Release status
The stable versions are v1.0.1 for the server and v1.0.0 for the Go SDK. These are the first stable releases; existing tags are unchanged.
A stable release does not mean your deployment has been accepted. Before production rollout, test capacity, recovery and security in your own environment. The recorded tests do not establish throughput or availability guarantees for every deployment.
The production checklist and test record identify test environments, failed runs and remaining checks.
v1.0.1 adds read-only recovery verification, offline Master Key rotation and management pagination, and fixes Kubernetes synchronization races and SDK snapshot isolation. Custom Management clients must follow pagination to read complete lists after upgrading. Machine reads and SDK calls are unchanged.
Who can read which data
- Tokens grant access by environment. An application granted
productioncan read all its Configs and Vault values, not just one item. - Namespaces only organize resources. Neither Vault nor Kubernetes Namespaces narrow the Token’s server-side access.
- Human roles cover the whole workspace. Admins can manage data; Viewers have read-only access and cannot reveal sensitive values. These are not per-project roles.
If teams or applications must not read each other’s data, do not rely on names within a shared environment. Use separate deployments or a system with the permission granularity you need.
Protections and their limits
Application reads use HTTPS and, by default, both a Token and a client certificate. The configured login provider authenticates people; management changes require Admin permission.
Vault values and CA signing keys are encrypted in the database. Someone who obtains both the database and Master Key may still decrypt them, so control and back them up separately. Client private keys are delivered only at issuance and are not retained by the service.
Revoking a Token, client certificate or CA prevents later authorized reads. It does not delete configuration already downloaded or clear a synchronized Kubernetes Secret.
The CSI provider is a trusted component running on Kubernetes nodes. A sync controller can read and write Secrets in its application namespace. Review these permissions before installing either component.
What is not guaranteed yet
Your deployment may differ from the tested environments. Check your API ingress’s mTLS pass-through, backup recovery and independent-host failures separately.
| Item | Effect on your deployment |
|---|---|
| Sustained 1000 reads per second | The v1.0.1 runtime completed 600,000 successful reads over ten minutes on a four-vCPU Linux host, with 31.9 ms p99 latency and a 2-CPU / 512-MiB API limit; this is not a capacity guarantee for every deployment |
| Kubernetes cross-host availability | The three-node drill uses one Docker host, not independent servers or availability zones |
| Automatic Master Key rotation | Offline rotation requires a maintenance window; no online rotation or HSM / cloud KMS custody |
| Per-Config permissions | Grants still cover an entire environment |
| Automatic application restarts | Configuration changes need application reload logic or deployment-controlled restarts |
| Automatic renewal deployment | New certificates can be issued, but deployment and expiry alerts need separate arrangements |
Access and Audit logs
Access records describe reads and are sent through NATS. They may be lost during failures, so they do not guarantee a record for every read.
Audit records describe changes and authenticated rejected writes. Stored events use a database-backed delivery queue with retries. If a rejection receipt cannot be persisted, the request returns 503 audit_unavailable. Tests cover redelivery after a ClickHouse outage; the service cannot promise a durable record while its database is unavailable.
Report a problem
For ordinary usage problems, open an issue with the version, status code, Request ID and a sanitized reproduction. Do not attach Tokens, private keys, production configuration or complete sensitive responses.
Use the repository’s private vulnerability reporting for security findings. Do not publish confidential exploit details first.