Changelog¶

All notable changes to the Helm chart and deploy tooling are documented here.

Format based on Keep a Changelog. Versioning: SemVer.

[Unreleased]¶

[0.7.3] - 2026-09-25¶

Fixed¶

Control-plane NetworkPolicy DNS egress allows NodeLocalDNS (port 53 without CoreDNS-only selectors) so the UI can resolve virtfoundry-api on Kubespray clusters.

[0.7.2] - 2026-09-25¶

Security release aligning charts with core/operator 0.7.2 (PSS hardening, networking/Ingress defaults, secrets fail-closed).

Security¶

Harden API/UI Deployments (closes #42): non-root + drop ALL + RuntimeDefault seccomp + readOnlyRootFilesystem, requests/limits, UI SA without token automount, Service 80→8080 via nginx ConfigMap. Default NetworkPolicy for control plane (networkPolicy.enabled); set allowedIngressNamespaces to restrict. Residuals: env-injected secrets; API egress open — follow-ups on the issue. Core images: UI listens on 8080 / API UID 65532.
Breaking: platform.networking.isolated.enabled defaults to false so a default install is API+UI-only (no hostNetwork bridge DaemonSet). Enabling isolated or public opts into host bridges with documented caps — closes #40. See Host bridges. Kind / homelab overlays that need Multus L2 must set isolated.enabled: true (and usually bridge.tolerations: [{operator: Exists}]).
Bridge DaemonSet hardening: dedicated SA without token automount, no hostPID, NET_ADMIN / NET_RAW instead of privileged: true, alpine pinned by digest. Residual: DHCP container still apk add dnsmasq at runtime (#54).
Breaking: ingress.enabled defaults to false (no cleartext HTTP control plane). Enabling Ingress requires ingress.tls or ingress.allowCleartext: true. Gateway profile uses sectionName: websecure; HTTP→HTTPS redirect example at httproute-https-redirect.yaml — closes #41. See Ingress and TLS.
api.security.allowedOrigins → ConfigMap security.allowed_origins (CORS / /ws/* Origin allowlist) — closes #51, residual from core#98 / PR #113. Default [] is correct for same-origin UI proxy; split UI/API must list UI origins. See Allowed origins.
Document CDI importer egress NetworkPolicy in each tenant namespace (created by core EnsureTenantNamespace; not a release-NS chart object) — closes #49, follow-up to core#95. See Images and templates and example private-mirror policy.
Breaking: the virtfoundry chart ships no credential defaults. secrets.rootPassword (min 12 chars) and secrets.jwtSecret (min 32 chars) are required, and the published sentinels virtfoundry / change-me-in-production are refused — install and helm template fail closed instead (#37, core#93)
Platform hook RBAC no longer grants apiGroups: ["*"] / resources: ["*"]. Each hook Job has its own ServiceAccount: -platform-kubevirt (get/patch on kubevirt/kubevirt only), -platform-multus and -platform-cdi (rendered only with platform.multus.install / platform.cdi.install)
Hook RBAC carries helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded, so no platform identity outlives the install/upgrade

Upgrading from 0.7.1 or older leaves the previous wildcard objects behind — Helm never owned them. Remove them once:

kubectl delete clusterrolebinding virtfoundry-platform --ignore-not-found
kubectl delete clusterrole virtfoundry-platform --ignore-not-found
kubectl -n virtfoundry-system delete serviceaccount virtfoundry-platform --ignore-not-found

Added¶

secrets.existingSecret (with secrets.rootPasswordKey / secrets.jwtSecretKey) — bring your own Secret; recommended for Argo CD and other GitOps flows
secrets.autoGenerateJwtSecret — random 48-char JWT secret on first install, preserved across upgrades via lookup
secrets.allowInsecureDefaults — local-development escape hatch that also sets VF_ALLOW_INSECURE_DEFAULTS=1 on the API

Changed¶

helm upgrade without --set secrets.* reuses the credentials already stored in the live Secret, so upgrades no longer reset the root password or invalidate issued tokens
Documented in Configuration — Secrets

[0.7.1] - 2026-09-04¶

Added¶

Chart values — full default values.yaml on the docs site, why --set belongs on the Helm command
platform.storage.defaultClass: auto — select Longhorn when the StorageClass exists
platform.networking.public.autoFromCluster — fill CIDR/gateway/pool from Node InternalIP when you do not --set them
scripts/detect-host-public-net.sh — print a public-net values snippet from kubectl/host

Changed¶

Charts and default appVersion 0.7.1 (core UI hides platform Windows ISO from VM create until the tenant uploads one)

[0.7.0] - 2026-09-02¶

Added¶

Platform prerequisites — install links for KubeVirt, Multus, CDI, Longhorn, MetalLB, CSI snapshotter

Changed¶

Charts and default appVersion 0.7.0
Homepage and quickstart point to prerequisites guide

0.6.0 - 2026-09-01¶

Added¶

virtfoundry-operator Helm chart (0.6.0) with bundled virtfoundry.io/v1alpha1 CRDs
store.driver=kubernetes profile documented as default install path

Changed¶

Breaking (0.x): removed MySQL StatefulSet, worker Deployment, and values-kubernetes.yaml overlay
Default images ghcr.io/virtfoundry/{core,ui,operator}:0.6.0
Install docs list KubeVirt, Multus, CDI prerequisites before Helm commands
VM snapshot UI screenshots and CRD store terminal shot refresh

Removed¶

Legacy MySQL store templates and worker chart resources

0.5.0 - 2026-08-16¶

Pre-1.0 release line. VirtFoundry is not 1.0 yet; v1.0.0–v1.5.0 tags were premature and are not a stability contract.

Changed¶

Chart version / appVersion and default images set to 0.5.0
Docs and install snippets pin --version 0.5.0

Docs¶

Kind laptop guide (no VLAN); public-network underlay without a switch

1.5.0 - 2026-08-11¶

Changed¶

Default container images bumped to 1.5.0 (API, worker, UI)

Added¶

appVersion aligned with core v1.5.0: root delete-tenant, dedicated CPU offerings, Features docs, IFNAMSIZ-safe public bridge default, CI attestation fix

Docs¶

Features guide under docs/guide/features/ (published on GitHub Pages)

1.4.1 - 2026-08-05¶