///Changelog

Release notes. Plain English. Dated. Immutable.

Versions follow semver. Every release lists what changed and who'll feel it: operators, dashboard users, helm installers, CLI consumers. Breaking changes get their own heading and a migration note.

v0.2.0

2026-07-09
  • ·New advisor service (seventh image: advisor). Agentic briefings — headline, full markdown, and a spoken script you can play from the dashboard — generated by Claude when you bring an Anthropic API key, by a deterministic rules engine when you don't. Every proposed action is validated against the CRD schema; anything that isn't a legal BudgetPolicy, CeilingPolicy, or RightsizingPolicy is downgraded to investigate-only. The advisor holds no write credentials.
  • ·Dashboard: new Advisor page with voice playback, source badge (demo / rules / generated), and guarded-CRD action cards with copy-to-apply manifests. Session cookies are now HMAC-signed and httpOnly (set KUBEHERO_SESSION_SECRET).
  • ·Collector: measured utilization via the kubelet Summary API (CPU usage and working-set memory per pod), blended with requests for attribution — no longer requests-only estimation. Falls back per-node when kubelet stats are unavailable.
  • ·Pricing engine: live AWS, GCP, and Azure catalogs now serve the Quote RPC with a TTL cache, request coalescing, and stale-then-static fallback — a provider outage can't fail a quote the static table can answer.
  • ·Control plane: real spend-anomaly detection (rolling z-scores over pod_cost_1s per workload). New KUBEHERO_DEMO_MODE=false hard-disables demo fixtures so an unwired install fails loudly instead of showing plausible fake data.
  • ·Toolchain: Go 1.26.5 across all modules — govulncheck clean; regenerated protobuf code with a descriptor-integrity test; dependency skew between operator and collector resolved.
  • ·Deploy: reference Terraform for GKE (regional cluster, Workload Identity, private Cloud SQL, dedicated ClickHouse pool). Helm chart gains the advisor Deployment with an existingSecret reference for the API key.

v0.1.0

2026-05-22
  • ·Initial public release. Six container images on ghcr.io/kubehero (control-plane, operator, collector, pricing-engine, cli, dashboard) — multi-arch (amd64 + arm64), Cosign-signed, Syft SBOM attested, Trivy CVE-gated.
  • ·Helm chart published to oci://ghcr.io/kubehero/charts. Eight optional subcharts (postgresql, clickhouse, valkey, dex, trivy-operator, tetragon, external-secrets, kube-prometheus-stack); cert-manager Certificate template; PriorityClass; production overlay.
  • ·Eleven Connect-RPC methods between dashboard and control-plane; live-wired UI for fleet, clusters, waste, budgets, ceilings, chargeback, posture, and per-workload drill-in.
  • ·Operator with three-condition reconciler (Ready / Armed / Tripped); ClickHouse-backed burn-rate provider; Trivy VulnerabilityReport ingest; real K8s actuator (HPA cap, pod evict, node cordon) with envtest coverage.
  • ·API-key + OIDC-with-JWKS auth interceptor; member/admin RBAC on mutating RPCs.
  • ·CLI: cluster add (one-time enrollment token), cluster list, scan, rightsize, apply, cap --arm, undo, quote, auth login.

Subscribe via the GitHub Releases feed to get notified on every new version: releases.atom.