docs(operator): sync v0.4.0 API reference and release notes

documentation/enterprise-kubernetes-operator/getting-started/aws.md

@@ -491,7 +491,7 @@ kubectl annotate serviceaccount default \
 The manifest below connects QuestDB to your S3 bucket and starts one instance
 with a backup every five minutes.
 
-Keep the QuestDB ECR account ID unchanged. The tested image tag for v0.3.1 is
+Keep the QuestDB ECR account ID unchanged. The tested image tag for v0.4.0 is
 `4.0.1-enterprise`; change it only when QuestDB provides another one.
 
 ```sh

documentation/enterprise-kubernetes-operator/getting-started/azure.md

@@ -327,7 +327,7 @@ You should see a successful rollout followed by all three CRDs.
 You're ready to create QuestDB. The manifest below connects it to your Blob
 container and starts one instance with a backup every five minutes.
 
-It uses the tested v0.3.1 `4.0.1-enterprise` image. Change the tag only when
+It uses the tested v0.4.0 `4.0.1-enterprise` image. Change the tag only when
 QuestDB provides another one.
 
 ```sh

documentation/enterprise-kubernetes-operator/reference/api.md

@@ -3,8 +3,8 @@ title: Kubernetes Operator API reference
 description: Custom resources provided by the QuestDB Enterprise Kubernetes Operator.
 ---
 
-<!-- Generated from questdb/questdb-enterprise-operator v0.3.1 (6e6eb55a58d21a5f480eed6a9324b1cd8cdf6580).
-     Do not edit directly. Run: make docs-sync DOCS_REPO=/path/to/documentation RELEASE_TAG=v0.3.1 -->
+<!-- Generated from questdb/questdb-enterprise-operator v0.4.0 (ccf29ce8787cc899fb73de99d2bbd9b4b8c1735a).
+     Do not edit directly. Run: make docs-sync DOCS_REPO=/path/to/documentation RELEASE_TAG=v0.4.0 -->
 # API Reference
 
 Packages:
@@ -224,6 +224,15 @@ legitimate day-2 operation that strands nothing (see the spec-level rules).<br/>
             <i>Validations</i>:<ul><li>self == oldSelf: spec.objectStoreRef is immutable</li></ul>
         </td>
         <td>false</td>
+      </tr><tr>
+        <td><b><a href="#questdbclusterspecpodmetadata">podMetadata</a></b></td>
+        <td>object</td>
+        <td>
+          podMetadata adds labels and annotations to every instance Pod (e.g. scrape
+annotations for a metrics agent). Operator-owned keys always win. Changing it
+rolls the Pods, including the primary.<br/>
+        </td>
+        <td>false</td>
       </tr><tr>
         <td><b><a href="#questdbclusterspecprotocols">protocols</a></b></td>
         <td>object</td>
@@ -875,6 +884,42 @@ reference. Which kind is determined by the field: see its documentation.<br/>
 </table>
 
 
+### QuestDBCluster.spec.podMetadata
+<sup><sup>[↩ Parent](#questdbclusterspec)</sup></sup>
+
+
+
+podMetadata adds labels and annotations to every instance Pod (e.g. scrape
+annotations for a metrics agent). Operator-owned keys always win. Changing it
+rolls the Pods, including the primary.
+
+<table>
+    <thead>
+        <tr>
+            <th>Name</th>
+            <th>Type</th>
+            <th>Description</th>
+            <th>Required</th>
+        </tr>
+    </thead>
+    <tbody><tr>
+        <td><b>annotations</b></td>
+        <td>map[string]string</td>
+        <td>
+          <br/>
+        </td>
+        <td>false</td>
+      </tr><tr>
+        <td><b>labels</b></td>
+        <td>map[string]string</td>
+        <td>
+          <br/>
+        </td>
+        <td>false</td>
+      </tr></tbody>
+</table>
+
+
 ### QuestDBCluster.spec.protocols
 <sup><sup>[↩ Parent](#questdbclusterspec)</sup></sup>
 
@@ -3064,24 +3109,27 @@ podDisruptionBudget tunes the operator-managed PodDisruptionBudget.
         <td><b>enabled</b></td>
         <td>boolean</td>
         <td>
-          enabled controls whether the operator maintains a PDB. Defaults to true.
-Set false to remove the PDB entirely (e.g. to permit unrestricted node drains).<br/>
+          enabled controls whether the operator maintains a PDB. When unset, a
+replicated cluster (instances &gt; 1) gets one and a single-instance cluster does
+not, unless minAvailable is set. Set false to remove the PDB entirely (e.g. to
+permit unrestricted node drains).<br/>
         </td>
         <td>false</td>
       </tr><tr>
         <td><b>minAvailable</b></td>
         <td>integer</td>
         <td>
           minAvailable overrides the computed integer minAvailable. When unset:
-single instance =&gt; 1; replicated =&gt; instances-1.
+replicated =&gt; instances-1; single instance =&gt; 1 if the PDB is enabled.
 
 LIMITATION: instance Pods have no controller to reschedule them, so a PDB
 that leaves no disruption budget HARD-BLOCKS voluntary evictions (`kubectl
 drain` hangs) until a human deletes the Pod or the PDB. This happens whenever
-minAvailable &gt;= the number of currently-Ready instances — including the
-single-instance default (minAvailable=1 over one Pod). It is intentional
-protection for a database, NOT auto-clamped: set a lower minAvailable, scale
-out, or disable the PDB if you need drains to proceed unattended.<br/>
+minAvailable &gt;= the number of currently-Ready instances — which is why a
+single-instance cluster gets no PDB by default: a drain evicts its only Pod
+(a short outage) and the operator recreates it on another node. It is NOT
+auto-clamped: set a lower minAvailable, scale out, or disable the PDB if you
+need drains to proceed unattended.<br/>
           <br/>
             <i>Format</i>: int32<br/>
             <i>Minimum</i>: 0<br/>

documentation/enterprise-kubernetes-operator/releases.md

@@ -3,29 +3,29 @@ title: Kubernetes Operator releases
 description: Release history for the QuestDB Enterprise Kubernetes Operator.
 ---
 
-<!-- Generated from questdb/questdb-enterprise-operator v0.3.1 (6e6eb55a58d21a5f480eed6a9324b1cd8cdf6580).
-     Do not edit directly. Run: make docs-sync DOCS_REPO=/path/to/documentation RELEASE_TAG=v0.3.1 -->
+<!-- Generated from questdb/questdb-enterprise-operator v0.4.0 (ccf29ce8787cc899fb73de99d2bbd9b4b8c1735a).
+     Do not edit directly. Run: make docs-sync DOCS_REPO=/path/to/documentation RELEASE_TAG=v0.4.0 -->
 # Changelog
 
 Notable changes to the QuestDB Enterprise Operator are documented here.
 
 <!-- generated latest operator artifacts: start -->
 ## Latest operator artifacts
 
-Latest stable release: **0.3.1**
+Latest stable release: **0.4.0**
 
 ### Operator images
 
 **AWS ECR**
 
 ```text
-695242380269.dkr.ecr.eu-west-1.amazonaws.com/questdb-enterprise-operator:0.3.1
+695242380269.dkr.ecr.eu-west-1.amazonaws.com/questdb-enterprise-operator:0.4.0
 ```
 
 **Non-AWS mirror**
 
 ```text
-registry.distribution.questdb.io/questdb-enterprise-operator:0.3.1
+registry.distribution.questdb.io/questdb-enterprise-operator:0.4.0
 ```
 
 Both references require the registry access supplied by QuestDB.
@@ -37,10 +37,51 @@ Both references require the registry access supplied by QuestDB.
 ```sh
 helm install questdb-operator oci://ghcr.io/questdb/charts/questdb-operator \
   --namespace questdb-operator-system --create-namespace \
-  --version 0.3.1
+  --version 0.4.0
 ```
 
 <!-- generated latest operator artifacts: end -->
+## [0.4.0] - 2026-10-16
+
+### Upgrade notes
+
+- Single-instance clusters no longer get a PodDisruptionBudget by default.
+  After the upgrade, draining the node (or a managed node upgrade on AKS or
+  EKS) restarts the database on another node instead of blocking forever. To
+  keep the old behaviour, set
+  `spec.scheduling.podDisruptionBudget.enabled: true`. Replicated clusters are
+  unchanged.
+- If you manage CRDs yourself (`crd.enable=false`), apply this release's CRDs
+  before upgrading the operator, so `spec.podMetadata` is accepted.
+
+### Added
+
+- `spec.podMetadata` adds your own labels and annotations to every QuestDB
+  Pod, for example metrics-scrape annotations:
+
+  ```yaml
+  podMetadata:
+    annotations:
+      k8s.grafana.com/scrape: "true"
+  ```
+
+  The operator's own labels always win. Changing `podMetadata` restarts the
+  Pods one at a time, like a `scheduling` change.
+
+### Changed
+
+- When a rolling update is waiting, the `Progressing` condition says why and
+  on which instance, for example
+  `waiting: PeerNotReady on instance prod-3`.
+
+### Fixed
+
+- A replica whose PVC was deleted now rebuilds itself. Before, if its Pod came
+  back before the PVC was gone, the PVC stayed `Terminating` and the replica
+  never recovered.
+- The operator is built with Go 1.26.9 and updated dependencies, fixing
+  reported CVEs.
+
 ## [0.3.1] - 2026-09-28
 
 ### Upgrade notes