Skip to main content
StreamNative Private Cloud is an enterprise product which brings specific controllers for Kubernetes by providing specific Custom Resource Definitions (CRDs) that extend the basic Kubernetes orchestration capabilities to support the setup and management of StreamNative components. Latest release: v0.20.14, 2026-09-29

​
Operator v0.20.10 to v0.20.14

​
New configuration options

  • Broker disruption budgets: Set spec.apiObjects.pdb.maxUnavailable or spec.apiObjects.pdb.minAvailable on a PulsarBroker to control how many broker pods can be unavailable during voluntary disruptions. If you set both, minAvailable takes precedence. If you set neither, maxUnavailable remains 1.
  • Pod volumes: spec.pod.volumes supports projected, emptyDir, persistentVolumeClaim, downwardAPI, csi, and ephemeral volume sources in addition to configMap and secret.
  • Secret file permissions: Set spec.pod.secretVolumeDefaultMode to control file permissions for Secret volumes generated by the Operator. For example, use 288 for mode 0440 or 256 for mode 0400. When unset, Kubernetes uses its default. This setting leaves user-defined volumes and item-specific modes unchanged.

​
Fixes and security updates

  • Custom init containers can use the full Kubernetes securityContext. The generated init-copy-config container now inherits security settings and resource requests and limits from its workload container.
  • BookKeeper AutoRecovery now uses securityContext and imagePullSecrets from spec.autoRecovery.pod, falling back to spec.pod when either setting is absent. It also runs init containers from spec.autoRecovery.pod.initContainers. If you set spec.autoRecovery.pod.securityContext, AutoRecovery no longer inherits the BookKeeper security context, including readOnlyRootFilesystem. The effective AutoRecovery security context determines whether the Operator adds init-copy-config.
  • The Pulsar Proxy check-broker init container now uses the configured Proxy pod security context.
  • Updated the Go cryptography dependency to address CVE-2026-56855.

​
Upgrade notes

  • Apply the CRDs from the StreamNative Operator chart version 0.20.3 before upgrading to Operator v0.20.14. This chart includes the updated pod and PodDisruptionBudget schemas and the SQLWorkspace CRD. See Upgrade StreamNative Operator.
  • Upgrading to v0.20.14 changes the pod templates of workloads that use a read-only root filesystem, the Proxy check-broker init container, and BookKeeper AutoRecovery. The affected StatefulSets can roll their pods; plan a maintenance window.
  • Apply the CRDs and upgrade the Operator before upgrading the sn-platform or sn-platform-slim chart. Newer chart versions can render fields such as secretVolumeDefaultMode and projected volumes, which older CRDs reject.
  • Review pod security policies before setting secretVolumeDefaultMode. Kubernetes stores Secret files with root ownership. For non-root containers, use a pod fsGroup and a group-readable mode such as 0440. With fsGroup, Kubernetes adds group-read permission to Secret files even if you specify 0400.

​
Operator v0.20.6, 2026-09-07

​
🚀 New features

​
Agent Engine

  • Scheduled agent triggers: Added cron-based AgentTrigger sources backed by Kubernetes CronJobs, with schedule, time zone, and string payload configuration.
  • Shared sessions: Added the SHARED session mode for scheduled triggers. A state store URL is required when cron triggers use this mode.
  • Versioned agent references: Agent triggers can select an agent by required id and optional version.
  • Source validation: Added a validating webhook that prevents changing an AgentTrigger source type after creation.

​
Managed Kafka and Ursa storage

  • Explicit Ursa topic defaults: Added spec.config.ursaStorageTopicDefaultEnabled to explicitly enable or disable ursa.storage.topic.default.enable for managed Kafka.
  • Azure tiered storage settings: Azure Blob bucket names can use accountName@containerName; the Operator derives the Azure SDK account and container settings while preserving the legacy format.
  • Broker removal rebalancing: Enabled Cruise Control autoRebalance in remove-brokers mode by default so partitions are reassigned when managed Kafka brokers are removed.
  • Phased configuration rollout: Added on.rolloutLevel conditions for configuration definitions, based on the cloud.streamnative.io/rollout-level annotation, to roll out defaults in controlled waves.

​
Pulsar, BookKeeper, API keys, and Console

  • Partitioned StatefulSet updates: Broker and BookKeeper StatefulSets now honor spec.pod.updateStrategy.partition, enabling staged pod rollouts.
  • Classic-engine Ursa modes: Added spec.config.ursaModeForClassicEngineCluster.sbt and .sdt, with matching offload and schema-registry configuration behavior.
  • Custom API key claims: Added spec.config.server.allowCustomClaims for non-multi-tenant API key services. It remains disabled by default.
  • Console v2.3.30+ support: Added Console container command, arguments, working directory, custom volume mounts, resource propagation, and runtime layout support required by newer Console images.

​
🔧 Enhancements

  • Excluded the Kafka system namespace from load shedding on supported Pulsar versions.
  • Added Strimzi Cruise Control system topics to the Ursa compaction blacklist.
  • Tuned AvgShedder CPU weighting and minimum unload thresholds to reduce unnecessary unloads while retaining balancing for lower-traffic clusters.
  • Updated Kafka SDT interceptor configuration and disabled default topic storage when SDT is enabled.
  • Enabled KoP schema registry compatibility settings for both classic SBT and SDT Ursa modes.

​
🐛 Bug fixes and security updates

  • Fixed Pulsar Proxy startup with API key authentication by mounting the OIDC public key and revocation-list secrets.
  • Fixed Kafka Connect Confluent converters using an internal schema registry with PLAIN or SCRAM authentication by propagating converter-scoped SASL settings.
  • Fixed Oxia coordinator configuration that could be generated before namespace owner lookup completed; failed lookups now retry instead of producing partial state.
  • Fixed disabled managed-ledger offload configuration being evaluated as null and accidentally enabling classic offload settings.
  • Fixed cron AgentTrigger Jobs with injected Istio sidecars remaining in Running after the trigger completed.
  • Fixed apiObjects.pdb.maxUnavailable and apiObjects.pdb.minAvailable being silently ignored for BookKeeper, ZooKeeper, Pulsar Proxy, Pulsar Functions Worker, and Oxia workloads. PodDisruptionBudget availability overrides are now honored consistently across all supported components; minAvailable takes precedence when both fields are set.
  • Updated the Go/Alpine build image and Go networking and cryptography dependencies for security fixes.

​
🚨 Compatibility notes

  • AgentTrigger.spec.agentRef.name is replaced by the required AgentTrigger.spec.agentRef.id; update existing AgentTrigger manifests before or during the upgrade. Use the optional version field when a specific agent version is required.
  • The AgentTrigger source type is immutable after creation. Recreate the resource to switch between Pulsar, Kafka, and cron sources.
  • allowCustomClaims cannot be enabled when multiTenant.enable is true.
  • Apply the v0.20.6 CRDs and RBAC resources before updating the Operator. Cron AgentTriggers require permission to manage Kubernetes CronJobs.

​
📚 Documentation

  • Refreshed the CRDs and RBAC manifests for AgentTrigger, API keys, Console, Kafka, Pulsar, BookKeeper, ZooKeeper, and PodDisruptionBudget availability configuration.
  • Added Operator configuration references for phased rollout conditions and Pulsar broker settings.