Skip to content

BaseHarbor v0.4.13

v0.4.13 makes environment selection and policy evaluation explicit shared semantics before BaseHarbor freezes its application/runtime contracts.

The release does not implement Kubernetes. It deliberately keeps environment separate from runtime, topology and availability so a later namespace-only Kubernetes target can reuse the same application contract.

Added

  • Deterministic environment selection from either the compatibility root baseharbor.yaml or one complete envs/<environment>/baseharbor.yaml.
  • Environment-scoped protected state under .baseharbor/environments/<environment>/ for multi-environment deployments.
  • Typed policy results using allow, warn and deny.
  • baha policy check [-e ENV] [-o json].
  • baha policy explain [-e ENV] [-o json].
  • Read-only MCP tools:
  • baseharbor.policy.check
  • baseharbor.policy.explain

Changed

  • Repository root, selected manifest and deployment state are separate concepts.
  • Environment manifests are complete application intents; BaseHarbor does not merge hidden overlays.
  • Repository workload discovery continues from the actual Git/application root even when the selected manifest is below envs/.
  • Repository-aware lifecycle/read operations use the common environment resolver.
  • Backup, restore, update and destroy stay bound to the selected environment.
  • Existing Compose workload-security findings are represented through the shared policy result model.

Security

  • Policy remains deny-by-default and fail-closed.
  • BASEHARBOR_WORKLOAD_SECURITY_MODE=development cannot weaken a managed/test/production/custom environment.
  • The only current workload-security override is the explicit development-only host-device acknowledgement; privileged/runtime-socket/host-namespace/critical-host-mount/dangerous-capability findings remain non-overridable.
  • Environment-specific state isolates deployment inputs, normalized TLS material, generated runtime state and application state.

Compatibility & upgrade notes

  • Existing single-environment repositories keep their current .baseharbor state layout.
  • A root baseharbor.yaml remains valid.
  • Selecting a different environment with -e/--environment, or selecting an envs/<environment>/baseharbor.yaml, uses an isolated environment state root.
  • Multiple environment manifests without an explicit selection fail closed.
  • Manifest v1 remains the portable application compatibility surface.
  • Kubernetes/OpenShift runtime behavior is unchanged and remains future work.