Merge pull request #1954 from openziti/release-next

Release v1.1.0

.github/workflows/fablab-db-creation.yml

@@ -20,6 +20,7 @@ jobs:
   build:
     name: Build and Run
     runs-on: ubuntu-latest
+    if: github.repository_owner == 'openziti'
     steps:
       - name: Checkout ziti
         uses: actions/checkout@v4

.github/workflows/golangci-lint.yml

@@ -28,7 +28,7 @@ jobs:
         uses: golangci/golangci-lint-action@v4
         with:
           # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
-          version: v1.55.2
+          version: v1.57.2
 
           # Optional: working directory, useful for monorepos
           # working-directory: somedir

.github/workflows/main.yml

@@ -462,11 +462,6 @@ jobs:
                 -path "./release/*/linux/ziti" \
             | xargs -0 chmod -c +x
 
-      - name: Install Jfrog CLI
-        uses: jfrog/setup-jfrog-cli@v4
-        with:
-          version: 1.51.1
-
       - name: Publish GitHub Release
         # forks need to run this step with their own GPG key because ziti-ci creates the GH release 
         if: env.ziti_ci_gpg_key_id != null && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-v'))
@@ -478,7 +473,7 @@ jobs:
         run: |
           $(go env GOPATH)/bin/ziti-ci configure-git
           $(go env GOPATH)/bin/ziti-ci tag -v -f version
-          $(go env GOPATH)/bin/ziti-ci publish-to-github --archive-base ""
+          $(go env GOPATH)/bin/ziti-ci publish-to-github --prerelease --archive-base ""
 
       # only ziti-ci computed version for release branches and {version}-{run_id} for non-release branches
       - name: Compute the Ziti Version String for CI Jobs
@@ -505,15 +500,6 @@ jobs:
             echo ZITI_VERSION="${ZITI_VERSION}" | tee -a $GITHUB_OUTPUT
           fi
 
-      - name: Publish to Artifactory
-        if: ${{ env.JFROG_API_KEY != null && github.repository == 'openziti/ziti' }}
-        shell: bash
-        run: |
-          $(go env GOPATH)/bin/ziti-ci publish-to-artifactory
-        env:
-          JFROG_API_KEY: ${{ secrets.JFROG_API_KEY }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
   call-publish-prerelease-docker-images:
     # - !cancelled() allows evaluating further conditional expressions even if
     #   needed jobs were skipped

.github/workflows/publish-docker-images.yml

@@ -96,12 +96,14 @@ jobs:
         uses: docker/build-push-action@v5
         with:
           builder: ${{ steps.buildx.outputs.name }}
-          context: ${{ github.workspace }}/dist/docker-images/ziti-controller/
+          context: ${{ github.workspace }}/
+          file: ${{ github.workspace }}/dist/docker-images/ziti-controller/Dockerfile
           platforms: linux/amd64,linux/arm64
           tags: ${{ steps.tagprep_ctrl.outputs.DOCKER_TAGS }}
           build-args: |
             ZITI_CLI_TAG=${{ env.ZITI_CLI_TAG }}
             ZITI_CLI_IMAGE=${{ env.ZITI_CLI_IMAGE }}
+            DOCKER_BUILD_DIR=./dist/docker-images/ziti-controller
           push: true
 
       - name: Set Up Container Image Tags for Router Container
@@ -116,19 +118,20 @@ jobs:
           if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
             DOCKER_TAGS+=",${IMAGE_REPO}:latest"
           fi
-          echo "DEBUG: DOCKER_TAGS=${DOCKER_TAGS}"
-          echo DOCKER_TAGS="${DOCKER_TAGS}" >> $GITHUB_OUTPUT
+          echo DOCKER_TAGS="${DOCKER_TAGS}" | tee -a $GITHUB_OUTPUT
 
       - name: Build & Push Multi-Platform Router Container Image to Hub
         uses: docker/build-push-action@v5
         with:
           builder: ${{ steps.buildx.outputs.name }}
-          context: ${{ github.workspace }}/dist/docker-images/ziti-router/
+          context: ${{ github.workspace }}/
+          file: ${{ github.workspace }}/dist/docker-images/ziti-router/Dockerfile
           platforms: linux/amd64,linux/arm64
           tags: ${{ steps.tagprep_router.outputs.DOCKER_TAGS }}
           build-args: |
             ZITI_CLI_TAG=${{ env.ZITI_CLI_TAG }}
             ZITI_CLI_IMAGE=${{ env.ZITI_CLI_IMAGE }}
+            DOCKER_BUILD_DIR=./dist/docker-images/ziti-router
           push: true
 
       - name: Set Up Container Image Tags for Go Tunneler Container

.github/workflows/publish-linux-packages.yml

@@ -16,6 +16,8 @@ jobs:
       matrix:
         package_name:
           - openziti
+          - openziti-controller
+          - openziti-router
         arch:
           - goreleaser: amd64
             gox: amd64
@@ -40,6 +42,7 @@ jobs:
       ZITI_HOMEPAGE: "https://openziti.io"
       ZITI_VENDOR: "NetFoundry"
       GOARCH: ${{ matrix.arch.goreleaser }}
+      MINIMUM_SYSTEMD_VERSION: 232
       ZITI_DEB_TEST_REPO: ${{ vars.ZITI_DEB_TEST_REPO || 'zitipax-openziti-deb-test' }}
       ZITI_DEB_PROD_REPO: ${{ vars.ZITI_DEB_PROD_REPO || 'zitipax-openziti-deb-stable' }}
       ZITI_RPM_TEST_REPO: ${{ vars.ZITI_RPM_TEST_REPO || 'zitipax-openziti-rpm-test' }}

.golangci.yml

@@ -1,13 +1,15 @@
 run:
   build-tags:
     - apitests
-  deadline: 8m
-  skip-files:
-    - ziti/cmd/edge/verify_ca.go
+  # Default: 1m
+  timeout: 8m
 
 # golangci gives false positives for implementations of methods using generics in generic interfaces
 issues:
   exclude-rules:
     - path: 'controller/model/.*.go'
       linters:
         - unused
+    - path: 'ziti/cmd/edge/verify_ca.go'
+      linters:
+        - staticcheck

CHANGELOG.md

@@ -1,3 +1,49 @@
+# Release 1.1.0
+
+## What's New
+
+* HA Alpha2
+* Deployments Alpha
+    * Linux packages provide systemd services for controller and router. Both depend on existing package `openziti` which provides the `ziti` command line tool.
+        * `openziti-controller` provides `ziti-controller.service`
+        * `openziti-router` provides `ziti-router.service`
+    * Container images for controller and router now share the bootstrapping logic with the packages, so they
+      support the same configuration options.
+
+## HA Alpha2
+
+This release can be run in HA mode. The code is still alpha, so there are still some bugs and missing features,
+however basic functionality work with the exceptions noted. See the [HA Documementation](https://github.com/openziti/ziti/tree/release-next/doc/ha)
+for instructions on setting up an HA cluster.
+
+### Known Issues
+
+* JWT Session exchange isn't working with Go SDK clients
+    * This means Go clients will need to be restarted once their sessions expire
+* Service/service policy changes might not be reflected in routers
+    * Changes to policy may not yet properly sync to the routers, causing unexpected behavior with ER/Ts running in HA mode
+
+More information can be found on the [HA Project Board](https://github.com/orgs/openziti/projects/9/views/1)
+
+## Component Updates and Bug Fixes
+
+* github.com/openziti/edge-api: [v0.26.16 -> v0.26.17](https://github.com/openziti/edge-api/compare/v0.26.16...v0.26.17)
+    * [Issue #107](https://github.com/openziti/edge-api/issues/107) - Add configTypes param to service list
+
+* github.com/openziti/sdk-golang: [v0.23.19 -> v0.23.27](https://github.com/openziti/sdk-golang/compare/v0.23.19...v0.23.27)
+    * [Issue #545](https://github.com/openziti/sdk-golang/issues/545) - Set config types on query when listing services
+    * [Issue #541](https://github.com/openziti/sdk-golang/issues/541) - Token exchange in Go SDK not working
+    * [Issue #540](https://github.com/openziti/sdk-golang/issues/540) - Switch to EdgeRouter.SupportedProtocols from deprecated URLs map
+
+* github.com/openziti/ziti: [v1.0.0 -> v1.1.0](https://github.com/openziti/ziti/compare/v1.0.0...v1.1.0)
+    * [Issue #1952](https://github.com/openziti/ziti/issues/1952) - Remove support for fabric only identities in CLI
+    * [Issue #1950](https://github.com/openziti/ziti/issues/1950) - Add policy type to service policy router events
+    * [Issue #1951](https://github.com/openziti/ziti/issues/1951) - Add more attributes to route data model Identity
+    * [Issue #1942](https://github.com/openziti/ziti/issues/1942) - Rework ER/T intercept code to be sessionless or use JWT sessions
+    * [Issue #1936](https://github.com/openziti/ziti/issues/1936) - SDK Hosted HA sessions are getting removed when they shouldn't be
+    * [Issue #1934](https://github.com/openziti/ziti/issues/1934) - Don't publish binary builds to artifactory
+    * [Issue #1931](https://github.com/openziti/ziti/issues/1931) - "invalid kid: <kid>" randomly occurs in HA mode
+
 # Release 1.0.0
 
 ## About 1.0