Changelog¶

v1.5.0 — 3 November 2026¶

Upgrade from 1.4.0 with helm upgrade. The database migrates itself on first start. On a large scan history this takes several minutes, and the agent pod shows 0/1 until it finishes — see Troubleshooting.

Changed — read before upgrading¶

The agent has a startup probe. Liveness starts only once the agent has answered for the first time, and the agent gets up to 15 minutes to do so. An upgrade updates the database before the agent listens, and on a large scan history that takes a while; before, liveness could restart the agent partway through, which undid the update and started it again.
One built-in scan runs at a time across the install. A second scan — another admin's, another namespace's, or a scheduled one — is refused with the scan already running (its namespace, who started it, when, and its progress), and the scan console attaches to that scan. A scheduled batch scans its namespaces one after another, waiting its turn rather than skipping. Any admin can cancel the running scan; the run records who did. To allow parallel scans, set security.scanning.selfScan.maxConcurrentScans (default 1; always 1 with the persistent CVE-database cache). See Helm values: Container scanning.
The scan diff is capped, with exact totals. GET /security/scan/diff lists the worst 500 new and the worst 500 fixed findings of each kind, and adds new_total and fixed_total with the exact counts. The History screen shows the totals.

New¶

The Vulnerability Scanner's Findings tab opens on one row per CVE. Each row shows the worst severity, the highest CVSS v3.x score with its provenance, the fixing version or that there is none, and how many workloads, images and sightings the CVE reaches; sort by severity, score, fixable first or most workloads. Open a row for the per-workload sightings, paged, under the same filters. Exclude on the row accepts the CVE for every workload in the selected namespace, or everywhere when none is selected; Exclude on a sighting still accepts it for that workload alone. A segmented control switches between By CVE (the default), By image and All sightings, and the choice is remembered per browser. GET /security/findings takes group_by=cve (paged, sortable with sort=affected) and cve=<id> for one CVE's sightings; the export takes group_by=cve in every format. See Container Scanning.
Each CVSS score says which score it is. Hover a score in the Vulnerability Scanner to see its CVSS version (3.0 or 3.1), its source (NVD, Red Hat, GitHub and others) and its vector. Only what the scan report states is shown: a score reported without a vector shows as version 3.x, and a trivy-operator score names its source only when the operator is configured to include each vendor's scores. The column is headed "CVSS v3.x"; a CVE scored only in CVSS v2 or v4.0 shows an empty v3 cell. The CSV and JSON exports gain cvss_version and cvss_source columns, and the findings API returns cvss_version, cvss_source and cvss_vector on each vulnerability. Findings stored before this release gain them when their image is next scanned.
A CVSS column on workload rows. Deployments, StatefulSets, DaemonSets and Jobs show the worst CVSS v3 score of a workload's images right after the name, when a finished scan found a non-excluded critical or high finding in them; the cell stays empty otherwise. Hover or click a badge for the counts, the worst CVE with its fix and the score's version, source and vector, the images, when the scan ran, and a link to the workload's findings. The View control in the Workloads toolbar turns the column on or off, sets Critical only or High and critical, and switches on CVSS column on Pods (off by default). Read from the new GET /security/workload-badges/{namespace} endpoint.
Choose your Workloads tabs and columns. The View control has three sections. Tabs: switch any built-in kind off the strip (it stays one click away in All Resources), reorder tabs within their group, and add a tab for any kind you can list — a CronJob, an HPA, a PVC, an EndpointSlice, a custom resource; an added tab lists exactly what kubectl get <kind> prints. Columns, per kind: today's columns on or off plus extras such as Images, Labels, Controlled by and Selector; for an added kind, the API server's columns, with the -o wide ones as extras. Badges: the CVSS column settings. Reset to default restores the view a new user sees. Saved per user. See Workloads.
Long names show in full on hover. A workload name, node or status reason cut short by its column shows its full text in a small card after a moment, and on keyboard focus; Escape closes it.

Changed¶

The profile menu's "Users & access" item is now "Users & Groups", the same name as the Admin tab it opens.
All Resources reads like kubectl. The table shows the columns kubectl get <kind> prints for each kind, with the same values, so CRDs show their own printer columns. Right-click Describe shows what kubectl describe prints, served by the new GET /resources/describe/{group}/{version}/{plural}/{name} endpoint. Describe never shows payload values: anything in a data or stringData map shows its size in bytes, ConfigMap values follow the same rules as the YAML view, and literal values of credential-named environment variables are masked. Secret stays not describable. Listing asks the cluster for its table view, which carries no Secret data.
Describe on the Workloads tabs is kubectl describe too. Pods, Deployments, StatefulSets, DaemonSets, Jobs, Services, Ingresses and ConfigMaps open the same drawer as All Resources, with the equivalent command and Copy. Clicking a pod row still opens its pod details, with Diagnose. Secrets offer no Describe.
Status labels are a soft box with a hexagon. The workload Status column, now on Pods, Deployments, StatefulSets, DaemonSets and Jobs, shows each status as a box with a hexagon and the word. Green is running or converging, amber needs a look, red needs action, grey is finished or scaled away; amber and red rows carry a short reason such as "12 restarts". A changing state shows a hexagon outline with one bright side travelling round it; a settled state is solid and still. A rollout past its progress deadline is now called Error. Hover, focus or click a status for the evidence. Elsewhere in the product each status shows a small hexagon with its word, or a quiet box with its word.
The first Vulnerability Scanner page after an agent restart no longer waits on a cold cache. The default By CVE page is warmed in the background shortly after startup.

Fixed¶

KubeManta now truly cannot create or change Secrets in its own namespace. 1.4.0 said so, but with rbac.allowWrites=true it did not hold: KubeManta's write permission on Secrets applied in every namespace, its own included, where the admin password and encryption key live. On a cluster-wide install the chart now adds a ValidatingAdmissionPolicy that refuses KubeManta's own Secret changes there; with rbac.clusterWide=false the permission is no longer granted there; and on a cluster that cannot run the policy (or a helm template render without the cluster's API list), KubeManta gets no Secret write permission at all. Nothing in KubeManta used it: TLS and other Secret edits go through Expert Mode, which is unaffected.
Refreshing Users & Groups no longer shows an error page. Reloading the browser on Admin → Users & Groups replaced the whole app with a "500 — Something went wrong" page; reloading again usually worked. Opening the tab by clicking was not affected.
KubeManta starts on Cilium. With the default security.blockImds, the agent could not resolve names or reach the Kubernetes API server on a Cilium cluster, so it never became ready. The egress policies now name in-cluster pods with a selector, and on Cilium the chart adds a CiliumNetworkPolicy allowing the API server on its ports only (security.cilium.apiServerPolicy, default auto; set true for helm template or GitOps renders that cannot see the cluster). The air-gap policy and the Expert Mode egress allowlist get the same fix. See Troubleshooting.
The Vulnerability Scanner page and the CVE search no longer fail on large namespaces. On a namespace with about a million current findings, opening the page or searching for a CVE could answer 502 while the agent ran out of memory and restarted. The findings list, its totals, grouping by image, the posture grade, alert counts, a run's screen, scan history, the run diff and the CVE search are now computed in the agent's database a page at a time.
Grouping by image is as fast as the other views on large namespaces.
The scan diff no longer fails with a server error (GET /security/scan/diff returned 500 on namespaces scanned by the built-in scanner).
Exports stream. CSV, JSON, Markdown and HTML exports start at once and no longer hold the whole result in memory. GET /security/findings without a page returns the same complete document, streamed.
The third-party licence inventory now ships in both images. The agent and UI images carry it at /licenses/THIRD_PARTY_LICENSES.md.
An alert rule that notifies every channel says so in the rule list too. A rule with no channel picked still delivers to every enabled channel. The rule list now marks each such rule with the number of enabled channels and their names, and shows the picked channels on every other rule. The rule form warns with the same count and names while no channel is picked.
Prometheus history charts draw one at a time as they load. On the Metrics page each CPU and memory history chart now draws as soon as its own query returns.

Security¶

Third-party components in the agent image are updated to fix advisories published after 1.4.0:

authlib 1.9.1 (CVE-2026-96760, a signature verification bypass in its JSON-serialised JWS reader) and its JOSE backend joserfc 1.7.7 (CVE-2026-119284). KubeManta checks OpenID Connect sign-in tokens with authlib, but reads them in the compact form, which does not go through the affected reader.
pyasn1 0.6.5 (CVE-2026-119194, -119195, -119196 and -119197: crafted ASN.1 input can take quadratic CPU time to decode). pyasn1 is used on the LDAP sign-in path.
fpdf2 2.8.9 (CVE-2026-114609 and CVE-2026-114610), used to render PDF reports.

v1.4.0 — 22 October 2026¶

Upgrade from 1.3.1 with helm upgrade. The database migrates itself on first start. Read Changed — read before upgrading first: the browser terminal runs as its own ServiceAccount, three terminal values are retired, and the chart and the agent image must be upgraded together.

Changed — read before upgrading¶

Upgrade the chart and the agent image together. The agent hands the terminal its credentials on volumes that the 1.4.0 chart creates. A 1.4.0 chart running an older agent image leaves kubectl in the terminal without a credential; a 1.4.0 agent image under an older chart reports the terminal as not configured. A standard helm upgrade to the 1.4.0 chart does both; if you pin image.tag or an image digest, move it to 1.4.0 in the same upgrade.
terminal.proxySecret, terminal.signingKey and terminal.signingPubkey are removed, and km-terminal-keygen is retired. The agent now generates the key that signs every terminal session in memory each time it starts, and the terminal is given only the public half; no Secret, file or environment variable holds it, and there is nothing to configure. Signing is always on (up to 1.3.1 it was opt-in, and the key was kept in a Secret the terminal's own kubectl could read). The chart no longer reads the three values, and the install notes warn if they are still set. After upgrading, remove them from your values file or GitOps repository, and delete the Secret earlier releases created, which Helm keeps and nothing uses any more: kubectl -n <namespace> delete secret <release>-terminal. Restarting the agent now rotates the terminal's credentials. See Helm values: Terminal.
The browser terminal can no longer read KubeManta's own Secrets. kubectl in the terminal now runs as its own ServiceAccount (<release>-terminal) instead of KubeManta's, so the admin password, the encryption key and the other credentials KubeManta keeps in its namespace are out of the shell's reach. Kubernetes cannot grant "every namespace except one", so the terminal now reads Secrets only in namespaces you list in the new terminal.secretsNamespaces (read only); on a default install kubectl get secret in the terminal is refused. The product's own Secret views are unchanged, and listing a namespace for the terminal no longer narrows them. Listing KubeManta's own namespace, or one where KubeManta itself may not read Secrets, stops the install with an error. The chart adds the <release>-terminal ServiceAccount and its ClusterRole and ClusterRoleBinding, a <release>-terminal-identity Role and RoleBinding (KubeManta may mint that account's token and nothing else), and per-namespace Roles where you listed namespaces; with terminal.clusterCredentials.enabled=false none of them is created. Upgrade the chart and the agent image together. See Security model.
Deprecated: the terminal inheriting rbac.secretsNamespaces. For this release the terminal also still reads Secrets where rbac.secretsNamespaces (or rbac.tenantNamespaces with rbac.clusterWide=false) names a namespace, so nobody loses access silently. The install notes name those namespaces; copy them into terminal.secretsNamespaces before the next release removes the inheritance.
With rbac.allowWrites=true the terminal can no longer change anything in KubeManta's own namespace. Creating or exec-ing into a pod there reached the admin password. In scoped mode (rbac.clusterWide=false) the terminal's permissions there are now read-only; on a cluster-wide install the chart adds a ValidatingAdmissionPolicy (<release>-terminal-guard, Kubernetes 1.30+) that refuses every change the terminal's ServiceAccount attempts there. On a cluster that cannot run the policy the terminal gets no write verbs at all and the install notes say so. KubeManta's own write features and Expert Mode are unaffected.
The legacy top-level tenantNamespaces value no longer grants writes. Up to 1.3.1 every namespace listed there gave KubeManta pod delete and deployment patch, even on a read-only install. It is now an application-layer namespace list only; restart, scale and delete need rbac.allowWrites=true. For a boundary the API server enforces, use rbac.clusterWide=false with rbac.tenantNamespaces.
AI is refused if its guardrail settings cannot be read. When the AI guardrail configuration cannot be read and no read has succeeded in the last five minutes, AI requests return 503 instead of running without the kill switch, egress allow-list, cost caps and scope. /readyz lists the condition under degraded_controls.
The AI provider allow-list is now enforced on its own. Previously a provider unticked under Admin → AI → Guardrails → Allowed Providers was refused only when Local Only was also on. If you have unticked a provider you still use, tick it again before upgrading, or its AI requests will be refused. A list with nothing ticked still allows every provider.
Local Only now refuses every provider you do not host yourself (anything but Ollama or a custom endpoint), even when those providers are ticked.
Scraping /metrics now needs the scrape:read scope. If you scrape the agent with an API key holding metrics:read, create a key with scrape:read and use it instead — metrics:read no longer opens /metrics (see New, below). The scope picker under Account → API keys says which of the two is for Prometheus.

New¶

Prometheus can scrape KubeManta's own metrics. A new API-key scope, scrape:read, opens GET /metrics and nothing else, and that endpoint accepts the key as a Bearer token — which is how Prometheus and a ServiceMonitor authenticate. The observability guide has the steps, a ServiceMonitor and a plain scrape config.
The optional cert-manager subchart moves from v1.15.0 to v1.21.2 (global.installCertManager, off by default; nothing changes if you did not enable it). If you did: cert-manager recommends upgrading one minor version at a time, v1.21 is tested on Kubernetes 1.33-1.36, and since v1.18 a Certificate without privateKey.rotationPolicy gets a new private key on each renewal. If you set cert-manager.installCRDs yourself, replace it with cert-manager.crds.enabled=true (the two are refused together).
Azure OpenAI accepts the deployment URL the Azure portal shows. Give https://<resource>.openai.azure.com/openai/deployments/<deployment>/chat/completions?api-version=... (or the deployment URL without /chat/completions) as the base URL: the deployment and api-version are read from it (2024-10-21 when it has none), and the key is sent as Azure expects. The v1 URL (…/openai/v1/, with the deployment name as the model) works as before. On an api-version older than 2024-09-01, token usage is estimated rather than reported by Azure.

Added¶

diagnostics.loopDebug (default true) turns the agent's event-loop diagnostics off from your values file instead of kubectl set env, so the choice survives upgrades and GitOps reconciles.
license.reportNodeCount (default true): set it to false to stop the licensing heartbeat reporting the node count, from your values file instead of kubectl set env LICENSE_METER_ENABLED=false.
expertMode.networkPolicy.egress.* (off by default): limits where the expert-exec component may connect to — the Kubernetes API server, cluster DNS, HTTPS outside your network, and the ranges you list. Without it expert-exec accepts connections only from the agent but may connect anywhere the rest of KubeManta can. See Helm values: Expert Mode before enabling it.
GET /alerts takes ?limit= for its alert history: 500 entries by default, up to 5,000.

Improved¶

First sign-in goes straight to the welcome. The product-intro video is gone, along with its "Watch the intro" button on the Documentation page. New users see one welcome screen (the first admin of a fresh install sees the setup instead), and the getting-started tour is still on offer there and on the Documentation page.
The alert history is one durable log. GET /alerts used to serve an in-memory list that a restart emptied; its history now reads the same log as the Alerts tab, newest first, within the retention window. Clearing it from the Alerts tab, DELETE /alerts/history or DELETE /alerts/firings clears that one list everywhere, Activity and incident reports included. The old separate history table is folded into the log on first start.
Audit records survive write bursts. A busy database no longer drops audit rows: the writer waits longer for the lock and retries before writing anything after them, keeping the hash chain in order. A row that is still lost is counted — audit_writer (rows_lost, access_rows_shed, write_retries) appears in /readyz when any row was lost or shed since start, and always in /kubemanta/status.
The event-loop stall warning names what blocked the loop (blocked by: …), or says why it cannot.
Container scanning shows a stopped trivy-operator honestly. Its reports stay visible with the age of the newest one, and a failed status check reads "could not be checked" instead of counting the operator as running or gone.
One navigation path: the retired Mind Graph and Cluster Details pages can no longer be reached by shortcut or link, and links that pointed at them open the Cluster Map instead. The unfinished "Cloud Metrics" bandwidth view and its endpoint are removed; bandwidth from Prometheus or the kubelets is unchanged.
Every confirmation uses the same dialog, and actions that fail now say so instead of failing silently.

Security¶

The PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell") do not affect KubeManta. No KubeManta image contains PHP or PHP code. The agent image's bundled k9s includes phpserialize, a Go library that reads PHP's data format; it is not PHP and is not affected, though a scanner may list it by name.
Enforcing Pod Security restricted is now a documented install step. Every KubeManta pod already met the profile, but the chart does not own its namespace, so nothing enforced it. The install guide and wizard now label the namespace, and helm install prints the command when the namespace has no pod-security.kubernetes.io/enforce label.
The air-gap mirror list now includes cert-manager's five images, so an air-gapped install that enables the cert-manager subchart no longer fails to pull them.
Two components of the web interface are updated to fix high-severity advisories: source-map-js 1.2.2 (GHSA-68fv-2mgg-jv7q, a denial of service) and sharp 0.35.5 (GHSA-wq5f-xc86-pv6w, in its bundled image library).
The YAML editor is updated to Monaco 0.57, whose bundled DOMPurify fixes two cross-site scripting advisories, and its HTML sanitizer to DOMPurify 3.4.17, which fixes a critical sanitizer bypass (GHSA-cg2g-xh64-v4q7). YAML completion and validation work as before.
The web interface is updated to Next.js 16.4.2, which fixes two critical remote code execution advisories (GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr) and a denial of service (GHSA-p3m5-59mp-jv5r).
npm in the browser terminal is updated to 11.21.0, which fixes high-severity advisories in its bundled tar, ip-address and brace-expansion.
The agent's CA bundle drops a root certificate whose intermediates were compromised (certifi 2026.10.19), and the image library used for PDF reports is updated to Pillow 13.0.0, which fixes eight image-parsing advisories.
The UI server's proxy dependency is updated to fix a high-severity redirect advisory (follow-redirects 1.16.1).
A release is now published only after the full test suite, including the dependency security audit, has passed for the exact build being released.
Terminal sessions are always signed, with a key that never leaves the agent's memory (see Changed — read before upgrading). Up to 1.3.1 a terminal user could read what was needed to open an unrecorded shell, attach to another user's session or read another user's captured commands.
KubeManta can no longer create, change or delete Secrets in its own namespace, and opening a shell in a pod in its own namespace is refused even with system namespaces shown. Nothing in the product used either.
The web interface's Content Security Policy no longer allows inline or evaluated scripts: each page load carries its own nonce, and frames are allowed only from the Grafana URL you configured. After changing the Grafana URL, reload the page; a Grafana that redirects its frame to a sign-in page on another origin is refused. Embedded Grafana dashboards are sandboxed and cannot navigate the KubeManta tab — serve Grafana from its own origin.
Signing up for Free on kubemanta.com no longer returns the licence key in the response; it is always e-mailed, and every accepted signup gets the same response.

Fixed¶

Opening an application stack whose workloads had been deleted showed an error page ("HTTP 500") instead of the stack. Deleted workloads are now listed in the stack as missing.
The browser terminal no longer reports "connection failed" in red while it is still starting. It shows "Connecting to your terminal…" while it retries, and a Retry button if it cannot connect.
The browser terminal could refuse to reconnect to its own session when requests reached KubeManta from changing addresses, for example on AKS, where they arrive from whichever node routed them. A session now belongs to the signed-in user, not to an address.
YAML completion and schema validation in the editor now work; the editor never started its YAML service.
Deleting a workload from the Cluster Map pop-out failed on every click.
Deleting or switching off an alert rule that the server refused showed it as deleted or switched off while it kept firing; the rule now comes back with an error.
Pressing Escape in a confirmation opened over another dialog closed both.
Admin → TLS reports a tls.crt that is not a certificate as an error instead of a certificate with no expiry.

Fixed — licensing¶

Switching on single sign-on always needs Enterprise now. Two paths could switch an SSO sign-in method on without it: adding a second method to SSO that was already on, and importing a configuration file with SSO on. Both now follow the same rule as the SSO settings form — on an install without Enterprise, imported SSO settings arrive switched off (noted in the audit entry for the import). If a licence lapses, sign-in methods that are already on keep working, and you can still edit them or turn SSO off.
A lapsed licence no longer blocks keeping a live SAML sign-in working. Refreshing the identity provider's metadata (needed when it rotates its signing certificate) and rotating KubeManta's SP certificate returned 402 after an Enterprise lapse, so an IdP certificate rotation broke SSO sign-in with no way to repair it short of renewing. Both now work while SAML is on; preparing SAML that is not on yet still needs Enterprise.
The published feature matrix now lists exactly what is paid. The settings screens for alert integrations, ticketing, Slack inbound, cloud credentials, risk acceptance, SSO and AI guardrails were listed as paid because their paid action was: reading them has always been free, and only that action (switching an integration on, setting an expiry, changing the AI egress list) returns 402. Local user accounts were listed as Enterprise; they are available on every plan. The SSO sign-in pages were listed as gated; the gate is on switching SSO on, which is why a lapse never locks anyone out.
The feature matrix no longer sells AI features Enterprise does not gate. "AI guardrails & egress control" is now "AI egress governance": the Enterprise part is changing the AI egress allow-list. Copilot session export, cross-user session governance and a retention policy were listed under it, and none is part of the plan; every other AI guardrail, including prompt-audit retention, is available on every plan, as it always was.
A lapsed install can remove its stored cloud credentials. Setting them needs Pro, and the only way to remove one was the same paid save, so an install whose licence lapsed kept an AWS, GCP or Azure secret it could neither use nor delete. DELETE /admin/cloud/credentials (optionally ?provider=aws|gcp|azure) removes them on every plan and is audited.
Importing a configuration file follows the licence for every paid setting, not only SSO. A file exported from a paid install could switch on login-page branding, a changed AI egress allow-list, Pro alert destinations (PagerDuty, Datadog, CloudWatch, webhook), AI diagnosis of alerts, incident ticketing or Slack inbound on an install without that plan. Each now follows the same rule as its settings screen: the rest of the file imports, and what the licence does not cover arrives switched off (branding and the egress list are left as they were). Check file lists each one before you import, the result says it again, and the audit entry records it.
Saving alert integrations on a lapsed install no longer needs a Pro destination switched off first. A PagerDuty or webhook destination that was already on (including one set by Helm values) made every save of the Integrations form return 402, even a Slack edit. Only switching a Pro destination on needs Pro now.
Saving the AI guardrails no longer returns 402 when the egress allow-list is unchanged. The egress section was compared as sent rather than as enforced, so a save that restated the allow-list in force (for example with only some of its fields) could be refused without Enterprise.

v1.3.1 — 6 October 2026¶

Upgrade from 1.3.0 with a standard helm upgrade. No manual migration is needed.

New¶

Product intro for first-time users. Replay it any time from Documentation.
Air-gapped installs: the chart now includes a tool that copies every image into your own registry, or exports them to one file you import on the sealed side, and writes the values file for the install. See Air-gapped install.

Improved¶

Metrics is one page. Each section appears once, drawn from Prometheus when you have connected it and from KubeManta's built-in metrics otherwise.
Network bandwidth lives on the Network page, and works without Prometheus.
One alert history on the Alerts tab, holding everything that fired, including built-in alerts and alerts from Alertmanager. It replaces the separate Firings list under Rules. Clearing it now asks for confirmation.
Less repetition: Overview, Workloads, Alerts and Security show each piece of information once.
Dependency updates, including security fixes.

Fixed¶

An AI provider key saved in Admin → AI was not used by the AI panel, YAML assist or conversation summaries.
Opening KubeManta in a new browser could clear the saved AI provider key.
Applications, Helm releases and parts of the vulnerability scanner showed namespaces outside the allowed list.
The activity log could report a broken audit chain after a maintenance task.
Admin sub-pages (Groups, OAuth clients, AI, Observability) keep their address for links, refresh and Back.
The incident timeline shows changes as readable fields instead of raw data.
A new alert rule with no channel selected now shows which channels it will notify.
Scans and the guided Prometheus can pull from a private registry that needs credentials.

v1.3.0 — 2 October 2026¶

Upgrade from 1.2.0 with a standard helm upgrade. No manual migration is needed. Read Upgrade notes first.

New¶

Incidents are tracked from start to finish, with acknowledgement, recovery time, a timeline report and a Markdown postmortem export.
Response metrics on the Overview: time to acknowledge, time to first AI hypothesis, and recoveries over the last 30 days.
AI-drafted postmortems (Pro).
Jira and Trello triage (Pro): one ticket or card per incident.
SLOs with error budgets and burn-rate alerts.
Slack (Pro): ask the AI questions and approve suggested actions from Slack.
Developer role (Pro and Enterprise): restart, scale and open a shell, without admin rights.
Security posture panel, showing what KubeManta is permitted to do in your cluster.
Configuration export and import, encrypted, for moving or reinstalling.
First-run setup wizard and an OAuth clients screen.
Workload rightsizing: requested resources compared with actual use.
Crash-log capture (off by default): keeps the log of a container that restarted.
Terminal option without cluster credentials.
Alert rules for a single workload, and alerts now include the pod's recent history.
GitOps upgrades with Argo CD and Flux are supported.
TLS option for exposing KubeManta directly on a load balancer.

Improved¶

The vulnerability overview loads much faster.
Restarts and upgrades of KubeManta complete faster.
The Overview no longer treats an old, recovered out-of-memory kill as a crash.
Metrics charts are more accurate on clusters that collect the same metrics twice.
Help links open the documentation for the version you are running.
Dependency updates, including security fixes.

Upgrade notes¶

Viewers can no longer list Secret names. Use an admin account for this.
API requests without a session now return 401 instead of redirecting to the login page.
Asking questions and approving actions from Slack requires Pro. Sending alerts to Slack stays free.

v1.2.0 — 12 September 2026¶

Upgrade from 1.1.1 is a standard helm upgrade; the database migrates itself on first start.

This is the container-scanning release: scanning now handles a real namespace image by image, keeps its evidence when it fails, and never reports a clean result it did not earn. Alongside it, API keys gain scopes, the Applications tab is redesigned, and Telegram and Slack join alerting.

Two changes affect an install that sets nothing: API keys minted before 1.2.0 are revoked on upgrade and must be re-minted with scopes (see Upgrade notes), and basic alerting and the MCP server are now Free on every tier.

Container scanning¶

Scans run image by image, so memory is bounded by the largest image rather than the whole namespace — a large namespace no longer gets the scan killed.
Findings are saved as each image finishes; an interrupted run keeps what it scanned.
A failed scan keeps a readable reason for the failure instead of disappearing.
Private registries are scanned, using the cluster's own pull credentials.
Only images whose digest changed are rescanned.
Scanning a blocklisted namespace is refused with an explanation, instead of returning an empty result that reads as "all clean".
Search a CVE across every scan, with per-image outcomes.
Vulnerability totals count distinct (image, CVE) pairs — one CVE to fix, not one per workload it appears in.
The vulnerability overview loads roughly three times faster on a large cluster.

API key scopes¶

Every key carries scopes, chosen at mint, shown on the key, and enforced on every route. A route with no scope mapping is reachable by no key.
Keys minted before 1.2.0 are revoked by the upgrade (see Upgrade notes).

Applications, alerting and chat¶

The Applications tab is an explorer: your saved stacks as cards with status and composition, the stacks KubeManta found in your cluster beside them, and a two-pane detail view with a fast navigator you can filter and step with the keys.
An application's CPU and memory are charted over a window you choose, and say so when there is no data yet rather than drawing a flat line at zero.
Telegram joins Slack and email as an alert destination.
Alert rules are Free and unlimited, including editing and deleting, with Slack, Telegram and email delivery. Integrations, firing history and auto-investigation remain Pro.
Background tasks have a tray, so a scan that died no longer looks like one still running.

Resources, YAML and network¶

Describe and View YAML work for any kind the cluster serves (Secret stays undescribable).
Edit YAML returns a clean, editable manifest instead of a truncated live dump.
YAML validation runs in every editor.
The network policy view is a grouped, searchable table that shows whether the cluster's CNI actually enforces each policy.
An in-product API reference, generated from the running app.

Changed¶

Basic alerting and the MCP server are Free on every tier.
The update notifier is off by default, so a default install makes no outbound version call; in air-gap mode it is refused outright. Security advisories are announced out of band.
Observability settings are split into Prometheus, Alertmanager and Grafana.
Activity filters survive a reload and say when they are on.
Workloads sort by CPU and memory, and a pod with no measurement never sorts as idle.
Notifications appear top-right and can be swiped away.

Fixed¶

Telegram's Test button reported the integration as unknown while real alerts to Telegram arrived fine.
A finished scan no longer hides the namespace picker.
A scan that "completed with errors" now says which images failed and why.
The running-scan banner names the namespace being scanned.
A demoted admin loses admin surfaces on the next request, without signing out.
Being signed out says why — expiry, revocation and a restart no longer look identical.
The API key shown once at mint stays on screen, with a close button.
Terminal commands are recorded when submitted, so a command that never returns is still audited.

Security¶

An AI-proposed write is re-checked against the caller's role, so a non-admin cannot apply one.
The pod exec terminal requires exec permission (get and create on pods/exec), not just read access.
An SSO session stays bound to the account it authenticated as, and one LDAP directory account maps to exactly one user however the name was typed.
The AI provider key is no longer stored in the browser.
CSV and spreadsheet exports neutralise formulas.
AppArmor confinement uses the field current Kubernetes supports, so it applies on modern clusters.

Upgrade notes¶

API keys minted before 1.2.0 are revoked on upgrade and must be re-minted with scopes in Account → API keys. Re-mint before upgrading anything that depends on a key.
Scanning a blocklisted namespace now returns an error where it returned an empty result; automation that treats any non-200 as a failure will see this.
rbac.readSecrets still controls secret reads. The scanner takes pull credentials by reference and no longer carries a cluster-wide secret reader.
If you pinned image tags, the scanner and expert-exec images move with the release as usual.

v1.1.1 — 20 August 2026¶

A patch release, but not a small one: it corrects three defects that let a removed permission keep working, and a terminal failure that only appeared on busy clusters. Upgrade if you use roles, groups or the browser terminal.

helm upgrade kubemanta oci://registry.kubemanta.com/kubemanta/charts/stable/kubemanta \
  --version 1.1.1 -n kubemanta-system --reset-then-reuse-values

Security¶

Demoting an admin now takes effect immediately. A user demoted to viewer kept browser-terminal access and admin-level AI treatment until their session ended.
A role change is reflected on the next request, not the next sign-in. The UI gated on the role captured at sign-in, so a promotion or demotion appeared to do nothing until the user signed out and back in.
An unrecognised role is no longer treated as admin. It now grants nothing.
Erasing a user removes their group memberships with them. They could previously outlive the account and keep granting access through a group.

Fixed¶

The browser terminal could fail to open a shell on a busy node. The process limit it enforced was counted across the whole node rather than per session, so on a node already running many workloads the shell could not start at all.
Built-in metrics collection failed on some clusters because the scrape looked for its credential under the wrong name. Network bandwidth is now collected by default.
The update banner no longer claims "Up to date" when it cannot reach the version service. It says nothing rather than something untrue.
Capacity is shown as donuts with a top-10 list and sortable, paged storage; an oversized reference line no longer flattens the trend it was meant to give context to; the topology canvas renders with its intended styling and no overlapping labels.
Several Admin fixes: aligned Groups, a trimmed account menu, a more compact admin strip.

Added¶

Admin → Groups. See the groups your identity provider actually sends, and decide what each one grants. Group membership is replaced at every sign-in, so removing someone at the IdP removes their access here.
Account → API keys. Manage your own keys from your account, where the product already pointed you.
Applications match a family of labels, with control over whether new members join automatically.
The real client IP is preserved (service.externalTrafficPolicy), so access rules and the activity log record the actual source address rather than a node's. Revoke all sessions moved to Admin → Access Control.

Changed¶

A default install no longer contacts api.kubemanta.com. The update check is off unless you turn it on.

v1.1.0 — 18 August 2026¶

Upgrading from 1.0.0 is a standard helm upgrade — no manual migration. Read Breaking and Changed before you upgrade.

helm upgrade kubemanta oci://registry.kubemanta.com/kubemanta/charts/stable/kubemanta \
  --version 1.1.0 -n kubemanta-system --reset-then-reuse-values

Breaking¶

Shared password and shared API key removed. Sign in with per-user accounts; the admin account is seeded at install from security.adminPassword. Automation using the old shared API key must switch to a per-user API key (Admin → Users).
Pricing is per admin seat; node limits removed. Viewers are free and unlimited. A lapsed paid licence degrades to Free (read-only keeps working) — it never locks the cluster.
sso.local_login=off now fully disables password login. Recovery is a pod-side command (python3 -m app.recover_admin), not a UI toggle.

Changed (defaults)¶

rbac.readSecrets now defaults to true (Secret read on by default). Set false for a regulated install, or scope with rbac.secretsNamespaces. Secret write still rides rbac.allowWrites; delete is never granted.
security.scanning.enabled now defaults to true — container scanning is read-only (read your trivy-operator reports; let an admin trigger a scan), so the Security tab works on a fresh install. Set false to turn it off, which withholds the reader permissions and refuses the built-in self-scan. The write flags (rbac.allowWrites, expertMode.enabled) stay off by default. On upgrade, use --reset-then-reuse-values or -f values.yaml to pick up the new default; plain --reuse-values keeps your stored value.
Terminal memory is the container cgroup limit (terminal.resources.limits.memory, default 8Gi); the per-session RAM cap was removed.
expertMode.enabled=true deploys the privileged component but leaves expert operations off until enabled in Admin → Expert (a second gate).

Added¶

AI Copilot — cluster-grounded assistant with cited, deep-linkable answers.
MCP server — connect AI clients (Claude Code via API key; Claude Desktop / claude.ai via OAuth) to KubeManta's read-only tools.
AI Guardrails — master kill switch, data residency, cost caps, egress control.
Enterprise SSO — SAML 2.0, OIDC, LDAP/AD with group→role mapping; multiple methods concurrently; local login stays as break-glass.
User accounts & roles (admin/viewer), per-user API keys, 2FA (TOTP), GDPR data erasure, IP access control (allow/deny, auto-ban, idle timeout).
Container scanning — posture grade, history, per-workload drill-down, risk acceptance; read your trivy-operator reports or run a built-in scan; bring your own scanner.
Network Analyzer — pod-to-pod reachability with root-cause and a live probe; readable NetworkPolicy; multi-cloud VPC view.
Applications — group workloads with one health verdict, sizing/traffic, and one-click alerting.
Resource Builder — plan/apply/diff with Kubernetes-aware YAML, saved bundles, and a full Helm release manager.
Manage any resource — edit YAML, describe, or delete any editable kind directly from Workloads → All resources (right-click), no drop to kubectl.
Alert Rules Engine — condition types, start-from templates, firing history with captured evidence; inbound Alertmanager receiver; optional heartbeat.
Metrics — built-in trends (no setup), Prometheus integration, and a guided Prometheus + kube-state-metrics deploy.
Air-gap mode (security.airgap.enabled) with offline licensing.
Flexible exposure — service-only mode, any IngressClass, attach-to-existing cloud LB, multi-host Ingress, Gateway API.

Fixed¶

Sign-ins and sign-outs are attributed to the right person, in one unified activity feed.
Alert evidence (logs/events) is captured at firing time, so a crashed pod's logs aren't lost by the time you look.
Pod logs render as clean text everywhere.
Container-scan history, status and diff now agree with the findings view and never expose KubeManta's own platform CVEs.
A briefly-unavailable agent (e.g. during a helm upgrade) now returns a retriable error instead of looking like a crash.
Numerous UI, alerting, scanning, metrics and exposure fixes.

Security¶

Constant-time local login (no user-enumeration timing signal); revoked or deactivated sessions are refused on the next request.
Air-gap docs now state that egress enforcement depends on your CNI, with a verification step.

v1.0.0 — 2 August 2026¶

First generally available release: real-time workload visibility, AI-assisted diagnosis, a browser terminal, and remediation that always waits for your approval — installed with one Helm command and running entirely inside your cluster.

Included¶

Incident-first overview — leads with what is failing, where, and for how long, with per-pod incident stories from events, logs, exit codes and resource pressure; failure-cascade and network-topology visualizers.
Browser terminal — kubectl, helm, k9s and Node.js preinstalled, running as a separate unprivileged user, every command attributed; sessions start explicitly.
AI diagnosis with cited sources — bring your own model (Anthropic, OpenAI, Google, Azure, Groq, Ollama or any OpenAI-compatible endpoint); AI is optional and can be switched off.
Approval-gated remediation — every write (pod restart, scale, Helm upgrade, manifest apply) is previewed, approved and audited. No autonomous remediation.
Container scanning — read trivy-operator reports or scan on demand, with an A–F grade, per-workload drill-down and risk acceptance.
Per-admin-seat pricing — viewers free and unlimited; no node counting. Free includes the full read-only platform on one cluster with one admin seat.

Operating notes¶

Single instance by design. The agent owns a SQLite database on a ReadWriteOnce volume; the chart refuses replicaCount > 1. Recovery after a node failure depends on your StorageClass — networked storage reattaches in minutes, node-local storage waits for the node.
Alerting shares the agent's fate. Enable the heartbeat (alerts.heartbeat.enabled) and alert on its absence, and watch the agent's readiness from outside KubeManta.
Behind a proxy or edge, set security.trustedProxyCidrs — otherwise every request is attributed to your edge, collapsing audit attribution and letting one client's failed logins ban that shared IP for everyone.
Secure by default. A vanilla install is read-only; writes need rbac.allowWrites=true, the terminal and Helm need expertMode.enabled=true.
Everything stays in your cluster. Operational tables prune themselves; your own content (bundles, runbooks, workspace files) is never auto-deleted.