v3.0.0

First GA release — production-hardened, with the Kubernetes cluster monitoring built out
over the 2.3.x line.

⚠️ Breaking

• Migrations are squashed into a single consolidated schema per database (config + data).
  This resets migration history, so v3 requires a FRESH database — do NOT point it at an
  existing 2.x database (sqlx will refuse: "migration 1 … has been modified"). New installs
  only. The consolidated schema is byte-for-byte the end state of the old chain (verified by
  scripts/squash-migrations.sh), minus the create-then-drop churn (app_settings, data_cap,
  exec_credentials, dropped columns, the namespace→workspace rename).
• Helm chart is versioned + images are pinned (image.tag: 3.0.0, pullPolicy: IfNotPresent;
  DB images pinned). Set autoUpdate: true for the rolling :auto-update channel.

Added

• DB backup CronJob (backup.enabled), NetworkPolicy (networkPolicy.enabled),
  PodDisruptionBudget (podDisruptionBudget.enabled), and a Helm NOTES.txt.
• Cluster agent in the Helm agent chart (clusterAgent.enabled, default on) — a Helm
  agent install now gets the Cluster page's data, not just per-node host metrics.
• GET /api/kube/summaries — one batched cluster roll-up (Overview + Clusters call it
  once instead of one /kube/summary per cluster).
• Readiness probe /readyz that checks DB reachability (liveness stays static /healthz).

Changed / Hardened

• Hub container: non-root (uid 10001) with CAP_NET_RAW as a file capability (ICMP ping
  keeps working), resource requests/limits, a liveness probe, and nodeSelector amd64.
• EXEC_APP_SECRET auto-generated and persisted by the chart (hub.autoAppSecret, default
  on) so SSH-key encryption is protected out of the box. Back up the release Secret.
• Agent ALLOW_SHELL defaults OFF (opt-in), matching the two-sided-consent exec design.
• Kubernetes container stats: raw retention cut to 14 days (compress after 2) — no
  rollup ladder, so this bounds storage and stops the data-cap evicting host metrics; Cluster
  chart ranges capped to 7d.
• Ingest hot path at the 5s cadence: push interval cached (no per-push DB query), docker
  container metrics inserted in one UNNEST batch, DB pool sizes raised + env-configurable
  (CONFIG_DB_MAX_CONNS / DATA_DB_MAX_CONNS).
• Frontend: uPlot split into its own cached chunk.

Full Changelog: v2.3.26...v3.0.0

v2.3.26

Changed

• Push cadence is now hub-decided and tunable (instead of a fixed local INTERVAL).
  The hub returns the interval in each ingest ack and agents obey it on their next push.
  New defaults: hosts every 5s ("realtime" — previously effectively ~60s, which made
  the raw tier duplicate the 1-minute rollup), Kubernetes clusters every 15s (apiserver
  scrapes are heavier). Tune both under Settings → Data & retention → Sampling cadence
  (admin) — no agent redeploy needed. Backed by GET/POST /api/admin/ingest-intervals.

Fixed

• Data & retention now lists the Kubernetes tiers. The backend already tracked
  kube_namespace_stats / kube_deployment_stats / kube_container_stats (size + retention),
  but the page grouped tiers by name with no Kubernetes group, so they were filtered out of
  the display. Added a "Kubernetes" group.

Full Changelog: v2.3.25...v2.3.26

v2.3.25

Fixed

• Data & retention now lists the Kubernetes tiers. The backend already tracked
  kube_namespace_stats / kube_deployment_stats / kube_container_stats (size + retention),
  but the page grouped tiers by name with no Kubernetes group, so they were filtered out of
  the display. Added a "Kubernetes" group.

Full Changelog: v2.3.24...v2.3.25

v2.3.24

Added

• Cluster stats on the Overview dashboard — a Clusters tile group (clusters online,
  nodes, pods running, CPU cores used, rolled up across the selected workspaces) appears
  whenever a Kubernetes cluster is present. Clusters are no longer double-counted in the
  Hosts tiles.

Full Changelog: v2.3.23...v2.3.24

v2.3.23

Changed

• Cluster pages reskinned to the design system. The Clusters list gains an all-cluster
  roll-up strip (clusters online / nodes / pods / CPU / memory) and richer per-cluster cards
  (mini-KPI grid, Kubernetes + agent version pills, restart count). The Cluster detail page
  gains a KPI strip (CPU / memory / pods running / containers / restarts), a segmented
  group-by control (Namespace / Workload / Label), a workload Kind chip, and a
  usage-relative CPU bar on each breakdown row. Backed by a new
  GET /api/systems/:id/kube/summary (latest-snapshot cluster totals, incl. distinct nodes
  and namespaces).

Full Changelog: v2.3.22...v2.3.23

v2.3.22

Added

• Logs page (Settings → Logs, admin-only) — recent hub logs from an in-memory ring
  buffer (~2000 lines), with a filter box, auto-refresh, and Copy / Download, so you can
  grab logs to debug from the UI without kubectl logs.
• Kubernetes server version on the Clusters list — the cluster agent reads the
  apiserver /version (e.g. v1.29.4) and the cluster card shows it, with the Vantage
  agent version labelled separately (it was previously an unlabelled version badge).

Changed

• Hub logs are written without ANSI colour codes (cleaner in kubectl logs and the new
  Logs page).

Fixed

• Cluster overlay charts rendered empty (500 error). The per-group series query bound
  the time-bucket width as a text parameter (time_bucket(text, …) does not exist) instead
  of inlining the allowlisted constant, so CPU/memory charts on the Cluster page failed.
  Inlined it, matching the single-series query. Regression-guarded in
  scripts/check-kube-stats.sh.

Full Changelog: v2.3.21...v2.3.22

v2.3.21

Fixed

• Cluster overlay charts rendered empty (500 error). The per-group series query bound
  the time-bucket width as a text parameter (time_bucket(text, …) does not exist) instead
  of inlining the allowlisted constant, so CPU/memory charts on the Cluster page failed.
  Inlined it, matching the single-series query. Regression-guarded in
  scripts/check-kube-stats.sh.

Full Changelog: v2.3.20...v2.3.21

v2.3.20

Added

• Clusters page (/clusters, under Infrastructure in the nav) lists Kubernetes clusters
  separately from hosts — a k8s-cluster system no longer clutters Infrastructure → All.
• Per-group overlay on the Cluster charts — with no group focused, CPU/memory draw one
  line per namespace / workload / label (top 16 by usage, like the fleet host overlay);
  hover a line for its name, click a table row to focus a single group.
• Namespace scope selector on the Cluster page. Workloads are namespace-qualified so
  deployments that share a name across namespaces stay distinct (rows carry their namespace,
  and drill-down filters by namespace + workload).

Fixed

• Cluster charts no longer stretch a sparse or empty series across the whole panel — the
  x-axis now spans the selected time window (like the host charts).

Fixed

• Re-enrolling a host no longer creates duplicate rows. Systems were keyed by
  (key_id, hostname), so re-adding a cluster/host with a freshly-minted enrollment key
  (the "Add system" flow mints one each time) registered every node again as a NEW row and
  left the old ones behind as offline ghosts. Systems are now identified by
  (workspace_id, hostname) — a re-enroll updates the existing row and its owning key
  follows the latest report. Migration config/0028 collapses existing duplicates (keeps
  the most-recently-seen row per host).

Full Changelog: v2.3.19...v2.3.20

v2.3.19

Fixed

• Re-enrolling a host no longer creates duplicate rows. Systems were keyed by
  (key_id, hostname), so re-adding a cluster/host with a freshly-minted enrollment key
  (the "Add system" flow mints one each time) registered every node again as a NEW row and
  left the old ones behind as offline ghosts. Systems are now identified by
  (workspace_id, hostname) — a re-enroll updates the existing row and its owning key
  follows the latest report. Migration config/0028 collapses existing duplicates (keeps
  the most-recently-seen row per host).

Full Changelog: v2.3.18...v2.3.19

v2.3.18

Changed

• /pub/agent.yaml now installs full Kubernetes coverage in one manifest — both the
  per-node DaemonSet (host metrics) and the one-per-cluster collector Deployment
  (AGENT_KIND=k8s-cluster: namespace / deployment / pod / per-container CPU-RAM + labels,
  with the ServiceAccount + ClusterRole it needs). A single
  kubectl apply -f "<hub>/pub/agent.yaml?key=…&cluster=…" now yields the Cluster page's
  deployment/pod stats — previously it deployed only the node DaemonSet, so the Cluster
  view stayed empty until the separate deploy/k8s/cluster-agent.yaml was applied by hand.

Full Changelog: v2.3.17...v2.3.18