Skip to content

Cloudkeel-DD 0.3.6

Choose a tag to compare

View all tags
@cloudkeel cloudkeel released this 29 Aug 10:49
· 12 commits to main since this release
0.3.6
cb10357

Cloudkeel-DD 0.3.6

Security fix release, plus a batch of correctness and AWS-coverage fixes.

helm install dd oci://registry-1.docker.io/driftdetective/d-detective --version 0.3.6 \
  --namespace ddetective --create-namespace \
  --set secrets.fernetKey="$FERNET" \
  --set secrets.dataKeyWrapped="$DATAKEY" \
  --set secrets.jwtSecret="$JWT" \
  --set postgresql.auth.password="$(openssl rand -hex 16)"

Security

  • Fixed a cross-tenant issue in GitHub/GitLab remediation: an
    instance-wide remediation token combined with an unvalidated target
    repository could let one tenant's remediation reach another tenant's repo.
    0.3.5 shipped a narrower guardrail for this; 0.3.6 is the full fix.
    If you run multi-tenant with GitHub/GitLab remediation enabled, upgrade.

Other fixes since 0.3.5

  • A registration race under concurrency could let two simultaneous
    registrations both create a workspace — now guarded.
  • AWS baseline-exclusion improvements: service-linked IAM roles now match by
    name, and every VPC's auto-created "Main" route table is now recognized
    (the AWS API this used never exposed it at all — reads via a different API
    now).
  • AWS gets a real per-resource live cross-check on the Terraform-plan scan
    path, matching what Azure/GCP already had.
  • Several drift-event and dashboard-tile attribution fixes (misattributed
    tiles, a GCP subnetwork region collision inflating drift counts, live scan
    progress visibility).
  • Standalone IAM-role/S3-bucket Terraform resources now merge correctly
    instead of reporting false drift against an incomplete payload.
  • GCP key expiry and AWS key age now surfaced in findings.

No chart template, values.yaml default, or licensing/pricing behavior
changed in this release.

Verification

  • Full backend test suite passed (4,300 tests) and a live end-to-end pass
    against real Azure/AWS/GCP test accounts, with zero regressions.
  • Confirmed on the registry by digest, not tag name:
    • driftdetective/ddetective-backend:0.3.6 → sha256:72c7cfb89139c4fe862025f1b697c2e32e572e3c355328474573b48762f94d45
    • driftdetective/ddetective-frontend:0.3.6 → sha256:de512698da2d1e8c75ee5a797df278ac08d9139238f05099fc9ae099234d5984
Assets 2
Loading