chore: prepare Operator v3.17.0 (EN-2723)

[Dav-14]

Summary

Prepare the Operator v3.17.0 minor release from main, including the changes merged since v3.16.0:

• Bump the operator and operator-crds chart versions and appVersions.
• Update the CRD chart dependency lock.

The Credentials fixes (#548 and #544) are already merged into main and are included in this release candidate. They produce superuser=false with the required Ledger scopes, matching the Ledger Operator beta.10 Credentials schema. The Credentials CRD is provided by the Ledger Operator chart.

Validation

Both charts pass Helm lint, the Operator chart renders successfully, and git diff --check passes. Full local Go tests and Nix pre-commit were not rerun. CI and reviews must cover the latest commit.

This PR prepares the version; artifact publication and runtime qualification remain pending.

EN-2723

[NumaryBot]

docs/07-Upgrade/03-Operator v3.16.1.md:16

🟡 [minor] Correct and complete the schema migration inventory

The upgrade gate says monitoring.traces is removed, but the head CRD retains traces and removes only traces.sampling (config CRD lines 2120–2144). The diff also removes persistence.coldCache and replaces monitoring.pyroscope.authToken/basicAuthPassword with Secret references, neither of which is listed. An operator using this inventory to prepare migration can overlook pruned profiling credentials/cache configuration while unnecessarily removing valid tracing configuration.

Suggestion: List traces.sampling rather than traces, include coldCache and both Pyroscope credential replacements, and document moving the profiling credentials into referenced Secrets before applying the schema.

[Dav-14]

Addressed the schema migration finding in head 7a760262e8c7baf38ec165a52e8b0d4f1d624d9b.

The notes now list all 35 removed property paths, including persistence.coldCache and the two inline Pyroscope credential fields; tracing retains monitoring.traces and removes only traces.sampling. The Pyroscope procedure explicitly maps authToken to authTokenFrom and basicAuthPassword to basicAuthPasswordFrom, requires non-empty Secret name/key in the Ledger Cluster namespace, retains the existing auth method/basicAuthUser, and prepares the Secret references through the owning GitOps lane before coordinated schema/controller/configuration adoption. It includes delivery, missing-Secret/key, admission/reconciliation and recovery gates without exposing or creating credentials.

Verified against the generated candidate schema and git diff --check. Independent exact-head Principal/Product/SRE recheck passes for documentation accuracy and accepts the in-scope finding as addressed. This is a fallback issue comment, not a resolvable inline review thread. The full candidate remains blocked on compatible Ledger operator/CRD, effective-config migration, real ingestion/denial and recovery evidence, and linked human compatibility approval. Previous-head Tests/Dirty/five Kubernetes E2E passed; current-head CI is queued. The PR remains draft. No Slack, publication or deployment.

[Dav-14]

Current-head CI checkpoint for 7a760262e8c7baf38ec165a52e8b0d4f1d624d9b (run 37608245435):

Tests and Dirty passed. Kubernetes E2E 1.31 and 1.32 passed after one individual retry each for Docker Hub HTTP 500 errors before tests; 1.35 passed initially. Kubernetes 1.34 also passed after its single individual network retry. The run is complete and remains failed solely on the 1.33 cleanup below. No further job retry is planned.

⚠️ Kubernetes 1.33 remains failed and has not been retried: the webhooks assertions and manual cleanup-finalizers step completed, but Chainsaw cleanup reached its five-minute deadline while deleting fixture Database chainsaw-webhooks-webhooks. The separate auto-created chainsaw-webhooks-ledger Database did exist and was patched/deleted successfully. The fixture Database is absent from the manual finalizer-removal list. Logs do not establish why normal deletion failed, so this is not classified as a harmless infrastructure error or a proven release regression.

The independent review confirms the cleanup observation and that this test fixture is unchanged from v3.16.0. Root-cause evidence is still needed before changing the frozen candidate (v3.16.0 + #548/#544 only). The PR remains draft; runtime compatibility, migration, recovery and human approval gates remain open.

[NumaryBot]

The required automated review completed with no remaining findings.

The base branch was changed.

[NumaryBot]

The required automated review completed with no remaining findings.

[NumaryBot]

The required automated review completed with no remaining findings.

[NumaryBot]

The required automated review completed with no remaining findings.