nebius/nebius-ps-services nebius-vpngw-v0.6.0

nebius-vpngw-v0.6.0

Repository: nebius/nebius-ps-services

Tag: nebius-vpngw-v0.6.0

Published: 2026-09-03T23:52:08Z

Prerelease: no

Release notes:

• Restored reproducible Python 3.12 installs by bounding Click before its 8.4

rendering changes, Typer before its 0.26 Click-vendoring change, and the Nebius SDK before its 0.4 generated-API replacement. CI semantic CLI assertions now normalize captured terminal styling and use a stable terminal height, and VM-HA TLS contexts expose their existing TLS 1.2 minimum directly at construction for static security analysis.

• Fixed post-promotion VM-HA restoration for an exact already-running,

alias-free standby. The rearm service now adopts the committed authorization without issuing a Compute start, rejects foreign same-receipt checkpoint identity, and the controller serializes terminal restoration completion or blocking through the shared rearm writer lock.

• Fixed planned VM failover/failback terminal verification retaining a cloud

reader after its authenticated SDK owner had already closed. The public transfer command now owns one manager lifetime across preparation, cutover, and restored-standby proof; terminal cloud reads remain independent and fail-closed within the existing phase deadlines.

• Fixed idempotent prep-network verification for public allocations already

assigned to their exact intended gateway VM/NIC. Nebius reports these stable attachments as ASSIGNED, while unassigned reservations remain ALLOCATED; inconsistent state/assignment pairs and foreign attachments still fail closed.

• Fixed managed VM-HA credential enrollment when Nebius rereads an omitted

authorized-key expiry as a present zero-valued protobuf timestamp. Only the exact zero sentinel is accepted as non-expiring; every nonzero expiry still fails closed, and crash-resume retains the already verified IAM identity and pending private key without creating a replacement.

• Stopped steady-state VM-HA apply from rereading the ordinary gateway SSH

predecessor after the migration lifecycle is ACTIVE. The ordinary receipt remains bounded to provisioning and activation; subsequent applies use the already-published VM-HA receipt and retain exact Compute reproof.

• Reduced serial unit-test feedback without changing production timing or

weakening selection, existing assertions, or isolation. Four tests covering asset selection, allocation release, and allocation identity now record exact retry calls or stub an unrelated SDK lookup instead of waiting through production pacing. Their five-sample median fell from 28.59 seconds to 0.46 seconds; one complete instrumented 2,256-test run fell from 51.48 seconds to 23.51 seconds with identical passing outcomes.

• Completed fail-closed Nebius collection discovery across every public command

path. One bounded paginator now buffers all SDK or raw-stub pages, preserves request scope and VM-HA retry options, and rejects malformed responses, non-string or cyclic tokens, page-bound exhaustion, duplicate stable IDs, and provider failure without returning partial data. Configured VM, disk, allocation, subnet, network, and route-table discovery uses exact lookups with parent/name/ID validation and typed NOT_FOUND absence. status reports unavailable route evidence instead of an empty table, while preparation, apply, ordinary route reconciliation, destroy, IAM, and VM-HA transfer paths cannot authorize later effects from an incomplete inventory. The CLI, configuration, and persisted-state contracts are unchanged.

• Preserved installed ordinary gateways while making managed SSH trust usable

for immediate VM-HA conversion. Actual ordinary apply now serializes per project/gateway and can enroll one unchanged pre-branch VM exactly once via stable Ed25519 H1/cloud/H2 observation, pinned client authentication, guest identity correlation, and final Compute reproof; dry-run stays write-free and exits nonzero when enrollment is required. Exact configured client-key selection disables unrelated agent/default keys and password fallback. Authority-bearing v2 receipts record the bounded exception, and vm-ha requires the ordinary receipt before candidate or allocation effects, then imports its exact pin, predecessor digest, and current Compute binding into the approval-bound HA receipt. Ordinary pushes no longer stage or install VM-HA systemd/firewall assets.

• Isolated unit-test writer locks per test process so pytest-xdist workers do

not contend over reused fixture identities, and ignored generated destroy lifecycle receipts and write locks alongside the existing VM-HA state files.

• Made VM-HA runtime credentials fully managed by apply. Both wizards and

public YAML now omit credential paths and show one derived operator location under ~/.config/nebius-vpngw/credentials///. After the exact plan is approved, apply creates or reuses one product-labeled -vm-ha service account/group and one non-expiring RSA-4096/RS256 authorized key, publishes a crash-resumable mode-0600 credential source, and installs separate identity-bound copies on both members. Read-only planning now binds each IAM create/reuse action and reused resource identity; reuse cannot add a missing grant, generated SDK operations are awaited to terminal completion, source drift is rejected before IAM effects, and interrupted one-file cleanup residues resume safely. VM-HA rejects --sa, active lifecycle identity drift fails closed without rotation, and destroy retains the managed local and IAM state.

• Fixed managed VM-HA credential inspection under CLI federation profiles.

IAM preflight now preserves an explicitly supplied NEBIUS_IAM_TOKEN and otherwise uses the same renewable, bounded CLI-token bearer as gateway cloud discovery. Explicit-token commands no longer require a local CLI config when no profile endpoint needs resolving, and an explicit endpoint is passed directly to the SDK. Selected profiles still supply endpoint context, while the shared renewable bearer now serializes refreshes safely across threads and event loops. The supported SDK range is bounded to the versions covered by these authentication regressions.

• Fixed read-only VM-HA status and vm-ha use of the deployment-wide managed

SSH receipt. Managed trust is now resolved once for the complete member set and shared by the member probes, while an explicit known-hosts override keeps per-member failure isolation. No trust enrollment, cloud mutation, or guest mutation was added to either...