Prepare for release v0.67.0-rc.0

go.mod

@@ -27,8 +27,8 @@ require (
 	kmodules.xyz/client-go v0.34.3
 	kmodules.xyz/custom-resources v0.34.0
 	kmodules.xyz/monitoring-agent-api v0.34.1
-	kubedb.dev/apimachinery v0.66.0-rc.0
-	kubedb.dev/db-client-go v0.21.0-rc.0
+	kubedb.dev/apimachinery v0.67.0-rc.0
+	kubedb.dev/db-client-go v0.22.0-rc.0
 	kubeops.dev/petset v0.1.1-0.20260709161836-19b3570c41ab
 	sigs.k8s.io/controller-runtime v0.22.4
 	sigs.k8s.io/yaml v1.6.0
@@ -152,7 +152,7 @@ require (
 	go.opentelemetry.io/otel v1.43.0 // indirect
 	go.opentelemetry.io/otel/metric v1.43.0 // indirect
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
-	go.virtual-secrets.dev/apimachinery v0.1.0 // indirect
+	go.virtual-secrets.dev/apimachinery v0.2.0 // indirect
 	golang.org/x/crypto v0.52.0 // indirect
 	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect

go.sum

@@ -502,8 +502,8 @@ go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN8
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
 go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-go.virtual-secrets.dev/apimachinery v0.1.0 h1:m5u/bc7l9ILSMANdJVpxR2SWf8KFv4llPEogMV2HYlg=
-go.virtual-secrets.dev/apimachinery v0.1.0/go.mod h1:/o8QNIs2MoS1UwVoYY5hcWZJ07FM8iXQes85zgePQ3s=
+go.virtual-secrets.dev/apimachinery v0.2.0 h1:+25tNWXvkIAMZSDuZjuIyPUAdwhMjAeu78BVOYvuHeE=
+go.virtual-secrets.dev/apimachinery v0.2.0/go.mod h1:KSrWgHgwGAp+AhLj8e7vziC+2RB4fU0Y0W+nEx5wZRA=
 go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
 go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
@@ -795,10 +795,10 @@ kmodules.xyz/resource-metadata v0.46.1 h1:mm4sWZvQMFJJiLdKlPGxD9Cj6f44SCdHB7Csbk
 kmodules.xyz/resource-metadata v0.46.1/go.mod h1:ejz7IVjhqmj6VH8CVfprocJK/IM++OeunrfUp51ZrIw=
 kmodules.xyz/resource-metrics v0.34.0 h1:cqscgTx3PONxHj6PIySK3sTlKKv8iKTGzRd+S6YSwXg=
 kmodules.xyz/resource-metrics v0.34.0/go.mod h1:R34IKtp5+NqcQz7AQJheBJK6Iem0LqrCbm/55Mn+ECQ=
-kubedb.dev/apimachinery v0.66.0-rc.0 h1:JP1ryqzIe/YynZB9HzeYqMDKVEZ7Iec6AZwNx4vzPqI=
-kubedb.dev/apimachinery v0.66.0-rc.0/go.mod h1:tVMz+Fw+pJ26Rd9mK+rzdEt2EAsMM4pHYfY7rFW1/bE=
-kubedb.dev/db-client-go v0.21.0-rc.0 h1:OjOyCXt9fF8xUFWnMsv6tyRvY7sOkksgQjWbv8GrVNQ=
-kubedb.dev/db-client-go v0.21.0-rc.0/go.mod h1:AWqoU3zuoBYlrKZweBLV+XIv4cNxu+nLohx+PGwrfWk=
+kubedb.dev/apimachinery v0.67.0-rc.0 h1:+BerQvPs70WyWUh+FvJSU2r96xKDEMc9jSS4cMLrXcU=
+kubedb.dev/apimachinery v0.67.0-rc.0/go.mod h1:JDH2CEo4d0f7hySMPrYoPrO70S7MeLDB220U9mebHN4=
+kubedb.dev/db-client-go v0.22.0-rc.0 h1:NQmg3n5Rh53jR/LSOGuC30hHeYAHmpPrT9yjoDVDkVk=
+kubedb.dev/db-client-go v0.22.0-rc.0/go.mod h1:LvBT/TgaQj0LszxyyIrZDKDBRvw6ZZjfMN9BZp0B1vg=
 kubeops.dev/csi-driver-cacerts v0.5.1-0.20260418091014-4f539f46235c h1:ZKmBV3fFfCWQ3jDeWBbUi2J4WjJ2ff88n+cTqJ8ZXT8=
 kubeops.dev/csi-driver-cacerts v0.5.1-0.20260418091014-4f539f46235c/go.mod h1:VNbwC3gTWfmdQCVxd8mkVx+n1+0F1lOA5X3usyZN1rk=
 kubeops.dev/operator-shard-manager v0.0.6-0.20260418091213-65daf7da824d h1:/nZYflp2w1x+wQmxDtHR0Sbzl39fcuaJ66oqgVXBBwQ=

vendor/go.virtual-secrets.dev/apimachinery/apis/config/v1alpha1/secret_store_types.go

@@ -71,10 +71,25 @@ type SecretStoreList struct {
 }
 
 type Vault struct {
-	// Connection url to the secret manager
-	URL string `json:"url"`
-
-	// Name of the vault role to use for the operator
+	// Ref refers to the AppBinding (kmodules.xyz/custom-resources) that
+	// describes how to connect to the Vault/OpenBao server: connection URL and CA
+	// bundle. This is the same AppBinding a KubeVault VaultServer publishes for
+	// its consumers.
+	//
+	// If that AppBinding's spec.parameters carries isolateTenants: true, Secret
+	// reads/writes are routed into the OpenBao/Vault namespace of the tenant that
+	// owns the Secret's Kubernetes namespace (derived from the
+	// ace.appscode.com/client-org label and ace.appscode.com/org-id annotation on
+	// that Kubernetes namespace), instead of the Vault root namespace. Virtual
+	// Secrets never creates or mounts engines in that namespace itself; it only
+	// reads/writes into namespaces KubeVault has already provisioned.
+	Ref kmapi.ObjectReference `json:"ref"`
+
+	// RoleName is the Vault Kubernetes auth role Virtual Secrets logs in as,
+	// bound to the virtual-secrets-server service account. This is distinct
+	// from the AppBinding's own vaultRole parameter, which authenticates
+	// KubeVault's operator, not Virtual Secrets — it must be provisioned
+	// separately by a Vault admin.
 	// +optional
 	RoleName string `json:"roleName,omitempty"`
 }

vendor/go.virtual-secrets.dev/apimachinery/crds/config.virtual-secrets.dev_secretstores.yaml

@@ -99,12 +99,19 @@ spec:
                 type: object
               vault:
                 properties:
+                  ref:
+                    properties:
+                      name:
+                        type: string
+                      namespace:
+                        type: string
+                    required:
+                    - name
+                    type: object
                   roleName:
                     type: string
-                  url:
-                    type: string
                 required:
-                - url
+                - ref
                 type: object
             type: object
         type: object

vendor/kubedb.dev/apimachinery/apis/kubedb/v1alpha2/neo4j_helpers.go

@@ -356,9 +356,6 @@ func (r neo4jStatsService) Path() string {
 
 func (r neo4jStatsService) Scheme() string {
 	scheme := "http"
-	if r.Spec.TLS != nil && r.Spec.TLS.HTTP.Mode != TLSModeDisabled {
-		scheme = "https"
-	}
 	return scheme
 }
 

vendor/kubedb.dev/apimachinery/apis/kubedb/v1alpha2/rabbitmq_helpers.go

@@ -26,6 +26,7 @@ import (
 	catalog "kubedb.dev/apimachinery/apis/catalog/v1alpha1"
 	"kubedb.dev/apimachinery/apis/kubedb"
 	"kubedb.dev/apimachinery/crds"
+	apiutils "kubedb.dev/apimachinery/pkg/utils"
 
 	promapi "github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring/v1"
 	"gomodules.xyz/pointer"
@@ -52,9 +53,13 @@ func (r *RabbitMQ) CustomResourceDefinition() *apiextensions.CustomResourceDefin
 
 type RabbitmqApp struct {
 	*RabbitMQ
+	name string
 }
 
 func (r RabbitmqApp) Name() string {
+	if r.name != "" {
+		return r.name
+	}
 	return r.RabbitMQ.Name
 }
 
@@ -63,7 +68,14 @@ func (r RabbitmqApp) Type() appcat.AppType {
 }
 
 func (r *RabbitMQ) AppBindingMeta() appcat.AppBindingMeta {
-	return &RabbitmqApp{r}
+	return &RabbitmqApp{RabbitMQ: r}
+}
+
+func (r *RabbitMQ) ManagementAppBindingMeta() appcat.AppBindingMeta {
+	return &RabbitmqApp{
+		RabbitMQ: r,
+		name:     meta_util.NameWithSuffix(r.AppBindingMeta().Name(), "management"),
+	}
 }
 
 func (r *RabbitMQ) GetConnectionScheme() string {
@@ -74,6 +86,30 @@ func (r *RabbitMQ) GetConnectionScheme() string {
 	return scheme
 }
 
+func (r *RabbitMQ) GetAMQPEndpoint() (string, int32) {
+	if r.Spec.EnableSSL && !r.Spec.DisableSecurity {
+		return "amqps", kubedb.RabbitMQAMQPSPort
+	}
+	return "amqp", kubedb.RabbitMQAMQPPort
+}
+
+func (r *RabbitMQ) GetManagementEndpoint() (string, int32) {
+	if r.Spec.EnableSSL && !r.Spec.DisableSecurity {
+		return "https", kubedb.RabbitMQManagementUIPortWithSSL
+	}
+	return "http", kubedb.RabbitMQManagementUIPort
+}
+
+func (r *RabbitMQ) GetAMQPConnectionURL(username, password string) string {
+	scheme, port := r.GetAMQPEndpoint()
+	return fmt.Sprintf("%s://%s:%s@%s.%s.svc.%s:%d/", scheme, username, password, r.ServiceName(), r.Namespace, apiutils.FindDomain(), port)
+}
+
+func (r *RabbitMQ) GetManagementConnectionURL() string {
+	scheme, port := r.GetManagementEndpoint()
+	return fmt.Sprintf("%s://%s.%s.svc.%s:%d", scheme, r.DashboardServiceName(), r.Namespace, apiutils.FindDomain(), port)
+}
+
 func (r *RabbitMQ) GetAuthSecretName() string {
 	if r.Spec.AuthSecret != nil && r.Spec.AuthSecret.Name != "" {
 		return r.Spec.AuthSecret.Name

vendor/modules.txt

@@ -1941,7 +1941,7 @@ go.opentelemetry.io/otel/trace
 go.opentelemetry.io/otel/trace/embedded
 go.opentelemetry.io/otel/trace/internal/telemetry
 go.opentelemetry.io/otel/trace/noop
-# go.virtual-secrets.dev/apimachinery v0.1.0
+# go.virtual-secrets.dev/apimachinery v0.2.0
 ## explicit; go 1.25.0
 go.virtual-secrets.dev/apimachinery/apis/config/v1alpha1
 go.virtual-secrets.dev/apimachinery/apis/virtual/v1alpha1
@@ -2698,7 +2698,7 @@ kmodules.xyz/resource-metrics/kubedb.com/v1
 kmodules.xyz/resource-metrics/kubedb.com/v1alpha2
 kmodules.xyz/resource-metrics/kubevault.com/v1alpha2
 kmodules.xyz/resource-metrics/ops.kubedb.com/v1alpha1
-# kubedb.dev/apimachinery v0.66.0-rc.0
+# kubedb.dev/apimachinery v0.67.0-rc.0
 ## explicit; go 1.25.0
 kubedb.dev/apimachinery/apis
 kubedb.dev/apimachinery/apis/archiver/v1alpha1
@@ -2749,7 +2749,7 @@ kubedb.dev/apimachinery/pkg/factory
 kubedb.dev/apimachinery/pkg/secret
 kubedb.dev/apimachinery/pkg/utils
 kubedb.dev/apimachinery/pkg/utils/raft
-# kubedb.dev/db-client-go v0.21.0-rc.0
+# kubedb.dev/db-client-go v0.22.0-rc.0
 ## explicit; go 1.25.5
 kubedb.dev/db-client-go/elasticsearch
 kubedb.dev/db-client-go/redis