Version v0.13.0

This is the changelog for version 0.13.0.

Security

Fixed a denial-of-service where a ManagedResource whose template rendered invalid JSON could put the reconcile loop into an infinite loop: pinning CPU, flooding the logs, and blocking all other reconciliation while holding the shared reconcile lock. The operator kept reporting healthy while doing no work. See advisory GHSA-2xh4-9qm7-q779.

A rendered template document that cannot be decoded now fails the whole ManagedResource with Ready=False and applies none of its documents. Previously a malformed document in a multi-document template was skipped and the remaining documents were applied, leaving the resource reporting success, so a typo could silently drop a document. Templates that render valid documents are unaffected.
Resources created before a mid-reconcile failure are now recorded in .status.createdResources, and resources already deleted before a cleanup failure are removed from it. Previously a partial failure could leave the status out of sync with the cluster, which also prevented later cleanup from tracking those resources.

The published container image now records the operator's own Go module and version, so vulnerability scanners and SBOM tools can identify it. Previously only its dependencies were visible.

Check out the release on GitHub