v0.39.0

kobe 0.39.0 — hardening how leased clusters are accessed and isolated

kobe is a Kubernetes operator, written in Rust, that leases pre-warmed ephemeral clusters (k3s, k0s, vcluster, CAPI) to CI and developers — claim a fully configured cluster in seconds, use it, release it. 0.38 and 0.39 are a security-and-correctness pass over the lease lifecycle: who can reach a leased cluster, how a lease is bound to its instance, and how clusters are isolated from each other.

Why

Handing out live clusters means the boundaries have to hold. Interactive access (kubectl exec/attach/port-forward) shouldn't be reachable without proof of identity; a lease must be pinned to exactly the instance it was granted, with no way to drift onto another; and one tenant's cluster shouldn't share a database identity with the next. An internal audit also turned up a handful of pool/lease reconcile races worth closing before they bite.

What's new

• Client-cert-gated interactive access. The connect-proxy now requires a client certificate for exec / attach / port-forward, so a leased cluster's interactive endpoints aren't reachable without one.
• UID-fenced lease binding. A ClusterLease is now fenced to its ClusterInstance by UID, so a lease can't be satisfied by — or drift onto — a different instance than the one it was granted.
• Per-cluster datastore isolation. Each cluster gets its own PostgreSQL role rather than sharing one, tightening the blast radius between leases.
• Reconcile-race fixes. Three pool/lease correctness bugs found by audit are fixed — including not reverting an instance that took a lease mid-reconcile, and letting a queued claim scale up a scaled-to-zero pool.
• vcluster fidelity. The vcluster backend now honours the requested Kubernetes version and surfaces helm's stderr in provisioning errors.
• A large test-coverage pass over the CRD wire contracts, the CLI, and the vcluster backend (previously the only untested one), plus k0s and vcluster legs added to the conformance matrix.

Install

cargo binstall kobectl, or Homebrew / Scoop / Chocolatey / AUR; deploy the operator from the OCI Helm chart. Apache-2.0. Docs: github.com/kunobi-ninja/kobe.

These notes were drafted with LLM assistance and edited by the maintainers.

---

What's Changed

• harden(lease): UID-fence ClusterLease↔ClusterInstance binding by @emmanuelm41 in #90
• fix(kobe-sync): stop at the authority when probing the virtual apiserver by @emmanuelm41 in #91
• fix(kobectl): purge must not abandon the batch on one unremovable file by @emmanuelm41 in #95
• fix(aur): publish a real pkgver for the -git package by @emmanuelm41 in #94
• fix(reaper): stop counting skipped entries as cleaned by @emmanuelm41 in #97
• fix(kobectl): purge left files on disk with their tracking already dropped by @emmanuelm41 in #98
• fix(vcluster): carry helm's stderr into the provisioning error by @emmanuelm41 in #99
• fix(chart,vcluster): give helm a writable home so repo add can work by @emmanuelm41 in #104
• fix(datastore): give each cluster its own PostgreSQL role by @emmanuelm41 in #105
• fix(connect-proxy): count upgrade failures, and say why a request failed by @emmanuelm41 in #108
• chore: bump kobe to v0.39.0 by @emmanuelm41 in #110

Full Changelog: v0.38.0...v0.39.0