Skip to content

1.2.7

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Aug 21:46
1.2.7
72ec336

1.2.7 (2025-08-22)

Release 1.2.7 removes a dependency on the Bitnami kubectl container image, replacing it instead with a new cloudzero-certifik8s executable. This is critical as Broadcom (who controls Bitnami through VMware) is doing away with the old bitnami images.

Key Features

  • Go-Based Certificate Management: Complete transformation from bash scripts to modern Go-based certificate management with the new cloudzero-certifik8s tool, providing enhanced security, testability, and maintainability.
  • Comprehensive Security Context: Added security context to all Kubernetes resources (pods, containers, jobs, deployments, daemonsets) with secure defaults and component-specific overrides.
  • Enhanced Shipper Reliability: Improved shipper logging and fixed a replay file processing bug that could cause successful uploads to be incorrectly abandoned.

Security Enhancements

  • Certificate Management Security: Replaced bash scripts with secure Go-based certificate generation, eliminating dependency on deprecated bitnami/kubectl Docker image and implementing proper RBAC with reduced permissions.
  • Security Context Implementation: Added comprehensive security context to all Helm templates with secure defaults (runAsUser: 65534, runAsNonRoot: true) and proper property filtering for pod vs container contexts.
  • Checkov Security Compliance: Enabled security context rules (CKV_K8S_29, CKV_K8S_30, CKV_K8S_23) after implementing proper security contexts across all resources.
  • RBAC Improvements: Enhanced cluster-scoped permissions for certificate management with resource-specific restrictions and proper Kubernetes client integration.

Shipper Reliability Improvements

Replay File Processing Fix:

  • Fixed critical bug where successfully uploaded files were incorrectly abandoned
  • Corrected replay request loop to iterate over reference IDs instead of URLs
  • Enhanced abandon operation logging with file-specific details (reference_id and reason)
  • Added comprehensive debug logging for replay request processing

Enhanced Logging:

  • Improved abandon operation logging to include file-specific details
  • Added debug logging for replay request processing
  • Fixed smoke test failures related to replay request processing

Configuration Enhancements

CloudAccountId Validation:

  • Enhanced JSON schema to allow quoted values for better user experience
  • Added support for quoted numeric and UUID values (e.g., '1234567890', '123e4567-e89b-12d3-a456-426614174000')
  • Implemented comprehensive test coverage for all quote scenarios
  • Added warning notes discouraging manual configuration of auto-detectable properties

Upgrade Steps

To upgrade to version 1.2.7, run the following command:

helm upgrade --install <RELEASE_NAME> cloudzero/cloudzero-agent -n <NAMESPACE> --create-namespace -f configuration.example.yaml --version 1.2.7
Assets 3
Loading