Skip to content

v0.2.37

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 May 22:48
· 1922 commits to master since this release
v0.2.37
17f8e7c

Release v0.2.37

v0.2.37 fixes service registration topology handling for regional media clusters.

Upgrade

Cluster operators

This release ships one Quartermaster expand migration and one Quartermaster postdeploy migration.

The expand migration adds service_cluster_assignments.source, with allowed values gitops_seed, runtime, and adopted_local. Existing rows default to runtime, which matches how all existing assignment rows were created. The postdeploy migration validates the new CHECK constraint.

Recommended sequence:

frameworks cluster migrate validate
frameworks cluster migrate --manifest <path> --phase expand --to-version v0.2.37 --dry-run
frameworks cluster migrate --manifest <path> --phase expand --to-version v0.2.37
frameworks cluster provision --manifest <path>
frameworks cluster upgrade plan --manifest <path> --version v0.2.37
frameworks cluster upgrade --manifest <path> --version v0.2.37 --all
frameworks cluster migrate --manifest <path> --phase postdeploy --to-version v0.2.37
frameworks cluster status --manifest <path>

Run cluster provision during the upgrade. Foghorn Redis Sentinel env generation changed, and the release depends on reconciled service env.

Expand is back-compatible. Run postdeploy after the new binaries are live.

Tenants on a managed FrameWorks cluster

Nothing to do. This is an operator hotfix.

Edge-only self-hosters

Nothing to do. Foghorn continues to reconcile edge releases over the existing Helmsman stream.

Tenant-private / marketplace cluster operators

Run frameworks cluster provision as part of the upgrade. This release matters for regional media clusters where pool-assigned services such as Foghorn register from physical regional nodes but serve logical media clusters.

Hardened

  • Quartermaster now separates physical service registration from logical media-cluster assignment. Pool-assigned services register in the physical node cluster, while service_cluster_assignments carries the logical serving cluster used by DNS and discovery.
  • Pool-assigned service bootstrap now requires node_id, so Quartermaster can safely resolve the physical node cluster instead of accepting ambiguous host-only registrations.
  • service_cluster_assignments.source records assignment provenance. Runtime assignment paths write runtime for new rows and preserve existing source on conflict, so future GitOps-owned rows are not silently demoted by runtime upserts.
  • Privateer internal cert sync now uses the union of GitOps-expected services and Quartermaster-registered services. GitOps-declared services can request certificates before self-registration, and runtime-attached services still get certificates after registration.
  • Privateer cert sync isolates per-service issuance failures. One stale or denied service certificate request no longer blocks sibling service cert rotation.
  • Privateer cert sync now treats failures for registered services and local write failures as unhealthy, while expected-only denials are rate-limited to avoid log spam.
  • Foghorn Redis Sentinel config now passes REDIS_SENTINEL_PASSWORD alongside REDIS_PASSWORD, and the shared Redis client supports sentinel-specific username/password fields.

Fixes

  • Fixed pool-assigned services being rejected or registered against the wrong cluster when their logical media cluster differed from the physical node cluster.
  • Fixed runtime service-cluster assignment upserts lacking provenance.
  • Fixed self-hosting assignment writes to use runtime provenance and preserve source on conflict.
  • Fixed Privateer cert sync filtering too aggressively against registered node services.
  • Fixed Privateer cert sync stopping the whole sync on a single service certificate denial.
  • Fixed Foghorn Redis Sentinel auth missing sentinel credentials in generated env.

Build / infra

  • Added Quartermaster tests for pool-assigned bootstrap across physical and logical clusters.
  • Added Quartermaster tests for runtime assignment provenance and source preservation.
  • Added Privateer cert sync tests for expected/registered service union, per-service failure isolation, registered-service failure handling, local write failure handling, and registry fallback.
  • Added provisioner coverage for Foghorn Redis Sentinel password generation.
Assets 114
Loading