miki3421 opened a new pull request, #285: URL: https://github.com/apache/openserverless/pull/285
CHANGES stops at RC7 and omits the subsequent fixes already included in the 0.9.0 source pins. Append an unreleased 0.9.0 section with 19 entries covering 36 merged PRs across the platform repositories, while preserving the existing release history byte for byte. The entries cover tenant authentication and isolation, IAM and Redis recovery, protected custom OPTIONS handlers, provisioning and SSO, builder hardening, Cron containment, setup readiness, component versions, licensing and integration checks. They retain the relevant limits: NetworkPolicies require an enforcing CNI, and Cron containment retains Allow concurrency without duplicate prevention or recovery of missed executions. Open, draft, superseded and unpublished work is excluded; the existing SSO backport entry is not duplicated. Validation: checked each included code merge against the corresponding submodule pin at `d834957dcc72e61ac1a8daec9218758a39be432f`; verified the approved diff and unchanged existing content; confirmed that the whitespace check reports no errors. Documentation-only change; no runtime files or submodule pins are changed. Rebuilt-image publication and release signatures were not assessed. <details> <summary>Source PRs reviewed for the new entries</summary> - https://github.com/apache/openserverless-admin-api/pull/67 — Fix invalid ASF header in uv.lock - https://github.com/apache/openserverless-admin-api/pull/64 — Add Secret-authorized tenant provisioning API - https://github.com/apache/openserverless-admin-api/pull/61 — Require OIDC identity binding before issuing tenant credentials - https://github.com/apache/openserverless-admin-api/pull/60 — Isolate builder jobs and validate image targets on 0.9.0 - https://github.com/apache/openserverless-build/pull/24 — fix(controller): authenticate custom OPTIONS via OpenWhisk overlay - https://github.com/apache/openserverless-operator/pull/159 — fix(seaweedfs): reconcile restored IAM before exposing resumed ingress - https://github.com/apache/openserverless-operator/pull/158 — fix(redis): preserve pending RDB writes on graceful shutdown (0.9.0) - https://github.com/apache/openserverless-operator/pull/157 — fix(redis): persist tenant ACLs across Redis-only restarts on 0.9.0 - https://github.com/apache/openserverless-operator/pull/156 — Fix SeaweedFS integration access after NodePort removal - https://github.com/apache/openserverless-operator/pull/155 — Isolate SeaweedFS control APIs from tenant actions - https://github.com/apache/openserverless-operator/pull/154 — fix: update Milvus to 2.5.27 - https://github.com/apache/openserverless-operator/pull/153 — [0.9.0] Bound cron-init jobs and scheduler I/O - https://github.com/apache/openserverless-operator/pull/152 — Require client credentials for FerretDB on 0.9.0 - https://github.com/apache/openserverless-operator/pull/148 — Prevent image publication on branch pushes, including slash names - https://github.com/apache/openserverless-operator/pull/147 — Remove inaccurate Gradle attribution from operator licensing - https://github.com/apache/openserverless-operator/pull/146 — Isolate shared monitoring endpoints from tenant actions on 0.9.0 - https://github.com/apache/openserverless-operator/pull/145 — Isolate Kafka and ZooKeeper from tenant action pods on 0.9.0 - https://github.com/apache/openserverless-operator/pull/144 — Isolate malformed Cron annotations between tenants on 0.9.0 - https://github.com/apache/openserverless-operator/pull/142 — Fix FerretDB tenant provisioning on 0.9.0 - https://github.com/apache/openserverless-operator/pull/141 — Isolate etcd and Milvus credentials and management endpoints on 0.9.0 - https://github.com/apache/openserverless-operator/pull/140 — Restrict Redis tenant ACLs while preserving Lua on 0.9.0 - https://github.com/apache/openserverless-operator/pull/139 — Scope anonymous S3 access to web buckets on 0.9.0 - https://github.com/apache/openserverless-operator/pull/138 — Restrict CouchDB user metadata access on 0.9.0 - https://github.com/apache/openserverless-operator/pull/137 — Fix RC7 operator image build and Alertmanager defaults - https://github.com/apache/openserverless-site/pull/96 — docs: add SSO configuration guide - https://github.com/apache/openserverless-task/pull/243 — fix: correct devcontainer image catalog tag - https://github.com/apache/openserverless-task/pull/242 — fix: update Milvus image to 2.5.27 - https://github.com/apache/openserverless-task/pull/241 — [0.9.0] Install user provisioning RBAC during K3s setup - https://github.com/apache/openserverless-task/pull/239 — Reconcile reduced monitoring RBAC before operator upgrades on 0.9.0 - https://github.com/apache/openserverless-task/pull/238 — Grant operator NetworkPolicy permissions during 0.9.0 setup - https://github.com/apache/openserverless-task/pull/237 — Enable BuildKit process sandbox in 0.9.0 deployment configuration - https://github.com/apache/openserverless-task/pull/236 — Make full cluster setup readiness and component dependencies explicit - https://github.com/apache/openserverless-task/pull/232 — Update K3s install version to v1.36.4+k3s1 - https://github.com/apache/openserverless-testing/pull/18 — Recognize both Static landing pages and reject HTTP errors - https://github.com/apache/openserverless-testing/pull/17 — Remove obsolete MinIO config calls and propagate setup errors in S3 tests - https://github.com/apache/openserverless/pull/278 — Correct bundled licenses and OpenWhisk source archive boundary on 0.9.0 </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
