One post tagged with "DNS"

Version v3.1.6 is a large release across Kubernetes, networking and databases. The headline is node-pool plan rotation: changing a pool's instance plan used to be rejected outright while the pool had live workers, so the only way through was to scale to zero and back, a full capacity outage for that pool. Now the plan change is accepted and the platform rotates the workers for you, provisioning replacements before draining anything. Alongside it, System DNS turns provisioning into something that produces real hostnames rather than bare IP addresses, and managed databases on those names present publicly trusted TLS certificates that renew themselves. Load balancers gain host-based routing and can serve internal VIPs for Kubernetes Services. The release also carries a broad set of reliability fixes across Kubernetes operation locking, reverse DNS, backups and the admin panel.

Kubernetes​

• [Feature] Node-Pool Plan Rotation - A pool's instance plan can now be changed while it has live workers. Saving the change starts a surge rotation: new workers on the new plan are provisioned and confirmed ready first, then old ones are cordoned, drained through an escalating ladder, and destroyed, one wave at a time, so the pool never runs below capacity. Scale-down ordering is preserved across the rotation, so the pool does not scramble which node leaves next. Downsizing to a smaller plan is allowed with an explicit warning rather than blocked - it is your cluster - but it takes a second, separate confirmation naming the consequence, so a single click can never start one.
• [Feature] Rotation Visibility - The pool list shows a drift badge counting how many workers are still on the previous plan, with a Rotate action to start or resume a rotation. The decision data arrives with the page rather than from a probe request, so opening the page cannot consume the rate limit that governs the rotation endpoint itself.
• [Feature] Worker Pool Identity - Worker nodes now carry a hypervisor.io/node-pool label, following the same convention as the major managed Kubernetes providers, so kubectl get nodes -L hypervisor.io/node-pool shows which pool each node belongs to. Panel hostnames include the pool name too, so the instance lists in both panels no longer show several pools' worth of identically-shaped names. Renaming a pool heals the label on the next reconciliation. None of this costs anything in the database.
• [Feature] Internal Load Balancers for Services - A Kubernetes Service of type LoadBalancer annotated <prefix>internal: "true" now gets a private VIP inside the VPC instead of a public IP, and the cloud controller reports that private address back to the cluster. Internal services no longer have to be exposed publicly to be reachable, and no change to the cloud controller was required.
• [Improvement] One Transport for Long Orchestrations - Rolling upgrades, control-plane upgrades and plan rotations no longer run as queue jobs with a fixed ceiling. They run as detached console processes with a task row, an operation lock and a stale-task reconciler behind them, so a long rotation cannot be killed part-way by a queue timeout.
• [Fix] Kubernetes Operation Locking - Operation locks now correctly detect an already-held lock across the Redis client the platform ships, so concurrent scale, upgrade and rotation operations on one cluster are properly serialised. Lock acquisition also moved outside the surrounding database transactions, so a rolled-back operation releases its lock immediately instead of waiting for the timeout.

DNS​

• [Feature] System DNS - Every public instance, load balancer, managed database and Kubernetes control plane now receives a hostname automatically. Instances are named from their IP in the familiar cloud style (vm-203-0-113-7.cloud1.example.com); named resources use their own name (db-prod-mysql, lb-frontend, k8s-myapp-cp). Records are created at provision time, follow the resource if its IP changes, and are removed when it is destroyed. Where a reverse zone allows it, a matching PTR record is set so forward and reverse agree, and a value the customer set themselves is never overwritten. DNS problems never block or fail provisioning.
• [Feature] Delegation Wizard - Base domains are onboarded through a four-step wizard: enter the domain and nameservers, delegate at your registrar, then verify. Verification is real rather than advisory - the panel writes a random record into the zone and confirms both that your registrar delegates the domain and that public resolvers can see that record through the delegation, before the domain publishes anything. A daily re-check moves a domain that loses its delegation to a degraded state, where existing records keep resolving but no new resources are assigned to it, and restores it automatically when the delegation returns. A problem local to the panel, such as its own DNS tooling being unavailable, will never degrade your domains.
• [Feature] Trusted TLS for Managed Databases - A base domain can hold a Let's Encrypt wildcard certificate covering every name under it, issued over the DNS-01 challenge using the zone the panel already controls. Public managed databases receive it automatically and load it without a restart, so customers can connect with --ssl-mode=VERIFY_IDENTITY or sslmode=verify-full against the public trust store instead of trusting a self-signed certificate. One wildcard per domain keeps issuance well inside Let's Encrypt's rate limits, and renewal runs daily from 30 days before expiry, so a failed attempt has a month of retries behind it rather than being a countdown.
• [Feature] PowerDNS Deployment Kit - A self-contained kit ships with the release for operators who need authoritative DNS to point System DNS and reverse DNS at. It stands up a primary and any number of secondaries replicated by signed zone transfers, where a new zone propagates to every secondary without touching them. One script drives the whole fleet over SSH from the primary: it prints a readiness table per node and changes nothing until every node passes, then converges each node and verifies replication by querying each one directly, failing loudly if any node is not actually serving the zone.
• [Improvement] Reverse DNS Zone Forms - The reverse zone forms now show the hostname each automatic PTR format actually produces, built live from the prefix and domain you are typing, instead of four opaque option labels. Zone type is chosen from cards and the zone suffix follows the choice.
• [Fix] PowerDNS Reverse DNS - Corrected the call into the PowerDNS client when setting or rebuilding a PTR record, and added test coverage over that path. ClouDNS providers were not affected.
• [Fix] Automatic PTR Format Labels - The second and third automatic PTR format options in the reverse zone form now describe the output they actually produce, and the form previews the resulting hostname for each option. If you use format 2 or 3 on an existing zone, check the preview against what you expect before your next change.

Load Balancers​

• [Feature] Host-Based Routing - Load balancer rules can now match on the request host as well as the path, so one load balancer can serve several hostnames to different backends. The match-type options were consolidated at the same time.
• [Improvement] Self-Healing Configuration - A load balancer left stranded in the configuring state now recovers on its own instead of needing a manual sync, with the grace period derived from how long the agent-side configuration can legitimately take rather than an arbitrary number.
• [Fix] HTTPS Redirect and Form Wipes - The HTTPS-redirect option on port 80 now applies correctly, and a real-time update arriving while a load balancer configuration form is open no longer discards what you were typing.

Databases and Backups​

• [Feature] Detached Backup Execution - Managed database backups no longer run inside a single blocking connection to the guest. A backup taking more than about 58 minutes used to be killed mid-upload by a transport timeout that scaled with nothing, and the task showed no movement at all between "running" and completion, so a healthy 13 GB backup was indistinguishable from a hang. Backups now run detached with the panel polling progress, reporting transferred bytes live, and the ceiling is a policy you set rather than an artefact of how the command was run. A genuinely dead guest is now detected in about two minutes.
• [Feature] Backup Run-History Retention - Backup run records are now pruned on a schedule with a configurable retention period, so the history table stays a useful size on long-lived installs.
• [Improvement] Honest Backup Schedules - The backup settings page now shows the schedule actually in effect rather than a placeholder that could differ from it, and validates a custom schedule when you save it. New installs default to daily.
• [Improvement] Faster Failures on Broken Egress - The database agent scripts now fail immediately with a named reason when the guest has no route to the internet, instead of hanging until a timeout. The message points at the VPC NAT gateway, which is the usual cause.
• [Fix] PostgreSQL Incremental Backups - PostgreSQL incrementals are markers over continuous WAL archiving and upload no object of their own. The completion check now recognises that shape and records them correctly, and a marker whose WAL archiving is not actually running is reported as a failure rather than a success.
• [Fix] Phantom Restore Keys - A storage key recorded against those marker rows could make restore and retention treat an object that does not exist as downloadable. Marker rows no longer carry one.

Platform and Admin​

• [Improvement] Smaller Update Rollback Snapshots - The snapshot taken before an application update now skips logs, caches, images and existing backups, and skips walking those directories at all rather than listing and discarding them. Snapshots on a busy install were hundreds of megabytes of log files.
• [Improvement] Quieter Admin Lists - The VPC and load balancer list pages no longer reload on every NAT gateway heartbeat. Updates are batched, so a page that was reloading dozens of times a minute now settles.
• [Fix] Hypervisor Health Flag - The automatic health flag raised when a node stops reporting now clears again on the node's next successful metrics poll, so a node that recovers from a transient blip returns to the deployment pool by itself. Allow Deployments remains the operator-controlled switch, and the admin page now labels which is which.
• [Fix] Blank Task Status - Task status could arrive in a form the column could not store, leaving the dashboard blank for tasks that were running. The column has been widened and the accepted values are validated where they arrive.
• [Fix] Missing Hypervisor Uptime - KVM nodes showed "-" for uptime on the hypervisors list and the dashboard.
• [Fix] VPC Real-Time Updates - Aligned three broadcast channel names with what the panel subscribes to, so VPC views update live again.
• [Fix] Missing User Timezone Crashed Instance Metrics - Accounts created without a timezone caused the instance metrics endpoints to fail. Timezone resolution now falls back through the account, the system default and UTC in one place, existing accounts are backfilled, and a setting that nothing had ever written - so subuser invitations always fell back to UTC regardless of the configured default - now reads the correct one.
• [Fix] Supervisor Workers Pointed at a Missing PHP - The queue worker configuration hardcoded PHP 8.3 while the installers have defaulted to 8.4 for some time, so on a fresh install no queue worker would start, and every application update reapplied the mismatch. The PHP version is now substituted where the configuration is deployed, including the unversioned path that EL hosts use.
• [Fix] Build Pipeline Hardening - The release build now enforces the compatibility flag when targeting multiple PHP versions, records the flags used with each artifact, and adds a verification step plus a smoke test on the target host.
• [Fix] Billing and Provisioning Debt - Volume backup charges now apply the account balance policy consistently, user records created through every path carry the timestamps the schema requires, and VNC port allocation can no longer hand the same port to two instances.

Infrastructure Agent​

• [Improvement] PHP Entrypoint Pinning - The agent now selects its PHP interpreter explicitly, preferring 8.4 and falling back to 8.3, verifying the candidate actually carries the extensions it needs before committing to it. The update process repairs already-deployed nodes.
• [Fix] Proxy Survives an Unlinked Node - The SSH proxy no longer fails to start on a node that has not yet been linked to a master, and linking, relinking or unlinking now takes effect without a restart. Unlinking correctly revokes trust.
• [Fix] Stale Binaries After an Update - An incremental update could leave the previous version of a running binary in place, because a running executable cannot be overwritten in place. The update now replaces them correctly.
• [Fix] Missing VNC Port Tolerated - A null or zero VNC port arriving from the master no longer produces invalid guest XML or a firewall error.

Integrations​

• [Improvement] OpenTofu Provider and MCP Server - Both gained the node-pool rotation endpoint, and the MCP tool for updating a node pool gained the instance plan field it was missing, so a plan change and its rotation can be driven from infrastructure-as-code or from an AI agent as well as from the panel.

Upgrade notes​

• Deploy the infrastructure agent before the master. The certificate installation command the master sends reaches a route that only exists in the new agent.
• Three migrations run on upgrade: the task status column widening, the System DNS schema, and the user timezone backfill.
• Reverse DNS on PowerDNS providers is worth a quick check after upgrading, and if you use automatic PTR format 2 or 3, confirm the form's preview matches the naming you expect.