#Release Notes

#Compatibility and support matrix

The following table shows the compatibility and support matrix between the Alauda DevOps Connectors operator and ACP versions.

#v1.12.0

#Features and Enhancements

• Added the enable-pod-image-pull-via-connector feature flag (default off) to gate the OCI/Harbor PodWebhook's auto-rewrite of Pod container image addresses to the Connector Proxy URL. See Feature Flags.
• Added the enable-connector-apis-write-passthrough feature flag (default off) to enable write methods (POST/PUT/DELETE/PATCH) on the Connectors API gateway. Authorization for enabled writes follows the same fine-grained SAR chain used for GET, controlled by enable-connector-apis-permissions. See Feature Flags and Write methods (passthrough).
• Package the Connectors UI as a Console service-backend plugin managed by the operator.
• Added a guide for migrating Alauda DevOps v3 Integration and ClusterIntegration resources to Connectors using the int2conn CLI. See Migrating v3 Integrations to Connectors.

ConnectorsConfig Management

• Introduced ConnectorsConfig — a cluster-singleton CR that manages all connector components from a single spec, replacing the need to manage individual component CRs (ConnectorsCore, ConnectorsGit, ConnectorsHarbor, etc.) directly. The operator auto-creates a ConnectorsConfig on startup and automatically adopts any existing standalone component CRs. Configure the shared registry, labels, annotations, and feature flags once for all components, with per-component overrides where needed. See Installation.
• Added spec.installFlags to ConnectorsConfig to control installation behavior for specific cluster configurations. The pipeline-integration flag allows administrators to cap which ResourceInterface schema versions are deployed on clusters running legacy Tekton releases. See Install Flags and Feature Maturity.

SonarQube Connector Enhancements

• Provide the sonarqube-connector-automatic-creation Tekton Task to automate SonarQube project creation and connector initialization for Alauda Container Platform tenants and namespaces. Supports SonarQube 8.9.2 LTS and 25.1 LTA. More details:
  • Automatically Create and Reconcile SonarQube Connector Resources with Tekton

GitLab Connector Enhancements

• Provide the gitlab-connector-automatic-creation Tekton Task to automate GitLab Personal Access Token initialization, rotation, and credential refresh for Alauda Container Platform tenants and namespaces. More details:
  • Automatically Create and Reconcile GitLab Connector Resources with Tekton

Nexus Connector Enhancements

• Provide the nexus-connector-automatic-creation Tekton Task to automate Nexus connector initialization and credential refresh for Alauda Container Platform tenants and namespaces. More details:
  • It can create or reconcile Nexus repositories (hosted, proxy, group), scoped user + role + per-repository privileges, the Connector authentication Secret, and the Nexus Connector resource, with rerun-based self-healing for partial failures.
  • Automatically Create and Reconcile Nexus Connector Resources with Tekton

CSI Driver Enhancements

• The CSI Driver built-in configuration now includes a .curlrc file that workloads can pass to curl --config to configure proxy and TLS settings without exporting environment variables. When using an HTTPS destination behind a TLS-intercepting forward proxy, pass --cacert /{mount-path}/ca.crt alongside --config to satisfy certificate verification. See Built-in Configurations.

Git Connector Enhancements

• Git and GitLab ConnectorClasses now scope the proxy Authorization header to the proxy address ([http "<proxyAddress>"]) in the rendered .gitconfig, so the credential is not sent to other hosts such as submodule servers on a different Git instance. See Git ConnectorClass.

Harbor Connector Enhancements

• The harborCliImage parameter of the harbor-connector-automatic-creation task now has a built-in default and can be omitted in most deployments.
• The permissions parameter now supports a multi-resource format (<resource1>:<verbs>;<resource2>:<verbs>), allowing a single entry to grant access to multiple Harbor resource types for the same project. The existing single-resource format remains fully supported. See Using Harbor Connector Automatic Creation Task.

Security updates

• The operator pod now uses an explicit projected ServiceAccount token volume and sets automountServiceAccountToken: false, resolving Kubescape control C-0190.
• Updated base images and resolved security vulnerabilities in OpenSSL (CVE-2026-45447 and related CVEs).
• Updated Go toolchain to 1.26.4, resolving GO-2026-5039 (net/textproto), GO-2026-5038 (mime), and GO-2026-5037 (crypto/x509).

#Fixed Issues

• Before this update, when cloning a repository with submodules hosted on a different git server through a git-family Connector (git/gitlab/github), the submodule clone fails with 401/403 because the Connector proxy authentication header is sent globally to all servers. With this update, the authentication header is scoped to the proxy address only, so submodules from other git servers clone successfully, while submodules on the same Connector server remain unaffected.
• Before this update, when the custom CA certificate feature is enabled, Harbor Connector proxy client silently bypasses TLS verification, allowing connections with wrong CA certificates to succeed. With this update, when the custom CA certificate feature is enabled, Harbor Connector correctly performs TLS verification, rejecting connections with wrong CA certificates and accepting connections with correct CA certificates.
• Before this update, when using SonarQube Connector to run code scanning against SonarQube 8.9/9.9 servers, the scan fails with "You are not authorized to run analysis" due to incompatible authentication method. With this update, SonarQube Connector automatically adapts authentication to the server version, using Basic token auth on older versions and preferring Bearer token on newer versions, so scanning completes successfully.
• Before this update, the Connector forward proxy MITM-intercepted every HTTPS CONNECT request. As a result, in Tekton buildah task Containerfile RUN steps, requests to non-connector destinations such as curl, apt-get, and wget were also routed through the MITM proxy, forcing clients to trust the proxy CA even when the traffic did not need Connector interception. This caused major friction for buildah-based builds. With this update, the forward proxy chooses behavior based on whether the target matches a connector address: requests to connector addresses continue to use MITM with auth injection, while requests to non-connector addresses fall back to a transparent tunnel so the client sees the real upstream certificate and no proxy CA trust is required. This preserves proxy behavior for connector traffic while avoiding the incorrect CA requirement for unrelated HTTPS requests.

#Known Issues

No issues in this release.

#v1.10.1

#Features and Enhancements

• Security updates: Updated base images, dependencies, and resolved security vulnerabilities.

#Fixed Issues

• Before this update, the Connector forward proxy MITM-intercepted every HTTPS CONNECT request. As a result, in Tekton buildah task Containerfile RUN steps, requests to non-connector destinations such as curl, apt-get, and wget were also routed through the MITM proxy, forcing clients to trust the proxy CA even when the traffic did not need Connector interception. This caused major friction for buildah-based builds. With this update, the forward proxy chooses behavior based on whether the target matches a connector address: requests to connector addresses continue to use MITM with auth injection, while requests to non-connector addresses fall back to a transparent tunnel so the client sees the real upstream certificate and no proxy CA trust is required. This preserves proxy behavior for connector traffic while avoiding the incorrect CA requirement for unrelated HTTPS requests.

#Known Issues

No issues in this release.

#v1.10.0 (LTS)

#Features and Enhancements

New Connectors

• Support integration with GitHub by using GitHub Connector. More details:
  • GitHub Connector Quick Start
• Support integration with JFrog Artifactory by using JFrog Connector. More details:
  • JFrog Connector Quick Start
• Support integration with Nexus Repository by using Nexus Connector. More details:
  • Nexus Connector Quick Start

Permission and Access Control

• Added an additional connectors/apis permission validation for Connector API access.
  • When enable-connector-apis-permissions is enabled, the system performs an additional connectors/apis permission check for Connectors API requests that browse tool data. This change separates Connector discovery from actual Connector API usage.
  • For more details, see Connectors Permission Model and Connector API.
• Added an additional connectors/proxy permission validation for Connectors Proxy access.
  • When enable-connector-proxy-permissions is enabled, the system performs an additional connectors/proxy permission check before workloads or CLIs use proxy-based Connector access. This change separates Connector discovery from actual runtime use.
  • For more details, see Connectors Permission Model and Connectors Proxy.
• Added approval-gated access control for protected Connectors Proxy usage.
  • When enable-connectors-approval is enabled together with enable-connector-proxy-permissions, administrators can use AccessPolicy and AccessRequest to require approval before a workload is allowed to use protected Connector proxy access.
  • For more details, see Connectors Approval & Permission Gating.
• Added ACP platform roles for AccessPolicy and AccessRequest resources, so approval resources follow the expected platform, project, and namespace permission model.

Feature Flag Management

• Support declarative feature flag configuration through the ConnectorsCore CR spec.featureFlags field. CR values override manifest defaults during reconciliation, eliminating the need to manually edit the connectors-config ConfigMap. For more details, see Feature Flags.

Harbor Connector Enhancements

• Support mounting harbor-cli-config from Harbor Connector so workloads can use harbor-cli through the connector proxy without exposing the original Harbor credential. More details:
  • Harbor CLI configuration
• Provide the harbor-connector-automatic-creation Tekton Task to automate Harbor connector initialization and credential refresh for Alauda Container Platform tenants and namespaces. More details:
  • It can create or reconcile Harbor projects, robot accounts, Connector Secrets, Harbor Connectors, and target namespace imagePullSecrets.
  • Automatically Create and Reconcile Harbor Connector Resources with Tekton

Custom CA Certificates

• Support custom CA certificates for Connectors that target tools served by an internal or private Certificate Authority (CA), preserving TLS verification instead of disabling it. When the enable-custom-ca-certs feature flag is enabled, administrators can register cluster-wide CA bundles via labeled Secrets in the system namespace and Connector authors can additionally provide a per-Connector CA via spec.caCertSecretRef. The resulting trust pool is additive (system + global + per-connector) and load status is surfaced through the informational CACertReady condition. More details:
  • Configure Custom CA Certificates
  • Connector concepts: Custom CA Certificates

Other Enhancements

• Add ca.crt to the Connectors-CSI built-in configuration as a replacement for ca.cert.
• When CSI approval is rejected, the driver now mounts a .error.json file (google.rpc.Status JSON) instead of blocking the Pod, allowing the workload to fail promptly. For more details, see Connectors Approval.

Deprecation Notice

• ca.cert will be deprecated soon in the Connectors-CSI built-in configuration. Please use ca.crt instead. For more details, see: Connectors CSI Built-In Configurations

Security updates

Updated base images, dependencies, and resolved security vulnerabilities

#Breaking Changes

• The Maven ResourceInterface has been renamed from MavenArtifact to MavenRepository. The groupId, artifactId, and version parameters have been removed; the ResourceInterface now exposes a single repository attribute derived from the Connector address. Existing pipelines that reference the old MavenArtifact ResourceInterface or its removed parameters need to be updated.

#Fixed Issues

• Before this update, when Connector accessed GitLab through the forward proxy, requests could carry X-Forwarded and related headers injected by an ALB or gateway. GitLab could return 403 even when the credentials were valid, causing page access or data retrieval to fail. With this update, Connector removes those gateway forwarding headers before forwarding requests, so GitLab access and data retrieval work normally when the credentials are valid.
• Before this update, when users configured an HTTPS Nexus Maven repository with a custom CA certificate in Connector, the Maven authentication check did not use the Connector's CA certificate and could fail certificate validation. With this update, Maven authentication checks use the CA certificate configured on the Connector, so users can complete authentication for HTTPS Nexus Maven repositories normally.

#Known Issues

• Before this update, the Connector forward proxy MITM-intercepted every HTTPS CONNECT request. As a result, in Tekton buildah task Containerfile RUN steps, requests to non-connector destinations such as curl, apt-get, and wget were also routed through the MITM proxy, forcing clients to trust the proxy CA even when the traffic did not need Connector interception. This caused major friction for buildah-based builds. With this update, the forward proxy chooses behavior based on whether the target matches a connector address: requests to connector addresses continue to use MITM with auth injection, while requests to non-connector addresses fall back to a transparent tunnel so the client sees the real upstream certificate and no proxy CA trust is required. This preserves proxy behavior for connector traffic while avoiding the incorrect CA requirement for unrelated HTTPS requests.
• Before this update, the Connector forward proxy MITM-intercepted every HTTPS CONNECT request. As a result, in Tekton buildah task Containerfile RUN steps, requests to non-connector destinations such as curl, apt-get, and wget were also routed through the MITM proxy, forcing clients to trust the proxy CA even when the traffic did not need Connector interception. This caused major friction for buildah-based builds. With this update, the forward proxy chooses behavior based on whether the target matches a connector address: requests to connector addresses continue to use MITM with auth injection, while requests to non-connector addresses fall back to a transparent tunnel so the client sees the real upstream certificate and no proxy CA trust is required. This preserves proxy behavior for connector traffic while avoiding the incorrect CA requirement for unrelated HTTPS requests.

#v1.9.0

#Features and Enhancements

• Support Multiple Connectors in Connectors CSI Driver.
  • Using Multiple Connectors in Connectors CSI Driver
• Support permission control for Connectors Proxy capabilities via AccessPolicy.
• Security updates: Updated base images, dependencies, and resolved security vulnerabilities

#Breaking Changes

#Fixed Issues

No issues in this release.

#Known Issues

No issues in this release.

#v1.8.0

#Features and Enhancements

• Connectors Core Capabilities and existing connectors (Git, OCI, Maven, PyPI, NPM, Kubernetes) have been promoted to Beta maturity level. For more details, see Feature Maturity.
• Add performance description and tuning guide to the documentation. For more details, see Performance Guide.

Deprecation Notice

• Added registry-config configuration to OCI and Harbor ConnectorClasses. The legacy docker-config(oci) and config(harbor) configuration is now deprecated but remains functional for backward compatibility. It will be removed in a future release. When mounting Connector configurations, use registry-config instead of docker-config or config.
• Added registry-config workspace to OCIArtifact and HarborOCIArtifact ResourceInterfaces. The legacy docker-credentials workspace is now deprecated but remains functional for backward compatibility. It will be removed in a future release.

Security updates

Updated base images, dependencies, and resolved security vulnerabilities

#Breaking Changes

No breaking changes.

#Fixed Issues

No issues in this release.

#Known Issues

No issues in this release.

#v1.7.0

#Features and Enhancements

• Support integration with SonarQube and SonarCloud by using SonarQube Connector. more details:
  • SonarQube Connector Quick Start
• Support to deploy the Connectors system in a high availability (HA) configuration to ensure service continuity and fault tolerance. more details:
  • Deploy Connectors in High Availability (HA) Configuration

#Breaking Changes

• When using the built-in forward proxy, proxy authentication information must be included.

#Fixed Issues

No issues in this release.

#Known Issues

No issues in this release.

#v1.6.2

#Features and Enhancements

• Security updates: Updated base images, dependencies, and resolved security vulnerabilities.

#Fixed Issues

• Before this update, the Connector forward proxy MITM-intercepted every HTTPS CONNECT request. As a result, in Tekton buildah task Containerfile RUN steps, requests to non-connector destinations such as curl, apt-get, and wget were also routed through the MITM proxy, forcing clients to trust the proxy CA even when the traffic did not need Connector interception. This caused major friction for buildah-based builds. With this update, the forward proxy chooses behavior based on whether the target matches a connector address: requests to connector addresses continue to use MITM with auth injection, while requests to non-connector addresses fall back to a transparent tunnel so the client sees the real upstream certificate and no proxy CA trust is required. This preserves proxy behavior for connector traffic while avoiding the incorrect CA requirement for unrelated HTTPS requests.
• Before this update, when ConnectorsHarbor or ConnectorsOCI was deployed with NodePort exposure, the generated ConnectorClass could lose its openapi definition, so the Pipeline creation page could not load the Harbor/OCI project and repository options. With this update, the issue has been fixed, and the ConnectorClass keeps the full OpenAPI definition in NodePort deployments, allowing the related dropdown options to load normally.

#Known Issues

No issues in this release.

#v1.6.0 (LTS)

#Features and Enhancements

More Connectors

• Support integration with GitLab Server by using GitLab Connector. more details:
  • GitLab Connector Quick Start
• Support integration with NPM Registries by using NPM Connector. more details:
  • NPM Connector Quick Start
• Support integration with Harbor Registries by using Harbor Connector. more details:
  • Harbor Connector Quick Start

ResourceInterface for Pipeline Integration

• Provides out-of-the-box definitions for GitCodeRepository, OCIArtifact, and MavenArtifact resources, enabling seamless integration of external resources (Git repositories, OCI artifacts, Maven artifacts) into TektonCD pipelines through a unified UI interface. For more details, see
  • ResourceInterface
  • Pipeline Integration
• Support Dynamic Form in ResourceInterface for Pipeline Integration. For more details, see ResourceInterface Dynamic Form.

Connector API Enhancement

• Support accessing tool's original API through the Connector API when the ConnectorClass provides Proxy Service capabilities. The system now supports two ways to access tool resources: using the tool's original API via Proxy Service, or using custom APIs provided for the ConnectorClass. For more details, see Connector API.

ConnectorClass Customization Flexibility

• Support using Rego rules to extract tokens from client requests when using the built-in HTTP reverse proxy. Combined with the existing ability to inject authentication credentials into backend requests through Rego rules, you can now extend the built-in reverse proxy's capabilities to support tools with non-standard HTTP authentication mechanisms.
  • For token extraction configuration, see Custom Rego-based Authentication.
  • For authentication injection configuration, see Injecting Authentication Credentials into Backend Request when using built-in Reverse Proxy.
• Support using request variables in spec.auth.types[].generator.rego to inject authentication credentials into backend requests. more details: Variables Available in Rego.

OCI Connector Forward Proxy

• OCI Connector supports using forward proxy for image operations. For more details, see OCI Connector Forward Proxy.

CSI Driver Built-in Configurations

• Connectors CSI Driver provides built-in configuration files that are always mounted into Pods. For more details, see Built-in Configurations.

Other Enhancements

• Add docs to explain credential permissions required for each connector. more details: Credential Permissions Required.

#Breaking Changes

• Remove the input.xxx variable from spec.auth.types[].generator.rego. Use input.data.xxx instead.

#Fixed Issues

No issues in this release.

#Known Issues

• Before this update, the Connector forward proxy MITM-intercepted every HTTPS CONNECT request. As a result, in Tekton buildah task Containerfile RUN steps, requests to non-connector destinations such as curl, apt-get, and wget were also routed through the MITM proxy, forcing clients to trust the proxy CA even when the traffic did not need Connector interception. This caused major friction for buildah-based builds. With this update, the forward proxy chooses behavior based on whether the target matches a connector address: requests to connector addresses continue to use MITM with auth injection, while requests to non-connector addresses fall back to a transparent tunnel so the client sees the real upstream certificate and no proxy CA trust is required. This preserves proxy behavior for connector traffic while avoiding the incorrect CA requirement for unrelated HTTPS requests.