> ## Documentation Index > Fetch the complete documentation index at: https://tyk.io/docs/llms.txt > Use this file to discover all available pages before exploring further. # Tyk Operator Release Notes > Release notes documenting updates, enhancements, fixes and changes for Tyk Operator. **Licensed Protected Product** **This page contains all release notes for Tyk Operator displayed in reverse chronological order** ## Support Lifetime Only the most recent Tyk Operator release is supported. We recommend staying current to minimise exposure to security vulnerabilities from third party dependencies. *** ## 1.6 Release Notes ### 1.6.0 Release Notes #### Release Date 6 November 2026 #### Release Highlights **Kubernetes Gateway API support** Tyk Operator now implements the [Kubernetes Gateway API](https://tyk.io/docs/product-stack/tyk-operator/gateway-api/overview.md). You can route traffic through your existing Tyk Gateways with the standard `GatewayClass`, `Gateway` and `HTTPRoute` resources, and Tyk Operator creates a Tyk OAS API in Tyk Dashboard for each route. Platform teams manage the classes and gateways, and application teams manage their own routes. To add Tyk features such as authentication and rate limits, attach a Tyk OAS API definition to a route or a `Gateway`. To give clients access, reference the route in a `SecurityPolicy`, and Tyk Operator finds the APIs that it created from the route. Kubernetes Gateway API support requires Tyk Dashboard, and is disabled by default. To enable it, see [Get Started](https://tyk.io/docs/product-stack/tyk-operator/gateway-api/get-started.md). **Condition-Based Access Control and DNS Discovery** `SecurityPolicy` and `TykSession` resources can include [access conditions](https://tyk.io/docs/api-management/access-control/sessions-and-keys/access-conditions.md) on their path-based permissions. `ApiDefinition` resources for Tyk Classic APIs support [DNS discovery](https://tyk.io/docs/planning-for-production/ensure-high-availability/service-discovery.md#dns-discovery) for gRPC (h2c) upstreams. Both features require Tyk 5.16.0. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.6.0) below. #### Breaking Changes This release has no breaking changes. #### Dependencies ##### 3rd Party Dependencies & Tools | Third Party Dependency | Tested Versions | Compatible Versions | Comments | | :- | :- | :- | :- | | [Kubernetes](https://kubernetes.io) | 1.35.x | 1.34.x, 1.35.x | | Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release. #### Deprecations There are no deprecations in this release. #### Upgrade instructions Go to the [Upgrading Tyk Operator](https://tyk.io/docs/tyk-stack/tyk-operator/installing-tyk-operator.md) section for detailed upgrade instructions. #### Downloads * [Docker image v1.6.0](https://hub.docker.com/r/tykio/tyk-operator/tags?page=\&page_size=\&ordering=\&name=v1.6.0) * ```bash theme={null} docker pull tykio/tyk-operator:v1.6.0 ``` * Helm chart * [Tyk Charts 5.5.0](https://tyk.io/docs/developer-support/release-notes/helm-chart.md#5-5-release-notes) #### Changelog ##### Added > [accordion] Added support for the Kubernetes Gateway API > > Tyk Operator now implements the [Kubernetes Gateway API](https://tyk.io/docs/product-stack/tyk-operator/gateway-api/overview.md) for HTTP routing. You can route traffic through your Tyk Gateways with the standard `GatewayClass`, `Gateway` and `HTTPRoute` resources. > > Each resource maps to part of your Tyk deployment: > > * A `GatewayClass` whose `controllerName` is `tyk.io/gateway-controller` refers to an OperatorContext with the connection details of Tyk Dashboard. > * A `Gateway` represents an existing group of Tyk Gateways. It refers to an OperatorContext with the new `dataPlane` fields: `serviceRef`, the Kubernetes Service in front of the Tyk Gateways, and `tags`, the API sharding tags that Tyk Operator adds to every API. Tyk Operator doesn't deploy Tyk Gateways. > * Tyk Operator creates a Tyk OAS API in Tyk Dashboard for each combination of parent `Gateway`, hostname and path in an `HTTPRoute`, and deletes the APIs when you delete the route. > > Tyk Operator supports path prefix and method matches, hostnames including wildcards, header modification, URL rewrites, fixed redirects, and backend Services with weights, including in other namespaces through `ReferenceGrant`. It rejects any part of a route that it can't translate, and reports the field and the reason in the route status. For the details, see the [Kubernetes Gateway API Reference](https://tyk.io/docs/product-stack/tyk-operator/gateway-api/reference.md). > > To add Tyk features, such as authentication and rate limits, attach a `TykOasApiDefinition` to a route or a `Gateway` with the new `spec.targetRefs` field. The route keeps control of routing settings. A definition attached to a route replaces the one attached to its `Gateway`. To give clients access, add the route to the `access_rights_array` of a `SecurityPolicy` with `kind: HTTPRoute`. Tyk Operator finds the APIs that it created from the route. For the details, see [Secure and Extend Routes](https://tyk.io/docs/product-stack/tyk-operator/gateway-api/secure-and-extend-routes.md). > > Kubernetes Gateway API support requires Tyk Dashboard, and is disabled by default. To enable it, install the Kubernetes Gateway API CRDs, then set `enableGatewayAPI: true` in the Tyk Operator Helm chart. See [Get Started](https://tyk.io/docs/product-stack/tyk-operator/gateway-api/get-started.md). > [accordion] Added support for Conditional Granular Access Control > > Tyk Operator now supports the access conditions introduced with [Conditional Granular Access Control](https://tyk.io/docs/api-management/access-control/sessions-and-keys/access-conditions.md) in Tyk Gateway and Tyk Dashboard 5.16.0. Path-based permissions (`allowed_urls`) in `SecurityPolicy` and `TykSession` resources can include a `conditions` block, which is sent to the Dashboard intact and enforced by the Gateway. > > As part of this change, path and method restrictions declared on `TykSession` resources are now applied as declared. Policies and Sessions without conditions behave as before. > [accordion] Added support for DNS discovery in Tyk Classic API definitions > > The `ApiDefinition` resource now supports the [DNS discovery](https://tyk.io/docs/planning-for-production/ensure-high-availability/service-discovery.md#dns-discovery) configuration introduced in Tyk Gateway 5.16.0 for load balancing gRPC upstreams, under `proxy.dns_discovery`. > > The validating webhook rejects invalid configurations when you apply them: DNS discovery requires `proxy.enable_load_balancing` to be enabled, and cannot be used together with service discovery. For Tyk OAS APIs, DNS discovery is configured in the Tyk OAS API definition as usual (`x-tyk-api-gateway.upstream.dnsDiscovery`), with no change needed in Tyk Operator. ##### Fixed > [accordion] Fixed resources stuck in Terminating when deleted in an unexpected order > > We've resolved an issue where `SecurityPolicy`, `TykOasApiDefinition` and related resources could stay in `Terminating` indefinitely, requiring manual cleanup on the cluster. This could happen when a Policy was deleted after the API it protected was already gone, when a Policy that was never created in Tyk was deleted, or when an API was still linked to a Policy that no longer existed. > > These deletions now complete normally. Tyk Operator still prevents deleting an API while a Policy that actually exists protects it. The fix applies to Tyk OAS, Tyk Streams and MCP Proxy resources. ##### Security Fixes > [accordion] Resolved CVEs > > Addressed CVEs reported in dependent libraries, providing increased protection against security vulnerabilities, including, but not limited to: > > * [CVE-2026-56855](https://nvd.nist.gov/vuln/detail/CVE-2026-56855) > * [CVE-2026-78662](https://nvd.nist.gov/vuln/detail/CVE-2026-78662) > * [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) > * [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) > * [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) > * [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) > * [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) > * [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) > * [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) > * [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) > * [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) > * [DSA-6572-1](https://security-tracker.debian.org/tracker/DSA-6572-1) > * [CVE-2026-111943](https://nvd.nist.gov/vuln/detail/CVE-2026-111943) > * [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) ## 1.5 Release Notes ### 1.5.0 Release Notes #### Release Date 23 September 2026 #### Release Highlights This release delivers a major expansion of GitOps coverage for Tyk Dashboard resources, along with a first release of API Governance support and several reliability improvements. **Full declarative management of Tyk Dashboard resources** Tyk Operator now manages several new Kubernetes Custom Resources, closing key gaps that previously prevented full programmatic control of Tyk Dashboard configuration and required manual Dashboard configuration or ad hoc Kubernetes Jobs calling the Admin API: * **`TykSession`**: Client access control and tracking [Session](https://tyk.io/docs/api-management/access-control/sessions-and-keys/understanding-sessions.md). * **`TykCertificate`**: TLS certificate, with automatic reconciliation when the underlying Kubernetes Secret is rotated by tools like cert-manager or Vault. * **`TykIdentityProfile`**: Tyk Identity Broker (TIB) profile for [Dashboard Single Sign-On](https://tyk.io/docs/tyk-identity-broker/dashboard-sso.md). * **`TykOAuthClient`**: OAuth 2.0 client used with [Tyk OAuth 2.0](https://tyk.io/docs/api-management/authentication/oauth-2.md) authentication method. * **`TykWebhook`**: [Webhook handler](https://tyk.io/docs/api-management/gateway-events.md#event-handling-with-webhooks) for Gateway events. * **`TykUserGroup`**: Dashboard [user groups](https://tyk.io/docs/platform-management/user-groups.md) \[!NOTE] While user groups can now be defined declaratively, individual Dashboard user accounts are not managed via CRDs and continue to be configured through the Dashboard API or UI. **API Governance** This release introduces support for [Tyk's API Governance capability](https://tyk.io/docs/tyk-governance/overview.md): a new `TykRuleset` CRD lets you declare Spectral-based governance rulesets as Kubernetes resources (inline or referencing a ConfigMap/Secret), and Tyk OAS API definitions applied through the Operator can now be evaluated against active rulesets, including an admission webhook that can deny a non-compliant `kubectl apply` outright. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.5.0) below. #### Breaking Changes This release has no breaking changes. #### Dependencies ##### 3rd Party Dependencies & Tools | Third Party Dependency | Tested Versions | Compatible Versions | Comments | | :- | :- | :- | :- | | [Kubernetes](https://kubernetes.io) | 1.30.x to 1.36.x | 1.28.x to 1.36.x | | Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release. #### Deprecations There are no deprecations in this release. #### Upgrade instructions Go to the [Upgrading Tyk Operator](https://tyk.io/docs/tyk-stack/tyk-operator/installing-tyk-operator.md) section for detailed upgrade instructions. #### Downloads * [Docker image v1.5.0](https://hub.docker.com/r/tykio/tyk-operator/tags?page=\&page_size=\&ordering=\&name=v1.5.0) * ```bash theme={null} docker pull tykio/tyk-operator:v1.5.0@sha256:10f678bfdc27fe67e932883d97d59cb9745912c610be0fc254147f47af64efa2 ``` * Helm chart * [tyk-charts v5.4.0](https://tyk.io/docs/developer-support/release-notes/helm-chart.md#5-4-release-notes) #### Changelog ##### Changed > [accordion] Updated to Go 1.26 > > Tyk Operator has been updated to Go 1.26. ##### Added > [accordion] Added TykRuleset CRD for declarative Governance ruleset management > > A new `TykRuleset` custom resource lets you declare Tyk's API Governance rulesets, Spectral-based rules that lint your Tyk OAS APIs for compliance, as Kubernetes resources, instead of managing them only through the Dashboard. The ruleset's category list, action (`none`/`warn`/`block`), active state, and Spectral rule body can all be version-controlled and rolled back through Git. > The Spectral rule body can be supplied inline in the resource, or via a reference to a ConfigMap or Secret, letting large or sensitive rulesets live outside the CR. The Operator keeps the ruleset in sync with the Dashboard as the resource or its referenced object changes. > > For more information, visit [Governance via Operator](https://tyk.io/docs/tyk-governance/tyk-operator.md) > [accordion] Added admission webhook and reconcile-time Governance evaluation for Tyk OAS APIs > > Tyk OAS API definitions applied through the Operator can now be evaluated against active Governance rulesets (see `TykRuleset` above). A Kubernetes admission webhook can deny a `kubectl apply` outright when a matching ruleset with the `block` action has error-level findings, showing up to five violations inline; a ruleset with the `warn` action instead admits the object with an inline warning. > Separately, the reconciler evaluates the same rulesets and records the outcome on `status.governancePreflight` and as a Kubernetes Event, purely for visibility; it never blocks or withholds the Dashboard sync based on a governance result. > > Evaluation is opt-in: it only runs when an API's `categories` intersect an active `TykRuleset`'s categories, and results are cached against a hash of the OpenAPI document plus the matched ruleset set, so unrelated changes don't trigger repeat evaluation calls. > > For more information, visit [Governance via Operator](https://tyk.io/docs/tyk-governance/tyk-operator.md) > [accordion] Added TykSession CRD for declarative management of Sessions > > A new `TykSession` custom resource lets you declare Sessions for API client credentials, such as API tokens and HTTP Basic Auth users, as Kubernetes resources. The Operator creates, updates, and revokes the corresponding Session in the Gateway as the resource changes. > [Policies](https://tyk.io/docs/api-management/policies.md) associated with the Session (declared using the existing `SecurityPolicy` CRD) are referenced by their Kubernetes `metadata.name`, consistent with the Operator's existing cross-resource reference model, so no raw Tyk IDs are needed in the manifest. > [accordion] Added TykCertificate CRD for declarative TLS certificate management > > A new `TykCertificate` custom resource uploads a TLS certificate from a same-namespace Kubernetes Secret into [Tyk Certificate Store](https://tyk.io/docs/api-management/certificates.md#tyk-certificate-store). The resulting certificate ID, fingerprint, and expiry are exposed on `.status`. > The certificate ID is deterministic, so re-applying an unchanged resource is a no-op. Deleting the resource checks whether any API still depends on the certificate before removing it, so a certificate shared across multiple APIs is never deleted out from under them. > [accordion] Added automatic reconciliation for externally rotated certificates and basic auth passwords > > Operator detects when a Kubernetes Secret referenced by a `TykCertificate` or Basic Auth `TykSession` resource is rotated by an external system such as cert-manager or Vault, and reconciles the change automatically without needing a manual edit to trigger a sync. > For certificates, a rotated Secret produces a new certificate in Tyk, uploaded before the old one is removed, and the old certificate is only cleaned up once nothing still depends on it, so a live API is never left pointing at a missing certificate. > > For Basic Auth passwords, rotation updates the credential in place in the same Session object, so quota and rate-limit counters are preserved. > > > [!NOTE] > > > > Referencing a certificate or Session by its Kubernetes Secret name (rather than a copied-out Tyk ID) is what keeps it rotation-safe. A literal ID reference continues to work but won't pick up future rotations automatically. Rotating the token/seed of a bring-your-own key isn't supported, since the seed is the key's identity; the Operator reports this as failed and recommends deleting and re-applying the resource instead. > [accordion] Added TykIdentityProfile CRD for declarative TIB profile management > > A new `TykIdentityProfile` custom resource lets you declare Tyk Identity Broker (TIB) profiles, which broker external identity providers for SSO into Tyk Dashboard, as Kubernetes resources. > A profile is owned by either the Operator or the Dashboard, never both: an Operator-managed profile is authoritative, and any manual Dashboard edit is treated as drift and overwritten on the next reconcile, while a profile already created in the Dashboard is left alone unless explicitly annotated for the Operator to adopt it. > > Provider secrets in the profile configuration can be supplied as a reference to a same-namespace Kubernetes Secret rather than inline; the resolved value is sent to Tyk but never stored in the resource's status, logs, or events, and rotating the referenced Secret automatically re-triggers reconciliation. > [accordion] Added TykOAuthClient CRD for declarative Tyk OAuth 2.0 client management > > A new `TykOAuthClient` custom resource lets you declare OAuth 2.0 clients bound to a specific [Tyk OAuth 2.0](https://tyk.io/docs/api-management/authentication/oauth-2.md) enabled API as Kubernetes resources. A client can be created with a specific `client_id`/`client_secret` supplied via a Kubernetes Secret, or left for Tyk to generate; a Tyk-generated `client_secret` is written to an Operator-owned Secret and never exposed in the resource's status, logs, or events. > [accordion] Added TykWebhook CRD for declarative webhook management > > A new `TykWebhook` custom resource lets you declare [global webhooks](https://tyk.io/docs/api-management/gateway-events.md#using-webhooks-with-tyk-dashboard) that can be triggered by Gateway events as Kubernetes resources. Header values can reference a same-namespace Kubernetes Secret instead of being set inline, so credentials sent to the webhook target are never stored in the resource's status, logs, or events; rotating the referenced Secret automatically re-syncs the webhook. > [accordion] Added TykUserGroup CRD for declarative Dashboard user group management > > A new `TykUserGroup` custom resource lets you declare Dashboard user groups, the permission sets referenced by Dashboard users, TIB profiles, and Tyk OAS API ownership, as Kubernetes resources. > [accordion] Added reconcile status and error reporting to the SecurityPolicy resource > > `SecurityPolicy` resources now expose a `status.latestTransaction` field, matching the reconcile-status pattern already available on API definition resources. A failed Policy sync, an invalid Dashboard call or a missing linked API, is now visible directly on the resource via `kubectl get securitypolicy`, not just in the Operator's logs. A transient Kubernetes conflict encountered while writing the status no longer causes a spurious "Failed" state to be reported. > [accordion] API ownership is now applied for Tyk OAS APIs > > The Tyk Operator now applies API ownership from `OperatorContext` to Tyk OAS APIs. `user_owners` and `user_group_owners` are applied on create and update, and updating these fields on an `OperatorContext` reconciles every Tyk OAS API that references it, keeping ownership consistent between Kubernetes and the Dashboard. ##### Security Fixes > [accordion] Resolved CVEs > > Addressed the following CVEs, providing increased protection against security vulnerabilities, including, but not limited to: > > * [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) > * [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) > * [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) > * [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) > * [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) > * [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) > * [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) > * [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) > * [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) > * [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) ## 1.4 Release Notes ### 1.4.2 Release Notes #### Release Date 9 July 2026 #### Release Highlights In this release, we have fixed issues with the reliability of SecurityPolicy reconciliation under high load that could lead to infinite reconciliation loops, orphaned Dashboard policies, and inconsistent state between Kubernetes and Dashboard. The fix also introduces new configuration options that enable tuning of Tyk Operator's HTTP connection pool for different deployments. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.4.2) below. #### Breaking Changes This release has no breaking changes. #### Dependencies ##### 3rd Party Dependencies & Tools | Third Party Dependency | Tested Versions | Compatible Versions | Comments | | :- | :- | :- | :- | | [Kubernetes](https://kubernetes.io) | 1.28.x to 1.35.x | 1.19.x to 1.35.x | | Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release. #### Deprecations There are no deprecations in this release. #### Upgrade instructions Go to the [Upgrading Tyk Operator](https://tyk.io/docs/tyk-stack/tyk-operator/installing-tyk-operator.md) section for detailed upgrade instructions. #### Downloads * [Docker image v1.4.2](https://hub.docker.com/r/tykio/tyk-operator/tags?page=\&page_size=\&ordering=\&name=v1.4.2) * ```bash theme={null} docker pull tykio/tyk-operator:v1.4.2 ``` * Helm chart * [tyk-charts v5.3.0](https://tyk.io/docs/developer-support/release-notes/helm-chart.md#5-3-release-notes) #### Changelog ##### Fixed > [accordion] Fix SecurityPolicy reconciliation race conditions and connection leaks under load > > Resolved a set of related issues that prevented `SecurityPolicy` resources from reconciling reliably, particularly under high load or when a policy referenced a large number of APIs. > > Affected Operators could enter continuous reconciliation loops (most commonly with policies referencing nine or more APIs), leave a policy in the Dashboard after its Kubernetes resource had been deleted, repeatedly try to recreate a policy and fail with a "policy name already used" error, and steadily leak HTTP connections and file descriptors until the host exhausted its available ports. > > SecurityPolicy reconciliation is now idempotent and converges reliably: Kubernetes and Dashboard state stay consistent across create, update, and delete, the Operator recovers cleanly from partial failures, and HTTP connections are reused correctly so file descriptors no longer accumulate under sustained load. The same reconciliation improvements have been applied to Tyk OAS API definition resources. > > This release also introduces a set of environment variables for tuning the Operator's HTTP client to the Dashboard: `TYK_OPERATOR_HTTPCLIENTCONFIG_MAXIDLECONNS`, `TYK_OPERATOR_HTTPCLIENTCONFIG_MAXIDLECONNSPERHOST`, `TYK_OPERATOR_HTTPCLIENTCONFIG_MAXCONNSPERHOST`, `TYK_OPERATOR_HTTPCLIENTCONFIG_IDLECONNTIMEOUT`, `TYK_OPERATOR_HTTPCLIENTCONFIG_TLSHANDSHAKETIMEOUT`, and `TYK_OPERATOR_HTTPCLIENTCONFIG_TIMEOUT`. Each ships with a sensible built-in default, and Tyk recommends leaving them unchanged unless your infrastructure has specific constraints, such as file descriptor exhaustion, that require tuning. ##### Security Fixes > [accordion] Resolved CVEs > > Addressed the following CVEs, providing increased protection against security > vulnerabilities, including, but not limited to: > > * [CVE-2026-33814](https://nvd.nist.gov/vuln/detail/CVE-2026-33814) > * [CVE-2026-39830](https://nvd.nist.gov/vuln/detail/CVE-2026-39830) > * [CVE-2026-39831](https://nvd.nist.gov/vuln/detail/CVE-2026-39831) > * [CVE-2026-39833](https://nvd.nist.gov/vuln/detail/CVE-2026-39833) > * [CVE-2026-42508](https://nvd.nist.gov/vuln/detail/CVE-2026-42508) > * [CVE-2026-46595](https://nvd.nist.gov/vuln/detail/CVE-2026-46595) > * [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) > * [CVE-2026-39829](https://nvd.nist.gov/vuln/detail/CVE-2026-39829) > * [CVE-2026-42504](https://nvd.nist.gov/vuln/detail/CVE-2026-42504) > * [CVE-2026-39832](https://nvd.nist.gov/vuln/detail/CVE-2026-39832) > * [CVE-2026-39834](https://nvd.nist.gov/vuln/detail/CVE-2026-39834) > * [CVE-2026-46597](https://nvd.nist.gov/vuln/detail/CVE-2026-46597) > * [CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680) > * [CVE-2026-25681](https://nvd.nist.gov/vuln/detail/CVE-2026-25681) > * [CVE-2026-27136](https://nvd.nist.gov/vuln/detail/CVE-2026-27136) > * [CVE-2026-39827](https://nvd.nist.gov/vuln/detail/CVE-2026-39827) > * [CVE-2026-39828](https://nvd.nist.gov/vuln/detail/CVE-2026-39828) > * [CVE-2026-39835](https://nvd.nist.gov/vuln/detail/CVE-2026-39835) > * [CVE-2026-42502](https://nvd.nist.gov/vuln/detail/CVE-2026-42502) > * [CVE-2026-42506](https://nvd.nist.gov/vuln/detail/CVE-2026-42506) > * [CVE-2026-46598](https://nvd.nist.gov/vuln/detail/CVE-2026-46598) > * [CVE-2026-42507](https://nvd.nist.gov/vuln/detail/CVE-2026-42507) > * [CVE-2026-27145](https://nvd.nist.gov/vuln/detail/CVE-2026-27145) > * [CVE-2026-39824](https://nvd.nist.gov/vuln/detail/CVE-2026-39824) ### 1.4.1 Release Notes #### Release Date 21 May 2026 #### Release Highlights In this release, we have addressed CVEs for enhanced security and performance. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.4.1) below. #### Breaking Changes This release has no breaking changes. #### Dependencies ##### 3rd Party Dependencies & Tools | Third Party Dependency | Tested Versions | Compatible Versions | Comments | | :- | :- | :- | :- | | [Kubernetes](https://kubernetes.io) | 1.28.x to 1.32.x | 1.19.x to 1.32.x | | Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release. #### Deprecations There are no deprecations in this release. #### Upgrade instructions Go to the [Upgrading Tyk Operator](https://tyk.io/docs/tyk-stack/tyk-operator/installing-tyk-operator.md) section for detailed upgrade instructions. #### Downloads * [Docker image v1.4.1](https://hub.docker.com/r/tykio/tyk-operator/tags?page=\&page_size=\&ordering=\&name=v1.4.1) * ```bash theme={null} docker pull tykio/tyk-operator:v1.4.1 ``` * Helm chart * [tyk-charts v5.2.0](https://tyk.io/docs/developer-support/release-notes/helm-chart.md#5-2-0-release-notes) #### Changelog ##### Security Fixes > [accordion] Resolved CVEs > > Addressed the following CVEs, providing increased protection against security > vulnerabilities, including, but not limited to: > > * [CVE-2026-33811](https://nvd.nist.gov/vuln/detail/CVE-2026-33811) > * [CVE-2026-33814](https://nvd.nist.gov/vuln/detail/CVE-2026-33814) > * [CVE-2026-39820](https://nvd.nist.gov/vuln/detail/CVE-2026-39820) > * [CVE-2026-39836](https://nvd.nist.gov/vuln/detail/CVE-2026-39836) > * [CVE-2026-42499](https://nvd.nist.gov/vuln/detail/CVE-2026-42499) > * [CVE-2026-39823](https://nvd.nist.gov/vuln/detail/CVE-2026-39823) > * [CVE-2026-39826](https://nvd.nist.gov/vuln/detail/CVE-2026-39826) > * [CVE-2026-39825](https://nvd.nist.gov/vuln/detail/CVE-2026-39825) ### 1.4.0 Release Notes #### Release Date 20 May 2026 #### Release Highlights Tyk Operator 1.4.0 introduces support for managing [MCP (Model Context Protocol) Proxy](https://tyk.io/docs/ai-management/mcp-gateway/managing-proxies.md) definitions through Kubernetes custom resources. The new `TykMcpProxyDefinition` CRD allows you to manage MCP Proxies declaratively, and the `SecurityPolicy` CRD has been extended with MCP access rights for tool-based access control and per-primitive rate limiting. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.4.0). > [!NOTE] > > The initial Helm chart for Operator 1.4.0 contained an installation bug. Please ensure you use [Tyk Charts 5.2.0](https://tyk.io/docs/developer-support/release-notes/helm-chart.md#5-2-0-release-notes) or later to install Operator 1.4.0. #### Breaking Changes This release has no breaking changes. #### Dependencies ##### 3rd Party Dependencies & Tools | Third Party Dependency | Tested Versions | Compatible Versions | Comments | | :- | :- | :- | :- | | [Kubernetes](https://kubernetes.io) | 1.28.x to 1.32.x | 1.19.x to 1.32.x | | Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release. #### Deprecations There are no deprecations in this release. #### Upgrade instructions The MCP Proxy support in Tyk Operator 1.4.0 requires Tyk Gateway 5.13.0 and Tyk Dashboard 5.13.0 (or newer) Attempting to use `TykMcpProxyDefinition` resources with Operator 1.4.0 prior to upgrading Gateway and Dashboard to a version supporting MCP Proxies will cause reconciliation failures. See [MCP Gateway upgrade considerations](https://tyk.io/docs/developer-support/upgrading.md#mcp-upgrade-considerations) for details. Go to the [Upgrading Tyk Operator](https://tyk.io/docs/tyk-stack/tyk-operator/installing-tyk-operator.md) section for detailed upgrade instructions. #### Downloads * [Docker image v1.4.0](https://hub.docker.com/r/tykio/tyk-operator/tags?page=\&page_size=\&ordering=\&name=v1.4.0) * ```bash theme={null} docker pull tykio/tyk-operator:v1.4.0 ``` * Helm chart * [tyk-charts v5.2.0](https://tyk.io/docs/developer-support/release-notes/helm-chart.md#5-2-0-release-notes) #### Changelog ##### Added > [accordion] Add MCP Proxy support > > This release adds support for MCP (Model Context Protocol) Proxies with a new TykMcpProxyDefinition CRD and an extension to the SecurityPolicy CRD. > > **TykMcpProxyDefinition CRD** > > A new `TykMcpProxyDefinition` CRD allows you to manage MCP Proxy definitions declaratively in Kubernetes. > > The CRD status surface exposes three hashes — `CRDSpecHash`, `ConfigMapHash`, and `TykSpecHash` — to track synchronisation state between the Kubernetes resource, the ConfigMap, and the Tyk Gateway definition. > > **SecurityPolicy CRD — MCP access rights** > > The `SecurityPolicy` CRD has been extended to support MCP-specific access rights: > > * Per-tool, per-resource, and per-prompt allow/deny lists (`mcp_access_rights`) > * Per-JSON-RPC-method allow/deny lists (`json_rpc_methods_access_rights`) > * Per-primitive rate limits (`mcp_primitives`) and per-method rate limits (`json_rpc_methods`) > > For details, see the [MCP proxy policies documentation](https://tyk.io/docs/ai-management/mcp-gateway/policies.md). ## 1.3 Release Notes ### 1.3.0 Release Notes #### Release Date 11 March 2026 #### Release Highlights Tyk Operator v1.3.0 delivers improvements for API monitoring and ingress management in Kubernetes environments. This release adds native uptime test configuration support for both Tyk OAS and Tyk Classic API definitions, eliminating the need for manual Dashboard configuration. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.3.0) below. > [!NOTE] > > The initial `Helm chart` for Operator 1.3.0 contained an installation bug. Please ensure you use tyk-charts version [5.1.1](https://tyk.io/docs/developer-support/release-notes/helm-chart.md#5-1-1-release-notes) or later to install Operator 1.3.0. #### Breaking Changes This release has no breaking changes. #### Dependencies ##### 3rd Party Dependencies & Tools | Third Party Dependency | Tested Versions | Compatible Versions | Comments | | :- | :- | :- | :- | | [Kubernetes](https://kubernetes.io) | 1.28.x to 1.32.x | 1.19.x to 1.32.x | | Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release. #### Deprecations There are no deprecations in this release. #### Upgrade instructions Go to the [Upgrading Tyk Operator](https://tyk.io/docs/tyk-stack/tyk-operator/installing-tyk-operator.md) section for detailed upgrade instructions. #### Downloads * [Docker image v1.3.0](https://hub.docker.com/r/tykio/tyk-operator/tags?page=\&page_size=\&ordering=\&name=v1.3.0) * ```bash theme={null} docker pull tykio/tyk-operator:v1.3.0 ``` * Helm chart * [tyk-charts v5.1.0](https://tyk.io/docs/developer-support/release-notes/helm-chart.md#5-0-0-release-notes) #### Changelog ##### Changed > [accordion] Golang 1.25 Update > > The Tyk Operator now runs on Golang 1.25, providing improved performance, enhanced security, and access to the latest language features. > > This update ensures the Operator remains current with supported Go versions and reduces exposure to security vulnerabilities found in older runtime versions. ##### Added > [accordion] Added Uptime Test Configuration Support > > The Tyk Operator now supports configuration of [upstream uptime tests](https://tyk.io/docs/planning-for-production/ensure-high-availability/uptime-tests.md) directly in your API definitions through both Tyk OAS and Tyk Classic CRDs. ##### Fixed > [accordion] Tyk Operator Ingress Controller Now Respects Strip Listen Path Configuration > > The ingress controller now respects the [`listenPath.strip`](https://tyk.io/docs/api-management/gateway-config-tyk-oas#listenpath) configuration defined in your Tyk OAS API templates. This fix ensures that template configurations are preserved while maintaining backward compatibility, as templates without an explicit strip setting will continue to default to `true`, and ACME challenge paths will still force `strip: false` as required. ## 1.2 Release Notes ### 1.2.0 Release Notes #### Release Date 02 April 2025 #### Release Highlights ##### Support for Tyk 5.8 Tyk Operator v1.2 introduces key enhancements and critical fixes to improve API management in Kubernetes environments. This release adds support for HMAC request signing and YAML-based OAS definitions, aligning with Tyk Gateway 5.8. For a comprehensive list of changes, please refer to the detailed [changelog](#Changelog-v1.2.0) below. #### Breaking Changes This release has no breaking changes. #### Dependencies ##### 3rd Party Dependencies & Tools | Third Party Dependency | Tested Versions | Compatible Versions | Comments | | :- | :- | :- | :- | | [Kubernetes](https://kubernetes.io) | 1.28.x to 1.32.x | 1.19.x to 1.32.x | | Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release. #### Deprecations There are no deprecations in this release. #### Upgrade instructions Tyk Operator v1.2 introduced new Custom Resource Definitions (CRDs). Before upgrading to Tyk Operator v1.2 with Helm Chart, please run the following commands to install the CRDs: ```bash theme={null} $ kubectl apply -f https://raw.githubusercontent.com/TykTechnologies/tyk-charts/refs/heads/main/tyk-operator-crds/crd-v1.2.0.yaml ``` Go to the [Upgrading Tyk Operator](https://tyk.io/docs/tyk-stack/tyk-operator/installing-tyk-operator.md) section for detailed upgrade instructions. #### Downloads * [Docker image v1.2.0](https://hub.docker.com/r/tykio/tyk-operator/tags?page=\&page_size=\&ordering=\&name=v1.2.0) * ```bash theme={null} docker pull tykio/tyk-operator:v1.2.0 ``` * Helm chart * [tyk-charts v3.0.0](https://tyk.io/docs/developer-support/release-notes/helm-chart.md#3-0-0-release-notes) #### Changelog ##### Added > [accordion] HMAC request signing support > > Tyk Operator now supports HMAC request signing, enabling enhanced security and integrity for API requests. This feature aligns with Tyk 5.8 capabilities. > > [Learn More](https://tyk.io/docs/api-management/upstream-authentication/request-signing.md) > [accordion] YAML-based OAS API definitions > > Tyk Operator now allows OAS API definitions in YAML format, increasing flexibility in API configurations. > [accordion] JWT OAS API policy linking > > Tyk Operator now supports linking of policies for JWT default policies and JWT scope-to-policy mappings using kubernetes names. They can set these fields in TykOASApiDefinition CRD. ##### Updated **Removed dependency on kube-rbac-proxy** Tyk Operator removed dependency on kubebuilder's `rbac-proxy` for authentication/authorization of metrics server. `WithAuthenticationAndAuthorization` feature provided by Controller-Runtime will be used instead. Users are encouraged to update to Tyk Operator v1.2 to benefit from this change. For users who cannot immediately update, there is an alternative option: modifying the Operator's Helm chart configuration to replace the image `gcr.io/kubebuilder/kube-rbac-proxy` with another trusted source. For details, please see [Issue 365](https://github.com/TykTechnologies/tyk-charts/issues/365). ##### Fixed > [accordion] Operator reconciliation error handling > > Fixed an issue where reconciliation conflicts appeared as errors in logs, which occurred because an outdated copy of the Kubernetes resource was being processed. This has been resolved by fetching the latest copy of the object from the cluster and retrying the operation. > [accordion] Cert-manager dependency > > Users can now disable cert-manager, making it optional rather than mandatory for onboarding. This enhances flexibility in deployment configurations. > [accordion] Circuit breaker schema validation > > Fixed an issue where user was getting validation error while setting `threshold_precent` field of classic API Definition CRD starting from Operator v1.0.0, which blocked users from upgrading. > [accordion] Portal API Catalog infinite loop > > Resolved an issue where the Operator could enter an infinite loop when a PortalAPICatalogue CR was created. > [accordion] Leader election flag > > Because of some issue in Operator helm chart, configurations options were not getting read correctly. > Helm chart has been fixed and leader election works by default again. *** ## 1.1 Release Notes ### 1.1.0 Release Notes #### Release Date 09 December 2024 #### Release Highlights ###### Support for Tyk Streams API Tyk Operator v1.1 supports management of Tyk Streams APIs through the new **`TykStreamsApiDefinition`** custom resource. This allows you to have declarative, versioned, and fully automated control to your streaming APIs. #### Breaking Changes This release has no breaking changes. #### Dependencies ##### 3rd Party Dependencies & Tools | Third Party Dependency | Tested Versions | Compatible Versions | Comments | | :- | :- | :- | :- | | [Kubernetes](https://kubernetes.io) | 1.26.x to 1.30.x | 1.19.x to 1.30.x | | Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release. #### Deprecations There are no deprecations in this release. #### Upgrade instructions Tyk Operator v1.1 introduced new Custom Resource Definitions (CRDs). Before upgrading to Tyk Operator v1.1 with Helm Chart, please run the following commands to install the CRDs: ```bash theme={null} $ kubectl apply -f https://raw.githubusercontent.com/TykTechnologies/tyk-charts/refs/heads/main/tyk-operator-crds/crd-v1.1.0.yaml ``` Go to the [Upgrading Tyk Operator](https://tyk.io/docs/tyk-stack/tyk-operator/installing-tyk-operator.md) section for detailed upgrade instructions. #### Downloads * [Docker image v1.1.0](https://hub.docker.com/r/tykio/tyk-operator/tags?page=\&page_size=\&ordering=\&name=v1.1.0) * ```bash theme={null} docker pull tykio/tyk-operator:v1.1.0 ``` * Helm chart * tyk-charts v2.2.0 #### Changelog ##### Added **TykStreamsApiDefinition: new Custom Resource for Tyk Streams** The `TykStreamsApiDefinition` custom resource allows you to manage Tyk Streams APIs directly within your Kubernetes environment. This enhancement offers a Kubernetes-native approach to managing Tyk APIs, streamlining operations and ensure single source of truth in Kubernetes. [Learn More](https://tyk.io/docs/tyk-stack/tyk-operator/create-an-api.md#create-a-tykstreamsapidefinition-custom-resource) ##### Fixed **SecurityPolicy: kind of referenced API definitions should have a default value** With `TykOasApiDefinition` support, we expect API references in SecurityPolicy to have `kind` field which can be either `ApiDefinition` or `TykOasApiDefinition`. However, the validation was failing if users were upgrading from v0.18 to v1.0 since the `kind` field is empty in the CR. Updated CRD rules to add default value for the `kind` field. *** ## 1.0 Release Notes ### 1.0.0 Release Notes We are excited to announce the release of **Tyk Operator v1.0**, marking a significant milestone with new features, enhancements, and critical changes. This release introduces support for Tyk OAS APIs, extended capabilities for managing Classic APIs and security policies, and includes **license changes** that you must be aware of before upgrading. #### Release Date 10 Oct 2024 #### Release Highlights ##### Support for Tyk OAS API The Tyk Operator v1.0 release introduces powerful new features designed to enhance how you manage APIs in Kubernetes environments. One of the key highlights is the full support for Tyk OAS APIs, allowing you to define and manage APIs through the new **`TykOasApiDefinition`** custom resource. This integration extends GitOps API Management to Tyk OAS, allowing you to have declarative, versioned, and fully automated control to your APIs in Kubernetes environments. Key features: * **Define and Manage Tyk OAS APIs** using the TykOasApiDefinition custom resource. * **Manage API Definitions in ConfigMaps**: Any changes are automatically tracked and synced to Tyk. * **Configure Tyk OAS in a Kubernetes-native way**: You can organize APIs by categories or manage multiple API versions easily with the new CRD. * **Simplify certificate management** by referencing Kubernetes secrets. * **Use the Tyk Ingress controller** to create Tyk OAS APIs from Ingress specs. With this release, users benefit from seamless GitOps workflows, ensuring a Kubernetes-native operation workflow. Security is also made simpler with automated certificate synchronization, removing the hassle of manual certificate management. ##### Enhanced Classic API and Security Policy Features Enhanced support for Tyk Classic APIs continues, with improvements to security policies and new capabilities for setting API and endpoint-specific rate limits, making it easier than ever to customize API usage policies. This release represents a significant upgrade for both API management and security, offering a more efficient, scalable, and Kubernetes-native way to operate Tyk. Whether you're leveraging Tyk OAS APIs or continuing with Tyk Classic, this version brings the tools and features you need to streamline your workflows and enhance operational efficiency. For details please refer to the [changelog](#Changelog-v1.0.0) below. #### Breaking Changes **License Requirement:** Tyk Operator is now a closed-source product and requires a valid license key to operate. Please follow our [Installation and Upgrade Guide](https://tyk.io/docs/tyk-stack/tyk-operator/installing-tyk-operator.md) to set your license key before installation or upgrade. If the license is missing, invalid, or expired, Tyk Operator will exit with an error message. Ensure that you carefully review the setup steps to avoid any issues during the upgrade or installation process. **Admission Webhook Removal:** The admission webhook for security policy (`validate-tyk-tyk-io-v1alpha1-securitypolicy`) has been removed. No action is required from users, and existing `SecurityPolicy` CRDs and resources remain fully supported and unaffected. #### Dependencies ##### 3rd Party Dependencies & Tools | Third Party Dependency | Tested Versions | Compatible Versions | Comments | | :- | :- | :- | :- | | [Kubernetes](https://kubernetes.io) | 1.26.x to 1.30.x | 1.19.x to 1.30.x | | Given the time difference between your upgrade and the release of this version, we recommend customers verify the ongoing support of third-party dependencies they install, as their status may have changed since the release. #### Deprecations There are no deprecations in this release. #### Upgrade instructions Tyk Operator v1.0 introduced new Custom Resource Definitions (CRDs). Before upgrading to Tyk Operator v1.0 with Helm Chart, please run the following commands to install the CRDs: ```bash theme={null} $ kubectl apply -f https://raw.githubusercontent.com/TykTechnologies/tyk-charts/refs/heads/main/tyk-operator-crds/crd-v1.0.0.yaml ``` Go to the [Upgrading Tyk Operator](https://tyk.io/docs/tyk-stack/tyk-operator/installing-tyk-operator.md#upgrading-tyk-operator) section for detailed upgrade instructions. #### Downloads * [Docker image v1.0.0](https://hub.docker.com/r/tykio/tyk-operator/tags?page=\&page_size=\&ordering=\&name=v1.0.0) * ```bash theme={null} docker pull tykio/tyk-operator:v1.0.0 ``` * Helm chart * [tyk-charts v2.1.0](https://tyk.io/docs/developer-support/release-notes/helm-chart.md#2-1-0-release-notes) #### Changelog ##### Added > [accordion] TykOasApiDefinition: new Custom Resource for Tyk OAS > > The `TykOasApiDefinition` custom resource allows you to manage Tyk OAS APIs directly within your Kubernetes environment. You can now categorize APIs, manage multiple versions, and simplify SSL certificate management by referencing Kubernetes secrets. This enhancement offers a Kubernetes-native approach to managing Tyk APIs, streamlining operations and reducing the complexity of versioning and certificate handling across different environments. > > Learn More: [Create Tyk OAS API](https://tyk.io/docs/tyk-stack/tyk-operator/create-an-api.md#set-up-tyk-oas-api) > [accordion] Ingress Controller: Support Tyk OAS API as an Ingress Template > > With this release, you can use the TykOasApiDefinition resource as a template for automatically creating Tyk OAS APIs based on Kubernetes Ingress specs. This simplifies the process of generating APIs by leveraging Ingress controller annotations, reducing manual intervention, and automating API creation workflows for better scalability and operational efficiency. > > Learn More: [Tyk Ingress Controller](https://tyk.io/docs/product-stack/tyk-operator/tyk-ingress-controller.md) > [accordion] SecurityPolicy: Support for Key-Level Per-API Rate Limits and Quota > > This release introduces the ability to configure specific rate limits, quotas, and throttling rules at the API level using the `access_rights_array` in the security policy. Each API now has the flexibility to inherit global limit settings or apply custom limits, making it easier to control API usage on a per-API basis. This provides enhanced granularity in managing traffic, ensuring optimal resource allocation and improved performance under heavy loads. > > Learn More: [Key-Level Per-API Rate Limits and Quota](https://tyk.io/docs/tyk-stack/tyk-operator/create-an-api.md#security-policy-example) > [accordion] SecurityPolicy: Support for Key-Level Per-Endpoint Rate Limits > > By configuring key-level per-endpoint limits, you can restrict the request rate for specific API clients to a specific endpoint of an API. > > Learn More: [Key-Level Per-Endpoint Rate Limits](https://tyk.io/docs/tyk-stack/tyk-operator/create-an-api.md#security-policy-example) > [accordion] SecurityPolicy: Support for TykOasApiDefinition > > This update extends the security policy to include TykOasApiDefinition resources within the `access_rights_array`, allowing you to manage security policies for both Tyk Classic APIs and Tyk OAS APIs. By specifying the API kind, you can now apply rate limits, quotas, and other access controls to Tyk OAS APIs, streamlining security management in mixed environments. > > Learn More: [TykOasApiDefinition in Security Policy](https://tyk.io/docs/tyk-stack/tyk-operator/create-an-api.md#add-a-security-policy-to-your-api) > [accordion] ApiDefinition: Support for Event Handler > > Tyk Operator now supports event handler integration for ApiDefinition, enabling webhooks to be triggered by specific API events. This allows for real-time, event-driven automation between Tyk and other systems, sending notifications or executing actions as events occur in the API lifecycle. The event\_handlers field in the ApiDefinition CRD makes it easy to set up webhook-driven processes for better control and automation across your services. > > Learn More: [Event Webhook with Tyk Classic](https://tyk.io/docs/api-management/gateway-events.md#webhook-event-handlers-with-tyk-classic-apis) > [accordion] ApiDefinition: Support timeout Field in Advanced Cache Control > > The advanced cache configuration for ApiDefinition now supports a timeout field, providing greater control over cache behavior. You can define specific cache timeouts for different API paths, allowing for more fine-tuned control over caching strategies. This feature helps optimize API performance, particularly for high-traffic endpoints requiring precise cache management. > > ```yaml theme={null} > extended_paths: > advance_cache_config: > - path: "/json" > method: "GET" > cache_response_codes: [200, 204] > timeout: 120 > ``` > [accordion] ApiDefinition: Support new Fields in `VersionDefinition` > > `VersionDefinition` within `ApiDefinition` has been expanded to include additional fields, offering more granular control over API versioning and path management. These new fields allow you to configure version handling more flexibly, enhancing your ability to manage API versions and customize how version data is processed in API paths. ##### Changed **Go Version Updated to 1.22** The underlying Go runtime for Tyk Operator has been updated to version 1.22. This upgrade brings performance improvements, enhanced security, and compatibility with the latest Go libraries, ensuring Tyk Operator remains efficient and secure in production environments. **Admission Webhook for SecurityPolicy Removed** The admission webhook for the security policy (`validate-tyk-tyk-io-v1alpha1-securitypolicy`) has been removed because it did not perform any functional validation. This change simplifies deployment of Tyk Operator and reduces webhook overhead. *** ## 0.18 Release Notes ### 0.18.0 Release Notes #### Release date 4 Jul 2024 #### Breaking Changes This release has no breaking changes. #### Deprecations There are no deprecations in this release. #### Upgrade Instructions Go to the [Upgrading Tyk Operator](https://tyk.io/docs/tyk-stack/tyk-operator/installing-tyk-operator.md#upgrading-tyk-operator) section for detailed upgrade instructions. #### Release Highlights This release added support for Tyk 5.4 API definition. For details please refer to the [changelog](#Changelog-v0.18.0) below. #### Downloads * [Docker image v0.18.0](https://hub.docker.com/r/tykio/tyk-operator/tags?page=\&page_size=\&ordering=\&name=v0.18.0) * ```bash theme={null} docker pull tykio/tyk-operator:v0.18.0 ``` * Source code tarball - [Tyk Operator Repo](https://github.com/TykTechnologies/tyk-operator/releases/tag/v0.18.0) #### Changelog ##### Added **Added support of Tyk 5.4 API definition CRD** Added to ApiDefinition [Custom Resource Definition (CRD)](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/): * [introspection](https://tyk.io/docs/api-management/graphql.md#turning-off-introspection) option to enable/disable GraphQL introspection * [graphql.proxy.auth\_headers](https://tyk.io/docs/api-management/graphql.md#creating-a-graphql-api-via-the-dashboard-ui) * [graphql.proxy.subscription\_type](https://tyk.io/docs/api-management/graphql.md#graphql-subscriptions) * [graphql.proxy.request\_headers](https://tyk.io/docs/api-management/graphql.md#request-headers) * graphql.proxy.use\_response\_extensions * graphql.proxy.request\_headers\_rewrite * graphql.proxy.features ## 0.17 Release Notes ### 0.17.1 Release Notes #### Release date 6 May 2024 #### Breaking Changes This release has no breaking changes. #### Deprecations There are no deprecations in this release. #### Upgrade Instructions Go to the [Upgrading Tyk Operator](https://tyk.io/docs/tyk-stack/tyk-operator/installing-tyk-operator.md#upgrading-tyk-operator) section for detailed upgrade instructions. #### Release Highlights This release is focused on bug fixes. For details please refer to the [changelog](#Changelog-v0.17.1) below. #### Downloads * [Docker image v0.17](https://hub.docker.com/r/tykio/tyk-operator/tags?page=\&page_size=\&ordering=\&name=v0.17.1) * ```bash theme={null} docker pull tykio/tyk-operator:v0.17.1 ``` * Source code tarball - [Tyk Operator Repo](https://github.com/TykTechnologies/tyk-operator/releases/tag/v0.17.1) #### Changelog ##### Fixed > [accordion] Fixed ApiDefinition Custom Resources generated by the Ingress Controller used a wrong certificate > > When using Tyk as an Ingress Controller with TLS enabled, the ApiDefinition Custom Resources generated by the Ingress Controller is missing the OrgID field. As a result, Tyk Gateway used a wrong certificate when serving a request. It is fixed by adding back OrgID field to ApiDefinition CRs created by Ingress Controller. > [accordion] Added Webhook and RBAC port configurations in Tyk Operator Helm chart > > Users can configure Tyk Operator webhook and RBAC port via helm chart values `.Values.webhookPort` and `.Values.rbac.port` respectively. > [accordion] Addressed security vulnerabilities CVE-2023-45288 > > Addressed security vulnerabilities [CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288) where an attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection. > [accordion] Addressed security vulnerabilities CVE-2024-24786 > > Addressed security vulnerabilities [CVE-2024-24786](https://nvd.nist.gov/vuln/detail/CVE-2024-24786) where the `protojson.Unmarshal` function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a `google.protobuf.Any` value, or when the `UnmarshalOptions.DiscardUnknown` option is set. ### 0.17.0 Release Notes #### Release date 05 Apr 2024 #### Breaking Changes This release has no breaking changes. #### Deprecations There are no deprecations in this release. #### Upgrade Instructions Go to the [Upgrading Tyk Operator](https://tyk.io/docs/tyk-stack/tyk-operator/installing-tyk-operator.md#upgrading-tyk-operator) section for detailed upgrade Instructions. #### Release Highlights This release added support for `GraphQLIntrospectionConfig` in API definition and fixed an issue where the Tyk Operator creates duplicate APIs on Tyk. For details please refer to the [changelog](#Changelog-v0.17.0) below. #### Downloads * [Docker image v0.17](https://hub.docker.com/r/tykio/tyk-operator/tags?page=\&page_size=\&ordering=\&name=v0.17.0) * ```bash theme={null} docker pull tykio/tyk-operator:v0.17.0 ``` * Source code tarball - [Tyk Operator Repo](https://github.com/TykTechnologies/tyk-operator/releases/tag/v0.17.0) #### Changelog ##### Fixed **Fixed creating duplicated API definitions on Tyk** Fix creating duplicated API definitions on Tyk in case of cluster failures. If network errors happen while updating the API definition, the Tyk Operator retries the reconciliation based on the underlying error type. ##### Added **Added support of GraphQLIntrospectionConfig in API definition CRD** Added to ApiDefinition CRD: support of `GraphQLIntrospectionConfig` field at `graphql.introspection.disabled`. This feature will be enabled in future Tyk releases. ## 0.16 Release Notes ### 0.16.0 Release Notes #### Release date 12 Jan 2024 #### Breaking Changes This release has no breaking changes. #### Deprecations There are no deprecations in this release. #### Upgrade Instructions While upgrading Tyk Operator release via Helm, please make sure that the latest CRDs are also applied on the cluster, as follows: ```bash theme={null} kubectl apply -f https://raw.githubusercontent.com/TykTechnologies/tyk-operator/v0.16.0/helm/crds/crds.yaml ``` #### Release Highlights This release added support for analytics plugin, UDG global header, and detailed tracing setting in ApiDefinition as detailed in the [changelog](#Changelog-v0.16.0) below. #### Downloads * [Docker image to pull](https://hub.docker.com/layers/tykio/tyk-operator/v0.16.0/images/sha256-7c5b526af96ef772e8e53b8817538f41585c4ad641388609b349368219bb3d7d?context=explore) * [Source code](https://github.com/TykTechnologies/tyk-operator/releases/tag/v0.16.0) #### Changelog ##### Added > [accordion] Added imagePullSecrets configuration for ServiceAccount in Tyk Operator Helm chart > > Added [imagePullSecrets](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) configuration for ServiceAccount in Tyk Operator Helm chart. It allows user to pull image from a private registry. > [accordion] Added tyk to categories field of CRDs > > Added tyk to categories field of CRDs. So, from now on, all CRs related to Tyk Operator is grouped into tyk category and can be displayed via kubectl get tyk. > [accordion] Added support of analytics plugin in ApiDefinition CRD > > Added to ApiDefinition CRD: support of analytics plugin at [spec.analytics\_plugin](https://doc.crds.dev/github.com/TykTechnologies/tyk-operator/tyk.tyk.io/ApiDefinition/v1alpha1@v0.16.0#spec-analytics_plugin). See [Example CRD with Analytics Plugin](https://github.com/TykTechnologies/tyk-operator/tree/master/config/samples/analytics_plugin.yaml) for details. > [accordion] Added support of UDG Global Header in ApiDefinition CRD > > Added to ApiDefinition CRD: support for UDG Global Header at [spec.graphql.engine.global\_headers](https://doc.crds.dev/github.com/TykTechnologies/tyk-operator/tyk.tyk.io/ApiDefinition/v1alpha1@v0.16.0#spec-graphql-engine-global_headers) object in ApiDefinition CRD. This feature is compatible with Tyk 5.2 or above. > [accordion] Added support of detail tracing in ApiDefinition CRD > > Added to ApiDefinition CRD: support for detail tracing configuration at [spec.detailed\_tracing](https://doc.crds.dev/github.com/TykTechnologies/tyk-operator/tyk.tyk.io/ApiDefinition/v1alpha1@v0.16.0#spec-detailed_tracing) field in ApiDefinition CRD. Enable it for the API if you want to get detail span for each middleware involved in request processing. ##### Updated **Updated Go version to 1.21** Updated Go version to 1.21 ##### Fixed **Fixed CVE-2023-39325 (NVD)** Fixed [CVE-2023-39325 (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) **Fixed security policy handling in OSS mode** Fixed a bug that prevents Tyk Operator to work with SecurityPolicy in OSS Mode. Now, SecurityPolicy controller will not modify spec.MID (\_id) field in SecurityPolicy ## Further Information ### Upgrading Tyk Please refer to the [upgrading Tyk](https://tyk.io/docs/developer-support/upgrading.md) page for further guidance on the upgrade strategy. ### FAQ Please visit our [Developer Support](https://tyk.io/docs/developer-support/community.md) page for further information relating to reporting bugs, upgrading Tyk, technical support and how to contribute.