The registry TLS certificate moves out of the project tree. New commands manage it. One fix for lo up in a shell without PATH_SECRETS.

Breaking

• The registry TLS certificate lives in a docker volume. lo up mints the certificate for a registry set into the volume <network>-registry-tls, next to the set's data volumes. Every registry container mounts the volume at /etc/registry/certs. Releases before v0.4.0 wrote the certificate to .secrets/tls/registries/ and bind-mounted that directory. See TLS registries.
• .secrets/ holds no lok8s content. The per-domain store clusters/<domain>/secrets/ is the only secrets store. lo lint no longer treats registries-tls as a legitimate flat-store entry. See Migrating a flat .secrets/ store.

New

• lo registry tls status prints the certificate (SANs, validity dates) and what each registry container mounts.
• lo registry tls renew mints a new certificate into the volume and restarts the set's containers.
• lo doctor (the binary) reports which mount the registry containers use when they still mount the pre-v0.4.0 directory.
• See lo registry tls.

Fixed

• lo up on the lo (kind) driver failed with error: PATH_SECRETS is not set — cannot mint the registry TLS cert in a project whose shell exports only PATH. The bash entrypoint defaulted PATH_SECRETS before any driver ran; the binary did not. The mint no longer reads PATH_SECRETS: it hands the Secret generator a scratch directory under clusters/<domain>/ and stores the result in the volume.

Who is affected

Every project with spec.registries.tls: true (the default). A project on a release before v0.4.0 has its certificate in .secrets/tls/registries/ and registry containers that bind-mount that directory.

Upgrade

1. Reinstall the binary: bash lo-install.sh, or unpack lo-<os>-<arch>.tar.gz (lo-full-<os>-<arch>.tar.gz for the in-process build) from the release. A project that pins lo through lo toolchain install bumps github.com/kernpilot/lok8s in .bin/b.yaml to v0.4.0 and runs b install.
2. Run lo up. The first run imports the certificate from .secrets/tls/registries/ into the volume and prints one [warn] line: the running registry containers still mount the old directory.
3. Run lo registry down && lo registry up. The registries come back with the volume mounted. lo registry tls status shows volume for each container. Then remove .secrets/.
4. Add clusters/*/.registry-tls-tmp.*/ to the project .gitignore. The mint writes its scratch store there. A mint that stops before its cleanup leaves the directory with the private key in it. New projects get the pattern from lo init project. lo up removes stale directories before each mint.

The bash implementation changed the same way. A project that routes registry or up to bash (lok8s.yaml spec.implementation) mints into the same volume, imports the same legacy files and has the same lo registry tls status|renew. A switch between the implementations never leaves two certificate locations behind.

Two lo up runs on the same registry network at the same time can collide on the helper container <network>-registry-tls-io: that run fails, and a retry succeeds because the read-out checks both files and mints again into an incomplete volume.

Assets

The same set as v0.3.1: for linux and darwin, amd64 and arm64, lo-<os>-<arch>.tar.gz, lo-full-<os>-<arch>.tar.gz, kustomize-secret-<os>-<arch>, lochat-<os>-<arch>, plus lok8s-v0.4.0.tar.gz (the framework tree), lo-install.sh and checksums.txt.

Previous notes: v0.3.1, v0.3.0.