chore(main): release 1.0.0

[panicboat-github-workflow-bot]

🤖 I have created a release beep boop

1.0.0 (2026-08-27)

Features

• aws/eks,kubernetes: evaluate OpenSRE with a read-only role and a fault-injected sandbox (#751) (647ef5e)
• aws/eks: grant SSO AdministratorAccess an EKS access entry (#820) (884ca8e)
• aws/karpenter: create EC2 Spot service-linked role (#672) (fac501e)
• aws/route53: add DKIM and dystopia.city apex records (#714) (5f441d8)
• aws/route53: manage panicboat.net apex TXT/MX via Terraform (#713) (712a6a0)
• ci: release-please workflow を追加 (#412) (4739e4f)
• eks-{logs,metrics,traces}: add force_destroy to S3 buckets (#324) (f9729fe)
• eks-lifecycle: teardown + recreate scripts (#390) (a6333f2)
• eks: Cilium native CNI (ENI mode) 化 + system-critical MNG rename (#393) (201a6bc)
• eks: cilium-operator IRSA → Pod Identity Association (#401) (e1d9594)
• eks: deterministic IRSA names + hydrate-time substitution (#326) (113c00c)
• eks: otel-native log collection (replace fluent-bit) (#342) (534aad4)
• eks: Phase 6-1 — monorepo migration foundation (#323) (d14b6f6)
• eks: Phase 6-2 — monorepo application deploy (#343) (87cf7c7)
• eks: Phase 6-3 application end-to-end validation companion (= nginx-sample 削除) (#367) (3a367bb)
• eks: port grafana dashboards to production (#331) (d3c6b2b)
• eks: tempo metrics-generator + service graph datasource (#345) (ae559f7)
• flux: add gotk-components + image-reflector/automation controllers (#407) (b473258)
• flux: grant monorepo GitRepository write access via GitHub App (#436) (c919ee8)
• github/branch: allow GitHub App bypass for monorepo main ruleset (#445) (4503a81)
• holmesgpt: allow read-only git commands for source investigation (#784) (15db18c)
• kubernetes/components/oauth2-proxy/production: gate monitoring UIs on panicboat.net domain (#734) (cd82d69)
• kubernetes/components/tempo/production: move to the grafana-community chart (#762) (b0aa54f)
• kubernetes: add bootstrap-webhooks kustomize root (#410) (c48d77c)
• kubernetes: add gp3 StorageClass for production cluster (#406) (2ffb74f)
• kubernetes: add sandbox for okteto CLI evaluation (#736) (c93bd05)
• kubernetes: deploy Keycloak Phase 1 infra (CloudNativePG + Keycloak) (#735) (5d4715b)
• kubernetes: introduce Falco runtime security (#738) (5a5ae79)
• kubernetes: patch gp2 StorageClass to non-default (#409) (eb43a16)
• kubernetes: recreate production EKS cluster in dedicated AWS account (#817) (ca7d91d)
• kubernetes: restore fault-injected sandbox for HolmesGPT evaluation (#767) (de63e6d)
• migrate application to dystopia.city + unify ALB IngressGroup (#433) (43ebbd5)
• prometheus-operator: Alertmanager-owned Slack notification for critical alerts (#782) (ad9174a)
• prometheus-operator: route critical alerts to holmes (#780) (b5110d9)
• scripts: post-flight Pod Identity injection probe + #25 upstream block note (#419) (faca8f7)
• split production and develop into dedicated AWS accounts (Phase 2-6) (#809) (100da1d)
• unify aws resource provenance tag schema across iac + k8s controllers (#427) (fc04183)
• vpc: add S3 gateway VPC endpoint to private route table (#354) (f1566d2)
• wire holmes into production (DNS + Alertmanager route) (#777) (8eb0c02)

Bug Fixes

• auto-approve: skip self-authored PRs from panicboat-ci-bot (#810) (2db15d5)
• aws/ai-assistant: drop GitHubOrg + GitHubRepos tags from actions role (#429) (71d6f46)
• aws/eks: disable unused ebs-csi-driver snapshotter sidecar (#698) (14a38c6)
• aws/eks: grant eks:ListPodIdentityAssociations to eks-admin role (#420) (93f9fef)
• aws/eks: grant ExternalDNS IAM access to dystopia.city zone (#435) (70a2dd1)
• aws/iam-service-linked-roles: use envs/production for CI dispatch (#694) (7ddde31)
• aws/karpenter: set force_update_version on system_critical MNG (#432) (3a519a8)
• ci: drive deploy-trigger from pull_request:closed instead of push:main (#322) (0f72e06)
• cilium-gateway: allow HTTPRoutes from any namespace (#825) (49b6cd7)
• cilium: exclude cilium-envoy from system_critical MNG nodes (#423) (fd9cc60)
• docs: Update EKS login command in README (#353) (fed2928)
• eks-lifecycle: 00-auth.sh kubectl reachability check inside admin subshell (#405) (df26b79)
• eks-lifecycle: 10-k8s-cleanup.sh ALB/NLB foreground cascade + AWS-tag fallback (#398) (25d8986)
• eks-lifecycle: 10-k8s-cleanup.sh Karpenter foreground cascade + AWS-tag fallback (#397) (99c5301)
• eks-lifecycle: 40-orphan-verify.sh exit 0 in DRY_RUN (#395) (c972a71)
• eks/monitoring: Phase 6-3 Theme B monitoring stack hardening (#361) (677450f)
• eks: add ec2:DescribeRouteTables to cilium-operator policy (#402) (ca23f44)
• eks: disable OTel Operator metrics auth (= 6-1 fix forward) (#327) (055b6f6)
• eks: remove ruby from Instrumentation CR (= 6-2 fix forward) (#344) (ee33736)
• flux: AWS Secrets Manager property names to snake_case (#444) (70b8c33)
• flux: ExternalSecret apiVersion v1beta1 -> v1 (#442) (8fdeecf)
• flux: K8s Secret keys to camelCase for source-controller compatibility (#443) (7461e9a)
• karpenter: EC2NodeClass.spec.role to deterministic name (#332) (7ae57ed)
• kubernetes/components/oauth2-proxy/production: pass email as the upstream username (#763) (2f773fc)
• kubernetes/components/tempo/production: drop the chart-default opencensus receiver (#743) (9efc8c1)
• kubernetes/dashboard: correct kube_pod_status_phase query filters (#700) (ed669d0)
• kubernetes: stop Karpenter node churn loop from hubble-relay affinity (#695) (00f6d37)
• kubernetes: use xforwarded proxy headers for Keycloak behind ALB (#745) (43b8c9b)
• pin hydrate toolchain and render against the cluster Kubernetes version (#740) (63f7ff2)
• prometheus-operator: use Slack channel ID for holmes webhook (#783) (27da39d)
• renovate: extract major.minor from EKS cluster_version updates (#670) (7285e16)
• scripts/eks-lifecycle: assume into production's dedicated account (#821) (8e4b516)
• scripts/eks-lifecycle: sweep orphan ALB controller LB/SG before vpc destroy (#799) (1100792)
• scripts/eks-lifecycle: sweep orphan EBS / Route53 in teardown chain (#452) (8432d24)
• terraform: pin required_version to 1.11.6 across multiple modules (#428) (fd0626b)

Performance Improvements

• kubernetes: right-size CPU requests to actual usage (#699) (1946ef3)

Reverts

• ci: restore push:main deploy-trigger (revert #322 + #325) (#334) (392e859)
• PR #423 cilium-envoy tolerations override (#434) (23d4eb1)

---

This PR was generated with Release Please. See documentation.