Release notes
v0.1.0
First on-premises release.
Installing
Two methods, both documented on one procedure that branches once: install from our registry, or create an offline bundle and mirror it into your own.
Requires
| Kubernetes | 1.23 or later |
| Nodes | 3 for production, 16 vCPU and 32 GiB each recommended |
| Storage | sized to your retention |
| Cluster egress | api.gen0sec.com:443, required |
Credentials you need from us
Two, and the second is easy to miss:
- A registry token, for downloading the kit and pulling artifacts.
- Your Gen0Sec API key, which the relay uses to fetch data from us. Without it the whole fleet receives empty artifacts with no error. See Credentials from gen0sec.
Not in this release
| Zero-egress deployment | Known limitations |
| Explicit egress proxy for the relay | Known limitations |
| Single sign-on of any kind | Email and password only. Microsoft Entra ID is in development |
| Shipped dashboards and alert rules | Monitor lists what to watch meanwhile |
| The threat service | Not shipped at this release |
How we version
| Scheme | Semantic versioning. Each minor is a release train |
| Supported | The latest two minor trains |
| Upgrades | Sequential minors, patches in place. Skipping a minor is not supported |
| Release candidates | Published, but never served as latest |
Full policy: Component versions.
Finding a release
curl -fsSL https://releases.gen0sec.com/api/repos/cerebellum/latest | jq -r .tag_name
Returns the latest full release. Pin the tag explicitly for an install you want to reproduce, so a rebuild in six months fetches the same bytes.
What every release publishes
| Artifact | Where |
|---|---|
| Install kit and its signature | https://releases.gen0sec.com/cerebellum/<tag>/ |
| Images and charts | The registry, each pinned to a digest in the kit's release manifest |
| Signatures and SBOM attestations | Alongside each image and chart, as OCI referrers |
See Supply chain.