Skip to content

kollect 0.8.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Jul 08:51
v0.8.0
ea44014

0.8.0 - 2026-07-10

Bug Fixes

  • pipeline: Drop computed make() capacity flagged by CodeQL overflow 11b9ee3

  • cli: Context selection, skip-to-exitcode, and dead --namespace flag ba53f06

  • controller: Requeue on family-sink status conflict instead of dropping it 7cb5cbe

  • collect: Block on dispatch backpressure instead of inline sync fallback c570338

  • controller: Degrade scope not whole target on RBAC-forbidden namespace (#28) 7cdc108

  • release: Tolerate Rekor 409 on asset re-sign 0a8f61a

  • sink/nats: Reconnect when cached connection is closed 05323e7

  • sink/bigquery: Snapshot emulator mode in Config 7ab6387

  • test: Drop duplicate family sink condition tests b6bfdb7

  • build: Fix go-arch-lint exclude paths for local dirs 95850bb

  • validation: Block private sink endpoint targets 6c1ed5b

  • sink: Retry BigQuery emulator readiness in L3 tests 5106a32

  • controller: Enforce namespace intersections in rollups c4439c3

  • sink: Re-enable backend pool after layout integration test bea1372

  • sink: Infer resource manifest layout e83c30f

  • build: Compile full cmd package after pprof fold 796e744

  • controller: Panic-guard family-sink, connection-test, cluster-target reconcilers b333ce0

  • controller: Aggregate per-sink export errors af341f8

  • controller: Stop requeue on terminal finalizer cleanup b3ae025

  • api: [breaking] Reject stub sink types at admission 5eee44d

  • sink: Remove stub backends, make unknown sink type terminal eaf5a15

  • sink/git: Redact credentials from git CLI errors 7a8e6d0

  • collect: Stabilize export fingerprints for debounce 038cbec

  • docs: Purge stale hub/spoke from operator manual 367b6bf

  • docs: Repair broken links and stale ADR references be7c448

  • chart: Sync family-sink CRDs with ADR-0416 fields 7baaa66

  • build: Upgrade alpine packages in UI image for Trivy 3cdce54

  • ci: Stop perf-report writing agent-context in CI 5efafd6

  • ui: Disambiguate Playwright inventory row locator 878dff2

  • ci: Stabilize nightly Playwright and perf-report fcb0533

  • build: Upgrade debian packages for Trivy gate 5c8f07f

  • controller: Recover panics and suspend status 3bb8c55

  • git: Resolve lint issues in sink hardening 1cd7ef7

  • docs: Remove extra blank line in git-sink-attribution 152cb40

  • e2e: Guard multitenant port-forward cleanup trap fde54d4

  • e2e: Use object form for snapshotSinkRefs c434c9e

  • e2e: Validate git-export and multitenant via HTTP b934eb2

  • e2e: Drop legacy sinkRefs from multitenant scope 7efd330

  • e2e: Drop removed inventory sinkRefs field f7de7af

  • e2e: Validate collection via inventory HTTP 67404df

  • e2e,test: Stabilize smoke bootstrap and debounce IT 2b7b31d

  • samples: Drop legacy sinkRefs from team-a scope 4598ce5

  • e2e: Wait on family sink CRDs in kind smoke fac0a82

  • gitlab: Basic auth for Forgejo Gitea MR API 92e2ce0

  • collect,controller: Resolve race detector findings 2fc1aff

  • api: Keep KollectRemoteCluster status optional in codegen 578af5e

  • api: Drop required status on KollectRemoteCluster create 88e7bc5

  • ops: P2 hardening and chart connectionTest default 4a07ab6

  • git: Terminal auth errors and per-repo export lock 2b596ba

  • lint: Gofmt webhooks and phase A envtest cleanup f132bf9

  • sink: Isolate circuit breaker test from parallel pollution d5ec865

  • e2e: Revert multitenant namespaceSelector 4ba734c

  • controller: Continue multi-sink export on partial failure 6b1fa36

  • e2e: Apply tenant-scope after multitenant asserts 475f3f9

  • e2e: Stabilize multitenant matrix job waits 9ed2c7a

  • sink: Validate git export paths for CodeQL 4855b3d

  • ci: Sync CHANGELOG and UI Docker npm ci 0eef82c

  • e2e: Bootstrap samples for matrix git-export 7957b7b

  • sink: Gitlab HTTP client timeout 2c1377c

  • sink: Postgres connect uses request context 3590d22

  • collect: Degrade target on SAR API error 9ada555

  • hub: Rollback merge when export fails 6065122

  • controller: Requeue conflicts and log map errors a9cd353

  • sink: Close backends and log close errors a52d779

  • transport: Commit Kafka offset on handler success e15ef5b

  • spoke: Retain delta until publish succeeds 42fe240

  • sink: Validate git CLI args before exec 0625bcc

  • demo: Satisfy OpenSSF Scorecard in kind-wide-scope 78be170

  • git: Set bare HEAD after file-remote push e591f74

  • inventory: Extract degraded status goconst 9b264c2

  • sink: Use git.TypeName for goconst CI lint 1d5fd48

  • demo: Survive Step 2 bootstrap failures 4561c6a

  • demo: Continue past prerequisite check b3ed1c2

  • chart: Restrict PrometheusRule alerts to kollect metrics 818af18

  • ui: Exclude Playwright specs from Vitest runner c6f250d

  • ui: Align inventory drawer and badge props with merged API cfad0ba

  • ui: Align inventory drawer with merged status APIs 00014bc

  • lint: Extract goconst strings for CI golangci-lint f974805

  • chart: Mount writable /tmp for git export d605752

  • sink: Harden git export paths and command args for CodeQL 0493418

  • ci: Add RBAC audit and expand fuzz gates e538490

  • supply-chain: Address OpenSSF Scorecard findings 27cb90f

  • docs: Restore mkdocs nav for reference hub pages 0f01235

  • docs: Drop mkdocs nav to uncommitted pages 3e49484

  • e2e: Recreate unhealthy kind clusters 8d4b654

  • ci: Harden workflows for OpenSSF Scorecard 1fe5aa4

  • security: Harden inventory auth and SAR caches 4ab89e3

  • ci: Use codecov-action v5 tag instead of bad SHA 0c0247d

  • ci: Restore 60% coverage floor for test job 6fe3ed7

  • docs: Repair open questions list rendering 4bd0486

  • ci: Perf-report envtest gate and changelog 147a16c

  • ci: Lll wrap, coverage floor, and changelog 04e854e

  • ci: Pin scorecard-action to commit SHA 86e3217

  • docs: Repair attribute extraction mermaid flowchart abc875e

  • docs: Restore material icon rendering fdc6296

  • ci: Resolve goconst lint and codecov action pin 914ddd7

  • ci: Seed Certificate before team-certificates target 00095b9

  • ci: Poll tenant inventory itemCount in multitenant e2e 50953e1

  • ci: Seed cert-test namespace before Certificate target 7e15f6c

  • ci: Skip git export clone without GIT_EXPORT_TEST_REPO c780773

  • ci: Assert cert collection via Ready message not itemCount ced6d28

  • ci: Create cert-test namespace before target registration 497cf32

  • ci: Poll cert-manager target itemCount in e2e 7e2fdb4

  • helm: Grant cert-manager Certificate list/watch for generic CRD e2e eb32441

  • ci: Poll inventory HTTP for cert-manager e2e cfcc9ca

  • ci: Wait for manager controllers before e2e smoke 941f2b5

  • ci: Export env before cert-manager e2e subprocess 839ac6d

  • helm: Sync manager ClusterRole with kubebuilder RBAC 8036e9c

  • ci: Apply e2e samples directly without kustomize parent refs aa46947

  • ci: Use lean e2e samples without unreachable sinks ce757ae

  • api: Drop required status on KollectConnectionTest create 4f98d27

  • ci: Repair Go 1.26 internal coverage profile merge 8f25a28

  • ci: Skip cmd packages in coverage pre-pass 1053e74

  • controller: Gate validating webhooks when chart disables TLS fff187d

  • ci: Merge internal coverage profile without -p 1 707216e

  • ci: Stabilize coverage profile merge and cmd skip 6462139

  • ci: Raise kind e2e helm install wait timeouts b197499

  • controller: Stabilize cluster target and inventory envtests 56e3c1d

  • sink/git: Simplify file remote push and clone tests 3737454

  • ci: Pin git export tests to main branch 7abe06e

  • sink/git: Reset workdir after failed file clone acf644a

  • sink/git: Use native git for file:// export path f6c58f1

  • sink/git: Write export payload via worktree FS 6eb020c

  • release: Use v0.0.4 MVP anchor, reserve v0.1.0 for publish 11fc310

  • sink/git: Native push for file remotes on CI 78be033

  • sink/git: Force-push when bare clone has no HEAD 53e34cc

  • Address code review P0/P1 findings 7423030

  • validation: Require ClusterTarget namespaceSelector 4669000

  • inventory: V1alpha1 HTTP paths and export caps 796168e

  • collect: Avoid startInformer mutex deadlock 7b614f5

  • obs: Standalone perf-report shell script 98d6d33

  • build: Use repo-root kustomize in deploy task 6812cee

  • build: Move scrub patterns out of Taskfile 023da6f

  • test: Satisfy ginkgolinter and shorten status comments d6cf08c

Features

  • cli: Wire collect -> runner -> store -> sink end-to-end (P-005) 4e40389

  • cli: Kollect-pipeline cobra entrypoint + multi-context resolution (P-001) 7a29f6e

  • collect: One-shot List-based collection runner (P-003) 48e779a

  • sink: Local filesystem sink backend (P-004) e8f6cd1

  • pipeline: Local config loader (P-002) 63c4eff

  • controller,sink: Add TTL prune to coalesce tracker and backend pool ff18055

  • controller: Surface extraction failures in target status (EC-P1-05) (#36) 3c489e4

  • metrics: Bound profile label cardinality (EC-P2-09) (#32) fea790e

  • scope: Cluster static-ref namespace allowlist (#23) 789135f

  • webhook: Reject cluster kinds in tenantMode da49cd3

  • controller: Classify forbidden static refs for cluster kinds 0825198

  • api: [breaking] Reference namespaced static config from cluster kinds 7b30097

  • controller: Shard snapshot exports by max bytes 8184257

  • api: Add cluster rollup shard status 59dcdaf

  • api: Add cluster inventory namespaces list 713cdf0

  • helm: Add minimal RBAC team install profile 925a8d8

  • sink: Add BigQuery database backend ec64d81

  • sink/nats: Version event envelope schema 58a4bf4

  • demo: Add hero harness with in-kind Forgejo 6e6a86a

  • sink: Wire ADR-0419 git layout into export pipeline c33baa6

  • export: Full-resource pruning and Git layout 8502f58

  • sink: Render status.preview surface (ADR-0416) f1931fc

  • sink: MongoDB database sink (ADR-0417) 3796733

  • api: ADR-0416 sink config layering 5f07736

  • sink/git: PERF-10 mirror and fingerprint skip f8d3d23

  • perf: Scale lane PERF-08/09/15 and 10k load tier f2444ff

  • collect: PERF-03 tunable dispatch pool 66426c8

  • ui: Align sink families and add UI docs 5b1cc94

  • sink/git: Rich commit context and templates 96834ba

  • [breaking] Remove hub/spoke tier and KollectRemoteCluster edfb2b6

  • git: Harden export clone, auth, and push recovery 22921a0

  • git: Port transport retry and SSH host keys 1486898

  • controller: Wire family sink reconcilers and export 61d1a33

  • api: Add sink family CRDs and remove KollectSink efc1b1a

  • controller: Add cluster rollup finalizers a371b8b

  • controller: Add target finalizers 240f4be

  • controller: Extend inventory finalizer teardown db06c39

  • collect: Add hub cluster store cleanup 23ef632

  • collect: Add helm: release Secret decode a5be27a

  • samples: Add helm-release-values-redacted profile 2bb8a36

  • collect: ScrubKeys redaction at extraction 36d3b53

  • hub: Ingest auth cache and structured denial logs d987846

  • controller: Parallel sinks, debounce metrics, hub coalesce e34a482

  • sink: Backend pool cache and envelope export path d238c8c

  • controller: Add inventory deletion finalizer 128f1a7

  • sink: Add per-sink gobreaker circuit breaker e136296

  • api: Per-sink export interval scheduling 83c7085

  • demo: Venue pitch personas, fast churn, UI reveal 674a336

  • chart: Add Prometheus Operator monitoring 92a682a

  • api: Default KollectSink connectionTest to true 528c5b2

  • ui: Merge inventory MVP with filters and virtualization f63f6fd

  • demo: Refactor wide-scope kind showcase c944750

  • ui: Wire inventory rows to detail drawer fc99b52

  • ui: Add inventory MVP with filters and virtualization d27069d

  • ui: Merge overview degraded strip and export stats e921580

  • ui: Merge detail drawers for targets and sinks c19a410

  • ui: Add detail drawers for targets and sinks 8752432

  • sink: Add git push policy branch and auth options 90319b2

  • ui: Implement Phase 1 mock Read API (MSW + Prism) 6b0485c

  • inventory: Extend Read API for UI contract d1f0871

  • api: Add Target collection filtering (ADR-0207) 8c63fcb

  • export: Enforce object-store spill above 1 MiB 938f63d

  • api: Add KollectSink spec.pathTemplate 31004c5

  • sink: Add S3/GCS Parquet snapshot export 8704e76

  • [breaking] Remove KollectHub reconciler 3c30605

  • [breaking] Remove KollectHub CRD surface 6470a34

  • webhook: Validate KollectSink spec.type enum 5b509e7

  • api: Add KollectClusterInventory spec.dedupe e8bf743

  • export: Add schemaVersion inventory envelope e115d27

  • sink: Add NATS JetStream event sink backend 135021c

  • export: Add schemaVersion to export envelopes 0b69ae9

  • sink: Add Capabilities and postgres delete reconciliation 119e861

  • controller: Wire cluster inventory aggregate dedupe 9e87710

  • aggregate: Add cross-target dedupe spike stub 1592473

  • sink: Push gitlab exports to feature branch in mr mode 2f1f2df

  • collect: Emit prometheus label values from profile metrics 033fa15

  • collect: Wire profile metrics paths and hub merge metric fbdd059

  • api: Add KollectProfile.spec.metrics spike 25fc642

  • collect: Wire RecordCustomResourceSeries on snapshot fcf0c5d

  • collect: Add Phase 4 aggregation metrics stub 1806597

  • sink: Add GitLab API v4 merge request client 6af3630

  • collect: Complete ADR-0020 metrics catalog 9c940b1

  • sink: Add gitlab mergeRequest CRD and transport ACL wire 304c50d

  • controller: Wire cluster inventory export to sinks 18ed358

  • transport: Add queue wire ACL allowlist stub 83beaf5

  • controller: Add cluster target and inventory skeletons 741d35f

  • sink/gitlab: Scaffold GitLab export backend b2c1527

  • hub: Parallel Postgres+Kafka export on ingest d5a97e4

  • api: Add KollectClusterProfile CR ee6ff58

  • api: Add KollectClusterInventory CR 91465f2

  • api: Add KollectClusterInventory CR d7eb87a

  • api: Add KollectClusterTarget CR and webhook 2c7d6a9

  • api: Add KollectConnectionTest CR b1036cd

  • inventory: Export debouncing with checksum 377b091

  • api: [breaking] Namespaced KollectSink and same-ns sinkRefs 687c4c7

  • transport: Queue TLS and hub ACL hardening 65caa30

  • controller: SinkReachable export and probe cleanup 92598d9

  • operator: Add hub and spoke mode flag d2bc4da

  • api: [breaking] Make KollectProfile namespaced 64687aa

  • scope: Enforce KollectScope in reconcilers 60e79ce

  • hub: Wire remoteClusters and credential pull d1ca137

  • cli: Add create-remote-secret stub ef6ec64

  • hub: Add SAR on ingest auth da8e632

  • hub: Remote cluster Connected and queue wire auth 203509d

  • collect: Namespace and resource watch labels 156e196

  • hub: Spoke push auth via TokenReview 8ef9bef

  • Namespaced multi-tenant operator support e2020df

  • spoke: Delta publish with transport reuse e75a5d9

  • hub: 100-spoke merge spike and delta removals aeba1f3

  • transport: Add NATS JetStream backend d981a90

  • hub: Wire consumer mode and spoke publish stub 9a3940e

  • hub: Spoke report merge consumer da9daa9

  • transport: Kafka backend with redpanda tests 5ef18a7

  • obs: Task perf-report and metrics catalog 4de96e8

  • perf: Parallelism, metrics, and pprof 3da5ff8

  • sink: Postgres and kafka export backends fa8aeb5

  • sink: GCS backend and prometheus stub 7bde2ba

  • api: KollectHub and KollectScope CRDs ae90224

  • transport: Pluggable factory with Redis Streams d08d612

  • metrics: Complete ADR-0020 operator metric set 0e14c05

  • collect: SAR degradation and namespaceSelector 39ae427

  • inventory: Store-backed HTTP API and K8s auth ee03b72

  • controller: Wire collection and inventory export b40252f

  • transport: Add in-process pub/sub bus 9154c22

  • collect: Add dynamic informer engine and store 666bded

  • sink: Add git export and s3 PutObject backends 8157739

  • inventory: Add toggleable HTTP endpoint and metrics 1b6f907

  • sink: Add connection test with TLS CA support dcc6e48

  • webhook: Validate Profile CEL and JSONPath paths 6329e86

  • helm: Add kollect operator chart 9b3e0da

  • api: Add sink TLS and inventory HTTP fields fba40b7

  • controller: Validate KollectTarget profileRef 51a3c51

  • sink: Add backend registry with git stub 472800c

  • collect: Add CEL and JSONPath extractor 8b079e4

  • api: Add KollectProfile/Sink/Target/Inventory v1alpha1 types 5f5866f

Performance

  • controller: Indexed FieldIndexer lookup for sink-watch mappers (AR-09) 64494f4

  • controller,collect: Incremental namespace fingerprint cache (AR-10) (#37) 6ca0c8e

Refactoring

  • aggregate: Remove dead ExportCoalesce abstraction (AR-12) 1c1b14e

  • sink/postgres: Typed sentinel errors for Export stages (F61) 0d81aba

  • validation,sink: Typed errors for family-sink and s3 empty-payload 8568765

  • controller,api: Generic family-sink reconciler (AR-08/F68) afa3e85

  • sink/bigquery: Typed sentinel errors for Export failure stages (F66) 59da86f

  • sink/gitlab: Dedup inventory path parsing via pathvalidate 10a4988

  • sink: Extract shared secret-value-from-keys helper (dup audit) (#38) dacbece

  • webhook: Dedup ValidateDelete boilerplate across validators (#33) d333c26

  • sink: Extract inventoryFromObjectPath into pathvalidate (#29) 4f4c6f2

  • bigquery: Inject query execution adapter 71491d6

  • s3: Isolate head-bucket check helper 8393135

  • postgres: Narrow upsert tx interfaces 75bb338

  • export: Extract envelope partition helpers 6e13c42

  • mongodb: Isolate export scope planning cc264c9

  • postgres: Extract export planning helpers d858a67

  • controller: Compose cluster rollups by namespace 374f6e6

  • inventory: Fold internal/httpauth into inventory e570f82

  • cmd: Fold internal/pprof into cmd d0c7f82

  • validation: Decouple layout path checks from sink package 43d89c6

  • collect: GVR index and sharded store 0c97ee7

  • perf: P0/P1 export path optimizations 3e12aaf

  • collect: Namespace-scoped store watch driver 4f1210c

  • arch: Resolve arch-04, arch-11, arch-12 1709158

  • docs: Phase 1 root doc moves fcbaca0

  • controller: Remove --export-debounce flag 3d5b729

  • Unify bearer auth and brittle error assertions 13fdc78

  • sink: Extract shared RunExportItems pipeline 3762989

  • controller: Extract cluster inventory export path 535cca4

  • hub: Deprecate KollectHub controller 6cf1bb3

  • collect: Store Len and reconcile metrics 09e1ca0

  • api: [breaking] Make KollectInventory namespaced 1db8ed6

  • samples: Consolidate on kollect_v1alpha1_* set 8c6263d

Container image (operator)

ghcr.io/konih/kollect:0.8.0

Multi-arch (linux/amd64, linux/arm64), Debian bookworm-slim nonroot base (includes git and openssh-client for spec.git.engine: cli).

OCI attestations (SBOM + SLSA provenance) are attached in GHCR and on the repository
Attestations page. Verify the signature:

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect@sha256:ae99a1c67658b70abf1cb4a2663e50188c7b3fd07558beff5f5b4b9cc85402a8

Container image (kollect-ui)

Optional read-only UI SPA — enable with Helm ui.enabled=true.

ghcr.io/konih/kollect-ui:0.8.0

Multi-arch (linux/amd64, linux/arm64), nginx alpine static server.

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect-ui@sha256:9d3af4638277837afc3f9323e428dc3a80b41317b5cc0ce129ceeda118a06758

Install (Kustomize)

kubectl apply -f install-crds.yaml
kubectl apply -f install.yaml

Install (Helm — OCI)

helm upgrade --install kollect oci://ghcr.io/konih/kollect \
  --version 0.8.0 \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.8.0 \
  --set ui.image.tag=0.8.0

Install (Helm — GitHub Release tarball)

helm upgrade --install kollect kollect-0.8.0.tgz \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.8.0 \
  --set ui.image.tag=0.8.0

Verify checksums with sha256sum -c checksums.txt. Each release asset includes a
<file>.sigstore.json Sigstore bundle; release-provenance.intoto.jsonl attests all assets.
See docs/RELEASE.md.

Assets 17
Loading