Release Notes for Tetrate Patch Service

New capabilities land here as they ship.

Technical Preview

The initial release of Tetrate Patch Service includes:

New Features

• Cluster inventory: an in-cluster agent reporting full snapshots of the Tetrate images running and every managed product installed, with a per-cluster drill-down, version and status badges, and a products column in the Clusters view that marks clusters running no managed product with a Manual upgrades badge, so it is clear which upgrades are yours to apply. The agent recognizes Tetrate's workloads against the release catalog, so no workload needs labeling and your own applications are never reported.
• CVE scanning: nightly fleet-wide scans of every observed image, findings of every severity categorized as actionable, pending, or third party, and freshness warnings that never present missing data as clean.
• CVE risk scores: each finding carries a 0 to 100 score of how likely it is to be exploited, weighted by its impact, drawn from exploit-prediction data and known exploitation in the wild. The CVEs view shows the score beside severity, sorts and filters findings by it, and ranks images by their highest score; findings with no prediction data show as not scored rather than as low risk.
• Release catalog: public machine-readable release manifests with registry-verified digests, powering categorization, upgrade available markers, and upgrade targets that never cross image variants.
• Managed data plane: a private per-customer GitOps repository reconciled by ArgoCD, with automated upgrade pull requests, one per environment, and evidence-based rollout tracking. Every automated request is labeled with the layer it upgrades and the size of its version jump, and an Upgrades view lists each product with the clusters it reaches and the requests waiting on it.
• Upgrade review in the console: opening a pending upgrade shows its description, the checks gating it, its diff and its conversation, and releases it with approve, hold, merge and close, all without leaving for GitHub. Commands travel as comments on the request under your own GitHub account, and the panel reports what it sent rather than claiming an outcome the automation has not reached yet.
• Cloud account discovery: AWS account connections through an assumable IAM role with no stored credentials, fleet-wide cluster discovery, and per-cluster install targets with bulk installs. Each connection carries a name, discovered from the account when the role allows it and editable at any time.
• Agent configuration and upgrades: a reference of every agent Helm value, a guide to recognizing Tetrate images pulled from your own registry with registry aliases or extra repositories, and a guide to upgrading the agent with Helm on clusters without a managed data plane.
• The tetrate CLI: single-command cluster onboarding, multi-cluster planning across kubeconfig contexts, and managed product installs, for macOS and Linux, with a reference of every command and flag.
• Agent settings at connection time: choose the namespaces the agent watches and the registry mirrors you pull Tetrate's images through when you connect a cluster, with tetrate onboard flags or the Agent settings panel on the Connect Cluster page and in a cloud account's fleet, and change them later by connecting again. See Configuring the Agent.
• AWS Marketplace subscription: organizations billed through AWS Marketplace see the purchase they are billed through under AWS Subscription in the sidebar, as described in A Tour of the Console.