v0.35.1

[github.com/gardener/etcd-druid:v0.35.1]

🏃 Others

• [OPERATOR] Added next-cluster-version-compatible CLI flag to the Etcd configMap template to ensure version compatibility during etcd upgrades or downgrades. by @Shreyas-s14 [#1293]
• [OPERATOR] Upgrade to golang:1.25.7 in build/Dockerfile by @Shreyas-s14 [#1292]

[github.com/gardener/etcd-wrapper:v0.6.2]

🏃 Others

• [OPERATOR] Update to Go:1.25.7 in Dockerfile. by @ishan16696 [#83]

[github.com/gardener/etcd-backup-restore:v0.41.1]

🐛 Bug Fixes

• [OPERATOR] Fix the deadlock issue in snapshotter. by @ishan16696 [#984]
• [OPERATOR] Memory leak issue has been fixed by ensuring the etcd watch client is properly closed. by @ishan16696 [#987]

🏃 Others

• [OPERATOR] Upgrade to golang:1.25.7 in build/Dockerfile by @Shreyas-s14 [#997]
• [OPERATOR] Added the next-cluster-version-compatible flag to embed etcd and helm chart for version compatibility of etcd. by @Shreyas-s14 [#998]

Helm Charts

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/etcd-druid:v0.35.1

Container (OCI) Images

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/gardener/etcd-druid:v0.35.1

v0.35.0

[github.com/gardener/etcd-druid:v0.35.0]

📰 Noteworthy

• [DEVELOPER] Refactor e2e tests using go-native tests. make ci-e2e-kind ca now be run against providers none, local or both.
  Set environment variable RETAIN_TEST_ARTIFACTS=all|failed to retain all test-related resources in the cluster. But beware, this can lead to resource starvation for subsequent test cases in the e2e test run. Not setting this will clean up clean up test artifacts for successfully completed test cases.
  Set environment variable RETAIN_KIND_CLUSTER=true to ensure the KIND cluster created for e2e tests is not cleaned up after the tests finish running.
  Specify go-test arguments to be passed to the e2e test run via environment variable GO_TEST_ARGS, like GO_TEST_ARGS="-run TestBasic -count=1 -v".

  You can use convenience make target make clean-e2e-test-resources to clean up test artifacts created for e2e tests, such as PKI resources and test-case-related resources in the KIND cluster. by @shreyas-s-rao [#1060]

✨ New Features

• [OPERATOR] An optional field BackupSpec.StoreSpec.EndpointOverride is introduced in the etcd API, which enables operators to specify the object store's endpoint, overriding the cloud provider's default. by @renormalize [#1236]

🐛 Bug Fixes

• [DEVELOPER] Fixed the release workflow. by @renormalize [#1268]

🏃 Others

• [OPERATOR] Upgrade to Go 1.25.5 in Dockerfile. by @ishan16696 [#1261]
• [OPERATOR] Upgrade k8s.io/* to v0.34.3, sigs.k8s.io/controller-runtime to v0.22.5. by @renormalize [#1264]
• [OPERATOR] Upgrade to golang:1.25.6 in Dockerfile. by @renormalize [#1263]
• [OPERATOR] EtcdCopyBackupsTask also supports bucket override specified in StoreSpec.EndpointOverride. by @renormalize [#1266]
• [USER] A new Etcd API field spec.etcd.enableGRPCGateway has been introduced to allow raw http(s) calls to the etcd server endpoint without using the etcdctl or etcdutl clients. by @shreyas-s-rao [#1060]
• [DEVELOPER] api module unit tests are now part of GHA tests and enabled GHA tests across all builds by @anveshreddy18 [#1229]

[github.com/gardener/etcd-backup-restore:v0.41.0]

✨ New Features

• [OPERATOR] Operators can now configure a secondary target for backup storage, please check this usage doc for more information: https://github.com/gardener/etcd-backup-restore/tree/master/docs/usage/backup_sync_dual_site.md by @tchinmai7 [#917]

🐛 Bug Fixes

• [OPERATOR] Fixed the restoration failures that could occur when etcd backups was taken from etcd which has auth enabled. by @Tomy2e [#954]

🏃 Others

• [OPERATOR] Upgrade to go 1.25.0 by @ishan16696 [#969]
• [OPERATOR] Storage endpoint configuration must now be passed through the --store-endpoint-override flag instead of a field in the credential secret. The older method of passing endpoint through credential files is now deprecated. by @renormalize [#952]
• [OPERATOR] Update AWS SDK to provider support for new regions by @kon-angelo [#960]
• [OPERATOR] Upgrade to golang:1.25.6 in build/Dockerfile by @renormalize [#974]
• [OPERATOR] Upgrade k8s.io/* to v0.34.3, and cloud provider dependencies to latest. by @renormalize [#980]
• [DEVELOPER] Introduce build/.dockerignore to reduce the time take in the COPY phase during a local docker build on a developer's machine. by @renormalize [#972]

[github.com/gardener/etcd-wrapper:v0.6.1]

🏃 Others

• [OPERATOR] Upgrade to golang:1.25.6 in Dockerfile, 1.25.0 in go.mod. by @renormalize [#77]

Helm Charts

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/etcd-druid:v0.35.0

Container (OCI) Images

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/gardener/etcd-druid:v0.35.0

v0.34.0

[github.com/gardener/etcd-druid:v0.34.0]

📰 Noteworthy

• [OPERATOR] CRDs are now included directly in the git repository and helm charts, improving deployment reliability and version control tracking. by @mjudeikis [#1195]
• [DEPENDENCY] Upgrade k8s.io/* dependencies to v0.34.2, and direct dependencies to latest desired versions. by @renormalize [#1213]

✨ New Features

• [OPERATOR] Introduced the EtcdOpsTask CRD to enable declarative management of out-of-band etcd operational tasks, starting with on-demand snapshot configuration. Refer the api documentation to learn more about the etcdopstask api. by @seshachalam-yv [#1129]
• [OPERATOR] Cluster ID mismatch could now be detected by observing the ClusterIDMismatch Condition on the Etcd resource. by @CaptainIRS [#1165]
• [OPERATOR] Introduced and implemented the on-demand snapshot task for both delta and full snapshots for etcd. Refer the usage doc to learn more about how to configure and deploy an etcdopstask by @seshachalam-yv [#1129]

🏃 Others

• [OPERATOR] fix order of instructions in recovery docs by @mstueer [#1175]
• [OPERATOR] Set the PodSecurityContext's fsGroupChangePolicy to OnRootMismatch. by @ishan16696 [#1207]
• [OPERATOR] Upgrade to Go 1.25 in Dockerfile and Actions. by @renormalize [#1205]
• [OPERATOR] export testresults as inlined ocm-resource by @heldkat [#1164]
• [OPERATOR] Now, the singleton etcd cluster's readiness probe will use the /readyz endpoint of the etcd-wrapper instead of the /healthz endpoint of backup-restore. by @ishan16696 [#1193]
• [OPERATOR] Added cli flags for etcdopstask controller configuration for non Operator-Config based etcd-druid setup. by @Shreyas-s14 [#1226]
• [USER] Snapshot compression is now enabled by default.
  If you wish to disable the snapshot compression then please set the etcd resource: .spec.backup.compression.enabled to false. by @ishan16696 [#1202]
• [DEVELOPER] Set least permissible privileges for GHA build for release & non-release workflows by @anveshreddy18 [#1224]

[github.com/gardener/etcd-wrapper:v0.6.0]

🏃 Others

• [OPERATOR] export testresults as inlined ocm-resource by @GuezelS [#68]
• [OPERATOR] Upgrade to Go 1.25 in Dockerfile and Actions. by @renormalize [#69]
• [USER] Change permissions of files in etcd data directory to 0600. by @shreyas-s-rao [#55]
• [DEVELOPER] set proper permissions to release build for calling other dependency workflows by @anveshreddy18 [#74]
• [DEVELOPER] Update golang images to 1.24.4 by @shreyas-s-rao [#57]
• [DEVELOPER] Convert .reuse/dep5 to REUSE.toml. by @shreyas-s-rao [#61]

[github.com/gardener/etcd-backup-restore:v0.40.0]

📰 Noteworthy

• [DEPENDENCY] Upgrade k8s.io/* dependencies to v0.34.2, and direct dependencies to latest desired versions. by @renormalize [#937]

🏃 Others

• [OPERATOR] Adds the additional handling to reduce file permissions of safe_guard file. by @ishan16696 [#933]
• [OPERATOR] Upgrade to Go 1.25 in Dockerfile and Actions. by @renormalize [#929]
• [USER] Snapshot compression is now enabled by default.
  If you wish to disable the snapshot compression then please set this flag: --compress-snapshots to false. by @ishan16696 [#927]
• [DEVELOPER] Set least permissible privileges for GHA build for release & non-release workflows by @anveshreddy18 [#942]

Helm Charts

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/etcd-druid:v0.34.0

Container (OCI) Images

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/gardener/etcd-druid:v0.34.0

v0.33.0

[github.com/gardener/etcd-druid:v0.33.0]

⚠️ Breaking Changes

• [DEVELOPER] .ci scripts have been removed. As a consequence, GHA workflows and Dockerfile are now streamlined. by @shreyas-s-rao [#1172]
• [DEVELOPER] make druid has been replaced by make build with the correct ldflags and args. by @shreyas-s-rao [#1172]

✨ New Features

• [OPERATOR] Validations are added to EtcdCopyBackupsTask. by @CaptainIRS [#1155]

🐛 Bug Fixes

• [OPERATOR] An issue causing Etcd objects to not get reconciled on Create due to a stale PartialObjectMetadata cache is now fixed. by @shafeeqes [#1188]

🏃 Others

• [OPERATOR] Reduces the default value of etcd's --snapshot-count from 75,000 to 10,000 set by spec.etcd.snapshotCount. This will reduce memory and disk usage of etcd.
  If you rely on the previous default, then set spec.etcd.snapshotCount: 75000 to keep the old behavior. by @ishan16696 [#1166]
• [DEVELOPER] Add make target make check-license-headers to check missing license headers. by @shreyas-s-rao [#1170]

[github.com/gardener/etcd-backup-restore:v0.39.0]

✨ New Features

• [OPERATOR] When using S3 (or a S3-compatible) storage provider you can now configure the responseChecksumValidation and requestChecksumCalculation options via the secret file by @maboehm [#902]
• [OPERATOR] Cluster ID is now part of the etcd member lease for operators to easily troubleshoot split-brain/split-quorum scenarios. by @CaptainIRS [#913]
• [OPERATOR] GCS snapstore now support web identity authentication.
  To be enabled, the credentialsConfig (or serviceaccount.json) must be configured with credentials of type external_account, additionally in the same directory files projectID and token must be set respectively with the GCP project id and identity token. by @vpnachev [#908]

🏃 Others

• [DEVELOPER] migrate CICD-Pipeline to GitHub-Actions by @ccwienk [#894]

Helm Charts

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/etcd-druid:v0.33.0

Container (OCI) Images

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/gardener/etcd-druid:v0.33.0

v0.32.0

[github.com/gardener/etcd-druid:v0.32.0]

⚠️ Breaking Changes

• [OPERATOR] Snapshot compaction resources API has been changed in incompatible way. Refer the snapshotCompactionSpec section in the document to learn more on how to configure snapshot compaction controller. by @anveshreddy18 [#1130]

📰 Noteworthy

• [OPERATOR] EtcdStatus.Conditions slice is extended with a new condition type ConditionTypeLastSnapshotCompactionSucceeded that reports the status of last compaction activity ( compaction job / fullSnapshot ). See #1130 for more details. by @anveshreddy18 [#1130]

✨ New Features

• [OPERATOR] Trigger full snapshot when spinning up a compaction job is unviable, in order to expedite the successive restoration efforts by etcd-backup-restore. by @anveshreddy18 [#1130]

🐛 Bug Fixes

• [OPERATOR] Fix backup-restore TLS related CLI flags to etcd-wrapper. by @anveshreddy18 [#1133]

🏃 Others

• [DEVELOPER] migrate CICD-Pipeline to GitHub-Actions by @ccwienk [#1135]
• [DEVELOPER] rotate expired server credentials required for e2e tests to function by @anveshreddy18 [#1137]
• [DEVELOPER] Convert .reuse/dep5 to REUSE.toml. by @shreyas-s-rao [#1154]
• [OPERATOR] set stricter predicates for compaction controller : reduce unnecessary reconciliations triggered by job object. by @anveshreddy18 [#1158]

📖 Documentation

• [USER] fix documentation typo by @klocke-io [#1138]

Helm Charts

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/etcd-druid:v0.32.0

Container (OCI) Images

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/gardener/etcd-druid:v0.32.0

v0.31.0

[gardener/etcd-druid]

⚠️ Breaking Changes

• [OPERATOR] The existing CLI flag reconciler-service-account was optional. Its value is a fully qualified name of the service account used by etcd-druid in the format "system:serviceaccount::". This has now been made required. If you are continuing to use the deprecated CLI fags then you must specify it. Alternatively if you have switched to using the new OperatorConfiguration then you should set "OperatorConfiguration.Webhooks.EtcdComponentProtection.ServiceAccountInfo" instead. by @unmarshall [#1090]

✨ New Features

• [DEVELOPER] The new .spec.etcd.wrapperPort field allows to change the server port of etcd-wrapper. by @rfranzke [#1086]
• [OPERATOR] Introduced OperatorConfiguration as a replacement to the existing etcd-druid CLI flags. The configuration gets mounted as a ConfigMap onto the etcd-druid Deployment. The existing CLI flags have been marked as deprecated. Their support will be removed after a few releases of etcd-druid. by @unmarshall [#1090]

🐛 Bug Fixes

• [DEVELOPER] Fix incorrectly named config field in skaffold profile for e2e tests by @anveshreddy18 [#1134]
• [DEVELOPER] An issue has been fixed which caused etcd pods not to start when port different from the default values were used. by @rfranzke [#1086]
• [OPERATOR] Fix a bug which caused etcd-druid to fail at start up, due to a group mismatch for OperatorConfiguration in its group registration and templates. by @renormalize [#1118]
• [USER] Fix a volume mount issue of provider Local for etcd backups by @anveshreddy18 [#1102]

🏃 Others

• [USER] Secret controller now manages finalizer on referenced backup-restore TLS secrets. by @shreyas-s-rao [#1125]
• [OPERATOR] replace usage of fake client library in tests with the fake client builder in test/utils directory by @Shreyas-s14 [#1120]
• [OPERATOR] Fixes etcd-druid service template yaml to properly support operator configuration values defined in values.yaml by @unmarshall [#1132]
• [DEVELOPER] Remove the functionality that deletes old ConfigMaps from the cluster by @anveshreddy18 [#1103]

[gardener/etcd-backup-restore]

✨ New Features

• [DEVELOPER] AWS SDK has been upgraded to v2. by @vpnachev [gardener/etcd-backup-restore#874]

🏃 Others

• [DEVELOPER] Update golang version to 1.24.4. by @shreyas-s-rao [gardener/etcd-backup-restore#886]

[gardener/etcd-wrapper]

🏃 Others

• [DEVELOPER] Update golang images to 1.24.4. by @shreyas-s-rao [gardener/etcd-wrapper#58]

Helm Charts

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/etcd-druid/etcd-druid:v0.31.0

Container (OCI) Images

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/gardener/etcd-druid:v0.31.0

v0.30.1

[gardener/etcd-wrapper]

🏃 Others

• [USER] Change permissions of files in etcd data directory to 0600. by @shreyas-s-rao [gardener/etcd-wrapper#56]

Helm Charts

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/etcd-druid/etcd-druid:v0.30.1

Container (OCI) Images

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/gardener/etcd-druid:v0.30.1

v0.30.0

[gardener/etcd-wrapper]

✨ New Features

• [DEVELOPER] Introduce make targets docker-build and docker-push to build and push etcd-wrapper docker images to the configured registry. by @shreyas-s-rao [gardener/etcd-wrapper#51]
• [DEVELOPER] The new --etcd-client-port flag (default: 2379) allows to configure the etcd client port. by @rfranzke [gardener/etcd-wrapper#52]
• [DEVELOPER] The new --etcd-wrapper-port flag (default: 9095) allows to configure the etcd-wrapper server port. by @rfranzke [gardener/etcd-wrapper#52]

🏃 Others

• [DEPENDENCY] Update golang version to 1.23.5. by @shreyas-s-rao [gardener/etcd-wrapper#42]
• [USER] Change permissions for files in etcd data directory to 0640. by @shreyas-s-rao [gardener/etcd-wrapper#51]

[gardener/etcd-druid]

📰 Noteworthy

• [USER] Re-introduce /scale subresource for Etcd CRD. by @shreyas-s-rao [#1070]

✨ New Features

• [DEVELOPER] It is now possible to run the etcd pod as root by setting .spec.runAsRoot=true in the Etcd API. by @rfranzke [#1088]

🐛 Bug Fixes

• [OPERATOR] Fix the etcd reconciler bug that was introduced in #1070 by @renormalize [#1091]

🏃 Others

• [DEVELOPER] Remove unit test, integration test steps from PR jobs in concourse. by @shreyas-s-rao [#1056]

[gardener/etcd-backup-restore]

📰 Noteworthy

• [DEPENDENCY] Upgrade cloud.google.com/go/storage to v1.50.0. by @renormalize [gardener/etcd-backup-restore#854]

🐛 Bug Fixes

• [USER] Fix regression in cleanup of snapshot temporary directory. by @seshachalam-yv [gardener/etcd-backup-restore#876]
• [USER] Fix regression for snapshot temp dir cleanup when no snapstore configured. by @shreyas-s-rao [gardener/etcd-backup-restore#882]

🏃 Others

• [USER] Clean up snapshot temp directory during initialization. by @shreyas-s-rao [gardener/etcd-backup-restore#869]
• [DEVELOPER] Updated e2e test setup to install provider CLIs using apt package manager and fixed a failing test case involving etcd-wrapper process PID retrieval. by @anveshreddy18 [gardener/etcd-backup-restore#862]
• [DEVELOPER] Upgrade the concourse pipeline to go1.24.1. by @renormalize [gardener/etcd-backup-restore#859]

Helm Charts

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/etcd-druid/etcd-druid:v0.30.0

Container (OCI) Images

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/gardener/etcd-druid:v0.30.0

v0.29.1

[gardener/etcd-backup-restore]

🏃 Others

• [OPERATOR] Support non-HA autonomous clusters by skipping creation of Kubernetes clientset.
  ⚠️ To completely prevent the creation of the Kubernetes clientSet in the non-HA etcd-backup-restore, please also set the following CLI flags to false: --enable-member-lease-renewal and --enable-snapshot-lease-renewal. by @ishan16696 [gardener/etcd-backup-restore#870]

Helm Charts

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/etcd-druid/etcd-druid:v0.29.1

Docker Images

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/gardener/etcd-druid:v0.29.1

v0.29.0

[gardener/etcd-druid]

⚠️ Breaking Changes

• [DEVELOPER] Upgraded to golang 1.24.
  Removed the need for hack/tools.go and instead using first class support for tools in go.mod.
  Please update local go version to 1.24. by @unmarshall [#1041]

📰 Noteworthy

• [USER] compaction job metrics are now enhanced with the new label failureReason to query the reason for failure job failures. by @anveshreddy18 [#1039]

🏃 Others

• [DEPENDENCY] Bump versions of tools used for tests and checks. by @renormalize [#1042]
• [OPERATOR] feature operator
  Add possibility to add nodeSelector, affinity, tolerations & topologySpreadConstraints on the helm charts by @Hirostil [#1043]
• [OPERATOR] Component containers, which do not require privilege escalations, now forbid privilege escalation explicitly. by @georgibaltiev [#1038]
• [OPERATOR] Added CEL expression to prevent unsetting and setting of immutable fields in etcd.Spec after creation. by @Shreyas-s14 [#1053]

[gardener/etcd-wrapper]

🏃 Others

• [DEPENDENCY] Upgrade Go to 1.24, and dependencies. by @renormalize [gardener/etcd-wrapper#48]
• [OPERATOR] Upgrade indirect dependencies. by @renormalize [gardener/etcd-wrapper#50]

[gardener/etcd-backup-restore]

📰 Noteworthy

• [DEVELOPER] Introduce golangci-lint, goimports-reviser, goimports, upgrade tool versions, etc. by @renormalize [gardener/etcd-backup-restore#863]
• [USER] Added a support for skipping or ignoring any snapshot in an object lock-enabled S3 bucket. For more information please refer to this doc: https://github.com/gardener/etcd-backup-restore/blob/master/docs/usage/enabling_immutable_snapshots.md#aws-s3 by @renormalize [gardener/etcd-backup-restore#863]

🏃 Others

• [DEVELOPER] Upgrade Go to 1.24, and dependencies. by @renormalize [gardener/etcd-backup-restore#863]

Helm Charts

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/charts/gardener/etcd-druid/etcd-druid:v0.29.0

Docker Images

• etcd-druid: europe-docker.pkg.dev/gardener-project/releases/gardener/etcd-druid:v0.29.0