Version pins¶
Every version in this repository has exactly one source of truth. The tables below are generated by scripts/sync-versions.sh and verified in CI, so editing them by hand is pointless: the next run overwrites the change and the drift gate fails the pipeline in the meantime.
| Kind | Source of truth | Consumed by |
|---|---|---|
| Operator toolbox (kubectl, helm, terraform, …) | ARG *_VERSION in Dockerfile |
the container image you run task commands inside |
| Cluster components (kubeadm, containerd, Cilium, …) | *_version in stage1/inventories/inventory.yml |
Stage 1 Ansible, installed onto the nodes |
| Helm chart versions | the individual helm_release resources in stage2/ |
Stage 2 Terraform |
Container tools¶
What the Docker image ships. Bump with task versions:bump, which edits the Dockerfile and then regenerates these tables. It fetches kubectl, helm, terraform, taskfile, trivy and every Alpine package pin; tflint, bws and oci-cli are bumped in the Dockerfile by hand.
| Tool | Version |
|---|---|
| kubectl | 1.36.3 |
| helm | 4.2.4 |
| terraform | 1.16.1 |
| taskfile | 3.53.1 |
| trivy | 0.74.0 |
| tflint | v0.64.0 |
| bws | 2.1.0 |
| oci-cli | 3.90.3 |
Cluster components¶
What Stage 1 installs on the nodes.
| Component | Version | Upstream releases |
|---|---|---|
| kubeadm | 1.36.3 | https://kubernetes.io/releases/ |
| kubectl | 1.36.3 | https://kubernetes.io/releases/ |
| kubelet systemd unit | 0.21.1 | https://github.com/kubernetes/release/releases |
| containerd | 2.3.4 | https://github.com/containerd/containerd/releases |
| runc | 1.5.1 | https://github.com/opencontainers/runc/releases |
| crictl | 1.36.0 | https://github.com/kubernetes-sigs/cri-tools/releases |
| nerdctl | 2.3.5 | https://github.com/containerd/nerdctl/releases |
| CNI plugins | 1.9.1 | https://github.com/containernetworking/plugins/releases |
| Cilium | 1.20.0 | https://github.com/cilium/cilium/releases |
| Cilium CLI | 0.19.7 | https://github.com/cilium/cilium-cli/releases |
| pluto | 5.24.1 | https://github.com/FairwindsOps/pluto/releases |
| minikube | 1.38.1 | |
| k3s | v1.34.3+k3s1 |
Cilium has two independent pins
cilium_version is the agent and operator release running in the cluster. cilium_cli_version is only the local binary that drives Helm. They move independently, so gating an agent upgrade on the CLI version compares unrelated numbers.
The only tested upgrade and rollback path is between consecutive minor releases. Always move one minor at a time, and always update to the latest patch of the current minor before starting.
kubectl is pinned in both sources: ARG KUBECTL_VERSION for the operator's client and kubectl_version for the nodes. scripts/sync-versions.sh asserts they agree and fails outright if they diverge, so a silent client/server skew cannot reach the published docs.
Keeping prose in sync¶
Generated blocks are regenerated wholesale and diffed. Text outside a sentinel is never read, so a sentence recording that "we moved from 1.35.4 to 1.36.3" cannot trip the gate.
Prose that genuinely must not go stale opts in by wrapping the value in a span, which renders invisibly:
Any key from either source works. scripts/sync-versions.sh rewrites every span on every page under docs/ and --check fails if one is stale.