[TakGN]

What changes

Moves needle from ghcr.io/ipni/needle:v1.0.0 to v1.1.0 (tag at needle commit 38f5ac61, released 2026-11-03).

• k8s/needle/kustomization.yaml: digest: is now the v1.1.0 index digest, sha256:067e3be30bad134931f4c681d2dbc4baf53bb648051fab2a425ca86a63071dba. The comment above it has the new version, date and amd64 manifest digest, sha256:cd7d2074a72b7a18da1524f07846388159d2581e44ee6136099c23836d1cc91c. Both digests were read from docker buildx imagetools inspect. The index still covers amd64, arm/v7 and arm64.
• README.md: the current version under **Version:**.

The README's other v1.0.0 mentions stay: the rename at v1.0.0 and the dated 2026-09-18 cutover entry are history. AGENTS.md and roles/needle don't state a running version.

This is digest-only. It adds no env vars. Tracing config is a separate follow-up, so any regression from this rollout traces back to one change.

What the release contains

Full list in the changelog.

• Security: gRPC v1.83.2 and OTLP trace exporters v1.45.0, which fix the advisories listed in the changelog.
• Tracing: working sampling, named request spans, per-router spans, and a new NEEDLE_TRACING_TRUST_TRACEPARENT (default false).

This deployment sets no OTLP endpoint, no trace exporter and no NEEDLE_TRACING_* variable. The changelog says that with no exporter configured nothing is sampled, so the tracing work should stay inert here. The kad-dht fork is unchanged at v0.42.2-ipni.2, and the changelog marks nothing as breaking.

The image came from a manual docker.yml run on the tag, because the tag push did not trigger a build.

Merging does not deploy this

CI: k8s/needle/ and README.md match none of the path patterns in the changes job of .github/workflows/ci.yml, for site.yml, platform.yml or cve.yml. Neither this PR nor its merge triggers a CI dry run or apply, only the checks. routing.yml doesn't run from CI at all.

Argo CD: nothing in this repo points it at needle (roles/argocd has no needle reference and points Argo at ipni/infra). I did not check ipni/infra itself.

Nothing reaches the boxes until a person runs the rollout below.

Rollout plan, for a person to run

After merging, from an up-to-date main:

ansible-playbook routing.yml --check --diff -l sing-1   # dry run first
ansible-playbook routing.yml -l sing-1                  # one box
ansible-playbook routing.yml                            # the remaining boxes, one at a time, warmed

• Never use -e production_rollout=false. It rolls all three boxes at once, and each box is a whole site with no failover, so that is an outage.
• A warmed rollout takes hours per box. It rolls one instance at a time and warms each one first, because needle stays degraded for tens of minutes after a restart, long after the pod reports Ready.

To roll back, revert this PR and run the same steps, which costs another warm-up.

Checks run locally

All pass:

• yamllint . and ansible-lint (Passed: 0 failure(s), 0 warning(s), profile production)
• ansible-playbook --syntax-check on all seven playbooks
• scripts/render-manifests.yml, plus kubectl kustomize on every overlay
• The other CI checks: the needle instance count at 1, 2 and 4, the cert-manager checksum, libp2p_identity.py unit tests, dns.txt and dns-libp2p.txt against their generator, known pinset.yml sections, and shellcheck

Render diff against main: in kubectl kustomize rendered/needle, the only change is the image: line on the four Deployments. The ConfigMap hash is unchanged, and every other overlay renders identically.

Differences from CI: these ran on macOS with Python 3.14, and ansible-lint used ansible-core 2.22, while CI uses Ubuntu with Python 3.12. The syntax checks and renders used ansible-core 2.19.4. The cert-manager checksum used shasum -a 256 rather than sha256sum.

Not run: anything against the boxes, including the routing.yml dry run. That stays with the person doing the rollout.

Follow-up

The comment at k8s/route-origin/envoy.yaml.j2:91-93 says v1.0.0 drops the traceparent Envoy sends and that its sampling never fires. It goes stale once this rolls out. It is deliberately left alone for the tracing config PR.

🤖 Generated with Claude Code