The v2.2.0 release is a regular quarterly Crossplane release that is focused on maturing a number of key areas of functionality across the project, as Crossplane continues to become more capable, more reliable, and more performant for your production workloads. This release includes many fixes and reliability improvements, a new alpha feature for debugging (the pipeline inspector), and usability improvements.

ℹ️ Extended support for v1.20

Normally, the release of v2.2 would correspond with the end-of-life for v1.20. However, because v1.20 is the last minor release of the v1 series and major version upgrades require additional planning for users, v1.20 will continue to receive critical fixes. The final EOL date for v1.20 is to be determined.

⚠️ Upgrade from v2.1

It is strongly advised to upgrade to v2.2 from the previous minor version, which is v2.1. Upon upgrade for each minor release, Crossplane performs any necessary migrations of its CRDs to ensure the latest versions are stored in the Kubernetes API server. Therefore, it is important to upgrade sequentially through one minor version at a time as described in the upgrade docs.

🚨 Notable and Breaking Changes

• Input CRDs included in Function packages are no longer installed by the package manager, following the xpkg specification. Unknown or disallowed resources in a package are now ignored instead of causing package installation to fail. See #6976.
• The on-disk structure of the package cache has changed. This breaks an undocumented behavior via which packages could be side-loaded into Crossplane, which was especially useful for testing. See #6981 for details on the change and #7147 for discussion of the test changes necessary to accommodate it.

🎉 Highlights

• ImageConfig can now be used to configure the DeploymentRuntimeConfig used for packages, including those installed as dependencies. Note that a matching ImageConfig takes precedence over the runtimeConfigRef in a package spec if both are present. See #6382.
• The MRD controller now uses server-side apply to update CRDs, improving reliability. See #6934.
• The pipeline inspector is now available as an alpha feature (disabled by default). When enabled, the inspector forwards function requests and responses to a user-configured gRPC endpoint for debugging or observability. See #7025 and #7031.
• XRDs can now configure x-kubernetes-validations outside of the spec. This allows for validation of metadata such as names and labels. See #7018.
• Composition and operation functions can now request OpenAPI schemas for any resource kind in the cluster using the RequiredSchemas field in the function response. Crossplane now advertises capabilities (including required schemas) to functions in a new function request field. See #7022.
• The crossplane beta trace CLI command now supports tracing all resources of a given kind, and supports watching resources. See #6552 and #7015.
• New documentation has been added regarding connection details for composite resources and workload identity with Crossplane.

🏅 Release MVP

@jonasz-lasut is the v2.2 release MVP! Their work driving enhancements, fixing bugs, and maintaining quality across Crossplane and its ecosystem is much appreciated by the Crossplane maintainers. Additionally, @jonasz-lasut is an active participant on the Crossplane Slack instance, answering questions and providing guidance to many new and experienced members of the community. Thank you for your dedication, @jonasz-lasut! 🎉

What's Changed

• chore(deps): bump crossplane-runtime to v2.2.0-rc.0 by @jbw976 in #6888
• build: add release-2.1 to renovate baseBranches by @jbw976 in #6892
• Fix Docker port binding race condition on macOS by using HostPort "0" by @kaessert in #6897
• v2.1 release follow ups by @jbw976 in #6903
• Fix XR circuit breaker to account for double token consumption by @negz in #6911
• chore: add Evaneos to adopters list by @jbw976 in #6916
• chore(deps): update docker/login-action digest to 5e57cd1 (main) by @crossplane-renovate[bot] in #6890
• chore(deps): update module golang.org/x/crypto to v0.43.0 [security] (main) by @crossplane-renovate[bot] in #6921
• chore: add ambev tech as adopter by @rafaelvilarinho in #6925
• Update ADOPTERS.md by @O5ten in #6900
• Fix claim controller watch startup after transient failures by @negz in #6929
• Add option to prevent events from being emitted in default namespace by @frigaut-orange in #6733
• Allow configuring custom annotations on Crossplane helm chart secret resources by @ravilr in #6917
• Use server-side apply for MRD controller by @negz in #6934
• fix: Add TLS as app protocol to function service by @ezgidemirel in #6943
• pkg: Allow configuration of DeploymentRuntimeConfig via ImageConfig by @adamwg in #6940
• chore(deps): update module github.com/jmattheis/goverter to v1.9.2 (main) by @crossplane-renovate[bot] in #6918
• chore(deps): update github/codeql-action digest to d3ced5c (main) by @crossplane-renovate[bot] in #6891
• chore(deps): update module golang.org/x/crypto to v0.45.0 [security] (main) by @crossplane-renovate[bot] in #6937
• chore(deps): update actions/checkout digest to 34e1148 (main) by @crossplane-renovate[bot] in #6954
• add yaml support to render --context-files and --context-values flag by @u-kai in #6830
• chore(deps): update github/codeql-action digest to 497990d (main) by @crossplane-renovate[bot] in #6955
• Add Netclab to adopters list with usage details by @mbakalarski in #6972
• fix(render): propagate root composite identity through nested XR trees by @jcogilvie in #6957
• Add Sumo Logic to adopters by @jcogilvie in #6958
• Update ADOPTERS.md by @TheBelgarion in #6754
• fix(deps): update module google.golang.org/protobuf to v1.36.11 (main) by @crossplane-renovate[bot] in #6960
• Disable CodeRabbit issue enrichment beta feature by @negz in #6993
• chore: update run function proto comments for v2 connection details by @jbw976 in #6992
• pkg: Stop installing function input CRDs and ignore disallowed kinds by @adamwg in #6976
• fix broken link by @cahillsf in #6995
• chore: Remove ESS leftovers by @ezgidemirel in #7001
• tests: add error handling test for printPodsTable by @intojhanurag in #6944
• feat: Support list of resources for crossplane beta trace by @twobiers in #6552
• Introduce xpkg.Client to consolidate package fetching by @negz in #6981
• Bump golangci-lint to v2.6.2 by @negz in #7009
• apis: Eliminate imports of internal packages in apis by @adamwg in #7002
• Add sidecar container support to Crossplane Helm chart by @phisco in #7007
• feat(helm): Set automountServiceAccountToken on service accounts by @bradyz7 in #6873
• chore: add adamwg as maintainer, move turkenh to emeritus by @jbw976 in #7027
• docs: fix typo in comments by @NAM-MAN in #7028
• Pipeline inspector hook one-pager by @phisco in #7025
• chore(deps): update module github.com/go-chi/chi/v5 to v5.2.4 [security] (main) by @crossplane-renovate[bot] in #7033
• Add Cosign v3 support by @jonasz-lasut in #6985
• pkg: Fix upgrading packages with common transitive dependencies by @adamwg in #7030
• Add an option to prevent caching of resources in other namespaces by @frigaut-orange in #6732
• feat: add defaultCompositionRevisionSelector for v1 and v2 APIs by @markussiebert in #7032
• docs(links): update links in crds by @haarchri in #7045
• Migrate build system from Earthly to Nix by @negz in #6999
• Fix Renovate ...

❗ Important

Crossplane version v2.2.0-rc.1 is a release candidate intended to collect input from the community and offer users an opportunity to experiment with Crossplane in non-production environments before the official release of version v2.2.0.

To install Crossplane with this release:

helm repo add crossplane-stable https://charts.crossplane.io/stable --force-update
helm install crossplane --namespace crossplane-system --create-namespace crossplane-stable/crossplane --devel

To install the Crossplane CLI with this release:

curl -sL https://raw.githubusercontent.com/crossplane/crossplane/v2.2.0-rc.1/install.sh | XP_VERSION=v2.2.0-rc.1 sh

🚨 Notable and Breaking Changes

• Input CRDs included in Function packages are no longer installed by the package manager, following the xpkg specification. Unknown or disallowed resources in a package are now ignored instead of causing package installation to fail. See #6976.

🎉 Highlights

• ImageConfig can now be used to configure the DeploymentRuntimeConfig used for packages, including those installed as dependencies. Note that a matching ImageConfig takes precedence over the runtimeConfigRef in a package spec if both are present. See #6382.
• The MRD controller now uses server-side apply to update CRDs, improving reliability. See #6934.
• The pipeline inspector is now available as an alpha feature (disabled by default). When enabled, the inspector forwards function requests and responses to a user-configured gRPC endpoint for debugging or observability. See #7025 and #7031.
• XRDs can now configure x-kubernetes-validations outside of the spec. This allows for validation of metadata such as names and labels. See #7018.

📖 Full Changelog

• chore(deps): bump crossplane-runtime to v2.2.0-rc.0 by @jbw976 in #6888
• build: add release-2.1 to renovate baseBranches by @jbw976 in #6892
• Fix Docker port binding race condition on macOS by using HostPort "0" by @kaessert in #6897
• v2.1 release follow ups by @jbw976 in #6903
• Fix XR circuit breaker to account for double token consumption by @negz in #6911
• chore: add Evaneos to adopters list by @jbw976 in #6916
• chore(deps): update docker/login-action digest to 5e57cd1 (main) by @crossplane-renovate[bot] in #6890
• chore(deps): update module golang.org/x/crypto to v0.43.0 [security] (main) by @crossplane-renovate[bot] in #6921
• chore: add ambev tech as adopter by @rafaelvilarinho in #6925
• Update ADOPTERS.md by @O5ten in #6900
• Fix claim controller watch startup after transient failures by @negz in #6929
• Add option to prevent events from being emitted in default namespace by @frigaut-orange in #6733
• Allow configuring custom annotations on Crossplane helm chart secret resources by @ravilr in #6917
• Use server-side apply for MRD controller by @negz in #6934
• fix: Add TLS as app protocol to function service by @ezgidemirel in #6943
• pkg: Allow configuration of DeploymentRuntimeConfig via ImageConfig by @adamwg in #6940
• chore(deps): update module github.com/jmattheis/goverter to v1.9.2 (main) by @crossplane-renovate[bot] in #6918
• chore(deps): update github/codeql-action digest to d3ced5c (main) by @crossplane-renovate[bot] in #6891
• chore(deps): update module golang.org/x/crypto to v0.45.0 [security] (main) by @crossplane-renovate[bot] in #6937
• chore(deps): update actions/checkout digest to 34e1148 (main) by @crossplane-renovate[bot] in #6954
• add yaml support to render --context-files and --context-values flag by @u-kai in #6830
• chore(deps): update github/codeql-action digest to 497990d (main) by @crossplane-renovate[bot] in #6955
• Add Netclab to adopters list with usage details by @mbakalarski in #6972
• fix(render): propagate root composite identity through nested XR trees by @jcogilvie in #6957
• Add Sumo Logic to adopters by @jcogilvie in #6958
• Update ADOPTERS.md by @TheBelgarion in #6754
• fix(deps): update module google.golang.org/protobuf to v1.36.11 (main) by @crossplane-renovate[bot] in #6960
• Disable CodeRabbit issue enrichment beta feature by @negz in #6993
• chore: update run function proto comments for v2 connection details by @jbw976 in #6992
• pkg: Stop installing function input CRDs and ignore disallowed kinds by @adamwg in #6976
• fix broken link by @cahillsf in #6995
• chore: Remove ESS leftovers by @ezgidemirel in #7001
• tests: add error handling test for printPodsTable by @intojhanurag in #6944
• feat: Support list of resources for crossplane beta trace by @twobiers in #6552
• Introduce xpkg.Client to consolidate package fetching by @negz in #6981
• Bump golangci-lint to v2.6.2 by @negz in #7009
• apis: Eliminate imports of internal packages in apis by @adamwg in #7002
• Add sidecar container support to Crossplane Helm chart by @phisco in #7007
• feat(helm): Set automountServiceAccountToken on service accounts by @bradyz7 in #6873
• chore: add adamwg as maintainer, move turkenh to emeritus by @jbw976 in #7027
• docs: fix typo in comments by @NAM-MAN in #7028
• Pipeline inspector hook one-pager by @phisco in #7025
• chore(deps): update module github.com/go-chi/chi/v5 to v5.2.4 [security] (main) by @crossplane-renovate[bot] in #7033
• Add Cosign v3 support by @jonasz-lasut in #6985
• pkg: Fix upgrading packages with common transitive dependencies by @adamwg in #7030
• Add an option to prevent caching of resources in other namespaces by @frigaut-orange in #6732
• feat: add defaultCompositionRevisionSelector for v1 and v2 APIs by @markussiebert in #7032
• docs(links): update links in crds by @haarchri in #7045
• Migrate build system from Earthly to Nix by @negz in #6999
• Fix Renovate local preset syntax to use owner/repo//path format by @negz in #7055
• Fix Nix config for Renovate post-upgrade tasks by @negz in #7058
• Disable Nix build-users-group for Renovate by @negz in #7059
• fix(deps): update module github.com/sigstore/cosign/v3 to v3.0.4 [security] (main) by @crossplane-renovate[bot] in #7047
• chore(deps): pin dependencies (main) by @crossplane-renovate[bot] in #7057
• skip checklist-completed check for comments by @lsviben in #7061
• chore(deps): update module github.com/go-chi/chi/v5 to v5.2.4 [security] (main) by @crossplane-renovate[bot] in #7046
• chore(deps): update module github.com/theupdateframework/go-tuf/v2 to v2.4.1 [security] (main) by @crossplane-renovate[bot] in #7048
• chore(deps): update module github.com/sigstore/rekor to v1.5.0 [security] (main) by @crossplane-renovate[bot] in #7034
• fix(deps): update module github.com/sigstore/sigstore to v1.10.4 [security] (main) by @crossplane-renovate[bot] in #7035
• chore(deps): update module github.com/quic-go/quic-go to v0.57.0 [security] (main) by @crossplane-renovate[bot] in #6977
• fix(fn-cache): prevent caching responses with unfulfilled requirements by @haarchri in #6961
• fix: improve errors for malformed xpkg examples by @majiayu000 in #6990
• Add Christopher Haar as a maintainer by @negz in #70...

This release backports #7030 to the 2.1 branch to fix one of the issues reported in #3423, where shared transitive dependencies could not be upgraded successfully. It also contains security updates to Crossplane's dependencies.

What's Changed

• chore(deps): update module github.com/quic-go/quic-go to v0.57.0 [security] (release-2.1) by @crossplane-renovate[bot] in #6978
• Backport #7030 to release-2.1 by @adamwg in #7054
• [release-2.1] Update sigstore dependencies to fix CVEs by @negz in #7064
• chore(deps): update module github.com/theupdateframework/go-tuf/v2 to v2.4.1 [security] (release-2.1) by @crossplane-renovate[bot] in #7067
• chore(deps): update module github.com/go-chi/chi/v5 to v5.2.4 [security] (release-2.1) by @crossplane-renovate[bot] in #7040
• [Backport release-2.1] fix(render): propagate root composite identity through nested XR trees by @github-actions[bot] in #6974

Full Changelog: v2.1.3...v2.1.4

This release backports #7030 to the 2.0 branch to fix one of the issues reported in #3423, where shared transitive dependencies could not be upgraded successfully. It also contains security updates to Crossplane's dependencies.

What's Changed

• Backport #7030 to release-2.0 by @adamwg in #7053
• [Backport release-2.0] fix(render): propagate root composite identity through nested XR trees by @github-actions[bot] in #6973
• [release-2.0] Update sigstore dependencies to fix CVEs by @negz in #7065
• chore(deps): update module github.com/theupdateframework/go-tuf/v2 to v2.4.1 [security] (release-2.0) by @crossplane-renovate[bot] in #7094

Full Changelog: v2.0.6...v2.0.7

This release backports #7030 to the 1.20 branch to fix one of the issues reported in #3423, where shared transitive dependencies could not be upgraded successfully. It also contains security updates to Crossplane's dependencies.

What's Changed

• Backport #7030 to release-1.20 by @adamwg in #7052
• [release-1.20] Update sigstore dependencies to fix CVEs by @negz in #7066

Full Changelog: v1.20.4...v1.20.5

This release resolves #6761 - issues when upgrading providers that manifest with errors like these:

cannot establish control of object: addresses.compute.gcp.upbound.io is already controlled by ProviderRevision provider-gcp-compute-a41e4ba551fc (UID 58db5dee-38e7-40f9-9d31-669bb25a688e)

What's Changed

• [Backport release-2.1] Use server-side apply for MRD controller by @negz in #6952

Full Changelog: v2.1.2...v2.1.3

This release resolves #6761 - issues when upgrading providers that manifest with errors like these:

cannot establish control of object: addresses.compute.gcp.upbound.io is already controlled by ProviderRevision provider-gcp-compute-a41e4ba551fc (UID 58db5dee-38e7-40f9-9d31-669bb25a688e)

What's Changed

• [Backport release-2.0] Use server-side apply for MRD controller by @negz in #6953

Full Changelog: v2.0.5...v2.0.6

What's Changed

• chore(deps): update module golang.org/x/crypto to v0.43.0 [security] (release-2.1) by @crossplane-renovate[bot] in #6926
• [Backport release-2.1] Fix claim controller watch startup after transient failures by @github-actions[bot] in #6933
• [Backport release-2.1] fix: Add TLS as app protocol to function service by @github-actions[bot] in #6946
• chore(deps): update module golang.org/x/crypto to v0.45.0 [security] (release-2.1) by @crossplane-renovate[bot] in #6941

Full Changelog: v2.1.1...v2.1.2

What's Changed

• chore(deps): update module golang.org/x/crypto to v0.43.0 [security] (release-2.0) by @crossplane-renovate[bot] in #6923
• [Backport release-2.0] Fix XRD controller watch startup after transient failures by @negz in #6930
• [Backport release-2.0] Fix claim controller watch startup after transient failures by @github-actions[bot] in #6932
• [Backport release-2.0] fix: Add TLS as app protocol to function service by @github-actions[bot] in #6945
• chore(deps): update module golang.org/x/crypto to v0.45.0 [security] (release-2.0) by @crossplane-renovate[bot] in #6939

Full Changelog: v2.0.4...v2.0.5

What's Changed

• chore(deps): update module golang.org/x/crypto to v0.43.0 [security] (release-1.20) by @crossplane-renovate[bot] in #6922
• [Backport release-1.20] Fix XRD controller watch startup after transient failures by @negz in #6931
• [Backport release-1.20] Fix claim controller watch startup after transient failures by @negz in #6936
• chore(deps): update module golang.org/x/crypto to v0.45.0 [security] (release-1.20) by @crossplane-renovate[bot] in #6938
• [Backport release-1.20] fix: Add TLS as app protocol to function service by @negz in #6948

Full Changelog: v1.20.3...v1.20.4