Replikate 1.0 — A Stable Contract

From “Grows Up” to Grown

A day ago I wrote that Replikate had grown up — instant drift correction, metrics, namespace exclusions, a field indexer, and an optional validating webhook, all shipped between v0.1 and v0.4. I ended that post naming the two things still standing between it and a 1.0: a real fix for the same-name source collision, and actually running the webhook end to end on a live cluster.

Both are done. Replikate is 1.0.0, and the replikate.brainchurts.com/sync annotation contract is now officially stable.

What 1.0 Means Here

A version number that starts with a 1 is a promise, not a milestone you award yourself for effort. For Replikate it means exactly this: the annotation shape, the labels stamped on managed copies, and the fan-out/cleanup semantics will not change in a backward-incompatible way without a 2.0. If you annotate a ConfigMap today, that annotation keeps meaning the same thing for the entire 1.x line. That’s the whole reason to cut a 1.0 — so people can build on it without watching the changelog for the rug-pull.

I wasn’t willing to make that promise until two specific things were true.

The Clobber War, Fixed

The launch post listed a limitation almost as a footnote: two sources with the same name in different namespaces, both targeting a third, “collide on name — give them distinct names.” Digging into it for the last write-up, I found it was worse than a naming nag. Because Replikate overwrote any copy carrying its managed-by label without checking which source owned it, two same-named sources didn’t collide once — they entered a clobber war, each rewriting the other’s copy on every single reconcile, forever, flipping the data and ownership labels back and forth.

1.0 fixes it properly. Every managed copy records which source it belongs to, and Replikate now checks that ownership before it writes. If a copy belongs to a different source, it refuses to touch it and emits a Conflict event you can see in kubectl describe. First writer wins; the loser gets a clear, visible error instead of a silent fight. Cleanup was already scoped by ownership, so no source ever deletes another’s copy either.

The best thing a “limitations” section can do is turn into a fixed bug. This one did.

The Test That Had Never Run

The webhook was the honest asterisk on the last post. Its logic was unit-tested, and the Helm chart rendered correctly — but the actual admission round-trip, with a real ValidatingWebhookConfiguration and cert-manager injecting the CA bundle over TLS, had never executed. I wasn’t going to stamp 1.0 on a feature that had only ever run in my head.

So Replikate now has three tiers of testing, each proving something the one below it can’t:

Unit tests (controller-runtime’s fake client) prove the logic — fan-out, adoption, cleanup, drift, exclusions, the conflict guard.
An envtest suite runs the real manager against a real API server — proving the watches, the cache, and the field index are actually wired the way the code claims.
A live smoke test spins up a kind cluster, installs cert-manager, deploys the chart with the webhook on, and applies a good selector and a bad one — proving the thing I couldn’t prove any other way.

That last one is now green in CI. A ConfigMap with a valid selector is accepted; one with a=b=c comes back rejected, straight from Replikate’s own webhook, over real TLS. The asterisk is gone.

What’s Still Open

Honesty section, as always — but it’s short now. There’s essentially one thing left on the roadmap, and it’s the big post-1.0 feature: cross-cluster replication. Everything today assumes a single cluster and one in-cluster manager; syncing a Secret from one cluster into another is a genuine design problem — multiple kubeconfigs, credential distribution, and sensible behavior when a remote cluster is unreachable — not a weekend patch. That’s the 1.x headline, and because 1.0 froze the contract, it’ll arrive as an addition that doesn’t break a single existing source. (A smaller idea — replicating resource kinds beyond ConfigMaps and Secrets — sits behind it.)

Get It

Replikate 1.0.0 is BSD 3-Clause licensed at github.com/cwolsen7905/replikate, with a CHANGELOG and ROADMAP that say exactly what shipped and what’s next. helm install, annotate a source, and stop writing the kubectl loop — on a contract that’s now promised to stay put.