@serve.zone/appstore 32.4.0 → 32.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/apps/cloudly/app.json +2 -2
- package/apps/cloudly/versions/1.5.0/config.json +173 -0
- package/apps/cloudly/versions/1.6.0/config.json +173 -0
- package/appstore.json +1 -1
- package/changelog.md +24 -0
- package/dist_ts_client/data.generated.js +352 -4
- package/package.json +2 -2
- package/readme.md +2 -2
- package/ts_client/data.generated.ts +351 -3
package/apps/cloudly/app.json
CHANGED
|
@@ -4,8 +4,8 @@
|
|
|
4
4
|
"description": "Multi-node serve.zone control plane for clusters, workload services, domains, and deployments.",
|
|
5
5
|
"category": "Dev Tools",
|
|
6
6
|
"iconName": "server",
|
|
7
|
-
"latestVersion": "1.
|
|
8
|
-
"versions": ["1.0.0", "1.1.0", "1.1.1", "1.1.2", "1.1.3", "1.1.4", "1.1.5", "1.1.6", "1.1.7", "1.1.8", "1.1.9", "1.1.10", "1.2.0", "1.2.1", "1.3.0", "1.4.0"],
|
|
7
|
+
"latestVersion": "1.6.0",
|
|
8
|
+
"versions": ["1.0.0", "1.1.0", "1.1.1", "1.1.2", "1.1.3", "1.1.4", "1.1.5", "1.1.6", "1.1.7", "1.1.8", "1.1.9", "1.1.10", "1.2.0", "1.2.1", "1.3.0", "1.4.0", "1.5.0", "1.6.0"],
|
|
9
9
|
"maintainer": "serve.zone",
|
|
10
10
|
"links": {
|
|
11
11
|
"Source": "https://code.foss.global/serve.zone/cloudly",
|
|
@@ -0,0 +1,173 @@
|
|
|
1
|
+
{
|
|
2
|
+
"image": "code.foss.global/serve.zone/cloudly@sha256:11bc9a39011c1fa21bf621067e0ff6d4c2fe8cb0306745eca825db13285ae756",
|
|
3
|
+
"targetPorts": [
|
|
4
|
+
{
|
|
5
|
+
"name": "web",
|
|
6
|
+
"port": 3000,
|
|
7
|
+
"protocol": "http",
|
|
8
|
+
"default": true
|
|
9
|
+
}
|
|
10
|
+
],
|
|
11
|
+
"envVars": [
|
|
12
|
+
{
|
|
13
|
+
"key": "SERVEZONE_ENVIRONMENT",
|
|
14
|
+
"value": "production",
|
|
15
|
+
"description": "Cloudly runtime environment.",
|
|
16
|
+
"required": true
|
|
17
|
+
},
|
|
18
|
+
{
|
|
19
|
+
"key": "SERVEZONE_PUBLIC_ORIGIN",
|
|
20
|
+
"value": "https://${SERVICE_DOMAIN}",
|
|
21
|
+
"description": "Canonical public Cloudly origin including protocol and optional public port.",
|
|
22
|
+
"required": true
|
|
23
|
+
},
|
|
24
|
+
{
|
|
25
|
+
"key": "SERVEZONE_LISTENPORT",
|
|
26
|
+
"value": "3000",
|
|
27
|
+
"description": "Internal Cloudly HTTP port inside the container.",
|
|
28
|
+
"required": true
|
|
29
|
+
},
|
|
30
|
+
{
|
|
31
|
+
"key": "SERVEZONE_SSLMODE",
|
|
32
|
+
"value": "external",
|
|
33
|
+
"description": "Use external TLS termination through Onebox or dcrouter.",
|
|
34
|
+
"required": true
|
|
35
|
+
},
|
|
36
|
+
{
|
|
37
|
+
"key": "SERVEZONE_SECRET_KEYRING_PATH",
|
|
38
|
+
"value": "/run/secrets/cloudly-secrets-v2-keyring.json",
|
|
39
|
+
"description": "Path to the Cloudly Secrets v2 keyring mounted by Onebox; the keyring value is never placed in the public environment.",
|
|
40
|
+
"required": true
|
|
41
|
+
},
|
|
42
|
+
{
|
|
43
|
+
"key": "SERVEZONE_SECRET_KEYRING_FILE",
|
|
44
|
+
"description": "Existing Cloudly Secrets v2 keyring. Onebox stores it encrypted and mounts it only as a root-readable file; retain the existing keyring when upgrading.",
|
|
45
|
+
"required": true,
|
|
46
|
+
"secret": true,
|
|
47
|
+
"delivery": {
|
|
48
|
+
"type": "file",
|
|
49
|
+
"targetPath": "/run/secrets/cloudly-secrets-v2-keyring.json",
|
|
50
|
+
"uid": 0,
|
|
51
|
+
"gid": 0,
|
|
52
|
+
"mode": 256
|
|
53
|
+
}
|
|
54
|
+
},
|
|
55
|
+
{
|
|
56
|
+
"key": "SERVEZONE_WORKLOADINIT_APPROVAL_PATH",
|
|
57
|
+
"value": "/run/secrets/cloudly-workloadinit-approval.json",
|
|
58
|
+
"description": "Private WorkloadInit release-approval artifact mounted by Onebox for Coreflow secret-runtime registration.",
|
|
59
|
+
"required": true
|
|
60
|
+
},
|
|
61
|
+
{
|
|
62
|
+
"key": "SERVEZONE_WORKLOADINIT_APPROVAL_FILE",
|
|
63
|
+
"description": "Operator-approved WorkloadInit release authority. Onebox stores it encrypted and mounts it only as a root-readable file.",
|
|
64
|
+
"required": true,
|
|
65
|
+
"secret": true,
|
|
66
|
+
"delivery": {
|
|
67
|
+
"type": "file",
|
|
68
|
+
"targetPath": "/run/secrets/cloudly-workloadinit-approval.json",
|
|
69
|
+
"uid": 0,
|
|
70
|
+
"gid": 0,
|
|
71
|
+
"mode": 256
|
|
72
|
+
}
|
|
73
|
+
},
|
|
74
|
+
{
|
|
75
|
+
"key": "MONGODB_URL",
|
|
76
|
+
"value": "${MONGODB_URI}",
|
|
77
|
+
"description": "Authenticated MongoDB wire-protocol URL provisioned by Onebox Corestore.",
|
|
78
|
+
"required": true
|
|
79
|
+
},
|
|
80
|
+
{
|
|
81
|
+
"key": "MONGODB_NAME",
|
|
82
|
+
"value": "${MONGODB_DATABASE}",
|
|
83
|
+
"description": "MongoDB wire-protocol database name provisioned by Onebox Corestore.",
|
|
84
|
+
"required": true
|
|
85
|
+
},
|
|
86
|
+
{
|
|
87
|
+
"key": "MONGODB_USER",
|
|
88
|
+
"value": "${MONGODB_USERNAME}",
|
|
89
|
+
"description": "MongoDB wire-protocol username provisioned by Onebox Corestore.",
|
|
90
|
+
"required": true
|
|
91
|
+
},
|
|
92
|
+
{
|
|
93
|
+
"key": "MONGODB_PASS",
|
|
94
|
+
"value": "${MONGODB_PASSWORD}",
|
|
95
|
+
"description": "MongoDB wire-protocol password provisioned by Onebox Corestore.",
|
|
96
|
+
"required": true
|
|
97
|
+
},
|
|
98
|
+
{
|
|
99
|
+
"key": "S3_ENDPOINT",
|
|
100
|
+
"value": "onebox-corestore",
|
|
101
|
+
"description": "S3 endpoint host provisioned by Onebox Corestore.",
|
|
102
|
+
"required": true
|
|
103
|
+
},
|
|
104
|
+
{
|
|
105
|
+
"key": "S3_PORT",
|
|
106
|
+
"value": "9000",
|
|
107
|
+
"description": "S3 endpoint port provisioned by Onebox Corestore.",
|
|
108
|
+
"required": true
|
|
109
|
+
},
|
|
110
|
+
{
|
|
111
|
+
"key": "S3_USESSL",
|
|
112
|
+
"value": "false",
|
|
113
|
+
"description": "Use plain HTTP for internal Corestore S3 traffic on the Onebox network.",
|
|
114
|
+
"required": true
|
|
115
|
+
},
|
|
116
|
+
{
|
|
117
|
+
"key": "S3_BUCKET",
|
|
118
|
+
"value": "${S3_BUCKET}",
|
|
119
|
+
"description": "S3 bucket provisioned by Onebox Corestore for Cloudly's registry.",
|
|
120
|
+
"required": true
|
|
121
|
+
},
|
|
122
|
+
{
|
|
123
|
+
"key": "S3_ACCESSKEY",
|
|
124
|
+
"value": "${S3_ACCESS_KEY}",
|
|
125
|
+
"description": "S3 access key provisioned by Onebox Corestore.",
|
|
126
|
+
"required": true
|
|
127
|
+
},
|
|
128
|
+
{
|
|
129
|
+
"key": "S3_SECRETKEY",
|
|
130
|
+
"value": "${S3_SECRET_KEY}",
|
|
131
|
+
"description": "S3 secret key provisioned by Onebox Corestore.",
|
|
132
|
+
"required": true
|
|
133
|
+
}
|
|
134
|
+
],
|
|
135
|
+
"platformRequirements": {
|
|
136
|
+
"mongodb": true,
|
|
137
|
+
"s3": true
|
|
138
|
+
},
|
|
139
|
+
"platformOidc": {
|
|
140
|
+
"redirectPath": "/auth/oidc/callback",
|
|
141
|
+
"roles": [
|
|
142
|
+
{
|
|
143
|
+
"id": "admin",
|
|
144
|
+
"label": "Administrator",
|
|
145
|
+
"description": "Full Cloudly administration for this hosted instance."
|
|
146
|
+
},
|
|
147
|
+
{
|
|
148
|
+
"id": "user",
|
|
149
|
+
"label": "User",
|
|
150
|
+
"description": "Standard authenticated Cloudly access for this hosted instance."
|
|
151
|
+
}
|
|
152
|
+
],
|
|
153
|
+
"environmentVariables": {
|
|
154
|
+
"issuerUrl": "SERVEZONE_PLATFORM_OIDC_ISSUER",
|
|
155
|
+
"clientId": "SERVEZONE_PLATFORM_OIDC_CLIENT_ID",
|
|
156
|
+
"clientSecret": "SERVEZONE_PLATFORM_OIDC_CLIENT_SECRET",
|
|
157
|
+
"redirectUri": "SERVEZONE_PLATFORM_OIDC_REDIRECT_URI",
|
|
158
|
+
"audience": "SERVEZONE_PLATFORM_OIDC_AUDIENCE"
|
|
159
|
+
},
|
|
160
|
+
"clientAuthenticationMethod": "client_secret_basic"
|
|
161
|
+
},
|
|
162
|
+
"minOneboxVersion": "32.4.0",
|
|
163
|
+
"changelog": "Move Cloudly to 33.2.0, a feature release over 33.1.0: an administrator hands Cloudly a dcrouter admin token once through bootstrapExternalGatewayCredential or servezone gateway bootstrap, from which Cloudly provisions and stores its own gateway-client credential without storing or logging the token; a first enrollment starts with the gateway settings and turns admin-bootstrap-required instead of refusing them for the missing credential; a gateway settings change the held credential cannot carry is staged while the running gateway client keeps serving, until the next bootstrap switches both; a runtime network address plan with a list out of its canonical order is refused plan-unsorted; and a relay naming a node Cloudly does not hold is refused relay-node-unknown. The runtime contract is unchanged from 1.4.0 and requires Onebox 32.4.0. From 1.4.0 there is no data step, as the data version stays 0.21.0: roll out Cloudly 33.2.0 first, then Coreflow 33.2.0, which recognises the relay-node-unknown refusal, and take a verified backup before upgrading. From 1.3.0 there is no data step either, but the per-node database endpoint of Cloudly 33.1.0 applies: roll out Cloudly 33.2.0 first, then Coreflow 33.2.0 (33.1.0 at minimum), then Corestore 33.0.0, and set every node's Corestore database endpoint with setClusterNodeCorestoreDatabaseEndpoint, because a database binding on a node without one is not granted and its service is refused database-endpoint-missing, and existing database bindings answer no credential material until they are granted again for the endpoint. From 1.2.1 or earlier, startup runs the forward-only data migration from 0.20.0 to 0.21.0 through the step retire-cluster-relay-acme, which drops the relay certificate and DNS collections of Cloudly's retired Cloudflare and Let's Encrypt integration and logs every relay name whose A record Cloudly had written at Cloudflare: remove each such record at the provider. A cluster relay then requires a dcrouter that advertises dns.clientRecords and certificates.exactIssuance, SERVEZONE_SSLMODE=letsencrypt is refused (this template keeps external), and the typed API changes as the Breaking Changes of the Cloudly 33.0.0 changelog list; review them, stop Cloudly and take a verified backup before upgrading, because the 32.9 image refuses the migrated data and rollback requires a full restore. The upgrade is marked breaking, migration-required, backup-before-upgrade and manual-review because these flags are read from the target version alone and an upgrade from 1.2.1 or earlier still runs the migration on this image. An installation on 1.1.10 or earlier also runs the 1.2.0 steps first, from 0.10.0, and requires completed Secrets v2 cutover retirement. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files.",
|
|
164
|
+
"breaking": true,
|
|
165
|
+
"requiresManualReview": true,
|
|
166
|
+
"migrationRequired": true,
|
|
167
|
+
"backupBeforeUpgrade": true,
|
|
168
|
+
"healthCheck": {
|
|
169
|
+
"path": "/status",
|
|
170
|
+
"port": 3000,
|
|
171
|
+
"expectedStatus": 200
|
|
172
|
+
}
|
|
173
|
+
}
|
|
@@ -0,0 +1,173 @@
|
|
|
1
|
+
{
|
|
2
|
+
"image": "code.foss.global/serve.zone/cloudly@sha256:fe1d10de09a8dc28f4dcf32b8e2cfed1ca7329b7d1b7405048a6e328afe5f9a6",
|
|
3
|
+
"targetPorts": [
|
|
4
|
+
{
|
|
5
|
+
"name": "web",
|
|
6
|
+
"port": 3000,
|
|
7
|
+
"protocol": "http",
|
|
8
|
+
"default": true
|
|
9
|
+
}
|
|
10
|
+
],
|
|
11
|
+
"envVars": [
|
|
12
|
+
{
|
|
13
|
+
"key": "SERVEZONE_ENVIRONMENT",
|
|
14
|
+
"value": "production",
|
|
15
|
+
"description": "Cloudly runtime environment.",
|
|
16
|
+
"required": true
|
|
17
|
+
},
|
|
18
|
+
{
|
|
19
|
+
"key": "SERVEZONE_PUBLIC_ORIGIN",
|
|
20
|
+
"value": "https://${SERVICE_DOMAIN}",
|
|
21
|
+
"description": "Canonical public Cloudly origin including protocol and optional public port.",
|
|
22
|
+
"required": true
|
|
23
|
+
},
|
|
24
|
+
{
|
|
25
|
+
"key": "SERVEZONE_LISTENPORT",
|
|
26
|
+
"value": "3000",
|
|
27
|
+
"description": "Internal Cloudly HTTP port inside the container.",
|
|
28
|
+
"required": true
|
|
29
|
+
},
|
|
30
|
+
{
|
|
31
|
+
"key": "SERVEZONE_SSLMODE",
|
|
32
|
+
"value": "external",
|
|
33
|
+
"description": "Use external TLS termination through Onebox or dcrouter.",
|
|
34
|
+
"required": true
|
|
35
|
+
},
|
|
36
|
+
{
|
|
37
|
+
"key": "SERVEZONE_SECRET_KEYRING_PATH",
|
|
38
|
+
"value": "/run/secrets/cloudly-secrets-v2-keyring.json",
|
|
39
|
+
"description": "Path to the Cloudly Secrets v2 keyring mounted by Onebox; the keyring value is never placed in the public environment.",
|
|
40
|
+
"required": true
|
|
41
|
+
},
|
|
42
|
+
{
|
|
43
|
+
"key": "SERVEZONE_SECRET_KEYRING_FILE",
|
|
44
|
+
"description": "Existing Cloudly Secrets v2 keyring. Onebox stores it encrypted and mounts it only as a root-readable file; retain the existing keyring when upgrading.",
|
|
45
|
+
"required": true,
|
|
46
|
+
"secret": true,
|
|
47
|
+
"delivery": {
|
|
48
|
+
"type": "file",
|
|
49
|
+
"targetPath": "/run/secrets/cloudly-secrets-v2-keyring.json",
|
|
50
|
+
"uid": 0,
|
|
51
|
+
"gid": 0,
|
|
52
|
+
"mode": 256
|
|
53
|
+
}
|
|
54
|
+
},
|
|
55
|
+
{
|
|
56
|
+
"key": "SERVEZONE_WORKLOADINIT_APPROVAL_PATH",
|
|
57
|
+
"value": "/run/secrets/cloudly-workloadinit-approval.json",
|
|
58
|
+
"description": "Private WorkloadInit release-approval artifact mounted by Onebox for Coreflow secret-runtime registration.",
|
|
59
|
+
"required": true
|
|
60
|
+
},
|
|
61
|
+
{
|
|
62
|
+
"key": "SERVEZONE_WORKLOADINIT_APPROVAL_FILE",
|
|
63
|
+
"description": "Operator-approved WorkloadInit release authority. Onebox stores it encrypted and mounts it only as a root-readable file.",
|
|
64
|
+
"required": true,
|
|
65
|
+
"secret": true,
|
|
66
|
+
"delivery": {
|
|
67
|
+
"type": "file",
|
|
68
|
+
"targetPath": "/run/secrets/cloudly-workloadinit-approval.json",
|
|
69
|
+
"uid": 0,
|
|
70
|
+
"gid": 0,
|
|
71
|
+
"mode": 256
|
|
72
|
+
}
|
|
73
|
+
},
|
|
74
|
+
{
|
|
75
|
+
"key": "MONGODB_URL",
|
|
76
|
+
"value": "${MONGODB_URI}",
|
|
77
|
+
"description": "Authenticated MongoDB wire-protocol URL provisioned by Onebox Corestore.",
|
|
78
|
+
"required": true
|
|
79
|
+
},
|
|
80
|
+
{
|
|
81
|
+
"key": "MONGODB_NAME",
|
|
82
|
+
"value": "${MONGODB_DATABASE}",
|
|
83
|
+
"description": "MongoDB wire-protocol database name provisioned by Onebox Corestore.",
|
|
84
|
+
"required": true
|
|
85
|
+
},
|
|
86
|
+
{
|
|
87
|
+
"key": "MONGODB_USER",
|
|
88
|
+
"value": "${MONGODB_USERNAME}",
|
|
89
|
+
"description": "MongoDB wire-protocol username provisioned by Onebox Corestore.",
|
|
90
|
+
"required": true
|
|
91
|
+
},
|
|
92
|
+
{
|
|
93
|
+
"key": "MONGODB_PASS",
|
|
94
|
+
"value": "${MONGODB_PASSWORD}",
|
|
95
|
+
"description": "MongoDB wire-protocol password provisioned by Onebox Corestore.",
|
|
96
|
+
"required": true
|
|
97
|
+
},
|
|
98
|
+
{
|
|
99
|
+
"key": "S3_ENDPOINT",
|
|
100
|
+
"value": "onebox-corestore",
|
|
101
|
+
"description": "S3 endpoint host provisioned by Onebox Corestore.",
|
|
102
|
+
"required": true
|
|
103
|
+
},
|
|
104
|
+
{
|
|
105
|
+
"key": "S3_PORT",
|
|
106
|
+
"value": "9000",
|
|
107
|
+
"description": "S3 endpoint port provisioned by Onebox Corestore.",
|
|
108
|
+
"required": true
|
|
109
|
+
},
|
|
110
|
+
{
|
|
111
|
+
"key": "S3_USESSL",
|
|
112
|
+
"value": "false",
|
|
113
|
+
"description": "Use plain HTTP for internal Corestore S3 traffic on the Onebox network.",
|
|
114
|
+
"required": true
|
|
115
|
+
},
|
|
116
|
+
{
|
|
117
|
+
"key": "S3_BUCKET",
|
|
118
|
+
"value": "${S3_BUCKET}",
|
|
119
|
+
"description": "S3 bucket provisioned by Onebox Corestore for Cloudly's registry.",
|
|
120
|
+
"required": true
|
|
121
|
+
},
|
|
122
|
+
{
|
|
123
|
+
"key": "S3_ACCESSKEY",
|
|
124
|
+
"value": "${S3_ACCESS_KEY}",
|
|
125
|
+
"description": "S3 access key provisioned by Onebox Corestore.",
|
|
126
|
+
"required": true
|
|
127
|
+
},
|
|
128
|
+
{
|
|
129
|
+
"key": "S3_SECRETKEY",
|
|
130
|
+
"value": "${S3_SECRET_KEY}",
|
|
131
|
+
"description": "S3 secret key provisioned by Onebox Corestore.",
|
|
132
|
+
"required": true
|
|
133
|
+
}
|
|
134
|
+
],
|
|
135
|
+
"platformRequirements": {
|
|
136
|
+
"mongodb": true,
|
|
137
|
+
"s3": true
|
|
138
|
+
},
|
|
139
|
+
"platformOidc": {
|
|
140
|
+
"redirectPath": "/auth/oidc/callback",
|
|
141
|
+
"roles": [
|
|
142
|
+
{
|
|
143
|
+
"id": "admin",
|
|
144
|
+
"label": "Administrator",
|
|
145
|
+
"description": "Full Cloudly administration for this hosted instance."
|
|
146
|
+
},
|
|
147
|
+
{
|
|
148
|
+
"id": "user",
|
|
149
|
+
"label": "User",
|
|
150
|
+
"description": "Standard authenticated Cloudly access for this hosted instance."
|
|
151
|
+
}
|
|
152
|
+
],
|
|
153
|
+
"environmentVariables": {
|
|
154
|
+
"issuerUrl": "SERVEZONE_PLATFORM_OIDC_ISSUER",
|
|
155
|
+
"clientId": "SERVEZONE_PLATFORM_OIDC_CLIENT_ID",
|
|
156
|
+
"clientSecret": "SERVEZONE_PLATFORM_OIDC_CLIENT_SECRET",
|
|
157
|
+
"redirectUri": "SERVEZONE_PLATFORM_OIDC_REDIRECT_URI",
|
|
158
|
+
"audience": "SERVEZONE_PLATFORM_OIDC_AUDIENCE"
|
|
159
|
+
},
|
|
160
|
+
"clientAuthenticationMethod": "client_secret_basic"
|
|
161
|
+
},
|
|
162
|
+
"minOneboxVersion": "32.4.0",
|
|
163
|
+
"changelog": "Move Cloudly to 33.3.0, a feature release over 33.2.0: an administrator sets a service's network egress with setServiceNetworkEgress, which states whether the service's attached workloads reach the public internet and which platform endpoints of the protected authority they reach, and reads it with getServiceNetworkEgress; before this nothing could grant a workload public egress or a platform endpoint. A workload whose enabled database or object-storage binding sits on a node whose Corestore endpoint its network does not select is refused database-endpoint-unselected or objectstorage-endpoint-unselected instead of being started against a connection that stays dark, and an isolated network selects none; a replica already running keeps running while its target reports the refusal, so grant the endpoint through the service's egress before such a workload is placed again. The default runtime spec of a new service probes its process instead of its first TCP target port. The runtime contract is unchanged from 1.5.0 and requires Onebox 32.4.0. From 1.5.0 there is no data step, as the data version stays 0.21.0; take a verified backup before upgrading. From 1.4.0 there is no data step either, but the gateway admin bootstrap of Cloudly 33.2.0 applies: an administrator hands Cloudly a dcrouter admin token once through bootstrapExternalGatewayCredential or servezone gateway bootstrap, from which Cloudly provisions and stores its own gateway-client credential; a first enrollment turns admin-bootstrap-required, a gateway settings change the held credential cannot carry is staged, a runtime network address plan out of its canonical order is refused plan-unsorted, and a relay naming a node Cloudly does not hold is refused relay-node-unknown: roll out Cloudly 33.3.0 first, then Coreflow 33.2.0, which recognises the relay-node-unknown refusal. From 1.3.0 there is no data step either, but the per-node database endpoint of Cloudly 33.1.0 applies: roll out Cloudly 33.3.0 first, then Coreflow 33.2.0 (33.1.0 at minimum), then Corestore 33.0.0, and set every node's Corestore database endpoint with setClusterNodeCorestoreDatabaseEndpoint, because a database binding on a node without one is not granted and its service is refused database-endpoint-missing, and existing database bindings answer no credential material until they are granted again for the endpoint. From 1.2.1 or earlier, startup runs the forward-only data migration from 0.20.0 to 0.21.0 through the step retire-cluster-relay-acme, which drops the relay certificate and DNS collections of Cloudly's retired Cloudflare and Let's Encrypt integration and logs every relay name whose A record Cloudly had written at Cloudflare: remove each such record at the provider. A cluster relay then requires a dcrouter that advertises dns.clientRecords and certificates.exactIssuance, SERVEZONE_SSLMODE=letsencrypt is refused (this template keeps external), and the typed API changes as the Breaking Changes of the Cloudly 33.0.0 changelog list; review them, stop Cloudly and take a verified backup before upgrading, because the 32.9 image refuses the migrated data and rollback requires a full restore. The upgrade is marked breaking, migration-required, backup-before-upgrade and manual-review because these flags are read from the target version alone and an upgrade from 1.2.1 or earlier still runs the migration on this image. An installation on 1.1.10 or earlier also runs the 1.2.0 steps first, from 0.10.0, and requires completed Secrets v2 cutover retirement. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files.",
|
|
164
|
+
"breaking": true,
|
|
165
|
+
"requiresManualReview": true,
|
|
166
|
+
"migrationRequired": true,
|
|
167
|
+
"backupBeforeUpgrade": true,
|
|
168
|
+
"healthCheck": {
|
|
169
|
+
"path": "/status",
|
|
170
|
+
"port": 3000,
|
|
171
|
+
"expectedStatus": 200
|
|
172
|
+
}
|
|
173
|
+
}
|
package/appstore.json
CHANGED
|
@@ -151,7 +151,7 @@
|
|
|
151
151
|
"description": "Multi-node serve.zone control plane for clusters, workload services, domains, and deployments.",
|
|
152
152
|
"category": "Dev Tools",
|
|
153
153
|
"iconName": "server",
|
|
154
|
-
"latestVersion": "1.
|
|
154
|
+
"latestVersion": "1.6.0",
|
|
155
155
|
"tags": ["serve.zone", "control-plane", "clusters", "deployments"]
|
|
156
156
|
},
|
|
157
157
|
{
|
package/changelog.md
CHANGED
|
@@ -1,5 +1,29 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 2026-09-27 - 32.6.0
|
|
4
|
+
|
|
5
|
+
### Features
|
|
6
|
+
|
|
7
|
+
- publish the Cloudly 1.6.0 template for Cloudly 33.3.0 (cloudly)
|
|
8
|
+
- Add Cloudly app version 1.6.0, pinned to the Cloudly 33.3.0 multi-platform image index `code.foss.global/serve.zone/cloudly@sha256:fe1d10de09a8dc28f4dcf32b8e2cfed1ca7329b7d1b7405048a6e328afe5f9a6` (linux/amd64 and linux/arm64), and mark it as the latest catalog version.
|
|
9
|
+
- Keep the 1.5.0 runtime contract and `minOneboxVersion` 32.4.0. Cloudly 33.3.0 changes neither `qenv.yml` nor the Dockerfile and reads no new environment variable, so every start-required variable is still a required template variable and `SERVEZONE_SSLMODE` stays `external`.
|
|
10
|
+
- Mark the upgrade breaking, migration-required, backup-before-upgrade and manual-review. Hosts read these flags from the target version alone, and an installation on 1.2.1 or earlier still runs the forward-only 0.20.0 → 0.21.0 migration of Cloudly 33.0.0 on this image (backup first, full-restore rollback). From 1.4.0 and 1.5.0 there is no data step, as 33.3.0 keeps data version 0.21.0. The template changelog names the administrator's service network egress (`setServiceNetworkEgress`, `getServiceNetworkEgress`), the `database-endpoint-unselected` and `objectstorage-endpoint-unselected` refusals of a workload whose network does not select its binding's Corestore endpoint (a replica already running keeps running), and the process readiness probe of a new service's default runtime spec. For an installation still on 1.4.0 it names the gateway admin bootstrap of Cloudly 33.2.0 and the rollout order Cloudly 33.3.0 before Coreflow 33.2.0, and for 1.3.0 and earlier the per-node Corestore database endpoint and the prerequisites of the 33.0.0 migration, as 1.5.0 did.
|
|
11
|
+
- Update the bundled client data, the README guidance and the resolver regression coverage, which now holds 1.6.0 to the 1.5.0 runtime contract and upgrade flags.
|
|
12
|
+
|
|
13
|
+
### Maintenance
|
|
14
|
+
|
|
15
|
+
- Release tooling: `@git.zone/tstest` 6.3.2.
|
|
16
|
+
|
|
17
|
+
## 2026-09-26 - 32.5.0
|
|
18
|
+
|
|
19
|
+
### Features
|
|
20
|
+
|
|
21
|
+
- publish the Cloudly 1.5.0 template for Cloudly 33.2.0 (cloudly)
|
|
22
|
+
- Add Cloudly app version 1.5.0, pinned to the Cloudly 33.2.0 multi-platform image index `code.foss.global/serve.zone/cloudly@sha256:11bc9a39011c1fa21bf621067e0ff6d4c2fe8cb0306745eca825db13285ae756` (linux/amd64 and linux/arm64), and mark it as the latest catalog version.
|
|
23
|
+
- Keep the 1.4.0 runtime contract and `minOneboxVersion` 32.4.0. Cloudly 33.2.0 changes neither `qenv.yml` nor the Dockerfile and reads no new environment variable, so every start-required variable is still a required template variable and `SERVEZONE_SSLMODE` stays `external`.
|
|
24
|
+
- Mark the upgrade breaking, migration-required, backup-before-upgrade and manual-review. Hosts read these flags from the target version alone, and an installation on 1.2.1 or earlier still runs the forward-only 0.20.0 → 0.21.0 migration of Cloudly 33.0.0 on this image (backup first, full-restore rollback). From 1.4.0 there is no data step, as 33.2.0 keeps data version 0.21.0. The template changelog names the gateway admin bootstrap, first enrollment, staged gateway settings changes and the `plan-unsorted` and `relay-node-unknown` refusals, and the rollout order Cloudly 33.2.0 before Coreflow 33.2.0 (33.1.0 of both at minimum). For an installation still on 1.3.0 it names the per-node Corestore database endpoint and that existing database bindings return no credentials until they are granted again; for 1.2.1 or earlier it names the migration's prerequisites again: remove the logged Cloudflare A records at the provider, a dcrouter advertising `dns.clientRecords` and `certificates.exactIssuance`, `SERVEZONE_SSLMODE=letsencrypt` refused, and the Cloudly 33.0.0 typed API breaks.
|
|
25
|
+
- Update the bundled client data, the README guidance and the resolver regression coverage, which now holds 1.5.0 to the 1.4.0 runtime contract and upgrade flags.
|
|
26
|
+
|
|
3
27
|
## 2026-09-26 - 32.4.0
|
|
4
28
|
|
|
5
29
|
### Features
|