release v0.68.3

[AndrewChubatiuk]

includes changes for upcoming 0.68.3 operator release

---

Summary by cubic

Recreate StatefulSets when VolumeClaimTemplates or immutable fields change, and correctly roll pods under OnDelete. Consolidate VMAuth backends in vmdistributed into one read target (all VMSelects) and one write target (all VMAgents) using static URLs.

• Bug Fixes
  • Recreate STS on any VolumeClaimTemplate change (size up/down, storage class, labels/annotations, renames) and on immutable STS field changes; return a recreate signal; respect pod recreation with OnDelete updates.
  • Update PVCs using previous templates; skip updates when only third‑party labels/annotations differ.
  • vmdistributed VMAuth: group all VMSelect URLs into one read target and all VMAgent URLs into one write target (static URLs, stable ordering).
  • Misc: fix SnapshotDeleteURL; add VM_LOOPBACK to override loopback; add config‑reloader -log-format alias to -loggerFormat; increase STS readiness timeout; cleaner diff output for map keys; skip PVC creation/mount when storage requests are zero; update CRD/docs/tests; upgrade Go builder to 1.25.8.

^{Written for commit a8fbf35. Summary will update on new commits.}

[cubic-dev-ai]

2 issues found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/CHANGELOG.md">

<violation number="1" location="docs/CHANGELOG.md:26">
P1: Custom agent: **Changelog Review Agent**

This changelog entry violates mandatory changelog format rules: it is added in a released section instead of `tip`, and it omits both the required before/now user-impact explanation and references.</violation>
</file>

<file name="internal/controller/operator/factory/reconcile/statefulset_pvc_expand.go">

<violation number="1" location="internal/controller/operator/factory/reconcile/statefulset_pvc_expand.go:60">
P1: Storage size changes now force StatefulSet recreation but skip PVC resize reconciliation, so existing PVC capacity can remain stale after reconcile.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[vrutkovs]

Lets convert this into 0.68.3 PR and start cherry-picking fixes there?

[vrutkovs]

Lets cherry pick #1903 here too

[AndrewChubatiuk]

let's merge #1936
and i'll cherry-pick this to 0.68

[AndrewChubatiuk]

ported this change using StaticRef instead of CRDRef to avoid introducing new CRD fields

[vrutkovs]

lets add #1937 too

[AndrewChubatiuk]

this PR is already ported version of #1937

[cubic-dev-ai]

1 issue found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/CHANGELOG.md">

<violation number="1" location="docs/CHANGELOG.md:19">
P1: Custom agent: **Changelog Review Agent**

This changelog entry does not meet the required structure: it lacks a before/now user-visible explanation and includes no issue/PR reference, so it should be rejected under the changelog format rules.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

2 issues found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/CHANGELOG.md">

<violation number="1" location="docs/CHANGELOG.md:20">
P1: Custom agent: **Changelog Review Agent**

This changelog entry is missing mandatory issue/PR reference links required by the changelog format.</violation>

<violation number="2" location="docs/CHANGELOG.md:22">
P1: Custom agent: **Changelog Review Agent**

This SECURITY entry fails mandatory changelog structure: it does not list affected service(s) and lacks a user-centric before/now impact explanation.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Custom agent: Changelog Review Agent

This changelog entry is missing mandatory issue/PR reference links required by the changelog format.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/CHANGELOG.md, line 20:

<comment>This changelog entry is missing mandatory issue/PR reference links required by the changelog format.</comment>

<file context>
@@ -17,7 +17,9 @@ aliases:
 
 * BUGFIX: [vmoperator](https://docs.victoriametrics.com/operator/): recreate STS if immutable fields changed.
-* BUGFIX: [vmdistributed](https://docs.victoriametrics.com/operator/resources/vmdistributed/): updated VMAuth config consolidating all VMSelects into a single read and all VMAgents into a single write backend
+* BUGFIX: [vmdistributed](https://docs.victoriametrics.com/operator/resources/vmdistributed/): updated VMAuth config consolidating all VMSelects into a single read and all VMAgents into a single write backend.
+
+* SECURITY: upgrade Go builder from Go1.25.7 to Go1.25.8. See [the list of issues addressed in Go1.25.8](https://github.com/golang/go/issues?q=milestone%3AGo1.25.8+label%3ACherryPickApproved).
</file context>

[cubic-dev-ai]

P1: Custom agent: Changelog Review Agent

This SECURITY entry fails mandatory changelog structure: it does not list affected service(s) and lacks a user-centric before/now impact explanation.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/CHANGELOG.md, line 22:

<comment>This SECURITY entry fails mandatory changelog structure: it does not list affected service(s) and lacks a user-centric before/now impact explanation.</comment>

<file context>
@@ -17,7 +17,9 @@ aliases:
-* BUGFIX: [vmdistributed](https://docs.victoriametrics.com/operator/resources/vmdistributed/): updated VMAuth config consolidating all VMSelects into a single read and all VMAgents into a single write backend
+* BUGFIX: [vmdistributed](https://docs.victoriametrics.com/operator/resources/vmdistributed/): updated VMAuth config consolidating all VMSelects into a single read and all VMAgents into a single write backend.
+
+* SECURITY: upgrade Go builder from Go1.25.7 to Go1.25.8. See [the list of issues addressed in Go1.25.8](https://github.com/golang/go/issues?q=milestone%3AGo1.25.8+label%3ACherryPickApproved).
 
 ## [v0.68.2](https://github.com/VictoriaMetrics/operator/releases/tag/v0.68.2)
</file context>

Suggested change

	* SECURITY: upgrade Go builder from Go1.25.7 to Go1.25.8. See [the list of issues addressed in Go1.25.8](https://github.com/golang/go/issues?q=milestone%3AGo1.25.8+label%3ACherryPickApproved).
	* SECURITY: [vmoperator](https://docs.victoriametrics.com/operator/): previously builds used Go1.25.7; now builds use Go1.25.8 to include upstream security fixes and reduce exposure to known Go runtime/toolchain issues. See [the list of issues addressed in Go1.25.8](https://github.com/golang/go/issues?q=milestone%3AGo1.25.8+label%3ACherryPickApproved).

[cubic-dev-ai]

2 issues found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/CHANGELOG.md">

<violation number="1" location="docs/CHANGELOG.md:20">
P1: Custom agent: **Changelog Review Agent**

These new bugfix entries violate the changelog format: they are written as internal implementation notes and omit the required issue/PR links. Rewrite each one in user-facing before/after terms before keeping it in `tip`.</violation>

<violation number="2" location="docs/CHANGELOG.md:21">
P2: Fix the malformed `vmdistributed` documentation link; the current `docs.victoriametrics.com.com` URL will send readers to a broken page.

(Based on your team's feedback about keeping docs links accurate.) [FEEDBACK_USED]</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}