All notable changes to this project will be documented in this file.

• Support floating tags for product images via the new spec.image.stackableVersionPolicy field (#767).
• Add /ready endpoint to the operator Deployment, which reports the CRD installation status (#770).
• Document that the Stackable Hive images restore the get_table and get_table_objects_by_name Thrift methods removed by HIVE-26537, and assert it in the smoke test (#766).
• Add support for Hive 4.2.1 (#766, #782).
• The logs of the containerdebug process are now collected by the Vector agent and forwarded to the Vector aggregator (#790).
• The metastore now has a default affinity to the OPA Pods when OPA authorization is configured (#772).

• Remove support for Hive 4.0.1 (#766).

• BREAKING: spec.image.stackableVersion must now be a full, valid semver version, e.g. 26.7.1. Abbreviated values such as 26.7 are no longer accepted (#767).
• BREAKING: spec.image.pullPolicy now defaults to IfNotPresent for non-floating tags instead of always defaulting to Always (#767).
• Internal operator refactoring: introduce a build() step in the reconciler that assembles all relevant Kubernetes resources before anything is applied (#726).
• The RBAC ServiceAccount and RoleBinding are now built with the operator-rs v2::rbac functions and carry the full set of recommended labels (#731).
• BREAKING: The metastore role is now required by the CRD; a HiveCluster without it was previously accepted by the API server but failed reconciliation (#731).
• Bump stackable-operator to 0.121.0 (#735, #748, #767, #770, #779).
• The reconciler now applies resources and derives the cluster status in discrete apply and update_status steps (#737).
• All product containers now run with securityContext.runAsNonRoot set to true to improve security (#741).
• envOverrides names are now validated by the shared EnvVarName type rather than by operator-specific validation code (#748).
• Remove the app.kubernetes.io/component and app.kubernetes.io/role-group labels from the resources they don't apply to (#748, #787).
• Make operations infallible where dependent on static inputs (#759, #764).
• Support Vector 0.58.0 (#776, #780, #781).
• test: Update OPA to 1.20.2 in integration tests (#778).
• Replace serde_yaml with yaml_serde (#779).
• All pods now set securityContext.seccompProfile.type to RuntimeDefault (#779).
• The operator Deployment runs with a restricted security context and a read-only root filesystem, so it can be deployed into namespaces that enforce the restricted Pod Security Standard (#785).

• HMS now also handles table and schema locations using the s3:// scheme, not just s3a://, when an S3 connection is configured (#736).
• Fix a longstanding problem of including empty categories, shortNames and additionalPrinterColumns in the CRDs, which could cause problems with GitOps tools (e.g. ArgoCD) reporting a diff in the custom resources. See our internal issue and the fix for details (#741).
• The operator now watches all resources that it creates and early-exits the reconcile action when the cluster is marked for deletion (#754).
• The operator now watches the S3Connection referenced by spec.clusterConfig.s3.reference (#765).
• The containerdebug process writes its log file again. The operator set CONTAINERDEBUG_LOG_DIRECTORY, which containerdebug stopped reading in its version 0.2.0 when it moved to stackable-telemetry; the directory is now set via FILE_LOG_DIRECTORY. The file is rotated hourly and at most two files are kept, because rotation is opt-in (#790).
• The Vector unit tests run again. #780 added a test-config.yaml argument to test-vector.sh without adding the file, so since then the test run aborted before executing any case (#790).

• BREAKING: Add required CLI argument and env var to set the image repository used to construct final product image names: IMAGE_REPOSITORY (--image-repository), eg. oci.example.org/my/namespace (#702).

• Bump stackable-operator to 0.113.3 (#725).
• BREAKING: configOverrides now only accepts the supported config file names hive-site.xml and security.properties. Previously arbitrary keys were silently accepted but ignored (#695).
• Document Helm deployed RBAC permissions and remove unnecessary permissions (#693).
• Bump stackable-operator to 0.110.0 and kube to 3.1.0 (#695).
• BREAKING: Implement generic database connection. This means you need to replace your simple database connection string with a typed struct. This struct is consistent between different CRDs, so that you can easily copy/paste it between stacklets. Read on the Hive database documentation for details (#674).
• Internal operator refactoring: introduce dereference() and validate() steps in the reconciler (#707).
• test: Bump vector-aggregator to 0.55.0, replace /graphql call with gRPC call (#713).
• Deprecated support for 4.0.1 (#711).
• BREAKING: Removed product-config machinery. This is a breaking change in terms of configuration. Users relying on the product-config properties.yaml file have to set these properties via the CRD (#716).

• Removed support for 4.1.0 (#711).

• Add conversion webhook (#676).
• Add OPA authorization using the operator-rs OpaConfig (#652).
• Support objectOverrides using .spec.objectOverrides. See objectOverrides concepts page for details (#665).
• Enable the restart-controller, so that the Pods are automatically restarted on config changes (#666).
• Add support for 4.2.0 (#668).

• Bump stackable-operator to 0.108.0 and strum to 0.28 (#683, #685).
• Gracefully shutdown all concurrent tasks by forwarding the SIGTERM signal (#670).
• Bump testing-tools to 0.3.0-stackable0.0.0-dev (#664).
• Deprecate support for 4.1.0 (#668).

• Fix "404 page not found" error for the initial object list (#685).

• Helm: Allow Pod priorityClassName to be configured (#633).
• Add prometheus.io/path|port|scheme annotations to metrics service (#641).
• Add end-of-support checker (#647).
  • EOS_CHECK_MODE (--eos-check-mode) to set the EoS check mode. Currently, only "offline" is supported.
  • EOS_INTERVAL (--eos-interval) to set the interval in which the operator checks if it is EoS.
  • EOS_DISABLED (--eos-disabled) to disable the EoS checker completely.

• Bump stackable-operator to 0.100.1 and product-config to 0.8.0 (#646).

• Previously we had a bug that could lead to missing certificates (#636).

  This could be the case when you specified multiple CAs in your SecretClass. We now correctly handle multiple certificates in this cases. See this GitHub issue for details

• Adds new telemetry CLI arguments and environment variables (#596).
  • Use --file-log-max-files (or FILE_LOG_MAX_FILES) to limit the number of log files kept.
  • Use --file-log-rotation-period (or FILE_LOG_ROTATION_PERIOD) to configure the frequency of rotation.
  • Use --console-log-format (or CONSOLE_LOG_FORMAT) to set the format to plain (default) or json.
• BREAKING: Add Listener support for Hive (#605).
• Add internal headless service in addition to the metrics service (#613).
• Add RBAC rule to helm template for automatic cluster domain detection (#615).

• BREAKING: Replace stackable-operator initialize_logging with stackable-telemetry Tracing (#585, #592, #596).
  • The console log level was set by HIVE_OPERATOR_LOG, and is now set by CONSOLE_LOG_LEVEL.
  • The file log level was set by HIVE_OPERATOR_LOG, and is now set by FILE_LOG_LEVEL.
  • The file log directory was set by HIVE_OPERATOR_LOG_DIRECTORY, and is now set by FILE_LOG_DIRECTORY (or via --file-log-directory <DIRECTORY>).
  • Replace stackable-operator print_startup_string with tracing::info! with fields.
• BREAKING: Inject the vector aggregator address into the vector config using the env var VECTOR_AGGREGATOR_ADDRESS instead of having the operator write it to the vector config (#589).
• test: Bump to Vector 0.46.1 (#599).
• BREAKING: Previously this operator would hardcode the UID and GID of the Pods being created to 1000/0, this has changed now (#603)
  • The runAsUser and runAsGroup fields will not be set anymore by the operator
  • The defaults from the docker images itself will now apply, which will be different from 1000/0 going forward
  • This is marked as breaking because tools and policies might exist, which require these fields to be set
• Use versioned common structs (#604).
• BREAKING: Bump stackable-operator to 0.94.0 and update other dependencies (#615).
  • The default Kubernetes cluster domain name is now fetched from the kubelet API unless explicitly configured.
  • This requires operators to have the RBAC permission to get nodes/proxy in the apiGroup "". The helm-chart takes care of this.
  • The CLI argument --kubernetes-node-name or env variable KUBERNETES_NODE_NAME needs to be set. The helm-chart takes care of this.
• The operator helm-chart now grants RBAC patch permissions on events.k8s.io/events, so events can be aggregated (e.g. "error happened 10 times over the last 5 minutes") (#617).

• Use json file extension for log files (#591).
• Fix a bug where changes to ConfigMaps that are referenced in the HiveCluster spec didn't trigger a reconciliation (#589).
• Allow uppercase characters in domain names (#615).

• Remove the lastUpdateTime field from the stacklet status (#615).
• Remove role binding to legacy service accounts (#615).

• Run a containerdebug process in the background of each Hive container to collect debugging information (#554).
• Aggregate emitted Kubernetes events on the CustomResources (#560).
• Support configuring JVM arguments (#572).
• Support for S3 region (#574).
• Support for version 4.0.1 as LTS (#579).

• Default to OCI for image metadata and product image selection (#561).
• Increase default memory reservation to 768Mi to avoid OOMKilled (#578).
• Mark version 4.0.1 as experimental and set 4.0.0 as LTS (#582).

• BREAKING: Remove the hive-env.sh config file, as e.g. setting HADOOP_OPTS in there had absolutely no effect. This is considered a fix, as users expected the envs to be used, but they haven't. Users should use envOverrides instead, which are actually working (#572).
• BREAKING: The env variable HADOOP_HEAPSIZE was previously put in hive-env.sh and very likely had no effect. It is now passed as env variable, thus working. This might impact your stacklet as the heap size setting now actually has an effect (#572).

• BREAKING: Use distinct ServiceAccounts for the Stacklets, so that multiple Stacklets can be deployed in one namespace. Existing Stacklets will use the newly created ServiceAccounts after restart (#544).

• Add support for Hive 4.0.0 (#508).
• The operator can now run on Kubernetes clusters using a non-default cluster domain. Use the env var KUBERNETES_CLUSTER_DOMAIN or the operator Helm chart property kubernetesClusterDomain to set a non-default cluster domain (#522).

• Reduce CRD size from 487KB to 60KB by accepting arbitrary YAML input instead of the underlying schema for the following fields (#505):
  • podOverrides
  • affinity
• Use config-utils (#518).

• BREAKING: The fields connection and host on S3Connection as well as bucketName on S3Bucketare now mandatory (#518).
• An invalid HiveCluster doesn't cause the operator to stop functioning (#523).
• Fix upgrade path from HMS 3.3.x to 4.0.x. Previously the schemaTool would try to re-create the database tables and would therefore fail. Starting with version 4.0.0 the schemaTool has the flag -initOrUpgradeSchema, which we use to resolve that problem (#539).

• Added documentation/tutorial on using external database drivers (#449).

• BREAKING: Switch to new image that only contains HMS. For most of the users this is an internal change, but this is breaking for users of custom logging configurations as the key hive-log4j2.properties in the ConfigMap containing the logging configuration must now be called metastore-log4j2.properties (#447).
• Bump stackable-operator from 0.64.0 to 0.70.0 (#480).
• Bump product-config from 0.6.0 to 0.7.0 (#480).
• Bump other dependencies (#483).

• [BREAKING] Move the metastore user and password DB credentials out of the CRD into a Secret containing the keys username and password (#452).
• Processing of corrupted log events fixed; If errors occur, the error messages are added to the log event (#472).

• Various documentation of the CRD (#394).
• Support user authentication using Kerberos (#402).
• Helm: support labels in values.yaml (#406).

• Default stackableVersion to operator version (#360).
• Configuration overrides for the JVM security properties, such as DNS caching (#365).
• Support PodDisruptionBudgets (#376).
• Support graceful shutdown (#385).

• vector 0.26.0 -> 0.33.0 (#361, #377).
• operator-rs 0.44.0 -> 0.55.0 (#360, #376, #377).
• jmx-exporter now referenced via soft link without version (#377).
• Service discovery now exposes the cluster service to enable HA (#382).

• Support for 2.3.9 (#377).

• Generate OLM bundle for Release 23.4.0 (#338).
• Missing CRD defaults for status.conditions field (#340).
• Set explicit resources on all container (#345, #347)
• Support podOverrides (#352)

• Increase the size limit of the log volume (#354).

• Operator-rs: 0.40.2 -> 0.44.0 (#336, #354).
• Use 0.0.0-dev product images for testing (#337)
• Use testing-tools 0.2.0 (#337)
• Added kuttl test suites (#348)

• Deploy default and support custom affinities (#315).
• Openshift compatibility (#323).
• Incorporated cluster-operation change. (#323).
• Extend cluster resources for status and cluster operation (paused, stopped) (#324).
• Cluster status conditions (#326).

• [BREAKING]: Support specifying Service type by moving serviceType (which was an experimental feature) to clusterConfig.listenerClass. This enables us to later switch non-breaking to using ListenerClasses for the exposure of Services. This change is breaking, because - for security reasons - we default to the cluster-internal ListenerClass. If you need your cluster to be accessible from outside of Kubernetes you need to set clusterConfig.listenerClass to external-unstable or external-stable (#327).
• Use operator-rs build_rbac_resources method (#323).
• operator-rs 0.36.0 → 0.40.2 (#323, #324).

• Bugfix: heap formatting and update product images used for tests (#317)

• Updated stackable image versions (#271).
• operator-rs 0.25.2 → 0.32.1 (#274, #283, #292, #298).
• Consolidated security context user, group and fs group (#277).
• [BREAKING] Use Product image selection instead of version. spec.version has been replaced by spec.image (#280).
• Fix role group node selector (#283).
• [BREAKING] Moved database specification from role / role-group level to top-level clusterConfig (#292).
• [BREAKING] Moved s3, serviceType and hdfs discovery to top-level clusterConfig (#292).
• Enable logging (#298).

• PVCs for data storage, cpu and memory limits are now configurable (#242).
• Orphaned resources are deleted (#254).
• Support HDFS connections (#264).

• operator-rs 0.22.0 -> 0.25.2 (#254).

• Improved, tested getting started guide via script (#225).
• Add temporary attribute to support using ClusterIP instead of NodePort service type (#237).

• Include chart name when installing with a custom release name (#204, #205).
• operator-rs 0.21.1 -> 0.22.0 (#206).
• Add support for Hive 3.1.3 (#211, #213).

• Add missing role to read S3Connection objects (#220).

• Reconciliation errors are now reported as Kubernetes events (#137).
• Use cli argument watch-namespace / env var WATCH_NAMESPACE to specify a single namespace to watch (#142).
• Warning in docs to use only PostgreSQL <= 10 (#168).
• Support S3 TLS verification (#198).

• operator-rs 0.10.0 -> 0.21.0 (#137, #142, #168, #179).
• Adapted S3 connection to operator-rs provided structs (#179).
• [BREAKING] Specifying the product version has been changed to adhere to ADR018 instead of just specifying the product version you will now have to add the Stackable image version as well, so version: 2.3.9 becomes (for example) version: 2.3.9-stackable0.4.0 (#184)

• monitoring scraping label prometheus.io/scrape: true (#115).

• operator-rs 0.8.0 → 0.10.0 (#115).

• Discovery via ConfigMaps (#52).
• Services and Nodeports (#52).

• operator-rs 0.5.0 → 0.8.0 (#52, #73, #85).
• Migrated to StatefulSet rather than direct Pod management (#52).
• Changed version from enum to String (#52).
• Shut down gracefully (#72).

• Command handling and respective CRDs (#52).
• Hive port and metrics port not configurable anymore and removed from CRD (#52).

• operator-rs 0.3.0 → 0.4.0 (#21).
• Adapted pod image and container command to docker image (#21).
• Adapted documentation to represent new workflow with docker images (#21).

• operator-rs : 0.3.0 (#14)
• Use framework re-exports. (#14)