v0.0.3

Breaking

• The Helm charts now name resources <release>-<chart>. A release named
  k4a-index or k4a-mcp keeps its names; any other release is renamed
  unless fullnameOverride is set, and serviceAccount.name follows, which
  can break an existing EKS Pod Identity association (#66).
• Without --auth, the method is inferred from what was given (credentials
  mean scram, a cert or key means mtls, OAuth settings mean
  oauthbearer, nothing means plaintext) instead of always scram, in the
  CLI, the TUI and k4a-index (#69, #99).
• --auth mtls refuses --insecure instead of silently skipping server
  verification, as docs/design/auth.md always said (#98).
• $VAR in a password, a path or a flag is expanded only when it is the whole
  value ($VAR or ${VAR}), so a literal $ is no longer mangled (#71).
• ui.readonly now blocks the mutating headless commands too, and
  delete-topic asks for confirmation (--yes to skip; it refuses rather
  than hangs without a terminal) (#88).

Added

• Authentication: SCRAM-SHA-256, SASL/PLAIN and OAUTHBEARER (static token,
  token file, or client credentials with refresh), and SASL without TLS as an
  explicit --no-tls opt-in that warns (#78, #82).
• Confluent Schema Registry decoding of Avro, Protobuf and JSON Schema keys
  and values in Messages, Message Detail and k4a consume --decode, with a
  per-context schema-registry: block; x toggles raw and decoded. Schema IDs
  in Confluent 8 record headers, google/type imports and Any fields are
  resolved (#86, #92, #129).
• Headless commands for what the TUI could already do: list-topics,
  list-groups, describe-group, describe-broker-config, reset-offsets,
  delete-offsets, delete-group, delete-acl, add-partitions,
  purge-topic (#101, #106, #108).
• k4a produce --value, --record-key, -H k=v and --stdin, and Value,
  Key and Headers fields in the TUI Produce form (#110).
• Seeking: k4a consume --from-beginning | --offset N | --since, and t in
  the Messages view; consume --no-group reads every partition, or one with
  --partition (#85, #126, #127).
• k4a search --path and path: in the TUI: a jq-style JSON-path predicate,
  always answered by a scan (#125).
• Copy a message's value, key or record (c/K/C) over OSC 52 or a native
  clipboard tool (ui.clipboard), export the visible messages or search
  results to JSONL (e), and step through messages in Message Detail
  (n/N) (#100, #128).
• TUI administration: edit broker configs, edit an ACL binding, a client
  quotas view (:quotas), partition reassignment from Topic Detail (a), and
  re-run/edit/filter in the Search view (#96, #105, #107, #109, #111).
• k4a index status / k4a index clear, and k4a state export /
  k4a state import (a validated tar.gz; inline secrets stripped unless
  --include-secrets) (#73, #124).
• k4a-index and k4a-mcp: optional TLS, mTLS and bearer-token auth on
  their listeners, a server-side --max-search-limit, Prometheus metrics and
  /healthz / /readyz on --admin-listen, grpc.health.v1, and
  --shutdown-timeout (#77, #84, #90, #93).
• k4a-index: bounded backfill when it starts following a topic, catch-up
  after a restart, and a follow-set that survives a container restart (#95).
• Helm charts: Kafka credentials and TLS from existing Secrets, OAuth and
  noTLS, log level, a hardened pod and container security context, and
  optional NetworkPolicy, PodDisruptionBudget and ServiceMonitor (#66, #82,
  #90, #93).

Changed

• The TUI's hint bars and ? help are generated per view from one key table,
  so they list only keys that work there (#83, #94).
• k4a-mcp serves MCP statelessly, so replicas need no sticky sessions
  (#61).
• The on-disk search cache is capped at 256 MiB and drops entries unused for
  7 days (#68).
• Search patterns are logged at debug, not info, by k4a-index (#84).

Fixed

• Form fields in the TUI take keys that are also global shortcuts, so
  orders-1 can be typed (#65).
• Every connection flag (--username, --password, --cert, --key,
  --ca, -k, --region) overrides the selected context, in the CLI and in
  k4a-index (#63, #80).
• An AWS profile's own region, and AWS_REGION, are used instead of
  us-east-1 (#104).
• k4a upgrade refuses unknown flags instead of installing (#62).
• Out-of-range partition counts, replication factors and partition IDs are
  refused instead of wrapping (#67).
• :upgrade restarts the TUI with the original command line (#74).
• :produce matches only the whole word and keeps the topic's case;
  :search uses the topic on screen; errors the TUI swallowed are shown
  (#76, #79, #87).
• The ACLs tab (4) showed an empty box; it now has its view (#109).
• enter in a filtered Messages view opened the wrong message (#100).
• Headless commands close their Kafka client; produce reports what was
  actually sent after Ctrl+C (#72, #81).
• k4a-index: illegal topic names (including . and ..) are refused before
  they become index paths; a tail that dies leaves the follow-set; a Coverage
  probe no longer keeps a topic from being evicted; shutdown and eviction
  races are closed; byte sizes that overflow are refused (#64, #70, #75, #77,
  #89).

Full Changelog: v0.0.2...v0.0.3

v0.0.2

Fixed

• ctrl-d on the messages view now opens the purge prompt its hint bar
  advertises; it used to fall through to navigation and do nothing (#24).

Changed

• k4a upgrade no longer depends on go-selfupdate: it finds, verifies and
  installs the release itself, so the build no longer links
  golang.org/x/crypto/openpgp (GO-2026-5932) and the go-vulncheck commit
  hook is back on (#17).
• Releases, the images and the charts are now built, signed and attested by
  the shared workflows in blairham/.github
  (go-release.yml, go-chart.yml), so the keyless signing identity is
  that workflow rather than this repository's own; SECURITY.md has the new
  verify commands and how to verify 0.0.1 and earlier.
• k4a upgrade looks up a gh token under the upgrade's own context, so
  canceling an upgrade no longer waits out the token lookup.

Security

• Built with Go 1.26.9 (GO-2026-6603 to 6617 in net/http and
  crypto/tls).

Full Changelog: v0.0.1...v0.0.2

v0.0.1

Added

• The README documents installing with brew install blairham/tap/k4a.

Changed

• Dependency updates: aws-sdk-go-v2, franz-go (and kadm/kmsg), bubbletea,
  tuikit, gRPC, bleve, the MCP Go SDK, go-selfupdate and smithy-go.

Fixed

• k4a upgrade and :upgrade no longer overwrite a Homebrew-installed
  binary; they point at brew upgrade blairham/tap/k4a instead, and
  k4a upgrade --check names that command (#12).

Full Changelog: v0.0.0...v0.0.1

v0.0.0

The first open-source release of k4a, under the Apache License 2.0.

Added

• k4a, a terminal UI for Kafka in the style of k9s: topics, consumer
  groups, brokers, ACLs and their configuration; a live message tail with a
  message detail view; producing; creating and deleting topics and ACLs;
  growing partitions and changing replication; resetting group offsets; a
  regex filter on every list and a : command mode. --readonly blocks the
  mutating actions.
• Headless subcommands for the same operations (produce, consume,
  create-topic, describe-topic, topic-size, alter-config,
  alter-replication, list-acls, create-acl, delete-topic, verify),
  and search over a whole topic with key, value and header scopes, time
  bounds and partition filters.
• Connections over plaintext, TLS, SASL/SCRAM-SHA-512, mTLS and MSK IAM.
  AWS profiles (SSO, credential_process) resolve in-process through the
  AWS SDK; broker lists can come from SSM parameters.
• Named contexts in ~/.k4a/config.yaml, kubeconfig-style, with contexts,
  use-context and config subcommands.
• An opt-in local index (index.enabled) that serves repeated searches
  without rescanning, and an on-disk cache of search results. A search the
  index cannot answer with full recall falls back to a scan.
• k4a-index, a shared index daemon that tails an allowlisted set of topics
  and answers searches over gRPC, reporting its coverage so a client scans
  whatever it does not hold; and k4a-mcp, a Model Context Protocol server
  in front of it. k4a mcp serves the same search tool over stdio.
• Helm charts for k4a-index and k4a-mcp, and signed multi-arch images
  ghcr.io/blairham/k4a-index and ghcr.io/blairham/k4a-mcp.
• k4a upgrade, which replaces the binary with the latest release after
  checking it against the release checksums.

Full Changelog: ...v0.0.0