Configra v1.2.1

Configra v1.2.1 fixes cross-environment Config copies, credential setup and actionable error reporting. All binaries use Go 1.26.9; the Kubernetes component also updates x/net to v0.60.0 to address reachable HTTP/2 vulnerabilities.

本版修复 test → production 的同名 Config 首次复制、含糊的错误、日期有效期和 CA 标识复制体验。从 v1.2.0 升级无需数据库结构迁移，schema 保持 4；configra-go 继续使用 v1.2.0。

Fixes

• Copy to environment / 复制到环境 creates the first target version while retaining the Config key. Existing targets are protected by revision checks. Clone continues to create a globally new key and now explains name collisions.
• Saved source revisions are pinned. Network retries retain Operation IDs, failed operations keep safe reasons, and completed transfers can replay after archival. Restore waits for the complete snapshot before another copy; format-only changes create a new revision.
• Errors show concrete guidance plus copyable Request/Operation IDs. Parser text and secret values are excluded from errors and audits.
• Credential dates show elapsed lifetime and policy overruns. Expired Tokens display correctly. CA IDs, full fingerprints and issuer/Token identifiers are visible and copyable, with explicit clipboard feedback.
• Machine reads reuse eight fixed SQL statement plans. Authorization and resource results remain uncached; Config/File reads retain read-only repeatable-read snapshots.
• The frontend build dependency source-map-js moves to 1.2.2 for CVE-2026-93749; CI now rejects high/critical npm advisories. The npm audit reports zero findings.
• Go runtime and Kubernetes HTTP/2 security updates retain strict module, runtime-license, source/SBOM and artifact checks. Kubernetes source builds require Go 1.26.9; the downloaded executable requires no installed Go compiler. SDK APIs and CRDs are unchanged.

Upgrade

Download the archive for your platform and verify SHA256SUMS. Each archive contains configra, configractl and configra-kubernetes for macOS/Linux, amd64/arm64.

Drain writers, replace/restart the matching services, check doctor and a real mTLS read, then reload the Management UI. Do not reinitialize the database. For upgrades from v1.1.0 or v1.0.1, follow the earlier schema migration instructions linked in the runbook.

Patch upgrade and rollback · Config copy guide

Verification

Source commit: f62ad6be808add905d1d2c6e36263158dbe8f319.

• Normal CI: Go/race/vet/module checks, vulnerability gates, Web and actual service integration.
• Release acceptance: real MySQL/NATS/ClickHouse, ten-minute capacity/leakage gate and three-node Kubernetes recovery/rotation.
• All 78 browser cases pass. Final four-platform bundles pass checksum, composition, target/toolchain, SDK and source/SBOM binding checks. All 20 SBOMs validate against CycloneDX 1.6; the three native macOS/arm64 executables report v1.2.1 and the exact source commit.
• Final hosted actual-image capacity: 600,000 requests over ten minutes, zero errors, 999.97 completed requests/s, p95 312.86 ms; all 615,002 access events captured/persisted and leak scans passed.
• Final local actual-image capacity: 600,000 measured requests over ten minutes, zero errors, 999.99 completed requests/s, p95 36.72 ms; all 615,002 expected access events captured/persisted and leak scans passed.
• Tag-triggered release build passed. All five downloaded assets were independently rechecked before publication, including archive checksums, exact source identity, all 20 SBOM schemas and native executable versions. Verification record.

Earlier capacity failures and the subsequent SQL-preparation optimization are retained in the verification record; capacity thresholds were not relaxed.

Publication does not update or restart your production deployment automatically.

Full changes since v1.2.0

Configra v1.2.0

Configra v1.2.0 ships a Go operator CLI built with Cobra/pflag, complete release sets and production operations controls.

• configractl: Config/Vault/File writes, private contexts/outputs, deployment credential inventory and verified two-phase rotation.
• Immutable Config+File preparation, local semantic validation, generation-checked activation and whole-set rollback; SDK and Kubernetes opt-in complete reads.
• Shared administrator session invalidation/blocking and verified OIDC back-channel logout.
• Private Prometheus metrics and alerts, independent audit/notification workers, write admission and safe archived Outbox pruning.
• Separate MySQL service/migration roles, HA overlay and verified-backup scheduling references.

Upgrade requires MySQL schema 3 → 4. Stop writers and all service replicas, preserve a verified backup and matching Master Key, run configra migrate with a temporary migration identity, verify with configra doctor, then start matching v1.2.0 services. Existing current-value reads remain compatible; complete releases are explicitly enabled by consumers. Do not run old binaries against schema 4.

• Upgrade / 升级与回退
• CLI / 部署 CLI
• Release sets / 整套发布
• Verification / 验证记录
• Go SDK v1.2.0

Each Darwin/Linux amd64/arm64 archive includes configra, configractl and configra-kubernetes, notices, source-access material and SBOMs. Verify SHA256SUMS after downloading. Production ingress, independent fault domains, storage retention and application reload remain deployment-specific acceptance steps.

Tagged release verification passed: all four downloaded archives match SHA256SUMS and source commit 4711d5ff4c440049cc422f37a4d62a9128045bcc; all 20 SBOMs pass the official CycloneDX 1.6 schema. Native macOS arm64 binaries report v1.2.0 and the tag commit; Linux binaries were executed in the tag build. Server/SDK CI, real-dependency E2E, actual-image recovery, the unchanged 600,000-request capacity gate and hosted three-node Kubernetes acceptance pass.

Configra v1.1.0

Automation can now write Config and Vault resources in explicit environments and
issue/revoke read-only deployment Token/client-certificate pairs through the
9443 machine API. Scoped writers require both Token and a registered active
mTLS certificate; only an OIDC Administrator with verified signed MFA evidence
can issue them on Management. Environment creation, user/role administration,
writer delegation and Master Key export remain outside this credential's powers.

新增有范围的写令牌：管理员在管理端 OIDC 登录并提供签名 MFA 证明后签发，绑定环境、
可选 Config/namespace 白名单，明确过期（默认最多 90 天，可配置更短）并可随时吊销。
9443 同时校验 Token 与 mTLS 证书，支持范围内 Config 版本、Vault item/field/File
写入，以及继承范围的只读部署 Token/证书签发与吊销。全部写操作记录无值审计，包含
Token ID、操作、对象/字段、时间、来源 TCP IP；部署凭据与证书绑定，writer 吊销会级联。

• 令牌模型、签发、API、权限与轮换
• Token model, issuance, API, boundaries and rotation
• 完整中英文升级步骤 / Upgrade
• Go SDK v1.1.0 and operator example

Upgrade from v1.0.1 requires a maintenance window: stop all replicas/workers,
back up MySQL/ClickHouse and preserve the original Master Key. Start one new
Management replica first to migrate MySQL schema 2 → 3 and add ClickHouse
Audit source_ip/field_key; verify readiness/schema before starting other new
replicas and API. API now needs runtime database write privileges but does not
perform migrations. Configure signed IdP amr MFA evidence and log in again.
Existing read-only credentials remain compatible. Rollback requires restoring
the complete pre-upgrade backup and original key; mixed binaries or stripping
scope columns are unsupported.

升级必须安排维护窗口并备份，保留原 Master Key；先启动一个新版 Management 自动迁移
MySQL schema 2→3 和 ClickHouse 审计列，验证后再启动其余副本与 API。API 账号需要
运行时写权限，API 不执行迁移。配置 IdP 签名 amr MFA 并重新登录。旧只读凭据保留；
回退恢复完整升级前备份与原密钥，不能混跑旧版本或原地删除 scope 列。

Verification / 验证

• Server PR CI and
  SDK CI.
• Real MySQL 8.0.22/NATS/ClickHouse/HTTPS/mTLS E2E exercises scope 403s,
  expiry/revocation, retained history, audit metadata/redaction and the actual
  SDK operator uploading 17 secret File fields in both testing and production.
• The unchanged ten-minute Mac/Docker capacity gate passes with 600,000 /
  600,000 HTTP 200, 999.996 completed/s, p99 24.911 ms and all 615,002 Access
  Events captured/persisted, API limited to 2 CPUs / 512 MiB. Leakage scans
  pass. Three-node Kubernetes acceptance also passes.
• The bounded evidence record
  retains the earlier 34 local timeouts and hosted Linux warmup failure; this
  release does not claim new native Linux capacity acceptance or a deployment SLA.

Release source: 5bd686a23feeda93527b217a59e56811da888140;
server PR #14 and
SDK PR #3.
Runtime acceptance used d06c1851b163f431bf21e0382cd9cd04d2d130f2; the subsequent
commit changes only release/verification documentation.

Downloaded draft archives independently pass all four SHA256 checks, executable target/toolchain checks, complete runtime/module/UI license and source materials, and SBOM/inventory binding. Darwin bundles each contain 269 inventoried files / 120 components; Linux bundles each contain 271 files / 121 components. All BUILD records map to the release source above; native arm64 Configra and Kubernetes executables report v1.1.0 and that commit. Tagged release build also passes Linux binary execution. SDK v1.1.0 is independently downloaded through the official Go proxy/sumdb; its published module checksum is h1:d/vkzh9iVLGgOpLNuOEp0Z2z93p6B3txPZAjPQVzLrg=.

SHA256SUMS:

1ffb0decb2e24f313a063afe3c94bf7d98289bdcb6f5ed2df5134c9186cc4f6f  configra_1.1.0_darwin_amd64.tar.gz
6fb55e4db123bae6853a1e02b7717a54e5b1687d6d798d98d2cbb2868da735b6  configra_1.1.0_darwin_arm64.tar.gz
95b2621a32ec763cdf213e000a86c0662483fbd9765dbd23ada35ff8a7cfcf7a  configra_1.1.0_linux_amd64.tar.gz
8d8b091c4af851d8960c419e6acd8279d78b9731b649b82b34d9ca64fb401a64  configra_1.1.0_linux_arm64.tar.gz

Configra v1.0.1

Configra v1.0.1

Configra 的首个正式稳定版。用 JSON/YAML 引用 Vault 中的值，应用按 Environment 获取渲染结果，开发、测试、生产环境不需要更换字段名或引用。

下载与使用

• 提供 macOS、Linux 的 amd64 / arm64 包。每个包包含服务端、Kubernetes 工具、部署示例、许可证、SBOM 和文件清单；下载后先核对 SHA256SUMS。
• 中文入门 · 安装说明 · Go SDK v1.0.0
• Web UI 已嵌入程序。运行仍需 MySQL、NATS、ClickHouse、OIDC、证书和外部 Master Key；不是独立桌面应用。
• macOS 程序尚未经过 Apple 签名或公证。容器镜像请用标签中的 Dockerfile 构建，并推送到自己的 registry。

修复与升级注意

• 修复特殊环境名的 Token 授权显示、分页种子初始化、特殊 Vault 字段名导致的页面异常，补充回归测试。
• 加固 API 输入大小、请求／数据库超时、分页查询和故障状态码，继续支持 MySQL 8.0.22。
• 修复 Kubernetes 原生同步的并发覆盖和删除竞态、CSI 路径冲突、SDK 的可变快照共享问题。
• 提供只读恢复检查和离线 Master Key 轮换，验证失败回滚、丢失 COMMIT 响应、恢复后证书签发与吊销。
• 从 rc.2 升级时，自编 Management 客户端需要适配分页。机器读取接口与 SDK 调用方式不变。换钥需要维护窗口，不要直接替换原密钥。

为什么从 v1.0.1 发布

v1.0.0 只生成了草稿，未正式发布。最后复验发现测试把端口号 6380 误匹配到时间戳，并非配置泄漏。v1.0.1 将测试改为精确校验事件元数据，固定复现连续运行 50 次及原生 Linux／MySQL 8.0.22／SDK 完整集成通过。没有改写已有标签或下载包；SDK 已发布的 v1.0.0 保持不变。

验收范围

最终运行时代码在独立 4 vCPU Linux 主机上通过十分钟 1000 QPS 测试：600,000 次读取全部成功，P99 为 31.935 ms，API 限制为 2 CPU / 512 MiB。v1.0.1 与该次测试的运行时代码相同；之后只修改了测试和文档。

本机、独立 Linux、GitHub CI 均通过完整三节点 Kubernetes 演练，覆盖两种 provider、凭据/API/控制器/工作节点故障和离线换钥。Linux 三轮 API 滚动更新中，111 次不重试 mTLS 读取全部成功；随后标签级 Kubernetes 复验的 99 次读取也全部成功，该次任务整体失败来自上面已修正的测试误报。

51 项 UI 测试、Go 1.25.13/1.26.7 race/vet、可达漏洞扫描和六个 TLA+ 模型检查通过。完整验收记录保留了早期失败，包括一次缺少原始诊断、原因未能确认的 hosted provider 演练。后续同一运行时代码在三种环境完整通过，没有把旧失败改记为通过。

稳定版不代表每个部署都已验收。需验证自己的入口能透传 mTLS，并演练独立主机／可用区故障、备份恢复和实际容量。三节点测试仍共用一台宿主机，结果不是 SLA。

发布文件复核

• Source: b4afa48. Tagged build and final-commit CI pass.
• 四个实际 GitHub 下载包均通过 SHA-256、版本／源码／目标平台／工具链、SDK 固定版本、原始许可证与源文件／SBOM 对应关系和完整文件清单检查。macOS 包为 269 个文件／120 个组件，Linux 包为 271 个文件／121 个组件。
• macOS arm64 和 Linux amd64 原生运行两个程序的 --version 与 --help，均报告 v1.0.1 / b4afa48。另外两个目标完成交叉构建和文件验证，未宣称做过原生运行测试。
• 下载到的 Linux 服务端通过完整 OIDC／mTLS／服务故障／备份恢复／doctor／离线换钥／SDK／CA／Audit／泄漏扫描。测试只用临时容器承载该文件；这个容器不作为发布镜像分发。

All four actual GitHub downloads pass checksum, version/source/target/toolchain, SDK pin, notice/source/SBOM and complete-inventory checks. Both executables run natively on macOS arm64 and Linux amd64; the other targets are cross-built and metadata-verified. The downloaded Linux server also passes the full real-service, failure, encrypted-recovery and offline-rotation drill. Its disposable test wrapper is not a distributed container image.

中英文官网已通过部署检查，对应源码 c39dd1e：36 项测试通过，线上 26 个页面的桌面／手机布局、同页语言切换、代码复制和资源请求均通过。五个公开下载链接可匿名访问，公开校验和与已验证的下载包一致。

The bilingual website is deployed from c39dd1e. All 36 site checks pass, plus live-browser checks of 26 routes at desktop/mobile widths, same-page language switching, clipboard examples and resource requests. Anonymous checks confirm all five public download links and the matching checksum file.

---

English

Configra's first stable server release resolves JSON/YAML templates with Vault values for the requested Environment. Applications keep the same field names and references across development, testing and production.

Download the macOS or Linux amd64/arm64 archive and verify SHA256SUMS. Bundles include both executables, deployment examples, licenses, SBOM and an inventory. The UI is embedded; databases, OIDC, TLS and an external Master Key are still required. macOS executables are not Apple-signed/notarized. Build container images from the tagged Dockerfiles for your registry. The Go SDK is v1.0.0, not v1.0.1.

This release fixes UI and pagination regressions, API bounds and failure handling, Kubernetes synchronization/deletion races, CSI path validation and SDK snapshot isolation. It retains MySQL 8.0.22 compatibility and provides read-only recovery checks and offline Master Key rotation. Custom Management clients upgrading from rc.2 must follow pagination; machine reads and SDK calls are unchanged. Key rotation requires a maintenance window.

The server's v1.0.0 candidate was never published. Its last replay exposed a test matching port digits in a valid timestamp, not a data leak. v1.0.1 includes the corrected exact-metadata assertion. Fifty deterministic repetitions and full native Linux/MySQL/SDK integration pass; existing tags and checksums are unchanged.

The identical runtime passed 600,000 reads over ten minutes on a four-vCPU Linux host, with a two-CPU/512-MiB API limit and 31.935 ms p99 latency. Native Linux, Mac and hosted CI passed the full three-node Kubernetes provider/fault/recovery/rotation drill. Linux verified 111 no-retry mTLS reads across three API rollouts; a later tagged replay verified 99. An earlier hosted provider failure lacks sufficient diagnostics to identify its cause and remains in the record. Results are not an SLA: validate your ingress, independent-host failures, recovery procedures and capacity.

Getting started · Installation · Acceptance record

Configra v0.1.0-rc.2

Configra v0.1.0-rc.2

This preview replaces the withdrawn server rc.1. The repository starts from one
clean source snapshot without the old screenshot history. Public screenshots
remain on the website; the Go SDK keeps
its existing release tags and history.

Included

• YAML/JSON configuration, shared Vault values and per-environment versions.
• A Chinese/English management UI, with light and dark themes.
• Managed client CAs, encrypted signing-key storage, one-time private exports,
  client certificate issuance and revocation.
• Go SDK reads and both Kubernetes integrations: CSI-mounted files and native
  Secret/ConfigMap synchronization. Kubernetes pins the existing SDK rc.2.
• Authenticated mutation-rejection audit receipts and recovery of certificate
  audit events rejected by the earlier identifier-length check.
• A development-only MySQL native-AIO workaround, while retaining MySQL 8.0.22.
• Project, Go-runtime, dependency and UI license materials; covered MySQL driver
  source; aggregate SBOMs and per-file inventories in each binary bundle.

Downloads

Choose one archive for macOS or Linux, on amd64 or arm64, and download
SHA256SUMS to check it before extraction. Each archive contains both commands,
deployment examples, build metadata and the distribution materials above.
The optional review-records-2026-09-12.tar.gz is text-only historical evidence,
not required to install or run Configra. It has a separate checksum file.

macOS executables are not Apple-signed or notarized. No public container image
is supplied; build the included Dockerfiles and publish to your own registry.

Installation ·
English guide ·
Go SDK rc.2

Evaluation only

This is not a stable production release. Machine permissions cover a whole
Environment; human roles cover the whole workspace. The ten-minute 1000 QPS
gate, bounded backend inventories, key-rotation/recovery and final operational
acceptance remain open. Do not infer a production SLA from a successful build
or functional test. See production readiness.

Configra must not supply its own database credentials, Master Key or other
bootstrap secrets through its provider. Keep them external and separately backed up.

Existing checkouts

Main has new history. Keep any local changes and use a fresh clone in another
directory instead of forcing a pull over a working checkout. Server rc.1 has
been withdrawn; do not retag it or reuse its old artifacts as rc.2. SDK module
versions have not been rewritten.

Checks for this release

• Source: 11accd7ea7127a44110c6ef6397e2c44e7410c97. Release workflow passed Go race tests/vet, four-platform builds, archive verification and Linux amd64 command execution.
• All four CI-produced archives were downloaded and independently checked for checksums, target/source metadata, notice delivery, covered source, SBOMs and file inventories. Both macOS arm64 commands were executed from those downloaded archives.
• A fresh rc.2 source checkout passed local setup against MySQL 8.0.22, real OIDC login, managed CA/client issuance, Token creation, mTLS SDK reads, ETag 304 and missing-certificate rejection. Authenticated rejection receipts and recovered certificate Audit events were queried successfully. This protocol walkthrough is not final production-image or fault/soak acceptance.
• Kubernetes manifests rendered successfully; a new production-cluster installation and full backup/restore walkthrough were not performed for this documentation pass.

The optional review archive has its own .sha256 file. The four program archives retain the workflow-generated SHA256SUMS; their bytes have not been replaced.