diff --git a/blog/2026-06-11-v0.7.0-beta.5.md b/blog/2026-06-11-v0.7.0-beta.5.md index 70e14ec..f39ab50 100644 --- a/blog/2026-06-11-v0.7.0-beta.5.md +++ b/blog/2026-06-11-v0.7.0-beta.5.md @@ -4,56 +4,236 @@ title: Version 0.7.0-beta.5 Released tags: [releases] --- -Fifth beta of the 0.7.0 line. A maintenance beta focused on housekeeping: -a fresh dependency sweep across every repo, and a small backend -restructure that makes the release version actually flow into the -published OpenAPI schema (and from there, into the rendered API -reference and the generated SDKs). On top of beta.1–beta.4's OCI -registry support, local cluster mode, configurable database pool, -tunable deployment credentials, TLS provider fix, and bots-API -restoration. Still beta β€” exercise it in non-production first. +Fifth beta of the 0.7.0 line. beta.5 itself is a housekeeping release β€” a +dependency sweep across every +repo, a backend restructure that makes the release version flow into the +published OpenAPI schema, and a documentation overhaul. The rest of this +post is the cumulative changelog for the whole 0.7.0 cycle so far: OCI +registry discovery, local cluster mode, a configurable database pool, +tunable deployment credentials, a TLS crash fix, the restored bots API, +and a new Python SDK. Still beta β€” exercise it in non-production first. {/* truncate */} -## Dependency Refresh 🧹 +## 🧹 Dependency Refresh -Every source repo had its third-party deps refreshed β€” Cargo -lockfiles, npm patches, and GitHub Actions versions normalized across -the org (`actions/checkout` β†’ v6, `docker/build-push-action` β†’ v7, +Every source repo had its third-party dependencies refreshed β€” Cargo +lockfiles, npm patches, and GitHub Actions versions normalized across the +org (`actions/checkout` β†’ v6, `docker/build-push-action` β†’ v7, `docker/login-action` β†’ v4, `docker/setup-buildx-action` β†’ v4). No external behavior change, but the images now build against current upstreams. -## OpenAPI Version Actually Tracks the Release 🏷️ +## 🏷️ OpenAPI Version Now Tracks the Release -Backend's workspace member crates now inherit their version from a -single `[workspace.package].version` key, instead of each crate -hard-coding `0.1.0`. That stale `0.1.0` was exactly what `utoipa` read -for the OpenAPI `info.version`, so every prior release's published -`openapi.yaml` claimed `0.1.0` regardless of the tag. From beta.5 -onwards, the schema advertises the real release version, which means -the [API reference](/api) rendered on this site and the generated -[Python](/docs/api/sdks/python) and [Rust](/docs/api/sdks/rust) -SDKs all carry the matching version. +Backend's workspace member crates now inherit their version from a single +`[workspace.package].version` key, instead of each crate hard-coding +`0.1.0`. That stale `0.1.0` was exactly what `utoipa` read for the OpenAPI +`info.version`, so every prior release's published `openapi.yaml` claimed +`0.1.0` regardless of the tag. From beta.5 onwards the schema advertises +the real release version, which means the [API reference](/api) rendered +on this site and the generated [Python](/docs/api/sdks/python) and +[Rust](/docs/api/sdks/rust) SDKs all carry the matching version. -## Documentation Improvements πŸ“š +## πŸ“š Documentation Overhaul -A round of cleanups and additions on this site: +A large round of additions and corrections on this site: - **Interactive API reference at [/api](/api)**, rendered from the - backend's OpenAPI schema (Redoc) instead of a hand-maintained + backend's OpenAPI schema with Redoc instead of a hand-maintained endpoint table that was bound to drift. - **New install guides** under [Installation](/docs/guide/install/helm): single EKS, multi-EKS - (control + deployment clusters), multi-account (cross-account IRSA - federation), and a security-considerations page. + (control cluster managing deployment clusters), multiple AWS accounts + (cross-account IRSA federation), and a security-considerations page. - **Fixed long-standing inaccuracies** in the Terraform module docs - (submodule layout, cross-account trust model), the bot - permission/audit model, the admin-email wiring, and several Postgres - connection claims. + (submodule layout, the cross-account trust model), the bot + permission/audit model, the admin-email wiring, the Postgres + connection/TLS claims, and the chart-extension status refresh floor. -## What's Next +## πŸ”’ TLS Crypto Provider Fix -The 0.7.0 stable cut is on the horizon β€” please surface any beta -regressions on -[GitHub Issues](https://github.com/platzio/backend/issues) before then. +With both `aws-lc-rs` and `ring` linked into rustls 0.23, neither was the +process default, so the first outbound TLS handshake panicked. `api`, +`chart-discovery`, and `status-updates` now install the `aws-lc-rs` +provider explicitly at startup, so HTTPS to registries, AWS, and OIDC +providers works reliably. + +Thanks to [@ben-schreiber](https://github.com/ben-schreiber) for this +contribution! + +## πŸ€– Bots API: Create and Delete Restored + +The bots collection exposed only list/get/update in its OpenAPI schema β€” +the `POST /bots` (`createBot`) and `DELETE /bots/{id}` (`deleteBot`) +operations, and the `NewBot` request body, were missing from the +generated schema and therefore from every generated SDK. The collection +now registers the full set, so `NewBot`, `createBot`, and `deleteBot` are +back in the OpenAPI document and the SDKs. + +## 🐍 Python SDK + +There's a Python SDK, published to PyPI as +[`platz`](https://pypi.org/project/platz/). Like the JavaScript SDK it's +generated from the backend's OpenAPI schema and versioned to match the +backend. Betas install with the pre-release flag: + +```bash +pip install --pre platz +``` + +## πŸ”‘ Tunable Deployment Credentials + +`k8s-agent` previously hard-coded the deployment credentials refresh +cadence to a fraction of a fixed token lifetime. Both numbers are now +operator-tunable via humantime durations: + +- `PLATZ_DEPLOYMENT_CREDENTIALS_REFRESH_INTERVAL` β€” how often to refresh + per-deployment credentials. Default `20m`. +- `PLATZ_DEPLOYMENT_CREDENTIALS_TOKEN_DURATION` β€” lifetime of issued + deployment credential tokens. Default `1h`. + +Both surface through the helm chart as per-instance values: + +```yaml +k8sAgent: + instances: + - name: default + deploymentCredentialsRefreshInterval: 30m + deploymentCredentialsTokenDuration: 2h +``` + +The refresh loop also no longer aborts the whole batch on the first +deployment that fails to apply a credential β€” remaining deployments in +the same chunk now get their refresh attempt, and the error is propagated +after the chunk completes. + +Thanks to [@ben-schreiber](https://github.com/ben-schreiber) for this +contribution! + +## πŸ“¦ OCI Registry Discovery + +`chart-discovery` can poll a generic OCI registry instead of listening for +ECR push events. Set `provider: oci` on a chart-discovery instance and +point `oci.registryUrl` at a Docker Distribution, zot, ghcr.io, or any +other registry that speaks the OCI distribution spec. + +The poller walks the registry's `/v2/_catalog` and per-repo tag listings, +filters to helm-config-media-type artifacts, pulls each chart with +`helm pull`, and records it the same way the ECR provider does. ECR +continues to be the default, and existing deployments need no changes. + +```yaml +chartDiscovery: + instances: + - name: default + provider: oci + oci: + registryUrl: "http://registry.platz.svc.cluster.local:5000" + pollInterval: 5s +``` + +The `helm_registries` table gained a `provider` column to record which +backend a registry came from. The Helm pod's bootstrap script now skips +`aws ecr get-login-password` for non-ECR registries β€” they're expected to +be anonymously readable from the cluster running the pod. + +## 🏠 Local Cluster Provider Mode + +`k8s-agent` can register a single cluster from a kubeconfig context instead +of scanning AWS for EKS clusters. Set `provider: local` on a k8s-agent +instance and optionally pin a `localContext`; the agent derives a synthetic +`local:` provider ID and writes a row through the same code path EKS +discovery uses. + +This unblocks running Platz outside AWS, and is what powers the +single-command local dev stack in `platzio/dev`. + +```yaml +k8sAgent: + instances: + - name: default + provider: local + localContext: kind-platz + disableDeploymentCredentials: true +``` + +`PLATZ_DISABLE_DEPLOYMENT_CREDENTIALS` is readable from the environment in +addition to the CLI flag, so the chart values can flip it on without a +custom command line. + +## 🏊 Configurable Database Connection Pool + +Every Platz pod that opens the database can have its connection pool tuned +via environment variables β€” `DB_POOL_MAX_SIZE` (default 50), +`DB_POOL_MIN_IDLE`, `DB_POOL_CONNECTION_TIMEOUT_SECS` (default 30), +`DB_POOL_IDLE_TIMEOUT_SECS` (default 600), and `DB_POOL_MAX_LIFETIME_SECS` +(default 1800). Database pool exhaustion is now handled as a graceful error +rather than a panic. + +Surfaced through the helm chart under `database.pool` and the Terraform +module's `database_pool` variable: + +```hcl +module "platz" { + source = "github.com/platzio/terraform-aws-platzio//modules/main?ref=v0.7.0-beta.5" + # ... + database_pool = { + max_size = 200 + connection_timeout_secs = 10 + } +} +``` + +Thanks to [@joshimi](https://github.com/joshimi) for this contribution! + +## ⚑ Build and Release Pipeline + +The backend Dockerfile was rewritten around +[cargo-chef](https://github.com/LukeMathWalker/cargo-chef) with +per-architecture musl static builds, and the release workflow now uses +per-arch native runners instead of QEMU. End-to-end backend release time +dropped from ~50 minutes to ~20. CI is split into separate test, build, and +release workflows, with image builds running in parallel with tests and the +release gated on tests passing. + +The Dockerfile also gained a `dev` target stage so the same Dockerfile +serves local dev and release builds, matching how the helm chart and +terraform module already work. The frontend Dockerfile builds `dist/` in +its own multi-stage, multi-arch build, removing the implicit dependency on +a pre-built artifact and matching the backend's release pattern. + +## πŸ› οΈ Local Dev Lives in `platzio/dev` + +The old `docker-compose.yaml`, `scripts/run-api.sh`, `scripts/run-db.sh`, +`scripts/run-oidc.sh`, and `scripts/container-build.sh` have been removed +from the backend repo. Local development now lives in +[platzio/dev](https://github.com/platzio/dev), which orchestrates the full +stack via Tilt against a `kind` cluster running k8s-agent in local provider +mode and chart-discovery against a Docker Distribution registry. + +## 🧰 SDKs + +All three SDKs are published at `0.7.0-beta.5`, regenerated against this +release's OpenAPI schema: + +- `platz-sdk` ([crates.io](https://crates.io/crates/platz-sdk)) β€” Rust. +- `@platzio/sdk` ([npm](https://www.npmjs.com/package/@platzio/sdk)) β€” + TypeScript. +- `platz` ([PyPI](https://pypi.org/project/platz/)) β€” Python. PyPI + normalizes the version to `0.7.0b5`; install betas with + `pip install --pre platz`. + +The Rust SDK's `HelmRegistry` carries the `provider` field, and the +collections that had drifted out of it β€” `bots`, `bot_tokens`, +`deployment_permissions`, `env_user_permissions`, `helm_tag_formats` β€” +remain exposed. + +## ⎈ Helm Chart + +Images bumped to `v0.7.0-beta.5` (backend and frontend; the helm base image +stays at `v9`). The chart is published with `artifacthub.io/prerelease: true`, +so ArtifactHub flags it as a pre-release. Every Rust pod (`api`, +`chart-discovery`, `k8s-agent`, `resource-sync`, `status-updates`) honors a +per-pod `extraEnv` list for injecting arbitrary env vars without forking the +chart, and `resource-sync` correctly honors `resourceSync.replicaCount`.