From beb4c3a36f00646b0043458c93cd5931e06da607 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 13 Jun 2026 11:49:20 +0000 Subject: [PATCH 1/3] Rewrite v0.7.0-beta.5 release notes as full cycle changelog MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The beta.5 post collapsed the entire beta.1-beta.4 feature set into a single intro sentence and only detailed its own delta — unlike every other 0.7.0 beta post, which carries the whole cycle's notes forward from the last stable (v0.6.8) per the release-version skill's 'release notes accumulate across the beta cycle' rule. Rewrote it as the cumulative changelog (OCI registry discovery, local cluster mode, configurable DB pool, tunable deployment credentials, TLS fix, restored bots API, Python SDK) plus beta.5's own items (dependency refresh, OpenAPI version alignment, docs overhaul), and moved the section-heading emojis to the start of each heading line. --- blog/2026-06-11-v0.7.0-beta.5.md | 248 +++++++++++++++++++++++++++---- 1 file changed, 217 insertions(+), 31 deletions(-) diff --git a/blog/2026-06-11-v0.7.0-beta.5.md b/blog/2026-06-11-v0.7.0-beta.5.md index 70e14ec..10e3b0a 100644 --- a/blog/2026-06-11-v0.7.0-beta.5.md +++ b/blog/2026-06-11-v0.7.0-beta.5.md @@ -4,55 +4,241 @@ title: Version 0.7.0-beta.5 Released tags: [releases] --- -Fifth beta of the 0.7.0 line. A maintenance beta focused on housekeeping: -a fresh dependency sweep across every repo, and a small backend -restructure that makes the release version actually flow into the -published OpenAPI schema (and from there, into the rendered API -reference and the generated SDKs). On top of beta.1–beta.4's OCI -registry support, local cluster mode, configurable database pool, -tunable deployment credentials, TLS provider fix, and bots-API -restoration. Still beta — exercise it in non-production first. +Fifth beta of the 0.7.0 line, and likely the last before the stable cut. +beta.5 itself is a housekeeping release — a dependency sweep across every +repo, a backend restructure that makes the release version flow into the +published OpenAPI schema, and a documentation overhaul. The rest of this +post is the cumulative changelog for the whole 0.7.0 cycle so far: OCI +registry discovery, local cluster mode, a configurable database pool, +tunable deployment credentials, a TLS crash fix, the restored bots API, +and a new Python SDK. Still beta — exercise it in non-production first. {/* truncate */} -## Dependency Refresh 🧹 +## 🧹 Dependency Refresh -Every source repo had its third-party deps refreshed — Cargo -lockfiles, npm patches, and GitHub Actions versions normalized across -the org (`actions/checkout` → v6, `docker/build-push-action` → v7, +Every source repo had its third-party dependencies refreshed — Cargo +lockfiles, npm patches, and GitHub Actions versions normalized across the +org (`actions/checkout` → v6, `docker/build-push-action` → v7, `docker/login-action` → v4, `docker/setup-buildx-action` → v4). No external behavior change, but the images now build against current upstreams. -## OpenAPI Version Actually Tracks the Release 🏷️ +## 🏷️ OpenAPI Version Now Tracks the Release -Backend's workspace member crates now inherit their version from a -single `[workspace.package].version` key, instead of each crate -hard-coding `0.1.0`. That stale `0.1.0` was exactly what `utoipa` read -for the OpenAPI `info.version`, so every prior release's published -`openapi.yaml` claimed `0.1.0` regardless of the tag. From beta.5 -onwards, the schema advertises the real release version, which means -the [API reference](/api) rendered on this site and the generated -[Python](/docs/api/sdks/python) and [Rust](/docs/api/sdks/rust) -SDKs all carry the matching version. +Backend's workspace member crates now inherit their version from a single +`[workspace.package].version` key, instead of each crate hard-coding +`0.1.0`. That stale `0.1.0` was exactly what `utoipa` read for the OpenAPI +`info.version`, so every prior release's published `openapi.yaml` claimed +`0.1.0` regardless of the tag. From beta.5 onwards the schema advertises +the real release version, which means the [API reference](/api) rendered +on this site and the generated [Python](/docs/api/sdks/python) and +[Rust](/docs/api/sdks/rust) SDKs all carry the matching version. -## Documentation Improvements 📚 +## 📚 Documentation Overhaul -A round of cleanups and additions on this site: +A large round of additions and corrections on this site: - **Interactive API reference at [/api](/api)**, rendered from the - backend's OpenAPI schema (Redoc) instead of a hand-maintained + backend's OpenAPI schema with Redoc instead of a hand-maintained endpoint table that was bound to drift. - **New install guides** under [Installation](/docs/guide/install/helm): single EKS, multi-EKS - (control + deployment clusters), multi-account (cross-account IRSA - federation), and a security-considerations page. + (control cluster managing deployment clusters), multiple AWS accounts + (cross-account IRSA federation), and a security-considerations page. - **Fixed long-standing inaccuracies** in the Terraform module docs - (submodule layout, cross-account trust model), the bot - permission/audit model, the admin-email wiring, and several Postgres - connection claims. + (submodule layout, the cross-account trust model), the bot + permission/audit model, the admin-email wiring, the Postgres + connection/TLS claims, and the chart-extension status refresh floor. -## What's Next +## 🔒 TLS Crypto Provider Fix + +With both `aws-lc-rs` and `ring` linked into rustls 0.23, neither was the +process default, so the first outbound TLS handshake panicked. `api`, +`chart-discovery`, and `status-updates` now install the `aws-lc-rs` +provider explicitly at startup, so HTTPS to registries, AWS, and OIDC +providers works reliably. + +Thanks to [@ben-schreiber](https://github.com/ben-schreiber) for this +contribution! + +## 🤖 Bots API: Create and Delete Restored + +The bots collection exposed only list/get/update in its OpenAPI schema — +the `POST /bots` (`createBot`) and `DELETE /bots/{id}` (`deleteBot`) +operations, and the `NewBot` request body, were missing from the +generated schema and therefore from every generated SDK. The collection +now registers the full set, so `NewBot`, `createBot`, and `deleteBot` are +back in the OpenAPI document and the SDKs. + +## 🐍 Python SDK + +There's a Python SDK, published to PyPI as +[`platz`](https://pypi.org/project/platz/). Like the JavaScript SDK it's +generated from the backend's OpenAPI schema and versioned to match the +backend. Betas install with the pre-release flag: + +```bash +pip install --pre platz +``` + +## 🔑 Tunable Deployment Credentials + +`k8s-agent` previously hard-coded the deployment credentials refresh +cadence to a fraction of a fixed token lifetime. Both numbers are now +operator-tunable via humantime durations: + +- `PLATZ_DEPLOYMENT_CREDENTIALS_REFRESH_INTERVAL` — how often to refresh + per-deployment credentials. Default `20m`. +- `PLATZ_DEPLOYMENT_CREDENTIALS_TOKEN_DURATION` — lifetime of issued + deployment credential tokens. Default `1h`. + +Both surface through the helm chart as per-instance values: + +```yaml +k8sAgent: + instances: + - name: default + deploymentCredentialsRefreshInterval: 30m + deploymentCredentialsTokenDuration: 2h +``` + +The refresh loop also no longer aborts the whole batch on the first +deployment that fails to apply a credential — remaining deployments in +the same chunk now get their refresh attempt, and the error is propagated +after the chunk completes. + +Thanks to [@ben-schreiber](https://github.com/ben-schreiber) for this +contribution! + +## 📦 OCI Registry Discovery + +`chart-discovery` can poll a generic OCI registry instead of listening for +ECR push events. Set `provider: oci` on a chart-discovery instance and +point `oci.registryUrl` at a Docker Distribution, zot, ghcr.io, or any +other registry that speaks the OCI distribution spec. + +The poller walks the registry's `/v2/_catalog` and per-repo tag listings, +filters to helm-config-media-type artifacts, pulls each chart with +`helm pull`, and records it the same way the ECR provider does. ECR +continues to be the default, and existing deployments need no changes. + +```yaml +chartDiscovery: + instances: + - name: default + provider: oci + oci: + registryUrl: "http://registry.platz.svc.cluster.local:5000" + pollInterval: 5s +``` + +The `helm_registries` table gained a `provider` column to record which +backend a registry came from. The Helm pod's bootstrap script now skips +`aws ecr get-login-password` for non-ECR registries — they're expected to +be anonymously readable from the cluster running the pod. + +## 🏠 Local Cluster Provider Mode + +`k8s-agent` can register a single cluster from a kubeconfig context instead +of scanning AWS for EKS clusters. Set `provider: local` on a k8s-agent +instance and optionally pin a `localContext`; the agent derives a synthetic +`local:` provider ID and writes a row through the same code path EKS +discovery uses. + +This unblocks running Platz outside AWS, and is what powers the +single-command local dev stack in `platzio/dev`. + +```yaml +k8sAgent: + instances: + - name: default + provider: local + localContext: kind-platz + disableDeploymentCredentials: true +``` + +`PLATZ_DISABLE_DEPLOYMENT_CREDENTIALS` is readable from the environment in +addition to the CLI flag, so the chart values can flip it on without a +custom command line. + +## 🏊 Configurable Database Connection Pool + +Every Platz pod that opens the database can have its connection pool tuned +via environment variables — `DB_POOL_MAX_SIZE` (default 50), +`DB_POOL_MIN_IDLE`, `DB_POOL_CONNECTION_TIMEOUT_SECS` (default 30), +`DB_POOL_IDLE_TIMEOUT_SECS` (default 600), and `DB_POOL_MAX_LIFETIME_SECS` +(default 1800). Database pool exhaustion is now handled as a graceful error +rather than a panic. + +Surfaced through the helm chart under `database.pool` and the Terraform +module's `database_pool` variable: + +```hcl +module "platz" { + source = "github.com/platzio/terraform-aws-platzio//modules/main?ref=v0.7.0-beta.5" + # ... + database_pool = { + max_size = 200 + connection_timeout_secs = 10 + } +} +``` + +Thanks to [@joshimi](https://github.com/joshimi) for this contribution! + +## ⚡ Build and Release Pipeline + +The backend Dockerfile was rewritten around +[cargo-chef](https://github.com/LukeMathWalker/cargo-chef) with +per-architecture musl static builds, and the release workflow now uses +per-arch native runners instead of QEMU. End-to-end backend release time +dropped from ~50 minutes to ~20. CI is split into separate test, build, and +release workflows, with image builds running in parallel with tests and the +release gated on tests passing. + +The Dockerfile also gained a `dev` target stage so the same Dockerfile +serves local dev and release builds, matching how the helm chart and +terraform module already work. The frontend Dockerfile builds `dist/` in +its own multi-stage, multi-arch build, removing the implicit dependency on +a pre-built artifact and matching the backend's release pattern. + +## 🛠️ Local Dev Lives in `platzio/dev` + +The old `docker-compose.yaml`, `scripts/run-api.sh`, `scripts/run-db.sh`, +`scripts/run-oidc.sh`, and `scripts/container-build.sh` have been removed +from the backend repo. Local development now lives in +[platzio/dev](https://github.com/platzio/dev), which orchestrates the full +stack via Tilt against a `kind` cluster running k8s-agent in local provider +mode and chart-discovery against a Docker Distribution registry. + +## 🧰 SDKs + +All three SDKs are published at `0.7.0-beta.5`, regenerated against this +release's OpenAPI schema: + +- `platz-sdk` ([crates.io](https://crates.io/crates/platz-sdk)) — Rust. +- `@platzio/sdk` ([npm](https://www.npmjs.com/package/@platzio/sdk)) — + TypeScript. +- `platz` ([PyPI](https://pypi.org/project/platz/)) — Python. PyPI + normalizes the version to `0.7.0b5`; install betas with + `pip install --pre platz`. + +The Rust SDK's `HelmRegistry` carries the `provider` field, and the +collections that had drifted out of it — `bots`, `bot_tokens`, +`deployment_permissions`, `env_user_permissions`, `helm_tag_formats` — +remain exposed. + +## ⎈ Helm Chart + +Images bumped to `v0.7.0-beta.5` (backend and frontend; the helm base image +stays at `v9`). The chart is published with `artifacthub.io/prerelease: true`, +so ArtifactHub flags it as a pre-release. Every Rust pod (`api`, +`chart-discovery`, `k8s-agent`, `resource-sync`, `status-updates`) honors a +per-pod `extraEnv` list for injecting arbitrary env vars without forking the +chart, and `resource-sync` correctly honors `resourceSync.replicaCount`. + +## 🚀 What's Next The 0.7.0 stable cut is on the horizon — please surface any beta regressions on From ba27205f82a4914d91c4074177cbedbf80bf30e7 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 13 Jun 2026 11:55:24 +0000 Subject: [PATCH 2/3] Drop speculative 'likely the last' wording from beta.5 intro --- blog/2026-06-11-v0.7.0-beta.5.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/blog/2026-06-11-v0.7.0-beta.5.md b/blog/2026-06-11-v0.7.0-beta.5.md index 10e3b0a..9dcb371 100644 --- a/blog/2026-06-11-v0.7.0-beta.5.md +++ b/blog/2026-06-11-v0.7.0-beta.5.md @@ -4,8 +4,8 @@ title: Version 0.7.0-beta.5 Released tags: [releases] --- -Fifth beta of the 0.7.0 line, and likely the last before the stable cut. -beta.5 itself is a housekeeping release — a dependency sweep across every +Fifth beta of the 0.7.0 line. beta.5 itself is a housekeeping release — a +dependency sweep across every repo, a backend restructure that makes the release version flow into the published OpenAPI schema, and a documentation overhaul. The rest of this post is the cumulative changelog for the whole 0.7.0 cycle so far: OCI From fda5673a07a754a63afad32a0293a09827458720 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 13 Jun 2026 11:57:04 +0000 Subject: [PATCH 3/3] Drop forward-looking 'What's Next' section from beta.5 notes --- blog/2026-06-11-v0.7.0-beta.5.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/blog/2026-06-11-v0.7.0-beta.5.md b/blog/2026-06-11-v0.7.0-beta.5.md index 9dcb371..f39ab50 100644 --- a/blog/2026-06-11-v0.7.0-beta.5.md +++ b/blog/2026-06-11-v0.7.0-beta.5.md @@ -237,9 +237,3 @@ so ArtifactHub flags it as a pre-release. Every Rust pod (`api`, `chart-discovery`, `k8s-agent`, `resource-sync`, `status-updates`) honors a per-pod `extraEnv` list for injecting arbitrary env vars without forking the chart, and `resource-sync` correctly honors `resourceSync.replicaCount`. - -## 🚀 What's Next - -The 0.7.0 stable cut is on the horizon — please surface any beta -regressions on -[GitHub Issues](https://github.com/platzio/backend/issues) before then.