Skip to content

v0.1.5

Choose a tag to compare

View all tags
@rahulv8 rahulv8 released this 23 Sep 05:46
· 1 commit to main since this release
v0.1.5
c7ff98c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Everything since v0.1.4: Kubernetes installs on a single 4-vCPU node, change data capture
drains partitions in parallel, and login resolves through an interface that fails closed.
Images are published for linux/amd64 and linux/arm64.

Install

Docker (Compose)

curl -sSL https://raw.githubusercontent.com/rsync-ai/rsync/v0.1.5/install.sh | bash

Kubernetes (Helm) — one command; it sizes the install to your cluster:

curl -sSL https://raw.githubusercontent.com/rsync-ai/rsync/v0.1.5/install-k8s.sh | bash

The chart is also available directly: helm pull oci://ghcr.io/rsync-ai/charts/rsync-ai --version 0.1.5.

What changed

Kubernetes

  • A single 4-vCPU node installs. install-k8s.sh waits for the cluster's own DaemonSets
    before measuring free capacity — a node reads emptier than it is for about 25 seconds after
    it registers — counts unscheduled pods as room already owed, and adds a rung below lean
    that trims replica counts rather than leaving pods Pending.
  • Kafka's log directory is a subdirectory of its volume rather than the volume root, so the
    broker no longer trips over lost+found on a fresh PersistentVolume.

Change data capture

  • CDC data topics are created with min(3, brokers) partitions instead of whatever the broker
    happened to auto-create them at. Kafka Connect creates them through topic.creation.* before
    producing, so auto-create never gets a turn. KAFKA_CDC_TOPIC_PARTITIONS sets it wider.
  • The sink drains those partitions in parallel flush lanes sharded on (topic, partition), so
    one slow table no longer stalls the others. RSYNC_SINK_FLUSH_LANES (default 4) sets the
    width; per-key ordering is unchanged.

Identity

  • Login resolves through an interface and fails closed: a provider name this build does not
    have refuses every login, and now says so at boot instead of waiting for the first user who
    cannot get in. The password path stays the tested default.

Interface

  • PII Management is reachable from the nav.
  • The README opens with a screenshot of the approval gate.

Fixes

  • The PII detection tier can store a scan result again, and a failed load stops reading as zero.
  • A dev build left inside cmd/kafka-sink-worker/ is ignored again.

Dependencies

  • Two Dependabot rounds: Go OpenTelemetry 1.45.0, plus frontend and Python pins.

Re-pointed 2026-09-23

This tag was moved from 7e1e907 to c7ff98c and everything at 0.1.5 was
rebuilt from it. Nothing had installed the first cut yet, so the three fixes
below were folded into this release rather than spending a 0.1.6 on them.

  • The Kubernetes temporal-adapter waits for Kafka. createKafkaProducer
    failing is log.Fatalf with no retry, exactly like the orchestrator, but only
    the orchestrator was wired to wait. A fresh kind install of chart 0.1.5
    brought the adapter up after 4 restarts, every one Failed to create Kafka producer ... connection refused. If you installed the chart before this, that
    crash-loop is what you saw, and it resolved itself once the broker accepted.
  • kafka-connect restarts on failure. It defaulted to RestartPolicy=no, so
    a single OOM kill stopped CDC capture permanently while every topic still read
    lag 0 and the pipeline still read running — a dead producer and a caught-up
    one are indistinguishable from lag alone. Its memory cap is now 2 GiB.
  • sniStrict is back to false (Traefik's own default). true refuses any
    handshake whose SNI does not match a configured certificate, which makes
    https://<ip>/ unreachable — the only address an operator has before DNS
    points anywhere. The TLS floor, cipher suites, certificate validation and HSTS
    are unchanged.

The move also picks up the post-tag follow-up, so install-k8s.sh now defaults
to chart 0.1.5 instead of 0.1.4 and Chart.yaml matches the release.

install.sh, docker-compose.quickstart.yml and SHA256SUMS are byte-identical
to the first cut and were not re-uploaded; the published checksums still verify.
The chart digest changed from sha256:fdb2db2c… to sha256:f337e4cd….

If you pulled 0.1.5 before 2026-09-23, re-pull — a moved tag does not
re-pull on its own.

Assets 5
Loading