:01:20 2026 +0300" }, "message": "Disable functions for oxia since BookKeeperPackagesStorage requires Zookeeper\n" }, { "commit": "b97508adf12defb779f86f5ba22b19fade3331b5", "tree": "b47043e00b68f14595605842865ad5214037c442", "parents": [ "26cd1500987f8519fbe563798266da3dd493d764" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 13:44:08 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 13:44:08 2026 +0300" }, "message": "Examples: add merge-values.sh helper and expand examples README\n\nAdd examples/merge-values.sh, which deep-merges multiple Helm values files\n(later files win, the same precedence as repeated `helm -f`) into a single\nfile on stdout using yq, stripping the leading license header. It supports a\n--download/-d flag that fetches the named files from the examples directory on\nthe master branch with curl, so it can run without a checkout, and prints\ninstall guidance if yq (or curl) is missing.\n\nDocument the script in examples/README.md and add a \"Finding all available\nvalues\" section pointing to `helm show values apachepulsar/pulsar` and the\nmaster values.yaml. Also fix the chart reference to use the canonical\napachepulsar/pulsar Helm repo alias.\n" }, { "commit": "26cd1500987f8519fbe563798266da3dd493d764", "tree": "f01b587938aa7d2a4687ad50a0335d379e25c17d", "parents": [ "c9076387b413e2d4eb20ef3d6aaf3bf141e85f32" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 13:25:04 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 13:25:04 2026 +0300" }, "message": "Examples: use in-chart JWT secret generation in the JWT examples\n\nEnable auth.authentication.jwt.generateSecrets so the chart mints the JWT\nsigning key and per-superuser tokens via a pre-install/pre-upgrade hook job,\nremoving the need to run prepare_helm_release.sh before installing.\n\nAlso set jwt.enabled: true (required to actually activate JWT auth and the\ngeneration job) and drop the deprecated auth.authentication.provider setting.\nThe previous examples set provider: \"jwt\" but never set jwt.enabled, so they\nrendered a cluster with no JWT auth wired in.\n\nUpdate the examples README to describe the in-chart generation workflow.\n" }, { "commit": "c9076387b413e2d4eb20ef3d6aaf3bf141e85f32", "tree": "096ff68299e912c485c50f65bb2237df067b66c0", "parents": [ "bf9cb8455b95ff3fd13d682bcef648e4264ca783" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 13:01:01 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Wed Jun 24 13:01:01 2026 +0300" }, "message": "Examples: document values files, keep persistence, switch UI to Dekaf\n\n- Add examples/README.md describing each example values file, grouped by\n category, with usage/composition notes.\n- Stop disabling persistence in the Minikube example so data survives pod\n restarts; drop the no-longer-needed autoSkipNonRecoverableData override.\n- Add a clear data-loss warning to values-no-persistence.yaml, the one\n deliberate ephemeral example.\n- Replace pulsar-manager with the Dekaf UI in the examples that enabled a\n management UI (local-cluster, minikube, init-containers).\n- Fix the broken values-tls.yaml link in the top-level README and point to\n the new examples index.\n" }, { "commit": "bf9cb8455b95ff3fd13d682bcef648e4264ca783", "tree": "e31ec2c091b7c86280b1d4a0f5ff7f8f08e9253a", "parents": [ "647d6cdcf27aee7325ebb597738076bf7502c996" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Tue Jun 09 10:15:37 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Tue Jun 09 10:15:37 2026 +0300" }, "message": "Chart: Bump version to 4.6.1\n" }, { "commit": "647d6cdcf27aee7325ebb597738076bf7502c996", "tree": "df04dfae03442808ebeb72c47a32b7dfb3ee658c", "parents": [ "23468c0c849eb863a8bde46d27e9ede6489c2b29" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Tue Jun 09 10:12:42 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 09 10:12:42 2026 +0300" }, "message": "Upgrade appVersion to 4.0.11 to use Pulsar 4.0.11 image by default (#692)" }, { "commit": "23468c0c849eb863a8bde46d27e9ede6489c2b29", "tree": "da0bf6ea26d8e6f317f0c650f25319e695de5ae9", "parents": [ "2efecd36483ba31103b3a965f2d82e3bd92fcde0" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Tue Jun 09 10:12:30 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 09 10:12:30 2026 +0300" }, "message": "Upgrade to Oxia 0.16.7 (#693)" }, { "commit": "2efecd36483ba31103b3a965f2d82e3bd92fcde0", "tree": "1c9fe8dd62fe27b4977cb2f945576642f49d7c62", "parents": [ "1aee88fec214e0206ddca6482be2505e3d30ea82" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Sun Jun 07 23:39:17 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Jun 07 23:39:17 2026 +0300" }, "message": "Upgrade Oxia to 0.16.6 (#691)" }, { "commit": "1aee88fec214e0206ddca6482be2505e3d30ea82", "tree": "0d37d5ea36249ae178ada2421157fd1d3782c194", "parents": [ "315cb8cfcc7a62fbdf8bb33494813bff171e0dc7" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Sun May 31 19:48:20 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun May 31 19:48:20 2026 +0300" }, "message": "Upgrade Oxia to 0.16.4 (#690)" }, { "commit": "315cb8cfcc7a62fbdf8bb33494813bff171e0dc7", "tree": "a797350bf71b1c1701f58e2bd6e064a761489861", "parents": [ "6b7ab04a41f28da725f3a81cd8ce56536ab96713" ], "author": { "name": "Frank J Kelly", "email": "frank@frankkelly.us", "time": "Wed May 27 03:02:33 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed May 27 10:02:33 2026 +0300" }, "message": "Add support for extra init command to Broker STS upgrade for Istio sidecar support. (#688)" }, { "commit": "6b7ab04a41f28da725f3a81cd8ce56536ab96713", "tree": "46ec29ecc7068043c62375c77feb2e9f8911b41a", "parents": [ "1ce9e804f0c90804d35e6451c1a57e1ed1401224" ], "author": { "name": "Shaun Becker", "email": "smbecker@gmail.com", "time": "Mon May 18 08:25:38 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon May 18 11:25:38 2026 +0300" }, "message": "Fix fully-qualified dns name (#686)\n\n* Fix fully-qualified dns name\n\n* Update ci tests to use fully-qualified DNS name\n\n* Retain wildcard certs so that hostname verification works for headless services used for BK, ZK and broker statefulset pods\n\n---------\n\nCo-authored-by: Lari Hotari \u003clhotari@apache.org\u003e" }, { "commit": "1ce9e804f0c90804d35e6451c1a57e1ed1401224", "tree": "81cf958dfe48f542177a65a23b561ba5ad715840", "parents": [ "5d3ca5510d1aedee5c1206ac8b1f5cfbddef8f10" ], "author": { "name": "The Apache Software Foundation", "email": "root-asf-gitbox-commits@apache.org", "time": "Mon May 18 01:06:34 2026 -0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon May 18 09:06:34 2026 +0300" }, "message": "Set up default protection ruleset for default and release branches (#687)" }, { "commit": "5d3ca5510d1aedee5c1206ac8b1f5cfbddef8f10", "tree": "baf46d8d3bf746f0f21735779ffca4eefae5443c", "parents": [ "f2a3a69dc903e9ba7a0ab852e8cbb1e755dbb09f" ], "author": { "name": "Daniel Kovacs", "email": "kovacsdanielhun@gmail.com", "time": "Mon May 04 15:51:02 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon May 04 16:51:02 2026 +0300" }, "message": "feat: added global labelselector feature for podmonitors (#402)\n\nCo-authored-by: Daniel Kovacs \u003cdaniel.kovacs@directed.global\u003e\nCo-authored-by: Lari Hotari \u003clhotari@apache.org\u003e" }, { "commit": "f2a3a69dc903e9ba7a0ab852e8cbb1e755dbb09f", "tree": "fe116ce617ae80f4f7db3bebc3f03492539117f4", "parents": [ "c8f74d7aa88aea239c549aebc91ba96fcb9e8704" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon May 04 16:28:05 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon May 04 16:28:05 2026 +0300" }, "message": "Add support for priorityClassName (#685)\n\nCo-authored-by: Ludwig Lauer \u003cludwig@tenjin.com\u003e" }, { "commit": "c8f74d7aa88aea239c549aebc91ba96fcb9e8704", "tree": "89086ab51f6f89012f6c45f454c1acbaaaba101b", "parents": [ "1c5782de0dcc887291a7f0d22dc8e36b5cb713cb" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon May 04 15:19:59 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon May 04 15:19:59 2026 +0300" }, "message": "Add CI step to validate helm template renders with all features enabled (#684)\n\nAdds .ci/templates-all-values.yaml (every optional feature on, with\nmulti-element lists and maps for every list/map-shaped value) and\n.ci/templates-all-values-patch1.yaml (overlay that flips\nmutually-exclusive choices: zookeeper -\u003e oxia, JWT symmetric -\u003e OpenID,\nselfsigning -\u003e ca issuer, multiVolumes -\u003e single common bookkeeper\nvolume, hard -\u003e soft anti-affinity, etc.). A new step in the ct-lint\njob renders both combinations with `helm template` and validates them\nwith `kubeconform -strict` against k8s 1.34.0.\n\nThis catches indent / `range` / `toYaml | nindent` bugs that no\nindividual scenario in .ci/clusters/ can surface on its own, since\neach existing scenario only enables one or two features at a time.\n\nAlso fixes two real bugs uncovered by writing the test:\noxia-coordinator-serviceaccount.yaml and oxia-server-serviceaccount.yaml\ntreated `images.imagePullSecrets` as an object with `.secretName`,\nbut per the schema in values.yaml and the `pulsar.imagePullSecrets`\nhelper, it is a list of secret-name strings. Both files now use the\nshared helper and template-error no longer when the field is set." }, { "commit": "1c5782de0dcc887291a7f0d22dc8e36b5cb713cb", "tree": "66030e3d28cf09dd52fdfbfc3707c2d7f6244461", "parents": [ "8d69259ef29e3a7147a6c8f2d41600ee9daa3cdd" ], "author": { "name": "jvellaft", "email": "johann.vella@fosh.tech", "time": "Mon May 04 13:31:57 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon May 04 14:31:57 2026 +0300" }, "message": "Fix nodeSelector and tolerations handling in pulsar-manager-cluster-initialize.yaml (#683)\n\nFixes #681" }, { "commit": "8d69259ef29e3a7147a6c8f2d41600ee9daa3cdd", "tree": "b088486cc05e9cd71763883d6e4c870b99843daa", "parents": [ "cd251fb90ad8da7c99acdead2810745d8e973d11" ], "author": { "name": "jvellaft", "email": "johann.vella@fosh.tech", "time": "Mon May 04 13:31:28 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon May 04 14:31:28 2026 +0300" }, "message": "Fix nodeSelector and tolerations handling in dekaf-deployment.yaml (#682)\n\nFixes #681" }, { "commit": "cd251fb90ad8da7c99acdead2810745d8e973d11", "tree": "1a7e2858ed0f3a65561e258b64a580b610fda2f2", "parents": [ "51cd95ca1aa1e465e18dddb097efe5b5a655fac3" ], "author": { "name": "samkes", "email": "sam@samkes.net", "time": "Mon May 04 12:20:52 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon May 04 13:20:52 2026 +0300" }, "message": "Set FQDN to cluster domain instead of hard coded cluster.local (#680)" }, { "commit": "51cd95ca1aa1e465e18dddb097efe5b5a655fac3", "tree": "b642588f9b59aec8deaeb432617b18ac4c7dfc20", "parents": [ "8d490d43a2162e695290b9a184207ff840ef7ef2" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Thu Apr 30 22:03:12 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Thu Apr 30 22:03:12 2026 +0300" }, "message": "Update 4.6.0 upgrade notes\n" }, { "commit": "8d490d43a2162e695290b9a184207ff840ef7ef2", "tree": "5d024f14e4cdf3287b8235d6519112f41ba13182", "parents": [ "168b288ab743758e584e0a551f781da458dd53fb" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Apr 27 23:52:51 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Apr 27 23:52:51 2026 +0300" }, "message": "Chart: Bump version to 4.6.0\n" }, { "commit": "168b288ab743758e584e0a551f781da458dd53fb", "tree": "d137d9fbef2209996b8ddf4a938f82995e31eb0f", "parents": [ "05bcfe1c846d0a2b93d3c8b468167f15c5251697" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Apr 27 23:46:36 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Apr 27 23:46:36 2026 +0300" }, "message": "Upgrade Oxia to 0.16.3 (#678)\n\n* Upgrade Oxia to 0.16.3\n\n* Add allowExtraAuthorities configuration required by 0.16.3" }, { "commit": "05bcfe1c846d0a2b93d3c8b468167f15c5251697", "tree": "cb164a152504f0078c67cf45ad4a1f3ce8dd1ecb", "parents": [ "8b47d1eb659674424ad22fd92d7163e4535626c6" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Apr 27 17:42:59 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Apr 27 17:42:59 2026 +0300" }, "message": "Upgrade appVersion to 4.0.10 so that Pulsar 4.0.10 image is used by default (#677)" }, { "commit": "8b47d1eb659674424ad22fd92d7163e4535626c6", "tree": "02f833a8269b7407a9836ea7f4c9fade4db7fcb3", "parents": [ "608d62181747903f69d8cbf5e99a04eaabcb4b87" ], "author": { "name": "Ganesh Kalyan K", "email": "srikgk333@gmail.com", "time": "Mon Apr 27 13:33:37 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Apr 27 11:03:37 2026 +0300" }, "message": "fix: Improve Zookeeper initialization wait logic to support multi url configuration store (#671)\n\n* fix: Improve Zookeeper initialization wait logic to support multi url cs\n\n* Update charts/pulsar/templates/pulsar-cluster-initialize.yaml\n\n* fix: Add TLS settings and volume mounts for Zookeeper initialization\n\n---------\n\nCo-authored-by: Ganesh Kalyan Kommisetti \u003cgkommisetti@paypal.com\u003e" }, { "commit": "608d62181747903f69d8cbf5e99a04eaabcb4b87", "tree": "5458cd8d1902872986f361932fcd5565aa28dcf9", "parents": [ "a1fb8938dd0514c39c778a5f68524a9a24787d65" ], "author": { "name": "Shaun Becker", "email": "smbecker@gmail.com", "time": "Mon Apr 27 03:26:42 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Apr 27 10:26:42 2026 +0300" }, "message": "Update standalone defaults to use zookeeper (#675)\n\n* Update standalone defaults to use zookeeper\n\n* Move PULSAR_STANDALONE_USE_ZOOKEEPER to standalone-configmap.yaml\n\n---------\n\nCo-authored-by: Lari Hotari \u003clhotari@apache.org\u003e" }, { "commit": "a1fb8938dd0514c39c778a5f68524a9a24787d65", "tree": "67ba1429b9d0abf816bfe9649f33af0ff6fd62cf", "parents": [ "f18d0206e088ba2a1d6f68d5408d88592b6b52a1" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Sat Apr 25 23:18:59 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Apr 25 23:18:59 2026 +0300" }, "message": "Fix oxia coordinator RoleBinding roleRef.apiGroup to prevent GitOps drift (#676)\n\nThe empty `apiGroup: \"\"` was silently filled in by the Kubernetes API\nserver with `rbac.authorization.k8s.io`. GitOps tools like Pulumi and\nArgoCD detected the mismatch on every reconcile and tried to recreate\nthe RoleBinding. Because `roleRef` is immutable, this caused the\nbinding to be deleted and recreated on every deployment." }, { "commit": "f18d0206e088ba2a1d6f68d5408d88592b6b52a1", "tree": "1c9c834bf4654aa0c9b53e533b11d81f96e54315", "parents": [ "20febea0aed531f3c7d090ee9b70f5d7b0294ad4" ], "author": { "name": "Shaun Becker", "email": "smbecker@gmail.com", "time": "Fri Apr 24 09:26:54 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Apr 24 16:26:54 2026 +0300" }, "message": "Add support for deploying pulsar as standalone (#674)" }, { "commit": "20febea0aed531f3c7d090ee9b70f5d7b0294ad4", "tree": "15ed829c3873b64e9a729960af3909d0009dd509", "parents": [ "02b02e573d5cddf473b5790ac36c332f3e94e3e5" ], "author": { "name": "Shaun Becker", "email": "smbecker@gmail.com", "time": "Wed Apr 22 05:52:53 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Apr 22 12:52:53 2026 +0300" }, "message": "Add cert annotation configuration (#673)" }, { "commit": "02b02e573d5cddf473b5790ac36c332f3e94e3e5", "tree": "9726059df632c565954786deaea8f6e84f70ff70", "parents": [ "1cbf727f16224fbe0ba5846df85fb46cc5ffffcb" ], "author": { "name": "Shaun Becker", "email": "smbecker@gmail.com", "time": "Tue Apr 21 09:53:40 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Apr 21 16:53:40 2026 +0300" }, "message": "Add support for generating JWT secrets during install (#672)" }, { "commit": "1cbf727f16224fbe0ba5846df85fb46cc5ffffcb", "tree": "bb27d05cb37a1b6dddcf1cf9ea13e9302d8b5973", "parents": [ "3a6c811671d0631d814b44c2291eb7aad5dee887" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Tue Apr 21 09:57:59 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Tue Apr 21 09:57:59 2026 +0300" }, "message": "Fix CI: sync tune-runner-vm changes from apache/pulsar\n" }, { "commit": "3a6c811671d0631d814b44c2291eb7aad5dee887", "tree": "ca7ed73271fd614ba4dd6c537186ce8f0a6503c8", "parents": [ "215498ad9710779f3f19b4d2ad0b4166a1df09fc" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Tue Apr 21 09:39:50 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Tue Apr 21 09:43:47 2026 +0300" }, "message": "Replace go based license check with Apache RAT\n" }, { "commit": "215498ad9710779f3f19b4d2ad0b4166a1df09fc", "tree": "8bc6e25e6acef6ea17697da522564c548232357e", "parents": [ "f4f58efaa6d89d1093bc9b9246adcd1bbc5c4141" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Tue Apr 21 09:25:04 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Tue Apr 21 09:25:04 2026 +0300" }, "message": "Fix CI\n\n- pin azure/setup-helm to approved pinned hash\n- upgrade official GitHub actions\n" }, { "commit": "f4f58efaa6d89d1093bc9b9246adcd1bbc5c4141", "tree": "9e99e839f9f9f92c72e6c678f489ac537c26b8aa", "parents": [ "9273347d63567fe3041b454b51ed1ac9676d6cf4" ], "author": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Fri Apr 17 17:46:57 2026 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@apache.org", "time": "Fri Apr 17 17:46:57 2026 +0300" }, "message": "Add DeepWiki badge\n" }, { "commit": "9273347d63567fe3041b454b51ed1ac9676d6cf4", "tree": "b5b0f87b917709cc0a122d1bdf59a3b4adcd327b", "parents": [ "f9fe6c617d95b9da679d18f8416840d617b1b7e0" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Sat Mar 21 01:15:16 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Mar 21 01:15:16 2026 +0200" }, "message": "Enable TLS certificate file refresh for BookKeeper components by default (#669)\n\n* Enable TLS certificate file refresh by default when they get updated\n\n* Fix format" }, { "commit": "f9fe6c617d95b9da679d18f8416840d617b1b7e0", "tree": "aa60013ef2f7fd35a5e7cab0c763556f66f26ea5", "parents": [ "339d2d522195f3453bd0b70c7f2916324f9d48be" ], "author": { "name": "ankith-carver", "email": "98942109+ankith-carver@users.noreply.github.com", "time": "Fri Mar 20 12:11:35 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Mar 20 08:41:35 2026 +0200" }, "message": "Add support for ipAddresses in TLS certificate templates (#643)" }, { "commit": "339d2d522195f3453bd0b70c7f2916324f9d48be", "tree": "8a39b799f65ee67b05bdba9f54d754c45541b61b", "parents": [ "d4af990ff5b39bb89aaf25c9a39ee00ca0db6cfa" ], "author": { "name": "Darin Spivey", "email": "darinspivey@users.noreply.github.com", "time": "Fri Mar 20 02:41:12 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Mar 20 08:41:12 2026 +0200" }, "message": "fix: Add chart control for `updateStrategy` to brokers and proxies (#668)\n\nA user can control the `updateStrategy` for the pods of bookies and\nzookeeper. However, the values for brokers and proxies is hardcoded.\nBeing able to control this value via the Helm chart is crucial to being\nable to do smooth chart upgrades to a fully-running cluster. For\nexample, setting the strategy to `OnDelete` would allow a user to\ncontrol which order the pods are restarted after an upgrade.\n\nFixes: #667" }, { "commit": "d4af990ff5b39bb89aaf25c9a39ee00ca0db6cfa", "tree": "18bf5d63641d1826f8d872347da4454e03fafcf8", "parents": [ "800e18b420a3b3bf5ca6cd2f853f32ac34b9aa9f" ], "author": { "name": "Yuval Levy", "email": "yuvalle@armosec.io", "time": "Wed Mar 18 20:09:46 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Mar 18 20:09:46 2026 +0200" }, "message": "add support for custom annotations on initialization Jobs (#665)" }, { "commit": "800e18b420a3b3bf5ca6cd2f853f32ac34b9aa9f", "tree": "936e9724584ab857422ffcc614ad316ac476a027", "parents": [ "b46338289f420a175715478aaed4266d7012e6dd" ], "author": { "name": "frankgrimes97", "email": "frankgrimes97@yahoo.com", "time": "Wed Mar 18 18:09:24 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Mar 18 20:09:24 2026 +0200" }, "message": "Apply ShellCheck suggested fixes to pulsar Bash scripts (#663)\n\nShellCheck: https://github.com/koalaman/shellcheck\n\nAlso suppressed a few ShellCheck warnings where deemed necessary." }, { "commit": "b46338289f420a175715478aaed4266d7012e6dd", "tree": "078e2dca6288b2b38631d1c5a8c65bd8ba5b6ff8", "parents": [ "d7f19766dff5fa21cbefdc9c3f32e0d72ba3e8ac" ], "author": { "name": "soyji", "email": "114239936+soyji@users.noreply.github.com", "time": "Sat Mar 07 06:24:11 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Mar 07 08:24:11 2026 +0300" }, "message": "fix: remove usage of tty in generate_token.sh‎ to avoid introducing \\r (#661)" }, { "commit": "d7f19766dff5fa21cbefdc9c3f32e0d72ba3e8ac", "tree": "e45ffd36f007ea01b1521b390ebb7bf7426ec1b6", "parents": [ "becdc871b5af9791e97b81e433e1cce6269d8bcd" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Mar 02 14:43:32 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Mar 02 14:43:32 2026 +0200" }, "message": "Upgrade to Oxia 0.16.0 (#658)\n\n" }, { "commit": "becdc871b5af9791e97b81e433e1cce6269d8bcd", "tree": "b2d5eabf513b5c701fc7877f626f5bcf364bab2f", "parents": [ "e6861c85af059ae8741b121954b9bd14d4591b89" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Mar 02 14:43:10 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Mar 02 14:43:10 2026 +0200" }, "message": "Upgrade VictoriaMetrics to a supported version (#657)\n\n" }, { "commit": "e6861c85af059ae8741b121954b9bd14d4591b89", "tree": "77dc6d6b018280676ac78ca1854efc1435675017", "parents": [ "4d4a41ced9be311127163199f53fc37ae511c82e" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Mar 02 14:42:51 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Mar 02 14:42:51 2026 +0200" }, "message": "Fix CI failures with OpenID jobs (#659)\n\n* Fix waiting for upterm session to close\n\n* Upgrade k9s version used for ci debugging\n\n* Migrate to use https://artifacthub.io/packages/helm/codecentric/keycloakx for Keycloak in ci" }, { "commit": "4d4a41ced9be311127163199f53fc37ae511c82e", "tree": "2144181ee0fb693b5d7d4169228a8a011b0e043d", "parents": [ "71ba62418ee3f0c649f66dec573fb71ca794af3c" ], "author": { "name": "soyji", "email": "114239936+soyji@users.noreply.github.com", "time": "Tue Feb 24 15:44:37 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Feb 24 16:44:37 2026 +0200" }, "message": "fix: fix extra volumes indentation for rendering the helm chart properly (#656)\n\n" }, { "commit": "71ba62418ee3f0c649f66dec573fb71ca794af3c", "tree": "3eeb67471fb4860f18cc5a153fc017695fc177f1", "parents": [ "9730ba599bb770c16ae0f25f794b7ce4375290ac" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Tue Feb 24 13:16:49 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Feb 24 13:16:49 2026 +0200" }, "message": "Enable local sessions in ZK when readonly mode is enabled (#655)\n\n" }, { "commit": "9730ba599bb770c16ae0f25f794b7ce4375290ac", "tree": "83f1de61d528b1c3bd5a2239c322a51d7077c1f8", "parents": [ "d70d94fbe8e25ac57de24801384ac075595a100d" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Tue Feb 24 11:47:28 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Feb 24 11:47:28 2026 +0200" }, "message": "Prepare for 4.2.0 support: remove statsProviderClass config for bookkeeper (#654)\n\n" }, { "commit": "d70d94fbe8e25ac57de24801384ac075595a100d", "tree": "88444832b2d1af9a1b15ed410714c1dbf6b988d9", "parents": [ "dd879cf4576e6086480162d224803907fcf1944c" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Feb 23 23:41:50 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Feb 23 23:41:50 2026 +0200" }, "message": "Fix pulsar_metadata.metadataStoreAllowReadOnlyOperations with ZooKeeper (#653)\n\n- passing -Dreadonlymode.enable\u003dtrue was missing from ZooKeeper server command line\n- init containers for waiting ZK availability in broker / bookie startup were blocked by not enabling readonly mode on zookeeper-shell\n - pass \"-r\" on command line\n- note: bookkeeper server doesn\u0027t support configuring readonly ZK support\n- it\u0027s necessary to set pulsar_metadata.bookkeeper.usePulsarMetadataClientDriver to true to enable readonly mode for the bookkeeper client." }, { "commit": "dd879cf4576e6086480162d224803907fcf1944c", "tree": "f10b2f299465412cd13e1ba9042cbd9688105a6c", "parents": [ "85c72351322fe5698266ddd14e94f32e45e59ef0" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Feb 23 23:13:23 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Feb 23 23:13:23 2026 +0200" }, "message": "Revisit configurationMetadataStoreUrl and bookkeeperMetadataServiceUri settings (#652)\n\n- Set configurationMetadataStoreUrl only if it\u0027s different than metadataStoreUrl\n- Don\u0027t set bookkeeperMetadataServiceUri if usePulsarMetadataClientDriver\u003dtrue" }, { "commit": "85c72351322fe5698266ddd14e94f32e45e59ef0", "tree": "6ed70577478cc2e7b3c9ccabb8f138c4328840cc", "parents": [ "57e2aec5aaf1822afeac97bc9b0041cd300b08c6" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Sat Feb 21 14:34:39 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Feb 21 14:34:39 2026 +0200" }, "message": "Add separate headless service for brokers with publishNotReadyAddresses (#650)\n\n" }, { "commit": "57e2aec5aaf1822afeac97bc9b0041cd300b08c6", "tree": "4195d7bc5056f057d8513b43abd3525bd0ecdbfa", "parents": [ "88892724a6d2ee3d71d08828e68d4c3b1f93a179" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Sat Feb 21 00:19:21 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Feb 21 00:19:21 2026 +0200" }, "message": "Add separate headless service for ZooKeeper statefulset (#649)\n\n" }, { "commit": "88892724a6d2ee3d71d08828e68d4c3b1f93a179", "tree": "d2ce83a6e9f555109f1e034ab1c11164715d3283", "parents": [ "85d45fa26335bef0739597785b80195c26dcfc3c" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Thu Feb 19 23:46:57 2026 +0200" }, "committer": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Thu Feb 19 23:46:57 2026 +0200" }, "message": "Chart: Bump version to 4.5.0\n" }, { "commit": "85d45fa26335bef0739597785b80195c26dcfc3c", "tree": "3925c47360f89da4c419f30d6d0d98e85a9710eb", "parents": [ "cde7a1032e6ed4800d8352e3f8d9530e49773efd" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Thu Feb 19 23:45:05 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Feb 19 23:45:05 2026 +0200" }, "message": "Upgrade to Pulsar 4.0.9 (#648)\n\n- set appVersion to 4.0.9\n- fix broken CI with a workaround\n - Pulsar regression, which will be fixed by https://github.com/apache/pulsar/pull/25254" }, { "commit": "cde7a1032e6ed4800d8352e3f8d9530e49773efd", "tree": "1e222d4b01e474e580330f2198a92b5f5db72840", "parents": [ "d48410ad00608eda5ba939858ef9311b13e6b967" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Thu Feb 05 11:48:25 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Feb 05 11:48:25 2026 +0200" }, "message": "Upgrade to Oxia 0.15.3 (#647)\n\n" }, { "commit": "d48410ad00608eda5ba939858ef9311b13e6b967", "tree": "4fcf07079237fbe392bdb502546c42b6d01fe2b9", "parents": [ "8334f866ac988facedd5419e8d46b49265c3d60d" ], "author": { "name": "sinan liu", "email": "liusinan1998@gmail.com", "time": "Wed Jan 07 21:49:19 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jan 07 15:49:19 2026 +0200" }, "message": "Add support for BookKeeper indexDirectories configuration (#645)\n\n" }, { "commit": "8334f866ac988facedd5419e8d46b49265c3d60d", "tree": "cf7ae2001fc977bb1fea626b9e3a6d8fb676281f", "parents": [ "804192a2bd1bad6a6e69f04ec36f9259af2da782" ], "author": { "name": "Kiryl Valkovich", "email": "visortelle@gmail.com", "time": "Wed Jan 07 16:48:53 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jan 07 15:48:53 2026 +0200" }, "message": "Upgrade Dekaf UI to 1.1.0 (#646)\n\n" }, { "commit": "804192a2bd1bad6a6e69f04ec36f9259af2da782", "tree": "e9f1c94143687ccfd07f5fcc4ffbb0a6d3bb0683", "parents": [ "75b05057d5015746bfbd0952a643b17d30d73d46" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Dec 15 19:21:39 2025 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Dec 15 19:21:39 2025 +0200" }, "message": "Upgrade Oxia to 0.15.1 (#641)\n\n* Upgrade Oxia to 0.15.1\n\n* Add access to coordination k8s api" }, { "commit": "75b05057d5015746bfbd0952a643b17d30d73d46", "tree": "11682d369437a163a6416641af0e15bb39ecc41e", "parents": [ "0fc174ba3edcdc143f470b307d79dc8626b97f1e" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Dec 15 17:06:47 2025 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Dec 15 17:06:47 2025 +0200" }, "message": "Fix ssh-access to CI in forks (#644)\n\n" }, { "commit": "0fc174ba3edcdc143f470b307d79dc8626b97f1e", "tree": "1b77fd1a24de71ed619d3db0ea07e9825b42bdea", "parents": [ "c341e7d65d8d351adc1f866acc2bf67c51a96b5c" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Dec 08 20:19:02 2025 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Dec 08 20:19:02 2025 +0200" }, "message": "Increase max heap size from 64m -\u003e 128m for proxy and autorecovery (#642)\n\n" }, { "commit": "c341e7d65d8d351adc1f866acc2bf67c51a96b5c", "tree": "0060c9c4c24e9be786013e6ccea5ae7242b84e40", "parents": [ "a1953762c7ec794c6d70cd1829b44e569283f6ed" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Nov 17 11:52:25 2025 +0200" }, "committer": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Nov 17 11:52:25 2025 +0200" }, "message": "Chart: Bump version to 4.4.0\n" }, { "commit": "a1953762c7ec794c6d70cd1829b44e569283f6ed", "tree": "e3f7de7bbf0167dcc0decc6f73e0b239eb92d152", "parents": [ "f8333e5df5205cd60e74d7c94123411971ac6500" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Mon Nov 17 11:49:57 2025 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Nov 17 11:49:57 2025 +0200" }, "message": "Upgrade to Pulsar 4.0.7 (#640)\n\n" }, { "commit": "f8333e5df5205cd60e74d7c94123411971ac6500", "tree": "b7b5e6165160e09a9a59abeeb545f59c757d4c1a", "parents": [ "fce102b7303195df3c0418ea6acc58c837906487" ], "author": { "name": "Kiryl Valkovich", "email": "visortelle@gmail.com", "time": "Tue Nov 04 23:08:06 2025 +0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Nov 04 23:08:06 2025 +0400" }, "message": "Fix broken link" }, { "commit": "fce102b7303195df3c0418ea6acc58c837906487", "tree": "b0dc1f7dfa6799480120ae25dcc84508c7b92b41", "parents": [ "dc034a89c26e73b4cf337c0c8dd4b790170dea7e" ], "author": { "name": "Kiryl Valkovich", "email": "visortelle@gmail.com", "time": "Mon Nov 03 17:47:12 2025 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Nov 03 18:47:12 2025 +0400" }, "message": "Minor README improvements (#638)\n\n" }, { "commit": "dc034a89c26e73b4cf337c0c8dd4b790170dea7e", "tree": "86f6e04daa886aa0eb1468f62f6cddbf2d0a9ead", "parents": [ "e9f7f1d2285e2795961bc6a9b18dfc12c9ef9c85" ], "author": { "name": "Kiryl Valkovich", "email": "visortelle@gmail.com", "time": "Mon Nov 03 13:48:59 2025 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Nov 03 12:48:59 2025 +0200" }, "message": "Initial Dekaf UI support (#637)\n\n" }, { "commit": "e9f7f1d2285e2795961bc6a9b18dfc12c9ef9c85", "tree": "eed94396c9c2a0dae26c82ae2f04cd4777eb4cb5", "parents": [ "b45e0d7a9dea460532adfee57903a1feadeb7303" ], "author": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Sat Sep 27 15:41:14 2025 +0300" }, "committer": { "name": "Lari Hotari", "email": "lhotari@users.noreply.github.com", "time": "Sat Sep 27 15:41:14 2025 +0300" }, "message": "Chart: Bump version to 4.3.0\n" } ], "next": "b45e0d7a9dea460532adfee57903a1feadeb7303" }