Changelog

All notable changes of this project are documented in this file.

v0.16.4

Release date: 2026-06-08

What's Changed

fix: correctly clear reconciling condition when reconciliation is being skipped by @alexandermarston in flux-iac#1789
chore(deps): bump fluxcd/pkg from 1.31.0 to 1.32.0 in the gh-minor group across 1 directory by @dependabot[bot] in flux-iac#1791
chore(deps): bump the go-minor group across 3 directories with 6 updates by @dependabot[bot] in flux-iac#1793
chore(deps): bump the gh-patch group across 1 directory with 2 updates by @dependabot[bot] in flux-iac#1790
chore(deps): bump the go-patch group across 2 directories with 6 updates by @dependabot[bot] in flux-iac#1792
Add multi-provider support for branch planner by @sillychilly-byte in flux-iac#1780
fix: remove CVE exceptions from trivyignore file by @alexandermarston in flux-iac#1794
chore(deps): bump the go-patch group across 3 directories with 11 updates by @dependabot[bot] in flux-iac#1798
chore(deps): bump the go-minor group across 3 directories with 1 update by @dependabot[bot] in flux-iac#1799
fix: replan pending terraform resources when spec changes by @alexandermarston in flux-iac#1796
ci: fix image pushing when running on forks by @gionn in flux-iac#1805
fix: install azure-cli via pip in a virtualenv instead of copying binary by @gionn in flux-iac#1804
fix(deps): bump opentofu to v1.12.1 by @alexandermarston in flux-iac#1806
fix: make local dev tooling work on Apple Silicon and containerd v2 by @adonispd in flux-iac#1811
fix(deps): bump go to 1.26.4 to patch CVE-2026-42504 by @adonispd in flux-iac#1813
feat: support plan-only options via spec.plan (e.g. -lock=false) by @ricardo-mng in flux-iac#1812
chore(deps): bump the gh-patch group across 1 directory with 3 updates by @dependabot[bot] in flux-iac#1814
chore(deps): bump the go-patch group across 2 directories with 7 updates by @dependabot[bot] in flux-iac#1816

New Contributors

@sillychilly-byte made their first contribution in flux-iac#1780
@gionn made their first contribution in flux-iac#1805
@adonispd made their first contribution in flux-iac#1811

v0.16.3

Release date: 2026-05-05

What's Changed

fix: use mutex-safe helpers in refreshCACertsIfNeeded to prevent map race by @TarasLykhenko in flux-iac#1785
feat: add ResourceQuota support with jitter-based requeue by @TarasLykhenko in flux-iac#1769

v0.16.2

Release date: 2026-04-01

What's Changed

fix: temporarily ignore trivy vulnerabilities by @alexandermarston in flux-iac#1738
chore(deps): bump actions/cache from 5.0.3 to 5.0.4 in the gh-patch group across 1 directory by @dependabot[bot] in flux-iac#1735
build(docker): add --no-install-recommends to apt-get install by @cschindlbeck in flux-iac#1734
fix(deps): perform a fleet of dependency upgrades by @alexandermarston in flux-iac#1740
chore(docs): backup and restore (add information that custom backends do not create secrets) by @cschindlbeck in flux-iac#1736
chore(deps): bump the go-minor group across 2 directories with 5 updates by @dependabot[bot] in flux-iac#1741
fix: handle plan failing if workspace is too long by @alexandermarston in flux-iac#1742
chore(lints): ran golangci-lint run --fix on codebase by @coillteoir in flux-iac#1725

New Contributors

@cschindlbeck made their first contribution in flux-iac#1734
@coillteoir made their first contribution in flux-iac#1725

v0.16.1

Release date: 2026-02-03

What's Changed

chore: modernize code by @artem-nefedov in flux-iac#1712
fix: compute a safe label value for terraform plan resources by @alexandermarston in flux-iac#1714
fix(deps): bump go and tofu by @alexandermarston in flux-iac#1719
chore(deps): bump the go-minor group across 3 directories with 3 updates by @dependabot[bot] in flux-iac#1718
chore(deps): bump the gh-minor group with 2 updates by @dependabot[bot] in flux-iac#1716
chore(deps): bump the gh-patch group with 2 updates by @dependabot[bot] in flux-iac#1715
chore(deps): bump the go-patch group across 3 directories with 2 updates by @dependabot[bot] in flux-iac#1717

v0.16.0

Release date: 2026-01-27

We are pleased to release Tofu-Controller v0.16.0, which is our first stable release since v0.15.1 which was released in July 2023.

This release delivers several important enhancements, fixes and changes, most notably:

First-class OpenTofu support — OpenTofu v1.11.3 is now bundled by default in the runner images.
Improved Terraform reconciliation — better reconciliation behavior and strategy for Terraform resources, along with controller priority queue.
Helm Chart renaming - the Helm Chart has been renamed from tf-controller to tofu-controller.
Introduction of the Branch Planner feature.

We would like to thank our contributors for their continued support and effort in improving the Tofu-Controller.

Please follow the upgrade guide in the documentation to ensure a smooth transition to the latest version.

Breaking Changes:

Migrate Tofu Controller to OpenTofu by @alexandermarston in flux-iac#1675

What's Changed

refactor: use the term "branch planner" everywhere by @yitsushi in flux-iac#735
fix tfctl message when we're in the plan only mode by @chanwit in flux-iac#748
Adding comments to pulls request managed by bbp by @luizbafilho in flux-iac#738
feat: set approvePlan to be blank and force to be false by @yitsushi in flux-iac#757
refactor: add build sha and version to go run tasks by @yitsushi in flux-iac#759
patch: use hcl syntax and don't use
Details
tag for plan output in comments by @yitsushi in flux-iac#758
Improving ConfigMap Handling and Parsing Object Key, Removed Redundant Notation for the Controller and the Branch Planner by @squaremo in flux-iac#768
patch: use "flux-system" namespace instead of "default" for config by @yitsushi in flux-iac#761
feat: support watching all Terraform objects in namespace by @yitsushi in flux-iac#763
refactor: make tilt friendlier by @yitsushi in flux-iac#772
if force mode is true, we skip the plan annotation check by @chanwit in flux-iac#769
implement replan comment trigger by @chanwit in flux-iac#775
feat: use RUNTIME_NAMESPACE for resources if namespace is not defined by @yitsushi in flux-iac#774
chore(deps): bump libcrypto3 to 3.1.1-r3 by @yitsushi in flux-iac#787
add dependabot.yaml by @chanwit in flux-iac#788
docs: getting started with branch planner by @yitsushi in flux-iac#784
Bump the ci group with 21 updates by @dependabot[bot] in flux-iac#789
Add license scan report and status by @fossabot in flux-iac#792
Fix source deletion when using branch planner by @luizbafilho in flux-iac#790
add interval docs by @chanwit in flux-iac#796
Resource deletion docs by @chanwit in flux-iac#800
feat: add branch planner cli flag to helm chart values by @yitsushi in flux-iac#795
Add --no-cross-namespace-refs to branch-based-planner by @squaremo in flux-iac#676
feat: post error as comment to a pull request by @yitsushi in flux-iac#801
Bump the ci group with 6 updates by @dependabot[bot] in flux-iac#809
Document ADR for denying cross-ns refs by default by @squaremo in flux-iac#782
fix: Typo by @yiannistri in flux-iac#818
patch: use allowedNamespaces in Branch Planner by @yitsushi in flux-iac#813
docs: add example yaml for easier deployment by @yitsushi in flux-iac#815
improve renaming variable docs by @chanwit in flux-iac#816
Add RecordDuration metrics and using functions from fluxcd by @luizbafilho in flux-iac#811
fix: clear comment id after replan by @yitsushi in flux-iac#810
feat: ability to set resource limits and security context for branch planner by @yitsushi in flux-iac#819
Bump the ci group with 4 updates by @dependabot[bot] in flux-iac#817
patch: static replica count for branch planner by @yitsushi in flux-iac#821
bump helm chart to v0.16.0-rc.1 by @chanwit in flux-iac#822
capture stderr from tf init and send it back to the controller by @chanwit in flux-iac#832
fix output secret relocation for branch planner by @chanwit in flux-iac#835
enable configmap creation and bump chart to v0.16.0-rc.2 by @chanwit in flux-iac#834
bump libcrypto3 and libssl3 by @yitsushi in flux-iac#841
build(deps): bump the ci group with 5 updates by @dependabot[bot] in flux-iac#826
Resume and Suspend All by @luizbafilho in flux-iac#842
build: remove nsswitch.conf creation by @hiddeco in flux-iac#849
Prevent dependson crossnamespace reference by @luizbafilho in flux-iac#824
docs: Add Branch Planner guide by @yiannistri in flux-iac#852
Polish docs by @chanwit in flux-iac#854
feat: do not create branch planner resources if there are no terraform changes by @yitsushi in flux-iac#839
chore: post blocked issues on watermelon slack on Mon and Thu by @yitsushi in flux-iac#857
Update getting-started.md by @chanwit in flux-iac#860
refactor runner base image by @chanwit in flux-iac#868
test: disable flaky tests by @yitsushi in flux-iac#863
add webhook docs by @chanwit in flux-iac#875
Add DCO by @yiannistri in flux-iac#877
Add Flux Receiver and Alert integration doc by @kingdonb in flux-iac#879
small fix for branch planner to support terraform cloud by @chanwit in flux-iac#881
branch planner integration docs for terraform cloud by @chanwit in flux-iac#884
patch: back-backport v0.14 break-the-glass changes by @yitsushi in flux-iac#869
Adds OpenSSF badge to Readme by @lasomethingsomething in flux-iac#892
ci: Add OpenSSF Scorecard GH Action by @yiannistri in flux-iac#883
doc: Add SECURITY.md by @yiannistri in flux-iac#897
build(deps): bump the ci group with 16 updates by @dependabot[bot] in flux-iac#895
ci: Run go vet on CI by @yiannistri in flux-iac#900
fix tfctl install --export not separating yaml objects properly by @matheuscscp in flux-iac#909
Defaults ObservedGeneration to -1 and sets LastHandledReconcileAt by @luizbafilho in flux-iac#867
Update RunnerPodSpec to include more fields by @luizbafilho in flux-iac#910
fix: 000011_workspace_no_outputs_test test by @yitsushi in flux-iac#917
docs: Add information on how to provide feedback and contribute by @yiannistri in flux-iac#925
fix: 000031 test and add more safe defer cleanup by @yitsushi in flux-iac#924
Allow DNS resolution of the runner pod for all k8s setup by @syalioune in flux-iac#886
[breaking change] Add flag --allow-cross-namespace-refs to tf-controller and branch-planner by @squaremo in flux-iac#840
Fix tc000080_* flakiness by @luizbafilho in flux-iac#927
Adding make test-flaky deps by @luizbafilho in flux-iac#928
experiment: break up test jobs by @yitsushi in flux-iac#938
fix: controllers/tc00004x tests by @yitsushi in flux-iac#936
build(deps): bump github.com/cyphar/filepath-securejoin from 0.2.3 to 0.2.4 by @dependabot[bot] in flux-iac#929
Fix controllers/tc00008x_x, tc000090, tc000111 by @luizbafilho in flux-iac#933
fix: controllers/tc00005x tests and the manual approval stuck in loop bug by @yitsushi in flux-iac#943
fix: controller 7x tests by @yitsushi in flux-iac#944
fix: controller 12x and 13x tests by @yitsushi in flux-iac#953
Adds Troubleshooting Section and tip to drift detection page by @lasomethingsomething in flux-iac#934
fix: controller 1xx tests by @yitsushi in flux-iac#955
Expose --allow-cross-namespace-refs in the chart by @squaremo in flux-iac#931
fix: controller test 64 by @yitsushi in flux-iac#960
fix: test 64, terraform version mismatch by @yitsushi in flux-iac#962
Fix controllers/tc00006x by @luizbafilho in flux-iac#961
fix: controller test 201 and fix test clean-up by @yitsushi in flux-iac#958
add install docs for gke autopilot by @chanwit in flux-iac#971
fix: controller test 230 by @yitsushi in flux-iac#969
docs: update least required permissions for a github api token by @yitsushi in flux-iac#967
fix: controller test 24x by @yitsushi in flux-iac#970
add tools target for the makefile by @chanwit in flux-iac#975
add set -e to the local e2e script by @chanwit in flux-iac#976
add missing pod spec CRDs to the chart template by @chanwit in flux-iac#977
fix tcp address validation by @chanwit in flux-iac#978
Screen cross-ns refs in .spec.cliConfigSecretRef by @squaremo in flux-iac#959
Explain allowCrossNamespaceRefs in chart README and docs/howto/ by @squaremo in flux-iac#966
correct the behaviour of e2e tests by @chanwit in flux-iac#980
tests: run non-numbered tests as part of the github workflow by @yitsushi in flux-iac#982
fix controllers/tc00029x tests by @luizbafilho in flux-iac#979
fix: controller test 260 by @yitsushi in flux-iac#987
fix: controller test 20 by @yitsushi in flux-iac#988
fix: controller test 28x and remaining defer calls in controller tests by @yitsushi in flux-iac#989
add base image to the release pipeline by @chanwit in flux-iac#990
ci: Pinned checkout and setup-go GH actions to commit hashes by @yiannistri in flux-iac#992
exclude branch from create object name function by @chanwit in flux-iac#993
ci: Pinned GH actions to commit hashes by @yiannistri in flux-iac#994
ci: Pinned GH actions to commit hashes by @yiannistri in flux-iac#995
ci: Pinned GH actions to commit hashes by @yiannistri in flux-iac#996
ci: Move elevated permissions to run level by @yiannistri in flux-iac#999
fix: Use write permissions when pushing Helm docs by @yiannistri in flux-iac#1002
Deleting the Terraform object before deleting its source by @chanwit in flux-iac#1001
Add the pr string to suffix by @chanwit in flux-iac#1003
fix: Bump golang.org/x/net to v0.15.0 to address GO-2023-1988 by @yiannistri in flux-iac#1007
Additional docs for breakglass by @madAndroid in flux-iac#1009
refactor: add testing.T to gomega wrapper functions by @yitsushi in flux-iac#1004
Enable drift detection if plan approval is disabled by @luizbafilho in flux-iac#1011
chore(deps): update libcrypto3 and libssl3 by @yitsushi in flux-iac#1013
fix: branch planner does not use the original state file by @yitsushi in flux-iac#1022
propose adr 0003 for workspace blob caching by @chanwit in flux-iac#1010
Adding tfctl logs command by @luizbafilho in flux-iac#1026
fix: Tiltfile by @yitsushi in flux-iac#1039
Adds page on upgrading TF-Controller by @lasomethingsomething in flux-iac#964
docs: Document a fix to "terraform objects stuck on deletion" issue by @yitsushi in flux-iac#1025
Adds Slack channel info to Readme by @lasomethingsomething in flux-iac#1060
Add docs on how to build a custom runner image by @madAndroid in flux-iac#1056
bump libcrypto3 to 3.1.4 by @yitsushi in flux-iac#1064
Updates maintainers file by @lasomethingsomething in flux-iac#1074
chore(deps): Update google.golang.org/grpc and golang.org/x/net by @yitsushi in flux-iac#1075
chore(deps): Bump github.com/docker/docker from 24.0.5+incompatible to 24.0.7+incompatible by @dependabot[bot] in flux-iac#1073
fix: Updated config to reflect contributor changes by @yiannistri in flux-iac#1080
chore(deps): Bump golang.org/x/net from 0.15.0 to 0.17.0 in /api by @dependabot[bot] in flux-iac#1045
chore(deps): Bump github.com/aws/aws-sdk-go-v2/credentials from 1.13.35 to 1.13.43 by @dependabot[bot] in flux-iac#1049
chore(deps): Bump github.com/aws/aws-sdk-go-v2/credentials from 1.13.43 to 1.14.0 by @dependabot[bot] in flux-iac#1084
Add support for Terraform LockTimeout feature in the plan stage by @nalum in flux-iac#1087
Fix missing version and sha in runner output by @madAndroid in flux-iac#1058
Fix break glass command; respect all flags by @jonasbadstuebner in flux-iac#1098
bump libcrypto3 and libssl3 by @yitsushi in flux-iac#1114
docs: Bump version in manifest used in user guide to reflect latest RC by @yiannistri in flux-iac#1113
docs: Fix API version by @yiannistri in flux-iac#1118
docs: Fix API version by @yiannistri in flux-iac#1119
test: add test around the polling server and fix surfaced issues by @yitsushi in flux-iac#1112
chore(scripting): a simple script to bump libcrypto3 and libssl3 version by @yitsushi in flux-iac#1115
chore(deps): Bump github.com/aws/aws-sdk-go-v2/credentials from 1.14.0 to 1.16.0 by @dependabot[bot] in flux-iac#1122
chore(deps): Bump github.com/zclconf/go-cty from 1.13.2 to 1.14.1 by @dependabot[bot] in flux-iac#1116
chore: Only do security updates for Go modules and GH actions by @yiannistri in flux-iac#1145
fix: add unique hash to cloned source to avoid conflict by @yitsushi in flux-iac#1136
chore(deps): bump chart-testing-action to 2.6.1 by @yitsushi in flux-iac#1147
docs: add docs about ipv6 by @yitsushi in flux-iac#1135
feat: add remediation retry by @yitsushi in flux-iac#1061
docs: update branch planner default configuration by @yitsushi in flux-iac#1150
test: add test case to remediation test: retry resets when source is updated by @yitsushi in flux-iac#1151
Adds a starter docs page on Azure by @lasomethingsomething in flux-iac#1153
Revises branch planner pages a bit by @lasomethingsomething in flux-iac#1154
docs: Rename to index.md by @yiannistri in flux-iac#1155
docs: Fix navigation by @yiannistri in flux-iac#1156
ci: limit rbac for the reconciler by @sbx0r in flux-iac#1099
Add CreateWorkspaceBlob RPC method to Runner service by @luizbafilho in flux-iac#1152
feat: generate checksum for cache blobs by @yitsushi in flux-iac#1159
feat: Implement BLOB encryption within the tf-runner by @yitsushi in flux-iac#1162
Changes URLs for better SEO and fixes small typos by @lasomethingsomething in flux-iac#1160
chore(deps): Bump golang.org/x/crypto from 0.14.0 to 0.17.0 by @dependabot[bot] in flux-iac#1167
Bump dependencies. by @bigkevmcd in flux-iac#1164
Fix make docker-build target by @yiannistri in flux-iac#1168
fix use cases link in readme by @nwilken in flux-iac#1170
chore(deps): Bump github.com/go-git/go-git/v5 from 5.9.0 to 5.11.0 by @dependabot[bot] in flux-iac#1169
I volunteer to be a maintenance by @yitsushi in flux-iac#1172
chore(deps): bump libcrypto and libssl version by @yitsushi in flux-iac#1183
ci: Use GITHUB_OUTPUT envvar instead of set-output command by @arunsathiya in flux-iac#1179
Feature/add tfvarspaths spec2 by @itamar-marom in flux-iac#1185
chore: disable slack notifications about blocked issues by @yitsushi in flux-iac#1187
replace container reg ghcr.io/weaveworks with ghcr.io/flux-iac by @dgem in flux-iac#1198
update helloworld testdata sources to .../flux-iac/... by @ilithanos in flux-iac#1201
Update URL for Helm Docs by @tech1ndex in flux-iac#1202
rename github.com/weaveworks/tf-controller to github.com/flux-iac/tofu-controller by @akselleirv in flux-iac#1207
Helm chart url fixes by @ilithanos in flux-iac#1205
updating tf_version by @kasper-leFevre in flux-iac#1212
move urls from weave to flux-iac in makefile by @ilithanos in flux-iac#1213
updating documentation for custom runner by @kasper-leFevre in flux-iac#1214
config yaml renaming and docker file binary renamed by @ilithanos in flux-iac#1216
Renaming /tools/check-runner-images.sh by @kasper-leFevre in flux-iac#1218
dockerfiles updated to alpine:3.19 by @ilithanos in flux-iac#1220
#1209 Relocate CRDs in helm chart by @dgem in flux-iac#1221
fallback ghcr urls changed to flux-iac in runner by @ilithanos in flux-iac#1223
Tiltfile: added config for building tf-runner image and using it in helloworld example by @akselleirv in flux-iac#1224
CLI: Reduce Binary Size by @bdwyertech in flux-iac#1226
Add Tonni Follmann (@ilithanos) as a MAINTAINER by @chanwit in flux-iac#1232
tilt: speed up compiling of binaries by @akselleirv in flux-iac#1235
add private registries integration docs by @ArieLevs in flux-iac#1237
helm-chart: add watchAllNamespaces argument by @akselleirv in flux-iac#1239
bump chart and doc yamls to v0.16.0-rc.4 by @chanwit in flux-iac#1242
Fix runner-serviceaccount helm template by @ayanevbg in flux-iac#1251
Update Repo URLs in Docs by @tech1ndex in flux-iac#1253
Update development docs by @akselleirv in flux-iac#1248
Add Aksel Skaar Leirvaag (@akselleirv) as a MAINTAINER by @chanwit in flux-iac#1258
#1247 helm readme update to tofo-controller by @dgem in flux-iac#1260
Helm chart rename by @ilithanos in flux-iac#1264
Tilt: fix references to helm chart after renaming by @akselleirv in flux-iac#1272
branch planner is now checking for both PostPlanningWebhookFailedReason and TFExecInitFailedReason for failing PR by @raz-bn in flux-iac#1271
docs: remove weaveworks.github.io references from docs by @zonorti in flux-iac#1276
Improve docs by @vishu42 in flux-iac#1275
fix(helm-chart): missing renamings by @akselleirv in flux-iac#1282
fix: build of tf-runner-azure by @akselleirv in flux-iac#1290
Fix Incorrect Metric Reporting Post-Update in Terraform Controller by @TarasLykhenko in flux-iac#1287
Removed mentions of team wild-watermelon by @akselleirv in flux-iac#1299
Bump golang.org/x/net from 0.19.0 to 0.23.0 by @dependabot[bot] in flux-iac#1285
Speedup wait for pod ip by @akselleirv in flux-iac#1302
Move hardcoded "flux-system" namespace from templates to default values by @artem-nefedov in flux-iac#1303
Enable non-security dependency upgrades by @akselleirv in flux-iac#1305
Enable dependabot for github actions by @akselleirv in flux-iac#1311
Bump actions/checkout from 3df4ab11eba7bda6032a0b82a6bb43b11571feac to b80ff79f1755d06ba70441c368a6fe801f5f3a62 by @dependabot[bot] in flux-iac#1320
Update fluxcd/pkg requirement to 1bfad582060d2d6e464756fbd5d7a2b2fa4f75b9 by @dependabot[bot] in flux-iac#1321
Bump fluxcd/flux2 from 3b42b200d376430f0e24d35f1a600447d92da531 to 896e0fa46d5107a05e953dd0a5261d78a145ec8c by @dependabot[bot] in flux-iac#1319
Bump github.com/hashicorp/go-retryablehttp from 0.7.5 to 0.7.7 by @dependabot[bot] in flux-iac#1315
Upgrade go version to 1.22 and set version via go.mod in workflow by @akselleirv in flux-iac#1310
Bump aws-sdk-go-v2 deps and fix deprecated usage by @akselleirv in flux-iac#1331
Bump the gh-major group across 1 directory with 8 updates by @dependabot[bot] in flux-iac#1328
Bump github.com/spf13/viper from 1.16.0 to 1.19.0 by @dependabot[bot] in flux-iac#1342
Bump the gh-minor group across 1 directory with 8 updates by @dependabot[bot] in flux-iac#1336
Print plan before apply by @akselleirv in flux-iac#1304
Bump controller-runtime and k8s.io/* by @akselleirv in flux-iac#1334
bump libcrypto to 3.1.6-r2 by @akselleirv in flux-iac#1401
bump github.com/fluxcd/pkg/ssa to v0.39.1 by @akselleirv in flux-iac#1402
Bump github.com/docker/docker from 24.0.7+incompatible to 25.0.6+incompatible by @dependabot[bot] in flux-iac#1407
Bump the go-minor group across 3 directories with 20 updates by @dependabot[bot] in flux-iac#1405
Delete stale metrics on object delete by @TarasLykhenko in flux-iac#1362
fix(helm-chart): ensure helm release namespace is applied by @mloiseleur in flux-iac#1425
Bump alpine and libcrypto by @akselleirv in flux-iac#1439
feat(helm-chart): Add additionalLabels for deployments by @adberger in flux-iac#1400
docs: provide instructions for autocomplete by @mloiseleur in flux-iac#1448
fix(helm-chart): rbac for branch planner by @mloiseleur in flux-iac#1447
Bump fluxcd/pkg from 1bfad582060d2d6e464756fbd5d7a2b2fa4f75b9 to 30c101fc7c9fac4d84937ff4890a3da46a9db2dd by @dependabot[bot] in flux-iac#1443
Bump actions/checkout from b80ff79f1755d06ba70441c368a6fe801f5f3a62 to d632683dd7b4114ad314bca15554477dd762a938 by @dependabot[bot] in flux-iac#1456
Bump github.com/moby/moby from 24.0.5+incompatible to 24.0.9+incompatible by @dependabot[bot] in flux-iac#1374
Added exponential backoff on reconciliation failure by @akselleirv in flux-iac#1460
Fix deprecated usage of the k8s.io/apimachinery/pkg/util/wait package by @akselleirv in flux-iac#1461
Bump the gh-minor group with 12 updates by @dependabot[bot] in flux-iac#1465
Bump docker/build-push-action from 5.3.0 to 6.9.0 in the gh-major group by @dependabot[bot] in flux-iac#1466
README.md: remove roadmap by @akselleirv in flux-iac#1459
Upgrade Go version to 1.23.4 and deps by @akselleirv in flux-iac#1502
Release v0.16.0-rc.5 by @akselleirv in flux-iac#1503
fix goreleaser flag in release workflow by @akselleirv in flux-iac#1504
fix: goreleaser v1 to v2 by @akselleirv in flux-iac#1507
Fix the HelmRelease scripts to install the latest helm chart by @moconnor-cni in flux-iac#1509
Control init -upgrade behaviour by @daniel-ciaglia in flux-iac#1471
fix(ci): setup terraform by @akselleirv in flux-iac#1510
Bump actions/checkout from 4.2.0 to 4.2.2 in the gh-patch group across 1 directory by @dependabot[bot] in flux-iac#1517
Bump the go-patch group across 3 directories with 11 updates by @dependabot[bot] in flux-iac#1518
fix(oci): allow unlimited layer size by @KarstenSiemer in flux-iac#1519
chore: bump libcrypto to 3.3.3-r0 by @akselleirv in flux-iac#1525
Replace github.com/pkg/errors with errors wrapping using stdlib by @akselleirv in flux-iac#1526
Rename Weave GitOps to tofu-controller by @pyaillet in flux-iac#1549
Bump the gh-minor group across 1 directory with 17 updates by @dependabot[bot] in flux-iac#1548
Fix broken github link by @isakstenstrom in flux-iac#1578
chore: bump libcrypto to 3.3.5-r0 and alpine to 3.22 by @TarasLykhenko in flux-iac#1583
Bump golang.org/x/crypto from 0.32.0 to 0.35.0 by @dependabot[bot] in flux-iac#1561
Bump golang.org/x/net from 0.34.0 to 0.38.0 by @dependabot[bot] in flux-iac#1562
chore: upgrade to go 1.24 + upgrade deps and tooling by @TarasLykhenko in flux-iac#1588
Bump github.com/docker/docker from 28.3.2+incompatible to 28.3.3+incompatible by @dependabot[bot] in flux-iac#1594
Bump the deprecated FluxCD versions by @moconnor-cni in flux-iac#1539
fix: implement more descriptive errors during instance id mismatches by @alexandermarston in flux-iac#1622
fix: implement a Terraform Exec Wrapper to detect State Lock Errors by @alexandermarston in flux-iac#1623
chore: upgrade controller-runtime to v0.22.0 and their dependencies by @ricardo-mng in flux-iac#1602
fix(ci): avoid e2e race condition on cert gc by @alexandermarston in flux-iac#1631
docs: fix code display on exposed using hostname subdomain page by @mloiseleur in flux-iac#1540
fix(chart): handling additional deployment labels by @alexandermarston in flux-iac#1632
chore: move condition types and reasons, and add comments by @alexandermarston in flux-iac#1633
docker: drop unused libretls by @xnox in flux-iac#1634
fix(ci): speed up docker builds by @alexandermarston in flux-iac#1635
chore: add self to MAINTAINERS by @alexandermarston in flux-iac#1637
fix(docker): use native build platform for go build stages by @alexandermarston in flux-iac#1636
feat: enable priority queue by @ricardo-mng in flux-iac#1641
chore(docs): update docs to refer to CNCF Slack Channel by @alexandermarston in flux-iac#1644
feat: controller refactoring by @alexandermarston in flux-iac#1640
chore: release v0.16.0-rc.6 by @alexandermarston in flux-iac#1646
chore(docs): document release process by @alexandermarston in flux-iac#1647
chore(docs): update tf-controller references by @alexandermarston in flux-iac#1653
feat: compare interval with LastPlanAt timestamp by @alexandermarston in flux-iac#1648
fix: align tf-runner pod app.kubernetes.io/created-by label by @alexandermarston in flux-iac#1650
fix: skip drift detection when spec has changed by @alexandermarston in flux-iac#1651
fix: patch dependency finalizers instead of update by @alexandermarston in flux-iac#1652
fix(metrics): remove deprecated metrics by @alexandermarston in flux-iac#1649
fix: delete reconciling condition on unknown readiness by @alexandermarston in flux-iac#1658
feat: support storing plans over chunked kubernetes resources by @alexandermarston in flux-iac#1655
chore: release v0.16.0-rc.7 by @alexandermarston in flux-iac#1659
fix: reconcile terraform when reconcile.fluxcd.io/requestedAt is set by @alexandermarston in flux-iac#1662
fix: clear terraform state lock condition by @alexandermarston in flux-iac#1661
chore!: remove v1beta2 source API usage by @artem-nefedov in flux-iac#1663
chore(deps): bump the gh-minor group across 1 directory with 9 updates by @dependabot[bot] in flux-iac#1666
fix: reconcile terraform when source revision changes by @alexandermarston in flux-iac#1668
fix: handle more reconciliation cases by @alexandermarston in flux-iac#1671
fix: delete reconciling condition on successful initial apply by @artem-nefedov in flux-iac#1670
Set max grpc message size for gRPC client to fix webhook payload creation by @gpietrus-akamai in flux-iac#1676
fix(test): avoid race in test resources cleanup by @artem-nefedov in flux-iac#1672
chore(deps): bump the gh-major group across 1 directory with 8 updates by @dependabot[bot] in flux-iac#1678
feat: refactor plan loading/saving by @alexandermarston in flux-iac#1664
feat: use a distroless image for tofu-controller by @alexandermarston in flux-iac#1674
fix(build): add missing build arguments for Go cross-compliation build by @alexandermarston in flux-iac#1680
chore(deps): bump the go-patch group across 1 directory with 13 updates by @dependabot[bot] in flux-iac#1679
chore(deps): bump the gh-patch group across 1 directory with 4 updates by @dependabot[bot] in flux-iac#1677
fix: avoid "secret already exists" error by @artem-nefedov in flux-iac#1682
chore(ci): fix flaky e2e cert GC test by @alexandermarston in flux-iac#1694
fix(deps): bump dependencies by @alexandermarston in flux-iac#1693
fix: reconcile without delay when dependencies were last not ready by @alexandermarston in flux-iac#1692
chore(deps): bump fluxcd/pkg from 30c101fc7c9fac4d84937ff4890a3da46a9db2dd to cac55028ec9b367d40381b50f75d7bd26abc36cc by @dependabot[bot] in flux-iac#1687
chore(deps): bump the go-minor group across 2 directories with 10 updates by @dependabot[bot] in flux-iac#1698
chore(deps): bump github/codeql-action from 4.31.8 to 4.31.9 in the gh-patch group by @dependabot[bot] in flux-iac#1684
chore(deps): bump the gh-minor group across 1 directory with 2 updates by @dependabot[bot] in flux-iac#1690
chore(deps): bump github.com/maxbrunsfeld/counterfeiter/v6 from 6.12.0 to 6.12.1 in the go-patch group across 1 directory by @dependabot[bot] in flux-iac#1695
feat: implement graceful shutdown by @artem-nefedov in flux-iac#1699
chore: release v0.16.0-rc.8 by @alexandermarston in flux-iac#1700
fix(ci): fix signing configuration for release process by @alexandermarston in flux-iac#1701
chore(deps): bump the go-minor group across 3 directories with 9 updates by @dependabot[bot] in flux-iac#1708
chore(deps): bump the gh-minor group across 1 directory with 4 updates by @dependabot[bot] in flux-iac#1707
chore(deps): bump the gh-patch group across 1 directory with 3 updates by @dependabot[bot] in flux-iac#1706
chore(deps): bump github.com/elgohr/go-localstack from 1.0.146 to 1.0.147 in the go-patch group across 1 directory by @dependabot[bot] in flux-iac#1704
chore(ci): prepare for new release by @alexandermarston in flux-iac#1709

v0.16.0-rc.8

Release date: 2026-01-16

Tofu Controller v0.16.0-rc.8 is now available. This release delivers several important enhancements and fixes, most notably:

First-class OpenTofu support — OpenTofu v1.11.3 is now bundled by default in the runner images.
Improved Terraform reconciliation — better reconciliation behavior and strategy for Terraform resources.

We would like to thank our contributors for their continued support and effort in improving the Tofu-Controller.

Please follow the upgrade guide in the documentation to ensure a smooth transition to the latest version.

Breaking Changes:

Migrate Tofu Controller to OpenTofu (#1675) (1a291c1d)

New Features and Bug Fixes:

feat: implement graceful shutdown (#1699) (2d656b07)
chore(deps): bump github.com/maxbrunsfeld/counterfeiter/v6 (#1695) (1f038464)
chore(deps): bump the gh-minor group across 1 directory with 2 updates (#1690) (837c7aa8)
chore(deps): bump github/codeql-action in the gh-patch group (#1684) (91a3cabc)
chore(deps): bump the go-minor group across 2 directories with 10 updates (#1698) (1b2770ff)
chore(deps): bump fluxcd/pkg (#1687) (01162b86)
fix: reconcile without delay when dependencies were last not ready (#1692) (23525efb)
fix(deps): bump dependencies (#1693) (4df454ef)
chore(ci): fix flaky e2e cert GC test (#1694) (7cb8bb8c)
fix: avoid "secret already exists" error (#1682) (8759b9ed)
chore(deps): bump the gh-patch group across 1 directory with 4 updates (#1677) (417a454d)
chore(deps): bump the go-patch group across 1 directory with 13 updates (#1679) (ff0c6b9a)
fix(build): add missing build arguments for Go cross-compliation build (#1680) (ca7e52d1)
feat: use a distroless image for tofu-controller (#1674) (748f4469)
feat: refactor plan loading/saving (#1664) (7aaf7573)
chore(deps): bump the gh-major group across 1 directory with 8 updates (#1678) (9270321e)
fix(test): avoid race in test resources cleanup (#1672) (a17baa19)
fix: set max grpc message size for grpc client (#1676) (5e870de1)
fix: delete reconciling condition on successful initial apply (#1670) (7f632571)
fix: handle more reconciliation cases (#1671) (7e622eba)
fix: reconcile terraform when source revision changes (#1668) (1000a3f7)
chore(deps): bump the gh-minor group across 1 directory with 9 updates (#1666) (6ec9705f)
chore!: remove v1beta2 source API usage (#1663) (07ff2cc0)
fix: clear terraform state lock condition after subsequent successful operation (#1661) (c13b35c9)
fix: reconcile terraform when reconcile.fluxcd.io/requestedAt is set (#1662) (ab20fd8b)

v0.16.0-rc.7

Release date: 2025-12-04

We would like to thank our contributors for their continued support and effort in improving the Tofu-Controller.

Please follow the upgrade guide in the documentation to ensure a smooth transition to the latest version.

Breaking Changes:

fix(metrics): remove deprecated metrics (#1649) (0c896e0b)

New Features and Bug Fixes:

feat: support storing plans over chunked kubernetes resources (#1655) (91e25a8c)
fix: delete reconciling condition on unknown readiness (#1658) (ac39a777)
fix: patch dependency finalizers instead of update (#1652) (e5bccf46)
fix: skip drift detection when spec has changed (#1651) (a8f30b12)
fix: align tf-runner pod app.kubernetes.io/created-by label (#1650) (75d3bdc5)
feat: compare interval with LastPlanAt timestamp (#1648) (08d4beaa)
chore(docs): update tf-controller references (#1653) (0d66bfcb)
chore(docs): document release process (#1647) (d67e2f0d)

v0.16.0-rc.6

Release date: 2025-11-25

This is the second release candidate of Tofu Controller this calendar year, and contains various new features and bug fixes.

We would like to thank our contributors for their continued support and effort in improving the Tofu-Controller.

Please follow the upgrade guide in the documentation to ensure a smooth transition to the latest version.

New Features and Bug Fixes:

feat: controller refactoring (#1640) (38a6bd1c)
chore(docs): update docs to refer to CNCF Slack Channel (#1644) (be1c0445)
feat: enable controller priority queue (13b5f452)
fix(docker): use native build platform for go build stages (#1636) (516a098f)
chore: add self to MAINTAINERS (#1637) (59238cae)
fix(ci): speed up docker builds (#1635) (96eb5290)
docker: drop unused libretls (#1634) (3b1e6953)
chore: move condition types and reasons, and add comments (#1633) (0eaef3b6)
fix(chart): handling additional deployment labels (#1632) (f6ee8377)
docs: fix code display on exposed using hostname subdomain page (#1540) (bc4ee033)
fix(ci): avoid e2e race condition on cert gc (978bf29e)
chore: upgrade controller-runtime to v0.22.0 and their dependencies (#1602) (e4060875)
fix: implement a Terraform Exec Wrapper to detect State Lock Errors (#1623) (b67e9c7a)
fix: implement more descriptive errors during instance id mismatches (#1622) (536b9b4a)
Bump the deprecated FluxCD versions (#1539) (446d3b13)
Bump github.com/docker/docker (#1594) (13c7438d)
chore: upgrade to go 1.24 + upgrade deps and tooling (#1588) (7d88a637)
Bump golang.org/x/net from 0.34.0 to 0.38.0 (#1562) (d0b0910a)
Bump golang.org/x/crypto from 0.32.0 to 0.35.0 (#1561) (358235ee)
chore: bump libcrypto to 3.3.5-r0 and alpine to 3.22 (#1583) (d3d858be)
Fix broken github link (#1578) (5c7c6420)
Bump the gh-minor group across 1 directory with 17 updates (#1548) (67198a27)
Rename Weave GitOps to tofu-controller (#1549) (da8f516a)
Replace github.com/pkg/errors with errors wrapping using stdlib (#1526) (90ae7db8)
chore: bump libcrypto to 3.3.3-r0 (#1525) (88287639)
fix(oci): allow unlimited layer size (#1519) (a5c2ca77)
Bump the go-patch group across 3 directories with 11 updates (#1518) (36cfee53)
Bump actions/checkout from 4.2.0 to 4.2.2 in the gh-patch group across 1 directory (#1517) (b07f185a)
fix(ci): setup terraform (#1510) (f4893afd)
Control init -upgrade behaviour (#1471) (7ca23dc1)
Fix the HelmRelease scripts to install the latest helm chart (#1509) (4c3c1552)

v0.16.0-rc.5

Release date: 2025-01-14

This release introduces several enhancements, fixes, and updates to improve functionality and stability. It also addresses ongoing community feedback and includes dependency updates to keep the project secure and up-to-date.

We would like to thank our contributors for their continued support and effort in improving the Tofu-Controller.

Please follow the upgrade guide in the documentation to ensure a smooth transition to the latest version.

BREAKING CHANGES

Helm Chart Renaming: The Helm chart has been renamed from tf-controller to tofu-controller.

New Features and Bug Fixing:

add private registries integration docs by @ArieLevs in flux-iac#1237
helm-chart: add watchAllNamespaces argument by @akselleirv in flux-iac#1239
bump chart and doc yamls to v0.16.0-rc.4 by @chanwit in flux-iac#1242
Fix runner-serviceaccount helm template by @ayanevbg in flux-iac#1251
Update Repo URLs in Docs by @tech1ndex in flux-iac#1253
Update development docs by @akselleirv in flux-iac#1248
Add Aksel Skaar Leirvaag (@akselleirv) as a MAINTAINER by @chanwit in flux-iac#1258
#1247 helm readme update to tofo-controller by @dgem in flux-iac#1260
Helm chart rename by @ilithanos in flux-iac#1264
Tilt: fix references to helm chart after renaming by @akselleirv in flux-iac#1272
branch planner is now checking for both PostPlanningWebhookFailedReason and TFExecInitFailedReason for failing PR by @raz-bn in flux-iac#1271
docs: remove weaveworks.github.io references from docs by @zonorti in flux-iac#1276
Improve docs by @vishu42 in flux-iac#1275
fix(helm-chart): missing renamings by @akselleirv in flux-iac#1282
fix: build of tf-runner-azure by @akselleirv in flux-iac#1290
Fix Incorrect Metric Reporting Post-Update in Terraform Controller by @TarasLykhenko in flux-iac#1287
Removed mentions of team wild-watermelon by @akselleirv in flux-iac#1299
Speedup wait for pod ip by @akselleirv in flux-iac#1302
Move hardcoded "flux-system" namespace from templates to default values by @artem-nefedov in flux-iac#1303
Enable non-security dependency upgrades by @akselleirv in flux-iac#1305
Enable dependabot for github actions by @akselleirv in flux-iac#1311
Upgrade go version to 1.22 and set version via go.mod in workflow by @akselleirv in flux-iac#1310
Bump aws-sdk-go-v2 deps and fix deprecated usage by @akselleirv in flux-iac#1331
Print plan before apply by @akselleirv in flux-iac#1304
Bump controller-runtime and k8s.io/* by @akselleirv in flux-iac#1334
bump libcrypto to 3.1.6-r2 by @akselleirv in flux-iac#1401
bump github.com/fluxcd/pkg/ssa to v0.39.1 by @akselleirv in flux-iac#1402
Delete stale metrics on object delete by @TarasLykhenko in flux-iac#1362
fix(helm-chart): ensure helm release namespace is applied by @mloiseleur in flux-iac#1425
Bump alpine and libcrypto by @akselleirv in flux-iac#1439
feat(helm-chart): Add additionalLabels for deployments by @adberger in flux-iac#1400
docs: provide instructions for autocomplete by @mloiseleur in flux-iac#1448
fix(helm-chart): rbac for branch planner by @mloiseleur in flux-iac#1447
Added exponential backoff on reconciliation failure by @akselleirv in flux-iac#1460
Fix deprecated usage of the k8s.io/apimachinery/pkg/util/wait package by @akselleirv in flux-iac#1461
README.md: remove roadmap by @akselleirv in flux-iac#1459
Upgrade Go version to 1.23.4 and deps by @akselleirv in flux-iac#1502

v0.16.0-rc.4

Release date: 2024-03-14

This is the first release of the project after rebooting under its new name and organization: Tofu Controller, now part of the Flux-IaC organization. Fully driven by our community, Tofu Controller and Flux-IaC aim to help innovate the development of Infrastructure as Code (IaC) controllers for Flux.

Thank you so much to our vibrant community, which propelled us to reach 1,000 stars on GitHub recently.

With the renaming of the controller, our community has identified several breaking changes, although some may have been missed. The transition from Weave TF-Controller to Flux-IaC Tofu-Controller could be challenging. We advise:

Backing up your Terraform states (tfstates)
Setting spec.destroyResourcesOnDeletion=false to avoid unintentional resource deletion
Pausing all Terraform CRs

before doing the upgrade.

BREAKING CHANGES

The renaming of the controller.
Reorganization of CRDs in the Helm Chart, which may lead to their uninstallation and reinstallation.

New Features and Bug Fixing:

Pass missing build arg TARGETARCH to docker-build.
Implement BLOB encryption within the tf-runner.
Add tfvars feature and API.
Generate checksum for cache blobs.
Implement remediation retry.
Add unique hash to cloned source to avoid conflict.
Speed up compiling of binaries.
Added config for building tf-runner image and using it in helloworld example.
Bump version in manifest used in user guide to reflect latest RC.
Document a fix to "terraform objects stuck on deletion" issue.
Fix docker build breaking due to LIBCRYPTO_VERSION.
Fix issues surfaced around the polling server.
Add documentation about IPv6 support.
Update branch planner default configuration.

v0.16.0-rc.3

Release date: 2023-09-19

We've been implementing the new feature called the Branch Planner during v0.15.x as a separate component. And it has been included in the installation of TF-Controller since v0.16.0-rc.2. This version also includes many improvement for the Branch Planner. Branch Planner allows us to interact with Pull Requests to plan and review the planning process with a separate branch, while the GitOps automation is still working on the main branch. This feature is currently Technology Preview.

BREAKING CHANGES

This version also introduced the lockdown mode by default. Lockdown is the mode that enhances security for your Terraform Controller setup by preventing the Terraform objects from referencing cross-namespace Secrets and ConfigMaps. To relax this restriction, you can enable --allow-cross-namespace-refs flag at the controller level. This setting can also be done via a Helm Chart value too.

New Features and Bug Fixing:

Branch Planner: Delete Terraform objects before deleting its source @chanwit
Branch Planner: Exclude branch name from the planning object (use PR ID as suffix instead) @chanwit
correct the behaviour of e2e tests @chanwit
Screen cross-ns refs in .spec.cliConfigSecretRef @squaremo
docs: update least required permissions for a github api token @yitsushi
Add install docs for GKE Autopilot @chanwit
Fix reconcile stuck in a loop with manual approval @yitsushi
Expose --allow-cross-namespace-refs in the chart @squaremo
Adds Troubleshooting Section and tip to drift detection page @LappleApple
Update dependency github.com/cyphar/filepath-securejoin @chanwit
Add flag --allow-cross-namespace-refs to tf-controller and branch-planner @squaremo
Use Pod's Subdomain-based DNS resolution @syalioune
Add PriorityClassName, SecurityContext and ResourceRequirements to the Runner PodSpec @luizbafilho
Set default observedGeneration to -1 for Kustomization Controller compatibility @luizbafilho
Fix tfctl install --export not separating yaml objects properly @matheuscscp
Support Flux v2.1.0 @chanwit
Add SECURITY.md @yiannistri
Add OpenSSF Scorecard @yiannistri @LappleApple
Improve integration tests @yitsushi @luizbafilho @squaremo @yiannistri @chanwit
Refactor the runner base image @chanwit
Do not create branch planner resources if there are no terraform changes @yitsushi
Docs: Add Branch Planner guide @yiannistri @chanwit
Prevent dependsOn crossnamespace reference @squaremo @luizbafilho
Build: remove nsswitch.conf creation @hiddeco
Implement Resume and Suspend All @luizbafilho
Build(deps): bump the ci group with 5 updates @chanwit
Bump libcrypto3 and libssl3 @yitsushi

v0.16.0-rc.2

New Features and Bug Fixing:

Fix NPE in the Branch Planner @chanwit
Capture StdErr from Terraform Init and send it back to the controller @chanwit
Implementing the Branch Planner system @yitsushi @luizbafilho @squaremo @yiannistri @chanwit

v0.16.0-rc.1

New Features and Bug Fixing:

patch: static replica count for branch planner @yitsushi
feat: ability to set resource limits and security context for branch planner @yitsushi
fix: clear comment id after replan @yitsushi
Add RecordDuration metrics and using functions from fluxcd @luizbafilho
patch: use allowedNamespaces in Branch Planner @yitsushi
feat: post error as comment to a pull request @yitsushi
Fix source deletion when using branch planner @luizbafilho
Improve the Plan Only mode @yitsushi

v0.15.1

Release date: 2023-06-06

This version is a bug fix release for v0.15.

Bug Fixing:

Fix type information suffix (@chanwit)
Update gRPC dependency for CVE-2023-32731 (@chanwit)

v0.15.0

Release date: 2023-06-04

This version is the first stable release of Terraform Controller to support Flux v2 GA.

Bug Fixing:

Add OIDC go-client plugin to tfctl (@chanwit)
Update documents for v0.15.0 (@chanwit)

v0.15.0-rc.6

Release date: 2023-06-01

This is the last release candidate for v0.15.0. We'll release v0.15.0 in the next release.

Breaking changes:

Upgrade Flux to v2.0.0-rc.5 (@chanwit)

New Features and Bug Fixing:

Honor pod grace period seconds in case of the controller restarting (@chanwit)
Add planOnly mode (@yitsushi)
Add finalizer to a dependency only if object is not being deleted (@chanwit)
Add --no-cross-namespace-refs to the tf-controller / the lockdown mode (@squaremo)
Fix force-unlock in the object deletion path (@mmeha)
Pending plan not equal plan id in the plan storage (@chanwit)
Add plan log sanitization (@chanwit)

v0.15.0-rc.5

New Features and Bug Fixing:

Fix logging in tf-runner (@chanwit)
Fix broken metrics due to the Flux v2 upgrade (@chanwit)
Upgrade Alpine to v3.18 (@chanwit)
Fix logging in terraform output (@chanwit)

v0.15.0-rc.4

New Features and Bug Fixing:

Upgrade Flux to v2.0.0-rc.4 (@chanwit)

v0.15.0-rc.3

New Features and Bug Fixing:

Allow passing cluster domain (default is cluster.local) (@chanwit)
Add host aliases to the runner pod template (@chanwit)

v0.15.0-rc.2

New Features and Bug Fixing:

Update Flux APIs and use OCI HelmRepository (@stefanprodan)
Fix the case of no resources to destroy (@chanwit)
Change the default retryInterval to 15s (@chanwit)
Fix regression when output plan is blank (@chanwit)
Implement garbage collection for old cert secrets (@chanwit)
Add labels and annotations to outputted secrets (@scott-david-walker)
Fix instance label (@luizbafilho)
Change output type suffix to __type (@luizbafilho)
Implement break-the-glass mode (@chanwit)
Support renaming keys in varsFrom (@chanwit)
Support multiple version of Terraform Runners (@chanwit)

v0.15.0-rc.1

Release date: 2023-04-15

This release has a notable breaking change as we started supporting Flux v2.0.0 release candidates. Please note that you need to upgrade your Flux to v2.0.0-rc.1 or later to use this release. And this version is not compatible with Flux v2 0.41.x or earlier.

Breaking changes:

Upgrade Flux to v2.0.0-rc.1 (@chanwit)
Bump Terraform API to v1alpha2 and deprecated v1alpha1 (@chanwit)

v0.14.0

Release date: 2023-02-25

This release contains a number of new features and bug fixes. The most notable feature is the first-class support for Terraform Cloud in TF-controller with the spec.cloud field. This feature allows Weave GitOps Enterprise users to use GitOps Templates with Terraform Cloud as a backend for your Terraform resources. We also upgraded Flux to v0.40.0 and Terraform to v1.3.9 in this release.

New Features and Bug Fixing:

Add Weave GitOps metadata to the AWS package (@chanwit)
Fix env vars in Helm chart by enforcing quotes (@odise)
Improve AWS package docs (@chanwit)
Add servicemonitor for Helm chart (@oliverbaehler)
Fix missing inventory entries (@chanwit)
Support configuring Kube API QPS and Burst (@tariq1890)
Fix typo and missing links in doc (@tariq1890)
Update docs for replicaCount (@tariq1890)
Add enterprise placeholder (@chanwit)
Fix wrong indentations for selector labels in Helm chart (@geNAZt)
Update Terraform binary to v1.3.7 (@akselleirv)
Add parallelism option for the Terraform apply stage (@siiimooon)
Update Flux to v0.38 (@chanwit)
Force replan if the controller cannot load the plan correctly from secret (@tomhuang12)
Fix error an error in the doc examples (@kingdonb)
Refactor message trimming (@chanwit)
Update dependency for CVE-2022-41721 (@chanwit)
Enhance outputs with type information (@chanwit)
Add cloud spec to first-class support Terraform Cloud (@chanwit)
Support multi-arch images (@rparmer)
Allow customizing controller log encoding (@tomhuang12)
Upgrade Terraform to v1.3.9 and Alpine to v3.16.4 (@chanwit)
Upgrade Flux to v0.40 (@chanwit)

v0.13.1

Release date: 2022-11-06

New Features and Bug Fixing:

Update Source controller to v0.31.0 / Flux v0.36.0 (@chanwit)
Improve tfctl commands (@chanwit)

v0.13.0

Release date: 2022-10-27

A notable feature in this version is the first-class YAML support for Terraform. A Terraform object in v0.13.0+ allows you to better configure your Terraform resources via YAMLs, without introducing any extra CRDs to your cluster.

Together with a new generator, Tofu-Jet, we'll now be able to ship pre-generated primitive Terraform modules for all major cloud providers. We shipped the alpha version of AWS package in this release.

A primitive Terraform module is a module that only contains a single primitive resource, like aws_iam_role, or aws_iam_policy. With this concept, we would be able to use Terraform without writing Terraform codes, and make it more GitOps-friendly at the same time.

New Features and Bug Fixing:

Implement webhooks for Terraform stages (@chanwit)
Add use case examples (@tomhuang12)
Add .spec.workspace field (@k0da)
Add the default value to workspace (@k0da)
Implement spec.values and map it to Terraform HCL (@chanwit)
Add docs for preflight checks (@chanwit)
Implement Helm-like template for Terraform files (@chanwit)
Add runner Dockerfile for Azure (@tomhuang12)
Upgrade Golang to v1.19 (@chanwit)
Bundle an alpha version AWS Package (@chanwit)
Fix e2e (@chanwit)
Implement init containers support on the runner pod (@Nalum)
Implement spec.dependsOn and watch for the output secret changes (@chanwit)
Implement templating for input references (@chanwit)
Fix the check of dependencies by taking the output secret into account (@chanwit)
Add tests for the spec.dependsOn feature (@chanwit)
Change templating delimiter to ${{ }} (@chanwit)
Add labels to "tfstate" via the K8s backend so that we can group them by the labels (@chanwit)
Fix dependency in the finalizer (@chanwit)
Add an ability to Helm chart for creating service accounts in each namespace (@adamstrawson)
Parameterize AWS package in chart (@k0da)
Add trace logging (@Nalum)
Fix runner service account template not returning multiple docs (@skeletorXVI)
Implement "replan" to avoid double planning (@chanwit)
Add SHA and version information to the binaries (@chanwit)

v0.12.0

Release date: 2022-09-07

This release contains a number of new features and bug fixes.

New Features and Bug Fixing:

Enable custom backends for Terraform (@fsequeira1)
Support backendConfigsFrom for specifying backend configuration from Secrets (@chanwit)
Add a parameter for specifying max gRPC message size, default to 4MB (@chanwit)
Implement force-unlock for tfstate management (@Nalum)
Fix the initialization status (@chanwit)
Recording events to support Flux notification controller (@chanwit)
Support specifying targets for plan and apply (@akselleirv)
Add node selector, affinity and tolerations for the runner pod (@Nalum)
Add volume and volumeMounts for the runner pod (@steve-fraser)
Add file mapping to map files from Secrets to home or workspace directory (@itamar-marom)
Fix Plan prompt being overridden by the progressing message (@chanwit)
Support storing human-readable plan output in a ConfigMap (@chanwit)

v0.11.0

Release date: 2022-08-12

This release is another milestone of the project as it is the first release of TF-controller that supports Flux's OCIRepository.

New Features and Bug Fixing:

Added support for Flux's OCIRepository (@chanwit)
Fixed EnvVars to pick up valueFrom to work with Secrets and ConfigMaps (@Nalum)
Fixed tfctl to show plan in the working directory (@github-vincent-miszczak)
Updated tfexec to v0.16.1 for the force-lock option (@chanwit)
Updated the Source controller to v0.26.1 (@chanwit)

v0.10.1

Release date: 2022-08-05

This release is a huge improvement as we have successfully reconciled 1,500 Terraform modules concurrently. This pre-release contains the following changes.

Bug Fixing:

Fix pod deletion process (@chanwit)
Make the gRPC dial process more reliable (@chanwit)
Add the runner pod creation timeout, default at 5m0s (@chanwit)
Fix another race condition secret (@chanwit)
Map runner's home to a volume to make it writeable (@chanwit)

v0.10.0

Release date: 2022-08-02

This pre-release contains the following changes.

New Features and Bug Fixing:

Add support for Terraform Enterprise (@chanwit)
Implement resource inventory (@chanwit)
Improve security to make the images work with Weave GitOps Enterprise (@chanwit)
Re-implement certificate rotator (@chanwit)
Correct IRSA docs (@benreynolds-drizly)
Update Kubernetes libraries to v0.24.3 (@chanwit)
Update go-restful to fix CVE-2022-1996 (@chanwit)
Add pprof to the /debug/pprof endpoint (@chanwit)
Fix race condition to make sure that gRPC client and the runner use the same TLS (@chanwit)

v0.9.5

Release date: 2022-05-30

This pre-release contains the following changes.

New Features:

Update Terraform binary to 1.1.9 (@chanwit)
Allow runner pod metadata customization (@tomhuang12)
Support runner pod environment variables specification (@Nalum)
Implement .spec.refreshBeforeApply to refresh the state before apply (@chanwit)
Use controller runtime logging library in runner (@chanwit)

Bug Fixing:

Fix nil reference for event recorder (@chanwit)
Fix insertion of sensitive information to runner pod logging (@chanwit)
Fix nil reference for in writeBackendConfig (@chanwit)

v0.9.4

Release date: 2022-04-15

This pre-release contains the following changes.

New Features and Bug Fixing:

Fix Helm chart to support image pull secrets for tf-runner Service Accounts (@Nalum)
Upgrade Source Controller API to v0.22.4 (@tomhuang12)
Fix json bytes encoding (@phoban01)
Add Helm chart an option to specify AWS Security Group policy (@Nalum)
Move plan revision from labels to annotations (@Nalum)
Update images to include fix for CVE-2022-28391 (@chanwit)
Update Terraform binary to 1.1.8 (@chanwit)

v0.9.3

Release date: 2022-03-28

This pre-release contains the following changes.

Bug Fixing:

Fix runner pod pointer variables so that getting pods works correctly (@chanwit)

v0.9.2

Release date: 2022-03-25

This pre-release contains the following changes.

Bug Fixing:

Wait for runner pods to be completely terminated before reconcile a new one (@chanwit)

v0.9.0

Release date: 2022-03-21

This pre-release contains the following changes.

New Features and Bug Fixing:

Network-based health checks (@tomhuang12)
Improved drift detection status (@phoban01)
Add FOSSA and CodeQL scan (@tomhuang12)
Support HCL variables (@phoban01)
Implemented local gRPC runner (@chanwit)
Update source-controller to v0.21.1 (@tomhuang12)
Add Trivy scan (@tomhuang12)
Change image repository to ghcr.io/weaveworks (@phoban01)
Move repository to Weaveworks (@chanwit)
Add E2E Tests (@tomhuang12)
Moved charts to weaveworks/tf-controller (@tomhuang12)
Add local http server for http health check (@tomhuang12)
Update Terraform version (@fsequeira1)
Update the Helm repository URL (@tomhuang12)
Implement CA certification generation and mTLS rotation (@phoban01)
Add documentation site (@tomhuang12)
Implemented runner pods (@chanwit)
Add multi-tenancy E2E test case (@tomhuang12)
Implemented output name mapping (@chanwit)
Improve test coverage (@tomhuang12)
Fix documents GitHub Actions (@tomhuang12)
Set the default Service Account to tf-runner (@tomhuang12)
Make certification rotation configurable (@tomhuang12)
Implement gRPC retry policy (@chanwit)
Implement TLS validation and graceful shutdown (@phoban01)
Fix certification validation (@chanwit)
Fix drifted outputs (@chanwit)
Change the behaviour of pod cleanup to be default (@chanwit)
Add concurrency to the Helm chart (@chanwit)
Fix CVE-2022-0778 (@chanwit)

v0.8.0

Release date: 2022-01-24

This pre-release contains the following changes.

Breaking Changes:

Change .spec.varsFrom from object to be an array of object in v1alpha1. Users require to update their Terraform objects.

New Features:

Helm chart (@tomhuang12)
Allow many instances of .spec.varsFrom (@phoban01)
Add the Drift Detection only mode (@phoban01)
Upgrade Terraform to 1.1.4 (@chanwit)

Improvements:

Fix recording the status of destroy plans (@chanwit)

v0.7.0

Release date: 2022-01-16

This pre-release contains the following changes.

New Features:

Add flag to allow disabling drift detection .spec.disableDriftDetection (@phoban01)
Add field to allow specifying TF client configuration .spec.cliConfigurationSecretRef and disable backend completely .spec.backendConfig.disable (@chanwit)

Improvements:

Add documentation on how to use TF-controller with EKS IRSA (@phoban01)
Support gzip encoding for tfplan (@tomhuang12)
Improve re-plan behaviour (@chanwit)

v0.6.0

Release date: 2022-01-12

This pre-release contains the following changes.

Improvements:

Correct the manual approval behaviour, as amended in tc000030.
Upgrade Go to 1.17.6
Upgrade Source controller to v0.20.1
Support Flux v2 0.25.x

v0.5.2

Release date: 2022-01-11

This pre-release contains the following changes.

Improvements:

Improve UX for plan generation message. Plan message now includes an action with the short form of the plan id, as amended in tc000050.

v0.5.1

Release date: 2022-01-10

This pre-release contains the following changes.

Improvements:

Improve UX for plan generation message. Plan name is shown in the message, so that it can be used for an approval, as amended in tc000050.

v0.5.0

Release date: 2022-01-09

This pre-release contains the following changes.

Improvements:

Improve status messages.
shouldDetectDrift is now specified by tc000180

v0.4.3

Release date: 2022-01-09

This pre-release contains the following changes.

Improvements:

Improve shouldDetectDrift logic for new objects

v0.4.2

Release date: 2022-01-09

This pre-release contains the following changes.

Improvements:

Add resource's shortName
Add display columns to the CRD.

v0.4.1

Release date: 2022-01-09

This pre-release contains the following changes.

Improvements:

Improve shouldDetectDrift logic.
Improve the behaviour of the auto mode t0 be started over from planning when the apply process fail because of entity exists externally, as specified by tc000170.

v0.4.0

Release date: 2022-01-08

This pre-release contains the following changes.

Improvements:

Introduce .status.lastPlannedRevision to handle a case of source changes by non TF-files, as specified by tc000160
Improve shouldDetectDrift logic using .status.lastPlannedRevision.

v0.3.1

Release date: 2022-01-07

This pre-release ships with the following changes.

Improvements:

Upgrade the Terraform binary tp v1.1.3.
Improve the spec documentation of the test files.

v0.3.0

Release date: 2022-01-05

This pre-release ships with the implementation of the following features.

New Features:

The ability to apply Terraform in the auto approval mode, as specified by tc000010.
Support backend configuration, as specified by tc000020.
The ability to plan Terraform, as specified by tc000030, and tc000050.
Support outputs and selection of those outputs as secrets, as specified by tc000040 and tc000041.
Support variables, also from Secrets and ConfigMaps, as specified by tc000060, tc000070, tc000080, tc000090.
The ability to reconcile when Source changes, as specified by tc000100, and tc000110.
Resource deletion implementation, as specified by tc000120.
Support the destroy mode, as specified by tc000130.
Support drift detection, as specified by tc000140 and tc000150.

FilesExpand file tree

CHANGELOG.md

Latest commit

History

CHANGELOG.md

File metadata and controls

Changelog

v0.16.4

What's Changed

New Contributors

v0.16.3

What's Changed

v0.16.2

What's Changed

New Contributors

v0.16.1

What's Changed

v0.16.0

Breaking Changes:

What's Changed

v0.16.0-rc.8

v0.16.0-rc.7

v0.16.0-rc.6

v0.16.0-rc.5

v0.16.0-rc.4

v0.16.0-rc.3

v0.16.0-rc.2

v0.16.0-rc.1

v0.15.1

v0.15.0

v0.15.0-rc.6

v0.15.0-rc.5

v0.15.0-rc.4

v0.15.0-rc.3

v0.15.0-rc.2

v0.15.0-rc.1

v0.14.0

v0.13.1

v0.13.0

v0.12.0

v0.11.0

v0.10.1

v0.10.0

v0.9.5

v0.9.4

v0.9.3

v0.9.2

v0.9.0

v0.8.0

v0.7.0

v0.6.0

v0.5.2

v0.5.1

v0.5.0

v0.4.3

v0.4.2

v0.4.1

v0.4.0

v0.3.1

v0.3.0