[Feat] Add v4.4.0 release notes

content/latest/_index.md

@@ -4,7 +4,7 @@ weight: 002
 description: User guides, deploy docs, references, and deep dives about the
   Rhize manufacturing data hub.
 cascade:
-  v: "4.3.0"
+  v: "4.4.0"
   type: "docs"
   icon: molecule
 

content/latest/releases/4-4-0.md

@@ -0,0 +1,193 @@
+---
+title: 4.4.0
+description: Release notes for v4.4.0 of the Rhize application
+categories: ["releases"]
+weight: 1639347320
+aliases:
+  - /releases/4-4-0
+
+---
+
+Release notes for version 4.4.0 of the Rhize application.
+
+_Release date:_
+11 August 2026
+
+## Changes by service
+
+The following sections document the changes this release brings to each service.
+
+### Admin
+
+#### Add
+- Add opt-in support for authentication against a generic OIDC provider instead of Keycloak
+- Add environment variable `APP_AUTH_OIDC_ADDITIONAL_SCOPES` to request extra scopes on top of standard scopes
+- Add JWT node template
+
+#### Change
+- Change Physical Assets page to use generic versioned entity components
+- Change OIDC to request `openid`, `profile`, `email`, and `offline_access` as standard scopes on every sign-in
+- Change description on Google BigQuery node template for clarity
+
+#### Fix
+- Fix issue where inline editing on Equipment Class Properties would result in a GraphQL error
+- Fix issue where saving a versioned entity with many entities present would cause the version dropdown to disappear
+- Fix Equipment sidebar search not searching unloaded Equipment
+- Fix missing success notification for enabling and disabling Equipment
+- Fix missing scopes on OIDC sign-in
+- Fix extra brackets being displayed around version on Physical Asset page
+- Fix Approved and Deprecated Physical Asset versions allowing properties to be disabled
+- Fix Physical Asset page showing success message along with error message when trying to create duplicate property
+- Fix versioning in Physical Asset properties to include version number in entity version prefix to prevent duplicate ID error
+- Fix issue with connections not rendering in Work Master editor
+- Fix issue with dragging nodes not updating selection in Work Master editor
+- Fix positioning of Work Master nodes created by API
+
+### Known Issues
+- Known issue where navigating to another tab after adding an Equipment Asset Mapping may cause the newly created mapping to disappear
+- Known issue preventing editing of inherited properties on Equipment, Person, Operations Event Definition, and Physical Asset pages
+- Known issue where creating a new version on the Person page causes other versions to disappear from the dropdown
+- Known issue where two Active versions may display for an Operational Location
+- Known issue where editing an Operational Location property may cause other properties on the table to disappear
+- Known issue where prior values for an Operations Event Definition version may display after creating a new version
+
+### Agent
+
+### Add
+- Add option to bypass OIDC
+- Add support for authentication against a generic OIDC provider instead of Keycloak
+- Add support for Azure EventHub datasource
+
+### Change
+- Change JWT library to golang-jwt/jwt/v5 from dgrijalva/jwt-go/v4
+- Change OIDC to use `client_credentials` grant
+- Change `oidc.realm` in config to be optional
+- Change golang to v1.25.12 from v1.25.11
+- Change library golang.org/x/net to v0.57.0 from v0.55.0
+- Change library golang.org/x/text to v0.39.0 from v0.37.0
+- Change library google.golang.org/grpc to v1.82.1 from v1.80.0
+
+### Remove
+- Remove support for OIDC username and password
+- Remove durable queue from `MessageHandler`
+
+### BaaS
+
+### Add
+- Add `EventDefinitions` and `SchemaDiagrams` to the `/admin` GraphQL API
+- Add functionality to allow GraphQL queries to be called with a timestamp
+- Add full CDC sink-and-source pipeline for publishing CDC events to Solace
+- Add an immutable audit trail for capturing CDC events from a Solace queue and writing append-only rows to an Apache Iceberg table, allowing audit records to be queried through the `queryAudit` resolver on the `/admin` GraphQL API
+- Add Schema Explorer page to the BAAS Console, allowing visualization of the GraphQL schema as a node graph
+- Add support for authentication against a generic OIDC provider instead of Keycloak with `enable-generic-oidc`
+
+### Change
+- Change library golang.org/x/text to v0.39.0 from v0.37.0
+- Change library google.golang.org/grpc to v1.82.1 from v1.81.1
+- Change library github.com/go-chi/chi/v5 to v5.3.0 from v5.2.4
+- Change library github.com/klauspost/compress to v1.18.7 from v1.18.4
+
+### Fix
+- Fix `worker`: resolve CDC-pinned orphaned transactions
+- Fix `worker/cdc`: reset stranded pending events when WAL is trimmed past `seenIndex`
+- Fix GraphQL subscriptions failing with authentication
+- Fix rebuild index ignoring schema requirements
+
+## Known Issues
+- Known issue where BAAS Console S3/Minio Backup page may show a success message despite giving an invalid destination
+- Known issue where BAAS Console Local Export backup page may show a success message despite giving a potentially invalid export destination
+- Known issue where BAAS Console schema upload page will not show an error for a potentially invalid schema
+
+### ISA-95
+
+### Add
+- Add tests for timeseries queries
+- Add `AzureEventHub` to `DataSourceProtocol`
+- Add `historyQuery` custom field to Equipment type to enable SQL queries of timeseries data within Equipment context
+- Add `EventSource*` types for defining event specific data sources
+- Add `ackMethod` field to `EventSourceTopic`
+
+### Change
+- Change schema to reflect default limits on SQL runtime queries
+- Change golang to v1.25.12 from v1.25.11
+- Change library golang.org/x/text to v0.39.0 from v0.37.0
+
+### Fix
+- Fix `DispatchStatus` values to align with ISA-95 specification
+- Fix missing deprecation on `DispatchStatus` for `CANCELED` causing errors
+
+### Typescript host service
+
+_Releasing in step with other components._
+
+### Workflow
+
+### Add
+- Add JSON schema node for fetching schema from a schema registry
+- Add support for authentication against a generic OIDC provider instead of Keycloak
+- Add terminal error messages to BPMN variable context
+- Add AMQP Event Source driver
+- Add support for different acknowledgement methods for Event Sources based on topic configuration
+
+### Change
+- Fix missing check for debug mode on Workflow Instances
+- Change OIDC to use `client_credentials` grant
+- Change calls to Restate from BPMN nodes to allow calls to any endpoint
+- Change `zeebe:input` mapping with an empty target to spread resolved JSON object fields directly into `taskVars`
+- Change `zeebe:input` source evaluation to read inputs starting without "=" as raw JSON when the input's target is empty
+- Change golang to 1.25.12 from 1.25.9
+- Change library golang.org/x/tools to v0.47.0 from v0.45.0
+- Change library google.golang.org/grpc to v1.82.1 from v1.80.0
+
+### Fix
+- Fix authentication not being checked on BPMN load and execution
+- Fix trailing `/` being appended to discovery URL in OIDC adapter
+
+### Remove
+- Remove support for OIDC username and password
+
+## Compatibility
+
+{{< compatible "4.4.0" >}}
+
+## Checksums
+
+{{% checksums "v4.4.0-checksums.txt"  %}}
+
+## Upgrade
+
+To upgrade to v4.4.0, first ensure that you have made corrections for the following breaking changes.
+
+After you've made the necessary mitigations, follow the [Upgrade instructions](/deploy/upgrade).
+
+## Breaking Changes
+
+### Changes to OIDC Configuration
+Agent and Workflow now authenticate with client credentials instead of password grants. The OAuth client must now be confidential with service accounts enabled, and its service account user must be granted any necessary roles. For Keycloak the following changes will need to be made:
+
+#### Workflow Required Roles
+Workflow nwo requires the `bpmn:mutation` role to execute BPMNs that are not started by a user.
+
+1. In the left hand menu, select **Clients > `{{< param application_name >}}Baas`** and then select the **Roles** tab.
+1. Select **Create role**.
+1. Name the role `bpmn:mutation`.
+1. **Save**.
+1. In the left hand menu, select **Groups**.
+1. Select your admin group, and then select the **Role mapping** tab.
+1. Select **Assign role > Client roles**.
+1. Select `bpmn:mutation` from **`{{< param application_name >}}eBaas`**.
+1. **Assign**.
+
+#### Configure Clients
+Clients will now need to be configured to use service account roles and have their service account user be added to the admin group.
+
+1. In the left hand menu, select **Clients > `{{< param application_name >}}Workflow`**.
+1. Under **Capability config** enable **Service account roles**.
+1. **Save**.
+1. Select the **Service account roles** tab.
+1. In the notice for "To manage details..." select the `service-account-{{< param application_name >}}workflow` link.
+1. Select the **Groups** tab.
+1. Select **Join Group**.
+1. Select your admin group, commonly named `{{< param application_name >}}AdminGroup`.
+1. **Join**.
+1. Repeat the process for `{{< param application_name >}}Agent`.

content/versions/v4.3.0/_index.md

@@ -0,0 +1,21 @@
+---
+title: Rhize Product documentation
+weight: 002
+description: User guides, deploy docs, references, and deep dives about the
+  Rhize manufacturing data hub.
+cascade:
+  v: "4.3.0"
+  type: "docs"
+  icon: molecule
+
+---
+
+The following topics cover everything you need to know to administrate and use Rhize.
+
+For administrators, the Deploy topics cover everything about deploying Rhize on Kubernetes and maintaining through the cycle.
+For day-to-day users, the product documentation covers everything you need to use Rhize to model production and transform and store data.
+
+
+{{< card-list >}}
+
+

content/versions/v4.3.0/deploy/_index.md

@@ -0,0 +1,41 @@
+---
+title: Deploy
+description: >-
+  A collection of pages to administrate Rhize: install, upgrade, back up, and more.
+weight: 100
+icon: server
+identifier: deploy
+cascade:
+  icon: server
+  domain_name: libremfg.ai
+  brand_name: Libre
+  application_name: libre
+  db: libreBaas
+  pre_reqs: |-
+    - Optional: [kubectx](https://github.com/ahmetb/kubectx) utilities
+        - `kubectx` to manage multiple clusters
+        - `kubens` to switch between and configure namespaces easily
+    - Optional: the [k8 Lens IDE](https://k8slens.dev), if you prefer to use Kubernetes graphically
+  k8s_cluster_ns: |-
+    ```bash
+    ## context
+    kubectl config current-context
+    ## namespace
+    kubectl get namespace
+    ```
+
+    To change the namespace for all subsequent [`kubectl` commands](https://kubernetes.io/docs/reference/kubectl/cheatsheet/) to `libre`, run this command:
+
+    ```bash
+    kubectl config set-context --current --namespace=libre
+    ```
+
+aliases:
+  - /deploy/
+
+---
+
+A collection of pages to administrate Rhize: install, upgrade, back up, and more.
+
+
+{{< card-list >}}

content/versions/v4.3.0/deploy/about-openidconnect.md

@@ -0,0 +1,50 @@
+---
+title: About OpenID connect
+description: The Rhize GraphQL implementation uses OpenIDConnect for
+  Authentication and role-based access control. This section describes how to
+  set up Keycloak
+weight: 999
+categories: ["concepts"]
+db: libreBaas
+aliases:
+  - /explanations/about-openidconnect
+  - /deploy/about-openidconnect
+
+---
+
+Rhize uses [OpenIDConnect](https://openid.net/developers/how-connect-works/) to connect to a [Keycloak](https://www.keycloak.org/) server to authenticate users and manage Role-based access controls.
+
+Open ID Connect is a security architecture that uses JSON Web Tokens (JWTs) to access secured resources.
+JWTs are issued by Keycloak. Users can also be managed in Keycloak.
+Or you can manage users in other services such as LDAP, Google, Azure AD, Facebook, etc.
+
+The general authentication flow is as follows:
+1. When a user accesses the user interface, the UI redirects to Keycloak.
+1. Depending on how it is configured, Keycloak redirects to the authentication provider so that the user can log in.
+1. If the user is successfully authenticated, Keycloak redirects back to the user interface with an authentication code in the URL parameters.
+1. The UI calls a secure API to exchange the authentication code for a JWT.
+1. The UI then uses that JWT to access secure APIs such as the Rhize GraphQL API.
+
+The Rhize DB, {{< param db >}}, has the public key from Keycloak, which can be used to verify the JWT.
+
+```mermaid
+sequenceDiagram
+	actor User
+	participant UI as Web UI
+	participant Rhize as Rhize DB
+	participant KC as Keycloak
+	participant AP as AuthProvider
+	Rhize->>KC: Get Public Key
+	User->>UI: Log In
+	UI-->>KC: Redirect
+	KC-->>AP: Redirect
+	AP->>User: Credentials
+	AP-->>KC: Auth Result
+	KC-->>UI: Redirect with Code
+	UI->>KC: Exchange Code for Token
+	KC->>UI: Reply with id_token and access_token
+	UI->>Rhize: Access API with Bearer Token
+	Rhize->>Rhize: Verify Token with Public Key from Keycloak
+
+```
+

content/versions/v4.3.0/deploy/backup/_index.md

@@ -0,0 +1,24 @@
+---
+date: "2023-09-12T19:35:35+11:00"
+title: Back up
+description: Guides to back up your data on Rhize
+categories: ["how-to"]
+weight: 200
+cascade:
+  icon: database
+aliases:
+  - /deploy/backup/
+
+---
+
+Backup is critical to ensure reliability and recovery.
+
+These guides show you how to back up different services and data on Rhize.
+They also serve as blueprints for automation.
+
+Your organization must determine how frequently you backup services, and how long you store them for.
+The correct practice here is highly contextual,
+depending on the size of the data, the importance of the data, and the general regulatory and governance demands of your industry.
+
+
+{{< card-list >}}

content/versions/v4.3.0/deploy/backup/audit.md

@@ -0,0 +1,55 @@
+---
+title: 'Back up Audit PostgreSQL'
+date: '2024-03-26T11:20:56-03:00'
+categories: ["how-to"]
+description: How to backup Audit PostgreSQL on your Rhize deployment
+weight: 300
+aliases:
+  - /deploy/backup/audit
+
+---
+
+This guide shows you the procedure to backup your Audit PostgreSQL database on your Rhize Kubernetes deployment.
+
+## Prerequisites
+
+Before you start, ensure you have the following:
+
+- A designated backup location, for example `~/rhize-backups/libre-audit`.
+- Access to the [Rhize Kubernetes Environment](/deploy/install/setup-kubernetes)
+{{% param pre_reqs %}}
+
+
+Also, before you start, confirm you are in the right context and namespace.
+
+{{% param k8s_cluster_ns %}}
+
+## Steps
+
+To back up Audit PostgreSQL, follow these steps:
+
+1. Check the logs for the Audit pods, either in Lens or with [`kubectl logs`](https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#logs).
+    Ensure there are no errors.
+
+1. Retrieve the Audit user password using the following command:
+
+
+    ```bash
+    kubectl get secret <SECRET-NAME> -o jsonpath="{.data.<SECRET-KEY>}" | base64 --decode
+    ```
+
+1. Execute a command on the Audit Postgres pod to perform a full backup:
+
+    ```bash
+    kubectl exec -i audit-postgres-0 -- pg_dumpall -U <DB_USER> | gzip > audit-postgres-backup-$(date +"%Y%m%dT%I%M%p").sql.gz
+    ```
+
+On success, the backup creates a GZIP file, `audit-postgres-backup-YYYYMMDDTHHMMSS.sql.gz`.
+To check that the backup succeeded, unzip the files and inspect the data.
+
+## Next Steps
+
+- To back up other Rhize services, read how to backup:
+  - [Keycloak]({{< relref "keycloak" >}}).
+  - [Grafana]({{< relref "grafana" >}}).
+  - [The Graph Database]({{< relref "graphdb" >}}).