[github-actions]

🤖 I have created a release beep boop

3.12.0 (2026-11-02)

Features

• fluentbit: add compress option to the forward output (#2083) (43c9b16)
• fluentbit: add flush interval options to the log_to_metrics filter (#2084) (3b19291)
• fluentbit: make the namespace routing rewrite_tag key configurable (#2088) (41269cc)
• fluentbit: read Kafka output rdkafka properties from secrets (#2096) (6cdce28)
• fluentd: add ports to expose inputs the operator can't derive ports for (#2090) (4f6e07e)
• fluentd: support a PodDisruptionBudget for the Fluentd StatefulSet (#2085) (6e48b86)

Bug Fixes

• fluentbit: drop Lua comments from inline code so they stop swallowing the rest (#2095) (9dd55de)
• fluentbit: skip namespaced Outputs whose config cannot be rendered (#2098) (76b8600)
• fluentd: use Fluentd's default ports for inputs without a port (#2089) (26abfc3)
• helm: do not default Loki credentials so secret references stop warning (#2091) (57a4824)
• rbac: give each instance its own ClusterRole so rbacRules aren't overwritten (#2094) (8a7c634)

---

This PR was generated with Release Please. See documentation.

[joshuabaird]

Reminder: if #2094 is merged before this release, add an upgrade note to the changelog body here and to the fluent/helm-charts sync PR. Its release-note block won't be picked up automatically.

#2094 moves FluentBit, Collector and Fluentd instances from a shared ClusterRole to one ClusterRole per instance. Things to call out:

• Anyone managing the operator's RBAC themselves (operator.rbac.create: false, kustomize, etc.) must give the operator delete on clusterrolebindings before upgrading. Otherwise reconciles fail.
• Rolling back to an older operator requires deleting the instance ClusterRoleBindings first, since roleRef can't be changed.
• Rules added by hand to the old shared roles (fluent-operator-fluent-bit, fluent-operator-collector, fluent-operator-fluentd) no longer apply and should be moved to spec.rbacRules. The old roles can be deleted after upgrading.