[miki3421]

CHANGES stops at RC7 and omits the subsequent fixes already included in the 0.9.0 source pins. Append an unreleased 0.9.0 section with 19 entries covering 36 merged PRs across the platform repositories, while preserving the existing release history byte for byte.

The entries cover tenant authentication and isolation, IAM and Redis recovery, protected custom OPTIONS handlers, provisioning and SSO, builder hardening, Cron containment, setup readiness, component versions, licensing and integration checks. They retain the relevant limits: NetworkPolicies require an enforcing CNI, and Cron containment retains Allow concurrency without duplicate prevention or recovery of missed executions. Open, draft, superseded and unpublished work is excluded; the existing SSO backport entry is not duplicated.

Validation: checked each included code merge against the corresponding submodule pin at d834957dcc72e61ac1a8daec9218758a39be432f; verified the approved diff and unchanged existing content; confirmed that the whitespace check reports no errors. Documentation-only change; no runtime files or submodule pins are changed. Rebuilt-image publication and release signatures were not assessed.

Source PRs reviewed for the new entries

• Fix invalid ASF header in uv.lock openserverless-admin-api#67 — Fix invalid ASF header in uv.lock
• Add Secret-authorized tenant provisioning API openserverless-admin-api#64 — Add Secret-authorized tenant provisioning API
• Require OIDC identity binding before issuing tenant credentials openserverless-admin-api#61 — Require OIDC identity binding before issuing tenant credentials
• Isolate builder jobs and validate image targets on 0.9.0 openserverless-admin-api#60 — Isolate builder jobs and validate image targets on 0.9.0
• fix(controller): authenticate custom OPTIONS via OpenWhisk overlay openserverless-build#24 — fix(controller): authenticate custom OPTIONS via OpenWhisk overlay
• fix(seaweedfs): reconcile restored IAM before exposing resumed ingress openserverless-operator#159 — fix(seaweedfs): reconcile restored IAM before exposing resumed ingress
• fix(redis): preserve pending RDB writes on graceful shutdown (0.9.0) openserverless-operator#158 — fix(redis): preserve pending RDB writes on graceful shutdown (0.9.0)
• fix(redis): persist tenant ACLs across Redis-only restarts on 0.9.0 openserverless-operator#157 — fix(redis): persist tenant ACLs across Redis-only restarts on 0.9.0
• Fix SeaweedFS integration access after NodePort removal openserverless-operator#156 — Fix SeaweedFS integration access after NodePort removal
• Isolate SeaweedFS control APIs from tenant actions openserverless-operator#155 — Isolate SeaweedFS control APIs from tenant actions
• fix: update Milvus to 2.5.27 openserverless-operator#154 — fix: update Milvus to 2.5.27
• [0.9.0] Bound cron-init jobs and scheduler I/O openserverless-operator#153 — [0.9.0] Bound cron-init jobs and scheduler I/O
• Require client credentials for FerretDB on 0.9.0 openserverless-operator#152 — Require client credentials for FerretDB on 0.9.0
• Prevent image publication on branch pushes, including slash names openserverless-operator#148 — Prevent image publication on branch pushes, including slash names
• Remove inaccurate Gradle attribution from operator licensing openserverless-operator#147 — Remove inaccurate Gradle attribution from operator licensing
• Isolate shared monitoring endpoints from tenant actions on 0.9.0 openserverless-operator#146 — Isolate shared monitoring endpoints from tenant actions on 0.9.0
• Isolate Kafka and ZooKeeper from tenant action pods on 0.9.0 openserverless-operator#145 — Isolate Kafka and ZooKeeper from tenant action pods on 0.9.0
• Isolate malformed Cron annotations between tenants on 0.9.0 openserverless-operator#144 — Isolate malformed Cron annotations between tenants on 0.9.0
• Fix FerretDB tenant provisioning on 0.9.0 openserverless-operator#142 — Fix FerretDB tenant provisioning on 0.9.0
• Isolate etcd and Milvus credentials and management endpoints on 0.9.0 openserverless-operator#141 — Isolate etcd and Milvus credentials and management endpoints on 0.9.0
• Restrict Redis tenant ACLs while preserving Lua on 0.9.0 openserverless-operator#140 — Restrict Redis tenant ACLs while preserving Lua on 0.9.0
• Scope anonymous S3 access to web buckets on 0.9.0 openserverless-operator#139 — Scope anonymous S3 access to web buckets on 0.9.0
• Restrict CouchDB user metadata access on 0.9.0 openserverless-operator#138 — Restrict CouchDB user metadata access on 0.9.0
• Fix RC7 operator image build and Alertmanager defaults openserverless-operator#137 — Fix RC7 operator image build and Alertmanager defaults
• docs: add SSO configuration guide openserverless-site#96 — docs: add SSO configuration guide
• fix: correct devcontainer image catalog tag openserverless-task#243 — fix: correct devcontainer image catalog tag
• fix: update Milvus image to 2.5.27 openserverless-task#242 — fix: update Milvus image to 2.5.27
• [0.9.0] Install user provisioning RBAC during K3s setup openserverless-task#241 — [0.9.0] Install user provisioning RBAC during K3s setup
• Reconcile reduced monitoring RBAC before operator upgrades on 0.9.0 openserverless-task#239 — Reconcile reduced monitoring RBAC before operator upgrades on 0.9.0
• Grant operator NetworkPolicy permissions during 0.9.0 setup openserverless-task#238 — Grant operator NetworkPolicy permissions during 0.9.0 setup
• Enable BuildKit process sandbox in 0.9.0 deployment configuration openserverless-task#237 — Enable BuildKit process sandbox in 0.9.0 deployment configuration
• Make full cluster setup readiness and component dependencies explicit openserverless-task#236 — Make full cluster setup readiness and component dependencies explicit
• Update K3s install version to v1.36.4+k3s1 openserverless-task#232 — Update K3s install version to v1.36.4+k3s1
• Recognize both Static landing pages and reject HTTP errors openserverless-testing#18 — Recognize both Static landing pages and reject HTTP errors
• Remove obsolete MinIO config calls and propagate setup errors in S3 tests openserverless-testing#17 — Remove obsolete MinIO config calls and propagate setup errors in S3 tests
• Correct bundled licenses and OpenWhisk source archive boundary on 0.9.0 #278 — Correct bundled licenses and OpenWhisk source archive boundary on 0.9.0