v0.40.0

0.40.0 (2026-09-08)

Features

• auth: a platform credential that holds scopes rather than the operator role (#542) (10f812c)
• operator: grow the platform's own volumes on a running install (#552) (bd6aa1e), closes #533

Bug fixes

• api: an open alert carries the current round's reading, and says when it was taken (#546) (7c28722), closes #532
• chart,operator: bound ClickHouse's own system.* log tables and collect what they orphan (#549) (277d783), closes #530
• chart: mount clickhouse.extraConfig by subPath, never over config.d (#539) (5e90870), closes #529
• operator: record the system-log reclaim the moment it happens (#563) (461a0ee), closes #562 #530
• restore the platform credential (#542) that the checkpoint commit undid (#550) (64b48ce)
• signals: judge the store's disk by its volume, not by the database on it (#538) (1cb910b), closes #531
• ui: give a restarting pod grace before the upgrade calls it a fault (#560) (b045851)
• ui: raise the overlay layer above the shell's chrome (#561) (5829e37)

Install

helm install kitchen oci://ghcr.io/bermos/charts/kitchen --version 0.40.0 \
  --namespace kitchen-system --create-namespace \
  --set kitchen.baseDomain=apps.example.com \
  --set kitchen.tls.acme.email=you@example.com \
  --set kitchen.tls.acme.dns01.cloudflare.apiTokenSecretName=cloudflare-api-token

The kitchen CLI is not published as a binary; it is built
from this tag by the Go toolchain:

go install github.com/Bermos/Kitchen/cmd/kitchen@v0.40.0

Artifacts

Artifact	Reference	Digest
Operator image	ghcr.io/bermos/kitchen:0.40.0	sha256:5e42e50fda6403fed284bbc87018e72025dbd5d72583f61f2b4b5c5ca57dfe7f
Auth image	ghcr.io/bermos/kitchen-auth:0.40.0	sha256:bfc0ec0eca80eaeb96d3af0069d41d5b2a05453422777d1b1fe092b0d3900e37
Chart	oci://ghcr.io/bermos/charts/kitchen:0.40.0	sha256:8ad587cab9f4054654163e187720bdc827d2afebde2e1d676441f12fae8e6283

Both images are linux/amd64 and linux/arm64 and carry a signed
build provenance attestation. The chart is attached below as well.