platzio · popen2 · Jun 13, 2026 · Jun 13, 2026 · Jun 13, 2026 · Jun 13, 2026
diff --git a/blog/2026-06-11-v0.7.0-beta.5.md b/blog/2026-06-11-v0.7.0-beta.5.md
@@ -4,56 +4,236 @@ title: Version 0.7.0-beta.5 Released
 tags: [releases]
 ---
 
-Fifth beta of the 0.7.0 line. A maintenance beta focused on housekeeping:
-a fresh dependency sweep across every repo, and a small backend
-restructure that makes the release version actually flow into the
-published OpenAPI schema (and from there, into the rendered API
-reference and the generated SDKs). On top of beta.1–beta.4's OCI
-registry support, local cluster mode, configurable database pool,
-tunable deployment credentials, TLS provider fix, and bots-API
-restoration. Still beta — exercise it in non-production first.
+Fifth beta of the 0.7.0 line. beta.5 itself is a housekeeping release — a
+dependency sweep across every
+repo, a backend restructure that makes the release version flow into the
+published OpenAPI schema, and a documentation overhaul. The rest of this
+post is the cumulative changelog for the whole 0.7.0 cycle so far: OCI
+registry discovery, local cluster mode, a configurable database pool,
+tunable deployment credentials, a TLS crash fix, the restored bots API,
+and a new Python SDK. Still beta — exercise it in non-production first.
 
 {/* truncate */}
 
-## Dependency Refresh 🧹
+## 🧹 Dependency Refresh
 
-Every source repo had its third-party deps refreshed — Cargo
-lockfiles, npm patches, and GitHub Actions versions normalized across
-the org (`actions/checkout` → v6, `docker/build-push-action` → v7,
+Every source repo had its third-party dependencies refreshed — Cargo
+lockfiles, npm patches, and GitHub Actions versions normalized across the
+org (`actions/checkout` → v6, `docker/build-push-action` → v7,
 `docker/login-action` → v4, `docker/setup-buildx-action` → v4). No
 external behavior change, but the images now build against current
 upstreams.
 
-## OpenAPI Version Actually Tracks the Release 🏷️
+## 🏷️ OpenAPI Version Now Tracks the Release
 
-Backend's workspace member crates now inherit their version from a
-single `[workspace.package].version` key, instead of each crate
-hard-coding `0.1.0`. That stale `0.1.0` was exactly what `utoipa` read
-for the OpenAPI `info.version`, so every prior release's published
-`openapi.yaml` claimed `0.1.0` regardless of the tag. From beta.5
-onwards, the schema advertises the real release version, which means
-the [API reference](/api) rendered on this site and the generated
-[Python](/docs/api/sdks/python) and [Rust](/docs/api/sdks/rust)
-SDKs all carry the matching version.
+Backend's workspace member crates now inherit their version from a single
+`[workspace.package].version` key, instead of each crate hard-coding
+`0.1.0`. That stale `0.1.0` was exactly what `utoipa` read for the OpenAPI
+`info.version`, so every prior release's published `openapi.yaml` claimed
+`0.1.0` regardless of the tag. From beta.5 onwards the schema advertises
+the real release version, which means the [API reference](/api) rendered
+on this site and the generated [Python](/docs/api/sdks/python) and
+[Rust](/docs/api/sdks/rust) SDKs all carry the matching version.
 
-## Documentation Improvements 📚
+## 📚 Documentation Overhaul
 
-A round of cleanups and additions on this site:
+A large round of additions and corrections on this site:
 
 - **Interactive API reference at [/api](/api)**, rendered from the
-  backend's OpenAPI schema (Redoc) instead of a hand-maintained
+  backend's OpenAPI schema with Redoc instead of a hand-maintained
   endpoint table that was bound to drift.
 - **New install guides** under
   [Installation](/docs/guide/install/helm): single EKS, multi-EKS
-  (control + deployment clusters), multi-account (cross-account IRSA
-  federation), and a security-considerations page.
+  (control cluster managing deployment clusters), multiple AWS accounts
+  (cross-account IRSA federation), and a security-considerations page.
 - **Fixed long-standing inaccuracies** in the Terraform module docs
-  (submodule layout, cross-account trust model), the bot
-  permission/audit model, the admin-email wiring, and several Postgres
-  connection claims.
+  (submodule layout, the cross-account trust model), the bot
+  permission/audit model, the admin-email wiring, the Postgres
+  connection/TLS claims, and the chart-extension status refresh floor.
 
-## What's Next
+## 🔒 TLS Crypto Provider Fix
 
-The 0.7.0 stable cut is on the horizon — please surface any beta
-regressions on
-[GitHub Issues](https://github.com/platzio/backend/issues) before then.
+With both `aws-lc-rs` and `ring` linked into rustls 0.23, neither was the
+process default, so the first outbound TLS handshake panicked. `api`,
+`chart-discovery`, and `status-updates` now install the `aws-lc-rs`
+provider explicitly at startup, so HTTPS to registries, AWS, and OIDC
+providers works reliably.
+
+Thanks to [@ben-schreiber](https://github.com/ben-schreiber) for this
+contribution!
+
+## 🤖 Bots API: Create and Delete Restored
+
+The bots collection exposed only list/get/update in its OpenAPI schema —
+the `POST /bots` (`createBot`) and `DELETE /bots/{id}` (`deleteBot`)
+operations, and the `NewBot` request body, were missing from the
+generated schema and therefore from every generated SDK. The collection
+now registers the full set, so `NewBot`, `createBot`, and `deleteBot` are
+back in the OpenAPI document and the SDKs.
+
+## 🐍 Python SDK
+
+There's a Python SDK, published to PyPI as
+[`platz`](https://pypi.org/project/platz/). Like the JavaScript SDK it's
+generated from the backend's OpenAPI schema and versioned to match the
+backend. Betas install with the pre-release flag:
+
+```bash
+pip install --pre platz
+```
+
+## 🔑 Tunable Deployment Credentials
+
+`k8s-agent` previously hard-coded the deployment credentials refresh
+cadence to a fraction of a fixed token lifetime. Both numbers are now
+operator-tunable via humantime durations:
+
+- `PLATZ_DEPLOYMENT_CREDENTIALS_REFRESH_INTERVAL` — how often to refresh
+  per-deployment credentials. Default `20m`.
+- `PLATZ_DEPLOYMENT_CREDENTIALS_TOKEN_DURATION` — lifetime of issued
+  deployment credential tokens. Default `1h`.
+
+Both surface through the helm chart as per-instance values:
+
+```yaml
+k8sAgent:
+  instances:
+    - name: default
+      deploymentCredentialsRefreshInterval: 30m
+      deploymentCredentialsTokenDuration: 2h
+```
+
+The refresh loop also no longer aborts the whole batch on the first
+deployment that fails to apply a credential — remaining deployments in
+the same chunk now get their refresh attempt, and the error is propagated
+after the chunk completes.
+
+Thanks to [@ben-schreiber](https://github.com/ben-schreiber) for this
+contribution!
+
+## 📦 OCI Registry Discovery
+
+`chart-discovery` can poll a generic OCI registry instead of listening for
+ECR push events. Set `provider: oci` on a chart-discovery instance and
+point `oci.registryUrl` at a Docker Distribution, zot, ghcr.io, or any
+other registry that speaks the OCI distribution spec.
+
+The poller walks the registry's `/v2/_catalog` and per-repo tag listings,
+filters to helm-config-media-type artifacts, pulls each chart with
+`helm pull`, and records it the same way the ECR provider does. ECR
+continues to be the default, and existing deployments need no changes.
+
+```yaml
+chartDiscovery:
+  instances:
+    - name: default
+      provider: oci
+      oci:
+        registryUrl: "http://registry.platz.svc.cluster.local:5000"
+        pollInterval: 5s
+```
+
+The `helm_registries` table gained a `provider` column to record which
+backend a registry came from. The Helm pod's bootstrap script now skips
+`aws ecr get-login-password` for non-ECR registries — they're expected to
+be anonymously readable from the cluster running the pod.
+
+## 🏠 Local Cluster Provider Mode
+
+`k8s-agent` can register a single cluster from a kubeconfig context instead
+of scanning AWS for EKS clusters. Set `provider: local` on a k8s-agent
+instance and optionally pin a `localContext`; the agent derives a synthetic
+`local:<ctx>` provider ID and writes a row through the same code path EKS
+discovery uses.
+
+This unblocks running Platz outside AWS, and is what powers the
+single-command local dev stack in `platzio/dev`.
+
+```yaml
+k8sAgent:
+  instances:
+    - name: default
+      provider: local
+      localContext: kind-platz
+      disableDeploymentCredentials: true
+```
+
+`PLATZ_DISABLE_DEPLOYMENT_CREDENTIALS` is readable from the environment in
+addition to the CLI flag, so the chart values can flip it on without a
+custom command line.
+
+## 🏊 Configurable Database Connection Pool
+
+Every Platz pod that opens the database can have its connection pool tuned
+via environment variables — `DB_POOL_MAX_SIZE` (default 50),
+`DB_POOL_MIN_IDLE`, `DB_POOL_CONNECTION_TIMEOUT_SECS` (default 30),
+`DB_POOL_IDLE_TIMEOUT_SECS` (default 600), and `DB_POOL_MAX_LIFETIME_SECS`
+(default 1800). Database pool exhaustion is now handled as a graceful error
+rather than a panic.
+
+Surfaced through the helm chart under `database.pool` and the Terraform
+module's `database_pool` variable:
+
+```hcl
+module "platz" {
+  source = "github.com/platzio/terraform-aws-platzio//modules/main?ref=v0.7.0-beta.5"
+  # ...
+  database_pool = {
+    max_size                = 200
+    connection_timeout_secs = 10
+  }
+}
+```
+
+Thanks to [@joshimi](https://github.com/joshimi) for this contribution!
+
+## ⚡ Build and Release Pipeline
+
+The backend Dockerfile was rewritten around
+[cargo-chef](https://github.com/LukeMathWalker/cargo-chef) with
+per-architecture musl static builds, and the release workflow now uses
+per-arch native runners instead of QEMU. End-to-end backend release time
+dropped from ~50 minutes to ~20. CI is split into separate test, build, and
+release workflows, with image builds running in parallel with tests and the
+release gated on tests passing.
+
+The Dockerfile also gained a `dev` target stage so the same Dockerfile
+serves local dev and release builds, matching how the helm chart and
+terraform module already work. The frontend Dockerfile builds `dist/` in
+its own multi-stage, multi-arch build, removing the implicit dependency on
+a pre-built artifact and matching the backend's release pattern.
+
+## 🛠️ Local Dev Lives in `platzio/dev`
+
+The old `docker-compose.yaml`, `scripts/run-api.sh`, `scripts/run-db.sh`,
+`scripts/run-oidc.sh`, and `scripts/container-build.sh` have been removed
+from the backend repo. Local development now lives in
+[platzio/dev](https://github.com/platzio/dev), which orchestrates the full
+stack via Tilt against a `kind` cluster running k8s-agent in local provider
+mode and chart-discovery against a Docker Distribution registry.
+
+## 🧰 SDKs
+
+All three SDKs are published at `0.7.0-beta.5`, regenerated against this
+release's OpenAPI schema:
+
+- `platz-sdk` ([crates.io](https://crates.io/crates/platz-sdk)) — Rust.
+- `@platzio/sdk` ([npm](https://www.npmjs.com/package/@platzio/sdk)) —
+  TypeScript.
+- `platz` ([PyPI](https://pypi.org/project/platz/)) — Python. PyPI
+  normalizes the version to `0.7.0b5`; install betas with
+  `pip install --pre platz`.
+
+The Rust SDK's `HelmRegistry` carries the `provider` field, and the
+collections that had drifted out of it — `bots`, `bot_tokens`,
+`deployment_permissions`, `env_user_permissions`, `helm_tag_formats` —
+remain exposed.
+
+## ⎈ Helm Chart
+
+Images bumped to `v0.7.0-beta.5` (backend and frontend; the helm base image
+stays at `v9`). The chart is published with `artifacthub.io/prerelease: true`,
+so ArtifactHub flags it as a pre-release. Every Rust pod (`api`,
+`chart-discovery`, `k8s-agent`, `resource-sync`, `status-updates`) honors a
+per-pod `extraEnv` list for injecting arbitrary env vars without forking the
+chart, and `resource-sync` correctly honors `resourceSync.replicaCount`.