chore(main): release 1.0.0

[panicboat-github-workflow-bot]

🤖 I have created a release beep boop

1.0.0 (2026-10-14)

Features

• add the private trust security group (#897) (d1cb07e)
• aws/eks,kubernetes: evaluate OpenSRE with a read-only role and a fault-injected sandbox (#751) (647ef5e)
• aws/eks: grant SSO AdministratorAccess an EKS access entry (#820) (884ca8e)
• aws/karpenter: create EC2 Spot service-linked role (#672) (fac501e)
• aws/route53: add DKIM and dystopia.city apex records (#714) (5f441d8)
• aws/route53: manage panicboat.net apex TXT/MX via Terraform (#713) (712a6a0)
• aws/secrets-manager: manage existing Secrets Manager secrets via terragrunt (#880) (1459932)
• ci: release-please phase 2 — production deploy trigger (#886) (7870e23)
• holmesgpt: allow read-only git commands for source investigation (#784) (15db18c)
• kubernetes/components/oauth2-proxy/production: gate monitoring UIs on panicboat.net domain (#734) (cd82d69)
• kubernetes/components/tempo/production: move to the grafana-community chart (#762) (b0aa54f)
• kubernetes/dashboard: add Workload filter to Grafana dashboards (#953) (505b1ad)
• kubernetes/dashboard: wire workload filter into dashboard panels (#961) (19144f2)
• kubernetes: add sandbox for okteto CLI evaluation (#736) (c93bd05)
• kubernetes: add workload resource attribute to logs/traces (#950) (42f31a6)
• kubernetes: deploy Keycloak Phase 1 infra (CloudNativePG + Keycloak) (#735) (5d4715b)
• kubernetes: introduce Falco runtime security (#738) (5a5ae79)
• kubernetes: recreate production EKS cluster in dedicated AWS account (#817) (ca7d91d)
• kubernetes: restore fault-injected sandbox for HolmesGPT evaluation (#767) (de63e6d)
• prometheus-operator: Alertmanager-owned Slack notification for critical alerts (#782) (ad9174a)
• prometheus-operator: route critical alerts to holmes (#780) (b5110d9)
• split production and develop into dedicated AWS accounts (Phase 2-6) (#809) (100da1d)
• wire holmes into production (DNS + Alertmanager route) (#777) (8eb0c02)

Bug Fixes

• auto-approve: skip self-authored PRs from panicboat-ci-bot (#810) (2db15d5)
• aws/eks: disable unused ebs-csi-driver snapshotter sidecar (#698) (14a38c6)
• aws/iam-service-linked-roles: use envs/production for CI dispatch (#694) (7ddde31)
• cilium-gateway: allow HTTPRoutes from any namespace (#825) (49b6cd7)
• eliminate EKS cross-AZ data transfer cost (#938) (e0a55df)
• github/branch: let fluxcd-bot bypass monorepo's pull_request rule (#883) (c19a85c)
• kubernetes/components/beyla: instrument the application namespaces (#900) (383c63d)
• kubernetes/components/dashboard: fix Grafana investigability gaps (#878) (6ec5d8d)
• kubernetes/components/oauth2-proxy/production: pass email as the upstream username (#763) (2f773fc)
• kubernetes/components/opentelemetry: point Node.js exporter at the OTLP/HTTP port (#903) (b72a717)
• kubernetes/components/prometheus-operator: disable EKS-absent control plane monitoring (#876) (fd8bb36)
• kubernetes/components/tempo/production: drop the chart-default opencensus receiver (#743) (9efc8c1)
• kubernetes/dashboard: correct kube_pod_status_phase query filters (#700) (ed669d0)
• kubernetes/gateway-api: upgrade CRDs to v1.6.1 experimental channel (#959) (f5846ae)
• kubernetes/prometheus-operator: disable ruler probe on Mimir datasource (#979) (4d7d583)
• kubernetes: set required reinvocationPolicy on MutatingAdmissionPolicy (#943) (03cbeb2)
• kubernetes: stop Karpenter node churn loop from hubble-relay affinity (#695) (00f6d37)
• kubernetes: use trace/log_statements instead of resource_statements (#951) (4e3e275)
• kubernetes: use xforwarded proxy headers for Keycloak behind ALB (#745) (43b8c9b)
• pin hydrate toolchain and render against the cluster Kubernetes version (#740) (63f7ff2)
• prometheus-operator: use Slack channel ID for holmes webhook (#783) (27da39d)
• renovate: extract major.minor from EKS cluster_version updates (#670) (7285e16)
• scripts/eks-lifecycle: assume into production's dedicated account (#821) (8e4b516)
• scripts/eks-lifecycle: sweep orphan ALB controller LB/SG before vpc destroy (#799) (1100792)
• switch trafficDistribution to PreferSameZone (#940) (9a78696)

Performance Improvements

• kubernetes: right-size CPU requests to actual usage (#699) (1946ef3)

---

This PR was generated with Release Please. See documentation.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: bd897423-f144-46ff-a29a-2030e54453f2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}