Skip to content

Releases

Kerf 0.1.0-rc.4

Kerf 0.1.0-rc.4 Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Nov 16:02
v0.1.0-rc.4
5cc2188
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Pre-release. For testing; use a final version in production.

Highlights

First public version.

Added

  • Recommendations and savings (audit). The hub reads container CPU and memory usage from Prometheus or
    VictoriaMetrics, recommends requests and limits per container, and prices the difference per node type
    (pricing service: AWS price list or a static price table).

  • Automation (auto-patch). A per-cluster agent applies recommendations through RightsizingPolicy
    resources: in-place pod resize or a rollout, with guardrails, maintenance and freeze windows, and automatic
    rollback when a workload becomes unhealthy. A mutating webhook gives new pods the recommended resources.

  • Smarter recommendations. HPA coordination (requests and the HPA target change together), JVM heap-aware
    memory, and zero-downtime handling of single-replica workloads and StatefulSets with OnDelete.

  • kerf report. A command-line tool that runs the recommender against an existing Prometheus, VictoriaMetrics or
    Amazon Managed Service for Prometheus, without installing the hub: workloads sorted by monthly saving as a table, CSV,
    JSON or Markdown, with the hub's profiles, confidence and risk flags. Prices come from a static table or the AWS
    Pricing API, and a kubeconfig adds HPAs and JVM settings. Signed binaries for Linux and macOS (amd64, arm64) are
    attached to each release (docs/cli.md).

  • Web UI and admin area. Workloads, recommendations, savings, policies, audit log; users and tokens;
    approve, apply and roll back from the UI.

  • Cluster onboarding. An add-cluster wizard, per-cluster metrics sources and readiness checks
    (Registered → Agent connected → Metrics OK → Ready for audit → Automation ready).

  • Install. One Helm chart (kerf, global.mode: hub | spoke | all) with zone spread,
    autoscaling, External Secrets, Postgres over verified TLS, ingress, NetworkPolicies, alerts and Grafana
    dashboards. The hub runs highly available (leader election on Postgres).

  • Release. Multi-arch images (linux/amd64, linux/arm64) with SBOM and provenance, signed with cosign,
    and OCI Helm charts, published to GitHub Container Registry.

  • GPU visibility. Workloads that request nvidia.com/gpu show their GPU utilisation and memory (from the
    NVIDIA DCGM exporter), what the GPUs cost (the price of each GPU node times the workload's share of its GPUs) and a
    status: idle (95th percentile utilisation under 5 %) or under-used (under 40 %, or under 30 % of the GPU memory),
    with a direction: time-slicing or MIG, a smaller GPU type, or scale to zero. Opportunities has a GPU filter, the
    workload page a GPU panel, and the new readiness check metrics.dcgm says exactly which DCGM series are missing.
    Visibility only: Kerf changes no GPU request. Needs database migration 0020 (the hub applies it) and, for GPU
    prices, the pricing service on a version that exports kerf_gpu_hourly_cost_usd. See docs/gpu.md.

  • Maintenance page and update check. Admin → Maintenance lists the version of every component (each hub
    replica, the web UI, the pricing service, and the agent and webhook pods of every cluster) and flags
    mismatches. Once a day the hub checks the public GitHub releases of kerf-dev/kerf for a newer stable version
    and shows the release notes and helm upgrade commands; "Check now" runs it at once. It is on by default and
    sends nothing about the installation; turn it off with hub.updateCheck.enabled: false. Metric
    kerf_update_available{current,latest} and the alert KerfUpdateAvailable (severity info).

  • Notifications. Admin → Notifications sends the events that matter (a change applied, rolled back, failed
    or blocked, a cluster losing readiness, automation paused or resumed) to Slack, Microsoft Teams
    (Workflows webhook) or a generic webhook signed with HMAC-SHA256 (X-Kerf-Signature, a versioned JSON payload
    documented in docs/contracts/notifications.md), routed by rules on event type, cluster and namespace patterns.
    A weekly digest (day, time and time zone are yours) sums up estimated savings, the week's realized savings, the top opportunities, the changes
    and the clusters that need attention. Webhook URLs and secrets are encrypted at rest and never returned; the hub
    leader sends with retries and exponential backoff for an hour, a per-channel rate limit, a "Send test" button and
    the last delivery status per channel. Channels can also come from the chart (hub.notifications). Metrics
    kerf_notification_deliveries_total and kerf_notification_last_success_timestamp_seconds, and the alert
    KerfNotificationDeliveryFailing.

  • Effective AWS prices from the Cost and Usage Report. The pricing service can read your CUR 2.0 export
    (AWS Data Exports, Parquet in S3), through Athena or directly from S3, and price nodes at the rate you paid
    over the last 30 days, with Savings Plans and Reserved Instances amortised. Instance types without usage keep
    the list price; an unreadable report falls back to list prices with a pricing.coverage readiness warning.
    The workload's savings estimate and Admin → Pricing show where each rate comes from (cur, list, spot,
    static) and the period it covers. Off by default (pricing.cur.source); see docs/pricing.md for the IAM
    policy and the Data Exports settings. The cost series gain a source label.

  • Realized savings. What the applied changes actually saved since they were applied: the requests released
    by every applied change (rollbacks and later increases subtract) × the replicas that ran × the node rates of
    the time, computed hourly by the hub leader, including changes applied before the upgrade. Shown as
    "Realized since " on the Overview (total and a monthly chart) and on the workload page, always apart
    from the estimated savings, which are now labelled "Estimated (if applied)". A node cost trend per cluster
    draws the hourly node cost and the requested/allocatable ratio next to the released requests (correlated, not
    caused). New API GET /v1/savings/realized, GET /v1/workloads/{id}/savings/realized and
    GET /v1/savings/realized/node-cost, metrics kerf_hub_realized_* and a Grafana row; the method is in
    docs/realized-savings.md. Database migration 0016_realized_savings.

  • Copy as a patch. A Copy as… menu on the workload page and on the Opportunities bulk bar turns the
    recommended values into a strategic merge patch, a kubectl patch command, a Kustomize patches: entry or a
    Helm values snippet, for one workload or a selection, so teams that keep their manifests in Git can make the
    change through their own pull request. Viewers can select rows and copy too. See
    Copy a recommendation as a patch.

  • Documentation site. The documentation is published at getkerf.dev/docs, built from
    docs/ with search, a version switch (dev, and one version per minor release) and light and dark themes that
    match the site. New pages cover the concepts (modes, policies, apply strategies, guardrails, rollback, HPA, JVM,
    approve once, GitOps), operating Kerf (upgrade, backup, alerts and dashboards, readiness, troubleshooting),
    installing on any cluster, a comparison and an FAQ. The chart values, custom resources and hub API reference pages
    are generated from values.schema.json and the chart values, api/v1alpha1 and api/openapi/hub.yaml
    (make docs-generate); CI fails when they are out of date.

  • Sign in with OpenID Connect. Okta, Microsoft Entra ID, Google, Keycloak, Dex or any OpenID Connect
    provider (authorization code flow with PKCE). Groups map to roles (hub.auth.oidc.roleMappings, a default
    role or deny); the role is re-read from the provider every refreshInterval, so removing someone from a
    group removes the role. IdP users are created at their first sign-in, and the audit log records their IdP
    subject and e-mail. hub.auth.local.enabled: false keeps passwords only for one break-glass admin. The
    client secret comes from a Secret; refresh tokens are stored encrypted and no token is ever logged. Settings
    per provider: Sign-in and access.

  • Teams and team-scoped access. Admin → Teams defines teams by namespace selectors (names, globs, namespace
    labels, clusters) and an owner label on the workload or its namespace (team by default,
    hub.config.teams.ownerLabel); the workload's own label wins, and workloads in no team are "Unassigned". Users
    get viewer or operator on one or more teams in Admin → Access, and identity-provider users from group
    mappings with teams:; admin stays fleet-wide. The hub filters every list, count, total, detail and write by
    the caller's teams: other teams' workloads are not found, and approving or overriding them answers
    403 scope_forbidden. The audit log records the team that allowed each action (actor.teams). Opportunities
    filters and groups by team, the Overview shows savings by team, the workload page shows its team, and the weekly
    digest has a savings-by-team section. New API /v1/admin/teams, team filters and groupBy=team on workloads,
    facets, the savings trend and realized savings. The agent reports workload and namespace labels and now reads
    namespaces (RBAC). Database migration 0021_teams. See Teams.

Changed

  • Breaking: signing in is always required. Visitors without a session see only the sign-in page, and the hub
    answers 401 to every /v1 request without a session or a bearer token, except sign-in. The UI checks the
    session before it shows anything, returns to the page you asked for after sign-in, and brings you back to
    sign-in with a notice when a session expires or is revoked. Bearer tokens for automation are unchange...
Read more

Contributors

tomer1983
Loading

Kerf 0.1.0-rc.3

Kerf 0.1.0-rc.3 Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Nov 08:16
v0.1.0-rc.3
a6ecba0

Pre-release. For testing; use a final version in production.

First public version.

Added

  • Recommendations and savings (audit). The hub reads container CPU and memory usage from Prometheus or
    VictoriaMetrics, recommends requests and limits per container, and prices the difference per node type
    (pricing service: AWS price list or a static price table).
  • Automation (auto-patch). A per-cluster agent applies recommendations through RightsizingPolicy
    resources: in-place pod resize or a rollout, with guardrails, maintenance and freeze windows, and automatic
    rollback when a workload becomes unhealthy. A mutating webhook gives new pods the recommended resources.
  • Smarter recommendations. HPA coordination (requests and the HPA target change together), JVM heap-aware
    memory, and zero-downtime handling of single-replica workloads and StatefulSets with OnDelete.
  • Web UI and admin area. Workloads, recommendations, savings, policies, audit log; users and tokens;
    approve, apply and roll back from the UI.
  • Cluster onboarding. An add-cluster wizard, per-cluster metrics sources and readiness checks
    (Registered → Agent connected → Metrics OK → Ready for audit → Automation ready).
  • Install. One Helm chart (kerf, global.mode: hub | spoke | all) with zone spread,
    autoscaling, External Secrets, Postgres over verified TLS, ingress, NetworkPolicies, alerts and Grafana
    dashboards. The hub runs highly available (leader election on Postgres).
  • Release. Multi-arch images (linux/amd64, linux/arm64) with SBOM and provenance, signed with cosign,
    and OCI Helm charts, published to GitHub Container Registry.
  • Maintenance page and update check. Admin → Maintenance lists the version of every component (each hub
    replica, the web UI, the pricing service, and the agent and webhook pods of every cluster) and flags
    mismatches. Once a day the hub checks the public GitHub releases of kerf-dev/kerf for a newer stable version
    and shows the release notes and helm upgrade commands; "Check now" runs it at once. It is on by default and
    sends nothing about the installation; turn it off with hub.updateCheck.enabled: false. Metric
    kerf_update_available{current,latest} and the alert KerfUpdateAvailable (severity info).

Fixed

  • Signing in through the web UI kept users read-only: the web proxy looked for the old session cookie name
    and never forwarded kerf_session, so every request still went out with the read-only UI token.

Install

One Helm chart installs everything (global.mode: all), the hub cluster (hub) or a workload cluster (spoke).
The images below are its defaults.

helm install kerf oci://ghcr.io/kerf-dev/kerf/charts/kerf \
  --version 0.1.0-rc.3 --namespace kerf --create-namespace \
  -f values.yaml

Artifacts

Every image is multi-arch (linux/amd64, linux/arm64) with an SBOM and SLSA provenance, and is signed with
cosign (keyless, by this repository's release workflow).

Artifact Reference (version 0.1.0-rc.3) Digest
image hub ghcr.io/kerf-dev/kerf/hub sha256:07d747e73314ef164e6e8a405c891e7248cee57bafc13ec4631bc6f2ffb59bd7
image pricing ghcr.io/kerf-dev/kerf/pricing sha256:41adf1707e3562bd777724d72e158f8718a5b093b4613af7cd50195ded822b07
image agent ghcr.io/kerf-dev/kerf/agent sha256:2a596069884742581df4a79e904670e67a5d6786b51b597abb1c71bfef2f367b
image webhook ghcr.io/kerf-dev/kerf/webhook sha256:ca84cb1352906125d248d4a6fb9f6ef2b7186c7caab5fa569c824c3df334e095
image web ghcr.io/kerf-dev/kerf/web sha256:aab271d472b9e359f6df4543e9a30e0c1541afcad8ce585a8a0413dad10c24ed
chart kerf oci://ghcr.io/kerf-dev/kerf/charts/kerf sha256:7b026673335e6be80419c5c928aecd09cea293f6a378f8902fbd18d1de2a608b
chart hub oci://ghcr.io/kerf-dev/kerf/charts/hub sha256:d41a73652d2f6174f1657bf8ec4e1d9ab886d040a8991beb03273e245cf20fd3
chart pricing oci://ghcr.io/kerf-dev/kerf/charts/pricing sha256:92a3197917e227cb520f8fa1db6c3ac99a7c7de294878307fdbd3edc2cf98bec
chart agent oci://ghcr.io/kerf-dev/kerf/charts/agent sha256:e6b73e0d0008480bac2df7ca2b7cce72272800cb41dc41ac626d9fffc91cbcbe
chart webhook oci://ghcr.io/kerf-dev/kerf/charts/webhook sha256:fa891a5f1f63af97f17e9b174def90f1e694cf7a040d9d7d5d21854087b74214
chart web oci://ghcr.io/kerf-dev/kerf/charts/web sha256:dd795852c4683f334bf0c651cb2f4f91be2e0c90a5a7674ba858341328a9d7f9

Verify a signature:

cosign verify ghcr.io/kerf-dev/kerf/hub:0.1.0-rc.3 \
  --certificate-identity-regexp '^https://github.com/kerf-dev/kerf/.github/workflows/release.yaml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Full Changelog: v0.1.0-rc.2...v0.1.0-rc.3

Loading

Kerf 0.1.0-rc.2

Kerf 0.1.0-rc.2 Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Nov 01:08
v0.1.0-rc.2
1701406

Pre-release. For testing; use a final version in production.

First public version.

Added

  • Recommendations and savings (audit). The hub reads container CPU and memory usage from Prometheus or
    VictoriaMetrics, recommends requests and limits per container, and prices the difference per node type
    (pricing service: AWS price list or a static price table).
  • Automation (auto-patch). A per-cluster agent applies recommendations through RightsizingPolicy
    resources: in-place pod resize or a rollout, with guardrails, maintenance and freeze windows, and automatic
    rollback when a workload becomes unhealthy. A mutating webhook gives new pods the recommended resources.
  • Smarter recommendations. HPA coordination (requests and the HPA target change together), JVM heap-aware
    memory, and zero-downtime handling of single-replica workloads and StatefulSets with OnDelete.
  • Web UI and admin area. Workloads, recommendations, savings, policies, audit log; users and tokens;
    approve, apply and roll back from the UI.
  • Cluster onboarding. An add-cluster wizard, per-cluster metrics sources and readiness checks
    (Registered → Agent connected → Metrics OK → Ready for audit → Automation ready).
  • Install. One Helm chart (kerf, global.mode: hub | spoke | all) with zone spread,
    autoscaling, External Secrets, Postgres over verified TLS, ingress, NetworkPolicies, alerts and Grafana
    dashboards. The hub runs highly available (leader election on Postgres).
  • Release. Multi-arch images (linux/amd64, linux/arm64) with SBOM and provenance, signed with cosign,
    and OCI Helm charts, published to GitHub Container Registry.

Install

One Helm chart installs everything (global.mode: all), the hub cluster (hub) or a workload cluster (spoke).
The images below are its defaults.

helm install kerf oci://ghcr.io/kerf-dev/kerf/charts/kerf \
  --version 0.1.0-rc.2 --namespace kerf --create-namespace \
  -f values.yaml

Artifacts

Every image is multi-arch (linux/amd64, linux/arm64) with an SBOM and SLSA provenance, and is signed with
cosign (keyless, by this repository's release workflow).

Artifact Reference (version 0.1.0-rc.2) Digest
image hub ghcr.io/kerf-dev/kerf/hub sha256:97d3bd26b69f9e316f1fdc5b6a3141d23dccdc6c560b3708b8bbd10bdc66c76e
image pricing ghcr.io/kerf-dev/kerf/pricing sha256:ae5e59ebca1192a1f88b70d81bf3ea72970ed991a01dba0cef640ecaee7c96d7
image agent ghcr.io/kerf-dev/kerf/agent sha256:bf4d7356bdc2ef473eb8ff4e6595b9f714c26a5db94af447e062ca200acce487
image webhook ghcr.io/kerf-dev/kerf/webhook sha256:23ad36e79d22fd237017c7acdff05b152275b45a570ab16633eba75e6bd9995d
image web ghcr.io/kerf-dev/kerf/web sha256:8a026a8fa5306ee69b7841647f0053cb3239588d05942f83381a1c441136e313
chart kerf oci://ghcr.io/kerf-dev/kerf/charts/kerf sha256:6acae7762780e876524ae7434e023aa63c34b8025c53bfa3a418afec0890aa78
chart hub oci://ghcr.io/kerf-dev/kerf/charts/hub sha256:a9bbc8cdaebe53756f0f3a25d32fe51c382393368922c150a88807b898169af8
chart pricing oci://ghcr.io/kerf-dev/kerf/charts/pricing sha256:6ee699c163756c230cb402dadcdf63bd63f4c57c88e9aa7d6fc9c216c0ea52db
chart agent oci://ghcr.io/kerf-dev/kerf/charts/agent sha256:4beba804e5a0a6710eb6fc2b045fc80bbe2cae1fd84ad9737919d798c35517ef
chart webhook oci://ghcr.io/kerf-dev/kerf/charts/webhook sha256:2c781a4b96bbe3340afb4dadb9c9db68a0bf0fad60c9dfded274c5aca77f45a7
chart web oci://ghcr.io/kerf-dev/kerf/charts/web sha256:9ca82d620e61b605b1deef594d80840e2b43065ef17de7673b66764453bcfa19

Verify a signature:

cosign verify ghcr.io/kerf-dev/kerf/hub:0.1.0-rc.2 \
  --certificate-identity-regexp '^https://github.com/kerf-dev/kerf/.github/workflows/release.yaml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Full Changelog: https://github.com/kerf-dev/kerf/commits/v0.1.0-rc.2

Loading