Skip to content

Releases

This page tracks notable changes in Apache Superset Kubernetes Operator releases.

Unreleased

Changed

  • Kubernetes support now covers the three newest kind-published minor versions instead of two. CI tests Kubernetes 1.37, 1.36, and 1.35 natively, with the experimental next lane disabled again (#317).

Fixed

  • The operator now requests update on supersets/finalizers, so reconciliation no longer fails on clusters with the OwnerReferencesPermissionEnforcement admission plugin enabled (e.g. OpenShift), where the API server previously rejected the blockOwnerDeletion owner references the operator sets on child resources (#359, @villebro).

Security

  • Breaking: CRs with serviceAccount.create=true (or unset) and serviceAccount.name != metadata.name are now rejected at admission. To use a pre-existing ServiceAccount with a different name, set serviceAccount.create=false (#324, @villebro).
  • Breaking: Valkey cache and results-backend keyPrefix values are now constrained to ^[A-Za-z0-9._:-]*$ (max 128 characters); values containing spaces, slashes, or other characters outside that set are rejected. The safer rendering also causes a one-time config-checksum change and pod roll on upgrade (#325, @villebro).
  • Seed excludeTables, excludeTableData, and postSeedSQL values are now passed literally to generated seed scripts; values that previously relied on shell expansion no longer expand (#325, @villebro).
  • Breaking: Celery Flower is no longer published on the Ingress/Gateway surface in Production by default. Flower's default command ships without authentication and its dashboard discloses task names and arguments — for Superset, other users' async SQL Lab statements and alert/report payloads. In Production (the default) Flower is fanned out onto the end-user host — and its port opened in the built-in NetworkPolicy — only when you explicitly set celeryFlower.service.gatewayPath; Development and Staging continue to publish it by default. To keep exposing Flower in Production, set celeryFlower.service.gatewayPath (e.g. /flower) after placing authentication in front of it (e.g. FLOWER_BASIC_AUTH injected from a Secret via celeryFlower.podTemplate.container.env) (#279, @villebro).
  • Breaking: A Production Superset CR can no longer be changed in place to Development or Staging; delete and recreate the instance to change environment out of Production. Upgrades toward Production and non-Production transitions are unaffected (#327, @villebro).

0.2.0 - 2026-08-11

Added

  • Seconds and year precision in cronSchedule. Lifecycle task cronSchedule fields now accept 6- and 7-field cron expressions in addition to the classic 5-field form — an optional leading seconds field and/or trailing year field (e.g. */30 * * * * * every 30 seconds, 0 0 2 * * * 2027). Existing 5-field schedules are unaffected (#238, @villebro).
  • Helm imagePullSecrets. The Helm chart now exposes an imagePullSecrets value that sets spec.template.spec.imagePullSecrets on the operator Deployment, letting operators pull the manager image from a private registry. The referenced Secrets must already exist in the release namespace — the chart does not create them (#240, @younsl).
  • Helm topologySpreadConstraints. The Helm chart now exposes a topologySpreadConstraints value that sets spec.template.spec.topologySpreadConstraints on the operator Deployment, letting operators distribute manager pods across failure domains such as nodes and zones (#213, @younsl).
  • Helm revisionHistoryLimit. The Helm chart now exposes a revisionHistoryLimit value that allows setting spec.revisionHistoryLimit on the operator Deployment, capping the number of old ReplicaSets retained for rollback (@younsl).
  • Helm extra manifests. The Helm chart now supports extraManifests for rendering trusted, release-scoped Kubernetes manifests with Helm tpl. Use it for companion resources owned by the operator release, not shared cluster infrastructure such as Gateway API controllers, CRDs, or shared Gateways (#196, @younsl).
  • Helm resize policy. The Helm chart now supports resizePolicy on the manager container, controlling whether an in-place pod resize (InPlacePodVerticalScaling) restarts the container (#200, @younsl).

Changed

  • Breaking: renamed the "version" status fields to "tag". status.version → status.tag (the kubectl get column is renamed Version → Tag), and status.lifecycle.upgrade.fromVersion/toVersion → fromTag/toTag. No behavior change.
  • Breaking: downgrade blocking is removed. Any change to the lifecycle image tag now re-runs the migrate task (superset db upgrade) regardless of direction — the operator no longer performs semver comparison or sets status.phase: Blocked on a version decrease. The migrate task only runs superset db upgrade (Superset's down migrations are poorly tested and often break, so the operator never runs them), so take a database backup before an upgrade if you may need to revert. The direction field is removed from status.lifecycle.upgrade, and the VersionComparisonSkipped warning event no longer fires.
  • Breaking: the lifecycle clone task is renamed to seed. Rename spec.lifecycle.clone to spec.lifecycle.seed (and its postCloneSQL field to postSeedSQL) in your Superset resources. The task Job name suffix changes from -clone to -seed, and the lifecycle status phase from Cloning to Seeding. Custom seed.command scripts must read the renamed SUPERSET_OPERATOR__SEED_SRC_* environment variables.

Security

  • Credential redaction in task failure output. Lifecycle task failure messages are now scrubbed with best-effort pattern-based redaction before being persisted to the parent Superset status and Kubernetes Events: passwords embedded in connection URIs and common credential assignments (password=..., token=..., etc.) are masked. This mitigates the known limitation where a failing task command could leak credential fragments into status (@younsl).

0.1.1 - 2026-06-29

Fixed

  • Honor HPA-managed replica counts: the operator no longer overwrites the replica count on Deployments whose scaling is owned by a HorizontalPodAutoscaler (#152, @pashtet04).

0.1.0 - 2026-06-10

Added

Known limitations

  • Websocket server is experimental. The websocket server is not yet well supported and is pending security hardening; it is not recommended for production use.
  • Downgrade protection requires semver image tags. Downgrades are detected and blocked only when both image tags are valid semver. Non-semver tags (latest, date stamps, digest pins) cannot be ordered, so the operator emits a VersionComparisonSkipped warning and proceeds without blocking. See Lifecycle.
  • Task failure messages may include credential fragments. Lifecycle task failure output is truncated into status and could contain fragments of task stdout, including credentials. See security.md.