Skip to content

v1.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Oct 12:06
· 130 commits to master since this release
v1.3.0
832ef72

Changes

  • Node logs (node-logs-v1, proto v1.3.0). The node sends its own warnings, errors and a fixed set of events (agent start, configuration applied, last-known-good in use, OpenResty start, certificate renewal, node channel switch, upgrade finished) to the console with ReportNodeLogs. OpenResty's error output is parsed from its pipe by the process that runs it; under supervise the supervisor buffers it and the agent fetches it over the supervisor socket, so entries survive an agent restart, crash or failed upgrade trial. Entries are redacted on the node, limited to 3 per message and window (then folded into one "×N" entry), and kept in nodelogs-spool.json (at most 5,000) while the console is unreachable.
  • When an origin is marked down after repeated failures, including a failed DNS lookup, Lua logs one warning per outage with the reason.
  • Origin protection (origin-mtls-v1, origin-ca-v1). Origin pools can present the cluster's client certificate issued by the console to HTTP/1.1, HTTP/2 and gRPC origins and in active health checks (never to S3 origins); the key is fetched over the node channel and stored 0600. Pools can trust only the console's Origin CA, with its CRL checked on every handshake; a revocation takes effect with the next config revision. The client certificate is part of the upstream connection-pool key, so a request without one never reuses an authenticated connection.
  • nginx no longer warns on every start and reload: the variables hash is sized for the $edgeweir_* names, and text/html and repeated types are left out of gzip_types, brotli_types and zstd_types.

With an older console nothing changes: it sends no origin certificates and does not ask for logs. After a remote upgrade, a supervisor still running the previous version sends only the agent's entries until the node service is restarted (systemctl restart edgeweir-node).

Upgrade: use the console's node upgrade, or the install command with --version 1.3.0.

Changelog

  • 832ef72 build(proto): generate from proto/v1.3.0
  • afd9eea feat(agent): install origin client certificates and present them in health checks
  • ee86b70 feat(agent): report the node's own warnings, errors and events to the console
  • f99484f feat(configir): origin client certificates, Origin CA trust and its CRL in the plan and content hash
  • f1baa42 feat(lua): warn once per outage when an origin is marked down
  • c857a1d feat(proto): regenerate for ReportNodeLogs
  • 27b8b16 feat(proto): regenerate for origin client certificates and Origin CA trust
  • 7586a18 feat(render): origin mTLS and Origin CA trust with revocation per origin pool
  • 63cd044 fix(render): no nginx warnings on start and reload

Verify

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/marvinli001/edgeweir-node/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt
sha256sum --ignore-missing -c checksums.txt
gh attestation verify <artifact> --repo marvinli001/edgeweir-node
Assets 26
Loading