cluster-health-autopilot 1.26.0

Cluster Health Autopilot 1.26.0 — see the README for the 30-second demo.

Install

• Binaries below for darwin-{amd64,arm64}, linux-{amd64,arm64}, and windows-{amd64,arm64}.
• Container image: docker.io/docker4zerocool/cluster-health-autopilot:1.26.0 (multi-arch). The ghcr.io mirror exists but is not yet publicly pullable (package visibility — pending org settings change).
• Helm chart: charts/cluster-health-autopilot/ at this tag.

Changelog

• 178eabb: P1+P3: security fail-closed, silently-dead-feature fixes, CRD/RBAC/flag parity gates (adversarial-review remediation) (#186) (@salilkadam)
• 9126c92: chore/helm values gcp subnet silence status (#203) (@salilkadam)
• 5647b64: feat(audit): port the hash-chained audit-trail primitive to OSS pkg/audit (#201) (@salilkadam)
• 381e097: feat(catalog,chart): env gates + chart toggles for the 6 base probes and 7 core analyzers (#198) (@salilkadam)
• dc6e3db: feat(chart): deploy the read-only dashboard — Deployment+SA+read-only RBAC+Service+Ingress+NetworkPolicy, gated dashboard.enabled (P6.6 deploy) (#196) (@salilkadam)
• caf8f34: feat(chart,operator): ticketing.{jira,servicenow,route} values → CHA-com ticketing env (secret-refs for tokens); makes the paid Jira/ServiceNow sinks deployable (#194) (@salilkadam)
• 2d7140a: feat(cloud): append CHA-com RCA join keys to LB and Azure cert finding messages (#202) (@salilkadam)
• c11e155: feat(fix): explicit OWASP K8s Top-10 mapping + posture-non-regression guard test (G2) (#190) (@salilkadam)
• 8f53fc1: feat(fix,ai,chart,operator): append-only protected-namespace extension via CHA_PROTECTED_NAMESPACES_EXTRA (#200) (@salilkadam)
• baa68d5: feat(operator,chart): approval-server NetworkPolicy closes X-Forwarded-User bypass (P2.6b-OSS) (#188) (@salilkadam)
• 848ef29: feat(playground): kind-verified hosted-playground bundle — drift injector + CHA + live viewer + deploy/DNS runbook (P6.8) (#195) (@salilkadam)
• 619c97a: feat(release): CycloneDX SBOM + cosign keyless image signing + attestation (P6.2) (#192) (@salilkadam)
• f6d75d5: feat(ticketing): resolve-on-clear + debounced comment-on-recurrence (M2) — tickets auto-close (P6.5) (#191) (@salilkadam)
• a9fa3be: fix(chart): silence binding targets the watcher SA (was cha.fullname → -sa); guard test (live-verify finding) (#193) (@salilkadam)
• 5ddbe19: fix(diagnose,report): DNSChainDrift emitted non-enum severities ("warn"/"error") failing every DriftReport reconcile; normalize at the Reconcile choke point + AST lint guard (#197) (@salilkadam)
• 1ca6f84: fix(watcher,diagnose,snapshot): silence v1 Endpoints deprecation spam — EndpointSlice-first reads + watch trigger + filtered warning handler (#199) (@salilkadam)
• b0d0f86: fix/operator cronjob flags release 1.26.0 (#204) (@salilkadam)
• d8ad2c4: test(cmd): command-tree --help smoke for cha + cha-operator (P2.4) (#187) (@salilkadam)

---

Full changelog: v1.25.1...v1.26.0