v2.0.1

Production fixes for the Landing Zone Configurator.

• Remove the obsolete Development badge from the application header.
• Enable Runner callbacks and shared warm reserves for the explicitly trusted production address.
• Wait for all three API replicas to become ready after activation, with a bounded timeout and unchanged availability checks.

Known limitation: the enabled Assistant is not fully qualified; intermittent model-service HTTP 400 errors remain under investigation in #225.

Operator setup, credential rotation and recovery: production runbook.

v2.0.0

First production release of the Landing Zone Configurator.

• Dedicated production infrastructure and public STACKIT login.
• Three web/API replicas, PostgreSQL replica set and rolling application deployments.
• Versioned, immutable application/Runner bundles; production activation requires manual approval.
• Shared foundations, Application Landing Zone upgrades and audit-log integration.

Known limitation: the enabled Assistant is not fully qualified; intermittent model-service HTTP 400 errors remain under investigation in #225.

Operator setup, credential rotation and recovery: production runbook.

v1.2.0

Notes

• Firewall High Availability: the hub-and-spoke-firewall flavor can now deploy an active/passive OPNsense pair with CARP, a second appliance in a separate availability zone and a shared LAN virtual IP that replaces the primary's address as the next hop for corporate landing zones, so a node failure never touches the routes (#55)
• Organization-Wide Audit Logs: a Telemetry Link streams audit events into a Telemetry Router, which forwards them to a Logs instance for querying and archives them to object storage with optional WORM protection, retention defaults to 180 days (#53)
• Deployment Verification Before Release: publishing a release now plans, applies and destroys a full landing zone against a test organization first (#71)
• Stricter Pull Request Gates: formatting, linting, module validation and configuration tests run on every pull request (#60, #52)

What's Changed

• chore(deps): bump the terraform-providers group across 9 directories with 2 updates by @dependabot[bot] in #52
• Export org wide audit logs to a Logs instance and S3 archive by @mahauber in #53
• docs: update/fix license file date and company name by @lweberru in #58
• feat(connectivity): add active/passive CARP support for firewall high… by @mahauber in #55
• ci: strengthen pull request quality gates by @lweberru in #60
• Update Terraform configurations and module documentation by @mahauber in #70
• feat: add verification workflow and enhance validation processes by @mahauber in #71
• fix: update variable precedence in deployment workflow and add overri… by @mahauber in #73
• fix: validate STACKIT_SERVICE_ACCOUNT_KEY format and update key path … by @mahauber in #74
• fix: add FOLDER_PREFIX to separate cycle's folder tree in verificatio… by @mahauber in #75
• fix: enforce folder name length limit for rm_folders in variables.tf by @mahauber in #76
• fix: remove unused variables and enhance configuration rendering in v… by @mahauber in #77

Full Changelog: v1.1.0...v1.2.0

v1.1.0

Notes

• Site-to-Site VPN: the hub can now terminate an IPsec VPN against an on-premises or third-party peer, HA by default with two tunnels in separate availability zones (#51)
• Firewall Appliance Replaced: the hub-and-spoke-firewall flavor now deploys OPNsense 26.1 instead of pfSense 2.7.2, which is not an in-place upgrade and requires replacing the appliance (#32)
• Firewall Configuration as Code: the new firewall-config module pushes aliases, rules, NAT and routes to the OPNsense appliance through its API via terraform (#51)
• Platform Managed Kubernetes: the new platform-kubernetes module provisions a central, region-scoped SKE cluster with an HA baseline and optional KMS-encrypted volumes and observability (#39)

What's Changed

• chore(deps): bump the terraform-providers group across 1 directory with 2 updates by @dependabot[bot] in #25
• Updated STACKIT Marketplace link by @mahauber in #26
• feat(governance): support custom parent folder ID for resource manage… by @mahauber in #29
• chore(deps): bump stackitcloud/stackit from 0.96.0 to 0.97.0 in /src in the terraform-providers group across 1 directory by @dependabot[bot] in #27
• feat: add federated identity provider configuration for management se… by @mahauber in #24
• feat(firewall): switch from pfSense to OPNsense in configurations and… by @mahauber in #32
• chore(deps): bump stackitcloud/stackit from 0.97.0 to 0.98.0 in /src in the terraform-providers group across 1 directory by @dependabot[bot] in #33
• fix: update stackit version and correct firewall next hop IP description by @mahauber in #38
• chore(deps): bump stackitcloud/stackit from 0.98.0 to 0.99.0 in /src in the terraform-providers group across 1 directory by @dependabot[bot] in #42
• chore(deps): bump the terraform-providers group across 1 directory with 2 updates by @dependabot[bot] in #44
• feat: central/shared kubernetes platform landing zone and optional namespace creation in app landing zone by @lweberru in #39
• feat: add architecture documentation by @mahauber in #40
• chore(deps): bump stackitcloud/stackit from 0.101.0 to 0.104.0 in /src in the terraform-providers group across 1 directory by @dependabot[bot] in #45
• Add VPN + OPNSense firewall config by @mahauber in #51

New Contributors

• @lweberru made their first contribution in #39

Full Changelog: v1.0.0...v1.1.0

v1.0.0

We are excited to announce the first public release of our Landing Zone module examples.

v0.1.0

What's Changed

• Bump the terraform-providers group across 2 directories with 1 update by @dependabot[bot] in #1
• Bump the terraform-providers group across 7 directories with 1 update by @dependabot[bot] in #5
• Feature/cleanup and dynamic inputs by @mahauber in #10

New Contributors

• @dependabot[bot] made their first contribution in #1
• @mahauber made their first contribution in #10

Full Changelog: https://github.com/stackitcloud/stackit-landing-zone/commits/v0.1.0