v2.3.0

Release Notes — v2.3.0

✨ Features

AWS VPC networking

• Transit Gateway — connect many VPCs and on-prem networks through a central hub (attachments, route tables, routes, propagation).
• Site-to-Site & Client VPN — customer/virtual-private gateways, VPN connections with static routes, and Client VPN remote-access endpoints with target networks and authorization rules.
• PrivateLink (VPC endpoint services) — publish a service and let other VPCs consume it privately.
• DHCP option sets, managed prefix lists, egress-only internet gateways (IPv6 outbound), and Network Firewall.
• VPC IP Address Manager (IPAM) — plan and hand out your IP space: pools, scopes, allocations, BYOIP/BYOASN, prefix-list resolver, policy, and usage metrics.
• Traffic Mirroring — copy VPC traffic to monitoring appliances (targets, filters, sessions).
• Network Insights — Reachability Analyzer ("can A reach B?") and Network Access Analyzer (access-scope analyses).
• VPC Block Public Access — the account/region control that blocks internet access broadly, with per-VPC/subnet exclusions.

Azure Cosmos DB for PostgreSQL & Databricks

• Cosmos DB for PostgreSQL (Citus) — provision distributed PostgreSQL cluster groups (Microsoft.DBforPostgreSQL/serverGroupsv2) with the Azure SDK/CLI.
• Databricks — full Microsoft.Databricks ARM resource coverage, so a workspace deployment models end to end.

Resource discovery & cost inventory

• Discovered resources now carry VM size/SKU, attached managed disks, and database tier, so inventory and cost views match what a real account would show.
• Azure Resource Graph cost fields — every supported Azure type projects its priceable SKU/tier/capacity through armresourcegraph (VMs & scale sets, disks, SQL databases/managed instances, storage accounts, Cosmos, AKS, App Service plans, …) and survives real-SDK creation end to end, so a Resource Graph cost query returns the same shape as a real subscription.

🔧 Enhancements

AWS service operations & tagging

• SQS — get/set queue attributes, purge a queue, and tagging.
• Lambda — versions, aliases, resource-based permissions (AddPermission/GetPolicy/RemovePermission), and tagging.
• Consistent tagging across EC2, SNS, DynamoDB, SQS, SSM, and Lambda.
• More operations to complete provision/teardown flows — ECR login (GetAuthorizationToken), Secrets Manager update + tagging, IAM inline role policies, ElastiCache cluster modify, CloudWatch Logs retention, and extra EC2 lookups (DescribeRegions, DescribeInstanceTypes, …).

Kubernetes data plane

• Completed API-surface parity — the existing in-memory cluster (reachable via any EKS/AKS/GKE kubeconfig) now serves the remaining surface, so kubectl, Helm, and controller-runtime / operator-SDK workloads behave as they would against a real cluster.
• CustomResourceDefinitions — a created CRD is served, discoverable, and Established immediately; deleting it cascade-deletes its custom resources.
• Server-side apply — per-fieldManager ownership in managedFields, 409 conflicts with force takeover, and field removal on re-apply.
• Metrics & autoscaling — kubectl top (metrics.k8s.io) and CPU-utilization-driven HorizontalPodAutoscaler actuation.
• Policy & admission — object-count ResourceQuota, LimitRange defaulting, RBAC SubjectAccessReview, NetworkPolicy evaluation, and opt-in admission webhooks.
• Deterministic controllers — Deployment→ReplicaSet→Pod, DaemonSet, and cron-parsed CronJob scheduling, all driven explicitly (no wall clock).

🐛 Fixes

AWS

• Messaging now delivers — messages published to an SNS topic, and events matched by an EventBridge rule, reach subscribed SQS queues (previously dropped).
• Correct not-found errors — EC2 Describe* for a nonexistent ID returns the proper *.NotFound instead of an empty result.
• Truer request/response behavior — DynamoDB applies FilterExpression in Query; S3 honors max-keys/pagination and serves HeadBucket + bucket tagging; CloudWatch now works from the aws CLI.

GCP

• Fidelity fixes across 19 services — a partial update to a Cloud Monitoring alert policy no longer silently disables it; Pub/Sub subscription listing returns your real subscriptions in stable, sorted order; and long-running operations resolve correctly for the Artifact Registry / Eventarc SDK clients.

Technical Details

AWS networking (#317, #318, #324)

• #317 — Transit Gateway, Site-to-Site VPN, DHCP option sets, managed prefix lists, egress-only internet gateways, VPC endpoint services (PrivateLink), Client VPN, and Network Firewall — added as AWS-only optional EC2 capabilities (the portable Networking interface is not widened; no Azure/GCP stubs).
• #318 — VPC IPAM: scopes, pools, CIDR provisioning, allocations, resource discovery, BYOASN/BYOIP, prefix-list resolver, policy, and IPAM CloudWatch metrics.
• #324 — Traffic Mirroring (targets/filters/rules/sessions), Network Insights (Reachability Analyzer + Network Access Analyzer), and VPC Block Public Access (options + exclusions).

Kubernetes data plane (#314)

• #314 — full in-memory Kubernetes data-plane parity: CustomResourceDefinitions, server-side apply, metrics.k8s.io + HPA actuation, opt-in admission webhooks, RBAC/NetworkPolicy evaluation, ResourceQuota/LimitRange, finalizer-gated deletion, key-anchored list pagination, and deterministic Deployment/DaemonSet/CronJob controllers (#312).

Azure & resource discovery (#311, #306, #316, #327)

• #311 — Azure Cosmos DB for PostgreSQL (Microsoft.DBforPostgreSQL/serverGroupsv2, Citus) full-parity support.
• #306 — remaining Microsoft.Databricks ARM resources (#209).
• #316 — Resource Graph generic resource-shape attributes (VM SKU, managed disks, DB tier).
• #327 — Resource Graph cost-field projection across all supported Azure types (VM osType, VMSS, disks, SQL databases/managed instances, storage accounts, Cosmos, AKS, App Service plans), wired through the ARM create paths (#323).

Parity-audit enhancements & fixes (#320, #322)

• #320 — AWS parity audit: SNS→SQS / EventBridge→SQS delivery, EC2 Describe *.NotFound, DynamoDB FilterExpression, S3 pagination/HeadBucket/tagging, CloudWatch query protocol, plus the additive operations listed under Enhancements (#319).
• #322 — GCP parity audit across 19 services (monitoring PATCH, Pub/Sub list ordering, LRO @type, non-threshold conditions, and more).

Full Changelog: v2.2.0...v2.3.0