Skip to content

v0.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Aug 21:29
· 21 commits to main since this release
v0.3.0
This tag was signed with the committer’s verified signature.
jayonthenet Clemens Jütte
SSH Key Fingerprint: IkGL19qLxHl0blMSyV3s0L97ux8+Fc4pZGZpXbt1l5s
Verified
Learn about vigilant mode.
da303c6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Platform Orchestrator Helm chart 0.3.0

This breaking release makes HTTPS the stable runner-facing protocol while
retaining NATS JetStream as the Orchestrator's internal durable transport.
Runner agents and deployment Jobs no longer receive broker endpoints or
credentials.

Included versions

Component Version
Control plane v2.0.0
Data plane v3.0.0
IAM v2.0.0
Runner v3.0.0
Console v1.0.2
Kubernetes runner chart 0.3.0
NATS Helm dependency 2.14.0

Architecture

  • The chart deploys two stateless runner-gateway replicas backed by central
    JetStream.
  • External runner agents long-poll the public
    https://<api-host>/runner-gateway endpoint. Direct Kubernetes Jobs use the
    cluster-internal gateway Service, and ECS Jobs use the public endpoint.
  • Agents authenticate with short-lived Ed25519 JWTs. Deployment Jobs receive
    deployment-scoped tokens rather than broker credentials.
  • Encrypted command receipts preserve JetStream acknowledgement, retry, and
    rejection semantics across gateway replicas without sticky sessions.
  • Commands remain centrally buffered while edge runners are disconnected.
    Edge results and encrypted logs use the runner-side RWX outbox until the
    HTTPS return path recovers.

Upgrade requirements

  1. Publish and verify data-plane and runner v3.0.0 plus runner chart 0.3.0.
  2. Configure a trusted TLS route for /runner-gateway and set the chart's
    public gateway URL to that route.
  3. Update runner registrations and installations with matching Ed25519 public
    and private keys.
  4. Upgrade data-plane, runner gateway, and runner installations as one
    coordinated compatibility boundary.
  5. Execute a deployment and verify its result and encrypted logs before
    reopening deployment traffic.

Qualification limits

The simple and edge paths passed local real-JetStream and Kind deployment
tests, including a real Kubernetes resource and encrypted log return. The
physical diode path and live ECS execution were not tested. Air-gap operation
requires a separately authorized reverse relay for results and logs. Logs
remain bounded encrypted objects rather than a live tail.

Assets 3
Loading