[ankur-paan]

Release Candidate 5 — rekuiper v1.0.0-rc5

This pull request prepares and qualifies rekuiper v1.0.0-rc5 (Release Candidate 5). It remediates newly published RustSec advisories (tokio and zstd), hardens REST/OTLP/UI authentication and network boundaries, eliminates lock-across-.await concurrency hazards in the Fleet Control Plane while adding durable KV state persistence, enforces deterministic WASM instruction fuel metering with lock-free instance pooling, and updates the technical documentation and architectural diagrams.

---

1. Executive Summary & Single-Core Benchmark Results

All benchmarks were executed on a single thread (--test-threads=1, TOKIO_WORKER_THREADS=1) in --release mode (-C target-cpu=native) on native Linux ext4 via crates/rekuiper-server/tests/perf_throughput.rs (500,000 events with active WHERE temp > 20.0 filtering, SELECT id, temp * 1.8 + 32 AS temp_f projection, and dead-letter queue error checks enabled):

Pipeline Architecture	v1.0.0-rc4 Baseline	v1.0.0-rc5 Verified	Elapsed Time (500k Events)	Improvement	Drain Delay
Zero-Parse In-Process SQL Pipeline	2,207,367 EPS	2,464,711.30 EPS	202.86 ms	+11.7%	0.0 ms
End-to-End JSON Streaming SQL Pipeline	1,085,885 EPS	1,141,416.93 EPS	438.05 ms	+5.1%	0.0 ms

---

2. Supply-Chain Security & RustSec Advisory Remediation

Remediated newly published RustSec advisories across the dependency tree while preserving strict zero-ignore isolation for downstream library crates (rekuiper-core and rekuiper-sql):

Advisory ID	Crate / Component	Vulnerability / Notice	Resolution in v1.0.0-rc5
RUSTSEC-2026-0386	tokio	Newly published advisory on tokio <= 1.53.1	Upgraded workspace tokio in Cargo.lock from 1.53.1 to 1.54.1.
RUSTSEC-2026-0410	zstd-sys	Newly published advisory on zstd-sys 2.1.0+zstd.1.5.7	Upgraded zstd-sys in Cargo.lock to 2.1.2+zstd.1.5.7.
RUSTSEC-2026-0391	zstd	SeekTable allocation bounds in zstd 0.13.3	Upgraded direct zstd dependency in rekuiper-sql from 0.13 to 0.14.3 (zstd-safe 8.2.0). Documented scoped transitive exception in deny.toml for rskafka 0.6.0 -> zstd 0.13.3 (SeekTable not used in Kafka framing).
RUSTSEC-2026-0398	zstd-safe	Multi-threaded dictionary sharing in zstd-safe 7.3.0	Upgraded rekuiper-sql to zstd-safe 8.2.0; documented scoped transitive exception in deny.toml for rskafka 0.6.0.
RUSTSEC-2026-0403	zstd-safe	Custom frame parameter bounds in zstd-safe 7.3.0	Upgraded rekuiper-sql to zstd-safe 8.2.0; documented scoped transitive exception in deny.toml for rskafka 0.6.0.

• Downstream Core Crates Zero-Ignore Isolation: Both rekuiper-core and rekuiper-sql compile with zero ignored RustSec advisories.

---

3. Security & Network Boundary Hardening

• Conditional Web UI Route Registration (crates/rekuiper-server/src/routes.rs):
  • /ui and /ui/ws routes are conditionally mounted only when basic.enable_ui is true, returning 404 Not Found when disabled.
• Authentication Middleware Enforcement (crates/rekuiper-server/src/routes.rs, state.rs):
  • Enforced basic.authentication RS256 JWT validation across /ui, /v1/metrics, /v1/logs, and /v1/traces (or configured ui_password bearer token on /ui). Only public liveness routes (/, /ping) and fleet endpoints (/fleet/ws, /api/v1/fleet/*, which enforce dedicated fleet_token bearer authentication) bypass the global RS256 middleware.
• Real Peer Socket IP Extraction (crates/rekuiper-server/src/lib.rs, state.rs):
  • Switched both the primary HTTP listener and the secondary EdgeX compatibility listener (59720) to app.into_make_service_with_connect_info::<SocketAddr>() so ui_ip_allowlist validates the client's TCP peer IP address rather than spoofable X-Forwarded-For headers.
• Configurable Prometheus Exporter Port (crates/rekuiper-server/src/lib.rs):
  • Updated the standalone Prometheus listener to bind to config.basic.prometheus_port (default 20499).

---

4. Fleet Control Plane Concurrency & Durable KV Persistence

• Non-Blocking Rollout & Rollback Dispatch (crates/rekuiper-server/src/fleet.rs):
  • Refactored dispatch_snapshot_to_cohort and trigger_rollback to clone matching device command channels (mpsc::Sender<ControlMessage>) inside short synchronous read-lock scopes, drop the lock guard immediately, and perform asynchronous channel dispatch outside the lock.
• Durable KV Persistence & Startup Recovery (crates/rekuiper-server/src/fleet.rs, state.rs):
  • Attached Arc<dyn KvStore> to FleetControlPlane with automatic state restoration (restore_from_kv()) on startup across four dedicated KV namespaces: fleet_devices, fleet_snapshots, fleet_rollouts, and fleet_audit (bounded to the 1,000 most recent entries).
  • Restored devices initialize with status: "offline" and connected_via_ws: false until their live Yamux WebSocket tunnel reconnects.

---

5. WASM Sandbox Fuel Metering & Runtime Efficiency

• Deterministic WASM Instruction Fuel Metering (crates/rekuiper-core/src/wasm.rs):
  • Enabled wasmi::Config::consume_fuel(true) on the WASM engine and enforced DEFAULT_WASM_FUEL_BUDGET = 1_000_000 instructions per UDF call (store.set_fuel(...)). Runaway guest loops deterministically trap with an instruction budget exhaustion error instead of stalling Tokio worker threads.
• Lock-Free WASM Instance Pooling (crates/rekuiper-core/src/wasm.rs):
  • Replaced per-record Linker::new + Module::instantiate allocations with a lock-free crossbeam_queue::ArrayQueue<PooledInstance> (8 pre-instantiated instances per module) with automatic linear-memory offset reset (__heap_base / 65536).
• 500ms TTL Host Telemetry Cache (crates/rekuiper-server/src/handlers/metrics.rs):
  • Replaced synchronous per-request sysinfo::System::new_all() scans on GET / and GET /metrics with a 500ms TTL cached snapshot (CachedHostStats).
• $O(1)$ Ring-Buffer Eviction (crates/rekuiper-core/src/manager.rs, crates/rekuiper-server/src/engine/windows.rs):
  • Replaced Vec::remove(0) $O(N)$ shifts with VecDeque::pop_front() $O(1)$ ring-buffer eviction across TraceSpan.events, RuleErrorBuffer.entries, and JoinStreamState.rows.
• Modular Source Connector Architecture (crates/rekuiper-server/src/engine/sources.rs):
  • Extracted source ingestion actors (mqtt, httppull, httppush, file, kafka, redis, sql, websocket, simulator, video, zmq, parquet, edgex, rabbitmq, neuron, modbus, opcua, otlp) from engine/mod.rs into engine/sources.rs.

---

6. Documentation & Release Artifacts (1.0.0-rc5)

• Fixed broken relative links in docs/en_US/guide/ui/web_console_user_guide.md.
• Synchronized docs/en_US/operation/fleet_management.md, docs/en_US/configuration/global_configurations.md, docs/en_US/extension/wasm/overview.md, and docs/en_US/public/diagrams/mcp_architecture.svg with the 1.0.0-rc5 runtime schemas and configuration parameters.
• Added architectural SVG diagrams across core concepts, security, windowing, join, DLQ, GitOps, WASM, and benchmark documentation pages.
• Updated Cargo.toml, Cargo.lock, Makefile, CHANGELOG.md, RELEASE_NOTES.md, SECURITY.md, README.md, openapi.json, deploy/chart/rekuiper/*, deploy/docker/*, and docs/* to 1.0.0-rc5.

---

7. Verification Matrix

• cargo fmt --all -- --check: 0 formatting diffs
• cargo clippy --workspace --all-targets -- -D warnings: 0 warnings across all targets
• cargo-deny check advisories & downstream rekuiper-core / rekuiper-sql zero-ignore isolation: Passed
• crates/rekuiper-core/src/wasm.rs unit & fuel-exhaustion sandbox tests: 4/4 passed
• crates/rekuiper-server/tests/test_otlp_and_ui.rs security & auth hardening tests: 4/4 passed
• crates/rekuiper-server/tests/test_phase4_fleet_control_plane.rs concurrency & KV persistence tests: 2/2 passed
• crates/rekuiper-server/tests/perf_throughput.rs single-core --release benchmark: 2,464,711.30 EPS (zero-parse) / 1,141,416.93 EPS (JSON)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ekuiper	Ready	Preview	Oct 28, 2026 12:26pm UTC

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.