CHANGELOG.md

Changelog

4.0.0-alpha.3 (2026-05-03)

⚠ BREAKING CHANGES

• add new metric gates, diags and not_before off by defaut,

• container: switch default variant from busybox to scratch (floating tags)

• chart: make the Service headless by default (no ClusterIP)

• the Helm chart is now published exclusively as an OCI artifact at oci://quay.io/enix/charts/x509-certificate-exporter. The legacy Helm repository at https://charts.enix.io is no longer updated; users must switch to the OCI reference (Helm 3.8+ required). Installation: helm install x509-certificate-exporter oci://quay.io/enix/charts/x509-certificate-exporter --version <vX.Y.Z>. the Helm chart's values schema may diverge from v3 in edge cases despite a best-effort to preserve backwards compatibility. Review your existing values against the updated chart/values.yaml before upgrading. A JSON schema (chart/values.schema.json) is shipped with the chart so helm install / helm upgrade will reject any values that no longer match the expected shape, surfacing regressions early instead of at runtime. Alpine-based container images are no longer published. The release pipeline now ships only the busybox and scratch variants on linux/amd64,arm64,riscv64. Users pulling *-alpine tags must switch to one of the new variants — busybox is the closest functional replacement (still has a shell), scratch is the minimal distroless option.

• release 4.0.0-alpha.1 (410319d)

• release 4.0.0-alpha.1 (3f5d581)

• release 4.0.0-alpha.2 (c43ed24)

• release 4.0.0-alpha.3 (39d54d6)

Features

• add new metric gates, diags and not_before off by defaut, (a719113)
• add opt-in flag to skip symlinks (85c97e3)
• build: bump all Go dependencies (fc3bff2)
• build: bump all Go dependencies (e3b6c74)
• build: bump Go to version 1.26.1 (06d47be)
• build: bump Golang to version 1.20.7 (f2a7a19)
• build: bump Golang to version 1.21 (4014073)
• build: bump Golang to version 1.21.6 (a800033)
• build: bump Golang to version 1.21.8 (05582fc)
• build: bump Golang to version 1.21.9 (61a0f71)
• build: bump Golang to version 1.22.2 (8f15013)
• build: bump Golang to version 1.22.5 (956074c)
• build: bump Golang to version 1.23.0 (862481b)
• build: bump Golang to version 1.23.1 (082a818)
• build: bump Golang to version 1.23.2 (756827c)
• build: bump Golang to version 1.23.4 (1d90a66)
• build: publish OpenVEX documents for new releases (1ed09e5)
• build: publish SBOM documents for new releases (3bf4f4a)
• build: release FreeBSD binaries for RISC-V (0b8db06)
• build: upgrade to golang 1.19 (3916d18)
• build: upgrade to golang 1.20 (16429b9)
• chart: make the Service headless by default (no ClusterIP) (b1d5b5c)
• chart: remove support for legacy apiVersion (k8s < 1.16) (7f560fd)
• charts: add expose-secret-label parameter to exporter deployment (905f789)
• chart: satisfy PSA restricted profile and OpenShift restricted-v2 SCC (3d8b935)
• charts: configurable probes with values (2f58ca0)
• chart: support image digest pinning across all images (fd81d79)
• configurable burst and QPS in k8s client (e002b89)
• container: bump Alpine base image to 3.17.0 (e311864)
• container: bump Alpine base image to 3.18.2 (53ede98)
• container: bump Alpine base image to version 3.17.3 (de23f78)
• container: bump Alpine base image to version 3.18.3 (1d089c6)
• container: bump Alpine base image to version 3.19.0 (fc71664)
• container: bump Alpine base image to version 3.19.1 (9d0f7b5)
• container: bump Alpine base image to version 3.20.1 (500829e)
• container: bump Alpine base image to version 3.20.2 (3d2904a)
• container: bump Alpine base image to version 3.20.2 (1738e29)
• container: bump Alpine base image to version 3.21.0 (476b093)
• container: bump Alpine base image to version 3.22.0 (e0511a0)
• container: bump Alpine base image version to 3.23.3 (29c9c9a)
• container: bump Busybox base image to version 1.36 (29464ca)
• container: bump Busybox base image to version 1.36.1 (8201737)
• container: bump Busybox base image to version 1.37.0 (bf1f613)
• container: images for RISC-V now track Alpine stable (eb7752a)
• container: publish images to GitHub Registry (GHCR) (26f924d)
• container: switch Busybox images to glibc flavor (fix for RISC-V) (8f97b98)
• container: switch default variant from busybox to scratch (floating tags) (5ef7b43)
• container: switch to stable Alpine base images for RISC-V (92860e2)
• deploy,chart: make metricRelabelings configurable in ServiceMonitor and PodMonitor (6f81197)
• exporter: ability to expose k8s labels as prometheus metrics labels (cee171c)
• exporter: add auto tuning of GC memory limit (automemlimit) (cc3b0c0)
• exporter: use automaxprocs to limit threads count (efd7a6e)
• globbing support for -d (cbebdde)
• globbing support for -f option (7fa2298)
• globbing support for -k (30b406e)
• helm: add deployment and daemonSet annotations (5d81768)
• helm: add the Grafana dashboard (f145ffc), closes #136
• helm: added extraArgs (d2466a1)
• helm: bump kube-rbac-proxy to v0.13.1 and pull new repository (412f225)
• helm: do not use a headless Service by default (a5d2bf8), closes #50
• helm: increase CPU limits for all containers (902a45e)
• helm: introduce extraDeployVerbatim to skip templating engine (8b88740)
• helm: make revisionHistoryLimit configurable (6fc58ab)
• helm: mount of additional volumes (c3430d4)
• helm: new value to override release namespace (4c34353)
• helm: new value to set HostPath type for DaemonSet volumes (290094a)
• helm: options to set the priority class (f956d29)
• helm: report time left in expiration alert (45d9b15)
• helm: support custom TLS config (ff99541)
• helm: support for "web configuration" (HTTP auth and TLS) (0bc9f17)
• helm: switch to OCI artifacts (still tracked by Helm repository) (c9fd9d0)
• helm: upgrade hook to handle immutable changes with 3.20.0 (6fe7f4a)
• include or exclude namespaces to watch based on their labels (fc47f9b)
• rewrite from scratch with new architecture and toolchain (b4f3f84)
• symlink path mapping and containment (bbd179c)
• unify log format to use structured logs only (645a3ca)

Bug Fixes

• bundle errors not reaching the stats UI (cbd2724)
• chart: add app.kubernetes.io/component label to identify different resources (dad3408)
• ci: print line numbers for golang-ci-lint (e2d8253)
• clusterlevel resources dont need namespaces (4cbacc6)
• consider no match as a read error (8d11d1a)
• deploy,chart: remove cpu limits for secretsExporter and hostPathsExporter (a9d4a86)
• don't delay server initialization while caches are populated (0bf10f5)
• don't list all namespaces if not needed for filtering (d5adc63)
• helm: allow customization of httpGet heathchecks for TLS users (11d8af4), closes #445
• helm: allow secretsExporter.replicas to be set to 0 (bdcf627)
• helm: DaemonSets inherit global podAnnotations (1a670ed), closes #106
• helm: extraVolumeMounts omitted if webConfiguration not set (45a55f0)
• helm: grammar in Prometheus alerts descriptions (7803a4b)
• helm: namespace override value in DaemonSet template (26d6a88)
• helm: resolve redundant double slashes (//) in certificate monitoring paths (ce27399)
• kubernetes: fetch ConfigMaps when keys are configured (77f58c1), closes #368
• linter issues (c2707f5)
• properly resolve relative syminks (a59a7ab)
• properly resolve symlink paths (#86) (beb88b3)
• shrinkSecret to actually shrink (3bb2ed2)
• use doublestar fork to properly resolve symlinks (f7944e4)

Documentation

• 3to4: fix codeql warning on typescript syntax (584ecdb)
• add a v3 to v4 migration guide (da6ba51)
• add security policy with reporting channels and scope (146d4c0)
• add v3-to-v4 migration guide (d93d187)
• assets: new alternative logo (0a7d655)
• chart: add a menu (1212b90)
• chart: fix image URLs in README (79e927e)
• chart: link to the hardening guide (1a39d3f)
• chart: remove old notes ; link to curated starter values (a393d5a)
• chart: run helm-docs to update values in README.md (3b930c7)
• chart: update README with new project template ; migration to v4 (a90955b)
• clarify that hostPathsExporter was implemented for RKE (bb1dd92)
• dedicated metrics reference under docs/ (6b5078c)
• examples: add curated values.yaml starters for generic and per-distro setups (297fd74)
• Fix Linux deploy README (d3d81e7)
• fix markdown linting issues (5bcb838)
• fix typo (78d54a7)
• helm: emojis not requiring VS16 for colors in anchrored headers (3646831)
• helm: fix english texts (6e033bd)
• helm: fix value description and run helm-docs to update README (dec9be8)
• helm: fix values comment to pass helm linter (d907077)
• helm: refactor the concepts section (e0b9d71)
• helm: strip VS16 from emojis to fix GitHub anchors (2f19db6)
• helm: update values documentation in README (c8395dd)
• helm: update values in README (de59c88)
• helm: use Github generated anchror slugs for headings with VS16 emojis (4485844)
• metrics: new gates ; fixed labels ; better promql snippets ; cardinality clarification (c28eb69)
• new page with frequent questions (ba3bd51)
• README: add logo and refactor badges (efe4de8)
• README: fix broken link for sigstore ; better badge label (30d3015)
• README: fix links to the github project (0a780d9)
• README: new sections and markdown readability (1df03e4)
• readme: refresh file with helm-docs (71ff80c)
• README: relocate hardening to a dedicated page ; add a menu (30d1174)
• relocate grafana dashboard screenshot (9cbeb94)
• SECURITY: drop schedule (7d68bd5)
• SECURITY: restore timeline (b45520f)
• v3-to-v4: clarify the deprecation of CLI flags (3dd744b)
• v3-to-v4: drop hallucinated content (aa87503)
• warning about the relation between getLabels & compareCertificates (563028c)

4.0.0-alpha.3 (2026-05-03)

⚠ BREAKING CHANGES

• add new metric gates, diags and not_before off by defaut,

• container: switch default variant from busybox to scratch (floating tags)

• chart: make the Service headless by default (no ClusterIP)

• the Helm chart is now published exclusively as an OCI artifact at oci://quay.io/enix/charts/x509-certificate-exporter. The legacy Helm repository at https://charts.enix.io is no longer updated; users must switch to the OCI reference (Helm 3.8+ required). Installation: helm install x509-certificate-exporter oci://quay.io/enix/charts/x509-certificate-exporter --version <vX.Y.Z>. the Helm chart's values schema may diverge from v3 in edge cases despite a best-effort to preserve backwards compatibility. Review your existing values against the updated chart/values.yaml before upgrading. A JSON schema (chart/values.schema.json) is shipped with the chart so helm install / helm upgrade will reject any values that no longer match the expected shape, surfacing regressions early instead of at runtime. Alpine-based container images are no longer published. The release pipeline now ships only the busybox and scratch variants on linux/amd64,arm64,riscv64. Users pulling *-alpine tags must switch to one of the new variants — busybox is the closest functional replacement (still has a shell), scratch is the minimal distroless option.

• release 4.0.0-alpha.1 (410319d)

• release 4.0.0-alpha.1 (3f5d581)

• release 4.0.0-alpha.2 (c43ed24)

• release 4.0.0-alpha.3 (39d54d6)

Features

• add new metric gates, diags and not_before off by defaut, (a719113)
• add opt-in flag to skip symlinks (85c97e3)
• build: bump all Go dependencies (fc3bff2)
• build: bump all Go dependencies (e3b6c74)
• build: bump Go to version 1.26.1 (06d47be)
• build: bump Golang to version 1.20.7 (f2a7a19)
• build: bump Golang to version 1.21 (4014073)
• build: bump Golang to version 1.21.6 (a800033)
• build: bump Golang to version 1.21.8 (05582fc)
• build: bump Golang to version 1.21.9 (61a0f71)
• build: bump Golang to version 1.22.2 (8f15013)
• build: bump Golang to version 1.22.5 (956074c)
• build: bump Golang to version 1.23.0 (862481b)
• build: bump Golang to version 1.23.1 (082a818)
• build: bump Golang to version 1.23.2 (756827c)
• build: bump Golang to version 1.23.4 (1d90a66)
• build: publish OpenVEX documents for new releases (1ed09e5)
• build: publish SBOM documents for new releases (3bf4f4a)
• build: release FreeBSD binaries for RISC-V (0b8db06)
• build: upgrade to golang 1.19 (3916d18)
• build: upgrade to golang 1.20 (16429b9)
• chart: make the Service headless by default (no ClusterIP) (b1d5b5c)
• chart: remove support for legacy apiVersion (k8s < 1.16) (7f560fd)
• charts: add expose-secret-label parameter to exporter deployment (905f789)
• chart: satisfy PSA restricted profile and OpenShift restricted-v2 SCC (3d8b935)
• charts: configurable probes with values (2f58ca0)
• chart: support image digest pinning across all images (fd81d79)
• configurable burst and QPS in k8s client (e002b89)
• container: bump Alpine base image to 3.17.0 (e311864)
• container: bump Alpine base image to 3.18.2 (53ede98)
• container: bump Alpine base image to version 3.17.3 (de23f78)
• container: bump Alpine base image to version 3.18.3 (1d089c6)
• container: bump Alpine base image to version 3.19.0 (fc71664)
• container: bump Alpine base image to version 3.19.1 (9d0f7b5)
• container: bump Alpine base image to version 3.20.1 (500829e)
• container: bump Alpine base image to version 3.20.2 (3d2904a)
• container: bump Alpine base image to version 3.20.2 (1738e29)
• container: bump Alpine base image to version 3.21.0 (476b093)
• container: bump Alpine base image to version 3.22.0 (e0511a0)
• container: bump Alpine base image version to 3.23.3 (29c9c9a)
• container: bump Busybox base image to version 1.36 (29464ca)
• container: bump Busybox base image to version 1.36.1 (8201737)
• container: bump Busybox base image to version 1.37.0 (bf1f613)
• container: images for RISC-V now track Alpine stable (eb7752a)
• container: publish images to GitHub Registry (GHCR) (26f924d)
• container: switch Busybox images to glibc flavor (fix for RISC-V) (8f97b98)
• container: switch default variant from busybox to scratch (floating tags) (5ef7b43)
• container: switch to stable Alpine base images for RISC-V (92860e2)
• deploy,chart: make metricRelabelings configurable in ServiceMonitor and PodMonitor (6f81197)
• exporter: ability to expose k8s labels as prometheus metrics labels (cee171c)
• exporter: add auto tuning of GC memory limit (automemlimit) (cc3b0c0)
• exporter: use automaxprocs to limit threads count (efd7a6e)
• globbing support for -d (cbebdde)
• globbing support for -f option (7fa2298)
• globbing support for -k (30b406e)
• helm: add deployment and daemonSet annotations (5d81768)
• helm: add the Grafana dashboard (f145ffc), closes #136
• helm: added extraArgs (d2466a1)
• helm: bump kube-rbac-proxy to v0.13.1 and pull new repository (412f225)
• helm: do not use a headless Service by default (a5d2bf8), closes #50
• helm: increase CPU limits for all containers (902a45e)
• helm: introduce extraDeployVerbatim to skip templating engine (8b88740)
• helm: make revisionHistoryLimit configurable (6fc58ab)
• helm: mount of additional volumes (c3430d4)
• helm: new value to override release namespace (4c34353)
• helm: new value to set HostPath type for DaemonSet volumes (290094a)
• helm: options to set the priority class (f956d29)
• helm: report time left in expiration alert (45d9b15)
• helm: support custom TLS config (ff99541)
• helm: support for "web configuration" (HTTP auth and TLS) (0bc9f17)
• helm: switch to OCI artifacts (still tracked by Helm repository) (c9fd9d0)
• helm: upgrade hook to handle immutable changes with 3.20.0 (6fe7f4a)
• include or exclude namespaces to watch based on their labels (fc47f9b)
• rewrite from scratch with new architecture and toolchain (b4f3f84)
• symlink path mapping and containment (bbd179c)
• unify log format to use structured logs only (645a3ca)

Bug Fixes

• bundle errors not reaching the stats UI (cbd2724)
• chart: add app.kubernetes.io/component label to identify different resources (dad3408)
• ci: print line numbers for golang-ci-lint (e2d8253)
• clusterlevel resources dont need namespaces (4cbacc6)
• consider no match as a read error (8d11d1a)
• deploy,chart: remove cpu limits for secretsExporter and hostPathsExporter (a9d4a86)
• don't delay server initialization while caches are populated (0bf10f5)
• don't list all namespaces if not needed for filtering (d5adc63)
• helm: allow customization of httpGet heathchecks for TLS users (11d8af4), closes #445
• helm: allow secretsExporter.replicas to be set to 0 (bdcf627)
• helm: DaemonSets inherit global podAnnotations (1a670ed), closes #106
• helm: extraVolumeMounts omitted if webConfiguration not set (45a55f0)
• helm: grammar in Prometheus alerts descriptions (7803a4b)
• helm: namespace override value in DaemonSet template (26d6a88)
• helm: resolve redundant double slashes (//) in certificate monitoring paths (ce27399)
• kubernetes: fetch ConfigMaps when keys are configured (77f58c1), closes #368
• linter issues (c2707f5)
• properly resolve relative syminks (a59a7ab)
• properly resolve symlink paths (#86) (beb88b3)
• shrinkSecret to actually shrink (3bb2ed2)
• use doublestar fork to properly resolve symlinks (f7944e4)

Documentation

• 3to4: fix codeql warning on typescript syntax (584ecdb)
• add a v3 to v4 migration guide (da6ba51)
• add security policy with reporting channels and scope (146d4c0)
• add v3-to-v4 migration guide (d93d187)
• assets: new alternative logo (0a7d655)
• chart: add a menu (1212b90)
• chart: fix image URLs in README (79e927e)
• chart: link to the hardening guide (1a39d3f)
• chart: remove old notes ; link to curated starter values (a393d5a)
• chart: run helm-docs to update values in README.md (3b930c7)
• chart: update README with new project template ; migration to v4 (a90955b)
• clarify that hostPathsExporter was implemented for RKE (bb1dd92)
• dedicated metrics reference under docs/ (6b5078c)
• examples: add curated values.yaml starters for generic and per-distro setups (297fd74)
• Fix Linux deploy README (d3d81e7)
• fix markdown linting issues (5bcb838)
• fix typo (78d54a7)
• helm: emojis not requiring VS16 for colors in anchrored headers (3646831)
• helm: fix english texts (6e033bd)
• helm: fix value description and run helm-docs to update README (dec9be8)
• helm: fix values comment to pass helm linter (d907077)
• helm: refactor the concepts section (e0b9d71)
• helm: strip VS16 from emojis to fix GitHub anchors (2f19db6)
• helm: update values documentation in README (c8395dd)
• helm: update values in README (de59c88)
• helm: use Github generated anchror slugs for headings with VS16 emojis (4485844)
• metrics: new gates ; fixed labels ; better promql snippets ; cardinality clarification (c28eb69)
• new page with frequent questions (ba3bd51)
• README: add logo and refactor badges (efe4de8)
• README: fix broken link for sigstore ; better badge label (30d3015)
• README: fix links to the github project (0a780d9)
• README: new sections and markdown readability (1df03e4)
• readme: refresh file with helm-docs (71ff80c)
• README: relocate hardening to a dedicated page ; add a menu (30d1174)
• relocate grafana dashboard screenshot (9cbeb94)
• SECURITY: drop schedule (7d68bd5)
• SECURITY: restore timeline (b45520f)
• v3-to-v4: clarify the deprecation of CLI flags (3dd744b)
• v3-to-v4: drop hallucinated content (aa87503)
• warning about the relation between getLabels & compareCertificates (563028c)

4.0.0-alpha.3 (2026-05-03)

• release 4.0.0-alpha.3 (39d54d6)

Documentation

• metrics: new gates ; fixed labels ; better promql snippets ; cardinality clarification (c28eb69)

4.0.0-alpha.2 (2026-05-03)

• release 4.0.0-alpha.2 (c43ed24)

4.0.0-alpha.1 (2026-05-03)

⚠ BREAKING CHANGES

• add new metric gates, diags and not_before off by defaut,

• container: switch default variant from busybox to scratch (floating tags)

• chart: make the Service headless by default (no ClusterIP)

• the Helm chart is now published exclusively as an OCI artifact at oci://quay.io/enix/charts/x509-certificate-exporter. The legacy Helm repository at https://charts.enix.io is no longer updated; users must switch to the OCI reference (Helm 3.8+ required). Installation: helm install x509-certificate-exporter oci://quay.io/enix/charts/x509-certificate-exporter --version <vX.Y.Z>. the Helm chart's values schema may diverge from v3 in edge cases despite a best-effort to preserve backwards compatibility. Review your existing values against the updated chart/values.yaml before upgrading. A JSON schema (chart/values.schema.json) is shipped with the chart so helm install / helm upgrade will reject any values that no longer match the expected shape, surfacing regressions early instead of at runtime. Alpine-based container images are no longer published. The release pipeline now ships only the busybox and scratch variants on linux/amd64,arm64,riscv64. Users pulling *-alpine tags must switch to one of the new variants — busybox is the closest functional replacement (still has a shell), scratch is the minimal distroless option.

• release 4.0.0-alpha.1 (410319d)

• release 4.0.0-alpha.1 (3f5d581)

Features

• add new metric gates, diags and not_before off by defaut, (a719113)
• chart: make the Service headless by default (no ClusterIP) (b1d5b5c)
• chart: remove support for legacy apiVersion (k8s < 1.16) (7f560fd)
• chart: satisfy PSA restricted profile and OpenShift restricted-v2 SCC (3d8b935)
• chart: support image digest pinning across all images (fd81d79)
• container: switch default variant from busybox to scratch (floating tags) (5ef7b43)
• rewrite from scratch with new architecture and toolchain (b4f3f84)
• symlink path mapping and containment (bbd179c)

Bug Fixes

• bundle errors not reaching the stats UI (cbd2724)

Documentation

• 3to4: fix codeql warning on typescript syntax (584ecdb)
• add a v3 to v4 migration guide (da6ba51)
• add security policy with reporting channels and scope (146d4c0)
• add v3-to-v4 migration guide (d93d187)
• assets: new alternative logo (0a7d655)
• chart: add a menu (1212b90)
• chart: fix image URLs in README (79e927e)
• chart: link to the hardening guide (1a39d3f)
• chart: remove old notes ; link to curated starter values (a393d5a)
• chart: update README with new project template ; migration to v4 (a90955b)
• dedicated metrics reference under docs/ (6b5078c)
• examples: add curated values.yaml starters for generic and per-distro setups (297fd74)
• fix markdown linting issues (5bcb838)
• helm: emojis not requiring VS16 for colors in anchrored headers (3646831)
• helm: refactor the concepts section (e0b9d71)
• helm: strip VS16 from emojis to fix GitHub anchors (2f19db6)
• helm: use Github generated anchror slugs for headings with VS16 emojis (4485844)
• new page with frequent questions (ba3bd51)
• README: add logo and refactor badges (efe4de8)
• README: fix broken link for sigstore ; better badge label (30d3015)
• README: fix links to the github project (0a780d9)
• README: new sections and markdown readability (1df03e4)
• README: relocate hardening to a dedicated page ; add a menu (30d1174)
• relocate grafana dashboard screenshot (9cbeb94)
• SECURITY: drop schedule (7d68bd5)
• SECURITY: restore timeline (b45520f)
• v3-to-v4: clarify the deprecation of CLI flags (3dd744b)
• v3-to-v4: drop hallucinated content (aa87503)