v1.26.0 Release Notes
Upgrade Notes
v1.26.0 is a large feature release and changes several runtime defaults — the router now serves warm traffic from EndpointSlices and accounts concurrency per replica, OCI package delivery becomes the cold-start path when a registry is configured, and streaming responses are no longer bound by the function timeout. None of these require a configuration change to keep working, but review the items below before rolling out, especially if you depend on global concurrency enforcement or on the previous Ingress route flow. The minimum Kubernetes version is unchanged at 1.32.
For the general upgrade steps (CRDs, CLI, Helm chart), see the Upgrade Guide. The behavioral changes specific to v1.26.0 and the action each requires are below.
Router serves warm traffic from EndpointSlices; concurrency is per-replica by default
The router now discovers function pod addresses natively from Kubernetes EndpointSlices instead of asking the executor on every request.
Warm traffic no longer makes an executor RPC, so functions stay reachable even while the executor is restarting or unavailable.
As part of this, every invoked pool-manager function gets a headless Service automatically (previously these pods were invisible to Kubernetes service discovery), and the router needs new RBAC for endpointslices and services — the chart adds it automatically.
The default concurrency accounting also changes: each router replica now enforces a function’s concurrency limit locally rather than coordinating a global count.
On a single-replica router this is identical to before.
On a multi-replica router the effective ceiling is the per-function limit times the replica count.
If a function requires a strict global limit, set the annotation fission.io/concurrency-enforcement: strict on it to restore global enforcement.
The data plane is on by default (router.endpointSliceCache.mode: "on", executor.functionServices.enabled: true).
A one-release escape hatch (router.endpointSliceCache.mode: "off") is available if you need to fall back to executor-driven addressing.
OCI package delivery becomes the cold-start path when a registry is configured
With a package registry configured (packageRegistry.enabled: true plus a repositoryPrefix and push/pull secrets), every successful build now publishes the deployment archive as a digest-pinned OCI image, and functions cold-start by pulling that image instead of downloading a tarball from the storage service.
If no registry is configured, nothing changes — packages keep using tarballs through the storage service exactly as before.
fallbackToStorage (default true) keeps a build succeeding by falling back to a tarball if the registry push fails; the package then carries an OCIPublished=False condition.
A single package can be kept on the tarball path with the annotation fission.io/package-delivery: tarball.
On Kubernetes 1.33+ you can additionally let the kubelet mount the code image directly as an image volume (executor.enableOCIImageVolume, default true, auto-gated to clusters that support it).
See OCI image packages for the full setup, registry-credential, and compatibility detail.
Streaming responses are not bound by the function timeout
Functions can opt into streaming (Server-Sent Events, HTTP chunked transfer, or a WebSocket upgrade) per function.
A streaming response is flushed incrementally and is not cut off at functionTimeout; instead it is governed by an idle timeout (default 60s, reset on each chunk) and an optional absolute maxDuration ceiling.
Existing functions are unaffected — streaming is off unless you enable it.
See Streaming responses.
Ingress route flow is deprecated in favor of the Gateway API
The router can now manage a Gateway API HTTPRoute for an HTTPTrigger, the same way it managed an Ingress for --createingress.
The --createingress / IngressConfig path still works but is deprecated, because the Kubernetes Ingress API is frozen.
Existing Ingress-based triggers keep working after upgrade and are not auto-converted; migrate them per trigger when you are ready.
See Exposing functions with the Gateway API.
Cleanup finalizers are active by default
A fission.io/function-cleanup finalizer (chart-wide finalizerEnabled, default on) makes the executor tear a function’s workloads down before the Function object is collected, closing a long-standing cross-namespace teardown leak.
If you ever need to force-delete a Function while the executor is down, clear its finalizers:
kubectl patch function <name> -n <ns> --type=merge -p '{"metadata":{"finalizers":[]}}'
Route conflicts are now deterministic and observable
The router builds its route table incrementally and resolves overlapping triggers with a deterministic precedence (host-qualified before host-less, exact path before prefix, longest prefix, then oldest trigger).
A trigger that loses a conflict now surfaces a RouteAdmitted=False condition with reason RouteConflict instead of producing a silently nondeterministic outcome.
If you have multiple triggers that overlap on host/path, check the RouteAdmitted condition after upgrading — the winning trigger may differ from the previous, list-order-dependent behavior.
Deprecations/Removals
- The Ingress route flow (
--createingress,IngressConfig) is deprecated in favor of the Gateway API route provider. It still functions; the Kubernetes Ingress API is frozen, so new triggers should use the Gateway API. - The event-based WebSocket keepalive mechanism (the fetcher
/wseventendpoints used by the Pythonsocket_tracker.py) is deprecated in favor of the streaming WebSocket path and is targeted for removal in v1.28. Themain(ws, clients)programming model is unchanged. - Minimum Kubernetes is unchanged at 1.32 (
kubeVersion: ">=1.32.0-0").
Highlights
- OCI-native package delivery.
A package’s deployment archive can be an OCI image instead of a zip archive — build a code-only image (
FROM scratch), push it to any registry, and reference it withfission package create --oci <ref>. When a package registry is configured, builds publish digest-pinned images automatically and functions cold-start by pulling cached layers instead of downloading and extracting a tarball, with a tarball fallback preserved. On Kubernetes 1.33+ the kubelet can mount the code image directly as an image volume, removing fetch-and-extract from the cold-start path entirely. - Gateway API route provider.
The router manages a Gateway API
HTTPRoutefor an HTTPTrigger in attach mode — Fission creates only the route and points it at an operator-owned Gateway, so it works with any conformant implementation (Envoy Gateway, Istio, NGINX Gateway Fabric, …) with minimal RBAC. Newfission routeflags (--route-provider,--route-host,--route-path,--gateway,--route-annotation) and aspec.routeConfigfield configure it. - Streaming responses. Functions can stream their response incrementally over Server-Sent Events, HTTP chunked transfer, or a WebSocket upgrade — for LLM token streaming, AI agent runs, chat, and other long-running responses — governed by an idle timeout rather than the function timeout. WebSocket is now first-class for every environment, not just the Python GEVENT environment.
- Functions as Model Context Protocol (MCP) tools.
A function can be advertised as an MCP tool (
fission fn create --expose-as-mcp --tool-description …) and discovered and invoked by any LLM agent that speaks MCP, with per-namespace scoping via a signed JWT. A newfission function toolssubcommand lists the exposed tools. - EndpointSlice-native data plane and a faster router hot path. The router serves warm traffic from EndpointSlices with zero executor RPCs, and a shared HTTP transport fixes connection keep-alive that never actually worked before — together cutting warm-path round-trip time substantially and raising throughput by an order of magnitude under load.
- Standard Kubernetes conditions on CRDs.
Function, Package, HTTPTrigger, and other resources now carry standard status
conditions(Ready,BuildSucceeded,RouteAdmitted, …), sokubectl wait --for=condition=Ready function/<name>andfission fn get -o wide(aCONDITIONScolumn) work, andkubectl describesurfaces why a resource is not ready.
Fixes
- Incremental router route updates. Canary weight changes and trigger edits no longer rebuild the entire router mux; routes are patched in place through a route table with handler indirection, and conflicts resolve deterministically.
- Self-healing function workloads.
A Deployment or Service deleted out-of-band is now re-created by the executor proactively (targeting
MinScale) instead of waiting for the next invocation. - Runtime error-noise reduction.
Pods use Kubernetes’ native
sleeppreStop lifecycle action instead ofexec /bin/sleep(which failed on shell-less distroless images), and trigger events delivered during the window between trigger creation and route reconciliation are retried instead of dropped on a transient router 404. - Endpoint quarantines expire after a TTL so a briefly-unhealthy pod address is retried rather than parked indefinitely.
- Routine dependency and CI maintenance.
- Helm chart published as 1.26.0, versioned independently from the app version.
Changelog
What’s Changed
- test(integration): add Rust + JVM builder env tests; enable post_body/src_glob by @sanketsudake in https://github.com/fission/fission/pull/3477
- feat(router): Gateway API route provider; deprecate Ingress by @sanketsudake in https://github.com/fission/fission/pull/3478
- fix(security): confine fetcher file ops to shared volume via os.Root by @sanketsudake in https://github.com/fission/fission/pull/3479
- chore(deps): bump the go-dependencies group with 2 updates by @dependabot[bot] in https://github.com/fission/fission/pull/3480
- chore(deps): bump the github-actions group with 2 updates by @dependabot[bot] in https://github.com/fission/fission/pull/3481
- feat(router): RFC-0008 streaming invocation path (SSE / chunked / WebSocket) by @sanketsudake in https://github.com/fission/fission/pull/3482
- feat(mcp): expose Fission functions as Model Context Protocol (MCP) tools by @sanketsudake in https://github.com/fission/fission/pull/3483
- feat: OCI-native package delivery by @sanketsudake in https://github.com/fission/fission/pull/3484
- feat: RFC-0002 EndpointSlice-native data plane (phases 0-3) by @sanketsudake in https://github.com/fission/fission/pull/3485
- docs: publish implemented RFCs under docs/rfc; add RFC-0002 perf benchmarks by @sanketsudake in https://github.com/fission/fission/pull/3486
- fix(router): expire endpoint quarantines after a TTL by @sanketsudake in https://github.com/fission/fission/pull/3487
- feat: RFC-0002 phase 4 — EndpointSlice data plane on by default by @sanketsudake in https://github.com/fission/fission/pull/3488
- chore(logging): fix three mislevelled/false-alarm control-plane logs by @sanketsudake in https://github.com/fission/fission/pull/3489
- chore(release): prepare 1.26 by @sanketsudake in https://github.com/fission/fission/pull/3490
- perf(router): RFC-0014 — shared transport (fix never-working keep-alive), allocation diet, resolver-cache removal by @sanketsudake in https://github.com/fission/fission/pull/3491
- perf(router): RFC-0013 — incremental route updates (route table + handler indirection, precedence + RouteConflict conditions) by @sanketsudake in https://github.com/fission/fission/pull/3493
- feat: RFC-0012 — OCI-native package delivery as the default (producer, B-fetcher variant, pool reaper, Path B default) by @sanketsudake in https://github.com/fission/fission/pull/3494
Full Changelog: https://github.com/fission/fission/compare/v1.25.0...v1.26.0