Releases and the release feed

Every version the Lifecycle Manager can roll out comes from the release feed. The platform reads it on its own; nothing is ever pushed to a cluster.

What a release is

A platform release is a named set of component versions — the platform API, the operator, the portal, the backend modules, the CRD bundle, and the third-party charts and installer the release pins. For each component the feed names:

• a container image pinned by digest (…@sha256:…), or, for the CRD bundle and third-party charts, a bundle URL with the SHA-256 checksum it must match;
• the channel the release belongs to;
• for a CRD bundle, which installer version the release runs as its platform step.

The feed lists releases newest first, and the Target list on the planning page shows them in that order.

How the platform reads the feed

The Lifecycle module fetches the feed and its detached signature (the feed URL with .sig appended) about once an hour, and again whenever someone chooses Check for updates on the Components tab. Before it uses anything in it:

• The signature must verify against one of the public keys the platform trusts. A feed that is unsigned, carries a bad signature, cannot be parsed, or reaches a platform that trusts no key at all is rejected whole.
• The channel must match. The feed declares a channel, and a platform only reads a feed on the channel it is configured for — stable unless set otherwise. A feed on another channel is ignored.
• Every entry must be pinned. An entry whose image is not pinned by digest is skipped, as is an entry for a component the platform does not know and the feed does not describe.

A rejected feed changes nothing: the releases already recorded stay, and Check for updates reports Could not reach the release feed. The operator checks the CRD bundle against its checksum once more before it applies it, so a bundle cannot be altered between the feed and the cluster.

Reading the feed only records which releases exist. Nothing that runs changes until someone executes a rollout.

Settings

The feed is configured in the ConfigMap module-lifecycle-config in stackship-system, which the module-lifecycle Deployment reads its settings from when it starts: restart the Deployment after a change. The installer sets the values when the platform is installed. A rollout that includes the Lifecycle module writes them again: a feed URL or channel you set is kept, but ReleaseFeed__TrustedPublicKeysPem__0 is set back to Stackship's key, so add a key of your own as __1.

Setting	Default	Meaning
ReleaseFeed__FeedUrl	https://releases.stackship.se/feed.json, set by the installer	Where the feed is read from. Point it at a mirror only when the cluster cannot reach the public feed; the mirror must also serve the .sig file next to it
ReleaseFeed__Channel	stable	The only channel whose feed is used
ReleaseFeed__TrustedPublicKeysPem__0	Stackship's release-signing public key, set by the installer	A PEM public key the feed's signature is checked against; further keys go in __1, __2 and so on
ReleaseFeed__PollIntervalSeconds	3600	How often the feed is read, in seconds; never more often than every 60 seconds

The module's configuration reference lists all of its settings.

Without a feed

When ReleaseFeed__FeedUrl is empty, the platform reads no feed. That is a valid configuration, for an installation without outbound access for example, and it has these consequences:

• Check for updates reports No release feed configured;
• no release is recorded, so there is nothing to plan a rollout or an install from;
• the pre-upgrade check Release feed is reachable is skipped;
• the Kubernetes permissions a release declares are never applied, so the Components tab warns that cluster RBAC is not converged — see Statuses.

The installed release

Images are built once and promoted from release to release, so an image cannot tell which release it belongs to. The CRD bundle can: every release carries one, named after the release. When a rollout applies a release's CRD bundle, the Lifecycle module records that version as the installed platform release, in the ConfigMap stackship-platform-release in stackship-system, and the platform API reports it as the platform's version. It records it once it notices the rollout has succeeded — see After the rollout.

What's new

A release can carry highlights: a few short items, in English and Swedish, each with links into the documentation. The feed signature covers them like the rest of the release. When the Lifecycle module records the installed release, it records that release's highlights next to it, and every user sees them once in the portal after the upgrade, under What's new. They can open it again from the help menu. A release without highlights shows nothing.