Skip to content

kollect 0.21.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Oct 22:25
· 594 commits to main since this release
v0.21.0
5c5a413

Important

Upgrade notes — two breaking security changes

  • spec.tls.insecureSkipVerify: true now requires --allow-insecure-sinks (Helm: allowInsecureSinks: true). Without it, admission rejects create/update of such sinks and existing insecure sinks stop exporting after upgrade (deletion is unaffected). List affected sinks before upgrading — see Upgrading.
  • NATS URLs must not carry credentials. A spec.nats.url / spec.endpoint containing user:pass@ now fails configuration; move the token or username/password into secretRef.

New, opt-in: KollectSnapshotSink.spec.deletionPolicy: Delete retracts an inventory's exported objects when the inventory is deleted. The default Retain keeps today's behaviour (see ADR-0421).

0.21.0 - 2026-10-01

Bug Fixes

  • sink: Serialize git mirror users and base new branches on the clone tip ad632da

  • security: Mask the GitLab private_token query parameter 46c0a40

  • security: Static messages at the git auth and ssh-pinning parse sites 2233a59

  • security: Widen redact.Text to query, header, DSN and quoted-URL credentials 135aeba

  • security: Static messages at the remaining git/gitlab URL parse sites 5b6f686

  • security: Redact the ReconcilePanic Event message 365e313

  • security: Redact target Degraded messages from scope-deny paths 17c0e0c

  • security: Redact the all-sinks-failed Degraded/Ready message a8ad552

  • security: Widen userinfo run to the proven character class; pin bare IPv4 NATS servers eac20ce

  • security: Scrub authorization/bearer carrier keys (K-24) 3e7d813

  • security: [breaking] Static messages at URL parse sites; reject NATS URL userinfo (K-23, K-25) 7816b0f

  • security: Redact error text at every status/Event writer (K-23) 7e081fa

  • sink: Strip GitLab credentials on an https to http redirect d55fde3

  • sink: Escape BigQuery string literals with GoogleSQL backslash escapes 9ff2d1f

  • cmd: Log the insecure-sinks warning after SetLogger 3e7c03d

  • sink: [breaking] Harden transport and credential hygiene 7d71eb6

  • collect: Classify two more evaluation errors (#391)ebef8a5

  • collect: Keep field values out of extraction errors 50fcb9f

  • sink: Close evicted pool backends outside the lock d551a0c

  • sink: Close replaced pool backends outside the lock 3496c9e

  • controller: Clear Ready when a namespaced export fails (#387)71f050a

  • sink: Bound response headers when the HTTP client timeout is zero (#389)e77302e

  • export: Stop silent oversize drops and torn relational snapshots (#378)79b841c

  • collect: Drop the user-reachable pin exception under an enforced ceiling abb9e2b

  • controller: Requeue after scope-lookup deny, not just unregister 5ba732b

  • webhook: Reject inventory sink refs outside the scope allowlist at admission 0d38070

  • controller: Unregister scope-denied targets and watch KollectScope 05fb780

  • collect: Fail closed on empty effective set under a scope ceiling cbc8ff7

  • security: Reject cross-namespace secretRef at admission and validate auth mode (#377)23e8b86

Features

  • sink: Retract exports on inventory deletion via deletionPolicy (#383)577e265

  • chart: Add allowInsecureSinks value for --allow-insecure-sinks 53626b2

Refactoring

  • sink: Share sink TLS resolution across git, kafka and nats 9736f1f

  • controller: Fold lookup requeue into the scope-deny helper 3cb4638

  • controller: Extract scope-deny degrade helper; clear lint shadows cab5676

Container image (operator)

ghcr.io/platformrelay/kollect:v0.21.0

Multi-arch (linux/amd64, linux/arm64), Debian bookworm-slim nonroot base (includes git and openssh-client for spec.git.engine: cli).

OCI attestations (SBOM + SLSA provenance) are attached in GHCR and on the repository
Attestations page. Verify the signature:

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/PlatformRelay/Kollect/.+' \
  ghcr.io/platformrelay/kollect@sha256:a86edc5ec3a8c9c7a8897324e8baf5b061684688d24b213b02e57be8d65e80f2

Container image (kollect-pipeline)

One-shot CI/CD collection CLI (ADR-0801) — collect inventory from a kubeconfig without installing
the operator. See the pipeline CLI guide.

ghcr.io/platformrelay/kollect-pipeline:0.21.0

Multi-arch (linux/amd64, linux/arm64), distroless static nonroot base. The git snapshot sink
uses the pure-Go go-git engine over HTTPS; git.engine: cli and file:// remotes are not supported
in this minimal image.

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/PlatformRelay/Kollect/.+' \
  ghcr.io/platformrelay/kollect-pipeline@sha256:4d3f23aa06fd69f15b2d8c1a46ef4f1e68cef5cc62a2f54a139843672e9166fa

Install (Kustomize)

kubectl apply -f install-crds.yaml
kubectl apply -f install.yaml

Install (Helm — OCI)

helm upgrade --install kollect oci://ghcr.io/platformrelay/charts/kollect \
  --version 0.21.0 \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/platformrelay/kollect \
  --set image.tag=v0.21.0

Install (Helm — GitHub Release tarball)

helm upgrade --install kollect kollect-0.21.0.tgz \
  --namespace kollect-system \
  --create-namespace \
  --set image.repository=ghcr.io/platformrelay/kollect \
  --set image.tag=v0.21.0

Verify checksums with sha256sum -c checksums.txt. Each release asset includes a
<file>.sigstore.json Sigstore bundle; release-provenance.intoto.jsonl attests all assets.
See docs/RELEASE.md.

Assets 15
Loading