Skip to content

Kerf 0.1.0-rc.3

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Nov 08:16
· 28 commits to main since this release
v0.1.0-rc.3
a6ecba0

Pre-release. For testing; use a final version in production.

First public version.

Added

  • Recommendations and savings (audit). The hub reads container CPU and memory usage from Prometheus or
    VictoriaMetrics, recommends requests and limits per container, and prices the difference per node type
    (pricing service: AWS price list or a static price table).
  • Automation (auto-patch). A per-cluster agent applies recommendations through RightsizingPolicy
    resources: in-place pod resize or a rollout, with guardrails, maintenance and freeze windows, and automatic
    rollback when a workload becomes unhealthy. A mutating webhook gives new pods the recommended resources.
  • Smarter recommendations. HPA coordination (requests and the HPA target change together), JVM heap-aware
    memory, and zero-downtime handling of single-replica workloads and StatefulSets with OnDelete.
  • Web UI and admin area. Workloads, recommendations, savings, policies, audit log; users and tokens;
    approve, apply and roll back from the UI.
  • Cluster onboarding. An add-cluster wizard, per-cluster metrics sources and readiness checks
    (Registered → Agent connected → Metrics OK → Ready for audit → Automation ready).
  • Install. One Helm chart (kerf, global.mode: hub | spoke | all) with zone spread,
    autoscaling, External Secrets, Postgres over verified TLS, ingress, NetworkPolicies, alerts and Grafana
    dashboards. The hub runs highly available (leader election on Postgres).
  • Release. Multi-arch images (linux/amd64, linux/arm64) with SBOM and provenance, signed with cosign,
    and OCI Helm charts, published to GitHub Container Registry.
  • Maintenance page and update check. Admin → Maintenance lists the version of every component (each hub
    replica, the web UI, the pricing service, and the agent and webhook pods of every cluster) and flags
    mismatches. Once a day the hub checks the public GitHub releases of kerf-dev/kerf for a newer stable version
    and shows the release notes and helm upgrade commands; "Check now" runs it at once. It is on by default and
    sends nothing about the installation; turn it off with hub.updateCheck.enabled: false. Metric
    kerf_update_available{current,latest} and the alert KerfUpdateAvailable (severity info).

Fixed

  • Signing in through the web UI kept users read-only: the web proxy looked for the old session cookie name
    and never forwarded kerf_session, so every request still went out with the read-only UI token.

Install

One Helm chart installs everything (global.mode: all), the hub cluster (hub) or a workload cluster (spoke).
The images below are its defaults.

helm install kerf oci://ghcr.io/kerf-dev/kerf/charts/kerf \
  --version 0.1.0-rc.3 --namespace kerf --create-namespace \
  -f values.yaml

Artifacts

Every image is multi-arch (linux/amd64, linux/arm64) with an SBOM and SLSA provenance, and is signed with
cosign (keyless, by this repository's release workflow).

Artifact Reference (version 0.1.0-rc.3) Digest
image hub ghcr.io/kerf-dev/kerf/hub sha256:07d747e73314ef164e6e8a405c891e7248cee57bafc13ec4631bc6f2ffb59bd7
image pricing ghcr.io/kerf-dev/kerf/pricing sha256:41adf1707e3562bd777724d72e158f8718a5b093b4613af7cd50195ded822b07
image agent ghcr.io/kerf-dev/kerf/agent sha256:2a596069884742581df4a79e904670e67a5d6786b51b597abb1c71bfef2f367b
image webhook ghcr.io/kerf-dev/kerf/webhook sha256:ca84cb1352906125d248d4a6fb9f6ef2b7186c7caab5fa569c824c3df334e095
image web ghcr.io/kerf-dev/kerf/web sha256:aab271d472b9e359f6df4543e9a30e0c1541afcad8ce585a8a0413dad10c24ed
chart kerf oci://ghcr.io/kerf-dev/kerf/charts/kerf sha256:7b026673335e6be80419c5c928aecd09cea293f6a378f8902fbd18d1de2a608b
chart hub oci://ghcr.io/kerf-dev/kerf/charts/hub sha256:d41a73652d2f6174f1657bf8ec4e1d9ab886d040a8991beb03273e245cf20fd3
chart pricing oci://ghcr.io/kerf-dev/kerf/charts/pricing sha256:92a3197917e227cb520f8fa1db6c3ac99a7c7de294878307fdbd3edc2cf98bec
chart agent oci://ghcr.io/kerf-dev/kerf/charts/agent sha256:e6b73e0d0008480bac2df7ca2b7cce72272800cb41dc41ac626d9fffc91cbcbe
chart webhook oci://ghcr.io/kerf-dev/kerf/charts/webhook sha256:fa891a5f1f63af97f17e9b174def90f1e694cf7a040d9d7d5d21854087b74214
chart web oci://ghcr.io/kerf-dev/kerf/charts/web sha256:dd795852c4683f334bf0c651cb2f4f91be2e0c90a5a7674ba858341328a9d7f9

Verify a signature:

cosign verify ghcr.io/kerf-dev/kerf/hub:0.1.0-rc.3 \
  --certificate-identity-regexp '^https://github.com/kerf-dev/kerf/.github/workflows/release.yaml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Full Changelog: v0.1.0-rc.2...v0.1.0-rc.3

Assets 11
Loading