Skip to content

v0.21.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Jul 16:43
· 61 commits to main since this release
v0.21.0
5a9ecd1

This release introduces compute egress capabilities, a new sandbox runtime for worker isolation, a redesigned console UI with enhanced resource management, and significant improvements to the tunnel infrastructure including graceful relay draining and VPC networking enhancements.

Features

  • Compute Worker Egress: Complete egress data and control plane implementation for compute Services with DNS resolution, SSRF filtering, and per-tenant isolation (c169a5f, 18197e0, fb8efff, b88f038, 407407a, 67fbc11, 969ea86)
  • EgressGateway and EgressRoute APIs: New API resources for configuring compute worker egress policies (c169a5f)
  • Compute Service Runtime: Add complete compute Service runtime with residents, manager, and per-tenant isolation (3a03377, a4b4deb, 54e4ec4)
  • gVisor Sandbox Runtime: New workerd-host with gVisor sandbox isolation for compute workers (8ee02a2, 1e24151, a8f9350, ae95f78)
  • SecretStore API: New SecretStore resource with secret bindings for compute Services (d0e55c6, 582d324)
  • CLI Build and Deploy Commands: Add build, bundle push, and deploy capabilities for compute Services (2c43eec, ee5574f)
  • Zero-Config Deploy: Bootstrap, status UI, target confirmation, and platform registry for streamlined deployments (a0aec0c)
  • CLI Service Management Commands: Add egress, service, and servicerevision commands with label selector support (3d81a1c)
  • Service Versions Command: New apoxy service versions [name] command with positional Service argument (5a9ecd1)
  • VPC Networking Enhancements: VPCService spec.hostname published as <hostname>.<network>.vpc zone (8581ee5)
  • Kernel TUN Agent Mode: Tunnel agent support with relay transit routes for backplane VTEP (042cad7)
  • VPC API Group: New vpc.apoxy.dev/v1alpha1 API group (9c4975f)
  • Compute API Group: New compute.apoxy.dev/v1alpha1 API group with Service, ServiceRevision, and Build resources (ce96a13)
  • DomainRecord Lifecycle Management: Add DomainRecord Phase field and shared ownership contract (054017c)
  • HTTP-Only Domain Support: Add DomainTLSSpec.Disabled for HTTP-only reference targets (23b8b67)
  • Dynamic Go Plugin Configuration: Support for dynamic Go plugin configuration (b038bd4)
  • Console UI Redesign: Complete redesign with YAML editor, command palette, keyboard navigation, miller-column browser, and schema-driven resource management (73538ac, b222846, c834781, 6de6a13, 12ab64c, 3a03377)
  • Console Analytics: Add PostHog product analytics to console-core (0758df9)
  • TLS Certificate Hot-Reload: Shared pkg/cert/reload for hot-reloading TLS server certificates (c6bd2bb, f5bf67a)

Bug Fixes

  • Tunnel Connection Deadlock: Fix connection-slot deadlock on single-relay drain (97bd686)
  • Tunnel Memory Leak: Reap idle/half-open proxied connections to stop tunnel memory leak (24c887a)
  • Connection Flow Accounting: Fix conntrack flow accounting and idle-expiry for drain early-exit (b41b278)
  • Bifurcate Data Race: Fix data race delivering nil/corrupt frames from reused batch slice (2306617)
  • Batch Write Loop: Loop on partial WriteBatch so short sendmmsg can't drop the tail (dfe7e50)
  • Install Script: Resolve latest release dynamically and fix amd64 arch mapping (614df7b)
  • VPC Netns MAC Resolution: Bump icx for pod-netns MAC resolution fix (166ea6a)
  • Console Chart Issues: Fix chart crosshair drift, tooltip occlusion/alignment, and rendering issues (dfc03cd, 9b05d62, 5bd8b74)
  • DNAT Rule Sync: Call AllowedRoutes() accessor in DNAT rule sync (2438d87)
  • Logtail Fallocate: Isolate logtail fallocate behind Linux build-tagged helpers (8380b55)

Improvements

  • Graceful Relay Drain: Implement GOAWAY + lame duck mode with agent make-before-break (b3792cd)
  • Tunnel Architecture Overhaul (APO-825): Multi-phase tunnel infrastructure rewrite with dual-stack relay datapath, ipalloc block-lease, relay registrar, and storage migration (257e3b6, 41eec1c, 4256712, 9bb3fbd, fab4359, d178767)
  • Split Relay Connection Policy: Consumer connect-all, agent probing for improved reliability (ff27f8e)
  • VPCService Status Handling: Split VPCService Reconciled/Ready states and reject unusable specs (2ebe9ec)
  • Agent Discovery: Agent discovery via CLI config with kubeconfig as fallback (f46edb6)
  • Connection Diversity: Same-server connection diversity for multi-connection agents (6f41b4a)
  • xDS Snapshot Optimization: Skip xDS snapshot pushes and log dumps when resources are unchanged (3752e13, 965997c)
  • Relay/Agent Keying: Harden relay/agent keying against zero-master and stalled installs, use per-connection master secrets (3635989, 507407a)
  • Authenticated Source Learning: Bump icx to v0.19.0 with authenticated source learning (e6cc7c3)
  • Egress RST at SYN: RST denied egress at SYN before any netstack endpoint allocation (fb8efff)
  • OCI Digest Validation: Reject malformed OCI digests at admission (acf882c)
  • Log Noise Reduction: Demote per-event resolution and diagnostic logs to Debug level (f5c2c20, 4c986f2)
  • Gateway Upstream Support: Forward-port dynamic forward proxy h2/h2c upstream support with auto_sni (d2e74a1)
  • Gateway Cluster Defaults: Default cluster idle timeout to 60s with idempotent-only retry on reset (bb5d60f)
  • APIService Proxy Caching: Cache aggregator discovery responses in APIService proxy (e4d7dc7)
  • Certificate Auto-Renewal: Auto-renew apiz-cert via mTLS to cosmos with fsnotify hot-reload (f5bf67a, 2bbfac7)

Infrastructure

  • License Change: Relicense apoxy-cli to AGPL-3.0 while keeping api/ and client/ as Apache-2.0 (0d57bd4)
  • Image Publishing: Publish images to apoxy-dev public GAR instead of Docker Hub (d47ab81)
  • Daggerized Console Build: Daggerize console build, test, and codegen-drift checks (517f5e4, 3bd714c)
  • CI Improvements: Add console checks to PR workflow, guard against codegen drift, and improve edge-runtime builds (307afc5, 73538ac, f00fc77)
  • Release Notes Automation: Rewrite changelog publisher as Dagger LLM module and commit to docs2 (bb5d60f, f5bf67a)
  • Dependencies: Bump icx, clickhouse-go, gvisor, and other dependencies to latest versions (166ea6a, e6cc7c3, 3ea5a0c, f00fc77)
Assets 13
Loading