<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
Seems that per ingress annotations were not working, so had to put them
in the ingress configmap. Did tested this manually on staging so it's
confirmed it's working (I was getting 429s instead of 503s) and no
traffic was getting into the registry pod.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
A few changes related to configuring the rate limiting:
* Set `externalTrafficPolicy: Local` to preserve real client IPs
(otherwise we only see the cluster IPs)
* Disable `use-forwarded-headers` (L4 LB doesn't set `X-Forwarded-For`,
prevents spoofing)
* Scale NGINX to 2 replicas in prod (costs nothing, gives us
zero-downtime deploys to prod)
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following is an alternative solution to #833
Goal is to deploy and promote it to prod, then monitor the alerts for a
week to see its effect and reassess. In case it's actual traffic that
we've started blocking we can also up the replicas. I thought it doesn't
make sense to up them now since it would be nice to isolate the result
of this change first.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.208.0 to 3.210.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.210.0</h2>
<h2>3.210.0 (2025-12-03)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli/about] Print python toolchain information in <code>pulumi
about</code></p>
</li>
<li>
<p>[sdk/java] Update java to v1.18</p>
</li>
<li>
<p>[components/nodejs] Local components will use the version from
package.json rather than 0.0.0
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21100">#21100</a></p>
</li>
<li>
<p>[cli/package] Add <code>pulumi package delete</code> command to
delete package versions from the Pulumi Registry
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21069">#21069</a></p>
</li>
<li>
<p>[cli/package] Always print the schema first in <code>package
get-schema</code>, then print any binding errors
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21080">#21080</a></p>
</li>
<li>
<p>[sdk/python] Require <code>grpcio>=1.75.1</code> on Python 3.14
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21113">#21113</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>[sdk/nodejs] Fix ComponentResources transfering input arguments to
output properties automatically
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21094">#21094</a></li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/nodejs] Remove <code>@types/uuid</code> type declarations dev
dependency
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21077">#21077</a></li>
</ul>
<h2>v3.209.0</h2>
<h2>3.209.0 (2025-11-26)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Add native support for OIDC token exchange when logging into
Pulumi Cloud. Run <code>pulumi login --help</code> for more information.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20974">#20974</a></p>
</li>
<li>
<p>[sdk/python] Allow older grpcio and protobuf dependencies
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21007">#21007</a></p>
</li>
<li>
<p>[sdkgen/{dotnet,go,nodejs,python}] Generate .gitignore and
.gitattributes files for generated SDKs
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21034">#21034</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>3.209.0 (2025-11-26)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Add native support for OIDC token exchange when logging into
Pulumi Cloud. Run <code>pulumi login --help</code> for more information.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20974">#20974</a></p>
</li>
<li>
<p>[sdk/python] Allow older grpcio and protobuf dependencies
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21007">#21007</a></p>
</li>
<li>
<p>[sdkgen/{dotnet,go,nodejs,python}] Generate .gitignore and
.gitattributes files for generated SDKs
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21034">#21034</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/install] Correctly install non-standard plugins. See <a
href="https://redirect.github.com/pulumi/pulumi/issues/20953">pulumi/pulumi#20953</a>
for more information
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20983">#20983</a></p>
</li>
<li>
<p>[cli/new] Create pyproject.toml for uv and poetry projects when using
--generate-only
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20979">#20979</a></p>
</li>
<li>
<p>[sdk/nodejs] Fix serialization errors due to SxS copies of the SDK
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21029">#21029</a></p>
</li>
<li>
<p>[sdk/python] Add <code>PropertyValue</code> runtime validation checks
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21058">#21058</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>
<p>[engine] Don't send root directory and runtime options to language
plugins as command line arguments
<a
href="https://redirect.github.com/pulumi/pulumi/pull/21054">#21054</a></p>
</li>
<li>
<p>[sdk/{dotnet,java,yaml}] Bump language runtimes for yaml, dotnet and
java</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="43bb5ff53c"><code>43bb5ff</code></a>
Print python toolchain information in <code>pulumi about</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21122">#21122</a>)</li>
<li><a
href="bbe721d42f"><code>bbe721d</code></a>
Update java to v1.18.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21121">#21121</a>)</li>
<li><a
href="f770d66d60"><code>f770d66</code></a>
journaler: unlock the lock if the journaler is already closed (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21117">#21117</a>)</li>
<li><a
href="9217663c03"><code>9217663</code></a>
Add pulumi package delete command (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21069">#21069</a>)</li>
<li><a
href="749c6722ba"><code>749c672</code></a>
fix: use independent <code>http.Client</code> in pair with
<code>http.Server</code> (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20942">#20942</a>)</li>
<li><a
href="43bd0a8687"><code>43bd0a8</code></a>
enable journaling in testing (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20990">#20990</a>)</li>
<li><a
href="c0c4dfe970"><code>c0c4dfe</code></a>
Replace deprecated is-finite dependency in test (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21108">#21108</a>)</li>
<li><a
href="220cccd368"><code>220cccd</code></a>
Require <code>grpcio>=1.75.1</code> on Python 3.14 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21113">#21113</a>)</li>
<li><a
href="d6277b37b3"><code>d6277b3</code></a>
[journal] Add comments, support multiple Close() (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21112">#21112</a>)</li>
<li><a
href="df6ef98165"><code>df6ef98</code></a>
Remove construct_component_configure_provider binary (<a
href="https://redirect.github.com/pulumi/pulumi/issues/21110">#21110</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.208.0...v3.210.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Prepared by Claude Code, reviewd by me.
## Summary
- Upgrade Go from 1.24.9 to 1.24.11 in the main `go.mod` to fix
govulncheck CI failure
- Upgrade Go from 1.24.7 to 1.24.11 in `deploy/go.mod` for the same
vulnerability fix
## Details
This PR addresses the failing `govulncheck` check in CI caused by
vulnerability **GO-2025-4155**:
- **Vulnerability**: Excessive resource consumption when printing error
string for host certificate validation in `crypto/x509`
- **Found in**: `crypto/x509@go1.24.9` (and earlier versions like
go1.24.7)
- **Fixed in**: `crypto/x509@go1.24.11`
- **More info**: https://pkg.go.dev/vuln/GO-2025-4155
Both Go module files in the repository are updated to 1.24.11 to ensure
consistent vulnerability remediation.
## Test plan
- [x] CI passes govulncheck after the Go version upgrade
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
Bumps the go_modules group with 1 update in the /deploy directory:
[golang.org/x/crypto](https://github.com/golang/crypto).
Updates `golang.org/x/crypto` from 0.41.0 to 0.45.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4e0068c009"><code>4e0068c</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="e79546e28b"><code>e79546e</code></a>
ssh: curb GSSAPI DoS risk by limiting number of specified OIDs</li>
<li><a
href="f91f7a7c31"><code>f91f7a7</code></a>
ssh/agent: prevent panic on malformed constraint</li>
<li><a
href="2df4153a03"><code>2df4153</code></a>
acme/autocert: let automatic renewal work with short lifetime certs</li>
<li><a
href="bcf6a849ef"><code>bcf6a84</code></a>
acme: pass context to request</li>
<li><a
href="b4f2b62076"><code>b4f2b62</code></a>
ssh: fix error message on unsupported cipher</li>
<li><a
href="79ec3a51fc"><code>79ec3a5</code></a>
ssh: allow to bind to a hostname in remote forwarding</li>
<li><a
href="122a78f140"><code>122a78f</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="c0531f9c34"><code>c0531f9</code></a>
all: eliminate vet diagnostics</li>
<li><a
href="0997000b45"><code>0997000</code></a>
all: fix some comments</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/crypto/compare/v0.41.0...v0.45.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/modelcontextprotocol/registry/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR promotes prod to 1.3.10
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.206.0 to 3.207.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.207.0</h2>
<h2>3.207.0 (2025-11-12)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Log gRPC requests before invoking them in gRPC debug
interceptor
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20817">#20817</a></p>
</li>
<li>
<p>[engine] Add <code>ReplaceWith</code> resource option to allow one
resource's replace operations to trigger another's
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20693">#20693</a></p>
</li>
<li>
<p>[sdkgen/python] Allow all PEP440 version specifiers to be used</p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/import] Return errors when an import fails
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20904">#20904</a></p>
</li>
<li>
<p>[engine] Fix parenting of resources in some cases in <code>refresh
--run-program</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20894">#20894</a></p>
</li>
<li>
<p>[engine] Fix StackReference secrets performance
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20908">#20908</a></p>
</li>
<li>
<p>[programgen] Do not panic when re-writing type-invalid PCL
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20770">#20770</a></p>
</li>
<li>
<p>[sdk/go] Fix import path in instructions when linking a package in Go
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20888">#20888</a></p>
</li>
<li>
<p>[sdk/nodejs] Fix closure serialization on Node.js v25.2.0
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20913">#20913</a></p>
</li>
<li>
<p>[sdk/{nodejs,python}] Avoid cancellations due to do slow processing
of requests</p>
</li>
<li>
<p>[sdk/python] Avoid cancellations due to do slow processing of
requests in the callbacks server
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20917">#20917</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[engine] Stop sending ConfigPropertyMap as part of RunRequest
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20887">#20887</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.207.0 (2025-11-12)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Log gRPC requests before invoking them in gRPC debug
interceptor
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20817">#20817</a></p>
</li>
<li>
<p>[engine] Add <code>ReplaceWith</code> resource option to allow one
resource's replace operations to trigger another's
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20693">#20693</a></p>
</li>
<li>
<p>[sdkgen/python] Allow all PEP440 version specifiers to be used</p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[cli/import] Return errors when an import fails
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20904">#20904</a></p>
</li>
<li>
<p>[engine] Fix parenting of resources in some cases in <code>refresh
--run-program</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20894">#20894</a></p>
</li>
<li>
<p>[engine] Fix StackReference secrets performance
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20908">#20908</a></p>
</li>
<li>
<p>[programgen] Do not panic when re-writing type-invalid PCL
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20770">#20770</a></p>
</li>
<li>
<p>[sdk/go] Fix import path in instructions when linking a package in Go
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20888">#20888</a></p>
</li>
<li>
<p>[sdk/nodejs] Fix closure serialization on Node.js v25.2.0
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20913">#20913</a></p>
</li>
<li>
<p>[sdk/{nodejs,python}] Avoid cancellations due to do slow processing
of requests</p>
</li>
<li>
<p>[sdk/python] Avoid cancellations due to do slow processing of
requests in the callbacks server
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20917">#20917</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[engine] Stop sending ConfigPropertyMap as part of RunRequest
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20887">#20887</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="5e3a50056a"><code>5e3a500</code></a>
upgrade language providers to latest versions (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20918">#20918</a>)</li>
<li><a
href="ff9df44da3"><code>ff9df44</code></a>
Avoid cancellations due to do slow processing of requests (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20920">#20920</a>)</li>
<li><a
href="a332525939"><code>a332525</code></a>
schema: allow any pep440 constraint for specifying pulumi version in
python (...</li>
<li><a
href="ff1b5f6ddb"><code>ff1b5f6</code></a>
Disambiguate registry and non-registry templates in <code>pulumi
new</code> select (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20701">#20701</a>)</li>
<li><a
href="5137a3fc9f"><code>5137a3f</code></a>
import: actually return errors if we have them (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20904">#20904</a>)</li>
<li><a
href="b4002be0fe"><code>b4002be</code></a>
Avoid cancellations due to do slow processing of requests in the
callbacks se...</li>
<li><a
href="9c779ed24f"><code>9c779ed</code></a>
Fix StackReference secrets performance (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20908">#20908</a>)</li>
<li><a
href="4fedb1c1de"><code>4fedb1c</code></a>
Fix closure serialization on Node.js v25.2.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20913">#20913</a>)</li>
<li><a
href="32235a17d2"><code>32235a1</code></a>
Add <code>ReplaceWith</code> resource option (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20693">#20693</a>)</li>
<li><a
href="4201af6122"><code>4201af6</code></a>
Log deleteProvider calls (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20906">#20906</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.206.0...v3.207.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes)
from 4.23.0 to 4.24.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi-kubernetes/releases">github.com/pulumi/pulumi-kubernetes/sdk/v4's
releases</a>.</em></p>
<blockquote>
<h2>v4.24.0</h2>
<h3>Added</h3>
<ul>
<li>Added a <code>plainHttp</code> option to the <code>v4.Chart</code>
resource. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3250">pulumi/pulumi-kubernetes#3250</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>The <code>pulumi.com/waitFor</code> annotation now uses an
<a
href="https://www.rfc-editor.org/rfc/rfc9535.html">RFC9535</a>-compliant
JSONPath
parser. This makes it possible to wait for more complex scenarios.</p>
<p>For example:</p>
<ul>
<li>
<p>To wait for a Pod's <code>status.phase</code> to be
"Running" or "Succeeded":</p>
<p><code>pulumi.com/waitFor: "jsonpath={.status[?@ == 'Running' ||
@ == 'Succeeded' ]}"</code></p>
</li>
<li>
<p>To wait for for an object to have a "Failed" <em>or</em>
"Complete" condition with
a "True" value:</p>
<p><code>pulumi.com/waitFor:
"jsonpath={.conditions[?(@.type=='Failed'||@.type=='Complete')].status}=True</code></p>
</li>
</ul>
<p>(Tools like <a href="https://jsonpath.com">jsonpath.com</a> are very
helpful for
ensuring your JSONPath expression works as expected.)</p>
<p>Importantly, please note that <code>kubectl wait
--for=jsonpath=...</code> supports only
a <em>subset</em> of RFC9535. This means some complex
<code>waitFor</code> annotations will not
be reproducible with <code>kubectl</code>.</p>
<p>Existing expressions should continue to work normally with one
notable
exception: a selector like <code>.items[]</code> now requires an
explicit wildcard, i.e.
<code>.items[*]</code>.</p>
<p>As a reminder, the <code>pulumi.com/waitFor</code> annotation is
experimental and
subject to change. Similarly, RFC9535 is still only <em>proposed</em>
and may also
change in the future.</p>
</li>
<li>
<p><code>enableConfigMapMutable</code> and
<code>enableSecretMutable</code> are now stable.
(<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/3886">pulumi/pulumi-kubernetes#3886</a>)</p>
</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>
<p>Helm resources all now use the correct
<code>registry/config.json</code> file for
credentials. For backward-compatibility <code>registry.json</code> is
preferred if
it exists. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3606">pulumi/pulumi-kubernetes#3606</a>)</p>
</li>
<li>
<p>Fixed an issue where deletions could take longer than necessary. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3317">pulumi/pulumi-kubernetes#3317</a>)</p>
</li>
<li>
<p>Significantly reduced memory usage. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3713">pulumi/pulumi-kubernetes#3713</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi-kubernetes/blob/master/CHANGELOG.md">github.com/pulumi/pulumi-kubernetes/sdk/v4's
changelog</a>.</em></p>
<blockquote>
<!-- raw HTML omitted -->
<h1>CHANGELOG</h1>
<h2>Unreleased</h2>
<h3>Added</h3>
<ul>
<li>Added a <code>plainHttp</code> option to the <code>v4.Chart</code>
resource. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3250">pulumi/pulumi-kubernetes#3250</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>
<p>The <code>pulumi.com/waitFor</code> annotation now uses an
<a
href="https://www.rfc-editor.org/rfc/rfc9535.html">RFC9535</a>-compliant
JSONPath
parser. This makes it possible to wait for more complex scenarios.</p>
<p>For example:</p>
<ul>
<li>
<p>To wait for a Pod's <code>status.phase</code> to be
"Running" or "Succeeded":</p>
<p><code>pulumi.com/waitFor: "jsonpath={.status[?@ == 'Running' ||
@ == 'Succeeded' ]}"</code></p>
</li>
<li>
<p>To wait for for an object to have a "Failed" <em>or</em>
"Complete" condition with
a "True" value:</p>
<p><code>pulumi.com/waitFor:
"jsonpath={.conditions[?(@.type=='Failed'||@.type=='Complete')].status}=True</code></p>
</li>
</ul>
<p>(Tools like <a href="https://jsonpath.com">jsonpath.com</a> are very
helpful for
ensuring your JSONPath expression works as expected.)</p>
<p>Importantly, please note that <code>kubectl wait
--for=jsonpath=...</code> supports only
a <em>subset</em> of RFC9535. This means some complex
<code>waitFor</code> annotations will not
be reproducible with <code>kubectl</code>.</p>
<p>Existing expressions should continue to work normally with one
notable
exception: a selector like <code>.items[]</code> now requires an
explicit wildcard, i.e.
<code>.items[*]</code>.</p>
<p>As a reminder, the <code>pulumi.com/waitFor</code> annotation is
experimental and
subject to change. Similarly, RFC9535 is still only <em>proposed</em>
and may also
change in the future.</p>
</li>
<li>
<p><code>enableConfigMapMutable</code> and
<code>enableSecretMutable</code> are now stable.
(<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/pull/3886">pulumi/pulumi-kubernetes#3886</a>)</p>
</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Helm resources all now use the correct
<code>registry/config.json</code> file for
credentials. For backward-compatibility <code>registry.json</code> is
preferred if
it exists. (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3606">pulumi/pulumi-kubernetes#3606</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="d439b2074c"><code>d439b20</code></a>
Update TestHelmRelease's metrics image and update test assertion (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3930">#3930</a>)</li>
<li><a
href="ffd70d544c"><code>ffd70d5</code></a>
Mark SecretPatch inputs as secrets (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3893">#3893</a>)</li>
<li><a
href="65219f0e61"><code>65219f0</code></a>
Update dependency <code>@pulumi/pulumi</code> to v3.206.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3925">#3925</a>)</li>
<li><a
href="f1a455ad5f"><code>f1a455a</code></a>
Fix dotnet flakes (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3924">#3924</a>)</li>
<li><a
href="12a40978d9"><code>12a4097</code></a>
Update dependency <code>@pulumi/gcp</code> to v9.4.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3910">#3910</a>)</li>
<li><a
href="cafe468258"><code>cafe468</code></a>
Remove the 'BETA FEATURE' status in front of
<code>enableConfigMapMutable</code> and `en...</li>
<li><a
href="967bd478ab"><code>967bd47</code></a>
Update a redis image (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3917">#3917</a>)</li>
<li><a
href="f52a5b29fd"><code>f52a5b2</code></a>
Automated upgrade: bump pulumi/pulumi to 3.205.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3912">#3912</a>)</li>
<li><a
href="402da8a915"><code>402da8a</code></a>
Update dependency <code>@pulumi/pulumi</code> to v3.205.0 (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3909">#3909</a>)</li>
<li><a
href="a2bb6d7a53"><code>a2bb6d7</code></a>
Fix test cluster p-k version (<a
href="https://redirect.github.com/pulumi/pulumi-kubernetes/issues/3902">#3902</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi-kubernetes/compare/v4.23.0...v4.24.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.205.0 to 3.206.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.206.0</h2>
<h2>3.206.0 (2025-11-05)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[protobuf] Pass a <code>preview</code> flag to invokes so they can
tell if they're being called during a preview
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20827">#20827</a></p>
</li>
<li>
<p>[cli/about] Include PULUMI_* environment variables in the
<code>pulumi about</code> output
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20855">#20855</a></p>
</li>
<li>
<p>[auto/go] Get event log over gRPC instead of trying to read it from a
text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20822">#20822</a></p>
</li>
<li>
<p>[auto/nodejs] Get event log over gRPC instead of trying to read it
from a text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20824">#20824</a></p>
</li>
<li>
<p>[auto/python] Get event log over gRPC instead of trying to read it
from a text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20833">#20833</a></p>
</li>
<li>
<p>[cli/engine] Add environment variable to add --refresh to
preview,update,destroy
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20797">#20797</a></p>
</li>
<li>
<p>[sdk/nodejs] Add PULUMI_NODEJS_SKIP_COMPONENT_INPUTS environment
variable to skip the new feature of sending component inputs to the
engine for diffing and state storage
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20842">#20842</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Fix duplicate resource snapshot integrity issue, when
running <code>pulumi up --refresh --run-program</code> and when a
resource <code>PendingReplacement</code> exists in the snapshot
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20812">#20812</a></p>
</li>
<li>
<p>[engine] Support floating point NaN and Inf values in resource state
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20843">#20843</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/go] Use Language.Link to link Go packages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20811">#20811</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.206.0 (2025-11-05)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[protobuf] Pass a <code>preview</code> flag to invokes so they can
tell if they're being called during a preview
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20827">#20827</a></p>
</li>
<li>
<p>[cli/about] Include PULUMI_* environment variables in the
<code>pulumi about</code> output
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20855">#20855</a></p>
</li>
<li>
<p>[auto/go] Get event log over gRPC instead of trying to read it from a
text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20822">#20822</a></p>
</li>
<li>
<p>[auto/nodejs] Get event log over gRPC instead of trying to read it
from a text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20824">#20824</a></p>
</li>
<li>
<p>[auto/python] Get event log over gRPC instead of trying to read it
from a text file
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20833">#20833</a></p>
</li>
<li>
<p>[cli/engine] Add environment variable to add --refresh to
preview,update,destroy
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20797">#20797</a></p>
</li>
<li>
<p>[sdk/nodejs] Add PULUMI_NODEJS_SKIP_COMPONENT_INPUTS environment
variable to skip the new feature of sending component inputs to the
engine for diffing and state storage
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20842">#20842</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Fix duplicate resource snapshot integrity issue, when
running <code>pulumi up --refresh --run-program</code> and when a
resource <code>PendingReplacement</code> exists in the snapshot
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20812">#20812</a></p>
</li>
<li>
<p>[engine] Support floating point NaN and Inf values in resource state
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20843">#20843</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/go] Use Language.Link to link Go packages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20811">#20811</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="72334612d3"><code>7233461</code></a>
revert "temporarily disable journal validation" (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20875">#20875</a>)</li>
<li><a
href="fad720c136"><code>fad720c</code></a>
Bump SDKs for v3.206.0 (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20881">#20881</a>)</li>
<li><a
href="df81881bab"><code>df81881</code></a>
use event log in python (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20833">#20833</a>)</li>
<li><a
href="93d1e02d55"><code>93d1e02</code></a>
mark tests using dep_tracker as asyncio (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20876">#20876</a>)</li>
<li><a
href="8651da14aa"><code>8651da1</code></a>
refreshv2: only rebuild base state if we have a refresh (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20861">#20861</a>)</li>
<li><a
href="79a8a7d151"><code>79a8a7d</code></a>
fix operator precedence for persisted refreshes in journal (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20807">#20807</a>)</li>
<li><a
href="5ff9d4cc1b"><code>5ff9d4c</code></a>
skip another flaky tail test (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20872">#20872</a>)</li>
<li><a
href="b71a38546d"><code>b71a385</code></a>
return a new state from a refresh step when resource is pending
replacement (...</li>
<li><a
href="e7dda0378e"><code>e7dda03</code></a>
feat: adding PULUMI_OPTION_REFRESH environment variable (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20797">#20797</a>)</li>
<li><a
href="4cba7a03a7"><code>4cba7a0</code></a>
Use Language.Link to link Go packages (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20811">#20811</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.205.0...v3.206.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
This needs to be merged after we merge
https://github.com/modelcontextprotocol/registry/pull/726 and we cut a
release for v1.3.7
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps
[github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from
3.175.0 to 3.204.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/releases">github.com/pulumi/pulumi/sdk/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.204.0</h2>
<h2>3.204.0 (2025-10-23)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Print replace diffs when a resource tries to replace but is
blocked by still having an import id set
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20762">#20762</a></p>
</li>
<li>
<p>[engine] Support overriding policy severity on violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20767">#20767</a></p>
</li>
<li>
<p>[backend/service] Send journal entries to the backend if it's
supported
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20343">#20343</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Fix a potential snapshot integrity error when a resources
dependency fails to be destroyed using <code>destroy
--run-program</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20692">#20692</a></p>
</li>
<li>
<p>[engine] Fix import error to contain the import ID of non-existent
resources
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20753">#20753</a></p>
</li>
<li>
<p>[sdk/nodejs] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20774">#20774</a></p>
</li>
<li>
<p>[sdk/python] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20769">#20769</a></p>
</li>
<li>
<p>[sdkgen/go] Fix codegen of scalar return SDK functions
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20754">#20754</a></p>
</li>
<li>
<p>[sdkgen/{nodejs,python}] Fix scalar return protocol to allow
returning secret maps
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20747">#20747</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/nodejs] Use Language.Link to link Node.js packages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20715">#20715</a></li>
</ul>
<h2>v3.203.0</h2>
<h2>3.203.0 (2025-10-15)</h2>
<h3>Features</h3>
<ul>
<li>[cli/display] Display policy severity for violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20746">#20746</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md">github.com/pulumi/pulumi/sdk/v3's
changelog</a>.</em></p>
<blockquote>
<h2>3.204.0 (2025-10-23)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli] Print replace diffs when a resource tries to replace but is
blocked by still having an import id set
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20762">#20762</a></p>
</li>
<li>
<p>[engine] Support overriding policy severity on violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20767">#20767</a></p>
</li>
<li>
<p>[backend/service] Send journal entries to the backend if it's
supported
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20343">#20343</a></p>
</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>
<p>[engine] Fix a potential snapshot integrity error when a resources
dependency fails to be destroyed using <code>destroy
--run-program</code>
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20692">#20692</a></p>
</li>
<li>
<p>[engine] Fix import error to contain the import ID of non-existent
resources
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20753">#20753</a></p>
</li>
<li>
<p>[sdk/nodejs] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20774">#20774</a></p>
</li>
<li>
<p>[sdk/python] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20769">#20769</a></p>
</li>
<li>
<p>[sdkgen/go] Fix codegen of scalar return SDK functions
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20754">#20754</a></p>
</li>
<li>
<p>[sdkgen/{nodejs,python}] Fix scalar return protocol to allow
returning secret maps
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20747">#20747</a></p>
</li>
</ul>
<h3>Miscellaneous</h3>
<ul>
<li>[sdk/nodejs] Use Language.Link to link Node.js packages
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20715">#20715</a></li>
</ul>
<h2>3.203.0 (2025-10-15)</h2>
<h3>Features</h3>
<ul>
<li>
<p>[cli/display] Display policy severity for violations
<a
href="https://redirect.github.com/pulumi/pulumi/pull/20746">#20746</a></p>
</li>
<li>
<p>[cli/package] Show functions in <code>package info</code></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="24654399ab"><code>2465439</code></a>
Bump dotnet language plugin to latest version (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20778">#20778</a>)</li>
<li><a
href="3882b627ba"><code>3882b62</code></a>
implement journaling API and send journal entries to the service
directly (<a
href="https://redirect.github.com/pulumi/pulumi/issues/2">#2</a>...</li>
<li><a
href="ef3c2a316b"><code>ef3c2a3</code></a>
[Node.js] Pass secret values as Output objects to resource hooks (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20774">#20774</a>)</li>
<li><a
href="86503934b9"><code>8650393</code></a>
Support overriding policy severity on violations (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20767">#20767</a>)</li>
<li><a
href="be6db2b82a"><code>be6db2b</code></a>
Run analyzer lifecycle tests through gRPC (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20766">#20766</a>)</li>
<li><a
href="fd8c0a88b5"><code>fd8c0a8</code></a>
Pass secret values as Outputs to hooks (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20769">#20769</a>)</li>
<li><a
href="d292447a49"><code>d292447</code></a>
Add some tests for Python type inspection utilities (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20736">#20736</a>)</li>
<li><a
href="ba809f361c"><code>ba809f3</code></a>
Add a <code>--version</code> flag to <code>pulumi-language-nodejs</code>
(<a
href="https://redirect.github.com/pulumi/pulumi/issues/20768">#20768</a>)</li>
<li><a
href="89ea89b4da"><code>89ea89b</code></a>
update journaling docs (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20763">#20763</a>)</li>
<li><a
href="22797a9b84"><code>22797a9</code></a>
Share CurrentProjectContradictsWorkspace between backends (<a
href="https://redirect.github.com/pulumi/pulumi/issues/20759">#20759</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pulumi/pulumi/compare/v3.175.0...v3.204.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
There was feedback that other projects wanting to use the registry
package have to upgrade to 1.25 (because of how Go works). In the
registry itself we are not relying on 1.25 features so this PR reverts
us back to 1.24 until 1.25 becomes better adopted and we can safely move
to it.
Also realised we were not keeping our dependencies for our deploy/infra
code up to date with Dependabot so this fixes that too.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Telemetry to cover failure modes which are not covered by container logs
and metrics for finding resource constraints.
## Motivation and Context
When there is any issue with registry container we should be notified.
## How Has This Been Tested?
- Local seup
## Breaking Changes
- No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [X] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
- No additional exporter is used, taken advantage of opentelemetry
collector
- It covers metrics related to resource constraints, currently only
limited to default namespace.
- Takes cares of kubernetes events as logs which are the source of
figuring out any problem with service, covers all such scenarios where
pod is not able to start yet and get missed because there are no
container logs for such cases. Limited to default namespace.
- Taken care of daemonset deployment i.e. deploying otel collector as
agent by using correct filtering.
- Cardinality contributing factors are only pod ids (but have to observe
more), node ids will not increase cardinality as scale up will lead to
limited nodes.
- Shipping of metrics for resources happens every 60s and list of
metrics that will be emitted
[https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/receiver/kubeletstatsreceiver/metadata.yaml](url)
- Container errors
<img width="1440" height="816" alt="Screenshot 2025-10-10 at 1 21 14 AM"
src="https://github.com/user-attachments/assets/ba90a217-2a49-4522-aa44-a98c02adf95b"
/>
- Resource metrics
<img width="1440" height="816" alt="Screenshot 2025-10-10 at 1 23 51 AM"
src="https://github.com/user-attachments/assets/3467be96-db3c-4930-afa2-3cbf5f0ced8b"
/>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
Promotes prod to 1.3.3, the main changes are making mcpb package version
optional and also fixing the enforced schema validation.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
Bumps prod to 1.3.2
Note
https://github.com/modelcontextprotocol/registry/actions/runs/18570490434
needs to complete before merging
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR fixes the docs and the image reference for prod since
they don't expect to have the v prefix there.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR bumps prod to v1.3.0
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR splits the workflows for deploying to prod and staging
easing the use of gitops flows for promotions.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR moves away from automatically promoting latest releases
to production in favour of specifying the released version explicitly
via a PR & Review process.
Still sets the image tag to latest for now so we can enable it
separately whenever we decide 👍
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
## Summary
- Applied `gofmt -s -w` across the entire codebase to ensure consistent
Go formatting
- This will trigger a deployment with minimal code changes
## Test plan
- [x] Pre-commit hooks pass
- [x] No functional changes, formatting only
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
- Add workflow_dispatch to deploy.yml for manual deployment triggers
- Document that releases don't auto-deploy to production
- Add instructions for deploying releases to production
- Add verification steps for deployment
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR updates production to automatically receive new stable
releases when GitHub releases are cut while staging will continue
testing the latest main branch builds
Deails:
- Configures production deployment to **use latest stable** releases
instead of main branch
-`ghcr.io/modelcontextprotocol/registry:latest`(stable releases).
Released CLI matches version of the prod service API.
- Staging continues to **use main branch** for testing latest
development code - `ghcr.io/modelcontextprotocol/registry:main` (latest
development). Building the CLI from main would match the version of the
staging service API.
- Added environment-based Docker image tag selection logic
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
No
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
## Summary
Bumps the node machine type from e2-small to e2-standard-2 to provide
more CPU and memory headroom for the cluster.
Also disables PodDisruptionBudgets (PDBs) for single-instance PostgreSQL
clusters to prevent node upgrade operations from becoming blocked.
## Changes
- Increase GKE node machine type from e2-small to e2-standard-2
- Set `enablePDB: false` for registry and Grafana PostgreSQL clusters
## Context
The machine type increase addresses resource constraints causing
deployment failures.
The PDB change prevents a specific issue where GKE node upgrades get
stuck when trying to drain nodes containing single-instance PostgreSQL
pods. With `minAvailable: 1` PDBs, evicting the only database instance
violates the availability requirement, blocking the drain operation
indefinitely. Disabling PDBs for these development/staging
single-instance databases allows node maintenance to proceed smoothly.
For production deployments requiring high availability, the instances
count should be increased to 3 with PDBs enabled.
---------
Co-authored-by: Claude <noreply@anthropic.com>
## Motivation and Context
Logs will help in fixing issues quickly, thereby reducing the downtime
and MTTD.
## How Has This Been Tested?
End to end local setup is tested
## Breaking Changes
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
- It handles container logs for mcp-registry pods.
- It supports k8sattributes resources which helps in identifying from
where the logs are coming.
- Supports victorialogs and it's plugin in grafana.
<img width="1129" height="383" alt="Screenshot 2025-09-15 at 1 43 51 AM"
src="https://github.com/user-attachments/assets/a560c541-721d-415c-a0a8-8cbe008c3af6"
/>
<img width="1134" height="703" alt="Screenshot 2025-09-15 at 1 44 34 AM"
src="https://github.com/user-attachments/assets/8b5b4132-9fc3-4b8e-8027-27c7787070f1"
/>
<img width="1134" height="727" alt="Screenshot 2025-09-15 at 1 46 10 AM"
src="https://github.com/user-attachments/assets/bcdb4d9d-cea1-4d88-8dd5-fa4cdb51031f"
/>
---------
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR addresses the feedback comments from #366
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
## Summary
- Removed Azure deployment section and references from README
- Updated project structure to reflect current GCP prod/staging configs
- Removed Azure Load Balancer annotation from ingress controller
- Updated provider documentation to show GCP and local options only
- Added monitoring.go to project structure documentation
This cleans up outdated Azure/AKS deployment configuration that is no
longer used, leaving only the current GCP-based deployment structure.
## Motivation and Context
Ensures that the redirect url is set properly when logging in with
Google
## How Has This Been Tested?
In staging
## Breaking Changes
None
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Motivation and Context
Consistency with https://staging.registry.modelcontextprotocol.io/ URL
format (i.e. `<env>.<service>`, rather than `<service>.<env>`
## How Has This Been Tested?
Deployed in staging
## Breaking Changes
Grafana URL changes, but it's only just launched so fine.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Motivation and Context
After #328, the monitoring stack was failing to deploy because we hit
resource limits. This PR reduces the resource requests to a level
compatible with the cluster.
## How Has This Been Tested?
I've checked that everything still deploys happily in staging.
## Breaking Changes
None
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
This includes infra setup for metrics collection and visualisation
## Motivation and Context
It is important to have basic observability setup, so that common issues
can be identified quickly
## How Has This Been Tested?
- Tested on local
- Tested on one of the production setup
## Breaking Changes
No
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [X] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [X] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [X] My code follows the repository's style guidelines
- [X] New and existing tests pass locally
- [X] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
- This includes set up of following components:
- Victoriametrics single node cluster for storing metrics data with
persistent storage configuration for local and production env.
- Vmagent with target discovery for mcp-registry pods with scrape
interval of 30s.
- Grafana for visualising metrics and setting alerts.
- Datasource of victoriametrics is pre-configured as config map
- Persistent volume for basic configuration
- Sqlite for local and Postgres for production setup for storing
dashboard, alerts etc details
## Metrics in action
<img width="1422" height="666" alt="Screenshot 2025-08-31 at 4 35 28 AM"
src="https://github.com/user-attachments/assets/e54ce846-653c-4fa3-aa7a-fe277f0810e6"
/>
---------
Co-authored-by: Adam Jones <adamj@anthropic.com>
Co-authored-by: adam jones <adamj+git@anthropic.com>
## Summary
This PR implements OIDC authentication support for admin users,
specifically configured for Google Cloud Identity. The implementation
includes:
- Configurable OIDC authentication endpoints and validation
- Google Cloud Identity integration for admin access
- JWT token validation and user session management
- Deployment configuration updates for OIDC provider settings
Fixes#283
<!-- Provide a brief summary of your changes -->
Implements automated database backup functionality with Google Cloud
Storage integration, including retention policies and MinIO support for
local development.
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
This change adds critical database backup capabilities to ensure data
durability and disaster recovery. The solution provides automated
backups with configurable retention policies and supports both
production (GCS) and development (MinIO) environments.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
- Tested backup creation and restoration with MinIO in local development
- Verified GCS bucket lifecycle policies for automatic deletion after 60
days
- Tested backup retention and cleanup logic
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
No breaking changes. This is an additive feature that doesn't affect
existing functionality.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
- Implements 60-day retention period for backups as a safety net
- Uses GCS lifecycle rules for automatic cleanup
- Includes MinIO setup instructions for local development testing
- Port-forwarding commands updated for consistency across documentation
- Fixes#184
Fixes#228
## Motivation and Context
See #19
## How Has This Been Tested?
- Run locally
- Run in docker compose
- Run infra in minikube
- Unit and integration tests all passing :)
## Breaking Changes
Yes: users will not be able to access any data they used to have in
custom mongodb. We are accepting this breaking change, given the
registry is in experimental development status.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
I have not implemented connection pooling support for simplicity, and
because cloudnative-pg already provides built-in connection pooling with
pgBouncer so if we want it later we can switch to this endpoint easily.
## Motivation and Context
- Adds credentials for the new MCP Registry Login GitHub Apps (local,
staging, prod)
- Adds support for "none" auth to publisher
## How Has This Been Tested?
- Tested publisher workflows locally
- Unit and integration tests passing
## Breaking Changes
None
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
---
Merging based on Tadas's approval review, and only making minor docs changes on top of that.
## Motivation and Context
In staging (and prod, for now) we pull the `:latest` mcp-registry image.
But K8s won't actually change anything unless we recreate the pods.
This change ensures the workflow goes from docker -> staging -> prod,
and changes the annotation so that the pods are recreated each deploy.
This ensures they actually pull the latest version.
## How Has This Been Tested?
Deployed locally to minikube
## Breaking Changes
None
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
Fixes#264. Adds endpoints:
```
/v0/auth/github # exchange a github token for a registry token that gives you access to namespaces io.github.username and io.github.org for your orgs
/v0/auth/none # get a registry token for namespace io.modelcontextprotocol.anonymous (only for testing/local dev purposes)
```
Updates `/v0/publish` to accept one of these registry tokens.
## Motivation and Context
See #264
## How Has This Been Tested?
- Running locally and getting a token from `/v0/auth/none` and then
publishing to `/v0/publish`
- Updating the integration tests that get a token and then publish, and
them passing
## Breaking Changes
This is a breaking change to the auth API. This is fine for registry
given it's not deployed yet.
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: adam jones <domdomegg@users.noreply.github.com>
Radoslav Dimitrov
dependabot[bot]
Tadas Antanavicius
adam jones
Preeti Dewani
tadasant