Releases: openziti/ziti
v1.1.8
Release 1.1.8
What's New
- Bug fixes, enhancements and continuing progress on controller HA
Component Updates and Bug Fixes
-
github.com/openziti/edge-api: v0.26.20 -> v0.26.23
- Issue #120 - Add API for retrieving services referencing a config
- Issue #121 - Add API for retrieving the set of attribute roles used by posture checks
-
github.com/openziti/sdk-golang: v0.23.38 -> v0.23.39
- Issue #596 - SDK should submit selected config types to auth and service list APIs
- Issue #593 - SDK Golang OIDC Get API Session Returns Wrong Value
-
github.com/openziti/storage: v0.2.47 -> v0.3.0
-
github.com/openziti/ziti: v1.1.7 -> v1.1.8
- Issue #2121 - Use router data model for edge router tunnel
- Issue #2245 - Add ability to retrieve a list of services that reference a config
- Issue #2089 - Enhance Management API to list Posture Check Roles
- Issue #2209 -
/edge/v1/external-jwt-signers
needs to be open - Issue #2010 - Add config information to router data model
- Issue #1990 - Implement subscriber model for identity/service events in router
- Issue #2240 - Secondary ext-jwt Auth Policy check incorrectly requires primary ext-jwt auth to be enabled
v1.1.7
v1.1.6
Release 1.1.6
What's New
- Trust Domain Configuration
- Controller HA Beta 2
Trust Domain Configuration
OpenZiti controllers from this release forward will now require a trust domain
to be configured.
High Availability (HA) controllers already have this requirement. HA Controllers configure their trust domain via SPIFFE
ids that are embedded in x509 certificates.
For feature parity, non-HA controllers will now have this same requirement. However, as re-issuing certificates is not
always easily done. To help with the transition, non-HA controllers will have the ability to have their trust domain
sourced from the controller configuration file through the root configuration value trustDomain
. The configuration
field which takes a string that must be URI hostname compatible (see: https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE-ID.md).
If this value is not defined, a trust domain will be generated from the root CA certificate of the controller.
For networks that will be deployed after this change, it is highly suggested that a SPIFFE id is added to certificates.
The ziti pki create ...
tooling supports the --spiffe-id
option to help handle this scenario.
Generated Trust Domain Log Messages
The following log messages are examples of warnings produced when a controller is using a generated trust domain:
WARNING this environment is using a default generated trust domain [spiffe://d561decf63d229d66b07de627dbbde9e93228925],
it is recommended that a trust domain is specified in configuration via URI SANs or the 'trustDomain' field
WARNING this environment is using a default generated trust domain [spiffe://d561decf63d229d66b07de627dbbde9e93228925],
it is recommended that if network components have enrolled that the generated trust domain be added to the
configuration field 'additionalTrustDomains'
Trust domain resolution:
-
Non-HA controllers
- Prefers SPIFFE ids in x509 certificate URI SANs, looking at the leaf up the signing chain
- Regresses to
trustDomain
in the controller configuration file if not found - Regress to generating a trust domain from the server certificates root CA, if the above do not resolve
-
HA Controllers
- Requires x509 SPIFFE ids in x509 certificate URI SANs
Additional Trust Domains
When moving between trust domains (i.e. from the default generated to a new named one), the controller supports having
other trust domains. The trust domains do not replace certificate chain validation, which is still checked and enforced.
Additional trust domains are configured in the controller configuration file under the root field
additionalTrustDomains
. This field is an array of hostname safe strings.
The most common use case for this is field is if a network has issued certificates using the generated trust domain and
now wants to transition to a explicitly defined one.
Controller HA Beta 2
This release can be run in HA mode. The code is still beta, as we're still finding and fixing bugs. Several bugs
have been fixed since Beta 1 and c-based SDKs and tunnelers now work in HA mode. The smoketest can now be run
with HA controllers and clients.
- Latest ZET release supporting HA control: https://github.com/openziti/ziti-tunnel-sdk-c/releases/tag/v2.0.0-alpha9
- Windows, Mac and Mobile clients are in the process of being updated
For more information:
- HA overview/getting started/migration: HA Documentation
- Open Issues: HA Project Board
Component Updates and Bug Fixes
-
github.com/openziti/storage: v0.2.45 -> v0.2.46
- Issue #76 - Add support for non-boltz symbols to the the boltz stores
-
github.com/openziti/ziti: v1.1.5 -> v1.1.6
- Issue #2171 - Routers should consider control channels unresponsive if they are not connected
- Issue #2219 - Add inspection for router connections
- Issue #2195 - cached data model file set to
- Issue #2222 - Add way to get read-only status from cluster nodes
- Issue #2191 - Change raft list cluster members element name from values to data to match rest of REST api
- Issue #785 - ziti edge update service-policy to empty/no posture checks fails
- Issue #2205 - Merge fabric and edge model code
- Issue #2165 - Add network id
v1.1.5
Release 1.1.5
What's New
- Bug fixes
Component Updates and Bug Fixes
-
github.com/openziti/channel/v2: v2.0.133 -> v2.0.136
- Issue #132 - reconnecting dialer doesn't take local binding into account when reconnecting
-
github.com/openziti/identity: v1.0.80 -> v1.0.81
-
github.com/openziti/transport/v2: v2.0.136 -> v2.0.138
- Issue #83 - tls.Dial should use proxy configuration if provided
-
github.com/openziti/xweb/v2: v2.1.0 -> v2.1.1
-
github.com/openziti/ziti: v1.1.4 -> v1.1.5
- Issue #2173 - panic on HA peer connect
- Issue #2171 - Routers should consider control channels unresponsive if they are not connected
- Issue #2086 - Enable File Watching for Router/Controller Identities
- Issue #2087 - Ext JWT not setting provider value in auth query
v1.1.4
Release 1.1.4
What's New
- Bug fixes
- Controller HA Beta 1
Controller HA Beta 1
This release can be run in HA mode. The code is still beta, as we're still finding and fixing bugs. Several bugs
have been fixed since Alpha 3 and c-based SDKs and tunnelers now work in HA mode. The smoketest can now be run
with HA controllers and clients.
- Initial ZET release support HA control: https://github.com/openziti/ziti-tunnel-sdk-c/releases/tag/v2.0.0-alpha1
- Windows, Mac and Mobile clients are in the process of being updated
For more information:
- HA overview/getting started/migration: HA Documementation
- Open Issues: HA Project Board
Component Updates and Bug Fixes
-
github.com/openziti/channel/v2: v2.0.130 -> v2.0.133
-
github.com/openziti/edge-api: v0.26.19 -> v0.26.20
- Issue #113 - RecoveryCodesEnvelope is wrong
-
github.com/openziti/foundation/v2: v2.0.45 -> v2.0.47
- Issue #407 - Remove Branch from build info
-
github.com/openziti/identity: v1.0.77 -> v1.0.80
-
github.com/openziti/metrics: v1.2.54 -> v1.2.56
-
github.com/openziti/runzmd: v1.0.47 -> v1.0.49
-
github.com/openziti/sdk-golang: v0.23.37 -> v0.23.38
- Issue #573 - api session refresh spins in a tight loop if there is no current api session
- Issue #562 - Support sticky dials
-
github.com/openziti/secretstream: v0.1.20 -> v0.1.21
-
github.com/openziti/storage: v0.2.41 -> v0.2.45
-
github.com/openziti/transport/v2: v2.0.133 -> v2.0.136
-
github.com/openziti/ziti: v1.1.3 -> v1.1.4
- Issue #2084 - Bug: Router enrollment is missing its server chain
- Issue #2124 - api session certs should be deleted when related api sessions are deleted
v1.1.3
Release 1.1.3
What's New
- Sticky Terminator Selection
- Linux and Docker deployments log formats no longer default to the simplified format option and now use logging library
defaults:json
for non-interactive,text
for interactive.
NOTE: This release is the first since 1.0.0 to be marked promoted from pre-release. Be sure to check the release notes
for the rest of the post-1.0.0 releases to get the full set of changes.
Stick Terminator Strategy
This release introduces a new terminator selection strategy sticky
. On every dial it will return a token to the
dialer, which represents the terminator used in the dial. This token maybe passed in on subsequent dials. If no token
is passed in, the strategy will work the same as the smartrouting
strategy. If a token is passed in, and the
terminator is still valid, the same terminator will be used for the dial. A terminator will be consideder valid if
it still exists and there are no terminators with a higher precedence.
This is currently only supported in the Go SDK.
Go SDK Example
ziti edge create service test --terminator-strategy sticky
conn := clientContext.Dial("test")
token := conn.Conn.GetStickinessToken()
_ = conn.Close()
dialOptions := &ziti.DialOptions{
ConnectTimeout: time.Second,
StickinessToken: token,
}
conn = clientContext.DialWithOptions("test", dialOptions))
nextToken := conn.Conn.GetStickinessToken()
_ = conn.Close()
Component Updates and Bug Fixes
-
github.com/openziti/channel/v2: v2.0.128 -> v2.0.130
-
github.com/openziti/edge-api: v0.26.18 -> v0.26.19
-
github.com/openziti/foundation/v2: v2.0.42 -> v2.0.45
-
github.com/openziti/identity: v1.0.75 -> v1.0.77
-
github.com/openziti/metrics: v1.2.51 -> v1.2.54
-
github.com/openziti/runzmd: v1.0.43 -> v1.0.47
-
github.com/openziti/sdk-golang: v0.23.35 -> v0.23.37
- Issue #562 - Support sticky dials
-
github.com/openziti/secretstream: v0.1.19 -> v0.1.20
-
github.com/openziti/storage: v0.2.37 -> v0.2.41
-
github.com/openziti/transport/v2: v2.0.131 -> v2.0.133
-
github.com/openziti/ziti: v1.1.2 -> v1.1.3
- Issue #2064 - Fix panic on link close
- Issue #2062 - Link connection retry delays should contain some randomization
- Issue #2055 - Controller panics on 'ziti agent cluster list'
- Issue #2019 - Support mechanism for sticky dials
v1.1.2
Release 1.1.2
What's New
- Bug fixes and minor enhancements
Component Updates and Bug Fixes
- github.com/openziti/sdk-golang: v0.23.32 -> v0.23.35
- github.com/openziti/ziti: v1.1.1 -> v1.1.2
- Issue #2032 - Auto CA Enrollment Fails w/ 400 Bad Request
- Issue #2026 - Root Version Endpoint Handling 404s
- Issue #2002 - JWKS endpoints may not refresh on new KID
- Issue #2007 - Identities for edge routers with tunneling enabled sometimes show hasEdgeRouterConnection=false even though everything is OK
- Issue #1983 - delete of non-existent entity causes panic when run on follower controller
v0.34.3
This is a re-release of v1.0.0 to address a bug in the autonomous docker image, which doesn't correct handle changes to the major version.
v1.1.1
Release 1.1.1
What's New
- HA Alpha-3
- Bug fixes and minor enhancements
HA Alpha 3
This release can be run in HA mode. The code is still alpha, as we're still finding and fixing bugs.
For more information:
- HA overview/getting started/migration: HA Documementation
- Open Issues: HA Project Board
New Contributors
Thanks to new contributors
Component Updates and Bug Fixes
-
github.com/openziti/edge-api: v0.26.17 -> v0.26.18
-
github.com/openziti/sdk-golang: v0.23.27 -> v0.23.32
- Issue #554 - Passing in config types on service list breaks on older controller
-
github.com/openziti/storage: v0.2.36 -> v0.2.37
- Issue #64 - Add support for transaction complete listeners
-
github.com/openziti/ziti: v1.1.0 -> v1.1.1
- Issue #1973 - Raft should not initialize if db is misconfigured
- Issue #1971 - BUG: OIDC authentication does not convert config type names to ids
- Issue #1966 - Handle multi-entity updates in router data model
- Issue #1772 - provide a better error when the user is not logged in
- Issue #1964 - Add API Session Token Update Messaging
- Issue #1960 - JWT Session exchange isn't working
- Issue #1962 - permissions enum doesn't contain "Invalid"
v1.1.0
Release 1.1.0
What's New
- HA Alpha2
- Deployments Alpha
- Linux packages provide systemd services for controller and router. Both depend on existing package
openziti
which provides theziti
command line tool.openziti-controller
providesziti-controller.service
openziti-router
providesziti-router.service
- Container images for controller and router now share the bootstrapping logic with the packages, so they
support the same configuration options.
- Linux packages provide systemd services for controller and router. Both depend on existing package
HA Alpha2
This release can be run in HA mode. The code is still alpha, so there are still some bugs and missing features,
however basic functionality work with the exceptions noted. See the HA Documementation
for instructions on setting up an HA cluster.
Known Issues
- JWT Session exchange isn't working with Go SDK clients
- This means Go clients will need to be restarted once their sessions expire
- Service/service policy changes might not be reflected in routers
- Changes to policy may not yet properly sync to the routers, causing unexpected behavior with ER/Ts running in HA mode
More information can be found on the HA Project Board
Component Updates and Bug Fixes
-
github.com/openziti/edge-api: v0.26.16 -> v0.26.17
- Issue #107 - Add configTypes param to service list
-
github.com/openziti/sdk-golang: v0.23.19 -> v0.23.27
- Issue #545 - Set config types on query when listing services
- Issue #541 - Token exchange in Go SDK not working
- Issue #540 - Switch to EdgeRouter.SupportedProtocols from deprecated URLs map
-
github.com/openziti/ziti: v1.0.0 -> v1.1.0
- Issue #1952 - Remove support for fabric only identities in CLI
- Issue #1950 - Add policy type to service policy router events
- Issue #1951 - Add more attributes to route data model Identity
- Issue #1942 - Rework ER/T intercept code to be sessionless or use JWT sessions
- Issue #1936 - SDK Hosted HA sessions are getting removed when they shouldn't be
- Issue #1934 - Don't publish binary builds to artifactory
- Issue #1931 - "invalid kid: " randomly occurs in HA mode