Skip to content

Configra v1.0.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Sep 07:37
· 1 commit to main since this release
v1.0.1
b4afa48

Configra v1.0.1

Configra 的首个正式稳定版。用 JSON/YAML 引用 Vault 中的值，应用按 Environment 获取渲染结果，开发、测试、生产环境不需要更换字段名或引用。

下载与使用

  • 提供 macOS、Linux 的 amd64 / arm64 包。每个包包含服务端、Kubernetes 工具、部署示例、许可证、SBOM 和文件清单；下载后先核对 SHA256SUMS。
  • 中文入门 · 安装说明 · Go SDK v1.0.0
  • Web UI 已嵌入程序。运行仍需 MySQL、NATS、ClickHouse、OIDC、证书和外部 Master Key；不是独立桌面应用。
  • macOS 程序尚未经过 Apple 签名或公证。容器镜像请用标签中的 Dockerfile 构建，并推送到自己的 registry。

修复与升级注意

  • 修复特殊环境名的 Token 授权显示、分页种子初始化、特殊 Vault 字段名导致的页面异常，补充回归测试。
  • 加固 API 输入大小、请求／数据库超时、分页查询和故障状态码，继续支持 MySQL 8.0.22。
  • 修复 Kubernetes 原生同步的并发覆盖和删除竞态、CSI 路径冲突、SDK 的可变快照共享问题。
  • 提供只读恢复检查和离线 Master Key 轮换，验证失败回滚、丢失 COMMIT 响应、恢复后证书签发与吊销。
  • 从 rc.2 升级时，自编 Management 客户端需要适配分页。机器读取接口与 SDK 调用方式不变。换钥需要维护窗口，不要直接替换原密钥。

为什么从 v1.0.1 发布

v1.0.0 只生成了草稿，未正式发布。最后复验发现测试把端口号 6380 误匹配到时间戳，并非配置泄漏。v1.0.1 将测试改为精确校验事件元数据，固定复现连续运行 50 次及原生 Linux／MySQL 8.0.22／SDK 完整集成通过。没有改写已有标签或下载包；SDK 已发布的 v1.0.0 保持不变。

验收范围

最终运行时代码在独立 4 vCPU Linux 主机上通过十分钟 1000 QPS 测试：600,000 次读取全部成功，P99 为 31.935 ms，API 限制为 2 CPU / 512 MiB。v1.0.1 与该次测试的运行时代码相同；之后只修改了测试和文档。

本机、独立 Linux、GitHub CI 均通过完整三节点 Kubernetes 演练，覆盖两种 provider、凭据/API/控制器/工作节点故障和离线换钥。Linux 三轮 API 滚动更新中，111 次不重试 mTLS 读取全部成功；随后标签级 Kubernetes 复验的 99 次读取也全部成功，该次任务整体失败来自上面已修正的测试误报。

51 项 UI 测试、Go 1.25.13/1.26.7 race/vet、可达漏洞扫描和六个 TLA+ 模型检查通过。完整验收记录保留了早期失败，包括一次缺少原始诊断、原因未能确认的 hosted provider 演练。后续同一运行时代码在三种环境完整通过，没有把旧失败改记为通过。

稳定版不代表每个部署都已验收。需验证自己的入口能透传 mTLS，并演练独立主机／可用区故障、备份恢复和实际容量。三节点测试仍共用一台宿主机，结果不是 SLA。

发布文件复核

  • Source: b4afa48. Tagged build and final-commit CI pass.
  • 四个实际 GitHub 下载包均通过 SHA-256、版本／源码／目标平台／工具链、SDK 固定版本、原始许可证与源文件／SBOM 对应关系和完整文件清单检查。macOS 包为 269 个文件／120 个组件，Linux 包为 271 个文件／121 个组件。
  • macOS arm64 和 Linux amd64 原生运行两个程序的 --version 与 --help，均报告 v1.0.1 / b4afa48。另外两个目标完成交叉构建和文件验证，未宣称做过原生运行测试。
  • 下载到的 Linux 服务端通过完整 OIDC／mTLS／服务故障／备份恢复／doctor／离线换钥／SDK／CA／Audit／泄漏扫描。测试只用临时容器承载该文件；这个容器不作为发布镜像分发。

All four actual GitHub downloads pass checksum, version/source/target/toolchain, SDK pin, notice/source/SBOM and complete-inventory checks. Both executables run natively on macOS arm64 and Linux amd64; the other targets are cross-built and metadata-verified. The downloaded Linux server also passes the full real-service, failure, encrypted-recovery and offline-rotation drill. Its disposable test wrapper is not a distributed container image.

中英文官网已通过部署检查，对应源码 c39dd1e：36 项测试通过，线上 26 个页面的桌面／手机布局、同页语言切换、代码复制和资源请求均通过。五个公开下载链接可匿名访问，公开校验和与已验证的下载包一致。

The bilingual website is deployed from c39dd1e. All 36 site checks pass, plus live-browser checks of 26 routes at desktop/mobile widths, same-page language switching, clipboard examples and resource requests. Anonymous checks confirm all five public download links and the matching checksum file.

English

Configra's first stable server release resolves JSON/YAML templates with Vault values for the requested Environment. Applications keep the same field names and references across development, testing and production.

Download the macOS or Linux amd64/arm64 archive and verify SHA256SUMS. Bundles include both executables, deployment examples, licenses, SBOM and an inventory. The UI is embedded; databases, OIDC, TLS and an external Master Key are still required. macOS executables are not Apple-signed/notarized. Build container images from the tagged Dockerfiles for your registry. The Go SDK is v1.0.0, not v1.0.1.

This release fixes UI and pagination regressions, API bounds and failure handling, Kubernetes synchronization/deletion races, CSI path validation and SDK snapshot isolation. It retains MySQL 8.0.22 compatibility and provides read-only recovery checks and offline Master Key rotation. Custom Management clients upgrading from rc.2 must follow pagination; machine reads and SDK calls are unchanged. Key rotation requires a maintenance window.

The server's v1.0.0 candidate was never published. Its last replay exposed a test matching port digits in a valid timestamp, not a data leak. v1.0.1 includes the corrected exact-metadata assertion. Fifty deterministic repetitions and full native Linux/MySQL/SDK integration pass; existing tags and checksums are unchanged.

The identical runtime passed 600,000 reads over ten minutes on a four-vCPU Linux host, with a two-CPU/512-MiB API limit and 31.935 ms p99 latency. Native Linux, Mac and hosted CI passed the full three-node Kubernetes provider/fault/recovery/rotation drill. Linux verified 111 no-retry mTLS reads across three API rollouts; a later tagged replay verified 99. An earlier hosted provider failure lacks sufficient diagnostics to identify its cause and remains in the record. Results are not an SLA: validate your ingress, independent-host failures, recovery procedures and capacity.

Getting started · Installation · Acceptance record

Assets 7
Loading