build(deps): bump github.com/VictoriaMetrics/operator/api from 0.73.1 to 0.74.1

[dependabot]

Bumps github.com/VictoriaMetrics/operator/api from 0.73.1 to 0.74.1.

Release notes

Sourced from github.com/VictoriaMetrics/operator/api's releases.

v0.74.1

• BUGFIX: vldistributed: add validation webhook for VLDistributed resources.

v0.74.0

Update note 1: vmoperator: validation webhooks for prometheus-operator CRDs added to the operator in 0.72.0 is now disabled by default. Use VM_PROMCR_VALIDATION_ENABLED env var to enable it explicitly.

• Dependency: vmoperator: Updated default versions for VM apps to v1.148.0 version

• Dependency: vmoperator: Updated default versions for VL apps to v1.52.0.

• Dependency: vmoperator: Updated default versions for VT apps to v0.10.0 version.

• Dependency: vmoperator: Updated default versions for VMAnomaly to v1.30.0 version

• FEATURE: vmanomaly: support Temporal Envelope models, online-model history strength and warmup settings, causal and complexity-aware autotune options, and separate reader fetch and processing controls introduced in vmanomaly v1.30.0. See #2440.

• FEATURE: vmoperator: add networkPolicy field to all supported CRDs (VMSingle, VMAgent, VMAlert, VMAlertmanager, VMAuth, VLSingle, VLAgent, VTSingle, VMAnomaly, and all cluster sub-components). When set, the operator creates and manages a NetworkPolicy resource that restricts ingress/egress to the component's pods. See #2977.

• BUGFIX: vmoperator: grant the operator's ClusterRole permissions on networking.k8s.io/networkpolicies. The networkPolicy feature above was shipped without this grant, so the operator would fail with a Forbidden error creating/updating/deleting NetworkPolicy objects on a real cluster.

• FEATURE: vmauth: add opt-in spec.waitForConfigReload field. When enabled, the operator confirms that every replica has actually picked up a config change before marking dependent VMUser objects as applied, so their status can be trusted to reflect what's actually running rather than what was merely written out. vmdistributed's internal VMAuth load balancer always waits for this confirmation before rotating a zone in or out of the backend list, regardless of spec.vmAuth.spec.waitForConfigReload, so traffic is never routed to a zone that's still running a stale config.

• FEATURE: vlagent: add basicAuth field support to remoteWrite entries. See #2371.

• FEATURE: vmcluster: support VMCluster extraStorageNodes for vmselect component.

• FEATURE: vmuser: add defaultVMAccessClaim field to spec.jwt, mapped to vmauth's jwt.default_vm_access_claim. It lets a VMUser accept JWTs that don't carry a vm_access claim, matching vmauth v1.147.0+ behavior. See #2375.

• FEATURE: helm-converter: parse the victoria-metrics-auth chart's config value (vmauth's own native config file). Each config.users entry is converted into a standalone VMUser CR, and config.unauthorized_user is converted into the VMAuth CR's spec.unauthorizedUserAccessSpec. The generated VMUser CRs are appended to the same output file as additional YAML documents, and the VMAuth CR's spec.userSelector is set to a dedicated label matching them, so the operator actually loads them (a bare VMAuth CR's default selectors match nothing). See #2397.

• FEATURE: vmoperator: introduce VLDistributed CR, which controls multiple region-distributed VictoriaLogs clusters.

• BUGFIX: vmoperator: support Ignored status for child objects that were not picked, also do not set Failed status if object was applied on at least one parent object. See #2432.

• BUGFIX: vmoperator: removed library/ component, while building CR images that do not contain / in repo name. See #2409.

• BUGFIX: vmoperator: log only the changed key names and value sizes, instead of the full values, when updating ConfigMap. Previously a single data_diff log line could reach multiple megabytes for large ConfigMaps and break downstream log pipelines with per-line size limits. See #2426.

• BUGFIX: vmagent, vmsingle: add missing list verb to config-reloader's secrets RBAC rule. See #2384.

• BUGFIX: vmoperator: return an error instead of panicking when a Labels map value is malformed (missing the = separator) during config parsing.

• BUGFIX: vmalert: when no notifiers are configured, ignore alerting rules from selected VMRules instead of failing reconciliation; recording rules in the same group are kept and still reconciled. See #2388.

• BUGFIX: vmalertmanager: default pod securityContext.fsGroup to 65534 when persistent storage is configured and neither useStrictSecurity nor a user securityContext is set. Without it the alertmanager process cannot write notification log and silences to a freshly provisioned volume, so silences are silently lost on pod restart. User-provided securityContext and useStrictSecurity keep their previous behaviour.

• BUGFIX: vmoperator: allow pinning images by digest via the image.tag field of all operator CRs. When tag is a digest (e.g. sha256:<hex>) it is now joined to the repository with @ instead of :, producing a valid repository@sha256:<digest> reference. Regular tags are unaffected.

• BUGFIX: helm-converter: fix persistentVolume.storageClassName being dropped during conversion due to a stale storageClass field name. See #2389.

• BUGFIX: helm-converter: fix securityContext.runAsNonRoot, runAsUser, runAsGroup, seccompProfile, appArmorProfile, seLinuxOptions, and windowsOptions being silently dropped during conversion; these are now promoted to spec.securityContext.podSecurityContext, matching how the operator applies them to containers. See #2391.

• BUGFIX: helm-converter: fix TLS/mTLS settings (tlsCAFile, tlsCertFile, tlsKeyFile, tlsServerName, tlsInsecureSkipVerify) on remoteWrite entries being dropped during conversion for vmagent, vlagent, vlcollector, and vmalert charts. See #2390.

• BUGFIX: helm-converter: fix cannot unmarshal object into Go struct field ... headers of type []string error when a chart's default values.yaml ships a headers: {} map (e.g. vmalert's datasource.headers, notifier.headers, remoteWrite.headers); such maps are now normalized to the operator's key:value string-slice format before conversion. See #2398.

• BUGFIX: helm-converter: fix extraVolumes/extraVolumeMounts being silently dropped during conversion for vmsingle, vmagent, vmalert, vmanomaly, vmcluster, vlcluster, vtcluster, vtsingle, vlogs, and vmauth charts. See #2424.

• BUGFIX: vmagent, vmanomaly: target spec.vpa at the VMAgent/VMAnomaly custom resource itself instead of its underlying Deployment/StatefulSet. VPA rejects a targetRef whose owner chain includes another scalable controller, so a VerticalPodAutoscaler targeting the workload directly was silently non-functional whenever the CR exposed a scale subresource. See #2415.

• BUGFIX: vlagent: remove a vestigial scale subresource declaration referencing nonexistent spec/status fields, which unconditionally broke spec.vpa for VLAgent the same way as #2415.

• BUGFIX: vmalert, vmagent, vmalertmanager, vmauth, vmsingle: fix child object selection (VMRule, scrape objects, VMAlertmanagerConfig, VMUser) being silently skipped whenever the parent CR's spec contains a field the running operator version doesn't recognize (e.g. after a CRD/operator version mismatch), even though the CR otherwise reconciles successfully with no errors. See #2444.

Changelog

Sourced from github.com/VictoriaMetrics/operator/api's changelog.

v0.74.1

Release date: 04 August 2026

• FEATURE: vmalertmanagerconfig: add http_headers field to http_config, letting a receiver send custom HTTP headers (literal values, Secret-backed values, or values read from a file) with each notification request. See #2459.

• BUGFIX: vmoperator: fix spec.arbitraryFSAccessThroughSMs.deny silently not rejecting a bearerTokenFile/basicAuth.passwordFile/oauth2.clientSecretFile/authorization.credentialsFile reference whenever tlsConfig wasn't also set, since the check discarded any already-found violation instead of just skipping the (unset) TLS-specific ones.

• BUGFIX: vldistributed: add validation webhook for VLDistributed resources.

• BUGFIX: vmoperator: fix a regression introduced in v0.74.0 where disabling a child-object controller via -controller.disableReconcileFor, directly or transitively through its parent (e.g. VMUser via VMAuth), could crash the operator on startup with cannot register status condition indexers. See #2478.

v0.74.0

Release date: 30 July 2026

Update note 1: vmoperator: validation webhooks for prometheus-operator CRDs added to the operator in 0.72.0 is now disabled by default. Use VM_PROMCR_VALIDATION_ENABLED env var to enable it explicitly.

• Dependency: vmoperator: Updated default versions for VM apps to v1.148.0 version

• Dependency: vmoperator: Updated default versions for VL apps to v1.52.0.

• Dependency: vmoperator: Updated default versions for VT apps to v0.10.0 version.

• Dependency: vmoperator: Updated default versions for VMAnomaly to v1.30.0 version

• FEATURE: vmanomaly: support Temporal Envelope models, online-model history strength and warmup settings, causal and complexity-aware autotune options, and separate reader fetch and processing controls introduced in vmanomaly v1.30.0. See #2440.

• FEATURE: vmoperator: add networkPolicy field to all supported CRDs (VMSingle, VMAgent, VMAlert, VMAlertmanager, VMAuth, VLSingle, VLAgent, VTSingle, VMAnomaly, and all cluster sub-components). When set, the operator creates and manages a NetworkPolicy resource that restricts ingress/egress to the component's pods. See #2977.

• BUGFIX: vmoperator: grant the operator's ClusterRole permissions on networking.k8s.io/networkpolicies. The networkPolicy feature above was shipped without this grant, so the operator would fail with a Forbidden error creating/updating/deleting NetworkPolicy objects on a real cluster.

• FEATURE: vmauth: add opt-in spec.waitForConfigReload field. When enabled, the operator confirms that every replica has actually picked up a config change before marking dependent VMUser objects as applied, so their status can be trusted to reflect what's actually running rather than what was merely written out. vmdistributed's internal VMAuth load balancer always waits for this confirmation before rotating a zone in or out of the backend list, regardless of spec.vmAuth.spec.waitForConfigReload, so traffic is never routed to a zone that's still running a stale config.

• FEATURE: vlagent: add basicAuth field support to remoteWrite entries. See #2371.

• FEATURE: vmcluster: support VMCluster extraStorageNodes for vmselect component.

• FEATURE: vmuser: add defaultVMAccessClaim field to spec.jwt, mapped to vmauth's jwt.default_vm_access_claim. It lets a VMUser accept JWTs that don't carry a vm_access claim, matching vmauth v1.147.0+ behavior. See #2375.

• FEATURE: helm-converter: parse the victoria-metrics-auth chart's config value (vmauth's own native config file). Each config.users entry is converted into a standalone VMUser CR, and config.unauthorized_user is converted into the VMAuth CR's spec.unauthorizedUserAccessSpec. The generated VMUser CRs are appended to the same output file as additional YAML documents, and the VMAuth CR's spec.userSelector is set to a dedicated label matching them, so the operator actually loads them (a bare VMAuth CR's default selectors match nothing). See #2397.

• FEATURE: vmoperator: introduce VLDistributed CR, which controls multiple region-distributed VictoriaLogs clusters.

• BUGFIX: vmoperator: support Ignored status for child objects that were not picked, also do not set Failed status if object was applied on at least one parent object. See #2432.

• BUGFIX: vmoperator: removed library/ component, while building CR images that do not contain / in repo name. See #2409.

• BUGFIX: vmoperator: log only the changed key names and value sizes, instead of the full values, when updating ConfigMap. Previously a single data_diff log line could reach multiple megabytes for large ConfigMaps and break downstream log pipelines with per-line size limits. See #2426.

• BUGFIX: vmagent, vmsingle: add missing list verb to config-reloader's secrets RBAC rule. See #2384.

• BUGFIX: vmoperator: return an error instead of panicking when a Labels map value is malformed (missing the = separator) during config parsing.

• BUGFIX: vmalert: when no notifiers are configured, ignore alerting rules from selected VMRules instead of failing reconciliation; recording rules in the same group are kept and still reconciled. See #2388.

• BUGFIX: vmalertmanager: default pod securityContext.fsGroup to 65534 when persistent storage is configured and neither useStrictSecurity nor a user securityContext is set. Without it the alertmanager process cannot write notification log and silences to a freshly provisioned volume, so silences are silently lost on pod restart. User-provided securityContext and useStrictSecurity keep their previous behaviour.

• BUGFIX: vmoperator: allow pinning images by digest via the image.tag field of all operator CRs. When tag is a digest (e.g. sha256:<hex>) it is now joined to the repository with @ instead of :, producing a valid repository@sha256:<digest> reference. Regular tags are unaffected.

• BUGFIX: helm-converter: fix persistentVolume.storageClassName being dropped during conversion due to a stale storageClass field name. See #2389.

• BUGFIX: helm-converter: fix securityContext.runAsNonRoot, runAsUser, runAsGroup, seccompProfile, appArmorProfile, seLinuxOptions, and windowsOptions being silently dropped during conversion; these are now promoted to spec.securityContext.podSecurityContext, matching how the operator applies them to containers. See #2391.

• BUGFIX: helm-converter: fix TLS/mTLS settings (tlsCAFile, tlsCertFile, tlsKeyFile, tlsServerName, tlsInsecureSkipVerify) on remoteWrite entries being dropped during conversion for vmagent, vlagent, vlcollector, and vmalert charts. See #2390.

• BUGFIX: helm-converter: fix cannot unmarshal object into Go struct field ... headers of type []string error when a chart's default values.yaml ships a headers: {} map (e.g. vmalert's datasource.headers, notifier.headers, remoteWrite.headers); such maps are now normalized to the operator's key:value string-slice format before conversion. See #2398.

• BUGFIX: helm-converter: fix extraVolumes/extraVolumeMounts being silently dropped during conversion for vmsingle, vmagent, vmalert, vmanomaly, vmcluster, vlcluster, vtcluster, vtsingle, vlogs, and vmauth charts. See #2424.

• BUGFIX: vmagent, vmanomaly: target spec.vpa at the VMAgent/VMAnomaly custom resource itself instead of its underlying Deployment/StatefulSet. VPA rejects a targetRef whose owner chain includes another scalable controller, so a VerticalPodAutoscaler targeting the workload directly was silently non-functional whenever the CR exposed a scale subresource. See #2415.

• BUGFIX: vlagent: remove a vestigial scale subresource declaration referencing nonexistent spec/status fields, which unconditionally broke spec.vpa for VLAgent the same way as #2415.

• BUGFIX: vmalert, vmagent, vmalertmanager, vmauth, vmsingle: fix child object selection (VMRule, scrape objects, VMAlertmanagerConfig, VMUser) being silently skipped whenever the parent CR's spec contains a field the running operator version doesn't recognize (e.g. after a CRD/operator version mismatch), even though the CR otherwise reconciles successfully with no errors. See #2444.

Commits

• 5e62d6b docs: prepare 0.74.1 release (#2472)
• a9934f9 fix(deps): update module github.com/prometheus-operator/prometheus-operator/p...
• 4b382ad fix(deps): update module github.com/victoriametrics/operator/api to v0.74.0 (...
• 10b394e chore(deps): update github/codeql-action action to v4.37.0 (#2469)
• b8ed441 feat: add VLDistributed admission webhook (#2468)
• 802842b docs: add vldistributed page (#2467)
• 4442ad4 test: add upgrade tests for 0.74.0 (#2464)
• ca0f602 docs: prepare release 0.74.0 (#2462)
• 8ce4079 vmauth: check configuration hash unconditionally (#2463)
• 323303b operator: added Ignored status for child objects, do not mark object as faile...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)