Skip to content

Release v1.0.0

Latest
Latest
Compare
Choose a tag to compare
@LiZhenCheng9527 LiZhenCheng9527 released this 16 Jan 02:40
· 2 commits to release-1.0 since this release
v1.0.0
44069d8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.

At the start of the New Year 2025, we are pleased to announce the release of Kmesh v1.0.0. We would like to express our sincere gratitude to the Kmesh community contributors for their dedication and hard work over the past three months.

In this v1.0.0 release, we have made significant improvements to Kmesh's east-west traffic governance capabilities, particularly in the area of security. We have added support for Encrypted Communication and Authorization, enhancing the overall security posture of the Kmesh.

Furthermore, we have introduced support for headless services and locality load balancing, providing users with more flexibility and control over their service. Additionally, we have added service topology diagrams and optimized observability features, empowering users with better visibility into their services in Kmesh.

In the Kernel-Native mode, we have support for advanced capabilities such as circuit breaker, rate limiting, fully restart support and more, ensuring a comprehensive and robust set of features for our users. In this release cycle, Kmesh has been updated to support Istio version 1.24, and we have addressed several critical bugs while also reconstructing many key components. To ensure the stability and reliability of the platform, we have significantly increased the coverage of end-to-end tests and unit tests. We are excited to share these improvements with the Kmesh community and look forward to continued collaboration and growth in the future.

Main Features

Encrypted Communication:

Data transmitted in an unencrypted state poses a significant security risk. To address this concern, Kmesh has introduced a node encryption mode in its v1.0.0 release. This feature utilizes IPsec to encrypt the communication traffic between nodes, effectively eliminating security risks during data transmission.

Kmesh leverages the encryption capabilities provided by IPsec to secure the traffic flowing between nodes. The data encryption behavior of IPsec is finely controlled through the use of Kubernetes Custom Resource Definitions (CRDs), empowering users with granular control over the encryption policies.

Furthermore, Kmesh has built its node-to-node information synchronization mechanism on top of the Kubernetes api-service. This integration ensures that the encryption configuration and key management are seamlessly integrated with the Kubernetes ecosystem, simplifying the deployment and management of the secure communication infrastructure.

Offload Authorization Execution into XDP Prog:

In Kmesh v0.5.0, the authorization functionality has been offloaded to XDP eBPF. This integration has been further enhanced in the Kmesh v1.0.0 release.

Kmesh now supports IP-based authorization, where the authorization rules are determined within the eBPF program. When the authorization results in a rejection, the XDP program simply drops the request, ensuring that the client can perceive the connection failure.
This efficient authorization mechanism provides a secure and high-performance solution for service-to-service communication. Kmesh will support more authorisation features in XDP in future releases. Welcome to provide the relevant requests of users.

Locality Load Balance:

Locality Load Balancing is a critical optimization for performance and reliability in distributed systems. By directing traffic to the nearest service instances, this approach reduces latency, enhances availability, and lowers the costs associated with cross-region data transfers.
Kmesh now supports Locality Load Balancing across five different scopes: region, zone, subZone, nodeName, and clusterId. This fine-grained control allows users to configure load balancing policies based on the most appropriate locality level for their specific deployment topology and requirements

Observability enhancement:

Kmesh v1.0.0 introduces enhanced observability features, including the addition of service topology maps. By integrating Kmesh with Kiali, users can now visualize their service topology in a clear and intuitive manner.

Furthermore, Kmesh has optimized the metrics labels, ensuring that the presented metrics are more reasonable and understandable. This improvement enhances the overall clarity and usability of Kmesh's observability data.

Leveraging the easy access to network-native data provided by eBPF, Kmesh has also introduced new metrics related to TTL (Time To Live) and retries. This provides users with deeper insights into the state of the network, enabling them to better understand and monitor the performance and reliability of their distributed applications.

Kernel-Native Mode Support Restart:

Kmesh has further enhanced its capabilities by introducing the ability to gracefully reload eBPF maps and programs after a system reboot. This feature ensures that there is no need to re-register namespaces or specific pods into Kmesh following a reboot.

As a result, the service traffic remains uninterrupted during the reboot process, providing a significant benefit to Kmesh customers. This seamless handling of reboot scenarios helps maintain the availability and stability of the service mesh, minimizing the impact on end-users and applications.

Support Rate Limit and Circuit Breaker:

Kmesh v1.0.0 introduces enhanced traffic governance capabilities for its Kernel-Native Mode. This latest release now supports local rate limiting and circuit breaker functionality, addressing the core traffic management requirements of service mesh deployments.

Users can leverage these traffic governance features in the Kernel-Native Mode in the same way they would utilize rate limiting and circuit breaker capabilities in the Dual-Engine Mode. This consistency across the different operating modes ensures a seamless experience for Kmesh operators, regardless of their chosen deployment architecture.

Support Headless Service and ServiceEntry:

In the Kmesh Dual-Engine Mode, support for headless services and service entries has now been introduced.

Adopt istio 1.24:

Kmesh has been supported for istio 1.24 and there are e2e tests to ensure the stability of Kmesh in istio 1.24. Currently Kmesh is compatible with istio versions 1.22, 1.23 and 1.24.

Critical Bug Fix:

We have also made some big bug fix:

1.Support hostname type waypoint in workload
2.Check whether pods should be managed when ns is managed
3.Fix bpf ins over 100w

What's Changed

New Contributors

Thanks to:

We are delighted to welcome new developers to the Kmesh community and appreciate their valuable contributions to this release. A special thank you to: @delavet , @Kuromesi , @Okabe-Rintarou-0 , @bfforever , @yanchaomei , @noobwei , @derekwin , @skwwwwww , @yuanqijing and other developers who are new to the Kmesh community.

We also extend our sincere gratitude to the Kmesh community contributors who have consistently supported Kmesh. The successful launch of Kmesh v1.0.0 is a testament to the collective efforts of the entire team.

Contributors

tjons, YaoZengzeng, and 23 other contributors
Assets 5
Loading