Skip to content

v0.4.2

Choose a tag to compare

View all tags
@Yoshiofthewire Yoshiofthewire released this 16 Oct 19:27
v0.4.2
27466f6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First published KyYard release. Image: ghcr.io/busnes-app/kyyard:0.4.2 (attested by release-image.yml at this tag).

Upgrading

  • Upgrade the server first, then every agent container. An agent upgraded ahead of its server refuses deployments and every container with a mount until the server catches up.
  • The server now runs as uid 10001, not root. The first start chowns the data volume or ./data. Run apply-setup and other in-container commands with --user kyyard.
  • On first start this release deletes the retired SCIM group tables (groups, group_members). Back up the database first if you want that data.
  • Usernames are unique ignoring case. If two accounts differ only by case the server refuses to start and names them; see README → Upgrading.
  • KY_SSO_AUTO_PROVISION now defaults to off.
  • If KY_IMAGE still names ghcr.io/busness-app, re-pin it: that namespace is no longer controlled by this project.

Changes

  • Installer support: KyQuickStart-managed workloads are labelled, and KyYard refuses generic edits, exec and delete on them. Unattended apply-setup for installer sign-on.
  • Security: the agent protocol now has the server prove its identity, bound to a fresh agent nonce, before the agent signs.
  • Security: login is throttled per username and no longer reveals which accounts exist; a known browser can escape a stranger's login backoff. Self-service account budgets are charged on the account limiter.
  • Security: self-service MFA enrolment and password change (Settings → Security). init-admin also clears MFA with the password reset.
  • Security: image pulls, recreates, runs and application plans are held to the registry rules, including the registry host of digest references. Deploys that keep a host-backed volume or host bind on a new image are gated, and /etc binds are limited to a read-only allowlist.
  • Security: KyYard's own container on the built-in Local Docker endpoint is protected, and removing an application there needs a platform administrator.
  • Security: device pairing secrets are stored only as SHA-256; the bootstrap admin password stays out of logs and argv; the KySignOn webhook body is bounded before its signature is checked.
  • Directory sync: each identity-provider event applies once, in order, in one transaction with its account change; removals always apply and loss of admin is audited.
  • Kubernetes: deploys roll without downtime and keep the running config until they land; workload Secret references the workload does not already carry are refused; pod exec attach is bounded to 20 seconds.
  • Docker: recreates are undone and rolled back on failure; stop waits keep the container's grace and no longer take every command slot.
  • Removed the retired SCIM and device-pairing packages.
Assets 2
Loading