v1.4.0

Stories implemented since v1.3.0:

• release-container-image: the release workflow builds the container image around the release's own binary, pushes ghcr.io/beyond10x/conductor:<version> and names tag and digest in the Release's notes (closed by the v1.3.0 run of that workflow).

Built in this release under instance-pods, a story that stays a draft until the operator accepts it:

• daemon.kubernetes (namespace, image, owner, api_port, volume, resources, env): a daemon in a Kubernetes namespace creates, lists and deletes one pod per instance through the Kubernetes API with the service account its own pod mounts; per instance a Secret, a volume claim and a pod, each with four labels. Without the key nothing changes.
• Instance routes on the daemon: POST /v1/instances, GET, PUT and DELETE /v1/instances/{name}, POST /v1/instances/{name}/restart; each change validates the whole resulting config first and records one config revision.
• daemon.control_token: secret:<name>: a bearer equal to that secret is the machine principal control-plane, admitted for the reads and those five routes and refused on every other write.
• conductor daemon serve --daemon-config FILE: a second file with version and daemon only, written into the config file at every start; the instances the file holds are kept.
• A runtime alone in a pod serves its API on TCP, with a token on every request but GET /healthz.
• A lost instance pod is created again under the failed-start back-off; a daemon restart adopts its pods by label and restarts none; removing an instance deletes its pod and Secret and keeps its claim.
• Nothing a caller sends reaches a pod's image, command, volumes, env sources, namespace, service account, security context or labels; the pod passes the restricted pod security level and mounts no service-account token. The daemon's own secrets reach no instance pod.
• conductor doctor asks the cluster for the 10 rights the pod supervisor uses, one row each.
• /metrics carries conductor_build_info with the binary's version and config protocol.
• The guide website/docs/guides/run-in-kubernetes.md, with manifests a test holds to the daemon's code: the daemon in one namespace, the instance pods in another, the Role, a NetworkPolicy and the six calls. Conductor ships no chart.

Also in this release:

• The prerequisites name ess 0.93; the image carries that version.

Known limits: one daemon per owner label and one replica; no drain, stop or start as a desired state for an instance pod, and upgrade answers 409 for one (the image names its version); a daemon that starts on an empty config file deletes the pods and Secrets of its owner label and keeps the claims, so keep the daemon's volume; every secret of the daemon's secrets source that the daemon section does not name can be named into an instance pod by whoever holds the control token; not shown yet: an agent session started inside an instance pod, a forge token in a pod, postgres as the store of pod instances.

Container image

ghcr.io/beyond10x/conductor:1.4.0 at digest sha256:b4707c780d1955d30bd5a882fec830588be57c56390e624ae89a3e1ae2913633

docker run --rm ghcr.io/beyond10x/conductor:1.4.0 conductor --version