Changelog

0.37.0 (2026-10-27)

⚠ BREAKING CHANGES

remove the OpenTofu provider now that it lives in its own repository (#953)

Features

examples: commit release image manifests and verify them against upstream (#955) (9e7f295)
examples: expose the vSphere charts’ vCenter, scheduling and CA settings (#956) (2d282ea)

Bug Fixes

ci: stage publish-example packages off the runner’s /tmp (#952) (43c72ba)
microvm: check for a live fleet before sizing it against free memory (#959) (c840897)
phase: leave a sibling install phase’s engine files alone (#960) (59cb289)
phase: unmount under an engine path before removing it (#961) (c23db44)

Refactoring

remove the OpenTofu provider now that it lives in its own repository (#953) (049b617)

Miscellaneous

deps: update fast-uri to 3.1.9 (#954) (8003ab9)
examples: regenerate the vSphere examples for the new values surface (#957) (3a997aa)

Build

deps: bump almalinux/10-base from ed618ca to f72ef25 in /containers/ansible (#949) (f93b70e)
deps: bump almalinux/10-base from ed618ca to f72ef25 in /containers/ubi (#948) (4971bbc)

0.36.0 (2026-10-27)

⚠ BREAKING CHANGES

drop mdbook golang docs (#914)

Features

api: read a chart manifest wrapper carrying enabled, images, and values (#944) (ad0f036)
examples: declare each chart’s images under the chart that needs them (#946) (2cd97f8)
phase: keep a disabled chart’s images out of the upload (#945) (9960e00)

Bug Fixes

phase: promote the staged engine binary in the phase that stages it (#935) (e38835c)

Refactoring

coci: import zarf’s src/pkg/oci instead of defenseunicorns/pkg/oci (#897) (cb6e117)
microvm: export the fleet harness as test/microvm (#920) (742dd77)
provider: export the two symbols the OpenTofu provider needs across a module boundary (#913) (d72b98e)

Documentation

drop mdbook golang docs (#914) (b525b38)
remove hooks comment (#911) (eecb084)

Miscellaneous

examples: refresh generated examples (#915) (37d1634)

CI/CD

image: drop registry1 and pin the base image straight from cgr.dev (#933) (0ab83a4)

Build

deps: bump github.com/andybalholm/brotli from 1.2.6 to 1.2.7 (#936) (c09e093)
deps: bump github.com/docker/cli from 29.9.1+incompatible to 29.9.2+incompatible in the docker group (#903) (f4fe458)
deps: bump github.com/docker/docker-credential-helpers from 0.9.10 to 0.9.12 in the docker group (#926) (fb49ebc)
deps: bump github.com/go-openapi/strfmt from 0.27.3 to 0.27.4 in the openapi group (#898) (6cf315a)
deps: bump github.com/go-openapi/validate from 1.0.0 to 1.0.1 in the openapi group (#928) (31240db)
deps: bump github.com/google/certificate-transparency-go from 1.3.3 to 1.4.0 (#905) (669ef4c)
deps: bump github.com/huandu/xstrings from 1.6.2 to 1.6.3 (#906) (fedcf2b)
deps: bump github.com/klauspost/pgzip from 1.2.7 to 1.3.0 (#894) (1f3f7e3)
deps: bump github.com/minio/minlz from 1.2.2 to 1.2.3 (#900) (89738f9)
deps: bump github.com/shopspring/decimal from 1.5.0 to 1.6.0 (#895) (99e974b)
deps: bump github.com/sigstore/timestamp-authority/v2 from 2.1.4 to 2.1.5 in the sigstore group (#902) (888b887)
deps: bump google.golang.org/api from 0.304.0 to 0.305.0 (#899) (e448fb5)
deps: bump google.golang.org/api from 0.305.0 to 0.308.0 (#929) (c216bd3)
deps: bump https://github.com/astral-sh/ruff-pre-commit from v0.17.1 to 0.17.2 (#924) (c021ebb)
deps: bump j178/prek-action from 3.0.1 to 3.0.2 in the core group (#901) (970de60)
deps: bump j178/prek-action from 3.0.2 to 3.1.0 in the core group (#907) (0a2dbf3)
deps: bump library/alpine from 294b683 to be26560 in /containers/base (#921) (f44d214)
deps: bump library/debian from a29215f to 62bd423 in /containers/deb (#923) (5c6ce07)
deps: bump oras.land/oras-go/v2 from 2.6.4 to 2.7.0 (#930) (7c8d680)
deps: bump the cloud-kms group across 1 directory with 2 updates (#932) (e12c6bc)
deps: bump the core group with 4 updates (#931) (2185d3a)
deps: bump the sigstore group with 3 updates (#925) (46f5926)

0.35.0 (2026-10-21)

⚠ BREAKING CHANGES

phase: trim the Manager surface nothing uses (#892)
api: drop unreferenced methods and the two SetPath cul-de-sacs (#889)
pkg: drop dead symbols across phase, coci, lint and utils (#888)
phase: remove the NoWait and Force globals nothing read (#886)
cmd: remove the –fapolicyd flag and config key nothing read (#885)
release: assemble the provider artifact with oras-go (#645)
tofu: converge a cluster through the cargoship_cluster resource (#618)

Features

docs: generate a provider reference from the tofu schemas (#644) (a7da3dd)
package: import an OCI Image Layout as a native package (#876) (c5b99d3)
phase: write fapolicyd allow rules for a package’s executables (#875) (935faf6)
tofu: converge a cluster through the cargoship_cluster resource (#618) (60f7ae1)
tofu: define profiles and per-host overrides in the configuration (#622) (cd058b4)
tofu: override package values and route phase logs to tofu (#643) (e922ae2)
tofu: remove a single host from a cluster (#646) (364af84)

Bug Fixes

cmd: remove the –fapolicyd flag and config key nothing read (#885) (dc0ea26)
config: drop the config sections nothing reads (#879) (54143c4)
distro: release the etcd membership before deleting an upstream controller (#864) (82f6ef6)
phase: drain a node by the name the cluster calls it (#868) (8bb9c8c)
phase: prune the upload manifest when a stale upload is removed (#863) (079af70)
phase: remove the NoWait and Force globals nothing read (#886) (d97e7e6)

Refactoring

action: report what a constructor cannot build, and name the read-only run (#617) (7cbd141)
api: drop unreferenced methods and the two SetPath cul-de-sacs (#889) (08afc79)
cmd: drop unreachable logging plumbing and two inert flags (#887) (a0139a8)
drop four unused helpers from cmd and pkg/utils (#883) (6bc7f33)
internal: drop the unused split package (#884) (a1d7ef9)
node: drop the status helpers nothing calls (#882) (15170f2)
phase: share the node restart steps four phases each carried (#890) (5c6a535)
phase: trim the Manager surface nothing uses (#892) (921daa1)
pkg: drop dead symbols across phase, coci, lint and utils (#888) (36f48af)
pkg: drop two constructors nothing calls (#881) (9d03ced)
release: assemble the provider artifact with oras-go (#645) (2270546)

Documentation

config: name every setting in the sample config (#878) (3a1ef1e)
example: add a terragrunt layout and guide for the provider (#621) (f0ff407)
stop advertising cloud KMS key references on sign (#877) (ab5c211)

CI/CD

go: update from 1.27.2 to 1.27.3 (#893) (f1698f7)

Build

deps: bump github.com/gabriel-vasile/mimetype from 1.4.15 to 1.4.16 (#874) (122b4e2)
deps: bump github.com/zarf-dev/zarf from 0.87.0 to 0.88.0 (#872) (237c3d8)
deps: bump https://github.com/astral-sh/ruff-pre-commit from v0.17.0 to 0.17.1 (#869) (f7d2ea5)
deps: bump https://github.com/golangci/golangci-lint from v2.14.0 to 2.15.0 (#870) (466581a)
deps: bump oras.land/oras-go/v2 from 2.6.3 to 2.6.4 (#871) (dc1c159)

0.34.0 (2026-10-18)

⚠ BREAKING CHANGES

deps: cut the binary from 100 MiB to 39 MiB, and drop keyless signing (#847)
ansible: remove the zarf collection, now released from its own repository (#823)

Features

distro: add selector.when to make a file’s upload conditional on a value (#834) (a4d14f5)
distro: bring the container runtime up for an upstream apply (#841) (7f8a965)
phase: warn when hosts run fapolicyd and the package carries no rules (#843) (d249e82)

Bug Fixes

cli: report a missing distro instead of panicking on a nil action (#838) (d410145)
distro: let an upstream reset run over a host whose packages never installed (#845) (f367807)
phase: keep a targeted reset to the hosts it was given (#840) (99871a5)
phase: stop leaving an rpm-selected executable under its staging name (#833) (fdfeb06)

Refactoring

deps: cut the binary from 100 MiB to 39 MiB, and drop keyless signing (#847) (a0be5d3)

Documentation

microvm: fix the prepare and apply examples to pass a package (#835) (3208764)

Miscellaneous

ansible: remove the zarf collection, now released from its own repository (#823) (adcd344)
example: regenerate the examples for selector.when (#836) (9d1ee69)
example: regenerate the upstream examples for the fapolicyd rules (#844) (67b4258)

CI/CD

add gitignore for build (#830) (51235ae)
dependabot: group the gomod dependency trees that move together (#831) (2efed53)

Build

deps: bump github.com/docker/cli from 29.9.0+incompatible to 29.9.1+incompatible in the docker group (#854) (f8eb17e)
deps: bump github.com/go-chi/chi/v5 from 5.3.2 to 5.4.0 (#818) (50270e5)
deps: bump github.com/go-chi/chi/v5 from 5.4.0 to 5.5.0 (#855) (82e60d2)
deps: bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 (#860) (46e9efa)
deps: bump github.com/godbus/dbus/v5 from 5.2.2 to 5.2.4 (#859) (34f0c3c)
deps: bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.31.0 to 2.32.0 (#858) (0357c3a)
deps: bump github.com/klauspost/compress from 1.20.1 to 1.20.3 (#816) (070d81c)
deps: bump github.com/klauspost/cpuid/v2 from 2.4.0 to 2.4.1 (#826) (e1d0600)
deps: bump github.com/Microsoft/go-winio from 0.6.3 to 0.6.4 (#857) (0aa496e)
deps: bump github.com/nwaples/rardecode/v2 from 2.4.3 to 2.4.4 (#819) (3d0f8a2)
deps: bump github.com/nwaples/rardecode/v2 from 2.4.4 to 2.4.5 (#827) (c1128b1)
deps: bump github.com/open-policy-agent/opa from 1.21.1 to 1.21.2 (#817) (9dc23d6)
deps: bump github.com/sigstore/sigstore from 1.11.0 to 1.11.1 in the sigstore group (#853) (9f5d8f6)
deps: bump google.golang.org/api from 0.301.0 to 0.302.0 (#829) (a3caf75)
deps: bump google.golang.org/api from 0.302.0 to 0.304.0 (#856) (b6f7c7f)
deps: bump https://github.com/sirosen/texthooks from 0.7.1 to 1.0.0 (#851) (845e4ae)
deps: bump oras.land/oras-go/v2 from 2.6.2 to 2.6.3 (#828) (0e241d1)
deps: bump the core group with 2 updates (#820) (80e8e5b)
deps: bump the core group with 3 updates (#861) (5c0cad7)
deps: bump the opentelemetry group with 6 updates (#852) (1f94b91)

0.33.0 (2026-10-14)

⚠ BREAKING CHANGES

record the colonel-byte.dev API group move and its transition window (#798)
schema: rename the generated schema files off the zarf- prefix (#796)
api: drop the Zarf prefix from the owned API types (#794)
api: move api/zarf.dev to api/colonel-byte.dev (#793)

Features

api: accept colonel-byte.dev/v1alpha1 with Cluster and Distro kinds (#795) (3b1ac3c)
cli: add –receipt-path to the lifecycle commands (#781) (63ceeaa)
cli: add redact-receipt for sharing a run receipt (#783) (d03cc39)
cli: print a per-host summary table and document run receipts (#784) (39cc614)
cli: wire –receipt-path into the config file (#815) (9da1dc6)
phase: report per-host changes and per-phase duration (#779) (6cf4e53)
phase: report which hosts changed, with diffs where the file was read (#782) (5257c0e)
receipt: add the run receipt document and its writer (#780) (4c81c0e)

Refactoring

api: drop the Zarf prefix from the owned API types (#794) (ed30c85)
api: move api/zarf.dev to api/colonel-byte.dev (#793) (738c7dc)
schema: rename the generated schema files off the zarf- prefix (#796) (29f5f69)

Documentation

record the colonel-byte.dev API group move and its transition window (#798) (c9ce7f1)

Miscellaneous

example: regenerate example packages for the colonel-byte.dev group (#797) (0511fd3)

Build

deps: bump github.com/aws/aws-sdk-go-v2/service/ecrpublic from 1.47.3 to 1.47.4 (#806) (b05ecf7)
deps: bump github.com/aws/aws-sdk-go-v2/service/kms from 1.61.3 to 1.61.4 (#808) (9bb808b)
deps: bump github.com/fvbommel/sortorder from 1.2.0 to 1.2.1 (#804) (8007542)
deps: bump github.com/nwaples/rardecode/v2 from 2.4.2 to 2.4.3 (#812) (8ce9758)
deps: bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0 (#811) (632a2e4)
deps: bump github.com/prometheus/common from 0.72.0 to 0.72.1 (#805) (782e76a)
deps: bump github.com/prometheus/procfs from 0.21.1 to 0.22.0 (#802) (ec06714)
deps: bump github.com/pterm/pterm from 0.12.83 to 0.12.84 (#810) (70e2beb)
deps: bump golang.org/x/vuln from 1.8.0 to 1.9.0 (#803) (c8dc4c8)
deps: bump ossf/scorecard-action from 2.4.4 to 2.5.0 in the core group (#807) (31f6b39)

0.32.1 (2026-10-13)

Documentation

agent: prefer prek over pre-commit (#731) (154af7d)
agent: require an updater or dependabot entry for every pin (#745) (3594775)

CI/CD

actions: exempt dependabot pull request titles from the 100-char cap (#730) (9edcc87)
bot: raise the dependabot open pull request limit for gomod (#739) (2762460)

Build

deps: bump cloud.google.com/go/auth from 0.24.1-0.20261001053825-dbc26066f70a to 0.24.1 (#761) (911c84b)
deps: bump github.com/aws/aws-sdk-go-v2/…/accept-encoding from 1.13.19 to 1.13.20 (#722) (9a0471c)
deps: bump github.com/aws/aws-sdk-go-v2/config from 1.33.6 to 1.33.9 (#760) (276cd89)
deps: bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds from 1.20.1 to 1.20.2 (#725) (277295e)
deps: bump github.com/aws/aws-sdk-go-v2/internal/v4a from 1.5.4 to 1.5.5 (#752) (3288f6c)
deps: bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.66.1 to 1.66.4 (#753) (b959d02)
deps: bump github.com/aws/aws-sdk-go-v2/service/ecrpublic from 1.47.1 to 1.47.3 (#724) (78d7da3)
deps: bump github.com/aws/aws-sdk-go-v2/service/internal/presigned-url from 1.14.4 to 1.14.5 (#741) (f3e4180)
deps: bump github.com/aws/aws-sdk-go-v2/service/kms from 1.61.1 to 1.61.3 (#727) (cd857c8)
deps: bump github.com/aws/aws-sdk-go-v2/service/signin from 1.10.1 to 1.10.4 (#764) (f2dc08e)
deps: bump github.com/aws/aws-sdk-go-v2/service/sso from 1.38.1 to 1.38.3 (#772) (bcfb114)
deps: bump github.com/aws/aws-sdk-go-v2/service/ssooidc from 1.43.1 to 1.43.4 (#746) (6a4953f)
deps: bump github.com/aws/aws-sdk-go-v2/service/sts from 1.51.1 to 1.51.3 (#775) (fbbe552)
deps: bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.23.2 to 1.23.3 (#749) (5600d98)
deps: bump github.com/docker/cli from 29.8.2+incompatible to 29.9.0+incompatible (#743) (c2684ab)
deps: bump github.com/docker/docker-credential-helpers from 0.9.9 to 0.9.10 (#766) (41070d9)
deps: bump github.com/emicklei/go-restful/v3 from 3.13.0 to 3.14.0 (#755) (f8d0c6a)
deps: bump github.com/fxamacker/cbor/v2 from 2.9.4 to 2.9.6 (#771) (f3eb304)
deps: bump github.com/go-git/go-git/v5 from 5.19.2 to 5.19.3 (#770) (cac2936)
deps: bump github.com/go-openapi/runtime from 0.33.2 to 0.33.3 (#728) (1478337)
deps: bump github.com/googleapis/enterprise-certificate-proxy from 0.3.22 to 0.3.23 (#776) (0344bae)
deps: bump github.com/hashicorp/go-plugin from 1.7.0 to 1.8.0 (#765) (98217cb)
deps: bump github.com/hashicorp/terraform-registry-address from 0.4.0 to 0.5.0 (#756) (028e75f)
deps: bump github.com/hashicorp/terraform-svchost from 0.1.1 to 0.2.1 (#773) (63fa042)
deps: bump github.com/klauspost/pgzip from 1.2.6 to 1.2.7 (#758) (55c7846)
deps: bump github.com/mattn/go-colorable from 0.1.15 to 0.1.16 (#768) (82b9154)
deps: bump github.com/mattn/go-runewidth from 0.0.30 to 0.0.31 (#769) (4d7b347)
deps: bump github.com/moby/moby/client from 0.6.0 to 0.6.2 (#723) (32bbcc6)
deps: bump github.com/nwaples/rardecode/v2 from 2.4.1 to 2.4.2 (#744) (791bb33)
deps: bump github.com/olekukonko/ll from 0.1.8 to 0.1.9 (#762) (8a53e55)
deps: bump github.com/open-policy-agent/opa from 1.21.0 to 1.21.1 (#777) (dcdb2df)
deps: bump github.com/pjbgf/sha1cd from 0.6.0 to 0.7.0 (#747) (fc26850)
deps: bump github.com/shopspring/decimal from 1.4.0 to 1.5.0 (#754) (1ae2caa)
deps: bump github.com/sigstore/timestamp-authority/v2 from 2.1.3 to 2.1.4 (#751) (cebb46a)
deps: bump github.com/vektah/gqlparser/v2 from 2.5.58 to 2.5.62 (#774) (72ef884)
deps: bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.71.0 to 0.72.0 (#759) (4881a09)
deps: bump golang.org/x/mod from 0.41.0 to 0.42.0 (#778) (1955983)
deps: bump google.golang.org/api from 0.299.0 to 0.301.0 (#721) (e723ad4)
deps: bump https://github.com/astral-sh/ruff-pre-commit from v0.16.10 to 0.17.0 (#740) (13ffece)
deps: bump sigs.k8s.io/controller-runtime from 0.25.1 to 0.25.2 (#767) (37efa93)
deps: bump the core group with 6 updates (#750) (de03019)

0.32.0 (2026-10-12)

⚠ BREAKING CHANGES

example: release floor for kubernetes engines (#681)
tofu: read a fleet’s facts through the provider (#616)

Features

cmd: add a verify command for package signatures (#691) (648d920)
distro: add spec.config.os.selinux to the package schema (#661) (3525140)
distro: reset a named subset of hosts (#707) (360677d)
examples: add the recommended SELinux settings to the distro templates (#665) (ffb5cd8)
examples: bake a CNI into the upstream examples (#682) (b5e22cc)
examples: render upstream-cilium, upstream-canal, upstream-flannel (#683) (790de49)
magefiles: add dev:vmUp and dev:vmDown targets for the VM fleet (#700) (e9d9d53)
microvm: add a rootless qemu VM fleet for local Enterprise Linux testing (#699) (d05b4ab)
microvm: add an opt-in Ubuntu guest for a mixed fleet (#720) (c343aed)
phase: apply the package’s SELinux policy on enforcing hosts (#662) (b2bd693)
phase: remove the SELinux policy cargoship applied on reset (#663) (6b84de9)
tofu: read a fleet’s facts through the provider (#616) (4209a45)

Bug Fixes

deps: bump x/net to v0.61.0 and the go directive to 1.27.2 (#687) (9001e9b)
distro: match a host to its node by any identifier they share (#711) (ff4166a)
distro: remove the engine’s directories on uninstall (#712) (3c6ca37)
distro: render the engine’s node-ip from the host’s private address (#717) (0ff3770)
distro: repoint the controllers a removal keeps, on the right port (#718) (1258ed5)

Refactoring

e2e: describe the cluster fleet independently of bootloose (#701) (d074b39)

Documentation

agent: record the SELinux policy design decisions (#664) (4f6c5a4)
agents: record issue tracking, stacked PR, and README upkeep rules (#675) (8ffec03)
correct drift in README, docs/, and the agent rules files (#692) (33b821f)
examples: document the upstream CNI flavors (#684) (1da789c)

Miscellaneous

example: release floor for kubernetes engines (#681) (cdcd038)
examples: regenerate the example packages (#666) (d70614b)

CI/CD

repo: add issue forms for build, test, bug, feature, docs, and stack reports (#706) (815fec2)

Build

deps: bump github.com/go-openapi/analysis from 1.0.0 to 1.0.1 (#648) (3f5b368)
deps: bump github.com/go-openapi/strfmt from 0.27.2 to 0.27.3 (#651) (0caf1ce)
deps: bump github.com/Microsoft/go-winio from 0.6.3-0.20251027160822-ad3df93bed29 to 0.6.3 (#656) (25c5250)
deps: bump github.com/minio/minlz from 1.2.0 to 1.2.2 (#657) (1c4604c)
deps: bump github.com/oklog/run from 1.1.0 to 1.2.0 (#658) (a055faf)
deps: bump github.com/phuslu/lru from 1.0.18 to 1.0.24 (#652) (7e43c50)
deps: bump github.com/spiffe/go-spiffe/v2 from 2.8.2 to 2.9.0 (#659) (d52ce3a)
deps: bump go.opentelemetry.io/…/otlpmetricgrpc from 1.46.0 to 1.47.0 (#649) (f70a166)
deps: bump go.opentelemetry.io/…/otlptracegrpc from 1.46.0 to 1.47.0 (#660) (662ab8b)
deps: bump j178/prek-action from 3.0.0 to 3.0.1 in the core group (#653) (b60781b)
deps: bump library/debian from a99cfc5 to a29215f in /containers/deb (#655) (b43f33d)
deps: bump sigs.k8s.io/kustomize/api from 0.21.1 to 0.21.2 (#650) (81e67a4)

0.31.0 (2026-10-06)

⚠ BREAKING CHANGES

ansible: add read-only zarf modules and the roles that wrap them (#630)

Features

ansible: add read-only zarf modules and the roles that wrap them (#630) (6021940)
ansible: let zarf_package_inspect require a package signature (#633) (5e81e2c)
ansible: withhold the credentials in the zarf-state Secret (#632) (6ce4a4d)

Refactoring

ansible: share the read-only zarf plugins’ plumbing and cover their contract (#631) (a82287b)

Documentation

ansible: describe the read-only modules and render version_added (#635) (5821f40)

Build

deps: bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 in the core group (#628) (fc5d082)
deps: bump github.com/google/s2a-go from 0.1.10 to 0.1.11 (#642) (85cc30c)
deps: bump github.com/huandu/xstrings from 1.6.1 to 1.6.2 (#626) (33d493a)
deps: bump github.com/moby/moby/api from 1.56.0 to 1.56.1 (#640) (6efe78f)
deps: bump github.com/mozillazg/docker-credential-acr-helper from 0.4.0 to 0.4.1 (#623) (a93fd7b)
deps: bump github.com/pierrec/lz4/v4 from 4.1.31 to 4.1.32 (#625) (00ab3cc)
deps: bump github.com/pierrec/lz4/v4 from 4.1.32 to 4.1.33 (#641) (b1da6c0)
deps: bump go.opentelemetry.io/…/otelhttp from 0.71.0 to 0.72.0 (#639) (5b9aaa5)
deps: bump go.opentelemetry.io/…/stdoutmetric from 1.46.0 to 1.47.0 (#638) (c34887c)
deps: bump go.opentelemetry.io/otel from 1.46.0 to 1.47.0 (#624) (bdae158)
deps: bump sigs.k8s.io/release-utils from 0.12.4 to 0.12.5 (#627) (aeeed12)
pre-commit: lint the collections’ Python for errors with ruff (#634) (1ae77dc)

0.30.0 (2026-10-05)

⚠ BREAKING CHANGES

distro: upstream validate engine config against kubeadm API types (#517)
distro: render kubeadm v1beta4 config documents (#511)
ansible: add the colonel_byte.zarf collection (#599)
zarfmod: answer Ansible as zarf_init and zarf_package_deploy (#598)

Features

ansible: add the colonel_byte.zarf collection (#599) (592ffb3)
bootstrap single-controller upstream cluster (#512) (9c4abc6)
distro/upstream: join additional controllers via kubeadm HA path (#514) (45fc6b6)
distro: render kubeadm v1beta4 config documents (#511) (f5a1018)
distro: upstream validate engine config against kubeadm API types (#517) (a656ab2)
distro: upstream: reset with kubeadm reset (#516) (7996bfe)
distro: upstream: upgrade with kubeadm upgrade (#515) (070a758)
docs: generate a reference per Ansible collection (#602) (7b84a08)
release: build, package and smoke-test the zarf module files (#601) (4121315)
schema: mark the properties that can carry a secret (#606) (1efa64a)
tofu: publish the provider to ghcr.io as an OpenTofu mirror (#609) (7a687f9)
upstream: apply a CNI manifest after bootstrap (#513) (bea8299)
zarfmod: answer Ansible as zarf_init and zarf_package_deploy (#598) (5b96891)

Bug Fixes

distro: refuse a downgrade before any phase writes to a host (#607) (9f66dda)

Refactoring

cmd: build the released binary from cmd/cargoship (#596) (8127dbe)
containers: base the ubi image on almalinux 10-base (#593) (e3b8574)
containers: remove labels from docker files (#594) (abd7476)

Documentation

zarf: document the collection and record why it is a proof (#604) (77b526a)

Miscellaneous

git: mark every generated path linguist-generated (#597) (6a552e4)

Build

deps: bump github.com/andybalholm/brotli from 1.2.5 to 1.2.6 (#612) (27d3f41)
deps: bump github.com/Azure/azure-sdk-for-go/sdk/internal from 1.12.0 to 1.13.0 (#613) (08dd9c6)
deps: bump github.com/go-git/go-billy/v5 from 5.9.1 to 5.9.2 (#591) (89ae5ac)
deps: bump github.com/goccy/go-json from 0.11.1 to 0.11.2 (#611) (671a196)
deps: bump github.com/zarf-dev/zarf from 0.86.0 to 0.87.0 (#615) (85538ef)
deps: bump go.opentelemetry.io/proto/otlp from 1.11.0 to 1.11.1 (#614) (84c19d0)
tofu: add the provider binary and record where it lives (#605) (d7f6126)

0.29.0 (2026-10-02)

⚠ BREAKING CHANGES

remove 32bit support (#590)
reset: remove the hosts, firewall, and fapolicyd flags it never read (#573)
enable merge queue on main branch (#552)

Features

create: add –file-override to mirror file downloads (#548) (814694e)
create: record per-file provenance for overridden downloads (#549) (ac27c42)
examples: extract rke2 files straight from the release tarball (#567) (0423ca0)
render containerd config and hosts.toml, import bundled images (#510) (0bf420e)

Bug Fixes

cmd: check inputs before the –confirm gate and report each failure once (#571) (0b0f17f)
config: expand a leading ~ in age identity and recipients file paths (#586) (931ed0a)
create: validate extracted-file shasum, not the downloaded archive (#566) (7ce6811)
lang: correct typos and miswording in command help and phase titles (#575) (7e3029b)
reset: remove the hosts, firewall, and fapolicyd flags it never read (#573) (2a3cf37)

Refactoring

cmd: collapse the duplicate flag-name constants onto one each (#574) (7585b71)
magefiles: split large package files by topic (#547) (82ea3b4)
phase: drop the unused InstallFapolicy phase (#577) (d90456b)

Documentation

lang: add long help for the core lifecycle and package commands (#572) (6e47965)
readme: add installation instructions and –confirm to the examples (#570) (69a763a)

Miscellaneous

engine: update rke2 and k3s (#563) (26b1bd0)
examples: generate new distro (#564) (cee3ea2)
examples: regenerate the rke2 packages from the new template (#568) (18969dd)

CI/CD

enable merge queue on main branch (#552) (3beec00)
ignore crypto11 in Dependabot, its module path moved upstream (#587) (d5e37e7)
lint: run golangci-lint at the version the hooks pin (#551) (ee97211)
re-work dependabot config (#557) (934972b)
remove 32bit support (#590) (d7a59b8)
update Dependabot schedule to daily for gomod and pre-commit (#578) (8b2df63)

Build

deps: bump almalinux/10-base from f110fee to ed618ca in /containers/ansible (#580) (15c57d0)
deps: bump almalinux/10-minimal from ee053be to 1c0191d in /containers/ubi (#579) (829a09e)
deps: bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.23.1 to 1.23.2 (#585) (43b6dbd)
deps: bump github.com/AzureAD/microsoft-authentication-library-for-go from 1.10.0 to 1.10.1 (#584) (ff7f71b)
deps: bump github.com/buildkite/go-pipeline from 0.18.0 to 0.18.1 (#581) (4b13f5a)
deps: bump github.com/docker/cli from 29.8.1+incompatible to 29.8.2+incompatible (#555) (2d580cf)
deps: bump github.com/go-openapi/jsonreference from 1.0.2 to 1.0.3 (#562) (559b1b1)
deps: bump github.com/goccy/go-json from 0.10.6 to 0.11.1 (#559) (6e5d1de)
deps: bump github.com/googleapis/gax-go/v2 from 2.26.0 to 2.26.2 (#558) (42275b3)
deps: bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.30.0 to 2.31.0 (#560) (6140c26)
deps: bump github.com/nao1215/markdown from 1.1.0 to 1.1.1 (#561) (d9683bd)
deps: bump github.com/pb33f/go-yaml from 0.1.0 to 0.1.1 (#589) (54a52da)
deps: bump github.com/pb33f/ordered-map/v2 from 2.3.1 to 2.3.2 (#582) (5b0b1e2)
deps: bump github.com/pierrec/lz4/v4 from 4.1.30 to 4.1.31 (#583) (ad1e0d0)
deps: bump sigs.k8s.io/kustomize/kyaml from 0.21.1 to 0.21.2 (#588) (70668f0)

0.28.2 (2026-09-30)

Features

install: address issue when dnf pin is not present (#543) (d27943c)

Bug Fixes

gitattributes: drop stale src/ prefix from the generated Go pattern (#544) (8241486)

Documentation

agents: symlink CLAUDE.md to AGENTS.md and warn on its root-only scope (#545) (09d5858)

Build

deps: bump https://github.com/golangci/golangci-lint from v2.13.2 to 2.14.0 in the core group (#541) (4328aab)

0.28.1 (2026-09-30)

Features

drift: move files around to make sense (#540) (098ac1b)
install and pin upstream kubeadm packages (#509) (dbe72cb)

Documentation

agent: add Go test formatting rule and align repo with it (#534) (9d3e246)

CI/CD

examples: include version for upstream (#536) (6468cbf)
examples: update versions (#537) (dd0959b)
releaser: update config to address build issues (#539) (10ef7cc)

Build

deps: bump github.com/ProtonMail/go-crypto from 1.5.1 to 1.5.2 (#532) (0696e8a)
deps: bump the core group with 3 updates (#533) (11c1e7f)
deps: bump the cosign group with 15 updates (#529) (634975a)
deps: bump the k8s group with 7 updates (#528) (f203186)
deps: bump the misc group with 19 updates (#530) (fd2cfca)

0.28.0 (2026-09-27)

⚠ BREAKING CHANGES

move src/ contents to repo root (#503)
update to v2 rig (#214)

Features

add k3s single-controller topology for e2e-cluster CI (#504) (f95b31b)
finish the apply walk, from the engine config to disconnect (#273) (8f4830c)
generate example/upstream/distro.yaml instead of hand-writing it (#519) (853f22d)
register upstream (kubeadm) distro type (#508) (8934c6d)
tear the distro back off the cluster at the end of the run (#276) (2d67c45)
update to v2 rig (#214) (b7c5440)
walk the apply phases a second time against the installed cluster (#274) (1f04e4e)
walk the phases a third time to upgrade the installed cluster (#275) (c13eaa3)

Bug Fixes

mark engine populated only when a phase actually uploaded files (#502) (9e78c0d)

Refactoring

move src/ contents to repo root (#503) (cdf9b5f)
move test/ out of src/ and consolidate shared internal/ packages (#495) (cd771c4)

Documentation

add src/fuzz AGENTS.md and rename FuzzParseRecipient to avoid -fuzz ambiguity (#500) (970d154)
agent: require pre-commit before commit, drop em dash (#523) (458cc4d)
ai disclosure (#496) (770b931)
generate godoc and schema reference pages (#524) (157ab95)
security: annotate Binary-Artifacts scorecard finding (#491) (705db3f)
workflows: add per-workflow explanations under docs/workflows (#525) (d4467af)

Miscellaneous

deps: update Kubernetes upstream pin in thirdparty-src/pins.json (#526) (e85c04d)
regenerate example/upstream from the new generator (#520) (b4ac7c4)

CI/CD

fuzz: address found error in parser (#506) (a41ca5f)
publish artifacts on regular basis (#445) (89085d7)
test-build container images on dependabot docker bumps (#499) (a76827f)

Build

deps: bump chainguard/cgr.dev/chainguard/static from 90b7f22 to a6d1bbf (#490) (b547eae)
deps: bump chainguard/cgr.dev/chainguard/static from a6d1bbf to f2787f1 (#497) (c25c5e8)
deps: bump github.com/containerd/containerd/v2 from 2.4.0 to 2.4.1 (#507) (d0e9b6c)
deps: bump k8s.io/streaming from 0.37.0 to 0.37.1 in the k8s group (#492) (b78c39e)
deps: bump the golang group with 2 updates (#493) (24a532c)
deps: bump the misc group with 5 updates (#494) (e9f76d2)

0.27.0 (2026-09-24)

⚠ BREAKING CHANGES

release: add windows support (#487)

Documentation

address some drift (#486) (093b943)

CI/CD

release: add windows support (#487) (b80834d)

0.26.2 (2026-09-23)

Documentation

ansible: declare the module and role interfaces in the collection (#481) (c4437fe)
ansible: generate the collection reference pages (#482) (d53be49)
fix drift for new features (#479) (060493c)
generate the book’s front matter from README.md and SECURITY.md (#484) (6e77cef)

CI/CD

actions: address some issues with score-card (#485) (c57d82d)
deps: add workflow for adding back osv-scanned toml (#480) (8286777)
modify Cosign verification steps in .goreleaser.yaml (#477) (efbf83d)

0.26.1 (2026-09-22)

Features

cli: add flag for overriding version (#469) (472b4b2)
example: allow overriding pod sec (#470) (9055c02)
examples: update pod sec overrides (#471) (42412ec)

Miscellaneous

deps: update shadow utils 4.15.0-11.el10 (#476) (089b468)

CI/CD

actions: fix look up (#474) (c02d2db)
container: pin dnf packages (#468) (259f717)
pin: update issue search (#473) (01e35fd)

Build

deps: bump github.com/ulikunitz/xz from 0.5.16 to 0.5.17 in the misc group (#465) (b00556d)
deps: bump the cosign group with 2 updates (#464) (7963065)

0.26.0 (2026-09-22)

⚠ BREAKING CHANGES

address various unsafe repo settings (#446)

Features

ansible: add container to goreleaser (#456) (25667e2)
ansible: add heartbeat to ansible logs (#458) (7998f65)
ansible: add the apply, prepare, reset and kube-config modules (#433) (f611cfb)
ansible: build and publish the collection with the release (#434) (ec48f76)
ansible: expand flags passed in from ansible (#459) (a6fa3f3)
ansible: generate a cluster inventory from an Ansible inventory (#429) (46f6de8)
ansible: report changed from what the phases did (#432) (732df4e)
ansible: run the cargoship binary as an Ansible module (#430) (95763f9)
cli: loosen check on registry mismatch when encrypted (#460) (4e59787)
fuzz: add ansible (#436) (cbcf7c5)
release: add rpm, deb, and apk signing (#461) (7c58b2c)

Bug Fixes

clustercfg: correct six YAML splice defects (#438) (f2f0730)

Documentation

add ideas for inventory from-x (#437) (0707742)
agent: refine pr description (#440) (9d5c4d6)
agent: update docs folder agent (#441) (7017588)
ansible: readme’s and examples (#462) (ec651cb)
security md (#444) (aca4a58)

CI/CD

add openssf score card run (#443) (83f657c)
address various unsafe repo settings (#446) (d487baa)
ansible: add version checking (#455) (d198d4b)
codeql: add advanced setup for codeql (#428) (b9134df)
e2e: add ansible tests (#435) (f2acff9)
flow: add check for image drift in docker files (#442) (22d8106)
mage: expose osv overrides (#463) (7838fd9)
vendor: stop scoring vendored JavaScript and Python as cargoship vulns (#447) (d757666)

Build

deps: bump github.com/docker/cli from 29.8.0 to 29.8.1 (#451) (54c34a2)
deps: bump github.com/zarf-dev/zarf from 0.85.0 to 0.86.0 in the zarf group (#449) (ee26849)
deps: bump library/alpine from 28bd5fe to 294b683 in /containers/base (#466) (17025c5)
deps: bump the core group with 2 updates (#425) (d7cfa2f)
deps: bump the core group with 3 updates (#452) (85bcdf8)
deps: bump the cosign group with 10 updates (#453) (03eaa90)
deps: bump the golang group with 2 updates (#450) (0c68c6a)
deps: bump the misc group with 13 updates (#454) (8f4b952)
deps: bump ubi9/ubi-minimal from 7b8e25a to 984df0a (#448) (fdcd56c)

0.25.0 (2026-09-18)

⚠ BREAKING CHANGES

dagger: remove dagger config (#419)

Features

vault: add age receipts (#424) (1d814ee)

Bug Fixes

clustercfg: stop corrupting flow mappings and CRLF documents (#422) (687baea)

Documentation

github: add AGENTS.md for pull request descriptions (#423) (083794e)

CI/CD

dagger: remove dagger config (#419) (fb5be40)
fuzzing: testing (#421) (8d8eeff)

0.24.0 (2026-09-17)

⚠ BREAKING CHANGES

cli: add validate command (#417)
schema: generate schema file (#416)

Features

assemble: resolve values before the build runs (#403) (8c62cb5)
cli: add validate command (#417) (d0ca618)
engine-config-sync: report the files written in place (#405) (c52caef)
engineconfig: validate disable values against generated addon lists (#409) (9947469)
examples: give the example packages values files and schemas (#401) (a6ec737)
examples: show values templating, and document it (#406) (129b4ef)
helmvalues: add Helm-style value templating and values plumbing (#400) (a74a2af)
helmvalues: add the Helm serialization functions sprig lacks (#402) (adafd63)
refine schema more (#415) (459ba17)
schema: generate schema file (#416) (b20df28)
values: disable bundled engine addons from the inventory (#408) (92c9ba5)
values: render the engine configuration and templated files at … (#404) (0545780)

CI/CD

example: add schema support in-editor (#414) (47443df)
example: expand packages (#413) (4bcb523)
example: generate all examples (#412) (4326533)

Build

deps: bump chainguard/cgr.dev/chainguard/static from fa805e7 to 90b7f22 (#411) (902711a)

0.23.0 (2026-09-16)

⚠ BREAKING CHANGES

change base image for non-ubi image (#399)

Features

cluster: accept SSH keys as age keys (#391) (1323ef9)
clustercfg: report registry credentials encrypt-file unchanged (#387) (b850c09)
detect a host removed from the config (#340) (89278c0)
distrocfg: record installed distro release metadata on hosts (#378) (6a15aac)
engineconfig: add k3s and rke2 v1.37 generated engine config (#377) (2a2ffdc)
utils: add DownloadToCache helper (#379) (fa4b120)
vault: support age alongside ansible vault (#386) (d838275)
vault: vendor age-keygen (#389) (4efb76c)

Miscellaneous

examples: cache downloaded release asset lists (#376) (a8a04d1)

CI/CD

action: disable require main pr check (#390) (a6502d2)
add language_version tied to go.mod (#375) (6c191c5)
change base image for non-ubi image (#399) (4d9f93a)
dependabot: add docker registry auth (#395) (30c4623)
dependabot: add registry1 auth (#398) (863afa8)

Build

deps: bump sigs.k8s.io/controller-runtime from 0.25.0 to 0.25.1 (#396) (2a24295)
deps: bump the misc group across 1 directory with 2 updates (#397) (8b57a7e)
deps: bump ubi9/ubi-minimal from 186a94b to e5161a7 (#381) (4811f95)
deps: bump ubi9/ubi-minimal from d235f60 to 186a94b (#373) (3ff2627)
deps: bump ubi9/ubi-minimal from e5161a7 to 7b8e25a (#393) (eae8bbc)

0.22.1 (2026-09-13)

CI/CD

gorelease: add ‘latest’ tag (#372) (d4c0f1e)

Build

deps: Bump the cosign group with 20 updates (#369) (8f00046)
deps: Bump the misc group with 6 updates (#370) (7bc188f)

0.22.0 (2026-09-13)

⚠ BREAKING CHANGES

add docker images (#364)
add code owners file (#366)

Features

cli: remove unneeded global flags (#361) (1185e46)

Refactoring

test: make it more easy to track (#362) (bde3b68)

CI/CD

add code owners file (#366) (5053f9e)
add docker images (#364) (a3a5070)
add pre-commit checking (#365) (e19472a)

Build

deps: Bump alpine from 3.22 to 3.24 (#368) (6f85407)
deps: Bump the golang group 11 updates (#367) (d727bd3)

0.21.0 (2026-09-11)

⚠ BREAKING CHANGES

kubeconfig as value (#337)

Features

allow passing yaml blocks for helm manifests (#341) (d493a7c)
kubeconfig as value (#337) (d718299)
vault: add “vault decrypt” and “vault decrypt-path” (#346) (4d687ad)
vault: add “vault encrypt-file” and “vault decrypt-file” (#347) (a3304fb)
vault: add “vault encrypt-path” to encrypt a value in place (#345) (72eef41)
vault: add “vault rekey” to move a config to a new vault password (#351) (84c743f)
vault: group the vault commands under a “vault” subcommand (#344) (67c435c)
vault: make the new rekey password optional and re-salt in place (#354) (b06854a)
vault: resolve anchors and aliases before walking a config (#356) (dc16a42)
vault: take several YAML paths per encrypt-path and decrypt-path run (#355) (3cc9b2e)

Bug Fixes

vault: rewrite a credential two registries share only once (#357) (a91971a)

Refactoring

examples: show off yaml block (#342) (82ffe23)

Documentation

vault: add a guide to vault encryption and decryption (#348) (6f1ad35)

CI/CD

build required action always (#352) (43137fa)
delete a pull request’s example packages on close, and sweep stale ones after 30 days (#359) (f6a922a)
run publish-example once goreleaser has uploaded the release (#350) (90b9c13)
update logic on clean (#360) (d42991e)

0.20.1 (2026-09-10)

Features

add mage function for generating packages (#335) (5dd0c19)
engine-config: remove files cargoship no longer writes (#331) (2f9de30)
engine-config: write each engine config file with its own mode (#330) (d9fe4bf)
make the registry proxy optional (#328) (d5da3d7)
registry: check vault-encrypted registry values before connecting (#332) (e9b7f60)
registry: support per-registry TLS configuration (#329) (46f6486)
respect image compress on uploaded images (#265) (c517e71)

Bug Fixes

write the registry keys the engines actually read (#327) (ab1565b)

Refactoring

example: expand examples and dev setup (#334) (2c49dfd)

0.20.0 (2026-09-09)

⚠ BREAKING CHANGES

rework backend selection (#264)

Features

add dry-run support (#312) (c1a2cf4)
assemble multi-arch packages with an OCI image index (#263) (db8d106)
assert the firewall and the three upload phases (#272) (e5bc4c2)
multi-arch: export an image tarball per host architecture (#269) (765dfe5)
multi-arch: generate multi-architecture examples for rke2, k3s, and upstream (#323) (cb4d556)
multi-arch: publish a package index per architecture and pull across architectures (#322) (93ac0d3)
multi-arch: upload the files a host’s own architecture selects (#268) (ca40e5d)
reject a host the package carries no architecture for (#267) (fe73d68)
rework backend selection (#264) (7181dda)
run the staging phases against a smaller cluster in CI (#293) (2b62d54)
start work on multi-arch support (#261) (d5661d1)
walk the apply phases against a live cluster, through ModifyHosts (#271) (5886029)

Bug Fixes

export image tarballs for the package architecture (#266) (dbe65d7)
honour –architecture on package create and package pull (#262) (4665c85)

Refactoring

distro: drop the concrete-type switch from the uninstall phase (#318) (7e8f8ad)
distro: move the engine version regex off Common (#317) (d2149a4)
distro: read admin kubeconfig credentials through the distro interface (#319) (74c792a)
example: retune the cilium defaults and unquote the sysctl values (#324) (bb06592)

Documentation

play with cleaner print-able (#254) (c751bf4)

CI/CD

add extra label for release (#295) (fb865a0)
keep the cluster on failure and upload node diagnostics (#296) (a542a53)
publish an example package to GHCR with setup-cargoship (#326) (a9be49d)
unhide refactor section (#321) (f45dcd6)
update dependabot config (#303) (920e515)

Build

deps: Bump github.com/docker/cli from 29.7.2 to 29.8.0 (#300) (f399338)
deps: Bump github.com/zarf-dev/zarf from 0.84.0 to 0.85.0 (#297) (8ffbd14)
deps: Bump sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.0 (#298) (8d6e542)
deps: Bump the cosign group with 15 updates (#314) (7fca7b6)
deps: bump the cosign group with 9 updates (#301) (b3cd234)
deps: Bump the docker group with 2 updates (#316) (22ffa2b)
deps: Bump the golang group with 2 updates (#299) (f18c2ba)
deps: Bump the misc group across 1 directory with 36 updates (#313) (1574582)

0.19.0 (2026-09-01)

⚠ BREAKING CHANGES

rework to add ufw support (#249)
drop the update- prefix from the host modification flags (#250)

Features

add an nftables firewall backend (#251) (7541115)
drop the update- prefix from the host modification flags (#250) (39d0d47)
rework to add ufw support (#249) (8576563)

0.18.0 (2026-09-01)

⚠ BREAKING CHANGES

add package verification (#248)

Features

add package verification (#248) (231030b)

Build

deps: Bump github.com/docker/docker-credential-helpers from 0.9.8 to 0.9.9 (#241) (0c0d8e8)
deps: Bump golangci-lint from v2.13.1 to 2.13.2 in the core group across 1 directory (#239) (e9bdab8)
deps: Bump google.golang.org/api from 0.293.0 to 0.295.0 (#247) (a42d408)
deps: Bump the core group across 1 directory with 2 updates (#242) (2d16203)
deps: Bump the cosign group across 1 directory with 20 updates (#244) (b31baad)
deps: Bump the k8s group across 1 directory with 7 updates (#243) (afb47df)
deps: Bump the opentelemetry group across 1 directory with 11 updates (#245) (5d15c69)

0.17.0 (2026-08-31)

⚠ BREAKING CHANGES

make package signature verification actually run on publish and local sources (#236)

Bug Fixes

add logging into debug on config (#238) (28a9aba)
make package signature verification actually run on publish and local sources (#236) (bc34895)
remove no-op –skip-sbom flag, unblock vault-encrypt env fallbacks (#235) (8a5c5bc)

CI/CD

add commit into mage build (#237) (abca83e)
update actions (#232) (c62b748)

0.16.0 (2026-08-30)

⚠ BREAKING CHANGES

generate rke2 and k3s example packages per CNI flavor (#228)

Features

generate rke2 and k3s example packages per CNI flavor (#228) (d9e5c0d)
generate typed engine config structs per distro and version (#226) (c2649b3)
pull pinned k3s and rke2 source into thirdparty-src (#225) (b8ee106)
validate engine config keys against the generated schemas (#227) (b959ef5)

Documentation

add usage examples to every cargoship subcommand (#230) (d4d7528)
expand the mage target reference (#224) (84c60f7)

CI/CD

add commit hash (#231) (b9ac48a)

0.15.1 (2026-08-29)

Features

reduce binary (#221) (43a17fc)

0.15.0 (2026-08-28)

⚠ BREAKING CHANGES

add profile concurrency (#219)
allow registry overrides (#215)

Features

add profile concurrency (#219) (1abcc66)
allow registry overrides (#215) (cac56ee)

Bug Fixes

logging on rig (#217) (4e00e99)

0.14.0 (2026-08-27)

⚠ BREAKING CHANGES

add logging to file (#213)
add logic for keeping track of files uploaded (#212)
add registry overrides (#211)

Features

add ability to sign packages (#208) (3646edf)
add logging to file (#213) (b9ee105)
add logic for keeping track of files uploaded (#212) (de757a9)
add registry overrides (#211) (cb65777)
add the ability to create reproducible packages (#209) (2737a87)

0.13.0 (2026-08-24)

⚠ BREAKING CHANGES

add caching of artifacts (#204)

Features

add caching of artifacts (#204) (854111d)
add shell completion for arch (#207) (e81b2fb)
fix permissions when pulling package (#206) (8990299)

CI/CD

update dependabot config (#196) (3ca50fd)

Build

deps: Bump google.golang.org/grpc from 1.83.0 to 1.83.1 (#195) (8878453)
deps: Bump the core group across 1 directory with 2 updates (#198) (1b6324e)
deps: Bump the cosign group across 1 directory with 16 updates (#199) (3bbb43d)
deps: Bump the k8s group across 1 directory with 8 updates (#194) (9b49268)
deps: Bump the misc group across 1 directory with 28 updates (#201) (dfb9e29)

0.12.0 (2026-08-23)

⚠ BREAKING CHANGES

rework viper config (#191)

Features

add shell completion for flags (#190) (9c4046a)
rework viper config (#191) (5513027)

CI/CD

move mage main to allow vendoring (#188) (75c6d46)

0.11.0 (2026-08-21)

⚠ BREAKING CHANGES

update zarf version (#187)

Features

update zarf version (#187) (13c9595)

Build

deps: Bump the cosign group across 1 directory with 20 updates (#183) (eb4a6ff)
deps: Bump the golang group across 1 directory with 10 updates (#182) (a9deafc)
deps: Bump the misc group across 1 directory with 17 updates (#186) (b20ea24)
deps: Bump the opentelemetry group across 1 directory with 5 updates (#184) (61ce493)

0.10.2 (2026-08-14)

Features

remove ingests folder from tarball (#180) (29ded7b)

Documentation

add asd ste1000 (#179) (6fed7f5)

0.10.1 (2026-08-12)

Documentation

simplify markdown (#177) (37511a5)

0.10.0 (2026-08-11)

⚠ BREAKING CHANGES

add profiles for the config (#176)
schema generator includes golang comments (#165)

Features

add profiles for the config (#176) (cda1112)
add the built dagger artifacts (#158) (9f61630)
schema generator includes golang comments (#165) (68364ff)
standardize the location distro interaction (#159) (3ba592e)

Documentation

expand info about the project (#166) (4d672f5)

CI/CD

update dependabot to update indirect goland modules (#138) (5cd3b69)
update the dependabot (#174) (8061c61)
update the dependabot config (#172) (aa6652a)
update the dependabot logic (#150) (d7b2fef)

Build

deps: Bump github.com/alibabacloud-go/debug from 1.0.0 to 1.0.1 (#149) (6891f31)
deps: Bump github.com/aws/aws-sdk-go-v2/internal/configsources from 1.4.29 to 1.4.34 (#144) (45d3e40)
deps: Bump github.com/Azure/go-autorest/autorest/date from 0.3.0 to 0.3.1 (#143) (e3e647f)
deps: Bump github.com/docker/cli in the docker group across 1 directory (#167) (8ef1011)
deps: Bump github.com/felixge/httpsnoop from 1.0.4 to 1.1.0 (#154) (be7dd60)
deps: Bump github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.15 (#142) (e620467)
deps: Bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#163) (8300cdd)
deps: Bump github.com/go-openapi/swag/pools from 0.27.3 to 0.28.0 (#145) (f712628)
deps: Bump github.com/lestrrat-go/dsig from 1.2.1 to 1.3.0 (#141) (b280e61)
deps: Bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.2.0 (#157) (b077c77)
deps: Bump github.com/moby/sys/sequential from 0.6.0 to 0.7.0 (#156) (081a016)
deps: Bump go.opentelemetry.io/…/google.golang.org/grpc/otelgrpc from 0.68.0 to 0.69.0 (#155) (457dfa7)
deps: Bump go.opentelemetry.io/otel/metric from 1.44.0 to 1.45.0 (#162) (91435aa)
deps: Bump go.opentelemetry.io/otel/metric from 1.44.0 to 1.45.0 in /.dagger (#164) (268f75a)
deps: Bump the aws group across 1 directory with 14 updates (#151) (4af8fdf)
deps: Bump the aws group across 1 directory with 15 updates (#168) (56ea0cf)
deps: Bump the azure group across 1 directory with 6 updates (#152) (26a3688)
deps: Bump the docker group across 1 directory with 2 updates (#140) (9fce9c0)
deps: Bump the misc group across 1 directory with 28 updates (#175) (031dc81)
deps: Bump the openapi group across 1 directory with 11 updates (#153) (8273afb)
deps: Bump the sigstore group across 1 directory with 6 updates (#161) (26f65d3)

0.9.0 (2026-08-05)

⚠ BREAKING CHANGES

add framework for publishing and pulling packages (#134)

Features

add framework for publishing and pulling packages (#134) (9f97253)

0.8.0 (2026-08-04)

⚠ BREAKING CHANGES

add sha256sum command (#136)

Features

add sha256sum command (#136) (a1b5f8b)

Documentation

add mdbook site builder (#135) (fa31b78)

CI/CD

fix gitignore settings (#133) (47d77bc)
remove bootloose images (#131) (49bc60c)

0.7.0 (2026-07-28)

⚠ BREAKING CHANGES

vendor the golang dep (#128)

CI/CD

add envrc config (#123) (8e3154d)
address dependabot issues (#129) (07c3a04)
vendor the golang dep (#128) (832f376)

Build

deps: Bump actions/checkout from 7.0.0 to 7.0.1 (#122) (0d77578)
deps: Bump actions/setup-go from 6.5.0 to 7.0.0 (#120) (4276e9d)
deps: Bump actions/setup-node from 6.4.0 to 7.0.0 (#119) (bde75d1)
deps: Bump docker/build-push-action from 7.2.0 to 7.3.0 (#109) (d201529)
deps: Bump docker/login-action from 4.2.0 to 4.3.0 (#112) (902d370)
deps: Bump docker/login-action from 4.3.0 to 4.4.0 (#114) (a6ae875)
deps: Bump docker/login-action from 4.4.0 to 4.5.1 (#126) (3d087d1)
deps: Bump docker/login-action from 4.5.1 to 4.5.2 (#130) (e93e7c1)
deps: Bump docker/setup-buildx-action from 4.1.0 to 4.2.0 (#113) (92a726b)
deps: Bump github.com/containerd/containerd/v2 from 2.3.2 to 2.3.3 (#118) (8992739)
deps: Bump golang.org/x/sync from 0.21.0 to 0.22.0 (#115) (1ec8814)
deps: Bump https://github.com/google/keep-sorted from v0.9.0 to 0.9.1 (#110) (773b5f3)
deps: Bump k8s.io/client-go from 0.36.2 to 0.36.3 in the k8s group across 1 directory (#125) (7126818)
deps: Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#116) (7140d42)

0.6.0 (2026-06-30)

⚠ BREAKING CHANGES

add firewalld policy management (#107)
reduce binary size (#101)

Features

add firewalld policy management (#107) (4a52030)
reduce binary size (#101) (81bd7ea)

Build

deps: Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 (#105) (a314b7c)
deps: Bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 (#106) (0b32174)

0.5.0 (2026-06-25)

⚠ BREAKING CHANGES

add prepare command (#99)

Features

add prepare command (#99) (9f191aa)
logging: add better logic for distro output (#97) (8e96e83)
update the rig version to use upstream package (#92) (6e34be6)

CI/CD

dagger: update version (#88) (a1643cb)
update dagger to 0.21.7 (#96) (da2b4f8)

Build

deps: Bump actions/checkout from 6.0.2 to 6.0.3 (#85) (e059838)
deps: Bump actions/checkout from 6.0.3 to 7.0.0 (#94) (2c55700)
deps: Bump actions/setup-go from 6.4.0 to 6.5.0 (#98) (6686e60)
deps: Bump github.com/k0sproject/rig from 0.21.10 to 0.21.11 (#100) (8152958)
deps: Bump github.com/txn2/txeh from 1.8.0 to 1.8.1 (#86) (cc8160e)
deps: Bump github.com/zarf-dev/zarf from 0.76.0 to 0.77.0 (#83) (c9edcb8)
deps: Bump https://github.com/google/keep-sorted from v0.8.0 to 0.9.0 (#87) (682a63b)
deps: Bump k8s.io/client-go from 0.36.1 to 0.36.2 in the k8s group across 1 directory (#91) (1138748)
deps: Bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 (#89) (b4a51f8)

0.4.0 (2026-05-23)

⚠ BREAKING CHANGES

add dagger for ci building (#59)

Features

add dagger for ci building (#59) (2545844)
add mage for make like tool (#63) (e35aed7)
change sysctl to create a file (#62) (aba7d57)
cmd: expand version debug info (#68) (29fd345)
distro: update the upgrade logic for rancher (#66) (7c4da85)
update version to include deps (#60) (9304ae9)

Miscellaneous

deps: updates rig version (#69) (cf0afc0)
mage: move generate logic to mage (#70) (413eea0)

CI/CD

allow building on host system (20cac43)
remove the mage sub-modules (#74) (9c073a4)
update dagger deps (#64) (96ad0c8)

Build

deps: Bump actions/create-github-app-token from 3.1.1 to 3.2.0 (#61) (ac2c0b7)
deps: Bump docker/build-push-action from 7.1.0 to 7.2.0 (#79) (a0b4da1)
deps: Bump docker/login-action from 4.1.0 to 4.2.0 (#80) (5d69ede)
deps: Bump docker/setup-buildx-action from 4.0.0 to 4.1.0 (#82) (f147cf5)
deps: Bump github.com/containerd/containerd/v2 from 2.2.3 to 2.3.0 (#73) (9639439)
deps: Bump github.com/containerd/containerd/v2 from 2.3.0 to 2.3.1 (#78) (e6f1bd1)
deps: Bump github.com/invopop/jsonschema from 0.13.0 to 0.14.0 (#77) (d899d71)
deps: Bump github.com/magefile/mage from 1.15.0 to 1.17.2 (#75) (9ac36d1)
deps: Bump github.com/stoewer/go-strcase from 1.3.0 to 1.3.1 (#76) (df7314c)
deps: Bump github.com/zarf-dev/zarf from 0.75.1 to 0.76.0 (#67) (589b14f)
deps: Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (#81) (220e939)
deps: Bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 (#71) (e27ed7b)
deps: Bump k8s.io/client-go from 0.36.0 to 0.36.1 in the k8s group across 1 directory (#72) (920efb9)
deps: Bump sigstore/cosign-installer from 4.1.1 to 4.1.2 (#57) (3aa3636)

0.3.0 (2026-05-07)

⚠ BREAKING CHANGES

add proper code attribution (#55)

Features

add command to get kubeconfig (#41) (ae53fdf)
add proper code attribution (#55) (e971e89)
address panic when no config is found (#51) (ff86d1a)
update rig fork (#49) (71b9124)

CI/CD

e2e: add image files for testing cargoship (#52) (9d02b45)

Build

deps: Bump github.com/zarf-dev/zarf from 0.75.0 to 0.75.1 (#46) (57327f8)
deps: Bump https://github.com/golangci/golangci-lint from v2.11.4 to 2.12.1 (#45) (d791dd0)
deps: Bump https://github.com/golangci/golangci-lint from v2.12.1 to 2.12.2 (#56) (8d00775)

0.2.5 (2026-05-01)

CI/CD

release: expand release logic (10eb37f)

Build

deps: Bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 (#42) (945d93b)

0.2.4 (2026-04-29)

CI/CD

release: change cosign cert (#35) (ce4c5be)

0.2.3 (2026-04-28)

Features

rework cosign logic (#34) (9c5687f)

Build

deps: Bump sigstore/cosign-installer from 4.1.0 to 4.1.1 (#32) (25cbcdd)

0.2.2 (2026-04-28)

CI/CD

release: remove cosign key (#30) (2f0f9b0)

0.2.1 (2026-04-28)

CI/CD

release: add cosign binary (#28) (6ba9cee)

0.2.0 (2026-04-27)

CI/CD

release: add syft action (#24) (3b9293e)

0.1.0 (2026-04-27)

Features

add logic for allowing distro to manage stopping service (#11) (73010f5)
add reset action (#19) (5b3bc07)
core: basic logic for bootstrapping (#1) (03e1704)
distro: add kill-all script for k3s (#12) (d0bc761)
distro: add rke2 1.35.4 (#13) (fcf4616)
init (7918478)
run golangci lint (#16) (f1be9fa)
schema: rework config schema (#23) (444214f)

CI/CD

action: add check for go mod delta’s (#15) (9b1a40d)
commit: add pr title check (#14) (3e071da)
release: configure to bump minor (7bbed97)
release: fix config settings (88a8fd1)
release: remove versioning (30efbff)

Build

deps: Bump actions/setup-node from 6.3.0 to 6.4.0 (#21) (846530b)
deps: Bump github.com/invopop/jsonschema from 0.13.0 to 0.14.0 (#3) (51e8ace)
deps: Bump github.com/stoewer/go-strcase from 1.3.0 to 1.3.1 (#4) (9ea3635)
deps: Bump googleapis/release-please-action from 4.4.0 to 5.0.0 (#2) (0e30fa2)
deps: Bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 (#22) (5d094f0)

Keyboard shortcuts

0.37.0 (2026-10-27)

0.36.0 (2026-10-27)

0.35.0 (2026-10-21)

0.34.0 (2026-10-18)

0.33.0 (2026-10-14)

0.32.1 (2026-10-13)

0.32.0 (2026-10-12)

0.31.0 (2026-10-06)

0.30.0 (2026-10-05)

0.29.0 (2026-10-02)

0.28.2 (2026-09-30)

0.28.1 (2026-09-30)

0.28.0 (2026-09-27)

0.27.0 (2026-09-24)

0.26.2 (2026-09-23)

0.26.1 (2026-09-22)

0.26.0 (2026-09-22)

0.25.0 (2026-09-18)

0.24.0 (2026-09-17)

0.23.0 (2026-09-16)

0.22.1 (2026-09-13)

0.22.0 (2026-09-13)

0.21.0 (2026-09-11)