aerospike/aerospike-backup-service v3.7.0

on GitHub

This release is built on top of backup-go v0.12.0.
This release adds an HTTPS listener with mTLS and certificate revocation, cumulative incremental backups, timezone-aware schedules, filter expressions and set index support. It also hardens secret handling, configuration validation, packaging and deployment defaults, and makes backup retries and retention safer.
This release contains breaking changes. Review them before upgrading and see the Migration Guide for upgrade instructions.

Breaking Changes

• Secrets are returned as "[secret]" by the configuration API and redacted in logs. Sending "[secret]" back on PUT keeps the stored value; the literal "[secret]" is rejected on new entities. (#622, #624, #658) [BKRS-333, BKRS-269, BKRS-393]
• Configuration entity names must be a single path segment. (#676) [BKRS-414]
• User-supplied filesystem paths must be explicit. (#626, #656) [BKRS-338, BKRS-390]
• Secret references are validated at configuration load time. (#615, #625) [BKRS-287]
• compression and encryption policies must set mode explicitly. (#689) [BKRS-441]
• An empty rate-limiter white-list now limits every client; use 0.0.0.0/0 to exempt all. (#604) [BKRS-272]
• The .deb and .rpm packages run the service as the unprivileged aerospike-backup-service account under a systemd sandbox. The config file is owner-only, the unit file moves to /usr/lib/systemd/system, and logs move to /var/log/aerospike-backup-service/. (#640) [BKRS-277]
• Remove deprecated XDR-Backup support (unused). (#599) [BKRS-328]

New Features

• Add an HTTPS listener (service.https) with optional mTLS. (#633, #638) [BKRS-285, BKRS-299]
• Reload TLS certificate, key and client CA files without restart. (#639, #644) [BKRS-367, BKRS-376]
• Support mTLS client certificate revocation with CRLs. (#648) [BKRS-314]
• Add cumulative incremental backups via incr-mode (differential or cumulative) on backup policy. (#645) [BKRS-369]
• Add schedule-timezone on service.backup and backup routines: UTC (default), host timezone, or a named IANA zone. Backup paths remain UTC. (#643, #653) [BKRS-370, BKRS-388]
• Add filter-exp on backup routines for partial backups. (#593, #688) [BKRS-259, BKRS-438]
• Add set index 8.1.2 notation support. (#609) [BKRS-334]

Improvements

• Retry a failed namespace in its own attempt folder without deleting other namespaces' data. (#678) [BKRS-405]
• Do not retry permanent failures. (#688) [BKRS-438]
• Fail a routine run when a namespace backup cannot start. (#677) [BKRS-407]
• Retention deletes only completed incrementals; partial backups left by a crashed run are removed at startup. (#679) [BKRS-411]
• Validate storage paths before use. (#594) [BKRS-271]
• Remove the secret resolver cache so rotated secrets are picked up. (#600) [BKRS-292]
• Respect context cancellation in shutdown, retry back-off and the rate limiter. (#661) [BKRS-399]
• Queue backup-history sync instead of running it during config apply. (#666) [BKRS-401]
• Return more accurate status codes from configuration mutation endpoints. (#686) [BKRS-439]
• Separate structural configuration validation from runtime TLS probing. (#642) [BKRS-377]
• Accept OpenSSL -text dumps and PKCS#8 encrypted keys in TLS files. (#682) [BKRS-426]

Security

• Type credential fields as secrets to prevent leaks into logs. (#664) [BKRS-398]
• Mask sensitive data in error messages. (#634, #655) [BKRS-354, BKRS-389]
• Remove HTTP request body logging. (#603) [BKRS-266]
• Add support for HTTP server timeout configuration. (#627) [BKRS-297]
• Add support for per-IP rate limiter. (#672) [BKRS-417]
• Create local-storage backups owner-only (files 0600, directories 0700) in every deployment.
• Harden Helm and Kubernetes deployment defaults. (#641, #650) [BKRS-302]
• Update dependencies. (#583)

Bug Fixes

• Fix a deadlock in the Aerospike client manager. (#690) [BKRS-444]
• Fix a scan tracker race, restore job IDs and the config file mode. (#691) [BKRS-448]
• Fix context handling: release per-run contexts and commit configuration changes independently of the request context. (#668) [BKRS-424]
• Resolve the cluster TLS key-file-password through the Secret Agent. (#659) [BKRS-394]
• Fix Secret Agent handling for S3 storage credentials. (#671) [BKRS-419]
• Restore by timestamp: treat missing metadata compression as NONE. (#696) [BKRS-456]
• Fix the last successful backup timestamp metric being set outside the regular metrics flow. (#598) [BKRS-327]

Known limitations

• Restore namespace remapping (policy.namespace) supports a single namespace only: the restore must
  contain exactly one namespace, equal to policy.namespace.source. Otherwise the restore is rejected
  upfront with namespace remap from "<source>" requires the restore to be scoped to exactly that namespace.
  • Restore by path (/v1/restore/full, /v1/restore/incremental): point backup-data-path at a single
    namespace's backup (the key returned by GET /v1/backups/full) and run one restore per namespace.
  • Restore by timestamp (/v1/restore/timestamp): remapping works only for routines that back up a
    single namespace.
  • To restore several namespaces without remapping, omit policy.namespace; the destination cluster
    must have namespaces with the same names.

Full Changelog: v3.6.2...v3.7.0