v0.7.0
馃帀 Acorn v0.7.0 is available with many new features and improvements! 馃帀
New Features
Services and nested acorns - Service acorns open up a world of external cloud integrations to your applications. Nested acorns let's you build acorns of acorns, which is incredibly complex micro-service based applications. Check out our blog for demos and examples.
Security Enhancements - We've implemented project-level network isolation, which is on by default. We've also introduced alpha support for image signature policies, which we're calling ImageAllowRules. These features help you secure your software pipeline as well as your runtime.
Development and Debugging Enhancements - We've introduced the acorn dev and acorn port-forward commands. We've revamped the acorn run and update commands to be more intuitive and consistent. We've also introduced acorn events to surface useful information about what is happening with your applications. Try them out in the cli!
Known Issues and Considerations
Attention: With this release, the domain used to create endpoints when you launch an acorn app is changing from alpha.on-acorn.io to oss-acorn.io. Additionally, alpha.on-acorn.io endpoints will be retired in the near future.
The --default-publish-mode installation flag has been removed.
There are a few known issues related to service acorns and nested acorns. Of note, locally built images do not work as service or nested acorns. You must first publish the image to a remote registry such as ghcr.io or Docker Hub.
What's Changed
- Add docs for v0.6 by @thedadams in obot-platform/obot#1295
- Tell goreleaser to use correct tag by @thedadams in obot-platform/obot#1306
- Add controlplane taints and node selector to acorn system components (#1231) by @StrongMonkey in obot-platform/obot#1230
- Remove linkerd containers from acorn logs output by @g-linville in obot-platform/obot#1281
- ensure service-accounts are applied before deployments by @jsilverio22 in obot-platform/obot#1315
- add workflow for promoting to prod by @jsilverio22 in obot-platform/obot#1322
- Change to HTTP readiness probe for build-server (#1323) by @thedadams in obot-platform/obot#1324
- Ensure ComputeClasses and Apps created for ComputeClass tests are deleted before next test by @tylerslaton in obot-platform/obot#1312
- Add two approval requirement to PR template checklist by @g-linville in obot-platform/obot#1318
- add check to project default to ensure it exists (#1335) by @jsilverio22 in obot-platform/obot#1336
- Add fmt by @ibuildthecloud in obot-platform/obot#1338
- Create network policies to block cross-project traffic (#456) by @g-linville in obot-platform/obot#1330
- add check for project agnostic cmd for default project validation (#1335) by @jsilverio22 in obot-platform/obot#1342
- Revert default project validation (#1335) by @jsilverio22 in obot-platform/obot#1343
- Revert networkpolicies by @g-linville in obot-platform/obot#1345
- Create allow-all-ingress NetPol for each app and clean up all other NetPols created by Acorn by @g-linville in obot-platform/obot#1348
- Lay foundation for nested acorns and first class services by @ibuildthecloud in obot-platform/obot#1290
- Fix panic when no ports are set by @ibuildthecloud in obot-platform/obot#1349
- Handle unset port in http expose/publish by @ibuildthecloud in obot-platform/obot#1350
- Improve nightly test visibility on failures by @tylerslaton in obot-platform/obot#1346
- Aggregate all validation needed into "make validate" by @tylerslaton in obot-platform/obot#1271
- Print username on successful login attempt by @njhale in obot-platform/obot#1351
- Fix port publishing bugs from refactor by @ibuildthecloud in obot-platform/obot#1354
- update renovate config to add labels and add renovate.json validator by @jacobdonenfeld in obot-platform/obot#1333
- Fix VolumceClass GVK reported by clients (#1355) by @thedadams in obot-platform/obot#1356
- Add missing toleration for router deployments by @StrongMonkey in obot-platform/obot#1316
- add faq on increasing dockerhub rate limits (#1334) by @jsilverio22 in obot-platform/obot#1337
- Don't expose ports in test by @ibuildthecloud in obot-platform/obot#1361
- Add back build profiles by @ibuildthecloud in obot-platform/obot#1365
- Cache golang setup and change fetch depth to speed up CI by @jacobdonenfeld in obot-platform/obot#1321
- Fix publishing builders by @ibuildthecloud in obot-platform/obot#1368
- Dont use local.on-acorn.io when acorn-dns disabled (#1370) by @cjellick in obot-platform/obot#1371
- Fix sidecar container exec (#1216) by @rmodpur in obot-platform/obot#1317
- Add ability to interpolate any file content or env value by @ibuildthecloud in obot-platform/obot#1373
- Add comments explaining the need for defaults.Calculate and scheduling.Calculate by @tylerslaton in obot-platform/obot#1374
- Rewrite secret lookup logic by @ibuildthecloud in obot-platform/obot#1378
- Add json/yaml output support for volume classes (#1339) by @thedadams in obot-platform/obot#1382
- Add region to project spec by @thedadams in obot-platform/obot#1314
- Add back support for app.image and app.namespace by @ibuildthecloud in obot-platform/obot#1385
- Create containing dirs for EKS test artifacts to live in by @tylerslaton in obot-platform/obot#1360
- Decrypt secrets from external secret references by @ibuildthecloud in obot-platform/obot#1386
- Add ability to lookup service info in interpolation by @ibuildthecloud in obot-platform/obot#1387
- Upgrade to go 1.20 by @ibuildthecloud in obot-platform/obot#1376
- Ensure list types are correct for all public objects (#1383) by @thedadams in obot-platform/obot#1384
- Ensure calculated default set on project (#1388) by @thedadams in obot-platform/obot#1389
- Upgrade gomock by @cjellick in obot-platform/obot#1391
- If cert-manager annotations are set always use that tls by @ibuildthecloud in obot-platform/obot#1393
- Add goimports to lint check by @cjellick in obot-platform/obot#1395
- Replacing docker images with ghcr images (#1022) by @yashgiri in obot-platform/obot#1390
- disable cache for setup go action by @jacobdonenfeld in obot-platform/obot#1404
- Redesign NetworkPolicies (#456) by @g-linville in obot-platform/obot#1352
- add imageallowrules to require annotated image signatures (#502) by @iwilltry42 in obot-platform/obot#1240
- Address erroneous kinds (#1383) by @thedadams in obot-platform/obot#1406
- Redesign Region API and add regioned objects by @thedadams in obot-platform/obot#1405
- Enforce linting of leading and trailing whitespace in blocks by @thedadams in obot-platform/obot#1407
- change: rename ImageAllowRules to singular to avoid issues with pluralization in Kubernetes by @iwilltry42 in obot-platform/obot#1413
- add volume aliases (#1227) by @jacobdonenfeld in obot-platform/obot#1359
- Display correct field for volume class on volume (#1418) by @thedadams in obot-platform/obot#1419
- Add --service-lb-annotation flag to install command by @tylerslaton in obot-platform/obot#1417
- fix: signature verification registry authentication and rate limits (#1412 & #1414) by @iwilltry42 in obot-platform/obot#1416
- NetworkPolicies: Handle case where an Ingress routes to an ExternalName Service (#456) by @g-linville in obot-platform/obot#1408
- refactor cli/run_test.go to use gomock by @jacobdonenfeld in obot-platform/obot#1422
- Ensure app services are cleaned up after app is deleted (#1423) by @thedadams in obot-platform/obot#1424
- Get volume class information from bound existing volume (#1420) by @thedadams in obot-platform/obot#1421
- fix: make sure that ingress-check resources get deleted (#1430) by @iwilltry42 in obot-platform/obot#1431
- Disable NetworkPolicies for the nightly EKS test by @g-linville in obot-platform/obot#1432
- add project validation to project client (#1335) by @jsilverio22 in obot-platform/obot#1344
- Remove project placements by @thedadams in obot-platform/obot#1415
- Update alpine image that wasn't using the mirror by @tylerslaton in obot-platform/obot#1438
- Ensure default volume class region is validated (#1435) by @thedadams in obot-platform/obot#1437
- Fix faulty merging and update tests for Config by @tylerslaton in obot-platform/obot#1436
- add acorn dev and refactor acorn run/update (#1059) by @jsilverio22 in obot-platform/obot#1369
- fix: custom Digest() func to error out on HEAD 404 (#1414) by @iwilltry42 in obot-platform/obot#1441
- Add the volume class name to the invalid error message (#1435) by @thedadams in obot-platform/obot#1442
- fix faq to allow docker credentials to be used for acorn cmds (#1334) by @jsilverio22 in obot-platform/obot#1429
- Fix typo in regions implementation by @thedadams in obot-platform/obot#1447
- fix: enable referencing images by repo digest/SHA256 (#1320) by @iwilltry42 in obot-platform/obot#1327
- fix: match transport error to catch 404 on HEAD to get digests (#1414) by @iwilltry42 in obot-platform/obot#1449
- change: add appnamespace label to LE challenge resources (#1434) by @iwilltry42 in obot-platform/obot#1440
- fix acorn run --update behavior to allow --name flag (#1444 #1457) by @jsilverio22 in obot-platform/obot#1445
- Handle issues when stdin is closed on exec start by @ibuildthecloud in obot-platform/obot#1453
- Changes to prevent pull every upgrade interval for private images (#1398) by @yashgiri in obot-platform/obot#1433
- First class services by @ibuildthecloud in obot-platform/obot#1463
- fix: default to :latest for non-SHA-like image inputs (#1450) by @iwilltry42 in obot-platform/obot#1452
- Ensure app is removed before deleting other objects by @thedadams in obot-platform/obot#1461
- change: also check imageAllowRules for auto-upgrade without pattern (#1428) by @iwilltry42 in obot-platform/obot#1451
- fix autoupgrade acorns from losing autoupgrade image format on updates (#1456) by @jsilverio22 in obot-platform/obot#1462
- Add check to make sure NetPols are for real Acorn apps by @g-linville in obot-platform/obot#1471
- add regions to project output (#1460) by @jsilverio22 in obot-platform/obot#1465
- Fix permissions openapi schema by @ibuildthecloud in obot-platform/obot#1481
- Handle edge-cases around auto-upgrade patterns (#1377) by @thedadams in obot-platform/obot#1480
- fix: only consider current image when checking appinstance against imageAllowRules (#1428) by @iwilltry42 in obot-platform/obot#1476
- Fix missing digest on @{app.image} by @ibuildthecloud in obot-platform/obot#1483
- Refactor acornfile and image handling by @ibuildthecloud in obot-platform/obot#1484
- Add regions to offerings CLI output by @thedadams in obot-platform/obot#1477
- fix: leftover trimPrefix on digest was breaking imageAllowRules check (#1482) by @iwilltry42 in obot-platform/obot#1485
- Only add default toleration when it is empty by @StrongMonkey in obot-platform/obot#1489
- Support old clusterRules syntax in aml and k8s yaml by @ibuildthecloud in obot-platform/obot#1495
- remove nightly staging upgrade by @jsilverio22 in obot-platform/obot#1494
- Prefer remote digest for autoupgrade by @cjellick in obot-platform/obot#1492
- Create local image records for images used by acorns by @ibuildthecloud in obot-platform/obot#1491
- Fix service image reference by @ibuildthecloud in obot-platform/obot#1500
- Add functionality to observe changes in ImageDigests by @tylerslaton in obot-platform/obot#1498
- Move NetworkPolicy handlers to their own package by @g-linville in obot-platform/obot#1501
- Update go.mod to 1.20 by @tylerslaton in obot-platform/obot#1497
- Add back appImage.ID field by @ibuildthecloud in obot-platform/obot#1505
- refactor go routine for project region output (#1479) by @jsilverio22 in obot-platform/obot#1506
- Temporarily blank app image name if id is blank by @thedadams in obot-platform/obot#1507
- Revert "Temporarily blank app image name if id is blank" by @thedadams in obot-platform/obot#1508
- refactor acorn project routine (#1479) by @jsilverio22 in obot-platform/obot#1509
- Change app validation to use apiv1 types by @thedadams in obot-platform/obot#1510
- Remove a space for uniformity by @thedadams in obot-platform/obot#1516
- Add ability to manage AWS IAM permissions by @ibuildthecloud in obot-platform/obot#1515
- Add controller-service-account-annotation to installation by @ibuildthecloud in obot-platform/obot#1519
- Add HasRegion methods to all EnsureRegion objects by @thedadams in obot-platform/obot#1521
- Must use StringEquals for exact matches by @ibuildthecloud in obot-platform/obot#1520
- Ensure we return all permissions needed, not just the missing ones by @ibuildthecloud in obot-platform/obot#1522
- Make the api App object a region getter by @thedadams in obot-platform/obot#1523
- Update aml by @ibuildthecloud in obot-platform/obot#1524
- Fix goreleaser version to v1.15.2 by @thedadams in obot-platform/obot#1525
- Use Go's built-in DNS resolver to avoid DNS issues when building Acorns by @g-linville in obot-platform/obot#1518
- Revert "Use Go's built-in DNS resolver to avoid DNS issues when building Acorns" by @cjellick in obot-platform/obot#1526
- Fix typos by @jacobdonenfeld in obot-platform/obot#1528
- fix: handling untagged images when tagging and removing (#1511 + #1512) by @iwilltry42 in obot-platform/obot#1513
- Linked services: add label to resulting ExternalName Service by @g-linville in obot-platform/obot#1529
- Prevent users from logging in to 'gchr.io' (#1375) by @g-linville in obot-platform/obot#1530
- Goreleaser: use separate tags field for netgo by @g-linville in obot-platform/obot#1527
- Update mink to latest by @g-linville in obot-platform/obot#1537
- create and update a projects default and supported regions (#1478) by @jsilverio22 in obot-platform/obot#1488
- Move region to spec of container replicas and volumes by @thedadams in obot-platform/obot#1539
- Add -tags netgo to Makefile build target by @g-linville in obot-platform/obot#1543
- fix TestProjectUpdate on eks (#1478) by @jsilverio22 in obot-platform/obot#1544
- Revert "remove nightly staging upgraded" by @jsilverio22 in obot-platform/obot#1547
- add watch client to TestProjectUpdate for eks by @jsilverio22 in obot-platform/obot#1552
- retry for eks test by @jsilverio22 in obot-platform/obot#1553
- remove project validation checks from client (#1212 #1069) by @jsilverio22 in obot-platform/obot#1558
- make compute class errors more user friendly (#1291) by @jsilverio22 in obot-platform/obot#1565
- Service fixes by @ibuildthecloud in obot-platform/obot#1541
- Refactor info to support multiple regions by @thedadams in obot-platform/obot#1567
- Print extra data field in info by @thedadams in obot-platform/obot#1570
- simplify acorn run --help and add --help-advanced (#1358) by @jsilverio22 in obot-platform/obot#1455
- Change container name to match app public name by @ibuildthecloud in obot-platform/obot#1572
- Add acorn port-forward by @ibuildthecloud in obot-platform/obot#1574
- Block EC2 metadata access for all apps by @g-linville in obot-platform/obot#1568
- Create NetworkPolicies for builders by @g-linville in obot-platform/obot#1554
- Add missing endpoints permission for the acorn controller by @ibuildthecloud in obot-platform/obot#1576
- Initial work for hub on hub feature set by @ibuildthecloud in obot-platform/obot#1582
- Fix app and project region validation (#1542) by @thedadams in obot-platform/obot#1581
- Adding acorn version as command (#1569) by @imrajdas in obot-platform/obot#1591
- Determine app readiness based on deployment spec.Replicas rather than status.Replicas by @g-linville in obot-platform/obot#1589
- change: restructure and re-use image finding logic to make image rm output more concise (#1556 & #1551) by @iwilltry42 in obot-platform/obot#1593
- Disallow removing a supported region if a volume exists in that region by @thedadams in obot-platform/obot#1606
- Drop arm32v7 support by @cjellick in obot-platform/obot#1611
- Don't run validate-docs workflow all the time by @cjellick in obot-platform/obot#1613
- Block login to ghrc by @cjellick in obot-platform/obot#1560
- Add test summaries for test runs by @tylerslaton in obot-platform/obot#1612
- Make app.namespace point to app.Status.Namespace by @ibuildthecloud in obot-platform/obot#1620
- chore: update defaults to use oss-dns.acrn.io and .oss-acorn.io domains by @drpebcak in obot-platform/obot#1619
- Add basic
acorn eventssubcommand (#1562) by @njhale in obot-platform/obot#1604 - Only build test summary when tests run by @tylerslaton in obot-platform/obot#1624
- fix: reprovision wildcard certificates on cluster domain change (#1625) by @iwilltry42 in obot-platform/obot#1626
- Add quota management system by @tylerslaton in obot-platform/obot#1566
- Add job events by @ibuildthecloud in obot-platform/obot#1637
- Make public name labels safe for k8s by @g-linville in obot-platform/obot#1644
- Update README.md: change copyright date to 2023 by @sheng-liang in obot-platform/obot#1648
- Stop checking status for jobs that won't run (#1646) by @thedadams in obot-platform/obot#1647
- Disable nightly staging upgrade by @cjellick in obot-platform/obot#1650
- Add events to view role by @njhale in obot-platform/obot#1651
- Ensure create jobs are only run once (#1642) by @thedadams in obot-platform/obot#1654
- Add dev ports and app locking by @ibuildthecloud in obot-platform/obot#1614
- Check permission on devsession update by @ibuildthecloud in obot-platform/obot#1659
- Make service default a bit more explicit by @ibuildthecloud in obot-platform/obot#1660
- Revert "Make service default a bit more explicit" by @thedadams in obot-platform/obot#1661
- Get Project before modifying it in Quota test by @tylerslaton in obot-platform/obot#1641
- Deterministically set default service base on acornfile definition by @ibuildthecloud in obot-platform/obot#1663
- Fix volume binding name bug (#1561) by @g-linville in obot-platform/obot#1615
- Enable nightly staging upgrade by @cjellick in obot-platform/obot#1667
- Refactor App Status by @ibuildthecloud in obot-platform/obot#1668
- Fix job depends out of order by @ibuildthecloud in obot-platform/obot#1669
- Add missing space in messages by @ibuildthecloud in obot-platform/obot#1670
- change: appname must be DNS-1035 compliant (no leading numeric char) (#1590) by @iwilltry42 in obot-platform/obot#1671
- Fix nightly EKS failures by @tylerslaton in obot-platform/obot#1674
- Fix nightly EKS tests and up test-summary action's version by @tylerslaton in obot-platform/obot#1676
- Add remotes to VCS info (#1622) by @njhale in obot-platform/obot#1640
- fix: retrieve logs for sidecars (: notation in cli) (#1597) by @iwilltry42 in obot-platform/obot#1673
- Prioritize remote images for auto-upgrade (#1496) by @g-linville in obot-platform/obot#1653
- change: feature flags for image-allow-rules + secure-by-default policy (#1549) by @iwilltry42 in obot-platform/obot#1571
- Explicitly callout dev profiles being used in dev mode by @tylerslaton in obot-platform/obot#1486
- Change behavior of update jobs and add stop jobs (#1656) by @thedadams in obot-platform/obot#1664
- Stop using public names for Acorn Volumes (#1561) by @g-linville in obot-platform/obot#1677
- Determine container port uniqueness based on targetPort rather than port (#1402) by @g-linville in obot-platform/obot#1681
- Debug logs for hub client by @cjellick in obot-platform/obot#1686
- Fixes for app status reporting (#1675) by @thedadams in obot-platform/obot#1680
- Bump ggcr to v0.15.2 by @njhale in obot-platform/obot#1580
- fix: make IARs without signature rules work again (#1678) by @iwilltry42 in obot-platform/obot#1683
- Fix collectPorts by detecting duplicate ports and targetPorts (#1402) by @g-linville in obot-platform/obot#1685
- Allow stop job events (#1688) by @thedadams in obot-platform/obot#1699
- Reset statuses to ensure dependencies are handled correctly (#1657) by @thedadams in obot-platform/obot#1696
- Initial docs for services by @cloudnautique in obot-platform/obot#1602
- Give event timestamps microsecond precision (#1694) by @njhale in obot-platform/obot#1701
- Downgrade ggcr to prevent regression in downstream acorn dependents by @njhale in obot-platform/obot#1702
- Disable pruning for endpoints on the rendering handler for ServiceInstances by @g-linville in obot-platform/obot#1700
- fix: use remote images by short ID (#1563) by @iwilltry42 in obot-platform/obot#1682
- fix: ImageAllowRules to allow images by ID or build (#1684) by @iwilltry42 in obot-platform/obot#1692
- Revert "fix: resolvelocal should always return full ID if image is found (#1682)" by @cjellick in obot-platform/obot#1705
- Fix event table timestamp formatting and name generation (#1694) by @njhale in obot-platform/obot#1703
- Correctly report status for Acorn services that don't have k8s services (#1689) by @thedadams in obot-platform/obot#1697
- Clean up output of help messages for acorn run and update commands (#1358) by @g-linville in obot-platform/obot#1687
- Properly set auto-upgrade config for nested Acorns (#1598) by @g-linville in obot-platform/obot#1723
- Bump baaah dependency for alternate no-prune strategy by @thedadams in obot-platform/obot#1722
- Return a more useful error if the user tries to update a dependent acorn (#1710) by @g-linville in obot-platform/obot#1711
- Stop processing tags on app creation (#1502) by @thedadams in obot-platform/obot#1714
- Don't record "null" AppSpecUpdate events by @njhale in obot-platform/obot#1727
- Create separate UpdateArgs struct in order to remove --name from the update command by @g-linville in obot-platform/obot#1716
- Add TTL for Events (#1708) by @njhale in obot-platform/obot#1719
- Add name validation to acorn update --pull to block nested acorns by @g-linville in obot-platform/obot#1725
- Support auto-upgrade patterns in nested acorns by @g-linville in obot-platform/obot#1729
- Add a unit test for nested acorn by @g-linville in obot-platform/obot#1724
- fix: resolvelocal should always return full ID if image is found (#1563) by @iwilltry42 in obot-platform/obot#1718
- Ensure that a built image is properly marked as not remote (#1662) by @thedadams in obot-platform/obot#1721
- fix/regression: use user-defined ingressclassname during pre-install checks (#1665) by @iwilltry42 in obot-platform/obot#1730
- Don't process app image unless image digest changes (#1502) by @thedadams in obot-platform/obot#1732
- add: basic docs on alpha feature imageallowrules by @iwilltry42 in obot-platform/obot#1737
- Generate 0.7.0 docs by @njhale in obot-platform/obot#1734
New Contributors
- @njhale made their first contribution in obot-platform/obot#1351
- @rmodpur made their first contribution in obot-platform/obot#1317
- @yashgiri made their first contribution in obot-platform/obot#1390
- @imrajdas made their first contribution in obot-platform/obot#1591
- @drpebcak made their first contribution in obot-platform/obot#1619
Full Changelog: obot-platform/obot@v0.6.0...v0.7.0