This release focuses on major tunnel architecture improvements for multi-relay safety and performance, alongside CLI reorganization and compute infrastructure enhancements.
Features
- CLI reorganization: Regrouped egress under vpc and service under compute with improved table printing (a81bd67)
- Slot-based overlay allocation: Implemented slot-based overlay allocation for multi-relay safety (f523635, 225d460, 41ee65d)
- Live relay latency reporting: Report live relay latency from QUIC RTT and export path metrics (90315ec)
- Load shedding: Added WithMaxRequestsInFlight load-shedding option to apiserver (af472a3)
- HTTPS fetch support: Give globalOutbound tlsOptions so https:// fetch() works in workerd (73d473b)
- Bundle tag resolution: Resolve bundle tags in the control plane (7212d31)
Bug Fixes
- Tunnel stability: Stop aborted connects from bricking overlay prefixes (958e317)
- Envoy supervisor: Stop the envoy supervisor from spinning after context cancellation (512cf36)
- IPv6 overlay addresses: Skip DAD on overlay v6 addrs and drop addrs that fail to install (dddaf6f)
- Registry credential security: Never send the registry credential to a redirect target (1147cb8)
- Tenant catalog refresh: Refresh the whole tenant catalog under one resident queue key (86c22ab)
- Service refresh: Refresh the resident demux on Service changes (60f8d13)
Improvements
- Tunnel performance: Batch the kernel-TUN datapath and stop disabling offloads (a2c807d)
- Relay allocation: Lease slots outside the allocator mutex with per-network singleflight (9108e91)
- IPv4 pool management: Share IPv4 slice pool across a relay's publishers and allocate from relay-wide pool (4473558, a5d053a)
- Relay probing: Probe all relays to completion when ranking (9ba684f)
- Run status display: Order run status table by latency and restyle with brand palette (696da13, 63e27c3)
- Tunnel run UX: Improve alpha tunnel run UX and don't bind health endpoint by default in interactive runs (fadaf7c, ef4df8e)
- CLI text formatting: Drop em-dashes from user-facing help text (7ad2ca2)
- Domain resolution: Resolve bare FQDNs in domain get/delete commands (1966ee0)
- Logging: Log DNAT resyncs only when the destination set changes (58970f7)
- Mux semantics: Make mux Add replace-semantics with owner-checked removal (12b1b1e)
- Relay connection teardown: Make relay connection teardown identity-aware (4abfb71)
- VNI allocation: Randomize relay VNI allocation base (c50a4c6)
Infrastructure
- Workerd configuration: Use typed config and remove legacy host (20e0812)
- Config schema: Replace config schema generator (14354b8)
- Metadata generation: Opt into metadata.generation per resource (c0a7eab)
- Field manager: Leave spec.source.oci.digest to the deploy field manager (efc2bf0)
- Profiling cleanup: Remove automatic CPU profiling (b579411)