Release v1.19.0 · mulgadc/spinifex

What's Changed

Predastore's on-disk format changed, so a store written by v1.18.0 or earlier is rejected on read and no migration is provided
EBS volume and snapshot metadata is now partitioned by owning account, and metadata written by an earlier release is not readable under the new layout
Re-initialise affected clusters with spx admin init --force, which discards stored objects, export anything you need first
This is the last breaking change: every future format or layout change ships with a migration

CopyObject and UploadPartCopy are implemented, so server-side and multipart copies work
Batch DeleteObjects removes many keys in a single call
ListObjectsV2 paginates correctly, and v1 listings honour the marker parameter
Object ETags are derived from content, so client-side integrity checks match
aws-chunked upload bodies are decoded and authenticated, unblocking streaming SigV4 uploads
Unsupported S3 sub-resources are refused instead of being silently ignored
EBS metadata is partitioned by account, cutting describe latency on clusters with many tenants
S3 Service Metrics derive cluster health from raft quorum

sts:AssumeRole is gated on the caller's identity policy
IAM policy matching supports the ? single-character wildcard
A policy variable that cannot be resolved fails closed instead of matching
aws:userid works as both a condition key and a policy variable across the EC2, S3 and gateway paths
PassRole is authorized against the stored role ARN
Caller-supplied role and policy ARNs are verified against the stored canonical ARN
A policy ARN supplied by a caller is re-anchored onto the caller's own account
PermissionsBoundary is rejected on CreateRole and CreateUser rather than silently dropped
An IpAddress condition that cannot parse the request address fails closed
IMDS credentials resolve locally, cutting a network hop off every instance credential fetch
A credential refresh fails outright instead of extending a dead key's expiry

Instances on a node that has stopped answering now report impaired status
DescribeInstances judges completeness by responder identity, so a partial fan-out no longer looks like a full answer
Seven EC2 create calls honour ClientToken, so a retry no longer duplicates the resource
RunTask and CreateLaunchTemplateVersion honour ClientToken
InsufficientInstanceCapacity is returned with a 5xx status, so SDK retries kick in
DescribeImages reports a conformant BootMode

Outbound SMTP to ports 25, 465 and 587 is blocked for public destinations by default, matching AWS, with an operator-held per-VPC exemption
Unsupported security group protocols are rejected instead of emitting an allow-all rule
Security group default-deny rules now match every ethertype
Unscoped firewall accepts are family-qualified to IPv4
An internet gateway reports itself attached only once the underlying gateway is up
ENIs and their Elastic IP associations are released when the owning instance is gone
A launch that fails part-way releases its ENI and external address
DeleteSecurityGroup names the blocking resource in its DependencyViolation
DNS converges on change instead of on a timer, so records appear promptly after a lifecycle event
Stale EC2 DNS records are pruned against the live instance set
A node's resolver no longer answers recursive queries for arbitrary clients
Cluster-wide IPsec is enabled only once every chassis is configured

Control-plane egress is tunnelled through konnectivity
Internal control-plane routes bind to the calling control-plane VM
The cluster reconciler wakes on signals it already receives, so clusters converge faster
A transient reconcile failure retries immediately rather than waiting for the next resync
Control-plane health diagnostics report CPU and memory pressure alongside etcd disk state, and an unanswered probe reads as unreachable rather than healthy

ModifyLoadBalancerAttributes and ModifyTargetGroupAttributes accept the full documented attribute set, so Terraform and the AWS Load Balancer Controller no longer fail an apply on one missing key

A guest is paused on a backend I/O error instead of being handed EIO, turning a transient storage fault into a recoverable stall
A write-ahead log flush is reported durable only once the fsync covering it completes
A node upgrade refuses to proceed when a volume seal fails, instead of reporting success and leaving an unbootable root volume
A volume falls back to its local state copy when the backend copy is torn
A failed shard write can no longer wedge an object put
Storage readiness is gated on the write floor, so a node takes traffic only when it can serve writes
Caller cancellations no longer evict healthy connections from the pool
The message store keeps recovery headroom, so a full disk no longer takes it down on restart
Console assets are content-hashed, so a deploy cannot serve a mix of two builds

Boot volumes spread virtio-blk queues across an IOThread pool sized to the instance's vCPU count
Volume write-ahead logs can be placed on a dedicated device via wal_base_dir, keeping fsync tail latency off the shared device queue
Streaming shard read and write path with hedged repair
Object shards spread evenly across nodes, so losing one node no longer degrades the whole keyspace
NBD request latency and guest write backpressure are measured at the guest boundary, so slow-disk complaints are now attributable

Session tokens are redacted from canonical requests written to logs
Object listing no longer logs the raw query string
A streamed payload is verified at its declared length, not only at EOF
Inbound object bodies are bounded, and the CreateBucket body payload check is enforced