release: prepare v0.6.0

CHANGELOG.md

@@ -4,6 +4,8 @@ All notable changes to Devboxes are documented here. The project follows [Keep a
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-07-27
+
 ### Added
 
 - Added opt-in namespace-per-tenant isolation across Helm, the controller API, CLI,
@@ -20,6 +22,12 @@ All notable changes to Devboxes are documented here. The project follows [Keep a
   and CLI coverage for isolation, role enforcement, quota failures, migration, and
   configuration precedence.
 
+### Fixed
+
+- Retry Kubernetes resourceVersion conflicts during workspace start and stop with bounded
+  backoff and fresh tenant ownership validation, while returning a stable conflict response
+  if concurrent updates persist.
+
 ### Security
 
 - Keep principal token values out of Helm values by loading unique strong credentials from a
@@ -167,7 +175,8 @@ All notable changes to Devboxes are documented here. The project follows [Keep a
 - Portable Helm chart with values schema, namespace-scoped RBAC, configurable storage, ingress, LoadBalancer or NodePort SSH, ServiceMonitor, and disruption budget.
 - macOS and Linux CLI releases, SHA-256 verification installer, GHCR images, OCI chart publishing, image provenance attestations, and clean Kind install CI.
 
-[Unreleased]: https://github.com/vicotrbb/devboxes/compare/v0.5.1...HEAD
+[Unreleased]: https://github.com/vicotrbb/devboxes/compare/v0.6.0...HEAD
+[0.6.0]: https://github.com/vicotrbb/devboxes/compare/v0.5.1...v0.6.0
 [0.5.1]: https://github.com/vicotrbb/devboxes/compare/v0.5.0...v0.5.1
 [0.5.0]: https://github.com/vicotrbb/devboxes/compare/v0.4.0...v0.5.0
 [0.4.0]: https://github.com/vicotrbb/devboxes/compare/v0.3.0...v0.4.0

README.md

@@ -94,7 +94,7 @@ kubectl -n devboxes create secret generic devboxes-workspace \
   --from-file=SSH_AUTHORIZED_KEYS="$HOME/.ssh/id_ed25519.pub"
 
 helm install devboxes oci://ghcr.io/vicotrbb/charts/devboxes \
-  --version 0.5.1 \
+  --version 0.6.0 \
   --namespace devboxes
 ```
 

charts/devboxes/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: devboxes
 description: Self-hosted, ephemeral development environments on Kubernetes
 type: application
-version: 0.5.1
-appVersion: "0.5.1"
+version: 0.6.0
+appVersion: "0.6.0"
 kubeVersion: ">=1.29.0-0"
 home: https://github.com/vicotrbb/devboxes
 icon: https://raw.githubusercontent.com/vicotrbb/devboxes/main/docs/assets/devboxes-mark.svg
@@ -16,9 +16,9 @@ annotations:
   artifacthub.io/license: Apache-2.0
   artifacthub.io/category: integration-delivery
   artifacthub.io/changes: |
-    - kind: changed
-      description: Update JavaScript, Rust, Python, container, and GitHub Actions dependencies
-    - kind: fixed
-      description: Adapt PKCE verifier generation to the Rand 0.10 API
+    - kind: added
+      description: Add opt-in namespace-per-tenant isolation across Helm, API, CLI, and dashboard
+    - kind: added
+      description: Add tenant-specific RBAC, quotas, network policies, presets, GPU profiles, and images
     - kind: security
-      description: Update vulnerable transitive JavaScript parsing and expansion dependencies
+      description: Add Secret-backed principals, role enforcement, and tenant-scoped Insights data

cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "devbox-cli"
-version = "0.5.1"
+version = "0.6.0"
 edition = "2024"
 rust-version = "1.96"
 description = "Terminal client for self-hosted Kubernetes development environments"

controller/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devboxes-controller"
-version = "0.5.1"
+version = "0.6.0"
 description = "Controller and dashboard for self-hosted Kubernetes development environments"
 readme = "README.md"
 requires-python = ">=3.12"

controller/src/devboxes_controller/__init__.py

@@ -1,3 +1,3 @@
 """Devboxes controller package."""
 
-__version__ = "0.5.1"
+__version__ = "0.6.0"

controller/src/devboxes_controller/app.py

@@ -597,13 +597,16 @@ async def start_devbox(name: DevboxName, auth: Auth) -> Devbox:
         _require_manage(auth)
         try:
             return await _not_found(manager.scale(name, 1, auth.tenant), name)
-        except TenantQuotaExceededError as error:
+        except (DevboxConflictError, TenantQuotaExceededError) as error:
             raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail=str(error)) from error
 
     @app.post("/api/v1/devboxes/{name}/stop", tags=["devboxes"])
     async def stop_devbox(name: DevboxName, auth: Auth) -> Devbox:
         _require_manage(auth)
-        return await _not_found(manager.scale(name, 0, auth.tenant), name)
+        try:
+            return await _not_found(manager.scale(name, 0, auth.tenant), name)
+        except DevboxConflictError as error:
+            raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail=str(error)) from error
 
     @app.delete("/api/v1/devboxes/{name}", tags=["devboxes"])
     async def delete_devbox(

controller/src/devboxes_controller/manager.py

@@ -60,13 +60,16 @@
 
 logger = logging.getLogger(__name__)
 
+_SCALE_CONFLICT_ATTEMPTS = 5
+_SCALE_CONFLICT_BACKOFF_SECONDS = 0.05
+
 
 class DevboxNotFoundError(Exception):
     """Signal that a requested managed devbox does not exist."""
 
 
 class DevboxConflictError(Exception):
-    """Signal that a requested devbox name is already active."""
+    """Signal that a devbox operation conflicts with managed resource state."""
 
 
 class TenantQuotaExceededError(Exception):
@@ -440,58 +443,67 @@ async def _scale_locked(
         tenant: TenantConfig,
     ) -> Devbox:
         """Scale a devbox while holding its lifecycle lock."""
-        try:
-            deployment = await asyncio.to_thread(
-                self.apps.read_namespaced_deployment,
-                resource,
-                tenant.namespace,
-            )
-            if not self._belongs_to_tenant(deployment, tenant):
-                raise DevboxNotFoundError(name)
-            if replicas == 1:
-                deployment = await self._prepare_insights_template(deployment, tenant)
-                annotations = deployment.metadata.annotations or {}
-                ttl_hours = _ttl_hours(
-                    annotations.get(ANNOTATION_TTL_HOURS),
-                    self.settings.default_ttl_hours,
-                    self.settings.tenant_max_ttl_hours(tenant),
-                )
-                metadata_patch: dict[str, Any] = {
-                    "annotations": {
-                        ANNOTATION_AUTO_STOPPED_AT: None,
-                        ANNOTATION_EXPIRES_AT: (
-                            datetime.now(UTC) + timedelta(hours=ttl_hours)
-                        ).isoformat(),
-                    }
-                }
-                resource_version = getattr(deployment.metadata, "resource_version", None)
-                if resource_version:
-                    metadata_patch["resourceVersion"] = resource_version
-                await asyncio.to_thread(
-                    self.apps.patch_namespaced_deployment,
-                    resource,
-                    tenant.namespace,
-                    {
-                        "metadata": metadata_patch,
-                        "spec": {"replicas": 1},
-                    },
-                )
-            else:
-                scale_patch: dict[str, Any] = {"spec": {"replicas": replicas}}
-                resource_version = getattr(deployment.metadata, "resource_version", None)
-                if resource_version:
-                    scale_patch["metadata"] = {"resourceVersion": resource_version}
-                await asyncio.to_thread(
-                    self.apps.patch_namespaced_deployment_scale,
+        for attempt in range(_SCALE_CONFLICT_ATTEMPTS):
+            try:
+                deployment = await asyncio.to_thread(
+                    self.apps.read_namespaced_deployment,
                     resource,
                     tenant.namespace,
-                    scale_patch,
                 )
-        except ApiException as error:
-            if error.status == 404:
-                raise DevboxNotFoundError(name) from error
-            self._raise_quota(error, tenant)
-            raise
+                if not self._belongs_to_tenant(deployment, tenant):
+                    raise DevboxNotFoundError(name)
+                if replicas == 1:
+                    deployment = await self._prepare_insights_template(deployment, tenant)
+                    annotations = deployment.metadata.annotations or {}
+                    ttl_hours = _ttl_hours(
+                        annotations.get(ANNOTATION_TTL_HOURS),
+                        self.settings.default_ttl_hours,
+                        self.settings.tenant_max_ttl_hours(tenant),
+                    )
+                    metadata_patch: dict[str, Any] = {
+                        "annotations": {
+                            ANNOTATION_AUTO_STOPPED_AT: None,
+                            ANNOTATION_EXPIRES_AT: (
+                                datetime.now(UTC) + timedelta(hours=ttl_hours)
+                            ).isoformat(),
+                        }
+                    }
+                    resource_version = getattr(deployment.metadata, "resource_version", None)
+                    if resource_version:
+                        metadata_patch["resourceVersion"] = resource_version
+                    await asyncio.to_thread(
+                        self.apps.patch_namespaced_deployment,
+                        resource,
+                        tenant.namespace,
+                        {
+                            "metadata": metadata_patch,
+                            "spec": {"replicas": 1},
+                        },
+                    )
+                else:
+                    scale_patch: dict[str, Any] = {"spec": {"replicas": replicas}}
+                    resource_version = getattr(deployment.metadata, "resource_version", None)
+                    if resource_version:
+                        scale_patch["metadata"] = {"resourceVersion": resource_version}
+                    await asyncio.to_thread(
+                        self.apps.patch_namespaced_deployment_scale,
+                        resource,
+                        tenant.namespace,
+                        scale_patch,
+                    )
+                break
+            except ApiException as error:
+                if error.status == 404:
+                    raise DevboxNotFoundError(name) from error
+                if error.status == 409:
+                    if attempt + 1 == _SCALE_CONFLICT_ATTEMPTS:
+                        raise DevboxConflictError(
+                            f"devbox {name!r} changed concurrently; retry the request"
+                        ) from error
+                    await asyncio.sleep(_SCALE_CONFLICT_BACKOFF_SECONDS * (2**attempt))
+                    continue
+                self._raise_quota(error, tenant)
+                raise
         return await self.get(name, tenant)
 
     async def reconcile_insights(self) -> builtins.list[str]:

controller/src/devboxes_controller/templates/cli_authorize.html

@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <meta name="color-scheme" content="light">
     <title>Authorize Devbox CLI · Devboxes</title>
-    <link rel="icon" href="/static/favicon.svg?v=0.5.1" type="image/svg+xml">
-    <link rel="stylesheet" href="/static/styles.css?v=0.5.1">
+    <link rel="icon" href="/static/favicon.svg?v=0.6.0" type="image/svg+xml">
+    <link rel="stylesheet" href="/static/styles.css?v=0.6.0">
   </head>
   <body class="login-page">
     <main class="authorization-shell" aria-labelledby="authorization-title">

controller/src/devboxes_controller/templates/login.html

@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <meta name="color-scheme" content="light">
     <title>Sign in · Devboxes</title>
-    <link rel="icon" href="/static/favicon.svg?v=0.5.1" type="image/svg+xml">
-    <link rel="stylesheet" href="/static/styles.css?v=0.5.1">
+    <link rel="icon" href="/static/favicon.svg?v=0.6.0" type="image/svg+xml">
+    <link rel="stylesheet" href="/static/styles.css?v=0.6.0">
   </head>
   <body class="login-page">
     <main class="login-shell">

controller/tests/test_app.py

@@ -1,11 +1,13 @@
 from pathlib import Path
+from unittest.mock import AsyncMock
 from urllib.parse import parse_qs, urlencode, urlsplit
 
 from fastapi.testclient import TestClient
 
 from devboxes_controller.app import create_app
 from devboxes_controller.auth import pkce_s256
 from devboxes_controller.config import CustomImagePort, CustomImageProfile, GpuProfile, Settings
+from devboxes_controller.manager import DevboxConflictError
 
 from .fakes import FakeManager
 
@@ -80,7 +82,7 @@ def test_browser_login_and_dashboard_session() -> None:
         assert dashboard.headers["x-content-type-options"] == "nosniff"
         assert "Kubernetes connected" in dashboard.text
         assert "cluster default storage" in dashboard.text
-        styles = client.get("/static/styles.css?v=0.5.1")
+        styles = client.get("/static/styles.css?v=0.6.0")
         assert "[hidden]" in styles.text
         assert "display: none !important" in styles.text
         payload = client.get("/api/v1/devboxes").json()
@@ -200,6 +202,27 @@ def test_api_maps_conflicts_and_missing_names() -> None:
         assert "was not found" in missing.json()["detail"]
 
 
+def test_api_maps_exhausted_lifecycle_retries_to_conflicts() -> None:
+    settings = Settings(
+        access_token="test-access-token-at-least-32-characters",
+        cookie_secure=False,
+        cleanup_interval_seconds=3600,
+    )
+    manager = FakeManager(settings)
+    manager.scale = AsyncMock(  # type: ignore[method-assign]
+        side_effect=DevboxConflictError("devbox 'atlas' changed concurrently; retry the request")
+    )
+    headers = {"Authorization": "Bearer test-access-token-at-least-32-characters"}
+
+    with TestClient(create_app(settings, manager)) as client:  # type: ignore[arg-type]
+        for action in ("start", "stop"):
+            response = client.post(f"/api/v1/devboxes/atlas/{action}", headers=headers)
+            assert response.status_code == 409
+            assert response.json() == {
+                "detail": "devbox 'atlas' changed concurrently; retry the request"
+            }
+
+
 def test_api_requires_authentication() -> None:
     with app_client() as client:
         assert client.get("/api/v1/devboxes").status_code == 401