Skip to content

v0.1.1

Choose a tag to compare

View all tags
@ThomasK33 ThomasK33 released this 25 Sep 08:00
v0.1.1
78a2eca
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Warning

The release build for this tag failed before publishing, so v0.1.1 has no binaries, archives or container images. Use v0.1.2, which contains the same fix plus the packaging repair (#138). The v0.1.1 source and Go module already include the security fix (#136).

Security

  • Authentication for the aggregated API server and the MCP HTTP server (GHSA-c3vp-pjh2-7gv4, #136). In v0.1.0, both servers accepted unauthenticated requests and acted with the operator's authority, and the default --app=all ran both. The aggregated API server now authenticates and authorizes every request through Kubernetes (front-proxy certificates, TokenReview, SubjectAccessReview); anonymous callers reach only /healthz, /livez and /readyz. The MCP server no longer runs in --app=all; --app=mcp-http listens on 127.0.0.1:8090 and requires a bearer token from --mcp-token-file.
  • Dependency updates for published advisories (#92, #101, #104, #118), and code and image security scanning in CI (#88).

Upgrade notes

  1. The aggregated API server needs config/rbac/auth-delegator-binding.yaml and config/rbac/authentication-reader-binding.yaml for the operator ServiceAccount (both are applied by kubectl apply -f config/rbac/). Without read access to kube-system/extension-apiserver-authentication it does not start; without permission to create SubjectAccessReviews it denies requests.
  2. Clients that called port 6443 directly must send a Kubernetes bearer token with RBAC on aggregation.coder.com, or go through kube-apiserver (kubectl).
  3. RBAC on codertemplates and coderworkspaces is owner-equivalent inside Coder: the server calls Coder with the control plane's operator token. Grant it only to subjects you would trust as Coder owners.
  4. --app=all no longer runs MCP and deploy/mcp-service.yaml is removed; delete the old Service. To use MCP, run --app=mcp-http --mcp-token-file=<file> and connect through kubectl port-forward.
  5. Outside a cluster, the aggregated API server needs KUBECONFIG (exactly one file) or ~/.kube/config.

Added

  • dist/install.yaml, a generated one-file install bundle for the operator in controller mode, kept fresh by CI (#89).
  • CoderControlPlane can reference an external PostgreSQL connection Secret (#122).
  • Kind E2E coverage for the CoderWorkspace lifecycle (#114).

Fixed

  • CoderTemplate Update applies metadata only after the new source is active, and returns 409 Conflict if the template changed during the import (#129).
  • spec.files template Create waits for the import before creating the template (#116).
  • Canonical organization, owner, template and workspace names are enforced so repeated kubectl apply converges (#106, #111).
  • Aggregated API delete preconditions are honored, and workspace resourceVersion reflects the returned representation (#110, #115).
  • kubectl rollout restart works on operator-managed Deployments (#121).
  • Release and :main image builds are unified and repaired (#86, #87, #99, #131).

Documentation

  • Rewritten README and docs (#123); corrected deploy steps (#124, #126); the standalone session token is kept in a Secret (#135); the 34-second write budget for template imports is documented (#128).
Assets 2
Loading