Metacontroller-based deployment controller
— Migrated the Kubernetes deployment controller from an in-process controller to a Metacontroller webhook architecture (d65ecf7, c57ba8b)
0.21.0
No changes match these filters. Try a different search, impact, or backend.
Rise 0.21.0
This release focuses on security hardening, high-availability support, and a major architectural change to the Kubernetes deployment controller.
New Features
High-availability backend
— Backend is now safe to run with multiple replicas, including HA lease liveness and retryable OAuth state (7077511, fe18842)
Deployment secrets as Kubernetes Secrets
— Environment variable secrets are now injected as proper Kubernetes Secrets instead of inline values (bd10719)
Pod-IP validation for webhooks
— Replaced token-based webhook auth with pod-IP validation for improved security (a48c586)
--platform build option
--platform build option— Override the default build platform (e.g., --platform linux/amd64) (3626399)
rise env export
rise env export— New command to export environment variables, with a fix to environment resolution in rise run (08b6b67)
Bug Fixes
Fix handling of terminating pods in deployment status display (6c044ba)
6c044ba)Reject plain PKCE method in OAuth flow, require S256 (4b42ae3)
4b42ae3)Fix podSelector in webhook NetworkPolicy for metacontroller (6909f0f)
podSelector in webhook NetworkPolicy for metacontroller (6909f0f)Other Changes
Added cargo audit to CI (d3541cb)
cargo audit to CI (d3541cb)Dependency updates: openssl, pack (buildpacks), marked
Development documentation and task improvements
Updated tag-release script
What do the impact labels mean?
- Breaking
- Requires action or changes behavior incompatibly. Read the instructions before upgrading.
- Action required
- The upgrade succeeds, but an operator action is needed for the expected behavior.
- Config change
- Configuration is available or changes; defaults preserve existing behavior.
- No action required
- Features, fixes, and maintenance with no required operator action.