Skip to content

v0.1.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Oct 19:25
0.1.0
2afe765

0.1.0 (2026-10-08)

⚠ BREAKING CHANGES

  • aws: a cluster applied without cluster_log_types stops shipping control plane logs. Set it explicitly to keep them.
  • aws: cluster_support_type is gone.
  • aws: crossplane_service_account_namespace, crossplane_service_account_name and crossplane_policy_arns are gone, along with the crossplane_role_arn, ebs_csi_role_arn and crossplane_service_account_kubernetes_binding outputs.
  • aws: take the four EKS add-ons out of the module

Features

  • aws: control plane logging is off by default, opt-in through cluster_log_types (06bceb0), closes #80
  • aws: Crossplane's identity, and the boundary of every role it creates (22988d9)
  • aws: drop the workload identities — they belong to the plugins (4ebf965)
  • aws: EKS add-ons once compute exists, the shared Gateways, and external-dns wired end to end (32b2bda)
  • aws: encrypt both log groups with a customer-managed key (998af3e)
  • aws: make extended support impossible rather than discouraged (3acdcfd)
  • aws: take the four EKS add-ons out of the module (99164df)
  • aws: the AWS foundations OpenTofu module (0a08721)
  • aws: the bootstrap node group, and the facts Cilium needs from the cluster (5ad45b5), closes #32
  • azure: carry the pod range Cilium allocates from (21bc1eb), closes #32
  • azure: foundations module — VNet, AKS Standard + NAP, identities (5251c78)
  • bootstrap: install Cilium and CoreDNS before Flux, and Gateway API on every cloud (945a6c3), closes #32
  • bootstrap: the module — inputs only, Flux Operator renders the catalog (fae5893)
  • catalog: alerting for the monitoring stack — vmalert and Alertmanager (180d2af), closes #59
  • catalog: grafana behind the shared Gateway (4a2b111), closes #43
  • catalog: kyverno and kyverno_policies — the admission layer, Enforce made native (6eaedd9)
  • catalog: kyverno_policies judge the client's applications, never the socle's namespaces (48bd663)
  • catalog: otel_agent's alert rule — a node filesystem nearly full (78813e7)
  • catalog: otel_gateway's alert rules — pods crash-looping or Pending, nodes not ready, Deployments missing replicas (30aa992)
  • catalog: the argocd module — the client's GitOps layer (4a1a25d)
  • catalog: the artifact — hello module, one overlay per cloud, the cloud's colour (256e416)
  • catalog: the crossplane module — the tooling for every module to carry its own cloud IAM (faedb2f)
  • catalog: the external_dns module — DNS records in the cloud's own zone (c1c4707)
  • catalog: the external_secrets module — Secrets from the cloud's secret manager, read-only by prefix (bdb5bef)
  • catalog: the grafana module — the one place to read (d99cc47), closes #43
  • catalog: the keda module — event-driven autoscaling, a role scoped to the services named (cd31b4c), closes #60
  • catalog: the metrics_server module — the resource metrics API on aws (ce89fb4)
  • catalog: the otel_agent module — kubelet metrics from every node (9afb1e6), closes #43
  • catalog: the otel_gateway module — cluster state, scraping and OTLP in (9e92a3f), closes #43
  • catalog: the reloader module — a workload rolled when what it reads changes, opt-in only (b5fede1)
  • catalog: the velero module — backups the application chooses by two labels, restored with their data (a3e5977)
  • catalog: the victoria_logs module — the second signal (ce5dc1f), closes #43
  • catalog: the victoria_metrics module — the monitoring stack's metrics storage (5f21fb0), closes #43
  • catalog: the victoria_traces module — the third signal, off by default (aac0290), closes #43
  • catalog: victoria_metrics' alert rules, and Grafana lists the socle's rules (292680e)
  • ci: publish and sign the artifact, prove it on floci, release it from the conventional commits (a36212e)
  • clusters: the AWS root — one apply, one tfvars, one version (dff54c7)
  • crossplane: buckets a module owns — provider-aws-s3, a bucket grant with no delete, the account and the snapshot controller in the inputs (35ca8b8)
  • foundations: a helm_kubernetes output on every cloud, stamped with the socle version (91fe476)
  • gcp: state the Gateway API standard channel on the cluster (ed05f55), closes #32
  • gcp: the GCP foundations OpenTofu module (2347c8a)
  • registry: publish the OpenTofu modules beside the socle, same version (1ff1b20)
  • registry: the artifact lives at socle/flux-modules, the OpenTofu modules at socle/opentofu-modules (7f8cef2)
  • scaleway: the Scaleway foundations OpenTofu module (9f8dda5)

Bug Fixes

  • aws: grant the applier cluster-admin explicitly, not by default (d23fc54)
  • aws: move the example back to eu-west-3 (d6efd84)
  • azure: address the three Trivy findings on PR #25 (43f06a4)
  • azure: converge upgrade_settings drift, expose zones/vm_size overrides (c3da35d)
  • azure: drop the cross-cloud comparison from the NAT Gateway note (30fa72c)
  • bootstrap: the root Kustomization waits for the catalog's termination on uninstall (200e537)
  • catalog: argocd and crossplane values ConfigMaps carry the helm-controller watch label (200e537)
  • catalog: kyverno runs no cleanup controller, whose webhook outlived the uninstall (0857e7c)
  • catalog: the AWS providers run as a ServiceAccount the module creates, so no revision owns it and none takes it back (ffe6574), closes #80
  • catalog: the socle's defaults belong in the first valuesFrom, not inline (271a187)
  • catalog: velero's runbook deletes the Restore once checked — its finalizer otherwise holds the namespace when the module goes (a1768a1)
  • ci: one tag for both packages, and a promotion that can be re-run (c2c8f8e)
  • crossplane: a bucket's tags go through S3 Control — the grant, floci's services, and the tests wait for every CRD they assert (c6f3a6d)
  • release: pin the documented cosign identity to main, keep crane's stderr out of the digest (7bf407d)
Assets 2
Loading