0.18.0 - 2026-08-16
Bug Fixes
-
controller: Persist collectedCount independently of the Ready message d2e91b7
-
e2e: Keep operator input out of the piped webhook manifest 6ee6f3e
-
lab: Restore the exit-3 BLOCKED path and keep cleanup off unknown clusters d98ffd9
-
lab: Close a fail-open in the substrate allowlist (pathname expansion) 8f5f155
-
chart: Mirror CRDs instead of merging them, so deletions propagate (#299)39d4cff
-
chart,ci: Ship CRDs that match the API, and gate the drift cd7a7b1
-
devcontainer: Move the Go pin with go.mod so the image still builds (#296)71bf197
-
deps: Raise Go to 1.26.6 to clear 7 called stdlib advisories 96d0f55
-
docs: MD046 — admonition continuation read as an indented code block (#294)4ccba73
-
chart,manager: Address independent review of the metrics-reader and leader-election lane 610e57f
-
samples: Request ephemeral-storage on throwaway Postgres (#293)784fa34
-
release: Soft-fail the hub reporting steps too e5288ac
-
dist: Accept any well-formed Artifact Hub repositoryID a2b0fc1
-
release: Gate operatorhub-pr on the release environment and proven SHA ca72738
-
release: Soft-fail Artifact Hub push after the GitHub Release 5bb92bc
-
ci: Pass release-workflow secrets via env instead of run-block expansion 3418db5
-
collect: Backfill store when registering against a running informer 0a64977
-
collect: Refresh namespace cache before resolving target filters 41cd6b0
-
ci: Guard changelog-sync against demoting a released section (#285)a5fdd3d
Features
-
controller,api: Report a live collected resource count on KollectTarget a9e5500
-
lab: Allowlist lab substrates so Kind-only scenarios run on Talos 3e2fcd8
-
chart,manager: Authorize the metrics endpoint and make leader election survivable 9276abf
-
cli: Add validate subcommand (PIPE-VALIDATE-01) (#289)b4399fb
-
Build-stamped version for both binaries (VERSION-01) (#290)1e906f5
-
cli: Complete --context/--format/--log-level flags (#288)8958d66
-
release: Automate OperatorHub bundle PRs 7f6e8d8
-
olm: Add OperatorHub bundle generation 9dfacad
-
release: Push Artifact Hub repo metadata 373f93d
-
chart: Enrich Artifact Hub operator metadata 3e3adbe
-
collect: Surface namespace-scope misses in logs and metrics 2725fbc
Performance
- collect: Stop re-listing namespaces on every target registration 58ce071
Refactoring
Container image (operator)
ghcr.io/platformrelay/kollect:v0.18.0
Multi-arch (linux/amd64, linux/arm64), Debian bookworm-slim nonroot base (includes git and openssh-client for spec.git.engine: cli).
OCI attestations (SBOM + SLSA provenance) are attached in GHCR and on the repository
Attestations page. Verify the signature:
cosign verify \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/PlatformRelay/Kollect/.+' \
ghcr.io/platformrelay/kollect@sha256:9f116431941d1816bfdb22f574f3394c30cf41a348082e1028b2a16b5e0ccc5cContainer image (kollect-pipeline)
One-shot CI/CD collection CLI (ADR-0801) — collect inventory from a kubeconfig without installing
the operator. See the pipeline CLI guide.
ghcr.io/platformrelay/kollect-pipeline:0.18.0
Multi-arch (linux/amd64, linux/arm64), distroless static nonroot base. The git snapshot sink
uses the pure-Go go-git engine over HTTPS; git.engine: cli and file:// remotes are not supported
in this minimal image.
cosign verify \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/PlatformRelay/Kollect/.+' \
ghcr.io/platformrelay/kollect-pipeline@sha256:e8de37fb2c50d29d9d6e4183090d53c33334d8181f4830fbd82a06b98357c376Install (Kustomize)
kubectl apply -f install-crds.yaml
kubectl apply -f install.yamlInstall (Helm — OCI)
helm upgrade --install kollect oci://ghcr.io/platformrelay/kollect \
--version 0.18.0 \
--namespace kollect-system \
--create-namespace \
--set image.repository=ghcr.io/platformrelay/kollect \
--set image.tag=v0.18.0Install (Helm — GitHub Release tarball)
helm upgrade --install kollect kollect-0.18.0.tgz \
--namespace kollect-system \
--create-namespace \
--set image.repository=ghcr.io/platformrelay/kollect \
--set image.tag=v0.18.0Verify checksums with sha256sum -c checksums.txt. Each release asset includes a
<file>.sigstore.json Sigstore bundle; release-provenance.intoto.jsonl attests all assets.
See docs/RELEASE.md.