mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 02:25:56 +00:00
Prepare v6.3.1 stable patch release
This commit is contained in:
rcourtman
@@ -2,9 +2,9 @@ apiVersion: v2
|
||||
name: pulse
|
||||
description: Helm chart for deploying the Pulse hub and optional Docker, Kubernetes, or OpenShift monitoring agent.
|
||||
type: application
|
||||
version: 6.3.0
|
||||
appVersion: "6.3.0"
|
||||
icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.3.0/docs/images/pulse-logo.svg
|
||||
version: 6.3.1
|
||||
appVersion: "6.3.1"
|
||||
icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.3.1/docs/images/pulse-logo.svg
|
||||
keywords:
|
||||
- monitoring
|
||||
- proxmox
|
||||
@@ -32,7 +32,7 @@ annotations:
|
||||
description: Smoke tests with kind cluster deployment
|
||||
artifacthub.io/links: |
|
||||
- name: Documentation
|
||||
url: https://github.com/rcourtman/Pulse/blob/v6.3.0/docs/KUBERNETES.md
|
||||
url: https://github.com/rcourtman/Pulse/blob/v6.3.1/docs/KUBERNETES.md
|
||||
- name: Support
|
||||
url: https://github.com/rcourtman/Pulse/discussions
|
||||
artifacthub.io/maintainers: |
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# pulse
|
||||
|
||||
  
|
||||
  
|
||||
|
||||
Helm chart for deploying the Pulse hub and optional Docker, Kubernetes, or OpenShift monitoring agent.
|
||||
|
||||
|
||||
+1
-1
@@ -2,7 +2,7 @@ version: '3.8'
|
||||
|
||||
services:
|
||||
pulse:
|
||||
image: ${PULSE_IMAGE:-rcourtman/pulse:6.3.0}
|
||||
image: ${PULSE_IMAGE:-rcourtman/pulse:6.3.1}
|
||||
container_name: pulse
|
||||
restart: unless-stopped
|
||||
logging:
|
||||
|
||||
@@ -7,10 +7,14 @@ For historical v4 notes that previously lived in this repo, see:
|
||||
`docs/releases/RELEASE_NOTES_v4.md`
|
||||
|
||||
For the current stable v6 packet, see:
|
||||
- `docs/releases/RELEASE_NOTES_v6.3.1.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.3.1.md`
|
||||
|
||||
For the preceding stable v6 packet, see:
|
||||
- `docs/releases/RELEASE_NOTES_v6.3.0.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.3.0.md`
|
||||
|
||||
For the preceding stable v6 packet, see:
|
||||
For earlier stable v6.2 packets, see:
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.1.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.1.md`
|
||||
|
||||
@@ -18,7 +22,6 @@ For historical v6.3 release candidate packets, see:
|
||||
- `docs/releases/RELEASE_NOTES_v6.3.0-rc.6.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.3.0-rc.6.md`
|
||||
|
||||
For earlier stable v6.2 packets, see:
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0.md`
|
||||
|
||||
|
||||
+6
-3
@@ -4,10 +4,15 @@ This guide covers practical upgrade steps for existing Pulse installs moving to
|
||||
|
||||
For the current stable v6 packet, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.3.1.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.3.1.md`
|
||||
|
||||
For the preceding stable v6 packet, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.3.0.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.3.0.md`
|
||||
|
||||
For the preceding stable v6 packet, see:
|
||||
For earlier stable v6.2 packets, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.1.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.1.md`
|
||||
@@ -17,8 +22,6 @@ For historical v6.3 release candidate packets, see:
|
||||
- `docs/releases/RELEASE_NOTES_v6.3.0-rc.6.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.3.0-rc.6.md`
|
||||
|
||||
For earlier stable v6.2 packets, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0.md`
|
||||
|
||||
|
||||
@@ -1660,7 +1660,23 @@ diagnostics. The same release workflow also executes the generated self-signed
|
||||
and custom-CA Windows installer commands through Windows PowerShell 5.1 before
|
||||
release assembly, so the first HTTPS fetch is release proof rather than a
|
||||
string-shape assertion.
|
||||
The active stable `v6.3.0` cut sets the repo-root `VERSION`,
|
||||
The active stable `v6.3.1` cut sets the repo-root `VERSION`, repo-root
|
||||
`docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and
|
||||
Helm chart release metadata to the same `6.3.1` release version. This patch
|
||||
release uses the stable hotfix path with `rollback_version=v6.3.0`,
|
||||
`hotfix_exception=true`, a release-owner reason, and no fabricated same-version
|
||||
RC tag. The emergency reason is active customer harm across notification
|
||||
delivery recovery, Docker command continuity, local subscription setup, and
|
||||
Synology Docker host load. The exact pushed `main` SHA must pass the
|
||||
no-publication dry run and integrated candidate checks before the same SHA is
|
||||
dispatched through the single-build publication workflow. No governed
|
||||
mobile-facing path changed from `v6.3.0`, so the release decision is
|
||||
`no-mobile-impact` and no companion build or store rollout is required.
|
||||
Windows Authenticode remains mandatory for `v6.3.1` unless the release owner
|
||||
records a new explicit version-bound unsigned-Windows exception; the prior
|
||||
`v6.3.0` decision cannot be reused for this patch.
|
||||
|
||||
The preceding stable `v6.3.0` cut set the repo-root `VERSION`,
|
||||
repo-root `docker-compose.yml` image default, `scripts/install-docker.sh`
|
||||
fallback, and Helm chart release metadata to the same `6.3.0` release version.
|
||||
This stable minor release uses `promoted_from_tag=v6.3.0-rc.6`,
|
||||
@@ -2036,13 +2052,15 @@ For the active stable `v6.1.2` cut, the repo-root compose default and
|
||||
`scripts/install-docker.sh` fallback must both pin `6.1.2` whenever the
|
||||
governed `VERSION` is that stable cut. The stable promotion guard remains in
|
||||
force and rejects leftover `-rc.` defaults.
|
||||
For the active stable `v6.3.0` cut, the repo-root compose default and
|
||||
`scripts/install-docker.sh` fallback must both pin `6.3.0` until the next
|
||||
For the active stable `v6.3.1` cut, the repo-root compose default and
|
||||
`scripts/install-docker.sh` fallback must both pin `6.3.1` until the next
|
||||
governed release moves them forward. The stable promotion guard remains in
|
||||
force and rejects leftover `-rc.` defaults. Each new release moves
|
||||
these two pins together with the repo-root `VERSION` and the Helm chart metadata
|
||||
in the same commit; a cut that leaves any of the four on a superseded value is a
|
||||
release-packet blocker.
|
||||
For the preceding stable `v6.3.0` cut, the repo-root compose default and
|
||||
`scripts/install-docker.sh` fallback both pinned `6.3.0`.
|
||||
For the preceding stable `v6.2.1` cut, the repo-root compose default and
|
||||
`scripts/install-docker.sh` fallback must both pin `6.2.1`. The stable
|
||||
promotion guard remains in force and rejects leftover `-rc.` defaults. Each
|
||||
|
||||
@@ -0,0 +1,72 @@
|
||||
# Pulse v6.3.1 Release Notes
|
||||
|
||||
`v6.3.1` is a stable patch release for the Pulse v6 line. It follows stable
|
||||
`v6.3.0` and contains focused corrections for alert delivery, Unified Agent
|
||||
control, local subscription providers, and Docker monitoring overhead.
|
||||
|
||||
## Highlights
|
||||
|
||||
- Recover or dismiss terminal notification failures without losing delivery
|
||||
history, while disabled PBS offline alerts remain silent.
|
||||
- Docker commands recover safely after token rotation, and Synology hosts avoid
|
||||
repeated full-daemon storage scans on every report.
|
||||
- Local subscription providers now resolve and diagnose their CLIs as the
|
||||
actual Pulse service account.
|
||||
|
||||
## Improved
|
||||
|
||||
- Notification delivery history now exposes confirmed retry and dismiss
|
||||
operations for terminal failures. Retried items receive a fresh bounded
|
||||
attempt budget while their prior audit history remains available.
|
||||
- Refused governed actions record the resource, capability, stable refusal
|
||||
code, and the specific Docker command-agent lookup that missed.
|
||||
- Standard systemd installs give the Pulse service account a private CLI home
|
||||
and a deterministic executable search path. Explicit provider CLI path
|
||||
overrides remain available for non-standard layouts.
|
||||
- Docker host storage totals are refreshed on a bounded 15-minute cadence and
|
||||
retain the last good aggregate when a refresh fails. Live host and container
|
||||
metrics continue on the configured reporting interval.
|
||||
|
||||
## Fixed
|
||||
|
||||
- Disabled PBS offline alerts no longer enter the notification dispatch path;
|
||||
enabled alerts and recovery notifications retain their existing lifecycle.
|
||||
- Docker start, stop, restart, remove, and update commands recover after an
|
||||
agent reporting-token rotation by proving the exact tenant, agent ID, and
|
||||
canonical hostname rather than weakening identity matching.
|
||||
- Docker update preflight once again routes through the Unified Agent, and
|
||||
terminal digest-drift refusals no longer strand later update attempts.
|
||||
- Local subscription setup failures now distinguish a CLI that is missing or
|
||||
not logged in for the Pulse service account from provider network
|
||||
reachability failures.
|
||||
- Synology DSM Docker monitoring no longer launches a verbose daemon-wide disk
|
||||
usage inventory every 30 seconds or immediately retries a slow failed scan.
|
||||
|
||||
## Release Qualification
|
||||
|
||||
- The release uses the emergency stable-patch path because the fixes address
|
||||
active customer harm across alert delivery, infrastructure control, local AI
|
||||
setup, and Docker host load without introducing a same-version RC.
|
||||
- The exact pushed release SHA must pass the no-publication Release Dry Run and
|
||||
its integrated exact-SHA candidate checks before that same SHA is submitted
|
||||
to the single-build publication workflow.
|
||||
- Authenticode signing is required through SignPath. The rehearsal must return
|
||||
all three Windows Unified Agent binaries with valid signatures from the
|
||||
configured production signer before the candidate can advance.
|
||||
- No mobile-facing path changed between `v6.3.0` and this release, so the mobile
|
||||
decision is `no-mobile-impact`; no companion build or store rollout is
|
||||
required.
|
||||
|
||||
## Upgrade Notes
|
||||
|
||||
Use the normal v6 install or update flow for `v6.3.1`. Existing configurations
|
||||
remain valid and no manual data migration is required.
|
||||
|
||||
The rollback target is `v6.3.0`. The exact rollback reinstall command is:
|
||||
|
||||
```bash
|
||||
./scripts/install.sh --version v6.3.0
|
||||
```
|
||||
|
||||
Paid Pulse Pro, Relay, and eligible legacy customers should continue to use the
|
||||
private download page and private runtime image for paid runtime features.
|
||||
@@ -0,0 +1,43 @@
|
||||
# Pulse v6.3.1
|
||||
|
||||
_This changelog describes stable `v6.3.1` compared with stable `v6.3.0`._
|
||||
|
||||
## Changed
|
||||
|
||||
- Terminal notification failures can be retried with a fresh bounded budget or
|
||||
dismissed while retaining their delivery audit history.
|
||||
- Governed-action refusals identify the resource, capability, refusal code, and
|
||||
missed Docker command-agent lookup in the server journal.
|
||||
- Systemd installs provide a service-account CLI home and deterministic search
|
||||
path for local subscription providers, with explicit path overrides for
|
||||
custom installations.
|
||||
- Full Docker daemon storage inventory is cached for 15 minutes, uses a single
|
||||
refresh attempt, and retains the last successful aggregate on failure.
|
||||
|
||||
## Fixed
|
||||
|
||||
- Disabled PBS offline alerts no longer dispatch notifications.
|
||||
- Docker lifecycle and update operations recover safely after reporting-token
|
||||
rotation through exact tenant, agent-ID, and canonical-hostname admission.
|
||||
- Docker update preflight again uses the Unified Agent, and terminal
|
||||
digest-drift receipts no longer block a later attempt.
|
||||
- Local subscription setup reports missing executable and service-account login
|
||||
state instead of misclassifying those failures as provider reachability.
|
||||
- Synology DSM hosts avoid repeated verbose daemon-wide disk-usage scans on the
|
||||
normal live-report cadence.
|
||||
|
||||
## Release Metadata
|
||||
|
||||
- Version: `v6.3.1`
|
||||
- Previous stable: `v6.3.0`
|
||||
- Rollback target: `v6.3.0`
|
||||
- Rollback command: `./scripts/install.sh --version v6.3.0`
|
||||
- Promotion path: emergency stable patch from `main`, using the single-build
|
||||
release workflow after an exact-SHA no-publication dry run
|
||||
- Emergency reason: active customer harm across notification recovery, Docker
|
||||
control, local subscription setup, and Synology Docker host load
|
||||
- Windows signing decision: Authenticode signing is required through SignPath;
|
||||
the exact candidate must prove the configured production signer before
|
||||
publication
|
||||
- Mobile decision: `no-mobile-impact`; no governed mobile-facing path changed
|
||||
from `v6.3.0`, so no companion build or public store rollout is required
|
||||
@@ -4,10 +4,15 @@ This guide covers practical upgrade steps for existing Pulse installs moving to
|
||||
|
||||
For the current stable v6 packet, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.3.1.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.3.1.md`
|
||||
|
||||
For the preceding stable v6 packet, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.3.0.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.3.0.md`
|
||||
|
||||
For the preceding stable v6 packet, see:
|
||||
For earlier stable v6.2 packets, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.1.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.1.md`
|
||||
@@ -17,8 +22,6 @@ For historical v6.3 release candidate packets, see:
|
||||
- `docs/releases/RELEASE_NOTES_v6.3.0-rc.6.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.3.0-rc.6.md`
|
||||
|
||||
For earlier stable v6.2 packets, see:
|
||||
|
||||
- `docs/releases/RELEASE_NOTES_v6.2.0.md`
|
||||
- `docs/releases/V6_CHANGELOG_v6.2.0.md`
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@ set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
|
||||
DOCKER_IMAGE_REPO="${DOCKER_IMAGE_REPO:-rcourtman/pulse}"
|
||||
CANONICAL_DEFAULT_PULSE_VERSION="6.3.0"
|
||||
CANONICAL_DEFAULT_PULSE_VERSION="6.3.1"
|
||||
|
||||
resolve_default_pulse_version() {
|
||||
if [ -n "${PULSE_IMAGE_VERSION:-}" ]; then
|
||||
|
||||
@@ -742,8 +742,8 @@ func TestCurrentStablePatchReleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"`v"+previous+"`",
|
||||
"Use the normal v6 install or update flow",
|
||||
"integrated exact-SHA candidate checks",
|
||||
"not Authenticode-signed",
|
||||
"Unknown Publisher",
|
||||
"Authenticode signing is required through SignPath",
|
||||
"valid signatures from the configured production signer",
|
||||
"`no-mobile-impact`",
|
||||
"rollback target is `v"+previous+"`",
|
||||
)
|
||||
@@ -751,8 +751,8 @@ func TestCurrentStablePatchReleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"Version: `v"+version+"`",
|
||||
"Rollback target: `v"+previous+"`",
|
||||
"Promotion path: emergency stable patch from `"+releaseBranch+"`",
|
||||
"Windows signing decision: version-bound unsigned-Windows exception",
|
||||
"not Authenticode-signed",
|
||||
"Windows signing decision: Authenticode signing is required through SignPath",
|
||||
"configured production signer before publication",
|
||||
"Mobile decision: `no-mobile-impact`",
|
||||
)
|
||||
assertFileContainsAll(t, repoFile("docs", "RELEASE_NOTES.md"),
|
||||
|
||||
@@ -302,8 +302,8 @@ func TestInstallDockerProofTracksStablePatchReleaseContract(t *testing.T) {
|
||||
"This patch release uses the stable hotfix path with `rollback_version=v"+previous+"`, `hotfix_exception=true`, a release-owner reason, and no fabricated same-version RC tag.",
|
||||
"active customer harm",
|
||||
"`no-mobile-impact`",
|
||||
"version-bound unsigned-Windows exception",
|
||||
"not Authenticode-signed",
|
||||
"Windows Authenticode remains mandatory for `v"+version+"`",
|
||||
"prior `v"+previous+"` decision cannot be reused for this patch",
|
||||
"For the active stable `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"`",
|
||||
)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user