v2.0.0 — Role-based restructure, /v2 module, and five new SDK-compat services

Release Notes — v2.0.0

A major release. cloudemu is now organized by role so the repository stays legible as it grows — service packages live under services/, the cross-cutting wrappers under features/, and shared plumbing under internal/. Because that moves public import paths, the module is now github.com/stackshy/cloudemu/v2. On top of the restructure this release adds five new SDK-compat surfaces — AWS STS, AWS SSM Parameter Store, S3 multipart / tagging / versioning, Azure Queue & Table Storage, and Azure AI — and ships a full CI/CD + security pipeline.

⚠️ Breaking Changes

• Module path is now /v2. Update the dependency and your imports:

  go get github.com/stackshy/cloudemu/[email protected]

  // before
  import "github.com/stackshy/cloudemu/storage"
  // after
  import "github.com/stackshy/cloudemu/v2/services/storage"

• Public packages moved by role (import path == directory, so these are the source-visible changes):
  • Every emulated service → services/<name> (e.g. storage → services/storage, compute → services/compute, kubernetes → services/kubernetes, resourcediscovery → services/resourcediscovery, cost → services/cost).
  • Cross-cutting wrappers → features/<name>: chaos, recorder, metrics, ratelimit, inject, topology.
  • Shared helpers → internal/: statemachine → internal/statemachine, pagination → internal/pagination.
  • providers/{aws,azure,gcp} and server/{aws,azure,gcp} are unchanged — only their import prefixes gain /v2.
• No behavior changed in the move: the entrypoints (cloudemu.NewAWS(), NewAzure(), NewGCP()) and every driver, wire protocol, and error type are identical. The upgrade is a find-and-replace of the import prefix.

✨ Features

AWS STS — SDK-compat (query protocol)

The real aws-sdk-go-v2 STS client now works against cloudemu: GetCallerIdentity, AssumeRole, and GetSessionToken return well-formed credentials/identity envelopes so code that resolves an identity or assumes a role before calling other services runs end-to-end.

AWS SSM Parameter Store — SDK-compat (#239)

AWS Systems Manager Parameter Store drives a new parameterstore service: PutParameter (with overwrite + version bump), GetParameter / GetParameters / GetParametersByPath (recursive), DeleteParameter(s), and parameter labels — including String, StringList, and SecureString types and typed ParameterNotFound / ParameterAlreadyExists errors.

S3 — multipart upload, tagging, and versioning

The S3 handler gains the advanced object surface the SDK exercises for large and mutable objects: multipart (CreateMultipartUpload → UploadPart → CompleteMultipartUpload / AbortMultipartUpload, parts assembled in PartNumber order), object tagging (PutObjectTagging / GetObjectTagging / DeleteObjectTagging), and versioning (PutBucketVersioning plus version-aware GetObject / DeleteObject).

Azure Queue Storage + Table Storage — SDK-compat (#243)

Two Azure data-plane services land: Queue Storage (queue create/delete, put / get / peek / update / delete message with visibility-timeout and dequeue-count semantics) and Table Storage (table CRUD; insert / upsert / merge / replace / delete entity and OData-style query). Both speak the real azure-sdk-for-go wire format.

Azure AI — CognitiveServices + Machine Learning (#232)

Azure AI emulation across ARM and data plane: CognitiveServices accounts (ARM lifecycle) plus an assistants data plane, and Azure Machine Learning workspaces and their child resources. Unmodified azure-sdk-for-go clients drive both control-plane provisioning and data-plane calls.

🔧 Enhancements

CI/CD + security pipeline

A complete GitHub Actions setup lands with this release:

• ci.yml — build-vet (build then vet, sharing one cache), test, tidy, and advisory format / lint (golangci-lint v2) jobs, running in parallel with Go build + module caching (actions/cache@v4 with restore-keys) so repeat runs finish in well under a minute. Triggers on PRs and pushes to master, with concurrency cancel-in-progress.
• security.yml — govulncheck, gosec, CodeQL, and dependency-review (PR-only, fail-on high) as a separate parallel workflow.

Security hardening (CodeQL)

• Bounded RunInstances count across AWS EC2, Azure Virtual Machines, and GCP GCE — a request over the per-call maximum (1000) now returns InvalidArgument instead of attempting an uncontrolled allocation.
• Dropped a request-sized pre-allocation in Vertex AI FindNeighbors.

Correctness fixes

• S3 multipart now sorts parts by PartNumber before assembly, maps unknown upload IDs to NoSuchUpload, and rejects an empty CompleteMultipartUpload.
• SSM validates parameter labels and threads context through the PutParameter retry path.
• Azure Table supports UpsertEntity; Queue/Blob/Table shared-hostname collisions are documented.

Documentation

Every in-repo doc (architecture.md, services.md, features.md, getting-started.md) and the package overview were rewritten for the services/ / features/ / internal/ layout, and all import paths and badges updated to the /v2 module.

Technical Details

Repository restructure & /v2 module

• chore(v2)!: bump module path to github.com/stackshy/cloudemu/v2 — go.mod module path gains the required /v2 suffix; every internal import rewritten in lockstep across providers, servers, examples, and helpers.
• Service packages moved under services/ (28 services), cross-cutting wrappers under features/ (chaos, recorder, metrics, ratelimit, inject, topology), and generic helpers under internal/ (statemachine, pagination).
• providers/ and server/ trees kept their internal shape; only import prefixes changed. Build, go vet, and the full test suite are green on the new layout.

AWS STS & SSM Parameter Store

• STS (server/aws/sts, query protocol) — GetCallerIdentity, AssumeRole, GetSessionToken; typed error envelopes; registered with a disjoint action set.
• SSM (server/aws/ssm, query protocol → providers/aws/ssm) — PutParameter / GetParameter / GetParameters / GetParametersByPath (recursive) / DeleteParameter(s); label + version handling; String / StringList / SecureString; typed ParameterNotFound / ParameterAlreadyExists. fix(ssm) adds label validation and context threading in the Put retry path.

S3 — multipart, tagging, versioning

• feat(s3): add multipart, tagging, and versioning wire operations — CreateMultipartUpload / UploadPart / CompleteMultipartUpload / AbortMultipartUpload; PutObjectTagging / GetObjectTagging / DeleteObjectTagging; PutBucketVersioning with version-aware read/delete.
• fix(s3): sort multipart parts, map NoSuchUpload, reject empty Complete + test(s3) — out-of-order parts now assemble by PartNumber (regression test asserts AAAA…BBBB ordering), unknown upload IDs map to NoSuchUpload, and an empty Complete is rejected.

Azure Queue & Table Storage

• Queue (server/azure/queue) — queue create/delete; put / get / peek / update / delete message with visibility-timeout and dequeue-count semantics.
• Table (server/azure/table) — table CRUD; insert / upsert / merge / replace / delete entity; OData-style query. fix(azure-table) adds UpsertEntity support and documents Queue/Blob/Table shared-hostname collisions.

Azure AI (CognitiveServices + Machine Learning)

• CognitiveServices (server/azure/azureai) — ARM accounts lifecycle plus an assistants data plane.
• Machine Learning — workspaces and child resources (machinelearning*.go) over ARM, with data-plane round-trip coverage.

CI/CD & security workflows

• ci.yml — build-vet shares a single Go build+module cache (actions/cache@v4, restore-keys: go-${{ runner.os }}-); test, tidy, advisory format (gofmt, report-only) and lint (golangci-lint v2 via the official install script, report-only) run in parallel. Triggers: pull_request + push to master; concurrency with cancel-in-progress.
• security.yml — govulncheck (report-only), gosec (report-only), CodeQL (init/autobuild/analyze@v3, security-events: write), and dependency-review (fail-on-severity: high, PR-only), run as an independent parallel workflow.
• fix(security) — const maxRunInstances = 1000 guard in EC2/VM/GCE RunInstances; drop sized alloc in Vertex AI FindNeighbors. Resolves the CodeQL go/uncontrolled-allocation-size findings.

v1.9.0 — Full SDK-compat coverage across every service

Release Notes — v1.9.0

Full SDK-compat coverage. This release wires the last seven service domains through the SDK-compat HTTP layer, so every service driver cloudemu ships now speaks its cloud's real wire protocol across AWS, Azure, and GCP. Point the real aws-sdk-go-v2, azure-sdk-for-go, and cloud.google.com/go clients at a local endpoint and drive Load Balancer, Secrets, DNS, Cache, Logging, Notification, and Event Bus — no code changes, no Docker, no accounts. Completes #143.

✨ Features

Load Balancer — SDK-compat across AWS, Azure, and GCP

AWS ELBv2, Azure Load Balancer, and GCP Load Balancing now drive the existing loadbalancer driver: load balancers, target groups / backend pools, listeners / rules, and target registration & health — with each provider's native create / describe / delete semantics and typed errors.

Secrets — SDK-compat across AWS, Azure, and GCP

AWS Secrets Manager, Azure Key Vault (secrets data plane), and GCP Secret Manager now speak their real protocols against the secrets driver: secret lifecycle, value versioning / staging, and access — including Key Vault's bearer-challenge handshake.

DNS — SDK-compat across AWS, Azure, and GCP

AWS Route 53, Azure DNS, and GCP Cloud DNS drive the dns driver: hosted zones / managed zones and record sets (A/AAAA/CNAME/TXT/NS/PTR), with real change-batch / record semantics and typed errors.

Cache — SDK-compat across AWS, Azure, and GCP

AWS ElastiCache, Azure Cache for Redis, and GCP Memorystore now serve the cache driver's cluster/instance control plane: create / describe / list / delete with each provider's LRO and error shapes.

Logging — SDK-compat across AWS, Azure, and GCP

AWS CloudWatch Logs, Azure Log Analytics, and GCP Cloud Logging drive the logging driver: log groups / streams (or workspaces), put / get / filter log events, with AWS epoch-millis timestamps and typed errors.

Notification — SDK-compat across AWS, Azure, and GCP

AWS SNS, Azure Notification Hubs, and GCP FCM drive the notification driver: topics / subscriptions / publish (SNS), namespaces & hubs (Notification Hubs), and messages:send (FCM).

Event Bus — SDK-compat across AWS, Azure, and GCP

AWS EventBridge, Azure Event Grid, and GCP Eventarc drive the eventbus driver: event buses / topics / triggers, rules & targets, and event publishing.

Technical Details

Load Balancer

• AWS ELBv2 (server/aws/elbv2, query protocol) — CreateLoadBalancer, DescribeLoadBalancers (by ARN / by name / all), DeleteLoadBalancer; target groups, listeners, rules; RegisterTargets / DeregisterTargets / DescribeTargetHealth. Registered before EC2 with a disjoint action set. Typed errors incl. LoadBalancerNotFoundException, TargetGroupNotFoundException, RuleNotFoundException; a Describe by a non-existent name returns NotFound (not the whole fleet).
• Azure LB (server/azure/loadbalancer, ARM Microsoft.Network/loadBalancers) — CreateOrUpdate / Get / List / Delete; backend pools → target groups, load-balancing rules → listeners. Matches only loadBalancers (disjoint from network/dns).
• GCP LB (server/gcp/loadbalancer, compute REST) — global backendServices + forwardingRules insert / get / list / delete; a forwarding rule referencing a missing backend service errors rather than dangling.

Secrets

• AWS Secrets Manager (AWS JSON 1.1) — CreateSecret, DescribeSecret, ListSecrets, DeleteSecret, GetSecretValue, PutSecretValue, ListSecretVersionIds; AWSCURRENT/AWSPREVIOUS staging; ARN or name lookup; typed ResourceNotFoundException / ResourceExistsException.
• Azure Key Vault (/secrets/… data plane) — SetSecret, GetSecret (current / by version), list properties & versions, DeleteSecret; models the 401 + WWW-Authenticate bearer challenge.
• GCP Secret Manager (secretmanager/v1) — secrets create / get / list / delete, :addVersion, versions list / get, :access; latest alias.

DNS

• AWS Route 53 (REST/XML) — CreateHostedZone, GetHostedZone, ListHostedZones, DeleteHostedZone, ChangeResourceRecordSets (CREATE/UPSERT/DELETE), ListResourceRecordSets; record-level change errors map to InvalidChangeBatch; CallerReference round-trips.
• Azure DNS (ARM Microsoft.Network/dnsZones) — zones CRUD + record sets for A/AAAA/CNAME/TXT/NS/PTR; case-insensitive zone-name resolution.
• GCP Cloud DNS (dns/v1) — managedZones create / get / list / delete (by name or numeric id), changes.create (validated up front), resourceRecordSets.list.

Cache

• AWS ElastiCache (query protocol) — CreateCacheCluster, DescribeCacheClusters (get / list), DeleteCacheCluster; endpoint / configuration-endpoint split; typed CacheClusterNotFound / CacheClusterAlreadyExists.
• Azure Cache for Redis (ARM Microsoft.Cache/redis) — CreateOrUpdate / Get / List / Delete; SKU ↔ node type; inline LRO.
• GCP Memorystore (redis/v1) — instances create / get / list / delete with google.longrunning.Operation envelopes.
• Scope: cluster/instance control plane. The Redis data plane (GET/SET/…) has no cloud-SDK surface and is intentionally out of scope.

Logging

• AWS CloudWatch Logs (AWS JSON 1.1) — log groups & streams CRUD, PutLogEvents, GetLogEvents, FilterLogEvents; epoch-millis timestamps.
• Azure Log Analytics (ARM Microsoft.OperationalInsights/workspaces) — a workspace maps to a driver log group; CreateOrUpdate / Get / List / Delete (inline LRO). The data-plane log-query API is out of scope.
• GCP Cloud Logging (v2) — entries:write → put events, entries:list → get / filter (whole-token logName matching), logs.list, logs.delete.

Notification

• AWS SNS (query protocol) — CreateTopic, DeleteTopic, ListTopics, GetTopicAttributes, Subscribe, Unsubscribe, ListSubscriptions(ByTopic), Publish; ARN ↔ name; idempotent CreateTopic; typed NotFoundException.
• Azure Notification Hubs (ARM Microsoft.NotificationHubs) — namespaces & hubs CRUD (inline LRO).
• GCP FCM (fcm/v1) — messages:send → publish (honors validateOnly as a no-side-effect dry run). FCM's REST surface has no topic/subscription CRUD, so none is fabricated.

Event Bus

• AWS EventBridge (AWS JSON 1.1) — event buses, rules (+ enable/disable), targets, PutEvents; typed ResourceNotFoundException / ResourceAlreadyExistsException.
• Azure Event Grid (ARM Microsoft.EventGrid/topics) — topics → event buses CRUD (inline LRO). Data-plane event publish is a separate endpoint (out of scope).
• GCP Eventarc (eventarc/v1) — triggers → rules create / get / list / delete (LRO), with atomic rollback if target wiring fails.

v1.8.1

Release Notes — v1.8.1

✨ Features

Container Registry — SDK-compat servers across AWS, Azure, and GCP

Point the real registry clients at in-memory backends: AWS ECR (aws-sdk-go-v2), GCP Artifact Registry (artifactregistry/v1), and Azure Container Registry (azcontainerregistry) now drive the existing container-registry driver over each cloud's native wire protocol — repository and image/tag operations, matching each provider's real create / list / delete semantics and typed error codes.

🔧 Enhancements

IAM — managed policy versions across AWS, Azure, and GCP

Managed policies now carry versions: create, get, list, set-default, and delete, mirroring AWS semantics — an auto-seeded v1, monotonic never-reused version IDs, a five-version cap, and a protected default version whose document becomes the policy's effective document. Wired through the AWS IAM SDK surface with faithful error codes; Azure and GCP are covered at the portable API level.

Technical Details

AWS ECR

• SDK-compat server (AWS JSON 1.1, dispatched on X-Amz-Target) driving the existing container-registry driver.
• Repositories: CreateRepository, DescribeRepositories (get-by-name + list-all), DeleteRepository. Images: PutImage, ListImages, DescribeImages, BatchDeleteImage.
• BatchDeleteImage returns per-image failures; a missing repository throws RepositoryNotFoundException. Timestamps as Unix epoch seconds. Typed errors: RepositoryNotFoundException, RepositoryAlreadyExistsException, RepositoryNotEmptyException, InvalidParameterException, LimitExceededException.

GCP Artifact Registry

• SDK-compat REST server (artifactregistry.googleapis.com v1) driving the container-registry driver.
• Repositories: Create (async), Get, List, Delete (async); Images: dockerImages.list.
• Create / Delete return a completed long-running Operation inline; canonical projects/{p}/locations/{l}/repositories/{id} names; format DOCKER; imageSizeBytes rendered as an int64 string. Errors map to GCP status codes (404 notFound, 409 alreadyExists, …).

Azure Container Registry

• SDK-compat data-plane server (/acr/v1/…) driving the container-registry driver via azcontainerregistry.
• _catalog (list), repository properties, _tags (list), delete. No create call — repositories appear on image push, as in real ACR.
• Served anonymously (no challenge-token exchange); delete returns 202 Accepted, missing repo returns 404 (idempotent delete). Errors map to ACR codes (NAME_UNKNOWN, …).

IAM managed policy versions

• New driver + portable API + AWS/Azure/GCP mock operations: CreatePolicyVersion, GetPolicyVersion, ListPolicyVersions, DeletePolicyVersion, SetDefaultPolicyVersion.
• CreatePolicy auto-seeds v1; version IDs never reused; at most five versions; the default version cannot be deleted; the default's document is the policy's effective document (reflected by GetPolicy).
• AWS wire surface (query / XML) with faithful errors: DeleteConflict (delete default), LimitExceeded (version cap), NoSuchEntity (unknown policy / version). Azure and GCP covered at the portable / driver level, as their SDKs have no equivalent API.

v1.8.0

Release Notes — v1.8.0

✨ Features

AWS SageMaker — in-memory emulation + SDK-compat server

Point the real aws-sdk-go-v2 SageMaker client at an in-memory backend: models and endpoints (deploy / predict), training, processing, tuning, and batch-transform jobs, notebooks and Studio, pipelines, the model registry, feature store, and HyperPod-style clusters — with auto-metrics to CloudWatch and a portable Go API carrying the usual recording / metrics / rate-limit / error-injection / latency wrappers.

GCP Vertex AI — in-memory emulation + SDK-compat REST server

Datasets, the model registry and endpoints (deploy / predict), Gemini generateContent / streamGenerateContent / countTokens, tuning, custom / batch / hyperparameter-tuning jobs, pipelines, feature store, vector search, and ML metadata — with long-running-operation machinery, served over a REST surface the Vertex client can target.

🔧 Enhancements

Azure Databricks — faithful data-plane round-trips

Cluster, instance-pool, and SQL-warehouse settings that previously dropped between create and read now round-trip — custom tags, Photon runtime engine, pool idle-autotermination, and cluster policy / instance pool / Azure availability / source — and an explicit "never auto-stop" warehouse is honored. Query history is now served end-to-end.

Azure Resource Graph — Databricks discovery & type filtering

Databricks workspaces now appear in Resource Graph results, and where type in~ (...) type filters narrow correctly — including returning nothing (not everything) for a type the emulator doesn't model.

Technical Details

AWS SageMaker

• Portable Go API + driver + provider + SDK-compat handler (server/aws/sagemaker), AWS JSON 1.1 wire protocol.
• Families: models, endpoints (+ deploy / weights / predict / rawPredict), training / processing / tuning / batch-transform jobs, notebooks, Studio, pipelines, model registry (+ versions / packages), feature store, clusters.
• Auto-metrics to CloudWatch via SetMonitoring; chaos + cost wiring.

GCP Vertex AI

• Portable Go API + driver + provider + SDK-compat REST handler (server/gcp/vertexai), aiplatform.googleapis.com shape.
• Families: datasets, models (+ versions / evaluations), endpoints (+ deploy / predict), Model Garden generateContent / streamGenerateContent / countTokens, tuning + cached contents, custom / batch / HPO jobs, pipelines, feature store, vector search, metadata, schedules, notebook runtimes.
• google.longrunning.Operation responses with typed results; auto-metrics to Cloud Monitoring; chaos + cost wiring.

Azure Databricks

• Cluster: custom_tags, runtime_engine, policy_id, instance_pool_id, azure_attributes.availability, server-assigned cluster_source.
• Instance pool: idle_instance_autotermination_minutes, custom_tags.
• SQL warehouse: tags, and explicit auto_stop_mins = 0 honored (pointer-based, no default coercion).
• New GET /api/2.0/sql/history/queries (QueryHistory) handler.

Azure Resource Graph

• Databricks ARM workspaces fed into the cross-service discovery inventory via a dedicated walker.
• KQL where type in (...) / in~ (...) parsing with an any-of type filter; microsoft.databricks/workspaces mapped both ways.
• An all-unmapped / empty type filter now matches none instead of the whole inventory.

v1.7.3

Release Notes — v1.7.3

🔧 Enhancement

Azure Databricks — host metadata

The Databricks workspace server now answers the SDK's host-metadata discovery request, so the real databricks-sdk-go client resolves cleanly on first use — no fallback warning — and runs through the same workspace-detection path it uses against real Databricks.

Documentation — integrate cloudemu into your app

A new integration guide shows how to point your real SDK client at cloudemu in your existing tests instead of writing a throwaway demo, plus databricks-sdk-go SDK-server wiring and a full operation reference for Bedrock and Databricks.

Technical Details

Databricks host metadata

• Serves GET /.well-known/databricks-config (workspace-host stub) on the Azure server when the Databricks data plane is enabled.
• Wire value host_type: "workspace" (the SDK normalizes it to WORKSPACE_HOST); reports cloud: Azure and a request-derived OIDC token endpoint.
• Round-trip tested by decoding into the SDK's own config.HostMetadata and driving config.EnsureResolved.

Documentation

• docs/integration.md — endpoint-injection pattern (env var / config / direct), a _test.go harness, and a copy-paste AGENTS.md block for coding agents.
• docs/sdk-server.md — databricks-sdk-go quick-start and host-metadata notes.
• docs/services.md — Bedrock (Generative AI) and Databricks operation reference.

v1.7.2

Release Notes — v1.7.2

✨ Feature

Azure Databricks — full in-memory workspace coverage

Run and manage jobs and their runs end-to-end, resize and pin clusters and browse available machine types / runtimes / regions, set cluster policies, and install cluster libraries. Store secrets and access tokens, connect Git folders and credentials, work with files and notebooks, and run SQL warehouses and data pipelines. Manage model serving endpoints and identities (users, groups, and service accounts), and organize data with Unity Catalog — catalogs, schemas, tables, and storage.

Technical Details

Azure Databricks

• SDK: databricks-sdk-go — the real WorkspaceClient works against a local endpoint (Config.Host).
• Jobs / runs: submit, run-now, get-run, list-runs, cancel-run, cancel-all, get-output, delete-run, repair-run.
• Clusters: resize, pin, unpin, list-node-types, spark-versions, list-zones.
• Cluster policies; libraries (install / uninstall / status).
• Secrets (scopes / secrets / ACLs), tokens, git credentials, repos.
• DBFS (incl. block upload), workspace (notebooks / directories).
• SQL warehouses, pipelines, serving endpoints.
• Identity (SCIM): users, groups, service principals.
• Unity Catalog: catalogs, schemas, tables; metastores, external locations, storage credentials, volumes.

v1.7.1

Enhancement

• AWS Bedrock — In-memory emulation of Amazon Bedrock. Manage the foundation-model catalog, run model-customization jobs and the custom models they produce, configure guardrails, provisioned throughput, and invocation logging, and run inference through InvokeModel and Converse.
• Azure Databricks — In-memory emulation of Azure Databricks. Manage workspaces through Azure Resource Manager, and operate the workspace data plane: clusters, instance pools, jobs, and permissions.

Technical Details

AWS Bedrock

• SDKs: aws-sdk-go-v2/service/bedrock, .../bedrockruntime
• Control plane: foundation models, model-customization jobs, custom models, guardrails, provisioned throughput, invocation logging.
• Runtime: InvokeModel (family-aware response envelopes) and Converse.

Azure Databricks

• SDKs: armdatabricks, databricks-sdk-go
• ARM workspaces: create, get, update, delete, list by resource group / subscription.
• Data plane (/api/2.x): instance pools, clusters, jobs, and permissions.

v1.7.0 — IAM SDK-compat across AWS, Azure, and GCP

Feature

• AWS IAM SDK-compat handler covering thirty-four operations across Users, Roles, Policies, Attach and Detach and ListAttached, Groups, AccessKeys, and InstanceProfiles. Real aws-sdk-go-v2/service/iam clients connect by changing only the endpoint and round-trip end-to-end with typed NoSuchEntityException and EntityAlreadyExistsException errors.
• Azure IAM SDK-compat handler covering Microsoft.Authorization RoleDefinitions and RoleAssignments at any scope (subscription, resource group, resource, management group). Real armauthorization SDK clients work against the SDK server with errors surfaced as typed azcore.ResponseError.
• GCP IAM SDK-compat handler under iam.googleapis.com v1 covering ServiceAccounts, custom Roles, and ServiceAccountKeys. Real google.golang.org/api/iam/v1 clients round-trip end-to-end with errors surfaced as typed googleapi.Error.

Enhancement

• Documentation refresh for the cross-service ResourceDiscovery engine and the inventory SDK-compat handlers (AWS Resource Explorer and Resource Groups Tagging, Azure Resource Graph, GCP Cloud Asset Inventory): new Features section, new Services reference row with per-handler operations, per-provider Server reference entries, and a Supported services row in the README.

v1.6.4 — Resource discovery engine + cloud inventory SDK-compat

Feature

• Cross-service ResourceDiscovery engine that aggregates and queries resources across compute, storage, database, networking, and serverless from a single inventory surface.
• AWS Resource Explorer Two and Resource Groups Tagging SDK-compat handlers wired through the gateway.
• Azure Resource Graph SDK-compat handler with KQL-shaped query support over the unified inventory.
• GCP Cloud Asset Inventory SDK-compat handler covering searchAllResources, assets list, exportAssets, feeds, and operations.

Enhancement

• Database service exposes TagResource, UntagResource, and ListTagsOfResource so tagged resources flow into the discovery engine.
• Networking service exposes UpdateTags and RemoveTags on VPC, Subnet, and SecurityGroup.
• ResourceDiscovery exposes TagResourceByARN and UntagResourceByARN for tag operations addressed by canonical resource identifier.
• ResourceDiscovery engine wired into the AWS, Azure, and GCP provider factories so every service surfaces inventory entries automatically.

Fixed

• ResourceDiscovery now only swallows NotFound on tag lookups; all other lookup errors propagate to the caller.
• Addressed review feedback in the AWS Resource Explorer and Resource Groups Tagging handlers.
• Addressed review feedback in the Azure Resource Graph handler.
• Addressed review feedback in the GCP Cloud Asset Inventory handler.

v1.6.3 — Kubernetes data plane (Wave 2)

Release v1.6.3.

Headline

• Kubernetes data plane (Wave 2) — every cloudemu EKS/AKS/GKE cluster
  now has a working in-memory Kubernetes API behind it. Real client-go
  and kubectl operate end-to-end: kubeconfigs returned by the control
  plane point at <base>/k8s/<cluster-uid> instead of the Wave 1
  *-DATAPLANE-NOT-IMPLEMENTED sentinel.

Features

• New shared kubernetes/ package — an in-memory K8s API server
  registered once and reused by all three cloud servers
  (awsserver / azureserver / gcpserver). Per-cluster state isolation
  via cluster UID baked into the kubeconfig URL.
• 8 K8s resources with full CRUD + JSON-merge Patch + Watch:
  • core/v1: Namespace, ConfigMap, Pod, Service, Secret,
    ServiceAccount, Endpoints
  • apps/v1: Deployment
• Watch streaming (?watch=true) with chunked-transfer event stream
  and initial-state replay, so client-go SharedIndexInformer / Reflector
  machinery (operator-sdk, Helm, ArgoCD, Flux, …) works against
  cloudemu out of the box.
• Per-resource quirks mirror real apiserver behavior:
  • Secret StringData merged into Data on create / update
  • Service ClusterIP allocated from 10.96.0.0/12 (kubeadm default);
    immutable on update; "None" honored as headless
  • Pod born Pending (no scheduler in scope)
  • ServiceAccount "default" auto-created in every namespace
  • Deployment status.replicas mirrored from spec.replicas
  • Endpoints auto-created paired with each Service
• Namespace delete cascades: every namespaced resource is dropped and
  a DELETED Watch event published per object.
• Control-plane → data-plane wiring on all three clouds:
  • AWS EKS: SetK8sAPI + withK8sEndpoint rewrites Cluster.Endpoint
  • Azure AKS: ListClusterAdmin/User/MonitoringUser Credentials
    return a real kubeconfig
  • GCP GKE: Cluster.Endpoint returns the per-cluster URL
• Docs refresh: README leads with SDK-compat, docs/services.md gets a
  Master Table row 18 (Kubernetes) + a data-plane subsection,
  docs/sdk-server.md documents the new /k8s/{uid}/ protocol detection.

Every new resource ships with a real-SDK round-trip test:

• AWS EKS via aws-sdk-go-v2/service/eks + client-go (#190, #191)
• Azure AKS via armcontainerservice/v6 + clientcmd-parsed kubeconfig (#192)
• GCP GKE via google.golang.org/api/container/v1 + client-go (#192)
• SharedIndexInformer over the in-memory API proving Watch works (#193)

Wave 2 shipped in four PRs:

• #190 — Phase 1: APIServer + Namespace + ConfigMap + EKS wiring
• #191 — Phase 2: Pod, Service, Secret, ServiceAccount, Deployment, cascade
• #192 — Phase 3: AKS + GKE wiring; kubeconfig renderer; coverage tests
• #193 — Phase 4: Watch streaming, Endpoints, docs refresh

Out of scope (intentionally deferred):
Real controllers (Deployment → ReplicaSet → Pod, scheduler, Endpoints
populated from Service selector), RBAC, subresources (/status, /scale,
/log, /exec), PV/PVC, StatefulSet/DaemonSet/Job/CronJob, Ingress,
NetworkPolicy.