Release notes

v0.0.4

Summary

This MR closes a large batch of CVEs in the standalone Hive Metastore image and stabilizes the operator’s scaled-condition reporting.

Highlights

• The standaloneMetastore image is now built from Apache Hive source instead of a prebuilt tarball.
• A large batch of HIGH-severity CVEs in the standalone Hive Metastore image has been remediated.

v0.0.3

Summary

This release significantly improves Managed Hive Metastore operability and release process maturity. The module now includes separated webhook/controller components and broader TLS/S3 handling.

Highlights

• Webhook and controller are split into separate components.
• S3 region and TLS-related settings are handled more consistently.
• New smoke scenarios cover positive/negative and TLS-backed paths.
• Release notes/changelog flow is now bilingual and CI-automated.

Fixes

• S3/TLS validation and configuration edge-cases were fixed in operator/webhook logic
• Build and lint stability improved for the module release pipeline

v0.0.2

Features

Add server and client TLS certificate support

TLS certificates are supported for:

• Hive Metastore server TLS;
• client TLS for PostgreSQL connections;
• client TLS for S3 connections.

Two certificate management modes are supported:

• CertManager — issue and renew certificates with cert-manager;
• CustomCertificate — use user-provided Kubernetes Secrets.

Configuration example:

spec:
  tls:
    mode: CertManager
    certManager:
      clusterIssuerName: selfsigned

  externalConnections:
    database:
      type: Postgres
      postgres:
        mode: Secret
        secretName: pg-creds
        tls:
          insecureSkipVerify: false
          mode: CertManager
          certManager:
            issuerName: selfsigned

    objectStore:
      type: S3
      s3:
        endpoint: minio.minio:9000
        bucket: data-lake
        credentials:
          mode: Secret
          secretName: s3-creds
        tls:
          insecureSkipVerify: false
          mode: CustomCertificate
          caCertSecretName: s3-cert

Add init container for truststore and keystore

An init container prepares the truststore and keystore required for Hive Metastore TLS.

Add agent sidecar for certificate status

The agent sidecar validates certificates and writes results into the HiveMetastore status, including:

• certificate TTL;
• certificate validation errors;
• server certificate state;
• client certificate state for external connections.

Status example:

status:
  certificate:
    client:
      Postgres:
        ttl: '3624'
      S3:
        ttl: '3624'
    server:
      ttl: '89'

v0.0.1

First release of the Managed Hive Metastore module. This version provides the baseline for deploying and managing Hive Metastore instances in a DKP cluster.

Features

Standalone Hive Metastore servers

The HiveMetastore CRD deploys independent Hive Metastore servers. When creating a resource, users set compute resources (CPU, memory) and select a metastore class.

Validation via webhooks

Create and update operations on HiveMetastore and HiveMetastoreClass go through admission webhooks. Webhooks check parameter validity: allowed CPU and memory ranges, external connections, and administrator-defined custom rules.

Custom CEL validation rules

Administrators can define arbitrary validation rules for HiveMetastore resources in HiveMetastoreClass using CEL (Common Expression Language). Rules are evaluated by the webhook on every create or update, which enables organization-specific constraints without changing operator code.

Configuration templates via HiveMetastoreClass

The HiveMetastoreClass CRD lets administrators create named templates for metastores. A class defines allowed resource policy (CPU and memory ranges) and custom validation rules.

External connections

Connections to external resources:

Credential management modes

Users can choose how secrets are stored:

• Plain Mode: credentials are set directly in the configuration (suitable for development)
• Secret Mode: credentials are stored in Kubernetes Secrets (recommended for production)

Distroless images

Hive Metastore images are based on a distroless architecture, which improves security by minimizing components in the container.