pluralsh · michaeljguarino · Sep 9, 2026 · Sep 9, 2026 · Sep 9, 2026 · Sep 10, 2026
diff --git a/.cursor/skills/console-operator-crd-docs/SKILL.md b/.cursor/skills/console-operator-crd-docs/SKILL.md
@@ -0,0 +1,22 @@
+---
+name: console-operator-crd-docs
+description: Regenerates and synchronizes Console operator CRD documentation. Use whenever editing CRD definitions under go/controller/api.
+---
+
+# Console Operator CRD Documentation
+
+After updating Console operator CRD definitions under `go/controller/api`, run both documentation steps.
+
+First, regenerate the CRD reference from `go/controller/`:
+
+```bash
+make codegen-crd-docs
+```
+
+Then synchronize the generated reference into the documentation site from the repository root:
+
+```bash
+make documentation-sync
+```
+
+Include changes to both `go/controller/docs/api.md` and `js/documentation/pages/api-reference/kubernetes/management-api-reference.md` with the CRD update.
diff --git a/.github/workflows/helm-test-ci.yaml b/.github/workflows/helm-test-ci.yaml
@@ -7,6 +7,7 @@ on:
     paths:
       - ".github/workflows/helm-test-ci.yaml"
       - "go/helm-test/**"
+      - "charts/controller/**"
       - "charts/console/**"
       - "charts/console-rapid/**"
 permissions:

diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml
@@ -21,6 +21,7 @@ jobs:
         chart:
           - charts/console
           - charts/console-rapid
+          - charts/controller
     steps:
       - name: Checkout
         uses: actions/checkout@v6

diff --git a/Dockerfile b/Dockerfile
@@ -5,7 +5,7 @@
 ARG TOOLS_IMAGE=${OS_VARIANT}:${OS_VERSION}
 ARG RUNNER_IMAGE=alpine:3.23.4 # TODO: change back to ${OS_VARIANT}:${OS_VERSION}

 FROM node:24.11.1-alpine as node

 WORKDIR /app

@@ -22,12 +22,12 @@
 COPY js/console/ ./console/
 COPY js/design-system/ ./design-system/

 ARG VITE_PROD_SECRET_KEY
 ARG VITE_SENTRY_DSN
 ARG SENTRY_AUTH_TOKEN
 ARG GIT_COMMIT

 ENV VITE_PROD_SECRET_KEY=${VITE_PROD_SECRET_KEY} \
    VITE_GIT_COMMIT=${GIT_COMMIT} \
    VITE_SENTRY_DSN=${VITE_SENTRY_DSN} \
    SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN}
@@ -84,10 +84,10 @@

 RUN mix do db.certs, agent.chart, sentry.package_source_code, release

 FROM alpine:3.21.3 as tools
 
 ARG TARGETARCH=amd64
-ENV CLI_VERSION=v0.12.63
+ENV CLI_VERSION=v0.12.64
 
 COPY AGENT_VERSION AGENT_VERSION
 
@@ -148,4 +148,4 @@

 EXPOSE 4000 6000 4369 50051

 CMD mkdir -p /tmp/sqlite; /opt/app/bin/console start
diff --git a/charts/console-rapid/charts/controller-0.0.209.tgz b/charts/console-rapid/charts/controller-0.0.209.tgz
diff --git a/charts/console/charts/controller-0.0.209.tgz b/charts/console/charts/controller-0.0.209.tgz
diff --git a/charts/console/templates/kas/configmap.yaml b/charts/console/templates/kas/configmap.yaml
@@ -35,4 +35,9 @@ data:
       listen:
         address: ":{{ .Values.kas.service.privateApiPort }}"
         authentication_secret_file: "/etc/kas/.privateapi_secret"
+    {{- if .Values.console.tls.enabled }}
+    plural_url: "https://console.{{ .Release.Namespace }}:{{ .Values.service.port }}/gql"
+    plural_insecure_skip_tls_verify: true
+    {{- else }}
     plural_url: "https://{{ .Values.kas.consoleUrl }}/gql"
+    {{- end }}
diff --git a/charts/console/templates/kas/deployment.yaml b/charts/console/templates/kas/deployment.yaml
@@ -110,7 +110,12 @@ spec:
             - --disable-csrf-protection
             - --cluster-context-enabled=true
             - --insecure-bind-address=0.0.0.0
+            {{- if .Values.console.tls.enabled }}
+            - --token-exchange-endpoint=https://$(CONSOLE_HOST)/v1/dashboard/cluster
+            - --token-exchange-skip-tls-verify
+            {{- else }}
             - --token-exchange-endpoint=http://$(CONSOLE_HOST)/v1/dashboard/cluster
+            {{- end }}
           env:
             - name: KAS_HOST
               valueFrom:

diff --git a/charts/console/templates/secrets.yaml b/charts/console/templates/secrets.yaml
@@ -58,6 +58,9 @@ data:
 {{ if .Values.console.config.tarballQps }}
   CONSOLE_TARBALL_QPS: {{ .Values.console.config.tarballQps | toString | b64enc | quote }}
 {{ end }}
+{{ if .Values.console.config.maxRequestBodyLength }}
+  CONSOLE_MAX_REQUEST_BODY_LENGTH: {{ .Values.console.config.maxRequestBodyLength | toString | b64enc | quote }}
+{{ end }}
 {{ if .Values.console.config.cacheAgentQps }}
   CONSOLE_CACHE_AGENT_QPS: {{ .Values.console.config.cacheAgentQps | toString | b64enc | quote }}
 {{ end }}
@@ -73,6 +76,9 @@ data:
 {{ if .Values.console.config.healthmapClusterCount }}
   CONSOLE_HEALTHMAP_CLUSTER_COUNT: {{ .Values.console.config.healthmapClusterCount | toString | b64enc | quote }}
 {{ end }}
+{{ if .Values.console.config.tracing.endpoint }}
+  OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: {{ .Values.console.config.tracing.endpoint | b64enc | quote }}
+{{ end }}
 {{ range $key, $value := $extraSecretEnv }}
   {{ $key }}: {{ $value | b64enc | quote }}
 {{ end }}

diff --git a/charts/console/values.yaml b/charts/console/values.yaml
@@ -127,6 +127,10 @@ console:
     # tarballQps configures the global QPS limit for digest and git tarball endpoints.
     tarballQps: 100
 
+    # maxRequestBodyLength configures the maximum HTTP request body size in bytes.
+    # Leave unset to use the application default (100000000). Raise this if stack state uploads return 413.
+    maxRequestBodyLength: ~
+
     # cacheAgentQps configures the global QPS limit for pod-local cache agents.
     cacheAgentQps: ~
 
@@ -142,6 +146,12 @@ console:
     # healthmapClusterCount configures the number of clusters to show in the healthmap.
     healthmapClusterCount: ~
 
+    # tracing configures OpenTelemetry trace export from the Console.
+    tracing:
+      # endpoint is the full OTLP/HTTP traces endpoint. Leave unset to disable tracing.
+      # Example: http://otel-collector.observability:4318/v1/traces
+      endpoint: ~
+
     # rdsIamAuthentication is used to configure whether rds iam authentication should be enabled for all db connections.  Ensure your database is prepared to handle IAM authentication before enabling here.
     rdsIamAuthentication: false
 
@@ -580,6 +590,9 @@ provider: custom
 # controller is used in Chart.yaml to determine if controller dependency should be installed
 controller:
   enabled: true
+  console:
+    tls:
+      enabled: false
 
 # flux2 is used to override some values in flux2 default chart (packaged in charts/flux2-2.14.0.tgz). See https://github.com/fluxcd-community/helm-charts/blob/main/charts/flux2/values.yaml
 flux2:

diff --git a/charts/controller/crds/deployments.plural.sh_deploymentsettings.yaml b/charts/controller/crds/deployments.plural.sh_deploymentsettings.yaml
@@ -255,6 +255,15 @@ spec:
                         description: EmbeddingModel is the Bedrock model or inference
                           profile for embeddings. Same ID formats as modelId.
                         type: string
+                      endpoint:
+                        default: RUNTIME
+                        description: |-
+                          Endpoint selects the AWS Bedrock API surface. RUNTIME (the default) uses InvokeModel or
+                          Converse on bedrock-runtime; MANTLE uses the Bedrock Mantle Anthropic/OpenAI-compatible APIs.
+                        enum:
+                        - RUNTIME
+                        - MANTLE
+                        type: string
                       modelId:
                         description: |-
                           ModelID is the primary AWS Bedrock model or inference profile identifier.

diff --git a/charts/controller/crds/deployments.plural.sh_workbenchtools.yaml b/charts/controller/crds/deployments.plural.sh_workbenchtools.yaml
@@ -1727,6 +1727,74 @@ spec:
                     required:
                     - url
                     type: object
+                  victoriaLogs:
+                    description: VictoriaLogs connection (logs).
+                    properties:
+                      accountId:
+                        description: Optional AccountID tenant header.
+                        type: string
+                      passwordSecretRef:
+                        description: Reference to a secret key containing the basic
+                          auth password.
+                        properties:
+                          key:
+                            description: The key of the secret to select from.  Must
+                              be a valid secret key.
+                            type: string
+                          name:
+                            default: ""
+                            description: |-
+                              Name of the referent.
+                              This field is effectively required, but due to backwards compatibility is
+                              allowed to be empty. Instances of this type with an empty value here are
+                              almost certainly wrong.
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                            type: string
+                          optional:
+                            description: Specify whether the Secret or its key must
+                              be defined
+                            type: boolean
+                        required:
+                        - key
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      projectId:
+                        description: Optional ProjectID tenant header.
+                        type: string
+                      tokenSecretRef:
+                        description: Reference to a secret key containing the bearer
+                          token or api key.
+                        properties:
+                          key:
+                            description: The key of the secret to select from.  Must
+                              be a valid secret key.
+                            type: string
+                          name:
+                            default: ""
+                            description: |-
+                              Name of the referent.
+                              This field is effectively required, but due to backwards compatibility is
+                              allowed to be empty. Instances of this type with an empty value here are
+                              almost certainly wrong.
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                            type: string
+                          optional:
+                            description: Specify whether the Secret or its key must
+                              be defined
+                            type: boolean
+                        required:
+                        - key
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      url:
+                        description: VictoriaLogs base URL.
+                        type: string
+                      username:
+                        description: Basic auth username.
+                        type: string
+                    required:
+                    - url
+                    type: object
                 type: object
               mcpServerRef:
                 description: The mcp server for this tool.
@@ -1917,6 +1985,7 @@ spec:
                 - CLOUD_RUN
                 - AZURE_FUNCTION
                 - DOCKER
+                - VICTORIA_LOGS
                 type: string
             required:
             - tool

diff --git a/charts/controller/templates/deployment.yaml b/charts/controller/templates/deployment.yaml
@@ -1,4 +1,5 @@
-{{ $consoleUrl := .Values.consoleUrl | default (printf "http://console.%s:4000" .Release.Namespace) }}
+{{ $consoleScheme := ternary "https" "http" .Values.console.tls.enabled }}
+{{ $consoleUrl := .Values.consoleUrl | default (printf "%s://console.%s:4000" $consoleScheme .Release.Namespace) }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -36,6 +37,9 @@ spec:
       - args:
         {{- toYaml .Values.controllerManager.manager.args | nindent 8 }}
         - --console-url={{ $consoleUrl }}/gql
+        {{- if .Values.console.tls.enabled }}
+        - --console-insecure-skip-tls-verify
+        {{- end }}
         - --console-token=$(CONSOLE_TOKEN)
         command:
         - /manager

diff --git a/charts/controller/templates/manager-rbac.yaml b/charts/controller/templates/manager-rbac.yaml
@@ -5,37 +5,56 @@ metadata:
   labels:
     app.kubernetes.io/part-of: plural-deployment-controller
   {{- include "controller.labels" . | nindent 4 }}
+{{- $coreRules := list .Values.rbac.configMapsAndNamespaces .Values.rbac.secrets }}
+{{- range $rule := $coreRules }}
+{{- if or (has "*" $rule.resources) (has "*" $rule.verbs) }}
+{{- fail "RBAC resources and verbs must be explicitly enumerated; wildcards are not allowed" }}
+{{- end }}
+{{- end }}
+{{- $deploymentsRule := .Values.rbac.deploymentsPlural }}
+{{- if or
+  (has "*" $deploymentsRule.resources)
+  (has "*" $deploymentsRule.verbs)
+  (has "*" $deploymentsRule.finalizerVerbs)
+  (has "*" $deploymentsRule.statusVerbs)
+}}
+{{- fail "RBAC resources and verbs must be explicitly enumerated; wildcards are not allowed" }}
+{{- end }}
 rules:
 - apiGroups:
   - ""
   resources:
-  - configmaps
-  - namespaces
+{{ toYaml .Values.rbac.configMapsAndNamespaces.resources | indent 2 }}
   verbs:
-  - get
-  - list
-  - patch
-  - update
-  - watch
-  - create
+{{ toYaml .Values.rbac.configMapsAndNamespaces.verbs | indent 2 }}
 - apiGroups:
   - ""
   resources:
-  - secrets
+{{ toYaml .Values.rbac.secrets.resources | indent 2 }}
   verbs:
-  - get
-  - list
-  - patch
-  - update
-  - watch
-  - create
-  - delete
+{{ toYaml .Values.rbac.secrets.verbs | indent 2 }}
 - apiGroups:
   - deployments.plural.sh
   resources:
-  - '*'
+{{ toYaml $deploymentsRule.resources | indent 2 }}
   verbs:
-  - '*'
+{{ toYaml $deploymentsRule.verbs | indent 2 }}
+- apiGroups:
+  - deployments.plural.sh
+  resources:
+  {{- range $resource := $deploymentsRule.resources }}
+  - {{ $resource }}/finalizers
+  {{- end }}
+  verbs:
+{{ toYaml $deploymentsRule.finalizerVerbs | indent 2 }}
+- apiGroups:
+  - deployments.plural.sh
+  resources:
+  {{- range $resource := $deploymentsRule.resources }}
+  - {{ $resource }}/status
+  {{- end }}
+  verbs:
+{{ toYaml $deploymentsRule.statusVerbs | indent 2 }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding