Operational resilience
Database singleton lock. The server now guards against more than one instance being active on the same database. On startup it acquires a PostgreSQL advisory lock and holds it for its whole lifetime: a second server pointed at the same database waits for the lock and refuses to start if it cannot acquire it, and a running server that loses the lock (for example after a database failover) shuts down. This prevents database corruption from stray or duplicate servers, such as a forgotten instance left running during a migration. The lock is enabled by default and configurable via the new database.singleton_lock and database.singleton_lock_wait_time options.
Automatic recovery from stale local state. The server keeps each environment's project checkout and compiler venv on its local filesystem, while compile reports live in the database. These can disagree: the server may have been promoted after a failover, or its state directory may have been wiped or restored from a snapshot. At startup the server now verifies for every environment that the project state on its local filesystem was produced by that environment's latest compile, and when it was not, it automatically requests an update and recompile so the local state converges to the project definition.
Together, these two safeguards make the orchestrator more resilient against deployment errors and make an active/passive high availability setup easier to support and safer to operate.
Production-grade database authentication
The built-in database authentication method is now production grade. It ships with safer defaults out of the box (password rules, session expiry, audit logging) and can act as a break-glass fallback for OIDC setups. It intentionally stays simple: when you need advanced password policies, MFA or SSO, an external OIDC identity provider is still the way to go.
Hardened database login. Passwords must now be between 12 and 128 characters long and use at least three of four character classes (lowercase, uppercase, digit, special), enforced on the API and the inmanta-initial-user-setup tool. Login response times no longer reveal whether an account exists, and changing your own password now requires providing the current one (an administrator changing another user's password does not).
Login sessions expire and renew automatically. Web Console login sessions (database and break-glass authentication) now expire after one hour by default, controlled by the new server.login_session_expire option and decoupled from the auth_jwt expiry that governs agent and compiler service tokens. To keep this friction-free, a new POST /api/v2/login/renew endpoint lets an authenticated client exchange its still-valid session token for a fresh one, and login responses now report expires_in. The Web Console uses this to renew active sessions before they expire, so users are never logged out in the middle of their work.
Login audit logging and password redaction. Every login attempt, successful or not, is now audit-logged with the username and source IP. Password parameters of the login and user management API calls are redacted wherever they are logged, so they no longer end up in debug logs or tracing spans.
Unicode password normalization. Passwords are normalized to Unicode NFKC before hashing and verification, so passwords containing non-ASCII characters verify regardless of how they were typed. Existing password hashes keep working and are transparently re-hashed on the next successful login.
Break-glass database login for OIDC setups. With the new web-ui.oidc_local_fallback option, setups using OIDC or JWT authentication can fall back to the database authentication method. When the identity provider is unavailable, an admin can still sign in with a local database account and manage users and roles, just like with database authentication.
Revocable API tokens with attribution. User-created API tokens are now recorded in a token registry: each non-idempotent token carries a jti claim and can be listed and individually revoked through the new environment_token_list and environment_token_revoke API endpoints. Revoking a single leaked or retired token no longer requires rotating the signing key. Tokens also carry a claim identifying the user that created them, and the per-call request log reports the token's client types, creator and environment instead of an anonymous user. Idempotent, service and legacy tokens keep their stateless, signature-only validation.
Token lifecycle, revocable by default. Creating a token (both in the console and via environment_create_token) now produces a revocable, registered token by default; pass idempotent=true explicitly to keep creating reproducible, stateless tokens. Tokens can be given an expiry at creation time (presets or a custom duration in the console, an expire parameter on the API). The Settings page gains a Tokens tab that lists each registered token with its creator, client types, issue, last-used and revocation times, and lets you revoke tokens individually. Expired and revoked tokens are automatically removed from the registry after a retention period (server.token-retention, default thirty days).
Web Console: a more powerful Resources view
The Resources view introduced in ISO 9 keeps improving:
- Sorting is now available on the Resources page, including sorting by compound state and deployment status.
- A new orphaned filter was added to the status filter, and the orphaned, deploying and purged filters now support both include and exclude, with check and cross icons making the selection easy to read.
- A "Reset Filters" button restores the default view (excluding orphaned resources) in one click.
- Compound state popovers and legend tooltips now show human-readable labels (e.g. "Not Blocked", "Last Handler Run") instead of raw status keys.
- The deploying spinner label on the Resources page is now clickable, toggling the deploying filter on and off.
Web Console: smoother service instance workflows
- Service instance forms can now be split into named tabs through model annotations: a web_tabs catalog on the service entity defines the tabs, and a web_tab annotation assigns top-level attributes or relations to a tab; unassigned fields land on the default tab.
- Dictionary fields in service instance forms now use a dedicated JSON editor (Monaco) instead of a plain text input.
- Optional boolean attributes are shown as a True/False toggle group, with no selection representing the unset value.
- Form suggestions now support label/value pairs (a human-friendly label backed by the underlying value) and can resolve ${entity_type}, ${identifying_attribute} and ${instance_id} variables from the current form's identity.
- The set state and expert set state actions now let you attach a custom message to the state transfer.
- The attribute compare view lets you search for specific versions, shows the creation date of each version, and aligns timestamps for easier scanning.
- Selects with numeric enum options now sort numerically instead of alphabetically, and long option lists are scrollable.
Content-aware facts, parameters, and attribute views
The facts table, parameters table and resource details now present each value according to its content: JSON, XML and other long or multi-line values can be expanded inline into a read-only, formatted code editor with copy and download controls, while short values can be copied directly from the row. Pretty-printed JSON and XML values offer a "Copy raw value" action that copies the original, unformatted string. Fact timestamps are shown as relative dates with a full timestamp tooltip.
Web Console: orders, composer and performance
- The Orders view now colors the acknowledged status distinctly in the progress bar, links order detail rows to the service instance, shows display values instead of raw ids, and expands the matching row when clicking a dependency.
- The instance composer no longer freezes to a blank canvas when the service catalog is refreshed mid-session, and it properly cleans up its rendering engine when leaving the page.
- The composer is now loaded lazily, so its rendering libraries are only fetched when a composer page is opened, and moment.js was replaced with day.js, together making the initial page load noticeably lighter.
- Reduced unnecessary re-renders on the Resources page.
API and operations
- The inmanta module release command now uses the changelog entries of the released version as the release tag message.
- The orchestrator container image now installs the latest OS security updates when it is built.
- The resources GraphQL query gains a modelVersion filter to fetch the resources of a specific model version instead of the latest released one.
- The inmanta-support-tool collect-from-server command now works against https URLs and sends the authorization header when an authentication token is configured.
- The support tool's import-dump command now handles database schemas with circular foreign key constraints.
- The orchestrator container now ships the PostgreSQL client tools, so inmanta-support-tool captures a full pg_dump database dump instead of falling back to the slower export path.
- Resource IDs with invalid characters now raise a clear error instead of failing obscurely.
Reliability fixes
- Server-side compiles now run git non-interactively: a failing checkout of a repository that requires authentication reports the real authentication error instead of a confusing "could not read Username" message.
- Fixed a bug in stale session cleanup where a loss of database connectivity could cause the scheduler to miss new version notifications.
- Fixed a bug where the scheduler would stop processing new model versions after the database had been running in read-only mode.
- Fixed two agent executor cleanup issues: idle executors are cleaned up again after the agent reconnects to the server (no more leaked executor processes), and regularly used executors are no longer rebuilt more often than the configured retention time, removing avoidable deployment latency.
- Fixed a race condition where an executor created while the scheduler was shutting down would never be stopped or cleaned up, and fixed a leak of cleanup jobs in the executor pool manager.
- An update of the configured repository URL of an Inmanta project is now correctly reflected in the project checkout of the compiler service.
Deprecation notes
- The Compliance Check and Desired State Compare pages in the Web Console no longer offer showing unmodified resources.
Upgrade notes
- Please follow the documented upgrade procedure and ensure the database is backed up before executing the upgrade.
- The bundled Open Policy Agent (OPA) was bumped to v1.18.2.
For the full list of changes, see the changelog.