v0.96.1

Fixed

• malmok --help cited a document the repository does not contain, and so did the help for apply, attach and report.

Pinned versions

Component	Version
argo-cd	10.2.3
cert-manager	v1.21.1
trust-manager	v0.24.0
victoria-metrics-k8s-stack	0.91.2
local-path-provisioner	v0.0.37
helm (airgap build)	v4.2.4
k9s (airgap build)	v0.51.0
Go	1.25.8

RKE2 itself is not pinned. The version comes from the channel server, or from kubernetes.version in the document.

Full detail, with the reasoning, is in CHANGELOG.md.

v0.96.0

Changed

• README and the documentation landing pages say what 1.0 means.
• The lab harness has no default addresses.

Fixed

• CI failed on cache: pip the same way the documentation workflow did, and 0.95.0 fixed only the one it was looking at.

Pinned versions

Component	Version
argo-cd	10.2.3
cert-manager	v1.21.1
trust-manager	v0.24.0
victoria-metrics-k8s-stack	0.91.2
local-path-provisioner	v0.0.37
helm (airgap build)	v4.2.4
k9s (airgap build)	v0.51.0
Go	1.25.8

RKE2 itself is not pinned. The version comes from the channel server, or from kubernetes.version in the document.

Full detail, with the reasoning, is in CHANGELOG.md.

v0.95.0

Fixed

• ca-trust installed the private CA correctly and could never confirm it.
• The documentation workflow failed before it built anything.
• The carry list was missing five images, and only a closed site could tell.
• PF-802 blocked the air-gap procedure this repository documents.
• PF-802 blocked a resume on this tool's own work.
• MALMOK_SKIP_IMAGES=1 skipped the image bundle and then failed on the checksums.

Added

• The release carries the images.

Changed

• The air-gapped lab case stages the platform image bundle.
• The lab harness supplies the VIP and the load-balancer pool.
• The upgrade case builds at the previous minor instead of at stable.
• A killed run that ends on its own says so.

Pinned versions

Component	Version
argo-cd	10.2.3
cert-manager	v1.21.1
trust-manager	v0.24.0
victoria-metrics-k8s-stack	0.91.2
local-path-provisioner	v0.0.37
helm (airgap build)	v4.2.4
k9s (airgap build)	v0.51.0
Go	1.25.8

RKE2 itself is not pinned. The version comes from the channel server, or from kubernetes.version in the document.

Full detail, with the reasoning, is in CHANGELOG.md.

v0.91.0

Added

• malmok images prints the container images an air-gapped site has to carry.
  Until now an operator had to work them out by reading charts at the
  customer's site, which is where the answer is hardest to get and most
  expensive to get wrong.
  • The chart versions are pinned in this release, so the answer is fixed and
    is worked out once -- by scripts/images.sh, on a machine with a network
    -- rather than by everyone who installs. The result is committed and
    embedded, so the command answers on a node with no network and no helm,
    which is the only place the question is really asked.
  • With -f cluster.yaml, only the charts that document installs.
  • TestTheListMatchesThePinnedVersions fails when a chart version is bumped
    in Go without regenerating the list. Shipping last release's carry list is
    a mistake discovered at the customer's site, and it needs no network to
    catch here.
  • The extractor walks the rendered manifests and the chart values, because
    neither alone is enough: a chart states some images only in its values,
    where an operator reads them at run time. A grep was tried first and was
    quietly wrong -- it saw 7 of the metrics stack's images and missed its data
    plane, because a nested key has no value on its own line.

Known limits

• The list is not complete, and says so. victoria-metrics-k8s-stack templates
  VMSingle, VMAgent, VMAlert and VMAlertmanager resources whose images the
  VictoriaMetrics operator fills in at run time; the chart carries only their
  tags, with the repository in a renovate comment. Reading a comment would be a
  guess, and a guess in a carry list is discovered in a room with no way to
  fetch what is missing. Three more images have no tag in their chart at all --
  it comes from the chart's appVersion -- and are listed separately rather than
  dropped. malmok images --help gives the kubectl one-liner that reads the
  authoritative set off a cluster that has run the stack.
• It is a superset in the other direction: rendered from default values, so a
  component the document disables still appears. Carrying an image nobody pulls
  costs bytes.

v0.86.0

Changed

• The schema group is malmok.dev. platform.ryxen.dev was a reverse-DNS
  namespace carved out of a domain that was never registered -- a namespace
  anyone could take, in the apiVersion of every document and in annotation
  keys on the objects of running clusters. malmok.dev is registered to this
  project.
  • apiVersion: malmok.dev/v1alpha1, and the handoff document is
    malmok.dev/handoff/v1alpha1.
  • Annotation keys move with it: malmok.dev/fingerprint, /san,
    /chain-depth, /not-after, /source, /zone, /exposure,
    /matrix-case, /proxmox-vmid, /simulated.
  • The platform. prefix is gone. It existed to carve a namespace out of a
    personal domain; the domain is the project's now, so the prefix said
    nothing. This matches how projects that own their name do it --
    cert-manager.io, argoproj.io.
  • A document on the retired group is refused with the migration rather than
    with two strings to diff: the group moved and nothing else changed, so the
    error prints the sed that does the whole thing.
  • An existing cluster carries the old annotation keys. The next apply writes
    the new ones; the steps are idempotent, so this costs one re-application of
    a few annotated objects and nothing else.
  • The CHANGELOG is not rewritten. Entries below record what the module path
    and the group were at the time, and editing them to match today would make
    the record wrong rather than current.

v0.83.0

Changed

• The module path is github.com/ryxenix/malmok. In Go the module path is the
  import path, so it has to be the repository's real location or
  go install github.com/ryxenix/malmok@latest cannot resolve. Settled before
  the first tag rather than after: moving it later breaks the go.sum of
  anyone who has already fetched it.
• The Kubernetes API group is untouched. platform.ryxen.dev/v1alpha1 and the
  *.ryxen.dev annotation keys are not repository references -- they are in
  every cluster.yaml and on the objects of clusters already running, and
  renaming them would be a breaking change to documents rather than a rename.