Kubyl v0.3.8

[0.3.8] - 2026-09-30

Bug Fixes

• Show Argo CD on clusters whose argoproj.io prefers another version (21bce48)

Miscellaneous

• Update Flatpak manifest to v0.3.7 (a3b55a7)

Kubyl

• Wire in kubyl_prometheus (0f76f22)

Kubyl_explorer

• Favorite any view; reorder sidebar folders and clusters (e0bd276)

Kubyl_prometheus

• A Prometheus web UI for Prometheus, Thanos Query and VictoriaMetrics (d0f97fd)

Kubyl_ui

• Add the Flame icon (3d1ff25)
• TabBar::tab_element for tabs wrapped in another element (0b95af5)

Kubyl v0.3.7

[0.3.7] - 2026-09-30

Miscellaneous

• Update Flatpak manifest to v0.3.6 (7b597c7)

Kubyl_kube

• Only watches and log follows share the HTTP/2 connection (9a8e383)
• Re-run discovery only when a CRD changes what discovery sees (75b70f4)
• Forget cached CRD shapes that changed during a relist (review) (ba82fba)

Kubyl v0.3.6

[0.3.6] - 2026-09-29

Miscellaneous

• Update Flatpak manifest to v0.3.5 (abe0c71)

Terminal

• Bound the output queue so Ctrl+C stops a flood promptly (1fcb54b)

Kubyl

• Raise the open-file limit at startup (40992c7)
• Log when the open-file limit can't be raised (review) (f5aeda9)

Kubyl_kube

• HTTP/2 to API servers, one connection per cluster (8a1f17e)

Kubyl v0.3.5

[0.3.5] - 2026-09-29

DataTable

• Rows fill the width so cells line up with the header (bd78836)

Logs

• Unwrapped lines scroll sideways, with a horizontal scrollbar (7600610)

Miscellaneous

• Update Flatpak manifest to v0.3.4 (a40a293)

Topology

• Nodes keep their place and the view its fit across refreshes (c583fd8)

Kubyl v0.3.4

[0.3.4] - 2026-09-28

Bug Fixes

• No panic completing after a multi-byte space in the flow filter (9a4e9dd)
• Check read-only, RBAC and PROD for every cluster in a selection (0b6177e)
• Never let a container file name escape the download folder (31948f9)
• Reject unsafe entry names in drag-out staging and image preview (269b868)
• Keep draining tar stdout when local extraction fails (ece1069)
• Don't truncate container files on a failed write (7ffd036)
• Only resume a partial download of the same remote file (d567a68)
• Don't panic when the preview temp folder can't be created (1e14d37)
• Move blocking local filesystem calls off the UI thread (8ebd388)
• Strip every ESC from bracketed pastes (2e7ae57)
• Cap terminal output batches at 256 KiB (f50456d)
• Clean up privileged node-shell pods on quit, failure and aborted create (4477c91)
• Refuse cmd.exe metacharacters in cloud CLI arguments (ff7ec16)
• Validate the EKS region before building the endpoint host (af33a6b)
• SUC updates only to versions from the fetched channel list (00a50c6)
• Confirm dialog waits for the pre-flight run and follows its results (41137a7)
• A rekey during a write no longer leaves the cluster busy (54d2dce)
• EKS reads describe every update and report describe errors (d96c025)
• No integer overflow on server-supplied versions (331f392)
• CAPI read fails when KubeadmControlPlanes can't be listed (cb98223)
• OpenShift patch clears a stale desiredUpdate.image (f30a054)
• Cache short-lived cloud credentials for part of their life (f40a621)
• Typed confirmation for Scale on PROD from list/palette (9771bb5)
• Mask Secret data in Copy YAML (d88175b)
• Include the cluster id in list RowId (24cfd61)
• Loopback OAuth callback tolerates idle connections and checks state on errors (e76f116)
• Only drop the OIDC refresh token on invalid_grant (0fc8f33)
• Keep a pending or confirmed scale when the details target changes (487534a)
• Report skipped items when part of a bulk action didn't run (430204f)
• Ignore stale kubeconfig reload results (2a076fe)
• Plan and start the kubeconfig watcher off the UI thread (39db6f0)
• Repeat RBAC checks after a reconnect or a failed check (cc93f18)
• Keep PROD and read-only flags while a cluster is disconnected (593ff9f)
• Reject OpenShift tokens the API server treats as anonymous (cc73347)
• Serialize dev file credential store updates (71613b8)
• Confirm Cordon/Uncordon, typed on PROD (5c4b040)
• Key alert selection by (cluster, fingerprint) (9e53a9f)
• Copied helm commands carry --kubeconfig (3c75908)
• Uninstall with CRDs keeps CRDs another CSV owns (aaadab2)
• Clamp sync-window duration and bound the walk (28425ee)
• Confirm Terminate and switching sync policies on (2b7d67e)
• Sign-out cancels a sign-in in progress (acf28cf)
• Record the API forward at once and match ids in forward_stopped (5a10314)
• Iterative glob_match (c83d504)
• Only keep http(s) argocd-cm urls (06bf5c3)
• Drop in-flight API requests on connect/disconnect (c3376a1)
• Check patch RBAC before a Kubernetes-mode delete and bind it to the UID (f9c0f66)
• Fill_between can't index past a shorter baseline (f8d8b6c)
• Short_repo strips credentials up to the last @ before the path (60e271f)
• Never overwrite an unparsable settings.json (01e033a)
• Don't panic when a settings section is not an object (ab9fdca)
• Unique temp file and ordered, serialised settings/state writes (68bdb07)
• Wait for in-flight settings/state writes on quit (392b719)
• Private config dir when there is no platform config dir (fa4c23c)
• Read the wizard's certificate file off the UI thread (7a162fd)
• Exec-plugin consent covers where a relative command points (037df1d)
• Verify existing Secret and bindings before importing a service-account token (0a946d1)
• Don't keep every finished load task in the editor (a8beee0)
• Preview update channel falls back to stable; manifest channel is checked (df5fb5e)
• A panic while applying an update no longer crashes the app (63c23b2)
• Pin the signing identity when verifying a downloaded macOS bundle (94b07e5)
• Step past a full page of already-sent Loki records (ca41ba8)
• Do not request a Loki URL the FlowCollector chose (132bbe8)
• Park an idle web view on about:blank (8a36034)
• Re-create the web view when Private changed during creation ([7c89358](7c8935894b3...

Kubyl v0.3.3

[0.3.3] - 2026-09-28

Miscellaneous

• Update Flatpak manifest to v0.3.2 (3d52b61)

Kubyl v0.3.2

[0.3.2] - 2026-09-27

Bug Fixes

• Move Flathub manifest update into release.yml as a job (b0be571)
• Run manifest/artifact fetches on the Tokio runtime (#18) (3ec09da)

Miscellaneous

• Update Flatpak manifest to v0.3.1 (3780a0a)

Kubyl v0.3.1

[0.3.1] - 2026-09-27

Bug Fixes

• Install minisign via apt, not taiki-e/install-action (0e77618)

Kubyl v0.2.5

[0.2.5] - 2026-09-27

Plan

• Filter every Flow field in the network flows table, not a subset (8119e83)

README

• Features, install, build, contributing, sponsoring (955c5f7)
• Sponsoring without tiers, any amount helps (f17703b)

Design

• Board 18 (network flows: live table with filter chips, completion and flow details; topology at namespace and workload zoom; Calico Whisker and NetObserv without Loki; no flow source and a forbidden port-forward) (7e350b3)
• Phase 16 screenshots of every board 18 frame on the kind clusters (49af0ec)

Kubyl_charts

• Force-directed graph layout with warm starts and fitting (kubyl_charts::graph, phase 16) (df47f55)
• Layouts that don't depend on node order, and grouped layouts (phase 16) (732f71d)

Kubyl_explorer

• Namespace views other crates add to the favorites menu (catalog::register_namespace_view, phase 16) (576c01d)

Kubyl_metrics

• Transport::get_lines streams a response line by line (server-sent events for Calico Whisker, phase 16) (231b7e3)
• Transport::loopback for HTTP over a temporary port-forward (phase 16) (ed0d2ec)

Kubyl_netflow

• Stub crate (phase 16) with the vendored Hubble API (Cilium v1.20.2 protos, generated by protox in build.rs) (b44ff51)
• Flow model, filter language with completion, ring buffer, topology aggregation, detection and the Hubble Relay, Calico Whisker and NetObserv backends (live tests against the netflow-dev.sh clusters) (6abf794)
• The Network Flows view, its service, actions and details section (phase 16) (eb70169)
• Whisker over a temporary port-forward; blocking states like board 18 (phase 16) (5d297f8)
• The view against board 18 on the kind clusters (phase 16) (5347ce0)
• Only the blocked count is red in the details section (phase 16) (2f46f66)
• Review fixes (phase 16, review) (7f98939)

Kubyl_ui

• Waypoints icon (network flows, phase 16) (1936496)

Plans/16

• Correct the plan after the spike (Whisker's HTTP API instead of Goldmane's mTLS gRPC, Calico 3.30+, Hubble's policy fields, isolation vs deny rules, NetObserv through Loki and its metrics, gRPC through forwards only) (117eedd)

Plans/README

• Phase 16 decisions (flow model and providers, detection and overrides, transports, buffer and streaming, filter language, topology layout, sensitive fields, read-only clusters) (09e12c3)

Script

• Netflow-dev.sh (kind clusters with Cilium and Hubble Relay, NetObserv with Loki, Calico with Whisker; payments and storefront traffic, an isolating NetworkPolicy and a deny rule) (81d43a8)

Workspace

• Tonic, prost and protox for the Hubble Relay client, fjadra for the topology layout (phase 16) (b43bf0e)

Zed

• Run task uses the file credential store (8740ee4)

Kubyl v0.2.4

[0.2.4] - 2026-09-27

AGENTS.md

• Phase 13 live tests, cloud provider fixtures and mock endpoints (1d3017c)

CI

• Clippy and test the cloud update providers' features, cargo-deny with all features (phase 13) (3832633)
• Cargo-deny keeps the action's default --all-features (review) (f31b819)

Design

• Board 8 frames (OpenShift channel, update graph, pre-flight, progress, confirmation, EKS, k3s, read-only, credentials) and the Route frames (Routes under Network, Route web view) (2c08474)
• Phase 13 Routes screenshots (2cf0f0f)
• Phase 13 screenshots (OpenShift updates, channel, graph, pre-flight, progress, confirmation, EKS, k3s, self-managed, read-only, credentials missing, provider not built, 403, Route details) (8bf209a)

Kubyl

• Forward the cloud update provider features (updates-eks, updates-gke, updates-aks) (87c3d90)

Kubyl_argocd

• Route keys stay masked in live/desired diffs (phase 13) (bedca86)
• The TLS key note covers a stale last-applied copy (review) (7044cd7)

Kubyl_explorer

• Routes under Network with their own details (phase 13) (27b2c50)
• Route details resolve numeric target ports through the endpoints (phase 13) (3910027)

Kubyl_metrics

• Read monitoring Routes through the shared Route model (phase 13) (2bc41db)

Kubyl_operators

• Mask inline Route keys in Helm manifests (phase 13) (c036b4a)

Kubyl_palette

• Route and Service references (phase 13) (1d47bc0)

Kubyl_portforward

• Forward a Route's or Ingress's backend Service (phase 13) (f3266e1)
• Route forwards read the backend's EndpointSlices (phase 13) (188c1f9)
• The Route live test takes namespaces without Ingresses (real clusters) (44ed669)
• Backend forwards match the API group as well as the resource (review) (342a17c)
• The Route live test fails when a backend doesn't resolve (review) (8d4a895)

Kubyl_resources

• Route model, columns and target port resolution (phase 13) (27c0d35)
• Resolve numeric Route target ports through the endpoints (phase 13) (6dc7a3b)
• A Route's named target port reports the number its endpoints serve (phase 13) (b6122dc)
• Wider Services and Admitted columns for Routes (phase 13) (07893ee)
• Mask a Route's last-applied copy when it still holds a key taken out of spec (review) (8856f0c)

Kubyl_ui

• Route icon (OpenShift Routes, phase 13) (67e5912)

Kubyl_updates

• Provider trait, detection, model, versions, removed-API table, settings (bf19337)
• OpenShift, k3s/RKE2 (system-upgrade-controller), Cluster API and read-only providers, pre-flight checks, the update service and the Cluster Updates tab (0dcec4a)
• Provider override in settings, live tests against the dev clusters (26bcdd6)
• Shared cloud provider plumbing (CLIs, HTTP, errors, exec plugin, credential cache) (64ed5d5)
• Amazon EKS update provider (updates-eks) (12dc54f)
• Cloud API endpoint overrides (KUBYL_UPDATES_{EKS,GKE,AKS}_ENDPOINT) (962b53f)
• Google GKE update provider (updates-gke) (21881ae)
• Azure AKS update provider (updates-aks) (e09175a)
• The read-only OpenShift live test runs the pre-flight checks too (3f2b4d2)
• Operators and pools first while an update runs, wait for Prometheus discovery before the checks, node pools follow the control plane, write hints only where the provider can write, wrapping and graph fixes (f667089)
• Live test that updates the k3d cluster through its Plans and follows it (11f2571)
• One recorded-response bundle per cloud (tests/fixtures/{eks,gke,aks}.json) (3f1ec7d)
• Review fixes: the last-applied scan picks the kind's own group and never passes on an incomplete scan, pre-releases sort before their release, a pre-flight run without inputs finishes, one note for failed EKS add-on versions, AKS pools target only newer versions (75892bf)
• Pre-release stages order before their numbers (ec < fc < rc) (review) (f2873b9)

Kubyl_webview

• Web views of Route backends (phase 13) (659df65)
• Route web views resolve numeric target ports through the endpoints (phase 13) (a6a502b)

Kubyl_yaml

• Route template and inline TLS key masking (phase 13) (330b578)
• Stale Route keys in the last-applied copy stay masked in the editor, manifests and apply history (review) (50aab37)

Plans/12

• OpenShift check done on the user's test cluster (3525e80)

Plans/13

• Track the OpenShift Routes work (added on request) (8d93ec1)
• Done, handoff log (a65773a)
• Test counts (35db59b)

Plans/README

• Phase 13 decisions (update providers, writes, removed and deprecated APIs, cloud credentials, features, Routes) (42c17c0)
• Phase 13 extension points (update state, provider trait, Route helpers) and the cloud providers' details (0d3180c)

Script

• Updates-dev.sh (PDB and removed-API Helm release on kind, a fake OpenShift cluster with ClusterVersion, operators, pools, APIRequestCounts and Routes, a k3s cluster with system-upgrade-controller) (54236b6)

Workspace

• Hmac for SigV4 signing of the EKS update provider (phase 13) (5e7b7ca)