v0.7.1

What's new in v0.7.1

2026-10-14

Warning

holzkube-manager is alpha software under heavy development: this release can change or break things. Back up the data directory before updating.

• 🩹 Fixed: the "Cluster certificates" row added in v0.6.0 never filled in on a running manager. The read that looks at each control plane was started without a time limit, and the Talos client refuses a call that has none, so every pass failed quietly and the row stayed at "not read yet" (which is why it never said "fine" either, but also never warned). Every read now runs under its own 20 second limit. The tests missed it because each of them happened to carry a limit of its own; two new ones start the way the manager does, one of them against the simulator through the real client. Still only checked against the simulator: no real cluster has been read through it yet, so look at the row on a control plane once this is installed.

v0.7.1 (alpha, for the operator's own cluster): fixes the cluster certificate row of v0.6.0, which never filled in on a running manager because its reads carried no deadline and the Talos client refuses such calls; every read now runs under its own 20 second limit. Checked on a Mac against the simulator only: the new guards (one through the real client) were seen red against the original fault and green with the fix; golangci-lint v2.13.1 on Go 1.26.9 reports 0 issues; go vet, gofmt and the touched packages are green. NOT run there: task ci, layout tests, go test -race over the whole repository; the CI gate runs before this release. Known limits: never run against a real Talos cluster; no release signature (decided: none for now); the Kubernetes chain limits of v0.7.0 (ledger 174, 175) are unchanged.

---

Install or update: download the linux_arm64 archive below (builds are for the Raspberry Pi 5 only for now) — or run sudo holzkube-manager-update on a host that already has it. The guide has the rest.

v0.7.0

What's new in v0.7.0

2026-10-12

Warning

holzkube-manager is alpha software under heavy development: this release can change or break things. Back up the data directory before updating.

• 🔗 The Kubernetes upgrade chain names the newest stable patch. When a Kubernetes upgrade has to go through intermediate minors, the plan used to name each one as .0 (for example v1.33.0), which is not what anyone installs. It now asks dl.k8s.io for the newest stable patch of each minor on the way and shows that (v1.33.7, say). If that lookup fails, the plan is blocked with a sentence that says so, and never quietly falls back to .0; a target one minor away needs no lookup and is unaffected. The source has no setting. Still advice only: the job installs the version you typed in one run, so the chain tells you what to do and does not enforce it (open ledger entry 174), and a multi-minor target is blocked only while the lookup is down. Tested against the simulators and a fake server only: the format of dl.k8s.io was measured once and is not documented, and no real cluster has taken an intermediate patch from it yet (ledger 175).
• 📐 The compatibility table for Talos 1.12, 1.13 and 1.14 is corrected. It allowed Kubernetes only up to 1.33, 1.34 and 1.35; Talos 1.14 supports up to 1.37, so a cluster on Talos 1.14 could not plan a chain past 1.35. The windows are now 1.30 to 1.35, 1.31 to 1.36 and 1.32 to 1.37, and the Talos 1.14 row is held against the library this build is compiled with, so it cannot fall behind again unnoticed. Older Talos rows were not re-checked.
• 🧰 The build pipeline uses newer GitHub Actions (checkout, setup-go, setup-node, setup-task and goreleaser, each pinned to a commit). Nothing changes in the running program; the new versions are exercised by this release's own build.

v0.7.0 (alpha, for the operator's own cluster): the Kubernetes upgrade chain names the newest stable patch of each intermediate minor (looked up at dl.k8s.io, blocked with a sentence when the lookup fails, never a silent .0; single-hop targets need no lookup); the Talos 1.12 to 1.14 compatibility windows are corrected (1.14 now allows Kubernetes up to 1.37) and the 1.14 row is held against the compiled machinery; the five Dependabot GitHub Actions bumps are in (first release built with them). Checked on a Mac (darwin/arm64) against the simulators, httptest and fakes only: Go tests of the touched packages, go vet, gofmt, golangci-lint v2.13.1 (0 issues), plus guards each seen red against its fault; NOT run there: task ci, layout tests, go test -race over the whole repository, four httpapi tests that need the embedded web bundle; the CI gate runs before this release (a first dispatch failed on 7 lint findings in tests, fixed in ee962ca; no tag was created). Known limits: the dl.k8s.io format was measured once and has no live check (ledger 175); no real cluster has taken an intermediate patch; the chain is advice, not enforcement (ledger 174); matrix rows for Talos 1.7 to 1.11 not re-checked; not run on the Pi (linux/arm64); no release signature (decided: none for now).

---

Install or update: download the linux_arm64 archive below (builds are for the Raspberry Pi 5 only for now) — or run sudo holzkube-manager-update on a host that already has it. The guide has the rest.

v0.6.0

What's new in v0.6.0

2026-10-12

Warning

holzkube-manager is alpha software under heavy development: this release can change or break things. Back up the data directory before updating.

• 📅 Certificate expiry inside the cluster. Until now only the certificate this manager holds itself was counted down; the ones inside the cluster ran out unseen. The cluster card now lists, under Cluster certificates, the Talos API, etcd and Kubernetes certificates and their authorities, read from every control-plane node a minute after start and then every six hours, soonest first. An authority is never renewed by Talos, so it climbs the same ladder as the admin certificate (badge at 90 days, banner on every page at 30, red at 7). A certificate Talos issues is renewed by Talos long before it runs out, so being close at all means a stuck rotation: banner at 14 days, red at 3. Until the first read the card says "not read yet", never "fine"; a control plane that does not answer keeps its last reading and the card says how many answered. The wall shows one line, only from the banner rung down, naming the certificate's role and its days and no machine, and /metrics carries holzkube_node_certificate_seconds (negative once expired). Talos keeps these certificates beside their private keys; only the name and the dates are kept here, never a key. Run against the simulator only, not yet against a real cluster.
• 🗂️ Planning notes brought up to date and the 2026 interface mockup added to the repository (docs/mockups). Nothing changes in the running program.

v0.6.0 (alpha, for the operator's own cluster): certificate expiry inside the cluster. The cluster card, the banner, the wall and /metrics now report how long the Talos API, etcd and Kubernetes certificates and authorities of each control plane have left (authorities 90/30/7 days; Talos-renewed certificates 14/3 days as a stuck rotation); a control plane that does not answer keeps its last reading and an unread cluster says so. Only names and dates are kept, never keys. Checked on a Mac (darwin/arm64) against talossim only: Go tests for the touched packages, go vet, biome and the 900 jsdom web tests; NOT run there: task ci, layout tests, go test -race, four httpapi tests that need the embedded web bundle; CI runs the gate before this release. Known limits: never run against a real Talos cluster; no release signature yet (see .planning/AUDIT-2026-10-08.md); backups still stay on the same device.

---

Install or update: download the linux_arm64 archive below (builds are for the Raspberry Pi 5 only for now) — or run sudo holzkube-manager-update on a host that already has it. The guide has the rest.

v0.5.0

What's new in v0.5.0

2026-10-09

Warning

holzkube-manager is alpha software under heavy development: this release can change or break things. Back up the data directory before updating.

• 🛟 Scheduled etcd backups. Per cluster you can switch on a schedule (every 6 hours, daily or weekly) and say how many to keep; each run is a job that takes the snapshot from a healthy control-plane node, skips with a stated reason when the cluster is busy, unreachable or the disk is short, and never runs twice after a restart. The Upgrades screen lists them with size and checksum, downloads one, and has a Run now button. A cluster whose last scheduled backup is more than two intervals old is marked overdue on its card and in /metrics. The backups stay on this device: they do not survive losing its SD card, so copy a download somewhere else.
• 🔐 Security fixes from an audit. A stolen session cookie could skip the password prompt for destructive actions just by sending any Authorization header; that is closed. Handing out a kubeconfig, talosconfig, etcd snapshot, support bundle or pod log is now written to the audit log (the kubeconfig was documented as audited and was not). "Host: localhost" from another machine no longer reaches the password routes of an address that is single-sign-on only. Password hashing runs two at a time, so a burst of logins cannot exhaust the Pi's memory; anonymous requests that write to the audit log or create sessions are limited per address; expired sessions are swept while running; failed sign-ins and the peer address now appear in the journal.
• ♻️ The updater is stricter. It installs only a newer version (a downgrade needs --allow-downgrade), picks the highest release rather than the first listed, refuses a release without checksums.txt, remembers a version that failed its health check instead of retrying it every hour, replaces the program and itself atomically, and wants three healthy answers in a row before it calls an update good. --rollback now takes the lock and records itself. Releases are cut only from main, and CI actions are pinned and scanned for known vulnerabilities.
• 🧹 Removing a node is now a job. It leaves etcd, waits for it to settle, wipes the system disk and forgets the node, resumes after a restart, holds the cluster's lease and is shown step by step; the refusals (quorum, wrong cluster) stay immediate. The quorum check counts the voters that actually answer, not the ones on record. The route answers 202 with the job instead of 200, which matters only to scripts that call it.
• 🛠️ Fixes. Cancelling a running job ends it as cancelled instead of leaving it running and resuming after a restart; staged configuration can be applied again after the node rebooted; streams, forgotten machines and finished jobs no longer leak goroutines and memory. In the interface, one failed session check no longer throws you to the login page, log panels no longer repeat lines, the upgrade plan resets when you change the target, error messages are announced to screen readers, and dates use one format.

v0.5.0 (alpha, for the operator's own cluster): scheduled etcd backups with retention, download and an overdue state; a security and updater audit (sudo/CSRF bypass via any Authorization header closed, credential-handing reads audited, localhost Host trick closed, bounded password hashing, anonymous-route limiter, stricter semver/checksum updater, release only from main, pinned actions, govulncheck in the gate); toolchain raised to go1.26.9 and x/net to v0.60.0 (the previous build toolchain carried reachable net/http, crypto/tls and html/template vulnerabilities); node removal as a resumable job with a liveness-aware quorum check; job-cancel, stream-leak and UI fixes. Verified before dispatch on the Pi (aarch64) with GOTOOLCHAIN=go1.26.9: web suite, golangci-lint, go test ./..., govulncheck green (the web suite flaked on 5 s timeouts under unrelated load and passed when rerun alone); no go test -race here (Pi limit; CI runs it). Known limits: backups stay on the same device; updater timings checked against stubs, not real systemd; backups and node removal not run against real hardware; no release signature yet (see .planning/AUDIT-2026-10-08.md). Breaking: the node-removal route now answers 202 with a job.

---

Install or update: download the linux_arm64 archive below (builds are for the Raspberry Pi 5 only for now) — or run sudo holzkube-manager-update on a host that already has it. The guide has the rest.

v0.4.0

What's new in v0.4.0

2026-10-06

Warning

holzkube-manager is alpha software under heavy development: this release can change or break things. Back up the data directory before updating.

• 🔎 A button on the Upgrades screen asks whether there is a newer Talos: it compares what your nodes report with the newest stable release this version can install, names the next run (Talos goes one minor at a time) and links the release notes. The dashboard shows a badge on a cluster that has an update. Asking changes nothing and reads no node.
• 🛟 A Talos upgrade now needs a fresh etcd snapshot of the cluster, taken here, before it can be confirmed or started. The snapshot is taken from the Upgrades screen, kept on this machine (not in backups, the newest two per cluster) and counts for an hour. The server enforces it, not only the screen. Kubernetes upgrades are unchanged.
• 📐 The interface uses its space better. On a wide screen Settings, Config and Jobs sit in two columns and Nodes is a card; on a tablet the dashboard's clusters and recent activity sit side by side; a cluster's downloads and actions are one row each instead of a column of buttons; and on a phone a table row is a card with its values two to a line, about half as tall.
• 🔒 Security and updates: the library behind running a command in a container (spdystream) and golang.org/x/crypto are raised for published denial-of-service and security fixes, along with grpc, go-jose and a few smaller ones. Taking a safety snapshot is now one at a time per cluster, cut off after 30 minutes, refuses a cluster that does not exist without leaving anything behind, and no longer names a data-directory path in its refusals.

v0.4.0 (alpha, for the operator's own cluster): a Talos update check on the Upgrades screen and a dashboard badge; a Talos upgrade now needs a fresh etcd snapshot taken by this instance (enforced by the server); the interface uses its space better on desk, tablet and phone; security and dependency audit (spdystream, x/crypto, grpc and others raised). Verified before dispatch: golangci-lint v2.13.1 (0 issues), web lint, 855 jsdom and 27 browser tests, layout audit at 390 and 1280 px, go test ./... except one root-only test that cannot pass in the build container, govulncheck and npm audit. Known limits: not yet run against a real cluster; no size cap or free-space check for snapshots; grpc GO-2026-6443 (test simulator only) and x/crypto GO-2026-5932 (no upstream fix) remain.

---

Install or update: download the linux_arm64 archive below (builds are for the Raspberry Pi 5 only for now) — or run sudo holzkube-manager-update on a host that already has it. The guide has the rest.

v0.3.2

What's new in v0.3.2

2026-10-05

Warning

holzkube-manager is alpha software under heavy development: this release can change or break things. Back up the data directory before updating.

• 🔧 Talos machinery is raised from v1.14.0 to v1.14.2, the newest stable release, so the configuration documents of a v1.14.2 cluster are read by the library this product carries. The supported range stays v1.14.

v0.3.2 (alpha): Talos machinery raised from v1.14.0 to v1.14.2, the newest stable release; supported range unchanged (v1.14). Verified before dispatch: go build, the pin tests and go test ./... except one root-only test that cannot pass in the build container. Not yet run against a real v1.14.2 cluster.

---

Install or update: download the linux_arm64 archive below (builds are for the Raspberry Pi 5 only for now) — or run sudo holzkube-manager-update on a host that already has it. The guide has the rest.

v0.3.1

What's new in v0.3.1

2026-10-04

Warning

holzkube-manager is alpha software under heavy development: this release can change or break things. Back up the data directory before updating.

• 🩹 Fixed the redesign's navigation and dashboard. On a wide screen there is one navigation again, the labelled list; the icon rail only stands in for it on a tablet. The dashboard now uses the whole screen: the three fact cards on top, below them the machines (host, state, role, address, Talos version) and, beside them, every cluster with its nodes and certificate and the latest audit records.
• 📱 On a phone the three fact cards sit in one row, and the Kubernetes sections are one row that scrolls sideways (the open one stays in view) instead of three rows.

v0.3.1 (alpha): fixes the v0.3.0 redesign. One navigation on wide screens, a dashboard that fills the screen (machines, clusters, recent activity), and a tighter phone layout. Verified before dispatch: 846 jsdom tests, 27 browser tests, web lint, the layout audit at 390 and 1280 px, and the Go suite except one root-only test that cannot pass in the build container. Judged on rendered demo screenshots, not yet on the real cluster.

---

Install or update: download the linux_arm64 archive below (builds are for the Raspberry Pi 5 only for now) — or run sudo holzkube-manager-update on a host that already has it. The guide has the rest.

v0.3.0

What's new in v0.3.0

2026-10-04

Warning

holzkube-manager is alpha software under heavy development: this release can change or break things. Back up the data directory before updating.

• 🎨 The interface is the 2026 redesign: on a desk and a tablet the navigation is an icon rail (Dashboard, Clusters, Host, Jobs, Settings) with the full list as a labelled column beside it, on a phone the five sit as a bottom tab bar with icons and labels. The dashboard shows the fleet as cards with one big number each -- clusters, machines, the instance's own state -- instead of stacked reports. Logo, colours and every rule the shell carries (the Host mark, the audit chain warning, the 44px phone targets) are unchanged.

v0.3.0 (alpha): the 2026 redesign. Icon rail on desk/tablet, five-tab bottom bar on phones, card dashboard with big numbers. Logo, colours and shell rules unchanged. Verified: 846 jsdom tests, browser and layout suites per PR #3. Known limit: the visual result is judged on rendered screenshots, not yet on the operator's real cluster.

---

Install or update: download the linux_arm64 archive below (builds are for the Raspberry Pi 5 only for now) — or run sudo holzkube-manager-update on a host that already has it. The guide has the rest.

v0.2.2

What's new in v0.2.2

2026-10-02

Warning

holzkube-manager is alpha software under heavy development: this release can change or break things. Back up the data directory before updating.

• 🩹 Fixed: the navigation's name and tagline fit on one line each. The bar is a little wider (240 px); the tagline had broken onto two lines and the name could run past the edge.
• 📦 Releases are built for the Raspberry Pi 5 only for now (linux/arm64). The archives for amd64, macOS and Windows are gone, for the daemon and for holzkubectl; a Pi updating itself notices nothing.

v0.2.2 (alpha) - Raspberry Pi 5 only, and the navigation's name on one line

• Releases are built for linux/arm64 (Raspberry Pi 5) only; no amd64, macOS or Windows archives for the daemon or holzkubectl.
• The sidebar is 240 px instead of 224 px, so the name and tagline fit on one line each; a Chromium test holds 8 px of room.
• CI: the macOS job is gone; go test gets 20 min.

---

Install or update: download the linux_arm64 archive below (builds are for the Raspberry Pi 5 only for now) — or run sudo holzkube-manager-update on a host that already has it. The guide has the rest.

v0.2.1

What's new in v0.2.1

2026-10-02

Warning

holzkube-manager is alpha software under heavy development: this release can change or break things. Back up the data directory before updating.

• 🎨 The interface takes the new brand colour. The accent is Glut instead of brass: buttons, the selected navigation entry, focus rings, the Alpha badge and the first line of every chart. In the light theme, text and borders in that colour use a darker Glut, so they keep the contrast they had. Nothing else changes.

Patch on v0.2.0: the interface accent follows the brand colour. --hc-brass and everything derived from it (primary, accent, ring, input, chart-1, sidebar primary and accent, the ground washes) is Glut #EF7A4D instead of brass #F0AE5F; text and borders on light paper use #8F4B31 (6.07:1 on the ground, 6.52 on white, above the 5.84/6.28 the brass-era ink had). Live-chart series 1 is Glut stepped per mode (#C15529 light, #D7693E dark), validated with the blue series. Every contrast note in web/src/index.css re-measured; the Glut fill itself is lower than brass was (7.23 on the dark ground, 6.88 for the dark ink on it) but above AA everywhere. README screenshots re-rendered. No behaviour changes.

Known limits: as v0.2.0 - the host helper, the shipped update units under their real sandbox and the phone hand test have not run on real hardware (13-UAT items 5, 6, 16-18; 14-UAT pending); release blocker OPS-05 (ledger 87, with 82, 84, 85) stands; the linux/arm64 build is checked for presence, checksum and architecture only. In the dark theme Glut sits close to the danger colour #EC8272 (3.9 apart in OKLab); not changed here.

---

Install or update: download the archive for your machine below — linux_arm64 for a Raspberry Pi, linux_amd64 otherwise — or run sudo holzkube-manager-update on a host that already has it. The guide has the rest.