Skip to content

Vista Platform 4.6.0 — full list of changes

Covers 4.6.0 through its release candidates. The date on the final release is stamped when it ships. The release summary — highlights, what to do before upgrading, what each edition includes, and how to verify the signatures — is in CHANGELOG.md. This page is the complete, per-change record behind it.

4.6.0 is a platform-maintenance and clean-up release. The admin console gains a Maintenance section: backups of the platform database (optionally with the encryption keys and install secrets, encrypted under a passphrase), a banner and page that say when a newer release exists, and a one-click update that backs up first, verifies the chart signature, runs the upgrade as a Job and offers a rollback. A new Core maintenance-service does the work and is the only backend with a Kubernetes credential.

The release also finishes retiring resource-tracker-service, in four steps that each shipped behind the previous one: the AWS Cost Explorer sync nothing read was removed; resource-metrics ingest moved to auth-service; every reader moved to the metering table, dropping the generated figures the old readers filled gaps with; and the service itself was deleted. The algorithm reference table was reviewed row by row against current NIST guidance, and two fixes make the Observations review page stop growing with every repeat run of a controller.

Entries are grouped by kind, as they were recorded while the release was built.

Added

  • Back up the platform from the admin console. The new Maintenance → Backups page (platform group, needs platform.maintenance) takes a pg_dump of the platform database as a downloadable file, keeps the newest few (maintenance.backups.retention, default 5) and lists who ran what in a run history. Ticking Include encryption keys and install secrets also packs the master key, JWT signing key, install identity, generated datastore passwords and CBOM signing key, encrypted with a passphrase you choose (AES-256-GCM, key from Argon2id); the passphrase is stored nowhere. Restoring is a documented procedure, with a bundle-decrypt tool to open an encrypted file. See docsv4/core/operate/maintenance.md.
  • The admin console tells you when a newer release exists. A banner on every admin page ("Vista Platform X is available") and Maintenance → About & Updates compare the running version with the tags of the chart's OCI repository, so an install that pulls from a mirror checks its mirror. maintenance.updateCheck.{enabled,interval,includePrereleases} control it; enabled=false makes no outbound call, for air-gapped sites. About & Updates also ports the per-service version table and skew badge the tenant About page has.
  • Update the platform from the admin console. Maintenance → About & Updates → Update to X runs pre-flight checks, takes a database backup, verifies the chart's cosign signature, then runs helm upgrade --reset-then-reuse-values as a Job, with a progress page that survives the services restarting and a Roll back button when the upgrade or smoke step fails. maintenance.updates.{skipSignatureVerify,timeout,plainHttp} tune it for air-gapped mirrors. A release that changes the updater's own Role must be applied once with helm upgrade from the command line.
  • New Core maintenance-service (port 8102) behind all of these. It is the only backend holding a Kubernetes credential: a namespace-scoped ServiceAccount and Role, no ClusterRole, rendered only when maintenance.enabled (default on; false removes the service, its RBAC, the backups volume and the console section). It detects installs not managed by Helm (GitOps, not Kubernetes) and says so instead of offering an update. The new permission platform.maintenance is granted to Platform Administrator.

Changed

  • Algorithm catalogue aligned with current NIST guidance. The algorithm reference table was reviewed row by row against SP 800-131A Rev. 2, FIPS 186-5, SP 800-56A Rev. 3, SP 800-52 Rev. 2 and SP 800-227, and against the draft transition documents (SP 800-131A Rev. 3, IR 8547). Key sizes NIST disallowed in 2013 (RSA-1024, DH-1024, DH-768, P-192, the RFC 5114 1024-bit group), DSA (withdrawn by FIPS 186-5) and RC4 in Kerberos (RFC 8429) now grade obsolete / Critical, matching their already-obsolete siblings; five shipped obsolete rows that scored below the Critical band the Catalog dialog promises are raised to it, and a guard test now pins that floor. Triple DES stays deprecated but its mapping and date now say encryption was disallowed after 2023. Mappings that overstated NIST approval are corrected: X25519 / X448 are not SP 800-56A key-agreement schemes and ChaCha20-Poly1305 is not an approved cipher (strength ratings unchanged). HMAC-SHA-1 is rated one way everywhere (deprecated, approved until 2030): the Kerberos AES-CTS-HMAC-SHA1-96 types move from strong to acceptable, and the RFC 8009 Kerberos AES-SHA2 encryption types are added so they have an alternative to recommend. Every quantum-vulnerable public-key row now carries the IR 8547 (draft) 2030 deprecation date and names the 2035 disallowance in its guidance; the TLS and SSH PQ/T hybrid key exchanges share one convention; SHA-512/256, SHA-512/224, SHA3-224 and the SP 800-208 stateful hash signatures (LMS/HSS, XMSS, rated at their weakest approved parameter set) are catalogued; one SSH row that claimed a positive quantum category for classical X25519 and two inconsistent classical strengths are fixed. Existing installs pick the changes up on upgrade; rows a platform admin has edited are left alone.

  • Nothing reads from resource-tracker-service any more. Its four readers now take their figures from the metering table directly (third step of the service's retirement, issue #1263):

  • the MSP dashboard's API-call and data-ingestion series are real hourly buckets of tenant_resource_usage; its response-time, error-rate and throughput KPIs carry a measured flag and an empty series instead of the generated "realistic-looking" trend and placeholder constants they shipped with (the old fallback listed four services with made-up error rates);
  • inventory-service's tenant activity summary reads the tenant's 30-day API calls by SQL;
  • monitoring-service's tenant performance summary reads 24-hour API calls by SQL for throughput (it used to ask through a gateway URL that does not exist on Kubernetes and silently reported 0);

  • tenant-health's cost optimization factor is no longer scored: its inputs were an estimated price and an invented efficiency score. The breakdown keeps the key as null, unavailable_sources always lists cost-metering (as it does resource-metering), and the index is the three remaining factors at 25/20/15 over 60. Health indices move for every tenant on upgrade; the admin console shows the factor as "Not measured".

  • Resource-metrics ingest moves to auth-service. Every service's API-call metering middleware and monitoring-service's host collector now POST their samples to auth-service's HMAC-only /internal/resource-metrics, which writes tenant_resource_usage (the billing usage source) under the tenant bound into the request signature. The NATS METRICS stream and metrics.system subject are gone; the one publisher already spoke the HTTP shape. RESOURCE_TRACKER_URL is no longer read; RESOURCE_METRICS_INGEST_URL overrides the ingest URL in full. resource-tracker-service still accepts the old route for this release (second step of its retirement, issue #1263).

Fixed

  • Observations: a repeat interrogation of the same controller no longer re-creates every client it could not admit. Each run's sightings carried a new interrogation:<job> source ref, so every run of a UniFi controller added a fresh unresolved row per unadmitted client (one lab tenant reached 95 unresolved observations from four runs of one router). A run's observations now group by the interrogated device, so a repeat run is another receipt on the row the first made: the occurrence count rises, the row names the run its evidence came from, and the unresolved list stops growing per run. Rows created before the upgrade keep their old grouping and age out or can be dismissed; new runs do not add to them.
  • Observations review: a row that already belongs to one asset is offered as Link ahead of "needs a network" / "needs a sensor", and a hardware-address-only row is no longer told to add a network. The suggestion ladder consulted the network and collector state before ownership, so on a tenant whose sensors were all offline every blocked row read "needs a sensor" even when its identifiers already matched exactly one asset, and the one-click bulk Link was never offered. Ownership now decides first (one linkable owner → Link; several, or one that cannot be linked → review), "needs a network" is only suggested when the evidence carries an address a segment could cover, and a MAC-only unplaced row is marked likely noise with the new explanation code no_address_to_place. The SQL twin that filters and counts the page moved in lockstep; the Go-vs-SQL matrix now covers both polarities.

Removed

  • resource-tracker-service removed entirely (issue #1263, last of four steps). Everything it did that mattered now lives elsewhere: usage metering is written by auth-service's /internal/resource-metrics ingest and read from tenant_resource_usage by billing, the MSP dashboard, inventory-service and monitoring-service. Gone with it: its nine read endpoints (none had a UI caller), the resource_alerts table and active_resource_alerts view, its OpenAPI spec and typed client, its chart backend, routes and middlewares, its compose services, its place in the release matrices and the ECR/Harbor image lists, and RESOURCE_TRACKER_HOST_PORT. The commercial image set is 19 images (17 backends + 2 UIs) and Core is 18. The schema migration drops the two objects on upgrade. After upgrading, delete the orphaned METRICS JetStream stream (nats stream rm METRICS) and the service's Harbor repository by hand.

  • AWS Cost Explorer sync removed from resource-tracker-service. The sync job, its platform_integrations-backed credential loader, the aws_cost_data and aws_cost_sync_jobs tables with their three summary views and the cleanup_old_aws_cost_data() function are gone, and the service no longer pulls the AWS SDK into Core. Nothing read the data: no console page showed it, no peer called the cost endpoints, and the aws_costs block of GET /stats was an "estimated" stub on every deployment without an AWS integration record. The schema migration drops the objects on upgrade. ENCRYPTION_MASTER_KEY is no longer required by resource-tracker-service. First step of retiring the service (issue #1263; plan in docsv4/internal/developer/design/platform/resource-tracker-retirement-plan.md).