Issues

• Operator caches every Secret in the cluster for a handful of point reads

  nebari-dev/nebari-operator#190 · Filter by author marcelovilla opened on Oct 2, 2026

• SecurityPolicy OIDC issuer uses the internal Keycloak URL which is rejected by Envoy Gateway's v1.9.1 issuer validation

  needs: discussion 💬
  nebari-dev/nebari-operator#186 · Filter by author marcelovilla opened on Sep 7, 2026

• Add longDescription field to NebariApp.spec.landingPage

  area: user experience 👩🏻‍💻type: enhancement 💅🏼
  nebari-dev/nebari-operator#181 · Filter by author viniciusdc opened on Aug 14, 2026

• Migrate off deprecated controller-runtime events API (GetEventRecorderFor) and scheme.Builder

  nebari-dev/nebari-operator#171 · Filter by author viniciusdc opened on Aug 7, 2026

• Support TLS-passthrough routing (TLSRoute / routing.tcp) in NebariApp

  nebari-dev/nebari-operator#169 · Filter by author viniciusdc opened on Jul 23, 2026
  1

  

• feat(tls): adopt per-app ListenerSet for TLS ownership (ADR-0011, Option 2)

  nebari-dev/nebari-operator#168 · Filter by author oldsj opened on Jul 20, 2026
  

• Epic: Security assessment remediation (v0.1.0-alpha.20)

  area: securityepic
  nebari-dev/nebari-operator#166 · Filter by author dcmcand opened on Jul 15, 2026

• security: user-provided TLS Secrets are not cryptographically or semantically validated

  area: securitypriority: low 🌱type: bug 🐛
  nebari-dev/nebari-operator#165 · Filter by author dcmcand opened on Jul 15, 2026

• security: identity and credential reconciliation is additive with incomplete cleanup

  area: securitypriority: medium ⚡type: tech debt 🧹
  nebari-dev/nebari-operator#164 · Filter by author dcmcand opened on Jul 15, 2026

• security: build uses a stale Go patch and lacks govulncheck, image-scan, and SBOM gates

  area: securitypriority: medium ⚡type: maintenance 🛠
  nebari-dev/nebari-operator#163 · Filter by author dcmcand opened on Jul 15, 2026

• security: broad Kubernetes and Keycloak authority lacks network containment

  area: securitypriority: medium ⚡type: tech debt 🧹
  nebari-dev/nebari-operator#162 · Filter by author dcmcand opened on Jul 15, 2026

• security: token exchange trusts every peer NebariApp client in the realm

  area: securitypriority: medium ⚡type: tech debt 🧹
  nebari-dev/nebari-operator#161 · Filter by author dcmcand opened on Jul 15, 2026

• security: cross-namespace Service backends lack target-owner consent and leak an existence oracle

  area: securitypriority: medium ⚡type: tech debt 🧹
  nebari-dev/nebari-operator#160 · Filter by author dcmcand opened on Jul 15, 2026

• security: generic-oidc issuerURL is unvalidated (gateway-side SSRF and client-secret exposure)

  area: securitypriority: medium ⚡type: bug 🐛
  nebari-dev/nebari-operator#159 · Filter by author dcmcand opened on Jul 15, 2026

• security: generated child resources can overwrite unrelated same-name objects

  area: securitypriority: medium ⚡type: bug 🐛
  nebari-dev/nebari-operator#158 · Filter by author dcmcand opened on Jul 15, 2026

• security: release artifacts use mutable inputs and lack signing, provenance, and SBOM

  area: securitypriority: high 🔥type: maintenance 🛠
  nebari-dev/nebari-operator#157 · Filter by author dcmcand opened on Jul 15, 2026

• security: hostname and TLS listener delegation lacks an ownership boundary

  area: securitypriority: high 🔥type: tech debt 🧹
  nebari-dev/nebari-operator#156 · Filter by author dcmcand opened on Jul 15, 2026

• security: caller-selected spaClient.clientId can reconfigure or delete an existing Keycloak client

  area: securitypriority: high 🔥type: bug 🐛
  nebari-dev/nebari-operator#155 · Filter by author dcmcand opened on Jul 15, 2026

• security: self-service NebariApp fields can create and administer Keycloak realm groups and memberships

  area: securitypriority: high 🔥type: tech debt 🧹
  nebari-dev/nebari-operator#154 · Filter by author dcmcand opened on Jul 15, 2026

• security: auth.groups is documented as access control but is not enforced at the gateway

  area: securitypriority: high 🔥type: bug 🐛
  nebari-dev/nebari-operator#153 · Filter by author dcmcand opened on Jul 15, 2026

• security: auth-enabled routes are published before SecurityPolicy is accepted (fail-open)

  area: securitypriority: critical 🚨type: bug 🐛
  nebari-dev/nebari-operator#152 · Filter by author dcmcand opened on Jul 15, 2026

• Inject non-sensitive Keycloak values into NebariApp workloads so packs stop hardcoding them

  type: enhancement 💅🏼
  Feature

  nebari-dev/nebari-operator#147 · Filter by author dcmcand opened on Jun 24, 2026

• Inject standard OTLP env vars into NebariApp workloads so packs auto-publish telemetry

  type: enhancement 💅🏼
  Feature

  nebari-dev/nebari-operator#146 · Filter by author dcmcand opened on Jun 23, 2026
  1

• Epic: Routing & SecurityPolicy consolidation

  epic
  nebari-dev/nebari-operator#139 · Filter by author viniciusdc opened on Jun 6, 2026

• Routing: curated CORS block on the generated SecurityPolicy

  needs: discussion 💬type: enhancement 💅🏼
  Feature

  nebari-dev/nebari-operator#138 · Filter by author viniciusdc opened on Jun 6, 2026