Update Helm release crossplane to v2.4.0 (main)

Sylva Renovate botrequested to merge
renovate/main-crossplane-2.x into main

This MR contains the following updates:

Package Update Change
crossplane (source) minor 2.0.8 -> 2.4.0

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

crossplane/crossplane (crossplane)

v2.4.0

Compare Source

The v2.4.0 release is a regular quarterly Crossplane release that is focused on maturing a number of key areas of functionality across the project, as Crossplane continues to become more capable, more reliable, and more performant for your production workloads. This release includes the ability to watch required resources and reconcile XRs immediately when they change, scale to zero for safe-start capable providers, release artifacts that are vulnerability scannable, and a wide range of fixes and reliability improvements. It also includes security fixes in Crossplane's Go toolchain and dependencies.

🚨 v1.20 end-of-life (EOL) November 2026

This v2.4 release marks the final release cycle where v1.20 will be maintained.

When v2.5 is released in Nov 2026, v1.20 will reach its EOL and no longer receive any support or maintenance by the Crossplane project. Until that time, we will continue to provide critical fixes and security related dependency updates to v1.20.

[!IMPORTANT] This EOL notice applies only to the v1.20 release. v1 legacy workloads like Claims and cluster scoped resources remain supported in Crossplane v2 through extensive backwards compatibility support.

Is your control plane ready for v2?

Upgrading to Crossplane v2 does not require any migration as part of the upgrade process, with the exception of the minimal breaking changes explicitly called out in the v2 documentation. If your control plane is not affected by those changes, you can simply upgrade to v2 right away.

To better assist Crossplane users in determining if their control planes are affected by any of the breaking changes in v2, we have released a v2 readiness checker tool in the v1.20 Crossplane CLI that can be invoked via crossplane beta upgrade check. You can read all about this tool in the following resources:

Crossplane Downstream Distributions

Downstream distributions are eligible to continue their extended support and maintenance for their releases that are based on upstream Crossplane's v1.20. Check with your vendor for more details if you are using a downstream distribution of Crossplane.

🚨 v2.4 Notable and Breaking Changes

  • ⚠️ The Crossplane CLI is no longer published to releases.crossplane.io. New CLI releases go only to cli.crossplane.io, under the binary name crossplane rather than crank. This completes the CLI's move to https://github.com/crossplane/cli, which was announced in the v2.3.0 release notes and dual published to both locations for v2.3.0 to ease the transition.
    • f you are using custom installation scripts or CI steps that download the CLI directly from releases.crossplane.io, update them to use cli.crossplane.io, and update any firewall or proxy rule that allows releases.crossplane.io to now allow cli.crossplane.io instead.
      • Users of the install.sh script as their installation procedure are unaffected.
    • The CLI now follows its own release schedule, so a CLI release will not accompany every core Crossplane release and the two version numbers have diverged.
    • Documentation and installation instructions for the Crossplane CLI can be found on https://docs.crossplane.io/cli/latest/.
  • Package revision names are now derived from both the package digest and the package's metadata.generation, so any change to a package's spec produces a new PackageRevision. #​7473
    • This fixes the long standing issue where changing a package's runtimeConfigRef reused the existing revision, along with its stale runtime settings. #​5068
    • When upgrading to v2.4, every installed package gets a new revision, with a new name, on its first reconcile.
    • ⚠️ The Pods for Providers and Functions will be restarted for this new revision.
  • Package runtime objects (Deployment, ServiceAccount, Service, and TLS Secrets) are now applied with server-side apply under the pkg.crossplane.io/runtime field manager, replacing the previous merge patch applicator. #​7563
    • A field you remove from a DeploymentRuntimeConfig is now removed from the live runtime object, rather than lingering until that object is replaced. #​4817
    • Additions that Crossplane doesn't declare are left alone rather than replaced along with the array that held them, e.g. an injected sidecar container or an extra volume added out of band now survives a reconcile.
  • The RUNTIME printer column on ProviderRevision and FunctionRevision was renamed to RUNTIME-HEALTHY, and a new RUNTIME-ACTIVE column was added. #​7586
    • Update any tooling that reads kubectl get providerrevision or kubectl get functionrevision output by column position.
  • The type label on the engine_watches_started_total and engine_watches_stopped_total metrics changed from ComposedResource to Dependency, now that a single watch mechanism covers both composed and required resources. #​7572
    • Update any dashboards or alerts that filter on that label value.

🎉 Highlights

  • Watching required resources: Composition functions can require resources they don't compose, but Crossplane didn't watch them, so a change to a required resource didn't reconcile the XRs that required it until their next poll. Crossplane now tracks the resources each XR depends on and drives watches from that. A change to a required resource now reconciles the XRs that required it the same way a change to a composed resource does. This works when realtime compositions are enabled, which is the default. See design/one-pager-watching-required-resources.md and #​7572.
  • Safe-start provider runtimes scale to zero until activated: A provider with the safe-start capability runs no managed resource controllers while all of its ManagedResourceDefinitions are inactive, so there is no reason to run its pods. Crossplane now creates such a provider's runtime Deployment with zero replicas and scales it up once its first MRD becomes active, such as through a matching ManagedResourceActivationPolicy. Installing a broad set of providers no longer costs you a running pod for each one that has nothing to reconcile yet. #​7586
    • A new RuntimeActive condition on ProviderRevision and FunctionRevision makes this visible. It is False with reason AwaitingActivation while the runtime is intentionally scaled to zero and True once it has been scaled up. RuntimeHealthy stays healthy in both cases, and the package's Healthy condition surfaces the awaiting state with the same reason.
    • Scaling to zero takes precedence over an explicit spec.replicas in a DeploymentRuntimeConfig, which is now read as how many replicas to run while running, rather than a demand to always be running. #​7639
  • Vulnerability-scannable container images: Crossplane container images are now built with nixpkgs' buildGoModule, which includes the full Go dependency list into the binary. Scanners such as grype and trivy previously were only able to discover the Crossplane main module and the Go standard library, so CVEs in our third-party dependencies were not visible to them. Now Crossplane and its complete set of dependencies are visible to security scanner tools. #​7549
  • More reliable package runtime management: Server-side apply for package runtime objects means a field you remove from a DeploymentRuntimeConfig is now actually removed from the live Deployment instead of lingering (#​7563, fixing #​4817). Deactivating a revision also no longer deletes a runtime Deployment that another revision controls, which could happen when a DeploymentRuntimeConfig pins a stable deploymentTemplate.metadata.name (#​7561).
  • Hardening across composition and package paths: Several changes tighten paths where a caller could reach further than intended. The composed resource garbage collector now only deletes resources whose controller reference points back to the XR, so spec.resourceRefs can no longer be used to make the composite controller delete arbitrary resources (#​7627). The claim to XR syncers now strip XR machinery fields such as resourceRefs and the crossplane stanza, which a claim could otherwise smuggle through an XRD schema that sets x-kubernetes-preserve-unknown-fields: true (#​7626).
  • Version-aware docs search: Searching from an older version of the docs, such as /v1.20/, used to return results from all versions, potentially returning features and APIs that don't exist in the version you're actually reading. Search is now scoped to the version you're on, results carry a clearly visible version badge, and pages from older versions show a banner explaining that, with a link to latest. Thanks to @​haarchri for this one in crossplane/docs#1051, so give it a try at https://docs.crossplane.io.
  • Security fixes in dependencies: The Go version Crossplane builds/runs with was bumped to pick up standard library CVE fixes, alongside a steady stream of security updates to Crossplane's Go dependencies across this release cycle.
  • Other notable improvements:
    • Several fixes to the render engine that backs crossplane render: an XRD schema can now be supplied to crossplane internal render (#​7452), requirements are returned even when a function returns a fatal result (#​7455), a namespace is set on injected resource references only for cluster-scoped XRs, matching the real reconciler (#​7523), and an input XR fetched from a real cluster keeps its own UID so its observed resources are read correctly, with clear errors when observed resources don't line up with the XR (#​7544).
    • The sha256 files published with release binaries are now calculated after Nix strips the binary, so amd64 checksums match what you download. They didn't for v2.2.0 through v2.3.1, and CI now verifies checksums before uploading artifacts. #​7660
    • A composed Usage no longer gets a redundant owner update on every reconcile, which could repeatedly trigger composition reconciliation and eventually open the XR circuit breaker. #​7591
    • The deletion protection field index now uses a separator that can't appear in a group, kind, name, or namespace, so two distinct resources can no longer collide and block a deletion that should be allowed. #​7508
    • Sorting of spec.resourceRefs now includes the namespace, so references stay stable when composed resources share a name across namespaces. #​7341

🏅 Release MVP

For the v2.4 release cycle, we'd like to recognize @​rafal-jan as the release MVP!

They had an enormous impact in crossplane-runtime, first by diagnosing the root cause in crossplane/crossplane-runtime#1056 of significant memory usage by providers that are safe-start capable when they essentially watch and cache every CRD in the control plane. Then @​rafal-jan went a step further and submitted an elegant solution in crossplane/crossplane-runtime#1058 to strip the cached CRDs down to just the fields needed to watch and respond appropriately to events, drastically reducing the memory consumption by these providers. Thank you @​rafal-jan!

📖 Full Changelog

New Contributors

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.3.0...v2.4.0

v2.3.5

Compare Source

v2.3.5 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

  • Correct crank checksums for amd64 binaries (#​7666, originally #​7660): The published .sha256 files for linux_amd64 binaries had not matched the binaries themselves since v2.2.0, so any install script or Dockerfile that verified the amd64 checksum failed. Checksums are now calculated after Nix strips the binary, and the release workflow verifies them before uploading. Fixes #​7467.
  • Unambiguous Usage index key (#​7630, originally #​7508): The deletion protection webhook indexed Usage resources by joining API group, kind, name, and namespace with .. Since groups and names can contain . themselves, two distinct resources could collapse to the same key, causing the webhook to block a deletion that should have been allowed. The key now joins with /, which cannot appear in any of those fields.
  • Dependency security updates: Bumps cel-go (#​7761), golang.org/x/mod (#​7743), and sigstore-go (#​7678), plus a combined set of vulnerable dependency updates (#​7650), to pick up upstream CVE fixes. crossplane-runtime is also bumped to v2.3.4 (#​7765), which carries its own set of security dependency updates.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.3.4...v2.3.5

v2.3.4

Compare Source

v2.3.4 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

  • Fixed repeated owner updates for composed Usages (#​7597, originally #​7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
  • crossplane render fixes (#​7599, originally #​7544): render no longer overwrites the input XR's UID when one is already set, and now validates observed resources before proceeding with the render.
  • Vulnerability-scannable images (#​7574): Container images are now built with buildGoModule (replacing gomod2nix), so published images can be scanned by standard vulnerability tooling.
  • Dependency security updates: Bumps grpc / golang.org/x/net / golang.org/x/text (#​7618, #​7614, #​7615) and the sigstore stack — cosign (#​7559), rekor (#​7560), timestamp-authority (#​7570), sigstore-go (#​7583) — to pick up upstream CVE fixes. See ## What's Changed for the full list.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.3.3...v2.3.4

v2.3.3

Compare Source

v2.3.3 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

  • Fixed package signature verification TOCTOU (GHSA-mf7q-r4rv-jv94): A time-of-check-to-time-of-use flaw could let a malicious OCI registry pass signature verification with a signed image and then serve unsigned content for installation. For v2.3 this fix ships via the crossplane-runtime v2.3.3 bump in #​7541, since the affected code moved from crossplane to crossplane-runtime during the v2.3 milestone. See the crossplane-runtime v2.3.3 release notes for the full details.
  • Correct namespace on injected resource refs in crossplane render: crossplane render previously set a namespace on every injected resource reference, which is inaccurate for namespaced XRs (whose resource refs are local and carry no namespace) and broke composition functions with strict schemas, such as the generated KCL bindings used in control plane projects. Render now matches the real reconciler and sets the namespace only for cluster-scoped XRs. Backported in #​7525, originally fixed in #​7523.
  • Dependency security updates: This release also bumps the Go toolchain to 1.25.11 and golang.org/x/net and golang.org/x/sys in the apis module to pick up CVE fixes (#​7530). See ## What's Changed below for the full list.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.3.2...v2.3.3

v2.3.2

Compare Source

v2.3.2 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane's dependencies. The primary goal of this release is to fix regressions in the Crossplane CLI's render commands.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.3.1...v2.3.2

v2.3.1

Compare Source

v2.3.1 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane's dependencies.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.3.0...v2.3.1

v2.3.0

Compare Source

The v2.3.0 release is a regular quarterly Crossplane release that is focused on maturing a number of key areas of functionality across the project, as Crossplane continues to become more capable, more reliable, and more performant for your production workloads. This release includes a new high-fidelity local rendering engine, finer-grained reconciliation control for both XRs and managed resources, new alpha deletion protection for Provider packages, and a wide range of fixes and reliability improvements. It also includes security fixes in Crossplane's Go toolchain and dependencies.

ℹ️ Extended support for v1.20

Because v1.20 is the last minor release of the v1 series and major version upgrades require additional planning for users, v1.20 will continue to receive critical fixes. The final EOL date for v1.20 is to be determined.

⚠️ Upgrade from v2.2

It is strongly advised to upgrade to v2.3 from the previous minor version, which is v2.2. Upon upgrade for each minor release, Crossplane performs any necessary migrations of its CRDs to ensure the latest versions are stored in the Kubernetes API server. Therefore, it is important to upgrade sequentially through one minor version at a time as described in the upgrade docs.

🚨 Notable and Breaking Changes

  • github.com/crossplane/crossplane/apis/v2 is now a separate Go module from the rest of Crossplane. #​7019
    • External consumers of Crossplane APIs should update their dependencies from github.com/crossplane/crossplane/v2/apis to github.com/crossplane/crossplane/apis/v2.
    • The common APIs from crossplane-runtime have moved to github.com/crossplane/crossplane/apis/v2/core.
    • v1 and v2 of the common APIs have been collapsed into a single v2 package. The old v1.Resource* types are now v2.ClusterManagedResource* to differentiate them from v2.ManagedResource*, which are the namespaced versions.
    • A complete guide on how to update your provider source code to use these types can be found in the section below.
  • The Crossplane CLI (formerly crank) has moved into its own repository, https://github.com/crossplane/cli, and will be released separately from Crossplane core going forward. #​7355
    • A v2.3.0 release of the CLI coincides with this Crossplane core v2.3.0 release and has been dual published to the typical release location on releases.crossplane.io to help ease the transition. After the v2.3.0 release, version numbers and release schedules will diverge as the Crossplane CLI will have its own independent release schedule. Learn more and provide feedback in #​7350.
    • Commands have been re-organized into a noun-first tree.
    • Alpha and beta commands that previously lived in the crossplane alpha and crossplane beta trees have moved into the main tree.
    • Example: crossplane beta trace is now crossplane resource trace
    • See full release CLI notes (including full details on these breaking changes): https://github.com/crossplane/cli/releases/tag/v2.3.0

🎉 Highlights

  • High-fidelity render engine: crossplane render now drives the real composite reconciler via a new hidden crossplane internal render subcommand, instead of maintaining a parallel reimplementation. The output of crossplane render (and downstream tools like crossplane-diff) now matches what would actually happen in-cluster, eliminating differences between local rendering and real reconciliation. By default it pulls the Crossplane container image to run the reconcile, so a separate controller binary is not required. See #​7280 and #​7339.
  • Provider deletion protection: A new alpha feature automatically protects Provider packages from accidental deletion while instances of their managed resources still exist. When --enable-provider-deletion-protection is set, Crossplane will automatically create ClusterUsage resources that block Provider deletion through the existing Usage webhook. #​7362
  • Per-resource reconciliation control: Two new annotations give users fine-grained control over when individual resources reconcile. crossplane.io/poll-interval overrides the controller-level poll interval for a specific resource (e.g. "24h", "30m"), and crossplane.io/reconcile-requested-at triggers an immediate reconciliation when its value changes. This works immediately for XRs, but requires providers to release a new version based on crossplane-runtime v.2.3.0 to gain this behavior for their managed resources #​7239
  • Composition functions can now select all resources of a given kind: When a composition function returned a Requirements.ResourceSelector with only apiVersion and kind set (no matchName or matchLabels), Crossplane previously rejected this as an invalid request. A selector with no match field is now correctly interpreted as "all resources of that kind". #​7241
  • Scale subresource for XRs: CompositeResourceDefinition can now configure the scale subresource on the XRs it defines, so composite resources can be scaled with kubectl scale and other standard tooling. #​7004
  • Other notable improvements:
    • Improved docker network configuration support for crank render: A new render.crossplane.io/runtime-docker-network annotation on Function resources tells the Docker runtime which network function containers should join. This makes crossplane render work inside container jobs (such as GitHub Actions container jobs) where the default bridge network is unreachable from the caller. #​7216
    • commonAnnotations in compositions: Compositions can now propagate a set of common annotations to every composed resource, mirroring the existing commonLabels behavior. #​7211
    • crossplane beta validate now correctly resolves and caches dependencies that use semantic version ranges (e.g. ">=v0.6.0,<v1.0.0"), and adds an --update-cache flag to always check upstream for newer matching versions. #​7050
    • crossplane beta trace adds a YAML output format. #​7275
    • The XR circuit breaker now resets its state when the XR is deleted, so a new resource with the same name starts fresh instead of inheriting an open circuit. #​7201
    • CompositionRevision and composite reconcilers now skip no-op status updates, eliminating an unnecessary reconcile loop that prevented steady state convergence. #​7283

🏅 Release MVP

For the v2.3 release cycle, we'd like to recognize two amazing community members for their contributions and name them the v2.3 release MVPs! 🎉

  • @​yordis delivered one of this release's headline features in #​7239 as a first-time contributor to core Crossplane (but long time contributor to the Crossplane ecosystem 😉) : the per-resource reconciliation control. This work gives operators fine-grained control over when individual resources reconcile, and required coordinated changes across both the core composite reconciler and the managed reconciler in crossplane-runtime. Thank you @​yordis!
  • @​fernandezcuesta has had a sustained impact on the broader Crossplane ecosystem, contributing to and releasing a steady stream of community providers and extensions that expand what users can build on Crossplane, e.g. provider-kafka, provider-mongodbatlas, and provider-pagerduty. To top that off, they also landed new support in core Crossplane for commonAnnotations for compositions in #​7211. Thank you, @​fernandezcuesta!

Updating a provider's source code to the v2.3 API types

The common API types that providers embed (managed resource specs and statuses, provider config types, credential selectors, and conditions) now live in the new github.com/crossplane/crossplane/apis/v2 module, in its core/v2 package, rather than in crossplane-runtime. Providers adopt them by bumping their dependencies, changing to the new types, then regenerating their method sets with the latest build of crossplane-tools from master.

crossplane/provider-template#164 is a complete, merged example of this update and a useful reference to diff against while working through the steps below.

ℹ️ crossplane-tools support for v2.3+ is additive: it still generates against the legacy crossplane-runtime types, so upgrading crossplane-tools does not force this source code migration. It is also possible to just bump the tool first and then migrate your types when you are ready.

Update dependencies. Fetch the v2.3.3 runtime and APIs modules, plus the latest crossplane-tools from master:

go get github.com/crossplane/crossplane-runtime/v2@&#8203;v2.3.3
go get github.com/crossplane/crossplane/apis/v2@&#8203;v2.3.3
go get -tool github.com/crossplane/crossplane-tools/cmd/angryjet@latest

If your provider pins the generator a different way, such as a tools.go blank import rather than a Go tool directive, drop -tool and run go get github.com/crossplane/crossplane-tools@latest instead.

Update imports in all source code files. Replace the two crossplane-runtime common imports with the single core/v2 package:

// before
xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
xpv2 "github.com/crossplane/crossplane-runtime/v2/apis/common/v2"

// after
xpv2 "github.com/crossplane/crossplane/apis/v2/core/v2"

Update types. The core/v2 package keeps the same names as the old common/v2 types, and most of the common/v1 types also kept their names. They simply move to the new module with the import alias repoint.

The common/v1 (xpv1) types that need to be renamed are as follows:

Old (crossplane-runtime common/v1) New (apis/v2/core/v2)
ResourceStatus ManagedResourceStatus
ResourceSpec ClusterManagedResourceSpec

There is a single ManagedResourceStatus for both namespaced and cluster-scoped managed resources, so the spec is the only part that differs by scope (ManagedResourceSpec vs ClusterManagedResourceSpec).

Regenerate and tidy. Run make generate (or your go generate target), then go mod tidy.

Silence the deprecated event recorder. The Kubernetes controller-runtime version is also bumped during this process, which includes a deprecation of the EventRecorder API, so you will likely have linter failures if you are using that API until #​7152 is fixed. Consider adding a nolint comment for now:

managed.WithRecorder(event.NewAPIRecorder(mgr.GetEventRecorderFor(name))), //nolint:staticcheck // pending the new events API, see crossplane/crossplane#7152

Update your scaffolding templates. If your provider generates new resources from templates such as those under hack/helpers, update those to the v2.3 types so newly-added resources start on the new API.

What's Changed

New Contributors

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.2.0...v2.3.0

v2.2.5

Compare Source

v2.2.5 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

  • Correct crank checksums for amd64 binaries (#​7665, originally #​7660): The published .sha256 files for linux_amd64 binaries had not matched the binaries themselves since v2.2.0, so any install script or Dockerfile that verified the amd64 checksum failed. Checksums are now calculated after Nix strips the binary, and the release workflow verifies them before uploading. Fixes #​7467.
  • Unambiguous Usage index key (#​7629, originally #​7508): The deletion protection webhook indexed Usage resources by joining API group, kind, name, and namespace with .. Since groups and names can contain . themselves, two distinct resources could collapse to the same key, causing the webhook to block a deletion that should have been allowed. The key now joins with /, which cannot appear in any of those fields.
  • Dependency security updates: Bumps cel-go (#​7760), golang.org/x/mod (#​7742), sigstore-go (#​7677), and go-git (#​7724), plus a combined set of vulnerable dependency updates (#​7649), to pick up upstream CVE fixes. crossplane-runtime is also bumped to v2.2.4 (#​7766), which carries its own set of security dependency updates.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.2.4...v2.2.5

v2.2.4

Compare Source

v2.2.4 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

  • Fixed repeated owner updates for composed Usages (#​7596, originally #​7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
  • Vulnerability-scannable images (#​7575): Container images are now built with buildGoModule (replacing gomod2nix), so published images can be scanned by standard vulnerability tooling.
  • Dependency security updates: Bumps grpc / golang.org/x/net / golang.org/x/text (#​7619) and the sigstore stack — cosign (#​7558), rekor (#​7557), timestamp-authority (#​7569), sigstore-go (#​7582) — to pick up upstream CVE fixes. See ## What's Changed for the full list.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.2.3...v2.2.4

v2.2.3

Compare Source

v2.2.3 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane and its dependencies.

🎉 Highlights

  • Fixed package signature verification TOCTOU (GHSA-wfqx-gjrf-g28r): A time-of-check-to-time-of-use flaw would let a malicious OCI registry serve a correctly signed image for verification and then an unsigned image for installation, because Crossplane resolved tag references separately for each step. Crossplane now resolves a tag to a digest once and uses that same digest for both signature verification and the image pull, so the content that is verified is exactly the content that is installed. This affected only users who enable package signature verification, install packages by tag, and pull from registries they don't control. Installing by digest would avoid this issue. Backported in #​7520, and reported independently by @​bugbunny-research and @​tonghuaroot.
    • Note this fix appears in crossplane for v2.2 and crossplane-runtime for v2.3 because the affected code was moved from crossplane to crossplane-runtime during the v2.3 milestone.
  • Dependency security updates: This release also bumps the Go toolchain to 1.25.11 (#​7529), golang.org/x/net to v0.55.0 (#​7438), and crossplane-runtime to v2.2.3 (#​7540), picking up security fixes in those upstream dependencies.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.2.2...v2.2.3

v2.2.2

Compare Source

v2.2.2 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane's dependencies.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.2.1...v2.2.2

v2.2.1

Compare Source

v2.2.1 is a patch release scoped to fixing issues reported by users of Crossplane v2.2 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

  • Dependency upgrades work correctly with ImageConfig prefix rewriting: Packages installed via an ImageConfig prefix rewrite were previously not being upgraded when their dependencies changed, leaving users stuck on stale versions of dependent packages. Dependency upgrades now behave as expected when prefix rewrites are in use. Backported in #​7277, originally fixed in #​7233.

  • Composition functions can now select all resources of a given kind: When a composition function returned a Requirements.ResourceSelector with only apiVersion and kind set (no matchName or matchLabels), Crossplane previously rejected this as an invalid request. A selector with no match field is now correctly interpreted as "all resources of that kind". Backported in #​7247, originally fixed in #​7241.

This release also bumps Go to 1.25.9 and pulls in security related updates for a number of Crossplane's upstream dependencies, including cosign, go-git, go-jose, cloudflare/circl, moby/spdystream, sigstore/timestamp-authority, docker/cli, and the OpenTelemetry OTLP HTTP trace exporter

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.2.0...v2.2.1

v2.2.0

Compare Source

The v2.2.0 release is a regular quarterly Crossplane release that is focused on maturing a number of key areas of functionality across the project, as Crossplane continues to become more capable, more reliable, and more performant for your production workloads. This release includes many fixes and reliability improvements, a new alpha feature for debugging (the pipeline inspector), and usability improvements.

ℹ️ Extended support for v1.20

Normally, the release of v2.2 would correspond with the end-of-life for v1.20. However, because v1.20 is the last minor release of the v1 series and major version upgrades require additional planning for users, v1.20 will continue to receive critical fixes. The final EOL date for v1.20 is to be determined.

⚠️ Upgrade from v2.1

It is strongly advised to upgrade to v2.2 from the previous minor version, which is v2.1. Upon upgrade for each minor release, Crossplane performs any necessary migrations of its CRDs to ensure the latest versions are stored in the Kubernetes API server. Therefore, it is important to upgrade sequentially through one minor version at a time as described in the upgrade docs.

🚨 Notable and Breaking Changes

  • Input CRDs included in Function packages are no longer installed by the package manager, following the xpkg specification. Unknown or disallowed resources in a package are now ignored instead of causing package installation to fail. See #​6976.
  • The on-disk structure of the package cache has changed. This breaks an undocumented behavior via which packages could be side-loaded into Crossplane, which was especially useful for testing. See #​6981 for details on the change and #​7147 for discussion of the test changes necessary to accommodate it.

🎉 Highlights

  • ImageConfig can now be used to configure the DeploymentRuntimeConfig used for packages, including those installed as dependencies. Note that a matching ImageConfig takes precedence over the runtimeConfigRef in a package spec if both are present. See #​6382.
  • The MRD controller now uses server-side apply to update CRDs, improving reliability. See #​6934.
  • The pipeline inspector is now available as an alpha feature (disabled by default). When enabled, the inspector forwards function requests and responses to a user-configured gRPC endpoint for debugging or observability. See #​7025 and #​7031.
  • XRDs can now configure x-kubernetes-validations outside of the spec. This allows for validation of metadata such as names and labels. See #​7018.
  • Composition and operation functions can now request OpenAPI schemas for any resource kind in the cluster using the RequiredSchemas field in the function response. Crossplane now advertises capabilities (including required schemas) to functions in a new function request field. See #​7022.
  • The crossplane beta trace CLI command now supports tracing all resources of a given kind, and supports watching resources. See #​6552 and #​7015.
  • New documentation has been added regarding connection details for composite resources and workload identity with Crossplane.

🏅 Release MVP

@​jonasz-lasut is the v2.2 release MVP! Their work driving enhancements, fixing bugs, and maintaining quality across Crossplane and its ecosystem is much appreciated by the Crossplane maintainers. Additionally, @​jonasz-lasut is an active participant on the Crossplane Slack instance, answering questions and providing guidance to many new and experienced members of the community. Thank you for your dedication, @​jonasz-lasut! 🎉

What's Changed

New Contributors

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.1.0...v2.2.0

v2.1.8

Compare Source

v2.1.8 is a patch release scoped to fixing issues reported by users of Crossplane v2.1 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

  • Fixed repeated owner updates for composed Usages (#​7622, originally #​7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.
  • Dependency security updates: Bumps the Go toolchain to 1.25.12 (#​7577), grpc / golang.org/x/net / golang.org/x/text (#​7620, #​7609), and the sigstore stack — cosign (#​7556), rekor (#​7555), timestamp-authority (#​7568), sigstore-go (#​7581) — to pick up upstream CVE fixes. See ## What's Changed for the full list.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.1.7...v2.1.8

v2.1.7

Compare Source

v2.1.7 is a patch release scoped to fixing issues reported by users of Crossplane v2.1 and fixing security related issues in Crossplane's dependencies.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.1.6...v2.1.7

v2.1.6

Compare Source

v2.1.6 is a patch release scoped to fixing issues reported by users of Crossplane v2.1 and fixing security related issues in Crossplane's dependencies.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.1.5...v2.1.6

v2.1.5

Compare Source

v2.1.5 is a patch release scoped to fixing issues reported by users of Crossplane v2.1 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

  • Dependency upgrades work correctly with ImageConfig prefix rewriting: Packages installed via an ImageConfig prefix rewrite were previously not being upgraded when their dependencies changed, leaving users stuck on stale versions of dependent packages. Dependency upgrades now behave as expected when prefix rewrites are in use. Backported in #​7279, originally fixed in #​7233.

  • Composition functions can now select all resources of a given kind: When a composition function returned a Requirements.ResourceSelector with only apiVersion and kind set (no matchName or matchLabels), Crossplane previously rejected this as an invalid request. A selector with no match field is now correctly interpreted as "all resources of that kind". Backported in #​7246, originally fixed in #​7241.

This release also bumps Go to 1.25.9 and pulls in security related updates for a number of Crossplane's upstream dependencies, including grpc, cosign, go-git, go-jose, cloudflare/circl, moby/spdystream, sigstore/timestamp-authority, docker/cli, and the OpenTelemetry OTLP HTTP trace exporter.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.1.4...v2.1.5

v2.1.4

Compare Source

This release backports #​7030 to the 2.1 branch to fix one of the issues reported in #​3423, where shared transitive dependencies could not be upgraded successfully. It also contains security updates to Crossplane's dependencies.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.1.3...v2.1.4

v2.1.3

Compare Source

This release resolves #​6761 - issues when upgrading providers that manifest with errors like these:

cannot establish control of object: addresses.compute.gcp.upbound.io is already controlled by ProviderRevision provider-gcp-compute-a41e4ba551fc (UID 58db5de-38e7-40f9-9d31-669bb25a688e)

What's Changed

  • [Backport release-2.1] Use server-side apply for MRD controller by @​negz in #​6952

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.1.2...v2.1.3

v2.1.2

Compare Source

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.1.1...v2.1.2

v2.1.1

Compare Source

This release backports #​6911, which makes the new XR watch circuit breaker a little more lenient. We noticed sometimes simple XRs were triggering the circuit breaker during initial creation, which usually involves a burst of watch events as resources are created and update to reach a stable state.

What's Changed

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.1.0...v2.1.1

v2.1.0

Compare Source

The v2.1.0 release is a regular quarterly Crossplane release that is focused on maturing a number of key areas of functionality across the project, as Crossplane continues to become more capable, more reliable, and more performant for your production workloads. After the major v2.0 release, we spent time focusing on polishing and hardening the experience with the goal of enhancing core reliability.

⚠️ Upgrade from v2.0

It is strongly advised to upgrade to v2.1 from the previous minor version, which is v2.0. Upon upgrade for each minor release, Crossplane performs any necessary migrations of its CRDs to ensure the latest versions are stored in the Kubernetes API server. Therefore, it is important to upgrade sequentially through one minor version at a time as described in the upgrade docs.

🎉 Highlights

  • XR circuit breaker: A circuit breaker was added to all Composite Resource (XR) controllers in #​6777 to prevent reconciliation thrashing when controllers fight over composed resource state. This addresses a common cause of excessive resource (CPU) usage.
    • Each circuit breaker monitors reconciliation rates for their XR and opens ("breaks the circuit") when thresholds are exceeded (50 burst, 1 every 2s sustained). While open, it blocks most reconcile requests but allows one through every 30 seconds. The circuit stays open for 5 minutes, then automatically closes and returns to normal operation. If thrashing resumes, the circuit will open again.
  • Realtime compositions for namespaced XRs: #​6780 fixes an issue where namespaced XRs were not being reconciled in response to changes in their composed resources.
  • crossplane render for remote Docker daemons: #​6799 fixes an issue that prevented crossplane render from establishing a connection to the remote Docker host.
    • crossplane render now allows function annotations to be passed on the command line with -a/--function-annotations flags. Two new function annotations are now supported:
      • render.crossplane.io/runtime-docker-publish-address controls the host address Docker publishes the container port to (defaults to 127.0.0.1 for security)
      • render.crossplane.io/runtime-docker-target controls the address the CLI connects to (defaults to the publish address)
  • XRD change detection: In previous versions of Crossplane, XRD spec fields could change without the XR controller being restarted automatically. With #​6806, users no longer need to manually restart the Crossplane deployment for some XRD changes to take effect.

🚨 Warnings and breaking changes

  • Crossplane's custom rate limiting implementation as well as client-side rate limiting has been removed in #​6851 as proposed and described in detail in #​6790.
    • Crossplane's reconcilers will rely on a combination of the Kubernetes API Priority and Fairness, the circuit breaker described in the highlights below, and worker pool size configuration to appropriately manage reconciliation load and retries in the control plane.
    • --max-concurrent-reconciles can be set to influence the maximum number of concurrent reconcile operations (worker pool size) that Crossplane will perform.
      • The --max-reconcile-rate flag has been renamed to this new --max-concurrent-reconciles flag to better represent what this flag controls
      • The old --max-reconcile-rate flag is now an alias for the new flag name
    • Providers are unaffected by this change, only core Crossplane reconcilers are affected.

🏅 Release MVP

@​binarycode is the v2.1 release MVP! They discovered a critical issue preventing realtime compositions from functioning correctly for namespaced XRs. Their fix in #​6780 now properly configures an index for each namespaced XR so that events generated from changes in their composed resources correctly result in the XR being enqueued for reconciliation.

Thank you very much to @​binarycode, our latest release MVP! 🙇‍♂️

What's Changed

New Contributors

Full Changelog: https://github.com/crossplane/crossplane/compare/v2.0.0...v2.1.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot Sylva instance.

CI configuration couldn't be handle by MR description. A dedicated comment has been posted to control it.

If no checkbox is checked, a default pipeline will be enabled (capm3, or capo if capo label is set)

Edited by Sylva Renovate bot

Merge request reports