v0.35.0

kobe 0.35.0 — don't hand out a cluster until it's really ready

kobe is a Kubernetes operator, written in Rust, that manages fleets of ephemeral clusters — pre-warmed across k3s, k0s, vcluster, and CAPI backends so CI and developers can lease a fully configured cluster in seconds. 0.35.0 (following the 0.33.0 public release) hardens the guarantees around a lease: a cluster isn't handed out until it genuinely works, and it's recycled before its certificates can expire under you.

Why

"Pre-warmed and instant" is only useful if the cluster you're handed actually functions. A cluster that is API-reachable but can't yet mint a working service-account token will fail a CI job in a confusing way — so readiness has to mean provably usable, not just responding. And because leases are short-lived and recycled, cluster certificates need bounded lifetimes and proactive rotation so a long-held lease never trips over an expired cert.

What's new

• Token round-trip readiness gates. InClusterToken is now a default admission gate for the k3s, k0s, and vcluster backends — a cluster is only marked Ready once an in-cluster service-account token round-trips successfully, so a lease is bound only when the cluster can actually authenticate workloads.
• Bounded cert validity + recycle-before-expiry. Cluster PKI now uses bounded certificate lifetimes, and kobe recycles a cluster before its certs expire rather than letting a lease inherit a soon-to-fail cert.
• Resilience when pools are degraded. Ready clusters are served even from pools that are otherwise Failing, and a crashlooping cluster's last log lines ("dying words") are captured for diagnosis; k3s guest data is backed by a volume even without persistence.
• Conformance in CI. A k3s conformance smoke gate runs on main pushes and release tags, with backend coverage enforced, so backends can't silently regress.

Install

cargo binstall kobectl (also mise and Homebrew). Apache-2.0. Docs: github.com/kunobi-ninja/kobe.

These notes were drafted with LLM assistance and edited by the maintainers.

---

What's Changed

• feat(readiness): add InClusterToken to default k3s/k0s/vcluster admission gates by @jleni in #28
• chore(release): bump workspace version to 0.35.0 by @jleni in #29
• feat(ci): run k3s conformance on main pushes + release tags; enforce backend coverage by @jleni in #30
• docs: reconcile runtime strategy — kobe-sync on hold, vcluster + pkobe current by @jleni in #32
• feat(pki): bounded cert validity + recycle-before-expiry by @jleni in #33
• fix(e2e): import guest images without --all-platforms; pin CI toolchain by @jleni in #35

Full Changelog: v0.34.0...v0.35.0