Release version 1.0.5

[cjlapao]

Release 1.0.5

• fixed HTTP method types in /machines
• fix: fixed cloning a VM with a name is failing in the orchestrator mode
• [FEATURE] Orchestrator-as-Catalog VM creation support #524 # Type of change
• Added Jenkins minimum required version in user guide
• Merged parallel jobs into a single sequential job — Previously deploy-orchestrator and deploy-catalog ran as independent parallel jobs. Combined into one deploy-services job with conditional steps to prevent namespace CPU quota conflicts (2 CPU limit). Retained conditional deployment flexibility — Can still deploy orchestrator only, catalog only, or both via deploy_orchestrator/deploy_catalog input flags.
• Use python3 to extract kubelogin and fix unzip error (runner does not have unzip pre-installed)
• Fixed --wait/--atomic redundancy — --atomic already implies --wait; refactored to elif to avoid specifying both flags simultaneously
• Added --hide-notes to Helm deploy commands to reduce log verbosity.
• Runtime masking added for OIDC subject and audience.
• Cluster name and resource group added as repository secrets - values not exposed in logs.
• Lowered CPU limits per pod in both std & prd values files so rolling upgrades can run old and new pods concurrently.
• Update workflow permissions. Add actions: write to allow createWorkflowDispatch calls.
• GitHub-hosted runners cannot resolve the private AKS API endpoint. Switch to self-hosted runner with network access to the private cluster.
• Convert kubeconfig to use azurecli login mode to bypass interactive browser prompts. Fixes errors in CI.
• Add a 30-minute timeout safeguard to prevent the step from hanging indefinitely.
• Install kubelogin with GITHUB_TOKEN for AKS authentication
• Fix deployment workflow, namely Helm deploy steps by installing kubelogin.
• Summary of change:
• Updated the workflow job gate to use the boolean dispatch input directly:
• if: ${{ inputs.deploy_orchestrator }}
• The SecretProviderClass and workload identity (used to access Key Vault) are created by the infra repo, so that app must be synced before deploying this chart. The runtime Kubernetes Secret is then synced by the CSI driver when the application pod starts.
• Repository secrets and variables for Azure login and AKS context must be configured.
• OIDC trust uses the main branch subject because GitHub Environments are not available on the current plan.
• Chart changes take effect only after merge to main and redeployment.
• Added separate deploy jobs for orchestrator and catalog.
• Added workflow inputs to deploy either component independently.
• Documented workaround for GitHub Environments limitation: OIDC trusted subject is main branch ref.
• Added dedicated staging and production values overlays.
• Tuned replica count and resource requests/limits per environment.
• Added node affinity and tolerations for the intended node pool.
• Added envFrom runtime secret consumption pattern.
• Added optional CSI volume and mount in deployment template.
• CSI mount is opt-in and remains disabled by default in base values.
• Enables runtime sync flow: Key Vault to CSI to Kubernetes Secret to pod environment.
• Fixed incorrect security key gating condition to use the correct encryption private key field in templates.
• Prevents render issues when inline secret fallback paths are used.
• Runtime Kubernetes Secret must exist before app rollout, populated by infra-managed SecretProviderClass sync.