Skip to main content

Release 0.5.8 — Skills FGA, catalog API keys BFF, and RBAC migrations

Sri Aradhyula
Sri Aradhyula

Released: 2026-06-04 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.8 Previous release: 0.5.7

Highlights​

0.5.8 continues enterprise RBAC work: skill team shares reconcile through the shared OpenFGA shareable-resource module, catalog API keys can be minted from the CAIPE UI BFF without the supervisor, and admin ReBAC migrations cover agent/skill FGA backfills. See the upgrade guide below for the catalog API key hash change before upgrading production.

Release 0.5.9 — Slack Channel Management, Ownership Transfer, and RBAC Hardening

Sri Aradhyula
Sri Aradhyula

Released: 2026-06-05 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.9 Previous release: 0.5.8

Highlights​

0.5.9 rounds out Slack channel management (channel delete, in-place agent swap, config-team import), introduces unified ownership-transfer flows across agents, RAG knowledge bases, and MCP tools, and hardens local-dev RBAC so the org-admin bypass and Slack channel visibility work correctly out of the box. RAG embeddings are now preserved across non-interactive upgrades in setup-caipe.sh.

Release 0.5.7 — Keycloak PostgreSQL, AgentGateway Config-Bridge, and Setup Overhaul

Sri Aradhyula
Sri Aradhyula

Released: 2026-06-02 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.7 Previous release: 0.5.6

Highlights​

0.5.7 is a substantial release. Keycloak gains optional PostgreSQL persistence (database.enabled), the AgentGateway Helm chart wires in the config-bridge sidecar for dynamic MCP route management, and setup-caipe.sh is significantly overhauled to support public-domain SSO, optional GitHub social login, a unified LiteLLM front for chat and embeddings, shared Postgres for Keycloak and OpenFGA, and a creds command for reprinting local logins.

Release 0.5.5 — Keycloak Role and Admin UI Fixes

Sri Aradhyula
Sri Aradhyula

Released: 2026-06-01 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.5 Previous release: 0.5.4

Highlights​

0.5.5 is a targeted maintenance release fixing Keycloak service-account roles and admin UI noise. The caipe-platform service account role list is corrected (view-realm and manage-realm added, then manage-realm removed in the follow-up 0.5.6 patch — see those notes). Bootstrap admin log spam is silenced and Keycloak warning blocks are consolidated into a single amber UI section.

Release 0.5.6 — Keycloak manage-realm Role Patch

Sri Aradhyula
Sri Aradhyula

Released: 2026-06-01 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.6 Previous release: 0.5.5

Highlights​

0.5.6 is a single-fix patch. The manage-realm role is restored to the caipe-platform service account desired roles after it was incorrectly removed in 0.5.5. This role is required for the BFF migration to manage realm configuration.

Release 0.5.2 — RAG Access Control and Gateway Routing

Sri Aradhyula
Sri Aradhyula

Released: 2026-05-29 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.2 Previous release: 0.5.1

Highlights​

0.5.2 completes the OpenFGA relationship-based access model for RAG and Knowledge Bases — knowledge bases can now be shared with teams, every Knowledge sidebar tab is gated on a real OpenFGA capability, and the RAG server and BFF enforce deny-by-default. AgentGateway gains an MCP route bridge so platform MCP endpoints (including the built-in Knowledge Base server) can be rendered straight from Helm, and the default now routes all gateway-managed MCP servers through the gateway. Keycloak adds strict client-secret reconciliation for production installs and a migration-health panel in the admin UI, while a RAG ingestor SSRF fix and pinned TLS dependencies harden the web loader.

Release 0.5.3 — CRD-Free Gateway and Release-Name Defaults

Sri Aradhyula
Sri Aradhyula

Released: 2026-05-29 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.3 Previous release: 0.5.2

Highlights​

0.5.3 makes AgentGateway CRD-free by default. The new global.agentgateway.routingMode defaults to static, so enabling the gateway renders the standalone proxy's own config instead of Gateway API / AgentGateway custom resources — no cluster-scoped CRDs and no controller install required, which keeps helm diff and helm upgrade clean on clusters you do not own. The chart also stops hardcoding ai-platform-engineering-* service URLs: in-cluster defaults are now computed from the Helm release name in the deployment templates, so installs under a custom release name resolve their supervisor, Keycloak, OpenFGA, skill-scanner, and bot URLs correctly without manual overrides. Rounding out the release, every agent gains proper Kubernetes startup/liveness/readiness probe semantics, and a Twisted bump closes a DNS-compression DoS in the RAG web loader.

Release 0.5.4 — Admin UI Polish and Keycloak Realm Fix

Sri Aradhyula
Sri Aradhyula

Released: 2026-05-29 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.4 Previous release: 0.5.3

Highlights​

0.5.4 is a small maintenance release focused on admin UI consistency and a Keycloak fix. Native agent and team <select> controls are replaced with the shared searchable picker components, and the Slack and Webex admin panels are consolidated into a single ConnectorAdminPanel, so connector management looks and behaves the same everywhere. Team cards now surface knowledge-base, agent, and tool counts at a glance, the team Knowledge tab's create links point at the correct /knowledge-bases route, and Keycloak renders the configured realm name instead of assuming caipe. There are no values.yaml changes — this is a drop-in upgrade from 0.5.3.

Release 0.5.1 — Fine-Grained Knowledge Base RBAC

Sri Aradhyula
Sri Aradhyula

Released: 2026-05-27 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.1 Previous release: 0.5.0

Highlights​

0.5.1 makes OpenFGA the source of truth for human access to the RAG knowledge base surfaces — Search, Data Sources, Graph, and MCP Tools — and lets admins share individual knowledge bases with teams through relationship-based grants. Under the hood, team membership is consolidated into a single canonical store so every reader and writer agrees on who belongs to a team, eliminating the drift that caused authorized users to fall back to the Default CAIPE Supervisor instead of their configured agent. The release also adds a searchable team picker across admin panels, a friendlier first-run experience that seeds a working Hello-World agent, and an intentionally noisy emergency flag to bypass UI RBAC while repairing an OpenFGA/Keycloak stack.

Release 0.5.0 — Enterprise RBAC and OpenFGA Authorization

Sri Aradhyula
Sri Aradhyula

Released: 2026-05-26 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.0 Previous release: 0.4.18

Highlights​

0.5.0 is a headline minor release that lands CAIPE's enterprise authorization foundation: a full cutover from legacy role-based access control to relationship-based access control (ReBAC) backed by OpenFGA, with Keycloak as the identity provider and an AgentGateway ext_authz bridge enforcing per-call MCP decisions. The release introduces a new Webex bot alongside ReBAC-aware Slack routing, an envelope-encrypted credential store and OAuth connector platform, and a hardened secrets bootstrap that fails loudly on dev placeholders instead of silently shipping insecure defaults. The entire authorization stack is opt-in and disabled by default — for a stock 0.4.18 deployment this is a drop-in upgrade with no values.yaml edits required. Operators who adopt RBAC get team-based access control, per-document RAG ACLs, channel-derived team binding for bots, and a redesigned admin UI for managing teams, identity-group sync, and onboarding defaults.