Skip to content

v0.1.2

Choose a tag to compare

View all tags
@ThomasK33 ThomasK33 released this 25 Sep 08:27
v0.1.2
c9ffd94
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release contains the security fix from v0.1.1 plus a packaging repair. The v0.1.1 release build failed before publishing, so v0.1.1 has no binaries or images; use this release.

Security

  • Authentication for the aggregated API server and the MCP HTTP server (GHSA-c3vp-pjh2-7gv4, #136). In v0.1.0, both servers accepted unauthenticated requests and acted with the operator's authority, and the default --app=all ran both. The aggregated API server now authenticates and authorizes every request through Kubernetes (front-proxy certificates, TokenReview, SubjectAccessReview); anonymous callers reach only /healthz, /livez and /readyz. The MCP server no longer runs in --app=all; --app=mcp-http listens on 127.0.0.1:8090 and requires a bearer token from --mcp-token-file.
  • Dependency updates for published advisories (#92, #101, #104, #118), and code and image security scanning in CI (#88).

Upgrade notes

  1. The aggregated API server needs config/rbac/auth-delegator-binding.yaml and config/rbac/authentication-reader-binding.yaml for the operator ServiceAccount (both are applied by kubectl apply -f config/rbac/). Without read access to kube-system/extension-apiserver-authentication it does not start; without permission to create SubjectAccessReviews it denies requests.
  2. Clients that called port 6443 directly must send a Kubernetes bearer token with RBAC on aggregation.coder.com, or go through kube-apiserver (kubectl).
  3. RBAC on codertemplates and coderworkspaces is owner-equivalent inside Coder: the server calls Coder with the control plane's operator token. Grant it only to subjects you would trust as Coder owners.
  4. --app=all no longer runs MCP and deploy/mcp-service.yaml is removed; delete the old Service. To use MCP, run --app=mcp-http --mcp-token-file=<file> and connect through kubectl port-forward.
  5. Outside a cluster, the aggregated API server needs KUBECONFIG (exactly one file) or ~/.kube/config.

Added

  • dist/install.yaml, a generated one-file install bundle for the operator in controller mode, kept fresh by CI (#89).
  • CoderControlPlane can reference an external PostgreSQL connection Secret (#122).
  • Kind E2E coverage for the CoderWorkspace lifecycle (#114).

Fixed

  • CoderTemplate Update applies metadata only after the new source is active, and returns 409 Conflict if the template changed during the import (#129).
  • spec.files template Create waits for the import before creating the template (#116).
  • Canonical organization, owner, template and workspace names are enforced so repeated kubectl apply converges (#106, #111).
  • Aggregated API delete preconditions are honored, and workspace resourceVersion reflects the returned representation (#110, #115).
  • kubectl rollout restart works on operator-managed Deployments (#121).
  • Release and :main image builds are unified and repaired, and tag releases no longer fail on an unset GORELEASER_CHANNEL (#86, #87, #99, #131, #138).

Documentation

  • Rewritten README and docs (#123); corrected deploy steps (#124, #126); the standalone session token is kept in a Secret (#135); the 34-second write budget for template imports is documented (#128).
Assets 5
Loading