This release contains breaking changes that modernize the Velero Backup template with new fields and stricter rendering behavior.

Breaking Changes

1. defaultVolumesToRestic deprecated (#436)

defaultVolumesToRestic is now deprecated in favor of defaultVolumesToFsBackup. The old key still works but will be removed in a future release. Migrate your values:

backup:
  # defaultVolumesToRestic: true  # deprecated
  defaultVolumesToFsBackup: true   # use this instead

2. Backup requires Velero API to be available (#436)

The Backup resource is no longer rendered silently when Velero is not installed. If the velero.io/v1 API group is not available in the cluster, the template will fail with an explicit error message instead of rendering a resource that cannot be applied.

3. Optional fields no longer rendered when unset (#436)

snapshotVolumes, storageLocation, and ttl were previously always included in the Backup manifest regardless of whether they were set. They are now conditionally rendered and will be absent from the output when not explicitly configured.

If you rely on these fields being present (e.g., for GitOps diff stability), set them explicitly:

backup:
  snapshotVolumes: true
  storageLocation: default
  ttl: 720h0m0s

4. labelSelector.matchLabels uses selectorLabels (#436)

The Backup labelSelector.matchLabels now uses the standard selectorLabels helper instead of a hardcoded part-of label. If you rely on the previous label selector behavior, verify your backup selection still matches the expected workloads.

Notable Additions

New Velero backup fields are now supported:

• defaultVolumesToFsBackup
• snapshotMoveData
• csiSnapshotTimeout
• datamover
• itemOperationTimeout
• volumeSnapshotLocations
• includedNamespaceScopedResources
• excludedNamespaceScopedResources
• orderedResources

What's Changed

• feat(backup)!: add support for new velero fields by @Copilot in #436

Full Changelog: v8.2.0...v9.0.0

What's Changed

• chore(deps): update dependency prek to v0.4.1 by @renovate[bot] in #537
• chore(deps): update docker/login-action digest to 650006c by @renovate[bot] in #540
• chore(deps): update ad-m/github-push-action action to v1.2.0 by @renovate[bot] in #541
• chore(deps): update ad-m/github-push-action action to v1.3.0 by @renovate[bot] in #542
• chore(deps): update dependency prek to v0.4.2 by @renovate[bot] in #543
• chore(deps): update dependency prek to v0.4.3 by @renovate[bot] in #544
• chore(renovate): ignore unresolved placeholder image dependency by @Copilot in #545
• chore(deps): update bridgecrewio/checkov-action action to v12.3103.0 - autoclosed by @renovate[bot] in #546
• chore(deps): update bridgecrewio/checkov-action action to v12.3104.0 by @renovate[bot] in #548
• feat(schema): use comma-separated helm-docs type hints by @aslafy-z in #539
• chore(deps): update actions/checkout digest to df4cb1c by @renovate[bot] in #549

Full Changelog: v8.1.2...v8.2.0

What's Changed

• fix(schema): accept IntOrString and null for targetPort and pdb fields by @aslafy-z in #536

Full Changelog: v8.1.1...v8.1.2

What's Changed

• chore(test): stabilize snapshot by overriding chart version by @aslafy-z in #535
• fix(schema): accept string for service targetPort by @aslafy-z in #534

Full Changelog: v8.1.0...v8.1.1

Highlights

• JSON Schema for Helm values is now shipped with the chart, enabling IDE autocompletion and validation.
• Extra objects rendering is now deterministic thanks to sorted map keys.

What's Changed

• chore(docs): document json schema by @aslafy-z in 97a626f
• fix(extraobjects): sort map keys for deterministic rendering by @aslafy-z in 300be00
• chore: add helm values schema by @aslafy-z in #531
• chore(deps): update github artifact actions (major) by @renovate[bot] in #521
• chore(deps): update docker.io/nginx docker tag to v1.31.0 by @renovate[bot] in #523
• chore(deps): update dependency helm to v4.2.0 by @renovate[bot] in #525
• chore(deps): update dependency prek to v0.4.0 by @renovate[bot] in #529
• chore(mise): update tasks by @aslafy-z in #532
• chore(mise): add unit-test task by @aslafy-z in e308d5d
• chore(chart): clean up Chart.yaml formatting by @aslafy-z in 134c2c3
• chore(chart): update description and keywords by @aslafy-z in a287e26
• chore(test): add snapshot testing by @aslafy-z in #528
• chore(test): align image values by @aslafy-z in #530
• chore(test): use non existing image for init container values by @aslafy-z in 2d31e76
• chore(test): remove additional references to nginx image by @aslafy-z in fa33b96
• test(chart): add endpointmonitor unit tests by @aslafy-z in #522
• docs(chart): add contributing guide by @aslafy-z in ef5a5c2
• docs(chart): add OCI registry install instructions by @aslafy-z in 3b3f03e
• docs(chart): update project description by @aslafy-z in 9734cf3
• docs(chart): move CI scope section after install/uninstall by @aslafy-z in 9134997

Full Changelog: v8.0.0...v8.1.0

This release contains breaking changes that standardize resource naming across all templates.

Breaking Changes

1. Resource names now use the release name as default prefix (#466)

The application.name helper now defaults to .Release.Name instead of .Chart.Name when applicationName is not set. All resource names are generated using a consistent printf | trunc 63 | trimSuffix "-" pattern.

If you were relying on the chart name as the default, set applicationName explicitly:

applicationName: application

2. PVC name change — risk of data loss

If applicationName was not set, the PVC name changes from <chartName>-data to <releaseName>-data. This will create a new PVC and orphan the existing one, causing data loss.

To prevent drift, set persistence.name to your current PVC name before upgrading:

persistence:
  name: <your-current-pvc-name>

3. Resources now prefixed with release/application name

Resources that previously used standalone or value-only names are now prefixed:

4. Redundant type suffixes removed

What's Changed

• feat!: prefix all resource names with release name by @aslafy-z in #466

Full Changelog: v7.0.0...v8.0.0

This release contains four breaking changes that align CronJob and Job templates with existing Deployment conventions, tighten security defaults, and remove deprecated features.

Breaking Changes

1. Service account binding harmonized (#363)

• rbac.serviceAccount.enabled renamed to rbac.serviceAccount.create

• automountServiceAccountToken now defaults to false for Deployments, CronJobs, and Jobs. If your workloads call the Kubernetes API, explicitly set automountServiceAccountToken: true on the relevant resource.

• ServiceAccount name resolution is now consistent across all resource types via a new application.serviceAccountName helper:

  create	name	Result
  true	""	<release-name>
  true	"foo"	"foo"
  false	""	"default"
  false	"bar"	"bar"

2. Default part-of label removed (#455)

app.kubernetes.io/part-of is no longer added by default. If you rely on this label, set partOfOverride explicitly:

partOfOverride: my-application

3. List-based envFrom removed for Jobs and CronJobs (#518)

The deprecated list-based envFrom format (raw Kubernetes list) is removed. Use the dict-based format:

cronJob:
  jobs:
    example:
      envFrom:
        my-secret:
          type: secret
          name: my-secret

4. Pod security context support for CronJob and Job (#498)

cronJob.jobs.<name>.securityContext now maps to the pod-level security context. The previous container-level key is renamed to containerSecurityContext:

cronJob:
  jobs:
    example:
      containerSecurityContext:  # was securityContext
        runAsNonRoot: true
      securityContext:           # new, pod-level
        fsGroup: 20000

Job templates gain containerSecurityContext support (additive, no migration needed).

What's Changed

• chore(deps): update dependency helm to v4 by @renovate[bot] in #520
• chore(deps): update ad-m/github-push-action action to v1 by @renovate[bot] in #519
• feat!: harmonize service account binding by @aslafy-z in #363
• feat!: drop default part-of label, require explicit override by @aslafy-z in #455
• feat!: remove deprecated list-based envFrom for Jobs and CronJobs by @aslafy-z in #518
• feat!: add pod security context support to CronJob and Job by @alex1989hu in #498

Full Changelog: v6.18.0...v7.0.0

What's Changed

• feat: add clusterrole/binding support by @rasta-rocket in #421

New Contributors

• @rasta-rocket made their first contribution in #421

Full Changelog: v6.17.1...v6.18.0

What's Changed

• chore(deps): update dependency ubi:helm-unittest/helm-unittest to v1.1.0 by @renovate[bot] in #517
• chore(deps): update dependency prek to v0.3.13 by @renovate[bot] in #516
• fix(httpRoute): port property to render as integer instead of string by @Copilot in #488

Full Changelog: v6.17.0...v6.17.1

What's Changed

• feat: add enableServiceLinks support to Deployment by @alex1989hu in #476
• chore(deps): update bridgecrewio/checkov-action action to v12.3088.0 by @renovate[bot] in #484
• chore(deps): update bridgecrewio/checkov-action action to v12.3100.0 by @renovate[bot] in #494
• chore(deps): update bridgecrewio/checkov-action action to v12.3101.0 by @renovate[bot] in #503
• ci: refactor CI/CD workflows by @aslafy-z in #504
• ci: replace python3 YAML check with yamllint and fix template lint issues by @aslafy-z in #510
• chore(deps): update softprops/action-gh-release action to v3 by @renovate[bot] in #501
• chore(deps): update stefanprodan/helm-gh-pages digest to 0ad2bb3 by @renovate[bot] in #509
• chore(deps): update ad-m/github-push-action digest to d91a481 by @renovate[bot] in #508
• chore: setup mise-en-place by @aslafy-z in #450
• chore(deps): update actions/checkout action to v6 by @renovate[bot] in #512
• chore(deps): update docker.io/nginx docker tag to v1.30.0 by @renovate[bot] in #511
• chore(config): migrate Renovate config by @renovate[bot] in #513
• feat: support envFrom from external secrets and configmaps for Deployments, Jobs, and CronJobs by @Copilot in #491
• chore(deps): update dependency helm to v3.20.2 by @renovate[bot] in #515
• chore(deps): pin busybox docker tag to 1487d0a by @renovate[bot] in #514

Full Changelog: v6.16.1...v6.17.0