Skip to content

Releases: openziti/ziti

v0.29.0

13 Jul 16:01
@github-actions github-actions
v0.29.0
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
3ca2dd2
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.29.0

Release 0.29.0

What's New

Deprecated Binary Removal

This release removes the following deprecated binaries from the release archives.

  • ziti-controller - replaced by ziti controller
  • ziti-router - replaced by ziti router
  • ziti-tunnel - replaced by ziti tunnel

The release archives now only contain the ziti executable. This executable is now at the root of the archive instead of nested under a ziti directory.

Ziti CLI Demo Consolidation

The ziti CLI functions under ziti learn, namely ziti learn demo and ziti learn tutorial have been consolidated under ziti demo.

Continued Quickstart Changes

The quickstart continues to evolve. A breaking change has occurred as numerous environment variables used to customize the quickstart
have changed again. A summary of changes is below

  • All ZITI_EDGE_ROUTER_ variables have been changed to just ZITI_ROUTER_.
    • ZITI_EDGE_ROUTER_NAME -> ZITI_ROUTER_NAME
    • ZITI_EDGE_ROUTER_PORT -> ZITI_ROUTER_PORT
    • ZITI_EDGE_ROUTER_ADVERTISED_HOST -> ZITI_ROUTER_ADVERTISED_HOST
    • ZITI_EDGE_ROUTER_IP_OVERRIDE -> ZITI_ROUTER_IP_OVERRIDE
    • ZITI_EDGE_ROUTER_ENROLLMENT_DURATION -> ZITI_ROUTER_ENROLLMENT_DURATION
    • ZITI_EDGE_ROUTER_ADVERTISED_HOST -> ZITI_ROUTER_ADVERTISED_HOST
    • ZITI_EDGE_ROUTER_LISTENER_BIND_PORT -> ZITI_ROUTER_LISTENER_BIND_PORT
  • Additional variables have been added to support "alternative addresses" and "alternative PKI", for example
    to support using Let's Encrypt certificates easily in the quickstarts.
  • New variables were introduced to allow automatic generation of the alt_server_certs section. Both variables
    must be supplied for the variables to impact the configurations.
    • ZITI_PKI_ALT_SERVER_CERT - "Alternative server certificate. Must be specified with ZITI_PKI_ALT_SERVER_KEY"
    • ZITI_PKI_ALT_SERVER_KEY - "Key to use with the alternative server certificate. Must be specified with ZITI_PKI_ALT_SERVER_CERT"
  • New variables were introduced to allow one to override and customize the CSR section of routers which is used during enrollment.
    • ZITI_ROUTER_CSR_C - "The country (C) to use for router CSRs"
    • ZITI_ROUTER_CSR_ST - "The state/province (ST) to use for router CSRs"
    • ZITI_ROUTER_CSR_L - "The locality (L) to use for router CSRs"
    • ZITI_ROUTER_CSR_O - "The organization (O) to use for router CSRs"
    • ZITI_ROUTER_CSR_OU - "The organization unit to use for router CSRs"
    • ZITI_ROUTER_CSR_SANS_DNS - "The DNS name used in the CSR request"
  • New variable ZITI_CTRL_EDGE_BIND_ADDRESS allows controlling the IP the edge API uses

Component Updates and Bug Fixes

Assets 7
Loading

v0.28.4

23 Jun 15:22
@github-actions github-actions
v0.28.4
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
e603c58
This commit was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.28.4

Release 0.28.4

Component Updates and Bug Fixes

  • Restores Ziti Edge Client API as the default handler for /version and as the root handler to support previously enrolled GO SDK clients
Assets 7
Loading

v0.28.3

22 Jun 15:23
@github-actions github-actions
v0.28.3
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
91bccc0
This commit was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.28.3

Release 0.28.3

What's New

Bug fix

Component Updates and Bug Fixes

Assets 7
Loading

v0.28.2

21 Jun 22:10
@github-actions github-actions
v0.28.2
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
53009d9
This commit was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.28.2

Release 0.28.2

What's New

  • IMPORTANT: If you update your OpenZiti binaries to this version or later (which can be done easily with the getZiti() function, you will need to migrate any existing network that has been developed using OpenZiti v0.27.5 or earlier binaries as the new binaries will expect the new environment variable names. A function performMigration() has been provided in the ziti-cli-script.sh for this purpose. Simply source the latest ziti-cli-script.sh, and your current network's .env file, then run performMigration() to update environment variable name references. If the migration process cannot find your existing environment file in the default location, you will need to provide the path to the migration function, ex: performMigration <path-to-environment-file>
  • If you were using the ZITI_HOME environment variable to configure where your ziti CLI profiles were stored, you should now use ZITI_CONFIG_DIR instead.

Component Updates and Bug Fixes

Assets 7
Loading

v0.28.1

09 Jun 20:22
@github-actions github-actions
v0.28.1
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
a3c1f7e
This commit was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.28.1

Release 0.28.1

What's New

  • ziti CLI now trims jwt files specified for login preventing a confusing invalid header field value for "Authorization"
    error when trying to use -e flag

Router Health Check Changes

The link health check on routers now supports an initial delay configuration.


healthChecks:
  linkCheck:
    minLinks: 1
    interval: 30s
    initialDelay: 5s

The health check will also now start with an initial state of unhealthy, unless minLinks is set to zero.

Finally, link checks now include the addresses associated with the links:

    {
        "details": [
            {
                "linkId": "6a72EtnLib5nUvjhVLuHOb",
                "destRouterId": "5uUxuQ3u6Q",
                "latency": 2732886.5,
                "addresses": {
                    "ack": {
                        "localAddr": "tcp:127.0.0.1:4023",
                        "remoteAddr": "tcp:127.0.0.1:33520"
                    },
                    "payload": {
                        "localAddr": "tcp:127.0.0.1:4023",
                        "remoteAddr": "tcp:127.0.0.1:33504"
                    }
                }
            }
        ],
        "healthy": true,
        "id": "link.health",
        "lastCheckDuration": "53.213µs",
        "lastCheckTime": "2023-06-01T18:35:11Z"
    }

Event Changes

AMQP Event Writer Changes

A new field is available to the AMQP Event Writer. bufferSize denotes how many messages ziti will hold during AMQP connection outages. Any messages exceeding this limit will be logged and dropped.

Example configuration:

events:
  jsonLogger:
    subscriptions:
      - type: fabric.circuits
    handler:
      type: amqp
      format: json
      url: "amqp://localhost:5672" 
      queue: ziti
      durable: true      //default:true
      autoDelete: false  //default:false
      exclusive: false   //default:false
      noWait: false      //default:false
      bufferSize: 50     //default:50

Component Updates and Bug Fixes

Assets 7
Loading

v0.28.0

26 May 18:29
@github-actions github-actions
v0.28.0
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
64a46e4
This commit was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.28.0

Release 0.28.0

What's New

  • Event changes
    • Added AMQP event writter for events
    • Add entity change events for auditing or external integration
    • Add usage event filtering
    • Add annotations to circuit events
  • CLI additions for ziti to login with certificates or external-jwt-signers
  • NOTE: ziti edge login flag changes:
    • -c flag has been changed to map to --client-cert
    • --cert is now --ca and has no short flag representation
    • -e/--ext-jwt allows a user to supply a file containing a jwt used with ext-jwt-signers to login
    • -c/--client-cert allows a certificate to be supplied to login (used with -k/--client-key)
    • -k/--client-key allows a key to be supplied to login (used with -c/--client-cert)
  • Config type changes
    • address fields in intercept.v1, host.v1, and host.v2 config types now permit hostnames with underscores.
  • Edge Router/Tunneler now supports setting default UDP idle timeout/check interval

Event Changes

AMPQ Event Writer

Previously events could only be emitted to a file. They can now also be emitted to an AMQP endpoint.

Example configuration:

events:
  jsonLogger:
    subscriptions:
      - type: fabric.circuits
    handler:
      type: amqp
      format: json
      url: "amqp://localhost:5672" 
      queue: ziti
      durable: true      //default:true
      autoDelete: false  //default:false
      exclusive: false   //default:false
      noWait: false      //default:false

Entity Change Events

OpenZiti can now be configured to emit entity change events. These events describe the changes when entities stored in the
bbolt database are created, updated or deleted.

Note that events are emitted during the transaction. They are emitted at the end, so it's unlikely, but possible that an event will be emitted for a change which is rolled back. For this reason a following event will emitted when the change is committed. If a system crashes after commit, but before the committed event can be emitted, it will be emitted on the next startup.

Example configuration:

events:
  jsonLogger:
    subscriptions:
      - type: entityChange
        include:
          - services
          - identities
    handler:
      type: file
      format: json
      path: /tmp/ziti-events.log

See the related issue for discussion: openziti/fabric#562

Example output:

{
  "namespace": "entityChange",
  "eventId": "326faf6c-8123-42ae-9ed8-6fd9560eb567",
  "eventType": "created",
  "timestamp": "2023-05-11T21:41:47.128588927-04:00",
  "metadata": {
    "author": {
      "type": "identity",
      "id": "ji2Rt8KJ4",
      "name": "Default Admin"
    },
    "source": {
      "type": "rest",
      "auth": "edge",
      "localAddr": "localhost:1280",
      "remoteAddr": "127.0.0.1:37578",
      "method": "POST"
    },
    "version": "v0.0.0"
  },
  "entityType": "services",
  "isParentEvent": false,
  "initialState": null,
  "finalState": {
    "id": "6S0bCGWb6yrAutXwSQaLiv",
    "createdAt": "2023-05-12T01:41:47.128138887Z",
    "updatedAt": "2023-05-12T01:41:47.128138887Z",
    "tags": {},
    "isSystem": false,
    "name": "test",
    "terminatorStrategy": "smartrouting",
    "roleAttributes": [
      "goodbye",
      "hello"
    ],
    "configs": null,
    "encryptionRequired": true
  }
}

{
  "namespace": "entityChange",
  "eventId": "326faf6c-8123-42ae-9ed8-6fd9560eb567",
  "eventType": "committed",
  "timestamp": "2023-05-11T21:41:47.129235443-04:00"
}

Usage Event Filtering

Usage events, version 3, can now be filtered based on type.

The valid types include:

  • ingress.rx
  • ingress.tx
  • egress.rx
  • egress.tx
  • fabric.rx
  • fabric.tx

Example configuration:

events:
  jsonLogger:
    subscriptions:
      - type: fabric.usage
        version: 3
        include:
          - ingress.rx
          - egress.rx

Circuit Event Annotations

Circuit events initiated from the edge are now annotated with clientId, hostId and serviceId, to match usage events. The client and host ids are identity ids.

Example output:

 {
  "namespace": "fabric.circuits",
  "version": 2,
  "event_type": "created",
  "circuit_id": "0CEjWYiw6",
  "timestamp": "2023-05-05T11:44:03.242399585-04:00",
  "client_id": "clhaq7u7600o4ucgdpxy9i4t1",
  "service_id": "QARLLTKjqfLZytmSsIqba",
  "terminator_id": "7ddcd421-2b00-4b49-9ac0-8c78fe388c30",
  "instance_id": "",
  "creation_timespan": 1014280,
  "path": {
    "nodes": [
      "U7OwPtfjg",
      "a4rC9DrZ3"
    ],
    "links": [
      "7Ru3hoxsssZzUNOyvd8Jcb"
    ],
    "ingress_id": "K9lD",
    "egress_id": "rQLK",
    "initiator_local_addr": "100.64.0.1:1234",
    "initiator_remote_addr": "100.64.0.1:37640",
    "terminator_local_addr": "127.0.0.1:45566",
    "terminator_remote_addr": "127.0.0.1:1234"
  },
  "link_count": 1,
  "path_cost": 392151,
  "tags": {
    "clientId": "U7OwPtfjg",
    "hostId": "a4rC9DrZ3",
    "serviceId": "QARLLTKjqfLZytmSsIqba"
  }
}

ER/T UDP Settings

The edge router tunneler now allows configuring a timeout and check interval for tproxy UDP intercepts. By default intercepted UDP
connections will be closed after five minutes of no traffic, checking every thirty seconds. The configuration is done in the router
config file, in the options for the tunnel module. Note that these configuration options only apply to tproxy intercepts, not to
proxy or host side UDP connections.

Example configuration:

listeners:
  - binding: tunnel
    options:
      mode: tproxy
      udpIdleTimeout: 10s
      udpCheckInterval: 5s

Component Updates and Bug Fixes

Read more
Assets 7
Loading

v0.27.9

12 Apr 18:34
@github-actions github-actions
v0.27.9
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
5739c54
This commit was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.27.9

Release 0.27.9

What's New

  • Refactored the websocket transport to fix a concurrency issue
  • v0.27.6 changed delete behaviors to error if the entity was not found. This release reverts that behavior.

Component Updates and Bug Fixes

Assets 7
Loading

v0.27.8

06 Apr 14:12
@github-actions github-actions
v0.27.8
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
c0d3368
This commit was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.27.8

Release 0.27.8

What's New

  • CLI additions for auth policies and external JWT signers
  • Performance improvements for listing services

Component Updates and Bug Fixes

Assets 7
Loading

v0.27.7

30 Mar 14:05
@github-actions github-actions
v0.27.7
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
0e4eb56
This commit was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.27.7

Release 0.27.7

What's New

  • This release updates the build to use Go 1.20
Assets 7
Loading

v0.27.6

29 Mar 14:06
@github-actions github-actions
v0.27.6
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
9e11c91
This commit was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.27.6

Release 0.27.6

What's New

  • Makes inspect CLI more discoverable by adding subcommands for inspectable values
  • Adds new inspection allowing configs to be retrieved: ziti fabric inspect config
  • Many improvements to edge-router/tunneler hosting performance with large numbers of hosted services
    • Routers should no longer overwhelm controller while setting up or reestablishing hosting
  • Adds ability to disable router
  • Adds CLI command to compact offline bbolt database: ziti ops db compact <src> <dst>
  • Adds CLI command to re-enroll edge routers: ziti edge re-enroll edge-router
  • Routers can now be disabled. Connections to the controller from disabled routers will be rejected.
    • Disable with: ziti fabric update router <router-id> --disabled
    • Enable with: ziti fabric update router <router-id> --disabled=false

Component Updates and Bug Fixes

Assets 7
Loading