v0.8.6

Fugaro v0.8.6

Install:

• Homebrew: brew install dimipaun/tap/fugaro
• Go: go install github.com/dimipaun/fugaro/cmd/fugaro@v0.8.6
• Or download an archive below and verify it against checksums.txt (see docs/release.md).

Highlights

• fugaro init completes again on every installation. 0.8.5's could not: it stopped while creating the managed deployer's custom role, which named a permission Google does not allow (cloudscheduler.jobs.resume; Google's name for it is cloudscheduler.jobs.enable).
• Managed projects and fugaro init --provision-batch are turned off in this release. Neither could complete in 0.8.5, and both are planned to return in 0.9.0 after a redesign. fugaro init --create-project --managed, fugaro managed apply, fugaro restore and fugaro init --provision-batch now stop with a plain message before any cloud call, instead of failing partway through an apply.

For operators

1. Upgrade the CLI (brew upgrade dimipaun/tap/fugaro).
2. Once per installation, re-run fugaro init --firebase <gcp-project> in your own terminal. 0.8.5's fugaro init could not complete on any installation, so this is the run that finishes what 0.8.5 started. Its plan creates the fugaro-deployer account and its create-and-read role (unless 0.8.5's partial apply already created them), but not the deployer's scoped role or that role's binding (see Known limits).
3. In each repository checkout, run fugaro upgrade so the plugin pin follows the CLI.

fugaro doctor reports one info line, managed-deployer-disabled, saying that the scoped role is absent on purpose. It is not a warning, and --strict does not fail on it.

Known limits

• Managed projects are disabled. fugaro init --create-project --managed, fugaro managed apply and fugaro restore refuse with "managed projects are disabled in this release". The deployer's scoped role is fenced by an IAM condition on the fmgd- name prefix, and GCP does not accept that condition as written: it has 17 logical operators, and GCP allows 12. It also uses resource.name.contains(), which GCP does not support, and it fences resource types for which GCP does not support resource.name. The role and its binding are therefore not created. The fence will be redesigned and tested against a live project for 0.9.0 (design). A project created without --managed is unaffected.
• fugaro init --provision-batch is disabled. The Batch backend's reaper role names batch.jobs.cancel, which is not a permission Google has, so its provisioning could not complete. The reaper will be redesigned for 0.9.0.

Changelog

• fix: init completes again (0.8.6): the managed deployer's role names a permission Google does not allow, and its scoped fence is gated off (#630)
• website: offer the console beside the CLI on Getting Started (#625)
• console: frame the golden screenshots on the screen, not the window (#619)
• gitignore: .firebase/ and secrets/ are owner-local and never committed (#624)
• website: a withdrawal deletes the cookies Google Analytics set (#615)

Base images

Published by the images workflow for this tag:

• ghcr.io/dimipaun/fugaro-history:0.8.6 and ghcr.io/dimipaun/fugaro-history:0 (the sweeper and history job's image)
• ghcr.io/dimipaun/fugaro-base:0.8.6 and ghcr.io/dimipaun/fugaro-base:0 (one index for linux/amd64 and linux/arm64; per-architecture tags 0.8.6-amd64 and 0.8.6-arm64)

The images workflow then pulls each one with no login and fails if it is not public or lacks linux/amd64 (and, for fugaro-base, linux/arm64); each image's digest is in that run's summary.

The Terraform modules, the schemas and the plugin are versioned by this same tag.