chore(deps): update helm release mariadb-operator to v0.38.1

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
mariadb-operator	HelmChart	minor	0.31.0 -> 0.38.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

mariadb-operator/mariadb-operator (mariadb-operator)

v0.38.1

Compare Source

Run and operate MariaDB in a cloud native way

v0.38.0

Compare Source

Run and operate MariaDB in a cloud native way

v0.37.1

Compare Source

mariadb-operator 0.37.1 is here! 🦭

We're excited to introduce TLS 🔐 support in this release, one of the major features of mariadb-operator so far! ✨ Check out the TLS docs, our example catalog and the release notes below to start using it.

[!WARNING]
Be sure to follow the UPGRADE GUIDE to ensure a seamless transition from previous versions.

Issue certificates for MariaDB and MaxScale

Issuing and configuring TLS certificates for your instances has never been easier, you just need to set tls.enabled=true:

apiVersion: k8s.mariadb.com/v1alpha1
kind: MariaDB
metadata:
  name: mariadb-galera
spec:
  ...
  tls:
    enabled: true

apiVersion: k8s.mariadb.com/v1alpha1
kind: MaxScale
metadata:
  name: maxscale
spec:
  ...
  mariaDbRef:
    name: mariadb-galera
  tls:
    enabled: true

A self-signed Certificate Authority (CA) will be automatically generated to issue leaf certificates for your instances. The operator will also manage a CA bundle that your applications can use in order to establish trust.

TLS will be enabled by default in MariaDB, but it will not enforced. You can enforce TLS connections by setting tls.required=true to ensure that all connections are encrypted. In the case of MaxScale, TLS will only be enabled if you explicitly set tls.enabled=true or the referred MariaDB (via mariaDbRef) instance enforces TLS.

Native integration with cert-manager

cert-manager is the de facto standard for managing certificates in Kubernetes. This certificate controller simplifies the automatic provisioning, management, and renewal of certificates. It supports a variety of certificate backends (e.g. in-cluster, Hashicorp Vault), which are configured using Issuer or ClusterIssuer resources.

In your MariaDB and MaxScale resources, you can directly reference ClusterIssuer or Issuer objects to seamlessly issue certificates:

apiVersion: k8s.mariadb.com/v1alpha1
kind: MariaDB
metadata:
  name: mariadb-galera
spec:
  ...
  tls:
    enabled: true
    serverCertIssuerRef:
      name: root-ca
      kind: ClusterIssuer
    clientCertIssuerRef:
      name: root-ca
      kind: ClusterIssuer

apiVersion: k8s.mariadb.com/v1alpha1
kind: MaxScale
metadata:
  name: maxscale-galera
spec:
  ...
  tls:
    enabled: true
    adminCertIssuerRef:
      name: root-ca
      kind: ClusterIssuer
    listenerCertIssuerRef:
      name: root-ca
      kind: ClusterIssuer

Under the scenes, the operator will create cert-manager's Certificate resources with all the required Subject Alternative Names (SANs) required by your instances. These certificates will be automatically managed by cert-manager and the CA bundle will be updated by the operator so you can establish trust with your instances.

The advantage of this approach is that you can use any of the cert-manager's certificate backends, such as the in-cluster CA or HashiCorp Vault, and potentially reuse the same Issuer/ClusterIssuer with multiple instances.

Certificate rotation

Whether the certificates are managed by the operator or by cert-manager, they will be automatically renewed before expiration. Additionally, the operator will update the CA bundle whenever the CAs are rotated, temporarily retaining the old CA in the bundle to ensure a seamless update process.

In both scenarios, the standard update strategies apply, allowing you to control how the Pods are restarted during certificate rotation.

TLS requirements for Users

We have extended our User SQL resource to include TLS-specific requirements for user connections over TLS. For example, if you want to enforce the use of a valid x509 certificate for a user to connect:

apiVersion: k8s.mariadb.com/v1alpha1
kind: User
metadata:
  name: user
spec:
  ...
  require:
    x509: true

To restrict the subject of the user's certificate and/or require a specific issuer, you may set:

apiVersion: k8s.mariadb.com/v1alpha1
kind: User
metadata:
  name: user
spec:
  ...
  require:
    issuer: "/CN=mariadb-galera-ca"
    subject: "/CN=mariadb-galera-client"

If any of these TLS requirements are not satisfied, the user will be unable to connect to the instance.

Automatic updates when Galera options are changed

Whenever Galera options are changed, for example, adding providerOptions:

apiVersion: k8s.mariadb.com/v1alpha1
kind: MariaDB
metadata:
  name: mariadb-galera
spec:
  ...
  galera:
    enabled: true
+   providerOptions:
+     gcs.fc_limit: '64'

An update is now automatically triggered, and the Pods are restarted according to the configured update strategy.

Community contributions

• Support startupProbe in MariaDB and MaxScale by @​vixns
• Prevent deadlocks on Database reconcile while transactions are running by @​vixns
• Update CronJob template on reconcile by @​vixns
• Operator configuration via helm by @​sakazuki and @​indigo-saito
• Support EKS Service Accounts in S3 by @​Skaronator
• Add support for configuring priorityClassName, topologySpreadConstraints, PDB in Helm Chart by @​Skaronator
• Exclude dollar signs from generated passwords by @​simonhammes
• Fix examples SqlJob secret reference by @​driv
• FLUSH PRIVILEGES unnecessary for user/grant manipulation by @​grooverdan

Huge thanks to our awesome contributors! 🙇

---

We value your feedback! If you encounter any issues or have suggestions, please open an issue on GitHub. Your input is crucial to improve mariadb-operator🦭.

Join us on Slack: MariaDB Community Slack.

What's Changed

• Fix TLS defaults in embedded MaxScale by @​mmontes11 in https://github.com/mariadb-operator/mariadb-operator/pull/1143

Full Changelog: mariadb-operator/mariadb-operator@0.37.0...0.37.1

v0.37.0

Compare Source

[!WARNING]
A patch version 0.37.1 to fix a regression has been released. It is recommended to skip this version and upgrade to 0.37.1 instead

mariadb-operator 0.37.0 is here! 🦭

We're excited to introduce TLS 🔐 support in this release, one of the major features of mariadb-operator so far! ✨ Check out the TLS docs, our example catalog and the release notes below to start using it.

[!WARNING]
Be sure to follow the UPGRADE GUIDE to ensure a seamless transition from previous versions.

Issue certificates for MariaDB and MaxScale

Issuing and configuring TLS certificates for your instances has never been easier, you just need to set tls.enabled=true:

apiVersion: k8s.mariadb.com/v1alpha1
kind: MariaDB
metadata:
  name: mariadb-galera
spec:
  ...
  tls:
    enabled: true

apiVersion: k8s.mariadb.com/v1alpha1
kind: MaxScale
metadata:
  name: maxscale
spec:
  ...
  mariaDbRef:
    name: mariadb-galera
  tls:
    enabled: true

A self-signed Certificate Authority (CA) will be automatically generated to issue leaf certificates for your instances. The operator will also manage a CA bundle that your applications can use in order to establish trust.

TLS will be enabled by default in MariaDB, but it will not enforced. You can enforce TLS connections by setting tls.required=true to ensure that all connections are encrypted. In the case of MaxScale, TLS will only be enabled if you explicitly set tls.enabled=true or the referred MariaDB (via mariaDbRef) instance enforces TLS.

Native integration with cert-manager

cert-manager is the de facto standard for managing certificates in Kubernetes. This certificate controller simplifies the automatic provisioning, management, and renewal of certificates. It supports a variety of certificate backends (e.g. in-cluster, Hashicorp Vault), which are configured using Issuer or ClusterIssuer resources.

In your MariaDB and MaxScale resources, you can directly reference ClusterIssuer or Issuer objects to seamlessly issue certificates:

apiVersion: k8s.mariadb.com/v1alpha1
kind: MariaDB
metadata:
  name: mariadb-galera
spec:
  ...
  tls:
    enabled: true
    serverCertIssuerRef:
      name: root-ca
      kind: ClusterIssuer
    clientCertIssuerRef:
      name: root-ca
      kind: ClusterIssuer

apiVersion: k8s.mariadb.com/v1alpha1
kind: MaxScale
metadata:
  name: maxscale-galera
spec:
  ...
  tls:
    enabled: true
    adminCertIssuerRef:
      name: root-ca
      kind: ClusterIssuer
    listenerCertIssuerRef:
      name: root-ca
      kind: ClusterIssuer

Under the scenes, the operator will create cert-manager's Certificate resources with all the required Subject Alternative Names (SANs) required by your instances. These certificates will be automatically managed by cert-manager and the CA bundle will be updated by the operator so you can establish trust with your instances.

The advantage of this approach is that you can use any of the cert-manager's certificate backends, such as the in-cluster CA or HashiCorp Vault, and potentially reuse the same Issuer/ClusterIssuer with multiple instances.

Certificate rotation

Whether the certificates are managed by the operator or by cert-manager, they will be automatically renewed before expiration. Additionally, the operator will update the CA bundle whenever the CAs are rotated, temporarily retaining the old CA in the bundle to ensure a seamless update process.

In both scenarios, the standard update strategies apply, allowing you to control how the Pods are restarted during certificate rotation.

TLS requirements for Users

We have extended our User SQL resource to include TLS-specific requirements for user connections over TLS. For example, if you want to enforce the use of a valid x509 certificate for a user to connect:

apiVersion: k8s.mariadb.com/v1alpha1
kind: User
metadata:
  name: user
spec:
  ...
  require:
    x509: true

To restrict the subject of the user's certificate and/or require a specific issuer, you may set:

apiVersion: k8s.mariadb.com/v1alpha1
kind: User
metadata:
  name: user
spec:
  ...
  require:
    issuer: "/CN=mariadb-galera-ca"
    subject: "/CN=mariadb-galera-client"

If any of these TLS requirements are not satisfied, the user will be unable to connect to the instance.

Automatic updates when Galera options are changed

Whenever Galera options are changed, for example, adding providerOptions:

apiVersion: k8s.mariadb.com/v1alpha1
kind: MariaDB
metadata:
  name: mariadb-galera
spec:
  ...
  galera:
    enabled: true
+   providerOptions:
+     gcs.fc_limit: '64'

An update is now automatically triggered, and the Pods are restarted according to the configured update strategy.

Community contributions

• Support startupProbe in MariaDB and MaxScale by @​vixns
• Prevent deadlocks on Database reconcile while transactions are running by @​vixns
• Update CronJob template on reconcile by @​vixns
• Operator configuration via helm by @​sakazuki and @​indigo-saito
• Support EKS Service Accounts in S3 by @​Skaronator
• Add support for configuring priorityClassName, topologySpreadConstraints, PDB in Helm Chart by @​Skaronator
• Exclude dollar signs from generated passwords by @​simonhammes
• Fix examples SqlJob secret reference by @​driv
• Relabeling metrics for ServiceMonitor by @​nlamirault
• FLUSH PRIVILEGES unnecessary for user/grant manipulation by @​grooverdan

Huge thanks to our awesome contributors! 🙇

---

We value your feedback! If you encounter any issues or have suggestions, please open an issue on GitHub. Your input is crucial to improve mariadb-operator🦭.

Join us on Slack: MariaDB Community Slack.

What's Changed

• Bump golang.org/x/sync from 0.8.0 to 0.9.0 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1043
• Bump ubi8/ubi-micro from 8.10-13 to 8.10-15 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1044
• Bump github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring from 0.78.0 to 0.78.1 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1042
• Bump golang from 1.23.2-alpine3.20 to 1.23.3-alpine3.20 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1045
• ci github workflows - optional mariadb_version by @​grooverdan in https://github.com/mariadb-operator/mariadb-operator/pull/1048
• Update release workflow to create go pkg compatible tags by @​mmontes11 in https://github.com/mariadb-operator/mariadb-operator/pull/1049
• Relabeling metrics for ServiceMonitor by @​nlamirault in https://github.com/mariadb-operator/mariadb-operator/pull/1047
• Create gdc-airgapped.md by @​mariadb-pieterhumphrey in https://github.com/mariadb-operator/mariadb-operator/pull/1051
• Rename gdc-airgapped.md to GDC_AIRGAPPED.md by @​mariadb-pieterhumphrey in https://github.com/mariadb-operator/mariadb-operator/pull/1052
• Update GDC_AIRGAPPED.md by @​mariadb-pieterhumphrey in https://github.com/mariadb-operator/mariadb-operator/pull/1066
• Update GDC_AIRGAPPED.md by @​mariadb-pieterhumphrey in https://github.com/mariadb-operator/mariadb-operator/pull/1067
• Update NOTES.txt by @​mariadb-pieterhumphrey in https://github.com/mariadb-operator/mariadb-operator/pull/1065
• Update GDC_AIRGAPPED.md by @​mariadb-pieterhumphrey in https://github.com/mariadb-operator/mariadb-operator/pull/1073
• Bump github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring from 0.78.1 to 0.78.2 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1057
• Bump k8s.io/api from 0.31.2 to 0.31.3 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1055
• Bump sigs.k8s.io/controller-runtime from 0.19.1 to 0.19.3 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1069
• Bump golang from 1.23.3-alpine3.20 to 1.23.4-alpine3.20 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1068
• Bump github.com/onsi/ginkgo/v2 from 2.21.0 to 2.22.0 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1058
• Bump k8s.io/client-go from 0.31.2 to 0.32.0 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1075
• Bump entrypoints to include 11.7 (2024Q4p2) by @​grooverdan in https://github.com/mariadb-operator/mariadb-operator/pull/1059
• Bump golang.org/x/sync from 0.9.0 to 0.10.0 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1081
• Bump github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring from 0.78.2 to 0.79.0 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1080
• Bump github.com/go-chi/chi/v5 from 5.1.0 to 5.2.0 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1079
• Bump github.com/onsi/gomega from 1.35.1 to 1.36.1 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1078
• Bump github.com/gruntwork-io/terratest from 0.47.2 to 0.48.0 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1077
• FLUSH PRIVILEGES unnecessary for user/grant manipulation by @​grooverdan in https://github.com/mariadb-operator/mariadb-operator/pull/1083
• Update mariadb_galera_maxscale.yaml by @​mariadb-pieterhumphrey in https://github.com/mariadb-operator/mariadb-operator/pull/1087
• Fix examples SqlJob secret reference by @​driv in https://github.com/mariadb-operator/mariadb-operator/pull/1090
• Update LICENSE by @​mariadb-pieterhumphrey in https://github.com/mariadb-operator/mariadb-operator/pull/1106
• Bump github.com/minio/minio-go/v7 from 7.0.80 to 7.0.84 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1129
• Bump golang from 1.23.4-alpine3.20 to 1.23.5-alpine3.20 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1130
• Bump github.com/onsi/gomega from 1.36.1 to 1.36.2 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1103
• Bump ubi8/ubi-micro from 8.10-15 to 8.10-19 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1095
• Bump github.com/gruntwork-io/terratest from 0.48.0 to 0.48.1 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1092
• Bump github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring from 0.79.0 to 0.79.2 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1091
• Bump github.com/onsi/ginkgo/v2 from 2.22.0 to 2.22.2 by @​dependabot in https://github.com/mariadb-operator/mariadb-operator/pull/1113
• Release 0.37.0 by @​mmontes11 in https://github.com/mariadb-operator/mariadb-operator/pull/1118

New Contributors

• @​nlamirault made their first contribution in https://github.com/mariadb-operator/mariadb-operator/pull/1047
• @​driv made their first contribution in https://github.com/mariadb-operator/mariadb-operator/pull/1090

Full Changelog: mariadb-operator/mariadb-operator@0.36.0...0.37.0

v0.36.0

Compare Source

Run and operate MariaDB in a cloud native way

v0.35.1

Compare Source

Run and operate MariaDB in a cloud native way

v0.35.0

Compare Source

Run and operate MariaDB in a cloud native way

v0.34.0

Compare Source

Run and operate MariaDB in a cloud native way

v0.33.0

Compare Source

Run and operate MariaDB in a cloud native way

v0.32.0

Run and operate MariaDB in a cloud native way

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cardoe]

This unfortunately will break us due to changes in the CRD namespace. So we need to do this carefully.

[skrobul]

• upgrade to 0.0.26 - https://github.com/mariadb-operator/mariadb-operator/blob/main/docs/UPGRADE_v0.0.26.md
• upgrade to 0.0.28 - https://github.com/mariadb-operator/mariadb-operator/blob/main/docs/UPGRADE_v0.0.28.md
• upgrade to 0.0.30 - https://github.com/mariadb-operator/mariadb-operator/blob/main/docs/UPGRADE_v0.0.30.md
• upgrade to 0.0.31 - https://github.com/mariadb-operator/mariadb-operator/blob/main/docs/UPGRADE_v0.0.31.md