chore(release): prepare Hulumi 2.0.0 (#278)

Atomic six-package SemVer-major release preparation for the required clusterDns boundary identity. Independently audited exact 1695146; protected CI fully green.

Author: kerberosmansour

CHANGELOG.md

@@ -9,6 +9,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 _No changes yet._
 
+## [2.0.0] — 2026-08-02
+
+Atomic six-package publish:
+`@hulumi/baseline@2.0.0`, `@hulumi/policies@2.0.0`, `@hulumi/drift@2.0.0`,
+`@hulumi/k8s-baseline@2.0.0`, `@hulumi/cloudflare-baseline@2.0.0`, and
+`@hulumi/platform-patterns@2.0.0`.
+
+### Security
+
+- `BrokeredAuroraPostgresBoundary` and `WorkloadCapabilityIssuerBoundary`
+  now require the exact cluster-DNS namespace, Pod selector, and security-group
+  identity. Protected workloads receive only TCP/UDP 53 egress to that DNS
+  identity, with reciprocal security-group ingress and an ANDed Kubernetes
+  namespace-and-Pod peer.
+- Exact Route 53 Resolver `/32` rules remain in place for VPC DNS forwarding;
+  wildcard CIDRs and selectors are rejected.
+- Protected Pod templates explicitly disable Istio sidecar injection so their
+  one-container, zero-init-container admission contract remains enforceable.
+
+### Changed
+
+- This is a major release because both protected-boundary constructors now
+  require `clusterDns`; existing consumers must supply their exact cluster-DNS
+  namespace, Pod selector, and security-group identity before upgrading.
+
 ## [1.5.6] — 2026-07-30
 
 Atomic six-package publish:

README.md

@@ -190,6 +190,8 @@ The docs are organised by what you're trying to do. The full index lives at [doc
 | v1.5.2  | 2026-07-29 | First-create preview hardening for the brokered PostgreSQL boundary: known IRSA trust and secret parent/KMS relationships are prevalidated before provider-output deferral; remaining structural checks require resolved outputs. See [`docs/release/v1.5.2-release-notes.md`](./docs/release/v1.5.2-release-notes.md).                                                                                                                                                      |
 | v1.5.3  | 2026-07-29 | Deployment-mechanics fix for the brokered PostgreSQL boundary: Pulumi no longer awaits a migrator Job that is intentionally suspended; workloads remain inert until explicit activation. See [`docs/release/v1.5.3-release-notes.md`](./docs/release/v1.5.3-release-notes.md).                                                                                                                                                                                               |
 | v1.5.4  | 2026-07-29 | Live-state policy normalization for the brokered PostgreSQL boundary: semantically identical Kubernetes objects pass despite key ordering and server metadata, while explicit malformed values still fail closed. See [`docs/release/v1.5.4-release-notes.md`](./docs/release/v1.5.4-release-notes.md).                                                                                                                                                                      |
+| v1.5.6  | 2026-07-30 | Workload capability issuer boundary, exact native-TLS identity custody, scoped admission guards, and one authoritative DynamoDB table identity. The unpublished v1.5.5 candidate was superseded by this release.                                                                                                                                                                                                                                                             |
+| v2.0.0  | 2026-08-02 | Exact cluster-DNS security-group and NetworkPolicy routing for protected boundaries, plus Pod-template-only Istio injection opt-out that preserves the one-container admission contract. This major release requires exact `clusterDns` identity on both protected-boundary constructors. See [`docs/release/v2.0.0-release-notes.md`](./docs/release/v2.0.0-release-notes.md).                                                                                              |
 
 Per-milestone specs live in [`docs/slo/runbook-milestones/`](./docs/slo/runbook-milestones/) and lessons-learned in [`docs/slo/lessons/`](./docs/slo/lessons/). The master runbook is [`docs/slo/completed/RUNBOOK-hulumi.md`](./docs/slo/completed/RUNBOOK-hulumi.md). For what's next, watch the [issue tracker](https://github.com/kerberosmansour/hulumi/issues) and [CHANGELOG.md](./CHANGELOG.md).
 

declarations/cyclonedx-1.6-capabilities.json

@@ -8,7 +8,7 @@
     "component": {
       "type": "application",
       "name": "hulumi",
-      "version": "1.5.6"
+      "version": "2.0.0"
     }
   },
   "declarations": {
@@ -19,7 +19,7 @@
           "type": "library",
           "group": "@hulumi",
           "name": "baseline",
-          "version": "1.5.6",
+          "version": "2.0.0",
           "properties": [
             {
               "name": "cdx:sunlit:controls",
@@ -44,7 +44,7 @@
           "type": "library",
           "group": "@hulumi",
           "name": "policies",
-          "version": "1.5.6",
+          "version": "2.0.0",
           "properties": [
             {
               "name": "cdx:sunlit:controls",
@@ -93,7 +93,7 @@
           "type": "library",
           "group": "@hulumi",
           "name": "drift",
-          "version": "1.5.6",
+          "version": "2.0.0",
           "properties": [
             {
               "name": "cdx:sunlit:controls",
@@ -114,7 +114,7 @@
           "type": "library",
           "group": "@hulumi",
           "name": "k8s-baseline",
-          "version": "1.5.6",
+          "version": "2.0.0",
           "properties": [
             {
               "name": "cdx:sunlit:controls",
@@ -139,7 +139,7 @@
           "type": "library",
           "group": "@hulumi",
           "name": "cloudflare-baseline",
-          "version": "1.5.6",
+          "version": "2.0.0",
           "properties": [
             {
               "name": "cdx:sunlit:controls",
@@ -172,7 +172,7 @@
           "type": "library",
           "group": "@hulumi",
           "name": "platform-patterns",
-          "version": "1.5.6",
+          "version": "2.0.0",
           "properties": [
             {
               "name": "cdx:sunlit:controls",

docs/release/v2.0.0-release-notes.md

@@ -0,0 +1,27 @@
+# Hulumi v2.0.0
+
+Hulumi 2.0.0 closes the cluster-DNS path for the protected PostgreSQL broker
+and workload capability issuer boundaries without broadening their network or
+admission authority.
+
+## Security changes
+
+- Both boundary APIs require an exact cluster-DNS namespace, Pod selector, and
+  security-group identity.
+- Protected security groups permit TCP and UDP port 53 only to the declared DNS
+  security group; reciprocal ingress is added only on that DNS group.
+- Kubernetes NetworkPolicies retain the exact Route 53 Resolver `/32` path and
+  add one DNS peer whose namespace and Pod selectors are evaluated together.
+- Protected Pod templates opt out of Istio injection while shared resource
+  labels, Service selectors, NetworkPolicy selectors, and admission rules stay
+  unchanged.
+- Empty or wildcard DNS identities fail validation.
+
+## Breaking change
+
+Consumers of `BrokeredAuroraPostgresBoundary` or
+`WorkloadCapabilityIssuerBoundary` must provide the new `clusterDns` input.
+The major release makes this fail-closed constructor change explicit; existing
+deployments must supply the cluster DNS identity before upgrading.
+
+All six `@hulumi/*` packages remain on the atomic `2.0.0` release train.

packages/baseline/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hulumi/baseline",
-  "version": "1.5.6",
+  "version": "2.0.0",
   "description": "Hardened Pulumi baseline components for AWS and GitHub — SecureBucket, AccountFoundation, AWS organization guardrails, secure primitives, detection foundations, SecureRepository, OrgFoundation. SLSA Build L3 attestation on every release.",
   "license": "Apache-2.0",
   "publishConfig": {

packages/cloudflare-baseline/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hulumi/cloudflare-baseline",
-  "version": "1.5.6",
+  "version": "2.0.0",
   "description": "Hardened Pulumi baseline components for Cloudflare edge posture.",
   "license": "Apache-2.0",
   "publishConfig": {

packages/drift/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hulumi/drift",
-  "version": "1.5.6",
+  "version": "2.0.0",
   "publishConfig": {
     "access": "public",
     "provenance": true

packages/k8s-baseline/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hulumi/k8s-baseline",
-  "version": "1.5.6",
+  "version": "2.0.0",
   "description": "Hardened Pulumi K8s / EKS / Istio / RDS / Secrets-Manager baseline components — EksClusterFoundation, HardenedHelmRelease, EksSubnetTagger, IstioFoundation, AlbMeshedHttpEntrypoint, KubernetesSecretFromAwsSecretsManager, RdsCredentialSecret, GitHubAppCredential. SLSA Build L3 attestation on every release.",
   "license": "Apache-2.0",
   "publishConfig": {

packages/platform-patterns/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hulumi/platform-patterns",
-  "version": "1.5.6",
+  "version": "2.0.0",
   "description": "Cross-provider Pulumi patterns for Cloudflare edge ingress, AWS deployment identity, secure Pulumi state backends, GitHub deployment repositories, build provenance, and runner governance.",
   "license": "Apache-2.0",
   "publishConfig": {

packages/policies/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hulumi/policies",
-  "version": "1.5.6",
+  "version": "2.0.0",
   "publishConfig": {
     "access": "public",
     "provenance": true