[mannie-exe]

Chart 1.7.0 upgrades cfgate from alpha.7 to alpha.8 and installs matching recovery schemas. DNS write intents and ownership prefixes survive interrupted operations; token configuration gains rotation overlap and stricter validation. Existing chart values remain compatible.

The default image is pinned to the published, attested alpha.8 multi-architecture index (sha256:1655fd304fe4e1111eaef92fac743b127fa3fd226bd6e28e352866effe1acaa9). Operator release run 37103409834 passed all gates, including 121 E2E tests, zero failures or skips. Registry identity and the attestation's source commit/tag were verified locally; the chart release guard verifies them again before publication.

Upgrade notes cover automatic renewal, Secret distribution, admitted route discovery, delegated zones, immutable TXT prefixes, image overrides, and rollback obligations. Normalize legacy token durations such as 012h to 12h before upgrading schemas; the documented correction also works afterward. Historical migration guidance stays linked to its release tag; changelogs remain workflow-generated.

Validation:

• 20 chart/guard tests, Helm lint, default/custom/external-resource rendering, actionlint, and exact parity of all four rendered CRD specs with operator source passed
• Kubernetes 1.37.0: chart 1.6.0 → 1.7.0 with --reuse-values, published image digest, successful rollout and restart
• stored DNS object UID and user values preserved; new pending-write status fields retained; immutable prefix and token duration/overlap validation exercised
• legacy 012h migration tested before and after policy CRD replacement, including rejection of token-list edits until normalized
• claim ConfigMap creation permitted in the installation namespace and denied in another namespace
• test resources and disposable cluster cleaned up; temporary Colima setting restored

Greptile reviewed the final commit with 5/5 and no unresolved findings. CI passes.

[greptile-apps]

Confidence Score: 5/5

[High risk] Updates Kubernetes operator chart and CRD schemas.

The PR appears safe to merge based on the reviewed changes.

Summary

Chart 1.7.0 targets cfgate alpha.8 with a new default image digest, updated DNS recovery and service-token schemas, and expanded upgrade guidance.

• Updates chart metadata and image-rendering test expectations.
• Adds policy token validation and DNS recovery status fields.
• Documents token-duration migration and rollback precautions.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Chart[Chart 1.7.0] --> Image[cfgate alpha.8 image]
  Chart --> CRDs[Updated policy and DNS CRDs]
  CRDs --> Upgrade[Upgrade guidance]

Loading

_{Reviews (2) · Last reviewed commit: "docs: provide a token duration upgrade p..."}