wasmCloud
v2.3.0Orchestration & Managementv2.3.0 ships workload env/config/secrets management in wash, wasmtime 45 upgrade with security patches, and improved OTel tracing across workloads and HTTP spans.
securityApply wasmtime 45 upgrade and dependency security patches immediately
This release includes two wasmtime bumps: 44.0.2 was a targeted security patch, and 45 followed shortly after. On top of that, additional dependency security advisories were patched separately. If you're running wasmCloud in production, upgrade to v2.3.0 now rather than waiting — the cumulative security surface covered here is non-trivial.
enhancementScope Kubernetes RBAC to namespaces instead of cluster-wide
The runtime.wasmcloud.dev apiGroup RBAC can now be namespaced rather than cluster-scoped. If you're running the wasmCloud operator in multi-tenant Kubernetes clusters, revisit your RBAC configuration and tighten it to namespace scope where possible. This is a meaningful security posture improvement for shared clusters.
enhancementStart using wash workload env/config/secrets for structured configuration
Configuration and secrets management is now surfaced directly in the wash CLI. This is the workflow shift wasmCloud has been building toward — rather than managing config out-of-band, you can now handle env vars, config, and secrets as first-class workload concerns. Check the new otel-config example in the repo to see the intended pattern before adopting it in production.
主な変更 (5)
- wash now supports workload environment variables, config, and secrets management directly from the CLI
- wasmtime upgraded from 44.0.2 (security patch) to 45 — two wasmtime bumps in one release cycle
- HTTP response status codes are now recorded on request spans, making OTel traces more actionable
- RBAC for runtime.wasmcloud.dev apiGroup can now be scoped to namespace rather than cluster-wide
- WASI OTel RC2 integrated, and a wasip3 canary image is now built and published via CI