v1.1.0

1.1.0 (2026-08-26)

Features

• agentcore-demo: a real stranger for path 3, and prove the firewall (6088c47)
• agentcore-demo: BNK governance + end-to-end token observability (7b23469)
• agentcore-demo: guided demo driver and a slide diagram (65c2300)
• agentcore-demo: one-command rebuild, and fix a stale-kubeconfig trap (235fa09)
• agentcore-demo: real authn/authz, a privileged tool, and honest telemetry (1089364)
• agentcore-demo: TLS on the MCP hop — and retract the "BNK can't do HTTPS" claim (e9d6534)
• ai-rig: enable AWS LB Controller addon for Envoy proxy shootout (PRD-11) (e38c1bd)
• benchmark: real Envoy-vs-BNK shootout via NodePort pre-seed (WS-E2) (3d5acf2)
• benchmark: SageMaker cold-redeploy cache reset behind --reset-cache (PRD-11 Task B) (6214e70)
• benchmark: scenario-sequence + cache-reset seam (PRD-11 Task A) (d50f09d)
• benchmark: set opt-in internal-NLB tags on forge target for non-BNK shootouts (PRD-11 Slice 4) (16fa278)
• bnk: resync --watch — auto-heal stale pool members on EndpointSlice change (779d75a)
• cli: add 'awsbnkctl topology' — whole-cluster data-path view (ASCII + mermaid) (76b9112)
• cli: add up --demo flag + demo: config block + DEMO_MODE state marker (#68) (3942d1f)
• cli: per-phase deployment lines in `awsbnkctl status` (8bfd8ab)
• cni: enable VPC CNI prefix delegation to keep pods on the primary ENI (f5d2bda)
• complete agentcore demo with gateway api routing (295f016)
• complete BNK infrastructure routing and test clients for A2A and MCP governance (006b650)
• demo: ingress-migration + external BIG-IP VE/CIS demo scenarios (9fb69bb)
• demo: promote http2+diameter assets into //go:embed packages (PRD-10 Embed slice) (#71) (9fb8c4f)
• demo: Slice A2 — inject awsbnkctl:demo + demo-expiry tags onto all AWS resources (#69) (987a36b)
• demo: Slice B — Phase17dDemoStage jumphost client pre-staging (#73) (bbbd601)
• demo: Slice C0 — demo {list,run,clean} command group + clean enumerator (#75) (c859267)
• demo: Slice C1 — http2 use-case (HTTP/2 h2c end-to-end through TMM) (PRD-10) (#76) (9d0fa97)
• demo: Slice C2 — diameter use-case (L4 CER→CEA via BNK TMM) (PRD-10) (#77) (9739318)
• demo: Slice D — green scenarios in the demo catalogue (PRD-10) (#78) (cc88256)
• forge: --register-with-forge flag on awsbnkctl up (P2) (6119a21)
• forge-benchmark: mooncake trace replay + registry-derived scenario help (WS-C2) (31c48e9)
• forge-benchmark: port forge native scenario engine (WS-C1) (90c3dcb)
• forge-benchmark: rich raw /aiperf push + object-graph linkage + aiperf install hardening (293ac3b)
• forge-enabled demo example + live rocket timer (#89) (857ae2f)
• forge: delete benchmark artifacts on down + opt-in forge cleanup (42e24c0)
• forge: make forge credentials + REST URL configurable (flag/env/yaml) (537879e)
• forge: multi-scenario benchmark presets + jumphost access-method registration (7bd4baa)
• forge: proxy shootout — run one scenario through each front-end, stamp proxy_deployment_id (WS-D1) (1735462)
• forge: wire awsbnkctl to bnk-forge over MCP transport (38a1081)
• gpu: Group 4 — Phase11cNvidiaDevicePlugin up/down + lifecycle wiring + render golden tests (0a07f6b)
• gpu: Group 5 — examples/ai-rig/cluster.yaml + example load tests (e8d747c)
• gpu: Groups 1-3 — intent fields + phase10 per-ng AMI/spot/taints/AZ + NVIDIA manifest/render (40474e3)
• host-device: pciBusID NADs + node-side MAC discovery of iface/PCI (7895000)
• intent: mandate Kubernetes 1.32 as the floor for real clusters (4ae79ea)
• lb-controller: AWS Load Balancer Controller addon for internal-NLB proxy reachability (PRD-11 Slice 1) (a94e463)
• network: sriov-external pattern — TMM DPDK dataplane over vfio-bound ENA (#92) (7eae12c)
• network: three selectable BNK interface patterns (A/B/C) (#91) (8d5c359)
• phase24c: H4 — heal pod-manager cold-start race vs kube-proxy (199675e)
• prd-11: AI LB + SageMaker demo slices + live-run fixes (checkpoint) (8abcc23)
• real agentcore project via CLI instead of dummy yaml (3ecf51f)
• replace dummy mcp with real fastmcp server and add agentcore agent code (e09f64d)
• sagemaker: Qwen-32B sizing knobs + GPU-fit preflight (PRD-11 Task C) (9d20ad2)
• scenarios: add AI how-tos #6/#7 as Amber (annotation-driven) (0a65581)
• scenarios: add egress-snat Amber scenario (F5SPKEgress AUTOMAP + pseudo-CNI VXLAN) (8edd8ed)
• scenarios: add external-resource-pool (how-to #10, Pool CR backend) (72a23b8)
• scenarios: add http-traffic-split (weighted HTTPRoute, how-to #8) (46d84c0)
• scenarios: add multi-vip (chassis model — N VIPs from one pool) (b0f5550)
• scenarios: add proxy-protocol-l4 (how-to #9, L4Route + iRule) (a856833)
• slice-01: tracer-bullet VPC + subnets via strict Go SDK (8b1ddd4)
• slice-02: IAM phase — EKS cluster role + node role + instance profile (5e8d0c6)
• slice-03+04: EKS cluster + node group + kubeconfig + forge register (7131c5c)
• slice-05: BNK foundation — namespaces + supply-chain Secrets + cert-manager + cert chain (fd3ab15)
• slice-06: FLO Helm install + OTEL certs via Helm Go SDK (e5f7ffe)
• slice-07: full BNK activation — IRSA OIDC + secondary ENIs + CNEInstance + License + CWC heal + 20-min polling (#15) (2523e1b)
• slice-08: EBS CSI driver + gp3 StorageClass + hugepages-ds (#19) (1e6ee07)
• slice-10: host-device data plane (SelfIPs + F5SPKVlan + GatewayClass + IRSA routes) (#23) (23f78eb)
• slice-11: TMM SIGSEGV fixes + bnk resync helper + scenarios PRD — HTTP 200 e2e on syd-tracer (#24) (b786bd8)
• slice-12: jumphost phase + forge aws_profile + awsbnkctl test traffic (#25) (0e23a85)
• slice-13: scenarios framework + http-routing-e2e + 5 slice-12 cold-start fixes (#26) (623f361)
• status: add DEMO banner + warn-only TTL notice (Slice A3) (#70) (f32ca63)
• tf: terraform.applied.tfvars snapshot after successful apply (0e6ab89)
• ui: rocket-launch + SpaceX-landing renderer for up/down --demo (#87) (3b525f9)
• ui: Slice E — rocket-themed launch renderer for up --demo (PRD-10) (#79) (dc7fe00)

Bug Fixes

• agentcore-demo: correct the teardown blockers, and what the first real run found (1a22619)
• agentcore-demo: key the rate limit on caller identity, clip bodies for syslog (30e62da)
• agentcore-demo: remove an SSO guard that refused almost always (6689b30)
• agentcore-demo: the 401 is the tool's, not BNK's (67cb671)
• agentcore-demo: two bugs in rebuild.sh found by re-reading it (4fc36ea)
• ai-inference-e2e: bounded SSE-probe poll + 20m vLLM readiness gate (76be6fa)
• ai-inference-e2e: live-validated vLLM-on-g5.xlarge fixes (7c00614)
• aws: handle InvalidInstanceConnectEndpointId.NotFound error code during EICE teardown (ffbc3a0)
• benchmark: preflight vLLM served model name before aiperf (WS-E1) (58f9488)
• benchmark: send upstream_namespace tag + scheme-tolerant front-end URL (PRD-11) (6f0ac1e)
• ci: bump helm.sh/helm/v3 to v3.21.0 to clear govulncheck (2351d52)
• ci: file-ignore SA1019 for k8sfake.NewSimpleClientset (e538d06)
• ci: gofmt phase10 nosec annotation alignment (024d9bc)
• ci: green PR #11 — gosec G115 + G304 annotations (343e408)
• ci: green PR #13 — cspell dockerconfigjson + gosec G101 false positive (7993e0f)
• ci: green PR #14 — dead test helper + gosec G101 + cspell (8bf8732)
• ci: green PR #8 — staticcheck dead code + gosec + cspell (d2db8f4)
• ci: track ml.g5.xlarge example change + gosec G101 on REST path (125a9c0)
• cli: --var-file relative-path resolution + wire flag through to Plan (4e2b26d)
• cli: split --dry-run var so planCmd default does not poison upCmd (4973bfc)
• cli: split flagDownDryRun + audit-document cobra shared-var anti-pattern (77cd418)
• cli: status uses the targeted cluster's kubeconfig + unify -f/--config targeting (#66) (ebd3f28)
• cold-start: Chunk 1 — Critical fixes C-2/C-4/C-5/C-6/C-7 (#29) (548ae40)
• cold-start: Chunk 2 — High findings H-3..H-8 (#30) (f5e97a8)
• cold-start: Chunk 3+4 — Medium/Low cleanup (#31) (37d17c7)
• cold-start: Finding #2 — phase 25 budget 12→18 + ResyncCNEInstance kick (#34) (8c08a7b)
• cold-start: Finding #3 — Phase 24b DSSM --insecure readiness overlay (#35) (7448043)
• cold-start: hotfix — reset RESTMapper on NoKindMatch (C-6 follow-up; live-validated) (#32) (1863b55)
• cold-start: Phase 24b — patch all 7 --tls scripts (live-validated hotfix) (#36) (5c03f7b)
• correctly map subnets to their respective AZs for IPAM (3e23ab1)
• doctor: no-region AWS chain degrades to warning, honoring green-by-default (02cad33)
• down: tag-discovery teardown — clear SG cross-refs, discover IGW VPC (3f6ff0a)
• dryrun: allow nil Bnk block in infra-only dry-run (5bdf6cf)
• exec: rename k8sLongLivedKey → k8sLongLivedEnv (kill gitleaks false positive) (f0ed90f)
• filter Local Zone subnets from EKS control plane creation (16954fa)
• fmt: gofmt alignment on render_test.go comment columns (fbb1ad9)
• forge,jumphost: correct cluster name on post-apply register + python3 -m pip on AL2023 (ca1ad95)
• forge,jumphost: reconcile aiperf integration with real aiperf 0.10.0 CLI (8fdf516)
• forge: agent capabilities as dict + target-list object decode (WS-E1) (f84e5ba)
• forge: down purges the project + by-name discovery when link is lost (a9b8679)
• forge: match canonical aiperf transform + link run to config (0e603a1)
• forge: parse flat MCP create_project/create_cluster response shapes (652f05b)
• gitleaks: reword HF comment to avoid generic-api-key false positive (e3073d9)
• gofmt internal/aws/phases/phase17b_jumphost.go (c209e4e)
• gosec: G115 suppression on GPU-LT DiskSize int32 conversion (4994b17)
• gpu: v2 review fixes — DiskSize, AZ-filter unification, taint/capacityType validation (8e3435b)
• idempotency: guard phase14 FLO upgrade + phase24b DSSM overlay on healthy re-run (#74) (9d80670)
• ignore historical test credentials flag by gitleaks after history scrub (c738096)
• ignore more test credentials and remove duplicate ci step (ab5ae64)
• intent: move to k8s 1.35 everywhere, raise the floor to 1.34 (f8db6eb)
• lifecycle: honor --dry-run on down; stop up --dry-run polluting state (#83) (464d215)
• lint: staticcheck ST1005 — error string must not end with punctuation (9c5f0b6)
• lowercase docker image tags (ac92700)
• move agentcore-demo writeup to its example directory (9d7822b)
• phase13: H1 — accept empty CNEInstance status.state when sub-conditions True (d1a801b)
• phase17c: add idempotent-skip guard when TMM owns secondary ENIs (#72) (c7474da)
• phase23b: wait for GatewayClass CRD before applying CRs (0979b0c)
• phase24c: H4-rev — poll full window, allow up to 2 bounces (391696c)
• phase25: H1 — gate on F5Tmm+CNEController sub-conditions, not rollup Available (52f639e)
• re-audit pass — secret-on-argv, destructive-down gate, BIG-IP lifecycle, docs (c769e3b)
• remove completely unused SSM policy constant (6acbe6f)
• remove tracer from test slices (27e8a23)
• remove unused constants and functions from jumphost phase (0cac0af)
• resync: behaviour-preserving restore + concurrent-edit guards (3690d0e)
• sagemaker: auto-recover Failed endpoint + pin LMI served model name (02196e3)
• sagemaker: wait for execution-role IAM propagation before create (WS-E1) (b7f580b)
• scenarios,jumphost,forge: live-validated cycle-4 fixes (7/7 scenarios green) (4de8725)
• scenarios: force SSA on manifest apply so re-runs don't need clean (6f97643)
• scenarios: narrow http-routing-e2e VIP pool + harden L4Route status check (fc44e04)
• scenarios: rework external-resource-pool to EndpointSlice (no Pool CR) (02bd0fe)
• scenarios: verifier correctness — Host header, F5BnkGateway GVR, diagram ns (3365ca8)
• security: clear gosec findings in BIG-IP demo code (CI red since #93) (5b2a952)
• security: unblock govulncheck CI gate (b67c28d)
• security: update Go toolchain for crypto/tls CVE (16a42b7)
• slice-01: dry-run traverses all phases end-to-end (74e3633)
• slice-03+04: k8s label colon + REST flat-shape parsing + gosec G115 (234a66c)
• slice-04: forge REST third-shape parsing + base64-encoded kubeconfig (fb65dd0)
• slice-05: FAR Secret wraps GCP service-account JSON as dockerconfigjson (5ea56fb)
• slice-06: FLO Deployment name is f5-lifecycle-operator, not chart-subchart (2a6d49f)
• slice-07/10: pin node group to data-path AZ for host-device pattern (#20) (900aa43)
• slice-07: correct ManifestVersion default to BNK 2.3.0 manifest (#18) (3f5cf60)
• slice-07: create f5-cne-system namespace in Phase 12 (#16) (4b1326e)
• slice-07: install Multus CNI v4.2.4 in Phase 12 (#17) (f9a3c4b)
• slice-08: finish hugepages capacity wait + forge upsert (#21) (e4e96dd)
• slice-09: use AL2023 AMI so secondary ENIs name as ensN (#22) (565b844)
• test: satisfy Scenario.Namespace in cli fakes + gofmt phase24c test (e8056f8)