CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

0.39.0 (2026-08-12)

Features

• mesh: add a mesh provider abstraction and NetBird support (#594) (56824b3)
• workspace: add a configurable file update policy (#593) (83e9dfd)

Bug Fixes

• complete the metrics pipeline (OTel endpoint, ServiceMonitor lifecycle, metrics ingress isolation) (#590) (2b79d1e)
• scope the operator-namespace cache entry to Secrets in namespaced mode (#591) (a74bab1)

0.38.3 (2026-07-28)

Bug Fixes

• use fully-qualified Docker Hub image names to prevent ImageInspectError (#562) (8aabb56)

0.38.2 (2026-07-28)

Bug Fixes

• service: expose the managed metrics port alongside custom Service ports (#583) (6e22165)
• statefulset: hash rendered ConfigMap data so config changes roll the pod (#579) (5082152)

0.38.1 (2026-07-20)

Bug Fixes

• gate PhaseRunning on StatefulSetReady so consumers don't route to a not-ready instance (#572) (2a1820c)

0.38.0 (2026-07-19)

Features

• skills: support declarative skills for additional workspaces (#570) (efb202c)

0.37.0 (2026-07-18)

Features

• probes: opt-in disk-aware readiness guard for PVC-backed workspaces (#557) (fb98a92)

Bug Fixes

• probes: compare disk readiness free space as integer KiB (#569) (3f5dd83)
• skills: converge PVC-seeded skill pack files to the declared revision (#566) (35d2987)
• skills: preserve owner-qualified ClawHub refs for disambiguation (#559) (bb2f3aa)

0.36.5 (2026-06-20)

Bug Fixes

• controller: treat optimistic-lock conflicts as retryable, not failed (#553) (#554) (07a040b)

0.36.4 (2026-06-16)

Bug Fixes

• operatorhub: ship ci.yaml with updateGraph semver-mode (#551) (ab5f444)

0.36.3 (2026-06-16)

Bug Fixes

• bundle: declare com.redhat.openshift.versions for OpenShift cert (#549) (9a66a7f)
• ci: sync OperatorHub fork to avoid workflow-scope push rejection (#547) (4adde0e)

0.36.2 (2026-06-15)

Bug Fixes

• chart: refresh changelog for signed-chart release (0.36.2) (#545) (f99b35a)

0.36.1 (2026-06-08)

Bug Fixes

• keep otel-collector metrics alive (metric_expiration 8760h + directory-mount) (#538) (9e6cbe8)

0.36.0 (2026-06-03)

Features

• add optional Gateway API HTTPRoute support (#535) (e56d4bb)
• tier-1/2 parity (operatorhub digest pin, verify-signing, image CEL, conformance) (#533) (3787dd0)

Bug Fixes

• helm: grant cluster-scoped OpenClawClusterDefaults RBAC under watchNamespaces (#531) (7c176eb)
• idempotent plugin install in init-plugins container (#528) (58280c8)

0.35.0 (2026-06-02)

Features

• api: spec.config.forcePaths for partial-overwrite under mergeMode=merge (#500) (e59951c)

Bug Fixes

• check skip-backup annotation before setting BackingUp phase (#524) (b24b403)
• parsePluginEntry drops npm: prefix, all plugins route through clawhub (#518) (50e75a9)

0.34.8 (2026-06-02)

Bug Fixes

• replace operator logo sunglasses with open eyes (eb61231)

0.34.7 (2026-06-01)

Bug Fixes

• olm: ship all three CRDs in the OperatorHub bundle (842f736)

Refactoring

• complete openclaw-rocks -> paperclipinc migration (60d9f9e)

0.34.6 (2026-05-26)

Bug Fixes

• ci: operatorhub workflow gh repo fork CLI syntax (#515) (6be0b90)

0.34.5 (2026-05-26)

Bug Fixes

• rename openclaw-rocks → paperclipinc across chart, CI, docs, Go module (2de5f6b)

0.34.4 (2026-05-21)

Bug Fixes

• plugins: install via openclaw CLI to handle workspace:* deps (#506) (00d08d9)

0.34.3 (2026-05-20)

Bug Fixes

• environment-skill: document openclaw CLI availability (#499) (5067192)

0.34.2 (2026-05-20)

Bug Fixes

• config: inject gateway.mode=local for openclaw >= v2026.5.18 (#502) (e114ce7)

0.34.1 (2026-05-12)

Bug Fixes

• docs-site: correctly detect new CNAME file in gh-pages step (#490) (deb6b8c)

0.34.0 (2026-05-12)

Features

• docs site at openclaw.rocks/docs/operator/ (#488) (0a6aa43)

0.33.0 (2026-05-12)

Features

• shareProcessNamespace (default true) to reap zombies (#485) (4cbfd4d)

0.32.1 (2026-05-11)

Bug Fixes

• workspace: support nested paths in spec.workspace.initialFiles (#483) (efca189)

0.32.0 (2026-05-10)

Features

• chart: aggregate OpenClaw CRD permissions into admin/edit/view roles (#480) (8d06f81)

0.31.1 (2026-05-08)

Bug Fixes

• plugins: install plugins under ~/.openclaw/extensions for auto-discovery (#477) (de8c1c4)

0.31.0 (2026-05-05)

Features

• chart: allow disabling chart RBAC and scoping operator to namespaces (#469) (46abfa4)

0.30.0 (2026-04-24)

Features

• workspace: add spec.workspace.bootstrap.enabled disable flag (#465) (67bbf71)

Bug Fixes

• statefulset: symlink plugin-runtime-deps/node_modules/openclaw to /app (#464) (c4c5f50)

0.29.0 (2026-04-23)

Features

• cluster-defaults: add OpenClawClusterDefaults singleton CRD (#460) (0e3f6bc)

0.28.1 (2026-04-21)

Bug Fixes

• statefulset: mount ~/.config as writable PVC subPath (#458) (5ab8c08)

0.28.0 (2026-04-17)

Features

• skillpacks: install packs from plain git repos without skillpack.json (#454) (78b92d7)

0.27.1 (2026-04-17)

Bug Fixes

• init: mount full data volume in init-uv/init-pip for hostPath PVCs (#450) (2eaaea9)

0.27.0 (2026-04-14)

Features

• helm: add logLevel value to control operator log verbosity (#445) (4cab3f2)

Bug Fixes

• preserve third-party annotations and labels when reconciling managed resources (#447) (3711bce)

0.26.2 (2026-04-09)

Bug Fixes

• backup: use --skip-links instead of --copy-links in rclone (#430) (fd7b65e)

0.26.1 (2026-04-09)

Bug Fixes

• helm: always pass --metrics-secure flag to operator binary (#440) (b202def)

0.26.0 (2026-04-09)

Features

• exclude workspace from config-hash to skip unnecessary restarts (#432) (586e11f)

Bug Fixes

• remove env token injection in trusted-proxy mode (#434) (6daae12)

0.25.2 (2026-04-06)

Bug Fixes

• remove token injection in trusted-proxy mode (#428) (9486685)

0.25.1 (2026-04-01)

Bug Fixes

• plugins: set NODE_PATH so OpenClaw discovers installed plugins (#425) (c43ee12)

0.25.0 (2026-03-31)

Features

• expose internal scale-to-zero as public spec.suspended API (#420) (3933d97)

0.24.2 (2026-03-30)

Bug Fixes

• remove accidental worktree gitlinks breaking kustomize remote refs (#417) (9a2b5aa)

0.24.1 (2026-03-26)

Bug Fixes

• chromium: suppress container permission warnings (#415) (43741dc)

0.24.0 (2026-03-25)

Features

• add native OTLP metrics export for the operator (#410) (94b2a04)

0.23.2 (2026-03-25)

Bug Fixes

• security: harden pod security contexts and enforce resource limits (#408) (3b328a2)

0.23.1 (2026-03-25)

Bug Fixes

• chromium: override entrypoint to fix unquoted $@ in upstream run.sh (#407) (21b03e5)

0.23.0 (2026-03-24)

Features

• add spec.workspace.configMapRef and additionalWorkspaces for multi-agent support (#395) (8fe107a)

Bug Fixes

• backup: add --copy-links to rclone to include symlinks (#400) (8ffb8e8)
• chromium: use run.sh entrypoint and migrate deprecated image (#397) (e74dffd)
• controller: normalize UpdateStrategy.RollingUpdate to stop continuous reconcile loop (#403) (0df4bcb)
• e2e: stabilize flaky CDP integration screenshot test (#405) (2b441af)
• preserve user-set gateway auth mode in config enrichment (#404) (337eb72)

0.11.0 (2026-03-10)

Features

• add chromium CDP proxy to inject anti-bot Chrome launch args (1e30d22), closes #270
• chromium CDP proxy for anti-bot launch args (e7d9d86)
• resources: add logging and validation for resource quantities (0dc3508)
• validate existing PVC and improve resource parsing (351c87a)

Bug Fixes

• handle merge commits in release tag creation step (370edf6)
• handle merge commits in release tag creation step (07b45bf)
• resolve chromium sidecar startup race and NetworkPolicy gaps (8579946)
• resolve chromium sidecar startup race and NetworkPolicy gaps (8e7fc99), closes #270

0.10.30 (2026-03-10)

Features

• idempotent ClawHub skill installs for persistent storage (b02c5f2)

Bug Fixes

• add activeDeadlineSeconds and startingDeadlineSeconds to backup CronJob (d5a5a0a), closes #286
• add deadline safeguards to backup CronJob (5f3715d)
• add K8s API port 6443 egress when tailscale is enabled (5968cc1)
• inject POD_NAMESPACE env via Downward API (b793c0f)
• inject POD_NAMESPACE env via Downward API in operator deployment (8b5ae53), closes #281

0.10.29 (2026-03-09)

Bug Fixes

• increase chromium startup probe timeout from 2s to 5s (#279) (2ccf3ec), closes #270

0.10.28 (2026-03-09)

Bug Fixes

• auto-inject 127.0.0.0/8 into gateway.trustedProxies (#276) (e7ecc5c), closes #274
• handle OCI pagination in registry tag resolver (#275) (2fcf3dd)

0.10.27 (2026-03-09)

Features

• support persistent Chromium browser profiles via PVC (#271) (9d80414), closes #267

0.10.26 (2026-03-09)

Features

• persist Tailscale state across pod restarts via TS_KUBE_SECRET (#265) (0a9601d), closes #262

Bug Fixes

• remove invalid llmConfig from webhook validation and docs (#261) (e8f7399)
• respect pod-level runAsNonRoot in container security contexts (#266) (ad21b4c), closes #263

0.10.25 (2026-03-07)

Features

• enable writable package installs on read-only root filesystem (#254) (8d5f4ba)

0.10.24 (2026-03-06)

Bug Fixes

• use service DNS for Chromium CDP URL instead of localhost (#252) (70b9ec4)

0.10.23 (2026-03-06)

Bug Fixes

• correct attachOnly field placement in browser configuration (#250) (04d44af)

0.10.22 (2026-03-05)

Features

• inject default anti-bot-detection flags for Chromium sidecar (#247) (4a38b4d)

0.10.21 (2026-03-05)

Bug Fixes

• disable device auth for Control UI in K8s environments (#238) (c5c420c), closes #233
• propagate nodeSelector and tolerations to backup CronJob pods (#245) (98ef456), closes #244
• use localhost for Chromium CDP URL to support IPv6 clusters (#243) (08dc2c2), closes #228

0.10.20 (2026-03-04)

Features

• add attachOnly and disable device auth in browser profiles (#236) (44dd9ce)

0.10.19 (2026-03-04)

Features

• auto-inject gateway.controlUi.allowedOrigins (#234) (#235) (46b5445)

0.10.18 (2026-03-03)

Features

• switch probes from exec to httpGet (#231) (d5b7754)

0.10.17 (2026-03-02)

Bug Fixes

• add configurable timeout for BackingUp phase to prevent stuck instances (#226) (778a642), closes #224
• make skill pack resolution non-blocking to prevent provisioning failures (#227) (ffb2485), closes #225

0.10.16 (2026-03-01)

Bug Fixes

• propagate nodeSelector and tolerations to backup/restore Jobs (#221) (342c7ae)

0.10.15 (2026-02-27)

Features

• GitHub-based skill pack resolution (#218) (077dfa6)

0.10.14 (2026-02-27)

Bug Fixes

• prevent StatefulSet reconciliation loop from server-side defaults (#217) (0617b46)

0.10.13 (2026-02-27)

Bug Fixes

• use Node.js TCP connect for health probes instead of wget (#215) (ecb7474)

0.10.12 (2026-02-26)

Features

• add periodic scheduled backups via CronJob (#207) (bf29965)

Bug Fixes

• add optional S3_REGION support for MinIO backups (#212) (c5e96c8), closes #205
• chromium: pass extraArgs via DEFAULT_LAUNCH_ARGS env instead of container Args (#211) (ec79758), closes #209

0.10.11 (2026-02-26)

Bug Fixes

• store plaintext username and password in auto-generated basic auth secret (#208) (179b4a6), closes #201

0.10.10 (2026-02-26)

Features

• add performance benchmarks for resource builders (#197) (41efb29)

0.10.9 (2026-02-26)

Features

• add Operator SDK scorecard testing (#198) (3b44d9a)
• add topology spread constraints support (#196) (98ba176)

0.10.8 (2026-02-26)

Features

• chromium: add extraArgs and extraEnv fields to ChromiumSpec (#187) (2878482)
• chromium: add extraArgs/extraEnv to ChromiumSpec, fix issues #189-#193 (#194) (cba8d1a)

0.10.7 (2026-02-25)

Bug Fixes

• resolve chromium sidecar port conflict and unreachable CDP (#183) (2d3d212), closes #180

0.10.6 (2026-02-24)

Bug Fixes

• make Probes a pointer type to accept null/omitted values (#181) (df42069), closes #179

0.10.5 (2026-02-24)

Features

• add Tailscale sidecar for working tailnet integration (#177) (d956925)

0.10.4 (2026-02-24)

Features

• add nginx gateway proxy sidecar for loopback-bound gateway (#175) (a52383b)

0.10.3 (2026-02-23)

Bug Fixes

• auto-set gateway.bind=loopback and use exec probes for Tailscale serve/funnel (#170) (e26694b), closes #167
• expose metrics port in Service, StatefulSet, and ServiceMonitor (#169) (049d097), closes #166
• move CRDs from Helm crds/ to templates/ for upgrade support (#173) (599b394), closes #168

0.10.2 (2026-02-23)

Bug Fixes

• break reconciliation tight loop caused by unconditional status writes (#163) (88921b7), closes #161
• use single-quoted node -e argument in merge mode scripts (#164) (a661ed8), closes #162

0.10.1 (2026-02-22)

Features

• add ttyd web terminal managed sidecar (#159) (a9e1bce)

0.10.0 (2026-02-22)

⚠ BREAKING CHANGES

• The backup credentials Secret name changes from b2-backup-credentials to s3-backup-credentials, and the expected keys change from B2_BUCKET/B2_KEY_ID/B2_APP_KEY/B2_ENDPOINT to S3_BUCKET/S3_ACCESS_KEY_ID/S3_SECRET_ACCESS_KEY/S3_ENDPOINT.

Features

• rename B2/Backblaze to generic S3-compatible storage (#157) (df76683)

0.9.23 (2026-02-22)

Features

• add HPA auto-scaling and Auto Pilot capability level (#155) (024e51a)

0.9.22 (2026-02-22)

Features

• add OpenClawSelfConfig CRD for agent self-modification (#146) (2351737)

0.9.21 (2026-02-21)

Bug Fixes

• set CSV capabilities to Deep Insights (Level 4) (#152) (1fe72ed)

0.9.20 (2026-02-21)

Features

• add Level 4 Deep Insights - auto-provisioned PrometheusRule and Grafana dashboards (#149) (3c46765)

0.9.19 (2026-02-21)

Features

• add custom service ports and ingress backend port support (#144) (#145) (d0604c1)

0.9.18 (2026-02-20)

Features

• improve OperatorHub and ArtifactHub listing quality (#142) (b15937c)

0.9.17 (2026-02-20)

Bug Fixes

• configMapRef bypasses gateway auth enrichment (#138) (1322d5e)

0.9.16 (2026-02-20)

Features

• support npm packages in skills field and disable lifecycle scripts (#137) (a9db9d0), closes #131 #91

0.9.15 (2026-02-19)

Bug Fixes

• prevent StatefulSet spec drift on every reconcile (#133) (b6fa7b3)

0.9.14 (2026-02-19)

Bug Fixes

• restore config on container restart via postStart hook (#128) (38ea2c5)

0.9.13 (2026-02-19)

Bug Fixes

• inject browser config for Chromium sidecar (#126) (570344e)
• use copyFileSync instead of renameSync in merge mode init container (#121) (72bd962), closes #120

0.9.12 (2026-02-18)

Features

• add first-class Ollama sidecar support (860225e)
• add native Tailscale integration via CRD fields (#115) (c3a2ae4)

0.9.11 (2026-02-18)

Bug Fixes

• resolve flaky backup/restore tests and autorelease label API (#117) (da7a2a5)

0.9.10 (2026-02-18)

Bug Fixes

• emit provider-aware ingress annotations based on className (#109) (#110) (c040df6)
• graceful deletion when B2 backup credentials are not configured (#112) (10b59be), closes #111
• use shell-capable images for distroless init containers (#108) (2c87e68)

0.9.9 (2026-02-17)

Bug Fixes

• inject gateway.bind=lan so vanilla deployments pass health probes (#102) (7c63d86), closes #101

0.9.8 (2026-02-17)

Bug Fixes

• sync Helm RBAC and add gateway.existingSecret (#98) (33dbc2c)

0.9.7 (2026-02-17)

Bug Fixes

• use server-side apply for CRD installation and update README (#94) (73b0677)

0.9.6 (2026-02-16)

Features

• add runtime dependency init containers for pnpm and Python/uv (#89) (#90) (b6a583c)

0.9.5 (2026-02-16)

Features

• add Phase 2+3 features and CVE-2025-22868 fix (#84) (94d4273)
• add read-only rootfs, config merge mode, skill installation, and secret rotation detection (#82) (abd7911)
• auto-generate gateway token auth for OpenClaw instances (#85) (6ee7eca), closes #83

0.9.4 (2026-02-16)

Bug Fixes

• auto-label release PRs to prevent release-please stalling (#80) (c1bce0a)

0.9.3 (2026-02-16)

Features

• add auto-rollback on failed update with health check monitoring (#75) (1dff347)

0.9.2 (2026-02-16)

Features

• add opt-in auto-update for OCI registry version tracking (#71) (5ce624e)
• add webhook warning for latest image tag (#67) (6791624)

Bug Fixes

• add skip-backup annotation to E2E test instance (#69) (33ab056)
• extract imageTagLatest constant to satisfy goconst linter (#68) (fc14d1a)
• suppress gosec false positive and handle existing releases (aef5468)
• suppress gosec G101 false positive and handle existing releases (182fafb)
• sync release-please manifest to v0.9.1 (#72) (88f50a9)

0.6.0 (2026-02-13)

⚠ BREAKING CHANGES

• CRD API group changed from openclaw.openclaw.io to openclaw.openclaw.rocks. Existing CRDs must be deleted and re-created. This is acceptable at v1alpha1 stability level.

Features

• Add nautical banner image with crab captain at Kubernetes helm (84d1854)
• Add observability, testing, docs, and dev tooling (5af27e1)
• Add observability, testing, docs, and dev tooling for production readiness (a8c063b)
• Add support for custom sidecar containers (#27) (f0071f7), closes #24
• Initial OpenClaw Kubernetes Operator implementation (6d873ff)
• Inject CHROMIUM_URL env var into main container when sidecar is enabled (8553cc7)
• Inject CHROMIUM_URL env var when sidecar is enabled (b80dabe)
• Replace manual release steps with GoReleaser (#2) (fedc497)
• Support custom egress rules in NetworkPolicy (#15) (#16) (c62dc09)
• update banner with real OpenClaw logo and Kubernetes logo (#37) (840adb9)

Bug Fixes

• Add leader election RBAC and E2E test infrastructure (4eb6019)
• Apply same CreateOrUpdate pattern to ServiceMonitor reconciler (#30) (c1aaa36)
• Bump chromium /dev/shm from 256Mi to 1Gi (925d7b8)
• Bump chromium /dev/shm sizeLimit from 256Mi to 1Gi (a4b3fbb)
• change CRD API group domain from openclaw.io to openclaw.rocks (#41) (5bae852)
• Chromium sidecar crash (UID mismatch + read-only rootfs) and lint (#14) (febe1d3)
• Disable SBOM upload-release-assets to avoid race condition (d909808)
• Downgrade to Go 1.23 for golangci-lint compatibility (dd33c08)
• Increase golangci-lint timeout and update to v1.63.4 (1d982ca)
• Link OpenClaw to openclaw.ai, not openclaw.rocks (679b043)
• Link OpenClaw to openclaw.ai, not openclaw.rocks (#22) (9bfdbd8)
• Polish README copy and diagram alignment (#19) (ef6a8d1)
• Pre-enable channel modules in config to prevent EBUSY on startup (#13) (21ee585), closes #11
• Prevent endless Deployment reconciliation loop (#29) (db942b9), closes #28
• Remove chart-releaser, keep OCI-only Helm distribution (#3) (99e3cdb)
• Replace config subPath mount with init container to avoid EBUSY (#10) (38b60d3), closes #9
• Resolve variable shadowing of err in PVC reconciliation (a9ea85b)
• Set HOME env var to match config mount path (#5) (175ff92), closes #4
• skip GitHub release creation in release-please (#47) (96a5be9)
• Specify kind cluster name for image loading (7ac2116)
• update banner alt text (#38) (d00dc23)
• Update Chart.yaml version/appVersion to match latest release v0.2.4 (#26) (c475ffc)
• Update copyright to 2026 Paperclip Inc. (bca1f0f)
• Update copyright to 2026 Paperclip Inc. (4d462f9)
• Update Go version to 1.24 for CI compatibility (5c13d06)
• Use correct GitHub org name (OpenClaw-rocks) in all references (#20) (c157899)
• Use direct append instead of loop for image pull secrets (187477c)
• Use Go 1.24 with goinstall mode for golangci-lint (3dd40c8)
• Use govet enable list for shadow analyzer (3f04b1b)
• Use lowercase image names for OCI registry compatibility (2d3c87e)
• Use lowercase owner name for Helm OCI registry (67bc33e)
• use PAT for release-please to trigger downstream workflows (#45) (21191ed)

0.5.0 (2026-02-13)

⚠ BREAKING CHANGES

• CRD API group changed from openclaw.openclaw.io to openclaw.openclaw.rocks. Existing CRDs must be deleted and re-created. This is acceptable at v1alpha1 stability level.

Features

• Add nautical banner image with crab captain at Kubernetes helm (84d1854)
• Add observability, testing, docs, and dev tooling (5af27e1)
• Add observability, testing, docs, and dev tooling for production readiness (a8c063b)
• Add support for custom sidecar containers (#27) (f0071f7), closes #24
• Initial OpenClaw Kubernetes Operator implementation (6d873ff)
• Inject CHROMIUM_URL env var into main container when sidecar is enabled (8553cc7)
• Inject CHROMIUM_URL env var when sidecar is enabled (b80dabe)
• Replace manual release steps with GoReleaser (#2) (fedc497)
• Support custom egress rules in NetworkPolicy (#15) (#16) (c62dc09)
• update banner with real OpenClaw logo and Kubernetes logo (#37) (840adb9)

Bug Fixes

• Add leader election RBAC and E2E test infrastructure (4eb6019)
• Apply same CreateOrUpdate pattern to ServiceMonitor reconciler (#30) (c1aaa36)
• Bump chromium /dev/shm from 256Mi to 1Gi (925d7b8)
• Bump chromium /dev/shm sizeLimit from 256Mi to 1Gi (a4b3fbb)
• change CRD API group domain from openclaw.io to openclaw.rocks (#41) (5bae852)
• Chromium sidecar crash (UID mismatch + read-only rootfs) and lint (#14) (febe1d3)
• Disable SBOM upload-release-assets to avoid race condition (d909808)
• Downgrade to Go 1.23 for golangci-lint compatibility (dd33c08)
• Increase golangci-lint timeout and update to v1.63.4 (1d982ca)
• Link OpenClaw to openclaw.ai, not openclaw.rocks (679b043)
• Link OpenClaw to openclaw.ai, not openclaw.rocks (#22) (9bfdbd8)
• Polish README copy and diagram alignment (#19) (ef6a8d1)
• Pre-enable channel modules in config to prevent EBUSY on startup (#13) (21ee585), closes #11
• Prevent endless Deployment reconciliation loop (#29) (db942b9), closes #28
• Remove chart-releaser, keep OCI-only Helm distribution (#3) (99e3cdb)
• Replace config subPath mount with init container to avoid EBUSY (#10) (38b60d3), closes #9
• Resolve variable shadowing of err in PVC reconciliation (a9ea85b)
• Set HOME env var to match config mount path (#5) (175ff92), closes #4
• Specify kind cluster name for image loading (7ac2116)
• update banner alt text (#38) (d00dc23)
• Update Chart.yaml version/appVersion to match latest release v0.2.4 (#26) (c475ffc)
• Update copyright to 2026 Paperclip Inc. (bca1f0f)
• Update copyright to 2026 Paperclip Inc. (4d462f9)
• Update Go version to 1.24 for CI compatibility (5c13d06)
• Use correct GitHub org name (OpenClaw-rocks) in all references (#20) (c157899)
• Use direct append instead of loop for image pull secrets (187477c)
• Use Go 1.24 with goinstall mode for golangci-lint (3dd40c8)
• Use govet enable list for shadow analyzer (3f04b1b)
• Use lowercase image names for OCI registry compatibility (2d3c87e)
• Use lowercase owner name for Helm OCI registry (67bc33e)
• use PAT for release-please to trigger downstream workflows (#45) (21191ed)

0.4.0 (2026-02-13)

⚠ BREAKING CHANGES

• CRD API group changed from openclaw.openclaw.io to openclaw.openclaw.rocks. Existing CRDs must be deleted and re-created. This is acceptable at v1alpha1 stability level.

Features

• Add nautical banner image with crab captain at Kubernetes helm (84d1854)
• update banner with real OpenClaw logo and Kubernetes logo (#37) (840adb9)

Bug Fixes

• Apply same CreateOrUpdate pattern to ServiceMonitor reconciler (#30) (c1aaa36)
• change CRD API group domain from openclaw.io to openclaw.rocks (#41) (5bae852)
• Prevent endless Deployment reconciliation loop (#29) (db942b9), closes #28
• update banner alt text (#38) (d00dc23)

[Unreleased]

Added

• Custom Prometheus metrics (reconciliation duration, instance phases, resource failures)
• ServiceMonitor resource creation for Prometheus Operator integration
• Defaulting webhook for setting sensible defaults
• Comprehensive resource builder unit tests
• Webhook validation unit tests
• .golangci.yaml linter configuration
• .dockerignore for optimized Docker builds
• Architecture documentation
• API reference documentation
• Troubleshooting guide
• Deployment guides for EKS, GKE, AKS
• Grafana dashboard example
• PrometheusRule alert examples

[0.1.0] - 2024-01-01

Added

• Initial release of OpenClaw Kubernetes Operator
• OpenClawInstance CRD (v1alpha1)
• Controller with full reconciliation lifecycle
• Security-first design (non-root, dropped capabilities, seccomp, NetworkPolicy)
• Validating webhook (blocks root, warns on insecure config)
• Managed resources: Deployment, Service, ServiceAccount, Role, RoleBinding, NetworkPolicy, PDB, ConfigMap, PVC, Ingress
• Chromium sidecar support for browser automation
• Helm chart for installation
• CI/CD with GitHub Actions (lint, test, security scan, multi-arch build)
• Container image signing with Cosign
• SBOM generation
• E2E test infrastructure