From 7f1f80af1b76433ad73810248a8da0cc6c97e5c8 Mon Sep 17 00:00:00 2001 From: Tom Brow Date: Tue, 6 Oct 2026 10:49:38 -0700 Subject: [PATCH 1/2] release: push gateway chart 0.3.4 Signed-off-by: Tom Brow --- deploy/charts/buzz-push-gateway/CHANGELOG.md | 30 +++++++++++--------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/deploy/charts/buzz-push-gateway/CHANGELOG.md b/deploy/charts/buzz-push-gateway/CHANGELOG.md index 562601276e9..c9f15f78034 100644 --- a/deploy/charts/buzz-push-gateway/CHANGELOG.md +++ b/deploy/charts/buzz-push-gateway/CHANGELOG.md @@ -1,18 +1,20 @@ -# Chart release notes +## 0.3.4 -## 0.3.3 +Adds runtime Pod labels, a service account name, and a configurable termination +grace period of at least 60 seconds. Reserved selector labels cannot be overridden. -`gatewayOrigin` is now only an HTTPRoute routing input. It is optional unless -`httpRoute.enabled=true`, and is no longer passed to the gateway container as -`BUZZ_PUSH_GATEWAY_ORIGIN`. Implemented in -[#7877](https://github.com/block/buzz/pull/7877). +Allows a platform to replace the runtime NetworkPolicy by explicitly naming its +replacement. External policy mode supports PodMonitor without requiring unused +chart-owned monitoring selectors or APNs destinations. The complete-render gate requires exactly one ordinary replacement NetworkPolicy +in the effective release namespace, selecting the runtime Pods and declaring +both ingress and egress policy types. Helm and Argo CD hook policies are rejected. +External-policy callers must supply independent Deployment, policy and namespace +expectations so removed or overwritten markers fail closed. The gate validates +selector expression grammar and expands Kubernetes Lists. Operators must validate +the full parent render including hooks; a Helm 3 post-renderer alone is insufficient. -Adds optional `migration.podAnnotations` for the migration Job's Pod template. -The default is empty. Annotation values must be strings, and migration Pod -annotations are independent of runtime Deployment Pod annotations and Job hook -metadata. +Migration NetworkPolicy remains chart-owned and continues to require database +and DNS destinations. Runtime settings do not change migration Pod identity. +Default runtime rendering is unchanged. -For example, operators can set `migration.podAnnotations.sidecar.istio.io/inject` -to the string `"false"` to opt migration Pods out of Istio sidecar injection. - -Implemented in [#8105](https://github.com/block/buzz/pull/8105). +Implemented in [#8113](https://github.com/block/buzz/pull/8113). From 4f9057581737309345421f27d828f8f18381a418 Mon Sep 17 00:00:00 2001 From: Tom Brow Date: Tue, 6 Oct 2026 10:50:18 -0700 Subject: [PATCH 2/2] docs: retain prior gateway chart release notes Signed-off-by: Tom Brow --- deploy/charts/buzz-push-gateway/CHANGELOG.md | 22 +++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/deploy/charts/buzz-push-gateway/CHANGELOG.md b/deploy/charts/buzz-push-gateway/CHANGELOG.md index c9f15f78034..fb507066ed1 100644 --- a/deploy/charts/buzz-push-gateway/CHANGELOG.md +++ b/deploy/charts/buzz-push-gateway/CHANGELOG.md @@ -1,3 +1,5 @@ +# Chart release notes + ## 0.3.4 Adds runtime Pod labels, a service account name, and a configurable termination @@ -5,7 +7,8 @@ grace period of at least 60 seconds. Reserved selector labels cannot be overridd Allows a platform to replace the runtime NetworkPolicy by explicitly naming its replacement. External policy mode supports PodMonitor without requiring unused -chart-owned monitoring selectors or APNs destinations. The complete-render gate requires exactly one ordinary replacement NetworkPolicy +chart-owned monitoring selectors or APNs destinations. The complete-render gate +requires exactly one ordinary replacement NetworkPolicy in the effective release namespace, selecting the runtime Pods and declaring both ingress and egress policy types. Helm and Argo CD hook policies are rejected. External-policy callers must supply independent Deployment, policy and namespace @@ -18,3 +21,20 @@ and DNS destinations. Runtime settings do not change migration Pod identity. Default runtime rendering is unchanged. Implemented in [#8113](https://github.com/block/buzz/pull/8113). + +## 0.3.3 + +`gatewayOrigin` is now only an HTTPRoute routing input. It is optional unless +`httpRoute.enabled=true`, and is no longer passed to the gateway container as +`BUZZ_PUSH_GATEWAY_ORIGIN`. Implemented in +[#7877](https://github.com/block/buzz/pull/7877). + +Adds optional `migration.podAnnotations` for the migration Job's Pod template. +The default is empty. Annotation values must be strings, and migration Pod +annotations are independent of runtime Deployment Pod annotations and Job hook +metadata. + +For example, operators can set `migration.podAnnotations.sidecar.istio.io/inject` +to the string `"false"` to opt migration Pods out of Istio sidecar injection. + +Implemented in [#8105](https://github.com/block/buzz/pull/8105).