chore(main): release graylog 2.0.0

[github-actions]

🤖 I have created a release beep boop

2.0.0 (2026-08-27)

⚠ BREAKING CHANGES

• graylog: appVersion moves from 7.0 to 7.1.8. graylog.image.tag and datanode.image.tag default to appVersion, so upgrading moves the running Graylog and Data Node images unless you pin both tags (#181) (eee5bd8)
• values: global.imagePullSecrets, graylog.image.imagePullSecrets and datanode.image.imagePullSecrets now take {name: <secret>} objects instead of bare strings. Schema validation rejects the old string form (#93) (cdb719c)
• mongodb: the default replica set is now 3 data-bearing members with no arbiter, replacing 2 members plus 1 arbiter. Upgrading on the defaults adds a member and drops the arbiter, so budget for a third data volume (#127) (47edf85)
• mongodb: the chart now sets MongoDB container resources, which nothing could override before. A pod reserves 300m/1152Mi instead of the operator's 1000m/800M, and upgrading rolls the replica set (#176) (e49b97f)
• pods and containers now run under a restricted security context: runAsNonRoot: true, seccompProfile: RuntimeDefault, allowPrivilegeEscalation: false, and all capabilities dropped except NET_BIND_SERVICE on graylog and the file-ownership set on datanode. A custom image that runs as root or needs other capabilities will not start (#100) (cb9bd63)
• values: removed datanode.persistence.enabled, datanode.persistence.data.existingClaim, datanode.persistence.data.selector, datanode.persistence.data.dataSource, datanode.persistence.nativeLibs.existingClaim, datanode.persistence.nativeLibs.selector, graylog.persistence.mountPath and graylog.persistence.selector. None of them were wired to anything (6571951)
• geo-ip: the MaxMind database update runs as a sidecar on the Graylog pod instead of a CronJob. graylog.config.geolocation.maxmindGeoIp.cronSchedule moves to graylog.config.geolocation.sidecar.schedule, and postInstallRun is gone (#129) (e9c0354)
• ingress: ingress.forwarder splits into two channels, ingress.forwarder.messageChannel and ingress.forwarder.configChannel, each with its own className, annotations, labels, hosts and tls. Existing forwarder ingress values need rewriting, not renaming (#160) (29c1430)
• datanode: the native-libs volume claim template changes name from nativeLibs to native-libs. volumeClaimTemplates is immutable, so Kubernetes rejects the upgrade for anyone running with datanode.persistence.nativeLibs.enabled=true. Delete the StatefulSet with --cascade=orphan first (#75) (5fc7e22)
• graylog: terminationGracePeriodSeconds is now 300, and a preStop hook drains the journal before shutdown. Pod deletion, node drains and rolling upgrades take up to five minutes per pod (#147) (c643cd0)
• PodDisruptionBudgets are on by default for both graylog and datanode. A single-replica deployment blocks node drains until you relax the budget
• helpers: an explicit graylog.config.network.externalUri now wins over the LoadBalancer Service lookup, and a bare hostname gets the scheme and app port appended. Setting both a LoadBalancer service and externalUri changes the advertised http_external_uri (e3c965d)
• the chart renames the init script ConfigMap from the fixed init-script-cm to <release>-graylog-init-cm, so two releases can share a namespace. External references to the old name break (#79) (25653e2)
• the chart writes the generated root password to the backup Secret instead of printing it in NOTES.txt. Anything scraping the install output for the password must read the Secret (33499f2)
• probes: both StatefulSets now get a startupProbe, on by default. It allows 330s before the kubelet restarts the container, so an install that takes longer restarts in a loop until you raise startupProbe.failureThreshold (#169) (b411145)
• probes: removed graylog.livenessProbe.successThreshold and datanode.livenessProbe.successThreshold. The schema does not reject unknown keys, so either one still validates and does nothing (#169) (b411145)

Features

• Bring Your Own Opensearch (#135) (5d531c1)
• Allowing for custom labels and annotations to rendered kubernetes manifests. (#160) (29c1430)
• data-node: Adding sysctlInit datanode init container to set vm.max_map_count (8270c06)
• geo-ip: Setting up side car geoip update, working downloads (#129) (e9c0354)
• Safe Graylog Journal Draining (#147) (c643cd0)
• Updating datanode and graylog health check and startup probes (#169) (b411145)
• Updating to Graylog, and Datanode to 7.1.8 (#181) (eee5bd8)

Bug Fixes

• correct imagePullSecrets schema to use LocalObjectReference format (#93) (cdb719c)
• datanode: use with for each secret field (#77) (8bcd2d3)
• encode GRAYLOG_HTTP_TLS_KEY_PASSWORD (#76) (992c615)
• geo-ip: Updating GeoIP default image and secret handling (#168) (64aed49)
• helpers: Prefer an explicit externalUri over the Service lookup (e3c965d)
• ingress: point defaultBackend at the fallback Service port (91bee91)
• mongodb: let MongoDB container resources be configured (#176) (e49b97f)
• rename native-libs pvc template (#75) (5fc7e22)
• secrets: Accept secret peppers of exactly 64 characters (59f44af)
• secrets: Adding graylog-root-sha2 to automatic password generation (21fcb15)
• secrets: Adding graylog-root-sha2 to automatic password generation (9390114)
• service-accounts: Fixing bug in service account automount (#130) (fdff2a7)
• StatefulSet checksums (#83) (bd8c9a3)
• use release-specific templated names (#79) (25653e2)
• use selectorLabels (#80) (1b7f6ee)
• use toYaml with each nodeSelector (#78) (2fab1bd)
• values: Remove unused persistence configuration values (6571951)

Documentation

• chart: add an upgrade guide and document the commit-driven release (#182) (7400c0d)

---

This PR was generated with Release Please. See documentation.

[alix-graylog]

This is a preview test of a Release Please release artifact.
Releasing this as is would create an incorrect release, as the next published release needs a 2.. tag as to not break semver contracts.

[github-actions]

🤖 Created releases:

• graylog-2.0.0

🌻