v1.14.0: Metadata read

Karl Schriek·October 09, 2026

Someone who administers runners needs to know which stacks and namespaces exist so they can supply a runner to them. Until now that meant giving them read on those stacks, which is far more than they need. 1.14 adds a role that covers just that, and makes the dashboard say what it will refuse instead of failing when you click.

Full notes: 1.14.0 on GitHub.

Seeing a name without seeing the thing

MetadataReader is a new role at organization, stack, namespace and module level. It shows the name and id of a stack, namespace, module, runner, agent or integration, and nothing more than that. It is also a role on runners, agents and integrations themselves.

The Terraform data sources use it too, so looking something up by name no longer needs full read on it.

Supplying something makes it nameable

A runner, agent or integration supplied to a stack, namespace or module can now be named by anyone who can read that scope, without a separate role on the runner itself. A stack role covers whatever is supplied below it.

Between the two, whoever wires runners to namespaces can do it without being able to read what runs in them.

The dashboard stops failing on click

A form you can't save now opens read-only and says so at the top. An action you don't have permission for explains that in the dialog instead of erroring when you press the button. A list that is empty because of permission says that, instead of just looking empty.

When an action is refused you get a notification and the page keeps working, and when something genuinely breaks the error banner carries enough detail to report it.

Also in 1.14

Across the patch releases:

Modules wait for the apply that configures them. A Module created or changed by the Snap CD provider no longer starts deploying while that same apply is still writing its inputs, dependencies and settings. New ModuleHold server settings set the heartbeat interval and buffer, and the defaults suit most installations.
Variables are found by parsing HCL. Text inside a heredoc or a string is no longer mistaken for a variable or output block, and a # inside a string no longer truncates a declaration. A .tf file that doesn't parse now fails the Variables step with a message naming the file.
Variable and output types are stored in full. A large object({ ... }) type no longer fails the Variables step, a complex output type is no longer cut down to the word object, and a variable's default and full description are kept.
kubelogin is in the Azure runner image, so Modules can authenticate to AKS clusters using Entra ID through a kubeconfig exec plugin, with the same credentials the azurerm provider already uses.

Fixes

A state file lookup that skipped its permission check now runs it, and the state file version operations go through the secured repository.
Destroying many Modules at once no longer deadlocks. The dependency edge rebuild was taking a row's indexes in two different orders.
A busy runner is no longer shown as offline, and job logs arrive promptly instead of slowly or not at all.
Queued destroys are released in order, jobs are re-evaluated after an approval threshold changes, and a stack set to trigger all its Modules on change now does.
A Module or Namespace delete is no longer blocked by a transfer, and a path-filtered Module is no longer triggered by another runner's source refresh.

Intelligent GitOps for Infrastructure as Code. Automate, orchestrate, and scale your infrastructure deployments with confidence.

Impressum Privacy Policy Terms of Service Contact