CHANGELOG
What we
shipped.
Every feature, fix, and improvement to FerrVault. Cross-product view at ferrlabs.com/changelog.
RSSThe FerrVault operator no longer asks for organization and project
Operator 5.3.2 drops two fields the default mode never used, and syncs a new FerrVaultSecret as soon as it is created.
Audit events are kept for 90 days
FerrVault now purges audit events older than 90 days, as its privacy policy states. Each purge leaves an audit.purged entry in the log.
Prebuilt binaries for the FerrVault CLI
The FerrVault CLI now ships as a prebuilt binary for Linux, macOS and Windows, and the GitHub Action installs it instead of building from source.
Manage tokens from the vault page
FerrVault tokens now live in a Tokens tab on each vault, scoped to the environment selected there. The separate Developers > Tokens page is gone.
The connect-cluster wizard hands out snippets that work
The snippets FerrVault shows after you mint a token now apply and run: the Kubernetes manifest passes the CRD schema, and the CLI and GitHub Actions tabs install the CLI with cargo.
See your key quota on the Keys page
The FerrVault Keys page shows how many managed and HSM keys your plan allows and how many are used, links to the plan that raises the limit, and lists keys in a table.
The People tab shows names and emails
The People tab of a FerrVault vault listed members as @u- followed by an ID. It now shows each member by display name and email.
Grid or table, and a filter bar, on the vault list
The FerrVault vault list can switch between cards and a table, filter by text, and narrow to the vaults that need attention. The layout you pick is remembered in your browser.
Search vaults and secrets from the top bar
The FerrVault app now shows a search field in its top bar, opening the same palette as the keyboard shortcut.
Vault cards show what is inside and what needs doing
Each vault on the FerrVault home page now shows its environments, secret count, your role and its last activity, and flags a deactivated key, pending requests or secrets to rotate.
FerrVault pages link to their documentation
A question-mark icon in the page header of the FerrVault app opens the matching documentation page in a new tab.
FerrVault has documentation
ferrvault.com/docs replaces its one-page placeholder with real documentation, in English and French, covering vaults, tokens, keys, the CLI and the Kubernetes operator.
A key registry, and vaults that pick their key from it
Generate a managed key, software or HSM, or add one you already have, name it, and point any number of vaults at it from a select in their settings. Keys are billed and counted per key, not per vault.
Choose hardware or software for a managed key
When FerrVault mints a key for a vault, you now pick whether it lives in a hardware module or in software, instead of taking whatever your plan had left.
Retry a failed key rotation
A KEK rotation that stopped on an error can be put back in the queue from the API, instead of needing a hand-edit in the database and a restart.
FerrVault operator: a failed rolloutRestart is now retried instead of forgotten
When restarting the workloads of a changed FerrVaultSecret failed, the operator logged it once and never tried again, so pods kept the old values while the resource reported Ready. The restart is now retried until it goes through, and the failure shows on the resource.
FerrVault operator: a stuck reconcile is now cut short, and alerts say so
One reconcile that never returned could hold the operator for hours while the pod looked healthy. Each reconcile now has a deadline, set with --reconcile-timeout, and the Helm chart can install Prometheus alerts for stuck, timed-out and stale reconciles.
FerrVault API: defence-in-depth headers on every response, not just the ones nginx fronts
Direct callers of api.ferrvault.com received no security response headers at all. The CLI, the Kubernetes operator and anything using curl now get the same set the web app already had. HSTS is opt-in via a new FERRVAULT_TLS_ENABLED setting.
FerrVault operator: refreshInterval now actually governs how often secrets are pulled
Both controllers reconciled continuously instead of on their configured interval, so every FerrVaultSecret was reading from the API in a tight loop. The setting is now honoured. Expect a sharp drop in API calls and audit events from your clusters.
FerrVault: API package shipped to GHCR for the first time
ferrvault-api is now a proper independently-versioned package with its own Docker image and FerrFlow release lane. End of the "API lives in the app repo but never gets built" era.
FerrVault: End-to-end backend rewrite. Every screen talks to a real endpoint
Mocks are gone. Vault edit/delete, secret version history, and the K8s operator token page now hit real APIs. Sidebar trimmed to the three surfaces that actually have a data model.