Release v0.2.0

Changes

chart

Added

• Added local.storage to support local inputs and outputs (#41).
• Added transporter.storage.azure values for Azure Storage authentication (#27).
• Added a 15 minute TTL on the migration job (#25).
• Addes dynamic egress network policy additions for cloud and user exceptions (#34).
• Added optional per-container task resource usage sampling with kubelet TLS
  configuration
  (#48).
• Added task.storageClass for selecting the task PVC StorageClass (#52).

Fixed

• Fixed the task pod's outputs container so that it also mounts the task's
  input files at the same paths the executors used. Previously, a task's
  work directory could still contain symlinks pointing at input files (for
  example, if the task's own cleanup step never ran because the task
  failed), and the outputs container had no way to resolve such
  symlinks, causing the output sweep to fail with a misleading "no such
  file or directory" error that masked the task's real failure. (#50)

api

Fixed

• Fixed handling of FILE type outputs with path prefixes (#46).

Added

• Added support for local (file://) inputs and outputs (#41).
• Added support for the X-Forwarded-User header for respecting the user
  associated with TES API requests (#40).

Dependencies

• Updated dependencies to latest (#37).

orchestrator

Added

• Orchestrator now includes the output of the inputs or outputs container in
  the task's system log when they fail (#43).
• Added creating Kubernetes resources via a template (#38).
• Added shared storage for communicating inputs and outputs to task pods (#38).
• Added support for reading Azure Storage credentials from the K8s secret (#27).

Fixed

• Included failed executor details when a task is otherwise reported with an
  I/O or system error
  (#51).
• Fixed returning a 403 for when there is an invalid or missing authorization
  header (#26).
• Fixed incorrect task state when a system error was encountered (#28).

Dependencies

• Updated dependencies to latest (#37).

monitor

Added

• Added optional per-container task resource usage sampling from kubelets via
  --usage-sample-interval / USAGE_SAMPLE_INTERVAL
  (#48).
• Added creating Kubernetes resources via a template (#38).

Fixed

• Corrected several bugs in the monitor that prevented it from aborting tasks
  that no longer have running pods (#29).

Dependencies

• Updated dependencies to latest (#37).

transporter

Security Fix

• Ensure output symlinks cannot escape the output directory (GHSA-r3cq-9r6g-c766).

Fixed

• Set pipefail for certain Docker build commands (GHSA-r3cq-9r6g-c766).
• Fixed handling of FILE type outputs with path prefixes (#46).

Added

• Added support for output directories containing symlinks (GHSA-r3cq-9r6g-c766).

• Added support for local (file://) inputs and outputs (#41).

• Added --azure-account-name and --azure-access-key options for Azure
  Storage authentication (#27).

Dependencies

• Updated dependencies to latest (#37).

server

Security Fix

• Ensure strings are rendered as JSON strings in the task.yaml template by
  default (GHSA-xpq5-f3m7-cxh3).

Added

• Added support for rendering templates with local inputs and outputs (#41).

Dependencies

• Updated dependencies to latest (#37).

db

Added

• Added per-container task resource usage aggregation and TES task log
  metadata reporting
  (#48).
• Added name column to containers table (#43).
• Added support retrieving usernames of tasks for template rendering (#41).
• Added username column to tasks table to associate tasks with TES API
  users (#40).

Dependencies

• Updated dependencies to latest (#37).

Docker Images

All images are available on GitHub Container Registry with both amd64 and arm64 architectures:

• ghcr.io/stjude-rust-labs/planetary-api:v0.2.0
• ghcr.io/stjude-rust-labs/planetary-orchestrator:v0.2.0
• ghcr.io/stjude-rust-labs/planetary-monitor:v0.2.0
• ghcr.io/stjude-rust-labs/planetary-transporter:v0.2.0
• ghcr.io/stjude-rust-labs/planetary-migration:v0.2.0

Helm Chart

Install or upgrade with:

helm upgrade --install planetary ./chart