Changelog of the base of the orchestrator

5.32 (2026-10-06)

This version contains breaking changes. Actions to perform during the update are flagged with Migration.

  • Renamed the web service to web-application
    • Migration: in the custom configuration files of the /etc/cyberwatch/configs-enabled directory, rename the web service to web-application, otherwise the Cyberwatch deployment fails
  • Switched nginx to the unprivileged nginx-rootless image
    • Migration: when containers are isolated by namespace, the CBW_NGINX_UID and CBW_NGINX_GID variables of the config.env file must now match user 101 of the containers, and no longer root (see nginx certificate folder)
  • Replaced Certbot with the nginx ACME module
    • Deprecated: the --certbot option of the cyberwatch configure command is replaced by the --acme option
    • Removed the certbot container
    • Automatic migration of existing Certbot configurations, keeping the domain name
  • Switched to cosign 3 or later, provided with the cyberwatch package
    • Migration: in offline mode, update the cosign package at the same time as the cyberwatch package
  • Added the cyberwatch renew-certificates command to renew the Cyberwatch internal TLS certificates
  • Added the --force-pull option to the cyberwatch start and cyberwatch restart commands to download the images even if the CBW_NO_PULL variable is enabled in the config.env file
  • cyberwatch restart now continues the restart with the images already present on the node when it fails to download the new images
  • Display of mysqldump and mysql errors when cyberwatch backup save or cyberwatch backup restore fails
  • Fixed the --no-pull option being ignored by the cyberwatch start command
  • Fixed the CBW_DISABLE_ELK variable not being taken into account when running cyberwatch stop followed by cyberwatch start

5.31 (2026-07-09)

  • Storage of nginx certificates in the /etc/cyberwatch/ssl directory instead of a Docker volume
    • Automatic migration of existing certificates during the update
  • Ability to disable the deployment of Elasticsearch and Kibana via the CBW_DISABLE_ELK variable in the config.env file
  • Web interface disabled by default on satellite nodes via the ONLY_API_AND_THIRD_PARTIES variable in the containers.env file (during installation or after regenerating the configuration)
  • Support for a custom port for the backup and restore of an external database via the MYSQL_PORT variable in the containers.env file
  • Added asynchronous cleanup of unused images
    • If the timeout is exceeded at startup, the cleanup is postponed to a scheduled nightly task executed when the stack is stable
    • The cleanup is skipped if the CBW_DONT_PRUNE_UNUSED_IMAGES variable is enabled in the config.env file

5.30 (2026-04-10)

  • Enabled user management in Kibana
  • Fixed nginx certificate regeneration when using the cyberwatch configure command
  • Fixed a warning during certificate generation on satellite nodes

5.29 (2026-03-18)

  • Updated the validity period of certificates used by the application:
    • 10 years for the root certificate
    • 1 year for service certificates
  • Automatic renewal of service certificates:
    • 45 days before expiration by default
    • The renewal period can be changed by setting the CERT_RENEWAL_DAYS variable in the config.env file
  • Use of the root certificate for database backup and restore:
    • For instances using an external database, the certificate used is the one concatenated in the cbw-root-ca-cert.pem file
  • Ability to configure the number of replicas for the following services via variables in the config.env file:
    • web with the CBW_WEB_REPLICAS variable
    • sidekiq_node with the CBW_SIDEKIQ_NODE_REPLICAS variable
    • container-scanner with the CBW_CONTAINER_SCANNER_REPLICAS variable
  • Added a storage space check for containers (/var/lib/containerd) via the cbw doctor command
  • Fixed an issue with adding API_KEYS to the secret file
  • Fixed the minimum required Docker version for apt and rpm packages

5.28 (2025-11-28)

  • Added timestamp to Cyberwatch update logs in /var/log/cyberwatch.log
  • Fixed generation of empty backup file when a backup is interrupted
  • Fixed warning message related to security options in the container-scanner container

5.27 (2025-04-09)

  • Added a check during container startup to prevent the deletion of images for containers that have not yet been started
  • Fixed the display of a warning related to the use of the CBW_DONT_PRUNE_UNUSED_IMAGES option
  • New images are now pulled before stopping the stack to minimize application downtime

5.26 (2025-03-18)

  • Fixed a volume issue when configuring a node as an offline satellite
  • Removed support for MicroK8s orchestrator
  • The IP address of the Docker network used for container-scanner has been configured to be in a similar range to the default Docker network