v0.6.1

Platform Orchestrator Helm chart 0.6.1

This patch ships the API fixes used by the new CLI and Terraform automation
surfaces. IAM now returns complete, stable pages for service users, roles, and
SCIM group mappings, and the data plane supports explicitly clearing metadata
key constraints.

Included versions

Component	Version
Control plane	v2.1.0
Data plane	v3.1.1
IAM	v2.3.1
Runner	v3.0.0
Console	v1.2.0
Kubernetes runner chart	0.3.0
NATS Helm dependency	2.14.0

What changed

• IAM list endpoints use stable database ordering and correctly advance the
  offset, so automation can traverse every page without gaps or duplicates.
• Data-plane metadata key updates distinguish an omitted constraint from an
  explicit JSON null, allowing clients to remove a previously configured
  constraint.
• The chart deploys IAM v2.3.1 and data plane v3.1.1. No route, value, or
  secret changes are required.

Upgrade

Upgrade normally from chart 0.6.0. The patch requires no manual migration and
does not change the chart's public values schema.

Qualification

• IAM and data-plane unit, integration, lint, generation, vulnerability, and
  container-build gates passed before publication.
• The CLI and Terraform provider automation suites exercised the fixes against
  WX1, including multi-page listings and setting then clearing metadata
  constraints.
• The chart passed dependency resolution, linting, rendered contract tests,
  and full template rendering with the released images.

v0.6.0

Platform Orchestrator Helm chart 0.6.0

This release adds organization-scoped SCIM 2.0 provisioning. Identity providers
can create, update, deactivate, and reactivate users, synchronize groups, and
drive Platform Orchestrator role assignments through explicit group mappings.

Included versions

Component	Version
Control plane	v2.1.0
Data plane	v3.1.0
IAM	v2.3.0
Runner	v3.0.0
Console	v1.2.0
Kubernetes runner chart	0.3.0
NATS Helm dependency	2.14.0

What changed

• IAM implements the SCIM 2.0 service-provider discovery, Users, and Groups
  resources under /scim/v2/orgs/{org_id}.
• A dedicated, hashed service-user bearer token can be limited to the two SCIM
  provisioning permissions in one organization. Requests and directory results
  remain tenant-scoped.
• Deprovisioning revokes active sessions and device logins, prevents SSO and
  invitation paths from restoring access, and preserves memberships in other
  organizations.
• Organization owners can map SCIM groups to built-in or configurable roles by
  using /orgs/{org_id}/scim/group-mappings.
• Provisioning changes emit audit events over NATS.
• The IAM Gateway API route now exposes both the SCIM protocol and group-mapping
  management endpoints.

Upgrade

Upgrade normally from chart 0.5.0. The IAM database migrations run during
startup. SCIM is opt-in per organization, so existing authentication and role
assignments continue unchanged until an owner creates a token and configures an
identity provider.

Bearer tokens cannot be recovered after creation. Store each token in the
identity provider or a secret manager, rotate it if it is exposed, and use a
different token for every organization.

Qualification

• The final IAM tree passed 430 unit tests, 348 clean-database integration
  tests, the SpiceDB-to-Casbin upgrade and rollback test, go vet,
  golangci-lint, and govulncheck.
• SCIM user and group lifecycle, role mapping, deprovisioning, token rotation,
  tenant isolation, pagination, filtering, concurrent updates, and common
  identity-provider interoperability cases are covered by the integration
  suite.
• The audited image and feature chart were deployed to WX1 and exercised
  end-to-end before release.
• The chart route is protected by a rendered-manifest contract test.

v0.5.0

Platform Orchestrator Helm chart 0.5.0

This release makes configurable roles usable as granular orchestrator roles.
Operators can discover the authoritative permission catalog and combine
entity-specific read and write permissions instead of granting one broad write
capability.

Included versions

Component	Version
Control plane	v2.1.0
Data plane	v3.1.0
IAM	v2.2.0
Runner	v3.0.0
Console	v1.2.0
Kubernetes runner chart	0.3.0
NATS Helm dependency	2.14.0

What changed

• IAM publishes a catalog of 34 supported permissions with stable identifiers,
  display names, descriptions, entity groups, and access levels.
• Control-plane and data-plane operations enforce their entity-specific
  permissions.
• The console role editor loads and groups the catalog so roles can be built
  without guessing identifiers or payloads.
• Role create and update requests reject unknown permission identifiers.
• The chart routes the permission catalog endpoint to IAM and checks that route
  as part of its contract suite.
• Existing built-in and configurable roles retain their previous effective
  access through explicit legacy permission implications.

Upgrade

Upgrade normally from chart 0.4.3. IAM v2.2.0 is compatible with the legacy
permission checks used by the previous control plane and data plane, which
allows the workloads to roll independently. No database migration beyond the
schema already shipped in 0.4.3 is required.

Qualification

• All component unit suites and Docker or kind integration suites passed,
  including legacy-role equivalence and granular allow/deny cases.
• The chart passed ct lint and all rendered contract tests.
• A temporary build was deployed over the existing WX1 0.4.3 installation.
  A role limited to module read/write could use module APIs while project and
  deployment writes returned 403.
• The WX1 installer completed base, Redis, and PostgreSQL deployment stages,
  independent verification, and scoped teardown against the upgraded system.

v0.4.3

Platform Orchestrator Helm chart 0.4.3

This patch completes the operational qualification of the configurable Casbin
RBAC release. It carries forward the NATS bootstrap fix from 0.4.2 and fixes
the runner gateway's default NATS endpoint lookup.

Included versions

Component	Version
Control plane	v2.0.0
Data plane	v3.0.0
IAM	v2.1.0
Runner	v3.0.0
Console	v1.1.0
Kubernetes runner chart	0.3.0
NATS Helm dependency	2.14.0

What changed

• The runner gateway now reads the NATS endpoint from the documented
  global.config.NATS_URL value used by the rest of the chart.
• The runner gateway contract now asserts the exact rendered NATS endpoint.
• The bootstrap readiness check uses authenticated NATS protocol RTT and does
  not require $SYS account permissions.

Upgrade

Upgrade normally; no application or database migration is needed from 0.4.1
or 0.4.2. Installations upgrading from a supported SpiceDB-based release
still receive the automatic, fail-closed Casbin migration described in the
SpiceDB-to-Casbin upgrade procedure.

Qualification

• The rendered chart passed all chart and release contracts, including exact
  runner gateway NATS configuration and the bundled NATS CLI command.
• The bootstrap Job completed against the token-protected WX1 NATS service.
• The console, IAM, runner gateway, and supporting workloads completed their
  WX1 rollouts with all replicas ready.

v0.4.2

Superseded: Use v0.4.3. v0.4.2 can render the runner gateway NATS endpoint empty when using the documented defaults.

Platform Orchestrator Helm chart 0.4.2

This patch makes the NATS JetStream bootstrap Job compatible with the bundled
NATS CLI and with the chart's intentionally non-system application token. It
also carries forward the complete configurable Casbin RBAC release from chart
0.4.1.

Included versions

Component	Version
Control plane	v2.0.0
Data plane	v3.0.0
IAM	v2.1.0
Runner	v3.0.0
Console	v1.1.0
Kubernetes runner chart	0.3.0
NATS Helm dependency	2.14.0

What changed

• The bootstrap readiness check now uses an authenticated NATS protocol RTT.
• The check no longer uses the removed server ping --count=1 CLI syntax.
• The bootstrap no longer requires access to the NATS $SYS account.
• CI renders the bootstrap contract and validates the command against the exact
  NATS CLI image selected by the chart.

Upgrade

Upgrade from 0.4.1 normally; no application or database migration is needed.
Installations upgrading from a supported SpiceDB-based release still receive
the automatic, fail-closed Casbin migration described in the
SpiceDB-to-Casbin upgrade procedure.

Qualification

• The corrected readiness command completed against a deployed, token-protected
  NATS instance without system-account permissions.
• The chart passed Helm linting, chart-testing, release-contract tests, and a
  full render before publication.

v0.4.1

Superseded: Use v0.4.3. v0.4.1 has an incompatible NATS bootstrap readiness probe.

Platform Orchestrator Helm chart 0.4.1

This patch completes the configurable Casbin RBAC release by shipping the
matching role-management console. Organization administrators can now create,
edit, and delete custom roles from Settings → Roles, as well as through the
IAM API released in v2.1.0.

Included versions

Component	Version
Control plane	v2.0.0
Data plane	v3.0.0
IAM	v2.1.0
Runner	v3.0.0
Console	v1.1.0
Kubernetes runner chart	0.3.0
NATS Helm dependency	2.14.0

What changed

• The console lists built-in and configurable roles and their permissions.
• Administrators can create roles, edit their names and permissions, and
  delete roles after removing their assignments.
• Built-in Admin, Deployer, and Viewer roles remain visibly immutable.
• Existing member and service-user assignment screens resolve and assign
  configurable roles at organization, project, and environment scope.
• The chart now deploys console v1.1.0; IAM remains at v2.1.0 because the
  complete role CRUD API was already released there.

Upgrade

Upgrading from chart 0.4.0 requires no database migration and performs a
normal console rollout. Installations upgrading directly from a supported
SpiceDB-based release still receive the automatic, fail-closed Casbin migration
described in the
SpiceDB-to-Casbin upgrade procedure.

Qualification

• The console passed TypeScript validation, ESLint, duplicate detection, all
  325 unit tests with coverage, a production build, and the Chromium E2E suite.
• The role-management test covers creation, editing, deletion, and built-in
  role immutability.
• The chart passes dependency resolution, linting, release-contract tests, and
  full rendering with the console v1.1.0 image.

v0.4.0

Platform Orchestrator Helm chart 0.4.0

This release replaces the external SpiceDB authorization service with
configurable RBAC evaluated by Casbin inside IAM. Supported SpiceDB-based
installations upgrade automatically with an ordinary Helm upgrade.

Included versions

Component	Version
Control plane	v2.0.0
Data plane	v3.0.0
IAM	v2.1.0
Runner	v3.0.0
Console	v1.0.2
Kubernetes runner chart	0.3.0
NATS Helm dependency	2.14.0

What changed

• Casbin runs in each IAM process and stores roles, permissions, assignments,
  and scoped resource relations in the existing IAM PostgreSQL database.
• Organization administrators can create, edit, and delete configurable roles;
  built-in Admin, Deployer, and Viewer roles remain immutable.
• Authorization decisions and policy snapshots are cached in-process. NATS
  invalidation makes role and assignment changes visible across replicas.
• IAM no longer needs a SpiceDB workload, operator, endpoint, pre-shared key, or
  separate runtime database.
• The chart preserves the legacy SpiceDB database and credentials by default so
  operators retain a bounded rollback path.

Automatic upgrade

• The supported source is IAM schema 29; IAM v2.0.1 is the qualified legacy
  release. Older schemas are rejected with an instruction to upgrade first.
• IAM uses the Recreate deployment strategy, producing a short IAM outage but
  preventing old SpiceDB-based and new Casbin-based binaries from sharing the
  database.
• The first new replica takes a PostgreSQL advisory lock, validates and
  fingerprints legacy RBAC data, applies schemas 30 and 31, reconciles the full
  resource hierarchy from the control plane, and verifies the result before it
  becomes ready.
• Concurrent replicas wait for the same lock. Interrupted reconciliation is
  recorded and resumed on the next Kubernetes restart.
• A failed preflight, unavailable dependency, changed fingerprint, or invalid
  hierarchy prevents readiness and causes the Helm upgrade to fail closed.

Back up IAM PostgreSQL before upgrading and retain the previous IAM image plus
legacy SpiceDB data during the rollback window. See the
SpiceDB-to-Casbin chart upgrade for the
upgrade, verification, and guarded rollback procedure.

Qualification

The upgrade test boots the released IAM v2.0.1 with real PostgreSQL, NATS,
and SpiceDB; seeds human and service-user assignments at organization, project,
and environment scope; and records the legacy authorization results. It then:

• proves startup fails closed while the control plane is unavailable;
• starts two Casbin IAM replicas concurrently and exercises lock serialization;
• verifies the RBAC fingerprint and reconstructed resource hierarchy;
• repeats the authorization decisions after SpiceDB is stopped; and
• proves guarded rollback rejects RBAC changes before successfully restoring
  schema 29 after those changes are reverted.

v0.3.0

Platform Orchestrator Helm chart 0.3.0

This breaking release makes HTTPS the stable runner-facing protocol while
retaining NATS JetStream as the Orchestrator's internal durable transport.
Runner agents and deployment Jobs no longer receive broker endpoints or
credentials.

Included versions

Component	Version
Control plane	v2.0.0
Data plane	v3.0.0
IAM	v2.0.0
Runner	v3.0.0
Console	v1.0.2
Kubernetes runner chart	0.3.0
NATS Helm dependency	2.14.0

Architecture

• The chart deploys two stateless runner-gateway replicas backed by central
  JetStream.
• External runner agents long-poll the public
  https://<api-host>/runner-gateway endpoint. Direct Kubernetes Jobs use the
  cluster-internal gateway Service, and ECS Jobs use the public endpoint.
• Agents authenticate with short-lived Ed25519 JWTs. Deployment Jobs receive
  deployment-scoped tokens rather than broker credentials.
• Encrypted command receipts preserve JetStream acknowledgement, retry, and
  rejection semantics across gateway replicas without sticky sessions.
• Commands remain centrally buffered while edge runners are disconnected.
  Edge results and encrypted logs use the runner-side RWX outbox until the
  HTTPS return path recovers.

Upgrade requirements

1. Publish and verify data-plane and runner v3.0.0 plus runner chart 0.3.0.
2. Configure a trusted TLS route for /runner-gateway and set the chart's
   public gateway URL to that route.
3. Update runner registrations and installations with matching Ed25519 public
   and private keys.
4. Upgrade data-plane, runner gateway, and runner installations as one
   coordinated compatibility boundary.
5. Execute a deployment and verify its result and encrypted logs before
   reopening deployment traffic.

Qualification limits

The simple and edge paths passed local real-JetStream and Kind deployment
tests, including a real Kubernetes resource and encrypted log return. The
physical diode path and live ECS execution were not tested. Air-gap operation
requires a separately authorized reverse relay for results and logs. Logs
remain bounded encrypted objects rather than a live tail.

v0.2.0

Platform Orchestrator Helm chart 0.2.0

This release replaces RabbitMQ and the direct runner HTTP transport with NATS
JetStream across the control plane, data plane, IAM service, and deployment
runner. It is a breaking, atomic upgrade. Do not run mixed v1 and v2
service or runner images.

Included versions

Component	Version
Control plane	v2.0.0
Data plane	v2.0.0
IAM	v2.0.0
Runner	v2.0.0
Console	v1.0.2
Kubernetes runner chart	0.2.0
NATS Helm dependency	2.14.0

What changed

• Durable service events, runner commands, results, and encrypted log references
  now use NATS JetStream.
• Encrypted runner logs now live in the bounded NATS Object Store. The obsolete
  SeaweedFS operator, S3-compatible log store, and runner-log S3 credentials
  are no longer installed.
• The chart installs NATS with JetStream file storage and bootstraps bounded
  event, command, dead-letter, object, and runner-log storage.
• Runner commands are buffered centrally when an edge runner is disconnected.
• Edge runners use a persistent outbound spool. Multi-node installations need
  a ReadWriteMany storage class for the runner Job and flusher to share it.
• The runner chart contains the protected-side broker and signed file relay for
  the air-gap design.

Upgrade requirements

1. Publish and verify the v2.0.0 service and runner images before publishing
   this chart.
2. Publish runner chart 0.2.0 and the corresponding Terraform modules before
   updating runner installations.
3. Stop new deployments, confirm no deployment is still running, and upgrade
   the broker, backend services, and runners as one coordinated maintenance
   event.
4. Validate NATS stream health, then execute one real deployment and verify its
   result and encrypted logs before reopening deployment traffic.

RabbitMQ queues are not migrated. Rollback requires restoring the complete
v1 stack and its RabbitMQ configuration; rolling back individual components
is unsupported.

Qualification limits

• The simple and edge paths were exercised locally with real NATS, PostgreSQL,
  and a Kind cluster. A real runner created a Kubernetes resource and returned
  its result and decryptable encrypted log object.
• The physical diode path was not tested. Its chart templates and relay unit
  tests are included, but air-gap operation is not qualified by this release.
• Logs remain bounded, encrypted objects. This release does not provide live
  log tailing.
• The generated shared token is suitable for local bootstrap only. A production
  rollout remains gated on per-service and per-runner subject-scoped credentials
  with an issuance, rotation, and revocation procedure.

v0.1.8

Full Changelog: v0.1.7...v0.1.8