operator: v2.4.6
Changed
- Client certificates are now named
$FULLNAME-$CERT-client-cert. - Bump Redpanda helm chart dependency to 5.10.5
Fixed
-
ClusterRoles for the PVCUnbinder and BrokerDecommissioner are now enabled / disabled when their respective controller is enabled / disabled.Previously
ClusterRoles were always generated and could only be disabled by settingstatefulset.sideCars.controllers.createRBACtofalsewhich rendered the sidecar inoperable. -
Fix a bug with the way the config-watcher sidecar syncs users. The Kubernetes mechanism for writing out a changed secret is involves re-creating a symlink in the secrets directory that points to the mounted secret. Previously the config-watcher only detected changes to the entire directory and could potentially miss syncs, this resyncs everything anytime the symlink is recreated.
-
mTLS client certificates are now generated per certificate, as required, instead of using a single and potentially invalid certificate.