Config Connector version 1.151.0 is now available.

Change

New Alpha Resources (Direct Reconciler):

• CloudDeployAutomation
• ComputeFutureReservation
• GKEHubMembershipBinding
• GKEHubNamespace
• GKEHubScopeRBACRoleBinding
• NetworkServicesWasmPlugin
• VertexAIDataLabelingJob

Feature

New Fields:

• MemorystoreInstance
  • Added spec.automatedBackupConfig field.
  • Added spec.crossInstanceReplicationConfig field.
  • Added spec.maintenanceVersion field.
  • Added status.observedState.availableMaintenanceVersions field.
  • Added status.observedState.crossInstanceReplicationConfig field.
  • Added status.observedState.effectiveMaintenanceVersion field.
  • Added status.observedState.pscAttachmentDetails field.

Fixed

• BigQueryDataTransferConfig
  • Fix resource duplication loop.
• ContainerCluster
  • Enable projectID to projectNumber transform in fields in Container LROs.

Config Connector version 1.150.0 is now available.

Feature

New Alpha Resources (Direct Reconciler):

• GKEHubScope
  • Manage Google Kubernetes Engine Hub Scopes which let you group fleet resources for fine-grained management.
• CloudDeployTarget
  • Manage Cloud Deploy targets which define where your application is deployed.

Feature

New Fields:

• CertificateManagerCertificate
  • Added status.observedState field, which includes managed.state, managed.authorizationAttemptInfo, and managed.provisioningIssue. This enables tracking the current state of the certificate even when state-into-spec: absent is used.
• ContainerCluster
  • Added spec.ipAllocationPolicy.additionalIpRangesConfigs field.
• ContainerNodePool
  • Added spec.networkConfig.subnetworkRef field.

Feature

Improved resource creation logging for both Direct and DCL-based controllers by including structured diffs.

Change

Reconciliation Improvements:

Added support for direct reconciliation to more resources, with opt-in behaviour. The API is unchanged. To use the direct reconciler, add the cnrm.cloud.google.com/reconciler: direct annotation to the corresponding Config Connector object. The following resources now have direct reconciliation support:

• BigqueryTable
  • Fixed a permanent difference in the policyTag field when using the direct controller, ensuring safer upgrades.
• SQLInstance
  • Added detailed diff reporting for the userLabels field.
• DataplexLake
  • Added structured diff reporting to improve visibility into resource changes.

Fixed

Bug Fixes:

• ContainerCluster
  • Fixed a permanent difference in the databaseEncryption.state field and added support for the ALL_OBJECTS_ENCRYPTION_ENABLED value.
• MemorystoreInstance
  • Updated the controller to use change cookies, improving reconciliation stability and correctness.

Config Connector version 1.149.1 is now available.

Feature

New Alpha Resources (Direct Reconciler):

• NetworkServicesLBRouteExtension #6957
  • Manage load balancing route extensions which let you inject custom logic into the load balancing path.
• ParameterManagerParameterVersion #7140
  • Manage Parameter Manager parameter versions which lets you to manage regional parameters.

Feature

New Fields:

• ContainerCluster #7336
  • Added spec.nodeConfig.ephemeralStorageLocalSsdConfig.dataCacheCount field to support GKE Data Cache.
• ContainerNodePool #7336
  • Added spec.nodeConfig.ephemeralStorageLocalSsdConfig.dataCacheCount field to support GKE Data Cache.

Feature

New Features:

• Controlled CR reconciliation Added support for unmanaging specific resources through resourceSettings in ConfigConnector (global) and ConfigConnectorContext (per-namespace). This lets you to selectively disable reconciliation for specific Group/Kinds to save memory or manage resources differently.

Change

Reconciliation Improvements:

Added support for direct reconciliation to more resources, with opt-in behaviour. The API is unchanged. To use the direct reconciler, add the cnrm.cloud.google.com/reconciler: direct annotation to the corresponding Config Connector object.

• BigQueryDatasetAccess #7000

Fixed

Bug Fixes:

• Preview Tool Fixed a connection error in the Config Connector preview tool and enforced read-only access to the cluster for improved security.

Config Connector version 1.148.0 is now available.

Feature

New Alpha Resources (Direct Reconciler):

• ParameterManagerParameterVersion
  • Configure Parameter Manager parameter versions which lets you manage regional parameters.

Feature

New features:

• #6919: MultiClusterLeaseSpec now supports integration with a syncer for KRM objects. This helps Config Connector take ownership of resources with service generated IDs.
• #7202: kompanion: Added a Model Context Protocol (MCP) server to the kompanion tool to enable AI IDEs and assistants to interact with Config Connector resources.
• #7075: Config Connector controllers: Added a --skip-name-validation flag to bypass duplicate controller name checks during registration, facilitating integration tests and multi-manager scenarios.

Fixed

Bug Fixes:

• #7145: SQLInstance: Fixed an issue where settings.dataCacheConfig was incorrectly detected as different when dataCacheEnabled was false.
• #7200: SQLInstance: Updated matching functions to treat nil values in KRM as equivalent to empty or default objects in Google Cloud, preventing unnecessary re-reconciliation loops.
• #6943: TagKey/TagValue: Handle ALREADY_EXISTS error in TagKey and TagValue controllers by acquiring the existing resource.
• #6774: BigQueryAnalyticsHubDataExchange: Added structured reporting diff to improve visibility into resource changes and fixed reconciliation logic errors.
• #7115: CloudBuildTrigger: Restored missing descriptions in the CRD.
• #6693: RunService: Fixed a typo in environment variable values in samples and test fixtures.

Feature

Documentation:

• Added a guide for controller configuration, detailing Direct, Terraform, and DCL controllers, including precedence rules and overrides.
• Added a guide for enabling VerticalPodAutoscaler (VPA) for Config Connector Pods using ControllerResource and NamespacedControllerResource.
• Added a guide for the config-connector CLI and specifically for the preview command..

Config Connector version 1.147.1 is now available.

Feature

New Alpha Resources (Direct Reconciler):

• CloudDeployCustomTargetType
  • Please replace any instances of the DeployCustomTargetType resource with the new CloudDeployCustomTargetType (v1alpha1) resource.

Change

Reconciliation Improvements:

• Improved structured reporting diffs to provide better visibility into what changed during reconciliation for the following resources:
  • BigQueryDataset
  • BigQueryReservationAssignment
  • BigQueryTable
  • CertificateManagerDNSAuthorization
  • CloudIdentityGroup
  • DataformRepository
  • MetastoreService
  • PrivilegedAccessManagerEntitlement
  • WorkflowsWorkflow

Feature

New features:

• Enhanced config-connector preview to support side-by-side comparison between default and alternative controllers.
• Added a --skip-name-validation flag to Config Connector controllers to bypass duplicate controller name checks during registration.

Fixed

Bug Fixes:

• Added CRD filtering for the preview recorder to skip non-CNRM objects.

Config Connector version 1.144.0 was identified as a bad release. Do not use this version - upgrade directly to 1.145.0 or later.

Announcement

Config Connector version 1.146.0 is now available.

Feature

New Alpha Resources (Direct Reconciler):

• ParameterManagerParameter
  • Manage Parameter Manager Parameters.

Feature

New Fields:

• ContainerCluster
  • Added spec.controlPlaneEndpointsConfig.dnsEndpointConfig.enableK8sTokensViaDns field.

Change

Improvements:

• ContainerCluster
  • Made spec.clusterAutoscaling.autoProvisioningDefaults.bootDiskKMSKeyRef mutable.
• NetworkServicesWasmPlugin
  • Introduced identity and reference.
• Added structured reporting diff to numerous direct controllers to enhance diff visibility.

Fixed

Bug Fixes:

• SQLInstance
  • Added client-side default for RetainedBackups and RetentionUnit, and validated the edition field.
  • Added replicaConfiguration as an unmanageable field.
  • Controller now correctly defaults the field enablePrivatePathForGoogleCloudServices to false.
• CertificateManagerDnsAuthorization
  • Sanitized Kubernetes labels to avoid 400 errors from invalid characters.
• ConfigConnector Core
  • preview now performs an early exit when no resources are found to reconcile.
  • Fixed CRD field description for shared parent.
  • Fixed incorrect exit status in lint filter.
  • Updated mockgcp to improve compute regional resource mocks and defaults.

Config Connector version 1.145.0 is now available.

Feature

New Beta Resources (Direct Reconciler):

• ComputeSecurityPolicy
  • Manage Google Cloud Armor security policies.
• MemorystoreInstance
  • Manage Memorystore for Valkey Instances.

Feature

New Fields:

• ContainerCluster
  • Added spec.clusterAutoscaling.defaultComputeClassConfig field.
• RunJob
  • Added spec.template.template.volumes.nfs field to support NFS backed Volumes.
  • Added spec.template.template.volumes.gcs field to support GCS backed Volumes.
• SQLInstance
  • Added spec.settings.failoverDrReplicaRef field to support designating CloudSQL Enterprise Plus DR Replicas.

Feature

New features:

• Added the preview command to the config-connector CLI. The preview command has been removed from the experimental kompanion tool.

Change

Added support for structured diff reporting to the following direct controllers to improve logging and debugging:

• ApigeeEnvgroup
• ApigeeInstance
• AssetFeed
• AssetSavedQuery
• BackupVaultIdentity
• BigtableLogicalView
• CloudDeployDeliveryPipeline
• ColabRuntime
• RedisCluster
• SpannerBackupSchedule
• SpannerInstance
• SpannerInstanceConfig
• TaskQueue
• WorkstationConfig

Fixed

Bug Fixes:

• DataformRepository
  • Fixed a bug where the serviceAccountRef field could not be updated.
• SpannerBackupSchedule
  • Fixed an issue with invalid update masks by handling output-only fields.

Config Connector version 1.144.0 is now available.

Feature

New Beta Resources (Direct Reconciler):

• TagsLocationTagBinding
  • TagsLocationTagBinding is promoted to beta and now uses the direct reconciler by default.
  • Supports tagging of regional resources, including ArtifactRegistryRepository, CloudRun (RunJob, RunService), BigQueryDataset, BigQueryTable, and StorageBucket.
  • spec.location should be set to the region of the resource being tagged.

Fixed

Bug Fixes:

• Fixed incorrect diffs in TagsLocationTagBinding caused by project number versus. project ID mismatches.

Change

Reconciliation Improvements:

• TagsLocationTagBinding
  • Switched to direct reconciliation as the default reconciler.

Config Connector version 1.134.4 is now available.

Fixed

Bug Fixes:

• #6035: Fixed an issue where managedFields metadata could be incorrectly attributed to the status subresource during spec updates, causing "Location must be set" errors.

Feature

#6065: Enabled Vertical Pod Autoscaler (VPA) support. You can enable VPA for Config Connector components via ControllerResource and NamespacedControllerResource to automatically adjust resource requests.

Config Connector version 1.143.0 is now available.

Feature

New Alpha Resources (Direct Reconciler):

• ParameterManagerParameter

Feature

New Beta Resources (Direct Reconciler):

• ArtifactRegistryRepository
• LoggingLink
• MemorystoreInstance
• PrivateCACAPool

Feature

New Features:

• Set GOMEMLIMIT for KCC workloads to improve memory management and stability.

Feature

New Fields:

• AlloyDBInstance
  • Added spec.connectionPoolConfig field.
  • Added status.connectionPoolConfig field.

Change

Reconciliation Improvements:

• TagsTagBinding

  • Added support for organizations in parentRef.
  • Added support for multiple targets in parentRef.

• Resource References (refs.Ref) support added for the following resources to improve reference resolution:

  • BigQueryTable
  • BigQueryDataset
  • CloudRunService
  • CloudRunJob
  • ArtifactRegistryRepository
  • StorageBucket

Fixed

Bug Fixes:

• Issue 6221: ComputeBackendService can now correctly refer to clientTLSPolicy.
• Issue 6156: BigQueryTable now ignores int64 to int32 schema changes when configured.
• Issue 6026: Fixed identity parsing for TagsTagValue.

Config Connector version 1.142.0 is now available.

Feature

New Beta Resources (Direct Reconciler):

• AlloyDBBackup
• AccessContextManagerAccessLevel

Feature

New Features:

• IAM: Added support for iam.cnrm.cloud.google.com/disable-dependent-services annotation.
• Added support for Cilium cluster-wide network policy.

Feature

New Fields:

• AlloyDBInstance
  • Added spec.observabilityConfig and spec.queryInsightsConfig fields.
• ContainerNodePool
  • Added spec.nodeConfig.enableNestedVirtualization field.

Change

Reconciliation Improvements:

Added support for direct reconciliation to more resources, with opt-in behaviour. The API is unchanged. To use the direct reconciler, add the alpha.cnrm.cloud.google.com/reconciler: direct annotation to the corresponding Config Connector object. The following resources now have direct reconciliation support:

• TagsLocationTagBinding: Now supports direct reconciliation.

Fixed

Bug Fixes:

• BatchJob: Fixed a bug where the resource could not be created.
• FirewallPolicyRule: Fixed an issue with updating the resource.
• IAMServiceAccountKey: Fixed an issue causing unnecessary re-reconciliation.
• Fixed a bug where ComputeBackendService could not refer to clientTLSPolicy due to an invalid format.
• Fixed a bug where interconnect attachments were not ignored.
• Fixed a bug in the GitHub MCP server.
• Fixed a bug in the private cluster endpoint for mockgcp.

Config Connector version 1.141.0 is now available.

Feature

New Features:

• Enabled Vertical Pod Autoscaler (VPA) support for Config Connector controllers.
• Added verticalPodAutoscalerMode field to ConfigConnector and ConfigConnectorContext resources.

Feature

New Fields:

• RunJob

  • Added spec.template.spec.containers[].port field.

• DataplexTask

  • Replaced project with projectRef.
  • Replaced serviceAccount with serviceAccountRef.
  • Replaced kmsKey with kmsKeyRef.

Fixed

Bug Fixes:

• Fixed various issues in observedState handling for resources with reference fields.
• Fixed an issue where IAMPolicy and IAMPartialPolicy controllers would alphabetize the members field within the resource spec and write it back. This behavior can conflict with intent-based reconciliation from GitOps systems such as Config Sync, causing a loop of updates and potentially exhausting IAM read quotas.

Config Connector version 1.140.2 is now available.

Fixed

• Fixed a bug where the IAMPolicy and IAMPartialPolicy controllers would alphabetize the members field within the resource spec and write it back. This behavior can conflict with intent-based reconciliation from GitOps systems such as Config Sync, causing a loop of updates and potentially exhausting IAM read quotas. This issue affected versions 1.140.0 and has now been patched in version 1.140.2.

Config Connector version 1.140.0 is now available.

Feature

New Beta Resources (Direct Reconciler):

• CertificateManagerCertificateIssuanceConfig
  • Manage Certificate Manager certificate issuance configurations for automating certificate issuance.

Change

New Alpha Resources (Direct Reconciler):

• AssuredWorkloadsWorkload
  • Manage Assured Workloads workloads to support compliance and security requirements.
• ConfigDeliveryResourceBundle
  • Manage Config Delivery resource bundles for Config Sync.

Feature

New Fields:

• AlloyDBCluster
  • Added spec.restoreContinuousBackupSource and spec.restoreBackupSource fields to support restoring from a backup.
• BigQueryReservationAssignment
  • Added spec.jobType field.
• FirestoreDatabase
  • Added spec.deleteProtectionState field.
• FirestoreField
  • Added spec.ttlConfig field.
• RunJob
  • Added spec.template.template.containers.dependsOn field.

Change

Reconciliation Improvements:

• Integrated Multi-Cluster Leader Election for improved reliability in multi-cluster setups.

Fixed

• Fixed an issue where BigQueryReservationAssignment was not exposing externalRef.
• Fixed an issue with CertificateManagerDNSAuthorization API, Fuzzer and Mapper.
• Fixed an issue with FirestoreDatabase defaulting logic.

Config Connector version 1.139.0 is now available.

Change

New Alpha Resources (Direct Reconciler):

• FirestoreField

Feature

New Features:

• The controller type is now reported at the start and end of reconciliation.
• Mockgcp now supports iap oauth brands and bigtable materializedview.

Change

Reconciliation Improvements:

• IAM partial policy management

Fixed

• Reduced the memory footprint of the recorder.
• SQLInstance: Fixed an issue where empty maintenanceVersion patches were sent. The settings and maintenanceVersion fields are now unmanaged.
• FirestoreDatabase: Fixed boolean value exports.

Config Connector version 1.138.0 is now available.

Feature

New Beta Resources (Direct Reconciler):

• BackupDRBackupVault
• OrgPolicyCustomConstraint

Feature

New Alpha Resources (Direct Reconciler):

• FirestoreBackupSchedule
• FirestoreDocument

Change

Reconciliation Improvements:

• Improved Normalization logic for OrgPolicy, RunJob, TagsTagBinding, and VertexAIIndex resources.

Fixed

Bug Fixes:

• Fixed format validation issue in the DataflowFlexTemplateJob direct controller when the spec.subnetworkRef.external field contains full URL.
• Updated status.observedGeneration in ConfigConnector object.

New Beta Resources (Direct Reconciler):

• DocumentAIProcessorVersion
• EssentialContactsContact
• BigQueryBigLakeTable
• BackupDRBackupPlan

Fixed

Bug Fixes:

• Fixed an issue where ComputeBackendService backends were not sorted.
• Fixed an issue where CloudFunctionsFunction runtime was not a supported value.
• Fixed an issue with labels for BackupDRBackupPlan.
• Fixed an issue with labels for RunJob.
• Fixed a fuzzing issue for FirestoreField.
• Fixed an issue with KMSCryptoKey import.
• Fixed a flakiness issue in the MonitoringDashboard fuzzer.
• Fixed a flakiness issue in tests.
• Fixed an issue with bad labels in tests.
• Fixed an issue with etag in direct reconciliation.

Change

New Alpha Resources (Direct Reconciler):

• BigtableMaterializedView
• MemorystoreInstance

Change

Reconciliation Improvements:

• Enabled opt-in for IAM partial policy management.
• Enabled server-side apply for KMS resources.
• Improved reconciliation for BigtableLogicalView by using deep reflection.
• Improved reconciliation for FirestoreDatabase with identity pattern and export support.
• Improved reconciliation for RunJob with export support.
• Unified ComputeTargetTCPProxy direct API and controller.

Feature

New Fields:

• BigtableMaterializedView: Added spec.sourceTableRef and spec.definition.
• BackupDRBackupPlan: Added spec.backupConfig.retentionPeriodDays and spec.backupConfig.backupWindow.

Announcement

Config Connector version 1.137.0 is now available.

Reconciliation Improvements:

• Introduced Stateful Reconciliation for Direct Controllers. With stateful reconciliation, the direct controller stores a hash of the last successfully applied .spec in the resource's .status. This provides a lightweight, GitOps-safe record when a user has modified the desired state of the resource.

Change

New Beta Resources (Direct Reconciler):

• AssetFeed
• BigQueryReservationAssignment
• CloudDeployDeliveryPipeline
• ComposerEnvironment

Fixed

Bug Fixes:

• Added support for checking etag in spec for alpha resources.
• Fixed an issue where CloudIdentityMembership roles comparison would fail.
• Fixed a bug where the wrong GVK was reported in IAM controller.
• Fixed a bug where errors were swallowed when reading a Secret.
• Fixed an issue with LRO endTime in mockgcp.
• Fixed a bug in the etag mapper.
• Fixed a bug in the mapper generator for slice and single object map.
• Fixed a bug in the mapper generator for OneOf if the input is not proto.Message.
• Fixed an import for refs in the same package in controllerbuilder.

Feature

New Fields:

• ComposerEnvironment
  • Added spec.storageConfig field.
  • Added spec.config.workloadsConfig.dagProcessor field.
  • Added spec.config.workloadsConfig.triggerer field.
  • Added spec.config.softwareConfig.webServerPluginsMode field.
  • Added spec.config.softwareConfig.cloudDataLineageIntegration field.

Announcement

Config Connector version 1.136.1 is now available.

Config Connector version 1.134.1 is now available.

Fixed

Bug Fixes:

• #5230: Fixed an issue that could lead to premature certificate rotation by ensuring errors are not swallowed when reading a Secret.
• #5231: Add more verbose logging during certificate validation to assist with debugging.

Bug Fixes:

• PR#5009 Fix the nil pointer dereference error in AlloyDB direct controller

Announcement

Config Connector version 1.135.0 is now available.

Feature

New Fields:

• AlloyDBCluster
  • Added spec.databaseVersion field

Change

New Beta Resources (Direct Reconciler):

• AssetSavedQuery
• PubSubSnapshot

Change

Modified Beta Reconciliation: We migrated the following resources from the Terraform-based or DCL-based controller to the new Direct Controller.

• VMWareEngineExternalAddress

Improved reconciliation by migrating the following resources from the Terraform-based or DCL-based controller to the new direct controller. These resources are migrated automatically and you no longer need to apply the opt-in annotation to enable the direct controller:

• CloudIdentityGroup

• CloudIdentityMembership

Fixed

Bug Fixes:

• ConfigConnectorContext:
  • PR#4995: status.observedGeneration is now being set on the ConfigConnectorContext.
  • PR#4657: Added spec.managerNamespace.
• SQLInstance:
  • PR#4838: Fixed bug in SQLInstance maintenanceVersion UPDATE operation
  • PR#4843: Set status on acquisition for SQLInstance controller
  • PR#4857: Support SQLInstance maintenanceVersion in CREATE operation

Change

New Fields:

• ContainerCluster: DNS endpoint is supported in ContainerCluster.

Announcement

Config Connector version 1.134.0 is now available.

New Beta Resources (Direct Reconciler):

• APIGatewayAPI

• AppHubApplication

• StorageAnywhereCache

Change

New Alpha Resources (Direct Reconciler):

• BigtableLogicalView

Change

Reconciliation Improvements

Added support for direct reconciliation to more resources, with opt-in behaviour. The API is backward compatible. The following resources now have direct reconciliation support

• BigQueryTable
  • Use the alpha.cnrm.cloud.google.com/reconciler: direct annotation on the BigQueryTable CR object to opt-in the direct controller.
  • The direct controller also supports adding BigQueryDataPolicies directly to BigQueryTable columns within spec.schema.

Fixed

• PR#4808 filtered out Kubernetes labels that are invalid for Google Cloud in the ComputeForwardingRule direct controller, ensuring backward compatibility after migrating to the direct controller.

Announcement

Config Connector version 1.133.0 is now available.

Config Connector version 1.132.1 is now available.

Change

Reconciliation Improvements:

• SpannerInstance
  • You can opt-in the direct controller by adding the alpha.cnrm.cloud.google.com/reconciler: direct annotation to the SpannerInstance resource`.
  • Direct controller is opt-in if using the following fields:
    • spec.labels
    • spec.defaultBackupScheduleType
    • spec.edition
    • spec.autoscalingConfig

Reconciliation Improvements:

• BigtableAppProfile
  • You can opt-in the direct controller by adding the alpha.cnrm.cloud.google.com/reconciler: direct annotation to the BigtableAppProfile resource.
  • Added support for spec.dataBoostIsolationReadOnly field for resources reconciled by the direct controller.
• CloudIdentityGroup and CloudIdentityMembership
  • You can opt-in the direct controller by adding the alpha.cnrm.cloud.google.com/reconciler: direct annotation to the CloudIdentityGroup and CloudIdentityMembership resources.
  • With direct reconciliation, creating new resources will no longer write back the service-generated ID to spec.resourceID. To acquire a resource, you can find its resourceID from the last part of status.externalRef field, or via gcloud command or Cloud Console. The spec.resourceID field is used for acquisition only, leave the field unset when creating a new resource.

Feature

• Storage Bucket
  • Removed immutability constraint on spec.location and spec.customPlacementConfig.dataLocations fields. To learn more, see Relocate buckets.

Change

New Alpha Resources (Direct Reconciler):

• OrgPolicyPolicy
• OrgPolicyCustomConstraint
• SpeechRecognizer
• StorageAnywhereCache

Feature

New Fields:

• SpannerInstance For opt-in direct controller,
  • Added spec.labels field.
  • Added spec.defaultBackupScheduleType field.
• SecretManagerSecret For opt-in direct controller,
  • Added spec.labels field.

Announcement

Config Connector version 1.132.0 is now available.

Feature

New Beta Resources (Direct Reconciler):

• SpeechCustomClass
• SpeechPhraseSet
• SpeechRecognizer
• VertexAINotebooksInstance
• VertexAIMetadataStore

New Beta resources (direct reconciler)

• IAPSettings

Change

New Alpha resources (direct reconciler)

• ComputeNetworkAttachment
• ComputeNetworkEdgeSecurityService
• DataplexEntryGroup
• DataplexEntryType
• DataplexTask
• DataplexZone
• DatastreamRoute
• DocumentAIVersion
• GKEBackupBackup
• GKEBackupRestore
• PubSubSnapshot
• SpeechCustomClass
• VMwareEngineExternalAddress
• MetastoreService
• MetastoreFederation
• MetastoreBackup
• APIQuotaPreference
• APIQuotaAdjusterSettings
• EventarcGoogleChannelConfig
• EventarcChannel
• AssetSavedQuery
• AssetFeed
• EssentialContactsContact
• DataCatalogEntryGroup
• DataCatalogEntry
• DataCatalogTagTemplate
• DataCatalogTag

Announcement

Config Connector version 1.131.0 is now available.

Fixed

• Fixed an issue: excessive compute.firewallPolicies.patchRule Logs triggered by Config Connector direct reconciliation.

New Fields

• GKEHubFeatureMembership

  • Added spec.configmanagement.configSync.stopSyncing in version1.129.

• SpannerInstance.

  • Added spec.defaultBackupScheduleType field.
  • Added spec.labels field

Feature

New Beta resources (direct reconciler)

• ApigeeEndpointAttachment

• ApigeeEnvgroupAttachment

• ApigeeInstanceAttachment

• ManagedKafkaTopic

• SecureSourceManagerInstance

• SecureSourceManagerRepository

Change

New Alpha resources (direct reconciler)

• ApphubApplication
• BackupDRManagementServer
• BackupDRBackupVault
• BackupDRBackupPlan
• BackupDRBackupPlanAssociation
• BatchJob
• BigLakeTable
• BigQueryReservation
• CodeDeployDeliveryPipeline
• DataplexLake
• DatastreamPrivateConnection
• DatastreamConnectionProfile
• DocumentAIProcessor
• GKEBackupBackupPlan
• GKEBackupRestorePlan
• NetAppBackupPolicy
• NotebooksEnvironment
• SpannerInstanceConfig
• VertexAIFeaturestore
• VMwareEnginePrivateCloud
• VMwareEngineNetwork
• VMwareEngineNetworkPeering
• VMwareEngineNetworkPolicy
• WorkflowExecution

Announcement

Config Connector version 1.130.2 is now available.

Change

Reconciliation Improvements

Added support for direct reconciliation to more resources, with opt-in behaviour. The API is backward compatible. To use the direct reconciler, add the alpha.cnrm.cloud.google.com/reconciler: direct annotation to the corresponding Config Connector object. The following resources now have direct reconciliation support (and we list some of the issues that this fixes):

• SpannerInstance
  • You can use spec.edition field to optimize your enterprise edition type
  • You can use spec.autoscalingConfig to automate the scaling instead of manually configure spec.processingUnit or spec. numNodes.
  • You can use the defaultBackupScheduleType now.
  • Behavior Change If you use the SpannerInstance Kubernetes metadata.labels to configure your GCP labels, please change them to use the spec.labels field instead.

New Alpha resources (direct reconciler)

• ManagedKafkaTopic
• ApigeeInstanceAttachment
• ApigeeEnvgroupAttachment
• ApigeeEndpointAttachment

Change

Reconciliation Improvements

• SQLInstance

  • All SQLInstance types are now reconciled using the new direct controller instead of the legacy Terraform-based controller. The previous "opt-in" annotation (document reference) no longer applies. Users no longer need to apply the "opt-in" annotation to SQLInstance resources to enable the direct controller. Regardless of the presence (or absence) of an opt-in annotation on SQLInstance resources, the direct reconciler will be used.
  • This change enables all SQLInstance resources to switch from edition ENTERPRISE to ENTERPRISE_PLUS and fixes the bug that prevented SQL Instance upgrade.

Announcement

Config Connector version 1.129.2 is now available.

Feature

New Beta resources (direct reconciler)

• ManagedKafkaCluster

• ApigeeInstance

• AlloydbInstance

Reconciliation Improvements

• We have added support for direct reconciliation to more resources, with opt-in behaviour. The API is unchanged. To use the direct reconciler, add the alpha.cnrm.cloud.google.com/reconciler: direct annotation to the corresponding Config Connector object. The following resources now have direct reconciliation support:

  • AlloyDBInstance
  • SpannerInstance

Change

New Alpha resources (direct reconciler)

• IAPSettings

  • Customize the Identity-Aware Proxy (IAP) settings for applications and services running on Google Cloud Platform.

• SecureSourceManangerInstance

• SecureSourceManangerRepository

Announcement

Config Connector version 1.128.0 is now available.

Fixed

DataformRepository fields validation error.

• Fixed the incorrect format validation for the following fields:

  • spec.gitRemoteSettings.authenticationTokenSecretVersionRef
  • spec.gitRemoteSettings.sshAuthenticationConfig.userPrivateKeySecretVersionRef
  • spec.npmrcEnvironmentVariablesSecretVersionRef

Feature

New Beta resources (direct reconciler)

• ApigeeEnvgroup

  • Define environment groups to specify the hostnames for routing traffic to Apigee environments.

• KMSAutokeyconfig

  • Manage the KMS auto key which simplifies the CMEKs provisioning and assignment.

Feature

New Fields

• SpannerInstance

  • You need to use the alpha.cnrm.cloud.google.com/reconciler: direct annotation on SpannerInstance resource to opt-in these features.

    • spec.autoscalingConfig
    • spec.edition

SecretManagerSecretVersion Reconciliation Improvements

• You can use the alpha.cnrm.cloud.google.com/reconciler: direct annotation on the object to opt-in the direct controller, which gives the following improvements:

  • Resolved update stalling caused by DependencyNotReady errors.
  • Fixed the friction in spec.enabled that enabling or disabling a secret version does not always take effect in GCP.
  • API Behavior Change The service generated ID is changed from spec.resourceID to status.version with status.externalRef (new field) to guardrail the identity.

Fixed

• Dataflowflextemplatejob subnetwork validation error.
  • Error message should match regions/REGION/subnetworks/SUBNETWORK

Feature

New Fields

• BigQueryDataTransferConfig

  • Added spec.scheduleOptionsV2 to customize the different types of data transfer schedule.
  • Added status.observedState.error with detailed information about reason of the latest config failure.

• GkeHubFeatureMembership

  • Added spec.configmanagement.management to enable Config Sync Auto Upgrade. This is an opt-in feature and you need to turn on the alpha.cnrm.cloud.google.com/reconciler: direct annotation on the object.

Announcement

Config Connector version 1.127.0 is now available.

Feature

New Beta resources (direct reconciler)

• BigQueryAnalyticsHubListing

• FirestoreDatabase

• WorkstationConfig

• Workstation

Change

SecretManagerSecret Reconciliation Improvements

• You can use the alpha.cnrm.cloud.google.com/reconciler: direct annotation on the object to opt-in the direct controller, which gives the following improvements:

  • Enhanced spec.rotation.nextRotationTime to use a fixed datetime value to avoid relative now() friction.
  • Fixed the spec.replication.auto immutable issue
  • Added the in-use version aliases in status.observedState.versionAliases
  • Resolved update stalling issues.
  • Clarify the TTL use. See the problems and share your use in GitHub issue #3395

Config Connector version 1.126.0 is now available.

Feature

Use BigQueryConnectionConnection to provide the IAM Service Account

• IAMPolicyMember

  • Added spec.memberFrom.bigQueryConnectionConnectionRef
  • See an example on IAMPolicyMember use BigqueryConectionConnection "cloudSQL"

• IAMPartialPolicy

  • Added spec.memberFrom.bigQueryConnectionConnectionRef.

Announcement

Config Connector system management CRDs ControllerReconciler and NamespacedControllerReconciler are promoted to Beta. See how to configure the Controller manager rate limit.

Feature

New Beta resources (direct reconciler)

• BigQueryTransferConfig

  • Manage the metadata needed to perform a BigQuery data transfer.

• KMSKeyHandle

  • Manage the provisioning of a CryptoKey.

Change

New Alpha Resources

• Add new resource WorkstationConfig