Skip to content

Vesper v0.1.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Nov 22:13
· 18 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.1.0
This tag was signed with the committer’s verified signature.
damnthonyy Antoine Mahassadi
SSH Key Fingerprint: XNdYSfKz+dW0A0IPtuQmGXfAkBP4M6NdovdGT8JnBcE
Verified
Learn about vigilant mode.
c575ad4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The first release of Vesper: ephemeral preview environments for Kubernetes. You declare a PreviewEnvironment; Vesper runs it in a namespace of its own, gives it an address, and deletes it, namespace included, when its time to live ends.

What's in v0.1.0

  • An isolated namespace per preview: the restricted Pod Security profile, a ResourceQuota, a LimitRange and a default-deny NetworkPolicy that keeps a preview away from the other previews, from the rest of the cluster and from the API server and kubelets of the nodes.
  • A public address: with --preview-domain, each preview gets an Ingress through the ingress controller of the cluster, over HTTPS with --preview-tls and a wildcard certificate.
  • A lifetime: a TTL from 1 minute to 7 days (24 hours by default). When it passes, the preview and its namespace are deleted; a finalizer makes sure the cleanup runs.
  • vesperctl: create, list, get, extend and delete, as a table, JSON or YAML, with documented exit codes. vesperctl get shows the phase, the URL, the expiry, the conditions and the events.
  • Readable status: the conditions Ready, Available and Expired with a reason, and Kubernetes events at each change.
  • Prometheus metrics: the previews per phase and the expiries, behind authentication.
  • A verifiable release: binaries for Linux, macOS and Windows (amd64 and arm64), checksums, build provenance attestations, and a multi-platform image that runs as a non-root user, pinned by digest in install.yaml. Built with Go 1.27.4.

Install

kubectl apply -f https://github.com/eventide-oss/vesper/releases/download/v0.1.0/install.yaml
kubectl -n vesper-system rollout status deploy/vesper-controller-manager

Then follow the quickstart on a local kind cluster, or try Vesper on a server with k3s, a domain and HTTPS. To keep operator flags such as --preview-domain across upgrades, use a kustomize overlay, as the quickstart shows.

Verify the downloads

shasum -a 256 --check --ignore-missing checksums.txt
gh attestation verify install.yaml --repo eventide-oss/vesper
gh attestation verify "oci://$(grep -o 'ghcr.io/eventide-oss/vesper:[^ ]*' install.yaml)" --repo eventide-oss/vesper

Upgrading from a release candidate

Apply the install.yaml of v0.1.0 over the release candidate: the API is the same v1alpha1, and running previews are kept. The release candidates before rc.2 have an isolation gap (GHSA-m437-fj8p-6x8h), and every release candidate was built with Go 1.27.3 (GO-2026-6859): upgrade.

Known limits

  • A namespace is a soft boundary: Vesper isolates previews from each other, but does not promise hard multi-tenant isolation. See the security model.
  • The API is v1alpha1: it may change before v1.0.
  • A preview runs one application from one image. You create it yourself, with vesperctl or kubectl.

What's next

v0.2 creates, updates and deletes previews from pull requests, through a GitHub App that posts the URL of the preview on the pull request. Follow the milestone, and the good first issues if you want to help.

Changes since v0.1.0-rc.3

  • fix(deps): build with Go 1.27.4 for GO-2026-6859 (#159)
  • chore(deps): bump docker/login-action (#124)
  • docs: point the guides at v0.1.0 (#157)
  • test: run the v0.1 acceptance against the framing letter (#156)

The full history is in the notes of rc.1, rc.2 and rc.3.

Assets 11
Loading