3.25 Releases

Convox 3.25 upgrades Kubernetes to 1.35 across all providers. Later patch releases add stateful services with per-replica persistent volumes, per-app instance cost tracking on Azure, Karpenter NodeOverlays, GCP node pools with GPU and Cloud TPU support, multi-arch App image builds, and network isolation between App namespaces on AWS.

3.25.0

Released: 2026-07-08

Updates

• Upgraded Kubernetes to v1.35 across all providers (EKS, GKE, AKS, DOKS)
• Updated kube-proxy to v1.35.3
• Updated VPC CNI to v1.22.3
• Updated CoreDNS to v1.14.3
• Updated EBS CSI Driver to v1.62.0
• Updated EFS CSI Driver to v3.3.0
• Updated Cluster Autoscaler to v1.35.0

View on GitHub

3.25.1

Released: 2026-07-17

Feature Additions

• Added per-app instance cost tracking for Azure Racks through the new cost_tracking_enable rack parameter, which powers convox cost breakdowns and monthly budget caps
• Added the karpenter_node_overlays_config rack parameter for creating Karpenter NodeOverlays, which advertise extended resources such as nvidia.com/gpu on fractional-GPU instance families or adjust the prices Karpenter uses in its cost model
• Added six optional convox run flags for per-invocation pod customization: --termination-grace, --annotations, --labels, --use-service-lifecycle, --node-affinity, and --tolerations
• Added a CLI preflight check on convox build, convox deploy, and convox test that flags a Build which would drop environment variables set in the running Release. See build

Updates

• Updated the Karpenter chart from 1.10.0 to 1.13.1, adding Kubernetes 1.35 and 1.36 support. Racks with Karpenter enabled may see a one-time gradual node replacement after this update, bounded by karpenter_disruption_budget_nodes
• Refreshed the AWS and Azure instance price tables used by cost tracking, with AWS prices at current us-east-1 Linux on-demand list prices
• Run and Timer pods now honor the Service's termination.grace setting from convox.yml, matching the behavior of Service deployments

Fixes

• Renewed Let's Encrypt certificates now propagate automatically from the Rack namespace to App namespaces, so Services referencing a certificate through the certificate: option always serve the current one. See SSL

View on GitHub

3.25.2

Released: 2026-07-21

Updates

• The environment drop guard added in 3.25.1 now warns and continues instead of blocking, with CONVOX_ENV_DROP_GUARD=strict to restore the blocking behavior. This ships in the convox CLI, so it arrives with a CLI update rather than with convox rack update. See build

View on GitHub

3.25.3

Released: 2026-07-26

Feature Additions

• Added the additional_node_groups_config rack parameter to GCP Racks, using the same JSON format as Azure
• Added GPU node pools on GCP through the gpu_type and gpu_count fields of additional_node_groups_config
• Added single-host Cloud TPU node pools on GCP through the tpu_topology field of additional_node_groups_config
• Added the gpu_observability_enable, gpu_observability_chart_version, and dcgm_scrape_interval rack parameters to GCP Racks, which install the NVIDIA DCGM exporter and its Grafana dashboards
• GCP nodes in the g2, a2, a3, a4, a4x, and g4 machine families now receive the convox.io/gpu-vendor label
• Added the cloudwatch_disable rack parameter for AWS, which stops the Rack creating, writing, and reading its own CloudWatch log groups
• Added the karpenter_build_disruption_budget_nodes rack parameter for AWS, default 100%, which sets the Empty disruption budget on the Karpenter build NodePool so idle build nodes are reclaimed promptly
• Added multi-arch App image builds on AWS Racks with Karpenter enabled whose workload architectures span both amd64 and arm64
• The BuildArch App parameter is now accepted by the Rack, pinning an App's Builds to amd64 or arm64

Updates

• AWS additional node groups and build groups are now created before the old group is destroyed, and editing only a group's tags no longer forces a replacement. See additional_node_groups_config
• Raising min_size on an AWS additional node group now scales the live EKS group up before terraform apply runs, so the apply no longer fails when the requested minimum exceeds the group's current desired size. See additional_node_groups_config
• Convox-owned Helm releases left pending by an interrupted apply are now cleared before the next terraform apply on AWS Racks, so a Rack does not stay stuck behind a stranded release lock. See Troubleshooting
• The zones field of additional_node_groups_config is now preserved by the CLI, which previously dropped it before the value reached Terraform. See additional_node_groups_config
• karpenter_disruption_budget_nodes, karpenter_build_disruption_budget_nodes, and the disruption_budget_nodes field of additional_karpenter_nodepools_config now reject percentages above 100
• capacity_type inside additional_node_groups_config is now validated per provider: AWS accepts ON_DEMAND and SPOT, while Azure and the other providers additionally accept Regular and Spot
• Duplicate id values in additional_node_groups_config and additional_build_groups_config are now rejected instead of colliding on the Terraform for_each key
• convox rack params set now rejects Karpenter instance family lists that cannot satisfy the Rack's architecture
• convox rack params set now warns when cloudwatch_disable and fluentd_disable are set inconsistently on AWS
• Upgraded the build toolchain to Go 1.25.12 and refreshed golang.org/x/text to 0.39.0, golang.org/x/crypto to 0.53.0, and go-jose/go-jose to 4.1.4
• Build source packaging and .dockerignore matching now use moby/go-archive and moby/patternmatcher, which removes the docker/docker, moby/buildkit, containerd, and runc dependencies from the convox binary and changes how nested exclude and re-include patterns are matched. This ships in the CLI. See .dockerignore

Fixes

• Fixed convox rack install metal failing at terraform validate, caused by the metal router module using the key_algorithm argument removed in version 4 of the TLS provider without declaring the provider
• convox builds export and convox builds import now copy every platform in an image manifest instead of only the default one, so exporting and re-importing a multi-arch Build preserves all architectures
• A failed image push during convox builds import now fails the import instead of being reported as success

View on GitHub

3.25.4

Released: 2026-08-13

Feature Additions

• Added opt-in stateful Services, rendered as StatefulSets with a stable identity and a per-replica persistent volume
• Added the spreadAcrossZones Service attribute, which spreads a Service's pods across availability zones and nodes
• Added the network_policy_enable rack parameter for AWS Racks, which restricts inbound connections to an App's pods
• Added the health.grpcService Service attribute, which selects the gRPC health service name checked by the readiness probe

Updates

• Deploys, convox run --node-labels, and the BuildLabels App parameter now fail immediately when they target a Karpenter node pool the Rack does not have
• convox rack params set now requires --force before a change drops a node pool, node group, or build group from a Rack

Fixes

• health.disable is now honored on gRPC Services
• A liveness probe configured with liveness.path now renders as configured on a non-gRPC Service that also sets grpcHealthEnabled: true and health.disable: true

View on GitHub

See Also

• Releases for the full release history
• Volumes for stateful Services and per-replica persistent volumes
• network_policy_enable for restricting inbound connections to App pods
• Health Checks for gRPC health checks, including health.grpcService
• Karpenter for Karpenter configuration, node pool validation, NodeOverlays, and architecture selection
• cost_tracking_enable, Cost Tracking, and Budget Caps for the cost and budget surface
• run for the pod customization flags
• build for the environment drop guard
• SSL for certificate renewal propagation
• additional_node_groups_config for GCP node pools, including GPU and Cloud TPU pools
• gpu_observability_enable and Monitoring for GPU observability
• cloudwatch_disable and fluentd_disable for routing Rack and App logs away from CloudWatch
• additional_node_groups_config and additional_build_groups_config for AWS node groups
• BuildArch and Workload Placement for build architecture and node placement