🎉 v2.10.0

.changes/2.10.0.md

@@ -0,0 +1,38 @@
+## 2.10.0 (November 12, 2025)
+
+NOTES:
+
+* `RunsCollector`: Add new Prometheus-compatible metrics `hcp_tf_runs` and `hcp_tf_runs_total` to collect pending runs by status and the total number of pending runs, respectively. These metrics are in the alpha stage and subject to change. [[GH-637](https://github.com/hashicorp/hcp-terraform-operator/pull/637)]
+
+BUG FIXES:
+
+* `Workspace`: Fix an issue where sensitive Terraform or Environment variables are not updated when their sensitivity changes. [[GH-629](https://github.com/hashicorp/hcp-terraform-operator/pull/629)]
+* `AgentPool`: Exclude runs awaiting user interaction from scaling to prevent agents from being kept unnecessarily active. [[GH-618](https://github.com/hashicorp/hcp-terraform-operator/pull/618)]
+* `AgentPool`: Fix version parsing for Terraform Enterprise version format changes. [[GH-641](https://github.com/hashicorp/hcp-terraform-operator/pull/641)]
+
+FEATURES:
+
+* `RunsCollector`: Introduce a new controller that scrapes HCP Terraform run statuses from a specified Agent Pool and exposes them as Prometheus-compatible metrics. [[GH-637](https://github.com/hashicorp/hcp-terraform-operator/pull/637)]
+* `AgentToken`: Introduce a new controller that manages tokens in arbitrary agent pools. [[GH-628](https://github.com/hashicorp/hcp-terraform-operator/pull/628)]
+
+ENHANCEMENTS:
+
+* `Controllers`: Add a new annotation, `app.terraform.io/paused`, to pause reconciliation for a specific CR. [[GH-631](https://github.com/hashicorp/hcp-terraform-operator/pull/631)]
+* `AgentPool`: Update Kubernetes Secret synchronization to perform batch updates at the end of agent token reconciliation, reducing API calls and preventing race conditions. [[GH-650](https://github.com/hashicorp/hcp-terraform-operator/pull/650)]
+
+DEPENDENCIES:
+
+* Bump `kube-rbac-proxy` from 0.19.1 to 0.20.0. [[GH-640](https://github.com/hashicorp/hcp-terraform-operator/pull/640)]
+* Bump `k8s.io/api` from 0.32.3 to 0.34.1. [[GH-643](https://github.com/hashicorp/hcp-terraform-operator/pull/643)]
+* Bump `k8s.io/apimachinery` from 0.32.3 to 0.34.1. [[GH-643](https://github.com/hashicorp/hcp-terraform-operator/pull/643)]
+* Bump `github.com/hashicorp/go-slug` from 0.16.4 to 0.16.7. [[GH-644](https://github.com/hashicorp/hcp-terraform-operator/pull/644)]
+* Bump `github.com/hashicorp/go-tfe` from 1.76.0 to 1.93.0. [[GH-644](https://github.com/hashicorp/hcp-terraform-operator/pull/644)]
+* Bump `k8s.io/client-go` from 0.32.3 to 0.34.1. [[GH-643](https://github.com/hashicorp/hcp-terraform-operator/pull/643)]
+* Bump `sigs.k8s.io/controller-runtime` from 0.20.4 to 0.22.4. [[GH-643](https://github.com/hashicorp/hcp-terraform-operator/pull/643)]
+
+## Community Contributors :raised_hands:
+
+- @AleksaC made their contribution in https://github.com/hashicorp/hcp-terraform-operator/pull/617
+- @jrindy-iterable made their contribution in https://github.com/hashicorp/hcp-terraform-operator/pull/618
+- @nhomble made their contribution in https://github.com/hashicorp/hcp-terraform-operator/pull/627
+

CHANGELOG.md

@@ -1,3 +1,41 @@
+## 2.10.0 (November 12, 2025)
+
+NOTES:
+
+* `RunsCollector`: Add new Prometheus-compatible metrics `hcp_tf_runs` and `hcp_tf_runs_total` to collect pending runs by status and the total number of pending runs, respectively. These metrics are in the alpha stage and subject to change. [[GH-637](https://github.com/hashicorp/hcp-terraform-operator/pull/637)]
+
+BUG FIXES:
+
+* `Workspace`: Fix an issue where sensitive Terraform or Environment variables are not updated when their sensitivity changes. [[GH-629](https://github.com/hashicorp/hcp-terraform-operator/pull/629)]
+* `AgentPool`: Exclude runs awaiting user interaction from scaling to prevent agents from being kept unnecessarily active. [[GH-618](https://github.com/hashicorp/hcp-terraform-operator/pull/618)]
+* `AgentPool`: Fix version parsing for Terraform Enterprise version format changes. [[GH-641](https://github.com/hashicorp/hcp-terraform-operator/pull/641)]
+
+FEATURES:
+
+* `RunsCollector`: Introduce a new controller that scrapes HCP Terraform run statuses from a specified Agent Pool and exposes them as Prometheus-compatible metrics. [[GH-637](https://github.com/hashicorp/hcp-terraform-operator/pull/637)]
+* `AgentToken`: Introduce a new controller that manages tokens in arbitrary agent pools. [[GH-628](https://github.com/hashicorp/hcp-terraform-operator/pull/628)]
+
+ENHANCEMENTS:
+
+* `Controllers`: Add a new annotation, `app.terraform.io/paused`, to pause reconciliation for a specific CR. [[GH-631](https://github.com/hashicorp/hcp-terraform-operator/pull/631)]
+* `AgentPool`: Update Kubernetes Secret synchronization to perform batch updates at the end of agent token reconciliation, reducing API calls and preventing race conditions. [[GH-650](https://github.com/hashicorp/hcp-terraform-operator/pull/650)]
+
+DEPENDENCIES:
+
+* Bump `kube-rbac-proxy` from 0.19.1 to 0.20.0. [[GH-640](https://github.com/hashicorp/hcp-terraform-operator/pull/640)]
+* Bump `k8s.io/api` from 0.32.3 to 0.34.1. [[GH-643](https://github.com/hashicorp/hcp-terraform-operator/pull/643)]
+* Bump `k8s.io/apimachinery` from 0.32.3 to 0.34.1. [[GH-643](https://github.com/hashicorp/hcp-terraform-operator/pull/643)]
+* Bump `github.com/hashicorp/go-slug` from 0.16.4 to 0.16.7. [[GH-644](https://github.com/hashicorp/hcp-terraform-operator/pull/644)]
+* Bump `github.com/hashicorp/go-tfe` from 1.76.0 to 1.93.0. [[GH-644](https://github.com/hashicorp/hcp-terraform-operator/pull/644)]
+* Bump `k8s.io/client-go` from 0.32.3 to 0.34.1. [[GH-643](https://github.com/hashicorp/hcp-terraform-operator/pull/643)]
+* Bump `sigs.k8s.io/controller-runtime` from 0.20.4 to 0.22.4. [[GH-643](https://github.com/hashicorp/hcp-terraform-operator/pull/643)]
+
+## Community Contributors :raised_hands:
+
+- @AleksaC made their contribution in https://github.com/hashicorp/hcp-terraform-operator/pull/617
+- @jrindy-iterable made their contribution in https://github.com/hashicorp/hcp-terraform-operator/pull/618
+- @nhomble made their contribution in https://github.com/hashicorp/hcp-terraform-operator/pull/627
+
 ## 2.9.2 (May 28, 2025)
 
 BUG FIXES:

Dockerfile

@@ -7,7 +7,7 @@
 # Every target has a BIN_NAME argument that must be provided via --build-arg=BIN_NAME=<name>
 # when building.
 
-ARG GO_VERSION=1.25.1
+ARG GO_VERSION=1.25.4
 
 # ===================================
 #

Makefile

@@ -136,7 +136,7 @@ copywrite: install-copywrite ## Run copywrite against code.
 
 .PHONY: test
 test: manifests generate fmt vet copywrite envtest ## Run tests.
-	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test -timeout 45m -v ./internal/controller -coverprofile cover.out ${TESTARGS}
+	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test -timeout 1h -v ./internal/controller -coverprofile cover.out ${TESTARGS}
 
 .PHONY: test-api
 test-api: fmt vet copywrite ## Run API tests.

README.md

@@ -46,7 +46,7 @@ Three simple commands to install the Operator:
 ```console
 $ helm repo add hashicorp https://helm.releases.hashicorp.com
 $ helm repo update
-$ helm install demo hashicorp/hcp-terraform-operator --wait --version 2.9.2
+$ helm install demo hashicorp/hcp-terraform-operator --wait --version 2.10.0
 ```
 
 More detailed information about the installation and available values can be found [here](./charts/hcp-terraform-operator/README.md).
@@ -61,7 +61,7 @@ Controllers usage guides:
 - [AgentToken](./docs/agenttoken.md)
 - [Module](./docs/module.md)
 - [Project](./docs/project.md)
-- [Runs Collector](./docs/runs_collector.md)
+- [RunsCollector](./docs/runs_collector.md)
 - [Workspace](./docs/workspace.md)
 
 

RELEASING.md

@@ -47,10 +47,17 @@ To create a new release, adhere to the following steps:
 
   Note that the version option (`auto` in the example above) must match the option you selected earlier. If there are any issues, address them before proceeding.
 
-  Once the log entry appears as expected, proceed with the generation and merge your changes.
+  Once the log entry appears as expected, proceed with the generation.
 
   ```console
   $ changie batch auto
+  ```
+
+  _This is the time to review the corresponding changelog for the version in the `.changie/<SEMVER>.md` file and update it if necessary. Please include any community contribution acknowledgements here._
+
+  Merge the release changes into the [`CHANGELOG`](./CHANGELOG.md) file.
+
+  ```console
   $ changie merge
   ```
 

api/v1alpha2/runscollector_types.go

@@ -36,7 +36,7 @@ type RunsCollectorStatus struct {
 //+kubebuilder:printcolumn:name="Pool Name",type=string,JSONPath=`.status.agentPool.name`
 //+kubebuilder:metadata:labels="app.terraform.io/crd-schema-version=v25.11.0"
 
-// Runs Collector scraptes HCP Terraform Run statuses from a given Agent Pool and exposes them as Prometheus-compatible metrics.
+// RunsCollector scraptes HCP Terraform Run statuses from a given Agent Pool and exposes them as Prometheus-compatible metrics.
 // More information:
 //   - https://developer.hashicorp.com/terraform/cloud-docs/run/remote-operations
 type RunsCollector struct {

charts/hcp-terraform-operator/Chart.yaml

@@ -5,5 +5,5 @@ apiVersion: v2
 name: hcp-terraform-operator
 description: Official Helm chart for HCP Terraform Operator for Kubernetes.
 type: application
-version: "2.9.2"
-appVersion: "2.9.2"
+version: "2.10.0"
+appVersion: "2.10.0"

charts/hcp-terraform-operator/README.md

@@ -25,7 +25,7 @@ Use the option `--version VERSION` with `helm install` and `helm upgrade` comman
 
     ```console
     $ helm install demo hashicorp/hcp-terraform-operator \
-      --version 2.9.2 \
+      --version 2.10.0 \
       --namespace tfc-operator-system \
       --create-namespace
     ```
@@ -36,7 +36,7 @@ Below are examples of the Operator installation/upgrade Helm chart with options.
 
 ```console
 $ helm install demo hashicorp/hcp-terraform-operator \
-  --version 2.9.2 \
+  --version 2.10.0 \
   --namespace tfc-operator-system \
   --create-namespace \
   --set operator.syncPeriod=10m \
@@ -57,7 +57,7 @@ If targeting a Terraform Enterprise instance rather than HCP Terraform, set the
 
 ```console
 $ helm install demo hashicorp/hcp-terraform-operator \
-  --version 2.9.2 \
+  --version 2.10.0 \
   --set operator.tfeAddress="https://tfe-api.my-company.com"
 ```
 
@@ -69,7 +69,7 @@ For more information, please refer to the [FAQ](./../../docs/faq.md#general-ques
 
 ```console
 $ helm upgrade demo hashicorp/hcp-terraform-operator \
-  --version 2.9.2 \
+  --version 2.10.0 \
   --namespace hcp-terraform-operator-system \
   --set operator.syncPeriod=5m \
   --set controllers.agentPool.workers=5 \

charts/hcp-terraform-operator/crds/app.terraform.io_runscollectors.yaml

@@ -30,7 +30,7 @@ spec:
     schema:
       openAPIV3Schema:
         description: |-
-          Runs Collector scraptes HCP Terraform Run statuses from a given Agent Pool and exposes them as Prometheus-compatible metrics.
+          RunsCollector scraptes HCP Terraform Run statuses from a given Agent Pool and exposes them as Prometheus-compatible metrics.
           More information:
             - https://developer.hashicorp.com/terraform/cloud-docs/run/remote-operations
         properties:

charts/test/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/hcp-terraform-operator/charts/test
 
-go 1.25.1
+go 1.25.4
 
 require (
 	github.com/gruntwork-io/terratest v0.47.2

config/crd/bases/app.terraform.io_runscollectors.yaml

@@ -27,7 +27,7 @@ spec:
     schema:
       openAPIV3Schema:
         description: |-
-          Runs Collector scraptes HCP Terraform Run statuses from a given Agent Pool and exposes them as Prometheus-compatible metrics.
+          RunsCollector scraptes HCP Terraform Run statuses from a given Agent Pool and exposes them as Prometheus-compatible metrics.
           More information:
             - https://developer.hashicorp.com/terraform/cloud-docs/run/remote-operations
         properties:

config/manager/kustomization.yaml

@@ -5,4 +5,4 @@ kind: Kustomization
 images:
 - name: controller
   newName: registry.connect.redhat.com/hashicorp/hcp-terraform-operator
-  newTag: 2.9.2
+  newTag: 2.10.0

config/manager/manager.yaml

@@ -68,6 +68,8 @@ spec:
         - --module-sync-period=5m
         - --project-workers=1
         - --project-sync-period=5m
+        - --runs-collector-workers=1
+        - --runs-collector-sync-period=15s
         - --workspace-workers=1
         - --workspace-sync-period=5m
         image: controller:latest

config/manifests/bases/hcp-terraform-operator.clusterserviceversion.yaml

@@ -63,7 +63,7 @@ spec:
       name: projects.app.terraform.io
       version: v1alpha2
     - description: |-
-        Runs Collector scraptes HCP Terraform Run statuses from a given Agent Pool and exposes them as Prometheus-compatible metrics.
+        RunsCollector scraptes HCP Terraform Run statuses from a given Agent Pool and exposes them as Prometheus-compatible metrics.
         More information:
           - https://developer.hashicorp.com/terraform/cloud-docs/run/remote-operations
       displayName: Runs Collector

docs/api-reference.md

@@ -683,7 +683,7 @@ _Appears in:_
 
 
 
-Runs Collector scraptes HCP Terraform Run statuses from a given Agent Pool and exposes them as Prometheus-compatible metrics.
+RunsCollector scraptes HCP Terraform Run statuses from a given Agent Pool and exposes them as Prometheus-compatible metrics.
 More information:
   - https://developer.hashicorp.com/terraform/cloud-docs/run/remote-operations
 

docs/metrics.md

@@ -15,6 +15,8 @@ Starting with version `2.10.0`, the operator introduces HCP Terraform–specific
 | `hcp_tf_runs{run_status, agent_pool_id, agent_pool_name}` | Gauge | Pending runs by statuses. | RunsCollector | Alpha |
 | `hcp_tf_runs_total{agent_pool_id, agent_pool_name}` | Gauge | Total number of pending Runs. | RunsCollector | Alpha |
 
+_When combined with external scalers such as [KEDA](https://keda.sh/), runs-related metrics offer greater flexibility for scaling._
+
 ## Scraping Metrics
 
 How metrics are scraped will depend on how you operate your Prometheus server. The below example assumes that the [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator) is being used to run Prometheus.

docs/runs_collector.md

@@ -1,8 +1,8 @@
-# `Runs Collector`
+# `RunsCollector`
 
-`Runs Collector` controller scrapes HCP Terraform run statuses from a given Agent Pool.
+The `RunsCollector` controller retrieves HCP Terraform run statuses from a specified Agent Pool and exposes them as Prometheus metrics.
 
-Please refer to the [CRD](../config/crd/bases/app.terraform.io_runscollectors.yaml) and [API Reference](./api-reference.md#runscollector) to get the full list of available options.
+For a complete list of available configuration options, refer to the [CRD](../config/crd/bases/app.terraform.io_runscollectors.yaml) and [API Reference](./api-reference.md#runscollector).
 
 Below is a basic example of a Runs Collector Custom Resource:
 
@@ -23,6 +23,8 @@ spec:
 
 Once the above CR is applied, the Operator starts scraping run metrics from the `multik` agent pool under the `kubernetes-operator` organization.
 
+Please refer to the [metrics page](./metrics.md#available-metrics) for a complete list of available metrics.
+
 If you have any questions, please check out the [FAQ](./faq.md#runs-collector-controller).
 
 If you encounter any issues with the `RunsCollector` controller please refer to the [Troubleshooting](../README.md#troubleshooting).

go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/hcp-terraform-operator
 
-go 1.25.1
+go 1.25.4
 
 require (
 	github.com/go-logr/logr v1.4.3

internal/controller/agentpool_controller_test.go

@@ -99,7 +99,7 @@ var _ = Describe("Agent Pool controller", Ordered, func() {
 
 		Eventually(func() bool {
 			err := tfClient.AgentPools.Delete(ctx, instance.Status.AgentPoolID)
-			return err == tfc.ErrResourceNotFound || err == nil
+			return err == tfc.ErrResourceNotFound
 		}).Should(BeTrue())
 	})