Skip to content

v1.2.5 — Cloud-Native Optimization

Choose a tag to compare

View all tags
@singchia singchia released this 02 May 13:51
v1.2.5
01f158c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Frontier 1.2.5 — Cloud-Native Optimization

First release after RFC-001 Cloud-Native Optimization (PRs #103 + #104 + #105 + #106). Five workstreams (M1–M5) ship together; full design at docs/rfc/RFC-001-cloud-native-optimization.md.

Container images

singchia/frontier:1.2.5       (linux/amd64; runs as UID 65532)
singchia/frontlas:1.2.5       (linux/amd64; runs as UID 65532)

Highlights

M1 — Operator P0 correctness fixes

# Fix
1 TLS Cert/Key volume now mounts the cert/key Secret instead of the CA — mTLS pods finally receive a cert
2 getEBCAFromSecret propagates Secret read errors instead of swallowing them as ("", nil)
3 Operator-managed TLS Secret names follow <fc>-edgebound-... (was missing the dash)
4 Frontlas frontier-plane port is no longer hard-coded to 40012 — new controlplane.frontierPlanePort field + FRONTLAS_FRONTIERPLANE_PORT env

M2 — Production baseline (CRD + binaries)

  • PodOverrides on both frontier and frontlas: resources, nodeSelector, tolerations, topologySpreadConstraints, affinity, priorityClassName, serviceAccountName, imagePullSecrets, imagePullPolicy, annotations, labels, podSecurityContext, containerSecurityContext, terminationGracePeriodSeconds, livenessProbe, readinessProbe, lifecycle
  • Redis password via Secret: frontlas.redis.passwordSecret (SecretKeySelector); plaintext password deprecated
  • Production defaults applied automatically: runAsNonRoot=true, UID 65532, drop ALL capabilities, RuntimeDefault seccomp, IfNotPresent pull policy, preferred host anti-affinity, TCP probes, preStop sleep, frontier terminationGracePeriodSeconds=60
  • Graceful shutdown: cmd/frontier honors FRONTIER_DRAIN_SECONDS env (operator injects grace - 10)
  • Non-root containers: Dockerfile.frontier and Dockerfile.frontlas ship with USER 65532:65532

M3 — Observability HTTP server

Both binaries now expose three endpoints on a separate port:

Endpoint Frontier Frontlas Behavior
/healthz :9091 :9092 200 if process responds (liveness)
/readyz :9091 :9092 200 ready / 503 with reason; frontlas pings Redis
/metrics :9091 :9092 Prometheus default registry (Go runtime + process collectors)

Configured via the new observability block in frontier.yaml / frontlas.yaml.

M4 — Status, Events, CRD ergonomics

  • kubectl get fc (short name registered) shows: NAME / PHASE / FRONTIER / FRONTLAS / AGE
  • Status now carries []metav1.Condition (Available, Progressing, Degraded) + observedGeneration + per-component readyReplicas. Phase + Message kept for backwards compat
  • Operator emits Kubernetes Events: ServiceEnsureFailed, TLSEnsureFailed, DeploymentEnsureFailed (warnings); Available (normal, fired once on first ready)
  • New CRD markers: shortNames: fc, fcs, categories: frontier, 5 printcolumns

M5 — Helm chart (frontier + frontlas + Redis)

  • Official Helm repo: https://singchia.github.io/frontier (gh-pages + GitHub Pages)
  • Chart v1.2.5 deploys both data plane and control plane in one shot, with bundled bitnami/redis subchart (set redis.enabled=false to BYO)
  • Defaults track the operator's M2 baseline (nonRoot, preStop, probes, drain, preferred anti-affinity)
  • Optional serviceMonitor.enabled=true for Prometheus Operator

Install

Operator (recommended for declarative CR-driven workflows)

kubectl apply -f https://raw.githubusercontent.com/singchia/frontier/v1.2.5/pkg/operator/dist/install.yaml

cat <<'EOF' | kubectl apply -f -
apiVersion: frontier.singchia.io/v1alpha1
kind: FrontierCluster
metadata: { name: prod, namespace: frontier }
spec:
  frontier: { replicas: 2, servicebound: { port: 30011 }, edgebound: { port: 30012 } }
  frontlas:
    replicas: 1
    redis:
      addrs: ["redis.frontier:6379"]
      passwordSecret: { name: redis-creds, key: password }
      redisType: standalone
EOF

Helm (recommended for GitOps / platform teams)

helm repo add frontier https://singchia.github.io/frontier
helm repo update
helm install frontier frontier/frontier -n frontier --create-namespace

Full reference: https://frontier.singchia.io/docs/operator

Upgrade notes

  • CRD schema is additive — existing v1alpha1 CRs continue to work. New optional fields default to operator-internal production-grade values.
  • Default SecurityContext is now runAsNonRoot=true UID 65532. If your custom image runs as root, set spec.frontier.pod.podSecurityContext: {} + containerSecurityContext: { runAsNonRoot: false } to opt out.
  • Operator-managed Secret names changed from <fc>edgebound-... to <fc>-edgebound-.... After upgrade the new name is created; the orphaned old Secret is garbage-collected when the FrontierCluster CR is deleted.
  • Helm chart top-level schema moved from a flat frontier-only layout to frontier / frontlas / observability / serviceMonitor / redis sections. Re-review your values.yaml overrides when upgrading.

What's next

  • Webhook validation for the CRD (negative replicas, port ranges, RedisType enum)
  • v1alpha1 → v1beta1 with conversion webhook
  • klog → slog migration in the binaries
  • govulncheck + cosign image signing in CI
Assets 2
Loading