v0.7.12 — [UNRELEASED]

include: extended to all major Katalog blocks

Previously include: was only supported in e2e expect:. It now works across validation.rules, mutation.rules, conversion.paths, status.fields, notes.functions, profiles, idp.fields, and simulate ops:.

Each include file uses the same root key as the inline block and is expanded in place before the runtime sees the declaration. See documentation/concepts/composition/02-include.md for the full reference and domain layout pattern.

Server-Side Apply for all resource packages

Every reconcilable resource package now uses Kubernetes Server-Side Apply (ApplyPatchType, fieldManager: orkestra-runtime, force: true) instead of Get → compare → Update. Update delegates to the new Apply function; callers are unchanged.

This eliminates false-positive drift from k8s-injected defaults (SA token volumes, imagePullPolicy, Protocol: TCP, default security contexts) and resolves KI-002 resource-version conflicts caused by the status-patch → immediate-reconcile race. Jobs, ServiceAccounts, and PVCs keep Create semantics — their specs are immutable or managed externally.

Cluster-scoped GC and always-on finalizer

runners.DeleteOwnedClusterScopedResources now covers Namespaces, ClusterRoles, ClusterRoleBindings, PersistentVolumes, and cluster-scoped custom resources. Previously only Namespaces were explicitly cleaned up on CR deletion.

Every operator now receives the orkestra.orkspace.io/cleanup finalizer unconditionally. Previously the finalizer was only injected when the operator declared Namespace resources. Without it, a CR with cluster-scoped custom: children (e.g. a namespaced CR spawning a cluster-scoped child via custom:) was deleted by Kubernetes before the explicit GC runner could fire, leaving orphaned cluster-scoped resources.