kollect 0.7.0

0.7.0 - 2026-06-17

---

Container image (operator)

ghcr.io/konih/kollect:0.7.0

Multi-arch (linux/amd64, linux/arm64), Debian bookworm-slim nonroot base (includes git and openssh-client for spec.git.engine: cli).

OCI attestations (SBOM + SLSA provenance) are attached in GHCR and on the repository
Attestations page. Verify the signature:

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect@sha256:bd50c251502495931669703a7bfea6d13c4c44f45f4c5972acf3b97f8f734543

Container image (kollect-ui)

Optional read-only UI SPA — enable with Helm ui.enabled=true.

ghcr.io/konih/kollect-ui:0.7.0

Multi-arch (linux/amd64, linux/arm64), nginx alpine static server.

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect-ui@sha256:3bd72b73493018bf8cccfff536e97013e92cca4262624a5990e8ab9fd55b4291

Install (Kustomize)

kubectl apply -f install-crds.yaml
kubectl apply -f install.yaml

Install (Helm — OCI)

helm upgrade --install kollect oci://ghcr.io/konih/kollect \
  --version 0.7.0 \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.7.0 \
  --set ui.image.tag=0.7.0

Install (Helm — GitHub Release tarball)

helm upgrade --install kollect kollect-0.7.0.tgz \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.7.0 \
  --set ui.image.tag=0.7.0

Verify checksums with sha256sum -c checksums.txt. Each release asset includes a
<file>.sigstore.json Sigstore bundle; release-provenance.intoto.jsonl attests all assets.
See docs/RELEASE.md.

kollect 0.7.0-rc.1

0.7.0-rc.1 - 2026-06-13

Bug Fixes

• release: Tolerate Rekor 409 on asset re-sign 94de025

• sink/nats: Reconnect when cached connection is closed 319a2bf

• sink/bigquery: Snapshot emulator mode in Config 4c58988

Features

• webhook: Reject cluster kinds in tenantMode 3dbfd6b

• controller: Classify forbidden static refs for cluster kinds ae3057d

• api: [breaking] Reference namespaced static config from cluster kinds 9753744

---

Container image (operator)

ghcr.io/konih/kollect:0.7.0-rc.1

Multi-arch (linux/amd64, linux/arm64), Debian bookworm-slim nonroot base (includes git and openssh-client for spec.git.engine: cli).

OCI attestations (SBOM + SLSA provenance) are attached in GHCR and on the repository
Attestations page. Verify the signature:

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect@sha256:05fe500edf271489def67e61dc7f456f54983e83471f56ff4f5d226b806dcf7e

Container image (kollect-ui)

Optional read-only UI SPA — enable with Helm ui.enabled=true.

ghcr.io/konih/kollect-ui:0.7.0-rc.1

Multi-arch (linux/amd64, linux/arm64), nginx alpine static server.

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect-ui@sha256:b3c4169f0c72475e0abdfbcc1e0788e0eedd47d5c321dcbe830db1ca37977178

Install (Kustomize)

kubectl apply -f install-crds.yaml
kubectl apply -f install.yaml

Install (Helm — OCI)

helm upgrade --install kollect oci://ghcr.io/konih/kollect \
  --version 0.7.0-rc.1 \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.7.0-rc.1 \
  --set ui.image.tag=0.7.0-rc.1

Install (Helm — GitHub Release tarball)

helm upgrade --install kollect kollect-0.7.0-rc.1.tgz \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.7.0-rc.1 \
  --set ui.image.tag=0.7.0-rc.1

Verify checksums with sha256sum -c checksums.txt. Each release asset includes a
<file>.sigstore.json Sigstore bundle; release-provenance.intoto.jsonl attests all assets.
See docs/RELEASE.md.

kollect 0.6.0-rc.2

0.6.0-rc.2 - 2026-06-10

Bug Fixes

• test: Drop duplicate family sink condition tests f0bfb36

• build: Fix go-arch-lint exclude paths for local dirs 4e443f6

• validation: Block private sink endpoint targets f1c0d79

Features

• controller: Shard snapshot exports by max bytes d6ee50a

Refactoring

• bigquery: Inject query execution adapter 0d2208d

• s3: Isolate head-bucket check helper 12a47ea

• postgres: Narrow upsert tx interfaces 82e7bb1

• export: Extract envelope partition helpers 391bbb8

• mongodb: Isolate export scope planning 51154e7

• postgres: Extract export planning helpers 1e0248f

---

Container image (operator)

ghcr.io/konih/kollect:0.6.0-rc.2

Multi-arch (linux/amd64, linux/arm64), Debian bookworm-slim nonroot base (includes git and openssh-client for spec.git.engine: cli).

OCI attestations (SBOM + SLSA provenance) are attached in GHCR and on the repository
Attestations page. Verify the signature:

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect@sha256:6fda5bd7b4ae43775687a5d8f5dad69522baee7822b76c56830b6cd5bfbecb42

Container image (kollect-ui)

Optional read-only UI SPA — enable with Helm ui.enabled=true.

ghcr.io/konih/kollect-ui:0.6.0-rc.2

Multi-arch (linux/amd64, linux/arm64), nginx alpine static server.

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect-ui@sha256:43c9fdce6219dadd2f7885f9095d4796b24e090bf6af4564dec03c7eb7f5aa36

Install (Kustomize)

kubectl apply -f install-crds.yaml
kubectl apply -f install.yaml

Install (Helm — OCI)

helm upgrade --install kollect oci://ghcr.io/konih/kollect \
  --version 0.6.0-rc.2 \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.6.0-rc.2 \
  --set ui.image.tag=0.6.0-rc.2

Install (Helm — GitHub Release tarball)

helm upgrade --install kollect kollect-0.6.0-rc.2.tgz \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.6.0-rc.2 \
  --set ui.image.tag=0.6.0-rc.2

Verify checksums with sha256sum -c checksums.txt. Each release asset includes a
<file>.sigstore.json Sigstore bundle; release-provenance.intoto.jsonl attests all assets.
See docs/RELEASE.md.

kollect 0.6.0-rc.1

0.6.0-rc.1 - 2026-06-09

Bug Fixes

• sink: Retry BigQuery emulator readiness in L3 tests b5a6b85

• controller: Enforce namespace intersections in rollups 8e11ab6

• sink: Re-enable backend pool after layout integration test 95a417c

• sink: Infer resource manifest layout 90725d6

• build: Compile full cmd package after pprof fold 5045839

• controller: Panic-guard family-sink, connection-test, cluster-target reconcilers 95f2cae

• controller: Aggregate per-sink export errors 61d28d4

• controller: Stop requeue on terminal finalizer cleanup 439e5dd

• api: [breaking] Reject stub sink types at admission 2ebc8df

• sink: Remove stub backends, make unknown sink type terminal f39d19c

• sink/git: Redact credentials from git CLI errors f25cafb

• collect: Stabilize export fingerprints for debounce 76813eb

• docs: Purge stale hub/spoke from operator manual 5135c41

• docs: Repair broken links and stale ADR references d8b37cb

• chart: Sync family-sink CRDs with ADR-0416 fields 067c5c7

Features

• api: Add cluster rollup shard status 4809cfd

• api: Add cluster inventory namespaces list 3959ba2

• helm: Add minimal RBAC team install profile 907487e

• sink: Add BigQuery database backend 83fb2f3

• sink/nats: Version event envelope schema 48fd7dd

• demo: Add hero harness with in-kind Forgejo c64c14c

• sink: Wire ADR-0419 git layout into export pipeline 12d7f80

• export: Full-resource pruning and Git layout 3df4027

• sink: Render status.preview surface (ADR-0416) 5c9c80f

• sink: MongoDB database sink (ADR-0417) f49bf3e

Refactoring

• controller: Compose cluster rollups by namespace b1af6b1

• inventory: Fold internal/httpauth into inventory f89e2cd

• cmd: Fold internal/pprof into cmd 8a3004f

• validation: Decouple layout path checks from sink package a558394

---

Container image (operator)

ghcr.io/konih/kollect:0.6.0-rc.1

Multi-arch (linux/amd64, linux/arm64), Debian bookworm-slim nonroot base (includes git and openssh-client for spec.git.engine: cli).

OCI attestations (SBOM + SLSA provenance) are attached in GHCR and on the repository
Attestations page. Verify the signature:

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect@sha256:89c310a5f3a960366b71f987cf9f75c53662964834a8ab58d0639a8f8920743d

Container image (kollect-ui)

Optional read-only UI SPA — enable with Helm ui.enabled=true.

ghcr.io/konih/kollect-ui:0.6.0-rc.1

Multi-arch (linux/amd64, linux/arm64), nginx alpine static server.

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect-ui@sha256:8e69a4b8a2ec55294c68801493ed85be7fd6a2513b6dc643c77ce8bbba14f8fa

Install (Kustomize)

kubectl apply -f install-crds.yaml
kubectl apply -f install.yaml

Install (Helm — OCI)

helm upgrade --install kollect oci://ghcr.io/konih/kollect \
  --version 0.6.0-rc.1 \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.6.0-rc.1 \
  --set ui.image.tag=0.6.0-rc.1

Install (Helm — GitHub Release tarball)

helm upgrade --install kollect kollect-0.6.0-rc.1.tgz \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.6.0-rc.1 \
  --set ui.image.tag=0.6.0-rc.1

Verify checksums with sha256sum -c checksums.txt. Each release asset includes a
<file>.sigstore.json Sigstore bundle; release-provenance.intoto.jsonl attests all assets.
See docs/RELEASE.md.

kollect 0.5.0-rc.1

0.5.0-rc.1 - 2026-06-07

Bug Fixes

• build: Upgrade alpine packages in UI image for Trivy 45d08ce

• ci: Stop perf-report writing agent-context in CI 5ee2088

• ui: Disambiguate Playwright inventory row locator f422a78

• ci: Stabilize nightly Playwright and perf-report b6ea35f

Features

• api: ADR-0416 sink config layering dcc5fa9

---

Container image (operator)

ghcr.io/konih/kollect:0.5.0-rc.1

Multi-arch (linux/amd64, linux/arm64), Debian bookworm-slim nonroot base (includes git and openssh-client for spec.git.engine: cli).

OCI attestations (SBOM + SLSA provenance) are attached in GHCR and on the repository
Attestations page. Verify the signature:

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect@sha256:a06464989768c266713824390e2fd4497b0cf28ab30ed88a68d97ec0858dfe85

Container image (kollect-ui)

Optional read-only UI SPA — enable with Helm ui.enabled=true.

ghcr.io/konih/kollect-ui:0.5.0-rc.1

Multi-arch (linux/amd64, linux/arm64), nginx alpine static server.

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect-ui@sha256:22fa74946e4211577fb7030d2d185368bd4366b1f86e712d3b3c68c902ed18a6

Install (Kustomize)

kubectl apply -f install-crds.yaml
kubectl apply -f install.yaml

Install (Helm — OCI)

helm upgrade --install kollect oci://ghcr.io/konih/kollect \
  --version 0.5.0-rc.1 \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.5.0-rc.1 \
  --set ui.image.tag=0.5.0-rc.1

Install (Helm — GitHub Release tarball)

helm upgrade --install kollect kollect-0.5.0-rc.1.tgz \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.5.0-rc.1 \
  --set ui.image.tag=0.5.0-rc.1

Verify checksums with sha256sum -c checksums.txt. Each release asset includes a
<file>.sigstore.json Sigstore bundle; release-provenance.intoto.jsonl attests all assets.
See docs/RELEASE.md.

kollect 0.5.0

0.5.0 - 2026-06-07

---

Container image (operator)

ghcr.io/konih/kollect:0.5.0

Multi-arch (linux/amd64, linux/arm64), Debian bookworm-slim nonroot base (includes git and openssh-client for spec.git.engine: cli).

OCI attestations (SBOM + SLSA provenance) are attached in GHCR and on the repository
Attestations page. Verify the signature:

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect@sha256:04c8d5515ae81e63c4386e2afc2da14b0e7c81a3acffafda2511edd867ade23f

Container image (kollect-ui)

Optional read-only UI SPA — enable with Helm ui.enabled=true.

ghcr.io/konih/kollect-ui:0.5.0

Multi-arch (linux/amd64, linux/arm64), nginx alpine static server.

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect-ui@sha256:152ece79facc46c82d9f92d82a3e77aae99906c555c660bc9c61e80b21e2f6ff

Install (Kustomize)

kubectl apply -f install-crds.yaml
kubectl apply -f install.yaml

Install (Helm — OCI)

helm upgrade --install kollect oci://ghcr.io/konih/kollect \
  --version 0.5.0 \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.5.0 \
  --set ui.image.tag=0.5.0

Install (Helm — GitHub Release tarball)

helm upgrade --install kollect kollect-0.5.0.tgz \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.5.0 \
  --set ui.image.tag=0.5.0

Verify checksums with sha256sum -c checksums.txt. Each release asset includes a
<file>.sigstore.json Sigstore bundle; release-provenance.intoto.jsonl attests all assets.
See docs/RELEASE.md.