Highlights
- apple/container 1.2 support. kiac now feature-probes the 1.2.1+ OCI security-path flags and clears defaults that prevent Kubernetes node images from booting. The incompatible 1.2.0 release is rejected before any VM is created; 1.0 and 1.1 remain supported.
- Hardened large-upload proxy. Inter-node tunnels now require a per-cluster 256-bit token and can reach only ready Service endpoints local to the receiving node. The proxy uses list-only Service, EndpointSlice, and Node credentials instead of a copied cluster-admin kubeconfig.
- Correct TCP shutdown. Half-closed connections stay alive for delayed responses, while real copy failures terminate both directions cleanly.
- Dual-stack bundled Services. Traefik and Grafana now request
PreferDualStack, receiving IPv4 and IPv6 addresses on dual-stack clusters while retaining normal IPv4 fallback.
Upgrade note
Do not use apple/container 1.2.0. Upgrade to 1.2.1 or newer, then run:
brew update
brew upgrade kiac
kiac doctorValidation
Validated on Apple silicon and macOS 26.2 with fresh kubeadm and k3s clusters, including three workers per distro, Gateway API, observability, forced cross-node 1 MiB uploads, unauthorized tunnel rejection, restricted RBAC, node stop/start recovery, and HTTPRoute traffic over IPv4 and IPv6. The 1.2.1+ launch contract is covered by automated fake-CLI tests and matched against apple/container 1.2.2's published CLI tests.
What's changed
- Gateway and observability dual-stack Services by @yashrajshuklaaa in #15
- Runtime compatibility and edge-proxy hardening in #18
- Homebrew runtime guidance in #19
Thanks to @mkorbi, @yashrajshuklaaa, and @sudoalgorithm for the report, investigation, and proposed fixes around the container 1.2 regression.
Full changelog: v0.4.0...v0.4.1