Skip to content

v1.0.6-rc1 — HA foundation complete

Pre-release
Pre-release

Choose a tag to compare

View all tags
@gurkin33 gurkin33 released this 04 Jul 08:26
· 1 commit to main since this release
v1.0.6-rc1
d938fc6

The HA foundation is feature-complete. Pre-release; gate 1567 passed / 0 failed.

New in 1.0.6 (on top of 1.0.5-rc2):

  • etcd client-TLS (one-way, opt-in ETCD_CLIENT_SCHEME=https, default off/http byte-identical): Patroni↔etcd encrypted + server-verified against a shared CA. Provisioned via a new unified OOB 'cluster secret set' (ha-etcd-ca.sh + ha-convert/ha-join --client-tls); CA private key stays on the seed, never distributed. Validated: dcs-spike 25/25, tier2 12/12 over https-client through a SIGKILL crash.
  • Shared mfa enckey (#13): taranac-mfa Push tokens now decrypt on ANY node (provisioned via the same secret set; DMZ-standalone still self-generates, D4-safe).
  • Per-node alert scoping (#22): a healthy peer no longer resolves a sick node's daemon alert (no more flap); email:delivery reconcile is leader-only (#23).

Carried from 1.0.5-rc2: PatroniClient host fix (#18), edge self-heal + boot_migrate resilience (#19), etcd peer-TLS opt-in (#20), node attribution (#9), Telegram-any-node (#10), HA observability (#11).

Docs: ha.md §7.3 (client-TLS + rolling migration), §12 (secret set). Images: ghcr.io/taranaclabs/taranac/*:1.0.6-rc1

Assets 5
Loading