kollect 0.6.0-rc.1

0.6.0-rc.1 - 2026-06-09

Bug Fixes

• sink: Retry BigQuery emulator readiness in L3 tests b5a6b85

• controller: Enforce namespace intersections in rollups 8e11ab6

• sink: Re-enable backend pool after layout integration test 95a417c

• sink: Infer resource manifest layout 90725d6

• build: Compile full cmd package after pprof fold 5045839

• controller: Panic-guard family-sink, connection-test, cluster-target reconcilers 95f2cae

• controller: Aggregate per-sink export errors 61d28d4

• controller: Stop requeue on terminal finalizer cleanup 439e5dd

• api: [breaking] Reject stub sink types at admission 2ebc8df

• sink: Remove stub backends, make unknown sink type terminal f39d19c

• sink/git: Redact credentials from git CLI errors f25cafb

• collect: Stabilize export fingerprints for debounce 76813eb

• docs: Purge stale hub/spoke from operator manual 5135c41

• docs: Repair broken links and stale ADR references d8b37cb

• chart: Sync family-sink CRDs with ADR-0416 fields 067c5c7

Features

• api: Add cluster rollup shard status 4809cfd

• api: Add cluster inventory namespaces list 3959ba2

• helm: Add minimal RBAC team install profile 907487e

• sink: Add BigQuery database backend 83fb2f3

• sink/nats: Version event envelope schema 48fd7dd

• demo: Add hero harness with in-kind Forgejo c64c14c

• sink: Wire ADR-0419 git layout into export pipeline 12d7f80

• export: Full-resource pruning and Git layout 3df4027

• sink: Render status.preview surface (ADR-0416) 5c9c80f

• sink: MongoDB database sink (ADR-0417) f49bf3e

Refactoring

• controller: Compose cluster rollups by namespace b1af6b1

• inventory: Fold internal/httpauth into inventory f89e2cd

• cmd: Fold internal/pprof into cmd 8a3004f

• validation: Decouple layout path checks from sink package a558394

---

Container image (operator)

ghcr.io/konih/kollect:0.6.0-rc.1

Multi-arch (linux/amd64, linux/arm64), Debian bookworm-slim nonroot base (includes git and openssh-client for spec.git.engine: cli).

OCI attestations (SBOM + SLSA provenance) are attached in GHCR and on the repository
Attestations page. Verify the signature:

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect@sha256:89c310a5f3a960366b71f987cf9f75c53662964834a8ab58d0639a8f8920743d

Container image (kollect-ui)

Optional read-only UI SPA — enable with Helm ui.enabled=true.

ghcr.io/konih/kollect-ui:0.6.0-rc.1

Multi-arch (linux/amd64, linux/arm64), nginx alpine static server.

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/konih/kollect/.+' \
  ghcr.io/konih/kollect-ui@sha256:8e69a4b8a2ec55294c68801493ed85be7fd6a2513b6dc643c77ce8bbba14f8fa

Install (Kustomize)

kubectl apply -f install-crds.yaml
kubectl apply -f install.yaml

Install (Helm — OCI)

helm upgrade --install kollect oci://ghcr.io/konih/kollect \
  --version 0.6.0-rc.1 \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.6.0-rc.1 \
  --set ui.image.tag=0.6.0-rc.1

Install (Helm — GitHub Release tarball)

helm upgrade --install kollect kollect-0.6.0-rc.1.tgz \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/konih/kollect \
  --set image.tag=0.6.0-rc.1 \
  --set ui.image.tag=0.6.0-rc.1

Verify checksums with sha256sum -c checksums.txt. Each release asset includes a
<file>.sigstore.json Sigstore bundle; release-provenance.intoto.jsonl attests all assets.
See docs/RELEASE.md.