Release 2.8.0: Gate CRD installation behind installCrds (#163)

Author: pcholakov

AGENTS.md

@@ -35,6 +35,20 @@ After changing a CRD struct, regenerate in this order (or run `just generate-all
 
 When making changes, check whether the change warrants a release note by reviewing the guidelines in `release-notes/README.md`. If it does, create a release note file in `release-notes/unreleased/` as part of the same change.
 
+## Releasing
+
+The release workflow (`.github/workflows/release.yml`) is tag-driven: pushing a
+`v<version>` tag builds and publishes the docker image and helm chart under that
+version. It bumps nothing. In the release commit you must therefore bump all three
+version files together to the new version:
+
+- `Cargo.toml`
+- `Cargo.lock` (the `restate-operator` package entry — via `cargo check`, not by hand)
+- `charts/restate-operator-helm/Chart.yaml`
+
+Then consolidate the `release-notes/unreleased/` files into `v<version>.md`. See
+`release-notes/README.md` for the full, authoritative release process (bump → consolidate → delete → merge → tag).
+
 ## Trusted CA Certs Init Container
 
 The trusted CA certs feature (`spec.security.trustedCaCerts`) uses an init container that reads the system CA bundle from `/etc/ssl/certs/ca-certificates.crt` (Debian/Alpine path). If the Restate server base image is changed to a different distro (e.g. RHEL uses `/etc/pki/tls/certs/ca-bundle.crt`), the `SYSTEM_CA_BUNDLE` constant in `src/controllers/restatecluster/reconcilers/compute.rs` must be updated.

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "restate-operator"
-version = "2.7.0"
+version = "2.8.0"
 authors = ["restate.dev"]
 edition = "2024"
 rust-version = "1.92"

Cargo.toml

@@ -2,4 +2,4 @@ apiVersion: v2
 name: restate-operator-helm
 description: An operator for Restate clusters
 type: application
-version: "2.7.0"
+version: "2.8.0"

charts/restate-operator-helm/Chart.yaml

@@ -56,6 +56,30 @@ When making a significant change that affects users, create a release note file
 
 ## Release Process
 
+> **CI is tag-driven and bumps nothing.** The release workflow
+> (`.github/workflows/release.yml`) derives the version from the pushed `v<version>`
+> tag and publishes the docker image and helm chart under that version. It does
+> **not** edit or commit `Cargo.toml`, `Cargo.lock`, or `Chart.yaml`. You must bump
+> those version files by hand in the release commit *before* tagging. A tag whose
+> version differs from `Chart.yaml`'s internal `version:` publishes a chart whose OCI
+> tag and internal metadata disagree.
+
+Release checklist (in order):
+
+1. **Bump the version in all three files, together, to the new version:**
+   - `Cargo.toml` — `version = "<version>"`
+   - `Cargo.lock` — the `restate-operator` package entry. Do **not** hand-edit it;
+     run `cargo check` after bumping `Cargo.toml` so the lockfile updates, then
+     confirm the `restate-operator` entry reads `version = "<version>"`.
+   - `charts/restate-operator-helm/Chart.yaml` — `version: "<version>"`
+2. **Consolidate release notes** into `v<version>.md` (see the detailed steps below).
+3. **Delete the individual `unreleased/` files** after consolidation (keep `.gitkeep`).
+4. **Merge the release PR** into `main`.
+5. **Tag `v<version>` on the merge commit** and push it to trigger the release
+   workflow, which builds and publishes the docker image and helm chart.
+
+The rest of this section details the consolidation step.
+
 When creating a new release:
 
 1. **Review all unreleased notes**: Check `unreleased/` for all pending release notes

release-notes/README.md

@@ -0,0 +1,58 @@
+# Restate Operator v2.8.0 Release Notes
+
+## Highlights
+
+- **CRD installation is now gated behind the `installCrds` Helm value** — the chart's CRDs are templated (default `installCrds: true`) instead of living in Helm's special `crds/` directory. They now update on `helm upgrade`, and can be turned off with `installCrds: false` when CRDs are managed outside the chart.
+
+## New Features
+
+### Gate CRD installation behind `installCrds`
+
+The chart's CRDs are now templated and gated behind a new `installCrds` Helm value
+(default `true`). The CRD manifests moved from `crds/` to `crd-manifests/` and are
+rendered by `templates/crds.yaml`.
+
+Because the CRDs are templated rather than kept in Helm's special `crds/` directory,
+they are applied on `helm upgrade`, so CRD schema updates now ship with chart
+upgrades instead of requiring a manual `kubectl apply`.
+
+**Impact on Users:**
+- Existing deployments: no change with the default `installCrds: true`.
+
+**Migration Guidance:**
+
+Set `installCrds: false` when the CRDs are managed outside this chart (e.g. a
+separate manifest, as nuon-byoc vendors them) to avoid duplicate server-side-apply
+ownership:
+
+```yaml
+installCrds: false
+```
+
+Caveat: templated CRDs are removed on `helm uninstall`, which cascades to and
+deletes any existing custom resources (RestateClusters, RestateDeployments,
+RestateCloudEnvironments). Set `installCrds: false` if you need CRDs to survive an
+uninstall.
+
+*Related: PR [#161](https://github.com/restatedev/restate-operator/pull/161)*
+
+## Improvements
+
+### Helm Chart
+
+- **CRDs are templated and gated behind `installCrds`** (default `true`), so schema
+  updates apply on `helm upgrade` and CRD installation can be disabled when CRDs are
+  managed elsewhere. See the New Features section above for details and the uninstall
+  caveat. ([#161](https://github.com/restatedev/restate-operator/pull/161))
+
+## Upgrading
+
+Upgrade the operator via Helm:
+
+```bash
+helm upgrade restate-operator restatedev/restate-operator --version 2.8.0
+```
+
+With the default `installCrds: true`, the updated CRDs are applied as part of the
+upgrade. If you manage CRDs outside this chart, set `installCrds: false` and apply
+them yourself.