Changelog

Notable changes in each release of the Apollo GraphOS Operator

1.4.0

Features

  • Update minimum supported Kubernetes version to 1.33

    The operator now requires Kubernetes 1.33 or later, following the N-3 support policy.

Bug fixes

  • Add a default startup probe to the router container

    Without a startup probe, Kubernetes evaluates the readiness probe immediately on container start. Because it fires on a fixed periodSeconds: 10 schedule, a router that becomes ready at t+11s won't be marked ready until the next tick at t+20s — a 10-second step-function penalty on every deployment.

    The operator now injects a startup probe (/health?live, periodSeconds: 2, failureThreshold: 30) when no user-supplied startup probe is present. This gives the router a 60-second startup window at 2-second resolution, eliminating the step-function effect. Users who supply their own startupProbe in spec.deployment.podTemplate.routerContainer are unaffected.

  • Fix SupergraphSchema controller stalling on hung HTTP connections

    Outgoing HTTP to Apollo Studio is now backed by a shared, configurable transport with connect timeouts, TCP keepalive, HTTP/2 keepalive, and per-request OTel instrumentation. Connections that go silently unresponsive — for example when a NAT or network middlebox drops the mapping mid-flight — are now detected and torn down instead of stalling reconciliation indefinitely.

    As a belt-and-braces guard, each SupergraphSchema reconciliation now also has an explicit wall-clock budget. A reconcile that exceeds it is aborted and requeued — the controller can never be held open indefinitely by a stuck call. The bound is tunable:

    YAML
    1controllers:
2  supergraph_schema:
3    reconcile_timeout: 10m

    One related diagnostic: if a controller stops running for any reason the operator now logs an ERROR and emits an apollo.operator.controller.stopped counter.

    The http: config block remains available to tune the transport (all fields optional); existing deployments need no config changes.

  • Fix RUSTSEC-2026-0190

  • Fix RUSTSEC-2026-0145, RUSTSEC-2026-0112 and RUSTSEC-2026-0113

  • Fix RUSTSEC-2026-0104

  • Fix router pods entering CrashLoopBackOff with ACCESS_DENIED on first deployment

    A newly-provisioned graph API key could take a few seconds to propagate from Apollo Studio to Uplink. The operator now waits for the Secret to be created before starting the router Deployment, preventing the router from starting before its key is valid.

  • Fix OCI schema delivery for Supergraph CRD and make valid_oci_deployment test fully end-to-end

    Fix the MIME type the operator uses when fetching OCI schema artifacts: accept both application/apollo.schema (current canonical type) and the legacy application/vnd.apollographql.schema so artifacts pushed with either type are retrieved correctly

  • Fix Supergraph schema.oci.graphRef being ignored and router credentials not being mounted

    When schema.oci.graphRef is set, the operator now correctly reads the field (previously silently ignored due to a deserialisation bug) and mounts APOLLO_KEY and APOLLO_UPLINK_ENDPOINTS on the router container — matching the behaviour of schema.studio and schema.resource, and allowing the router to start when using --graph-artifact-reference.

  • Fix spec.routerConfig leaf values being silently overridden by operator defaults

    User-provided leaf values in spec.routerConfig (e.g. supergraph.path) were being overwritten by the operator's base configuration due to incorrect merge order. The merge now starts from base config and applies user config on top, so user values take precedence while base defaults still fill in omitted keys.

1.3.0

Breaking changes

  • Supergraph and SupergraphSet CRDs updated to v1alpha4 to achieve parity with the Router Helm chart — existing manifests must be migrated before upgrading

    spec.podTemplate has moved to spec.deployment.podTemplate, and spec.podTemplate.annotations / spec.podTemplate.labels have been promoted to top-level spec.annotations and spec.labels fields that apply to all managed resources. Resource-specific annotations can now be set independently under spec.deployment.annotations (for the Deployment) and spec.networking.annotations (for the Service). SupergraphSet follows the same structure under spec.supergraphTemplate.

    New fields added in this version include:

    • Service & Deployment annotations

    • NodeSelector

    • ImagePullSecrets

    • RollingUpdateParameters: maxUnavailable and maxSurge

    For other resources not managed directly by the Operator, see the migration guide.

Bug fixes

  • Bump dependencies to resolve CVE-2026-32766

  • Bump dependencies to resolve GHSA-pwjx-qhcg-rvj4, GHSA-9f94-5g5w-gf6r and GHSA-394x-vwmw-crm3

  • Bump dependencies to resolve CVE-2026-31812

  • Supergraphs with Argo Rollout strategy now report a clear failure when Argo is not installed

    If you configure a Supergraph with deploymentStrategy: rollout but the Argo Rollouts API is not installed in your cluster, the operator previously created a plain Kubernetes Deployment silently in its place. The Supergraph appeared to be running, but was not using the strategy you specified.

    The operator now sets Progressing: False with reason DeploymentFailed on the Supergraph, making the misconfiguration immediately visible via kubectl describe supergraph. No Deployment is created until the configuration is corrected or Argo Rollouts is installed.

  • Fix credentials expiring when using OCI registries with short-lived tokens (e.g. ECR, GAR)

  • Bump dependencies to resolve RUSTSEC-2026-0097

  • Fix leftover Rollout resource not being removed after migration to Kubernetes Deployment strategy

    After a successful migration, the Argo Rollout resource was not reliably cleaned up, leaving a stale resource in the cluster. It will now be removed once the Deployment has fully rolled out.

  • Fix SupergraphSchema controller becoming unresponsive after extended inactivity with no compositions

1.2.0

Breaking changes

  • Expose full router container configuration via routerContainer spec

    The Supergraph and SupergraphSet CRDs now expose a routerContainer field under spec.podTemplate for fine-grained control over the router container, including lifecycle hooks, liveness/readiness/startup probes, additional ports, and volume mounts. spec.podTemplate.additionalVolumes is also now available for mounting volumes into containers in the router pods. As a result, the Supergraph and SupergraphSet CRDs have been bumped from v1alpha2 to v1alpha3.

    Several fields have moved from spec.podTemplate into the new spec.podTemplate.routerContainer sub-object. Existing Supergraph and SupergraphSet resources using these fields must be updated:

    Old fieldNew field
    spec.podTemplate.envspec.podTemplate.routerContainer.additionalEnv
    spec.podTemplate.envFromspec.podTemplate.routerContainer.additionalEnvFrom
    spec.podTemplate.resourcesspec.podTemplate.routerContainer.resources
    spec.podTemplate.securityContextspec.podTemplate.routerContainer.securityContext

    See our documentation for more details as to exact fields exposed

Features

  • Add installCRDs and rbac.create flags to Helm chart values

    Set these to false when installing a second instance of the operator in the same cluster. installCRDs: false skips CRD creation so Helm does not conflict with the CRDs owned by the first installation, and rbac.create: false skips ClusterRole creation so the existing ClusterRoles are reused with new namespace-scoped RoleBindings.

Bug fixes

  • Bump dependencies to resolve GHSA-65p9-r9h6-22vj, GHSA-vw5v-4f2q-w9xf, and GHSA-hfpc-8r3f-gw53.

  • Improve Argo Rollouts detection and compatibility with namespaced mode

    Argo Rollouts availability detection and the Rollout resource watcher have been updated to work correctly when the operator is running in namespaced mode alongside a namespace-scoped Argo Rollouts install.

1.1.1

Bug fixes

  • Fix 404 errors when Argo Rollouts is not installed