Config Connector version 1.144.0 was identified as a bad release. Do not use this version - upgrade directly to 1.145.0 or later.

Announcement

Config Connector version 1.146.0 is now available.

Feature

New Alpha Resources (Direct Reconciler):

• ParameterManagerParameter
  • Manage Parameter Manager Parameters.

Feature

New Fields:

• ContainerCluster
  • Added spec.controlPlaneEndpointsConfig.dnsEndpointConfig.enableK8sTokensViaDns field.

Change

Improvements:

• ContainerCluster
  • Made spec.clusterAutoscaling.autoProvisioningDefaults.bootDiskKMSKeyRef mutable.
• NetworkServicesWasmPlugin
  • Introduced identity and reference.
• Added structured reporting diff to numerous direct controllers to enhance diff visibility.

Fixed

Bug Fixes:

• SQLInstance
  • Added client-side default for RetainedBackups and RetentionUnit, and validated the edition field.
  • Added replicaConfiguration as an unmanageable field.
  • Controller now correctly defaults the field enablePrivatePathForGoogleCloudServices to false.
• CertificateManagerDnsAuthorization
  • Sanitized Kubernetes labels to avoid 400 errors from invalid characters.
• ConfigConnector Core
  • preview now performs an early exit when no resources are found to reconcile.
  • Fixed CRD field description for shared parent.
  • Fixed incorrect exit status in lint filter.
  • Updated mockgcp to improve compute regional resource mocks and defaults.

Config Connector version 1.145.0 is now available.

Feature

New Beta Resources (Direct Reconciler):

• ComputeSecurityPolicy
  • Manage Google Cloud Armor security policies.
• MemorystoreInstance
  • Manage Memorystore for Valkey Instances.

Feature

New Fields:

• ContainerCluster
  • Added spec.clusterAutoscaling.defaultComputeClassConfig field.
• RunJob
  • Added spec.template.template.volumes.nfs field to support NFS backed Volumes.
  • Added spec.template.template.volumes.gcs field to support GCS backed Volumes.
• SQLInstance
  • Added spec.settings.failoverDrReplicaRef field to support designating CloudSQL Enterprise Plus DR Replicas.

Feature

New features:

• Added the preview command to the config-connector CLI. The preview command has been removed from the experimental kompanion tool.

Change

Added support for structured diff reporting to the following direct controllers to improve logging and debugging:

• ApigeeEnvgroup
• ApigeeInstance
• AssetFeed
• AssetSavedQuery
• BackupVaultIdentity
• BigtableLogicalView
• CloudDeployDeliveryPipeline
• ColabRuntime
• RedisCluster
• SpannerBackupSchedule
• SpannerInstance
• SpannerInstanceConfig
• TaskQueue
• WorkstationConfig

Fixed

Bug Fixes:

• DataformRepository
  • Fixed a bug where the serviceAccountRef field could not be updated.
• SpannerBackupSchedule
  • Fixed an issue with invalid update masks by handling output-only fields.

Config Connector version 1.144.0 is now available.

Feature

New Beta Resources (Direct Reconciler):

• TagsLocationTagBinding
  • TagsLocationTagBinding is promoted to beta and now uses the direct reconciler by default.
  • Supports tagging of regional resources, including ArtifactRegistryRepository, CloudRun (RunJob, RunService), BigQueryDataset, BigQueryTable, and StorageBucket.
  • spec.location should be set to the region of the resource being tagged.

Fixed

Bug Fixes:

• Fixed incorrect diffs in TagsLocationTagBinding caused by project number versus. project ID mismatches.

Change

Reconciliation Improvements:

• TagsLocationTagBinding
  • Switched to direct reconciliation as the default reconciler.

Config Connector version 1.134.4 is now available.

Fixed

Bug Fixes:

• #6035: Fixed an issue where managedFields metadata could be incorrectly attributed to the status subresource during spec updates, causing "Location must be set" errors.

Feature

#6065: Enabled Vertical Pod Autoscaler (VPA) support. You can enable VPA for Config Connector components via ControllerResource and NamespacedControllerResource to automatically adjust resource requests.

Config Connector version 1.143.0 is now available.

Feature

New Alpha Resources (Direct Reconciler):

• ParameterManagerParameter

Feature

New Beta Resources (Direct Reconciler):

• ArtifactRegistryRepository
• LoggingLink
• MemorystoreInstance
• PrivateCACAPool

Feature

New Features:

• Set GOMEMLIMIT for KCC workloads to improve memory management and stability.

Feature

New Fields:

• AlloyDBInstance
  • Added spec.connectionPoolConfig field.
  • Added status.connectionPoolConfig field.

Change

Reconciliation Improvements:

• TagsTagBinding

  • Added support for organizations in parentRef.
  • Added support for multiple targets in parentRef.

• Resource References (refs.Ref) support added for the following resources to improve reference resolution:

  • BigQueryTable
  • BigQueryDataset
  • CloudRunService
  • CloudRunJob
  • ArtifactRegistryRepository
  • StorageBucket

Fixed

Bug Fixes:

• Issue 6221: ComputeBackendService can now correctly refer to clientTLSPolicy.
• Issue 6156: BigQueryTable now ignores int64 to int32 schema changes when configured.
• Issue 6026: Fixed identity parsing for TagsTagValue.

Config Connector version 1.142.0 is now available.

Feature

New Beta Resources (Direct Reconciler):

• AlloyDBBackup
• AccessContextManagerAccessLevel

Feature

New Features:

• IAM: Added support for iam.cnrm.cloud.google.com/disable-dependent-services annotation.
• Added support for Cilium cluster-wide network policy.

Feature

New Fields:

• AlloyDBInstance
  • Added spec.observabilityConfig and spec.queryInsightsConfig fields.
• ContainerNodePool
  • Added spec.nodeConfig.enableNestedVirtualization field.

Change

Reconciliation Improvements:

Added support for direct reconciliation to more resources, with opt-in behaviour. The API is unchanged. To use the direct reconciler, add the alpha.cnrm.cloud.google.com/reconciler: direct annotation to the corresponding Config Connector object. The following resources now have direct reconciliation support:

• TagsLocationTagBinding: Now supports direct reconciliation.

Fixed

Bug Fixes:

• BatchJob: Fixed a bug where the resource could not be created.
• FirewallPolicyRule: Fixed an issue with updating the resource.
• IAMServiceAccountKey: Fixed an issue causing unnecessary re-reconciliation.
• Fixed a bug where ComputeBackendService could not refer to clientTLSPolicy due to an invalid format.
• Fixed a bug where interconnect attachments were not ignored.
• Fixed a bug in the GitHub MCP server.
• Fixed a bug in the private cluster endpoint for mockgcp.

Config Connector version 1.141.0 is now available.

Feature

New Features:

• Enabled Vertical Pod Autoscaler (VPA) support for Config Connector controllers.
• Added verticalPodAutoscalerMode field to ConfigConnector and ConfigConnectorContext resources.

Feature

New Fields:

• RunJob

  • Added spec.template.spec.containers[].port field.

• DataplexTask

  • Replaced project with projectRef.
  • Replaced serviceAccount with serviceAccountRef.
  • Replaced kmsKey with kmsKeyRef.

Fixed

Bug Fixes:

• Fixed various issues in observedState handling for resources with reference fields.
• Fixed an issue where IAMPolicy and IAMPartialPolicy controllers would alphabetize the members field within the resource spec and write it back. This behavior can conflict with intent-based reconciliation from GitOps systems such as Config Sync, causing a loop of updates and potentially exhausting IAM read quotas.

Config Connector version 1.140.2 is now available.

Fixed

• Fixed a bug where the IAMPolicy and IAMPartialPolicy controllers would alphabetize the members field within the resource spec and write it back. This behavior can conflict with intent-based reconciliation from GitOps systems such as Config Sync, causing a loop of updates and potentially exhausting IAM read quotas. This issue affected versions 1.140.0 and has now been patched in version 1.140.2.

Config Connector version 1.140.0 is now available.

Feature

New Beta Resources (Direct Reconciler):

• CertificateManagerCertificateIssuanceConfig
  • Manage Certificate Manager certificate issuance configurations for automating certificate issuance.

Change

New Alpha Resources (Direct Reconciler):

• AssuredWorkloadsWorkload
  • Manage Assured Workloads workloads to support compliance and security requirements.
• ConfigDeliveryResourceBundle
  • Manage Config Delivery resource bundles for Config Sync.

Feature

New Fields:

• AlloyDBCluster
  • Added spec.restoreContinuousBackupSource and spec.restoreBackupSource fields to support restoring from a backup.
• BigQueryReservationAssignment
  • Added spec.jobType field.
• FirestoreDatabase
  • Added spec.deleteProtectionState field.
• FirestoreField
  • Added spec.ttlConfig field.
• RunJob
  • Added spec.template.template.containers.dependsOn field.

Change

Reconciliation Improvements:

• Integrated Multi-Cluster Leader Election for improved reliability in multi-cluster setups.

Fixed

• Fixed an issue where BigQueryReservationAssignment was not exposing externalRef.
• Fixed an issue with CertificateManagerDNSAuthorization API, Fuzzer and Mapper.
• Fixed an issue with FirestoreDatabase defaulting logic.

Config Connector version 1.139.0 is now available.

Change

New Alpha Resources (Direct Reconciler):

• FirestoreField

Feature

New Features:

• The controller type is now reported at the start and end of reconciliation.
• Mockgcp now supports iap oauth brands and bigtable materializedview.

Change

Reconciliation Improvements:

• IAM partial policy management

Fixed

• Reduced the memory footprint of the recorder.
• SQLInstance: Fixed an issue where empty maintenanceVersion patches were sent. The settings and maintenanceVersion fields are now unmanaged.
• FirestoreDatabase: Fixed boolean value exports.

Config Connector version 1.138.0 is now available.

Feature

New Beta Resources (Direct Reconciler):

• BackupDRBackupVault
• OrgPolicyCustomConstraint

Feature

New Alpha Resources (Direct Reconciler):

• FirestoreBackupSchedule
• FirestoreDocument

Change

Reconciliation Improvements:

• Improved Normalization logic for OrgPolicy, RunJob, TagsTagBinding, and VertexAIIndex resources.

Fixed

Bug Fixes:

• Fixed format validation issue in the DataflowFlexTemplateJob direct controller when the spec.subnetworkRef.external field contains full URL.
• Updated status.observedGeneration in ConfigConnector object.

New Beta Resources (Direct Reconciler):

• DocumentAIProcessorVersion
• EssentialContactsContact
• BigQueryBigLakeTable
• BackupDRBackupPlan

Fixed

Bug Fixes:

• Fixed an issue where ComputeBackendService backends were not sorted.
• Fixed an issue where CloudFunctionsFunction runtime was not a supported value.
• Fixed an issue with labels for BackupDRBackupPlan.
• Fixed an issue with labels for RunJob.
• Fixed a fuzzing issue for FirestoreField.
• Fixed an issue with KMSCryptoKey import.
• Fixed a flakiness issue in the MonitoringDashboard fuzzer.
• Fixed a flakiness issue in tests.
• Fixed an issue with bad labels in tests.
• Fixed an issue with etag in direct reconciliation.

Change

New Alpha Resources (Direct Reconciler):

• BigtableMaterializedView
• MemorystoreInstance

Change

Reconciliation Improvements:

• Enabled opt-in for IAM partial policy management.
• Enabled server-side apply for KMS resources.
• Improved reconciliation for BigtableLogicalView by using deep reflection.
• Improved reconciliation for FirestoreDatabase with identity pattern and export support.
• Improved reconciliation for RunJob with export support.
• Unified ComputeTargetTCPProxy direct API and controller.

Feature

New Fields:

• BigtableMaterializedView: Added spec.sourceTableRef and spec.definition.
• BackupDRBackupPlan: Added spec.backupConfig.retentionPeriodDays and spec.backupConfig.backupWindow.

Announcement

Config Connector version 1.137.0 is now available.

Reconciliation Improvements:

• Introduced Stateful Reconciliation for Direct Controllers. With stateful reconciliation, the direct controller stores a hash of the last successfully applied .spec in the resource's .status. This provides a lightweight, GitOps-safe record when a user has modified the desired state of the resource.

Change

New Beta Resources (Direct Reconciler):

• AssetFeed
• BigQueryReservationAssignment
• CloudDeployDeliveryPipeline
• ComposerEnvironment

Fixed

Bug Fixes:

• Added support for checking etag in spec for alpha resources.
• Fixed an issue where CloudIdentityMembership roles comparison would fail.
• Fixed a bug where the wrong GVK was reported in IAM controller.
• Fixed a bug where errors were swallowed when reading a Secret.
• Fixed an issue with LRO endTime in mockgcp.
• Fixed a bug in the etag mapper.
• Fixed a bug in the mapper generator for slice and single object map.
• Fixed a bug in the mapper generator for OneOf if the input is not proto.Message.
• Fixed an import for refs in the same package in controllerbuilder.

Feature

New Fields:

• ComposerEnvironment
  • Added spec.storageConfig field.
  • Added spec.config.workloadsConfig.dagProcessor field.
  • Added spec.config.workloadsConfig.triggerer field.
  • Added spec.config.softwareConfig.webServerPluginsMode field.
  • Added spec.config.softwareConfig.cloudDataLineageIntegration field.

Announcement

Config Connector version 1.136.1 is now available.

Config Connector version 1.134.1 is now available.

Fixed

Bug Fixes:

• #5230: Fixed an issue that could lead to premature certificate rotation by ensuring errors are not swallowed when reading a Secret.
• #5231: Add more verbose logging during certificate validation to assist with debugging.

Bug Fixes:

• PR#5009 Fix the nil pointer dereference error in AlloyDB direct controller

Announcement

Config Connector version 1.135.0 is now available.

Feature

New Fields:

• AlloyDBCluster
  • Added spec.databaseVersion field

Change

New Beta Resources (Direct Reconciler):

• AssetSavedQuery
• PubSubSnapshot

Change

Modified Beta Reconciliation: We migrated the following resources from the Terraform-based or DCL-based controller to the new Direct Controller.

• VMWareEngineExternalAddress

Improved reconciliation by migrating the following resources from the Terraform-based or DCL-based controller to the new direct controller. These resources are migrated automatically and you no longer need to apply the opt-in annotation to enable the direct controller:

• CloudIdentityGroup

• CloudIdentityMembership

Fixed

Bug Fixes:

• ConfigConnectorContext:
  • PR#4995: status.observedGeneration is now being set on the ConfigConnectorContext.
  • PR#4657: Added spec.managerNamespace.
• SQLInstance:
  • PR#4838: Fixed bug in SQLInstance maintenanceVersion UPDATE operation
  • PR#4843: Set status on acquisition for SQLInstance controller
  • PR#4857: Support SQLInstance maintenanceVersion in CREATE operation

Change

New Fields:

• ContainerCluster: DNS endpoint is supported in ContainerCluster.

Announcement

Config Connector version 1.134.0 is now available.

New Beta Resources (Direct Reconciler):

• APIGatewayAPI

• AppHubApplication

• StorageAnywhereCache

Change

New Alpha Resources (Direct Reconciler):

• BigtableLogicalView

Change

Reconciliation Improvements

Added support for direct reconciliation to more resources, with opt-in behaviour. The API is backward compatible. The following resources now have direct reconciliation support

• BigQueryTable
  • Use the alpha.cnrm.cloud.google.com/reconciler: direct annotation on the BigQueryTable CR object to opt-in the direct controller.
  • The direct controller also supports adding BigQueryDataPolicies directly to BigQueryTable columns within spec.schema.

Fixed

• PR#4808 filtered out Kubernetes labels that are invalid for Google Cloud in the ComputeForwardingRule direct controller, ensuring backward compatibility after migrating to the direct controller.

Announcement

Config Connector version 1.133.0 is now available.

Config Connector version 1.132.1 is now available.

Change

Reconciliation Improvements:

• SpannerInstance
  • You can opt-in the direct controller by adding the alpha.cnrm.cloud.google.com/reconciler: direct annotation to the SpannerInstance resource`.
  • Direct controller is opt-in if using the following fields:
    • spec.labels
    • spec.defaultBackupScheduleType
    • spec.edition
    • spec.autoscalingConfig

Reconciliation Improvements:

• BigtableAppProfile
  • You can opt-in the direct controller by adding the alpha.cnrm.cloud.google.com/reconciler: direct annotation to the BigtableAppProfile resource.
  • Added support for spec.dataBoostIsolationReadOnly field for resources reconciled by the direct controller.
• CloudIdentityGroup and CloudIdentityMembership
  • You can opt-in the direct controller by adding the alpha.cnrm.cloud.google.com/reconciler: direct annotation to the CloudIdentityGroup and CloudIdentityMembership resources.
  • With direct reconciliation, creating new resources will no longer write back the service-generated ID to spec.resourceID. To acquire a resource, you can find its resourceID from the last part of status.externalRef field, or via gcloud command or Cloud Console. The spec.resourceID field is used for acquisition only, leave the field unset when creating a new resource.

Feature

• Storage Bucket
  • Removed immutability constraint on spec.location and spec.customPlacementConfig.dataLocations fields. To learn more, see Relocate buckets.

Change

New Alpha Resources (Direct Reconciler):

• OrgPolicyPolicy
• OrgPolicyCustomConstraint
• SpeechRecognizer
• StorageAnywhereCache

Feature

New Fields:

• SpannerInstance For opt-in direct controller,
  • Added spec.labels field.
  • Added spec.defaultBackupScheduleType field.
• SecretManagerSecret For opt-in direct controller,
  • Added spec.labels field.

Announcement

Config Connector version 1.132.0 is now available.

Feature

New Beta Resources (Direct Reconciler):

• SpeechCustomClass
• SpeechPhraseSet
• SpeechRecognizer
• VertexAINotebooksInstance
• VertexAIMetadataStore

New Beta resources (direct reconciler)

• IAPSettings

Change

New Alpha resources (direct reconciler)

• ComputeNetworkAttachment
• ComputeNetworkEdgeSecurityService
• DataplexEntryGroup
• DataplexEntryType
• DataplexTask
• DataplexZone
• DatastreamRoute
• DocumentAIVersion
• GKEBackupBackup
• GKEBackupRestore
• PubSubSnapshot
• SpeechCustomClass
• VMwareEngineExternalAddress
• MetastoreService
• MetastoreFederation
• MetastoreBackup
• APIQuotaPreference
• APIQuotaAdjusterSettings
• EventarcGoogleChannelConfig
• EventarcChannel
• AssetSavedQuery
• AssetFeed
• EssentialContactsContact
• DataCatalogEntryGroup
• DataCatalogEntry
• DataCatalogTagTemplate
• DataCatalogTag

Announcement

Config Connector version 1.131.0 is now available.

Fixed

• Fixed an issue: excessive compute.firewallPolicies.patchRule Logs triggered by Config Connector direct reconciliation.

New Fields

• GKEHubFeatureMembership

  • Added spec.configmanagement.configSync.stopSyncing in version1.129.

• SpannerInstance.

  • Added spec.defaultBackupScheduleType field.
  • Added spec.labels field

Feature

New Beta resources (direct reconciler)

• ApigeeEndpointAttachment

• ApigeeEnvgroupAttachment

• ApigeeInstanceAttachment

• ManagedKafkaTopic

• SecureSourceManagerInstance

• SecureSourceManagerRepository

Change

New Alpha resources (direct reconciler)

• ApphubApplication
• BackupDRManagementServer
• BackupDRBackupVault
• BackupDRBackupPlan
• BackupDRBackupPlanAssociation
• BatchJob
• BigLakeTable
• BigQueryReservation
• CodeDeployDeliveryPipeline
• DataplexLake
• DatastreamPrivateConnection
• DatastreamConnectionProfile
• DocumentAIProcessor
• GKEBackupBackupPlan
• GKEBackupRestorePlan
• NetAppBackupPolicy
• NotebooksEnvironment
• SpannerInstanceConfig
• VertexAIFeaturestore
• VMwareEnginePrivateCloud
• VMwareEngineNetwork
• VMwareEngineNetworkPeering
• VMwareEngineNetworkPolicy
• WorkflowExecution

Announcement

Config Connector version 1.130.2 is now available.

Change

Reconciliation Improvements

Added support for direct reconciliation to more resources, with opt-in behaviour. The API is backward compatible. To use the direct reconciler, add the alpha.cnrm.cloud.google.com/reconciler: direct annotation to the corresponding Config Connector object. The following resources now have direct reconciliation support (and we list some of the issues that this fixes):

• SpannerInstance
  • You can use spec.edition field to optimize your enterprise edition type
  • You can use spec.autoscalingConfig to automate the scaling instead of manually configure spec.processingUnit or spec. numNodes.
  • You can use the defaultBackupScheduleType now.
  • Behavior Change If you use the SpannerInstance Kubernetes metadata.labels to configure your GCP labels, please change them to use the spec.labels field instead.

New Alpha resources (direct reconciler)

• ManagedKafkaTopic
• ApigeeInstanceAttachment
• ApigeeEnvgroupAttachment
• ApigeeEndpointAttachment

Change

Reconciliation Improvements

• SQLInstance

  • All SQLInstance types are now reconciled using the new direct controller instead of the legacy Terraform-based controller. The previous "opt-in" annotation (document reference) no longer applies. Users no longer need to apply the "opt-in" annotation to SQLInstance resources to enable the direct controller. Regardless of the presence (or absence) of an opt-in annotation on SQLInstance resources, the direct reconciler will be used.
  • This change enables all SQLInstance resources to switch from edition ENTERPRISE to ENTERPRISE_PLUS and fixes the bug that prevented SQL Instance upgrade.

Announcement

Config Connector version 1.129.2 is now available.

Feature

New Beta resources (direct reconciler)

• ManagedKafkaCluster

• ApigeeInstance

• AlloydbInstance

Reconciliation Improvements

• We have added support for direct reconciliation to more resources, with opt-in behaviour. The API is unchanged. To use the direct reconciler, add the alpha.cnrm.cloud.google.com/reconciler: direct annotation to the corresponding Config Connector object. The following resources now have direct reconciliation support:

  • AlloyDBInstance
  • SpannerInstance

Change

New Alpha resources (direct reconciler)

• IAPSettings

  • Customize the Identity-Aware Proxy (IAP) settings for applications and services running on Google Cloud Platform.

• SecureSourceManangerInstance

• SecureSourceManangerRepository

Announcement

Config Connector version 1.128.0 is now available.

Fixed

DataformRepository fields validation error.

• Fixed the incorrect format validation for the following fields:

  • spec.gitRemoteSettings.authenticationTokenSecretVersionRef
  • spec.gitRemoteSettings.sshAuthenticationConfig.userPrivateKeySecretVersionRef
  • spec.npmrcEnvironmentVariablesSecretVersionRef

Feature

New Beta resources (direct reconciler)

• ApigeeEnvgroup

  • Define environment groups to specify the hostnames for routing traffic to Apigee environments.

• KMSAutokeyconfig

  • Manage the KMS auto key which simplifies the CMEKs provisioning and assignment.

Feature

New Fields

• SpannerInstance

  • You need to use the alpha.cnrm.cloud.google.com/reconciler: direct annotation on SpannerInstance resource to opt-in these features.

    • spec.autoscalingConfig
    • spec.edition

SecretManagerSecretVersion Reconciliation Improvements

• You can use the alpha.cnrm.cloud.google.com/reconciler: direct annotation on the object to opt-in the direct controller, which gives the following improvements:

  • Resolved update stalling caused by DependencyNotReady errors.
  • Fixed the friction in spec.enabled that enabling or disabling a secret version does not always take effect in GCP.
  • API Behavior Change The service generated ID is changed from spec.resourceID to status.version with status.externalRef (new field) to guardrail the identity.

Fixed

• Dataflowflextemplatejob subnetwork validation error.
  • Error message should match regions/REGION/subnetworks/SUBNETWORK

Feature

New Fields

• BigQueryDataTransferConfig

  • Added spec.scheduleOptionsV2 to customize the different types of data transfer schedule.
  • Added status.observedState.error with detailed information about reason of the latest config failure.

• GkeHubFeatureMembership

  • Added spec.configmanagement.management to enable Config Sync Auto Upgrade. This is an opt-in feature and you need to turn on the alpha.cnrm.cloud.google.com/reconciler: direct annotation on the object.

Announcement

Config Connector version 1.127.0 is now available.

Feature

New Beta resources (direct reconciler)

• BigQueryAnalyticsHubListing

• FirestoreDatabase

• WorkstationConfig

• Workstation

Change

SecretManagerSecret Reconciliation Improvements

• You can use the alpha.cnrm.cloud.google.com/reconciler: direct annotation on the object to opt-in the direct controller, which gives the following improvements:

  • Enhanced spec.rotation.nextRotationTime to use a fixed datetime value to avoid relative now() friction.
  • Fixed the spec.replication.auto immutable issue
  • Added the in-use version aliases in status.observedState.versionAliases
  • Resolved update stalling issues.
  • Clarify the TTL use. See the problems and share your use in GitHub issue #3395

Config Connector version 1.126.0 is now available.

Feature

Use BigQueryConnectionConnection to provide the IAM Service Account

• IAMPolicyMember

  • Added spec.memberFrom.bigQueryConnectionConnectionRef
  • See an example on IAMPolicyMember use BigqueryConectionConnection "cloudSQL"

• IAMPartialPolicy

  • Added spec.memberFrom.bigQueryConnectionConnectionRef.

Announcement

Config Connector system management CRDs ControllerReconciler and NamespacedControllerReconciler are promoted to Beta. See how to configure the Controller manager rate limit.

Feature

New Beta resources (direct reconciler)

• BigQueryTransferConfig

  • Manage the metadata needed to perform a BigQuery data transfer.

• KMSKeyHandle

  • Manage the provisioning of a CryptoKey.

Change

New Alpha Resources

• Add new resource WorkstationConfig

Config Connector version 1.125.0 is now available.

Feature

New Beta resources (direct reconciler)

• BigQueryConnectionConnection

  • Manage connections to connect to Google services and external data sources

• BigQueryAnalyticsHubDataExchange

  • Manage data exchange to enable self-service data sharing

• PrivilegedAccessManagerEntitlement

  • Manage entitlements to grant for projects, folders, and organizations

• WorkstationCluster

  • Manage workstation cluster to define a group of workstations in a particular region and the VPC network they're attached to.

Feature

Added cluster mode to manage the rate-limit for the Config Connector requests

• You can set the rate-limit for the reconciling requests to the kube-apiserver in Cluster and Namespace mode.
• Configure NamespacedControllerReconciler (Alpha) for namespace mode. This is added since 1.119
• Configure ControllerReconciler (Alpha) for cluster mode. The ControllerReconciler shows an example.

Change

SQLInstance Reconciliation Improvements

• You can use the alpha.cnrm.cloud.google.com/reconciler: direct annotation on the SQLInstance CR object to opt-in the direct controller.
• The direct reconciler contains 2 fix and improvement:
  • Fix the upgrade and downgrade issue between ENTERPRISE and ENTERPRISE_PLUS.
  • Supports creating from clone functionality via spec. cloneSource
• Migrated the SQLInstance from the Terraform-based or DCL-based controller to the new Direct Controller to enhance the reliability and performance. The CRD is unchanged.

Change

ComputeFirewallPolicyRule Reconciliation Improvements

• You can use the alpha.cnrm.cloud.google.com/reconciler: direct annotation on the ComputeFirewallPolicyRule CR object to opt-in the direct controller, which fixes the targetResources error "required value priority could not be found".
• Migrated this resource from the Terraform-based controller to the new Direct Controller to enhance the reliability and performance. The resource CRD is unchanged.

Change

AlloyDBInstance

• Added spec.networkConfig.enableOutboundPublicIp field.
• Added status.outboundPublicIpAddresses field.

Fixed

Issue 2973 kubelet_config has insecure_kubelet_readonly_port_enabled: true set even if not configured in the ContainerNodePool object.

Fixed

Issue 3007 ComputeBackendService cannot refer clientTLSPolicy due to invalid format

CertificateManagerDNSAuthorization

• Add the spec.Location field.

Change

ComputeForwardingRule

• Added spec.target.googleApisBundle field (allowed values are all-apis or vpc-sc). Note, when configuring this field, the resource will use direct reconciliation.

Change

CertificateManagerDNSAuthorization is migrated from the Terraform-based to the new Direct controller to enhance reliability and performance. The resource CRD is unchanged.

Announcement

Config Connector version 1.124.0 is now available.

Change

RedisCluster is promoted from alpha to beta (Direct Reconciler).

Change

New Alpha Resources (Direct Reconciler)

• PrivilegedAccessManagerEntitlement
• BigQueryAnalyticsHubDataExchange

Announcement

The direct resource development guide is now available for contributors

To improve the Config Connector resource development process, we have a new development guide to contributing resources to Config Connector with the direct reconciliation process. This new approach makes contributing more reliable and consistent with Kubernetes development practices. For more information, read the new Direct resource development guide.

Config Connector version 1.123.1 is now available.

Change

BigQueryConnectionConnection (v1alpha1) now uses direct reconciliation.

Change

BigQueryDataTransferConfig (v1alpha1) now uses direct reconciliation.

Breaking

If you use the CloudIdentityGroup, CloudBuildTrigger and FirestoreIndex resources, do not use version 1.123.0, as it contains regression issues for these resources due to the state-into-spec setting.

Change

DataformRepository is promoted from alpha to beta.

Fixed

Config Connector switches between the Direct and TF-based reconcilers depending on the SQLInstances objects' use of the spec.cloneSource field

Announcement

Starting from this version, all new CustomResources (CRs) have the cnrm.cloud.google.com/state-into-spec annotation field default to absent. For more information about this behavior, see the spec fields documentation. The behavior of existing CRs is not impacted by this change.

Announcement

You can use the alpha.cnrm.cloud.google.com/reconciler: direct annotation on DataflowFlexTemplateJob resource to opt-in the Direct Cloud Reconciler, which provides an advanced status update solution for some timeout issues.

Change

Added FirestoreDatabase (v1alpha1). This uses direct reconciliation.

Config Connector version 1.122.0 is now available.

Change

RunJob

Add the spec.template.template.volumes[].cloudSqlInstance field to configure Cloud SQL instance.

Change

ContainerCluster

The spec.nodeConfig.taint can be updated in place in lieu of destroying and recreating the object.

Change

RedisCluster (Alpha) now uses direct reconciliation.

Change

Added RedisCluster (Alpha) resource for service Redis.

Change

SQLInstance now uses direct reconciliation.

Change

SQLInstance

Add the spec.cloneSource field to clone a SQLInstance.

Change

ContainerNodePool

The spec.nodeConfig.taint can be updated in place in lieu of destroying and recreating the object.

Announcement

The state-into-spec field now defaults to Absent in all Config Controller clusters.

Config Connector version 1.121.0 is now available.

Announcement

The state-into-spec field now defaults to Absent in any new Config Controller clusters.

Starting in version 1.122, this will be the default for all Config Controller clusters.

Starting in version 1.123, this will be the default for all Config Connector clusters.

Change

BigQueryTable

• Added spec.requirePartitionFilter field. This release note was added on August 20.

Fixed

BigQueryConnection

• Added status.observedState field to store the output-only fields which are previously mistakenly defined in spec.

Change

DataformRepository (Alpha) now uses direct reconciliation.

Fixed

BigtableInstance

• When autoscaling is enabled (spec.cluster[].autoscalingConfig.), does not use numNodes (spec.cluster[].numNodes=2) as that applies only to manual scaling.