# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/).

## [6.2.0] 2026-11-04

### Added

- Add `global.trustStore.*` (`existingConfigMap` or `existingSecret`, `password`, `pythonBundle`) to use a prepared
  trust store (keys `cacerts` and optionally `pythoncacerts`) in DataIntegration, Explore and GraphInsights. It is
  mounted read-only to `/cacerts` instead of the emptyDir and used as is. Mutually exclusive with `global.customCACerts`.
- Add `bootstrap.pythonPlugins.uninstallBeforeInstall` (default `false`) to uninstall all python packages 
  before the plugins are installed again
- Add `bootstrap.cronjob.*`: the bootstrap is additionally deployed as suspended CronJob `cmemc-bootstrap`
  (disable with `bootstrap.cronjob.enabled: false`)

### Changed
- update Corporate Memory images to:
  - eccenca-dataintegration v26.2.1
  - eccenca-dataintegration-plugins:v4.0.1
  - eccenca-explore v26.2.3
  - eccenca-marketplace v26.2.9
  - eccenca-cmemc v26.2.3
  - eccenca-graphinsights v20.1.0-1
  - eccenca-marketplace-packages v1.0.0-1


## [6.1.0] 2026-10-09

### Added

- Add `marketplace.config.licenseModeAllowedLicenses` to restrict client-sent
  licenses by checksum (`ECC_MARKETPLACE_LICENSE_MODE_ALLOWED_LICENSES`.
  Empty/unset preserves existing access.
- Add the optional boolean `marketplace.config.mcp` to control
  `ECC_MARKETPLACE_MCP`; set it to `false` to disable the MCP endpoint, which is
  not protected by the license allowlist. The default `null` preserves image defaults.
- `routes.*` for Openshift compatibility (see README.md and values.yaml)
- Add `explore.config.marketplaceMcp` (default `false`) to register the Marketplace MCP endpoint
  (`<marketplace.service.contextPath>/mcp`) as Explore MCP client connection. Prepared for upcoming
  images; enable it together with the new Explore and Marketplace images. Requires `marketplace.enabled`
  and `marketplace.config.mcp` not set to `false`.

### Changed
- update Corporate Memory images to:
  - eccenca-marketplace v26.2.8
  - eccenca-cmemc v26.2.2
- Explore validates JWTs via `spring.security.oauth2.resourceserver.jwt.issuer-uri`
  (new `OAUTH_ISSUER_URI`, taken from `global.keycloakIssuerUrl`) instead of
  `jwk-set-uri`. The Keycloak realm must be reachable and initialized (keys
  created by a first login, which the bootstrap does) or Explore restarts.

## [6.0.2] 2026-09-10

### Changed
- update Corporate Memory images to:
  - eccenca-explore v26.2.2
  - eccenca-graphinsights:v20.0.2


## [6.0.1] 2026-09-04

### Fixed
- correct build connection endpoint url, which fixes missing build mcp tools in companion


## [6.0.0] 2026-09-02

### Added
- add new optional **Marketplace** component to install packages into Corporate Memory (see `marketplace.*` values).
  - enabled by default and served at the `/marketplace` ingress path (service `marketplace`, port `5050`)
  - requires a dedicated Keycloak OAuth client, configurable via `global.marketplaceClientId` (default `marketplace`)
  - using the default Marketplace functions requires a valid license (see `global.license`)
  - session signing secret must be set via `marketplace.config.sessionSecret` (or referenced through `marketplace.config.existingSecret`)
- add optional **Marketplace bootstrap packages** to ship pre-built packages (`*.cba`) from the `marketplace-packages` image (see `marketplace.bootstrapPackages.*`)
  - `marketplace.bootstrapPackages.enabled` (default `false`) mounts the packages and sets `ECC_MARKETPLACE_BOOTSTRAP_DIR` to `marketplace.bootstrapPackages.path`
  - defaults to a read-only image volume (Kubernetes >= v1.33); set `marketplace.bootstrapPackages.fromInitContainer: true` to instead copy them via an initContainer (`marketplace.initContainer.bootstrapPackages.*`) on older clusters
  - new `marketplace-packages` image referenced from `Chart.yaml` annotations
- add `marketplace.config.licenseFile` to configure the license file path (`ECC_MARKETPLACE_LICENSE_FILE`) instead of a hard-coded value
- add `values.marketplace-standalone.yaml` example for running the Marketplace as a standalone service (all other components disabled)
- add per-component `additionalPodLabels` for `dataintegration`, `explore`, `graphinsights`, `marketplace` and `bootstrap`, merged on top of the existing `global.additionalPodLabels`
- add embedded DataIntegration/Build MCP (Model Context Protocol) server, exposed at `/dataintegration/mcp`
  - `dataintegration.config.mcp.enabled` (default `true`) toggles the endpoint
  - `dataintegration.config.mcp.readonly` (default `true`) restricts it to read-only tools
- Explore now registers a streamable MCP client pointing at Build's `/mcp` endpoint
- rework of custom CA certificate handling with new configurable directories for explore, dataintegration, graphinsights and marketplace:
  - `CACertDirectory`, `CACertDirectoryEmptyDirSizeLimit` and `customCACertDirectory`
  - `dataintegration.config.PythonCAFile` to overwrite `REQUESTS_CA_BUNDLE`/`SSL_CERT_FILE` for Python
- add `initContainer` sections (incl. `customCACerts`) for explore and graphinsights
- bootstrap now auto-toggles Explore default view features based on component enablement:
  - `enableCompanion` follows `explore.companion.enabled`
  - `enableGraphInsights` follows `graphinsights.enabled`
- add `.dataintegration.config.workspaceRepository.s3.additionalCustomConfig` to allow some additional S3 configs like endpoint
- New Explore companion LLM profiles for the current model generation, see docs

### Changed
- `global.license` now defaults to `cmem-license` (referencing a Kubernetes secret) instead of empty. Explore still falls back to the free PEDAL license, but Marketplace default functions require a license.
- DataIntegration/Build consolidates log, cache, data and config paths inside the container. This allow a couple of changes:
  - adding base path as ENV variables in configmap:
    - `DATAINTEGRATION_DATA: /data`
    - `DATAINTEGRATION_CACHE: /tmp/dataintegration`
    - `XDG_CACHE_HOME: /tmp/dataintegration`
    - `DATAINTEGRATION_LOGS: /data/logs/dataintegration`
    - `DATAINTEGRATION_CONFIG: /opt/build/config`
  - remove a couple of mountpoints, all summed in temp or data emptyDir/volume
- explore.cache renamed to explore.temp; default `explore.temp.cacheSize` raised from `1G` to `2G`
- `dataintegration.tmp` renamed to `dataintegration.temp` for consistency with `explore.temp`
- reworked JVM memory defaults (see `docs/2026-07-22-jvm-memory-flags-report.md`):
  - DataIntegration: `-XX:MaxRAMPercentage=60`, `-XX:MaxDirectMemorySize=1G` (was `80` / `2G`); default `dataintegration.resources` memory raised from `4700Mi` to `5Gi`
  - Explore: `-XX:MaxRAMPercentage=55`, added `-XX:MaxMetaspaceSize=384m -Djdk.nio.maxCachedBufferSize=262144` (was `70.0`)
- `dataintegration.tmp` reworked: removed `silkPath`, added `jvmTempFolder`, default `cacheSize` raised from `500M` to `10G`
- `dataintegration.initContainer.customCACerts.enabled` now defaults to `false` (was `true`)
- Explore `maxCBDDepth` moved from a top-level application-config key into `explore.config.applicationProxy` (proxy config); default reduced from `10` to `5`
- GraphInsights configuration tweaks: `logLevel` `DEBUG` → `info`, `appNameOverride` relocated into `semspect.core`, and `SERVER_FRAME_ANCESTORS` added
- standardize init container value keys across explore, graphinsights and marketplace:
  - `initContainer.extraContainers` renamed to `initContainer.customInitContainers` (the previous key was never read by the templates)
  - explore `initContainer.customCACert` renamed to `initContainer.customCACerts` (plural, matching the other components) and fleshed out with full defaults
- update Corporate Memory images to:
    - eccenca-explore v26.2.1
    - eccenca-cmemc v26.2.1
    - eccenca-dataintegration v26.2.0
    - eccenca-dataintegration-plugins v4.0.0
    - eccenca-marketplace v26.2.7
    - eccenca-marketplace-packages v1.0.0 (new)

### Removed
- remove the `dataintegration.cache` values block (`cacheBasePath`, `cacheSize`, `maxLinks`, `pvcenabled`, `storageClassName`, `existentPvc`); DI cache/temp is now driven by the consolidated container paths and `dataintegration.tmp`
- remove `global.initContainerResources`; DataIntegration init containers now use per-init-container `resources` under `dataintegration.initContainer.provisioningData`, `dataintegration.initContainer.pythonPluginImageInstall` and `dataintegration.initContainer.customCACerts`
- remove the shared `dataintegration.initContainer.securityContext`; each DataIntegration init container now has its own `securityContext` (under `provisioningData`, `pythonPluginImageInstall` and `customCACerts`), matching explore, graphinsights and marketplace

### Fixed
- add missing resource declaration in python-install-image init container of DataIntegration
- explore.config.applicationProxy allows override of proxy variable in application.yml for explore
- fix GraphInsights custom CA certificate init container never rendering (template read `customCACert` while values defined `customCACerts`)
- fix nil-pointer render error when a `securityContext` is set on the custom CA certificate init container (explore, graphinsights, marketplace)

## [5.8.1] 2026-07-21

### Added
- add `explore.config.additionalCustomConfig` to append custom YAML to the generated Explore application config


## [5.8.0] 2026-07-08

### Added
- add `extraManifests` to render additional Kubernetes resources with the chart

### Fixed
- fix duplicate pod checksum annotation names for Explore and DataIntegration config file ConfigMaps
- only render Explore and DataIntegration ServiceMonitor resources when the corresponding metrics endpoint is enabled
- quote generated Secret `stringData` values and avoid rendering empty `stringData` blocks
- fix Explore companion existing PVC rendering


## [5.7.0] 2026-06-24

### Changed
- configFiles are now in separate ConfigMaps to allow easier replacement
- secrets now can be replaced with own preconfigured secrets
- update Corporate Memory images to:
    - eccenca-explore v26.1.3
    - eccenca-graphinsights v19.2.1
    - eccenca-cmemc v26.1.3
    - eccenca-dataintegration-plugins v3.8.0

### Added
- configName parameter for Build and Explore to use own configfiles
  - `explore.config.configMapApplication`
  - `explore.config.configMapLogback`
  - `dataintegration.config.configMapApplication`
  - `dataintegration.config.configMapLogback`
- several secretName's to allow replacement
  - `explore.config.secret`
  - `dataintegration.config.secret`
  - `graphinsights.config.secret`
- extraContainers for bootstrap
- customMounts for explore, graphInsights and bootstrap
- customVolumes for explore, graphInsights and bootstrap
- extraConfigMap for dataIntegration, explore, graphInsights and bootstrap
- extraSecret for dataIntegration, explore, graphInsights and bootstrap
- customCommand for explore, graphInsights and bootstrap
- add variable to disable ServiceMonitor requirement if metrics are enabled:
  - `explore.config.metrics.serviceMonitor.enabled` defaults to true
  - `dataintegration.config.metrics.serviceMonitor.enabled` defaults to true

### Fixed
- fix explore liveness health check url by concat `explore.config.backendContextPath` + `Values.explore.probes.livenessProbe.path`
- fix explore readiness health check url by concat `explore.config.backendContextPath` + `Values.explore.probes.readinessProbe.path`

## [5.6.3] 2026-05-08

### Changed

- update Corporate Memory images to:
    - eccenca-explore v26.1.2
    - eccenca-graphinsights v19.2.1
    - eccenca-cmemc v26.1.2
    - eccenca-dataintegration-plugins v3.7.0
- automountServiceAccountToken can now be set in values for all pods, was only build before.
- name a specific service account similar as it is for build now available for all pods.
- build: workspace.provider.plugin can be changed in values file instead dataintegration.conf only

### Bugfix

- set defaults for graphinsights JAVA_TOOL_OPTIONS
- add missing automountServiceAccountToken for bootstrap

### Removed

- because of better implementation of getting system certitificates we no longer need:
  - bootstrap.architecture
  - bootstrap.default_ca_bundle_path
  - dataintegration.config.architecture
  - dataintegration.config.di_ca_bundle_path


## [5.6.2] 2026-04-22

### Changed

- more debug output while bootstrapping

### Bugfix

- fix ReportManager clause in dataintegration.conf lead to not properly set the path for writing reports
- in bootstrap job, in case of SSL_VERIFY=false, no certificates needs to get copied, and REQUEST_CA_BUNDLE does not need to change


## [5.6.1] 2026-04-16

### Bugfix

- fix default path of default_ca_bundle_path and di_ca_bundle_path


## [5.6.0] 2026-04-14

### Note

Announcement for an upcoming breaking change:
In the next Build / DataIntegration release we will refactor the paths and mounting points needed for Build to operate.
The easiest migration would be a full backup of your workspace and re-import after the upgrade.
We will provide a detailed migration guide with that release.

### Changed

- update Corporate Memory images to:
    - eccenca-dataintegration v26.1.0
    - eccenca-explore v26.1.1
    - eccenca-graphinsights v19.2.0
    - eccenca-cmemc v26.1.0
    - eccenca-dataintegration-plugins v3.6.2
- change in config: Explore 26.1 (CMEM-6693) requires `global.validPostLogoutRedirectUri` to be relative.
    Changed default to '/'
- removed Snowflake-specific config in `dataintegration.conf`, instead it can be set in values.yaml
    in `.dataintegration.config.sparksqloption`
- Build's Mapping Creator feature is now enabled by default
  - See `.dataintegration.config.mappingCreator.enabled`
- Build is now using Explore's LLM proxy as default. This simplifies configuration.
    Separate configuration is still possible.
    See `.dataintegration.config.mappingCreator`
- Since the Python environment changed in cmemc and DataIntegration, set `.bootstrap.default_ca_bundle_path` to empty
    string. See added `bootstrap.architecture`
- Since the Python environment changed in cmemc and DataIntegration, moved `.bootstrap.di_ca_bundle_path` to
    `dataintegration.config.di_ca_bundle_path` and set to empty string. See added `dataintegration.config.architecture`

### Added

- `bootstrap.architecture` defaults to `amd64` and needs to be changed if deployed in ARM64 environments,
    otherwise you will have problems injecting self-signed/custom certificates for cmemc and pip in Build
- `dataintegration.config.architecture` defaults to `amd64` and needs to be changed if deployed in ARM64 environments,
    otherwise you will have problems injecting self-signed/custom certificates for cmemc and pip in Build
- template functions `cmem.cmemc-ca-bundle-path` and `cmem.di-ca-bundle-path` which use `bootstrap.architecture` and
    `dataintegration.config.architecture` respectively to decide where to find the certifi package. Defaults to:
  - `"/usr/local/cpython-3.13-linux-x86_64-gnu/lib/python3.13/site-packages/pip/_vendor/certifi/cacert.pem"` for `amd64`
  - `"/usr/local/cpython-3.13-linux-aarch64-gnu/lib/python3.13/site-packages/pip/_vendor/certifi/cacert.pem"` for `arm64`
- Migration.md
- values-arm64.yaml override file for easy ARM64/Apple Silicon deployments

### Removed

- `.dataintegration.config.snowflake` in values.yaml. Use `.dataintegration.config.sparksqloption` instead.


## [5.5.4] 2026-02-25

### Changed

- update Corporate Memory images to:
    - eccenca-explore v25.3.4

### Added

- add AWS Bedrock llm gateways explore configuration for reference


## [5.5.3] 2026-02-16

### Changed

- update Corporate Memory images to:
    - eccenca-dataintegration v25.3.3
    - eccenca-explore v25.3.3
    - eccenca-graphinsights v19.1.2
    - eccenca-cmemc v25.6.1
    - eccenca-dataintegration-plugins v3.4.1


## [5.5.2] 2026-01-20

### Fixed
- add missing 'v' to Graphinsights version tag in Chart.yaml


## [5.5.1] 2025-12-19

### Changed

- update Corporate Memory images to:
    - eccenca-dataintegration v25.3.2
    - eccenca-explore v25.3.1
    - eccenca-graphinsights v19.1.1-2

### Fixed

- Graph Insights Configmap JAVA_TOOL_OPTIONS referred to .Values.explore
- added `config.javaToolOptions` which was missing before
- removed wrong `and` in Volume mount in explore-node.yaml


## [5.5.0] 2025-12-10

### Changed

- refactored Chart.yaml annotations.images structure: removed `list:` keyword from annotations, now added
  programmatically in template helper function
- added mountpath value to .Values.graphinsights.persistence which defaulted to `/data` before
- update Corporate Memory images to:
    - eccenca-cmemc v25.6.0
    - eccenca-dataintegration-plugins v3.2.0

### Added

- extraContainers for graphinsights and explore to allow running sidecars
- subPath support for all persistence configurations: allows specifying subPaths for dataintegration, explore companion,
  graphinsights, and graphinsights explore integration volumes


## [5.4.2] 2025-12-04

### Fixed

- if not .Values.dataintegration.config.mappingCreator.enabled the relevant section in dataintegration.conf is not rendered


## [5.4.1] 2025-12-03

### Changed

- bugfix, typo .Values.dataintegration.config.mappingCreator.enabled (CMEM-7177)
- update Corporate Memory images to:
    - eccenca-dataintegration v25.3.1

## [5.4.0] 2025-12-01

### Changed

- DI/BUILD configuration - BREAKING CHANGE: for `.Values.dataintegration.config.workspaceRepository` `file` is no longer supported, use `sharedFileRepository` instead
- BREAKING CHANGE: Changed `.Values.dataintegration.strategy` and `.Values.explore.strategy` to `.Values.dataintegration.updateStrategy` resp. `.Values.explore.updateStrategy` to align with spec of StatefulSets`.Values.dataintegration.additionalCustomConfig`
- images used in the chart are now correctly used from Chart.yaml, or can be overwritten in values.yaml
- by default enable explore swaggerui
    - See `Values.explore.config.springdocSwaggerUIEnabled`
    - See `Values.explore.config.springdocApiDocsEnabled`
- update Corporate Memory images to:
    - eccenca-explore v25.3.0
    - eccenca-cmemc v25.5.0
    - eccenca-dataintegration-plugins v3.1.0
    - eccenca-dataintegration v25.3.0
    - eccenca-graphinsights v19.1.0-1

### Added

- Explore companion:
    - it can be enabled in the values file. See `Values.explore.companion.enabled=false`, default off.
    - companion requires LLM configuration in yaml syntax in `Values.explore.companion.config`
    - persistence requires a volume, configured to create on the fly or as predefined volume. See `Values.explore.companion.persistence`
- DataIntegration Mapping Creator settings
    - See `Values.dataintegration.config.mappingCreator`
- Graph-Insights configuration: default to disabled
    - See `Values.graphinsights`

## [5.3.4] 2025-10-29

### Changed

- update Corporate Memory images to:
    - EXPLORE_VERSION v25.2.6


## [5.3.3] 2025-10-28

### Changed

- update Corporate Memory images to:
    - EXPLRE_VERSION v25.2.5


## [5.3.2] 2025-10-06

### Changed

- update Corporate Memory images to:
    - EXPLRE_VERSION v25.2.3


## [5.3.1] 2025-09-08

### Changed

- update Corporate Memory images to:
    - DI_VERSION v25.2.2


## [5.3.0] 2025-08-28

### Changed

- update Corporate Memory images to:
    - EXPLRE_VERSION v25.2.2
    - DI_VERSION v25.2.1

### Added

- DI/BUILD configuration - introduced  value dataintegration.tmp.silkPath for adjusting silk temporary path, was fixed mount path before
    - fixed silk operators can't write temporary files
- automountServiceAccountToken for DI/Build configurable in values, default to false
- add serviceAccount value section for DI/Build, defaults to disabled

## [5.2.1] 2025-08-11


### Changed

- update Corporate Memory images to:
    - EXPLRE_VERSION v25.2.1


## [5.2.0] 2025-08-03


### Changed

- update Corporate Memory images to:
    - EXPLRE_VERSION v25.2
    - DI_VERSION v25.2
    - CMEMC_VERSION v25.4

### Added

- DI/Build initContainer securityContext at .Value.dataintegration.initContainer.securityContext
- DI/Build initContainer CustomCA option to disable this container. Enabled by default.
- eccenca-dataintegration-plugins option

### Fixed

- selfsigned SSL certs REQUESTS_CA_BUNDLE for DI/Build


## [5.1.1] 2025-06-13

### Fixed

- dataintegration.customCommand typo
- dataintegration.customVolumes wrong indentation
- missing extra container definition, e.g sidecar
- Python (cmempy) custom ssl cert handling for DI pod. (CMEM-6671)

## [5.1.0] 2025-05-21


### Fixed

- Setting `tolerations` does now take effect for explore and datatintegration

### Added

- Allow for [IAM roles for service accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) for DI connecting to S3 by not setting `accessKeyId` and `secretKey`
- Allow for setting `nodeSelector`, `tolerations` and `affinity` for bootstrap job
- custom Method for Build/DataIntegration to allow overwrite with values files
  - customInitContainer
  - customVolumeMounts
  - customCommand
- Python plugins now can be installed with docker-registry.eccenca.com/eccenca-dataintegration-plugins, default to false


## [5.0.2] 2025-05-21

### Changed

- update Corporate Memory images to:
    - EXPLRE_VERSION v25.1.1
    - DI_VERSION v25.1.1
    - CMEMC_VERSION v25.1.1

### Added

- Value.global.validPostLogoutRedirectUri defaults to http(s)://deployhost
    - this is used in DI and EXPLORE configmaps
    - this is added to to fix the logout issue coming with Keycloak v26 when enforcing validPostLogoutRedirectUri

## [5.0.1] 2025-04-28

### Fixed

- remove debug output


## [5.0.0] 2025-04-22

### Changed

- update Corporate Memory images to:
    - EXPLRE_VERSION v25.1.0
    - DI_VERSION v25.1.0
    - CMEMC_VERSION v25.1.0

### Added

- bootstrap now also uses customCACerts provided if provided by user
- allow overwriting the keycloak oauth redirect URL (for DI only) (workaround for CMEM-6591)
- support prometheus service monitors for scraping prometheus metrics

### Fixed

- di-configmap: PYTHON_PATH variable correctly renamed to PYTHONPATH
- Build/Di: introduce variables for requestTimeout and idleTimeout (OPS-3173)

## [4.0.2] 2025-02-12

### Changed

- update Corporate Memory images to:
    - CMEMC_VERSION v24.3.2
    - DI_VERSION v24.3.1

## [4.0.1] 2025-01-16

### Changed

- update Corporate Memory images to:
    - CMEMC_VERSION v24.3.1

## [4.0.0] 2024-12-19

### Changed

- merge DataPlatform and DataManager into Explore
- change Deployments to StatefulSets
- update Corporate Memory images to:
    - EXPLRE_VERSION v24.3.0
    - DI_VERSION v24.3.0
    - CMEMC_VERSION v24.3.0

## [3.4.0] 2024-12-04

### Added

- DI: allow to use an already existent PVC for dataintegration (default: false)
- DI: allow configuring the [Execution Report Manager](https://documentation.eccenca.com/latest/deploy-and-configure/configuration/dataintegration/#execution-report-manager)
- update Corporate Memory images to:
    - DM_VERSION v24.2.3

## [3.3.0] 2024-09-24

### Added

- DI: allow config to be extended with additional custom configuration

## [3.2.4] 2024-09-20

### Changed

- update Corporate Memory images to:
    - DP_VERSION v24.2.1
    - DM_VERSION v24.2.1

## [3.2.3] 2024-09-11

### Changed

- bootstrap: do not fail on warnings, only on errors

### Added

- option to block incoming traffic on `/dataintegraion/api/python/installPackage*`


## [3.2.2] 2024-08-22

### Changed

- added `cmemc admin store migrate --workspaces` to the bootstrap job


## [3.2.1] 2024-08-15

### Changed

- add `/root/.silk` to tmp emptyDir definition. Needed if use readOnlyRootFilesystem: true
- tmp dir path is no longer configurable, mounted at `/tmp` and `/root/.silk`


## [3.2.0] 2024-08-14

### Added

- extend bootstrap job with capability to manage (install/upgrade) [Python Plugins](https://documentation.eccenca.com/latest/develop/python-plugins/) (DI)
- added provisioning for DI data volume (CMEM-5874)

### Changed

- snowflake-jdbc jar version 3.16.0
- update release images
    - DM v24.2.0
    - DP v24.2.0
    - DI v24.2.1
    - CMEMC v24.2.0

### Removed

- Stardog support


## [3.1.2] 2024-08-13

### Changed

- update release images
    - CMEMC v24.1.5
- fix usage of security context for DI deployment, therefore adding a `/tmp` emptyDir mount


## [3.1.1] 2024-04-31

### Changed

- update release images
    - DI v24.1.2
    - CMEMC v24.1.2


## [3.1.0] 2024-04-30

### Added

- Helm chart annotations for images to be used by the [Helm Distribution plugin](https://github.com/vmware-labs/distribution-tooling-for-helm) as defined per [Creating an images lock](https://github.com/vmware-labs/distribution-tooling-for-helm?tab=readme-ov-file#creating-an-images-lock)
- Configuration for Snowflake JDBC driver (DI)
- ingress: add CORS settings but left uncommented

## [3.0.5] 2024-04-16

### Changed

- update release images
    - DM v24.1.3
    - DP v24.1.2
    - DI v24.1.1
    - CMEMC v24.1.1

## [3.0.4] 2024-04-02

### Changed

- update release images
    - DM v24.1.2


## [3.0.3] 2024-03-25

### Changed

- update release images
    - DM v24.1.1
    - DP v24.1.1


## [3.0.2] 2024-03-06

### Changed

- DI: fixes path generation for logFolder and cache (quotes were wrong)


## [3.0.1] 2024-03-06

### Changed

- fixes name of DI cache variable in values file
- merge 3 dataintegration caches together as one and make them configurable in values
  - for java.io.tmpdir
  - for dataintegration-internal-cache
  - boot logging
- value to decide if cache is an emptyDir (default) or a PVC. StorageClass can be edited.
- fix the file permissions of the truststore by init-containers (DI/DP) in case of a custom CA cert

### Bug identified

- bootstrap job fails though job completed successful with GraphDB free (fixed in next DP patch version v24.1.1)

## [3.0.0] 2024-02-21

### Changed

- Changed default service port to 8080 for all services, therefor also introduce some configMap entries
- set `readOnlyRootFilesystem` for DM, DP, DI and bootstrap. Therefore introduce some volumes for java-processes as emptyDir type
- for DI,DM,DP, bootstrap set
  - automountServiceAccountToken: false
  - allowPrivilegeEscalation: false
- for DM,DP, bootstrap set
  - runAsNonRoot: true
- `datamanager.cache`, `dataintegration.cache`, `dataplatform.cache` is now added to JAVA_OPTs as -Djava.io.tmpdir= as emptyDir volume
- since now using temp volumes, deploy strategy needs to of type: Recreate
- now use cmemc image for bootstrapping and update bootstrap.sh script
- always run bootstrap after running helm update, but disable updating admin user by default


### Removed

- removed fileAppender in DIs logback.xml


## [2.5.0] 2024-02-19

### Changed

- Changed default service port to 8080 for all services
- set `readOnlyRootFilesystem` for DM, DP, Bootstrap, therefore introduce a temp volume for java-processes (DP already there), DI still missing
- for DI,DM,DP set
  - automountServiceAccountToken: false
  - allowPrivilegeEscalation: false
- for DM,DP set
  - runAsNonRoot: true
- since now using temp volumes, deploy strategy needs to of type: Recreate
- now use cmemc image for bootstrapping and update bootstrap.sh script

### Added

- add option to allow for custom CA certs to be injected/added to the Java TrustStore of DI and DP, allowing for TLS-based communication to keycloak with custom CA cert (chain) (see `global.customCACerts` and `global.initContainerResources`)
- add option to append to pod labels (see `global.additionalPodLabels`)
- add option to set global variables for DI (see `dataintegration.config.globalVariables`)
- add serverPort configuration for DI/DP/DM and set to 8080 as default
- add `dataintegration.extraHosts` and `dataplatform.extraHosts` to allow configuration of static IP/Hostnames
- add `datamanager.cache`,`dataintegration.cache`,`dataplatform.cache` to allow mounting empty volumes, eg. used for mounting `java.io.tmpdir`, and also when `readOnlyRootFilesystem`
- add default values for podSecurityContext and securityContext for DM, DP, bootstrap
- add plugin scripting python section for DI
- add extraHosts for DI/DP deployments, and bootstrap job to allow running on localhost

### Removed

- removed fileAppender in DIs logback.xml
- remove some default values in dp-application.yml

### Changed

- set `eccencaDataPlatform.writeGraphType = true` by default (aligned with defaults on cmem-orchestration)
- update release images
    - DI v24.1.0
    - DM v24.1.0
    - DP v24.1.0


## [2.4.1] 2023-12-06

### Changed

- update release images
    - DI v23.3.1

## [2.4.0] 2023-11-16

### Changed

- update release images
    - DP v23.3.0
    - DM v23.3.0
    - DI v23.3.0
- BREAKING CHANGE: change dataplatform oauth2 client config to adjust for spring boot update (CMEM-5171)
  - spring.security.oauth2.client.registration.keycloak.client-authentication-method: basic -> client_secret_basic
  - removed this from configuration-files/dp-application.yml and added as ENV in dp-configmap.yaml
- BREAKING CHANGE: remove dataplatform property authorization.abox.prefix from configuration (CMEM-5227)
  - deployments which still set this property will fail on DP startup
- with DP 23.3 comes improved liveness/readyness checks. Constant database checks are disabled now by default
- add possibility to configure affinity to all DI/DM/DP pods
- allow custom env vars for DM
- add possibility to configure max upload file size for DI

## [2.3.2] 2023-11-16

### Changed

- add option to add a volume for DP usage java temp dir

## [2.3.1] 2023-09-04

### Changed

- update DP to v23.2.1
- update DI to v23.2.1

## [2.3.0] 2023-08-15

### Changed

- update DM to v23.2.0
- update DP to v23.2.0
- update DI to v23.2.0
- update bootstrap container to v1.5.0

### Added

- allow for setting additional env vars within the ConfigMap of both DI & DP
- move accesskey and secretkey to secrets so they don't appear within the configmap
- allow configuring resource repository workspace storage

## [2.2.4] 2023-07-21

### Added

- allow for setting the update strategy for all cmem applications

## [2.2.3] 2023-07-18

### Added

- allow storing resource repositories in S3 for DataIntegration (based on [S3 Bucket, Project Specific - projectS3](https://documentation.eccenca.com/23.1/deploy-and-configure/configuration/dataintegration/?h=resource+repo#s3-bucket-project-specific-projects3))

## [2.2.2] 2023-07-04

### Added

- bootstrap job allows for setting resource section

## [2.2.1] 2023-06-08

### Changed

- update DM v23.1.5
- update DP v23.1.3

## [2.2.0] 2023-05-24

### Changed

- for bootstrap job, make activeDeadlineSeconds and ttlSecondsAfterFinished customizable
- update images: DI 23.1.2 (with some fixes)

## [2.1.0] 2023-05-08

### Changed

- update images: DP 23.1.2, DM 23.1.4
- update the health check extended fail threshold
- update the health check reduce check time until healthy
- refactor bootstrap mechanism and create separate configMap
- option to overwrite bootstrap configMap in values

## [2.0.1] 2022-04-28

### Changed

- update images: DP 23.1.1, DI 23.1.1, DM 23.1.3

## [2.0.0] 2022-04-26

This release is our first release based on cmem 23.1 release and comes with few breaking changes.

### Added

- more comments in our Helm values file `values.yaml`
- sample Helm values file `values.sample.yaml` with minimal required configuration
- bootstrap job image is now configurable
- allow user to enable/disable deployment of the imagePullSecret
- basic Gitlab CI job for `helm lint`

### Changed

- DI/DM/DP images from 23.1 release
- oauth client id changed from `dataintegration` to `cmem` (configurable)
- DP & DI configuration adapted for 23.1 release
- increase `proxy-body-size` for ingress to allow for larger upload of data for users
- enable ssl-redirect for ingress by default

### Removed

- DataManager configuration (part of 23.1 release)

## [1.1.0] 2022-04-25

Starting with this release, we switch over to the new Helm Chart Release versioning (see README Section "Releases and Compatibility matrix").

### Changed

- update images: DP 23.1.2, DM 23.1.4
- update the health check extended fail threshold
- update the health check reduce check time until healthy
- refactor bootstrap mechanism and create separate configMap
- option to overwrite bootstrap configMap in values

## [2.0.1] 2022-04-28

### Changed

- update images: DP 23.1.1, DI 23.1.1, DM 23.1.3

## [2.0.0] 2022-04-26

This release is our first release based on cmem 23.1 release and comes with few breaking changes.

### Added

- more comments in our Helm values file `values.yaml`
- sample Helm values file `values.sample.yaml` with minimal required configuration
- bootstrap job image is now configurable
- allow user to enable/disable deployment of the imagePullSecret
- basic Gitlab CI job for `helm lint`

### Changed

- DI/DM/DP images from 23.1 release
- oauth client id changed from `dataintegration` to `cmem` (configurable)
- DP & DI configuration adapted for 23.1 release
- increase `proxy-body-size` for ingress to allow for larger upload of data for users
- enable ssl-redirect for ingress by default

### Removed

- DataManager configuration (part of 23.1 release)

## [1.1.0] 2022-04-25

Starting with this release, we switch over to the new Helm Chart Release versioning (see README Section "Releases and Compatibility matrix").

### Added

- checksum for secrets on deployments (so pods get restarted if secrets change)
- allow for Helm-templating of all configuration files
- [NOTES.txt](https://helm.sh/docs/chart_template_guide/notes_files/) with basic post-installation notes shown to the user

### Changed

- container names should not depend on the Chart name; will affect metrics and logs (best-practice: static name)
- remove `kube-version/major` and `kube-version/minor` labels (misleading and not used; helm labels would not get updated with new k8s update anyway)
- fix checksum for configs on deployments (so pods get restarted if config changes)
- fix indentation for better readability
- only set `resources` if set in values file
- increase default memory limits (commented out though)
- recommendation to not use CPU limits (see also https://home.robusta.dev/blog/stop-using-cpu-limits)
- split secrets and volumes YAMLs to separate files for product components
- fix deployments without persistence/volume had reference to non-existent pvc
- unify and refactor labels to match best-practices (see also https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/#labels)
- change `data` to `stringData` for secrets, so we can get rid of base64-function in this chart, and `helm template` will work with default `values.yaml`
- eccenca CMEM license can now be injected properly (see documentation in README.md)
- Datamanager version `22.2.3`

### Removed

- removed kind from resource name (e.g. bad practice to have a deployment with name `<name>-deployment`; best-practice: `<name>`)
- value option `dataplatform.secret`( as no need (yet) for having users deploy their own secret unmanaged by the chart)
- volume for DataPlatform logs (obsolete, as DP now logs to stdout)

## [v22.2.2] 2022-02-01

### Changed

- update CMEM DP & DM to latest patch release `22.2.2`
- enable logging in `json` format for DI & DP

## [v22.1.0] 2022-11-07

### Added

- First release version based on CMEM `22.1.0`