[mannie-exe]

Chart 1.6.0 installs the published cfgate 0.2.0-alpha.7 image by verified digest and includes its Access ownership/recovery schemas. The minor version follows the chart contribution rules for CRD schema changes.

The existing release guard now accepts and verifies the operator's digest-pinned connector reference. Helm rejects configuration budgets below the manager's 67-byte minimum. Upgrade notes focus on Access adoption, CRD updates, image overrides, CA rotation and overload behavior; historical guidance links to its release tag.

Validation:

• 20 chart/guard tests, Helm lint, actionlint, default/CI/external-resource rendering and packaging passed
• all four rendered CRD schemas match the released operator; operator provenance, source/package image pins and connector availability verified
• real ARM64 Kubernetes 1.37.0 upgrade from published chart 1.5.0 with --reuse-values passed: values unchanged, alpha.7 Ready, custom ports retained, matching installed schemas
• disposable cluster removed and temporary Colima setting restored

cfgate alpha.7 is published: https://github.com/cfgate/cfgate/releases/tag/v0.2.0-alpha.7. Its release E2E passed all 120 specs. Chart publication remains pending review; existing workflows generate release notes and publish the package.

[greptile-apps]

Confidence Score: 5/5

[High risk] Updates Kubernetes operator chart and CRD schemas.

The PR appears safe to merge based on the reviewed changes.

Summary

Chart 1.6.0 updates cfgate to alpha.7 with a pinned operator image, updated Access and Tunnel CRD schemas, a minimum configuration-byte budget, and revised upgrade guidance. The follow-up changes correct connector tag-versus-pin verification and document how existing Tunnels opt into the new connector pin.

_{Reviews (2) · Last reviewed commit: "fix: verify connector tag against pin"}

[mannie-exe]

@greptileai

Fixed the connector verification finding: resolve the version tag independently and compare it with the released operator's digest pin. The corrected regression reproduced the failure before the fix; all 20 chart/guard tests, Helm lint and packaging now pass. The actual connector tag matches its pin. Upgrade guidance now explains that existing Tunnels retain their stored connector image and must explicitly opt into the new pin.