v1.13.0

6 min read

Release Notes

These release notes describe all changes since the previous minor release, v1.12.0, not since the most recent 1.12.x patch. Some of the fixes and enhancements listed below were also delivered in the intervening v1.12.x patch releases, and are repeated here to provide a complete record of what changed between 1.12.0 and 1.13.0.

New Features & Enhancements

Kubernetes

  • The Edera Helm chart now includes the DRA kubelet plugin, admission webhook, and controller, and requires cert-manager. See Install Edera.
  • Added a first-party DRA and device-plugin driver for Edera nodes.
  • Added an opt-in protect.mode: container Helm setting that runs the Protect core as containers instead of host services. Containerd only.
  • Pods can request a scratch disk with the dev.edera/scratch-disk-size-mib and dev.edera/scratch-disk-mount-path annotations.
  • Zones now take their vCPU count from the pod’s CPU limit, or its CPU request when there is no limit. See Upgrade notes.
  • The containerd shim now packs image root filesystems with mksquashfs and can link packed images from containerd’s content store. Configurable via [oci] external-stores.

Core

  • Added zone export and import: protect-ctl zone export captures a running Xen PVH zone to a file, and protect-ctl zone import restores it on the same or another host. Requires the snapshot-v0 feature flag.
  • KVM zones can now be suspended and resumed.
  • Zones now grow their memory as soon as they report hard or critical memory pressure, instead of waiting for the next balloon adjustment.
  • Zones now use zram swap by default.
  • Xen hosts now run zram swap in dom0 at boot, and can grow dom0 toward a minimum set with EDERA_PROTECT_INSTALLER_DOM0_MEMORY_MIN_MIB before kubelet starts.
  • Added opt-in Landlock sandboxing for Cloud Hypervisor on KVM. Configurable via the [kvm] section of daemon.toml.
  • On KVM, writable host mounts can squash guest file ownership onto a per-zone host identity.
  • Host mounts can now set a cache policy of cached or none with protect-ctl workload launch --mount.
  • Added a certificate capability that issues workload certificates from SPIRE, a static CA, or your own CA through an adapter. Configurable via the [pki] section of daemon.toml.
  • Object capabilities are now always on, and the object-capabilities-v0 feature flag has been removed.
  • The daemon can listen on several addresses at once, and tls:// connections now support client certificates.
  • Updated the NVIDIA and AMD zone kernel variants to kernel 6.18.56, and the NVIDIA driver to 615.78.08.
  • Improved zone launch and image pull performance.

Observability

  • Added the zone_memory_max_bytes metric, and an importing value for the daemon_zones state label. See the metrics reference for details.

Integrations

Installer

  • Added Graviton4 support for Xen and KVM installs.
  • The installer now detects a host that already runs Edera’s Xen and skips the kernel install and reboot. Set EDERA_PROTECT_INSTALLER_INSTALL_KERNEL=false to skip it unconditionally.
  • Added bottlerocket-hostctr to the release artifacts.

Tools

  • Added protect-ctl zone port-forward, protect-ctl image prune, and the -o quiet output format, and made protect-ctl zone vcpu-list available in release builds. See the CLI reference.
  • protect-ctl shell completion now completes zone and workload names.

Bug Fixes

Kubernetes

  • Fixed inbound traffic not reaching workloads when the CNI’s ipvlan mode is L3s.
  • Fixed image references in the tag@digest form resolving by tag instead of digest.
  • Fixed image pulls under CRI-O.
  • Fixed several image assembly issues, including partial files left behind on failure and already-packed images being packed again. Image assembly now writes its scratch files under Edera’s own storage instead of /tmp.
  • Fixed kubelet in-place resizes of Edera containers.
  • Fixed CRI stats for Edera pods.
  • Fixed the zone hostname not being set through the containerd shim.
  • Fixed SPIRE pod annotations being ignored by the containerd shim.
  • Fixed zones not surviving daemon and host-container restarts on Bottlerocket.
  • Fixed a CNI sandbox leak when network namespace cleanup failed.
  • Fixed workloads starting before the zone’s IPv6 address was usable.
  • Various CRI and containerd shim reliability improvements.

Core

  • Fixed a SPIRE agent bootstrap using a stale trust bundle after the SPIRE server’s CA rotated.
  • Several SPIRE reliability fixes.
  • Fixed several issues with workload status reporting, including workloads marked Failed for a nonzero exit code.
  • Fixed several KVM zone teardown and hotplug issues.
  • The daemon now refuses PVH zones on hosts without hardware virtualization, zone memory requests larger than the host, and invalid zone names.
  • Zones now set kernel.pax.softmode=1, so OpenPaX does not enforce by default. Set kernel.pax.softmode=0 in the zone to enforce.
  • Fixed 9P host mounts following symlinks on chmod and opening special files swapped in by the guest.
  • OCI registry redirects and token realms that point at non-public addresses are now refused.
  • Hardened the daemon, xenstored, and Xen backend handling against misbehaving guests.
  • Fixed Edera’s nftables rules depending on the order other host software sets up the firewall.
  • Fixed GPU zone teardown.
  • Improved error messages for failed mounts, image pulls, and zone launches.

Installer

  • Enabled the Xen serial console on bare-metal EC2 hosts.
  • Increased the default dom0 memory ceiling from 8 GiB to 16 GiB.
  • Fixed EC2 network-card units claiming zone interfaces on Xen hosts.

Tools

  • protect-ctl image list now shows the upstream image’s source digest alongside the local one.
  • protect-ctl zone destroy now reports when it matched no zone.

Known Issues

KVM support

  • NUMA support is not enabled.
  • Memory ballooning is not supported.

Upgrade notes

The following changes in this release can break existing deployments when upgrading from the previous minor or patch release.

In-zone Control API removed

The control-api-idm-v0 feature flag and protect-ctl zone launch --control-api-access have been removed. Expose what a zone needs as an object capability instead.

Plaintext TCP limited to loopback

The daemon now refuses to start with a tcp:// listener on a non-loopback address. Use a tls:// listener for remote access.

Pod CPU limits set zone vCPUs

Zones previously got 2 vCPUs unless the pod set the dev.edera/cpu annotation. They now take their vCPU count from the pod’s CPU limit, or its CPU request when there is no limit, capped at the host’s CPU count. The dev.edera/cpu annotation still takes precedence.

Object capability dials require consumes

A zone can now dial an object capability only from a running workload whose consumes names that capability.

Last updated on