Crossplane v2.3.0
breakingsecurity+++++++++~-***!!!!!
Changes
- !Github.com/crossplane/crossplane/apis/v2 is now a separate Go module from the rest of Crossplane. This was necessary in order to move the Crossplane CLI out of core and into its own repository.other / breaking
- !External consumers of Crossplane APIs should update their dependencies from github.com/crossplane/crossplane/v2/apis to github.com/crossplane/crossplane/apis/v2.other / breaking
- !The common APIs from crossplane-runtime have moved to github.com/crossplane/crossplane/apis/v2/core.other / breaking
- !V1 and v2 of the common APIs have been collapsed into a single v2 package. The old v1.Resource* types are now v2.ClusterManagedResource* to differentiate them from v2.ManagedResource*, which are the namespaced versions.other / breaking
- !A complete guide on how to update your provider source code to use these types can be found in the section below.other / breaking
- !The Crossplane CLI (formerly crank) has moved into its own repository, and will be released separately from Crossplane core going forward.other / breaking
- !A v2.3.0 release of the CLI coincides with this Crossplane core v2.3.0 release and has been dual published to the typical release location on releases.crossplane.io to help ease the transition. After the v2.3.0 release, version numbers and release schedules will diverge as the Crossplane CLI will have its own independent release schedule. Learn more and provide feedback inother / breaking
- !Commands have been re-organized into a noun-first tree.other / breaking
- !Alpha and beta commands that previously lived in the crossplane alpha and crossplane beta trees have moved into the main tree.other / breaking
- !Example: crossplane beta trace is now crossplane resource traceother / breaking
- !See full release CLI notes (including full details on these breaking changes):other / breaking
- Update module github.com/cloudflare/circl to v1.6.3 [security] (main)security
63 more lines
- Update module google.golang.org/grpc to v1.79.3 [security] (main)security
- Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [security] (main)security
- Update module github.com/go-git/go-git/v5 to v5.17.1 [security] (main)security
- Update module github.com/go-jose/go-jose/v4 to v4.1.4 [security] (main)security
- Update module github.com/sigstore/cosign/v3 to v3.0.5 [security] (main)security
- Update module github.com/docker/cli to v29.2.0+incompatible [security] (main)security
- Update module github.com/sigstore/timestamp-authority/v2 to v2.0.6 [security] (main)security
- Bump Go to 1.25.9 [security]security
- Update module github.com/moby/spdystream to v0.5.1 [security] (main)security
- Update module github.com/go-git/go-git/v5 to v5.18.0 [security] (main)security
- Update module github.com/in-toto/in-toto-golang to v0.11.0 [security] (main)security
- Update module golang.org/x/net to v0.53.0 [security] (main)security
- Remove Hyland Software from ADOPTERS.mdremoved
- Remove crankremoved
- Apis: Make apis a separate go modulechanged
- High-fidelity render engine: crossplane render now drives the real composite reconciler via a new hidden crossplane internal render subcommand, instead of maintaining a parallel reimplementation. The output of crossplane render (and downstream tools like crossplane-diff) now matches what would actually happen in-cluster, eliminating differences between local rendering and real reconciliation. By default it pulls the Crossplane container image to run the reconcile, so a separate controller binary is not required. See #7280 and #7339.added
- Provider deletion protection: A new alpha feature automatically protects Provider packages from accidental deletion while instances of their managed resources still exist. When --enable-provider-deletion-protection is set, Crossplane will automatically create ClusterUsage resources that block Provider deletion through the existing Usage webhook.added
- Per-resource reconciliation control: Two new annotations give users fine-grained control over when individual resources reconcile. crossplane.io/poll-interval overrides the controller-level poll interval for a specific resource (e.g. "24h", "30m"), and crossplane.io/reconcile-requested-at triggers an immediate reconciliation when its value changes. This works immediately for XRs, but requires providers to release a new version based on crossplane-runtime v.2.3.0 to gain this behavior for their managed resourcesadded
- Composition functions can now select all resources of a given kind: When a composition function returned a Requirements.ResourceSelector with only apiVersion and kind set (no matchName or matchLabels), Crossplane previously rejected this as an invalid request. A selector with no match field is now correctly interpreted as "all resources of that kind".added
- Scale subresource for XRs: CompositeResourceDefinition can now configure the scale subresource on the XRs it defines, so composite resources can be scaled with kubectl scale and other standard tooling.added
- Other notable improvements:added
- Improved docker network configuration support for crank render: A new render.crossplane.io/runtime-docker-network annotation on Function resources tells the Docker runtime which network function containers should join. This makes crossplane render work inside container jobs (such as GitHub Actions container jobs) where the default bridge network is unreachable from the caller.added
- CommonAnnotations in compositions: Compositions can now propagate a set of common annotations to every composed resource, mirroring the existing commonLabels behavior.added
- Crossplane beta validate now correctly resolves and caches dependencies that use semantic version ranges (e.g. ">=v0.6.0,<v1.0.0"), and adds an --update-cache flag to always check upstream for newer matching versions.added
- Crossplane beta trace adds a YAML output format.added
- The XR circuit breaker now resets its state when the XR is deleted, so a new resource with the same name starts fresh instead of inheriting an open circuit.added
- CompositionRevision and composite reconcilers now skip no-op status updates, eliminating an unnecessary reconcile loop that prevented steady state convergence.added
- Add WG to adoptersadded
- Add a warning message for when a resource's namespace is overwrittenadded
- Add sig-prod-readinessadded
- Add render.crossplane.io/runtime-docker-network annotationadded
- Support ResourceSelector with no match fieldadded
- Implement commonAnnotationsadded
- Adopters: add T-Systems International GmbH to adopters listadded
- Allow XRDs to configure the scale subresourceadded
- Add YAML output format to crossplane beta traceadded
- Add UpToDate conditionadded
- Add high-fidelity render engineadded
- Add per-resource poll interval and reconcile-now annotationsadded
- Design: Add a design document for developer experience toolingadded
- Add per-service template vars for xpkg batchadded
- Protect Providers from deletion via ClusterUsageadded
- Adding required permissions to top level and jobs in the workflowfixed
- Xpkg push respects proxy environment variablesfixed
- Include resource kind, name, namespace in trace get errorsfixed
- Get all resources when requiredResources matchLabels is emptyfixed
- Set standard file permissions on Nix-built release binariesfixed
- Fix nix lint errorsfixed
- Avoid rebuilding upstream nixpkgs due to Go toolchain changesfixed
- Support dependency semantic version rangefixed
- Update go mod and gomod2nix after crank removalfixed
- @yordis delivered one of this release's headline features in #7239 as a first-time contributor to core Crossplane (but long time contributor to the Crossplane ecosystem 😉) : the per-resource reconciliation control. This work gives operators fine-grained control over when individual resources reconcile, and required coordinated changes across both the core composite reconciler and the managed reconciler in crossplane-runtime. Thank you @yordis!other
- @fernandezcuesta has had a sustained impact on the broader Crossplane ecosystem, contributing to and releasing a steady stream of community providers and extensions that expand what users can build on Crossplane, e.g. provider-kafka, provider-mongodbatlas, and provider-pagerduty. To top that off, they also landed new support in core Crossplane for commonAnnotations for compositions in #7211. Thank you, @fernandezcuesta!other
- Use foreground cascading deletion for unneeded composed resourcesother
- Readme: Leave a note about v1.20 extended supportother
- Issue #7200 - Reset circuit breaker state on XR deletionother
- Update crossplane-runtime and remove temporary copyother
- Pkg: Correctly handle dependency upgrades with ImageConfig prefix rewritingother
- README: update release table after v2.2 releaseother
- Use xcrd and xpkg packages from crossplane-runtimeother
- Use pkgs.unstable overlay instead of single pkgs.go-unstable attributeother
- Skip no-op status updates in revision and composite reconcilersother
- Update ADOPTERS.mdother
17 maintenance lines (dependency bumps, CI, tests, docs)
- Bump crossplane-runtime dependency to v2.3.0-rc.0maintenance
- Update renovate config for v2.2 releasemaintenance
- Clean up lingering refs to HACK_CROSSPLANE_ARGSmaintenance
- Mitigate potential script injection in promote workflowmaintenance
- Fix renovate config parsingmaintenance
- Update crossplane-runtime to use core APIs from the apis modulemaintenance
- Use new env for renovate allowed commandsmaintenance
- Switch to korthout/backport-action and update it.maintenance
- Drop Trivy vulnerability scanningmaintenance
- Add Lansweeper as adoptermaintenance
- Disable CodeRabbit automatic label applicationmaintenance
- Crank: Update render to use crossplane internal rendermaintenance
- Pin Renovate config validatormaintenance
- Pin Renovate Earthly downloadmaintenance
- Bump crossplane-runtime to v2.3.0-rc.1maintenance
- Bump Go to 1.25.10 to fix stdlib CVEs (release-2.3)maintenance
- Bump crossplane-runtime to v2.3.0maintenance
92 lines13 security2 removed27 added1 changed9 fixed23 other17 maintenancetyped from the source notes