diff --git a/.github/ISSUE_TEMPLATE/bug-report.yml b/.github/ISSUE_TEMPLATE/bug-report.yml index b01bf9364..12932df98 100644 --- a/.github/ISSUE_TEMPLATE/bug-report.yml +++ b/.github/ISSUE_TEMPLATE/bug-report.yml @@ -31,6 +31,7 @@ body: label: Version description: What version are you running? options: + - v1.7.0 - v1.6.0 - v1.5.1 - v1.5.0 diff --git a/README.md b/README.md index 4bcb38254..d9a3a4f69 100644 --- a/README.md +++ b/README.md @@ -16,7 +16,7 @@

- + diff --git a/compose/docker-compose.netclient.yml b/compose/docker-compose.netclient.yml index 3647bcdc6..9a8fa9cea 100644 --- a/compose/docker-compose.netclient.yml +++ b/compose/docker-compose.netclient.yml @@ -3,7 +3,7 @@ version: "3.4" services: netclient: container_name: netclient - image: 'gravitl/netclient:v1.6.0' + image: 'gravitl/netclient:v1.7.0' hostname: netmaker-1 network_mode: host restart: on-failure diff --git a/k8s/client/netclient-daemonset.yaml b/k8s/client/netclient-daemonset.yaml index 197307ae1..990da4e92 100644 --- a/k8s/client/netclient-daemonset.yaml +++ b/k8s/client/netclient-daemonset.yaml @@ -16,7 +16,7 @@ spec: hostNetwork: true containers: - name: netclient - image: gravitl/netclient:v1.6.0 + image: gravitl/netclient:v1.7.0 env: - name: TOKEN value: "TOKEN_VALUE" diff --git a/k8s/client/netclient.yaml b/k8s/client/netclient.yaml index ad4668997..224efcf02 100644 --- a/k8s/client/netclient.yaml +++ b/k8s/client/netclient.yaml @@ -28,7 +28,7 @@ spec: # - "" containers: - name: netclient - image: gravitl/netclient:v1.6.0 + image: gravitl/netclient:v1.7.0 env: - name: TOKEN value: "TOKEN_VALUE" diff --git a/k8s/server/netmaker-ui.yaml b/k8s/server/netmaker-ui.yaml index 06f2e403b..3a4658ef6 100644 --- a/k8s/server/netmaker-ui.yaml +++ b/k8s/server/netmaker-ui.yaml @@ -15,7 +15,7 @@ spec: spec: containers: - name: netmaker-ui - image: gravitl/netmaker-ui:v1.6.0 + image: gravitl/netmaker-ui:v1.7.0 ports: - containerPort: 443 env: diff --git a/main.go b/main.go index e22968b0a..42e267cd2 100644 --- a/main.go +++ b/main.go @@ -38,10 +38,10 @@ import ( "golang.org/x/exp/slog" ) -var version = "v1.6.0" +var version = "v1.7.0" // @title NetMaker -// @version 1.6.0 +// @version 1.7.0 // @description NetMaker API Docs // @tag.name APIUsage // @tag.description.markdown diff --git a/release.md b/release.md index d1944d6ba..00ffce516 100644 --- a/release.md +++ b/release.md @@ -1,75 +1,63 @@ -# Netmaker v1.6.0 Release Notes πŸš€ +# Netmaker v1.7.0 Release Notes πŸš€ ## πŸš€ What’s New -### πŸ” Site-to-Site ACLs (Beta) +### 🏒 Multi-Tenancy for MSPs (Organizations & Tenants) -Define ACL policies that permit traffic between egress endpoints across networks. +Run multiple customer environments from a single Netmaker server. -- Build site-to-site rules between egress resources on different networks. -- Combine egress resources, nodes, and specific IPs in a single policy. -- Site-to-site rules are emitted alongside device-mesh rules without key collisions. +- **Organizations & tenants** β€” Group customers under an organization; each tenant is an isolated Netmaker environment (networks, devices, users). +- **MSP license sync** β€” EE/MSP installs create and update orgs/tenants from the MSP license (including teardown when a tenant is removed from the license). CE and normal Pro accounts continues to use a single local default tenant. +- **Scoped access** β€” API and `nmctl` select the target org/tenant via `X-Organization-ID` / `X-Tenant-ID` (`--org_id` / `--tenant_id`), with `nmctl organization list` and `nmctl tenant list` for discovery. +### πŸ”Œ TCP Proxy / WSS Uplink -### πŸ›‘οΈ Egress ACLs with IP Restriction +Gateways can publish a **TCP/WSS uplink** so clients can reach the mesh in restrictive environments when UDP is blocked. -ACL policies can now target **individual IPs** inside an egress range using the `ip` ACL target type. +- Enable TCP proxy on the gateway/host (`tcp_proxy_enabled` and related listen/TLS settings). +- Clients can opt into a TCP uplink to the gateway when the proxy is enabled. +- Supports self-signed and externally terminated TLS modes for WSS endpoints. -- Restrict access to specific hosts within a larger egress CIDR. -- Validate that selected IPs fall within the referenced egress range at policy create/update time. -- Mix egress resources, nodes, tags, and individual IPs in the same policy. +### πŸ›‘οΈ EDR Integration (Pro) -### πŸ“¦ Egress Preset Catalog (Pro) +Connect endpoint detection and response platforms for **posture checks** from **Integrations**. -A built-in catalog simplifies domain-based egress for common SaaS and cloud providers. +- Supported providers: **Microsoft Defender**, **CrowdStrike**, **SentinelOne**, and **Wazuh**. +- Sync managed endpoints and evaluate EDR compliance (agent health / risk level) as part of device posture. +- Configure, test, and manage integrations via the REST API (`/api/v1/integrations/edr/{provider}`). -- Browse presets via `GET /api/v1/egress/presets` (AWS, Azure, Google, Salesforce, and more). -- Create egress resources from a `preset_id`; the server can resolve AWS IP ranges automatically. -- Support for **multiple domains** per egress resource. +### πŸ“± MDM Integration (Pro) -### ⏱️ JIT Group Memberships +Connect mobile device management platforms for **device compliance posture** from **Integrations**. -Just-In-Time (JIT) access can now be scoped to **user groups** per network. +- Supported providers: **Microsoft Intune**, **Jamf**, **JumpCloud**, and **Iru**. +- Match devices by Entra device ID, serial number, hardware UUID, or hostname. +- Enforce MDM enrollment/compliance checks alongside existing posture policies. +- Configure, test, and manage integrations via the REST API (`/api/v1/integrations/mdm/{provider}`). -- Enable JIT for all non-admin users, or limit it to selected user groups. -- Users request access; admins approve or deny with email notifications. -- Expired grants are cleaned up automatically and users are notified. - -### πŸ”— SIEM Integration - -Forward Netmaker audit events to your security stack from **Integrations**. - -- Supported providers: **Splunk**, **Datadog**, **Elastic**, and **Microsoft Sentinel**. -- Configure, test, and manage integrations via the REST API (`/api/v1/integrations/siem/{provider}`). -- Events are exported through the SIEM exporter service. - -### πŸ”‘ Default Enrollment Keys - -Networks can designate a **default enrollment key** for simplified device onboarding. - -- Fetch the default key per network via the API or CLI. -- Regenerate enrollment key tokens without recreating the key. --- ## πŸ—„οΈ Database Schema Migration -This release introduces schema changes to the following core entities: +This release completes the SQL schema path and introduces **multi-tenancy (org/tenant) bootstrap** as part of the v1.7.0 migration. + +**Upgrade requirement (existing deployments):** + +- You **must** run **Netmaker v1.6.0** successfully **before** upgrading to v1.7.0. +- v1.7.0 will **refuse to start** if `migration-v1.6.0` has not completed on a prior v1.6.0 deployment. +- Recommended path: deploy v1.6.0 β†’ confirm the server starts cleanly β†’ then upgrade to v1.7.0. -- Nodes -- Pending Users -- User Invites -- Posture Check Violations **Impact:** -- The database structure will be updated automatically during the upgrade. +- Schema and data are updated automatically on successful startup. - Downgrades may not be supported after migration. **πŸ‘‰ Action Required:** -- Ensure the application starts successfully and migrations are complete. -- Validate core functionality post-upgrade. +- Do not jump from v1.5.x (or earlier) straight to v1.7.0 on an existing database. +- Ensure migrations complete and validate core functionality post-upgrade. For detailed upgrade steps, refer to the official upgrade documentation: @@ -79,19 +67,15 @@ For detailed upgrade steps, refer to the official upgrade documentation: ## 🧰 Improvements & Fixes -- **Netclient registration UX** β€” Host registration over OAuth/basic auth now returns clear websocket close reasons on failure (auth errors, missing access, posture violations, and server errors). +- **Auto-relay peer reset** β€” Reset a specific peer-to-peer connection that is using a relay (clear/reassign auto-relay for that peer pair) without resetting the entire network’s auto-relay state. -- **User group management** β€” Streamlined user role permissions and group updates, role-downgrade handling. +- **Migration reliability** β€” v1.7.0 blocks startup until v1.6.0 migration completed on existing deployments; migration failures exit cleanly instead of panicking. -- **Orphan reference cleanup** β€” Removes stale network references left behind after resource deletion. -- **Scalability & reliability** β€” Optimized node status calculation, offline-status hooks, zombie/orphan node cleanup, and ACL cache race fixes. +- **Host status** β€” Host filtering uses live check-in status (Online/Offline/Disconnected) rather than a stale DB value. -- **API hardening** β€” Auth rate limiting on REST endpoints and activity-log permission fixes. +- **MSP installs** β€” `nm-quick.sh` `-s` flag to skip nmctl/mesh/netclient on MSP server installs. -- **Egress improvements** β€” CIDR validation for ACL egress IPs, multi-domain egress routing, and domain-answer handling for preset-based egress. - -- **Failover removed** β€” Legacy per-node failover APIs and CLI commands have been removed in favor of gateway-based patterns. --- diff --git a/scripts/nm-quick.sh b/scripts/nm-quick.sh index 493c49118..e1ab80aae 100755 --- a/scripts/nm-quick.sh +++ b/scripts/nm-quick.sh @@ -17,7 +17,7 @@ fi CONFIG_PATH="$INSTALL_DIR/$CONFIG_FILE" NM_QUICK_VERSION="1.0.0" #LATEST=$(curl -s https://api.github.com/repos/gravitl/netmaker/releases/latest | grep "tag_name" | cut -d : -f 2,3 | tr -d [:space:],\") -LATEST=v1.6.0 +LATEST=v1.7.0 BRANCH=master if [ $(id -u) -ne 0 ]; then echo "This script must be run as root" diff --git a/swagger.yaml b/swagger.yaml index 056eac207..2af645ac9 100644 --- a/swagger.yaml +++ b/swagger.yaml @@ -2925,7 +2925,7 @@ info: contact: {} description: NetMaker API Docs title: NetMaker - version: 1.6.0 + version: 1.7.0 paths: /api/dns: get: