Skip to content

Releases

This page tracks notable changes in Apache Superset Kubernetes Operator releases.

Unreleased

Added

  • Seconds and year precision in cronSchedule. Lifecycle task cronSchedule fields now accept 6- and 7-field cron expressions in addition to the classic 5-field form — an optional leading seconds field and/or trailing year field (e.g. */30 * * * * * every 30 seconds, 0 0 2 * * * 2027). Existing 5-field schedules are unaffected (#238, @villebro).
  • Helm imagePullSecrets. The Helm chart now exposes an imagePullSecrets value that sets spec.template.spec.imagePullSecrets on the operator Deployment, letting operators pull the manager image from a private registry. The referenced Secrets must already exist in the release namespace — the chart does not create them (#240, @younsl).
  • Helm topologySpreadConstraints. The Helm chart now exposes a topologySpreadConstraints value that sets spec.template.spec.topologySpreadConstraints on the operator Deployment, letting operators distribute manager pods across failure domains such as nodes and zones (#213, @younsl).
  • Helm revisionHistoryLimit. The Helm chart now exposes a revisionHistoryLimit value that allows setting spec.revisionHistoryLimit on the operator Deployment, capping the number of old ReplicaSets retained for rollback (@younsl).
  • Helm extra manifests. The Helm chart now supports extraManifests for rendering trusted, release-scoped Kubernetes manifests with Helm tpl. Use it for companion resources owned by the operator release, not shared cluster infrastructure such as Gateway API controllers, CRDs, or shared Gateways (#196, @younsl).
  • Helm resize policy. The Helm chart now supports resizePolicy on the manager container, controlling whether an in-place pod resize (InPlacePodVerticalScaling) restarts the container (#200, @younsl).

Changed

  • Breaking: renamed the "version" status fields to "tag". status.version → status.tag (the kubectl get column is renamed Version → Tag), and status.lifecycle.upgrade.fromVersion/toVersion → fromTag/toTag. No behavior change.
  • Breaking: downgrade blocking is removed. Any change to the lifecycle image tag now re-runs the migrate task (superset db upgrade) regardless of direction — the operator no longer performs semver comparison or sets status.phase: Blocked on a version decrease. The migrate task only runs superset db upgrade (Superset's down migrations are poorly tested and often break, so the operator never runs them), so take a database backup before an upgrade if you may need to revert. The direction field is removed from status.lifecycle.upgrade, and the VersionComparisonSkipped warning event no longer fires.
  • Breaking: the lifecycle clone task is renamed to seed. Rename spec.lifecycle.clone to spec.lifecycle.seed (and its postCloneSQL field to postSeedSQL) in your Superset resources. The task Job name suffix changes from -clone to -seed, and the lifecycle status phase from Cloning to Seeding. Custom seed.command scripts must read the renamed SUPERSET_OPERATOR__SEED_SRC_* environment variables.

Security

  • Credential redaction in task failure output. Lifecycle task failure messages are now scrubbed with best-effort pattern-based redaction before being persisted to the parent Superset status and Kubernetes Events: passwords embedded in connection URIs and common credential assignments (password=..., token=..., etc.) are masked. This mitigates the known limitation where a failing task command could leak credential fragments into status (@younsl).

0.1.1 - 2026-06-29

Fixed

  • Honor HPA-managed replica counts: the operator no longer overwrites the replica count on Deployments whose scaling is owned by a HorizontalPodAutoscaler (#152, @pashtet04).

0.1.0 - 2026-06-10

Added

Known limitations

  • Websocket server is experimental. The websocket server is not yet well supported and is pending security hardening; it is not recommended for production use.
  • Downgrade protection requires semver image tags. Downgrades are detected and blocked only when both image tags are valid semver. Non-semver tags (latest, date stamps, digest pins) cannot be ordered, so the operator emits a VersionComparisonSkipped warning and proceeds without blocking. See Lifecycle.
  • Task failure messages may include credential fragments. Lifecycle task failure output is truncated into status and could contain fragments of task stdout, including credentials. See security.md.