v0.15.0

What's Changed

• chore: pin vennir 0.14.0 in the catalog template by @github-actions[bot] in #300
• docs: 0.14.0 is released: the changelog and versions say so by @roburns in #301
• docs: getting your computer ready, on macOS, Linux and Windows (WSL 2) by @roburns in #302
• feat(samples): the azure samples run off AKS, by federation with the step's token by @roburns in #303
• feat(gateway): entraToken, a Microsoft Entra token for Azure backends by @roburns in #305

Full Changelog: v0.14.0...v0.15.0

v0.14.0

What's Changed

• chore: pin vennir 0.13.2 in the catalog template by @github-actions[bot] in #279
• docs: 0.13.1 and 0.13.2 are released: the changelog and versions say so by @roburns in #280
• docs: what the GCP-to-AWS run from 0.13.2 found users must do by @roburns in #281
• feat(samples): ecs-express, AWS's Cloud Run, replaces app-runner by @roburns in #282
• docs: ecs-express proven from GKE, and an API on it through the gateway by @roburns in #283
• feat(samples): ecs-express and app-hosting roll out a new version by @roburns in #284
• fix(test): the admission policy test retries a replace that conflicts by @roburns in #287
• feat(cli): apply says when the catalog repository isn't set up for it by @roburns in #285
• feat(samples): an aws API on ECS Express Mode, through the gateway by @roburns in #286
• fix: a failed rollout is reported, and every policy write retries by @roburns in #293
• build(deps): Bump the cli-go group in /cli with 2 updates by @dependabot[bot] in #288
• build(deps-dev): Bump @types/node from 26.6.5 to 26.6.6 in /catalog-template/samples/local/products/reverse in the sample-npm group by @dependabot[bot] in #289
• build(deps): Bump the console-npm group across 2 directories with 10 updates by @dependabot[bot] in #290
• build(deps): Bump the gateway-go group in /gateway with 5 updates by @dependabot[bot] in #291
• build(deps): Bump the kernel-go group in /kernel with 9 updates by @dependabot[bot] in #292
• feat(console): reads ACR as its own Entra identity, on AKS by @roburns in #294
• feat(cli): the azure target's config, sign-in and cluster credentials (1/3) by @roburns in #295
• feat(cli): the azure module, its install values, apply and destroy (2/3) by @roburns in #296
• feat(cli): azure is offered: priced, with its account guide (3/3) by @roburns in #297
• chore: the GitHub account is roburns (was rburns629) by @roburns in #299
• fix: what the first AKS run found, and the azure samples proven by @roburns in #298

Full Changelog: v0.13.2...v0.14.0

v0.13.2

What's Changed

• chore: pin vennir 0.13.1 in the catalog template by @github-actions[bot] in #278
• feat(helm): the gateway on GKE's load balancer from values alone by @rburns629 in #277

Full Changelog: v0.13.1...v0.13.2

v0.13.1

What's Changed

• chore: pin vennir 0.13.0 in the catalog template by @github-actions[bot] in #274
• docs: 0.13.0 is released: the changelog, versions and upgrade notes say so by @rburns629 in #275
• feat(samples): every aws product runs off EKS as its own role by @rburns629 in #276

Full Changelog: v0.13.0...v0.13.1

v0.13.0

What's Changed

• chore: pin vennir 0.12.0 in the catalog template by @github-actions[bot] in #257
• docs: 0.12.0 is released: samples use access, the site describes it by @rburns629 in #258
• feat: with catalogPolicy, the console's identity policy holds secret names alone (decision 27, 2/2) by @rburns629 in #252
• feat!: shareWith is gone from api.yaml: grants alone let others call an API by @rburns629 in #259
• feat: kernel policy signs in as a database role of its own by @rburns629 in #260
• feat: kernel policy on GKE: its own identity, and vennir turns it on by @rburns629 in #261
• feat: kernel policy on EKS: its own role, and vennir turns it on by @rburns629 in #262
• feat: kernel policy reads another project's catalog as its own by @rburns629 in #263
• fix(cli): helm list without --all, which Helm 4 dropped by @rburns629 in #264
• fix(aws): tag EBS volumes with extraVolumeTags; the add-on dropped k8sTagClusterId by @rburns629 in #265
• fix(gcp): Autopilot's Spot placement names the toleration Autopilot adds by @rburns629 in #266
• docs: kernel policy proven on GKE and EKS by @rburns629 in #267
• fix: a catalog in the reader's own project is its task registry; kernel policy reads it by @rburns629 in #268
• fix: the gateway is never the console's origin by @rburns629 in #269
• feat!: API backends in their team's own namespace are held by @rburns629 in #270
• feat: each grant's last call, recorded by the gateway and shown on the access pages by @rburns629 in #271
• feat: kernel policy reads another cloud's catalog by federation of its own by @rburns629 in #272
• fix: the gateway signs SigV4 without X-Forwarded-For; s3-bucket runs off EKS by @rburns629 in #273

Full Changelog: v0.12.0...v0.13.0

v0.12.0

What's Changed

• chore: pin vennir 0.11.0 in the catalog template by @github-actions[bot] in #207
• docs: onboarding, hosting, deploying to GCP and AWS, the API gateway, and addresses by @rburns629 in #208
• feat(site): vennir.io, the public website, from the mockups canvas by @rburns629 in #209
• fix(site): what the pages say matches what 0.11.0 does by @rburns629 in #210
• feat(site): ready for search engines and AI assistants by @rburns629 in #211
• feat(site): the FAQ compares Vennir with Argo Workflows, Backstage and HCP Terraform by @rburns629 in #212
• fix: a product runs only as its own ServiceAccount by @rburns629 in #213
• fix(gateway): only a query that reads in full is checked and forwarded by @rburns629 in #215
• fix: a catalog's team files are never read or mounted through a link by @rburns629 in #214
• fix: a step's result is read only from a Pod its own Job made by @rburns629 in #216
• fix(console): a template's run is rerun only by its owners by @rburns629 in #217
• fix(console): no bot makes credentials or changes who's in its team by @rburns629 in #218
• fix(console): a chat answer links only to the console's own pages by @rburns629 in #219
• fix: a SecretStore names only its team's credential and ESO's identities by @rburns629 in #220
• fix(console): never apply a catalog release older than the one applied by @rburns629 in #221
• fix(gateway): a backend gets the method, path and headers that were checked by @rburns629 in #222
• docs: who may delete what a run made, and what's left of the 2026-11-04 review by @rburns629 in #223
• chore: dependencies with fixes for known advisories by @rburns629 in #224
• feat: API backends run in a namespace of their own, -apis by @rburns629 in #225
• feat: the scan policy admits only digests that passed by @rburns629 in #226
• feat: the GKE reference install runs the platform in vennir-system by @rburns629 in #227
• feat(gateway): limits before sign-in, body deadline, reserved audiences, bounded traffic by @rburns629 in #228
• feat: only the scheduler makes step Jobs, shaped as its executor makes them by @rburns629 in #229
• feat: a step's product identity is its product's released digests by @rburns629 in #230
• test(helm): the admission tests use a team label of their own by @rburns629 in #231
• fix: what review of #227-#231 found by @rburns629 in #232
• fix: what review of #232 found by @rburns629 in #233
• fix(kernel): the security review's kernel findings by @rburns629 in #234
• fix(gateway): backend namespaces, ; in paths, session key window, IAM sign-in over verified TLS by @rburns629 in #235
• fix: retired teams run nothing, bots are never admins, and other 2026-11-04 review findings by @rburns629 in #236
• fix: ExternalSecrets, uppercase images, catalog federation by id, releases in use per product by @rburns629 in #237
• fix: what review of #234-#237 found by @rburns629 in #238
• fix: what review of #238 found by @rburns629 in #239
• fix: the security review's last open items by @rburns629 in #240
• fix(cli): klauspost/compress 1.20.2 (GO-2026-6865) by @rburns629 in #247
• fix: a raw DAG's steps' outputs are seen by their own teams by @rburns629 in #241
• docs: propose a host per API with subscriptions, and the kernel writing the catalog's policies by @rburns629 in #243
• fix: step Pods are always hardened (taskPodHardening removed) by @rburns629 in #242
• fix: sessions that rely on SSO claim groups last an hour by @rburns629 in #244
• fix: an API's ServiceAccount gets tokens only for its own audiences by @rburns629 in #246
• feat: the console records who read outputs, logs and secret names by @rburns629 in #245
• docs: decision 26: the gateway's paths as a pass-through, and an access list of group and user grants per API by @rburns629 in #248
• feat: each API's access list: grants to groups and users (decision 26) by @rburns629 in #249
• feat(console): pages for who may call each API (decision 26) by @rburns629 in #250
• feat: kernel policy writes what a signed catalog decides (decision 27, 1/2) by @rburns629 in #251
• fix(console): minimatch 11.0.4 for eslint's tooling by @rburns629 in #253
• docs: bring the docs and the site in step with decisions 26 and 27 by @rburns629 in #254
• fix(console): requesters offer their groups; review follow-ups on API access by @rburns629 in #255
• fix: kernel policy review follow-ups (decision 27) by @rburns629 in #256

Full Changelog: v0.11.0...v0.12.0

v0.11.0

What's Changed

• chore: pin vertra 0.10.0 in the catalog template by @github-actions[bot] in #205
• feat: rename Vertra to Vennir by @rburns629 in #206

Full Changelog: v0.10.0...v0.11.0

v0.10.0

What's Changed

• chore: pin vertra 0.9.0 in the catalog template by @github-actions[bot] in #203
• feat(catalog): per-team build Environments (buildEnvironments) by @rburns629 in #204

Full Changelog: v0.9.0...v0.10.0

v0.9.0

What's Changed

• docs: the repository map says a scheduler pass is two transactions by @rburns629 in #80
• chore: pin vertra 0.8.0 in the catalog template by @github-actions[bot] in #81
• fix(console): a bot belongs to the one team that made it by @rburns629 in #82
• fix(console): a catalog release registers products only in the teams it names by @rburns629 in #83
• fix(console): products are registered by the catalog or an admin, not a team's maintainers by @rburns629 in #84
• fix(gateway): a request's path can't stop traffic from being recorded by @rburns629 in #86
• fix(kernel): steps held by a cap or key don't keep others from being claimed by @rburns629 in #87
• fix(console): a chat model's key and the console's cloud identity go only where they were given for by @rburns629 in #88
• fix(helm): the console may run only its image scans and catalog verifications as Jobs by @rburns629 in #89
• fix(helm): the kernel's processes sign in to the bundled Postgres as a role of their own by @rburns629 in #90
• fix(cli): the AWS catalog publish role trusts a job of its Environment only on main by @rburns629 in #91
• fix(console): numeric settings are checked when it starts by @rburns629 in #93
• fix(console): audit retention keeps what isn't copied yet, and isn't mistaken for tampering by @rburns629 in #94
• fix(console): single sign-on linking an existing account makes it the only way in by @rburns629 in #95
• fix(console): purging a team deletes its single sign-on mappings and schedules by @rburns629 in #96
• fix(gateway): callers are checked as at the console: admin-set single sign-on, ordering bots, purged teams by @rburns629 in #97
• fix(kernel): a cancelled execution's tasks can't be retried, and a failed one's waiting tasks aren't in the queue by @rburns629 in #98
• fix(helm): the policies' kept lists are written as JSON strings, so an apostrophe can't break an upgrade by @rburns629 in #99
• fix(console): single sign-on's session is taken only by the tab that started the sign-in by @rburns629 in #92
• fix(console): a bot's run isn't approved by whoever made the bot something to act with by @rburns629 in #85
• fix(console): a run's approvers are worked out before the kernel has it by @rburns629 in #100
• fix(console): no bot's keyless identity may overlap another bot's by @rburns629 in #101
• fix: an API may only use an in-cluster backend in its own team's namespace by @rburns629 in #102
• fix(helm): a Group purger's members are held to the purge guard too by @rburns629 in #103
• fix: the gateway's token fence bounds audience and lifetime, and -api is reserved for APIs by @rburns629 in #104
• fix(helm): a step's container is held to what the executor builds, and hardened per container by @rburns629 in #105
• fix(helm): the sleeper may only suspend, resume and reschedule its CronJobs (H-7) by @rburns629 in #106
• docs: what a platform namespace shared with a team gives up (H-9) by @rburns629 in #107
• fix(helm): the bundled databases' passwords are kept with their volumes (H-10) by @rburns629 in #108
• fix(gateway): a path naming no API served here is counted under api="-" (G-7) by @rburns629 in #109
• fix(gateway): a rotated-out session key stops working within a minute, on both listeners (G-8) by @rburns629 in #110
• fix(gateway): what an API's OpenAPI document doesn't declare isn't forwarded (G-5) by @rburns629 in #111
• fix(console): a schedule due in the hour the clocks repeat runs once (D-4) by @rburns629 in #112
• fix(console): one console at a time makes each delivery pass (C-6) by @rburns629 in #113
• fix(console): the resource recorder pages past runs that haven't finished (D-6) by @rburns629 in #114
• fix(cli): destroy keeps only what's in the state (L-3) by @rburns629 in #116
• fix(ci): the proto check covers the kernel's generated code too (X-3) by @rburns629 in #117
• fix(cli): the aws check asks the region chosen, not only its list (M-2) by @rburns629 in #121
• fix(catalog-template): http-check's token goes only to the URL it was given (T-1) by @rburns629 in #129
• fix(cli): no AWS install keeps the account's GitHub OIDC provider in its state, so its destroy can't delete it from under others (M-3) by @rburns629 in #118
• fix(cli): a location group the gcp check can't read isn't a refusal (M-1) by @rburns629 in #119
• fix(cli): the cost screen prices the platform nodes its requests need, not always one (M-5) by @rburns629 in #120
• fix(cli): a catalog release pins each product to the signed image of its own commit, and :latest moves only once signed (T-6) by @rburns629 in #123
• fix(console): the first admin's password is never printed, so no log keeps it (L-2) by @rburns629 in #124
• fix(ci): the release scans what it pushes, can't half-publish a version, and only runs on main's tags (X-1, X-5, X-6) by @rburns629 in #125
• fix(catalog-template): the gcp samples install pyasn1 0.6.5 or later by @rburns629 in #134
• fix(catalog-template): gitleaks and Semgrep gate publishing, and the README says which checks main's ruleset requires (T-5) by @rburns629 in #126
• test(cli): the fake tofu answers a bare state list, as Forget now asks by @rburns629 in #135
• fix(console): each person may ask the chat agent 30 questions an hour and 200 a day, and bots none (D-5) by @rburns629 in #115
• fix(cli): the AWS catalog grant compares the reader's role before changing it, and leaves another reader's alone unless --replace (M-4) by @rburns629 in #122
• fix(catalog-template): a retried create waits for what it found to be ready (T-3) by @rburns629 in #130
• fix(catalog-template): s3-bucket is tagged as it's made, and a retry finishes its setup (T-4) by @rburns629 in #131
• fix(catalog-template): app-hosting deploys the team's images, as the team's runtime account (T-7) by @rburns629 in #132
• fix(cli): every chart vertra installs is checked by its SHA-256 first, and kind's registry runs by digest (L-4) by @rburns629 in #127
• fix(ci): Go code gets Semgrep's Go rules and govulncheck (X-2) by @rburns629 in #128
• fix(kernel,console,catalog-template): a sample's cleanup deletes only what it made for the team its run is for (T-2) by @rburns629 in #133
• test(console): the stuck-run test starts the recorder's cursor from the oldest by @rburns629 in #136
• docs: the v* tag ruleset is in place, and vertra checks the charts it installs by @rburns629 in #137
• fix(console): the database pool is at least two connections by @rburns629 in #138
• fix(cli): the console's AWS audit copy is create-only by IAM, not only by its own request (M-6) by @rburns629 in #139
• fix(cli): Secrets vertra writes are applied server-side, so no plaintext copy lands in their last-applied annotation (L-7) by @rburns629 in #146
• fix(cli): the cost screen leaves out the Postgres Pod a managed database doesn't run, and names what it doesn't price (M-8) by @rburns629 in #150
• fix(console): a check that couldn't start shows a plain sentence, not the platform's error (C-8) by @rburns629 in #140
• fix(console): a scan's verdict is recorded only by the reconcile whose Job it still is, and a failed one outlives its image (D-8, D-9) by @rburns629 in #142
• fix(cli): a catalog's schemas resolve only references within themselves, never a file or URL (L-10) by @rburns629 in #148
• fix(helm): the gateway's image can be pinned by digest, as the console's can (H-14) by @rburns629 in https://github.com/rbur...

v0.8.0

What's Changed

• fix: from the r7 run, build-image's tag lookup for an image in a folder, and what holds completion lag on GKE by @rburns629 in #74
• chore: pin vertra 0.7.0 in the catalog template by @github-actions[bot] in #73
• feat: the samples say their clouds by @rburns629 in #75
• fix: a pass records what finished, and commits it, before it dispatches by @rburns629 in #76
• fix: policy-controller checks a step's Pod, not its Job, so dispatch never waits on it by @rburns629 in #77
• feat: the Admin page's image sources say added sources don't run where signed images are required by @rburns629 in #78
• docs: keep Google's query API for Observe's alerts on GKE by @rburns629 in #79

New Contributors

• @github-actions[bot] made their first contribution in #73

Full Changelog: v0.7.0...v0.8.0