Skip to content

Veirox Connect v0.3.0

Choose a tag to compare

View all tags
@msrashed2018 msrashed2018 released this 23 May 21:10
v0.3.0
37c3de1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Public distribution pipeline. First tagged release that reaches
    end users. Mirrors the veirox-cli pattern:
    • GoReleaser config (.goreleaser.yaml) builds musl-static binaries
      for linux/amd64 and linux/arm64, packages tarballs, deb, rpm,
      apk, and multi-arch Docker images.
    • Release workflow (.github/workflows/release.yml) targets
      veirox-cloud/veirox-dist for the GitHub Release so users get
      public download links without GitHub auth.
    • Two Docker tag variants: :vX.Y.Z (distroless static, just the
      binary) and :vX.Y.Z-k8s (alpine + binary + kubectl + helm — the
      Helm chart's default).
    • Helm chart (charts/veirox-connector/) moved out of
      veirox-backend into the connector repo and published as an OCI
      artifact at oci://ghcr.io/veirox-cloud/charts/veirox-connector.
    • One-line systemd installer at https://veirox.com/install.sh
      (lives in veirox-marketing/public/install.sh).
  • DaemonSet mode in the Helm chart (mode: daemonset) — one
    connector per node, useful for multi-tenant clusters.
  • Configurable HTTP /health endpoint for k8s probes (via
    healthEndpoint.enabled: true in values.yaml).
  • Configurable replicas (.Values.replicas, default 1).
  • Hardened pod + container security context in the Helm chart:
    runAsNonRoot, readOnlyRootFilesystem, seccompProfile, drop
    ALL capabilities, dedicated UID 10001 matching the k8s image.
  • systemd unit hardening (in the deb/rpm/apk + install.sh):
    NoNewPrivileges, ProtectSystem=strict, capability bounding set
    empty, syscall filter, RestrictAddressFamilies to outbound only.
  • Cosign keyless signatures on every artifact (binaries, archives,
    deb/rpm/apk packages, Docker images, Helm chart).

Changed

  • Default backend URL moved to https://connect.veirox.com
    (dedicated subdomain with proper client-cert forwarding) from the
    legacy shared-SNI https://veirox.com. mTLS now works end-to-end
    without bearer-auth fallback.
  • Cargo features: default = [] (dropped insecure-dev).
    Release builds no longer compile in bearer auth or plaintext ws://.
    Local dev still works via cargo build --features insecure-dev.
  • Helm chart appVersion auto-bumped by the release workflow
    (helm package --app-version $(tag without v)) so chart + binary
    versions never drift.
  • Helm chart Chart.yaml: sources: URL fixed to the actual
    GitHub repo. Added artifacthub.io annotations.
  • CLAUDE.md / README.md: dropped dead references to non-existent
    agent/dist/ directory. Updated to point at the real
    charts/veirox-connector/, Dockerfile, and marketing-served
    install.sh.

Removed

  • docker.io/msrashed/veirox-connector — no longer used.
    Replaced by ghcr.io/veirox-cloud/veirox-connector (org GHCR).
  • oci://ghcr.io/msrashed2018/charts/veirox-connector — no
    longer used. Replaced by oci://ghcr.io/veirox-cloud/charts/veirox-connector.

Migration notes

Existing test installs using the personal-namespace image / chart
need to be uninstalled and reinstalled with the new URLs. There's
no in-place upgrade path because the registry hostnames changed.
Operators of in-cluster connectors:

helm uninstall veirox-connector
helm install veirox-connector \
  oci://ghcr.io/veirox-cloud/charts/veirox-connector --version 0.5.0 \
  …

Verify

# Tarballs (cosign keyless via GitHub OIDC):
cosign verify-blob \
  --signature   veirox-connector_<VER>_linux_<ARCH>.tar.gz.sig \
  --certificate veirox-connector_<VER>_linux_<ARCH>.tar.gz.pem \
  --certificate-identity-regexp '^https://github.com/veirox-cloud/veirox-connector/.github/workflows/release.yml@refs/tags/v.+' \
  --certificate-oidc-issuer    'https://token.actions.githubusercontent.com' \
  veirox-connector_<VER>_linux_<ARCH>.tar.gz

# Docker images:
cosign verify ghcr.io/veirox-cloud/veirox-connector:<VER> \
  --certificate-identity-regexp '^https://github.com/veirox-cloud/veirox-connector/.github/workflows/release.yml@refs/tags/v.+' \
  --certificate-oidc-issuer    'https://token.actions.githubusercontent.com'

Install

  • One-line systemd installer: curl -fsSL https://veirox.com/install.sh | sudo bash -s -- --token veirox_enr_...
  • Helm chart: helm install veirox-connector oci://ghcr.io/veirox-cloud/charts/veirox-connector
  • Docker: docker pull ghcr.io/veirox-cloud/veirox-connector:<VER>

See veirox.com/install.html for the full guide.

Assets 9
Loading