Skip to main content

Release 0.5.27 — Access Explorer, Audit Retention, OpenFGA as Source of Truth, and Credentials UI Refresh

Sri Aradhyula
Sri Aradhyula

Released: 2026-06-28 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.27 Previous release: 0.5.26

Highlights​

0.5.27 is the largest release in this series. OpenFGA becomes the authoritative source for team resource access, replacing a mix of local state and FGA reads. Admins get an access explorer and an RBAC self-check tool for diagnosing permission issues. Audit logging gains S3 retention controls, storage usage visibility, and configurable verbosity. The credentials panel is consolidated into a single scrollable pane. Stale RBAC principals and grants are cleaned up automatically. Several security fixes also land.

What's New​

OpenFGA is now the source of truth for team resource access​

Team resource access — which teams can reach which agents, knowledge bases, and tools — is now read exclusively from OpenFGA rather than from the local database. The admin team UI is decluttered to reflect this: only the access grants stored in FGA are shown, removing redundant fields. (#2021)

Access explorer and RBAC self-check​

A new access explorer in the admin panel lets admins browse effective permissions by user, team, and resource. Alongside it, an RBAC self-check tool runs a suite of authorization checks and reports pass/fail results — useful for diagnosing why a user cannot reach a resource without needing to interpret raw FGA tuples. (#2059)

Audit: S3 retention, storage visibility, and configurable verbosity​

Audit log retention can now be configured with S3 lifecycle rules directly from the platform. The admin panel shows current audit storage usage so you know how much space is being consumed. Log verbosity is also configurable — you can reduce audit volume for lower-signal event types without losing coverage on high-signal ones. (#2056)

Credentials panel consolidated into a single pane​

The credentials settings panel previously used multiple tabs for different credential types. These are now collapsed into a single scrollable pane, making it easier to scan and manage all credentials without tab-switching. (#2044)

Stale RBAC principals and grants cleaned up​

When users or teams are deleted, their associated OpenFGA grants and principal entries were previously left behind. These are now cleaned up as part of the delete flow, keeping the FGA model consistent with the actual set of active principals. (#2060)

Keycloak IDP hook delete policy is configurable​

The Keycloak IDP initialization hook now supports a configurable delete policy. This matters for deployments that want to preserve existing IDP configuration across upgrades rather than having the hook reset it. (#2051)

Bug Fixes​

  • Popover dropdowns did not open inside dialogs: Custom popover-based dropdowns (used in several admin forms) were not opening when the dropdowns were rendered inside a modal dialog. Fixed. (#2048)
  • Knowledge Bases settings tab removed from admin: The Knowledge Bases tab in the admin settings panel was showing stale configuration options that are no longer applicable. The tab is removed. (#2057)
  • Setup script referenced wrong secret path: The setup-caipe script was referencing configBridge.bff when the correct path is configBridge.ui. Configurations written by the setup script were being placed in the wrong location. (#2058)
  • Stale dynamic agent CRUD router removed: An old agent CRUD router from the dynamic agents service was still in place despite the routes it exposed being replaced by newer endpoints. The router is removed to avoid routing ambiguity. (#2054)
  • Security alerts in UI dependencies: Dependency audit and pnpm lockfile alerts are resolved for the UI package. (#2053)

Breaking Changes​

No breaking changes. Drop-in upgrade from 0.5.26.

Note: The configBridge.bff secret path used by the setup script is corrected to configBridge.ui. If you ran the setup script against 0.5.26 or earlier and are seeing missing configuration, re-run the setup wizard after upgrading.

Upgrade Guide: 0.5.26 → 0.5.27​

Helm Values Changes​

No required values changes.

If you want to configure Keycloak's IDP hook delete behavior, a new value is available:

keycloak:
  initIdpHook:
    deletePolicy: "skip"  # or "delete" (default behavior from prior releases)

Upgrade Runbook​

helm upgrade ai-platform-engineering \
  oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
  --version 0.5.27 \
  -f your-values.yaml

Verify:

kubectl get pods -n <namespace>