From 30abe1552ea833e85ecc1dae75e70f69101ccab4 Mon Sep 17 00:00:00 2001 From: "panicboat-github-workflow-bot[bot]" <215137590+panicboat-github-workflow-bot[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 18:09:57 +0000 Subject: [PATCH] chore(main): release 1.0.0 --- CHANGELOG.md | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 85e86b06..9bf277b6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,68 @@ # Changelog +## 1.0.0 (2026-10-18) + + +### Features + +* add the private trust security group ([#897](https://github.com/panicboat/platform/issues/897)) ([d1cb07e](https://github.com/panicboat/platform/commit/d1cb07ec43637eea63a1c40aed70e911712e8a33)) +* **aws/eks,kubernetes:** evaluate OpenSRE with a read-only role and a fault-injected sandbox ([#751](https://github.com/panicboat/platform/issues/751)) ([647ef5e](https://github.com/panicboat/platform/commit/647ef5eea5e479827ed75fcbf629f439d26b970b)) +* **aws/eks:** grant SSO AdministratorAccess an EKS access entry ([#820](https://github.com/panicboat/platform/issues/820)) ([884ca8e](https://github.com/panicboat/platform/commit/884ca8e2cc24c4b95ed86e5262b23e3d2f2f8ff3)) +* **aws/karpenter:** create EC2 Spot service-linked role ([#672](https://github.com/panicboat/platform/issues/672)) ([fac501e](https://github.com/panicboat/platform/commit/fac501e6e261af2cb12039e4ca7422262efc3bb6)) +* **aws/route53:** add DKIM and dystopia.city apex records ([#714](https://github.com/panicboat/platform/issues/714)) ([5f441d8](https://github.com/panicboat/platform/commit/5f441d8c3670626905659878f39e86be042d5e34)) +* **aws/route53:** manage panicboat.net apex TXT/MX via Terraform ([#713](https://github.com/panicboat/platform/issues/713)) ([712a6a0](https://github.com/panicboat/platform/commit/712a6a032bb1a5718d9b6ab1bc23edfc6deb2c8c)) +* **aws/secrets-manager:** manage existing Secrets Manager secrets via terragrunt ([#880](https://github.com/panicboat/platform/issues/880)) ([1459932](https://github.com/panicboat/platform/commit/14599328bf5dc0700472d768ad778e7cedd6920d)) +* **ci:** release-please phase 2 — production deploy trigger ([#886](https://github.com/panicboat/platform/issues/886)) ([7870e23](https://github.com/panicboat/platform/commit/7870e2392b2d81475a85206f3ae762ce9ce3e34e)) +* **holmesgpt:** allow read-only git commands for source investigation ([#784](https://github.com/panicboat/platform/issues/784)) ([15db18c](https://github.com/panicboat/platform/commit/15db18c22019fbec2b8890f1fa25db57a5c196c5)) +* **kubernetes/components/oauth2-proxy/production:** gate monitoring UIs on panicboat.net domain ([#734](https://github.com/panicboat/platform/issues/734)) ([cd82d69](https://github.com/panicboat/platform/commit/cd82d69da4df33ce0b132f3b54f1e8fd2d92c0c0)) +* **kubernetes/components/tempo/production:** move to the grafana-community chart ([#762](https://github.com/panicboat/platform/issues/762)) ([b0aa54f](https://github.com/panicboat/platform/commit/b0aa54f9bbe10beee08ff0107a1557d772259178)) +* **kubernetes/dashboard:** add Workload filter to Grafana dashboards ([#953](https://github.com/panicboat/platform/issues/953)) ([505b1ad](https://github.com/panicboat/platform/commit/505b1ad017b2e5c25c6fffedc77afd77cf0cc320)) +* **kubernetes/dashboard:** wire workload filter into dashboard panels ([#961](https://github.com/panicboat/platform/issues/961)) ([19144f2](https://github.com/panicboat/platform/commit/19144f28e5a335d59d352e070920a637abd2fdca)) +* **kubernetes:** add sandbox for okteto CLI evaluation ([#736](https://github.com/panicboat/platform/issues/736)) ([c93bd05](https://github.com/panicboat/platform/commit/c93bd056fe42dd5e836c2ff909a67b18b40fdef5)) +* **kubernetes:** add workload resource attribute to logs/traces ([#950](https://github.com/panicboat/platform/issues/950)) ([42f31a6](https://github.com/panicboat/platform/commit/42f31a68d3ddc99c2f8aa40af43aebdf91f496dd)) +* **kubernetes:** deploy Keycloak Phase 1 infra (CloudNativePG + Keycloak) ([#735](https://github.com/panicboat/platform/issues/735)) ([5d4715b](https://github.com/panicboat/platform/commit/5d4715b274d0b3a8597e27911298abea960b725c)) +* **kubernetes:** introduce Falco runtime security ([#738](https://github.com/panicboat/platform/issues/738)) ([5a5ae79](https://github.com/panicboat/platform/commit/5a5ae7935767b3ce19d3a7bb93fff220c9238b20)) +* **kubernetes:** recreate production EKS cluster in dedicated AWS account ([#817](https://github.com/panicboat/platform/issues/817)) ([ca7d91d](https://github.com/panicboat/platform/commit/ca7d91d7d5a049d6dd227f008a83bc42544a6f71)) +* **kubernetes:** restore fault-injected sandbox for HolmesGPT evaluation ([#767](https://github.com/panicboat/platform/issues/767)) ([de63e6d](https://github.com/panicboat/platform/commit/de63e6d5265c67f83a2d817aa42092b5c6c71395)) +* **prometheus-operator:** Alertmanager-owned Slack notification for critical alerts ([#782](https://github.com/panicboat/platform/issues/782)) ([ad9174a](https://github.com/panicboat/platform/commit/ad9174a4fee6461e65cfa7a3add62b9d6a8f6d81)) +* **prometheus-operator:** route critical alerts to holmes ([#780](https://github.com/panicboat/platform/issues/780)) ([b5110d9](https://github.com/panicboat/platform/commit/b5110d9d99f50c9db0ec335051601e90e7b9d98d)) +* split production and develop into dedicated AWS accounts (Phase 2-6) ([#809](https://github.com/panicboat/platform/issues/809)) ([100da1d](https://github.com/panicboat/platform/commit/100da1d2fc1f35c7add72eb1deee88de34c7dec1)) +* wire holmes into production (DNS + Alertmanager route) ([#777](https://github.com/panicboat/platform/issues/777)) ([8eb0c02](https://github.com/panicboat/platform/commit/8eb0c023522dc76e31d887300f0ff7c30dcc14de)) + + +### Bug Fixes + +* **auto-approve:** skip self-authored PRs from panicboat-ci-bot ([#810](https://github.com/panicboat/platform/issues/810)) ([2db15d5](https://github.com/panicboat/platform/commit/2db15d548e2940c3c31547702f77fb2bdbbe6b99)) +* **aws/eks:** disable unused ebs-csi-driver snapshotter sidecar ([#698](https://github.com/panicboat/platform/issues/698)) ([14a38c6](https://github.com/panicboat/platform/commit/14a38c6d15c1e2af3084b6d4167a4cc579202576)) +* **aws/iam-service-linked-roles:** use envs/production for CI dispatch ([#694](https://github.com/panicboat/platform/issues/694)) ([7ddde31](https://github.com/panicboat/platform/commit/7ddde31435d48a266c64d159c00869e2e2e92bbb)) +* **cilium-gateway:** allow HTTPRoutes from any namespace ([#825](https://github.com/panicboat/platform/issues/825)) ([49b6cd7](https://github.com/panicboat/platform/commit/49b6cd7d75cdc7f339b299c7be4101a195316777)) +* eliminate EKS cross-AZ data transfer cost ([#938](https://github.com/panicboat/platform/issues/938)) ([e0a55df](https://github.com/panicboat/platform/commit/e0a55dfa9df9bfca54259828c7b213aa301eb977)) +* **github/branch:** let fluxcd-bot bypass monorepo's pull_request rule ([#883](https://github.com/panicboat/platform/issues/883)) ([c19a85c](https://github.com/panicboat/platform/commit/c19a85c92afee340c7477a1e9789007f378f2b3c)) +* **kubernetes/components/beyla:** instrument the application namespaces ([#900](https://github.com/panicboat/platform/issues/900)) ([383c63d](https://github.com/panicboat/platform/commit/383c63df5b831190cd07cfb3f42d132c3a462608)) +* **kubernetes/components/dashboard:** fix Grafana investigability gaps ([#878](https://github.com/panicboat/platform/issues/878)) ([6ec5d8d](https://github.com/panicboat/platform/commit/6ec5d8d64a9f806bd5b710876bccb291179f032d)) +* **kubernetes/components/oauth2-proxy/production:** pass email as the upstream username ([#763](https://github.com/panicboat/platform/issues/763)) ([2f773fc](https://github.com/panicboat/platform/commit/2f773fc1553dfe801cc1de42a4615553320d73f3)) +* **kubernetes/components/opentelemetry:** point Node.js exporter at the OTLP/HTTP port ([#903](https://github.com/panicboat/platform/issues/903)) ([b72a717](https://github.com/panicboat/platform/commit/b72a71700b605fbfa0cd110b5c7c3bf99f60bd45)) +* **kubernetes/components/prometheus-operator:** disable EKS-absent control plane monitoring ([#876](https://github.com/panicboat/platform/issues/876)) ([fd8bb36](https://github.com/panicboat/platform/commit/fd8bb36ab5be35d6612eeaab32cc40f36405b65b)) +* **kubernetes/components/tempo/production:** drop the chart-default opencensus receiver ([#743](https://github.com/panicboat/platform/issues/743)) ([9efc8c1](https://github.com/panicboat/platform/commit/9efc8c173685a446c2a47b95683af8b6046cf149)) +* **kubernetes/dashboard:** correct kube_pod_status_phase query filters ([#700](https://github.com/panicboat/platform/issues/700)) ([ed669d0](https://github.com/panicboat/platform/commit/ed669d0ebf2f82d2ef839a826f379133c208d641)) +* **kubernetes/gateway-api:** upgrade CRDs to v1.6.1 experimental channel ([#959](https://github.com/panicboat/platform/issues/959)) ([f5846ae](https://github.com/panicboat/platform/commit/f5846ae5318aa7368d58697d171741076bff4c48)) +* **kubernetes/prometheus-operator:** disable ruler probe on Mimir datasource ([#979](https://github.com/panicboat/platform/issues/979)) ([4d7d583](https://github.com/panicboat/platform/commit/4d7d5836ead25de6baa0688dcc1b0345daa53bdc)) +* **kubernetes:** set required reinvocationPolicy on MutatingAdmissionPolicy ([#943](https://github.com/panicboat/platform/issues/943)) ([03cbeb2](https://github.com/panicboat/platform/commit/03cbeb26b9f08344d3a08601ef1952006ec38058)) +* **kubernetes:** stop Karpenter node churn loop from hubble-relay affinity ([#695](https://github.com/panicboat/platform/issues/695)) ([00f6d37](https://github.com/panicboat/platform/commit/00f6d37ba95a2fbe9624532fc997d52cc2108b31)) +* **kubernetes:** use trace/log_statements instead of resource_statements ([#951](https://github.com/panicboat/platform/issues/951)) ([4e3e275](https://github.com/panicboat/platform/commit/4e3e2758ad2876735e76035fdf7d3e43679a4b18)) +* **kubernetes:** use xforwarded proxy headers for Keycloak behind ALB ([#745](https://github.com/panicboat/platform/issues/745)) ([43b8c9b](https://github.com/panicboat/platform/commit/43b8c9b307359d4508e2b1964adc73b1d57d803e)) +* pin hydrate toolchain and render against the cluster Kubernetes version ([#740](https://github.com/panicboat/platform/issues/740)) ([63f7ff2](https://github.com/panicboat/platform/commit/63f7ff2f2ff898e1844095349b9d49444de5887d)) +* **prometheus-operator:** use Slack channel ID for holmes webhook ([#783](https://github.com/panicboat/platform/issues/783)) ([27da39d](https://github.com/panicboat/platform/commit/27da39dfd47afcf7e37cd38b43fb7d0c5faeb677)) +* **renovate:** extract major.minor from EKS cluster_version updates ([#670](https://github.com/panicboat/platform/issues/670)) ([7285e16](https://github.com/panicboat/platform/commit/7285e16500cfc9662f2be4c37c2fba72cf4be993)) +* **scripts/eks-lifecycle:** assume into production's dedicated account ([#821](https://github.com/panicboat/platform/issues/821)) ([8e4b516](https://github.com/panicboat/platform/commit/8e4b51648d410dc4659b52e07fae730376ff17bc)) +* **scripts/eks-lifecycle:** sweep orphan ALB controller LB/SG before vpc destroy ([#799](https://github.com/panicboat/platform/issues/799)) ([1100792](https://github.com/panicboat/platform/commit/1100792f2fe0dfd692a03e2368d77e712366a18b)) +* switch trafficDistribution to PreferSameZone ([#940](https://github.com/panicboat/platform/issues/940)) ([9a78696](https://github.com/panicboat/platform/commit/9a786962d4a2cb1810daaf552cdcb4abb7dacafd)) + + +### Performance Improvements + +* **kubernetes:** right-size CPU requests to actual usage ([#699](https://github.com/panicboat/platform/issues/699)) ([1946ef3](https://github.com/panicboat/platform/commit/1946ef38d94a28466cc5a8894e94fc036bb13bf6)) + ## 0.1.0 (2026-05-16)