Skip to content

docs: upgrade notes for v0.1.19 to v0.1.22 #185

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ndbroadbent merged 3 commits into from
Oct 25, 2026
Merged

docs: upgrade notes for v0.1.19 to v0.1.22 #185

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bf4a37e
docs: upgrade notes for v0.1.19 to v0.1.21 (gateways before the CLI, …
ndbroadbent Oct 25, 2026
5c0ec01
docs: mention v0.1.22 in the fresh MFA upgrade notes
ndbroadbent Oct 25, 2026
ac7d175
Merge branch 'main' into nathan/sc-6055-upgrade-notes
ndbroadbent Oct 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions docs/src/content/docs/operations/upgrades.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,6 +207,28 @@ A restore to before the upgrade loses the audit events written since; see

## Release Notes That Need Action

### Fresh MFA for every command (v0.1.19 to v0.1.22)

v0.1.19 asks for MFA on every `run` and `exec`, adds justifications and `--script`. Upgrade straight to v0.1.22:
v0.1.20 fixes the audit log page's links, v0.1.21 lets a script's command read the script after it drops to
another user (`gosu`, `su`), and in v0.1.22 the script review dialog takes the security key PIN, so a script run
without a terminal needs no separate PIN dialog.

1. **Upgrade every gateway before the CLI, and run commands on each rack with the CLI that matches its gateway.**
A CLI older than v0.1.19 skips the MFA prompt while the step-up window is open, and a v0.1.19+ gateway refuses
its `run` and `exec`. A v0.1.19+ CLI starts an attached `run` with a placeholder process that needs no MFA,
which an older gateway refuses: the run fails with "Multi-factor authentication is required for this action"
before any prompt. Deploy a rack that's still on the old gateway with the old CLI (`migrate` runs before the
promote), then switch.
2. **Run scripts with v0.1.21 or later on both the CLI and the gateway.** The gateway recognizes a `--script`
command by its runner, which v0.1.21 changed: when only one side has that change, the audit log records the raw
`sh -c` command instead of the script's name, text and SHA-256.
3. **`require_command_justification` is off by default.** Turn it on per app (app settings page, the API, or
`RGW_APP_<APP>_SETTING_REQUIRE_COMMAND_JUSTIFICATION=true`) once your users' CLIs are on v0.1.19+. Commands run
under a deploy approval use the approval's message as their justification.
4. **To hear about commands in Slack, map `process.exec.start` and `process.start`** to a channel. The message
never includes the command or the script, and links to the audit entry.

### Security audit fixes (v0.1.15)

This release fixes the findings of a security audit. Most changes need nothing from you; check these before you
Expand Down