0.5.0

CubePod 0.5.0

Features and improvements

• CubePlex cbxref_ zero-trust egress MITM & isolated guest CA injection. Wired cbxref_ credential placeholder exchange and ExchangeURL-triggered TLS MITM into cubepod-egress, split the guest-facing <box>-egress-ca Secret (mitm-ca.crt only, composed into /run/cubepod/ca-certificates.crt by podd-init in Block mode) from <box>-egress-mtls, and added -egress-upstream-ca-file across cubepod-controller, cubepod-gateway, and cubepod-egress for private upstream CAs. See Zero-Trust Egress.
• Longhorn V2 SPDK tuning for Kata Cloud Hypervisor (kata-clh) on EEVDF kernels. Pinned spdk_tgt reactor threads to CPU 1 (v2DataEngineCPUMask: "0x2") in deploy/k8s/longhorn-v2/values.yaml and added a cubepod-spdk-sched-idle systemd timer + 95% per-reactor cpu.max cap in deploy/k8s/longhorn-v2/prep-node.sh so Linux 6.6+/7.0 EEVDF per-CPU kworker/1:* workqueue flushes never stall volume detachments. See Kata & Block Storage.
• podd HTTP Range streaming & gateway empty-phase handling. Added 206 Partial Content Range support for file downloads in crates/podd and preserved empty initial PodBox phases as provisioning in Gateway resolveSandbox.

Fixes

• Egress proxy Host/URL mismatch SSRF hardening (pkg/egress/proxy.go). Enforced matching Host headers, request URL hosts, URL schemes, and TLS SNI across explicit ServeHTTP (GET & CONNECT), TransparentHTTPHandler, and serveMITMTLS before any upstream request or secret exchange occurs.
• Controller status persistence, Fork/Reset rollback, and WarmPool cleanup (pkg/controller/reconciler.go, kubeclient_crd.go). Persisted initial PodBox CRD status via UpsertPodBox on creation, preserved ResetRootFS generation/PVC progress across ensureEgressSecretsLocked and EnsurePod failures, rolled back failed cold creates and ForkFrom claims while preserving deterministic persistent VolumeKey workspace PVCs, deleted failed warm pods before PVCs to prevent kubernetes.io/pvc-protection hangs, stopped retries on deleted PodWarmPool CRs, and sanitized SyncFromKube WarmPool label selectors with SanitizeLabelValue.
• Kata MicroVM RLIMIT_NOFILE clamping (crates/podd). Clamped inherited 1073741824 RLIMIT_NOFILE limits under kata-clh down to 65536 soft / 1048576 hard at podd startup and child command launch to prevent FD-closing CPU spin in guest daemons such as start-stop-daemon.

Before upgrading

No Kubernetes CRD schema fields changed in 0.5.0 (if upgrading from 0.4.0 or earlier, apply CRDs first: kubectl apply -f deploy/helm/cubepod/crds/).

Upgrade gateway, controller, egress, and podd injector images together to v0.5.0 via the Kubernetes & Helm deployment guide, and update client SDKs (pip install -U cubepod==0.5.0 / npm install cubepod@0.5.0). Clusters running Longhorn V2 on Linux 6.6+/7.0 should also re-run deploy/k8s/longhorn-v2/prep-node.sh and apply the updated v2DataEngineCPUMask: "0x2" setting per Kata & Block Storage.

GitHub Release · Full changes since 0.4.2