v0.1.0

0.1.0 (2026-10-08)

⚠ BREAKING CHANGES

• aws: a cluster applied without cluster_log_types stops shipping control plane logs. Set it explicitly to keep them.
• aws: cluster_support_type is gone.
• aws: crossplane_service_account_namespace, crossplane_service_account_name and crossplane_policy_arns are gone, along with the crossplane_role_arn, ebs_csi_role_arn and crossplane_service_account_kubernetes_binding outputs.
• aws: take the four EKS add-ons out of the module

Features

• aws: control plane logging is off by default, opt-in through cluster_log_types (06bceb0), closes #80
• aws: Crossplane's identity, and the boundary of every role it creates (22988d9)
• aws: drop the workload identities — they belong to the plugins (4ebf965)
• aws: EKS add-ons once compute exists, the shared Gateways, and external-dns wired end to end (32b2bda)
• aws: encrypt both log groups with a customer-managed key (998af3e)
• aws: make extended support impossible rather than discouraged (3acdcfd)
• aws: take the four EKS add-ons out of the module (99164df)
• aws: the AWS foundations OpenTofu module (0a08721)
• aws: the bootstrap node group, and the facts Cilium needs from the cluster (5ad45b5), closes #32
• azure: carry the pod range Cilium allocates from (21bc1eb), closes #32
• azure: foundations module — VNet, AKS Standard + NAP, identities (5251c78)
• bootstrap: install Cilium and CoreDNS before Flux, and Gateway API on every cloud (945a6c3), closes #32
• bootstrap: the module — inputs only, Flux Operator renders the catalog (fae5893)
• catalog: alerting for the monitoring stack — vmalert and Alertmanager (180d2af), closes #59
• catalog: grafana behind the shared Gateway (4a2b111), closes #43
• catalog: kyverno and kyverno_policies — the admission layer, Enforce made native (6eaedd9)
• catalog: kyverno_policies judge the client's applications, never the socle's namespaces (48bd663)
• catalog: otel_agent's alert rule — a node filesystem nearly full (78813e7)
• catalog: otel_gateway's alert rules — pods crash-looping or Pending, nodes not ready, Deployments missing replicas (30aa992)
• catalog: the argocd module — the client's GitOps layer (4a1a25d)
• catalog: the artifact — hello module, one overlay per cloud, the cloud's colour (256e416)
• catalog: the crossplane module — the tooling for every module to carry its own cloud IAM (faedb2f)
• catalog: the external_dns module — DNS records in the cloud's own zone (c1c4707)
• catalog: the external_secrets module — Secrets from the cloud's secret manager, read-only by prefix (bdb5bef)
• catalog: the grafana module — the one place to read (d99cc47), closes #43
• catalog: the keda module — event-driven autoscaling, a role scoped to the services named (cd31b4c), closes #60
• catalog: the metrics_server module — the resource metrics API on aws (ce89fb4)
• catalog: the otel_agent module — kubelet metrics from every node (9afb1e6), closes #43
• catalog: the otel_gateway module — cluster state, scraping and OTLP in (9e92a3f), closes #43
• catalog: the reloader module — a workload rolled when what it reads changes, opt-in only (b5fede1)
• catalog: the velero module — backups the application chooses by two labels, restored with their data (a3e5977)
• catalog: the victoria_logs module — the second signal (ce5dc1f), closes #43
• catalog: the victoria_metrics module — the monitoring stack's metrics storage (5f21fb0), closes #43
• catalog: the victoria_traces module — the third signal, off by default (aac0290), closes #43
• catalog: victoria_metrics' alert rules, and Grafana lists the socle's rules (292680e)
• ci: publish and sign the artifact, prove it on floci, release it from the conventional commits (a36212e)
• clusters: the AWS root — one apply, one tfvars, one version (dff54c7)
• crossplane: buckets a module owns — provider-aws-s3, a bucket grant with no delete, the account and the snapshot controller in the inputs (35ca8b8)
• foundations: a helm_kubernetes output on every cloud, stamped with the socle version (91fe476)
• gcp: state the Gateway API standard channel on the cluster (ed05f55), closes #32
• gcp: the GCP foundations OpenTofu module (2347c8a)
• registry: publish the OpenTofu modules beside the socle, same version (1ff1b20)
• registry: the artifact lives at socle/flux-modules, the OpenTofu modules at socle/opentofu-modules (7f8cef2)
• scaleway: the Scaleway foundations OpenTofu module (9f8dda5)

Bug Fixes

• aws: grant the applier cluster-admin explicitly, not by default (d23fc54)
• aws: move the example back to eu-west-3 (d6efd84)
• azure: address the three Trivy findings on PR #25 (43f06a4)
• azure: converge upgrade_settings drift, expose zones/vm_size overrides (c3da35d)
• azure: drop the cross-cloud comparison from the NAT Gateway note (30fa72c)
• bootstrap: the root Kustomization waits for the catalog's ter...