kobe: baixar versions anteriors

Kobe keeps logs and terminals usable when a long-lived sandbox fills its execution ledger. New execution requests receive a capacity error before they consume space needed for access and teardown.
- Compact repeated execution identities while retaining every reservation and retry record.
- Recover full legacy ledgers during access registration or gate closing.
- Let existing reservations bind and finish even when the legacy ledger predates the admission budget.
- Update TLS dependencies to patched releases.
Operator upgrade
Stop every older operator replica before starting v0.61.1. Use a coordinated restart across this format change: an older controller can quarantine a lease after a newer replica compacts its history. Pause automatic rollout while coordinating the upgrade. Drain leases with compact histories before rolling back to an older operator.

What's Changed
- feat(cli): install a flake when leasing a sandbox by @jleni in #413
- chore: bump kobe to v0.61.0 by @jleni in #414
Full Changelog: v0.60.0...v0.61.0

What's Changed
- fix(sandbox): release a lease whose Pod ended instead of serving it as Ready by @emmanuelm41 in #408
- fix(sandbox): never rewrite the served Pod when teardown finds a replacement by @emmanuelm41 in #410
- feat(sandbox): optional workspace volume so a full disk fails writes instead of evicting by @emmanuelm41 in #411
- chore: bump kobe to v0.60.0 by @emmanuelm41 in #412
Full Changelog: v0.59.0...v0.60.0

Kobe now works with machines you already reach over SSH. Save a host, run commands, forward ports, or open a shell. For Macs with Screen Sharing enabled, kobe vnc --host adds screenshots, clicks, typing, and the system VNC viewer.
Install with Homebrew:
brew install kunobi-ninja/kunobi/kobe
Added
- SSH hosts: kobe host set, list, and remove manage named machines in global or project configuration. exec, port-forward, and ssh use your system SSH configuration and keys. #403 by @jleni.
- Mac Screen Sharing: VNC commands accept --host and connect over SSH. Passwords are resolved from 1Password, Keychain, environment variables, or commands; configuration stores the reference. #403 by @jleni.
kobe host set mini --ssh ci@mac-mini --vnc-password "op://vault/Mac/password"
kobe host exec mini -- uname -a
kobe vnc screenshot --host mini -f mini.png
Hosts are existing machines: Kobe does not reserve or recycle them. See the host guide for setup and commands.
Contributors
jleni
Full changelog: v0.58.0...v0.59.0

What's Changed
- ci: the pin note said no allowlist change was needed; it was wrong by @jleni in #389
- test(api): give the admission-budget tests room for a real HTTP round trip by @jleni in #391
- test(conformance): wait out a recovering runner before asserting fail-closed by @jleni in #392
- feat(controllers): extend the failure-backoff gate past instance by @jleni in #394
- feat(cli): exec and logs pick a lease when you do not name one by @jleni in #395
- docs(crd): say that rotating a template.files Secret reaches no Sandbox by @jleni in #396
- feat(sandbox): refill warm members when a mounted Secret rotates by @jleni in #397
- docs(agents): how to test what another component has to agree with by @jleni in #399
- fix(sandbox): the warm-member selector hashes the upstream name by @jleni in #398
- fix(conformance): runner_unreachable as a verdict is not a liveness failure by @jleni in #400
- chore: bump kobe to v0.58.0 by @jleni in #401
Full Changelog: v0.57.0...v0.58.0

What's Changed
- test(cli): an unstubbed request is evidence, not a crash by @jleni in #383
- feat(cli): trace requests behind KOBE_TRACE by @jleni in #384
- feat(cli): one interactivity rule, and a lease picker where the arg was required by @jleni in #387
- fix(controllers): stop unwrapping status the reconciler does not own by @jleni in #386
- ci: restore the Windows sysroot instead of downloading it per release by @jleni in #385
- chore: bump kobe to v0.57.0 by @jleni in #388
Full Changelog: v0.56.0...v0.57.0

What's Changed
- feat(cli): colour lease and pool state in status output by @jleni in #380
- fix(sandbox): a producer mid-handoff is not a verdict (#367) by @jleni in #381
- chore: bump kobe to v0.56.0 by @jleni in #382
Full Changelog: v0.55.3...v0.56.0

What's Changed
- fix(controllers): back off every failing reconcile, bounded by its deadline by @jleni in #378
- chore: bump kobe to v0.55.3 by @jleni in #379
Full Changelog: v0.55.2...v0.55.3

What's Changed
- fix(sandbox): name the predicate that rejects a child receipt by @jleni in #370
- fix(controllers): back off failing instances, and stop drift from cutting it by @jleni in #371
- fix(sandbox): make ping runnable under no_new_privs by @jleni in #372
- fix(controllers): never defer a delete behind a failure backoff by @jleni in #376
- chore: bump kobe to v0.55.2 by @jleni in #377
Full Changelog: v0.55.1...v0.55.2

What's Changed
- fix(sandbox): do not pass -clipboard to Debian x11vnc by @jleni in #368
- chore: bump kobe to v0.55.1 by @jleni in #369
Full Changelog: v0.55.0...v0.55.1

What's Changed
- fix(sandbox): split empty runner replies and surface a stale Pod by @jleni in #361
- fix(sandbox): stop minted Roles from reading Pod status by @jleni in #362
- fix(pool): prefer current-template members when binding a lease by @jleni in #364
- feat(sandbox): put KasmVNC in the workspace image by @jleni in #363
- fix(cli): list as status, and ~/ in informational paths by @jleni in #365
- chore: bump kobe to v0.55.0 by @jleni in #366
Full Changelog: v0.54.0...v0.55.0

What's Changed
- feat(cli): show live command output with exec --sync by @jleni in #358
- feat(sandbox): mount administrator-declared Secret files by @jleni in #357
- fix: make sandbox usage limits opt-in and observable by @jleni in #359
- chore: bump kobe to v0.54.0 by @jleni in #360
Full Changelog: v0.53.0...v0.54.0

Kobe sandboxes now include Nix, so projects can run additional tools and define development environments without root. This release also removes timer waits from lease cleanup, fixes stale pool status writes, and keeps k3s provisioning from occupying a reconciliation worker while a cluster boots.
cargo install kobectl --locked --version 0.53.0
# Or install the prebuilt CLI:
brew install kunobi-ninja/kunobi/kobe
Added
- Sandbox tools: Nix 2.35.2 is available to kobe exec and SSH sessions. The login banner suggests nix shell; use a project's nix develop environment for build dependencies. The store counts toward ephemeral storage, and Nix builds within a lease share its isolation boundary. #355 by @jleni.
- Pool recovery: Full pools report Exhausted. Operators can explicitly release quarantined capacity, with warning events and metrics recording completed overrides. The override also works with separate teardown authority. #350, #354 by @jleni.
Fixed
- Lease cleanup: Cluster and Sandbox controllers react to resource changes instead of waiting for short polling timers. Orphaned reservations retire, normal sandbox refills preserve readiness, and stalled execution cleanup reports its cause. These changes remove waits; release-time improvements have not yet been measured on the deployed version. #336, #340, #343, #347, #349 by @jleni.
- Cluster capacity: Pool reconciliation no longer overwrites newer instance state. Concurrent lease requests enforce principal quotas and replay keyed requests. k3s startup no longer blocks a controller worker, and transient bootstrap lookups keep booting clusters pending. #337, #338, #345, #352, #353 by @jleni.
- CLI and desktop: kobe init detects advertised OIDC authentication, doctor stops reporting false auth mismatches, and trust errors point to kobe login --retrust. The sandbox terminal renders UTF-8 correctly and the desktop keeps its background. #334, #341, #342 by @jleni.
Changed
- Lease API: Canonical lease routes accept caller-owned aliases for both lease kinds. Error bodies include consistent reasons; quota refusals and retryable throttling are distinct. Cluster extension refusals now return HTTP 409 instead of 400. #351, #353 by @jleni.
Upgrade notes
Apply the release's CRDs before upgrading the operator; Helm does not update crds/ on upgrades. See Deploy.
Pools with configuration fields their backend ignores now report ConfigSupported=False and stop creating members. Existing members continue serving leases. Remove the unsupported fields to resume provisioning. #348 by @jleni.
Before rolling back to an older operator, clear Exhausted pool phases as described in Troubleshooting.
Contributors
jleni
Full changelog: v0.52.0...v0.53.0

What's Changed
- feat(exec): let an execution run as long as its lease by @jleni in #328
- fix(sandbox): release a Sandbox lease in seconds by @jleni in #330
- feat(exec): show when a command stops, and why by @jleni in #329
- feat(workspace): add GPUI build libraries, clang and bc to the sandbox image by @jleni in #331
- chore: bump kobe to v0.52.0 by @jleni in #332
Full Changelog: v0.51.1...v0.52.0

What's Changed
- fix(auth): OIDC login against Clerk: no client-id audience, plus kobe login --retrust by @emmanuelm41 in #326
- chore: bump kobe to v0.51.1 by @emmanuelm41 in #327
Full Changelog: v0.51.0...v0.51.1

Renames the general-purpose agent image to zondax/kobe-sandbox, preinstalls opencode and iputils-ping, trims the login banner, and lets SSH reach a lease by its pool-relative name.
cargo install kobectl --locked --version 0.51.0
What changed
- Sandbox image rename: The image is published as zondax/kobe-sandbox (formerly kobe-agent-workspace). Existing SandboxPools continue working; update image: to docker.io/zondax/kobe-sandbox:v0.51.0 on your next rollout. Local builds use docker buildx bake sandbox. (#323)
- Preinstalled tooling in sandbox: opencode (opencode-ai@latest) is preinstalled alongside Codex and Claude Code, versioned in /etc/kobe-sandbox-versions. iputils-ping is included for first-hop network diagnostics. (#323)
- Branded login banner: Interactive logins print a single cyan line: kobe · sandbox · N CPUs (cgroup quota). The previous three-line lecture about env vars and GitHub issue numbers is removed. It respects NO_COLOR and TERM=dumb, and stays silent for non-interactive kobe exec. (#322, #323)
- SSH proxy lease resolution: ssh kobe-<pool>-<name> now resolves a lease named <name> within <pool> in addition to whole-host aliases. Leases created via kobe lease --name dev are reachable over SSH directly. (#321)
What this does not fix
- nproc inside the sandbox container still reports the host CPU count rather than the cgroup quota (#272). kobe-runner sizes CARGO_BUILD_JOBS and RUST_TEST_THREADS from the real quota on every process it spawns, but tools that read /proc/cpuinfo or nproc directly still see the host count until a virtualization runtime like Kata is deployed.
Full changelog: v0.50.1...v0.51.0

What's Changed
- fix(sandbox): do not quarantine a child teardown for evidence not written yet by @jleni in #316
- chore: bump kobe to v0.50.1 by @jleni in #317
Full Changelog: v0.50.0...v0.50.1

What's Changed
- feat(reaper): make the host reaper observable by @jleni in #297
- fix(ci): stop a TypeScript lint from fetching helm by @jleni in #298
- fix(runner): refuse non-regular spool documents instead of reading them by @jleni in #299
- fix(lease): expire queued leases on fixed-size pools too by @jleni in #301
- fix(runner): size cargo/rustc from the real cgroup CPU quota by @jleni in #303
- fix(sandbox): pin termination-message path/policy on Sandbox containers by @jleni in #302
- fix(ci): stop conformance from baking the agent-workspace image by @jleni in #300
- chore: bump kobe to v0.50.0 by @jleni in #304
- chore(deps): drop the AWS SDK's legacy TLS stack by @jleni in #306
- chore(deps): cargo update by @jleni in #308
- chore(deps): drop the unsound lru and stop ignoring RUSTSEC-2026-0253 by @jleni in #309
- chore(deps): kunobi-auth 0.11.1 and kunobi-ha 0.6.0 from crates.io by @jleni in #307
- docs: say what the snapshot path and the Sandbox APIs really are by @jleni in #310
- perf(sandbox): wake child placements on the ClusterLease watch by @jleni in #311
- perf(sandbox): advance child placements on child-cluster events by @jleni in #312
Full Changelog: v0.49.0...v0.50.0

What's Changed
- fix(workspace): put the AI CLIs where a shell-less exec can find them by @jleni in #281
- feat(metrics): time how long teardown holds the caller's slot by @jleni in #282
- feat(cli): kobe vnc, a headless VNC client for agents by @jleni in #285
- docs: how to see and drive a Sandbox desktop by @jleni in #286
- feat(cli): kobe vnc open, the desktop in your browser in one command by @jleni in #287
- feat(workspace): rsync in the image, and say that file transfer works by @jleni in #288
- chore: bump kobe to v0.49.0 by @jleni in #291
- fix(controller): announce a Ready lease once, not every 30s by @jleni in #292
- feat(metrics): count runner calls by outcome by @jleni in #293
- feat(metrics): record why a runner call failed, not just that it did by @jleni in #294
Full Changelog: v0.48.0...v0.49.0

What's Changed
- fix(ci): gate the publish on the run that actually built the release by @jleni in #269
- feat(cli): make the init report easier to read at a glance by @jleni in #270
- feat(cli): grouped help, kobe target, completions, and kobe config opens the editor by @jleni in #274
- chore(docker): keep Dockerfiles and their scripts apart by @jleni in #276
- feat(workspace): ship the AI coding CLIs in the baseline image by @jleni in #275
- refactor(workspace): one image, with the desktop inside it by @jleni in #277
- feat(cli): kobe exec --detach for work that outlives the exec by @jleni in #271
- docs: rewrite the public site for adopters and operators by @jleni in #268
- fix(cli): config editor save, working hints, and exec --detach output by @jleni in #278
- fix(cli): one unreachable-endpoint message everywhere, and plain piped output by @jleni in #279
- chore: bump kobe to v0.48.0 by @jleni in #280
Full Changelog: v0.47.0...v0.48.0

What's Changed
- feat(metrics): report sandbox stream lifetime by operation by @jleni in #258
- perf(cli): read the lease listing instead of refetching each lease by @jleni in #257
- fix(sandbox): finish child teardown after the instance is gone or the pool is edited by @jleni in #260
- feat(sandbox): bound lease extension by idleness instead of age by @jleni in #262
- ci: make the k3s conformance gate opt-in on pull requests by @jleni in #264
- fix(metrics): let SigNoz scrape the kobe-sync sidecar by @jleni in #263
- refactor(teardown): share receipt, evidence, pool and fence checks; name quarantine reasons by @jleni in #261
- ci: stop main runs from cancelling each other by @jleni in #265
- fix(cli): status JSON hides dead leases like the text view does by @jleni in #266
- chore: bump kobe to v0.47.0 by @jleni in #267
Full Changelog: v0.46.0...v0.47.0

What's Changed
- fix(cli): ssh-proxy names a pool image without kobe-sshd by @jleni in #254
- refactor(cli): list leases from /v1/leases only by @jleni in #255
- chore: bump kobe to v0.46.0 by @jleni in #256
Full Changelog: v0.45.1...v0.46.0

What's Changed
- fix(cli): attach --no-tty copies bytes without touching a terminal by @jleni in #249
- feat(cli): show availability, policy, and capabilities in the init pool picker by @jleni in #250
- ci: run both placements of a conformance scenario at once, with timings by @jleni in #251
- chore: bump kobe to v0.45.1 by @jleni in #252
- feat(sandbox): sessions that survive a dropped connection by @jleni in #253
Full Changelog: v0.45.0...v0.45.1

What's Changed
- fix(workspace): use Firefox in GUI leases by @emmanuelm41 in #228
- chore: bump kobe to v0.44.3 by @emmanuelm41 in #229
- docs: document kobe-action for GitHub Actions by @jleni in #231
- ci: always report Rust Checks so docs-only PRs can merge by @jleni in #232
- feat(workspace): serve SSH over the attach stream with kobe-sshd by @jleni in #241
- feat(cli): kobe ssh-proxy and ssh-config by @jleni in #242
- ci: pin the mise version in every job by @jleni in #245
- feat(cli): kobe init and kobe doctor by @jleni in #244
- test(runner): observe the start-lock release through the fork window by @jleni in #248
- chore: bump kobe to v0.45.0 by @jleni in #247
Full Changelog: v0.44.2...v0.45.0

What's Changed
- feat(workspace): improve GUI development leases by @emmanuelm41 in #226
- chore: bump kobe to v0.44.2 by @emmanuelm41 in #227
Full Changelog: v0.44.1...v0.44.2

What's Changed
- fix(cli): allow browser port-forwarding by @emmanuelm41 in #224
- chore(release): kobe v0.44.1 by @emmanuelm41 in #225
Full Changelog: v0.44.0...v0.44.1

What's Changed
- feat(sandbox): project-agnostic agent workspace image by @emmanuelm41 in #214
- fix(bake): keep one runner target in the push group by @emmanuelm41 in #215
- fix(agent-workspace): make the mise install survive a flaky download by @emmanuelm41 in #216
- feat(exec): forward stdin to the executed process so secrets stay out of argv by @emmanuelm41 in #218
- feat(sandbox): let a pool declare a range of exposed ports by @emmanuelm41 in #217
- feat(workspace): ship the GUI workspace image in Kobe v0.44.0 by @emmanuelm41 in #223
Full Changelog: v0.43.2...v0.44.0

What's Changed
- ci: do not install a release before its assets exist by @jleni in #212
- chore: bump version to 0.43.2 by @jleni in #213
Full Changelog: v0.43.1...v0.43.2

What's Changed
- feat(sandbox): optional iroh transport for attach and port-forward by @jleni in #201
- fix(sandbox): a receipt with nothing recorded yet is not a mismatch by @jleni in #202
- fix(vcluster): hold what the syncer Role grants, and show the denial by @jleni in #203
- fix(sandbox): recover the child instance this lease never recorded by @jleni in #205
- chore: bump version to 0.43.0 by @jleni in #204
Full Changelog: v0.42.1...v0.43.0

What's Changed
- fix(sandbox): a terminating child handle is not somebody else's by @jleni in #192
- ci: run the light jobs on the small kunobi runner set by @jleni in #193
- fix(harness): wait for the real condition, not for the write to return by @jleni in #196
- chore: bump version to 0.42.1 by @jleni in #194
- ci: name the reserved node explicitly for the jobs that need it by @jleni in #198
- chore(ci): use the default runner name for the light jobs by @jleni in #199
- fix(test): wait for the teardown policy to enforce, not just type-check by @jleni in #195
- ci: move docker-dry-run off the reserved node by @jleni in #200
Full Changelog: v0.42.0...v0.42.1

What's Changed
- fix(api): re-read a Sandbox lease when the release fence loses by @jleni in #183
- fix(vcluster): leave out snapshot RBAC the operator cannot delegate by @jleni in #184
- fix(cli): say what to do when kobe cannot be reached by @jleni in #186
- feat(cli): make attach the way into a sandbox by @jleni in #185
- fix(ci): stop a merge from cancelling the nightly by @jleni in #187
- fix(sandbox): prove absence for a cancel that beat every create by @jleni in #189
- feat(sandbox): let a pool say what attach lands in by @jleni in #188
- test(sandbox): prove attach forwards a terminal's own bytes by @jleni in #190
- chore: bump version to 0.42.0 by @jleni in #191
Full Changelog: v0.41.0...v0.42.0

What's Changed
- test(cli): cover unified resource command matrix by @jleni in #172
- feat(lease): add opaque caller metadata by @jleni in #168
- fix(chart): complete teardown authority boundary by @jleni in #174
- feat(sandbox): pin Agent Sandbox runtime to v1.0.0 by @jleni in #176
- fix(lease): fail closed on pool-kind mismatch by @jleni in #177
- chore(deps): bump reqwest to 0.13 and jsonwebtoken to 10 by @jleni in #178
- feat(sandbox): certify managed child runtime by @jleni in #175
- chore: bump version to 0.41.0 by @jleni in #182
- fix(cli): fail sandbox create immediately with the server error by @jleni in #180
- fix(cli): shrink kobe status to a glance by @jleni in #181
Full Changelog: v0.40.2...v0.41.0

What's Changed
- fix(reaper): clean stale nested k3s cgroups by @jleni in #166
- fix(chart): gate cgroup cleanup on image support by @jleni in #167
- feat(observability): expose saturation telemetry by @jleni in #165
- epic(sandbox): consolidate Agent Sandbox into one review lane by @jleni in #160
- feat(cli): unify pooled resource operations by @jleni in #169
- fix(lifecycle): prove progress after lost races by @jleni in #170
- chore: bump version to 0.40.2 by @jleni in #173
Full Changelog: v0.40.1...v0.40.2

What's Changed
- feat(observability): let the operator state which build it is by @jleni in #154
- fix(instance): stop reporting lost optimistic races as reconcile errors by @jleni in #155
- feat(pool): make drift detection see the rendered workload by @jleni in #156
- security(deps): patch h2 for RUSTSEC-2026-0258, and floor-check the fix by @jleni in #158
- fix(auth): back off the AccessPolicy watch, and pin its fail-closed path by @emmanuelm41 in #142
- fix(demo): detect the caller's IPv4 when scoping the Hetzner firewall by @0xPxt in #159
- fix(chart): pull the etcd dependency over OCI, not the Bitnami index by @0xPxt in #161
- fix: reject stale-bound Ready instances by @jleni in #163
- chore: release v0.40.1 by @jleni in #164
Full Changelog: v0.40.0...v0.40.1

What's Changed
- fix(lease): retire terminal leases that never bound, instead of retrying forever by @jleni in #151
- chore: release v0.40.0 by @jleni in #152
Full Changelog: v0.39.2...v0.40.0

What's Changed
- api(sandbox): add SandboxPool/SandboxLease APIs and the atomic admission ledger by @emmanuelm41 in #93
- lifecycle(k3s): add verified-teardown vocabulary and the Quarantined phase by @emmanuelm41 in #96
- lifecycle(k3s): verified teardown — contract, k3s provider, and the finalizer gate by @emmanuelm41 in #115
- security(sandbox): validate reservation shape, and reap abandoned admission state by @emmanuelm41 in #116
- epic(sandbox): land the Agent Sandbox foundation on main by @emmanuelm41 in #137
- fix(k3s): pin the node password so one restart cannot brick a cluster by @jleni in #146
- ci: give each image tag one meaning, and stop branch dispatches publishing by @jleni in #147
- chore: release v0.39.2 by @jleni in #148
Full Changelog: v0.39.1...v0.39.2

What's Changed
- ci(release): call the in-org mirror of _release-rust.yml by @emmanuelm41 in #111
- ci: move every action off the deprecated Node 20 runtime by @jleni in #121
- fix(lifecycle): stop the teardown fence from deadlocking recycling by @jleni in #119
Full Changelog: v0.39.0...v0.39.1

kobe 0.39.0 — hardening how leased clusters are accessed and isolated
kobe is a Kubernetes operator, written in Rust, that leases pre-warmed ephemeral clusters (k3s, k0s, vcluster, CAPI) to CI and developers — claim a fully configured cluster in seconds, use it, release it. 0.38 and 0.39 are a security-and-correctness pass over the lease lifecycle: who can reach a leased cluster, how a lease is bound to its instance, and how clusters are isolated from each other.
Why
Handing out live clusters means the boundaries have to hold. Interactive access (kubectl exec/attach/port-forward) shouldn't be reachable without proof of identity; a lease must be pinned to exactly the instance it was granted, with no way to drift onto another; and one tenant's cluster shouldn't share a database identity with the next. An internal audit also turned up a handful of pool/lease reconcile races worth closing before they bite.
What's new
- Client-cert-gated interactive access. The connect-proxy now requires a client certificate for exec / attach / port-forward, so a leased cluster's interactive endpoints aren't reachable without one.
- UID-fenced lease binding. A ClusterLease is now fenced to its ClusterInstance by UID, so a lease can't be satisfied by — or drift onto — a different instance than the one it was granted.
- Per-cluster datastore isolation. Each cluster gets its own PostgreSQL role rather than sharing one, tightening the blast radius between leases.
- Reconcile-race fixes. Three pool/lease correctness bugs found by audit are fixed — including not reverting an instance that took a lease mid-reconcile, and letting a queued claim scale up a scaled-to-zero pool.
- vcluster fidelity. The vcluster backend now honours the requested Kubernetes version and surfaces helm's stderr in provisioning errors.
- A large test-coverage pass over the CRD wire contracts, the CLI, and the vcluster backend (previously the only untested one), plus k0s and vcluster legs added to the conformance matrix.
Install
cargo binstall kobectl, or Homebrew / Scoop / Chocolatey / AUR; deploy the operator from the OCI Helm chart. Apache-2.0. Docs: github.com/kunobi-ninja/kobe.
These notes were drafted with LLM assistance and edited by the maintainers.
What's Changed
- harden(lease): UID-fence ClusterLease↔ClusterInstance binding by @emmanuelm41 in #90
- fix(kobe-sync): stop at the authority when probing the virtual apiserver by @emmanuelm41 in #91
- fix(kobectl): purge must not abandon the batch on one unremovable file by @emmanuelm41 in #95
- fix(aur): publish a real pkgver for the -git package by @emmanuelm41 in #94
- fix(reaper): stop counting skipped entries as cleaned by @emmanuelm41 in #97
- fix(kobectl): purge left files on disk with their tracking already dropped by @emmanuelm41 in #98
- fix(vcluster): carry helm's stderr into the provisioning error by @emmanuelm41 in #99
- fix(chart,vcluster): give helm a writable home so repo add can work by @emmanuelm41 in #104
- fix(datastore): give each cluster its own PostgreSQL role by @emmanuelm41 in #105
- fix(connect-proxy): count upgrade failures, and say why a request failed by @emmanuelm41 in #108
- chore: bump kobe to v0.39.0 by @emmanuelm41 in #110
Full Changelog: v0.38.0...v0.39.0