v0.4.0

Platform Orchestrator Helm chart 0.4.0

This release replaces the external SpiceDB authorization service with
configurable RBAC evaluated by Casbin inside IAM. Supported SpiceDB-based
installations upgrade automatically with an ordinary Helm upgrade.

Included versions

Component	Version
Control plane	v2.0.0
Data plane	v3.0.0
IAM	v2.1.0
Runner	v3.0.0
Console	v1.0.2
Kubernetes runner chart	0.3.0
NATS Helm dependency	2.14.0

What changed

• Casbin runs in each IAM process and stores roles, permissions, assignments,
  and scoped resource relations in the existing IAM PostgreSQL database.
• Organization administrators can create, edit, and delete configurable roles;
  built-in Admin, Deployer, and Viewer roles remain immutable.
• Authorization decisions and policy snapshots are cached in-process. NATS
  invalidation makes role and assignment changes visible across replicas.
• IAM no longer needs a SpiceDB workload, operator, endpoint, pre-shared key, or
  separate runtime database.
• The chart preserves the legacy SpiceDB database and credentials by default so
  operators retain a bounded rollback path.

Automatic upgrade

• The supported source is IAM schema 29; IAM v2.0.1 is the qualified legacy
  release. Older schemas are rejected with an instruction to upgrade first.
• IAM uses the Recreate deployment strategy, producing a short IAM outage but
  preventing old SpiceDB-based and new Casbin-based binaries from sharing the
  database.
• The first new replica takes a PostgreSQL advisory lock, validates and
  fingerprints legacy RBAC data, applies schemas 30 and 31, reconciles the full
  resource hierarchy from the control plane, and verifies the result before it
  becomes ready.
• Concurrent replicas wait for the same lock. Interrupted reconciliation is
  recorded and resumed on the next Kubernetes restart.
• A failed preflight, unavailable dependency, changed fingerprint, or invalid
  hierarchy prevents readiness and causes the Helm upgrade to fail closed.

Back up IAM PostgreSQL before upgrading and retain the previous IAM image plus
legacy SpiceDB data during the rollback window. See the
SpiceDB-to-Casbin chart upgrade for the
upgrade, verification, and guarded rollback procedure.

Qualification

The upgrade test boots the released IAM v2.0.1 with real PostgreSQL, NATS,
and SpiceDB; seeds human and service-user assignments at organization, project,
and environment scope; and records the legacy authorization results. It then:

• proves startup fails closed while the control plane is unavailable;
• starts two Casbin IAM replicas concurrently and exercises lock serialization;
• verifies the RBAC fingerprint and reconstructed resource hierarchy;
• repeats the authorization decisions after SpiceDB is stopped; and
• proves guarded rollback rejects RBAC changes before successfully restoring
  schema 29 after those changes are reverted.