v3.2.2

Release v3.2.2

🐛 Bug Fixes

• K8s /tmp emptyDir Mounts: Added emptyDir volumes for /tmp in all pod specs — fixes write failures in read-only root filesystem containers
• API 500 Errors: Resolved 500 errors from alpha smoke tests (gRPC converter datetime handling, EntityDTO dataclass mapping)

✨ Improvements

• AWS Connector: Dedup via external_id lookup, dependency linking for EC2/Lambda/RDS, IAM identity sync groundwork
• Cilium HTTPRoute: Wired Cilium Gateway API HTTPRoute template for beta ingress migration
• CI Pin Updates: Bumped CI dependency pins to v3.2.2

---

---

Version Details

Property	Value
Semantic Version	3.2.2
Full Version	3.2.2.1776737340
Epoch64 Timestamp	1776737340
Build Date	2026-04-21 02:09:00 UTC
Commit	146b78e5810e29235ddca825d77dc1eefb08ef89
Branch	main

Installation

Pull the latest Docker image:

docker pull ghcr.io/penguintechinc/elder:v3.2.2
docker pull ghcr.io/penguintechinc/elder:3.2.2.1776737340

---

This pre-release was automatically generated when the .version file was updated.

v3.2.1

Release v3.2.1

Version Details

Property	Value
Semantic Version	3.2.1
Full Version	3.2.1.1776737340
Epoch64 Timestamp	1776737340
Build Date	2026-04-21 02:09:00 UTC
Commit	f244fd1f84e98d843b8c92bbef5c08c9b0390549
Branch	main

Installation

Pull the latest Docker image:

docker pull ghcr.io/penguintechinc/elder:v3.2.1
docker pull ghcr.io/penguintechinc/elder:3.2.1.1776737340

---

This pre-release was automatically generated when the .version file was updated.

v3.1.6

Release v3.1.6

Version Details

Property	Value
Semantic Version	3.1.6
Full Version	3.1.6.1775150095
Epoch64 Timestamp	1775150095
Build Date	2026-04-02 17:14:55 UTC
Commit	ee173c84cb30af2ddfdf260560d4daf77e99629c
Branch	main

Installation

Pull the latest Docker image:

docker pull ghcr.io/penguintechinc/elder:v3.1.6
docker pull ghcr.io/penguintechinc/elder:3.1.6.1775150095

---

This pre-release was automatically generated when the .version file was updated.

v3.1.5

Release v3.1.5

🐛 Bug Fixes

PyDAL Stale Cursor — 401 on All @login_required Endpoints

• Fixed: All @login_required endpoints returned 401 Authentication required after the first request in a given connection
• Root cause: init_db() created a single app.db = DAL(..., pool_size=10) with no teardown_appcontext handler; psycopg2 closed the cursor after the first transaction and PyDAL's pool returned the stale connection to the next request; get_current_user() failed silently → None → 401
• Solution: Added teardown_appcontext(_teardown_db) in init_db() — calls db.commit() (or db.rollback()) at end of each request to reset cursor state cleanly

Issue Labels updated_at Missing Column

• Fixed: FieldNotFound: updated_at error when listing issues that have labels attached
• Root cause: issue_labels table defined in PyDAL without updated_at, but queries joining through issue_labels expected the column
• Solution: Added updated_at field to issue_labels PyDAL table definition and SQLAlchemy model

✨ Improvements

penguin-libs Migration

• Replaced: Local shared/react_libs copy with published @penguintechinc/react-libs npm package
• Integrated: SanitizedLogger from penguin-utils across API and Scanner services — replaces bare print() and logging.getLogger() calls with sanitized, structured output
• Removed: shared/react_libs/ directory; all consumers updated to package imports

E2E Test Suite (Playwright)

• Fixed CORS: loginAndSetToken rewritten to use Playwright's Node.js-side request.newContext() instead of page.evaluate() fetch — eliminates cross-origin failures when browser origin and API port differ
• Fixed port conflict: API port-forward now uses dynamic port selection via ss to avoid conflicts with docker-proxy (which binds 0.0.0.0:4000 for the API container)
• Graceful skip: Enterprise-gated UI elements (SSO Configuration and Tenants create buttons) now detected and skipped with test.skip() instead of timing out after 45s
• Result: 40 passing / 3 intentional skips / 0 failures (was 20 pass / 23 skip)

Kubernetes Manifests

• Added: Complete Helm + Kustomize overlays for alpha (elder.localhost.local) and beta (elder.penguintech.cloud) environments
• Added: scripts/smoke-test.sh with alpha (--alpha) and beta (--beta) modes; 9-phase test including Playwright browser tests
• Added: scripts/e2e-test-beta.sh for full beta E2E validation (pod health, ingress, API suite, Playwright)

---

---

Version Details

Property	Value
Semantic Version	3.1.5
Full Version	3.1.5.1774490516
Epoch64 Timestamp	1774490516
Build Date	2026-03-26 02:01:56 UTC
Commit	a850a8f8fdf9d64d0bb79df4740fc240ec4c3942
Branch	main

Installation

Pull the latest Docker image:

docker pull ghcr.io/penguintechinc/elder:v3.1.5
docker pull ghcr.io/penguintechinc/elder:3.1.5.1774490516

---

This pre-release was automatically generated when the .version file was updated.

v3.1.4

Release v3.1.4

Version Details

Property	Value
Semantic Version	3.1.4
Full Version	3.1.4.1773251978
Epoch64 Timestamp	1773251978
Build Date	2026-03-11 17:59:38 UTC
Commit	713475e10a56f547d1f49246bce743fe56ffa5f0
Branch	main

Installation

Pull the latest Docker image:

docker pull ghcr.io/penguintechinc/elder:v3.1.4
docker pull ghcr.io/penguintechinc/elder:3.1.4.1773251978

---

This pre-release was automatically generated when the .version file was updated.

v3.1.0

Release v3.1.0

⚠️ Breaking Changes

Cloud Discovery Execution Migration

• DEPRECATED: Cloud discovery execution in API (sunset v4.0.0)
  • Old behavior: POST /jobs/<id>/run executed synchronously, blocking until completion
  • New behavior: POST /jobs/<id>/run sets next_run_at=now() (202 Accepted), worker executes asynchronously
  • Fallback: POST /jobs/<id>/run?legacy=true for emergency synchronous execution (available until v4.0.0)
  • Migration: Update automation to poll GET /jobs/<id> for status and last_run_at instead of blocking on run endpoint

✨ New Features

Elder Worker Service

• Background operations ownership: Worker service now owns all background operations
  • Cloud discovery execution (AWS, GCP, Azure, Kubernetes)
  • Connector state synchronization
  • Credential refresh and expiration handling
• Worker polling architecture: Polls discovery_jobs table every 5 minutes
  • Zero external triggers required
  • Horizontal scaling ready (stateless design)
• Multi-provider discovery: Executes discovery for AWS, GCP, Azure, and Kubernetes providers
• Read replica support: Optional DATABASE_READ_URL environment variable for read-only connections
  • Enables horizontal scaling of read-heavy endpoints
  • Falls back to primary database if not configured

Stateless Container Architecture

• Worker credentials: Mounted from Kubernetes Secrets instead of persistent volumes
  • No PVC required
  • Supports pod disruption budgets and graceful eviction
• Scanner screenshots: Uses emptyDir temporary storage instead of PVC
  • Screenshots cleaned up after scan completion
  • No persistent storage overhead
• Ready for horizontal scaling: All Elder services now stateless (API, Worker, Scanner)

Per-Service Database Accounts (Least Privilege)

• Database role separation:
  • elder (API): Full access to all tables
  • elder_worker: discovery_jobs read/write, entities write, organizations read
  • elder_scanner: scan_jobs read, discovery_history write
• Benefits: Limits blast radius of compromised credentials, enforces operation separation
• Configuration: Via DATABASE_USERNAME and DATABASE_PASSWORD per container

Shared Database Module

• Centralized ORM/models: shared/models/ and shared/database/ for all services
  • Previously only available in Flask context
  • Now accessible to standalone services (Worker, Scanner, Connector)
• Non-API database access: Worker and other services can connect to databases without Flask
• Consistent schema version management: Alembic migrations centralized in shared/migrations/

Read Replica Optimization

• Heavy read endpoints use read replica (when DATABASE_READ_URL configured):
  • GET /entities (list, search, filters)
  • GET /graph (relationship traversal)
  • GET /discovery-jobs/<id>/history (discovery history)
  • GET /health/db (read-only health check)
• Write operations always use primary: Ensures consistency
• Fallback logic: If read replica unavailable, queries transparently use primary

🐛 Bug Fixes

Login System & Database Access

• Fixed: Portal authentication now uses Flask app context database properly
  • Changed from module-level database.db to current_app.db
  • Resolves database connection issues in single-tenant deployments
• Fixed: Single-tenant fallback for systems without explicit tenant
  • Login endpoint falls back to "system" tenant, then "default" if not found
  • Ensures login works in default deployments

Discovery Job Lifecycle

• Fixed: UpdateEntityRequest now includes organization_id field
  • Ensures entities are properly scoped to organizations during discovery
  • Resolves entity orphaning in multi-tenant scenarios
• Fixed: JWT token lifecycle improvements with proper datetime handling
  • Credentials now properly expire and refresh
  • Connector credentials no longer silently fail on expiration

📦 Technical Improvements

• Dependency: New worker service in Docker Compose (complementary to existing API, Scanner, Connector)
• Database scalability: Read replicas enable horizontal scaling without replication burden on primary
• Credential security: Kubernetes Secrets-based credential management (no PVC storage)
• Architecture documentation: Updated APP_STANDARDS.md with new microservices patterns

---

---

Version Details

Property	Value
Semantic Version	3.1.0
Full Version	3.1.0.1771036480
Epoch64 Timestamp	1771036480
Build Date	2026-02-14 02:34:40 UTC
Commit	156d64b3c24067ab78389fb06a3a8f0605f507f6
Branch	main

Installation

Pull the latest Docker image:

docker pull ghcr.io/penguintechinc/elder:v3.1.0
docker pull ghcr.io/penguintechinc/elder:3.1.0.1771036480

---

This pre-release was automatically generated when the .version file was updated.

Version 3.0.9

🎯 What's New

✨ Features & Improvements

• Connector entity client fixes and improvements from dmcnaught
• Express.js updated to ^4.21.0
• Enhanced TypeScript configuration for monorepo support
• Improved React components library integration

🐛 Bug Fixes

• Fixed module resolution for shared React components library
• Resolved TypeScript type checking issues in web application
• Fixed import ordering and linting issues

🔧 Technical Updates

• Updated CI/CD workflow for React library build step
• Enhanced TypeScript path aliases for better module resolution
• Improved type safety across web components

📦 Dependencies

• express: ^4.19.2 → ^4.21.0
• All dependencies updated and audited

✅ Quality Assurance

• All tests passing (Unit, Integration, E2E)
• Security scans passed
• Docker builds successful
• Code review passed (Sourcery)

Release Notes

This release includes important connector entity client fixes along with infrastructure improvements for better TypeScript support in the monorepo structure.

v3.0.8

Release v3.0.8

Version Details

Property	Value
Semantic Version	3.0.8
Full Version	3.0.8.1769707955
Build Date	2026-01-29
Commit	ebc625f

Highlights

Shared Component Library Migration

• Migrated 21+ form pages/components to shared @penguin/react_libs FormModalBuilder
• Migrated Profile page to shared FormBuilder with inline mode
• Migrated sidebar to shared SidebarMenu component
• Consistent form UX across the entire application

Docker & Infrastructure Fixes

• Fixed web container healthcheck failure (IPv6 mismatch with nginx)
• Replaced all Alpine images with Debian bookworm (postgres, redis, nginx)
• Added healthchecks for prometheus, alertmanager, and grafana
• Fixed connector port mapping (28000:8000 → 28000:28000)
• All 9 containers now report healthy

New Features (v3.0.x cumulative)

• On-call rotation management with automatic participant cycling
• Milestones for project timeline tracking
• License policy management for enterprise features
• Webhooks system with event-driven notifications
• Network topology visualization (interactive map)
• Sub-task support for hierarchical issue tracking
• SBOM dashboard with vulnerability tracking
• Global search across all resource types
• Multi-tenancy with tenant isolation

Installation

Pull images by release tag:

docker pull ghcr.io/penguintechinc/elder-api:3.0.8
docker pull ghcr.io/penguintechinc/elder-web:3.0.8
docker pull ghcr.io/penguintechinc/elder-connector:3.0.8
docker pull ghcr.io/penguintechinc/elder-scanner:3.0.8

Or use the latest stable release:

docker pull ghcr.io/penguintechinc/elder-api:latest
docker pull ghcr.io/penguintechinc/elder-web:latest
docker pull ghcr.io/penguintechinc/elder-connector:latest
docker pull ghcr.io/penguintechinc/elder-scanner:latest

Full Changelog

v3.0.7...v3.0.8

v3.0.7

Release v3.0.7

Version Details

Property	Value
Semantic Version	3.0.7
Full Version	3.0.7.1769481682
Epoch64 Timestamp	1769481682
Build Date	2026-01-27 02:41:22 UTC
Commit	c9fed4fc2fc5af4e427018024603393007191d46
Branch	main

Installation

Pull the latest Docker image:

docker pull ghcr.io/penguintechinc/elder:v3.0.7
docker pull ghcr.io/penguintechinc/elder:3.0.7.1769481682

---

This pre-release was automatically generated when the .version file was updated.

v3.0.6

Release v3.0.6

Version Details

Property	Value
Semantic Version	3.0.6
Full Version	3.0.6.1769094944
Epoch64 Timestamp	1769094944
Build Date	2026-01-22 15:15:44 UTC
Commit	feeb31dde71fc7343620387e1a1317aa811645d9
Branch	main

Installation

Pull the latest Docker image:

docker pull ghcr.io/penguintechinc/elder:v3.0.6
docker pull ghcr.io/penguintechinc/elder:3.0.6.1769094944

---

This pre-release was automatically generated when the .version file was updated.