Skip to content

v2.2.0

Choose a tag to compare

View all tags
@Nonetss Nonetss released this 09 Oct 16:41
· 34 commits to main since this release
v2.2.0
99b6b96

Image vulnerability scanning with Trivy, a redesigned console with a key-figures overview, live deploy activity, bulk actions and stack deletion. This release also covers the changes tagged as v2.1.0 to v2.1.2, which had no release of their own.

Highlights

  • Image security with Trivy. A new trivy service scans the images of every Komodo stack. The Security page (/security) lists each image with its stacks, the number of distinct CVEs per severity, how many have a fix and the scan state; each image opens in place into its CVEs, with severity filters, a "fixable only" switch, a rescan button and a copyable Markdown report. A stack's images are rescanned after every successful deploy, and the backend only scans when it has a Trivy server (TRIVY_SERVER_URL, set by the new compose.yml).
  • Gate CI on vulnerabilities. GET /api/v0/security/images, GET /api/v0/security/image and POST /api/v0/security/scan work with an API key, so a pipeline can wait for the scan and fail on critical findings. See Fail on vulnerabilities.
  • New overview. / now shows the key figures of the instance: stacks by state, which ones need attention (with the short reason) or have something new to deploy, CVEs by severity, the most exposed images and failed scans, and the deploys of the last 30 days per day with the success rate, the share launched from CI, the most deployed stacks and the latest failures. The running and stopped stacks are listed below.
  • Redesigned console. Master–detail stacks page with a URL per stack (/stacks/<name>), a stack search in the top bar, a new palette and type shared with the website, and a stack page with its services, commits, CI snippet and a security section with the stack's images and CVEs.
  • Bulk actions. Select several stacks and run Pull, Redeploy or Pull + Redeploy on all of them, at most three at a time, with one summary message.
  • Delete a stack. Remove a stack from Komodo from its page, with a two-click confirm. Only a signed-in session can do it; an API key gets 403.
  • Live deploy activity. GET /api/v0/deploy/events streams deploys as they start and finish (SSE). The dashboard follows deploys started from CI or another tab without a refresh.
  • History says who ran each action: a user or an API key (with the key's name). GET /api/v0/history/activity?days=30 returns the deploy events of the last 1 to 90 days for summaries.

Fixes

  • Scan totals count each CVE once instead of once per affected package.
  • The gateway keeps event streams out of compression so they arrive event by event.
  • The bottom bar labels stay whole on narrow phones, and every route has one short page fade.

For contributors

  • Frontend: entities layer for pieces shared by several features (stack, deploy-action, image-scan) instead of cross-feature imports, typed i18n and shared feedback, layout and table pieces.
  • New image_scan table, applied automatically on startup.
  • The backend image ships the trivy CLI at the same version as the trivy service (TRIVY_VERSION); the dev stack runs a trivy server too.
  • New OpenSpec capability image-security; the overview, stacks, history and access specs follow the changes above.

Images

ghcr.io/nonetss/komodo-cd-backend:2.2.0
ghcr.io/nonetss/komodo-cd-frontend:2.2.0
ghcr.io/nonetss/komodo-cd-gateway:2.2.0

latest keeps tracking main. Pin the installer to this release with:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v2.2.0/scripts/bootstrap.sh | KCD_REF=v2.2.0 bash

Upgrading

One new migration (the image_scan table), applied by the backend on startup. Back up the database first (see Upgrades and backups), then download the new compose.yml, which adds the trivy service and its trivy_cache volume, and recreate the stack:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v2.2.0/compose.yml -o compose.yml
docker compose pull
docker compose up -d --remove-orphans

On its first start the Trivy server downloads its vulnerability database, so the first scans may fail for a minute; retry them from the Security page.

Assets 2
Loading