Security CI and dependency upgrades
- Workflows audited with zizmor; RustSec advisories and the published image re-checked every day.
- Release binaries embed their dependency list (cargo-auditable) and are scanned with Trivy before they ship.
- base64 0.23, rand 0.10, sha2 0.11 and tower-http 0.7.
- The web console moved to apps/console.
Release notes One task runner for Rust and TypeScript
- Turborepo runs every task through a native Cargo workspace; Bun replaces pnpm and Node (ADR-024).
- CI jobs call the same turbo tasks developers run locally.
Release notes SQLite first-run fix
- The binary creates the SQLite data directory on first start.
Release notes General availability
- Several replicas on PostgreSQL: every replica serves the API, the Lease holder runs the controllers (ADR-023).
- Pods report ready only after the informers have synced, so a fresh replica never answers 404 for objects that exist.
- Safe concurrent bootstrap when several replicas start against a fresh database.
- Tested on Linux x64 and arm64, macOS and Windows on every change.
Release notes Production hardening
- Informer readiness gates and locked bootstrap for concurrent replicas.
- End-to-end suite on a real kind cluster.
Release notes Leader election
- Lease-based leader election for the controllers; standby replicas keep serving the API and the console.
Release notes Architecture and invariants
- The architecture blueprint, the review of its trade-offs and the invariants every change is checked against.
Release notes Helm chart, image and installer
- Helm chart published as an OCI artifact.
- Multi-arch distroless image and a static musl binary.
- One-line installer that verifies checksums.
Release notes Web console
- React console with releases, rollbacks, logs and the audit log.
- Embedded into the binary with the embed-ui feature.
Release notes Identity, roles and audit
- Argon2id passwords, opaque cookie sessions and scoped API tokens.
- Login throttling, the append-only audit log and kuben doctor.
Release notes REST API
- Axum REST API with server-sent events, an OpenAPI document and a generated TypeScript client.
Release notes Gateway API routing
- HTTPRoutes for every web app and health probes for zero-downtime rollouts.
Release notes Controllers
- Reconcilers turn apps into Deployments, Services, autoscalers and volumes and keep them in sync.
Release notes Storage
- SQLite and PostgreSQL behind one store, with embedded migrations and a test matrix across both.
Release notes Custom resources
- Project, Environment, App and Release custom resources and the domain core.
Release notes Foundation
- The Cargo workspace, its crates and the build pipeline.
Release notes
