v1.11.0

What's Changed

Kubernetes (EKS)

• Multinode EKS control plane: run the control plane across several hosts instead of one
• Highly available control plane self-heals — automatic recovery and continuous reconciliation after node loss
• Hardened control-plane auth with corrected IMDS and token-webhook credential flows

Networking

• Multinode software-defined networking via OVN with clustered OVSDB RAFT
• Routed-NAT external mode with two-tier ingress for cleaner north-south traffic
• vpcd auto-reconnects to the OVN northbound database after a restart, so control keeps flowing
• Networking recovers itself from a wedged OVN control node instead of stalling
• More reliable multinode bring-up and stable security-group rule reconciliation

Compute

• EC2 Spot Instances are now available
• Create AMIs from volume snapshots and boot new instances directly from them
• CreateVolume honors the requested Iops on gp3 volumes, with a clearer error for unknown volume types
• Five EC2 actions relax over-strict required parameters to match AWS, and KeyName is no longer mandatory

Identity (IAM / STS / IMDS)

• IAM Groups: create and delete groups, and add or remove members
• Attach managed policies and define inline policies on groups, with members inheriting group permissions
• Inline policies on IAM users
• Instance-role credentials delivered over IMDS to load-balancer agents and EKS server VMs
• S3 requests honor IAM user inline policies and group-inherited permissions

Resource Tagging

• Full EC2 tagging — create-tags, delete-tags, and describe-tags across instances, volumes, snapshots, AMIs, key pairs, VPCs, gateways, route tables, EIPs, and placement groups
• Tag resources at creation with --tag-specifications, and filter describe calls by tag:<key>
• IAM tagging for users, roles, policies, instance profiles, and OIDC providers, plus tag reads on load balancers, target groups, and listeners

Containers (ECS)

• Rolling ECS deployments for zero-downtime task updates
• Task-definition validation catches bad definitions before they run
• Execution-role support and a container logging signal
• StopTask reaps the container before releasing capacity, so slots free cleanly

Load Balancing (ELBv2)

• NLBs accept and enforce customer-supplied security groups
• Load-balancer failures surface a human-readable reason in State.Reason

Security

• EKS add-on sync uses instance-role credentials via IMDS instead of baked-in credentials
• At-rest volume encryption no longer hits AEAD failures under concurrent access, with the AEAD cipher pinned
• S3 SigV4 signatures over keys containing = now verify correctly

Observability

• Full-stack telemetry across the platform: distributed tracing, metrics, and structured logs
• Per-VM guest metrics for visibility into individual instances
• Sampling and trace context are tunable via environment for locally-rooted traces

Reliability

• VM restart hardening for cleaner recovery after host or service restarts
• Fixed a chunk-uploader goroutine leak in the block-storage path