Connectware 1.11.0
## What has changed in 1.11.0? {% hint style="warning" %} We have identified a critical bug in this release. Please do not upgrade to 1.11.0. We are working on a fix that will be released soon. {% endhint %} **Release date:** 06.03.2025 Connectware 1.11.0 represents a major step in our comprehensive architecture evolution to deliver long-term benefits in performance, scalability, and maintainability. However, version 1.11.0 is not intended for production use. **Who should install Connectware 1.11.0?** Only those who have been directly advised to do so by our Customer Success team. For most implementations, we strongly recommend continuing to use Connectware 1.10.1 until the architecture update is completed in a future Connectware release. {% hint style="warning" %} #### Upgrade Guide for Connectware 1.11.0 This release includes breaking changes and requires manual upgrade steps. Upgrade to Connectware 2.0.0, which will also require manual upgrade steps. In case of questions, our Customer Success team is able to advise you. * [Upgrading Connectware to 2.0.0 (Kubernetes)](/deployment/upgrading-connectware/on-kubernetes/to-2-0-0-on-kubernetes) * [Upgrading Connectware to 2.0.0 (Docker)](/deployment/upgrading-connectware/on-docker/to-2-0-0-on-docker) {% endhint %} #### Added **Performance & Scalability** * Introduces two new microservices (`resource-status-tracking` and `nats`) for Resource Status Tracking to provide more reliable tracking of Cybus resources at larger scales, with both HTTP and websocket API support. * CybusMQ: Enhanced message routing scalability following cluster reception. **Maintenance & Adaptability** * Updated the Connectware Toolkit Container to the latest version. **Reliability & Robustness** * Integrated NATS streaming broker to support Connectware's new Control Plane technology.Connectware 1.10.0 – 1.10.2
## What has changed in 1.10.0? **Release date:** 14.01.2025 #### Added **Security & Stability:** * Added [Microsoft Entra ID](/access/user-management/single-sign-on-sso/sso-with-microsoft-entra-id) support for single sign-on authentication in Connectware. ## What has changed in 1.10.1? **Release date:** 27.01.2025 #### Added **Security & Stability:** * New [environment variable](/reference/environment-variables): `CYBUS_SENSITIVE_ENVIRONMENT_VARIABLES` allows you to specify the environment variable names that must be hidden when container data is sent to a client. * New [environment variable](/reference/environment-variables): `CYBUS_ALLOW_INSECURE_TLS_CIPHERS` allows you to control the use of insecure Transport Layer Security (TLS) cipher suites in Connectware. **Reliability & Robustness:** * Enhanced the speed and stability of service installations that involve multiple endpoints. #### Fixed **Security & Stability:** * Token redirects now only work for Connectware related sites to improve [JSON Web Token](/access/security/json-web-tokens) security. * Enhanced LDAP authorization security by improving wildcard handling. * Improved the reliability of agent reconnection processes. **Usability & Accessibility:** * Improved error messages for failed login attempts with the same username for Entra ID and local. * **MFA Usage Mandatory** button will not be shown when [multi-factor authentication](/access/user-management/multi-factor-authentication) is disabled. **Reliability & Robustness** * Made FlowSync more resilient to configuration errors. ## What has changed in 1.10.2? **Release date:** 25.04.2025 #### Fixed **Reliability & Robustness** * OPC UA connections are now reliably restored after a connection loss, ensuring higher robustness in continuous operations. #### Added **Security & Stability:** * Mandatory security mode for user authentication: * Clients connecting to an OPC UA server with user credentials (username/password) must now use a security mode. * This change enhances communication security and aligns with updated OPC UA library requirements.Connectware 1.9.0
## What has changed in 1.9.0? **Release date:** 11.12.2024 #### Added **Reliability & Robustness:** * Introduced [FlowSync](/data-flows/flowsync) for advanced message synchronization. **Usability & Accessibility:** * Support for OPC UA methods for nodes and endpoints. * Updated [Live Data](/monitoring/live-data) view to support nodes that do not contain topics. #### Fixed **Usability & Accessibility:** * Fixed Rule Sandbox issue.Connectware 1.8.0
## What has changed in 1.8.0? **Release date:** 13.11.2024 #### Added **Security & Stability:** * The license ID is now hidden by default to improve security. **Usability & Accessibility:** * Users with restricted **Data Explorer** permissions will see a notification that guides them to the **Service Details View**, where they can select a service to explore its live data. * The Connectware documentation has been redesigned for better usability and an improved user experience. It is now available exclusively at [docs.cybus.io](https://docs.cybus.io/) and is no longer included in the Connectware installation package. Documentation for Connectware 1.7.3 and prior remains available at [docs-old.cybus.io](https://docs-old.cybus.io/). * Documentation links in Connectware now direct to the online documentation at [docs.cybus.io](https://docs.cybus.io/). **Monitoring & Resilience:** * Added a new **Live Data** tab in the **Service Details View** that shows live data for each service. See [Live Data](/monitoring/live-data). * The **Service Details View** and the tabs for **Mappings**, **Connections**, and **Endpoints** now show to which agent the resource is assigned to. See [Services Overview](/data-flows/services/service-overview). #### Fixed **Security & Stability:** * Fixed an issue where required permissions for auth/mfa were missing when multi-factor authentication (MFA) was enforced during login. **Usability & Accessibility:** * Fixed an incorrect permissions changed popup that appeared for users with minimum access on the **Service Details View**. **Reliability & Robustness:** * Fixed an issue where Kafka producer and consumer connections became inconsistent after losing network connection to the broker.Connectware 1.7.0 – 1.7.3
## What has changed in 1.7.0? For Connectware 1.7.0, we’ve improved the performance and stability of CybusMQ. As part of these improvements, older broker data volumes are not compatible with brokers of Connectware 1.7.0 and newer. To successfully upgrade to Connectware 1.7.0 or later, you’ll need to follow some additional update procedures. {% hint style="warning" %} #### Upgrade Guide for Connectware 1.7.0 This release requires manual upgrade steps. Read the following Connectware 1.7.0 Upgrade Guide carefully: * [Upgrading Connectware to 1.7.0 (Kubernetes)](/deployment/upgrading-connectware/on-kubernetes/to-1-7-0-on-kubernetes) * [Upgrading Connectware to 1.7.0 (Docker)](/deployment/upgrading-connectware/on-docker/to-1-7-0-on-docker) {% endhint %} #### Added **Security & Stability:** * CybusMQ now uses an upgraded Debian Linux 11.9 **Performance & Scalability:** * Improved CybusMQ cluster’s metadata replication performance * Optimized image size of CybusMQ * Service manager can now allocate up to 16GB of RAM as potentially required for large deployments **Usability & Accessibility:** * Admin UI: Added column in users overview table that shows if multi-factor authentication (MFA) is enabled or not * Admin UI: MFA options are now hidden for users if MFA is not enabled * Admin UI: Users are now automatically notified when the administrator enforces MFA or changes user permissions * Admin UI: Added notification to inform users of the number of login attempts with MFA and if they are banned after more than 5 failed login attempts **Maintenance & Adaptability:** * `imagePullSecrets` for microservices can now be specified with the option to change the imagePullPolicy for installations * Added new variable to enable or disable MFA #### Fixed **Performance & Scalability:** * Improved ability of CybusMQ to start with large number of objects in metadata store on disk **Usability & Accessibility:** * Selected table items in the service overview are only being de-selected in case they are gone from the view * Endpoint `/api/session` returns the reduced set of permissions when user has MFA enforced but not enabled yet * Notifications in the Data Explorer inform when corresponding service endpoints are unavailable **Maintenance & Adaptability:** ## What has changed in 1.7.1? #### Added **Usability & Accessibility:** * Made /api/topics usage optional, allowing users without read access to still load and use the Rule Engine and Data Explorer pages. * Added warning on Data Explorer to notify users with limited permissions that loading topics metadata is not possible. **Reliability & Robustness:** * Improved clustering connection stability in CybusMQ, enabling reliable clustered mode operation and reducing message loss. #### Fixed **Usability & Accessibility:** * Corrected the link to wildcards in the documentation to use the proper href format, ensuring accessibility and preventing permission errors. **Reliability & Robustness:** * Enabled message reception of a service sharing the same MQTT topic as another service by removing wildcard topic handling for overlapping topics. * Ensured MQTT connections using default credentials reconnect successfully after a Connectware restart. ## What has changed in 1.7.2? #### Added **Security & Stability:** * Fixed LDAP certificate mounting for Helm installations. ## What has changed in 1.7.3? **Release date:** 29.08.2024 #### Added **Security & Stability:** * KafkaJS Library Update **Usability:** * Protocol Mapper is listed under the Agents tab on the System Status page * Improved Deviations notification on Service Overview page now supports pagination * Enhanced the Service Details Page with a Deviations tab * Removed “type” column from Deviations list in Service Details page * Notification on changed permission (due to MFA) is now dismissible #### Fixed **Security & Stability:** * Fixed issue of TCP ingress routes with matching targets leading to flood of logs. **Reliability & Robustness:** * Resolved Services Graph data corruption in large deployments by moving storage to PSQL.Connectware 1.6.0 – 1.6.2
## What has changed in 1.6.0? #### Added **Performance & Scalability:** * Updated service behavior to allow immediate HTTP connection attempts upon enabling. **Usability & Accessibility:** * Redesigned the interface for an improved user experience and easier workflow. * Improved error handling when updating an existing service. * Introduced a validation endpoint `/api/validate/service` to ensure correctness of Service Commissioning Files and enhance error detection. **Monitoring & Resilience:** * Service Manager is now more resilient on larger deployments. * Better VRPC timeout flexibility to improve support for large-scale deployments. * Improved data flow recovery in services, ensuring consistent data publishing resumes after any disruptions. #### Fixed **Security & Stability:** * Updated the admin-web-app image to ensure the Frontend remains accessible when started as the root user. * Fixed access issues for MFA-enabled users, ensuring they can now access the workbench. **Usability & Accessibility:** * Enabled successful DateTime write operations to OPC UA variables, ensuring accurate updates on the server. * OPC UA write endpoint returns error on failing writing attempts when data types are mismatching. **Maintenance & Adaptability:** * OPC UA StatusCode for variable values is now accessible for read endpoints. **Monitoring & Resilience:** * Improved system resilience by ensuring smooth service enablement and stable Protocol-Mapper operation, even when custom protocol agents are absent during Service-Manager restarts. ## What has changed in 1.6.1? #### Added * General backend: Started using ESLint * Protocol Mapper: OPC UA read endpoints now have access to the full raw payload * Admin UI: VRPC timeout is configurable from the UI * Helm charts: VRPC timeout support added #### Fixed * General backend: Fixed an issue with running automated tests * Protocol Mapper: SOPAS - Fixed an issue with the EventListener being removed too early * Admin UI: Fixed an issue with not being able to write a configuration when not using the default user * Broker: Fixed an issue with cleaning up Broker cache entries ## What has changed in 1.6.2? #### Fixed **Usability & Accessibility:** * OPC UA: Fixed edge case falsely returning `BadTypeMismatch` when writing numerical valuesConnectware 1.5.0
## What has changed in 1.5.0? {% hint style="warning" %} #### Upgrade Guide for Connectware 1.5.0 This release requires manual upgrade steps when upgrading from a version below 1.5.0. The dedicated upgrade guides for this version have been removed. If you still run a Connectware version below 1.5.0, contact the [Cybus Support Portal](https://support.cybus.io). {% endhint %} In the latest version of Connectware, version 1.5.0, we’ve enhanced our approach to using elevated system permissions. Our focus is on improving security by adhering to the principle of least privilege across our software components. As part of these improvements, we’ve altered the system user account under which certain containers run. To successfully upgrade to Connectware 1.5.0 or later, you’ll need to follow some additional update procedures. #### Added **Security & Stability:** * Lowered system user privileges across several containers for enhanced security * Altered the internal ports for Connectware containers; external access remains unchanged on the original ports * Enhanced broker resilience to handle unexpected shutdowns more effectively * Enabled MQTT clients with persistent sessions to have their QoS 0 messages stored by the broker, minimizing message loss even for QoS 0 subscriptions (disabled by default) **Usability & Accessibility:** * Implemented message deduplication for MQTT clients with overlapping subscriptions to prevent message duplication across matching topics (enabled by default). For more information, see [Duplicate Message Delivery in MQTT Clients](/broker/cybusmq/configuration/duplicate-message-delivery). **Monitoring & Resilience:** * Revised the logging format of our broker to incorporate the current date for better tracking #### Fixed **Monitoring & Resilience:** * Container logs can now be displayed when third party workloads are present in the same Kubernetes namespaceConnectware 1.4.0 – 1.4.1
## What has changed in 1.4.0? Users can now enable MFA (Multi-Factor Authentication) for their login process. The HTTP server has been upgraded to seamlessly request MQTT credentials through GET requests. #### Added * Admin UI: MFA support * Auth Server: MFA support * Protocol Mapper: added GET support for HTTP server #### Fixed * Protocol Mapper: Fixed problems related to MaxListenersExceededWarning * fixed wrong OAuth access token format for HTTP client * Reconnection of OPC UA connections is much faster now * Child services do not stay in deviation when parent service got updated ## What has changed in 1.4.1? We’ve fixed a bug causing some endpoint resources to be hidden when intentionally disabled. Now, after updating, all disabled endpoint resources will show up as expected. #### Fixed * Protocol Mapper: Fixed a bug that caused endpoint resources to not be displayed if they were explicitly disabled.Connectware 1.3.0 – 1.3.2
## What has changed in 1.3.0? Introducing the latest version of Cybus Connectware. This release brings exciting new features and important fixes to enhance your experience. With the updated Admin UI, you now have the ability to filter logs by date and type, providing easier navigation and analysis. We have also made styling enhancements for a more seamless and visually appealing interface. In addition, the Auth Server now supports LDAP authentication, ensuring secure user access. The Broker now includes MQTT 5 simple authentication support, and the Protocol Mapper introduces MQTT 5 shared subscription support. We have also addressed various issues, including notification rendering, message delivery, and duplicate message retrieval. Upgrade now to enjoy the enhanced capabilities of Cybus Connectware. #### Added * Admin UI: Introduced ability to filter logs by date and type * Admin UI: Overall styling enhancements * Auth Server: LDAP support * Broker: MQTT 5 simple authentication support * Protocol Mapper: MQTT 5 shared subscription support #### Fixed * Admin UI: Fixed notifications sometimes not being rendered correctly * Broker: Fixed some messages not being delivered under certain configurations * Protocol Mapper: ADS - Fixed retrieval of duplicate messages after reconnection ## What has changed in 1.3.1? We’re excited to bring you a set of essential fixes in this update of Connectware. This update addresses an issue where optional parameters in Write Endpoints were not functioning as intended. It also resolves a bug that prevented proper parsing of MQTT payloads into JSON-compliant representation. #### Fixed * Protocol Mapper: Fix missing payload parsing for endpoint resource read operation * Protocol Mapper: MQTT - Fix payload send to broker to be JSON compliant ## What has changed in 1.3.2? {% hint style="warning" %} Parts of this release affect required UI permissions. Please ensure to incorporate them in case you are using custom roles. {% endhint %} Users can now change their password using the settings page. MQTT shared subscriptions can now handle Rule Engine context variables, and we have improved error messages. For Kafka, we have fixed issues related to connecting to servers over TLS and improved the OPC UA Server behavior during startup. Furthermore, we have significantly optimized overall resource consumption and our FANUC FOCAS protocol integration now supports AddressType E for even heavier lifting. #### Fixed * Admin UI: Consistent language throughout the whole product (EN) * Admin UI: Changing password using settings page * Protocol Mapper: Significantly improved overall resource consumption * Protocol Mapper: Fixed handling of Rule Engine context vars with MQTT shared subscriptions * Protocol Mapper: FANUC FOCAS - Adjusted configuration to support additional address types * Protocol Mapper: HTTP - Fixed auto generated endpoint topic name * Protocol Mapper: HTTP - Fixed missing error message on failed post request at TCP level * Protocol Mapper: Kafka - Fixed connecting to server using TLS * Protocol Mapper: OPC UA Server - Fixed potential race condition during startupConnectware 1.2.0 – 1.2.1
## What has changed in 1.2.0? We’re excited to announce the release of version 1.2.0, which brings a whole new User Interface, as well as a range of improvements and bug fixes to our Factory Data Hub. The whole new User Interface, with a sleeker, more intuitive and modernized design, enables a better overall experience managing your assets. We’ve enabled support for horizontal scaling on the Auth Server, which will allow it to handle an increased workload as needed. Additionally, we’ve fixed some issues related to registering Agents using mTLS, which will help streamline the authentication process. On the Protocol Mapper side, we’ve added support for OPC UA Server Historical Access StartBound aggregation, a configurable probe timeout to HTTP Connection resources, and the ability to send binary data on HTTP Write Endpoints. We’ve also improved deviation detection for Kafka protocol write operations, which will enhance the ability to detect and address any anomalies that may occur during data transmission. Lastly, some infrequent broker issues related to publish authentication timing were resolved, which significantly improved the reliability of message delivery. Overall, these changes aim to improve scalability, historical access, binary data transmission, and fix bugs, resulting in a smoother and more reliable user experience. #### Added * Admin UI: Completely revamped look, to get you where you want to be faster, with new in-app explanations and contextualization about Connectware. * Admin UI: User Management UI is now faster, with better warnings for dangerous commands and a more intuitive usage and search * Auth Server: Enabled support for horizontal scaling * Protocol Mapper: Added support for OPC UA Server Historical Access StartBound aggregation * Protocol Mapper: Added configurable probe timeout to HTTP Connection resource * Protocol Mapper: Added support of sending binary data on HTTP Write Endpoint #### Fixed * Admin UI: Will no longer crash if a user goes from a mapping details to the services page * Admin UI: Change password form now displays the correct error message when using the wrong credentials to perform an operation * Admin UI: Now better explains server unavailability errors * Auth Server: Fixed issues when registering Agents using mTLS * Broker: Fixed rare publish authentication timing issues * Protocol Mapper: Deviation detection for Kafka protocol write operations now works as expected ## What has changed in 1.2.1? We are excited to announce the release of Version 1.2.1 of our product, packed with powerful enhancements and optimizations. This release focuses on significantly improving the overall message throughput performance, ensuring a faster and more efficient user experience. Enhanced Message Processing: We have fine-tuned the underlying algorithms and systems to streamline the message processing mechanism. As a result, you will notice a substantial increase in the speed at which messages are handled, leading to quicker response times. #### Added * Protocol Mapper: Optimized overall message performanceConnectware 1.1.0 – 1.1.5
## What has changed in 1.1.0? This release increases the reliability and resilience of Connectware, especially when run in Kubernetes and in high load scenarios. Many of the changes also benefit deployments that run in Docker. The changes include updates to the Admin UI, improved Helm chart usability and improved stability and connectivity of Connectware services. When you upgrade Connectware to version 1.1.0, all services are disabled. After upgrading, you must enable the services that you want to use again. #### Added * Admin UI: You can now load resources via HTTP instead of WebSocket for most resources * Admin UI: Refresh license button on offline installations is now disabled * Admin UI: Loading times for resources on the User Management page have been improved * Admin UI: Users without management access can now access the detail pages * Admin UI: Improved error messages when installing commissioning files that contain errors * Broker: Cluster join/leave logic has been improved * Container Manager: You can now use HTTP endpoints to start/restart/stop containers by specifying their identifier * Implement optional MQTT traffic decoupling for Control Plane & Payload Data by using different brokers * Kubernetes: Add Helm value to configure storage class * Kubernetes: Add common Helm value for mTLS and enable mTLS in control-plane-broker * Kubernetes: Change default access mode for postgres volume to ReadWriteOnce and introduce configuration option * Kubernetes: Add Helm configuration for securityContext * Kubernetes: Change Helm podResources to allow setups without limits * Kubernetes: You can now configure the protocol-mapper resource requests/limits via protocolMapperAgent * Kubernetes: Support for Helm best practices labels * Kubernetes: Support labels and annotations for resources with Helm installation * Kubernetes: Added init container to broker that checks Kubernetes API availability * Protocol Mapper Agent: Enable support for mTLS registration/authentication * Protocol Mapper: The resource Cybus::HttpServer now accepts configurable payload sizes of up to 512 KB * Service Manager: Services Graph is now enabled by default #### Fixed * Admin UI: Custom topics are now displayed on the Explorer page * Admin UI: Stopping multiple containers now works as intended * Admin UI: You can now remove endpoints that are enabled * Admin UI: Rule Engine Sandbox and Mapping fix unexpected failure when non-JSON message is processed in transform rule * Admin UI: It is no longer possible to remove critical certificates from the Certificates page * Broker: MQTT clients are no longer interrupted and continue all operations when broker cluster nodes are down or not fully initialized * Service Manager: Restarting the Broker no longer makes Connectware Services unreachable * Protocol Mapper: Services with deviated connections are now displayed as deviated * Protocol Mapper: Kafka consumer no longer blocks execution on connection loss * Protocol Mapper: OPC UA value sanitizer now handles previously undetected errors ## What has changed in 1.1.1? This release increases the performance of the MQTT protocol both internally and when used in Services. #### Added * Protocol Mapper: Increase performance of MQTT protocol ## What has changed in 1.1.2? This release includes a fix for credentials handling for resources of type Server and Node in Agents in the case of restarts. #### Fixed * Protocol Mapper: Fix incorrect handling of credentials for Server and Node resources causing authentication errors ## What has changed in 1.1.3? This release includes a fix for the Server resource type and fixes for Agents’ credential handling Additionally we now support certificates using SAN for mTLS authentication and we expose some variables to configure the duration of broker authentication and authorization results. #### Fixed * Protocol Mapper: agents crash after registering with `CYBUS_PROTOCOL_MAPPER_PASSWORD` environment variable set * Protocol Mapper: improve credential management in Agents when using custom password rules * Protocol Mapper: improve credential management in Agents using mTLS when the registration process is aborted * Protocol Mapper: avoid potential crash when HTTP Server resource attempts to bind multiple times to its TCP port #### Added * Auth Server: make cache timeouts for broker auth endpoints configurable * Ingress Controller: added support for certificates using SAN * Kubernetes: Use podAntiAffinity to schedule broker pods on different K8s nodes * Kubernetes: Make broker volume sizes configurable * Kubernetes: Expose cache timeouts for broker auth endpoints environment variables ## What has changed in 1.1.4? This release includes a fix for mTLS and improvements to the Broker and Auth Server. #### Fixed * Connectware: add support for docker compose plugin * Protocol Mapper: fix potential data loss in Mappings * Protocol Mapper: fix mTLS authentication for Mappings #### Added * Protocol Mapper: correct log texts * Auth Server: retry mechanism for migration in case of failure ## What has changed in 1.1.5? This release includes improvements to the MQTT broker to improve authentication handling, cluster formation, and logging improvements. Additionally Protocol Mapper uses a better strategy in cases when Broker is restarted for maintenance or due to migration of Broker Pods. #### Added * Broker: make authentication more resilient * Broker: improve cluster formation to make it more deterministic * Broker: Investigate and implement possible robustness improvement around read-only filesystem * Kubernetes: Increase terminationGracePeriodSeconds for Broker and Control Plane Broker StatefulSets * Protocol Mapper: improve resilience when connection to the Broker is temporarily lostConnectware 1.0.0 – 1.0.93
## What has changed in 1.0.0? This is the first 1.0 stable release in the 1.0 series of the Connectware. Data governance and connectivity from the shop floor to the enterprise is now easier and more reliable than ever. #### Changes from last beta version **Changed** * Unify swagger filenames to swagger.yaml everywhere * Update node.js in protocol-mapper to 12.16.x **Fixed** * Clarified constraints on username/password length in UI and REST API * Improved OPC UA reconnect behavior * Mapping resource to respect the state of external MQTT connections * Fix erroneous handling of service id in REST API * Improved SOPAS sopas reconnection behavior * Fixed performance of frontend adding separate event-backends in react-vrpc, unmounting views not seen in details view, filtering results in parent components and separating state changes into smaller components ## What has changed in 1.0.1? Minor bug fixes with improved stability. #### Added * Added Rest API for Cybus::Link resource at /services/links * Added Agent view in Admin Web App so users can view currently connected agents #### Fixed * Fixed general bugs in Cybus services swagger files * Fixed issues with 0 or false values in default parameters in service files * Fixed issues with protocol mapper with a number of issues fixed in the MSSQL protocol ## What has changed in 1.0.2? Stability improvements with some bug fixes. #### Changed * The node.js version is upgraded to 12.18.0 which includes security updates #### Fixed * Service count number on home page view is fixed * REST API-based creation and deletion of services is now integrated correctly with admin ui * Topic generation in BACnet is fixed * OPC UA re-subscription which failed in certain re-connection scenarios is now fixed * S7 data write format is fixed ## What has changed in 1.0.3? The [Heidenhain](/connectors/shop-floor-connectors/heidenhain-dnc) protocol has been added and further stability improvements have been implemented, along with regular bug fixes and UI improvements. #### Added * [Heidenhain](/connectors/shop-floor-connectors/heidenhain-dnc) protocol has been added and completed in 1.0 * Log files can be downloaded as .csv files from UI * Installer script has alternative offline installation mode #### Changed * Node-RED version in [workbench](/data-flows/node-red-workbench) updated to current 1.0.6 * More npm dependencies have been updated to current versions * Updated CI pipeline with Balena OS VM images build and push #### Fixed * Fix all warnings from react in admin-web-app * Fix problem with topic construction on unsubscribe * Installer script checks even more for potentially missing Internet connection ## What has changed in 1.0.4? Feature updates and maintenance: Two new protocols have been added, [SINUMERIK](/connectors/shop-floor-connectors/sinumerik) and [Beckhoff ADS](/connectors/shop-floor-connectors/ads). Also, many stability improvements have been implemented, along with regular bug fixes and UI improvements. #### Added * Protocol implementation for [SINUMERIK](/connectors/shop-floor-connectors/sinumerik) controls * Protocol implementation for [Beckhoff](/connectors/shop-floor-connectors/ads) controls (ADS protocol) * Implemented mutual TLS authentication for MQTT #### Changed * Improve date/time format in filename of log download * Prohibit deletion of admin user and connectware-admin role in admin-ui and REST API * REST API call correlation-id is renamed to `id` according to JSON-RPC * user documentation: sample commissioning files improved #### Fixed * S7 protocol write method was dropping data on high load, now fixed * Fix selection of correct service in admin-ui service view * Fix burst rule in Rule Engine * user documentation: fix missing parts of Heidenhain protocol * Fix auth-server lock-up due to issues with PostgreSQL connection handling * Fix issues on disabling WERMA connections * REST API service delete is fixed * Fixed issue in incomplete disabling of mapping resources ## What has changed in 1.0.5? This release was skipped due to QA issues. The changes are listed in the 1.0.6 release. ## What has changed in 1.0.6? This release includes various stability and ease of life improvements as well as new features regarding service updates and configuration as well as agent tracking. #### Added * Enabled in-place update of service parameters and/or commissioning files * Agents are being tracked and emit messages on deviation * Possibility to specify `qos` and `retain` options for MQTT within mapping configuration #### Changed * Documentation regarding Connectware users and services has been improved * SINUMERIK initial compatibility checking of OPC UA server has been improved * Node.js updated to 12.18.2, node-red workbench updated to 1.1.0 #### Fixed * Fixed authentication limitations under load (PostgreSQL communication improved) * Fixed issue with subscribe topic resolution on wildcard ‘#’ mapping when published on parent * Fixed UI problem when pressing escape key in roles dropdown * Fixed issues with API calls to `POST /services` when used in combination with `targetState: enabled` * Fixed problems on disabling or deleting mappings in UI ## What has changed in 1.0.7? This release brings a large number of stability improvements and better explanations in the user documentation. #### Added * HTTP protocol: Added options to configure client certificates (SSL) and certificate policy * License file can be uploaded to system control server by REST endpoint * SINUMERIK protocol: Data point “number of teeth” added #### Changed * User documentation improved for protocols Http, Modbus, Sopas, and for Connection resource * Admin-UI: User interface has been refactored and improved for better performance in Service, Connection, Endpoint, Mapping view * Update node.js to latest 12.18.3 #### Fixed * Admin-UI: Fixed displaying of information when an external broker is involved during mapping * User documentation: HTTP permission explanation improved * Fix integer type interpretation of Cybus::MqttPort parameter * Admin-UI: serviceId parameter description fixed in configuration dialog * Admin-UI: favicon size set correctly in manifest * Admin-UI: button tooltips added where missing * Admin-UI: fixed issues with role names from commissioning file * Fix yaml schema to allow qos and retain options at mapping and endpoint resources * Fix missing docker label at bootstrap container * Performance fix when creating larger number of services * Fix authorization of REST calls with query string ## What has changed in 1.0.8? This release includes various stability and ease of life improvements as well as slightly more compact file size of the docker images of the Connectware. #### Changed * Reduce docker image sizes and application package by partly compiling application source code and javascript libraries * Reduce connectware networks to only one. Also, change default network mask to a slightly less common IP range 172.30.0.0/24 * Improve error log message on endpoint creation if endpoint does not find its connection, to simplify debugging #### Fixed * OPC UA protocol: [OpcuaEndpoint](/connectors/shop-floor-connectors/opc-ua/opc-ua-client#endpoint-properties) allows either nodeId or browsePath, where it previously required nodeId alone, but now allows either of both. * Mapping: Fix MQTT message handling with named wildcards, which previously stopped working after the first message, but now works correctly. * Fix erroneous deviation message on user or role permissions which contain pseudo-parameters * Admin-UI: fix various UI problems when deleting individual resources: Fix delete button of connections, fix deletion of endpoints, fix display update of volume list after deleting a volume * Documentation: Fix explanation of [parameter section](/data-flows/service-commissioning-files/parameters) in commissioning file ## What has changed in 1.0.9? With this release, performance for complex systems has been improved significantly. Additionally, numerous improvements in the Admin-UI and overall stability fixes have been included. Also, the installer will now remove old unused Docker images of previous Connectware versions, decreasing disk size usage and improving stability, too. #### Added * UI Explorer view: Data values which are JSON objects can be copied to clipboard by clicking on a newly introduced Clipboard icon, see [Copying Data to Clipboard](/monitoring/data-explorer#copying-data-to-clipboard) #### Changed * Installer: Add removal of old docker images after pulling the newest ones. * Update vrpc to 2.1.6 which also improves instance creation performance, so that now at least 200 endpoints can be handled quickly, with more to come * Improved API of genericVrpc protocol (subscribe now uses id instead of callback) * Improve change-of-value (cov) filter behavior. The COV Filter should now work as expected, independently from its position in the rule chain. * Use the native redsocks instead of our custom container in Balena release * The qos level for all internal MQTT connection was set to default 0 (zero) to improve overall connection performance. #### Fixed * Admin-UI: hide private (internal) roles in user overview upon sorting * Admin-UI: List view sorting and selection is not reset quickly anymore * Admin-UI: fix UI hang in resource/connection view if internal connection exists * Admin-UI: Fix log time display to use range 0..23 hours instead of 1..24 * Installer: fix erroneous usage of curl if only wget is available * Mappings: fix incomplete removal of mappings causing duplicate connections (“zombie connections”) * Fix balena-iso-config-configuration * Protocol Mapper: Endpoint waiting for connection now works more than once ## What has changed in 1.0.10? This regular update release brings further performance improvements and bugfixes. The bootstrap container has been removed and its functions have been integrated into other containers. The new protocol [Ethernet/IP](/connectors/shop-floor-connectors/ethernet-ip) has been added. #### Added * New protocol: [Ethernet/IP protocol](/connectors/shop-floor-connectors/ethernet-ip) #### Removed * Move bootstrap functionality into system-control-server, removing bootstrap container completely #### Changed * Auth-server: improve SQL queries for the user and role model to improve auth-server performance even more * User docs: Add hint about required license if examples use Docker image from Cybus registry * Implement license validation in system control server * Improve container [log file download](/monitoring/system-status/system-container-status#container-logs) * Admin-UI: improvement for success and failure messages on service state changes * Admin-UI: Service deviation information is now aggregated in backend instead of frontend to improve performance and response time in UI #### Fixed * Fix broken mapping [rules](/data-flows/rule-engine) for messages with non-JSON content. This was broken in 1.0.9 release, fixed in 1.0.10 release. * Admin-UI: Fix endpoint display in service details to show only relevant subset * Installer: fix installer in offline mode if docker-compose.yml is the same file ## What has changed in 1.0.11? Another regular update is published which brings further performance improvements and bugfixes. In particular, an annoying problem with duplicate messages after disabling and enabling services with mappings has been fixed. Also, the explorer window is working much faster right now, and more issues have been fixed, too. #### Changed * Improved internal communication performance by switching internal mqtt connections to bestEffort (qos=0) usage, except for the non-local connection of a protocol-mapper agent to the connectware #### Fixed * Increased performance of explorer view * Fix remaining duplicate subscriptions after disabling and enabling again any Mapping resource with more than one mapping * Fix wrong tooltips in toolbar of connection overview, and also fix endpoint and connection button functions * fixed installer in silent mode to be really silent ## What has changed in 1.0.12? The next weekly regular update with several bugfixes and performance improvements. #### Changed * Improve stability at docker container handling by preventing race conditions on docker calls * Update node-red to 1.1.3 #### Fixed * OPC UA: Some bugfix at reconnection handling * Installer: Fix problems at removing old bootstrap container and image * Fix erroneous generation of default serviceId which allowed only a very restricted character set for metadata.name. * Admin-UI: In service detail view, make sure to show only matching connection, endpoint, mapping, not ones from other services. * Admin-UI: Fix missing parameter default value 0 which was not displayed in the configuration dialog * Fix resourceId parsing which is now allowed to start with a number, too. * Remove any mention of old log-server and device-dispatcher, fixing spurious DNS queries for those outdated hostnames. * BACnet: Bugfix in logging statements ## What has changed in 1.0.13? Next weekly regular update with several bugfixes and performance improvements. Also, this release now includes the Pfannenberg protocol. #### Added * Pfannenberg protocol ported to v1.0 #### Fixed * Admin-UI: Fix connection and endpoint pages when Agents get offline * Admin-UI: Fix container overview page selections by only updating on data change * Admin-UI: Fix toolbar button availability if multiple services are selected * Mapping: Further fix potential message duplication when multiple Mapping resources were subscribing to the same topic * Improve connection cleanup on endpoint disable by removing event listeners on state change * BACnet: decrease verbosity in normal operation * RuleEngine: Fix parse rule for boolean values * ADS: removing unnecessary verbose error message ## What has changed in 1.0.14? A new weekly regular update with several bugfixes, some performance improvements in the user interface, and much speed-up of enabling and disabling of services. #### Changed * Make resource creation and deletion in parallel, and fix delete order. This significantly accelerates enabling and disabling of services * Clarify, clean up and improve [parse rule in RuleEngine](/data-flows/rule-engine/data-processing-rules#parse) * Admin-UI: Improve UI performance for Endpoints * Update nodejs version to 12.18.4 #### Fixed * User docs: Improved [documentation for MQTT\_ROOT](/data-flows/service-commissioning-files/parameters#global-pre-defined-parameters) * User docs: The documented REST API health endpoint was not working as expected, but instead /api/system/info is available to be used for health checking. * Admin-UI: Fix endpoint deletion in overview page * Improved genericVrpc to be resilient against instantiation order * Admin-UI: let all tables in the ui keep their local state to fix disappearing selection on state changes * Distributed agents: Fixed resource deletion on agents * SHDR: Fix endpoint key mismatch * BACnet: Fix TypeError crash * Let persistence of objects ignore files with parsing errors * Pfannenberg: Fix crashes on mismatching object declarations ## What has changed in 1.0.15? A new regular update with several bugfixes, some performance improvements in the user interface, and even more stability in working with services. Also, a general [SQL connection protocol](/connectors/enterprise-connectors/sql) has been added for connecting the MariaDB database. #### Added * New protocol: [SQL connection protocol](/connectors/enterprise-connectors/sql) for e.g. MariaDB has been added #### Changed * LDAP: Security and stability update. LDAP UTF-8 filter values now strictly required to be escaped following the XX hex notation (see [LDAP Filters Documentation](/access/user-management/single-sign-on-sso/sso-with-ldap#ldap-filters)). #### Fixed * Admin-UI: Fixing buttons in service detail page to appear automatically after enabling the service * Fixed buttons on service detail page that were broken after re-start * Admin-UI: In connection overview and connection detail page, show IP address also for various protocols like Heidenhain and BACnet * Docker: Improve error message on failing docker image pull * GenericVRPC: Fixing issues with deleting resources * Beckhoff: Fix subscribe/unsubscribe in Beckhoff ADS * Fix race condition that caused corrupt resource persistence storage by ensuring that all persistence access is protected against race conditions * Admin-UI: fix missing error message display on volume deletion * SINUMERIK: Fixed writing of SINUMERIK teethCount parameter * Fix container-manager memory leak * Modbus: Fix typo preventing processing discrete input * Service Manager: Fixed instabilities after restart by improving resource polling for deviation detection * Service Manager: Fix endpoints to not get stuck in enabling state * Service Manager: Fix confusing short user/role deviation display at service startup * Fix sopas reconnecting * User docs: Fix spelling of protocol names in docs ## What has changed in 1.0.16? Next regular update release with several bugfixes, in particular fixing an issue with resource persistence and also for OPC UA reconnection stability. Additionally, another new protocol [OPC DA](/connectors/shop-floor-connectors/opc-da) has been added, and plenty of small bugfix improvements make life easier in production use of the Connectware. #### Added * Implement [OPC DA protocol](/connectors/shop-floor-connectors/opc-da) #### Changed * Commissioning files: Allow more characters in [serviceId](/data-flows/services/serviceid) and [resourceId](/data-flows/service-commissioning-files/resources#resource-id). For backward compatibility reasons, the rule for auto-generation of a serviceId is kept unchanged, so that an auto-generated serviceId is still all lowercase. * Admin-UI: Implement more details overview of currently used Connectware license * All protocols: Introduce versioning in protocol-mapper so that distributed agents can check for compatible versions * Installer: Improve installer script to self-contain the docker-compose.yml file so that no extra download is needed anymore #### Fixed * Severe bugfix in Admin-UI: Fix erroneous removal of listeners from service instances, causing breaking persistence of resources and unexpectedly restore of older resource versions on Connectware restart * Admin-UI: Fill the host/port field in the Authorize dialog and the Connection overview and detail pages for all protocols * Admin-UI: In the Grant Client Registry dialog, also display the requested roles * All protocols: Improve logging statements in protocol-mapper to let all contain context * All protocols: Fix partly broken subscription restore on reconnect by improving the Connection base class API, especially for OPC UA * OPC UA: Fix remaining issues with OPC UA reconnection behavior to be much more stable * Pfannenberg: Fix polling data access, improve stability of subscribe data access * Modbus: Fix boolean datatype in modbus data ## What has changed in 1.0.17? This week’s regular update release brings again several bugfixes, in particular related to the [Beckhoff ADS protocol](/connectors/shop-floor-connectors/ads). Additionally, some user interface improvements were added, such as a notice about newer version availability on the [Home](/monitoring/system-status) section of the Admin-UI. #### Changed * Admin-UI: Improve user experience for Internet Connectivity checking * Admin-UI: Display available newer versions on Home page * Admin-UI: Improve display of hostname in agent overview * MsSQL: Extend mssql read function to use templates, similar to mssql write function * MsSQL: Add property to skip SQL query format validation, to enable using specific MsSQL syntax variants * Installer: Add extra operation mode for installer to prepare offline installation files #### Fixed * ADS: Fix Beckhoff crash by adding missing delete of async handler * ADS: Fixed subscriptions by choosing the correct subscribe mode * ADS: Update ADS client library from github * OPC DA: Improve wording for OPC DA error messages * Installer: Let the installer not logout if it was logged in before * Services: Fix missing termination condition when setting up state checking, related to the noted bugs * Services: On failing service update, improve cleaning up of resources for rollback * Startup: Fix blocked start-up of system-control-server by fixing an erroneous awk command in bootstrap script * Startup: Fix postgresql error message when User.read is called with empty userId ## What has changed in 1.0.18? This week’s update release brings stability improvements and bugfixes, especially regarding service commissioning files with larger number of endpoints. Additionally, some user interface improvements were implemented, such as an improved license handling and some minor usability improvements when no services are installed yet, to get started even easier. #### Added * OPC UA Server: New OPC UA server is added, available as Cybus::Server resource, using port 4841, along with historical access (using an InfluxDB internally). Documentation is still in preparation. * REST: Added /api/system/health endpoint which returns information about the connectware system container. #### Changed * [License file handling](/deployment/licensing) improved and better connected with Cybus Portal management interface * Admin-UI: Some UX improvement on empty connectware #### Fixed * BACnet: Updated BACnet code for improved stability and reliability * Service files: Enable enabling of a large number of endpoints (2000-3000 endpoints) * Service files: Fix cleanup on service rollback if service cannot be installed or updated * Service files: Fixed mapping resource validation on error * EtherNet/IP: programName property can now be null * EtherNet/IP: Optimized connectivity by removing watchdog in favor of reconnection logic in the scanning. * Beckhoff ADS: Fix problems with larger number of endpoints ## What has changed in 1.0.19? This week’s bugfix update improves some issues in SQL (MariaDB) and Beckhoff ADS protocols, along with further stability improvements. #### Added * Admin-UI: Let distributed agents show their versions in the Agent overview page * SQL protocol (MariaDB): Extend error reporting for when a query validation fails #### Changed * Beckhoff ADS protocol: Adding id, timestamp and value to protocol output * ADS protocol: User documentation improved by explaining input/output message format in detail * Admin-UI: Make endpoint overview page faster for large number of endpoints * Admin-UI: Improve display refresh of system health page #### Fixed * Beckhoff ADS protocol: Fix occasional segmentation fault on disconnect ## What has changed in 1.0.20? Another regular bugfix update of the Connectware. This time, some EtherNet/IP and MsSQL protocol issues have been fixed, some structure improvements with the [OPC UA Server](/connectors/servers/opc-ua-server) were added, and several overall stability improvements were implemented. #### Changed * Admin-UI: On a Balena managed appliance, show a different link for updating * Agent performs version check upon connecting to central broker, for now just printing a clear log message on version mismatch, but in the future more automatic actions are being prepared. #### Fixed * OPC UA Server: Simplify configuration to only define server and node, no more “parent node” resources. Various other configuration clarifications. * OPC UA Server: Several unhandled promise exceptions are fixed. Deviation tracking is fixed, too, and also UI representation. * Mssql protocol: Fixed host parameter which could not be changed on subsequent connection attempts. * EtherNet/IP protocol: Fix unhandled promise rejection on errors in scanning process * REST API: Fix client registration behavior if username already exists * Authentication: Fix errors with username and rolename with spaces * Container handling: Fix annoying log error messages about unhandled promise rejections after containers have been restarted * Admin-UI: Fix crashing UI on deleting service in service overview ## What has changed in 1.0.21? This regular bugfix update improves the stability of the new [OPC UA server](/connectors/servers/opc-ua-server) considerably. Also, issues with MQTT connections, in Heidenhain protocol, and in the user interface have been fixed. And the first beta version of the Service Catalog for downloading services online from the Cybus Portal has been added - more content will be added there over the upcoming weeks and months. #### Added * Admin UI: Added first draft of Service Catalog for installing services online from the portal * Docker resources: Add properties to limit CPU and memory usage #### Changed * OPC UA Server: enable OPC UA secure channel by default. BREAKING CHANGE: Connectivity to OPC UA Server is now only possible by “SecuritySetting: Basic256Sha256, SecurityMode: SignAndEncrypt” * Modbus protocol: Improved error messages in case of modbus server disconnect * Update some npm dependencies packages #### Fixed * OPC UA Server: Fix for nonexposure of Namespace metadata for cybus namespace * OPC UA Server: Fixed errors when more than one root node is specified * OPC UA Server: Fix error with array datatypes * OPC UA Server: Fix initialValue 0 not accepted * OPC UA Server: Fix slow endpoint creation if service contains also nodes * OPC UA Server: Catch errors and exceptions on starting OPC UA server if e.g. port is in use * MQTT and GenericVRPC protocols: Fix mqtt-package dependency to non-broken version 6.7.0 where the previous version 6.6.0 caused “Error: Invalid length” exceptions. The erroneous dependency affected Connectware 1.0.18, 1.0.19, and 1.0.20. * Heidenhain protocol: Fix endpoint schema to allow function call parameters on subscribe * Admin UI: Fix unsorted service overview table * Admin UI: Fix various mui-datatables deprecation warnings * Admin UI: Fix blank screen for service details if agent is offline * Admin-UI: Fix wrong character encoding on downloading commissioning files with non-ascii characters * Managed Appliances: Fix missing NODE\_ENV in balena docker-compose.yml file ## What has changed in 1.0.22? #### Added * Add local caching of valid license file so that offline instances can restart without additional license file handling * OPC UA Server: Added 64-bit integer number support * ADS protocol: Added data type conversion directly in endpoints #### Changed * Docker: Change docker image tags to version number instead of git commit hash * OPC UA Server Historical Access: Use the original data timestamp when writing to influx database * OPC UA Server Historical Access: Improved retention policy handling #### Fixed * OPC UA Server: fixing server behavior if MQTT broker is reconnecting * SQL protocol (MariaDB): Fix sql insertion when template variables contain non-ascii characters * OPC UA Server: Fix error on influx setup preventing OPC UA access at all ## What has changed in 1.0.23? This regular bugfix update improves stability and scalability, but also brings new features. The release includes ingress routes to custom service containers now not only for HTTP protocol connections but also for general TCP/IP connections. Also, the FOCAS protocol for FANUC CNC machines has been added. #### Added * New ingress routes for TCP/IP added, so that not only HTTP but also general TCP/IP connections can be routed to service containers via [Cybus::IngressRoute](/data-flows/service-commissioning-files/resources/cybus-ingressroute). * New protocol added: [FANUC FOCAS](/connectors/shop-floor-connectors/focas) #### Changed * Admin UI: Service catalog display page is updated with categories and more pointers on how to create and deploy further services #### Fixed * Modbus protocol: connection status not updating on half-open TCP socket * OPC UA Server: Increase large number of nodes that can be created * Documentation: Update docs to reflect actual default for QOS on mappings * Admin-UI: Fix double upload needed on license upload * Admin UI: Fix system status page reload * OPC UA Server: fix OPC UA Server’s different endpoint specification preventing some client access * Commissioning files: Fix bug in circular dependency detection algorithm ## What has changed in 1.0.24? Another regular maintenance release for the beginning of the year, bringing some bugfixes for OPC UA Server and improving the recently added FOCAS protocol. #### Changed * Update NodeJS to version 12.20.1, including security updates * All protocols: Switch base image of protocol-mapper from alpine linux to debian (buster-slim) to avoid compatibility issues with musl-libc and now just use standard glibc * MQTT Broker: Upgrade VerneMQ to version 1.11, fixing issues with overly consuming disk space #### Fixed * OPC UA Server: Fix for Mismatch of UserIdentityTokens, fixing some connection problems from specific OPC UA clients. * FOCAS protocol: Make FOCAS connection asynchronous again * FOCAS protocol: Fix crash on return value conversion of pmc\_rdpmcrng method * Documentation: Fix modbus example files to always define a dataType property on all endpoints ## What has changed in 1.0.25? This is just another regular maintenance release for the beginning of the year, bringing mainly some bugfixes for the OPC UA Server and some small improvements in SQL protocol and workbench handling. #### Added * SQL protocol: Enabled submitting multiple records per message into one SQL statement * Workbench: Added node-red project support (git repository) #### Changed * Ingress proxy: Update Envoy to version 1.17 * User docs: Added documentation for Cybus::Container resource limitations introduced in 1.0.21 #### Fixed * OPC UA Server: Fix connection from UAExpert * OPC UA Server: Fix crashing protocol-mapper on additional services in parallel to OPC UA Server * OPC UA Server: Let OPC UA Server also start correctly from persistence * Containers: all containers should exit when authorization is not possible. VRPC update to 2.3.0. * User docs: Fix mistake in OPC UA docs and adjust FOCAS endpoint properties description. ## What has changed in 1.0.26? The next regular maintenance release of the Connectware, including a collection of connectivity bugfixes for various protocols and for the OPC UA Server. #### Changed * OPC DA protocol: Improve handling of connection errors and wrong connection parameters to quickly show an understandable error message * FOCAS Protocol: Update FOCAS library to version 4.16 (February 2018) * Admin-UI: Let the Agent overview page also display Heidenhain agents * Containers will now exit on missing permissions #### Fixed * OPC UA Server: finalize integration testing * GenericVrpc protocol: Fix multiple connects in remote agent * OPC UA Server: Fix parsing int64 values and also initial values * BACnet protocol: Fix BACnet connection errors (on subscribe) * MQTT Protocol: Fix MQTTS connection errors * Heidenhain protocol: Fix broken reconnect if agents are restarted ## What has changed in 1.0.27? Another regular maintenance release of the Connectware, including a collection of OPC UA bugfixes and other protocol improvements. #### Fixed * OPC UA Server: Fix handling of initialValues for receivingDataNodes * OPC UA Server: Prohibit enabling if duplicate browseName was used * OPC UA: Update node-opcua to 2.31.0, fixing connection problems with Heidenhain client * ADS protocol: Fix cancelling of blocking connection requests * Fix spurious Endpoint/Node persistence files after deletion of service ## What has changed in 1.0.28? This release brings a new protocol for connecting to InfluxDB databases directly from the Connectware. Also, OPC UA Server can now have nodes added and removed at runtime flexibly. And some additional bugfixes for OPC UA Server, ADS protocol, and agent installation are improving Connectware stability and reliability continuously. #### Added * InfluxDB protocol: Add support for InfluxDB connection protocol #### Changed * Ingress: Update ingress-controller implementation to use Envoy API V3. * OPC UA Server: Enabled inter-service referencing for server nodes, so that additional nodes can be enabled and disabled while the server is running #### Fixed * OPC UA Server: Fix re-creation of service after restarting connectware * OPC UA Server: Print useful error message for out-of-range values, in case a JSON message contains a value that does not fit in the range of the OPC UA node * OPC UA Server, MQTT protocol: Node and Endpoint with improved qos option handling * Agents: Fix permission problem on restarting previously running agents * Installer: Clarify default value of systemd install option * Service enabling: Improve error message on offline agent * Service catalog: fix download counter on installing a service from the services catalog * ADS protocol: fix error on write operation * ADS Protocol: Code cleanup and better error reporting ## What has changed in 1.0.29? This regular maintenance release of the Connectware brings some OPC UA and ingress timing bugfixes. #### Changed * Ingress: Increase ingress route timeout to 30 seconds, and also add `CYBUS_ROUTE_TIMEOUT` as environment variable to the docker-compose.yml file. * OPC UA Server: Integration of prebuilt Nodeset files * Modules update: nodejs to 12.20.2, vrpc to 2.3.2, pg to 8.5.1, db-migrate-pg to 1.2.2 #### Fixed * OPC UA: Fix deletion of endpoints to not take too long anymore * Admin-UI: Fix TCP ingress routes erroneously shown as HTTP routes ## What has changed in 1.0.30? This regular maintenance release of the Connectware brings some protocol enhancements as well as a new node.js security patch and improvements to interdependent service handling. #### Changed * Service manager: Introduce inter-service dependent enabling/disabling so that disabling a parent service with dependent child services will cause those to be disabled as well. * WERMA protocol: Improve reconnection state handling * Update node.js to 12.21.0, which includes security updates * Container manager: Fix checking for docker container’s hostname string length which must not exceed 63 characters. Watch out: Under certain conditions, longer container names were silently accepted and seemed to work, but will no longer be accepted now. #### Removed * MSSQL protocol: Removed optional SQL syntax checking option. If the option is still used, a deprecation warning is logged, but nothing happens anyway now. #### Fixed * OPC UA Server: Fix error on deletion, and fix large numbers of endpoint and node deletion ## What has changed in 1.0.31? Another regular maintenance release of the Connectware. There are bugfixes in some protocols, some user documentation, and optimizations. #### Changed * SQL protocol: increased connection probe delay and reduced logging level. * Auth-server: Optimize basic auth API * OPC UA Server: ObjectNode integration. Allows creation of OPC UA object types by commissioning files and the ObjectType node creates a JSON topic that is published on MQTT topic. * Admin-UI: In the System->Agents list, allow offline agent entries to be deleted from the list. #### Fixed * User docs: Added instructions on how to deploy an agent on the Modbus Agent example * Connection parameters: AdditionalProperties property was set to false in all protocol connections and endpoints schema. ## What has changed in 1.0.32? This regular maintenance release of the Connectware brings stability improvements for OPC UA, some improvements on error reporting for container resources and container logs, and some bugfixes on InfluxDB and Modbus protocols. #### Added * Container resources: Add support for configuring ulimit -n in containers from commissioning file properties, see [ulimit](/data-flows/service-commissioning-files/resources/cybus-container#ulimit). * Admin-UI: For container logs, added “Download raw logs” button for retrieving more details for bug fixing, see [Container Logs](/monitoring/system-status/system-container-status#container-logs). #### Changed * Container manager: better feedback on missing registry permissions for pulling Docker images * OPC UA client: Some log output improvements for larger customer setups * Docker logs: Set docker logging parameter max-file default to 2, so that there should be one log file always available #### Fixed * OPC UA server: Fix occasional problems after service deletion when enabling another service with new OPC UA server * InfluxDB protocol: Fix disconnection tracking and improve configuration * Modbus protocol: Fix too quickly reported state changes, especially on startup ## What has changed in 1.0.33? Another regular maintenance release of the Connectware. This time, stability for larger commissioning files is improved, as well as error reporting in OPC UA server, InfluxDB, and other places. And there are many other bugfixes and overall improvements. #### Added * OPC UA client: Add optional check by TCP whether the target host and port is actually reachable (needs checkHostReachable: true) * OPC UA Server: Add OPC UA object types that can be received or published via JSON structures on MQTT topics. #### Changed * Container manager: Add more descriptive error message if setting ulimit in container fails due to missing permissions, which are not available on some Docker host setups, see [ulimit](/data-flows/service-commissioning-files/resources/cybus-container#ulimit) * OPC UA Server: Again introduce better error reporting on duplicate browse name errors * Admin-UI docker logs: Change button “raw logs download” to really return raw logs, which is the output from the Docker daemon’s logs, not anymore a JSON file, see [Container Logs](/monitoring/system-status/system-container-status#container-logs). * InfluxDB protocol: Improve InfluxDB user documentation and example, and improve error handling #### Fixed * OPC UA protocol: Fixed handling of large number of endpoints by managing endpoint in address groups internally * Services: Some fixing of deviation tracking in larger commissioning files. Also, fix criterion when deviation tracking is switched on or off for larger amount of endpoints. * Services: Reduce proxy timeout errors when subscribing deviation tracking * Services: Improve the loading behavior of persisted Service instances on service-manager restart * Protocol-mapper: Fix endpoint creation on container restart to also use batch creation ## What has changed in 1.0.34? This next regular maintenance release of the Connectware comes with a significant improvement towards handling very large systems and commissioning files. Many inconveniences and issues with large files have been fixed, together with some bugfixes in the Admin-UI and the OPC UA Server. #### Added * Add logLevel parameter to [SQL connection](/connectors/enterprise-connectors/sql#loglevel-string-enum): Adds a new flag for the SQL connection, logLevel, to switch on per-request log messages. * User docs: Adding kubernetes deployment example to the [agents documentation](/data-flows/agents/installing-agents/installing-agents-via-kubernetes) #### Changed * Service management: Several improvements to significantly increase speed and stability when dealing with large service commissioning files throughout their whole life cycle: At installation from Admin-UI, at installation from REST endpoint, at deviation tracking during runtime, at restarting of the protocol-mapper or other containers, and at disabling and deletion. * Mapping resources: Significantly improve performance when enabling large amounts of mappings * Admin-UI: Internal refactoring to improve response times and stability * Admin-UI: Implemented a warning display if frontend and backend may operate on different versions if page is not manually refreshed by user #### Fixed * Fix /api/services/post REST endpoint to accept large files * Service management: Fix various crashes with large number of endpoints * OPC UA Server: Check for duplicate browsenames and nodeids and display appropriate error messages * Pfannenberg protocol: Fix too often renewal of subscriptions * Admin-UI: fixed count of resources in service detail page after resources have been deleted ## What has changed in 1.0.35? Our next regular maintenance release of the Connectware comes with more speed and stability improvements for larger commissioning files, and some bugfixes in various protocols. #### Changed * OPC UA user documentation: Add [example endpoint](/connectors/shop-floor-connectors/opc-ua/opc-ua-client#simple-example) into documentation for commissioning files with only one connection, which might need also one simple endpoint (as a workaround for some OPC UA server that closes a connection after 30 seconds if it has no endpoint) * Modbus protocol: Adding support for configured data types on [input data](/connectors/shop-floor-connectors/modbus-tcp#input-format) for write operation * Service files: Speed up the initial file parsing considerably * Admin-UI: Code refactoring to improve handling of large files. Also, change service installation window to give better overview of upcoming parameters. * Update node.js to 12.22.0 #### Fixed * Admin-UI: Fix missing resource count update on enabling * Admin-UI and REST endpoint: Prevent default role `protocol-mapper-agent` from being deleted * OPC UA server: Fix accidental server shutdown after 60 minutes * Service files: Fix error messages about `createBatch timeout` which are not necessarily a problem * System startup: Fix occasional startup timing issues; sometimes error message `“Could not create EndpointView instance" 6000ms timeout”` appeared, sometimes the service-manager could not establish the connection to the container-manager, or vice versa. * System startup: Avoid writing resources with failed initialization to docker volume persistence. ## What has changed in 1.0.36? Another regular maintenance release of the Connectware. Again the stability and configuration time for larger commissioning files is improved, as well as error reporting in OPC UA client protocol, BACnet, InfluxDB, and other places. And there are many other bugfixes and overall improvements. #### Changed * OPC UA protocol: Clarify [reconnection timing behavior in user documentation](/connectors/shop-floor-connectors/opc-ua/opc-ua-client#reconnection-behavior), and decreasing default maximum waiting time between subsequent re-connection trials from 60 seconds to 30 seconds. * OPC UA protocol: Check and report if endpoint requests nodeId that does not exist on server. The respective endpoint will change into “disabled” state. * OPC UA server: Extend historical access methods to also allow aggregation functions Average, Minimum, and Maximum. * BACnet [user documentation](/connectors/shop-floor-connectors/bacnet) improvements * Admin-UI: Further improvements for loading large commissioning files, avoiding timeout error messages and increasing efficiency on loading the file in the backend. Improve efficiency on service delete, too. * Ingress-controller: Update Golang to 1.16.3 and use Alpine 3.13 for all Golang images #### Fixed * Admin-UI: Fix ingress routing issue with some service dashboards where permissions were missing * Admin-UI: Fix page redirect after deleting a container resource * Admin-UI: Fix missing cache-cleaning when reloading web-app after version upgrade in some browsers * Docker: Fix docker image permission check if the license requires exact match, where the permission check erroneously reported that the current license does not have permission for some docker image * InfluxDB protocol: Fix occasional crash on disconnection which unfortunately caused a protocol-mapper crash * Container-manager: Fix startup behavior * Fix re-attaching ingress route on restarting connectware if a service is enabled (broken since 1.0.33) * Fix service delete/install via REST API not showing up in UI (broken since 1.0.34) ## What has changed in 1.0.37? This next regular maintenance release of the Connectware comes with some improvements in most protocols about the reconnection timing, more stability towards handling very large commissioning files, and some more bugfixes and minor updates all across the board. #### Added * All protocols: Add incremental delays for re-connection attempts, so that instead of trying a reconnection every 1 second, the waiting time is now increasing until 30 second maximum, and can be configured by the `connectionStrategy` property, see [Cybus::Connection](/data-flows/service-commissioning-files/resources/cybus-connection) #### Changed * Upgrade BACnet stack to version 1.0.0 * Update various npm packages with minor and major version updates * Container-manager: Fix startup procedure of container-manager to not have it exit multiple times * OPC UA client: minor [user docs improvement](/connectors/shop-floor-connectors/opc-ua/opc-ua-client#nodeid-string) to clarify nodeId syntax #### Fixed * Fix service delete/install via REST API not showing up in UI * Improve loading of large files in REST: Re-use Parser results in Service constructor * Admin-UI: fixed rendering of service metadata in service details view * OPC UA server: Finish exposing metadata for historizing aggregations * Influxdb: Simplify the topic name for InfluxDB endpoints ## What has changed in 1.0.38? Our next regular maintenance release of the Connectware comes with some bugfixes in various protocols, an interesting new polling [schedule feature](/data-flows/service-commissioning-files/resources/cybus-endpoint#polling-interval-and-subscribe) on endpoints, and overall speed and stability improvements. #### Added * Some protocols: Cron expressions for polling at [fixed time points on endpoints](/data-flows/service-commissioning-files/resources/cybus-endpoint#polling-interval-and-subscribe) have been implemented. #### Changed * InfluxDB: Simplify the topic name for InfluxDB endpoints. The topic name for endpoints now uses either the name of the measurement for writing or “data” for read/subscribe #### Fixed * Agents: Fix missing mqtt scheme when creating the internal MqttConnection, causing problems for agents that want to use “mqtts” instead of “mqtt” * OPC UA: Better error reporting with MonitoredItemGroup in case of initialization failure ## What has changed in 1.0.39? Another regular maintenance release of the Connectware. The Admin-UI has been improved in the service details view, and several bugfixes and improvements regarding large number of endpoints have been implemented. And there is the regular share of further stability improvements. #### Changed * Admin-UI: Service details page for [updating services](/data-flows/services/managing/updating) restructured: Buttons are placed in a more structured form; install, update, and reconfigure all use the same new two-section window. Further internal refactoring to reduce technical debt. #### Fixed * Admin-UI: Services with no parameters will have a clear message about it * Admin-UI: Rows per page is now fixed on service resource tables and logs tables (but not yet on tables elsewhere) * Admin-UI/Explorer: Let mapping topics with named wildcard show messages in history * Admin-UI: Better error reporting when handling a service runs into an error * Service deviation detection: Fix deviation tracking and reporting for Endpoints, also for larger number * Admin-UI Deviation detection: Collect deviation events before emitting them, to fix freezing admin-ui on larger number of endpoints * Admin-UI: Available Service Catalog version is now always displayed on the service details page * OPC UA: Better cleanup after early termination of MonitoredItemGroup * Licensing: Fix expiration date to correctly keep working until day’s end of that date * BACnet protocol: fix potential leftover polling timers to avoid double messages after fast reconnections or service updates ## What has changed in 1.0.40? This is a bugfix release to improve the behavior on two issues recently discovered. In the Admin-UI, the “links” buttons are fixed again, and in BACnet the disable/enable behavior has been improved. Also, minor other updates are included. #### Fixed * BACnet: Fix leftover connections (“zombie”) after disabling some BACnet services. This also enables the `cronExpression` property for BACnet endpoints. * Admin-UI: Fix broken “Links” urls on the service detail pages ## What has changed in 1.0.41? This next regular maintenance release of the Connectware comes with some bugfixes in various protocols, some helpful new configuration properties for [OPC UA connections](/connectors/shop-floor-connectors/opc-ua/opc-ua-client#connection-properties), and overall speed and stability improvements. #### Added * OPC UA client: Add configuration property maxMonitoredItemsPerCall in [OPC UA connections](/connectors/shop-floor-connectors/opc-ua/opc-ua-client#connection-properties). This allows to let the group registration be done with the given maximum number of items per call, if the server requires such a restriction. #### Changed * Admin UI: Further refactoring to prepare login with different permission sets. On a changed connectware version the admin-ui will now logout. #### Fixed * Admin-UI: Revert service “links” style into buttons again * Admin-UI: Fixing issue where non-default parameters would not be loaded in update dialog * Admin-UI: Fix missing connection host/port to be displayed in overview table * Service manager: Fix waiting time upon service start that causes very long time on restart * Heidenhain protocol: Fix unhandled promise rejection on agent restarting by fixing missing await. Fix sanity check on disconnect. Also, fix lookup of instance name in ‘instanceGone’ event. Add more sanity checks where appropriate. Should fix missing reconnection on machine restarting. * Container-manager with more robust startup to run multiple attempts to instantiate a ProtectedDocker instance ## What has changed in 1.0.42? Our next regular maintenance release of the Connectware comes with some bugfixes in various protocols, an interesting new protocol [Systemstate](/connectors/enterprise-connectors/systemstate) for notifications of internal states, and overall speed and stability improvements. #### Added * Systemstate protocol: Added a new protocol [Systemstate](/connectors/enterprise-connectors/systemstate) that enables access to internal Connectware events as mqtt messages. * OPC UA Server: New Object Type [Opcua:Reference](/connectors/servers/opc-ua-server-references) was added for usage in commissioning files. This enables users to reference preexisting nodes and structures in a commissioning file. The Reference type also creates an MQTT topic that publishes the value of the nodeId. * Deployment: Adds initial support for running Connectware in a Kubernetes cluster * Influxdb protocol: Added writing of multiple data records per message for InfluxDB. #### Fixed * Fix missing MQTT endpoint/connection schema validation in service manager * Influxdb: Added default value `http` for connection scheme * Heidenhain: Make sure to not do anything if we are disconnected, to avoid any activity after service disabling. ## What has changed in 1.0.43? Another regular maintenance release of the Connectware. There are some helpful improvements in the commissioning file and in handling of container networks, and there are performance improvements in MQTT and S7 protocol. Also, the user interface has been worked on to fix some minor bugs and improve stability in general. #### Changed * Commissioning files: The agentName of an Endpoint does no longer need to be specified but is looked up from the Connection resource * Container manager: Networks that are created by deploying container resources are now cleaned up again on service disabling * Kubernetes: improve manifests, broker clustering, and volumes. * Admin UI: Add alternative permissions for services table and extend REST endpoint #### Fixed * S7 protocol: Fix “BAD 255” values when polling * MQTT protocol: Ensure that we never publish to a MQTT topic with wildcards, as this would terminate the mqtt connection immediately. * MQTT Performance: Improve auth-server performance for handling many mqtt clients * Admin UI: System Control Service changes for improved stability * Admin UI: Fix service links on the admin web ui to again open in new tab * Admin UI: Fixing issues where the services would appear for half a second to not be loaded when first loading the application ## What has changed in 1.0.44? This next regular maintenance release of the Connectware comes with some minor new feature for special login situations, several usability improvements in the Admin User Interface with earlier error checking, and various stability improvements and bugfixes in the general resource handling. #### Added * Implement potential long-lived JWT tokens to be passed in the URL. Those tokens can be created and managed through the REST API and are intended to be used in shop floor display devices where no keyboard login is usually used. (There is no UI to manage those tokens, yet) #### Fixed * Distributed agent: Fix too quick discarding of existing credentials, if on re-connecting to the central connectware there is no immediate login possible. Now, the distributed agent will keep re-trying with existing credentials on unreachable connectware and unreachable auth-server. * Admin-UI: Check and prevent issues with long service Id and too long container names. If the commissioning file contains docker containers, the length of the serviceId is now limited according the the resourceId so that the resulting container name is within the 63 character limit. Before, there was no limit on the serviceId length, but the service enabling would eventually fail due to the limit on the container name. * Mapping: Fix [setContextVars](/data-flows/rule-engine/data-processing-rules#setcontextvars) rule which was not working correctly, but is documented and working correctly now. * Auth-Server: Improve performance when querying roles and permissions * User docs: improve [OPC UA](/connectors/shop-floor-connectors/opc-ua) documentation ## What has changed in 1.0.45? This regular maintenance release of the Connectware brings another new protocol for connecting to Apache [Kafka](/connectors/enterprise-connectors/kafka) clusters, and some bugfixes throughout the system, in particular with the startup procedure of the system control server, in order to improve overall stability. #### Added * [Kafka protocol](/connectors/enterprise-connectors/kafka) implementation. This change adds the Kafka protocol that allows connectivity to Apache Kafka clusters/brokers. #### Fixed * User docs: mqtt client [documentation](/connectors/enterprise-connectors/mqtt) improvements * Improve startup timing of system control server, fixing some conditions where the connection between system control server and container manager was not set up correctly * Fix parsing error on using `Cybus::MqttPort` [global parameter](/data-flows/service-commissioning-files/parameters#global-pre-defined-parameters) which used to be refused in certain contexts requiring an integer value * Admin UI: removed beta tag from service catalog menu item ## What has changed in 1.0.46? Our next regular maintenance release of the Connectware brings a brand-new explorer page in the Admin UI where custom topics can be added, topics can be filters, and topic selection is much improved. Many more bugfixes in the Admin UI and some minor fixes in other areas are added, too, to achieve overall speed and stability improvements. #### Added * Admin UI: New Explorer UI is now live: Button for “Add custom topics”, filter by topic types, collapsable history, improved performance * Admin UI: Extend deviation reporting: Add “reason” to state event * Distributed mappings: Mappings now can run on agents by specifying an `agentName` property, see [Cybus::Mapping](/data-flows/service-commissioning-files/resources/cybus-mapping) #### Fixed * Admin UI: Connection details now displays extended properties * Admin UI: Fixed rows per page issue on Connections table and on Mappings table * Admin UI: Fixed sorting issues on Connections and Mappings table * Admin UI: Fixed issue with explorer UI where one could not copy JSON topic messages on the UI * Admin UI: Fixed issues with Sections expansion on Services (and now Connections) * Admin UI: Fixed issue on Admin Web UI where previous service parameters would be overwritten by the new default ones * Admin UI: Fixed issue where appbar breadcrumbs would use singular name instead of plural * Admin UI: Fixed issue with Admin Web UI rendering the wrong breadcrumbs on User and Role views * Auth-server: Fix creating and reading of roles with no permissions * OPC UA Server: Fix wrong if-clause before accessing this.\_historyManager ## What has changed in 1.0.47? This regular release of the Connectware brings significant improvements in the Mapping resources by adding the possibility to list many [subscribe](/data-flows/service-commissioning-files/resources/cybus-mapping#subscribe) topics for a single mapping, together with the [collect](/data-flows/rule-engine/data-processing-rules#collect) rule to combine these easily. The user interface for the Mapping got improved by displaying the data directly on the Admin-UI, together with potential errors from rules, to make rule debugging significantly easier and faster. The [OPC DA](/connectors/shop-floor-connectors/opc-da) protocol has been extended to support also simple write endpoints and an OPC DA bug with newer windows versions was fixed. Also, some more documentation improvements have been implemented, and more bugfixes in Mapping and OPC UA Server have been implemented. #### Added * Mapping: Support multiple endpoints/topics in Mapping subscription and add new collect rule (see [subscribe](/data-flows/service-commissioning-files/resources/cybus-mapping#subscribe) and [collect](/data-flows/rule-engine/data-processing-rules#collect)) * Admin UI: Add new MQTT message display in Mapping page, and also displaying errors from Mapping Rules directly in the Mapping page. * OPC DA: The write operation was implemented on the [OPC DA](/connectors/shop-floor-connectors/opc-da) protocol. * User docs: Explain the definition of array parameters better in documentation (see [Additional properties for arrays](/data-flows/service-commissioning-files/parameters#additional-properties-for-arrays)) * User docs: Add docs about system requirements (see [System Requirements](/deployment/installing-connectware/system-requirements)) * User docs: Complete list of S7 data types (see [Siemens SIMATIC S7](/connectors/shop-floor-connectors/siemens-simatic-s7)) * OPC UA Server: add config settings for max connections server in [Custom Server Properties](/connectors/servers/opc-ua-server#custom-server-properties) #### Fixed * OPC DA: Fix OPC DA protocol version for newer windows versions to fix `RPC_E_INVALID_HEADER` error message * Mapping: Fix potentially duplicated messages on re-enabled mapping, especially when connecting to an external MQTT broker northbound * Admin UI: Choose default MQTT message display types similar to what they have been before ## What has changed in 1.0.48? This regular release of the Connectware brings improvements to the Admin UI in the Permissions and Roles section, improvements to the Protocol Mapper in the form of OPC UA object crawling, support for MQTT V5 options in the MQTT endpoints and connections, and improved support for mutual TLS verification for the Broker. #### Added * Admin UI: New system role with limited permissions added * Platform: Add env file option `CYBUS_BROKER_USE_MUTUAL_TLS` for mqtt mutual TLS configuration (NOTE: docker-compose.yml file change) * Protocol Mapper: Add MQTT5 support in MQTT protocol for both connection and endpoint #### Changed * Admin UI: Improved License management on Admin UI, the license information, including id, can now be viewed by every user on the Connectware and other general improvements * Service Manger: Decrease log verbosity of systemstate protocol connections #### Fixed * Broker: Fixes in mutual TLS code and configuration * Protocol Mapper: Fixes for crawling of OPC UA structures * Service Manager: Fixes to deviation tracking * Admin UI: Improved permissions management ## What has changed in 1.0.49? This regular maintenance release of the Connectware brings a new overview table of all “links” (e.g. dashboard buttons) in the Admin-UI, some more improvements in the recently overhauled Explorer page, and some more bugfixes in OPC UA protocol, SQL protocol, Kafka protocol and throughout the software. #### Added * Admin-UI: Created Services Link table under the resources navigation tab, available also for non admin users * Kubernetes deployment: Added initial Helm chart integration #### Fixed * Admin-UI: Fixed issue with table sorting being reset after new items are added * Admin-UI Explorer: Now showing grayed out topic check-boxes if the children beneath it have multiple selection states. Added unsubscribe button to Monitored Topics section. Fixed issue with topic messages or paths being too long. Do not load topics that the user does not have permission to subscribe to. Instantly display monitored topics if they do not contain a wildcard * OPC UA: Detailed error logging for createmonitoreditems request * SQL protocol: Placeholders for SQL read endpoints * Kafka protocol: Improved Kafka connection state handling * Service Manager: Fixes to usage reporting ## What has changed in 1.0.50? Our next regular maintenance release of the Connectware brings further user interface improvements in the Admin-UI Explorer page, as well as improved Kubernetes deployment capabilities using a Helm Umbrella chart. Also, some bugfixes in the Admin-UI and also the rest of the software are improving the overall stability. #### Changed * Admin-UI Explorer: Added a new popover to display resources associated with a topic * Admin-UI Explorer: Now it is possible to filter topics by their associated resource * Admin-UI Explorer: Now removing irrelevant topics * Admin-UI Explorer: Now hiding Admin UI Explorer's monitored topic action buttons when not hovered #### Fixed * Admin-UI: Fixed issue where publish endpoints would cause an error on the recently added Admin UI, either in the mapping detail page or in more places of the admin-ui * Admin-UI: Added loader screen after login while waiting for some UI components to initialize fully, to avoid showing an empty screen instead #### Changes for Kubernetes deployment * Container-manager: Adapt container-manager to k8s, so that at least its first set of features (logs, container creation and deletion) are available in k8s as well * Broker cluster self-healing * Change Broker k8s Service to an StatefulSet * Make resource requests and limits configurable in the Helm chart * Add namespace to container-manager roles * Add an init container to the broker-cluster deployment ## What has changed in 1.0.51? This regular maintenance release of the Connectware brings a set of bugfixes in various protocols. The “write” operation now has return values added. And various improvements are implemented throughout the code. #### Changed * All protocols: The “write” operation will now also return a response value * Ingress: Increase possible number of incoming connections by adding possibility to configure the maximum number of connections in ingress-controller. The env variable `MAX_TCP_CONNECTIONS` (default: 10,000) is added to the docker-compose.yml configuration file (previously the maximum was 1024). (NOTE: docker-compose.yml file change) #### Fixed * OPC UA client: Fix BadTooManyOperations error on unsubscribing from servers with MaxMonitoredItemPerCall limits * OPC DA protocol: string type for values is fixed again * Container-manager: Fix to work on Kubernetes by adding k8s namespace and docker ingressHostname as configuration variables * Agent: Fix accidental dropping of credentials on receiving a HTTP 504 response code ## What has changed in 1.0.52? Our next regular maintenance release of the Connectware makes the explorer page even more powerful, and well-performing even for very large number of subscribed topics and messages. Additionally, in the S7 protocol there is an important bugfix, in the SQL protocol the connectivity to PostgreSQL has been added, and some more performance improvements have been implemented. #### Added * SQL Protocol: Support for [connecting to PostgreSQL databases](/connectors/enterprise-connectors/sql#connection) has been added #### Changed * Auth-server: The internal databases have been optimized to improve performance on large number of connecting clients * Connectware containers: The startup log messages of the node.js containers have been improved and skip the distracting info messages about added GET etc. routes. #### Fixed * Admin UI: On home screen, fix the displayed number of services * Admin UI: On login, always redirect users to the home screen regardless of the previous URL, to avoid displaying confusing permission error messages * Admin UI: Fix explorer page for large number of topics so that the browser does not freeze anymore and many messages can be displayed * S7 protocol: Fix undefined variable in code, causing crash on “Bad 255” occurrence (unfortunately introduces in CYB-2933 version 1.0.43). Fixed now. ## What has changed in 1.0.53? This regular maintenance release of the Connectware adds a new overview table for the current system usage, and contains some important bugfixes concerning deviation tracking, OPC UA writing to SIMATIC S7 OPC UA servers, and ADS connectivity. The performance for large numbers of resources is also being improved continuously. #### Added * Admin-UI: Add new information in page System -> Metrics where the collected usage numbers are shown in a table view. #### Fixed * Fix deviation display problems when larger number of resources are being used. Sometimes the Admin-UI shows deviations even though the resources were working fine, which has been fixed now. * OPC UA: Fix failing write for S7 OPC UA servers. Also, an error message is logged in case OPC UA write is failing. * ADS: Fix connection problems for when the net ids and port are invalid causing the protocol-mapper to enter in a reconnect loop and crash. * Admin-UI: Now showing connecting label on button while connection is connecting on the Admin UI. Fixed issued where influx db connection would not reconnect * Admin-UI: Fixed issue where user without admin service custom routes access would be thrown in a authentication loop and the user cannot login anymore ## What has changed in 1.0.54? Another maintenance release of the Connectware is available, this time also bringing new HTTP OAuth authentication support, and EUROMAP 77 features in OPC UA server, and some useful bugfixes especially at the Admin-UI. Additionally performance and stability got improved in general. #### Added * HTTP protocol: Add OAuth Client Credentials authentication support to HTTP Protocol, see [Oauth 2.0 Client Credentials Grant](https://docs.cybus.io/pages/n3tWloQNT8Iu3zL9xXZQ#oauth-2.0-client-credentials-grant) * OPC UA: Add basic EUROMAP 77 integration, so that the OPC UA server can serve the data in EUROMAP 77 format by using the suitable `nodesetFiles` property in the [configuration](/connectors/servers/opc-ua-server#custom-server-properties) #### Fixed * Admin-UI: Fix empty services list when switching between pages * Heidenhain protocol: Fix parallel reconnect trigger if multiple instances are being used * Kubernetes deployment: Fix service-manager volume mounting issue at startup ## What has changed in 1.0.55? This regular maintenance release of the Connectware brings performance improvements for large number of MQTT users, some fixes in the Admin-UI frontend where the pages were not displaying, and overall some updated and improve stability. #### Changed * Auth-Server: Improve authentication performance for large number of MQTT users by caching the login credentials also on MQTT logins (which have already been cached for HTTP logins since many versions) * System-control-server, Admin-UI: Fix all outdated mentioning of portal.cybus.io as backend URL, which has been replaced by a new backend URL graphql-server.cybus.io since version 1.0.49. (Yes, the DNS name is somewhat technical, but that’s the current setup.) The features requiring online connection (license update, Service catalog) use the new URL since version 1.0.49 but the preflight checks were still mentioning the old URL, which is fixed now. * Introduces a barebone protocol-mapper-base docker image ‘protocol-mapper-base’ that can be used for creating special protocol-mapper agent Docker images that implement custom protocols #### Fixed * Admin-UI: Fix several “vrpc connection lost” bugs by setting up the backend connection in a better way * Admin-UI: fix connectware metrics ordering in display * Usage metrics: Fix collecting number of messages in case of power cycling of broker to avoid negative numbers ## What has changed in 1.0.56? Another maintenance release of the Connectware is available with plenty of bugfixes all around the product. REST endpoints for bulk user handling are added, some dependencies have been updated, HTTP proxy handling has been improved, and bugs with GenericVrpc, distributed agents, and in the Admin-UI have been fixed. #### Added * Auth-server: Add REST endpoint for bulk insertion and deletion of users #### Changed * Workbench: Update node-red version to 2.0.6 (major update from 1.x to 2.0). * Update node.js version to 12.22.6 * ADS: Allow minimum read interval to be as low as zero, so that it is the user’s responsibility to find a useful minimum value for a given system configuration #### Fixed * Admin-UI: Fixed issue where the list of endpoints shows all resources, not only endpoint * Admin-UI: Fixing issue with occasional connection errors to backend * Container Startup: At startup when checking for existence of shared files, also check read permissions of those files * User docs: Fix portal backend address mentioning to be only a non-clickable DNS name * Distributed agent: Drop credentials only on 401 response. We change the policy on when the stored agent credentials are re-used and when they are dropped: Before, they were dropped on any result (including refused connection due to offline connectware) except a 501 or 503 timeout response from the ingress (which was caused by e.g. a overloaded auth-server). Now, they are dropped only on a valid http connection that gets a 401 response. * System Control Server: improve license validation and connectivity checks when the system is deployed behind a corporate proxy and add CYBUS\_PROXY environment variables to docker-compose.yml file (NOTE: docker-compose.yml file change) * GenericVrpc: fix deviation cleanup after reconnect ## What has changed in 1.0.57? This regular maintenance release of the Connectware brings many internal version updates, some stability improvements on restarts and shutdowns of containers, and a User Interface for managing certificates. #### Added * Admin-UI: Add certificates management on the Admin UI (under the User Management menu), or /api/certificates HTTP endpoints. #### Changed * Service-manager: Allow the “protocol” property of Connection and Endpoint to be set to an arbitrary value. Validation of child properties is skipped if the value is not one of the known list of protocols. In those cases validation is now done upon enabling those service and resources, not at installation time. * Version updates: Node.js from 12 to Node.js 14 in all containers; alpine runtime base image from 3.11 to alpine 3.12; VerneMQ to 1.12.3; node-opcua to 2.50.0 #### Fixed * Add correct handling of SIGTERM in containers, so that shutdown/restart of containers works considerably faster and under more control. * Admin-UI with reduced permission: Fix interpretation of readWrite to be accepted for read, too * Protocol-mapper: Improve error messages if x509 certificate errors are encountered during startup (such as expired internal certificates) * GenericVrpc: Fix crash on disable GenericVrpc resource * Fix auth-server startup warning about unknown sys-protocol-mapper user ## What has changed in 1.0.58? Our next regular maintenance release of the Connectware brings a few bugfixes in various areas, and a small improvement for the license file at startup, especially for installation without Internet connectivity. Minor bugs have been fixed in OPC UA, S7, HTTP, and the installer script, and the overall stability has been improved. #### Added * License file can be passed to system-control-server by injecting an environment variable (see [Uploading License File into Connectware](/deployment/licensing#setting-up-your-license-using-environment-variables)), especially for installations without Internet connectivity #### Fixed * OPC UA Server: Fix publishing of retained MQTT message * User docs: clarify dot operator in JSONata which gives confusing behavior if input messages are of array type * Fix installer –download-license-file option to be identical to the download from Portal website (NOTE: connectware-online-installer.sh file change) * Set default proxy configuration to empty in installer template (NOTE: connectware-online-installer.sh file change) * S7: minor improvements in error logging on connection timeouts * HTTP: Fix http probe on cleared \_client ## What has changed in 1.0.59? Another maintenance release of the Connectware brings several new features all around the product: Ingress routes can be extended with custom http headers to enable automated log-in at service webpages; Kafka gets more properties; OPC UA can be used with event subscriptions; OPC UA now has PLCOpen node types for S7 servers; Modbus gets more data type byte orders. Also, many bugfixes in the Admin-UI and several protocols have been implemented, increasing overall stability and performance. #### Added * Ingress routes: Add support for adding [http headers](/data-flows/service-commissioning-files/resources/cybus-ingressroute) to ingress routes. Adds support for configuring headers to be added to requests processed by Envoy for Cybus::IngressRoutes. * Kafka: Implemented additional properties at Kafka messages. The [message payload](/connectors/enterprise-connectors/kafka#message-assembly) for the `write` operation of the Kafka protocol was reworked to accept more properties. The main change was that now each MQTT message can hold one or more messages in the payload to be sent to the Kafka Broker. * OPC UA client: Implement OPC UA [event subscriptions](/connectors/shop-floor-connectors/opc-ua/opc-ua-client#events-for-opc-ua). OPC UA endpoints can now be configured to set up event subscriptions instead of normal node (monitored item) subscriptions. This needs the properties eventTypes and and fields to be set. * OPC UA client: Implement PLCOpen node types for OPC UA servers running on SIMATIC S7. Some OPC UA servers running on a S7 PLC contains some nodes which use data types from the PLCOpen nodeset files. This change includes this nodeset files into our code, and also introduces a local type cache which should correctly handle the case when the OPC UA server has nodes with those types instead of running into issued with the standard OPC UA types. * Modbus: Added modbus datatypes floatBEWS and floatLEWS as datatype conversions for word swap float values. #### Fixed * Admin-UI: Fixed issue where connections and other resources would be hidden if they were not from the protocol mapper agent. * Admin-UI: Fixing issue on the Admin UI where one could not consistently disable/delete/enable a cybus resource. * ADS: Fix endpoint deviation behavior on subscription issues. ADS protocol endpoints will now become deviated when a subscription issue an error. * FOCAS: Fixed FOCAS connection on disconnect. Improved connect/disconnect methods with a state variable avoid connecting an already connected protocol or disconnect a disconnected one. * S7: Improve connection tracking for S7 * S7: avoid protocol-mapper crash when attempting invalid reads. Add input validation and slight improvements to response in S7. Improve docs on S7 write operation. * Modbus: Improve disconnection state handling for Modbus. * Modbus: Add extra log for Modbus errors and improve disconnect on endpoint failure. Adds an extra error log in the case the jsmodbus library returns an error stating to check the response body of the request. * Kafka: The kafka protocol Write operation now correctly returns a message on the `/res` topic, indicating either success or an error. * Kafka: Only reset the connection on KafkaJSNumberOfRetriesExceeded exceptions, not on less severe errors. * User docs: Fix error in example for collect rule docs * Installer: Set default proxy configuration to empty to avoid issues on some outdated environments picking up empty string as a value ## What has changed in 1.0.60? This is our next maintenance release with a set of bugfixes, a minor addition in the FOCAS protocol, and improving overall stability and performance. #### Added * FOCAS: Adding new FOCAS methods: cncRdspeed, cncRdspload and cncRdgcode #### Fixed * Admin-UI: Fix missing endpoint display if endpoints are on remote agents * OPC UA server and retained messages: fix typo where an undefined variable was used in the code * OPC UA events: fix typo in example yaml file * OPC UA events: fix eventtype filtering for OPC UA endpoints ## What has changed in 1.0.61? This is a quick maintenance release because in version 1.0.60 the service catalog was unfortunately not working, but is working now again. #### Fixed * Fix broken access to Service Catalog ## What has changed in 1.0.62? This regular weekly Connectware release brings two new features, where the commissioning file now has a new [Cybus::File](/data-flows/service-commissioning-files/resources/cybus-file) resource, and the FOCAS protocol also has the [program\_download](/connectors/shop-floor-connectors/focas) command. Additionally, some minor bugfixes and stability improvements have been added to make working with the Connectware even more powerful and reliable. #### Added * Service resources: Add new [Cybus::File resource type](/data-flows/service-commissioning-files/resources/cybus-file) into commissioning file * FOCAS protocol: implement [program\_download](/connectors/shop-floor-connectors/focas) command (where “download” means loading the file into the PLC). ## What has changed in 1.0.63? This regular maintenance release brings a set of bugfixes to improve overall stability. #### Changed * OPC UA: improve error message if a session cannot be started due to mismatching security mode * Add user documentation of auto-generated [ServiceID](/data-flows/services/serviceid) #### Fixed * Fix [collect](/data-flows/rule-engine/data-processing-rules#collect) rule to use its own storage, not modified by rules later in the chain anymore * Fix broken deviation tracking for service without endpoints, broken since version 1.0.53 * Auth-server: Prevent removing grant type ‘token’ from ‘admin’ user * Admin UI: Fix displaying of error messages * Admin-UI: Fix table bugs on volume overview page * Admin-UI: fix metrics table sorting by date and time * Installer: Fix preflight checks to check for all URLs needed ## What has changed in 1.0.64? * This version has a serious bug with write endpoints, please update to version 1.0.66. Another regular release of the Connectware brings a set of new features: Endpoints for write operations can now enable additional [buffering options](/data-flows/service-commissioning-files/resources/cybus-endpoint#buffering). Agent [registration](/data-flows/agents/registering-agents-in-connectware) has more options for specifying a password. The SQL protocol has more options for connecting to PostgreSQL databases. Additionally, a whole set of bugfixes for rule engine and service handling has been implemented, along with plenty of performance improvements in the Admin-UI. #### Added * Introduce [buffering options](/data-flows/service-commissioning-files/resources/cybus-endpoint#buffering) for endpoints that write to devices * Agent registration: Allow environment variable for specifying a password on the agent, alternatively to storing a randomly generated password in the local docker volume for [agent registration](/data-flows/agents/registering-agents-in-connectware) * Services: Add validation of JSONata expression when enabling a service, to get faster and easier problem reporting on issues with JSONata expressions * Admin-UI: added button for sending usage metrics to portal manually * [SQL protocol](/connectors/enterprise-connectors/sql): Add support for accessing a postgres database over a SSL connection #### Fixed * Services: Fixes retain property not working on Endpoints * Services: Fix missing re-evaluation of `CYBUS_MQTT_ROOT` variable on reconfigure/update of a service * Rule Engine: Create independent stores for each collect rule usage, so that it behaves correctly when used at different stages of a pipeline * Admin-UI: Better displaying errors on Admin UI * Admin-UI: Fix issue when endpoint resources on agents were sometimes not displayed * Admin-UI: Fix overview page of service links to only show services that in fact have links * Admin-UI: Fixing issue where the Admin UI Explorer would temporarily stop working when displaying large messages * Fix bootstrap.sh syntax error that could cause a crash loop of system-control-server on startup ## What has changed in 1.0.65? * This version has a serious bug with write endpoints, please update to version 1.0.66. This next maintenance release of the Connectware brings some more user configuration options, some downloads of metrics data, new response messages also for HTTP POST requests, and plenty of bugfixes in many areas. #### Added * Users: Adding environment variable `CYBUS_ADMIN_USER_ENABLED` which can be switched off to disable the default admin user, see [Default Admin User](/access/user-management/users/default-admin-user) (NOTE: docker-compose.yml file change) * Admin-UI: added download possibility for a usage metrics report * HTTP protocol: Add response message on write endpoints also for the HTTP protocol on [POST requests](/connectors/enterprise-connectors/http-rest#publishing-data-to-a-rest-server). #### Changed * System-control-server: Storage location for some cache data is changed from certs volume to systemControlServerData volume. Old data is copied to new location, and also not removed from old location so going back to older Connectware version is possible. * User docs: Improve FOCAS documentation, especially for [methods](/connectors/shop-floor-connectors/focas#focas-methods) * Update Node.js to 14.18.1 and pkg to 5.4.1 * MQTT: Improve diagnosis of specific error condition when target host refuses connection due to keepAlive=0 parameter, which happens with newer mosquitto servers. * Broker: Removes stunnel process from broker container (that was a proxy for the TLS connection to the auth-server) and replace it with direct connection to auth-server #### Fixed * Admin-UI: Fix missing mqtt topics in explorer from agent, so that Explorer now shows all topics on central and distributed protocol-mapper agents. * Container-manager: Improve stability of microservice initialization on Kubernetes to avoid issues with VRPC connections * Broker: Fix and improve broker startup script * Connection: Fix unneeded persistence of connections during startup phase ## What has changed in 1.0.66? This regular maintenance release brings a set of bugfixes to improve overall stability. In particular, one important bugfix for write endpoint connection loss is included, where the bug is affecting 1.0.64 and 1.0.65 but is fixed in this version. #### Changed * Installer: Use curl in favor of wget and force IPv4 lookup for wget to fix IPv6 issues * Admin-UI: Refactor server and node pages to new code standard. Refactor container-manager display pages to new code standard, fixing table sorting and rows per page issues for these pages #### Fixed * All write endpoints: Fix missing subscribe of response endpoint after state change. This fixes a serious bug in version 1.0.64 and 1.0.65 concerning all write endpoints, which were not re-establishing their connection after a connection loss and re-connect. * Fix [SetContextVars](/data-flows/rule-engine/data-processing-rules#setcontextvars) rule not working properly with context vars and rules * Modbus: Improving stability by fixing one seldom crash due to unhandled error event ## What has changed in 1.0.67? This next weekly maintenance release includes another set of bugfixes in Kafka, Modbus, Rule Engine, and other areas. Also, user documentation has been improved, and Beckhoff/ADS implementation has been rewritten significantly. #### Changed * User documentation improvements: Documenting the input/output format of read and write endpoints for Influxdb, Modbus, MQTT, SQL * ADS re-implementation. This enables the capability of writing/reading complex data types like struct types. * Improve startup synchronization between microservices by letting the dependent ones wait on their dependencies before continuing with startup * OPC UA: improve error logging for MonitoredItem errors * Kafka: Better error reporting by printing topic names in log messages. #### Fixed * Kafka: Fix erroneous extra properties on address object, causing errors on protocol-mapper restarts * Fix changing env-1.0.sh content order that caused subsequent crash loop when downgrading to Connectware version 1.0.64 or older * Modbus: general error handling improvements, in particular fixing an unhandled error event during reconnection, causing the protocol-mapper to crash and restart * Rule Engine: Fix SetContextVars rule not working properly with context vars and rules ## What has changed in 1.0.68? The next Connectware release brings the new feature of [password policy](/access/security/password-policy-configuration) specification, an important bugfix for mapping subscription clean-up and another one for FANUC FOCAS protocol, and user interface improvements such as the display of inter-service dependencies on the service page. Many more bugfixes and changes improve overall stability and reliability even further. #### Added * User password policy: Add [password policy configuration option](/access/security/password-policy-configuration). This feature makes it possible to configure password complexity policy rules in the Connectware using an environment variable called `CYBUS_AUTH_PASSWORD_POLICY_RULES`. Note: As the initial installation also sets an initial password for the default admin user, this initial password can be set by the newly implemented environment variable `CYBUS_INITIAL_ADMIN_USER_PASSWORD`. If this was forgotten and the initial password is rejected due to a stronger password policy, the initial setup will immediately terminate. (NOTE: docker-compose.yml file change) * Admin-UI: Now show inter-service dependencies on service detail page (both: dependsOn and dependent services) and also if enabling/disabling a service will concern other services as well * User docs: Add docs for generating [API tokens](/access/security/json-web-tokens) by the REST interface #### Changed * Admin-UI: adjust metrics table headings for number of messages. Update user documentation of metrics page. * Modbus User docs: Update usage of /res /req /set in modbus docs * Only exit protocol-mapper after several consecutive failed broker authorizations * Further improvements in startup timing for Kubernetes and Docker Compose * Add consistent startup message across services: Adds the message ‘Connectware service bootstrap completed’ to all of our own-implemented services. #### Fixed * Mapping subscription cleanup (high-severity bugfix): Bugfix for exception at subscriptions cleanup with cronTask, introduced in version 1.0.40 and apparently never being noticed. The bug surely causes erroneous double- subscription, but potentially also additional follow-up errors. * FANUC FOCAS protocol (high-severity bugfix): Fix endpoints mix-up when connecting more than one machine. * Broker: Show clear error message at startup on missing file permissions: If the broker container has no write permissions on the file /vernemq/etc/vm.args and the file ends up empty, the VerneMQ process shows a weird error message and is stuck in a crash-restarting-loop. With this change, the broker will still not yet start correctly, but at least show a clear error message. * Kafka: Fix broken KafkaEndpoint stored persistence. The error on storing Kafka endpoints (since 1.0.59) is being detected since 1.0.67 but is now handled even more gracefully by just fixing this particular storage problem, causing the endpoints to load fine again in any case. * Endpoints: Avoid unhandled promise rejection error when an endpoint reference was incorrectly written in the commissioning file * Admin-UI: Fixed container names of core containers being displayed only partially in the container detail pages * Admin-UI: If the default admin user is disabled, it will be no longer shown in the list of users. ## What has changed in 1.0.69? This regular Connectware maintenance release brings a set of bugfixes in the area of service handling, exception handling on C++ libraries, systemstate protocol, and REST endpoint. Also, the user documentation has received some minor updates and overall stability has been improved. #### Fixed * Services (high-severity bugfix): Fix broken vrpc event listener un-registration in services, causing increasing vrpc traffic on every single disable/enable of any service. * Catch unhandled exception error on some C++ protocols if they encounter issues so that this does not crash the protocol-mapper anymore. * User management: Fix error on mqtt topic permissions that did not accept topics with spaces, although these are valid mqtt topics. * User docs: Add recently added protocol names in the user documentation of connection and endpoint * User model: Fix erroneous database transaction implementation on user creation * Systemstate protocol: Fix systemstate signalling of initial resource * Fix missing permissions for new REST endpoint `/api/policy/password` (read-only) * Admin-UI: Fixing an irrelevant error display about the `internal` connection in the connection page ## What has changed in 1.0.70? This next maintenance release includes another set of bugfixes in the Admin UI, in service life cycle management, and various other areas. Also, with some regular component updates and bugfixes the overall stability and performance has been improved. #### Changed * Upgrade node-opcua from 2.50.0 to version 2.62.7 #### Fixed * Admin-UI: Fixed issue on Admin UI where Connection page would never finish loading if the list is empty * Admin-UI: Now correctly hiding the `internal` connection from the list. * Admin-UI: Technical debt reduction for “agents” page. Fixed sorting and pagination issues with UI for agents page * OPC UA: Add log message warning and improve description for missing resourcePath property * Services: Fix container issues after service delete, where on incomplete delete some containers might not be removed, but are removed now. * Protocol-mapper: Increase error message verbosity on protocol-mapper batch create problems with persisted resource parameters * Broker startup: Check for empty configuration file, and error out with a clear message if this situation occurs to avoid unnoticed startup errors * Auth-server: Improve model implementation to use database transactions in a cleaner way, making the code much more robust and reducing technical debt. * Auth-server database: Fix remaining roles and permissions that were left behind on the database when deleting users. * Auth-server: Fix missing routing permission for new REST endpoint /api/policy/password ## What has changed in 1.0.71? This regular Connectware maintenance release improves some issues with service parameters, authentication stability, Beckhoff/ADS protocol implementation, ingress routes, and user documentation clarifications. #### Changed * [ADS protocol](/connectors/shop-floor-connectors/ads): More stability improvements. New properties on AdsConnection to handle connection checking process: routerTcpPort, timeoutDelay. The connectionCheck can be disabled or configured in more detail. localAddress and localPort properties are now explicitly marked as required, because the implementation requires them. * ADS user docs: Clarify endpoint MQTT topics and response messages * Heidenhain: Clarify user docs about endpoints and response message. Also, change `write` endpoints to also return a response message. * Sopas user docs: Clarify write endpoints and response messages * Pfannenberg user docs: Clarify write endpoints and response messages * Admin-UI: Technical debt reduction in deviation handling, simplifying code base. #### Fixed * Services (high-severity bugfix): Fix `Cybus::MqttHost` [global parameter](/data-flows/service-commissioning-files/parameters#global-pre-defined-parameters) value that was broken since version 1.0.67 because the connectware’s internal hostname for the broker (`broker`) is different from what service containers need to use (`connectware`). This change introduces a `CYBUS_MQTT_HOST_FROM_SERVICES` environment variable to configure this differently if needed. (NOTE: docker-compose.yml file change) * Auth-server (high-severity bugfix): Increase authentication stability by using only exactly one instance of the UserModel code, decreasing occurrences of closed auth connections even more * Ingress-controller (high-severity bugfix): Fix broken ingress routes if multiple routes should target the same container host but with different port numbers * Ingress-controller: Fix bug causing multiple updates when there are multiple ingress routes with the same target container host. * Admin-UI: Fixing errors on the Mapping page for services with distributed agents ## What has changed in 1.0.72? This next maintenance release includes another set of bugfixes in the Admin UI, the auth-server performance, and user documentation. Also, the web tokens can now be used for authentication, as needed e.g. for displaying status pages without having to enter a username and password in the browser. #### Added * Admin-UI: When using long-lived [JSON Web Tokens](/access/security/json-web-tokens), the possibility to use this token for authentication was added, see [Browser Authentication](/access/security/json-web-tokens#browser-authentication), where the token is specified by an extra apiToken URL parameter. This authentication can be used for either Admin-UI pages, or to access service containers according to their ingress routes. Both cases can be interesting for displaying status pages without having to enter a username and password in a browser. #### Changed * Auth-server: Further work on optimization of authentication by adding an extra function that is optimized only for this authentication * Admin-UI: For ADS connections, display the Ads routerTcpPort as port number (instead of the uninteresting AMS port number) * Admin-UI: Order items in permission lists for users and roles alphabetically * Auth-server: For custom password policy configuration, improve the handling in client registry procedure by returning a special status code (422) on unsatisfied password complexity, and adapt the remote distributed agent to respond accordingly, so that distributed agents will work with client registry and any password policy. * OPC UA client: Improve error log message on problems with OPC UA type mismatch * BACnet user docs: Extend docs for BACnet read/write * FOCAS user docs: set/res endpoint documentation for the FOCAS protocol. * SINUMERIK user docs: documentation added for set/res endpoints #### Fixed * Admin-UI: Fixed issue where Admin UI’s explorer page would take user to the wrong resource page in the hover-over box on some mqtt topic * Admin-UI: Fixing issue on Admin UI where messages in the Explorer page would not appear ## What has changed in 1.0.73? The weekly maintenance release of the Connectware includes two important high-severity bugfixes, for Mapping and for Kubernetes installations, as well as one new page in the Admin-UI for **Rule Engine Sandbox** and the new feature of MQTT topic prefixes. Additionally, many other areas received some bugfixes and stability improvements. #### Tasks and Features * Admin-UI: Implement **Rule Engine Sandbox** page for live evaluating Rule Engine transformation [expressions](/data-flows/rule-engine/data-processing-rules#expression) * New Feature: The MQTT broker can be configured to add an automatic MQTT topic prefix to incoming published MQTT messages, see [Adding an MQTT Publish Prefix for Users](/access/user-management/mqtt-user-authentication/adding-an-mqtt-publish-prefix), especially suited for high-throughput installations * Admin-UI: Feature request: Save Table View Settings * Auth-server optimization: Optimize User.read() method for Broker auth * User docs: Document result of using /set /res endpoints for protocol MSSQL #### Bugs fixed * Connection handling (high-severity bugfix): Mappings are stopping forwarding messages on certain combinations of disconnect/reconnect events * Postgres on kubernetes (high-severity bugfix): crash loop on startup due to missing permission for chmod, related to PGDATA environment variable. This is fixed with the current Helm chart and this Connectware version * Admin-UI: Wrong message on service deletion confirmation popup * Admin-UI: Password should not be stored after login on the Admin UI * Admin-UI: Error when displaying Service Details Page after installing a new service from a commissioning file * Admin-UI: Service details were not updated when uploading a file for a catalog service * Service validation: Mapping resources should validate rule names and properties * OPC UA Server: Clarify property “alternate hostname” which is needed always (to be renamed soon) * OPC UA client using events: Fix unhandled promise rejection for invalid nodeId in eventType ## What has changed in 1.0.74? This regular bugfix release includes ones important high-severity bugfix concerning the `qos` property in endpoints, another important change for Kubernetes deployment (unrelated to deployments using Docker Compose), and a set of additional bugfix and stability improvements. #### Tasks with minor additions * OPC UA user docs: Clarify [documentation](/connectors/shop-floor-connectors/opc-ua/opc-ua-client#opc-ua-subscriptions) about session, subscription, monitored item groups #### Bugs fixed * Endpoints (high-severity bugfix): `qos` property from commissioning file was unfortunately ignored when creating Endpoints, which is fixed now * Kubernetes deployment (high-severity bugfix): Fix Connectware unable to start due to Postgres mountPath error. This is a breaking change for any Kubernetes Helm chart deployment. However, it does not affect deployments using Docker Compose. * Kubernetes Admin-UI: Fix missing first letter in list of containers in Admin-UI * OPC UA server: Rename `alternateHostname` property to `hostname` to clarify its meaning, adapting the [documentation](/connectors/servers/opc-ua-server) accordingly. The old property name is still accepted for backward compatibility, though. * Services with Docker networks: Detect and log unintended ingress network change * Admin-UI: Minor layout improvements in explorer page for better understanding on first look * HTTP Client: Fix missing renewal of OAuth token that is used over longer time periods ## What has changed in 1.0.75? Our next weekly bugfix release included some bugfix for the `setContextVars` rule in the Rule Engine, some performance improvements for large number of users, and a set of additional bugfix and stability improvements. #### Tasks with minor additions * Broker: Improve handling of message rate peaks (reducing potential message loss) by increasing `max_online_messages` parameter and making it available as configuration option * User documentation: Clarify service [parameter](/data-flows/service-commissioning-files/parameters) array usage (and its limits) * User documentation: Add missing documentation about response codes for Write operations in all protocols, in particular also for using /set /res endpoints for protocol [EtherNet/IP](/connectors/shop-floor-connectors/ethernet-ip) * Auth-server: Improve performance for larger number of users and running services at service-manager #### Bugs fixed * Rule engine (high-severity bugfix for setContextVars rule): Fix erroneously failing verification of setContextVars rule whose var property needs and object, not array. Fix broken setContextVars rule where the variables could not be used in the publish topic. * Workbench: Fix global HTTP proxy settings to be applied in workbench, too * Kubernetes: Extend resource constraints to avoid out-of-memory kills under peak loads * Admin-UI: Fix missing display wrapping of service cards on service catalog page * OPC UA client with [events](/connectors/shop-floor-connectors/opc-ua/opc-ua-client#events-for-opc-ua): Fix erroneously ignored field selection from commissioning file ## What has changed in 1.0.76? This is another weekly maintenance release with a set of bugfixes, some documentation updates, and general maintenance. #### Tasks with minor additions * User documentation: Update documentation for [Certificates screen](/access/security/tls-certificates) * User documentation: Added explanation about the issue with [Docker networks](/data-flows/service-commissioning-files/resources/cybus-container#docker-networks) and alphabetical order of network names. * MQTT Broker: Configuration changed to increase maximum-topic-depth to 20 * Debugging output: Add explicit clientIds to internal MQTT clients to improve debug output readability * Update node.js to 14.19.0, alpine to 3.15 #### Bugs fixed * (High-severity bugfix) Fix MQTT message duplicates that could appear after an internal disconnect/reconnect event, which has been observed seldomly but would be a problem. With this fix, no more duplicates appear. * Admin-UI: Fix slightly confusing message on empty table on “Service Links” page * Kubernetes: Extend resource limits to avoid out-of-memory kills under peak loads * HTTP protocol: The HTTP connection check can now be configured in more detail, see [Connection Properties](/connectors/enterprise-connectors/http-rest#connection-properties). Also, fixed unexpected large number of server connections due to HTTP connection check, if the liveness of the connection has been proven by other activities anyway. #### Features removed * Pfannenberg protocol: The obsolete `pfannenberg` protocol has been removed because it was designed for some special devices which turned out to be out of use for quite some time already ## What has changed in 1.0.77? Our next weekly maintenance release brings a newly designed user management page in the UI, some bugfix for OPC UA Server Historical Access, and a number of further improvements and bugfixes all over the product. #### Tasks completed * Admin-UI user management: New User and Roles Management Screen. The pages for user management, role management, and permission overview were redesigned and re-implemented. This gives a much better overview and better user experience for editing all aspects of users and roles. * Admin-UI user management: Implement the possibility of renaming a user * Admin-UI user management: Hide auto-generated service users and roles in the user management page by default * Admin-UI user management: Enable editing the “Per-User MQTT prefix” (available since 1.0.73) in the user management page #### Bugs fixed * OPC UA Server Historical Access (high-severity bugfix): fixing missing data on Historical Access request * Kubernetes: Change the Postgresql volume’s access mode from ReadWriteOnce to ReadWriteMany (RWX) * Postgresql container shutdown: Fix missing SIGTERM handling to enable graceful shutdown * doc-server shutdown: Fix missing SIGQUIT handling in doc-server to enable graceful shutdown * ADS protocol: Specify existing limit on subscribe interval of approx. 7 minutes * Auth-server: Minor improvements in handling of lost postgresql connection * protocol-mapper startup: Fix potential startup failure where errors were not causing a clean restart * Admin-UI user management: Fix error on assigning grant types in user management pages * User with MQTT prefix: Changed authorization to check MQTT topic permission now with prefix. Note: This might break existing setups which are using “Per-User MQTT prefixes” available since 1.0.73 with very specific permissions, but does not touch any setup that was not yet using this “MQTT prefix” feature. ## What has changed in 1.0.78? This is another weekly maintenance release with a set of bugfixes in OPC UA and Rule Engine, a new feature for HTTP [query parameters](/connectors/enterprise-connectors/http-rest#reading-data-from-a-rest-server), some documentation updates, and general maintenance. #### Tasks completed * HTTP protocol: Added feature to set [query parameters](/connectors/enterprise-connectors/http-rest#reading-data-from-a-rest-server) dynamically from MQTT message * Admin-web-app shutdown: Fix missing SIGQUIT handling in admin-web-app to enable graceful shutdown of container #### Bugs fixed * OPC UA: Fix reconnect handling for many node subscriptions and slow servers that might cause too many requests at the server (high-severity bugfix) * Rule engine: Fix erroneous refusal of service installation when COV rule uses string array as key * ADS protocol: Fix error when receiving an INT64 value * User documentation: HTTP [Connection Probing](/connectors/enterprise-connectors/http-rest#connection-probing) explanation improved ## What has changed in 1.0.79? Note This version 1.0.79 is affected by a bug potentially causing instabilities, hence use version 1.0.81 instead. Our next weekly maintenance release brings a backup/restore function for the user database, an improved version check for distributed agents, several improves user interface pages, some bugfixes for MQTT and HTTP, significant user documentation updates, and improved overall stability. #### Task completed * Implemented new backup and restore function for user/role/permission database * Check connectware version match between protocol-mapper agent and main connectware and refuse startup on mismatch to avoid unexpected malfunction (causing breaking change when trying to use distributed protocol-mapper agents without update) * Admin-UI: Improve “client registry” page * Implement system resource monitoring log messages into the container logs #### Bugs fixed * MQTT protocol, Mappings: Fix extra duplicated messages if there are multiple overlapping wildcard subscriptions * HTTP protocol: Fix missing basic auth (username/password) implementation when accessing other HTTP servers #### User documentation updates * User docs: Explain route and [permission configuration](/access/user-management/access-permissions-for-admin-ui) when users with lesser permissions should still be able to see certain Admin-UI pages * User docs: Update “Explorer” page after recent UI changes * User docs: Update “user management” page after recent UI changes * User docs: Explain the “Setting of environment” steps in a separate section * User docs: Ensure that all sample commissioning files work out of the box ## What has changed in 1.0.80? Note This version 1.0.80 is affected by a bug potentially causing instabilities, hence use version 1.0.81 instead. This next maintenance release brings significant stability improvements on Kubernetes deployments, adds a [HTTP/REST server](/connectors/servers/http-server) for POSTing data to the Connectware, makes the password policy visible when changing password, and brings a set of further bugfixes and stability improvements. #### Task completed * Implemented [HTTP/REST server](/connectors/servers/http-server) to PUT/POST data to the connectware. (Known issue: The Admin-UI frontend does not list a HTTP server resource in the list of “Servers” - to be fixed in the next release.) * Admin-UI: Improved password dialog to show password policy when entering a new password * Admin-UI: Change deviation popups to custom snackbar with link to the list of deviations * Admin-UI: Show uptime column in container views #### Bugs fixed * K8s: Fixing [initial admin password](/access/user-management/users/default-admin-user) issues in Kubernetes/Helm that might be processed wrong if containing special characters. Concerns only deployments using Helm charts using the initial admin password setting: In that case, this is a BREAKING change as the password must now be given in base64 instead of plaintext. * K8s: Fix not being able to install a service initially due to “vrpc timeout” (high-severity bugfix). Fix role permissions so that statefulset can be queried correctly from broker startup scripts. Fix VerneMQ startup scripts to ensure multi-node broker cluster is found correctly. Implement readiness probe in VerneMQ broker pods. * HTTP protocol: Fix HTTP token renewal that did not work for write operations * HTTP protocol: Fix connection state that was shown connected even with wrong authentication credentials * k8s: Fix ServiceCatalog instance, avoiding vrpc timeout error * Admin-UI: Minor fix of explorer page styling #### User documentation updates * User docs: Adapt documentation to clarify which features are not available on k8s but only on Docker Compose * User docs: Improve list of Admin-UI access permissions by automating its generation * Minor swagger docs fix: Fix client registry swagger documentation about returned timestamp ## What has changed in 1.0.81? This maintenance release fixes a bug potentially causing a service-manager crash in high-load scenarios, hence we released just this bugfix release quickly. #### Bugs fixed * (High-severity bugfix) Fix crash in service-manager or other microservices due to missing sanity checking in the CPU/memory monitoring feature. The respective error message in the logs is “SyntaxError: Unexpected token { in JSON”, causing a restart of the respective container. The bug affects versions 1.0.79 and 1.0.80 but is fixed now. * S7: Fix writing boolean value “false” which was failing ## What has changed in 1.0.82? Our next weekly maintenance release brings a set of bugfixes in the Admin-UI, some internal updates now using Node.js 16, and overall stability improvements. #### Bugs fixed * Admin-UI: Add missing Cybus::Server::Http resource in server list in the frontend * Admin-UI: Fix button on service update form to not be enabled when it should not * K8s: Adapt service manager so that commissioning files with unavailable k8s features give a clear error message #### Tasks completed * Upgrade to NodeJS 16 ## What has changed in 1.0.83? Note This version 1.0.83 is affected by a bug preventing deviation tracking after multiple service enabling, hence use version 1.0.85 instead. This next regular release brings new features in the [Kafka](/connectors/enterprise-connectors/kafka) protocol connector, as well as an important bugfix and change about unifying the service and resource persistence. Additionally, a minor bug in the COV rule has been fixed and overall stability has been improved. #### Tasks completed * Kafka protocol: Implementing [Kafka consumer](/connectors/enterprise-connectors/kafka) (i.e. receiving data) #### Bugs fixed * Service persistence: Unifying service and resource persistence by moving this information from separate protocol-mapper volume(s) to everything in service-manager. Now all persistence information about services and resources is stored in one common place, namely in the service-manager volume and not any longer in any protocol-mapper volume. The protocol-mapper volume is now not used anymore. Upon upgrade, all change happens automatically and no action needs to be taken. * Rule Engine: The [Change-of-Value (COV) rule](/data-flows/rule-engine/data-processing-rules#cov) in its `keys` property now also accepts integer values in addition to strings. ## What has changed in 1.0.84? Note This version 1.0.84 is affected by a bug preventing deviation tracking after multiple service enabling, hence use version 1.0.85 instead. Our next maintenance release brings improvements in the Admin UI, in HTTP connections, and also some important bugfixes in Mappings and for Kubernetes deployments. #### Tasks completed * HttpConnection: Added option for dynamically [setting the path](/connectors/enterprise-connectors/http-rest#dynamic-path) in HTTP/REST read endpoints * Admin-UI: Add UI for database backup and restore * Admin-UI: Add Mqtt Publish Prefix documentation link on User Management forms * Admin-UI: Improve dialog screen when license cannot be validated * HTTP Server: Cleanup of remaining issues: additional content-type, timestamp, documentation clarification * OPC UA client: Filter incoming OPC UA Events by EventType * User docs: Clarify usage of Agents, in particular also handling of connection loss * Auth-server performance: Optimize the MQTT subscription authorization #### Bugs fixed * (High-severity bugfix) Fix failing Mapping subscriptions when overlapping wildcard topics exist. This bug affects versions 1.0.79 until 1.0.83 and could lead to Mappings not receiving data if topics with wildcards exist in overlapping ways. This can only be avoided by taking into account multiple duplicate messages in that situation, as [explained here](/connectors/enterprise-connectors/mqtt#duplicates-on-overlapping-subscriptions). * Auth-server: Fixing crash when /users/batch POST request is sent with duplicated username * Sopas protocol: Reduce log verbosity by correctly setting non-debug log level * Kubernetes: Fix usage metrics collection that was broken on multi-node broker cluster * Kubernetes: Fix initial connection failures of agents, causing errors about not being able to create resources on agent ## What has changed in 1.0.85? This next release brings a small but important bug fix that solves issues with resources deviation tracking, affecting versions 1.0.83 and 1.0.84. #### Bugs fixed * Fix deviation tracking that was broken on subsequent enabling of services (affecting 1.0.83, 1.0.84) ## What has changed in 1.0.86? Note This version 1.0.86 has the new `input buffering` feature enabled by default and for all endpoints, which can lead to changed behavior and unexpected message drop with certain Rule Engine rules (especially the `burst` rule), hence use version 1.0.87 instead where this feature is disabled by default. Our next maintenance release brings an important bugfix in protocol-mapper for high data rates, some improvements in Rules, Mapping, and Kubernetes orchestration, and overall bugfix and stability increases. #### Bugs fixed * Protocol Mapper (high-severity bugfix): Fix out-of-memory exception on high data load by introducing a controlled `input buffering` behavior for [endpoints](/data-flows/service-commissioning-files/resources/cybus-endpoint#inputbuffering), [mappings](/data-flows/service-commissioning-files/resources/cybus-mapping#inputbuffering), and [nodes](/data-flows/service-commissioning-files/resources/cybus-node#inputbuffering). This change introduces new properties on those three resources, most importantly `inputBuffering.maxInputBufferSize` (default: 5000). This value describes the maximum message burst size that can be received and are waiting to be processed, before messages have to be dropped. The value is set individually on each endpoint, mapping, or node resource. If message are being dropped, there will be a warning log message `Dropped \Connectware 0.x - 1.0
## What has changed from 0.x to 1.0? This section describes the general changes in the Cybus Connectware version 1.0.0 compared to the previous 0.x versions. #### Services and Resources The most important change is that everything is done in a [service](/data-flows/services) and described as [resources](/data-flows/services/service-resources-view). * The previous distinction between service commissioning file and device commissioning file has been removed. Both files are replaced by one single [commissioning file](/data-flows/service-commissioning-files) for services, similar to AWS cloud formation files, still in the well-known yaml file format. This enables “infrastructure as code” on a whole new level. * The new service commissioning file describes the complete system context as a set of [resources](/data-flows/services/service-resources-view). Resources can be devices, Docker containers (both customized by the customer or standard containers by Cybus), connections, data transformations, and more. * Describing connections to devices in device commissioning files has been replaced by describing [connection resources](/data-flows/service-commissioning-files/resources/cybus-connection) inside the service commissioning files. This change enables the following new features: * Service life cycle can be managed and observed explicitly: A service changes states from disabled to enabling to [enabled](/data-flows/services/managing/enabling) and [vice versa](/data-flows/services/managing/disabling). * If not all resources inside a service are available or working properly, a [deviation](/data-flows/services/deviations) for this service between expected state and actual state is shown and the service is marked as `deviated`, leading the user directly to the cause of the problem in order to fix it quickly * Resources can reference each other not only within one commissioning file and within one service, but also across different services using the [service id](/data-flows/services/serviceid). The complete system context can hence be described by one or multiple commissioning files, whatever fits best for the application. * When defining a container resource for the service, parameters such as port mappings can be specified with defaults from the commissioning files, but can also manually be entered when the commissioning file is [installed](/data-flows/services/managing/installing) into the Connectware * When writing commissioning files with multiple entries, several helper functions exist to avoid code duplications in the resources’ [properties](/data-flows/service-commissioning-files/resources): `ref` uses the value from somewhere else by reference; `sub` will substitute values from somewhere else as a string replacement; `merge` will merge a set of common parameter values with additional given specific values such as concrete addresses. #### User Interface * Each service is displayed in the admin user interface (web interface) with an overview and detail view. In the [detail view](/data-flows/services/service-details-view), the resources that are used within this service are all shown. Every of those resources can be clicked on to jump to the details view of those resources (such as connections, containers, endpoints). Alternatively, for every resource kind there exists an overview list from which one can go to the detail view of that resource, too. * The admin user interface includes an [Explorer](/monitoring/data-explorer) page which enables browsing through all MQTT topics by topic structure, showing the data as received from the machine endpoints or as prepared by the service mappings to semantic structures, both according to the configuration from the service commissioning file. #### Distributed Agents * Setup of distributed agents is much easier: Distributed systems can be set up very easily every time new machines and data sources should be connectedConnectware sits between your shop floor and your IT applications, providing a single Unified Namespace for both
| Connectors | Browse connectors for your machines: OPC UA, Modbus, S7, and many more. Each page includes configuration examples. | /files/6F1b8PMOWhgyRRkaylrt | /pages/4Ad8cZXYYeKev7ILps1e |
| Service Commissioning Files | Build your own service with the complete reference covering every resource type and property. | /files/JQap0TsVsV8NtZ3eb6OJ | /pages/UbQg7pMD0S82fqEDnYe0 |
| Monitoring | Use the Data Explorer and Live Data tab to verify that data flows correctly and monitor your connections. | /files/Nsc34MNv8OAxOOX0WVHQ | /pages/0lD2MMAsH2LJbiUzlDRQ |
| User Management | Create accounts, assign roles, and restrict access with role-based access control. | /files/WGm3YxI3dVq3opNNwCCx | /pages/CNdoMnGUqQRARZehYqfv |
| Agents | Deploy agents to bridge isolated networks when machines cannot reach Connectware directly. | /files/eV6rAxPqNrJOKXbJvb1b | /pages/LFR2Vq44wTTNj1J3QarJ |
• Advanced orchestration
• Automated deployment management
• For high-demand environments
• Comprehensive monitoring
• Automated scaling
• Robust service management
• Low infrastructure requirements
• For development environments
• For basic deployment needs
1. Migrating the values.yaml File
Download the skill below and run it with a [tool supporting the Agent Skills format](https://agentskills.io/clients) against your existing `values.yaml` file to automate the key renames and moves. The better the model's reasoning, the more reliable the output. {% hint style="warning" %} Always review the output before applying it. {% endhint %} {% file src="/files/L4Ek8LBTw3K0FSVQqdYp" %} The skill covers `values.yaml` key changes; work through the items in the next step for everything else.2. Before Running helm upgrade
* **Recreate the image pull secret if you used a different value for `global.registryUser` than `license`.** Create a pull secret manually and reference it through `global.image.pullSecrets`, or pods will fail with `ImagePullBackOff`. See [A1. License Values Changes](#a1.-license-values-changes). * **Verify customized security contexts after migration.** Overrides replace chart defaults and do not merge — the migrated output may be missing defaults. See [A3. Security Contexts](#a3.-security-contexts) and [B3. Security Contexts](#b3.-security-contexts). * **Decide whether to keep the previous resource defaults.** If your `values.yaml` does not set resource requests and limits, the new lower defaults apply after the upgrade. See [A8. Resources Moved to Per-Component](#a8.-resources-moved-to-per-component) and [B7. Resource Defaults](#b7.-resource-defaults). * **Set `authServer.replicas: 1` if you want the old single-replica behavior.** The default changed from `1` to `2`. See [A10. Auth-Server Default Replicas](#a10.-auth-server-default-replicas). * **Detect cluster resource renames for `connectware-agent` installations with affected names.** If your release is named `connectware`, or combined release-plus-agent names exceed 52 characters, run `helm diff upgrade` first. See [B8. Cluster Resource Name Changes](#b8.-cluster-resource-name-changes). * **Re-add TCP ports for `Cybus::IngressRoute` resources.** The ingress LoadBalancer Service no longer exposes ports `40000` to `40009` by default. If you have `Cybus::IngressRoute` resources of type `tcp`, add their `connectwarePort` to `connectwareIngress.service.ports` or they become unreachable. See [A13. Ingress Service Ports for TCP IngressRoutes](#a13.-ingress-service-ports-for-tcp-ingressroutes). * **Review the Container Manager RBAC change if your cluster restricts RBAC manifests.** The chart replaces the `pod-manager` Role with a `connectware-${INSTALLATION_NAME}-pod-reader` Role that only grants `get`, `list`, and `watch` on `pods` and `pods/log`, and binds a dedicated ServiceAccount instead of the namespace `default` ServiceAccount. If your cluster requires approval for changes to Roles, RoleBindings, or ServiceAccounts, share the diff with the team that approves RBAC manifests before running `helm upgrade`.3. Running helm upgrade
Follow the [Upgrade Procedure](#upgrade-procedure) to run `helm upgrade`. Then continue to the next step for post-upgrade actions.4. After Running helm upgrade
None of these items require changes to `values.yaml`. * **Update external selectors that reference the `app` label.** The label changed from `app=Overview of Mandatory Migration Steps
`connectware` chart steps: 1. [**License Keys**](#a1.-license-values-changes) 2. [**Image Version**](#a2.-image-version) 3. [**Security Contexts**](#a3.-security-contexts) 4. [**Storage to Persistence**](#a4.-storage-to-persistence) 5. [**User Management to Authentication**](#a5.-user-management-to-authentication) 6. [**Other Global Value Changes**](#a6.-other-global-value-changes) 7. [**Components Moved Out of global**](#a7.-components-moved-out-of-global) 8. [**Resources Moved to Per-Component**](#a8.-resources-moved-to-per-component) 9. [**CybusMQ Broker Value Changes**](#a9.-cybusmq-broker-value-changes) 10. [**Auth-Server Default Replicas**](#a10.-auth-server-default-replicas) 11. [**Reserved MFA Environment Variables**](#a11.-reserved-mfa-environment-variables) 12. [**Workload Label Rename**](#a12.-workload-label-rename) 13. [**Ingress Service Ports for TCP IngressRoutes**](#a13.-ingress-service-ports-for-tcp-ingressroutes) 14. [**NATS Metrics Path Change**](#a14.-nats-metrics-path-change) `connectware-agent` chart steps: 1. [**Protocol-Mapper Agents Structure**](#b1.-protocol-mapper-agents-structure) 2. [**Image Version**](#b2.-image-version) 3. [**Security Contexts**](#b3.-security-contexts) 4. [**Storage to Persistence**](#b4.-storage-to-persistence) 5. [**TLS CA Configuration Renames**](#b5.-tls-ca-configuration-renames) 6. [**Reserved Environment Variables**](#b6.-reserved-environment-variables) 7. [**Resource Defaults**](#b7.-resource-defaults) 8. [**Cluster Resource Name Changes**](#b8.-cluster-resource-name-changes)Updating the License Values
* Delete `global.registryUser`. If you authenticated against the image registry with a custom user, create a pull secret manually and reference it via `global.image.pullSecrets`. See [Configuring Registries and Pull Secrets](/cybus-helm-charts/working-with-cybus-helm-charts/registries-and-pull-secrets). * Rename `global.licensekey` to `global.licenseKey` (capital K). * If `global.licenseFile` is set to `online`, change it to `""` (empty string) or remove it. Real license file bodies used for offline installations remain unchanged. If you do not have this key in your `values.yaml`, you do not need to add it. **Before** {% code lineNumbers="true" %} ```yaml global: registryUser: license licensekey: xxxxxxxxxx licenseFile: online ``` {% endcode %} **After** {% code lineNumbers="true" %} ```yaml global: licenseKey: 'xxxxxxxxxx' licenseFile: '' ``` {% endcode %}Renaming the Image Key
* Rename `global.image.version` to `global.image.tag`. **Before** {% code lineNumbers="true" %} ```yaml global: image: version: 2.3.0 ``` {% endcode %} **After** {% code lineNumbers="true" %} ```yaml global: image: tag: '2.3.0' ``` {% endcode %}1. Pod and Container Security Context Renames
Both keys are available as a global default under `global.*` and as a per-component override. The per-component value takes precedence over the global one. * `securityContext` → `podSecurityContextOverride` * `containerSecurityContext` → `containerSecurityContextOverride` This applies to `global.*` and every component.2. Chart 3.0.0 Defaults to Merge Into Your Override
For your reference, these are the default security contexts our Helm charts apply. If you have customized a security context, merge your customization with these defaults and set them in the respective `podSecurityContextOverride` or `containerSecurityContextOverride`. You will find examples in the next steps. If you never customized a security context, delete any security context block from your `values.yaml` file and the defaults will apply. **Default pod security context** {% code lineNumbers="true" %} ```yaml runAsNonRoot: true seccompProfile: type: RuntimeDefault fsGroup: 1000 ``` {% endcode %} **Default container security context** {% code lineNumbers="true" %} ```yaml allowPrivilegeEscalation: false capabilities: drop: - ALL ``` {% endcode %}3. Merge Example (Pod Security Context)
This example adds `runAsUser: 1000` on top of the defaults. **Before** {% code lineNumbers="true" %} ```yaml global: securityContext: runAsUser: 1000 ``` {% endcode %} **After (defaults merged with your value)** {% code lineNumbers="true" %} ```yaml global: podSecurityContextOverride: runAsNonRoot: true seccompProfile: type: RuntimeDefault fsGroup: 1000 runAsUser: 1000 ``` {% endcode %}4. Merge Example (Container Security Context)
This example sets the container to run as a specific user ID (`runAsUser: 1000`) on top of the defaults. **Before** {% code lineNumbers="true" %} ```yaml broker: containerSecurityContext: runAsUser: 1000 ``` {% endcode %} **After (defaults merged with your value)** {% code lineNumbers="true" %} ```yaml broker: containerSecurityContextOverride: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsUser: 1000 ``` {% endcode %}5. Dropping Exact-Default Blocks
The former defaults and the 3.0.0 defaults listed above are identical. If your source security context block matches them exactly, drop the block entirely instead of emitting an override. The 3.0.0 defaults already cover it.Renaming Storage Keys
| Old | New | | -------------------------------------------------------------------------------- | ------------------------------------------ | | `global.storage` | `global.persistence` | | `Migrating Authentication Values
* Rename `global.userManagement.adminUser` to `global.authentication.adminUser`. * Change `adminUser.enabled` from the string `"true"` or `"false"` to the boolean `true` or `false`. * Change `adminUser.initialPassword` from base64 or the sentinel `"automatic"` to plain text. Decode any base64 value. Replace `"automatic"` with an empty string `""` to auto-generate a password. * Rename `global.userManagement.passwordPolicyRules` to `global.authentication.passwordPolicyRules`. * Delete `global.authentication.mTLS` if present. mTLS has been auto-enabled for several Connectware versions and the value no longer has any effect. **Before** {% code lineNumbers="true" %} ```yaml global: userManagement: adminUser: enabled: 'true' initialPassword: Y2hhbmdlbWU= passwordPolicyRules: 'default' authentication: mTLS: enabled: false ``` {% endcode %} **After** {% code lineNumbers="true" %} ```yaml global: authentication: adminUser: enabled: true initialPassword: 'changeme' passwordPolicyRules: 'default' ``` {% endcode %}Removing, Replacing, and Renaming Global Values
* Delete `global.setImmutableLabels`. Labels on immutable objects are now always set. * If you use MetalLB, replace `global.loadBalancer.metalLB.addressPoolName` with an annotation on `connectwareIngress.service.annotations` as explained in the [MetalLB documentation](https://metallb.io/usage/#requesting-specific-ips). You can then remove the `global.loadBalancer` section. * Rename `global.ingressDnsNames` to `global.ingressDNSNames` (uppercase DNS). **Before** {% code lineNumbers="true" %} ```yaml global: setImmutableLabels: true loadBalancer: metalLB: addressPoolName: my-pool ingressDnsNames: - connectware.example.com ``` {% endcode %} **After** {% code lineNumbers="true" %} ```yaml global: ingressDNSNames: - connectware.example.com connectwareIngress: service: annotations: metallb.universe.tf/address-pool: my-pool ``` {% endcode %}Moving Component Blocks to the Top Level
Move every `global.1. Moving Resources to Each Component
Drop `global.podResources.*` and put `resources:` directly on each component. Watch the alias keys: `connectware`, `controlServer`, `database`, and `distributedProtocolMapper` do not match their target component names. | Old Path | New Path | | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `global.podResources.2. Default Request Changes
The table below lists the default CPU and memory requests for each component in chart 2.4.0 and chart 3.0.0. Most components have lower defaults in chart 3.0.0. However, lower defaults do not mean Connectware requires fewer resources. The chart reduces defaults to make it easier to get started on smaller clusters. Use actual resource consumption data to set values that match your workload before going to production. Chart 3.0.0 also removes default limits. Running without limits is not recommended, since it allows workloads to starve others on the same cluster. See the [Kubernetes documentation on resource requests and limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for guidance on setting appropriate values. If you are unsure where to start, see [Right-Sizing Kubernetes Resources for Connectware](/guides/operations/right-sizing-kubernetes-resources). | Component | Old (cpu/mem) | New (cpu/mem) | | ------------------------ | -------------- | -------------- | | `adminWebApp` | 100m / 50Mi | 50m / 50Mi | | `authServer` | 1500m / 1000Mi | 1000m / 500Mi | | `broker` | 2000m / 3000Mi | 600m / 1000Mi | | `connectwareIngress` | 1000m / 500Mi | 400m / 250Mi | | `containerManager` | 250m / 200Mi | 150m / 200Mi | | `ingressController` | 100m / 100Mi | 150m / 100Mi | | `nats` | 2000m / 2000Mi | 500m / 750Mi | | `postgresql` | 2000m / 2000Mi | 500m / 750Mi | | `protocolMapper` | 2000m / 2000Mi | 1000m / 1000Mi | | `resourceStatusTracking` | 1000m / 1000Mi | 250m / 500Mi | | `serviceManager` | 1000m / 1000Mi | 1000m / 500Mi | | `systemControlServer` | 200m / 200Mi | 300m / 200Mi | | `topicExplorer` | 200m / 750Mi | 200m / 500Mi | | `workbench` | 200m / 400Mi | 150m / 200Mi |Updating CybusMQ Broker Values
* Rename `replicaCount` to `replicas`. * Rename `messageQueueSize` to `onlineMessageQueueSize`. * Convert `allowRegisterDuringClusterFormation`, `allowPublishDuringClusterFormation`, `allowSubscribeDuringClusterFormation`, and `allowUnsubscribeDuringClusterFormation` from the strings `"on"` or `"off"` to the booleans `true` or `false`. * Replace the `clusterSecret` placeholder `Setting the Old Replica Count
If your `values.yaml` file does not set `authServer.replicas`, the new default applies after the upgrade. To keep the old behavior, set the replica count explicitly: {% code lineNumbers="true" %} ```yaml authServer: replicas: 1 ``` {% endcode %}Migrating MFA Environment Variables to Helm Values
If you previously set `CYBUS_MFA_ISSUER` or `CYBUS_MFA_LABEL` through `authServer.env`, remove them from the `env` list and set the equivalent Helm values instead. | Environment Variable | Helm Value | | -------------------- | ---------------------------------- | | `CYBUS_MFA_ISSUER` | `global.authentication.mfa.issuer` | | `CYBUS_MFA_LABEL` | `global.authentication.mfa.label` | **Before** {% code lineNumbers="true" %} ```yaml authServer: env: - name: CYBUS_MFA_ISSUER value: 'Acme Corp' - name: CYBUS_MFA_LABEL value: 'Connectware' - name: SOME_OTHER_ENV value: '5' ``` {% endcode %} **After** {% code lineNumbers="true" %} ```yaml global: authentication: mfa: issuer: 'Acme Corp' label: 'Connectware' authServer: env: - name: SOME_OTHER_ENV value: '5' ``` {% endcode %}Updating External Workload Selectors
No changes to your `values.yaml` file are required. The upgrade works without action. If you have external tooling that selects Connectware workloads through the old label, update the selector. Common examples: * `kubectl` commands using `-l app=Adding TCP Ports for IngressRoutes
If you do not use `Cybus::IngressRoute` resources of type `tcp`, no action is required. If you do, add an entry to `connectwareIngress.service.ports` for every `connectwarePort` your TCP IngressRoutes use. Ports between `40000` and `40100` are valid. {% code lineNumbers="true" %} ```yaml connectwareIngress: service: ports: - name: 'generic-tcp-40001' port: 40001 targetPort: 40001 - name: 'generic-tcp-40002' port: 40002 targetPort: 40002 ``` {% endcode %} {% hint style="warning" %} The list under `connectwareIngress.service.ports` fully replaces the default Service ports. When adding entries, keep the default Connectware ports from the chart's `values.yaml` and append your TCP ports, otherwise the Admin UI, MQTT, and other core entry points become unreachable. {% endhint %}Moving NATS Metrics Keys
If you configured NATS metrics, move every key from `global.nats.metrics.prometheus.*` up one level to `nats.metrics.*`. The `global.nats` → `nats` move from [A7. Components Moved Out of global](#a7.-components-moved-out-of-global) applies here as well. | Old | New | | ------------------------------------------------- | ------------------------------- | | `global.nats.metrics.prometheus.enabled` | `nats.metrics.enabled` | | `global.nats.metrics.prometheus.resources` | `nats.metrics.resources` | | `global.nats.metrics.prometheus.serviceMonitor.*` | `nats.metrics.serviceMonitor.*` | **Before** {% code lineNumbers="true" %} ```yaml global: nats: metrics: prometheus: enabled: true resources: requests: cpu: 100m memory: 300Mi serviceMonitor: enabled: true labels: release: prometheus ``` {% endcode %} **After** {% code lineNumbers="true" %} ```yaml nats: metrics: enabled: true resources: requests: cpu: 100m memory: 300Mi serviceMonitor: enabled: true labels: release: prometheus ``` {% endcode %}Renaming the Image Key
* Rename `image.version` to `image.tag`. **Before** {% code lineNumbers="true" %} ```yaml protocolMapperAgents: - name: welder-robots image: version: 2.3.1 ``` {% endcode %} **After** {% code lineNumbers="true" %} ```yaml protocolMapperAgents: - name: welder-robots image: tag: 2.3.1 ``` {% endcode %}Helm Values to Use Instead
The following table shows how to control these environment variables with the `connectware-agent` Helm chart. | Environment Variable | Helm Value | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `CYBUS_AGENT_MODE` | Always set to "distributed", do not set manually | | `CYBUS_AGENT_NAME` | `protocolMapperAgents[*].name` | | `CYBUS_HOSTNAME_INGRESS` | `protocolMapperAgents[*].connectwareHost` or `protocolMapperAgentDefaults.connectwareHost` | | `CYBUS_PROTOCOL_MAPPER_PASSWORD` | Read from key `agentPassword` in the existing Kubernetes Secret configured in `protocolMapperAgents[*].existingAgentPasswordSecret` or `protocolMapperAgentDefaults.existingAgentPasswordSecret` | | `CYBUS_USE_MUTUAL_TLS` | `protocolMapperAgents[*].mTLS.enabled` | | `CYBUS_DATAPLANE_HOST` | `protocolMapperAgents[*].dataPlane.host`, `protocolMapperAgentDefaults.dataPlane.host`, `protocolMapperAgents[*].connectwareHost` or `protocolMapperAgentDefaults.connectwareHost` | | `CYBUS_DATAPLANE_PORT` | Computed or overridden with `protocolMapperAgents[*].dataPlane.port` or `protocolMapperAgentDefaults.dataPlane.port` | | `CYBUS_DATAPLANE_SCHEME` | Computed, do not set manually | | `CYBUS_DATAPLANE_USE_TLS` | Computed or overridden with `protocolMapperAgents[*].dataPlane.tls` or `protocolMapperAgentDefaults.dataPlane.tls` | | `CYBUS_STREAMSERVER_HOST` | `protocolMapperAgents[*].streamServer.host`, `protocolMapperAgentDefaults.streamServer.host`, `protocolMapperAgents[*].connectwareHost` or `protocolMapperAgentDefaults.connectwareHost` | | `CYBUS_STREAMSERVER_PORT` | Computed or overridden with `protocolMapperAgents[*].streamServer.port` or `protocolMapperAgentDefaults.streamServer.port` | | `CYBUS_STREAMSERVER_SCHEME` | Computed, do not set manually |Before (chart 2.1.0 values)
{% code title="values.yaml (2.1.0)" lineNumbers="true" expandable="true" %} ```yaml global: licensekey: xxxxxxxxxx image: registry: registry.cybus.io/cybus/ pullSecrets: - name: my-pull-secret pullPolicy: Always version: 2.3.0 userManagement: adminUser: initialPassword: Y2hhbmdlbWU= ingress: service: annotations: service.beta.kubernetes.io/load-balancer-scheme: 'internet-facing' ingressDnsNames: - connectware.example.com authServer: replicas: 1 broker: clusterSecret: xxxxxxxxxxxxxxxxx replicaCount: 3 postgresql: storage: storageClassName: block-storage nats: replicas: 3 ``` {% endcode %}After (chart 3.0.0 values)
{% code title="values.yaml (3.0.0)" lineNumbers="true" expandable="true" %} ```yaml global: licenseKey: 'xxxxxxxxxx' image: registry: registry.cybus.io/cybus/ pullSecrets: - name: my-pull-secret pullPolicy: Always tag: '2.3.0' authentication: adminUser: initialPassword: 'changeme' ingressDNSNames: - connectware.example.com authServer: replicas: 1 connectwareIngress: service: annotations: service.beta.kubernetes.io/load-balancer-scheme: 'internet-facing' broker: clusterSecret: 'xxxxxxxxxxxxxxxxx' replicas: 3 postgresql: persistence: storageClassName: block-storage nats: replicas: 3 ``` {% endcode %}Re-Registering Protocol-Mapper Agents
This applies if you moved agents from `global.protocolMapperAgents` to `connectwareAgent.protocolMapperAgents` in [B1](#b1.-protocol-mapper-agents-structure). After the Helm upgrade, Connectware still holds the old agent identities — one user entry in [Users View](/access/user-management/users#users-view) and one entry in the [Agents View](/data-flows/agents/agents-view) per agent. The new agent pods start up with fresh credentials and attempt to register, but the old entries block them. You must clean up the old entries first, then authorize the new registrations. Repeat the following steps for each migrated agent: 1. In the Admin UI, [delete the user](/access/user-management/users#deleting-users) whose name matches the agent. This clears the old credentials so the new agent can register under the same name. 2. In the [Agents View](/data-flows/agents/agents-view), select the old agent and click **Delete** to remove it from the list. 3. The agent pod registers automatically after the old entries are removed. In the Admin UI, open the [Client Registry](/access/client-registry) and authorize the pending registration for each agent. Check the agent name and pairing ID to confirm you are authorizing the correct agent. 4. Confirm each agent comes back online in **System** > **System Status** > **Agents**.Reviewing Resource Requests
If you did not set explicit resource values in [A8](#a8.-resources-moved-to-per-component) or [B7](#b7.-resource-defaults), your workloads now run with the chart 3.0.0 defaults: reduced CPU and memory requests with no limits set. Monitor resource usage and set explicit values on affected components if you observe throttling or eviction.Updating the Network Ports
Verify that your firewalls and security rules are updated to allow the new ports (TCP/4222 and TCP/4223) and to remove dependencies on the deprecated ones (TCP/1884 and TCP/8884). This ensures uninterrupted connectivity between your agents and Connectware.Updating the Hardware Setup
We recommend adding the following resources to your hardware setup: * **12** CPU cores * **11** GB of memory * **52** Gi of storage However, these are general guidelines. Check what your specific system needs and make adjustments accordingly. If you were using the `control-plane-broker` option, you can offset these additional requirements with the resources it used, since it is being removed in this upgrade.Adjusting Kubernetes Resource Requests and Limits for Core Microservices
The microservices `postgresql`, `auth-server`, `nats`, and `resource-status-tracking` now have new or revised Kubernetes resource requests and limits. Make sure to adapt the default values to match your deployment needs. We recommend beginning with the defaults, monitoring performance metrics, and fine-tuning resource allocations as needed. * To adjust the default values, update the corresponding values in the `global.podResources` Helm value context. **Example** ```yaml global: podResources: nats: limits: cpu: 2000m memory: 2000Mi requests: cpu: 2000m memory: 2000Mi resourceStatusTracking: limits: cpu: 1000m memory: 1000Mi requests: cpu: 1000m memory: 1000Mi database: limits: cpu: 2000m memory: 2000Mi requests: cpu: 2000m memory: 2000Mi authServer: limits: cpu: 1500m memory: 1000Mi requests: cpu: 1500m memory: 1000Mi ```Mandatory Upgrade Steps
These steps apply to every Connectware installation upgrading to Connectware 2.0.0. For a detailed guide, see [Mandatory Upgrade Steps](#mandatory-upgrade-steps). {% hint style="warning" %} Depending on your setup, you may also need to perform additional Conditional Steps. {% endhint %} 1. [**TLS Changes**](#id-1.-tls-changes): Default behavior on certificate validation has been adjusted. 2. [**Update Helm Values**](#id-2.-update-helm-values): Remove obsolete Helm values and adjust for changed and new values. 3. [**Preparing the Connectware Helm Upgrade**](#id-3.-preparing-the-connectware-helm-upgrade): Prepare removal of control-plane-broker and remove PostgreSQL StatefulSet. 4. [**Upgrading to Connectware 2.0.0**](#id-4.-upgrading-to-connectware-2.0.0): Download and install Connectware 2.0.0. 5. [**Enabling Agents in the Connectware Helm Chart**](#id-5.-enabling-agents-in-the-connectware-helm-chart): After upgrading Connectware, you need to go back to your agents to enable their TLS connections. 6. [**Updating Helm Values for the Connectware Agent Helm Chart**](#id-6.-updating-helm-values-for-the-connectware-agent-helm-chart): Update your agent configuration to comply with the updated Helm value configuration. 7. [**Upgrading Agents for the Connectware Agent Helm Chart**](#id-7.-upgrading-agents-for-the-connectware-agent-helm-chart): Upgrade your agents with the `connectware-agent` Helm chart. 8. [**Reinstalling Services**](#id-8.-reinstalling-services): This upgrade changes where your services are stored. You will need to reinstall any services after the upgrade.Feature-Specific Upgrade Steps
Only follow these if you use the related features, so they continue working after the upgrade. 1. [**Roles and Permissions**](#id-1.-permissions-and-roles): New permissions were added to Connectware. Verify your custom roles, if they require updates. 2. [**Custom Connectors**](#id-2.-custom-connectors): Update your customer connector configurations to meet new requirements. 3. [**Systemstate Protocol**](#id-3.-systemstate-protocol): Update your Systemstate protocol configurations to meet new requirements. 4. [**Log Monitoring**](#id-4.-log-monitoring): Some logging strings are changed. If you use log monitoring, you may need to update it. 5. [**Heidenhain Agents**](#id-5.-heidenhain-agents-windows): Upgrade your Heidenhain agents. 6. [**Auto-Generated MQTT Topics of Resources**](#id-6.-auto-generated-mqtt-topics-of-resources): Topic generation no longer includes resource-specific properties. Update your service commissioning files if you relied on old patterns. 7. [**Auto-Generated MQTT Users**](#id-7.-auto-generated-mqtt-users): The behavior of how MQTT users are auto-generated has changed. You may need to update your service commissioning file if you relied on auto-generated MQTT users.1. Introducing the cybus_combined_ca.crt
Connectware maintains two separate CA chains: * External certificates validated by `cybus_ca.crt`. * Internal certificates validated by `shared_yearly_ca.crt`. Which CA an agent requires depends on the hostname through which it connects to Connectware. For example, through the Connectware ingress, or directly to the Control Streaming Server (NATS) through the internal network. To simplify configuration, we introduced `cybus_combined_ca.crt`, a bundle containing both chains, so agents can use a single file without needing to distinguish between internal and external CA certificates.2. Certificate Chain Verification in Agents
Agents now enforce TLS chain validation by default. Each agent requires access to `cybus_combined_ca.crt`, available on the `certs` volume. * To revert to the previous behavior (skipping verification), set the environment variable `CYBUS_TRUST_ALL_CERTS` to `true`. Note that it has been renamed from `TRUST_ALL_CERTS`.3. Configuring Certificate Hostnames
The default Connectware-generated CA includes the hostnames `localhost` and `connectware`. * To add more hostnames, configure the Helm value `global.ingressDNSNames`.4. Renewal of Certificate Chains
With 2.0.0, the internal CA chain is replaced: * Certificate Authority renamed from `CybusCA` to `CybusInternalCA`. * The hostname `nats` is added as a Subject Alternate Name (SAN) to `shared_yearly_server.crt`. The built-in default external CA certificate chain is also replaced. * The hostname `connectware` is added as a SAN to `cybus_server.crt`. If you rely on monitoring, custom setups, or modified certificates, adapt your configuration accordingly.5. Replacing CA Certificate Chain
To replace Connectware’s default external chain with your enterprise-managed CA: * Replace `cybus_ca.crt` with your enterprise CA certificate. * Ensure `cybus_server.crt` and `cybus_server.key` form a valid key pair, signed by the CA in `cybus_ca.crt`. Do not replace the internal CA (`shared_yearly_ca.crt`). After replacement: 1. Restart the `system-control-server` deployment to rebuild and synchronize the combined CA bundle (`cybus_combined_ca.crt`): {% code lineNumbers="true" %} ```bash kubectl -n ${NAMESPACE} rollout restart deployment system-control-server ``` {% endcode %} 2. Restart all Connectware services.Removing Obsolete Helm Values
Some [Helm values](/reference/helm-chart-reference) are obsolete and have been removed. Remove the following Helm values from your `values.yaml` file for the `connectware` Helm chart: * `global.rpcTimeout` * `global.adminWebApp.rpcTimeout` * `global.containerManager.rpcTimeout` * `global.protocolMapper.rpcTimeout` * `global.systemControlServer.rpcTimeout` * `global.serviceManager.rpcTimeout` * `global.serviceManager.storage` * `global.controlPlaneBroker` * `global.protocolMapperAgents[*].controlPlane` * `global.serviceManager.useServicesGraph`1. Ingress DNS Name Configuration
With the changes TLS behavior in Connectware, it has become essential to add the DNS names under which Connectware is addressed, for example by agents. If you are replacing Connectware's default PKI, you can, and likely have managed this yourself by providing a valid `cybus_server.crt` containing all Subject Alternate Names (SANs) used within your setup. If you are using Connectware's default PKI, you can use the new Helm value `global.ingressDNSNames`, which is a list of names that will be added to the default `cybus_server.crt`. #### Hostname Formats You can include multiple hostnames in the list. The certificate will include all specified names in its SAN section. The configuration accepts various hostname formats: * Wildcards (e.g., `*.company.io`) * Subdomains (e.g., `connectware.company.io`) * Custom hostnames (e.g., `localhost`) * IP Addresses (e.g. 192.168.100.42) **Example** {% code lineNumbers="true" %} ```yaml global: ingressDNSNames: - company.io - localhost - *.company.io - connectware.company.io - 192.168.100.42 ``` {% endcode %}2. Proxy Configuration
Connectware's proxy configuration has been improved with version 2.0. Accompanying this, we added Helm values to configure proxy usage. This means that you cannot configure proxy usage directly through environment variables. If you have been doing this in the past, transfer your configuration to these new Helm values: | **New Helm Value** | **Type** | **Default Values** | **Purpose** | | ----------------------------- | -------- | ------------------ | ----------------------------------------------------------------------------------------------------- | | `global.proxy.url` | string | \3. NATS Configuration
Connectware 2.0.0 introduces NATS as the stream server, primarily used for inter-service communication. The key configuration parameter is `global.nats.replicas`, which defines the cluster size. Typical values are `3` or `5`, with `3` as the default. Increasing this to `5` raises the redundancy level from N+1 to N+2. {% hint style="warning" %} The replicas value is critical for the NATS cluster configuration and is shared across multiple Connectware components. This value can only be set during the initial installation of Connectware and cannot be modified later. Scaling operations on the `nats` StatefulSet must not be performed. {% endhint %} The following configuration values are available for the NATS streaming server: | **New Helm Value** | **Type** | **Default Values** | **Purpose** | | --------------------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------- | | `global.nats.replicas` | integer | 3 | The number of NATS replicas | | `global.nats.podAntiAffinity` | string | soft | The podAntiAffinity behavior for NATS (one of `none`, `soft`, `hard`) | | `global.nats.podAntiAffinityTopologyKey` | string | kubernetes.io/hostname | The podAntiAffinityTopologyKey for NATS (one of `none`, `soft`, `hard`) | | `global.nats.labels` | object | \4. Resource-Status-Tracking Configuration
In addition to the new stream server, Connectware introduces a second new component called `resource-status-tracking`. This component allows you to monitor the status of resources created through service commissioning files and enables you to detect deviations in service behavior. The following configuration values are available for `resource-status-tracking`: | **New Helm Value** | **Type** | **Default Values** | **Purpose** | | ---------------------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------- | | `global.resourceStatusTracking.replicas` | integer | 2 | The number of resource-status-tracking replicas | | `global.resourceStatusTracking.podAntiAffinity` | string | soft | The podAntiAffinity behavior for resourceStatusTracking (one of "none", "soft", "hard") | | `global.resourceStatusTracking.podAntiAffinityTopologyKey` | string | kubernetes.io/hostname | The podAntiAffinityTopologyKey for resourceStatusTracking (one of "none", "soft", "hard") | | `global.resourceStatusTracking.labels` | object | \5. PostgreSQL Storage Size
In previous releases, the storage volume of the PostgreSQL component was fixed at 1 Gi. With Connectware 2.0.0, the reliance on PostgreSQL has increased, resulting in a new default storage size of 5 Gi. This parameter is now configurable. We recommend to allocate at least 5 Gi. For larger deployments, storage sizes of 20 Gi or more may be appropriate. You can configure the storage size via the `global.postgresql.storage.size` Helm value: {% code lineNumbers="true" %} ```yaml global: postgresql: storage: size: 10Gi ``` {% endcode %}6. Enabling MQTTS for Protocol-Mapper Agents
A new Helm value is available to configure whether a protocol-mapper agent establishes its data plane connection to the Connectware MQTT broker using TLS. | **New Helm Value** | **Type** | **Default Values** | **Purpose** | | ---------------------------------------------- | -------- | ------------------ | ----------------------------------------------------------- | | `global.protocolMapperAgents[*].dataPlane.tls` | boolean | false | Enable TLS encryption for agent's MQTT data plan connection | {% code lineNumbers="true" %} ```yaml global: protocolMapperAgents: - name: welder-robots dataPlane: tls: true ``` {% endcode %}7. Disabling Agents During the Connectware Upgrade
{% hint style="warning" %} This step prepares agents orchestrated with the `connectware` Helm chart for disabling during the upgrade. Agents orchestrated by other methods must be shut down separately, as described in [7. Shutting Down Protocol-Mapper Agents](#id-4.-upgrading-to-connectware-2.0.0). {% endhint %} To prevent agents from requiring re-registration after the upgrade, you must disable them during the installation. Once the upgrade is complete, you will re-enable the agents, update their configuration, and provide them with a valid CA certificate. * To disable the agents defined in your Connectware Helm chart, set the Helm value `global.protocolMapperAgents` and all related values within this context to disabled. You can do this either by commenting out each line with a `#` or by temporarily removing them from the file.1. Removing the Control-Plane-Broker
The `control-plane-broker` is deprecated and its associated StatefulSet is no longer used. It will not be started anymore after the upgrade. * No action is required in your Helm installation. * Optional: Remove `global.controlPlaneBroker` from the `connectware` chart and `controlPlaneBrokerEnabled` from the `connectware-agent` chart. * The `brokerdata-control-plane-broker-*` and `brokerlog-control-plane-broker-*` PersistentVolumeClaims are not removed automatically. Delete them manually if you want to reclaim the storage.2. Backing Up Your PostgreSQL Database
With Connectware 2.0.0, Connectware uses a new major version of PostgreSQL. You need to delete your `postgresql` volume before upgrading Connectware (this is covered later in this upgrade guide). This requires you to create a backup of your database and restore this after the upgrade. {% hint style="warning" %} Any modifications done to Connectware after the following database backup will be lost after the Connectware 2.0.0 upgrade. We recommend to create the backup right before upgrading to Connectware 2.0.0. {% endhint %} 1. To create a backup of your database, run the following command. {% code lineNumbers="true" %} ```bash kubectl exec -n ${NAMESPACE} postgresql-0 -- \ bash -c "pg_dump -U cybus-admin --if-exists -c cybus_connectware" \ > connectware_database.sql ``` {% endcode %} 2. Make sure the backup is successful, then store the database file in a secure location.3. Service-Manager Volume Backup & Removal
The `service-manager` PersistentVolumeClaim (PVC) is deprecated and will be removed automatically during the upgrade to 2.0.0. Depending on your ReclaimPolicy, this may or may not mean that the volume is being deleted too. If it is not automatically deleted, you will have to manually delete the volume previously associated with the `service-manager` PersistentVolumeClaim to free up the disk space. The former contents will in the future be stored in the PostgreSQL database, but will not be automatically migrated. You will need to reinstall any services you used before. See [Reinstalling Services](#12-reinstalling-services). If you do not have your services stored outside of Connectware, make sure to export your services, or create a backup of your `service-manager` volume before upgrading.1. Updating Helm Repository Cache
Before performing the upgrade, update the Helm repository cache to ensure the latest Connectware chart version is available. * Run the following command: {% code lineNumbers="true" %} ```bash helm repo update ``` {% endcode %}2. Reviewing the Connectware Changelog
Before upgrading to Connectware 2.0.0, review the [changelog](/changelog#what-has-changed-in-200) to familiarize yourself with new features, bug fixes, and other changes introduced in Connectware 2.0.0.3. Reviewing the Readme File
Before upgrading to Connectware 2.0.0, review the readme file. The readme may contain important version-specific upgrade instructions. * To open the readme file, run the following command: {% code lineNumbers="true" %} ```bash helm show readme ${REPO_NAME}/connectware --version <2.0.0> ``` {% endcode %}4. Comparing Helm Configurations between Connectware Versions
With a new Connectware version, there might be changes to the default Helm configuration values. We recommend that you compare the default Helms values of your current Connectware version with the default Helm values of your target Connectware version. * To display the new default values, enter the following command: {% code lineNumbers="true" %} ```bash helm show values ${REPO_NAME}/connectware --version <2.0.0> ``` {% endcode %} * To display which Connectware default values have changed between your current version and your target version, enter the following command: {% code lineNumbers="true" %} ```yaml diff <(helm show values ${REPO_NAME}/connectware --version5. Adjusting Helm Values
When you have reviewed the necessary information, adjust your configuration in your `values.yaml` file. Not every upgrade requires adjustments. If you specified which image version of Connectware to use by setting the Helm value `global.image.version` you will need to update this to `6. Verifying your Backups
Make sure that you store backups of your setup. This allows you to restore a previous state if necessary. Your backups must consist of the following files: * All Kubernetes PersistentVolumes that Connectware uses * Your Connectware database * Your `values.yaml` file * All service commissioning files Depending on your local infrastructure, it may be necessary to back up additional files.7. Shutting Down Protocol-Mapper Agents
{% hint style="warning" %} In this step, you need to shut down any agents currently connected to your Connectware instance that are **not** managed by the `connectware` chart. Agents orchestrated through the `connectware` chart have already been prepared for shutdown as part of [7. Disabling Agents During the Connectware Upgrade](#id-2.-update-helm-values). {% endhint %} Before running the `helm upgrade` command, you must stop all connected agents. Agents which remain up during this upgrade run the risk of having to go through the agent registration process again. * **Docker Run**: To stop agents which were started using `docker run`, use the `docker stop` command. If you are not aware of the name these containers use, run the `docker ps` command to find out. * **Docker Compose**: If your agents are running in Docker Compose, use the `docker compose down` command to stop them. * **Agent Helm Chart**: You can shut down agents that have been installed via the `connectware-agent` Helm chart using this command: {% code lineNumbers="true" %} ```bash kubectl get -n ${NAMESPACE} sts -lapp.kubernetes.io/component=protocol-mapper-agent -o name | xargs -I % kubectl scale -n ${NAMESPACE} % --replicas 0 ``` {% endcode %}8. Removing the PostgreSQL StatefulSet
* Before running the `helm upgrade` command, you must remove the `postgresql` StatefulSet: {% code lineNumbers="true" %} ```bash kubectl -n ${NAMESPACE} delete sts postgresql ``` {% endcode %}9. Initial Connectware Upgrade
You can now start the first of two upgrade processes. This first upgrade run applies the new Connectware 2.0.0 workloads and prepares the system for the required database migration. * To upgrade Connectware, enter the following command: {% code lineNumbers="true" %} ```bash helm upgrade -n ${NAMESPACE} ${INSTALLATION_NAME} ${REPO_NAME}/connectware --version <2.0.0> -f10. Shutting Down Connectware
* Wait for the `system-control-server` deployment to contain a ready pod, then shut down Connectware to restore your PostgreSQL database: {% code lineNumbers="true" %} ```bash kubectl get -n ${NAMESPACE} deploy,sts -lapp.kubernetes.io/part-of=connectware -o name | xargs -I % kubectl scale -n ${NAMESPACE} % --replicas 0 ``` {% endcode %}11. Restoring the PostgreSQL Database
1. Note down the Persistent Volume name for your `postgresql-postgresql-0` PersistentVolumeClaim. You will need this name later to make sure the volume is not recycled. {% code lineNumbers="true" %} ```bash kubectl get -n ${NAMESPACE} pvc -o jsonpath='{.spec.volumeName}{"\n"}' postgresql-postgresql-0 ``` {% endcode %} 2. Remove the `postgresql-postgresql-0` PersistentVolumeClaim: {% code lineNumbers="true" %} ```bash kubectl -n ${NAMESPACE} delete pvc postgresql-postgresql-0 ``` {% endcode %} 3. Remove the PostgreSQL PersistentVolume. You can skip this step if the volume has been automatically deleted through a reclaim policy, or if you are sure a new volume will be used. If the same volume is reused for postgresql, the upgrade will fail. {% code lineNumbers="true" %} ```bash kubectl delete pv [persistent-volume-name-from-previous-step] ``` {% endcode %} 4. Start PostgreSQL: {% code lineNumbers="true" %} ```bash kubectl -n ${NAMESPACE} scale sts postgresql --replicas=1 ``` {% endcode %} 5. Restore your PostgreSQL Database. Wait for the postgresql-0 pod to become ready, then run: {% code lineNumbers="true" %} ```bash cat connectware_database.sql | kubectl exec -n ${NAMESPACE} postgresql-0 \ -i -- psql -U cybus-admin -d cybus_connectware ``` {% endcode %}12. Final Connectware Upgrade after Database Restore
You can start the final upgrade process. This upgrade finalizes the process by starting Connectware with the restored PostgreSQL database. * To upgrade Connectware, enter the following command: {% code lineNumbers="true" %} ```bash helm upgrade -n ${NAMESPACE} ${INSTALLATION_NAME} ${REPO_NAME}/connectware --version <2.0.0> -f13. Verifying the Connectware Upgrade
You can monitor the Connectware upgrade progress to verify that everything runs smoothly, to know when the installation is successful, or to investigate potential issues. #### Monitoring the Connectware Upgrade The Connectware upgrade can take a few minutes. To monitor the upgrade process, do one of the following: * To monitor the current status of the upgrade process, enter the following command: {% code lineNumbers="true" %} ```bash kubectl get pods -n ${NAMESPACE} ``` {% endcode %} * To monitor the continuous progress of the upgrade process, enter the following command: {% code lineNumbers="true" %} ```bash while [ True ]; do clear; kubectl get pod -n ${NAMESPACE}; sleep 5; done ``` {% endcode %} * To stop monitoring the continuous progress of the upgrade process , press Ctrl+C. #### Pod Stages During the Connectware Upgrade During the Connectware upgrade, the pods go through the following stages: * Terminating * Pending * PodInitializing * ContainerCreating * Init:x/x * Running When pods reach the STATUS Running, they go through their individual startup before reporting as Ready. To be fully functional, all pods must reach the STATUS Running and report all their containers as ready. This is indicated by them showing the same number on both sides of the / in the column READY. **Example** {% code lineNumbers="true" %} ```bash kubectl get pod -n ${NAMESPACE} ``` {% endcode %} | NAME | READY | STATUS | RESTARTS | AGE | | -------------------------------------- | ----- | ------- | -------- | ----- | | admin-web-app-7cd8ccfbc5-bvnzx | 1/1 | Running | 0 | 3h44m | | auth-server-5b8c899958-f9nl4 | 1/1 | Running | 0 | 3m3s | | broker-0 | 1/1 | Running | 0 | 3h44m | | broker-1 | 1/1 | Running | 0 | 2m1s | | connectware-7784b5f4c5-g8krn | 1/1 | Running | 0 | 21s | | container-manager-558d9c4cbf-m82bz | 1/1 | Running | 0 | 3h44m | | doc-server-55c77d4d4c-nwq5f | 1/1 | Running | 0 | 3h44m | | ingress-controller-6bcf66495c-l5dpk | 1/1 | Running | 0 | 18s | | postgresql-0 | 1/1 | Running | 0 | 3h44m | | protocol-mapper-67cfc6c848-qqtx9 | 1/1 | Running | 0 | 3h44m | | service-manager-f68ccb767-cftps | 1/1 | Running | 0 | 3h44m | | system-control-server-58f47c69bf-plzt5 | 1/1 | Running | 0 | 3h44m | | workbench-5c69654659-qwhgc | 1/1 | Running | 0 | 15s | At this point Connectware is upgraded and started. You can now make additional configurations or verify the upgrade status in the Admin UI.Overview of Certificate Behavior
| CA certificate | Value of `CYBUS_TRUST_ALL_CERTS` | Behavior | Log message during control connection | | -------------- | -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | Not Configured | false | **Default**: TLS connections, like the control connection to Connectware, will try to use the system trust store to do certificate validation. This will only work when the CAs being used in Connectware are signed by a well-known CA authority or when self-signed CAs were added to the system trust store. | CA certificate not found, using system trusted CAs for NATS connection. | | Not Configured | true | TLS connections, like the control connection to Connectware, will not validate certificates and will trust all certificates. | CA certificate not found, Connectware configured for trusting all certificates for NATS connection | | Configured | true | TLS connections, like the control connection to Connectware, will not validate server certificates and will trust any cert. | CA certificate found, but trusting all certificates for NATS connection | | Configured | false | **Recommended**: TLS connections, like the control connection to Connectware, will validate server certificates and will not trust any cert. | CA certificate found, using it for NATS connection with CA verification |1. Updating the Helm Values
You must update the Helm values of your `connectware` installation again to re-enable agents by removing the "#" you added, or adding them to the Helm values file again. Then add the `cybus_combined_ca.crt` or set `CYBUS_TRUST_ALL_CERTS` to `true`. If you were directly targeting our MQTT broker or control-plane-broker before, you should also move the respective configuration to their new replacements. The following Helm values have changed. If you had specific configuration for these in the past, update the Helm values accordingly. For some Helm values, you need to take additional steps depending on your setup. The required steps are covered in the following sections. | **Old Helm Value** | **New Helm Value** | **Required Change** | | --------------------------------------------------------------- | --------------------------------------------------------- | ------------------------------------------------- | | `global.protocolMapperAgents[*].mTLS.caChain.cert` | `global.protocolMapperAgents[*].tls.ca.certChain` | Move | | `global.protocolMapperAgents[*].mTLS.caChain.existingConfigMap` | `global.protocolMapperAgents[*].tls.ca.existingConfigMap` | Move | | `global.protocolMapperAgents[*].mqttDataHost` | `global.protocolMapperAgents[*].dataPlane.host` | See **1.1 - Directly Targeting MQTT Broker** | | `global.protocolMapperAgents[*].mqttDataPort` | `global.protocolMapperAgents[*].dataPlane.port` | See **1.1 - Directly Targeting MQTT Broker** | | `global.protocolMapperAgents[*].mqttHost` | `global.protocolMapperAgents[*].streamServer.host` | See **1.2 - Directly Targeting Streaming Server** | | `global.protocolMapperAgents[*].mqttPort` | `global.protocolMapperAgents[*].streamServer.port` | See **1.2 - Directly Targeting Streaming Server** |1.1 - Directly Targeting MQTT Broker
When deploying agents in the internal network of Connectware, they are able to directly connect to our MQTT broker instead of going through the Connectware ingress. This improves performance and reduces failure points, so if you are running a heavy, critical load, it may be worth the extra configuration. The major hindrance is, that the name "broker", which is used by our MQTT broker on the internal network, is not part of the `cybus_server.crt` by default. In order to connect agents with a TLS connection to this hostname, you either need to add the hostname "broker" as a Subject Alternate Name (SAN) to the certificate, or set `CYBUS_TRUST_ALL_CERTS=true` for the agent. **Adding the Hostname to the Default Certificate** If you are using the built-in default certificate for Connectware, you can add the hostname "broker" through the Helm value `global.ingressDNSNames`: {% code lineNumbers="true" %} ```yaml global: ingressDNSNames: - broker ``` {% endcode %} It is easiest if you add this Helm value before running your upgrade to Connectware 2.0.0, since activating it will automatically be covered by the upgrade guide. If applying this configuration after already upgrading to Connectware 2.0.0, running `helm upgrade` on your Connectware installation will cause the `system-control-server` Deployment to restart. Once it is ready again, restart the `broker` StatefulSet: {% code lineNumbers="true" %} ```bash kubectl rollout restart broker -n ${NAMESPACE} ``` {% endcode %} **Configuring Your Agents to Target the MQTT Broker** Next you need to configure your agents to target the MQTT broker directly by using the `protocolMapperAgents[*].dataPlane.host` Helm value: {% code lineNumbers="true" %} ```yaml global: protocolMapperAgents: - name: welder-robots dataPlane: host: broker - name: bender-robots dataPlane: host: broker ``` {% endcode %} The TCP port used for this connection is automatically determined by other configuration like TLS and mTLS settings, however, if for some reason you need to override this, use the Helm value `protocolMapperAgents[*].dataPlane.port`.1.2 - Directly Targeting Control Connection Streaming Server
When deploying agents in the internal network of Connectware, they are able to directly connect to our streaming server control plane instead of going through the Connectware ingress. This improves performance and reduces failure points, so if you are running a heavy, critical load, it may be worth the extra configuration. **Configuring Your Agents to Target the Streaming Server** Next you need to configure your agents to target the streaming server directly by using the `protocolMapperAgents[*].streamServer.host` Helm value. The default internal name is "nats". {% code lineNumbers="true" %} ```yaml global: protocolMapperAgents: - name: welder-robots streamServer: host: nats - name: bender-robots streamServer: host: nats ``` {% endcode %} The TCP port used for this connection is automatically determined by other configuration like mTLS settings, however, if for some reason you need to override this, use the Helm value `protocolMapperAgents[*].streamServer.port`.2. Adding the CA Certificate to Your Agent
You will need to have the CA certificate you want to add at hand, in this example we will assume, that you are using the `cybus_combined_ca.crt`: **1. Copy `cybus_combined_ca.crt` from Connectware:** {% code lineNumbers="true" %} ```bash kubectl cp -n [your namespace] postgresql-0:/connectware_certs/cybus_combined_ca.crt cybus_combined_ca.crt ``` {% endcode %} **2. Add `cybus_combined_ca.crt` to Agent Helm Values:** Add the CA certificate to the Helm values of every agent in your `connectware` installation: {% code lineNumbers="true" %} ```yaml global: protocolMapperAgents: - name: welder-robots tls: ca: certChain: | -----BEGIN CERTIFICATE----- MIIFpTCCA40CFEQKP621lWyKwv/7bZGbYEoxrLGdMA0GCSqGSIb3DQEBCwUAMIGN [skipped lines] tTa2qvRLD2J9Eh1KXZ//8IhLc+lIjZsqoPTnhZ7QXZCGwLFdOTEL15mbrgmJOiz/ lB0RUj8zolJa -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIGATCCA+mgAwIBAgIUCdqCz7EzCbalj4n7qbxZFxi3XdAwDQYJKoZIhvcNAQEL [skipped lines] ja2TMCBzQSaGyUoLs6Sm2hDD/Y5E6z56Dh7oKQPkoCWjc3+ShF4ilBO9cpyHY0dP CcN5u+A= -----END CERTIFICATE----- - name: bender-robots tls: ca: certChain: | -----BEGIN CERTIFICATE----- MIIFpTCCA40CFEQKP621lWyKwv/7bZGbYEoxrLGdMA0GCSqGSIb3DQEBCwUAMIGN [skipped lines] tTa2qvRLD2J9Eh1KXZ//8IhLc+lIjZsqoPTnhZ7QXZCGwLFdOTEL15mbrgmJOiz/ lB0RUj8zolJa -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIGATCCA+mgAwIBAgIUCdqCz7EzCbalj4n7qbxZFxi3XdAwDQYJKoZIhvcNAQEL [skipped lines] ja2TMCBzQSaGyUoLs6Sm2hDD/Y5E6z56Dh7oKQPkoCWjc3+ShF4ilBO9cpyHY0dP CcN5u+A= -----END CERTIFICATE----- ``` {% endcode %} Alternatively you can add it using an existing Kubernetes ConfigMap: {% code lineNumbers="true" %} ```bash kubectl create -n ${NAMESPACE} configmap my-connectware-ca --from-file cybus_combined_ca.crt ``` {% endcode %} {% code lineNumbers="true" %} ```yaml global: protocolMapperAgents: - name: welder-robots tls: ca: existingConfigMap: my-connectware-ca - name: bender-robots tls: ca: existingConfigMap: my-connectware-ca ``` {% endcode %}3. (Alternative) Disable TLS Certificate Validation
As an alternative you can disable TLS certificate validation for agents. This of course has negative impact on security of your TLS connections, allowing for Man-in-the-middle attacks, but this may be acceptable for development instances or test installations. {% hint style="info" %} This is only possible with agents using the username/password authentication method. If you are using mTLS for your agents, you need to care for a proper certificate setup. {% endhint %} {% code lineNumbers="true" %} ```yaml global: protocolMapperAgents: - name: welder-robots env: - name: CYBUS_TRUST_ALL_CERTS value: 'true' - name: bender-robots env: - name: CYBUS_TRUST_ALL_CERTS value: 'true' ``` {% endcode %}4. Run Helm Upgrade Again
After choosing and configuring your method of choice, you can run `helm upgrade` on your `connectware` installation again. * To upgrade Connectware, enter the following command: {% code lineNumbers="true" %} ```bash helm upgrade -n ${NAMESPACE} ${INSTALLATION_NAME} ${REPO_NAME}/connectware --version <2.0.0> -f1. Updating the Helm Values
**Obsolete Helm Values (Connectware-Agent Chart)** Some [Helm values](/reference/helm-chart-reference) are obsolete and have been removed. Remove the following Helm values from your `values.yaml` file for the `connectware` Helm chart: * `protocolMapperAgentDefaults.controlPlaneBrokerEnabled` * `protocolMapperAgents[*].controlPlaneBrokerEnabled` * `protocolMapperAgentDefaults.controlPlane` * `protocolMapperAgents[*].controlPlane` * `protocolMapperAgentDefaults.rpcTimeout` * `protocolMapperAgents[*].rpcTimeout` **Changed Helm Values (Connectware-Agent Chart)** The following Helm values have changed. If you had specific configuration for these in the past, update the Helm values accordingly. For some Helm values, you need to take additional steps depending on your setup. The required steps are covered in the following sections. | **Old Helm Value** | **New Helm Value** | **Required Change** | | ------------------------------------------------------------ | ------------------------------------------------------ | ------------------------------------------------- | | `protocolMapperAgentDefaults.mTLS.caChain.cert` | `protocolMapperAgentDefaults.tls.ca.certChain` | Move | | `protocolMapperAgentDefaults.mTLS.caChain.existingConfigMap` | `protocolMapperAgentDefaults.tls.ca.existingConfigMap` | Move | | `protocolMapperAgents[*].mqtt.tls` | `protocolMapperAgents[*].dataPlane.tls` | Move | | `protocolMapperAgents[*].mqtt.dataHost` | `protocolMapperAgents[*].dataPlane.host` | See **1.1 - Directly Targeting MQTT Broker** | | `protocolMapperAgents[*].mqtt.dataPort` | `protocolMapperAgents[*].dataPlane.port` | See **1.1 - Directly Targeting MQTT Broker** | | `protocolMapperAgents[*].mqtt.controlHost` | `protocolMapperAgents[*].streamServer.host` | See **1.2 - Directly Targeting Streaming Server** | | `protocolMapperAgents[*].mqtt.controlPort` | `protocolMapperAgents[*].streamServer.port` | See **1.2 - Directly Targeting Streaming Server** |1.1 - Directly Targeting MQTT Broker
When deploying agents in the internal network of Connectware, they are able to directly connect to our MQTT broker instead of going through the Connectware ingress. This improves performance and reduces failure points, so if you are running a heavy, critical load, it may be worth the extra configuration. The major hindrance is, that the name "broker", which is used by our MQTT broker on the internal network, is not part of the `cybus_server.crt` by default. In order to connect agents with a TLS connection to this hostname, you either need to add the hostname "broker" as a Subject Alternate Name (SAN) to the certificate, or set `CYBUS_TRUST_ALL_CERTS=true` for the agent. **Adding the Hostname to the Default Certificate** If you are using the built-in default certificate for Connectware, you can add the hostname "broker" through the Helm value `global.ingressDNSNames`: {% code lineNumbers="true" %} ```yaml global: ingressDNSNames: - broker ``` {% endcode %} It is easiest if you add this Helm value before running your upgrade to Connectware 2.0.0, since activating it will automatically be covered by the upgrade guide. If applying this configuration after already upgrading to Connectware 2.0.0, running `helm upgrade` on your Connectware installation will cause the `system-control-server` Deployment to restart. Once it is ready again, restart the `broker` StatefulSet: {% code lineNumbers="true" %} ```bash kubectl rollout restart broker -n ${NAMESPACE} ``` {% endcode %} **Configuring Your Agents to Target the MQTT Broker** Next you need to configure your agents to target the MQTT broker directly by using the `protocolMapperAgentDefaults.dataPlane.host` Helm value: {% code lineNumbers="true" %} ```yaml protocolMapperAgentDefaults: dataPlane: host: broker ``` {% endcode %} The TCP port used for this connection is automatically determined by other configuration like TLS and mTLS settings, however, if for some reason you need to override this, use the Helm value `protocolMapperAgentDefaults.dataPlane.port`.1.2 - Directly Targeting Streaming Server
When deploying agents in the internal network of Connectware, they are able to directly connect to our streaming server control plane instead of going through the Connectware ingress. This improves performance and reduces failure points, so if you are running a heavy, critical load, it may be worth the extra configuration. **Configuring Your Agents to Target the Streaming Server** Next you need to configure your agents to target the streaming server directly by using the `protocolMapperAgentDefaults.streamServer.host` Helm value. The default internal name is "nats". {% code lineNumbers="true" %} ```yaml protocolMapperAgentDefaults: streamServer: host: nats ``` {% endcode %} The TCP port used for this connection is automatically determined by other configuration like mTLS settings, however, if for some reason you need to override this, use the Helm value `protocolMapperAgentDefaults.streamServer.port`.2. Adding the CA Certificate to Your Agent
To connect a protocol-mapper agent with Connectware 2.0.0, you must either provide the agent with the valid CA certificate for the server certificate in use, or disable verification of TLS certificate validity by setting the environment variable `CYBUS_TRUST_ALL_CERTS` to `true` on the agent. Depending on the fact if you are connecting an agent through Connectware's ingress or through the internal network, you may need to provide either `cybus_ca.crt` or `shared_yearly_ca.crt`, but if you want to skip this complexity, there is a new file called `cybus_combined_ca.crt`, which includes both CA bundles, allowing internal and external connections. The following examples use the method of configuring all agents inside one `connectware-agent` installation through the `protocolMapperAgentDefaults` Helm value context. However, you can also configure this using the `protocolMapperAgents` Helm value context as described in [Configuration Principles for the connectware-agent Helm Chart](/cybus-helm-charts/connectware-agent-helm-chart#configuration-principles-for-the-connectware-agent-helm-chart). You need to have the CA certificate that you want to add at hand. In this example, we assume that you are using the `cybus_combined_ca.crt`: 1. Copy `cybus_combined_ca.crt` from Connectware: {% code lineNumbers="true" %} ```bash kubectl cp -n [your namespace] postgresql-0:/connectware_certs/cybus_combined_ca.crt cybus_combined_ca.crt ``` {% endcode %} 2. Add the CA certificate `cybus_combined_ca.crt` to the Helm values of your `connectware-agent` installation: {% code lineNumbers="true" %} ```yaml protocolMapperAgentDefaults: tls: ca: certChain: | -----BEGIN CERTIFICATE----- MIIFpTCCA40CFEQKP621lWyKwv/7bZGbYEoxrLGdMA0GCSqGSIb3DQEBCwUAMIGN [skipped lines] tTa2qvRLD2J9Eh1KXZ//8IhLc+lIjZsqoPTnhZ7QXZCGwLFdOTEL15mbrgmJOiz/ lB0RUj8zolJa -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIGATCCA+mgAwIBAgIUCdqCz7EzCbalj4n7qbxZFxi3XdAwDQYJKoZIhvcNAQEL [skipped lines] ja2TMCBzQSaGyUoLs6Sm2hDD/Y5E6z56Dh7oKQPkoCWjc3+ShF4ilBO9cpyHY0dP CcN5u+A= -----END CERTIFICATE----- ``` {% endcode %} Alternatively, you can add it using an existing Kubernetes ConfigMap: {% code lineNumbers="true" %} ```bash kubectl create -n ${NAMESPACE} configmap my-connectware-ca --from-file cybus_combined_ca.crt ``` {% endcode %} {% code lineNumbers="true" %} ```yaml protocolMapperAgentDefaults: tls: ca: existingConfigMap: my-connectware-ca ``` {% endcode %}3. (Alternative) Disable TLS Certificate Validation
You can choose to disable TLS certificate validation for agents. This is **not recommended**, as it weakens security and makes your setup vulnerable to man-in-the-middle attacks. However, it may be acceptable in non-production environments such as development or testing. {% hint style="info" %} This option is only available for agents using username/password authentication. If your agents use mTLS, you must configure proper certificates instead. {% endhint %} {% code lineNumbers="true" %} ```yaml protocolMapperAgentDefaults: env: - name: CYBUS_TRUST_ALL_CERTS value: 'true' ``` {% endcode %}Reinstalling Your Services
After completing the upgrade, you must reinstall all previously used services. You can do this using your preferred method: * Via the Admin UI, see [Installing Services](/data-flows/services/managing/installing). * Automatically through a CI pipeline. Additionally, there have been changes to the relationships between services. Understanding how these interdependencies behave at runtime is crucial for correct deployment and maintenance. **Install parent services first (recommended)**: If the service depends on another service (parent/child relationship), install the parent service first. This ensures: * Service relations are created during installation. * Each service can be installed with `targetState=enabled`. **Install child services first (alternative)**: It is possible to install the dependent (child) service first, but this comes with limitations: * Service relations are only established when the service is enabled. * The dependent (child) service can **only** be installed with `targetState=disabled`. For more details, see [Service Dependency Behavior](/data-flows/services/inter-service-referencing#service-dependency-behavior) and [targetState](/data-flows/service-commissioning-files/resources/cybus-endpoint#targetstate).Verifying Permissions
* Check the permissions of your users. Compare them with the default roles in Connectware 2.0.0 and make any updates needed so your users can continue working without interruptions. For more information on managing permissions, see [Permissions](/access/user-management/permissions).1. Remove VRPC
VRPC is no longer supported in the custom connector environment. * Remove all VRPC references in the custom connector code. This includes the import and any usage of `VrpcAdapter`: **Example** {% code lineNumbers="true" %} ```javascript // const { VrpcAdapter } = require('vrpc') <- REMOVE THIS const Connection = require('./FoobarConnection') const Endpoint = require('./FoobarEndpoint') // VrpcAdapter.register(Endpoint, { schema: Endpoint.getSchema() }) <- REMOVE THIS // VrpcAdapter.register(Connection, { schema: Connection.getSchema() }) <- REMOVE THIS ``` {% endcode %}2. Follow the Directory Naming Conventions
* When defining the Dockerfile, ensure that the destination path for the copied source files ends in a protocol-specific directory name written entirely in lowercase. **Example** {% code lineNumbers="true" %} ```yaml # protocol directory must be lowercase COPY ./src ./src/protocols/foobar ``` {% endcode %}3. Follow the Schema Naming Conventions
* The schema `$id` must match the file name (without the `.json`). * The schema must start with a capital letter, like `Foobar`. **Example** * In `FoobarConnection.json`, the class must be like: {% code lineNumbers="true" %} ```json { ... "$id": "FoobarConnection" ... } ``` {% endcode %} * In `FoobarEndpoint.json`, the class must be like: {% code lineNumbers="true" %} ```json { ... "$id": "FoobarEndpoint" ... } ``` {% endcode %}4. Schema Versioning
Schemas support versioning through the additional `version` property, which must be a positive integer greater than zero. If this property is omitted, the default value is `1`. Versioning ensures that only the latest version of a schema is considered active and valid. This means that even though all custom connector instances should run the same version of schemas, the latest version will overwrite any previous version in the CW control plane. **Example** * `FoobarConnection.json` supporting versioning. {% code lineNumbers="true" %} ```json { ... "$id": "FoobarConnection", "version": 3 ... } ``` {% endcode %}5. Follow the Source Directory Naming Conventions
Follow the case-sensitive naming conventions based on the protocol name. * File names must start with an uppercase protocol name (e.g., `Foobar`). * Connection and endpoint suffixes are mandatory. * JS files define classes. * JSON files define schemas. **Example** {% code lineNumbers="true" %} ```yaml src/ ├── FoobarConnection.js ├── FoobarConnection.json ├── FoobarEndpoint.js └── FoobarEndpoint.json ``` {% endcode %}6. Follow the Class Naming Conventions
* The class name must match the file name, excluding the `.js` extension. * The class name must start with a capital letter, such as `Foobar`. **Example** * In `FoobarConnection.js`, the class must be: {% code lineNumbers="true" %} ```javascript class FoobarConnection extends Connection { ... } ``` {% endcode %} * In `FoobarEndpoint.js`, the class must be: {% code lineNumbers="true" %} ```javascript class FoobarEndpoint extends Endpoint { ... } ``` {% endcode %}7. Class Constructors
Unless you need a specific constructor, there is no need to specify one because it is inherited from the parent class. However, if you need to implement a custom constructor for the `Connection` or `Endpoint` classes, preserve the following format: * In `FoobarConnection.js`, the class constructor must be like: {% code lineNumbers="true" %} ```javascript class FoobarConnection extends Connection { --- constructor (params) { super(params) --- // custom code --- } --- } ``` {% endcode %} * In `FoobarEndpoint.js`, the class constructor must be like: {% code lineNumbers="true" %} ```javascript class FoobarEndpoint extends Endpoint { --- constructor (params, dataPlaneConnectionInstance, parentConnectionInstance) { super(params, dataPlaneConnectionInstance, parentConnectionInstance) --- // custom code --- } --- } ``` {% endcode %}8. Do not Set the _topic Property Manually
The `_topic` property is now handled automatically. Manually assigning it will cause errors. The following code is invalid and must be removed since topics are now built internally. {% code lineNumbers="true" %} ```javascript // this is invalid, remove it this._topic = 'this/is/a/topic' ``` {% endcode %}9. ES Modules Not Supported
The standard JavaScript environment of custom connectors is based on CommonJS modules. ES modules are not supported.10. TypeScript Configuration
TypeScript is not officially supported in development workflows. However, if you want to use TypeScript and compile it to JavaScript, make sure to configure your `tsconfig.json` file as follows: {% code lineNumbers="true" %} ```json { "compilerOptions": { .... "target": "es2022", /* Set the JavaScript language version for emitted JavaScript and include compatible library declarations. */ "lib": ["es6"], /* Specify a set of bundled library declaration files that describe the target runtime environment. */ "module": "commonjs", /* Specify what module code is generated. */ .... }, "include": ["src/**/*.ts", "src/**/*.json", "src/**/*.js", "src/**/*.d.ts", "test/**/*"] } ``` {% endcode %} Additionally, the compiled JavaScript output must include an `exports.default` assignment and the exported class itself. This ensures interoperability with our CommonJS-based module system. The compiled `.js` file should result in: {% code lineNumbers="true" %} ```javascript class FoobarConnection { ... } exports.default = FoobarConnection; ``` {% endcode %}1. Stop Tracking Whole Services
* Tracking the entire service object is no longer allowed. You must update your connector configuration to track individual resources only (like specific endpoints or connections). **Example** {% code lineNumbers="true" %} ```yaml # Before (no longer supported) serviceEndpoint: type: Cybus::Endpoint properties: protocol: Systemstate connection: !ref systemStateConnection subscribe: resourceId: !sub '${Cybus::ServiceId}' ``` {% endcode %}2. Update Event Handling Logic
The following status events have been removed from Systemstate. If your implementation depends on them (e.g., for health monitoring or automation), you must refactor that logic: * `subscribed`/`unsubscribed` * `online`/`offline`Updating Your Log Monitoring
If you rely on log monitoring, review whether your setup references any of the updated log messages and adjust accordingly. | Type | Log Level | Original (with typo) | Corrected line | | ------------- | --------- | --------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | | Log message | info | MS Entra Login was succesful, redirecting to | MS Entra Login was successful, redirecting to | | Log message | debug | DELETE /:id/tokens sucess for user: '\Installing the Heidenhain Agent
You must upgrade the Windows-based [Cybus Heidenhain Agent](/connectors/shop-floor-connectors/heidenhain-dnc) to work with Connectware 2.0.0. 1. Uninstall the existing Heidenhain agent installation from your Windows system. 2. Install the updated Heidenhain agent. You can find the download link at [Heidenhain DNC](/connectors/shop-floor-connectors/heidenhain-dnc).Updating Auto-Generated Topic References
Auto-generated topics no longer include resource-specific properties. They always follow: {% code lineNumbers="true" %} ```bashVerify Your Service Commissioning Files
If you are using auto-generated MQTT users outside of services (e.g., scripts, dashboards, or other non-commissioning references), migrate to explicit identities: * Create dedicated users with the required roles/permissions. See [User Management](/access/user-management). * Update your external systems to use the new explicit credentials.Updating the Network Ports
Verify that your firewalls and security rules are updated to allow the new ports (TCP/4222 and TCP/4223) and to remove dependencies on the deprecated ones (TCP/1884 and TCP/8884). This ensures uninterrupted connectivity between your agents and Connectware.Updating the Hardware Setup
We recommend adding the following resources to your hardware setup: * **7** CPU cores * **6** GB of memory * **20** Gi of storage However, these are general guidelines. Check what your specific system needs and make adjustments accordingly.Mandatory Upgrade Steps
These steps apply to every Connectware installation upgrading to Connectware 2.0.0. For a detailed guide, see [Mandatory Upgrade Steps](#mandatory-upgrade-steps). {% hint style="warning" %} Depending on your setup, you may also need to perform additional Conditional Steps. {% endhint %} 1. [**TLS Changes**](#id-1.-tls-changes): Default behavior on certificate validation has been adjusted. 2. [**Update .env Configuration**](#id-2.-update-.env-configuration): Remove any obsolete environment variables and update the configuration for changed or new environment variables as necessary. 3. [**Preparing the Connectware Upgrade**](#id-3.-preparing-the-connectware-upgrade). 4. [**Upgrading to Connectware 2.0.0**](#id-4.-upgrading-to-connectware-2.0.0): Download and install Connectware 2.0.0. 5. [**Updating Agent Configuration**](#id-6.-updating-agent-configuration): Update your agent configuration to comply with the updated configuration. 6. [**Upgrading Agents**](#id-7.-upgrading-agents): Upgrade your agents. 7. [**Reinstalling Services**](#id-8.-reinstalling-services): This upgrade changes where your services are stored. You will need to reinstall any services after the upgrade.Feature-Specific Upgrade Steps
Only follow these if you use the related features, so they continue working after the upgrade. 1. [**Roles and Permissions**](#id-1.-permissions-and-roles): New permissions were added to Connectware. Verify your custom roles, if they require updates. 2. [**Custom Connectors**](#id-2.-custom-connectors): Update your customer connector configurations to meet new requirements. 3. [**Systemstate Protocol**](#id-3.-systemstate-protocol): Update your Systemstate protocol configurations to meet new requirements. 4. [**Log Monitoring**](#id-4.-log-monitoring): Some logging strings are changed. If you use log monitoring, you may need to update it. 5. [**Heidenhain Agents**](#id-5.-heidenhain-agents-windows): Upgrade your Heidenhain agents. 6. [**Auto-Generated MQTT Topics of Resources**](#id-6.-auto-generated-mqtt-topics-of-resources): Topic generation no longer includes resource-specific properties. Update your service commissioning files if you relied on old patterns. 7. [**Auto-Generated MQTT Users**](#id-7.-auto-generated-mqtt-users): The behavior of how MQTT users are auto-generated has changed. You may need to update your service commissioning file if you relied on auto-generated MQTT users.1. Introducing the cybus_combined_ca.crt
Connectware maintains two separate CA chains: * External certificates validated by `cybus_ca.crt`. * Internal certificates validated by `shared_yearly_ca.crt`. Which CA an agent requires depends on the hostname through which it connects to Connectware. For example, through the Connectware ingress, or directly to the Control Streaming Server (NATS) through the internal network. To simplify configuration, we introduced `cybus_combined_ca.crt`, a bundle containing both chains, so agents can use a single file without needing to distinguish between internal and external CA certificates.2. Certificate Chain Verification in Agents
Agents now enforce TLS chain validation by default. Each agent requires access to `cybus_combined_ca.crt`, available on the `certs` volume. * To revert to the previous behavior (skipping verification), set the environment variable `CYBUS_TRUST_ALL_CERTS` to `true`. Note that it has been renamed from `TRUST_ALL_CERTS`.3. Configuring Certificate Hostnames
The default Connectware-generated CA includes the hostnames `localhost` and `connectware`. * To add more hostnames, configure a comma separated list in the environment variable `CYBUS_INGRESS_DNS_NAMES`. * You will also be prompted for these names as part of running the Connectware installer.4. Renewal of Certificate Chains
With 2.0.0, the internal CA chain is replaced: * Certificate Authority renamed from `CybusCA` to `CybusInternalCA`. * The hostname `nats` is added as a Subject Alternate Name (SAN) to `shared_yearly_server.crt`. The built-in default external CA certificate chain is also replaced. * The hostname `connectware` is added as a SAN to `cybus_server.crt`. If you rely on monitoring, custom setups, or modified certificates, adapt your configuration accordingly.5. Replacing CA Certificate Chain
To replace Connectware’s default external chain with your enterprise-managed CA: * Replace `cybus_ca.crt` with your enterprise CA certificate. * Ensure `cybus_server.crt` and `cybus_server.key` form a valid key pair, signed by the CA in `cybus_ca.crt`. Do not replace the internal CA (`shared_yearly_ca.crt`). After replacement: 1. Restart the `system-control-server` deployment to rebuild and synchronize the combined CA bundle (`cybus_combined_ca.crt`). Ensure that only a single Connectware instance is running. {% code lineNumbers="true" %} ```bash docker restart $(docker container ls -f "label=io.cybus.connectware=core" -f "label=com.docker.compose.service=system-control-server" -q) ``` {% endcode %} 2. Restart all Connectware services.Removing Obsolete Environment Variables
Some [environment variables](/reference/environment-variables#docker-compose) are obsolete and have been removed. Remove the following environment variables from your .env file for Connectware: * `CYBUS_CM_RPC_TIMEOUT` * `CYBUS_ADMIN_WEB_APP_VRPC_TIMEOUT` * `CYBUS_PM_RPC_TIMEOUT` * `CYBUS_SM_RPC_TIMEOUT` * `CYBUS_SCS_RPC_TIMEOUT` * `CYBUS_USE_SERVICES_GRAPH`1. Ingress DNS Name Configuration
With the changes TLS behavior in Connectware, it has become essential to add the DNS names under which Connectware is addressed, for example by agents. If you are replacing Connectware's default PKI, you can, and likely have managed this yourself by providing a valid `cybus_server.crt` containing all Subject Alternate Names (SANs) used within your setup. If you are using Connectware's default PKI, you can use the new environment variable `CYBUS_INGRESS_DNS_NAMES`, which is a comma separated list of names that will be added to the default `cybus_server.crt`. #### Hostname Formats You can include multiple hostnames in the list. The certificate will include all specified names in its SAN section. The configuration accepts various hostname formats: * Wildcards (e.g., `*.company.io`) * Subdomains (e.g., `connectware.company.io`) * Custom hostnames (e.g., `localhost`) * IP addresses (e.g. 192.168.100.42) **Example** {% code lineNumbers="true" %} ```ini CYBUS_INGRESS_DNS_NAMES=connectware.company.io,*.company.io,192.168.100.42 ``` {% endcode %} The Connectware installer will also ask you for this value.1. Backing Up Your PostgreSQL Database
With Connectware 2.0.0, Connectware uses a new major version of PostgreSQL. You need to delete your `postgresql` volume before upgrading Connectware (this is covered later in this upgrade guide). This requires you to create a backup of your database and restore this after the upgrade. {% hint style="warning" %} Any modifications done to Connectware after the following database backup will be lost after the Connectware 2.0.0 upgrade. We recommend to create the backup right before upgrading to Connectware 2.0.0. {% endhint %} 1. To create a backup of your database, first identify the correct container from the NAMES column: {% code lineNumbers="true" %} ```bash docker container ls -f "label=io.cybus.connectware=core" -f "label=com.docker.compose.service=postgresql" ``` {% endcode %} If more than one container is shown, you need to identify the correct container. The prefix of the container is usually the folder name in which your Docker Composition is stored. For example, if you installed it in `/opt/connectware`, the name of the container would be `connectware-postgresql-1`. 2. Create a backup of the database in the file `connectware_database.sql`, replacing `${CONTAINER_NAME}` with the name of the container identified in step 1. {% code lineNumbers="true" %} ```bash docker exec \ ${CONTAINER_NAME} \ bash -c "pg_dump -U cybus-admin --if-exists -c cybus_connectware" \ > connectware_database.sql ``` {% endcode %} 3. Make sure the backup is successful, then store the database file in a secure location.2. Service-Manager Volume Backup & Removal
The `service-manager` volume is deprecated and will not be used after the upgrade to 2.0.0. After upgrading, you can remove this Docker volume. You can identify the volume using this command: {% code lineNumbers="true" %} ```bash docker volume ls -f "label=com.docker.compose.volume=service-manager" ``` {% endcode %} In the future, the former contents of this volume will be stored in the PostgreSQL database, but they will not be migrated automatically. You must reinstall any services that you previously used. See [Reinstalling Services](#12-reinstalling-services). If you do not have your services stored outside of Connectware, make sure to export your services, or create a backup of your `service-manager` volume before upgrading.1. Reviewing the Connectware Changelog
Before upgrading to Connectware 2.0.0, review the [changelog](/changelog#what-has-changed-in-200) to familiarize yourself with new features, bug fixes, and other changes introduced in Connectware 2.0.0.2. Verifying your Backups
Make sure that you store backups of your setup. This allows you to restore a previous state if necessary. Your backups must consist of the following files: * All Docker volumes * Your Connectware database * Your .env file * All service commissioning files Depending on your local infrastructure, it may be necessary to back up additional files.3. Shutting Down Protocol-Mapper Agents
Before running the upgrade, you must stop all connected agents. Any agents that remain active during the upgrade will have to go through the registration process again. * **Docker Run**: To stop agents which were started using `docker run`, use the `docker stop` command. If you are not aware of the name these containers use, run the `docker ps` command to find out. * **Docker Compose**: If your agents are running in Docker Compose, use the `docker compose down` command to stop them. * **Agent Helm Chart**: You can shut down agents that have been installed via the `connectware-agent` Helm chart using this command: {% code lineNumbers="true" %} ```bash kubectl get -n ${NAMESPACE} sts -lapp.kubernetes.io/component=protocol-mapper-agent -o name | xargs -I % kubectl scale -n ${NAMESPACE} % --replicas 0 ``` {% endcode %}4.Shutting Down Connectware
* Before running the installer, you must shut down Connectware. 1. Make sure you enter the directory in which you installed Connectware, where your `docker-compose.yaml` and `.env` files are located. This is likely `/opt/connectware`. 2. Shutdown Connectware: {% code lineNumbers="true" %} ```bash docker compose down ``` {% endcode %}5. Removing the PostgreSQL Volume
* Before running the installer, you must remove the `postgresql` volume. 1. Identify the correct volume to delete: {% code lineNumbers="true" %} ```bash docker volume ls -f "label=com.docker.compose.volume=postgresql" ``` {% endcode %} If this shows more than one volume, you must identify the correct volume. The prefix of this volume is usually the folder name in which your Docker Composition is stored. For example, if you installed in `/opt/connectware`, the name of this volume would be `connectware_postgresql`. 2. Delete the postgresql volume: {% code lineNumbers="true" %} ```bash docker volume rm [volume-identified-in-step-1]" ``` {% endcode %}6. Initial Connectware Upgrade
* To upgrade Connectware to a newer version, follow the steps in the [Prepare Installer Script](/deployment/installing-connectware/on-docker#preparing-the-installer-script) to get the latest installer script. When running the update, select your current Connectware installation directory. The update will automatically preserve your existing configuration, including your license key and network settings. If you are prompted to enter a license key during the update, this usually means that you have selected the wrong installation directory. In this case, cancel the update and verify you have chosen the correct directory. {% hint style="warning" %} If you originally installed Connectware with sudo privileges, make sure that you use `sudo` again when running the update. {% endhint %} {% hint style="warning" %} ## Downgrading to previous Connectware versions is not supported {% endhint %} ## Upgrading Connectware in Silent Mode The installer supports an automated deployment mode that requires no manual intervention. You can activate this by using either `-s` or `--silent`, and `-d`(directory) when [running the installation script](#running-the-installer-script). If you need to customize your installation, the script offers several configuration options. Run the installer with `--help` to view all available parameters. **Example** {% code lineNumbers="true" %} ```bash ./connectware-online-installer.sh -s -d7. Running Database Restore & Starting Connectware
1. Create a file called `docker-compose.override.yaml` and add the following content: {% code lineNumbers="true" %} ```yaml services: admin-web-app: profiles: - do-not-start auth-server: profiles: - do-not-start broker: profiles: - do-not-start connectware: profiles: - do-not-start container-manager: profiles: - do-not-start doc-server: profiles: - do-not-start ingress-controller: profiles: - do-not-start protocol-mapper: profiles: - do-not-start service-manager: profiles: - do-not-start workbench: profiles: - do-not-start resource-status-tracking: profiles: - do-not-start nats: profiles: - do-not-start ``` {% endcode %} {% hint style="info" %} If you are already using a file `docker-compose.override.yaml`, make sure to temporary rename this file for the upgrade. {% endhint %} 2. Start the Docker Composition: {% code lineNumbers="true" %} ```bash docker compose up -d ``` {% endcode %} 3. Once the postgresql container has started, restore the database (reuse the container name previously identified when backup up the database): {% code lineNumbers="true" %} ```bash cat connectware_database.sql | docker exec -i \ ${CONTAINER_NAME} \ bash -c "psql -U cybus-admin -d cybus_connectware" ``` {% endcode %} 4. Stop the Docker Composition: {% code lineNumbers="true" %} ```bash docker compose down ``` {% endcode %} 5. Remove `docker-compose.override.yaml` {% code lineNumbers="true" %} ```bash rm docker-compose.override.yaml ``` {% endcode %} {% hint style="info" %} If you were already using a file `docker-compose.override.yaml`, make sure to restore it now. {% endhint %} 6. Start Connectware 2.0.0: {% code lineNumbers="true" %} ```bash docker compose up -d ``` {% endcode %} 7. Restart Connectware 2.0.0: Finally, restart Connectware once more to ensure any certificate updates are properly applied: {% code lineNumbers="true" %} ```bash docker compose down && docker compose up -d ``` {% endcode %}1. Adding the CA Certificate to Your Agent
To connect a protocol-mapper agent with Connectware 2.0.0, you must either provide the agent with the valid CA certificate for the server certificate in use, or disable verification of TLS certificate validity by setting the environment variable `CYBUS_TRUST_ALL_CERTS` to `true` on the agent. Whether you are connecting an agent via Connectware's ingress or the internal network will determine whether you need to provide either `cybus_ca.crt` or `shared_yearly_ca.crt`. However, if you want to avoid this complexity, there is a new file called `cybus_combined_ca.crt` which includes both CA bundles and allows both internal and external connections. You need to have the CA certificate that you want to add at hand. In this example, we assume that you are using the `cybus_combined_ca.crt`: 1. Identify the correct container from the NAMES column: {% code lineNumbers="true" %} ```bash docker container ls -f "label=io.cybus.connectware=core" -f "label=com.docker.compose.service=system-control-server" ``` {% endcode %} 2. Copy `cybus_combined_ca.crt` from Connectware: {% code lineNumbers="true" %} ```bash docker cp [container-name-from-step-1]:/connectware_certs/cybus_combined_ca.crt cybus_combined_ca.crt ``` {% endcode %} 3. Copy the CA certificate `cybus_combined_ca.crt` to the directory which contains the `docker-compose.yaml` file for your agent: **Example using /opt/connectware-agent/ as directory:** {% code lineNumbers="true" %} ```bash cp cybus_combined_ca.crt /opt/connectware-agent/ ``` {% endcode %} 4. Mount the CA certificate `cybus_combined_ca.crt` to the `/connectware/certs/ca/ca-chain.pem` mount point of your agent by adding a volume in `docker-compose.yaml`: **Example using /opt/connectware-agent/ as directory:** {% code lineNumbers="true" %} ```yaml services: protocol-mapper-agent: image: registry.cybus.io/cybus/protocol-mapper:2.0.0 environment: CYBUS_AGENT_MODE: distributed CYBUS_AGENT_NAME: my-docker-compose-agent CYBUS_HOSTNAME_INGRESS: localhost volumes: - protocol-mapper-agent:/data - ./cybus_combined_ca.crt:/connectware/certs/ca/ca-chain.pem # Mount your cybus_combined_ca to the agent restart: unless-stopped network_mode: host hostname: my-docker-compose-agent volumes: protocol-mapper-agent: ``` {% endcode %}2. (Alternative) Disable TLS Certificate Validation
You can choose to disable TLS certificate validation for agents. This is **not recommended**, as it weakens security and makes your setup vulnerable to man-in-the-middle attacks. However, it may be acceptable in non-production environments such as development or testing. {% hint style="info" %} This option is only available for agents using username/password authentication. If your agents use mTLS, you must configure proper certificates instead. {% endhint %} {% code lineNumbers="true" %} ```yaml services: protocol-mapper-agent: image: registry.cybus.io/cybus/protocol-mapper:2.0.0 environment: CYBUS_AGENT_MODE: distributed CYBUS_AGENT_NAME: my-docker-compose-agent CYBUS_HOSTNAME_INGRESS: localhost CYBUS_TRUST_ALL_CERTS: true # disable certificate validation volumes: - protocol-mapper-agent:/data restart: unless-stopped network_mode: host hostname: my-docker-compose-agent volumes: protocol-mapper-agent: ``` {% endcode %}3. Updating Environment Variables
**Obsolete Environment Variables (Agents)** Some [Environment Variables](/reference/environment-variables#docker-compose) are obsolete and have been removed. Remove the following environment variables from your agent orchestration: * `CYBUS_PM_RPC_TIMEOUT` * `CYBUS_CONTROLPLANE_URI` **New or Changed Environment Variables (Agents)** The following environment variables have changed. If you had specific configuration for these in the past, update your orchestration accordingly. For some environment variables, you need to take additional steps depending on your setup. The required steps are covered in the following sections. | **Old Environment Variable** | **New Environment Variable** | **Required Change** | | ---------------------------- | -------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | - | `CYBUS_DATAPLANE_USE_TLS` | Set to `true` if you want your agents to use TLS encryption for the MQTT data plan | | `USE_MUTUAL_TLS` | `CYBUS_USE_MUTUAL_TLS` | Set to `true` if you want your agents to use mTLS authentication for the MQTT data plan | | `TRUST_ALL_CERTS` | `CYBUS_TRUST_ALL_CERTS` | Set to `true` if you want your agents to skip TLS certificate validation. | | `CYBUS_DATA_MQTT_HOST` | `CYBUS_DATAPLANE_HOST` | See **3.2 - Directly Targeting MQTT Broker** | | `CYBUS_DATA_MQTT_PORT` | `CYBUS_DATAPLANE_PORT` | See **3.2 - Directly Targeting MQTT Broker** | | `CYBUS_MQTT_HOST` | `CYBUS_STREAMSERVER_HOST` | See **3.3 - Directly Targeting Streaming Server** | | `CYBUS_MQTT_PORT` | `CYBUS_STREAMSERVER_PORT` | See **3.3 - Directly Targeting Streaming Server** | | `CYBUS_MQTT_SCHEME` | `CYBUS_DATAPLANE_SCHEME` and `CYBUS_STREAMSERVER_SCHEME` | See **3.2 - Directly Targeting MQTT Broker** and **3.3 - Directly Targeting Streaming Server** |3.1 - Updating Connectware Ingress Targeting
Connectware 2.0.0 changes how you address your Connectware instance with agents. Previously, the environment variable `CYBUS_MQTT_HOST` was used. Later, `CYBUS_HOSTNAME_INGRESS` was introduced for targeting the ingress, while `CYBUS_MQTT_HOST` was used for targeting the `control-plane-broker`. Additionally, `CYBUS_DATA_MQTT_HOST` was introduced to control the MQTT broker that the agent connected to as data plane. `CYBUS_MQTT_HOST` acted as a fallback for all three environment variables. With the removal of the `control-plane-broker`, we are simplifying and decoupling the configuration: * If you are only using the Connectware ingress for your agents, you must only configure `CYBUS_HOSTNAME_INGRESS`. * If you have more complex setup, which targeted the MQTT data plane broker or the `control-plane-broker`, use `CYBUS_DATAPLANE_HOST` and `CYBUS_STREAMSERVER_HOST` to refine your configuration, as explained in the next steps. In short, make sure that you target your Connectware instance using the `CYBUS_HOSTNAME_INGRESS` environment variable, replacing any legacy `CYBUS_MQTT_HOST` configuration you may have had, without the intention of directly targeting the MQTT data plane broker. {% code lineNumbers="true" %} ```yaml services: protocol-mapper-agent: image: registry.cybus.io/cybus/protocol-mapper:2.0.0 environment: CYBUS_AGENT_MODE: distributed CYBUS_AGENT_NAME: my-docker-compose-agent CYBUS_HOSTNAME_INGRESS: localhost # make sure you use CYBUS_HOSTNAME_INGRESS as the general Connectware target for your agent CYBUS_DATAPLANE_HOST: broker # use new environment variables for more complex network setups volumes: - protocol-mapper-agent:/data - ./cybus_combined_ca.crt:/connectware/certs/ca/ca-chain.pem restart: unless-stopped hostname: my-docker-compose-agent network_mode: host volumes: protocol-mapper-agent: ``` {% endcode %}3.2 - Directly Targeting MQTT Broker
When deploying agents in the internal network of Connectware, they are able to directly connect to our MQTT broker instead of going through the Connectware ingress. This improves performance and reduces failure points, so if you are running a heavy, critical load, it may be worth the extra configuration. The major hindrance is, that the name "broker", which is used by our MQTT broker on the internal network, is not part of the `cybus_server.crt` by default. In order to connect agents with a TLS connection to this hostname, you either need to add the hostname "broker" as a Subject Alternate Name (SAN) to the certificate, or set `CYBUS_TRUST_ALL_CERTS=true` for the agent. The previous steps explained how to add the CA certificate bundle file and how to set the environment variable. **Adding the Hostname to the Default Certificate** If you are using the built-in default certificate for Connectware, you can add the hostname "broker" through the environment variable `CYBUS_HOSTNAME_INGRESS` in the `.env` file of your Connectware installation: {% code lineNumbers="true" %} ```ini CYBUS_INGRESS_DNS_NAMES=connectware.company.io,broker ``` {% endcode %} It is easiest if you add this configuration during your upgrade to Connectware 2.0.0, since activating it will automatically be covered by the upgrade guide. You will be asked for the ingress hostnames by the installer script. You can also use the parameter `--ingress-dns-names` for the Connectware installer to set this. If applying this configuration after already upgrading to Connectware 2.0.0, running `docker compose up -d` on your Connectware installation will cause the multiple containers to restart. Once they are ready, restart Connectware again: {% code lineNumbers="true" %} ```bash docker compose down docker compose up -d ``` {% endcode %} **Configuring Your Agents to Target the MQTT Broker** Next, you must configure your agents to target the MQTT broker directly by using the `CYBUS_DATAPLANE_*` environment variables. To use TLS encryption for this connection, you must set `CYBUS_DATAPLANE_USE_TLS` to `true` and provide the agent with the CA certificate bundle, as explained previously. **Docker Compose Example** To add a Docker Composition to an existing network, you must add it as external network. For this, you need to know the name of the network. This example assumes the name is `connectware_cybus`, however you can find it using this command (NAME column): {% code lineNumbers="true" %} ```bash docker network ls -f "label=com.docker.compose.network=cybus" ``` {% endcode %} {% code lineNumbers="true" %} ```yaml services: protocol-mapper-agent: image: registry.cybus.io/cybus/protocol-mapper:2.0.0 environment: CYBUS_AGENT_MODE: distributed CYBUS_AGENT_NAME: my-docker-compose-agent CYBUS_HOSTNAME_INGRESS: connectware CYBUS_DATAPLANE_HOST: broker CYBUS_DATAPLANE_USE_TLS: true volumes: - protocol-mapper-agent:/data - ./cybus_combined_ca.crt:/connectware/certs/ca/ca-chain.pem restart: unless-stopped hostname: my-docker-compose-agent networks: - connectware_cybus # name from previous step extra_hosts: - 'connectware:host-gateway' # this extra host ensures the agent is still able to make HTTP API calls volumes: protocol-mapper-agent: networks: connectware_cybus: # name from previous step external: true ``` {% endcode %} The TCP port used for this connection is automatically determined by other configuration like TLS and mTLS settings, however, if for some reason you need to override this, use the environment variable `CYBUS_DATAPLANE_PORT`.3.3 - Directly Targeting Streaming Server
When deploying agents in the internal network of Connectware, they are able to directly connect to our streaming server control plane instead of going through the Connectware ingress. This improves performance and reduces failure points, so if you are running a heavy, critical load, it may be worth the extra configuration. **Configuring Your Agents to Target the Streaming Server** Next, you must configure your agents to target the streaming server directly by using the `CYBUS_STREAMSERVER_HOST` environment variable. The default internal name is "nats". **Docker Compose Example** To add a Docker Composition to an existing network, you must add it as external network. For this, you need to know the name of the network. This example assumes the name is `connectware_cybus`. However, you can find it using this command (NAME column): {% code lineNumbers="true" %} ```bash docker network ls -f "label=com.docker.compose.network=cybus" ``` {% endcode %} {% code lineNumbers="true" %} ```yaml services: protocol-mapper-agent: image: registry.cybus.io/cybus/protocol-mapper:2.0.0 environment: CYBUS_AGENT_MODE: distributed CYBUS_AGENT_NAME: my-docker-compose-agent CYBUS_HOSTNAME_INGRESS: connectware CYBUS_STREAMSERVER_HOST: nats volumes: - protocol-mapper-agent:/data - ./cybus_combined_ca.crt:/connectware/certs/ca/ca-chain.pem restart: unless-stopped hostname: my-docker-compose-agent networks: - connectware_cybus # name from previous step extra_hosts: - 'connectware:host-gateway' # this extra host ensures the agent is still able to make HTTP API calls volumes: protocol-mapper-agent: networks: connectware_cybus: # name from previous step external: true ``` {% endcode %} The TCP port used for this connection is automatically determined by other configuration like mTLS settings. However, if for some reason you need to override this, use the environment variable `CYBUS_STREAMSERVER_PORT`. {% hint style="info" %} If you are not using the `cybus_combined_ca.crt` for your agents, targeting the streaming server requires you to add the `shared_yearly_ca.crt`, not the `cybus_ca.crt`. {% endhint %}Reinstalling Your Services
After completing the upgrade, you must reinstall all previously used services. You can do this using your preferred method: * Via the Admin UI, see [Installing Services](/data-flows/services/managing/installing). * Automatically through a CI pipeline. Additionally, there have been changes to the relationships between services. Understanding how these interdependencies behave at runtime is crucial for correct deployment and maintenance. **Install parent services first (recommended)**: If the service depends on another service (parent/child relationship), install the parent service first. This ensures: * Service relations are created during installation. * Each service can be installed with `targetState=enabled`. **Install child services first (alternative)**: It is possible to install the dependent (child) service first, but this comes with limitations: * Service relations are only established when the service is enabled. * The dependent (child) service can **only** be installed with `targetState=disabled`. For more details, see [Service Dependency Behavior](/data-flows/services/inter-service-referencing#service-dependency-behavior) and [targetState](/data-flows/service-commissioning-files/resources/cybus-endpoint#targetstate).Verifying Permissions
* Check the permissions of your users. Compare them with the default roles in Connectware 2.0.0 and make any updates needed so your users can continue working without interruptions. For more information on managing permissions, see [Permissions](/access/user-management/permissions).1. Remove VRPC
VRPC is no longer supported in the custom connector environment. * Remove all VRPC references in the custom connector code. This includes the import and any usage of `VrpcAdapter`: **Example** {% code lineNumbers="true" %} ```javascript // const { VrpcAdapter } = require('vrpc') <- REMOVE THIS const Connection = require('./FoobarConnection') const Endpoint = require('./FoobarEndpoint') // VrpcAdapter.register(Endpoint, { schema: Endpoint.getSchema() }) <- REMOVE THIS // VrpcAdapter.register(Connection, { schema: Connection.getSchema() }) <- REMOVE THIS ``` {% endcode %}2. Follow the Directory Naming Conventions
* When defining the Dockerfile, ensure that the destination path for the copied source files ends in a protocol-specific directory name written entirely in lowercase. **Example** {% code lineNumbers="true" %} ```yaml # protocol directory must be lowercase COPY ./src ./src/protocols/foobar ``` {% endcode %}3. Follow the Schema Naming Conventions
* The schema `$id` must match the file name (without the `.json`). * The schema must start with a capital letter, like `Foobar`. **Example** * In `FoobarConnection.json`, the class must be like: {% code lineNumbers="true" %} ```json { ... "$id": "FoobarConnection" ... } ``` {% endcode %} * In `FoobarEndpoint.json`, the class must be like: {% code lineNumbers="true" %} ```json { ... "$id": "FoobarEndpoint" ... } ``` {% endcode %}4. Schema Versioning
Schemas support versioning through the additional `version` property, which must be a positive integer greater than zero. If this property is omitted, the default value is `1`. Versioning ensures that only the latest version of a schema is considered active and valid. This means that even though all custom connector instances should run the same version of schemas, the latest version will overwrite any previous version in the CW control plane. **Example** * `FoobarConnection.json` supporting versioning. {% code lineNumbers="true" %} ```json { ... "$id": "FoobarConnection", "version": 3 ... } ``` {% endcode %}5. Follow the Source Directory Naming Conventions
Follow the case-sensitive naming conventions based on the protocol name. * File names must start with an uppercase protocol name (e.g., `Foobar`). * Connection and endpoint suffixes are mandatory. * JS files define classes. * JSON files define schemas. **Example** {% code lineNumbers="true" %} ```yaml src/ ├── FoobarConnection.js ├── FoobarConnection.json ├── FoobarEndpoint.js └── FoobarEndpoint.json ``` {% endcode %}6. Follow the Class Naming Conventions
* The class name must match the file name, excluding the `.js` extension. * The class name must start with a capital letter, such as `Foobar`. **Example** * In `FoobarConnection.js`, the class must be: {% code lineNumbers="true" %} ```javascript class FoobarConnection extends Connection { ... } ``` {% endcode %} * In `FoobarEndpoint.js`, the class must be: {% code lineNumbers="true" %} ```javascript class FoobarEndpoint extends Endpoint { ... } ``` {% endcode %}7. Class Constructors
Unless you need a specific constructor, there is no need to specify one because it is inherited from the parent class. However, if you need to implement a custom constructor for the `Connection` or `Endpoint` classes, preserve the following format: * In `FoobarConnection.js`, the class constructor must be like: {% code lineNumbers="true" %} ```javascript class FoobarConnection extends Connection { --- constructor (params) { super(params) --- // custom code --- } --- } ``` {% endcode %} * In `FoobarEndpoint.js`, the class constructor must be like: {% code lineNumbers="true" %} ```javascript class FoobarEndpoint extends Endpoint { --- constructor (params, dataPlaneConnectionInstance, parentConnectionInstance) { super(params, dataPlaneConnectionInstance, parentConnectionInstance) --- // custom code --- } --- } ``` {% endcode %}8. Do not Set the _topic Property Manually
The `_topic` property is now handled automatically. Manually assigning it will cause errors. The following code is invalid and must be removed since topics are now built internally. {% code lineNumbers="true" %} ```javascript // this is invalid, remove it this._topic = 'this/is/a/topic' ``` {% endcode %}9. ES Modules Not Supported
The standard JavaScript environment of custom connectors is based on CommonJS modules. ES modules are not supported.10. TypeScript Configuration
TypeScript is not officially supported in development workflows. However, if you want to use TypeScript and compile it to JavaScript, make sure to configure your `tsconfig.json` file as follows: {% code lineNumbers="true" %} ```json { "compilerOptions": { .... "target": "es2022", /* Set the JavaScript language version for emitted JavaScript and include compatible library declarations. */ "lib": ["es6"], /* Specify a set of bundled library declaration files that describe the target runtime environment. */ "module": "commonjs", /* Specify what module code is generated. */ .... }, "include": ["src/**/*.ts", "src/**/*.json", "src/**/*.js", "src/**/*.d.ts", "test/**/*"] } ``` {% endcode %} Additionally, the compiled JavaScript output must include an `exports.default` assignment and the exported class itself. This ensures interoperability with our CommonJS-based module system. The compiled `.js` file should result in: {% code lineNumbers="true" %} ```javascript class FoobarConnection { ... } exports.default = FoobarConnection; ``` {% endcode %}1. Stop Tracking Whole Services
* Tracking the entire service object is no longer allowed. You must update your connector configuration to track individual resources only (like specific endpoints or connections). **Example** {% code lineNumbers="true" %} ```yaml # Before (no longer supported) serviceEndpoint: type: Cybus::Endpoint properties: protocol: Systemstate connection: !ref systemStateConnection subscribe: resourceId: !sub '${Cybus::ServiceId}' ``` {% endcode %}2. Update Event Handling Logic
The following status events have been removed from Systemstate. If your implementation depends on them (e.g., for health monitoring or automation), you must refactor that logic: * `subscribed`/`unsubscribed` * `online`/`offline`Updating Your Log Monitoring
If you rely on log monitoring, review whether your setup references any of the updated log messages and adjust accordingly. | Type | Log Level | Original (with typo) | Corrected line | | ------------- | --------- | --------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | | Log message | info | MS Entra Login was succesful, redirecting to | MS Entra Login was successful, redirecting to | | Log message | debug | DELETE /:id/tokens sucess for user: '\Installing the Heidenhain Agent
You must upgrade the Windows-based [Cybus Heidenhain Agent](/connectors/shop-floor-connectors/heidenhain-dnc) to work with Connectware 2.0.0. 1. Uninstall the existing Heidenhain agent installation from your Windows system. 2. Install the updated Heidenhain agent. You can find the download link at [Heidenhain DNC](/connectors/shop-floor-connectors/heidenhain-dnc).Updating Auto-Generated Topic References
Auto-generated topics no longer include resource-specific properties. They always follow: {% code lineNumbers="true" %} ```bashVerify Your Service Commissioning Files
If you are using auto-generated MQTT users outside of services (e.g., scripts, dashboards, or other non-commissioning references), migrate to explicit identities: * Create dedicated users with the required roles/permissions. See [User Management](/access/user-management). * Update your external systems to use the new explicit credentials.
Example of users, roles, and permissions
Advanced Mode in Create User dialog
Add Permission button
Add Permission modal
Delete button
Delete confirmation
Add Role dropdown options
Remove role from user
Activating Advanced Mode in Edit User dialog
Add Permission dialog
Add Permission modal
Activating Advanced Mode in Edit User dialog
Remove permission from user
Change Password button
Change Password dialog
Defines how long (in hours) a user stays signed in before being logged out for security reasons. After the configured time has passed, the user session expires and a new login is required.
The Admin UI displays a ten-minute countdown in the top right corner, and users receives a warning ten minutes before the session ends.
Defines how long (in hours) a user stays signed in before being logged out for security reasons. After the configured time has passed, the user session expires and a new login is required.
The Admin UI displays a ten-minute countdown in the top right corner, and users receives a warning ten minutes before the session ends. If the variable is not set, or if the value is negative or not a valid number, the system uses the default duration of 12 hours.
Roles View in Connectware
Add Role button
Edit Role dialog
Delete Role button
Delete confirmation
Permissions overview
Permission Details dialog
This will extend the dialog with an Additional permissions section.
If set to true, Entra ID is enabled. If set to false, Entra ID is disabled.
Default: false
Schema type: boolean
Your Application (client) ID as provided by Entra ID
Schema type: string
Your Directory (tenant) ID as provided by Entra ID
Schema type: string
Confidential key (in plain text) for authenticating with Entra ID. clientSecret is ignored if existingClientSecret is defined.
Schema type: string
Name of an existing Kubernetes secret containing the client secret
Schema type: base64-encoded string
Specifies the Connectware URL that users will be redirected to after authenticating with their Entra ID credentials
Schema type: string
Identity provider's token issuing URL
Schema type: string
User attribute to use as username. If not set, the default value is used.
Default: preferred\_username
Allowed values:name , oid, preferred\_username
Schema type: string
If set to true, Entra ID is enabled. If set to false, Entra ID is disabled.
Default: false
Schema type: boolean
Your Application (client) ID as provided by Entra ID
Schema type: string
Your Directory (tenant) ID as provided by Entra ID
Schema type: string
Confidential key (in plain text) for authenticating with Entra ID. To use the client secret in your .env file, you must encode it to base64.
Schema type: string
Specifies the Connectware URL that users will be redirected to after authenticating with their Entra ID credentials
Schema type: string
Identity provider's token issuing URL
Schema type: string
User attribute to use as username. If not set, the default value is used.
Default: preferred\_username
Allowed values:name , oid, preferred\_username
Schema type: string
Without bindPassword: Base DN where all user entries are located (e.g., ou=users,dc=corp,dc=com).
With bindPassword: Full DN of a dedicated bind user (e.g., cn=binduser,ou=users,dc=corp,dc=com).
global.authentication.ldap.bindPassword
or global.authentication.ldap.existingBindSecret
Password for the dedicated bind user or reference a Secret with keys bindDn and bindPassword. When provided, bindDn must contain the full DN of the bind user, and searchBase becomes required.
Note: If both are provided, existingBindSecret takes precedence.
global.authentication.ldap.caChain.cert
or global.authentication.ldap.caChain.existingConfigMap
Provide full CA chain in PEM via cert: or reference a ConfigMap (file must be ca.crt). No file path option.
Note: If both are provided, existingConfigMap takes precedence.
Without CYBUS\_LDAP\_BIND\_PASSWORD: Base DN where all user entries are located (e.g., ou=users,dc=corp,dc=com).
With CYBUS\_LDAP\_BIND\_PASSWORD: Full DN of a dedicated bind user (e.g., cn=binduser,ou=users,dc=corp,dc=com).
Path to CA file for LDAP server validation. Used with Secure LDAP when CYBUS\_LDAPS\_TRUST\_ALL\_CERTS is false.
Note: The CA file must be mounted into the container for this path to be accessible.
The field is labeled "DN of AD Group" in the UI, but it accepts the DN of any LDAP group, whether from Active Directory or OpenLDAP.
• Support for certificate signing requests (CSR)
• Ability to request specific roles and permissions
• Enhanced control over client configuration
• Suitable for distributed Connectware agents and advanced clients
• More information
• Works with any standard MQTT or HTTP client
• The client can generate random passwords automatically
• Simple process for basic device integration
• More information
Registering MQTT clients in Connectware
Registering clients in Connectware via REST API
Client Registry View
Version selection for services installed from the Services Catalog
Service Overview
Links in the Service Overview
Resources menu
Service Links View
Connections Details View
Servers View
Connections View
Connections Details View
Connections Details View with open resources
Endpoints View
Endpoint Details View
Connections Overview
Mapping Details View
Service Details view
Example of the resulting service ID presslinetempsensor01 displayed during upload to Connectware in the Create Service dialog.
A) Example for the General Limit (100 Characters)
* Resource name: **10 characters** * Calculation: **max.length - hyphen - resourceName.length** * Remaining for the service ID: **100 - 1 - 10** = **89** * Result: The service ID must be **89 characters or fewer**.B) Example for the Docker-Only Limit (63 Characters)
The following length limitation only applies to Docker-based deployments where service IDs are used in hostnames for containers ([Cybus::Container](/data-flows/service-commissioning-files/resources/cybus-container)) or volumes ([Cybus::Volume](/data-flows/service-commissioning-files/resources/cybus-volume)). * Resource name: **10 characters** * Calculation: **max.length - hyphen - resourceName.length** * Remaining for service ID: **63 - 1 - 10** = **52** * Result: The service ID must be **52 characters or fewer**.Deviation notification
Expanded Deviation notification showing state discrepancies
Deviations tab displaying expected vs. actual status for each deviated resource