k10y 2.7.0

• Two-factor login: a code from an authenticator app at every sign-in, with 10 single-use recovery codes. Set it up in My settings; require it for admins or everyone in System settings → Sign-in security; admins can reset it for a lost phone.
• More alert channels: Slack, email (SMTP) and webhooks (JSON, optionally signed with HMAC-SHA256), next to Telegram.
• Acknowledge and silence alerts: acknowledging stops reminders and tells the channels who's on it; silences mute one alert (also when it comes back) or a whole rule for 30 minutes up to a week.
• Full-volume alerts: Storage shows how full each PVC is, and alerts warn at 90% (bytes or inodes). Read from the kubelets with the read-only nodes/stats permission.
• Helm rollback from k10y (opt-in): dry run, then helm rollback on the agent, with review and audit. Needs K10Y_HELM_ENABLED=true and rbac-helm.yaml.
• Open a Service in the browser through the hub: one-hour, sandboxed links, with the new services.proxy permission.
• HAProxy topology: live traffic down to each server (requests/s and 5xx on every backend → server line).
• HAProxy review: when HAProxy rejects a change, each problem is shown with its line, section and text.
• Pages that need a newer agent say so instead of showing an error.
• Browser tests in the repo (make e2e), and the hub's startup moved to FastAPI's lifespan.
• Agent RBAC: nodes/stats (read) and services/proxy (control). Re-apply install.yaml when upgrading.

Upgrade agents: re-apply install.yaml (or install-readonly.yaml): it adds nodes/stats (volume usage, read-only) and services/proxy (open a Service, control role). Protected namespaces you chose in the hub are kept.

Optional: rbac-helm.yaml lets the agent roll back Helm releases (gives it the built-in edit role); also set K10Y_HELM_ENABLED=true.

Image: docker.io/k10y/k10y-agent:2.7.0 (amd64, arm64)

k10y 2.6.0

• Protected namespaces in the hub: choose each cluster's protected namespaces in System settings → Protected namespaces, with the new namespaces.protect permission (Admin and Kubernetes admin have it; it can be given per cluster). The agent keeps the list in its own Secret, so it survives restarts and upgrades, and every change is in the activity log.
• Add cluster: just type the address. Enter 192.168.64.2:30800 without a scheme; k10y finds how the agent answers. The agent serves HTTPS itself, also through a NodePort, so https:// is added for you, and an http:// address is switched to https:// when the agent speaks TLS (before, it failed with "Server disconnected").
• Search everything (Ctrl/⌘ K): find any Kubernetes object or Helm release in every cluster, and HAProxy frontends, backends and servers, from the top bar.
• Rollout history: a Deployment's Revisions tab lists each revision with images and who changed it, compares two revisions, and rolls back to any one.
• Helm releases: charts, versions, status and history; values and manifest (secrets masked, needs secrets.view); compare revisions; copy the rollback command.
• Workload logs: pick a pod or all, start from the last 15 min / hour / 6 hours, errors only, highlighted matches.
• Smarter alerts: OOMKilled, stuck rollouts, failed or late CronJobs, PVCs pending or lost, and TLS certificates expiring within 14 days join the problem list.
• Certificates page with days left for Ingress TLS secrets and cert-manager Certificates.
• CronJob runs and namespace quotas in the details panels.
• Right-sizing: real CPU (p95) and memory (peak) per pod against requests and limits, with recommended values and what you'd free.
• 7-day history: the hub keeps 5-minute samples for 7 days; Overview, Nodes and pods get 6 h, 24 h and 7 d ranges.
• Service → HAProxy: a Service shows the HAProxy backends that send traffic to it.
• Agent RBAC: read access to ResourceQuotas, LimitRanges and cert-manager Certificates. Re-apply install.yaml when upgrading.

Upgrade agents: re-apply install.yaml (or install-readonly.yaml): it adds read access to ResourceQuotas, LimitRanges and cert-manager Certificates. Protected namespaces you choose in the hub are kept across upgrades.

Image: docker.io/k10y/k10y-agent:2.6.0 (amd64, arm64)

k10y 2.5.0

Access control per system: Kubernetes roles and HAProxy roles, and HAProxy permissions per instance.

Roles per system

Role	Assign on
Admin	everything
Kubernetes viewer / operator / admin	everything or one cluster
HAProxy viewer / operator / admin	everything or one HAProxy instance

• The old Operator and Viewer roles become Kubernetes operator and Kubernetes viewer. Their HAProxy permissions move to HAProxy operator / viewer, which their users get automatically, so nobody loses access.
• The Roles page shows which system each role applies to, and groups permissions into Cluster, HAProxy and Hub.
• Built-in roles now pick up permissions added in newer versions (once; a permission you removed stays removed).

HAProxy permissions per instance

• On the Users page, a role can apply to everything, one cluster or one HAProxy instance. For example, HAProxy operator on lb-edge-1 lets someone drain servers and block IPs there without seeing the other load balancers.
• Every HAProxy page, button, list, alert and group change follows the permissions of that instance.
• New haproxy.manage permission for adding, editing and removing HAProxy instances and their Data Plane API logins (it used to be part of clusters.manage; roles that had it get it automatically). Adding a new instance needs it on everything.
• HAProxy operator and admin can use the HAProxy AI assistant on their instance.

Fixes

• The first IP block on an HAProxy (which adds the blocklist to every frontend, a config change) now needs haproxy.configure.
• "Compare configs" only shows to people who can configure, and only compares instances they may configure.

Upgrade

• Hub: docker compose pull && docker compose up -d (image 2.5.0). Roles and permissions are migrated automatically on start.
• Check your users afterwards: a Kubernetes role assigned on one HAProxy grants nothing there; use an HAProxy role.
• Agents: no agent changes; updating is optional: kubectl apply -f https://github.com/chhayserver/k10y-agent/releases/download/v2.5.0/install.yaml

Image: docker.io/k10y/k10y-agent:2.5.0 (amd64 + arm64). Website and docs: https://k10y.pages.dev

k10y 2.4.1

A small fix release.

Fixes

• Resource details panel: a long container image (e.g. docker.io/k10y/k10y-agent:2.4.0) no longer wraps one letter per line in the Containers table, and the "Image" and "Ports" headers no longer run together. Requests, limits and probes wrap so the table fits narrow panels.
• Table headers without a sort button now line up with their values.

Upgrade

• Hub: docker compose pull && docker compose up -d (image 2.4.1).
• Agents: no agent changes; updating is optional: kubectl apply -f https://github.com/chhayserver/k10y-agent/releases/download/v2.4.1/install.yaml

Image: docker.io/k10y/k10y-agent:2.4.1 (amd64 + arm64). Website and docs: https://k10y.pages.dev

k10y 2.4.0

HAProxy in k10y now works the way you write HAProxy config, with guided setups, live IP blocking, longer history, and a fix for Data Plane API crashes.

Your config, read and written your way

• Routes like use_backend inbound-order if { path /order } || { path_beg /order/ } are editable (shown as "/order and /order/…"), and new routes are written the same way. use_backend x without a condition, X-Forwarded-Port, certificate files (bind 0.0.0.0:443 ssl crt /etc/haproxy/new-tls.pem), option redispatch + retries, check inter 1s rise 3 fall 1, stick-table … stick on src and TCP keep-alive are all understood.
• A change writes only the part that changed (one route, one timeout, one server), so the rest of your config stays as you wrote it. New servers copy the check timing of the others.

Guided setups

• New frontend starts from what you're setting up: Microservices by path, Web app over HTTPS (e.g. Mattermost), RabbitMQ, REST API, WebSocket, PostgreSQL, MySQL, Redis, MongoDB, other TCP. One reviewed change creates the frontend and all its backends with their servers.
• Every balancing method and health check, sticky sessions, timeouts, server TLS and max connections, each explained.
• Add a route in one step (path → new backend with servers), placed before shorter paths.

Operate

• Block an IP instantly (no reload after the first time) from Rate limits & blocks or a log line; unblock a rate-limited client.
• Maintenance page per frontend, with addresses that still get through.
• Live numbers per route, live traffic on the topology, and charts up to 7 days.
• Copy a frontend or backend to another HAProxy, and compare configs in a group.

Fix

• The Data Plane API could crash ("concurrent map iteration and map write") when two changes ran at once, e.g. a preview during a Kubernetes sync. k10y now sends changes to each HAProxy one at a time, retries reads while it restarts, and cleans up transactions a crash left open. Tested with 450 parallel previews.

Upgrade

• Hub: docker compose pull && docker compose up -d (image 2.4.0). A new table for one-minute history is created automatically.
• Agents: no agent changes; updating is optional: kubectl apply -f https://github.com/chhayserver/k10y-agent/releases/download/v2.4.0/install.yaml

The project now lives at https://github.com/chhayserver/k10y-agent. Image: docker.io/k10y/k10y-agent:2.4.0 (amd64 + arm64). Website and docs: https://k10y.pages.dev

k10y 2.3.1

OpenRouter as an AI provider

• One key for models from many vendors (Gemini, GPT, Claude, DeepSeek, Qwen, Grok…) through OpenRouter.
• Load models lists only models that support tool calling, which the AI assistant needs.
• Keys for Google Gemini, CodeCraft and OpenRouter are kept side by side. When one provider is down, switch to another with one click.

Set it up in Administration → System settings → AI providers → OpenRouter: paste a normal API key from openrouter.ai/keys (a management key can't call models), pick a model, then Save & use.

Upgrade

• Hub: docker compose pull && docker compose up -d (image 2.3.1). No database changes.
• Agents: kubectl apply -f https://github.com/chhayserver/k10y-agent/releases/download/v2.3.1/install.yaml (needed to save OpenRouter settings on an agent used without the hub).

Image: docker.io/k10y/k10y-agent:2.3.1 (amd64 + arm64). Website and docs: https://k10y.pages.dev

k10y 2.3.0

HAProxy pages you can read at a glance and filter, and HAProxy's own word for them: frontends.

HAProxy Overview, redesigned

• A status line that says what's wrong ("2 problems need attention") with Ask AI why.
• Key numbers with trends: requests/s, error rate, response time, sessions, servers up. Click one to open the matching page.
• Needs attention only shows when something is wrong, with a link to the backend or the logs.
• Each frontend drawn as its routing: a Proxy (all traffic → backend), or Path routing (/api → api, everything else → web), with a dot per server and live traffic.
• One traffic chart: pick the metric (requests, errors, error %, sessions, response time), compare by frontend or backend, 15 min or 1 hour, show only some.
• Customize which sections show (including an optional topology); saved to your account.

Frontends and Backends as dashboards

• Number tiles at the top that follow your filters.
• Frontends: filter by type (Proxy, Path routing, Other rules), problems, TLS, rate limit or IP allow-list; search by name, port, path or backend; sort by traffic or errors; Cards or Table view.
• Backends: a new filter by the frontend that uses them (or unused backends).

Frontends, not services

"Services" are now called Frontends across the HAProxy pages, the AI assistant, alerts and docs. Old /haproxy/services links and saved start pages keep working.

Upgrade

• Hub: docker compose pull && docker compose up -d (image 2.3.0). No database changes; your preferences carry over.
• Agents (optional, no agent changes): kubectl apply -f https://github.com/chhayserver/k10y-agent/releases/download/v2.3.0/install.yaml

Image: docker.io/k10y/k10y-agent:2.3.0 (amd64 + arm64). Website and docs: https://k10y.pages.dev

k10y 2.2.1

A smaller release on top of 2.2.0: an AI assistant for HAProxy and a cleaner Backends page.

HAProxy

• AI assistant for HAProxy: investigate the whole HAProxy, one service or one backend (⋯ → Diagnose with AI, or the new AI Assistant page). It uses read-only tools (health checks, live rates, recent logs, config sections, certificates, recent changes) and gives a diagnosis. Proposed fixes go through the normal review and HAProxy validation; unsafe ones (such as draining the last healthy server) are refused.
• Backends page as one table: a row per backend with a health bar, settings and traffic; click a row to see its servers (state, weight and share of traffic, health check, requests, 5xx). Search, filters (Problems, From Kubernetes), sorting, and expand or collapse all. Backends with problems open by themselves.

AI

• Faster and more reliable investigations for Kubernetes and HAProxy: a lower thinking level for Gemini 3 models, a longer per-call timeout and one automatic retry.
• A clear message when the AI provider itself fails (5xx): retry later, or switch provider on the AI page.

Upgrade

• Hub: docker compose pull && docker compose up -d (image 2.2.1). No database changes.
• Agents (optional, no agent changes): kubectl apply -f https://github.com/chhayserver/k10y-agent/releases/download/v2.2.1/install.yaml

Image: docker.io/k10y/k10y-agent:2.2.1 (amd64 + arm64). Website and docs: https://k10y.pages.dev

k10y-agent 2.2.0: all your DevOps tools in one place (Kubernetes + HAProxy)

k10y is now a control room for more than one system: Kubernetes clusters and HAProxy load balancers, with one login, one set of roles, one audit log and one alert pipeline. Created and maintained by Kang Kimchhay.

One place for every system

• System switcher in the sidebar (Kubernetes, HAProxy, more to come). Each system has its own pages and picker; Alerts, Activity, Administration and My settings are shared.
• Home: the health of every cluster and HAProxy instance, firing alerts and recent changes. The new default start page.
• New URLs /k8s/…, /haproxy/…, /admin/… (old links redirect). A banner offers a reload when a newer version is deployed.

HAProxy management (Data Plane API v3)

• Services, backends and servers with live health, plus a service → backend → server topology.
• Live charts (requests, 5xx, sessions, response time) and live request logs (syslog to the hub on UDP 5514).
• Drain / maintenance / back in service instantly, weights for canaries, a guided rolling deploy.
• Add, edit and remove services, backends, servers and routes (path, host, header, client IP), TLS listeners, IP allow-lists, HTTPS redirect, per-IP rate limits, or edit the raw config. Every change: transaction → diff → HAProxy validation → graceful reload → confirmed result.
• Certificates with expiry, stick tables, config history with rollback (also detects changes made outside k10y).
• Groups: one change on several HAProxy at once. Alerts: server down, backend down, 5xx rate, sessions, certificate expiry, unreachable.
• Kubernetes link: a backend that stays in sync with a Kubernetes Service (node ports or pod IPs).
• New permissions haproxy.view, haproxy.operate, haproxy.configure; Administration → HAProxy instances.

Upgrade

• Hub: use the new docker-compose.yml (publishes UDP 5514 for HAProxy logs), then docker compose pull && docker compose up -d. The database upgrades automatically.
• Agents: kubectl apply -f https://github.com/chhayserver/k10y-agent/releases/download/v2.2.0/install.yaml (now pinned to 2.2.0).
• Try HAProxy with the lab in the repo: make haproxy-lab-up.

Image: docker.io/k10y/k10y-agent:2.2.0 (amd64 + arm64). Website and docs: https://k10y.pages.dev

k10y-agent 2.1.0: login page, YAML edit, pod shell, sessions, backups

New

• Modern sign-in page with the k10y-agent logo; show/hide button on every password and secret field; password strength meter.
• Edit YAML in any details panel (like kubectl edit): diff review, dry run, and a conflict check if someone else changed the object. New permission resources.edit.
• Pod shell in the browser (xterm.js), through the hub. Needs the new pods.exec permission; every session is audited.
• Sessions: see and sign out your devices; admins can sign a user out everywhere and disable or enable accounts.
• My settings follow you: sidebar pages, theme, refresh, start page and chart range are saved to your account.
• Automatic backups of the hub database to ./data/backups (daily, newest 14 kept), plus make hub-backup / make hub-restore.

Security

• Agents are now API-only. The old built-in dashboard and K10Y_MODE=dashboard were removed, and cross-origin browser calls are off by default, so people always go through the hub's logins, roles and audit.

Upgrade

• Agents: kubectl apply -f https://github.com/chhayserver/k10y-agent/releases/download/v2.1.0/install.yaml (adds pods/exec to the control role).
• Hub: use the new docker-compose.yml (adds the backup service), then docker compose up -d. The database is upgraded automatically.
• pods.exec is not in the Operator role by default. Add it to a role if you want people to use the shell.

Image: docker.io/k10y/k10y-agent:2.1.0 (amd64 + arm64).