Skip to content

controlplane-2026.7.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Jul 17:30
controlplane-2026.7.0
ad02046
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Union selfhosted/selfmanaged Helm charts — 2026.7.0

First stable 2026.7.0 (CalVer: July 2026), superseding the June 2026.6.10-alpha.* pre-releases. version + appVersion are 2026.7.0 across controlplane, dataplane, dataplane-crds, and sandbox. Notes below are the diff against the last stable release, 2026.6.9.

Install / upgrade

helm repo add unionai https://unionai.github.io/helm-charts
helm repo update
# control plane
helm upgrade --install union-cp unionai/controlplane --version 2026.7.0 -f your-values.yaml
# data plane
helm upgrade --install union-dp unionai/dataplane --version 2026.7.0 -f your-values.yaml

Charts in this release: controlplane · dataplane · dataplane-crds · sandbox · knative-migration — all 2026.7.0.

Highlights — dataplane self-registration + multi-dataplane routing

Dataplanes can now self-register. Each dataplane reports a bare host + TLS posture in Status.connection_config on every UpdateStatus heartbeat; the control plane builds http(s)://host from it and routes each project/domain to its mapped dataplane by cluster pool via the new direct cluster selector — removing the single-dataplane assumption and the global.DATAPLANE_HOST / global.DATAPLANE_ENDPOINT globals, and reaching dataplanes directly (no Cloudflare tunnel).

This is opt-in in 2026.7.0. The control-plane selector still defaults to local (backwards-compatible) and dataplane self-registration defaults to off — enable both together for multi-dataplane (see Migration). A future release will make direct the default.

Configuration changes

dataplane

  • New updateStatus.connectionConfig (opt-in via .enabled, default false):
    • host — DP-reachable hostname the CP dials back. Bare hostname only, no scheme/port (e.g. dp-1.internal.<domain>); empty falls back to ingress.host.
    • insecure — dial over http instead of https (default false).
    • insecureSkipVerify — skip TLS cert verification (default false).
    • Wiring: new _connection.tpl helper + operator/configmap-connection.yaml; the operator deployment mounts the config. Requires an appVersion 2026.7.0 operator image.
  • New examples/values.zero-trust.yaml reference overlay for enabling zero trust.
  • Billing now defaults to v2 usage-based collection (model: ResourceUsage).
  • Prometheus scrape/relabel config updates.

controlplane

  • New direct option for services.dataproxy.configMap.dataproxy.clusterSelector.type — resolves the target dataplane by cluster pool and dials its self-reported endpoint directly. The default stays local (data-plane-only self-resolver, backwards-compatible); direct is opt-in for multi-dataplane and must be paired with dataplane self-registration.
  • global.DATAPLANE_HOST / global.DATAPLANE_ENDPOINT removed as required globals — the CP derives the DP endpoint from self-reported connection_config. secureTunnelTenantURLPattern still reads global.DATAPLANE_HOST as an optional override.
  • connection.rootTenantURLPattern — control-plane tenant URL pattern (default dns:///<ingressFqdn>); used for tenant domain derivation and eager API-key minting.
  • Leasor queueSync.source: crud default (auto-generates queueSync.queues).
  • Gateway API / ingress template updates: new _ingress-protected.yaml, plus changes to _gateway.yaml, _grpcroute-protected.yaml, backend/client traffic policies, and protected/unprotected HTTP+gRPC routes.
  • Removed now-unused keys from values.aws.yaml / values.gcp.yaml; refreshed the intracluster example values.

dashboards

  • New endpoint-source DP self-report migration rows on the controlplane + dataplane overview dashboards: adoption over time, self-reporting count, and a per-dataplane source table.

dependencies

  • kube-prometheus-stack subchart → 25.30.2 (Prometheus v2.55.1); envoy-gateway-config touch-ups (envoyproxy / gatewayclass / redis).

Platform (control plane / data plane images — appVersion 2026.7.0)

  • Dataplane self-registration + host-based connection_config; dataproxy cluster-selector consolidation (local / remote / direct); endpoint-source metrics (a source label distinguishing self-reported vs admin-set endpoints).
  • Leasor scheduler batching + queue-routing improvements; queues UI additions (clusters tab, status filter, deep links). Note: queue drain/deletion is not supported yet — a queue name pinned to a cluster pool cannot currently be reused, so choose queue names deliberately. See Cluster workload management.
  • Billing v2 usage data collected by default; trustedIdentityClaims supported for the cluster service.
  • Prometheus v2.55.1 for the operator; dataplane / metrics-gateway label cleanups; dataproxy autoscaling ceiling raised.

Backward compatibility / migration

Upgrading to 2026.7.0 is behavior-preserving by default — the control-plane selector stays local and dataplane self-registration stays off, so routing is unchanged unless you opt in.

Enable multi-dataplane routing (opt-in) — set both sides together; enabling only one falls back to the templated URL pattern:

# control plane
services:
  dataproxy:
    configMap:
      dataproxy:
        clusterSelector:
          type: direct
# data plane
updateStatus:
  connectionConfig:
    enabled: true
    # host defaults to ingress.host; set it if the CP reaches the DP elsewhere:
    # host: "dp-1.internal.<domain>"

direct reads each dataplane's self-reported connection_config, so the dataplanes must self-report (enabled: true) for routing to resolve. Requires the 2026.7.0 operator image. A future release will make direct the default.

Configure the tenant URL (if your install previously relied on a removed global for it):

connection:
  rootTenantURLPattern: 'dns:///<your-control-plane-host>'

If you set the removed globals (global.DATAPLANE_HOST / global.DATAPLANE_ENDPOINT): remove them. To keep an explicit CP→DP tunnel URL, set secureTunnelTenantURLPattern directly (or keep global.DATAPLANE_HOST set — it's still read as that field's default). The admin-set DataplaneIngressURL fallback (via CreateTunnel) is unchanged.

Billing: v2 usage-based collection (model: ResourceUsage) is now the default — set the billing model explicitly if you need the previous behavior.

Changes

  • Release 2026.7.0 (#472)
  • dashboards: dataplane ingress endpoint-source panels (#463)
  • controlplane: default dataproxy clusterSelector.type to direct (#461)
Assets 3
Loading