v1.0.0-rc.1

Announcement 📢

• The SecretProviderClass and SecretProviderClassPodStatus CRDs are now v1!
• The helm charts have been moved to https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts. Refer to https://secrets-store-csi-driver.sigs.k8s.io/getting-started/upgrades.html#upgrades for information on upgrading existing clusters.
• Note to Providers: Return files in gRPC responses to the driver is now the recommended approach. See #551
• CustomResourceDefinitions in helm charts have been moved from templates to crds directory in v0.1.0. pre-upgrade hooks have been added to manage the lifecycle of CRDs during install/upgrade.
• ❗ Rollback to previous helm chart versions after installing v0.1.0+ will result in an error.

Features 🌈

• Promoted CRDs to v1 (#760, @aramase)
• Add Windows Server 2022 (#757, @nick5616)

Bug Fixes 🐞

• Update base image for ltsc2022 (#770, @aramase)

Driver images are hosted in GCR at k8s.gcr.io/csi-secrets-store/driver

v1.0.0-rc.0

Announcement 📢

• The helm charts have been moved to https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts. Refer to https://secrets-store-csi-driver.sigs.k8s.io/getting-started/upgrades.html#upgrades for information on upgrading existing clusters.
• Note to Providers: Return files in gRPC responses to the driver is now the recommended approach. See #551
• CustomResourceDefinitions in helm charts have been moved from templates to crds directory in v0.1.0. pre-upgrade hooks have been added to manage the lifecycle of CRDs during install/upgrade.
• ❗ Rollback to previous helm chart versions after installing v0.1.0+ will result in an error.

Bug Fixes 🐞

• create or update secretproviderclasspodstatus post mount (#735, @aramase)

Documentation 📘

• update RELEASE docs based on v0.3.0 experience (#718, @tam7t)
• fix typo in helm url (#720, @nilekhc)
• fix typo in chart url in charts dir (#721, @aramase)
• add detail about pprof and metrics endpoint (#731, @aramase)
• update design docs status (#737, @aramase)

Maintenance 🔧

• rename references from master to main (#726, @aramase)
• add LICENSE to all files (#727, @aramase)
• remove deprecated --prometheus-port flag (#732, @aramase)
• update the initialDelaySeconds and timeoutSeconds for node-driver-registrar livenessprobe (#729, @aramase)
• use structured logging and update imports order (#736, @aramase)
• use kubectl.kubernetes.io/default-container annotation (#738, @aramase)
• update to debian-base:bullseye-v1.0.0 (#742, @aramase)

Testing 💚

• implement e2e provider (#682, @nilekhc)
• add workflow for e2e using staging images (#730, @nilekhc)
• adds support for inplace upgrade test (#741, @nilekhc)

Driver images are hosted in GCR at k8s.gcr.io/csi-secrets-store/driver

v0.3.0

Announcement 📢

• The helm charts have been moved to https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts. Refer to https://secrets-store-csi-driver.sigs.k8s.io/getting-started/upgrades.html#upgrades for information on upgrading existing clusters.
• Note to Providers: Return files in gRPC responses to the driver is now the recommended approach. See #551
• CustomResourceDefinitions in helm charts have been moved from templates to crds directory in v0.1.0. pre-upgrade hooks have been added to manage the lifecycle of CRDs during install/upgrade.
• ❗ Rollback to previous helm chart versions after installing v0.1.0+ will result in an error.

Breaking Changes ⚠️

• --filtered-watch-secret cannot be disabled starting in v0.3.0. Refer to #550 for more info. If you're using nodePublishSecretRef in the volume, refer to https://secrets-store-csi-driver.sigs.k8s.io/load-tests.html on actions to take before upgrade.
• syncSecret.enabled has been set to false by default in v0.0.23. This means the RBAC clusterrole and clusterrolebinding required for sync mounted content as Kubernetes secret will no longer be created by default as part of helm install/upgrade. If you're using the driver to sync mounted content as Kubernetes secret, you'll need to set syncSecret.enabled=true as part of helm install/upgrade.
• Refer to https://secrets-store-csi-driver.sigs.k8s.io/getting-started/upgrades.html#pre-v010 before upgrade from versions < v0.1.0

Bug Fixes 🐞

• remove constraints on secret type name (#703, @aramase)

Testing 💚

• extended windows first pod timeout to 300s (#698, @aramase)
• cleanup filteredWatchSecret=false from e2e tests (#708, @aramase)
• update kubectl to 1.22.1 (#713, @tam7t)
• add aws release test (#633, @tam7t)

Helm 📈

• allow annotations on upgrade jobs (#692, @thomasmRavn )
• publish helm charts using github workflow (#693, @aramase)
• update chart repo to https://kuberentes-sigs.github.io/secrets-store-csi-driver/charts (#695, @aramase)
• add pod security policy to upgrade hooks (#709, @nilekhc)

Maintenance 🔧

• update release documentation (#649, @tam7t)
• update node-driver-registrar to v2.3.0 (#691, @aramase)
• update opentelemetry to v0.20.0 (#701, @aramase)
• refactor: remove csi-common package and update driver (#702, @aramase)
• update build to go 1.17 (#710, #711, @aramase)
• update livenessprobe to v2.4.0 (#712, @aramase)
• upgrade build runner to N1_HIGHCPU_8 (#714, @aramase)

Driver images are hosted in GCR at k8s.gcr.io/csi-secrets-store/driver

v0.2.0

Announcement 📢

• --filtered-watch-secret has been enabled by default in v0.1.0 release. Refer to #550 for more info.
• Note to Providers: Return files in gRPC responses to the driver is now the recommended approach. See #551
• CustomResourceDefinitions in helm charts have been moved from templates to crds directory in v0.1.0. pre-upgrade hooks have been added to manage the lifecycle of CRDs during install/upgrade.
• ❗ Rollback to previous helm chart versions after installing v0.1.0+ will result in an error.

Breaking Changes ⚠️

• syncSecret.enabled has been set to false by default in v0.0.23. This means the RBAC clusterrole and clusterrolebinding required for sync mounted content as Kubernetes secret will no longer be created by default as part of helm install/upgrade. If you're using the driver to sync mounted content as Kubernetes secret, you'll need to set syncSecret.enabled=true as part of helm install/upgrade.
• --filtered-watch-secret has been enabled by default in v0.1.0 release. Refer to #550 for more info. If you're using nodePublishSecretRef in the volume, refer to https://secrets-store-csi-driver.sigs.k8s.io/load-tests.html on actions to take before upgrade.
• Refer to https://secrets-store-csi-driver.sigs.k8s.io/getting-started/upgrades.html#pre-v010 before upgrade from versions < v0.1.0

Documentation 📘

• add details on v0.1.0 upgrades (#650, @tam7t)
• Update Membership.md with more roles/details (#607, @karenhchu)
• update load test doc for filtered watch secret (#667, @aramase)

Testing 💚

• use kubectl exec instead of cp (#664, @aramase)
• gcp tests: explicit specify namespace (#664, @tam7t)
• adds make target for deploy manifest (#669, @nilekhc)

Helm 📈

• add option to configure fullnameOverride (#671, @aramase)
• Add pre-install to upgrade hook so existing CRDs on helm install can be upgraded (#679, @ritazh)
• use same toleration and nodeselector for crd-hook jobs (#683, @uncycler)

Maintenance 🔧

• update golangci-lint (#635, @tam7t)
• Add metrics port definition to DS (#614, @NissesSenap)
• Migrate from deprecated io/ioutil package to using os package (#673, @katyamag)
• update debian base to buster-v1.9.0 (#681, @aramase)

Driver images are hosted in GCR at k8s.gcr.io/csi-secrets-store/driver

v0.1.0

Announcement 📢

• --filtered-watch-secret has been enabled by default in v0.1.0 release. Refer to #550 for more info.
• Note to Providers: Return files in gRPC responses to the driver is now the recommended approach. See #551
• CustomResourceDefinitions in helm charts have been moved from templates to crds directory. pre-upgrade hooks have been added to manage the lifecycle of CRDs during install/upgrade.
• ❗ Rollback to previous helm chart versions after installing v0.1.0 will result in an error.

Breaking Changes ⚠️

• syncSecret.enabled has been set to false by default. This means the RBAC clusterrole and clusterrolebinding required for sync mounted content as Kubernetes secret will no longer be created by default as part of helm install/upgrade. If you're using the driver to sync mounted content as Kubernetes secret, you'll need to set syncSecret.enabled=true as part of helm install/upgrade.
• --filtered-watch-secret has been enabled by default in v0.1.0 release. Refer to #550 for more info. If you're using nodePublishSecretRef in the volume, refer to https://secrets-store-csi-driver.sigs.k8s.io/load-tests.html on actions to take before upgrade.
• Refer to https://secrets-store-csi-driver.sigs.k8s.io/getting-started/upgrades.html#pre-v010 before upgrade

Features 🌈

• set filtered-watch-secret to true by default for nodePublishSecretRef (#594, @aramase)
• use DynamicRESTMapper for manager (#608, @aramase)
• add possibility to annotate the created secret with CSI driver (#612, @tetianakravchenko)
• Initial implementation of token request (#471, @micahhausler)

Bug Fixes 🐞

• fix Windows nodes compatibility issues in pod definition (#625, @georgechang)
• fix CVE-2021-33910 (#645, @aramase)

Documentation 📘

• Debugging (#556, @nilekhc)
• Release management (#555, @nilekhc)
• update master to main release (#616, @ikarldasan)
• link and mention optional features (#627, @tam7t)
• use testgrid for readme test status (#631, @tam7t)
• adds note about crd upgrade (#642, @nilekhc)

Testing 💚

• add e2e for filtered-watch-secret=false (#596, @aramase)
• add kubernetes.io/os nodeselector for azure tests (#626, @aramase)
• use kubectl wait to check if pods ready (#628, @aramase)
• implements e2e upgrade test (#602, @nilekhc)
• ensure pod deletion is successful (#599, @tam7t)
• include more debug info in artifacts (#632, @tam7t)
• get logs for sidecar containers (#638, @aramase)
• gcp use workload id instead of node publish (#641, @tam7t)
• add driver-crd image to e2e-helm-upgrade target (#657, @aramase)

Helm 📈

• ❗ Move crds to crds dir for helm3 and installCRDs flag for supporting helm3 ( #289, @Evalle)
• move default annotations out of conditional (#629, @aramase)
• Crd upgrade via helm hooks (#623, @nilekhc)
• add keep-crd upgrade hook (#656, @aramase)

Maintenance 🔧

• upgrades controller-runtime to v0.9.0 (#593, @nilekhc)
• update to debian-base v1.7.2 and update packages to fix CVEs (#603, @aramase)
• add warning message for sync secret forbidden error (#606, @aramase)
• update debian base to buster-v1.8.0 (#609, @aramase)
• removes local cache used for rotation (#598, @nilekhc)
• revert changes from deploy and add to manifest_staging (#630, @aramase)
• switch to using distroless base image for driver-crds (#643, @aramase)

Driver images are hosted in GCR at k8s.gcr.io/csi-secrets-store/driver

v0.0.23

Announcement 📢

• --filtered-watch-secret will be enabled by default in v0.1.0 release. Refer to #550 for more info.
• Note to Providers: Prepare to return files in gRPC responses as this will become the recommended approach in the next release. See #551

Breaking Changes ⚠️

• syncSecret.enabled has been set to false by default. This means the RBAC clusterrole and clusterrolebinding required for sync mounted content as Kubernetes secret will no longer be created by default as part of helm install/upgrade. If you're using the driver to sync mounted content as Kubernetes secret, you'll need to set syncSecret.enabled=true as part of helm install/upgrade.

Features 🌈

• add arm64 build (#575, @aramase)
• add rbac role and binding for rotation (#586, @aramase)

Bug Fixes 🐞

• CVE-2021-3520 (#562, @aramase)

Documentation 📘

• set-as-env-var pod indent (#553, @dawncold)
• add membership criteria and getting involved section (#563, @aramase)
• fix the default volume path for providers (#574, @katyamag)
• Add AWS Provider (#517, @nlamirault)
• add aws provider ref in install provider (#584, @aramase)

Testing 💚

• enable shellcheck and fix errors (#557, @aramase)
• Add test coverage report into Makefile for unit test (#537, @hixichen)
• add aws integration tests (#533, @lasred)
• Add uuid to AWS secret and parameter names (#569, @lasred)

Helm 📈

• provide ability to add volume and volumeMounts (#539, @hixichen)
• add image pull secrets (#554, @mehmetsalgar)
• default syncSecret.enable to false (#510, @ritazh)

Maintenance 🔧

• add psp snippet to manifests target (#560, @aramase)
• add tam7t as approver (#564, @aramase)
• update to debian-base v1.7.0 (#565, @aramase)
• remove deprecated --grpc-supported-providers and --debug flag (#566, @aramase)
• Add golang version validate at Makefile (#538, @hixichen)
• Added GOPROXY propagation to container builds (#571, @micahhausler)
• Replace golang.org/x/net/context with context (#577, @hixichen)
• generate log if grpc message size larger than max (#581, @aramase)
• list builder instances in image build (#583, @aramase)
• enable qemu for multi-arch (#586, @aramase)

Driver images are hosted in GCR at k8s.gcr.io/csi-secrets-store/driver

v0.0.22

Announcement 📢

• syncSecret.enabled will be set to false by default in the next release v0.0.23. Refer to #268 for more info.
• --filtered-watch-secret will be enabled by default in v0.1.0 release. Refer to #550 for more info.
• Note to Providers: Prepare to return files in gRPC responses as this will become the recommended approach in a future release. See #551

Features 🌈

• add optional healthcheck for provider plugins (#508, @aramase)
• allow maxCallRecvMsgSize to be increased for large secret mounts (#512, @tam7t)
• vendor atomic_writer and use it to write files returned by grpc (#520, @tam7t)

Bug Fixes 🐞

• GetMountedFiles() returns map that key includes sub directory (#516, @mitsutaka)
• windows targetpath cleanup as part of node unpublish (#545, @aramase)

Documentation 📘

• fix indentation in load tests (#504, @aramase)
• add test scenarios currently supported (#509, @aramase)
• install to kube-system & best-practices (#505, @tam7t)

Testing 💚

• include nested path in secret sync and update vault suite (#532, @aramase)

Helm 📈

• Added Pod Security Policy to the chart (#478, @pierluigilenoci)
• node affinity now prevents CSI driver from being scheduled on a node with a label 'type=virtual-kublet' (#513, @manedurphy)

Maintenance 🔧

• updates CSIDriver api ver to storage.k8s.io/v1 (#518, @nilekhc)
• update to using k8s.io/mount-utils (#524, @aramase)
• remove windows file deletion on unmount (#526, @tam7t)
• update sidecar images and set imagePullPolicy to IfNotPresent (#519, @aramase)
• update release docs and makefile targets (#543, @aramase)
• Bump versions for v0.0.22 (#544, @tam7t)
• make manifests dependencies (#547, @tam7t)

Driver images are hosted in GCR at k8s.gcr.io/csi-secrets-store/driver

v0.0.21

Features 🌈

• add helpers and tools to install proto utilities (#461, @tam7t)
• optimization based on load test (#458, @aramase)
  • add filtered watch for reconcile
  • switch to using versioned clients for rotation
  • enable filtered secret watch with feature flag
  • create separate cache for nodepublishsecretref in rotation
  • ❗ Refer to Load tests for more details and actions to take.
• connect to plugins at runtime instead of configuration (#462, @tam7t)
• allow providers to have the driver write files (#481, @tam7t)

Bug Fixes 🐞

• CVE-2021-24032 (#470, @aramase)
• prevent duplicate owner references (#493, @aramase)
• grpc naming is not compatible with windows unix socket (#490, @tam7t)

Documentation 📘

• update ingress sample url for azure provider (#452, @aramase)
• fix urls in providers doc (#466, @aramase)
• add design docs url and remove old docs (#468, @aramase)
• Fix broken doc link for website (#465, @hixichen)
• use multi-os image for examples and update urls (#494, @aramase)
• add load test spec and results (#497, @aramase)

Testing 💚

• add e2e for filtered watch secret (#479, @aramase)
• update vault e2e to use versioned deployment (#484, @aramase)
• add make target for installing chart releases (#487, @aramase)
• add helm deploy target for windows tests (#491, @aramase)
• update tests to use multi-os image (#480, @aramase)

Maintenance 🔧

• update to go 1.16 (#467, @aramase)
• upgrade to controller-runtime v0.8.2 (#473, @aramase)
• remove v1.15 yamls and update doc (#486, @aramase)
• update servercore reference to windows-servercore-cache (#488, @aramase)
• update debian base to buster-v1.5.0 (#496, @aramase)

Driver images are hosted in GCR at k8s.gcr.io/csi-secrets-store/driver

v0.0.20

Features 🌈

• enable 2004 builds for windows images (#439)
• set secrets-store default container for log (#451)

Bug Fixes 🐞

• set rsa key type for pkcs1 key (#448)

Documentation 📘

• Update mdbook to 0.4.5 to fix CVE-2020-26297 (#436)
• update docs site (#399)
• update readme to reference docs site (#445)

Testing 💚

• Update e2e tests for gRPC Vault provider release (#431)
• add image scan as part of CI (#441)

Helm 📈

• Helm value for setting pod annotations (#440)
• add podLabels parameter (#444)
• add log verbosity for node-driver-registrar (#449)

Maintenance 🔧

• update debian-base image to buster-v1.3.0 (#428)
• add vault provider to grpc supported providers (#434)
• remove host network (#437)
• remove deprecated logic of invoking provider binary (#433)
• update klog to v2.5.0 (#449)
• increase cloudbuild timeout to 1h (#456)

Driver images are hosted in GCR at k8s.gcr.io/csi-secrets-store/driver

v0.0.19

Warning ⚠️

• With this release of the driver, the liveness-probe sidecar container image has been updated to v2.2.0. This version of the liveness-probe contains a fix for memory leak issues that were observed in previous versions. Update to the latest driver using helm or manifests to get the latest liveness-probe image.

Features 🌈

• use common port for all metrics (#421)

Bug Fixes 🐞

• CVE-2020-27350, CVE-2020-29362 (#422)

Helm 📈

• add support to set annotations (#412)
• add providersDir (#409)

Maintenance 🔧

• add azure provider to grpc supported providers (#417)
• update PR template for chart updates (#419)
• update node-driver-registrar and liveness-probe images (#424) ❗

Driver images are hosted in GCR at k8s.gcr.io/csi-secrets-store/driver