Skip to main content
Version: 0.7 (Next)

Konstruct 0.6.3

Released: July 2026

Highlights​

  • Fixed: GitHub App cross-tenant access — listing repositories and minting tokens for an installation now verify that the caller's organization owns that installation
  • Fixed: cleared Terraform variables no longer override a module's own default
  • Fixed: cluster name field losing focus after the first character you type
  • Fixed: deleting a project that never provisioned a cluster could remove every cluster from the GitOps registry
  • Fixed: the bootstrap platform-admin override now survives a session refresh
  • IAM trust policies accept both GitHub OIDC subject formats, so application roles created before 0.6.3 keep working

Security: GitHub App installation access​

Two GitHub App endpoints accepted an installation id without checking that the caller had any claim to it, so a guessed id could reach another tenant's installation. Both now authorize the caller first:

  • GET repositories for an installation
  • POST to mint an installation token

A caller is allowed when they are a platform administrator, or when one of their organizations has a saved GitHub connection that includes the installation. Everyone else receives 403. The check lives in the handler because the route-level role guard does nothing on SaaS.

An unused CreateNamespace cluster endpoint was also removed rather than left reachable.

Fixes​

Cleared Terraform variables use the module default. An optional Infrastructure-as-Code value that you cleared arrived as an empty string or as the literal text null, and was passed to Terraform as -var=key=null, overriding the module's own default and failing type conversion — a number variable, for example, failed with "a number is required". Empty and null values are now omitted, so the variable's default applies, and a genuinely required variable fails with a clear "no value for required variable" instead.

IAM trust policies accept both GitHub OIDC subject formats. The trust policy generated for an application's role now trusts the legacy name-based subject (repo:{org}/{name}:ref:refs/heads/main) as well as the immutable form with numeric organization and repository IDs. Roles created before the immutable format was introduced keep working, and the trust policy revision was bumped so existing applications re-apply the two-subject policy on their next reconcile.

The cluster name field keeps focus. The input wrapper changed its root element the moment the asynchronous availability spinner appeared, which made React re-create the field and drop focus after the first character. The wrapper is now always rendered, so only the icon is conditional.

Deleting a project with no cluster no longer touches the cluster registry. When a project's cluster name was empty, the deletion path resolved to the shared registry/konstruct-clusters directory itself and committed its removal, taking unrelated clusters with it. Deletion now skips GitOps cleanup entirely when there is no cluster to clean up, and refuses any cluster name that does not resolve to a direct subdirectory of konstruct-clusters.

The bootstrap platform-admin override survives a refresh. Re-minting a session dropped the bootstrap super-admin override, so the bootstrap account lost its elevated role after a refresh. The override is now re-applied on every re-mint.

Upgrade notes​

Update the targetRevision in your platform team's Konstruct Argo CD Application manifest to 0.6.3:

spec:
  source:
    chart: konstruct
    repoURL: oci://europe-west2-docker.pkg.dev/civo-com/charts
    targetRevision: 0.6.3

Commit and push — Argo CD syncs the new version automatically. No manual migration steps are required.

  • Existing application IAM roles re-apply their trust policy on the first reconcile after upgrading. No action is needed.
Prefer 0.6.4

0.6.4 contains the same product changes as 0.6.3 while pinning released component charts instead of a release candidate. If you are upgrading now, go straight to 0.6.4.

What's next?​