v0.6.0

v0.6.0 — Rotation API Completion + Production Hardening

Features

• abort_rotation through full stack (Phase 8): genesis_abort_rotation exposed via Rust FFI and Go bridge. Rotation state machine can now cleanly transition from Rotating back to Active on error.
• Bootstrap traceability labels (Phase 8): Injected secrets now carry genesis.io/bootstrap-name and genesis.io/bootstrap-namespace labels, linking each secret back to its managing GenesisBootstrap CR.
• Rotation abort-on-error (Phase 9): BridgeRotationExecutor calls AbortRotation() when CompleteRotation() fails after BeginRotation() succeeds, emitting proper audit events and cleaning up state.
• Post-rotation verification (Phase 9): Controller validates secret existence, data key, and managed-by label after rotation. Best-effort (cache lag acknowledged); emits K8s events on mismatches.
• Rotation controller wired to Rust bridge (Phase 7): BridgeRotationExecutor runs the full rotation flow (New → Load → BeginBootstrap → InjectSecret → BeginRotation → CompleteRotation) entirely in Rust memory.
• AdditionalNamespaces via bridge (Phase 5): inject_secrets_multi FFI for multi-target injection in a single state transition.

Tests

• CLI output format regression tests: 6 tests validating exact filenames, YAML structure, SOPS config, file permissions, JSON output, and cross-file consistency.
• Rotation error + verification tests: 4 new test cases covering error handling and post-rotation validation.
• 202 Rust tests, 17 Go packages passing.

Fixes

• Go bumped to 1.26.1 for stdlib vulnerability fixes
• golangci-lint v2 built from source for Go 1.26 compatibility
• check-key-material scan widened to include internal/controller/
• Removed unused getProviderFactory after Phase 5 refactoring

Known Issues

• Identity filename mismatch (#8): genesis writes genesis-identity.key, launch expects age-identity.txt. Blocks pre-cluster secrets pipeline. Requires cross-project coordination.

v0.5.0

Highlights

This release completes the four-phase Rust bridge migration, restoring the security invariant that key material never enters Go memory.

Security Invariant Restored (Phase 4)

• BootstrapInjector strategy pattern cleanly separates production (Rust bridge) and test (legacy Go) paths
• BridgeBootstrapInjector: decrypt + inject entirely in Rust via FFI — no plaintext in Go heap
• LegacyBootstrapInjector: retained for test compatibility and AdditionalNamespaces (pending Phase 5 FFI addition)
• Controller automatically selects the appropriate injector based on CRD configuration

KMS Config JSON Bridge (Phase 3)

• BuildKmsConfigJSON() resolves Go-side cloud credentials (IRSA, Workload Identity, Instance Principal) and serializes them for Rust KMS providers
• Enables cloud-native authentication to flow through the CGO FFI boundary

UreqSecretInjector Enrichment (Phase 2)

• Labels (app.kubernetes.io/managed-by, genesis.io/bootstrap) and annotations on Rust-injected secrets
• TLS CA certificate verification for in-cluster API server communication
• FFI metadata propagation for secret provenance tracking

Infrastructure

• Dependabot auto-merge workflow: dependency update PRs auto-merge when all CI gates pass
• Mock-dependent CLI tests properly guarded behind genesis_mock build tag
• 193 Rust tests + 17 Go packages passing

Upgrading from v0.4.0

Drop-in replacement. No CRD schema changes. The controller automatically uses the bridge path for standard bootstrap operations.

Full Changelog: v0.4.0...v0.5.0

v0.4.0

Changelog

• ec31794 Merge feature/pq-crypto: PQ crypto + local provider + test coverage
• d58910c Merge pull request #1 from LarsenClose/fix/release-workflow
• c946764 feat: implement post-quantum cryptography and standalone mode
• 3380127 feat: wire Go bridge and CLI for PQ crypto + local provider
• 5d3c50e fix: add G703 nosec annotation for SOPS_AGE_KEY_FILE path
• 8af4068 fix: add OCI labels to Dockerfile for GHCR auto-linking
• e20f976 fix: release workflow test failures and arm64 push permissions
• 7dd553f fix: use PAT for GHCR push in release workflow
• 15f06e0 perf: native arm64 runners + cache mounts for Docker builds
• 453a1ad security: harden genesis-core for production deployment (#20)