v6.0.0 — Milestone 1: Pattern Modernization & Reliability

v6.0.0 — Milestone 1: Pattern Modernization & Reliability

Breaking Changes

• Default topology renamed: simple → azure (clusterGroupName: azure in values-global.yaml). Existing simple deployments must update their values-global.yaml.
• ESO migration: golang-external-secrets replaced by Red Hat openshift-external-secrets (OCP 4.20+). Old ESO namespace/chart refs are removed.
• Custom imperative container removed: All imperative jobs now use the framework default container. References to ghcr.io/butler54/imperative-container are gone.
• Chart version bumps: trustee-chart 0.8., sandboxed-containers 0.2., sandboxed-policies 0.2.*

New Features

• Authenticated registry support: CoCo pods pull from registry.redhat.io via ACM-distributed pull secret and KBS credential
• Hardware profile gating: global.hardware.profile controls which operators are active (intel-tdx, amd-snp, *-gpu variants)
• ArgoCD sync-wave ordering: Infrastructure (wave 0) → MCO-triggering operators (wave 10) → vault-dependent apps (wave 20) → workloads (wave 30), with a vault-unseal sync hook at wave 5
• Manual subscription sync-wave: sandbox/trustee subscriptions at wave 10 to prevent SA/auto-approve deadlock
• Workload charts: hello-openshift (3 variants), kbs-access-curl (CDH pattern), kbs-access-sealed (sealed secret), gpu-workload — all using Red Hat httpd-24
• Container signing infrastructure: sigstore/GPG key management via make cache-keys (enforcement blocked by upstream image-rs bug)
• NVIDIA GPU support: GPU operator, IOMMU MachineConfig, CC GPU verification workload
• Firmware reference values: Automated collection via veritas container for bare metal attestation
• E2E testing skills: 4 composable verification skills with false-positive detection (cluster-verify, pattern-deploy-verify, coco-workload-verify, secrets-verify)

Bug Fixes

• Fix Kyverno race condition: sync-waves ensure initdata injection before workload pods start
• Fix imperative SA config: use admin SA for CronJobs requiring cluster-wide permissions
• Fix hello-openshift port mismatch: all deployments consistently use httpd-24 on port 8080
• Remove embedded Red Hat signing keys from source (download from official URLs instead)

Phases Completed

1. Framework & Chart Updates
2. Eliminate Custom Container
3. Authenticated Registry
4. Values File Simplification
5. Test Workload Replacement
6. Container Signing Policy (infrastructure ready, enforcement blocked upstream)
7. E2E Testing Skills
8. ArgoCD Sync Hooks Sequencing

🤖 Generated with Claude Code

v5.6.1

5.6.1 (2026-06-02)

Bug Fixes

• rewrite firmware collection to use veritas container approach (#94) (f12a4a0)

v5.6.0

5.6.0 (2026-06-01)

Features

• update trustee-chart to v0.7.* across all profiles (#93) (bfc6374), closes validatedpatterns/trustee-chart#32

v5.5.1

5.5.1 (2026-05-29)

Bug Fixes

• handle empty arrays with set -u in pattern.sh (#91) (8e728e4)

v5.5.0

5.5.0 (2026-05-28)

Features

• enable firmware reference values in bare metal profiles (#90) (5fb705e), closes #30

v5.4.0

5.4.0 (2026-05-28)

Features

• add firmware reference values workflow for bare metal attestation (#89) (7958b00), closes #30

v5.3.2

5.3.2 (2026-05-28)

Bug Fixes

• remove extraSecrets mySecret blocking KBS deployment (#88) (e69084c), closes #85 #85

v5.3.1

5.3.1 (2026-05-27)

Bug Fixes

• ignore CRD label differences for Kyverno (#86) (4419a55)

v5.3.0

5.3.0 (2026-05-27)

Features

• consolidate trustee and kyverno overrides via extraValueFiles (#85) (c9cb2cb)

v5.2.1

5.2.1 (2026-05-06)

Bug Fixes

• update dependencies to resolve security vulnerabilities (#83) (1c8287f)