v0.6.0

What's Changed

• fix(docs): the site builds again by @fentas in #204
• fix(e2e): the round-trip gate accepts a relative binary path by @fentas in #205
• test(e2e): a real cluster matrix, one binary, both implementations by @fentas in #206
• feat(kubehz): the 503 AT_CAPACITY message names the control-plane shape by @fentas in #207
• feat(kubehz)!: a space is three numbers, not a plan by @fentas in #208

Full Changelog: v0.5.0...v0.6.0

v0.5.0

One presentation layer for the terminal, the lo init screens and a
new verb. No command changed its piped output, with the exceptions
listed under Changed.

The rule

lo decides per stream. Off a terminal (a pipe, a file, CI) the output is
the plain text of the bash implementation, byte for byte. Scripts keep
matching on it.

On a terminal lo renders one house style. Titles and sections are bold.
The ✓ ! ✗ · markers and the [error]/[warn] prefixes have colour.
Tables measure their columns. A command with an obvious next step ends on
a dim next: lo <cmd> # why line. NO_COLOR (set to a non-empty value)
and the new global --no-color flag keep the terminal shape without colour. See
Output.

Changed

• lo doctor no longer prints ANSI escapes into a pipe. It is the one
  command whose piped bytes change. The bash implementation gates its colour
  the same way, so both print the same plain bytes. On a terminal the
  command is the title, and the report starts with its first section.
  lo up, lo down, lo provision, lo recover, the apply progress
  and the bootstrap engine still print their escapes into a pipe, as
  the bash implementation does. Their gate is a follow-up (WP12).

• A project with a bash tree ejected before v0.5.0 keeps the escapes in
  the doctor's provider section until lo assets update bash.

• lo status renders bold headers on a terminal. Piped, it is unchanged.

• lo toolchain doctor has a title and no leading blank line. When a
  pinned tool is missing it ends on next: lo toolchain install.
  lo toolchain install ends on next: lo toolchain doctor.

• lo addons measures its columns on a terminal, so a long addon name
  stays in line. Piped, the printf layout is unchanged. lo assets list
  and lo assets diff measure in both modes.

• The not-found messages of lo status, and of every command that
  resolves a spec, name clusters/<domain>/. The old text named
  .lok8s/<domain>/. Both implementations changed together.

• Bare lo init on a terminal. Without a project here, or in a
  project without a git repository, one welcome line and one bootstrap
  screen with every value prefilled (the name, the first cluster
  <name>.dev, the driver, the environment file, the toolchain, git init); Create, Change details or Cancel. Create runs and
  continues in project mode. In a project: the state card in the layout
  of the lo up header, then one choice from what the state allows
  (a cluster, a service, the test suite, the toolchain when a pinned
  tool is missing, the active domain when none is valid or with several
  clusters, the bash tree or the implementation switch, Exit); each
  action is one screen, then the card again with a one-line result. A
  failed step is a row under the card, not an exit. Nothing is written
  except on a screen's Create. Esc cancels; Ctrl-C leaves with rc 130.
  Off a terminal, under CI or with --yes, bare lo init prints the
  help as before. See lo init.

• The state card. Two columns, the project name first, the facts
  joined with ·: the implementation, the branch and the count of
  uncommitted paths, the clusters grouped by driver with the active one
  first, the toolchain with the count of pinned tools, the environment
  file, the bash tree, services.yaml, tests/. A row that starts with
  ! needs an action; the command is in the list's equivalent row and
  in --plan. No doctor sections inside the card (lo doctor keeps
  them).

• lo init service and lo init test open their screen on a
  terminal without --yes; a value given on the command line is a fixed
  row. Off a terminal they run as before.

• lo init --plan prints the mode's screen as text: the welcome
  and the bootstrap screen, or the card with the action list and the
  next step.

Added

• A bare lo use on a terminal opens a select over the domains and
  preselects the active one. Enter sets it. Esc or Ctrl-C leaves it as it
  is. Without a cluster it prints no clusters yet and points at
  lo init.
• lo use <unknown> on a terminal adds the closest domain and the
  available ones under the error.
• lo bogus prints cobra's "Did you mean this?" block and the
  Run "lo -h" hint. Words from other tools (start, stop, delete,
  switch, apply) suggest their lo command.
• Every flag error, on every command, prints in the one argsh shape.
• --no-color.
• lo init cluster [domain] [--driver lo|kubeone|capi|kkp|kubehz-hosted] [--no-active] [--force] writes clusters/<domain>/cluster.lok8s.yaml
  and makes the domain the active one. The verb behind project mode's
  "Add a cluster". Go-only.
• --yes, --plan and --dry-run on lo init cluster, lo init service and lo init test.

Removed

• The lo init wizard's menu, form chain, Yes/No confirms and summary
  screen from v0.3.x. Their flag twins stay: lo init project --env --cluster --driver --implementation, lo init service <name> --path,
  lo init test, lo toolchain install --groups, lo assets eject bash, lo use <domain>.

Discoverability

• lo completion bash|zsh|fish|powershell completes the values that live
  in the project. Domains complete on lo use, lo audit, lo recover,
  every --domain and --cluster-override, and the drivers' positional.
  Addon names complete on lo addons, asset paths on lo assets eject|diff|update, service names on lo init service. A Tab never
  writes into the project. Install lines: CLI reference.
• Every command's --help ends with an Examples: block of one to three
  lines with real-looking values.
• The generated CLI commands page lists every
  command with its flags and examples. go test ./internal/clidoc/ fails
  while the committed page is stale.
• A bare lo on a terminal prints an orientation block: the project, the
  active domain and its driver, the kubeconfig when one exists, the six
  everyday commands and the next step. Off a terminal it prints the full
  help as before.
• The Short of the Go-only commands (assets, mcp, toolchain) starts
  with a verb and has at most 60 characters.

Safety and scripts

• On a terminal, lo down, lo clean, lo destroy (local driver), lo registry clean and lo image clean list what they remove (the cluster
  name, the kubeconfig, the registry containers and volumes, the docker
  volumes) and ask once. --yes answers the prompt; --force keeps its
  meaning (a precondition override) and does not. Off a terminal nothing
  changes: no prompt, no new requirement.
• -o, --output text|json|yaml on use, status, addons, assets list, registry status, version and doctor, with stable lowerCamel
  field names (CLI reference).
• On a terminal an error with a next step prints as error: … and
  next: …. Off a terminal the exact [error] line prints as before.
  --debug names every failed external command with its exit code. The
  exit codes are documented (CLI reference).
• lo lint --format text|editor|github. github is the default under
  GITHUB_ACTIONS=true off a terminal.
• -q, --quiet silences the informational stderr lines. -v stays the
  [debug] channel (Levels).

Upgrade

Reinstall the binary: bash lo-install.sh, or unpack lo-<os>-<arch>.tar.gz
(lo-full-<os>-<arch>.tar.gz for the in-process build) from the release.
A project that pins lo through lo toolchain install bumps
github.com/kernpilot/lok8s in .bin/b.yaml to v0.5.0 and runs
b install. A project that routes commands to the bash tree runs
lo assets update bash to pick up the colour gate in verbose.sh and
libs/doctor.

What's Changed

• feat(ui): one presentation layer for the terminal; piped output stays the bash contract by @fentas in #200
• feat(init): the state card in the header layout, the bootstrap screen, project mode, lo init cluster by @fentas in #198
• feat(cli): discoverability: completion, examples, generated reference, bare lo orientation (UX PR A) by @fentas in #199
• feat(cli): safety and scripts: confirmations, -o json|yaml, the error shape, lint --format, -q and --debug (UX PR B) by @fentas in #201
• release: v0.5.0 by @fentas in #203

Full Changelog: v0.4.1...v0.5.0

v0.4.1

One fix for lo up in a shell that exports only PATH. No configuration
change is needed.

Fixed

• lo up with the v0.4.0 lo (core) binary created the kind cluster and
  then failed in the bootstrap step:

  Error: loading generator plugins: failed to load generator: unable to find plugin root - tried: ('<no value>'; homed in $KUSTOMIZE_PLUGIN_HOME), …
  [error] bootstrap: render failed for cilium
  

  Every addon that depends on cilium was skipped. lo doctor in the same
  shell reported ✓ KUSTOMIZE_PLUGIN_HOME=<project>/.kustomize.

  The cause: the binary set KUSTOMIZE_PLUGIN_HOME for its bash children
  and for the lo build render, but not for the kustomize child of the
  addon render that bootstrap runs. The project .envrc exports the
  variable; a shell that exports only PATH does not. In that shell the
  child had no plugin home.

  The fix: one function decides the plugin home for every child of the
  binary. It returns the variable when the shell exports it, else
  <project>/.kustomize. The addon render, lo build, lo k8s, the
  registry TLS mint, the bash shim and lo doctor all read that function.
  lo doctor cannot report a home that the render does not use.

Who is affected

A project that runs lo (core), or lo-full with LO_RENDER=exec, from a
shell that does not export KUSTOMIZE_PLUGIN_HOME. The in-process render
of lo-full reads no plugin home and was not affected. A shell that
exports the variable was not affected.

Upgrade

1. Install the binary: bash lo-install.sh, or unpack
   lo-<os>-<arch>.tar.gz (lo-full-<os>-<arch>.tar.gz for the
   in-process build) from the release. A project that pins lo through
   lo toolchain install bumps github.com/kernpilot/lok8s in
   .bin/b.yaml to v0.4.1 and runs b install.
2. Run lo up again. The addons that were skipped are applied.

Assets

The same set as v0.4.0: for linux and darwin, amd64 and arm64,
lo-<os>-<arch>.tar.gz, lo-full-<os>-<arch>.tar.gz,
kustomize-secret-<os>-<arch>, lochat-<os>-<arch>, plus
lok8s-v0.4.1.tar.gz (the framework tree), lo-install.sh and
checksums.txt.

Previous notes: v0.4.0, v0.3.1, v0.3.0.

What's Changed

• fix(render): hand every kustomize child the plugin home; v0.4.1 by @fentas in #202

Full Changelog: v0.4.0...v0.4.1

v0.4.0

The registry TLS certificate moves out of the project tree. New commands
manage it. One fix for lo up in a shell without PATH_SECRETS.

Breaking

• The registry TLS certificate lives in a docker volume. lo up mints
  the certificate for a registry set into the volume
  <network>-registry-tls, next to the set's data volumes. Every registry
  container mounts the volume at /etc/registry/certs. Releases before
  v0.4.0 wrote the certificate to .secrets/tls/registries/ and
  bind-mounted that directory. See
  TLS registries.
• .secrets/ holds no lok8s content. The per-domain store
  clusters/<domain>/secrets/ is the only secrets store. lo lint no
  longer treats registries-tls as a legitimate flat-store entry. See
  Migrating a flat .secrets/ store.

New

• lo registry tls status prints the certificate (SANs, validity dates)
  and what each registry container mounts.
• lo registry tls renew mints a new certificate into the volume and
  restarts the set's containers.
• lo doctor (the binary) reports which mount the registry containers use
  when they still mount the pre-v0.4.0 directory.
• See lo registry tls.

Fixed

• lo up on the lo (kind) driver failed with
  error: PATH_SECRETS is not set — cannot mint the registry TLS cert in a
  project whose shell exports only PATH. The bash entrypoint defaulted
  PATH_SECRETS before any driver ran; the binary did not. The mint no
  longer reads PATH_SECRETS: it hands the Secret generator a scratch
  directory under clusters/<domain>/ and stores the result in the volume.

Who is affected

Every project with spec.registries.tls: true (the default). A project on
a release before v0.4.0 has its certificate in .secrets/tls/registries/
and registry containers that bind-mount that directory.

Upgrade

1. Reinstall the binary: bash lo-install.sh, or unpack
   lo-<os>-<arch>.tar.gz (lo-full-<os>-<arch>.tar.gz for the in-process
   build) from the release. A project that pins lo through
   lo toolchain install bumps github.com/kernpilot/lok8s in
   .bin/b.yaml to v0.4.0 and runs b install.
2. Run lo up. The first run imports the certificate from
   .secrets/tls/registries/ into the volume and prints one [warn] line:
   the running registry containers still mount the old directory.
3. Run lo registry down && lo registry up. The registries come back with
   the volume mounted. lo registry tls status shows volume for each
   container. Then remove .secrets/.
4. Add clusters/*/.registry-tls-tmp.*/ to the project .gitignore. The
   mint writes its scratch store there. A mint that stops before its cleanup
   leaves the directory with the private key in it. New projects get the
   pattern from lo init project. lo up removes stale directories before
   each mint.

The bash implementation changed the same way. A project that routes
registry or up to bash (lok8s.yaml spec.implementation) mints into
the same volume, imports the same legacy files and has the same
lo registry tls status|renew. A switch between the implementations never
leaves two certificate locations behind.

Two lo up runs on the same registry network at the same time can
collide on the helper container <network>-registry-tls-io: that run
fails, and a retry succeeds because the read-out checks both files and
mints again into an incomplete volume.

Assets

The same set as v0.3.1: for linux and darwin, amd64 and arm64,
lo-<os>-<arch>.tar.gz, lo-full-<os>-<arch>.tar.gz,
kustomize-secret-<os>-<arch>, lochat-<os>-<arch>, plus
lok8s-v0.4.0.tar.gz (the framework tree), lo-install.sh and
checksums.txt.

Previous notes: v0.3.1, v0.3.0.

What's Changed

• fix(lo): registry TLS cert in the set's docker volume (both implementations); lo registry tls; v0.4.0 by @fentas in #197

Full Changelog: v0.3.1...v0.4.0

v0.3.1

A fix release for lo build. No new commands, no changed flags.

Fixed

• lo build failed with split: failed to split <domain>/artifacts.yaml
  on every split-mode domain when the OS temp dir is on a different
  filesystem than the project. The split staged its files under $TMPDIR
  and moved them into clusters/<domain>/ with a rename, which fails
  across filesystems (EXDEV). The scratch dir now lives in the domain
  dir (.artifacts-tmp.*, removed on every exit), and a move that still
  crosses a device copies the file instead.

• The split's failure messages name the cause:
  split: failed to split <artifact>: <error>.

Who is affected

Any project whose /tmp is a separate filesystem from the project tree:
a tmpfs /tmp (Arch, Fedora and many CI runners; Debian and Ubuntu keep
/tmp on disk) with the project on a disk, or a CI runner whose workspace
is a mounted volume (the
kubehz-cluster render.yml runners failed on every domain). A project on
the same filesystem as /tmp, or a build with TMPDIR set to a directory
on the project's filesystem, was not affected. The bash implementation was
not affected: mv copies across devices.

Upgrade

Reinstall the binary: bash lo-install.sh, or unpack lo-<os>-<arch>.tar.gz
(lo-full-<os>-<arch>.tar.gz for the in-process build) from the release.
Nothing in the project changes. A project that pins lo through
lo toolchain install bumps github.com/kernpilot/lok8s in .bin/b.yaml
to v0.3.1 and runs b install.

Assets

The same set as v0.3.0: for linux and darwin, amd64 and arm64,
lo-<os>-<arch>.tar.gz, lo-full-<os>-<arch>.tar.gz,
kustomize-secret-<os>-<arch>, lochat-<os>-<arch>, plus
lok8s-v0.3.1.tar.gz (the framework tree), lo-install.sh and
checksums.txt.

What's Changed

• fix(build): keep the split's scratch dir on the project filesystem (v0.3.1) by @fentas in #196

Full Changelog: v0.3.0...v0.3.1

v0.3.0

lo is one Go binary. Every command runs natively in it. The binary embeds
the frozen argsh tree, and the tree stays runnable: a project selects it per
command through lok8s.yaml (spec.implementation).

Install

New installs use lo-install.sh. Download it and checksums.txt from the
release, verify, read, then run it. See
Installation.

Two builds, and both install as lo:

• lo (core, about 18 MB) renders through the pinned kustomize binary and
  the exec plugins that lo toolchain install installs with b.

• lo-full (lo-install.sh --full) links the kustomize API and khelm and
  renders in-process. The two builds give byte-identical output.

New

• lo init runs a wizard on a terminal. It detects where you stand, asks,
  prints the plan, then writes. lo init --plan prints the plan and writes
  nothing. Every answer has a flag twin on a subcommand.

• lo toolchain install writes .bin/b.yaml with the pins of this lo
  build. It installs b (SHA-256 verified) and runs b install.
  lo toolchain doctor verifies what landed.

• lo assets is the eject model. The binary embeds the addons, the driver
  templates, the CRD mirror, the Tilt extension and the bash tree. They land
  in .lok8s/ on first use. lo assets list|diff|eject|update manage the
  copies. A local copy always wins.

• lo mcp serves the MCP server for editors and agents from the same binary.

• lo secrets uses the kernpilot age-only sops fork. The fork drops the
  cloud KMS, Vault and PGP backends. lo rejects a rule with such a
  recipient.

Removed

• LO_IMPL and LO_GO_BASH. Nothing in the environment selects the
  implementation. lok8s.yaml does.

• lo assets show. Use lo assets diff <rel>.

• lo init project --env both. Pick mise, direnv or none.

Deprecated

• lo init toolchain is a hidden alias of lo toolchain install. This
  release keeps it, the next one removes it.

Breaking

• .lok8s/lo no longer marks a project root. The binary walks up to the
  nearest clusters/ directory or a kind: Project lok8s.yaml (D30).

• Install through lo-install.sh or the release archives. lo-up stays
  online as legacy and does not install the Go binary.

• Go refuses go install github.com/kernpilot/lok8s/cmd/lo@v0.3.0. The
  module carries replace directives.

Upgrade an existing project

1. Install the binary: bash lo-install.sh.

2. Add lok8s.yaml at the project root if there is none:

   kind: Project
   spec:
     implementation:
       default: go

3. Run lo toolchain install. It never overwrites an existing .bin/b.yaml.
   It prints a diff against the pins.

4. Optional: lo assets eject bash writes the frozen tree into .lok8s/.
   Then spec.implementation.bash.commands can route a command to it.

5. Run lo doctor.

Deviations

Where the binary does not match the bash on purpose:
the deviations catalogue.

Assets

For linux and darwin, amd64 and arm64: lo-<os>-<arch>.tar.gz,
lo-full-<os>-<arch>.tar.gz, kustomize-secret-<os>-<arch>,
lochat-<os>-<arch>, plus lok8s-v0.3.0.tar.gz (the framework tree),
lo-install.sh and checksums.txt.

What's Changed

• fix(kubeone): render_addons carries the cluster's inline bootstrap values by @fentas in #160
• test(drift-gate): catch |.kind pipe stages; name the (.kind) grouping gap by @fentas in #161
• docs: b.yaml toolchain page, service-vs-target note, drop the private-repo pointer by @fentas in #162
• feat(audit): lo audit --sarif — SARIF 2.1.0 output for GitHub code scanning by @fentas in #163
• feat(kubehz): lo kubehz node join|remove|status — nodes you bring to a hosted control plane (A-5 phase 5) by @fentas in #165
• fix(kubehz): node r3 findings — post-mint slot note, server-string scrub, per-word kubeadm log by @fentas in #166
• docs: STE pass over the user guide — minimize em dashes, active voice, short words by @fentas in #167
• feat(kubehz): lo kubehz join writes the api's join script to a private file by @fentas in #170
• fix(security): supply chain, CI proof of the Go binary, credential handling (2026-09-05 review) by @fentas in #171
• docs+quality: CLI reference drift, one ErrHandled, real flags for the hand-parsed leaves, parity holes (2026-09-05 review) by @fentas in #172
• kubehz: re-vendor the live agent at kubehz-agent v0.1.0 by @fentas in #173
• build(deps): sops age-only fork shrinks the core binary by @fentas in #174
• fix: address review round 2 on the Go port by @fentas in #175
• feat: single-binary Go lo — full port with parity gates, goreleaser release, verified installer by @fentas in #168
• ci(deps): Bump docker/setup-buildx-action from 3.12.0 to 4.3.0 by @dependabot[bot] in #176
• ci(deps): Bump actions/deploy-pages from 4.0.5 to 5.0.1 by @dependabot[bot] in #177
• ci(deps): Bump helm/kind-action from 1.12.0 to 1.15.0 by @dependabot[bot] in #178
• ci(deps): Bump actions/upload-pages-artifact from 3.0.1 to 5.0.0 by @dependabot[bot] in #179
• ci(deps): Bump docker/setup-qemu-action from 3.7.0 to 4.3.0 by @dependabot[bot] in #180
• chore(deps): Bump golang.org/x/term from 0.45.0 to 0.46.0 by @dependabot[bot] in #181
• chore(deps): Bump golang.org/x/crypto from 0.54.0 to 0.57.0 by @dependabot[bot] in #182
• docs+chore: internal plan moved, self-contained ai/README, .lok8s/README, stale .secrets and api/ stubs removed by @fentas in #186
• chore(deps): Bump filippo.io/age from 1.3.1 to 1.3.2 by @dependabot[bot] in #183
• chore(deps): Bump golang.org/x/crypto from 0.54.0 to 0.57.0 in /kustomize by @dependabot[bot] in #184
• ci: run the main-only e2e and kind jobs from their own workflow by @fentas in #185
• feat(mcp): the editor talks to lo mcp; docs for the Go and the bash server by @fentas in #187
• feat: embed the bash implementation in the binary (WP7) by @fentas in #188
• feat(cli): select the implementation in lok8s.yaml, remove LO_IMPL (WP8) by @fentas in #190
• feat: WP9: lo toolchain, files-only init, assets and marker cleanup, lint --notes by @fentas in #191
• feat: a context-aware bare lo init (WP9b) by @fentas in #192
• release: prepare v0.3.0 by @fentas in #193

New Contributors

• @dependabot[bot] made their first contribution in #176

Full Changelog: v0.2.0...v0.3.0

v0.2.0

What's Changed

• fix(ci): silence SC2120 in .lok8s/libs/ai (greens main ShellCheck) by @fentas in #15
• chore(operator): refresh image + toolchain to clear CVE alerts (305→30) by @fentas in #16
• docs(readme): rewrite for first-impressions and broader positioning by @fentas in #18
• docs(home): lead landing-page install with the curl one-liner by @fentas in #19
• feat(tilt): tilt.hooks — dev lifecycle hooks via a hidden lo hooks by @fentas in #20
• fix(tilt): drop live_update for production builds by @fentas in #21
• fix(lo): self-protect the generated .containerd tree with a .gitignore by @fentas in #17
• feat(lok8s): KubeOne driver to production (OIDC, addon overrides, registry auth) + secrets env-fallbacks by @fentas in #22
• feat(bootstrap): parallel addon scheduler with per-entry wait: barriers by @fentas in #24
• fix(ceph-osd): GPT bare-metal carve + cloud/bare-metal split + ROOT_GIB 60 by @fentas in #23
• feat(bootstrap): add dependsOn for fine-grained DAG ordering (parallel CRD owners) by @fentas in #25
• feat(bootstrap): add name: entry override to disambiguate dependsOn (addon vs same-name target) by @fentas in #26
• fix(bootstrap): on failure skip only the failed entry's dependents, not the whole run by @fentas in #27
• feat(hetzner): cloud.d module library — reach framework modules from a custom cloudInit.path by @fentas in #28
• feat(rook-ceph): bump to v1.20.1 + document bare-metal single-disk OSD limit by @fentas in #29
• fix(ceph-osd): document the real bare-metal #17716/FORCE_GPT limitation by @fentas in #30
• chore(b): bump vendored b v4.16.0 → v4.18.4 by @fentas in #31
• feat(provision): lo provision -b|--bootstrap — re-apply spec.bootstrap on an existing cluster by @fentas in #32
• fix(cert-manager-webhook-hetzner): auth-reader RoleBinding must stay in kube-system by @fentas in #33
• feat(rook-ceph): add ceph-csi-drivers — fix idle CSI operator / all PVCs Pending by @fentas in #34
• feat(build/deploy): domain-based build/deploy — one artifact per domain + opt-in -l filter by @fentas in #35
• feat(kubeone): make bundled provider CSI opt-in via spec.network.csi (Ceph-first default) by @fentas in #37
• fix(lint): resolve spec.bootstrap via the shared parser (map-form entries) by @fentas in #39
• feat(kubehz): heartbeat agent reports control-plane component health + platform docs page by @fentas in #40
• feat(hetzner): #wipe-devices — guarded device wipe on bare-metal fresh install by @fentas in #36
• feat(hetzner): provider::rebuild + provider::doctor hooks; lo doctor infra section by @fentas in #38
• feat(recover): lo recover — bare-metal DR orchestrator by @fentas in #41
• fix(bootstrap): export driver spec-env on the standalone lo bootstrap path by @fentas in #42
• chore(kubehz): park the non-functional managed-operator manifests (ghost image) by @fentas in #45
• feat(kubehz): per-node instanceType in heartbeat (self-hosted cost overview) by @fentas in #44
• feat(kubehz): P0 self-hosted agent-secret claim (in-cluster identity + authed heartbeat) by @fentas in #47
• fix(kubehz): robustly parse heartbeat node names/roles/version (P0: agent DOA on modern k8s) by @fentas in #48
• feat(audit): lo audit static security-posture audit + addon overview by @fentas in #49
• fix(ci): install pinned kustomize for bats + repair docs deploy by @fentas in #50
• chore(deps): force vite ^6.4.3 via resolutions (fixes both Dependabot alerts) by @fentas in #51
• feat: ClusterInventory CRD wave — lo-written deploy inventory + published addons index by @fentas in #52
• fix(recover): load provider creds before doctor/rebuild phases by @fentas in #53
• fix(recover): multi-worker installimage, cred-loader return-0, restore.d DR hook, CCM placement by @fentas in #55
• feat(kubeone): plumb node-tier labels from #labels to Node labels by @fentas in #56
• feat(kubehz): render the capacity-rejection envelope on hosted provision by @fentas in #57
• fix(cilium): raise Hetzner per-node pod CIDR to /23 (double CP density) by @fentas in #58
• fix(cli): argsh-conformance sweep — inert dispatches, guards, imports, annotations by @fentas in #61
• fix(cilium): raise Hetzner per-node pod CIDR to /23 (double CP density) by @fentas in #59
• fix(kubeone): descriptor-anchored inventory — exclude machine-controller VMs from static hosts by @fentas in #62
• feat(bootstrap): valueFiles on inline addon entries by @fentas in #66
• fix(cli): lo up exit code, surfaced destroy failures, build/deploy doc drift by @fentas in #60
• fix(ci): inventory kind-test asserted pruning, but SSA rejects — red since #52 by @fentas in #64
• style: antipattern sweep — brace positionals, SC2250 enforcement, underscore-prefix cleanup by @fentas in #67
• feat(lint): adopt argsh lint (shellcheck + argsh-lint) as the one entrypoint by @fentas in #68
• feat(addons): add fluxcd (Flux CD GitOps toolkit) framework addon by @fentas in #69
• chore(lo-driver): make kapply a hard dependency, drop the [[ -f ]] guard by @fentas in #70
• feat(bootstrap): aggregate parallel apply output — buffered blocks + progress ticker by @fentas in #71
• feat(build): spec-declared split artifacts — per-resource files + sops Secrets by @fentas in #74
• feat(build): decouple Secret encryption from split — spec.build.encrypt + on:change + lo build --no-secrets by @fentas in #75
• feat(secrets): store-free plugin off switch + run-but-suppress env knobs by @fentas in #76
• feat(secrets): lo secrets set accepts - to read the value from stdin by @fentas in #77
• feat(addons): sso-gate — OIDC login in front of any HTTPRoute by @fentas in #78
• feat(cilium): restore WireGuard encryption + production posture (KubeOne) by @fentas in #79
• feat(kubehz): apply the customer bootstrap DAG onto hosted clusters by @fentas in #80
• fix(cilium): MTU 1250 → 1380 — the 1.19 knob is the RAW pod MTU by @fentas in #81
• docs: align ARCHITECTURE + concepts with the bootstrap DAG by @fentas in #82
• fix(cilium): encryption belongs to the Hetzner provider layer by @fentas in #83
• fix(build): support renvsubst — envsubst flavor shim for restricted substitution by @fentas in #84
• fix(build): restricted substitution goes native (jq) on non-GNU envsubst by @fentas in #85
• fix(build): route the artifacts pipe through template::envsubst by @fentas in #86
• feat(addons): loki + promtail — cluster log store and node collector by @fentas in #87
• fix(cli): single domain-resolution point — env precedence, driver gates, honest errors by @fentas in #88
• feat(secret): template: generator for composite secrets by @fentas in #92
• feat(secret): template typed sub-sections, bash-style substitutions, key: generator by @fentas in #93
• ci(e2e): wire lo up --ci end-to-end job (GOLIVE 0.2) by @fentas in #94
• feat(secrets): lo secrets set --encrypt + stale-.enc warning by @fentas in #95
• fix(secrets): address PR #95 review — pin sops --config + clearer warn by @fentas in #96
• fix(bootstrap): reconcile cilium/ccm via --bootstrap on KubeOne (gate on path, not DS existence) by @fentas in #97
• feat(bootstrap): unify gate execution + batched conflict heal by @fentas in #98...

v0.1.0

What's Changed

• feat(capi): complete the CAPH driver — real Hetzner clusters, E2E green by @fentas in #7
• feat(capi): HA + private-network + multi-pool example variant by @fentas in #8
• docs: install one-liner + sync capi docs to the reworked driver by @fentas in #9
• feat(secrets): lint flags flat-store shadows of per-domain secrets by @fentas in #10
• feat: local AI for lok8s — lo chat assistant + the benchmark that shaped it by @fentas in #11
• feat: lo ai skill management + skill drift-audit + new skills by @fentas in #12
• ci(release): build + attach the lo chat (lochat) binaries by @fentas in #13
• fix(ci): build kustomize plugins in the release (unblock the broken tarball) by @fentas in #14

New Contributors

• @fentas made their first contribution in #7

Full Changelog: https://github.com/kernpilot/lok8s/commits/v0.1.0