Skip to content

Releases: openziti/ziti

v0.33.0

12 Mar 21:38
@github-actions github-actions
v0.33.0
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Verified
Learn about vigilant mode.
21b29f0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.33.0

Release 0.33.0

What's New

  • SDK Terminator stability improvements
  • Minor feature updates and bug fixes

SDK Terminator stability improvements

This release was focused on creating a chaos test for SDK terminators, running it and fixing any issues found.
The test repeatedly and randomly restarts the controller, routers and tunnelers then verifies that terminators
end up in the correct state.

The following tools were also used/added to aid in diagnosing and fixing issues:

  • ziti fabric validate router-sdk-terminators
    • Compares the controller state with the router state
  • ziti fabric validate terminators
    • Checks each selected terminator to ensure it's still valid on the router and/or sdk
  • ziti fabric inspect sdk-terminators
    • Allows inspecting each routers terminator state
  • ziti fabric inspect router-messaging
    • Allows inspecting what the controller has queued for router state sync and terminator validations
  • ziti edge validate service-hosting
    • Shows how many terminators each identity which can host a service has

Several changes were made to the terminator code to ensure that terminators are properly created and cleaned up.
The routers now use an adaptive rate limiter to control how fast they send terminator related requests to the
controller. For this to work properly, the rate limiting on the controller must be enabled, so it can report
back to the routers when it's got too much work.

Component Updates and Bug Fixes

  • github.com/openziti/edge-api: v0.26.10 -> v0.26.12
  • github.com/openziti/ziti: v0.32.2 -> v0.33.0
    • Issue #1815 - Panic if api session sync failed handler is called twice in the router
    • Issue #1794 - Add SDK terminator chaos test and fix any bugs found as part of chaos testing
    • Issue #1781 - Improve performance when adding intercepted services
    • Issue #1369 - Allow filtering by policy type when listing identities for service or services for identity
    • Issue #1791 - route dial isn't checking for network timeouts correctly
    • Issue #1204 - ziti cli identity tags related flags misbehaving
    • Issue #987 - "ziti create config router edge" doesn't know about --tunnelerMode proxy
    • Issue #652 - Update CLI script M1 Support when github actions allows
Assets 8
Loading

v0.32.2

10 Feb 05:58
@github-actions github-actions
v0.32.2
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Verified
Learn about vigilant mode.
7c53aa0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.32.2 Pre-release
Pre-release

NOTE: This release has an incompatibility with the latest c-based tunnelers, which will cause hosting services to fail.

Release 0.32.2

What's New

  • Terminator performance improvements
  • API Rate Limiter enabled by default

Component Updates and Bug Fixes

Assets 7
Loading

v0.32.1

31 Jan 20:47
@github-actions github-actions
v0.32.1
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Verified
Learn about vigilant mode.
1cfa0b1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.32.1 Pre-release
Pre-release

Do not use, the release contains a deadlock which can be triggered if many SDK terminators are being created at a time.

Release 0.32.1

What's New

  • Bugfixes
  • New router setting to control startup timeout

Router startup timeout

The router now has a configuration setting to control how long it wait on startup to be able to
connect to a controller, before it gives up and exits.

ctrl:
  endpoints: 
    - tls:localhost:1280
  startupTimeout: 5m

Component Updates and Bug Fixes

Assets 7
Loading

v0.32.0

19 Jan 23:45
@github-actions github-actions
v0.32.0
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Verified
Learn about vigilant mode.
97e9244
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.32.0 Pre-release
Pre-release

NOTE: This release has bugs related to link management and is not recommended for production use!

Release 0.32.0

What's New

  • Auth Rate Limiter
  • Link Management Fixes
  • ziti edge quickstart command deprecates redundant --already-initialized flag. The identical behavior is implied by --home.

Backwards compatibility

This release includes new response types from the REST authentication APIS. They are now able to return
429 (server too busy) responses to auth requests. As this is an API change, the version number is
being bumped to 0.32.

If controller and router are both v0.32 or later, only the router which dialed a link will report it to the controller.
If the controller is older, newer routers will report links from both the dialing and listening side of the link.

Auth Rate Limiter

In order to prevent clients from overwhelming the server with auth requests, an auth rate limiter has been introduced.
The rate limiter is adaptive, in that it will react to auth attempts timing out by shrinking the number of allowed
queued auth attempts. The number will slowly recover over time.

Example configuration:

edge:
  # This section allows configurating the rate limiter for auth attempts
  authRateLimiter:
    # if disabled, no auth rate limiting with be enforced
    enabled: true
    # the smallest window size for auth attempts
    minSize: 5
    # the largest allowed window size for auth attempts
    maxSize: 250

New metrics:

  • auth.limiter.queued_count - current number of queued auth attempts
  • auth.limiter.window_size - current size at which new auth attempts will be rejected
  • auth.limiter.work_timer - tracks the rate at which api sessions are being created and how long it's taking to create them

Link Management Fixes

With long lived link ids, there was potential for link control message to be ambiguous, as the link id wasn't enough to identify
a specific iteration of that link. An iteration field has been added to links so that messaging is unambiguous.
Links will also only be reported from the dialing router now to reduce ambiguouity and race condition in link control channel
messaging.

Router SSL Handshake Timeout Config

There is a new router config setting which allows setting the SSL handshake timeout for TLS connections, when using ALPN for listeners.

tls:
  handshakeTimeout: 15s

Component Updates and Bug Fixes

Assets 7
Loading

v0.31.4

18 Dec 16:30
@github-actions github-actions
v0.31.4
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Verified
Learn about vigilant mode.
1c21434
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.31.4

Release 0.31.4

What's New

  • Bug fix for a data flow stall which is especially likely to happen on circuits with single router paths

Thanks

  • @marvkis - for providing high quality debug data which made tracking down a couple of flow control stall issues much easier

Component Updates and Bug Fixes

Contributors

marvkis
Assets 7
Loading

v0.31.3

13 Dec 19:45
@github-actions github-actions
v0.31.3
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Verified
Learn about vigilant mode.
2ece53e
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.31.3 Pre-release
Pre-release

DO NOT USE THIS RELEASE

This release contains a posture check optimization to speed up service list queries. Unfortunately it also broke posture query support for networks with no posture checks.

The 0.31.4 release reverts the optimization. We'll revisit the optimization in a future release.

Release 0.31.3

What's New

  • Services Max Idle Time
  • Add/Remove Peer and Transfer Leadership via REST

Service Max Idle Time

A max idle time can now be configured on services. The default value of 0 indicates that no maximum will
be enforced. A circuit is considered idle when no traffic is flowing across through the initiating or
terminating router.

ziti edge create service test-service --max-idle-time 5m

Note that the idle time calculation is done on the router, so if max idle time on a service is less
than the configured scan interval on the router, it make take longer than expected for idle circuits
to be removed.

Raft Cluster Management via REST

The controller now allows some Raft cluster management operations to be performed via REST.

NOTE: If your cluster is not bootstrapped yet, the REST API won't be available. These will only work on a bootstrapped cluster!

The following operations are now supported:

  • Add member
  • Remove member
  • Transfer leadership
ziti fabric raft add-member tls:localhost:6363
ziti fabric raft add-member tls:localhost:6464
ziti fabric raft transfer-leadership 
ziti fabric raft transfer-leadership ctrl3
ziti fabric raft remove-member ctrl2
ziti fabric raft remove-member ctrl3

Component Updates and Bug Fixes

Assets 7
Loading

v0.31.2

07 Dec 19:59
@github-actions github-actions
v0.31.2
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Verified
Learn about vigilant mode.
7095b90
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.31.2

Release 0.31.2

What's New

  • Go version updated from 1.20 to 1.21
Assets 7
Loading

v0.31.1

07 Dec 18:11
@github-actions github-actions
v0.31.1
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Verified
Learn about vigilant mode.
9ea976c
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.31.1

Release 0.31.1

What's New

  • SDK Hosting Improvements
  • Terminator validation utility
  • Circuit/Link query support

SDK Hosting Improvments

In previous versions of OpenZiti, if many SDK clients were attempting to establish hosting, the controller could get overwhelmed.
In this release, routers will use the rate limiter pool introduced in 0.27.6 when creating terminators on behalf of sdk clients
hosting applications. Additionally, routers now have the ability to verify terminator state with the sdk, if the sdk supports it.
In general, hosting large numbers of services using the sdk should now be less suceptible to thundering herd issues.

Manual Terminator Validation

There is a new CLI command available to validate terminator state. This is primarily a developer tool to validate that terminator
setup logic is correct. However it may also be used to diagnose and resolve issues with production systems, should the need arise.

ziti fabric validate terminators

Circuit/Link Query Support

Previously listing circuit and links always showed the full list. This is because these types are in memory only and are not stored
in the bbolt datastore. There's now basic support for querying in-memory types and circuits and links can now be filtered/paged/sorted
the same as other entity types.

Component Updates and Bug Fixes

Assets 7
Loading

v0.31.0

01 Nov 18:03
@github-actions github-actions
v0.31.0
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Verified
Learn about vigilant mode.
5237e2b
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.31.0

Release 0.31.0

What's New

  • Rate limited for model changes

Rate Limiter for Model Changes

To prevent the controller from being overwhelmed by a flood of changes, a rate limiter
can be enabled in the configuration file. A maximum number of queued changes can also
be configured. The rate limited is disabled by default for now. If not specified the
default number of queued changes is 100.

When the rate limit is hit, an error will be returned. If the request came in from
the REST API, the response will use HTTP status code 429 (too many requests).

The OpenAPI specs have been updated, so if you're using a generated client to make
REST calls, it's recommened that you regenerate your client.

commandRateLimiter:
    enabled:   true
    maxQueued: 100

If the rate limiter is enabled, the following metrics will be produced:

  • command.limiter.queued_count - guage of the current number of queued operations
  • command.limiter.work_timer - timer for operations. Includes the following:
    • A histogram of how long operations take to complete
    • A meter showing that rate at which operations are executed
    • A count of how many operations have been executed

Component Updates and Bug Fixes

Assets 7
Loading

v0.30.5

13 Oct 20:31
@github-actions github-actions
v0.30.5
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Verified
Learn about vigilant mode.
4f324bd
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.30.5

Release 0.30.5

What's New

  • Initial proxy support in host.v1/host.v2

Proxy Support in host.v1/host.v2

host.v1 and host.v2 configurations may now specify a proxy to use.
Currently only HTTP Connect proxies which don't require authentication are supported.

Example using host.v1

{
"address": "192.168.2.50",
"port": 1234,
"protocol": "tcp",
"proxy": {
"address": "192.168.1.110:3128",
"type": "http"
}
}

Component Updates and Bug Fixes

Assets 7
Loading