Skip to main content

Versions and compatibility

Where StackNGO stands​

StackNGO is in preview. Everything documented here works, but the interfaces may still change. Each page carries a badge that says whether the feature is available, in beta or in preparation; this changelog announces the changes.

What v1alpha1 means​

All manifests are at version v1alpha1. In practice:

  • Non-breaking additions: new optional fields, new enumeration values, new conditions may appear at any time. A manifest that is valid today stays valid.
  • Incompatible changes possible, but announced: a field may be renamed, moved or made required. These changes are listed here with the steps to follow, and the old field remains accepted for at least one intermediate version when possible.
  • The move to v1beta1 will mark stabilization: from then on, no breaking change without a new API version and automatic conversion.

The status of resources follows the same rule: documented reason values are stable, new ones may be added.

CLI​

The CLI follows semantic versioning. As long as no version is published, it is installed from source and displays dev. Commands marked beta may change flags; available commands only change with a major version.

HTTP API​

  • The /v1 prefix is stable. Routes marked beta in the OpenAPI specification (x-stackngo-status: beta) may change shape.
  • Response fields are never removed without notice; new fields may appear. A client must ignore fields it does not know.
  • Unknown request fields are rejected (400): a client that sends a field not yet deployed receives a clear error rather than silence.

Changelog​

0.0.1 Beta — Authentication for your users​

  • Per-tenant directory: your applications' users have a directory of their own in your tenant, available as soon as it is created (no more sng iam init). Invitation or open sign-up, passwordless sign-in (link sent by email, Google, GitHub, GitLab, Microsoft, LinkedIn, OpenID Connect, passkeys), account blocking, roles and permissions. See Users of your applications.
  • OIDC: an IAMApplication with directory: tenant signs in at your tenant's issuer; tokens carry tenant, roles and permissions. See Authentication for your applications.
  • Customizable sign-in page (logo, colors, theme, texts) with a preview in the console, and a new IAMProvider Kind for sign-in providers.
  • CLI: sng iam is reworked (user, invitation, role, app, provider, login-page). Removed: sng iam init, config, group, user create|update, role assign|unassign|resources|sub|group, app link|unlink; roles are created with sng iam role create --permission. See sng iam.
  • Manifests: IAMApplication gains the directory field (platform by default, tenant); IAMRole and IAMGroup no longer declare your users' roles.
  • Console: new Authentication section (users, roles, applications, providers, sign-in page).

0.0.1 Beta — Console resource editor​

  • Console: a single editor with two synchronized tabs, Form and YAML, creates and edits your resources (Registry, Monitoring, Applications, Create a resource). Creation from a template or a minimal skeleton, several objects separated by ---, refusals shown on the field concerned, usable on a phone. See the resource editor.

0.0.1 Beta — Fixes​

  • Registry: the ZotRepository Kind is renamed RegistryRepository (and ZotRobot became RegistryAccessKey); reapply your manifests with the new Kind.
  • Registry: the old secret of a RegistryAccessKey stays accepted 24 h after a renewal (instead of one hour), adjustable from 0 to 720 h with spec.graceHours.
  • Identity: assignableRoles (IAMApplication) and assignableByApplications (IAMRole), which were accepted without effect, are now refused with the reason UnsupportedConfiguration. childRoles now refers to another IAMRole by its name; an unknown name gives InvalidReference. Managed policies show a description.
  • Monitoring: a notification channel whose secret is missing no longer prevents the other channels from alerting; it shows the reason SecretNotFound.
  • DNS: a DNSRecord applied with sng apply requires a declared DNSZone, like sng dns record set; deleting a DNSZone that still has records is refused (409) whatever the command. sng dns zone create prints the TXT to add right away.
  • CI access (OIDC): a platform issuer is refused as soon as the trust is created; without audiences, the API URL is used; sng tenant oidc get shows the result of the issuer check.
  • API: 415 and 429 errors are JSON like the others; the rate limit becomes 300 requests per minute per IP address; the X-Tenant-Token header is refused on every route.
  • CLI: sng tenant use and sng tenant assume say what to do when access is missing; sng iam app link works; sng sso login --client-credentials accepts --client-id (or STNG_OAUTH_CLIENT_ID); sng monitor create uses 5m by default, accepted by every tier; sng apply, plan, list, edit and delete show Kind/name; sng registry honours --tenant on all its commands, prints the digest only once, and build scans the image with trivy on your machine (--registry-scan for the registry scan).
  • Secrets: a deleted secret can be restored with all its versions (sng secret restore, POST /v1/secrets/{name}/restore, action ssm:write). The scheduled rotation can be canceled without touching the value (POST /v1/secrets/{name}/rotate/cancel, action ssm:rotate); an SSMSecret that carries rotateDays rearms it. With spec.materialize: true, an SSMSecret is usable by your static sites and notification channels, even if no App reads it.
  • Applications: an App pulls images from the platform registry without imagePullSecrets (read-only default-pull robot in each tenant). An exposed service is only Ready once its HTTPS certificate is issued. New reasons: RegistryAccessPending, CertificatePending, DNSConflict (domain name already taken in DNS, silent until now).
  • Resource state: sng kind get KIND NAME shows the observed state as comments below the manifest, and --json (like GET /v1/resources/{kind}/{name}) includes status, for App, SSMSecret, CDNSite, RegistryRepository, RegistryAccessKey, IAMApplication, IAMRole and IAMGroup.
  • Registry: sng registry robot credentials NAME [--show-password] (and GET /v1/registry/robots/{name}/credentials, action registry:admin) hands a robot's credentials to a tool without a session.
  • Identity: sng iam role assign and sng iam group add-user accept the manifest name of an IAMRole or IAMGroup (409 while it is not ready). deletionPolicy: Block waits until the resource is no longer in use, with a message that says by what, then deletes it: recreating it under the same name works.
  • Static sites: each folder serves its index.html (/docs/intro/ and /docs/intro); a page not found is now only kept 30 seconds in cache; automatic HTTPS for each site.
  • Tiers: grid 3XS, 2XS, XS, S, M, L, XL, 2XL, 3XL, tenant created in 3XS; the former names XXS, XXL and XXXL are still accepted. An existing tenant keeps its resources under the matching name of the new grid.
  • Sign-out: sng sso logout and POST /v1/iam/logout really end sessions, within a few seconds: the session presented, or every session of the account with the identity token. An ended session receives 401.

2026-10 — Documentation overhaul​

  • New documentation: manifests, CLI and API documented from the code, in French and English.
  • The OpenAPI specification is served by the API at GET /v1/openapi.yaml.
  • Features in beta: DNS (DNSZone, DNSRecord, sng dns), image registry (sng registry), monitoring (Monitor, NotificationChannel, StatusPage), CI access via OIDC (IAMOIDCTrust, sng tenant oidc), tenant tiers (sng tenant tier).
  • In preparation: OpenTofu (Workspace, Provider), generated APIs (GeneratedAPI).

2026-09 — Declarative secrets and rotation​

  • SSMSecret: secret declared by manifest, value generated by the platform, periodic rotation (spec.rotateDays).
  • sng secret set without a value generates a random value; flags --length, --contains, --rotation.
  • Breaking: sng secret rotate no longer takes a value as an argument; the new value is generated or provided via --key / generation flags.

2026-09 — Identity v5​

  • A single token per request; the X-Tenant-Token header is rejected.
  • Permissions via policies (sng tenant policy), managed policies admin, readonly, readwrite, assume-role, plus two policies reserved for the operation of secrets.
  • sng tenant use and sng tenant assume replace the old session commands.