v0.68.3

• FEATURE: vmoperator: prettify reconcile diff in logs, now diff objects show only changed JSON fields.

• FEATURE: vmoperator: introduce VM_LOOPBACK env variable, which allows to override default loopback address, which is either localhost if VM _ENABLETCP6=true or 127.0.0.1 in other cases. Note: this change may cause component rollouts when 127.0.0.1 is used as the loopback address. Make sure to set this env var before upgrading
  .

• BUGFIX: vmoperator: recreate STS if immutable fields changed.

• BUGFIX: vmoperator: pod recreation isn't lost after triggerring StatefulSet delete.

• BUGFIX: vmdistributed: updated VMAuth config consolidating all VMSelects into a single read and all VMAgents into a si
  ngle write backend.

• BUGFIX: vmoperator: fix finalizer cleanup for VLAgent, VLogs, VMAgent, and VMSingle to target the correct resources.

• BUGFIX: config-reloader: log-format option supported as fallback for loggerFormat. See [#1954](https://gi
  thub.com//issues/1954).

• SECURITY: upgrade Go builder from Go1.25.7 to Go1.25.8. See the list of issues addressed in Go1.25.8.

v0.68.3-rc0

• FEATURE: vmoperator: prettify reconcile diff in logs, now diff objects show only changed JSON fields.

• FEATURE: vmoperator: introduce VM_LOOPBACK env variable, which allows to override default loopback address, which is either localhost if VM _ENABLETCP6=true or 127.0.0.1 in other cases. Note: this change may cause component rollouts when 127.0.0.1 is used as the loopback address. Make sure to set this env var before upgrading
  .

• BUGFIX: vmoperator: recreate STS if immutable fields changed.

• BUGFIX: vmoperator: pod recreation isn't lost after triggerring StatefulSet delete.

• BUGFIX: vmdistributed: updated VMAuth config consolidating all VMSelects into a single read and all VMAgents into a si
  ngle write backend.

• BUGFIX: vmoperator: fix finalizer cleanup for VLAgent, VLogs, VMAgent, and VMSingle to target the correct resources.

• BUGFIX: config-reloader: log-format option supported as fallback for loggerFormat. See [#1954](https://gi
  thub.com//issues/1954).

• SECURITY: upgrade Go builder from Go1.25.7 to Go1.25.8. See the list of issues addressed in Go1.25.8.

v0.68.2

• Dependency: vmoperator: Updated default versions for VL apps to v1.47.0.

• BUGFIX: vmoperator: perform statefulset pods deletion instead of eviction when maxUnavailable set to 100%, which is important for minimum downtime strategy. See #1706.

• BUGFIX: vmoperator: VMPodScrape for VLAgent and VMAgent now uses the correct port; previously it used the wrong port and could cause scrape failures. See #1887.

• BUGFIX: vmdistributed: fix PVC being owned by StatefulSet and top-level object simultaenously. See #1845.

• BUGFIX: vmoperator: remove unneeded finalizer from core K8s resources. See #835.

• BUGFIX: vmdistributed: remove finalizers from VMServiceScrape and VMPodScrape objects, and keep finalizers on VMAgent, VMCluster, and VMAuth when DeletionTimestamp is not empty.

• BUGFIX: vmsingle and vmagent: previously, ingest-only mode could still mount scrape configuration secrets when relabeling or stream aggregation was configured, which caused unexpected secret mounts and RBAC-related failures; now these secrets are not mounted in ingest-only mode, so deployments start with the expected minimal permissions and avoid related runtime errors. See #1828.

• BUGFIX: vmoperator: do not recreate STS if VCT size was increased and recreate in other cases.

• BUGFIX: vmoperator: wait for STS deletion in case of recreation without throwing an error.

v0.69.0-rc1

• Dependency: vmoperator: Updated default versions for VM apps to v1.137.0 version

• Dependency: vmoperator: Updated default versions for VL apps to v1.47.0.

• FEATURE: vmsingle: VMSingle reuses vmagent implementation to allow scraping and relabelling. See #1694

• FEATURE: vmoperator: perform statefulset pods deletion instead of eviction when maxUnavailable set to 100%, which is important for minimum downtime strategy. See #1706.

• FEATURE: vmuser: support targetRefs[*].crds to place multiple CRD objects behind a single backend

• BUGFIX: vmoperator: VMPodScrape for VLAgent and VMAgent now uses the correct port; previously it used the wrong port and could cause scrape failures. See #1887.

• BUGFIX: vmdistributed: updated VMAuth config consolidating all VMSelects into a single read and all VMClusters into a single write backend

• BUGFIX: vmdistributed: fix PVC being owned by StatefulSet and top-level object simultaenously. See #1845.

• BUGFIX: vmoperator: remove unneeded finalizer from core K8s resources. See #835.

v0.69.0-rc0

• Dependency: vmoperator: Updated default versions for VL apps to v1.47.0.

• FEATURE: vmsingle: VMSingle reuses vmagent implementation to allow scraping and relabelling. See #1694

• FEATURE: vmoperator: perform statefulset pods deletion instead of eviction when maxUnavailable set to 100%, which is important for minimum downtime strategy. See #1706.

• BUGFIX: vmoperator: VMPodScrape for VLAgent and VMAgent now uses the correct port; previously it used the wrong port and could cause scrape failures. See #1887.

• BUGFIX: vmoperator: remove unneeded finalizer from core K8s resources. See #835.

v0.68.1

SECURITY: upgrade Go builder from Go1.25.5 to Go1.25.7. See the list of issues addressed in Go1.25.7.)

• BUGFIX: vmanomaly: fix configuration marshalling for Prophet model. Previously, using Prophet model would lead to panic during configuration marshalling.

v0.68.0

Release date: 23 February 2026

Update note 1: deprecated VMProbe's spec.targets.ingress. Use spec.targets.kubernetes slice instead. Please check example of VMProbe with Ingress discovery. This field will be removed in v0.71.0.

Update note 2: deprecated VMProbe's spec.targets.staticConfig. Use spec.targets.static instead. Please check example of VMProbe with static targets. This field will be removed in v0.71.0.

• Dependency: vmoperator: Updated default versions for VM apps to v1.136.0 version

• Dependency: vmoperator: Updated default versions for VL apps to v1.45.0.

• FEATURE: vmalertmanager: added namespace to --cluster.peer arguments explicitly when spec.clusterDomainName is omitted and added unit tests to test this.

• FEATURE: vmoperator: introduce VMDistributed CR, which helps to propagate changes to each zone without affecting global availability. Before distributed setup deployment was multistep manual action. See #1515.

• FEATURE: vlagent: support ability to override default stream fields for vlagent in logs collection mode.

• FEATURE: vmoperator: added VM_*_EPHEMERAL_STORAGE_REQUEST and VM_*_EPHEMERAL_STORAGE_LIMIT global variables that allow to configure ephemeralStorage requests and limits. See #1711.

• FEATURE: vmalertmanager: added tracing support. See #1770.

• FEATURE: vmprobe: added spec.targets.kubernetes property, that allows to configure probe for ingress, pod and service roles. See #1078 and #1716.

• FEATURE: vmscrapeconfig: added nomad_sd_config support. See #1809.

• FEATURE: vmoperator: support VPA for vmcluster, vtcluster, vlcluster and vmauth. See #1795. Thanks to the @dctrwatson for the pull request #1803.

• BUGFIX: vmagent: previously the operator requested nodes/proxy RBAC permissions even though vmagent did not use them; now this permission is no longer required, reducing the default privilege footprint for users running vmagent. See #1753.

• BUGFIX: vmalert: throw error if no notifiers found. See #1757.

• BUGFIX: vlagent: previously the operator emitted quoted spec.k8sCollector.{msgField,timeField,ignoreFields,decolorizeFields} values, which caused vlagent to misparse these fields; now these fields are emitted unquoted so collector settings are applied correctly. See #1749.

• BUGFIX: vmoperator: fixed conflicts for VMAlert, VMAlertmanager and VMAuth reconcilers, which are updating same objects concurrently with reconcilers for their child objects.

• BUGFIX: vmoperator: previously PVC downscaling always emitted a warning, which is not expected, while using PVC autoresizer; now warning during attempt to downsize PVC is only emitted if operator.victoriametrics.com/pvc-allow-volume-expansion: false is not set. See #1747.

• BUGFIX: vmoperator: skip self scrape objects management if respective controller is disabled. See #1718.

• BUGFIX: vmagent: support both prometheus-compatible endpointslice and old endpointslices roles.

• BUGFIX: vmanomaly: fix pod metrics port in the default VMPodScrape.

• BUGFIX: vmoperator: support Prometheus operator AlertmanagerConfig spec.muteTimeIntervals conversion to VMAlertmanagerConfig spec.timeIntervals. See #1783.

• BUGFIX: vmoperator: previously StatefulSet/Deployment/DaemonSet rollouts could proceed in parallel, now pods are rolled out sequentially. See #1693.

• BUGFIX: config-reloader: previously --only-init-config still kept the reloader running background watchers; now it exits after the initial config update so the pod terminates as expected. See #1785.

• BUGFIX: vmoperator: previously, recreating a resource after deletion could hang and block updates; now resource recreation completes normally. See #1707.

• BUGFIX: vmoperator: use global image registry unless image.repository is defined. See #1813.

• BUGFIX: vmalertmanagerconfig: previously spec.route and spec.receivers were required; now both parameters are optional to align with prometheus operator. VMAlertmanager now can be used to set just the global inhibition rules. See #1800.

• BUGFIX: vmoperator: use global image registry unless image.repository is defined. See #1813.

• BUGFIX: vmagent: fixed RBAC, when ingestOnlyMode is enabled and relabel of stream aggregation configurations defined. See #1828.

v0.68.0-rc1

Update note 1: deprecated VMProbe's spec.targets.ingress. Use spec.targets.kubernetes slice instead. Please check example of VMProbe with Ingress discovery. This field will be removed in v0.71.0.

Update note 2: deprecated VMProbe's spec.targets.staticConfig. Use spec.targets.static instead. Please check example of VMProbe with static targets. This field will be removed in v0.71.0.

• Dependency: vmoperator: Updated default versions for VM apps to v1.135.0 version

• Dependency: vmoperator: Updated default versions for VL apps to v1.45.0.

• FEATURE: vmalertmanager: added namespace to --cluster.peer arguments explicitly when spec.clusterDomainName is omitted and added unit tests to test this.

• FEATURE: vmoperator: introduce VMDistributed CR, which helps to propagate changes to each zone without affecting global availability. Before distributed setup deployment was multistep manual action. See #1515.

• FEATURE: vlagent: support ability to override default stream fields for vlagent in logs collection mode.

• FEATURE: vmoperator: added VM_*_EPHEMERAL_STORAGE_REQUEST and VM_*_EPHEMERAL_STORAGE_LIMIT global variables that allow to configure ephemeralStorage requests and limits. See #1711.

• FEATURE: vmalertmanager: added tracing support. See #1770.

• FEATURE: vmprobe: added spec.targets.kubernetes property, that allows to configure probe for ingress, pod and service roles. See #1078 and #1716.

• BUGFIX: vmagent: previously the operator requested nodes/proxy RBAC permissions even though vmagent did not use them; now this permission is no longer required, reducing the default privilege footprint for users running vmagent. See #1753.

• BUGFIX: vmalert: throw error if no notifiers found. See #1757.

• BUGFIX: vlagent: previously the operator emitted quoted spec.k8sCollector.{msgField,timeField,ignoreFields,decolorizeFields} values, which caused vlagent to misparse these fields; now these fields are emitted unquoted so collector settings are applied correctly. See #1749.

• BUGFIX: vmoperator: fixed conflicts for VMAlert, VMAlertmanager and VMAuth reconcilers, which are updating same objects concurrently with reconcilers for their child objects.

• BUGFIX: vmoperator: previously PVC downscaling always emitted a warning, which is not expected, while using PVC autoresizer; now warning during attempt to downsize PVC is only emitted if operator.victoriametrics.com/pvc-allow-volume-expansion: false is not set. See #1747.

• BUGFIX: vmoperator: skip self scrape objects management if respective controller is disabled. See #1718.

• BUGFIX: vmagent: support both prometheus-compatible endpointslice and old endpointslices roles.

• BUGFIX: vmanomaly: fix pod metrics port in the default VMPodScrape.

• BUGFIX: vmoperator: support Prometheus operator AlertmanagerConfig spec.muteTimeIntervals conversion to VMAlertmanagerConfig spec.timeIntervals. See #1783.

• BUGFIX: vmoperator: previously StatefulSet/Deployment/DaemonSet rollouts could proceed in parallel, now pods are rolled out sequentially. See #1693.

• BUGFIX: config-reloader: previously --only-init-config still kept the reloader running background watchers; now it exits after the initial config update so the pod terminates as expected. See #1785.

• BUGFIX: vmoperator: previously, recreating a resource after deletion could hang and block updates; now resource recreation completes normally. See #1707.

v0.68.0-rc0

• Dependency: vmoperator: Updated default versions for VM apps to v1.135.0 version

• Dependency: vmoperator: Updated default versions for VL apps to v1.44.0.

• FEATURE: vmalertmanager: added namespace to --cluster.peer arguments explicitly when spec.clusterDomainName is omitted and added unit tests to test this.

• FEATURE: vmoperator: introduce VMDistributed CR, which helps to propagate changes to each zone without affecting global availability. Before distributed setup deployment was multistep manual action. See #1515.

• FEATURE: vlagent: support ability to override default stream fields for vlagent in logs collection mode.

• FEATURE: vmoperator: added VM_*_EPHEMERAL_STORAGE_REQUEST and VM_*_EPHEMERAL_STORAGE_LIMIT global variables that allow to configure ephemeralStorage requests and limits. See #1711.

• FEATURE: vmalertmanager: added tracing support. See #1770.

• BUGFIX: vmagent: previously the operator requested nodes/proxy RBAC permissions even though vmagent did not use them; now this permission is no longer required, reducing the default privilege footprint for users running vmagent. See #1753.

• BUGFIX: vmalert: throw error if no notifiers found. See #1757.

• BUGFIX: vlagent: previously the operator emitted quoted spec.k8sCollector.{msgField,timeField,ignoreFields,decolorizeFields} values, which caused vlagent to misparse these fields; now these fields are emitted unquoted so collector settings are applied correctly. See #1749.

• BUGFIX: vmoperator: fixed conflicts for VMAlert, VMAlertmanager and VMAuth reconcilers, which are updating same objects concurrently with reconcilers for their child objects.

• BUGFIX: vmoperator: previously PVC downscaling always emitted a warning, which is not expected, while using PVC autoresizer; now warning during attempt to downsize PVC is only emitted if operator.victoriametrics.com/pvc-allow-volume-expansion: false is not set. See #1747.

• BUGFIX: vmoperator: skip self scrape objects management if respective controller is disabled. See #1718.

• BUGFIX: vmagent: support both prometheus-compatible endpointslice and old endpointslices roles.

v0.67.0

Update note 1: removed 3rd-party config reloaders. Now VMAlert, VMAgent, VMAuth and VMAlertmanager are using only VM config reloader. Please verify spec.configReloaderExtraArgs in all instances of VMAlert, VMAuth, VMAgent and VMAlertmanager CRs are using valid config-reloader arguments before upgrading.
Update note 2: removed deprecated VMAgent spec.aPIServerConfig property
Update note 3: removed deprecated VMCluster spec.vmselect.persistentVolume property
Update note 4: VM_CUSTOMCONFIGRELOADERIMAGE is deprecated and will be removed in next releases. Use VM_CONFIG_RELOADER_IMAGE instead.
Update note 5: VMAgent’s, VMAuth’s, VMAlert’s and VMAlertmanager’s spec.configReloaderImageTag is deprecated and will be removed in next releases. Use spec.configReloaderImage instead.
Update note 6: VMAgent’s spec.vmAgentExternalLabelName is deprecated and will be removed in next releases. Use spec.externalLabelName instead.
Update note 7: VMAuth’s spec.unauthorizedUserAccessSpec.url_prefix and spec.unauthorizedUserAccessSpec.url_map are deprecated and will be removed in next releases. Use spec.unauthorizedUserAccessSpec.targetRef instead.
Update note 8: VMServiceScrape’s endpointslices role is deprecated and will be removed in 0.70.0. Use endpointslice instead.

• Dependency: vmoperator: Updated default versions for VM apps to v1.134.0 version

• Dependency: vmoperator: Updated default versions for VL apps to v1.43.1.

• Dependency: vmoperator: Updated default versions for VT apps to v0.7.0 version.

• Dependency: vmoperator: Updated default versions for VMAnomaly to v1.28.5 version

• FEATURE: vmagent: support namespace parameter in attach_metadata section for all scrape configurations. See #1654.

• FEATURE: vlagent: support logs collection. See #1501.

• FEATURE: vmoperator: use operator_bad_objects_total metric with object_namespace and crd labels to track invalid objects managed by VMAgent, VMAuth, VMAlert and VMAlertmanager. Old operator_alertmanager_bad_objects_count and operator_vmalert_bad_objects_count are deprecated and will be removed in next releases.

• FEATURE: vmoperator: added HPA support for all cluster CR storage. See #1678.

• FEATURE: vlagent, vlsingle and vlcluster: support license options. See #2649.

• FEATURE: vmanomaly: add support of spec.server configuration.

• FEATURE: vlagent: add collector extraFilter, includePodLabels, includePodAnnotations, includeNodeLabels and includeNodeAnnotations support for more flexible Kubernetes logs by metadata selection.

• FEATURE: vlagent: use a single volume for all VLAgent data by default instead of separate volumes/paths for checkpoints and remote write data.

• FEATURE: vmagent: global sample limit per scrape target is supported via sampleLimit option in scrape config. See #10168.

• BUGFIX: vmoperator: fixed HPA cleanup logic for all cluster resources, before it was constantly recreated. Bug introduced in this commit.

• BUGFIX: VMCluster, VLCluster and VTCluster: prevent cluster load balancer secret from infinite reconcile.

• BUGFIX: vmsingle, vlsingle and vtsingle: do not mount emptydir if storage data volume is already present in volumes list. Before it was impossible to mount external PVC without overriding default storageDataPath using spec.extraArgs and without having unneeded emptydir listed among pod volumes. Related issues #1477.

• BUGFIX: vmoperator: use Service labels instead of selector in VMServiceScrape selector. See #1709.

• BUGFIX: vmoperator: update Alertmanager dependency to fix config validation for Incident.io. See #1730.

• BUGFIX: vmoperator: do not add -enterprise suffix to image, if tag contains @ symbol. See #1723.

• BUGFIX: vmoperator: use 127.0.0.1 instead of localhost in reload and snapshot url for setups without IPV6 enabled.

• BUGFIX: vmscrapeconfig: properly convert prometheus ScrapeConfig's role into VMScrapeConfig. See #1735.

• BUGFIX: vmagent: make vmagent container default. See #1740.

• BUGFIX: vmoperator: use 127.0.0.1 instead of localhost in reload url for setups without IPV6 enabled.

• BUGFIX: VLAgent: update strict security mode configuration to work correctly with K8sCollector.