NetBox Enterprise Release Notes

NetBox Enterprise 2.4.x

2.4.0

NetBox Enterprise 2.4.0 moves NetBox core to 4.7.1 and Embedded Cluster to Kubernetes 1.35. Both moves need attention before you upgrade: NetBox 4.7 carries breaking changes, and Embedded Cluster hosts must now run cgroup v2. The release addresses findings from a 2026 third-party penetration test. Anonymous access to NetBox is now off by default, NetBox worker pods no longer hold credentials they do not use, and support bundles mask most credentials passed as command-line flags. The backups of the built-in database can no longer fill the disk unnoticed: their retention and schedule are now configurable, and status reports when the backup repository runs short of space. The netbox-secrets and NetBox Healthcheck plugins are no longer included. Read the Upgrade Notes before you upgrade.

Versions

This release uses the following upstream software:

• NetBox 4.7.1
• Diode Pro 2.3.0
• PostgreSQL 16.14, 17.10 or 18.4 (if the built-in database is enabled, via PostgreSQL Operator 6.0.2 and pgBackRest 2.58.0)
• Redis 7.4.8 (if built-in Redis is enabled, via Redis Operator 0.26.0)
• Traefik v3.7.1 (Embedded Cluster gateway)
• nbe-operator Chart 2.4.0
• Embedded Cluster 2.19.9 (Kubernetes 1.35.6)

Plugin updates since 2.3.0:

• netbox-acls 2.1.0 (was 2.0.1)
• netbox-bgp 0.20.0 (was 0.19.0)
• netbox-enterprise-plugin 0.2.8 (was 0.2.7)
• netbox-floorplan-plugin 0.10.0 (was 0.9.2)
• netbox-inventory 2.6.1 (was 2.6.0)
• netbox-ndx-plugin 0.8.0 (was 0.5.0)
• netbox-qrcode 1.0.0 (was 0.0.21)
• netbox-turbobulk 0.4.1 (was 0.2.1)
• netbox-validity 3.6.0 (was 3.5.2)
• netboxlabs-diode-netbox-plugin 1.17.0 (was 1.14.1)
• netboxlabs-netbox-asset-lifecycle 0.3.1 (was 0.3.0)
• netboxlabs-netbox-assurance-plugin 1.6.0 (was 1.5.4)
• netboxlabs-netbox-branching 1.2.1 (was 1.0.4)
• netboxlabs-netbox-changes 1.1.3 (was 1.0.1)
• netboxlabs-netbox-custom-objects 0.7.0 (was 0.5.1)
• slurpit_netbox 1.4.4 (was 1.3.30)
• netbox-secrets and netbox-healthcheck-plugin are removed. See Upgrade Notes.

This list shows only plugins whose versions changed in 2.4.0. See the Plugins table below for the full set included in this release.

Features

• Built-in database backups can no longer fill the disk unnoticed. Two new options in the PostgreSQL group of the Admin Console, shown when the built-in database is enabled, control how much disk the pgBackRest backup repository uses. Full Backups to Keep sets how many full backups are kept, from 2 to 255, and defaults to 4. Full Backup Schedule takes a five-field cron schedule and defaults to Sundays at 01:00. A busy database uses less disk with more frequent full backups, because less change log is kept between them; for example, 0 3 * * * takes one every night at 03:00. The incremental backup runs at 01:00 Monday to Saturday, so a custom schedule should avoid 01:00: PGO does not run two backups at once. Helm installs set the same values as netboxEnterprise.spec.postgresql.backups.retentionFull and netboxEnterprise.spec.postgresql.backups.fullSchedule (NBE-3129). See Repository size and retention.
  • A new PostgresBackupRepoPressure status condition reports when the filesystem that holds the backup repository is 70% full or more, or when the repository has outgrown its storage request. An hourly check feeds it, and an event is recorded each time it changes. It does not affect Ready. See Status Conditions.
  • Lowering Full Backups to Keep frees disk only after the next backup runs, or after you run pgbackrest expire. See Free space now.
  • If you set retentionFull earlier with kubectl patch, leaving Full Backups to Keep empty keeps that value. Setting a different value there fails the deploy with a field-manager conflict until you remove the field manager of the earlier patch. See Change the retention or the full-backup schedule.
• Configuration changes that cannot affect the database schema no longer run NetBox migrations. Changing settings such as the secret key, email password, allowed hosts, Redis, storage, metrics, or LDAP, OIDC and SAML authentication now restarts NetBox without running the migration Job first. Changes to the Python configuration overrides, plugins, the superuser, and the database name, user, host or port still run it. Editing the ConfigMap named by customPythonConfigRef in place now runs it too, and customPythonConfigRef.optional: true is now honored (NBE-1883).

Security

• NetBox worker pods no longer receive credentials they do not use. Worker pods no longer mount a Kubernetes service account token, and no longer receive the superuser password or API token. The netbox Role and RoleBinding, which nothing used, are no longer created; on an upgraded install the existing ones stay, but no pod can use them. Worker pods restart once during the upgrade (NBE-2123).
• Embedded Cluster: guidance on the HTTPS certificate. The gateway's HTTPS certificate has two gaps, and installing a certificate closes only one. Until you install your own certificate, clients that use your DNS name get a self-signed placeholder that does not match that name. Clients that connect by node IP address, or send no matching name, get the gateway's own self-signed default certificate, whatever certificate you install. Install a certificate for the name your users use on the Admin Console's TLS page, and have them reach NetBox only by that name, never by IP address. The NetBox Configuration group of the Admin Console and a new HTTPS Certificate on Embedded Cluster preflight now explain this. The preflight cannot read the certificate in place, so it shows on every Embedded Cluster install, including one that already has a certificate. It always passes, so it does not block a headless install. The NetBox Hostname help text is corrected: on Embedded Cluster the hostname does not change the certificate (NBE-2125, NBE-3074). See TLS.
• Leftover Diode OAuth2 bootstrap pods are deleted. Before 2.3.0, the logs of the hydra-oauth2-bootstrap pods held the Diode OAuth2 client secrets in plain text. The operator now deletes those finished pods, so the logs no longer stay on the cluster. Logs already collected elsewhere, and support bundles already sent, still hold the secrets, and this release does not rotate them. If this install was first set up before 2.3.0 and a support bundle from it was shared outside your organization, or your pod logs are sent to an external store, contact NetBox Labs support to rotate the Diode OAuth2 client secrets. Rotation replaces the Diode OAuth2 clients, so connected Diode clients stop authenticating until they receive the new secrets (NBE-2223).
• Support bundles mask credentials passed as command-line flags. In every file a support bundle collects, the value after a flag whose name ends in password, passwd, passphrase, secret or token, or in api-key, access-key, private-key, secret-key or auth-key, such as --admin-console-password, is now masked, and so is an Embedded Cluster join token. Flags that name where a credential is kept, such as --password-file, --secret-name or --token-ttl, are left readable on purpose, and so is a flag ending in a bare key, such as --license-key. In an unquoted value that contains spaces, the text after the first space can stay readable. Bundles collected before the upgrade are not masked after the fact (NBE-3099).

Bug Fixes

• Media uploads to buckets with ACLs disabled work. With External S3-Compatible Storage or In-Cluster Object Storage, NetBox sent private as the default ACL on every upload, and buckets with ACLs disabled, such as Google Cloud Storage with uniform bucket-level access, rejected the upload with HTTP 400 InvalidArgument. NetBox no longer sends an ACL; files stay private through presigned URLs. If you added a Python configuration override to work around this, you can remove it (NBE-2485).
• An out-of-memory kill is named in status. When a NetBox container is killed for running out of memory, status now says so, for example container 'netbox' last terminated OOMKilled (exit code 137, memory limit 1500Mi), instead of only CrashLoopBackOff. The default NetBox Resources preset is unchanged. If you enable many of the included community plugins and NetBox runs out of memory on the default Regular preset, choose Large (NBE-3109).
• The Diode address shown in NetBox is one a client can reach. On Embedded Cluster, and on any install that routes through the Gateway API, the NetBox UI showed grpcs://<host>/diode. It now shows grpcs://<host>, the address the gateway serves. Use the new address for new Diode clients. A wildcard host is no longer displayed (NBE-2256).
  • Helm installs using an Ingress class other than nginx, such as the AWS Load Balancer Controller, no longer receive the Diode and Copilot Ingress objects, and the operator deletes the ones an earlier release created. Those classes cannot route them, and on AWS they stopped the whole Ingress group, taking NetBox down with it. On those classes, reach Diode and Copilot through the Gateway API instead. See Ingress and TLS.
• Faster recovery after a database restore. After a restore, the operator now checks for the missing NetBox migration state within seconds of starting again, instead of up to 5 minutes later, and runs the migration again sooner (NBE-3037).
• Startup waits stop on time. The init containers that wait for PostgreSQL, Redis, Hydra, HTTP services and migrations now stop when their time budget runs out, measured on the clock instead of by counting attempts, and report how long they waited and the last error they saw. The operator reports these as waits for a dependency, not as failures. NetBox workers check whether NetBox is ready every second instead of every 5 seconds, and their wait is bounded by spec.netbox.migrationTimeout (default 3600 seconds) (NBE-2935, NBE-2758).
• A failed restore Job says what to do next. The PostgresRestoreFailed condition fires on the first failed restore pod, and its message now tells you how to read it. It gives the command to check the restore Job: if the Job is still Running, it has attempts left and may still succeed; if it has Failed, nothing restarts it, and the message points to the recovery steps. It also names a network fault to the backup repository as a possible cause. Recovery from a Failed Job is still a manual step (NBE-2767). See Restore fails in a loop.
• Helm installs: a failed S3 wheelhouse download no longer stops NetBox. When spec.netbox.config.plugins.wheelhouse.s3 is set and the download fails, NetBox now falls back to the wheelhouse in the media directory instead of exiting. The download is now bounded at 10 minutes in total, so a slow or unreachable S3 endpoint no longer holds startup indefinitely (NBE-2220, NBE-1635).
• Appliance: high-availability clusters can be joined. The appliance firewall blocked the ports that cluster nodes use to reach each other, so a second or third node failed host preflights and could not join. On first boot the appliance now opens those ports to the other nodes on its own subnet. Nodes on different subnets still cannot join each other. This applies only to appliances deployed from 2.4.0 images. An existing appliance keeps the firewall rules it was first booted with; to open the ports on one, contact NetBox Labs support (NBE-2877). See Ports between cluster nodes.
• Custom plugin wheelhouses built with the 2.4.0 constraints keep the included NetBox Labs plugins. A custom plugin that depends on one of the NetBox Labs plugins included in this release could pull a newer release of that plugin into your wheelhouse, one that does not support this NetBox version, and the newer release then replaced the included one. The NetBox Labs wheelhouse build script now pins the versions of the included plugins. The protection is in the build, not the install: NetBox Enterprise installs whatever versions your wheelhouse holds. If you build a custom wheelhouse, contact NetBox Labs support for the 2.4.0 constraints and rebuild it with them (NBE-3001).
• Preflight checks and support bundles report problems they used to hide. Nine certificate preflight checks, and the IPv6 loopback and unprivileged port host preflights, passed when they collected nothing; they now warn or fail. In support bundles, an in-pod Django check that cannot import a wheelhouse plugin is now reported as a warning, not an error, and a database probe rejected because the endpoint is read-only or a replica is now reported as that, not as a stall (NBE-2221, NBE-2177, NBE-2222).

Upgrade Notes

• Embedded Cluster moves to Kubernetes 1.35, and hosts must run cgroup v2. Embedded Cluster moves from 2.18.1 (Kubernetes 1.34) to 2.19.9 (Kubernetes 1.35.6). Kubernetes 1.35 does not run on a cgroup v1 host, so on such a host both a new install and the upgrade fail. No NetBox Enterprise preflight warns about this before the upgrade starts. Before you upgrade, run stat -fc %T /sys/fs/cgroup/ on every node: it must print cgroup2fs. RHEL and Rocky Linux 8, Oracle Linux 8 and Ubuntu 20.04 can use cgroup v1 by default and must be switched to cgroup v2 first. RHEL 7 cannot run cgroup v2 and is not supported. Helm installs are not affected (NBE-2954). See Enable cgroup v2.
  • Embedded Cluster upgrades Kubernetes one minor version at a time. The last release on Kubernetes 1.34 is 2.3.0, and it is a required release. An Embedded Cluster install on an earlier release upgrades to 2.3.0 first, then to 2.4.0.
• The "Configure NetBox to Use Proxies" option is removed. It has had no effect since 2.0.0. Proxy settings still reach every NetBox pod as HTTP_PROXY, HTTPS_PROXY and NO_PROXY. No action is needed (NBE-2328).
• NetBox core moves to 4.7.1. This is a minor upstream release, not a patch, and it carries breaking changes. Read the NetBox v4.7.0 release notes before upgrading (NBE-2716).
  • The config-context cache starts empty. NetBox 4.7 adds a pre-rendered config-context cache. The NetBox Enterprise upgrade does not fill it, so the upgrade takes no longer because of it. When you read an object that has no cache entry, NetBox renders its config context at that time, so NetBox is correct either way. To fill the cache, run manage.py rebuild_config_context_cache in a NetBox pod after the upgrade. The command skips objects that already have an entry, so it is safe to stop and run again.
  • The database now needs the ltree extension. NetBox 4.7 stores hierarchies (regions, site groups, locations, device roles, platforms, tenant groups, contact groups, wireless LAN groups, module bays and inventory items) in a PostgreSQL ltree column instead of django-mptt. The built-in database provides this and installs it automatically. If you run external PostgreSQL, the role NetBox connects with must be able to run CREATE EXTENSION ltree, or the upgrade fails. ltree is a trusted extension and does not require superuser permission. See External Database.
  • External PostgreSQL must be 15 or later, and external Redis 6.0 or later. NetBox 4.7 drops PostgreSQL 14 and Redis 5.x. The built-in database and cache are already above both floors and need no action. NetBox 4.6 reported an old PostgreSQL as a warning; 4.7 stops the database migration.
  • Application service ports changed shape. The separate protocol and ports fields on services and service templates are replaced by a single port_mappings field, so one service can now expose the same port on several protocols. The REST API still accepts the old pair on write and still returns it, but some filter lookups it supported (protocol__ic, protocol__isw, protocol__empty, port__empty) are gone.
  • Selection custom fields now return an object, not a bare value. The REST and GraphQL APIs return {"value": "datacenter", "label": "Data Center"} where they previously returned "datacenter". Writes still accept the bare value. Check any integration that reads these fields.
  • Let the background queues drain before upgrading. Any webhook job still queued when the workers restart will fail.
  • Custom scripts run through the REST API now need a token with write access enabled, and the API no longer lets a client choose the plaintext value of an API token.
  • This upgrade restarts NetBox pods and runs database migrations.
• The netbox-secrets plugin is no longer included. NetBox Labs withdrew its certification of netbox-secrets on 2026-09-22 because of an unpatched public security advisory, and no release of it supports NetBox 4.7, so NetBox Enterprise 2.4.0 no longer ships it (NBE-2716).
  • If you use netbox-secrets, retrieve any secrets you still need before you upgrade. After the upgrade the plugin is not loaded, so its pages and API endpoints are gone. Its database tables are left in place and do no harm.
  • If netbox_secrets is listed in PLUGINS in the NetBox Python Configuration Overrides field, NetBox still starts: the plugin is skipped and the NetBox logs say Skipping plugin 'netbox_secrets': netbox-secrets is no longer included from NetBox Enterprise 2.4.0. Remove it from PLUGINS and PLUGINS_CONFIG to silence the warning.
• Anonymous access to NetBox is now disabled by default. NetBox Enterprise previously overrode the NetBox LOGIN_REQUIRED default, letting unauthenticated callers reach several endpoints. That override is removed, so NetBox Enterprise now inherits the upstream default of requiring authentication. Upstream NetBox has deprecated LOGIN_REQUIRED and removes anonymous access entirely in v5.0, so this brings NetBox Enterprise in line with upstream rather than adding a NetBox Enterprise restriction. There is no Admin Console option to re-enable anonymous access. Python configuration overrides load after the shipped configuration, so a LOGIN_REQUIRED = False line there still takes effect and keeps these endpoints open (NBE-2126).
  • After upgrading, these stop responding to unauthenticated requests. Anything reading them without credentials needs an API token or a session: /graphql/, which previously returned the full GraphQL schema to any caller and was the finding that prompted this change, and /api/status/, commonly scraped by monitoring. /search/, /, and, on the default Pvc storage backend, /media/ redirect to the login page instead, so any page or tool that links to media by URL is affected.
  • /graphql/ answers differently depending on the Accept header, and it is the only endpoint here that does. A request sending Accept: application/json receives 403; one sending Accept: text/html, or the */* that the curl command sends by default, receives a 302 to the login page. Both mean the gate is working. If you test with a plain curl command and expect a 403, the change looks like it did not land.
  • The object REST API already required authentication under the shipped default and is unaffected. If you set EXEMPT_VIEW_PERMISSIONS yourself to allow anonymous reads, those reads now require authentication too: LOGIN_REQUIRED gates the request before view permissions are consulted, so the exemption no longer applies. Check your Python overrides for both LOGIN_REQUIRED and EXEMPT_VIEW_PERMISSIONS before upgrading.
  • To close these endpoints while you stay on an earlier release, see Known Issues.
  • This upgrade restarts NetBox pods.
• The NetBox Healthcheck plugin is removed from this release. netbox-healthcheck-plugin 0.3.0 does not load on NetBox 4.7, and no compatible release of it exists yet, so 2.4.0 does not ship it. It is planned to return in 2.5.0 (NBE-3103).
  • If you added netbox_healthcheck_plugin to PLUGINS in NetBox Python Configuration Overrides, no action is needed to upgrade. NetBox Enterprise skips the entry at startup and prints a warning. Remove the entry to silence the warning. Supplying the plugin yourself is not a workaround: NetBox Enterprise keeps the entry when the package is present, and 0.3.0, the only published release, still fails to load on NetBox 4.7.
  • Its PLUGINS_CONFIG entry, if you have one, is skipped with it. Nothing else in your configuration can load the plugin: an INSTALLED_APPS line in the overrides has no effect, because NetBox builds that list itself.
  • Nothing else in NetBox Enterprise uses the plugin. If it was not in your PLUGINS, no action is needed.

Known Issues

• A plugin enabled before its wheelhouse is uploaded leaves a failed migration. If you add a plugin to PLUGINS in NetBox Python Configuration Overrides before you upload its wheelhouse (the archive of Python wheels that NetBox Enterprise installs your own plugins from) to the NetBox media directory, the migration fails. After you upload the wheelhouse, deploying the same configuration again does not retry the migration. Changing the configuration back to an earlier value and then forward again does not retry it either. To retry, change NetBox Python Configuration Overrides to a value you have not deployed before, such as adding the line # retry 1, then deploy. The new migration uses the uploaded wheelhouse. Leave the line in place: it has no effect on NetBox, and removing it is another configuration change that runs one more migration and restarts the NetBox pods. If that migration also fails, fix the cause, then use a new value again, such as # retry 2 (NBE-3128).

  • While the migration stays failed, a deploy can show as in progress in the Admin Console for up to 90 minutes, and then show as failed. A later deploy waits until it ends. If a deploy is still in progress when you deploy the # retry change, the # retry deploy starts only after that earlier deploy ends. On Embedded Cluster, the later deploy can show as Deployed in the version history of the Admin Console while it still waits, so confirm that the NetBox pods run the new version before you rely on it.
  • Helm installs get the same failed migration. The same change to customPythonConfig retries it, or you can delete the failed Job, and the operator then runs the migration again for the same configuration. To find the Job, run kubectl get jobs -n <install-namespace> -l app.kubernetes.io/component=netbox-migrate and look for the -netbox-migrate-p1- Job with status Failed, then run kubectl delete job -n <install-namespace> <job-name>.

• Embedded Cluster backups to some S3-compatible stores fail. If your backup location is an S3-compatible store that rejects AWS trailing checksums (sent as x-amz-content-sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER), every backup on 2.4.0 fails with this error:

  api error InvalidArgument: x-amz-content-sha256 must be UNSIGNED-PAYLOAD, STREAMING-AWS4-HMAC-SHA256-PAYLOAD or a valid sha256 value.

  On 2.3.x and earlier, setting checksumAlgorithm: "" in the Velero BackupStorageLocation config avoids this (see Backups). 2.4.0 ships Velero AWS plugin v1.14.2, which adds the checksum regardless of that setting, so the workaround no longer works, and an install already on 2.4.0 has no workaround. If your store rejects trailing checksums, do not upgrade past 2.3.x until a release with the fix ships. This is tracked upstream as velero-plugin-for-aws#335. Helm installs supply their own Velero, which this release does not change; a Helm install that runs Velero AWS plugin v1.14.1 or later against such a store fails the same way, whatever NetBox Enterprise version it runs (NBE-3071).

• Releases before 2.4.0 allow anonymous access to several NetBox endpoints. They include /graphql/ and /api/status/, and 2.4.0 closes them. While you stay on an earlier release, close them by adding LOGIN_REQUIRED = True to the NetBox Python Configuration Overrides field, which appears after you tick Show Advanced Settings on the admin console Config page. Anything that reads those endpoints without credentials, such as monitoring that scrapes /api/status/, then needs an API token or a session. To confirm the override took effect, run this without credentials: it prints 403 once the override is active.

  curl -s -o /dev/null -w '%{http_code}\n' -H 'Accept: application/json' https://<netbox-host>/api/status/

• Helm installs: the chart's Velero backup is not a restore point. With disasterRecovery.createVeleroSpecs: true, the chart creates one Velero Backup, netbox-enterprise-backup, and no schedule. Velero runs it once, when Helm creates it, and deletes it after 30 days. The next helm upgrade after that creates it again. So it holds the cluster as it was the last time Helm created it, which depends on your upgrade history, and restoring it loses everything since. Create a Velero Schedule, as Scheduled backup describes, and restore from one of its backups instead. This affects Helm installs from 2.3.0 on and is not new in 2.4.0. Embedded Cluster installs are unaffected (NBE-3157).

• Helm installs whose own NetBoxEnterprise resource sets spec.registry can run community NetBox. If the resource sets spec.registry and does not set spec.netbox.image, NetBox resolves to the community netbox:v4.7.1 image in your registry instead of the NetBox Enterprise image. If you did not mirror that image, the NetBox pods fail with ImagePullBackOff. If you did, the database migration fails. To avoid it, set spec.netbox.image.repository to netboxlabs/nbe-core and spec.netbox.image.tag to the tag that helm show values prints under netboxEnterprise.spec.netbox.image, or let the chart create the resource by setting netboxEnterprise.enabled: true. Installs through the admin console, and Helm installs that pull through the Replicated proxy, are unaffected. This is not new in 2.4.0 (NBE-2508).

• Restoring the manual secrets backup into a different install breaks Diode authentication. The manual backup procedure in Backups keeps each secret's owner references. Applied to a new or reset install, most of the secrets are rejected, including the Diode authentication secrets, and nothing reports the failure. NetBox data restores and the install reports Ready, but Diode clients cannot authenticate: Hydra's /.well-known/jwks.json returns 500, and token requests fail with 401 invalid_client. Restoring onto the install the backup came from is unaffected. If you need to restore secrets into a different install, contact NetBox Labs support before you start. This is not new in 2.4.0 (NBE-3134).

• An empty PostgreSQL backup schedule fails validation. Setting spec.postgresql.backups.fullSchedule or incrementalSchedule to "" does not turn that schedule off. The operator rejects the value, the reconcile fails, and Ready becomes False with ReconcileFailed (Invalid spec.postgresql.backups.incrementalSchedule '': expected 5 fields, found 0). Remove the field, or set a valid cron expression, to recover. To stop all PostgreSQL backups, enabled: false still works (NBE-3200).

Plugins

The following plugins are included in this release:

Slurp'it (slurpit_netbox) is still included. It is now a NetBox Labs partner plugin, and partner plugins are not marked Certified.

NetBox Enterprise 2.3.x

2.3.0

NetBox Enterprise 2.3.0 brings high availability to the bundled data tier, so a three-node cluster no longer needs external PostgreSQL, Redis and object storage to run highly available. It adds two new licensed plugins — NetBox Data Exchange and Asset Lifecycle Management — and takes TurboBulk out of opt-in. The disaster-recovery path received the largest single body of work in the release: an Embedded Cluster restore now returns the database, and the same recovery now works on a direct Helm install.

Versions

This release uses the following upstream software:

• NetBox 4.6.8
• Diode Pro 2.3.0
• PostgreSQL 16.14, 17.10 or 18.4 (if the built-in database is enabled, via PostgreSQL Operator 6.0.2 and pgBackRest 2.58.0)
• Redis (if built-in Redis is enabled, via Redis Operator 0.26.0)
• Traefik v3.7.1 (Embedded Cluster gateway)
• nbe-operator Chart 2.3.0

Plugin updates since 2.2.1:

• netbox-bgp 0.19.0 (was 0.18.1)
• netbox-documents 0.8.5 (was 0.8.2)
• netbox-floorplan-plugin 0.9.2 (was 0.9.1)
• netbox-inventory 2.6.0 (was 2.5.1)
• netbox-ndx-plugin 0.5.0 (new in 2.3.0)
• netbox-plugin-dns 1.5.10 (was 1.5.8)
• netbox-qrcode 0.0.21 (was 0.0.20)
• netbox-secrets 3.1.0 (was 3.0.2)
• netbox-turbobulk 0.2.1 (was 0.1.8)
• netboxlabs-diode-netbox-plugin 1.14.1 (was 1.13.0)
• netboxlabs-netbox-asset-lifecycle 0.3.0 (new in 2.3.0)
• netboxlabs-netbox-branching 1.0.4 (was 1.0.3)

This list shows only plugins whose versions changed in 2.3.0. See the Plugins table below for the full set included in this release.

Features

• High availability without an external data tier (HA Phase 2): A three-or-more-node cluster can now run PostgreSQL, Redis and object storage in-cluster and still be highly available, where 2.2.0 blocked an HA install unless all three were external. In-cluster PostgreSQL runs Patroni quorum synchronous commit, so a standby acknowledges every commit before it returns and losing the primary promotes a replica without losing an acknowledged write (NBE-1694). Redis and in-cluster object storage spread one pod per node under a hard placement rule with PodDisruptionBudgets (NBE-1698, NBE-1956, NBE-2023). In-cluster PostgreSQL placement is best effort — nothing guarantees the copies land on separate nodes, so external PostgreSQL remains the stronger answer where a placement guarantee is required. The install-time HA guard is now a per-tier gate rather than one all-or-nothing check, so each tier is assessed on its own (NBE-1699, NBE-1974). See High Availability Requirements and In-Cluster Database and Cache.
• NetBox Data Exchange (NDX): The bundled netbox-ndx-plugin browses, imports and enriches device types from the NDX catalog. NDX comes with all paid NetBox Enterprise licenses and is enabled by your license rather than by an installation step: the Admin Console shows the option only when the license carries the NDX entitlement, so a paid license whose profile is missing it shows nothing. The token is delivered as a Secret, the plugin refuses to boot without one, and the value is redacted from support bundles (NBE-1572, NBE-1869, NBE-1870). See NetBox Data Exchange.
• Asset Lifecycle Management (Premium): The bundled netbox-asset-lifecycle plugin can now be enabled from the KOTS admin console, gated on a Premium license, to track hardware procurement and lifecycle — bill of materials, purchase orders, shipments, and installs (NBE-1570, NBE-1574). See Asset Lifecycle Management.
• TurboBulk enabled by default (Premium): The bundled netbox-turbobulk plugin is now on by default for Premium and Enterprise licenses, where 2.2.0 shipped it opt-in. The bulk write path (load, upsert and delete) stays off by default: a single call can modify or delete large numbers of objects in one transaction and is difficult to reverse, so validate write workflows outside production before enabling it. See TurboBulk.
• PostgreSQL backups through pgBackRest: The built-in database is now backed up by pgBackRest, which the PostgreSQL Operator runs on the operator's behalf. It takes consistent base backups and archives the write-ahead log continuously into a dedicated repository volume, and Velero then captures that repository. This replaces a filesystem copy of the live data directory, which was a torn copy that reported success and could not be restored. It is on by default, so on a supported storage class a default install has working disaster recovery with no configuration. Weekly full backups and daily incrementals are the defaults, and the schedules, the retention count, and the repository volume size are all configurable under spec.postgresql.backups (NBE-1695, NBE-2619). An external database is unaffected -- its backups remain yours to run. See PostgreSQL Backups and Disaster Recovery.
• Every install now requires a license: The operator no longer invents a fallback license when it cannot reach the Replicated SDK. It caches the last good license in a Secret, serves that on a restart, and blocks reconciliation while no license is available at all. A license the SDK does not recognize is reported as LicenseHealth=False with reason LicenseUnrecognized, which is distinct from LicenseUnavailable, and the expiration banner now shows for every license type. status.license.edition is retired: it stays in the schema so a status written by an older operator still parses, and nothing writes it. The license-edition label is removed from managed resources (NBE-1341). See License Information.
• Extra manifests: spec.extraManifests takes a list of YAML strings, and the operator applies them beside the workloads it manages. Each entry may hold several documents. Every document goes through the same mutation pipeline as an operator-built resource, and an unsupported kind is rejected at reconcile time. See spec.extraManifests.
• Operator observability: The operator now exposes a reconcile-duration histogram labeled by resource kind, a requeue and wait-reason counter, Kubernetes API client counters (verb, latency, conflicts), and a first-successful-reconcile timestamp gauge (NBE-1897, NBE-1898, NBE-1899, NBE-1900).

Security

• NetBox core 4.6.8 closes a privilege escalation in the grant_token UI, which a third-party penetration test chained to remote code execution via CVE-2026-29514 (NBE-1970). The release also carries backported dependency security fixes (NBE-2154).
• The appliance no longer serves the application on port 80 without a redirect. Credentials and the session cookie previously traveled in clear on that port. Port 80 now redirects to HTTPS and the session cookie is marked secure (NBE-2124).
• Secrets no longer leak into logs and support bundles. The Hydra bootstrap Job logged all three Diode OAuth2 client secrets in plaintext (NBE-2108), and the support-bundle redactor corrupted cluster-resources/pods/*.json into invalid JSON because the Authorization mask ran past the JSON string terminator (NBE-2369). The netbox-enterprise support-bundle command on Embedded Cluster now applies that redactor spec, which it previously skipped entirely — including the NDX token (NBE-2479).

Bug Fixes

• Embedded Cluster disaster recovery returns the database. A restore previously handed back a cluster reporting Ready=True over an empty database, on every topology. Fixing it took a chain of independent defects: two ConfigMaps both claimed Velero's pod-volume-restore plugin config, so the pgBackRest repository — the only copy of the database in the backup — was never restored (NBE-2596); the PostgresCluster arrived unpaused, so PGO ran initdb over the volume before the pgBackRest restore got its window (NBE-2732); spec.dataSource made PGO restore over a live database on every install and upgrade (NBE-2668); the operator sent schedules: null and PGO rejected every reconcile (NBE-2629); the operator tore down PGO's own bootstrap restore Job mid-flight (NBE-2715); PostgreSQL opened a new stanza generation before the restore ran (NBE-2633); and a restored cluster's own backups expired the source's, destroying the only remaining copy (NBE-2616). The cluster now reports the truth throughout: Ready no longer goes True over a restored-but-unrecovered database (NBE-2620, NBE-2715), a failing pgBackRest restore is reported rather than hidden behind Ready=True (NBE-2688, NBE-2766), a slow restore is distinguishable from a hung one (NBE-2684), and a terminally failed restore Job says so and points at the runbook. An Embedded Cluster restore on an upgraded cluster now offers backups taken after the upgrade, not only those from the original install (NBE-2678).
• Pure-Helm disaster recovery works. Both Velero ConfigMaps that Embedded Cluster receives from its platform addon are now rendered by the chart behind the existing default-off gate, so a Helm restore brings the pgBackRest volume back with its data and the PostgresCluster arrives paused instead of being initdb'd over. Previously a Helm restore returned an empty database while reporting Completed (NBE-2747, NBE-2773).
• External PostgreSQL and Redis with mutual TLS. A client certificate supplied without its key silently disabled Postgres mTLS, and X.509 v1 server certificates were rejected at every sslmode (NBE-2572). The wait-dependencies init container carried no client certificate, so a pod could never start against an mTLS-required database (NBE-2452), and the preflight collectors for PostgreSQL, Diode, Hydra and Redis presented none either, reporting a false "cannot connect" (NBE-2451, NBE-2302). A raw-PEM CA value aborted the install outright (NBE-2425, NBE-2685). Copilot gained CA delivery for both PostgreSQL and Redis (NBE-1794, NBE-2171, NBE-2066).
• Redis master election no longer wedges. Sentinel could keep pointing at a replica after Redis churn, leaving NetBox workers crash-looping on "No master found" with nothing converging them back (NBE-2437), and one unpullable Redis pod could stall election permanently — the bundled Redis operator moves to v0.26.0 to fix it (NBE-2245, NBE-2374). The Redis wait now names what is missing instead of reporting "no action is required" (NBE-2262).
• Gateway host ports (Embedded Cluster): The gateway DaemonSet no longer binds host port 8080. Traefik's /ping health endpoint now serves on the web entryPoint (port 80), and the separate dashboard/health entryPoint is removed. Only ports 80 and 443 are bound on the node. This completes the host-port hardening started in 2.2.1 (which removed 9100 and moved 8080 to loopback): a loopback 8080 bind still collided with a process already holding 0.0.0.0:8080. Helm installs using your own ingress controller are unaffected (NBE-1743).
• Vendored CRDs are applied on upgrade (Helm and KOTS): The bundled PostgreSQL, Redis, Gateway API and Traefik CustomResourceDefinitions now ship from the chart's templates/ directory instead of crds/. Helm skips a chart's crds/ directory on upgrade entirely, so an upgraded cluster previously kept whatever CRD schema its very first install applied, indefinitely, while the release still reported deployed. Two clusters on the same build could hold different CRD schemas depending on whether they were installed or upgraded. Direct Helm installs have a one-time adoption step for this; see Upgrade Notes below (NBE-2375).
• The published Helm chart no longer ships an unsubstituted image tag. A 2.3.0 pre-release chart shipped tag: "@NETBOX_TAG@" verbatim, so every pure-Helm install failed to reach Ready (NBE-2216).
• Air-gapped installs no longer force external PostgreSQL and can be completed with the bundled database (NBE-2224). Garage image relocation into an air-gapped registry works and reports why when it does not (NBE-2217).
• Failures are diagnosable rather than silent. A failed NetBox or Copilot migration reported its cause three different ways at once — truncated log tail, bare exit code, empty termination message — and now reports it once, properly (NBE-2291). wait-postgres reports a permanent CA mismatch immediately instead of retrying for fifteen minutes (NBE-2277). Proxy misconfiguration is detectable at install time (NBE-2011). The TlsCaTrust condition is now set when extraCaCertificates is invalid or missing, where it was previously never set at all (NBE-2035, NBE-2297), and a repeat storage wait no longer opens already stalled (NBE-2431).
• Diagnosable operator watch failures: When a watch feeding the operator's NetBoxEnterprise or GarageCluster controller stops making progress, the log now names the underlying reason. The Kubernetes controller-runtime library reports such a fault as event queue error and drops its cause, so a watch stopped by a resource the operator could not read previously reported that bare phrase and nothing more, while the pod stayed Ready with no restarts and nothing reconciled. A scheduled reconcile for an object already gone from the operator's cache is reported separately, at debug level, because it is expected and clears itself (NBE-2436).
• Login no longer returns HTTP 500 when the authenticating user has no UserConfig, which affected fixture-imported and race-created users (NBE-2426). LDAP no longer 500s a user when AUTH_LDAP_FIND_GROUP_PERMS runs a post-authentication group search against an empty base (NBE-1598).
• Bring-your-own private registry: spec.imagePullSecrets is now wired into the Redis and Sentinel builders, the Garage StatefulSet, and the Diode proxy Deployment, which previously ignored it (NBE-1562, NBE-2362, NBE-2520).

Upgrade Notes

• Take a full backup immediately after you upgrade. A backup taken before 2.3.0 cannot restore your database. Every earlier release disabled pgBackRest and did not exclude the PostgreSQL data directory from Velero, so an older archive holds a torn file-by-file copy of a live data directory and no pgBackRest repository. There is nothing in such an archive to recover from. This also changed the failure mode: those releases could not restore volume contents at all, so a restore of an old archive returned empty volumes and failed obviously. That defect is fixed, which means a restore of a pre-upgrade archive now writes the torn data directory onto disk faithfully. PostgreSQL usually refuses to start on it, and the danger is the other case, where it starts and the data is quietly wrong. The first valid restore point is the first pgBackRest backup taken after the upgrade. Turning pgBackRest on for a running cluster is safe and non-destructive: existing data is untouched, and stanza creation runs against the live database. Expect short-lived UnableToCreateStanzas warnings while the instance rolls to add the sidecar; both clear on their own (NBE-1695). See Upgrading.
• A hostPath storage class is unsupported, and it is the default on k3s, k3d, and kind. Velero's filesystem backup cannot read a hostPath volume: its node agent only sees the kubelet pod-volumes directory, and kubelet bind-mounts a hostPath volume straight into the container instead. Velero skips the volume with no error, so the backup reports Completed while it holds the volume definitions and none of their contents, and the restore returns empty volumes. This affects every NetBox Enterprise volume, not just the database. Embedded Cluster ships OpenEBS LocalPV and meets the requirement with no action. A pure-Helm install on local-path-provisioner does not. Velero must also be 1.13 or newer, or the whole backup fails validation and never runs. See Storage requirements.
• Pure-Helm installs should set disasterRecovery.createVeleroSpecs: true, and remove any hand-applied pod-volume-restore ConfigMap in the same change. The chart now renders the four Velero objects a Helm restore needs. An earlier revision of the Helm backup guide told you to apply one of them, netbox-enterprise-pod-volume-restore-config, by hand. If you followed it, helm upgrade alone lands a second claimant for the same Velero lookup, that lookup then fails, and every volume restore aborts before the init container is injected (NBE-2596). Nothing warns you at the time, because the plugin config is read only on restore. The operator reports the count as a VeleroRestoreConfigInvalid condition. See On upgrade, remove your own copy.
• Direct Helm installs must adopt the vendored CRDs on the first 2.3.0 upgrade. The netbox-enterprise-crds-pgo, netbox-enterprise-crds-redis, netbox-enterprise-crds-gateway and netbox-enterprise-crds-traefik charts now deliver their CustomResourceDefinitions from templates/ rather than crds/, so helm upgrade re-applies them (NBE-2375). CRDs that a pre-2.3.0 release installed from crds/ carry no Helm ownership metadata, so this first upgrade has to adopt them. Without that, helm upgrade aborts with invalid ownership metadata and the release stays on its old revision. Add --take-ownership (Helm 3.17 or later) to the helm upgrade for each of those charts you have installed; gateway and traefik are only present if you run the bundled gateway. netbox-enterprise-crds is the exception and needs no flag: it has always shipped its CRD from templates/, so it is already Helm-owned and must keep failing loudly if something else claims it. The adoption is needed once, so do not leave --take-ownership in a runbook, where it would disable Helm's ownership check on every later upgrade. On a Helm client older than 3.17, stamp the metadata with kubectl label and kubectl annotate instead, naming each CRD explicitly rather than selecting a whole API group. The full procedure, including the CRD names per chart, is in the Helm upgrade guide. Embedded Cluster installs need no action. Other KOTS installs need none either, provided kotsadm is at least the 1.124.0 floor this release sets, which is the first version to bundle a Helm that understands the flag.
• Rolling back below 2.3.0 after dropping superuser.apiToken (direct Helm installs only): spec.netbox.config.superuser.apiToken is no longer a required field. Nothing reads it, and NetBox 4.5 and later issue peppered v2 tokens that cannot be planted from a plaintext secret, so a bring-your-own superuser no longer has to invent a value for it (NBE-2219). Upgrading is unaffected and resources that already set the field keep applying unchanged. Rolling back is where care is needed:
  • Restore apiToken on the resource before rolling back, and make sure the Secret it points at really carries that key. Any value will do, since nothing reads it, but on 2.3.0 a key the Secret does not carry is still projected, so kubelet fails the NetBox pod's secrets volume (references non-existent secret key) and NetBox will not start. The operator reports that on the resource as a SuperuserSecret=False condition with a Warning event, so kubectl describe netboxenterprise names the key before you go looking at the pod. A cluster already in the stalled state recovers in place: adding the field back is accepted even after the older CRD is reinstalled, and the operator picks it up on its next reconcile, or on its next restart attempt where it is crash-looping.
  • A pre-2.3.0 operator cannot deserialize a NetBoxEnterprise resource that omits apiToken. Reconciliation then stops for every NetBoxEnterprise resource it watches, not only the one missing the field. Which symptom you see depends on whether the resource missing the field is the one the operator's startup check reads, because that check reads only the first resource in the API server's list order.
  • If it is, the operator logs Failed to list NetBoxEnterprise API: Error deserializing response: missing field apiToken, naming the field, and exits 1, so the pod shows CrashLoopBackOff in kubectl get pods and spotting the failure does not depend on reading the log. A cluster holding one NetBoxEnterprise resource always takes this path, since that resource is necessarily the first; the chart emits one per Helm release, and the operator's list spans every namespace it watches.
  • If another resource sorts ahead of it, the startup check passes and the controller's own watch meets the resource instead. The pod then stays Ready with passing health probes and no restarts, and the operator's own line is bare: Controller trigger stream error with event queue error, naming no field. The reason is still on the log, but only at the tail of a multi-kilobyte kube_client dump of the whole list body. 2.3.0 puts it on the operator's own line instead (NBE-2436).
  • Installs driven by the KOTS admin console or Embedded Cluster cannot reach this state. Those installs render no superuser block at all unless a superuser password is set, and when they do set one they set all four fields including apiToken.
• Rolling back below 2.3.0 is a restore, not a downgrade. As in every previous release, there is no automated rollback: recovery to an earlier version is a restore from a backup taken on that version. Take a backup before upgrading.

Known Issues

• A shared backup location offers other clusters' backups at restore time. The Embedded Cluster restore prompt lists every backup in the configured location, newest first, regardless of which cluster produced it, and shows only a name and a timestamp. If two clusters share a bucket and prefix and the other cluster's backup is the newer one, that is what you are offered, and accepting it is silent: the restore completes, reports success, and the cluster comes up healthy holding another cluster's data. Give each cluster a unique prefix or its own bucket. Before restoring, note the name and completion time of the backup you intend to restore from the Backups tab of the admin console while the cluster is still healthy, and continue at the prompt only if the name matches. See Backups for the full procedure, and the Helm equivalent in Backups (Helm) (NBE-2692, NBE-2689).

Plugins

The following plugins are included in this release:

NetBox Enterprise 2.2.x

2.2.1

NetBox Enterprise 2.2.1 is a patch release. It corrects the host ports the bundled Traefik gateway binds on Embedded Cluster, updates the bundled assurance plugin (a security fix) and validity plugin (a GraphQL schema collision that could block upgrades), and fixes several upgrade-reliability issues around long migrations, external PostgreSQL connections, and custom-plugin migrations.

Versions

This release uses the following upstream software:

• NetBox 4.5.10
• Diode Pro 2.0.3
• PostgreSQL 18.x (via PostgreSQL Operator 6.0.1)
• Redis 7.4.8 (via Redis Operator 0.24.0)
• Hydra v25.4.0
• nbe-operator Chart 2.2.1

Plugin updates since 2.2.0:

• netbox-validity 3.5.2 (was 3.4.3)
• netboxlabs-netbox-assurance-plugin 1.5.4 (was 1.5.3)

This list shows only plugins whose versions changed in 2.2.1. See the Plugins table below for the full set included in this release.

Bug Fixes

• Gateway host ports (Embedded Cluster): The gateway DaemonSet no longer binds host port 9100, which collided with Prometheus node-exporter, and now binds its dashboard/health port 8080 on loopback (127.0.0.1) only instead of on every node interface. Only ports 80 and 443 remain bound on the node's external interfaces. This unblocks Embedded Cluster upgrades on nodes already running node-exporter. Helm installs using your own ingress controller are unaffected (NBE-1661).
• Assurance plugin security update: netbox-assurance-plugin is updated to 1.5.4, fixing an unauthenticated endpoint in the bulk interface (NBE-1662).
• Validity plugin GraphQL collision: netbox-validity is updated to 3.5.2, which renames its GraphQL JobType/JobFilter types. This resolves a DuplicatedTypeName: JobType schema-build crash that blocked the migration job (and therefore the upgrade) when both the validity and ipfabric_netbox community plugins were enabled (NBE-1756).
• Upgrade no longer reports a false failure during long migrations: The KOTS deploy-wait timeout could fire before the NetBoxEnterprise resource finished converging, reporting a spurious Deploy Failed while the upgrade was still progressing. The Helm wait budget is raised to 90 minutes so long-running migrations complete and report accurately (NBE-1757).
• External PostgreSQL deploys no longer hang: Two connection issues against customer-managed PostgreSQL are fixed. Connection attempts are now time-bounded, so a migration can no longer hang indefinitely on connect, and sslmode=allow/prefer now negotiate TLS correctly against an SSL-only server instead of stalling the deploy (NBE-1763, NBE-1773).
• Custom-plugin changes re-run migrations: The migration fingerprint ignored the media-directory wheelhouse, so uploading or changing a custom plugin did not re-trigger database migrations. The wheelhouse is now included in the fingerprint, so custom-plugin changes apply on the next deploy (NBE-1672).
• Support-bundle redaction covers more credentials: Passwords containing @ or / in PostgreSQL DSNs, Redis URLs, and proxy URLs are now redacted from support bundles, extending the redaction added in 2.2.0 (NBE-1558).

Known Issues

• External PostgreSQL: database migrations are not re-run after a restore. On deployments using customer-managed (external) PostgreSQL, the operator cannot read the credentials its nbe_ready sentinel probe needs, so it cannot determine whether the sentinel is present. It fails open, logging Could not verify nbe_ready sentinel; treating Phase 1 as up-to-date (hash unchanged) and skipping the check. If a database restore has since wiped the sentinel, the operator does not re-run the migrate-p1 Job in response, and NetBox and worker pods restarted while the sentinel is missing wait in their wait-migrations init container with no error reported. Deployments using the built-in PostgreSQL are not affected. This is fixed in 2.3.0 and is not backported to the 2.2.x line, so upgrading is the remedy (NBE-1792).

  How long the outage lasts depends on whether you supply custom plugins from a wheelhouse:

  • No wheelhouse source configured (the default): migrations re-run on a ten-minute cycle for unrelated reasons, and each run rewrites the sentinel. The deployment recovers on its own within about ten minutes.
  • A wheelhouse configured from S3 or a PVC: that periodic re-run does not happen, so the deployment does not recover on its own. Use the recovery steps below, or upgrade.

  To recover without upgrading, re-run the Phase 1 migration by hand. This copies the existing migration Job under a new name; it re-applies no schema changes on an already-migrated database, and only rewrites the sentinel. Substitute your namespace if it is not the default kotsadm:

  NS=kotsadm
  
  # Select the most recently created Phase 1 migration Job
  SRC=$(kubectl -n $NS get jobs \
    -l app.kubernetes.io/component=netbox-migrate,netboxlabs.com/migration-phase=p1 \
    --sort-by=.metadata.creationTimestamp \
    -o jsonpath='{.items[-1:].metadata.name}')
  echo "Source Job: $SRC"
  
  # Clear any previous manual run so this procedure can be repeated
  kubectl -n $NS delete job nbe-manual-migrate-p1 --ignore-not-found
  
  kubectl -n $NS get job "$SRC" -o json | jq '
    del(.metadata.uid, .metadata.resourceVersion, .metadata.creationTimestamp,
        .metadata.generation, .metadata.managedFields, .metadata.ownerReferences,
        .spec.selector,
        .spec.template.metadata.labels["controller-uid"],
        .spec.template.metadata.labels["batch.kubernetes.io/controller-uid"],
        .spec.template.metadata.labels["job-name"],
        .spec.template.metadata.labels["batch.kubernetes.io/job-name"],
        .status)
    | .metadata.name = "nbe-manual-migrate-p1"
  ' | kubectl -n $NS create -f -

  The Job takes roughly a minute. Confirm it succeeded, then confirm the sentinel is back:

  kubectl -n $NS get job nbe-manual-migrate-p1

  Pods still waiting in wait-migrations proceed on their next poll. kubectl create job --from does not work here — it only accepts a CronJob as its source.

Plugins

The following plugins are included in this release:

2.2.0

NetBox Enterprise 2.2.0 moves Embedded Cluster routing to the Traefik Gateway API, adds opt-in high availability for the operator, introduces end-to-end egress proxy support for restricted networks, and brings the NetBoxEnterprise CRD to a versioned v1alpha2 schema with an automatic storage-version migration.

Versions

This release uses the following upstream software:

• NetBox 4.5.10
• Diode Pro 2.0.3
• PostgreSQL 18.x (via PostgreSQL Operator 6.0.1)
• Redis 7.4.8 (via Redis Operator 0.24.0)
• Hydra v25.4.0
• nbe-operator Chart 2.2.0

Plugin updates since 2.1.2:

• netbox-enterprise-plugin 0.2.7 (was 0.2.6)
• netbox-healthcheck-plugin 0.3.0 (was 0.2.0)
• netboxlabs-netbox-copilot 1.33.3 (was 1.33.0)

This list shows only plugins whose versions changed in 2.2.0. See the Plugins table below for the full set included in this release.

Features

• Gateway API routing (Embedded Cluster): North/south traffic on Embedded Cluster now flows through a bundled Traefik gateway instead of ingress-nginx. The operator resolves the routing mode, emits Gateway, HTTPRoute, and GRPCRoute resources with a durable RoutingHealth condition, and enforces a configurable maximum upload size on request bodies. Gateway API v1.5.1 and the Traefik Middleware CRD ship as their own CRD charts. Raw Helm installs continue to use your own ingress controller (NBE-1188, NBE-1349).
• Operator high availability: The operator can now run multiple replicas with active-passive leader election backed by a coordination.k8s.io/v1 Lease. Only the leader reconciles; a standby takes over on node loss or during a rolling upgrade, typically within 15 to 20 seconds. HA is opt-in: run more than one replica, or enable Operator High Availability in the Administration Console. Single-replica installs are unchanged. HA requires an external data tier, so the installer blocks an HA install backed by the built-in database or Redis, and the operator raises a status condition if HA is expected but the data tier is embedded (NBE-878, NBE-1199, NBE-1340, NBE-1539).
• Egress proxy support: A new spec.proxy field propagates HTTP(S) proxy and no-proxy settings to NetBox, workers, Copilot, Diode, Hydra, migrations, the operator, and the Replicated SDK. On Embedded Cluster and KOTS the proxy is inherited from the install-time proxy flags and shown read-only in the Administration Console; raw Helm installs set it via global.replicated (NBE-1501, NBE-1396).
• CRD API v1alpha2: The NetBoxEnterprise CRD now serves a versioned v1alpha2 schema alongside v1alpha1, backed by an automatic storage-version migration. The two versions carry the same JSON wire shape, so no conversion webhook exists and none is needed. Existing custom resources convert transparently on upgrade (NBE-1195).
• TurboBulk (Premium): The bundled netbox-turbobulk plugin can now be enabled, with an optional bulk-write path, from the Administration Console, gated on a Premium license (NBE-771).
• Change Management toggle: Change Management can be enabled or disabled from the Administration Console, with the operator running the required migration on toggle (NBE-1473).
• Availability-zone topology spread: Zone-aware scheduling is now configurable from the Administration Console, extending the workload topology spread added in 2.1.1 (NBE-1506).
• Clearer upgrade status: The operator reports a distinct Upgrading state with a configurable application-ready timeout, so long dependency waits during an upgrade are no longer misreported as failures, and app workloads now terminate gracefully (NBE-1469, NBE-1401).
• Plugin health surfacing: A PluginsReady status condition reports plugin import failures instead of silently degrading, and enabled-but-unimportable plugins are caught at startup (NBE-1190).

Upgrade Notes

• Ingress to Gateway cutover (Embedded Cluster): Upgrading an Embedded Cluster install replaces the bundled ingress-nginx with the Traefik gateway. A pre-upgrade step prunes the legacy ingress and frees the host ports before the gateway schedules, so expect a brief routing blip during the cutover. Helm installs are unaffected and keep using your own ingress controller (NBE-1188, NBE-1401).
• HA now requires an external data tier: Enabling operator HA, or installing with more than one replica, requires external PostgreSQL and Redis. An HA install pointed at the built-in data tier is blocked at preflight (NBE-1539).
• CRD conversion is automatic: A one-time storage migration runs at operator startup and re-encodes stored objects as v1alpha2. No conversion webhook is installed, and none is needed. No action is required; single-replica and HA installs both convert in place (NBE-1195).
• Egress proxy: Existing installs are unchanged unless you set a proxy. On Embedded Cluster the proxy is inherited from the install-time proxy flags rather than configured in NetBox Enterprise (NBE-1396).

Key Improvements

• NetBox web liveness is decoupled from Redis, so a Redis blip no longer restarts NetBox pods (NBE-1413).
• Operator-built Deployments and Jobs tolerate the node-cordon taint, so draining a node during maintenance no longer strands NetBox pods (NBE-1511).
• Hydra re-runs its bootstrap Job when OAuth2 clients are wiped or the external database changes, and preserves its replica count during in-place upgrades even if RBAC lookups fail (NBE-1557, NBE-1302, NBE-1441).
• The operator recovers automatically when a license changes from the Community fallback back to a valid enterprise license, without a restart (NBE-1297).
• Support bundles redact tokens and passwords across all collected sources (NBE-1334).
• wait-redis supports mTLS client certificates for external Redis in verify modes (NBE-1399).
• Completed migration Jobs no longer trip an immutable spec.template error on later reconciles (NBE-1565).
• License-status checks now target the in-cluster Replicated SDK instead of the public API, so licensing works in fully air-gapped installs (NBE-1499).

Plugins

The following plugins are included in this release:

NetBox Enterprise 2.1.x

2.1.2

NetBox Enterprise 2.1.2 bumps NetBox to 4.5.10 and Copilot to 1.33.0, adds Redis tuning knobs on the CRD, configurable Diode reconciler rate limits and replicas, per-component Diode environment variable overrides, and a long list of bug fixes around Redis, Diode, ingress status tracking, Copilot preflights, and the operator startup path.

Versions

This release uses the following upstream software:

• NetBox 4.5.10
• Diode Pro 2.0.3
• PostgreSQL 18.x (via PostgreSQL Operator 6.0.0)
• Redis 7.4.8 (via Redis Operator 0.24.0)
• Hydra v25.4.0
• nbe-operator Chart 2.1.2

Plugin updates since 2.1.1:

• netbox-acls 2.0.1 (was 2.0.0)
• netbox-interface-synchronization 4.5.8 (was 4.5.1)
• netbox-inventory 2.5.1 (was 2.5.0)
• netbox-lifecycle 1.1.9 (was 1.1.8)
• netbox-plugin-dns 1.5.8 (was 1.5.2)
• netbox-secrets 3.0.2 (was 3.0.0)
• netbox-validity 3.4.3 (was 3.4.1)
• netboxlabs-diode-netbox-plugin 1.13.0 (was 1.11.0)
• netboxlabs-netbox-assurance-plugin 1.5.3 (was 1.5.0)
• netboxlabs-netbox-copilot 1.33.0 (was 1.30.0)
• netboxlabs-netbox-custom-objects 0.5.1 (was 0.4.10)
• slurpit_netbox 1.3.30 (was 1.3.3)

This list shows only plugins whose versions changed in 2.1.2. See the Plugins table below for the full set included in this release.

Features

• Redis CRD tuning: New aofEnabled, maxMemoryPercent, maxMemoryPolicy, and additionalConfig fields let you tune Redis without rebuilding the operator. additionalConfig is wired in via a dedicated ConfigMap.
• Diode reconciler scaling: Rate limits and replica count are now exposed in the Administration Console (NBE-892, NBE-1001).
• Diode processing knobs: Reconciler ingestion-log and auto-apply processor concurrency, plus an ingester Redis memory high-watermark (defaults to 90%, only active when Redis has a maxmemory cap), are now tunable via the CRD and KOTS config (NBE-1162).
• Diode environment overrides: Per-component extraEnvs for ingester, reconciler, auth, and hydra, settable via the CRD or Administration Console, with user values overriding operator defaults (NBE-1027).
• Copilot 1.33.0: Plugin and backend image bumped (NBE-919).

Upgrade Notes

NetBox jumps from 4.5.3 to 4.5.10. A few upstream changes in that range are worth flagging:

• GraphQL MAX_PAGE_SIZE enforcement (4.5.5): GraphQL queries now respect MAX_PAGE_SIZE. Automation that was previously pulling unbounded result sets via GraphQL will see truncated responses. The prior behavior was arguably a bug, but it is still a behavior change.
• Constrained object permissions fix (4.5.9, upstream #21893): The fix tightens how constrained object permissions are evaluated. If permissions were previously misconfigured and "working" by accident, users may now see less than they did before.
• UI permission tightening (4.5.4/4.5.5): Several controls that used to leak to users without the right permission are now hidden: the script list view, the script "Add" button, and the VM "Add components" dropdown (#20490, #21579, #21580). Same flavor of change as the constrained permissions fix: if you were unintentionally relying on the leak, things will disappear for non-privileged users.
• EventRule action_data validation (4.5.9, upstream #21989): Event rules now validate action_data as a JSON object on save. Existing rules with malformed action data still execute, but editing them will fail validation until the payload is fixed.
• VLAN table pagination on interface view (4.5.5, upstream #21012): The VLAN table on interface views previously truncated silently at 100 entries. It now paginates, so interfaces with large numbers of VLANs will show all of them.
• NetBox DNS / Slurp'it interop fix: netbox-plugin-dns 1.5.5 fixed an IPAddress consistency issue that surfaced when used alongside the Slurp'it plugin. Both plugins are bumped in this release, so the fix is in place by default.
• Redis dynamic config restart: If you have set redis.dynamicConfig, upgrading triggers a one-time Redis restart so the directives take effect. This is expected; no action needed.

Plugins

The following plugins are included in this release:

Bug Fixes

• Operator startup: The operator no longer applies the NetBoxEnterprise CRD on startup, which avoided a class of upgrade races (NBE-996).
• Migration loop: Spec image is rewritten before the version check so private-registry rewrites cannot trigger a migration loop (NBE-841).
• Wildcard ingress / CNAMEs: Restored the implicit wildcard host rule that 2.0 dropped. Hostnames not listed in ingress.tls.hosts (for example, CNAMEs pointing at the cluster) were hitting the nginx default backend and returning 404 (NBE-1143).
• Sub-operator Service pruning: The operator no longer prunes Services owned by sub-operators, so an upgrade cannot delete redis-master out from under OpsTree and crash-loop Diode while it is recreated (NBE-922).
• Diode OAuth2: The diode-oauth2 secret projection is skipped when Diode is disabled, so the operator does not trip on a missing secret (NBE-924).
• Diode reconciler validation: Field validation tightened to 1-255 to match the upstream config (NBE-1001).
• Diode POSTGRES_HOST: Whitespace is trimmed on the env var so leading or trailing spaces in KOTS config do not break the connection (NBE-892).
• Redis master Service: Explicit type and sessionAffinity so the master Service is consistent across reconciles (NBE-901).
• Redis maxmemory: Guarded against u64 overflow, emitted directly instead of via the OpsTree field, and validation tightened on maxMemoryPolicy and maxMemoryPercent.
• Redis dynamicConfig: Directives now actually reach Redis; they were previously wired to a runtime path that never applied them (NBE-1214).
• Worker startup: Workers wait for the NetBox schema to be ready before starting and shut down cleanly on SIGTERM during that gate (NBE-1171).
• KOTS helm wait: Bumped the helm wait timeout to 15m so multi-replica Diode installs do not time out on first deploy (NBE-997).
• Copilot preflight: Switched from tcpPortStatus to the http collector, fixed textAnalyze file paths and excludes, and surfaced the resolved Bedrock region in the warn message (NBE-818, NBE-848).
• Copilot postgres label: Hidden in the Administration Console when Copilot is not entitled (NBE-985).
• Status informers: Track the ingress controller, Ingress objects, postgres primary Service, redis-operator, and copilot Deployments so KOTS status reflects actual health (NBE-951).
• strawberry pins: strawberry-graphql and strawberry-graphql-django pinned to match NetBox 4.5.10 to clear CVE GHSA-hv3w-m4g2-5x77 (NBE-959).
• requests pin: Floored to >=2.32.5 for NetBox 4.5.3 compatibility.
• wait- binaries*: Dropped from the operator Dockerfile (the operator handles waits internally).
• Plugin compat pins: floorplan, inventory, and qrcode pinned to 4.5.x-compatible releases (NBE-1235).
• CVE fixes: openssl 0.10.80 (CVE-2026-45784), 0.10.79 (CVE-2026-44662, CVE-2026-42327), and 0.10.78 (CVE-2026-41676, CVE-2026-41677, CVE-2026-41678, CVE-2026-41681, CVE-2026-41898); lxml v6.1.0 (CVE-2026-41066); dulwich >=1.2.5 (CVE-2026-42305, CVE-2026-42563) (NBE-1151); granian >=2.7.4 (CVE-2026-42544, CVE-2026-42545) and pymdown-extensions >=10.21.3 (CVE-2026-46338) (NBE-1159); rustls-webpki (RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0104); rand (RUSTSEC-2026-0097).
• Dependency floors: cryptography v48, gunicorn v26, tokio 1.52.3, sha2 0.10.9, hmac 0.12.1, and uv 0.11.15 floored to current releases, plus per-build apk layer busting so Alpine security fixes land.

2.1.1

NetBox Enterprise 2.1.1 adds topology-aware scheduling, configurable reconcile and ingress timing, NetBox 4.5+ migration support, and a long list of bug fixes.

Versions

This release uses the following upstream software:

• NetBox 4.5.3
• Diode Pro 1.16.0
• PostgreSQL 18.x (via PostgreSQL Operator 6.0.0)
• Redis 7.4.8 (via Redis Operator 0.24.0)
• Hydra v25.4.0
• nbe-operator Chart 2.1.1

Plugin updates since 2.1.0:

• Diode Pro 1.16.0 (was 1.12.4)
• netbox-enterprise-plugin 0.2.6 (was 0.1.7)
• netboxlabs-netbox-branching 1.0.3 (was 0.9.0)
• netboxlabs-netbox-changes 1.0.1 (was 0.4.3)
• netboxlabs-netbox-assurance-plugin 1.5.0 (was 1.3.0)
• netboxlabs-diode-netbox-plugin 1.11.0 (was 1.9.0)

This list shows only plugins whose versions changed in 2.1.1. Plugins not listed here were not updated in this release (for example, netbox_custom_objects remains at 0.4.10). See the Plugins table below for the full set included in this release.

Features

• Topology spread constraints: Operator-managed workloads (NetBox, worker, Copilot, and Diode components) accept topologySpreadConstraints for zone-aware scheduling, plus a cluster-wide default at spec.replication.topologySpreadConstraints. User-set constraints are honored; hostname spread is auto-injected for Redis replication and Sentinel.
• Configurable reconcile timing: Reconcile interval and debounce window are now tunable via the CRD spec (NBE-867).
• Ingress proxy timeouts: Per-service timeout overrides for NetBox, Copilot, and Diode, with nginx annotation translation. Exposed in the Administration Console (NBE-761).
• NetBox 4.5+ migration support: The migration Job now runs in two phases to handle plugin-init branching, and skips repair on fresh installs (NBE-902).
• Diode/Hydra scaling: Diode and Hydra replicas scale with node count on multi-node clusters.
• Operator visibility: Redundancy fallback decisions and topology spread resolution are now surfaced in operator logs (NBE-869).

Plugins

The following plugins are included in this release:

Bug Fixes

• Branching + Assurance: Fixed the AttributeError crash when viewing the Changes tab on a branch containing objects created via Diode (NBE-862).
• Custom Objects + Branching: netbox-enterprise-plugin 0.2.6 exempts netbox_custom_objects from netbox_branching so the two plugins can be enabled together without crashing (NBE-956).
• Migration deployment handling: The operator now deletes NetBox Deployments with Foreground propagation before image-change migrations instead of scaling to 0, and handles stuck terminating Deployments and legacy unlabeled migration Jobs during cleanup (NBE-953).
• Multi-node auto-scaling: cluster_size and instances in KOTS config now default to 0 so the operator scales Redis and PostgreSQL to match node count on multi-node clusters (NBE-860).
• Bootstrap Job TTL: Removed the TTL on the bootstrap Job and stopped non-idempotent SSA writes that caused reconcile loops (NBE-901).
• Spec drift false positives: The operator no longer treats Kubernetes-injected PVC and Service fields as user-driven changes (NBE-901).
• Migration index repair: Repair handles duplicate indexes and other init quirks introduced by the new migration Job (NBE-870).
• diode-ingester startup: Added a wait-for-redis init container so the ingester does not crash-loop while Redis is still coming up (NBE-864).
• External Postgres init.sql: No longer hardcodes database names, so external-DB installs can use whatever names are configured (NBE-936).
• Diode target display: diode_target_display now points at the external ingress host instead of the internal service (NBE-523).
• API token pepper: The operator retries api_token_pepper secret reads on startup to handle kubelet cache lag (NBE-857).
• Migration DB check: stderr is captured separately so diagnostic output does not break the readiness check (NBE-880).
• Deployment stability: External secret checksum changes are debounced to prevent unnecessary rollouts (NBE-867).
• External secret checksums: The operator now resolves external secret checksums before the first deploy and clears the stale hash when you flip between embedded and external secrets, so config swaps no longer trigger spurious rollouts (NBE-940).
• NetBox warm-up: Added a liveness probe initial delay so NetBox is not killed and restarted mid-startup on slow nodes (NBE-938).
• Ingress: Disabled IPv6 in ingress-nginx to avoid connectivity issues on IPv4-only clusters.
• Rolling updates: NetBox deployments use a shared rolling update strategy to avoid deadlocks with topology spread constraints.
• Host preflight: Added a check for IPv6 loopback incompatibility with kube-proxy NLLB, and fixed the host preflight collector path and localhost regex (NBE-891).
• CVE fixes: Bumped kubectl to clear Trivy findings (NBE-890).

2.1.0

NetBox Enterprise 2.1.0 adds Redis Sentinel for redundant Redis deployments, expands Private Copilot with external database and CA certificate support, replaces the migration init-container with a Kubernetes Job, and adds input escaping across all generated Python and SQL configuration.

Versions

This release uses the following upstream software:

• NetBox 4.5.3
• Diode Pro 1.12.4
• PostgreSQL 18.x (via PostgreSQL Operator 6.0.0)
• Redis 7.4.8 (via Redis Operator 0.24.0)
• Hydra v25.4.0
• nbe-operator Chart 2.1.0

Features

• Redis Sentinel: When the Redis cluster size is greater than 1, the operator deploys Redis Sentinel for automatic master failover. Set cluster_size: 0 to auto-scale based on node count (requires cluster-scoped RBAC). Sentinel-unaware clients use a dedicated master-only Service.
• Private Copilot external database: Private Copilot now supports an external PostgreSQL database with verify-ca and verify-full SSL modes and CA certificate trust via the TLS keychain. Private Copilot can also reuse the NetBox PostgreSQL server.
• Migration Job: Database migrations now run as a Kubernetes Job in the reconcile loop, replacing the old init-container approach for safer, more observable upgrades.
• Input escaping: User-supplied values in generated Python config and SQL are escaped to prevent injection (NBE-778, NBE-779, NBE-792).
• API token peppers: Generates API_TOKEN_PEPPERS for the NetBox 4.5 v2 token format. The operator backfills missing pepper keys on upgrade.
• Velero backup/restore: Operator-managed resources carry Velero-selectable labels. Backup and Restore CRDs are included for KOTS-driven disaster recovery.
• Container scanning: CI now runs container security scans on nbe-operator and nbe-core images.

Plugins

The following plugins are included in this release:

Key Improvements

• Redis Sentinel provides automatic failover, eliminating ReadOnlyError during Redis pod restarts on multi-node clusters
• Operator validates Private Copilot database config at reconcile time with actionable error messages
• Migration Job provides better visibility into database migration status and avoids init-container race conditions
• KOTS admin console secrets use data + b64enc instead of stringData for Replicated compatibility
• PGO finalizer wait loop ensures PostgreSQL deletion completes before Helm teardown
• Hydra upgraded to v25.4.0 to match Diode chart requirements

---

NetBox Enterprise 2.0.x

2.0.1

A minor release with plugin and dependency updates.

Versions

This release uses the following upstream software:

• NetBox 4.4.10
• Diode Pro 1.12.4
• PostgreSQL 18.x (via PostgreSQL Operator 6.0.0)
• Redis 7.x (via Redis Operator 0.22.2)
• Hydra v25.4.0
• nbe-operator Chart 2.0.1

Updates

• Update netbox-branching plugin to 0.8.3
• Update Hydra to v25.4.0 to match the Diode chart

2.0.0

NetBox Enterprise 2.0.0 introduces a new declarative Kubernetes operator with intelligent resource orchestration, significant architectural improvements, enhanced security capabilities, and streamlined chart management. This is a major release that adds a second deployment method (Helm) alongside the existing Embedded Cluster path.

Versions

This release uses the following upstream software:

• NetBox 4.4.10
• Diode Pro 1.12.4
• PostgreSQL 18.x (via PostgreSQL Operator 6.0.0)
• Redis 7.x (via Redis Operator 0.22.2)
• nbe-operator Chart 2.0.0

Major Features

• NBE Operator: New Kubernetes-native operator that intelligently orchestrates NetBox, Diode, and related infrastructure components based on declarative NetBoxEnterprise CRD specifications
• CRD Chart Separation: NetBox Enterprise CRD chart is now decoupled from the operator chart, enabling namespace-scoped deployments and independent CRD management
• Enhanced Security: Comprehensive mTLS support for Redis and PostgreSQL connections, plus mTLS for S3 storage connections
• PostgreSQL Operator Upgrade: PGO upgraded to 6.0.0 with PostgreSQL 18 as default
• Diode Pro Support: Full integration with Diode Pro 1.12.4
• Improved Authentication: Hydra OIDC/OAuth2 support with automatic issuer URL generation
• Resource Presets: Configurable resource allocations for Redis and PostgreSQL via Helm values
• Static File Management: Automatic plugin static file collection
• Enhanced Diode Integration: Expanded Diode OAuth2 secret projection
• Custom CA Certificates: Extra CA certs configured via extraCaCertificates are now automatically trusted by Python HTTP clients (webhooks, custom scripts) via REQUESTS_CA_BUNDLE

Plugins

The following plugins are included in this release:

---

NetBox Enterprise 1.14.x

1.14.1

This is a minor bug fix release addressing Redis configuration and certificate handling issues.

Versions

This release uses the following upstream software:

• NetBox 4.4.10
• Redis 7.4.3 (if built-in Redis is enabled)
• PostgreSQL 16.11 (if built-in database is enabled)
• Diode 1.12.0
• Diode Pro 1.12.0

Plugins

The following plugins are included in this release:

Bug Fixes

• cluster: always mount ca-certificates in share to preserve ssl symlinks (b2254e5)
• cluster: ensure consistent formatting of extra CA certs (f6aaa1d)
• cluster: preserve embedded Redis hostname in KOTS values (5f6b282)
• config: patch RedisHealthCheck via post_init instead of class attribute (a5b46d1)
• redis: make sure username/password are properly escaped (24979d4)

1.14.0

This release includes several new features, bug fixes, and dependency updates, primarily an update to NetBox 4.4.

Notable changes in this release include:

• Upgraded NetBox to 4.4.10 and updated several bundled plugins and dependencies.
• Upgraded Diode to 1.12.0 and Diode Pro to 1.12.0 with query optimizations and other updates.
• Updated configuration options (e.g., max_cots for custom objects, maintenance/suspend modes).
• Numerous bug fixes for build, cluster readiness, plugin management, and test automation.
• Dependency updates across Rust, Python, and Docker images for security and compatibility.

Versions

This release uses the following upstream software:

• NetBox 4.4.10
• Redis 7.4.3 (if built-in Redis is enabled)
• PostgreSQL 16.11 (if built-in database is enabled)
• Diode 1.12.0
• Diode Pro 1.12.0

Plugins

The following plugins are included in this release:

Features

• actions: CI/CD workflow improvements including create-or-update channel, configurable case-sensitivity, appliance build triggers on main/promotion, arm64 build optimization, temp replicated customer with auto-cleanup, channel ID resolution, cache hashing updates, automation test dispatching on release, reusable tool downloading, and helm subchart caching
• appliance: reduce apt-get update surface with --no-install-recommends, support direct sequence number download
• auth: feature gate auth configuration with additional config values from netbox docs (NBE-533)
• cluster: (neko) allow external configmap ref and basic customPythonConfig param in CRD for custom python
• config: add max_cots setting for custom objects
• database: update init sql to 4.4.8 schema
• diode: update to Diode chart 1.13.0 with reconciler 1.12.x
• docker: improve layer caching, fix pip wheel cache, add json comments support in packageignore, require JFROG_USER
• netbox: update plugins: branching to 0.8.1, changes to 0.4.2, validity to 3.4.0
• release: update appliance build to create a 1.13.0 stable image
• crd: add license tier to status (NBE-532), CRD status field and event recording, ready status + debounce on api, velero missing warning, auth CRD examples (NBE-533)
• crd: add suspend option to NetBoxCluster and various components for debugging resource application (NBE-409)
• crd: namespace only mode and prune orphaned components (NBE-408)
• operator: netbox-config crate and auth module, wire up to k8s crate for user auth script (NBE-533)
• operator: implement resource mutation pipeline for Kubernetes resources
• operator: add Replicated SDK readiness checks and timeout configuration
• testing: added test for adding a site with DRY refactoring, k9s pod monitoring for deployments
• tooling: rust-toolchain toml file and flake enhancements

Bug Fixes

• actions: CI/CD fixes including accept routes default, undici dependency update, channel handling without assigned customers, release promotion as separate action, channel name resolution with replicated action, slack notification webhook type
• appliance: fix missing size update to builds, cut out filesystem zeroing for build performance
• auth: group mapping in SAML auth, add azuread options to OIDC, use secret projection & helper methods instead of SecretString (NBE-533)
• build: ensure appliance builds trigger properly when updated
• chart: set 0.0.1-main tag for nbe-operator
• ci: run clippy with and without feature flags, fix chart lint and push to replicated workflow
• cluster: prevent RBAC secret errors on multi-node restore (NBE-548), include diode proxy in readiness UI display
• config: prevent azure login URI mismatches (NBE-546), update ova instance settings
• database: back off to older schema
• deps: prevent scrapli errors when Validity plugin is enabled (NBE-543), align kube crypto backend with reqwest using aws-lc-rs
• deps: update netboxlabs-netbox-branching to 0.8.0, netboxlabs-netbox-custom-objects to 0.4.4
• diode: correct diode config to use clientCertPath, fix missing redis tls client mount in dbwait container
• docker: don't redownload internal plugins if they exist, add py deps that need a compiler to sec requirements, streamline Dockerfile, ensure proper newlines
• offline: fix nginx image caching, bump version to 1.29.4
• release: handle Unstable channel name correctly, remove NBE-376 branch condition from release job
• tests: include ca-certs for operator k8s mock client unit tests, fix test initialization missing suspend field
• operator: ready/unready status per component, prevent race condition on upgrade pauses, remove unused K8sError variants, fix locator and channel/license validation for local runs
• linting: super-linter adjustments, shift auth enums to structs for schemars ease, update jq calls to properly throw errors, fix clippy strict mode issues
• ci: stop duplicated messages, update yaml for create customer, graceful allure upload failure handling, schedule main runs to avoid timeouts
• slack: amend notifications for non-test failures, update Slack GitHub action to v2.1.1
• misc: fix reuse ip behavior with env example docs, gitignore path corrections, remove obsolete NetBox versions from packageignore.json, update docker_image to main-latest

Build Updates

• actions: improve workflow of downloading github release tarballs (e78adb2)
• deps: update rust crates: reqwest to 0.13.1, serde_json to 1.0.149, clap to 4.5.54, schemars to 1.2.0, redis to 1.0.2, axum to 0.8.8, k8s-openapi to 0.26.1
• deps: update rust tokio and serde package groups
• deps: bump rsa in the cargo group
• deps: update GitHub Actions: tailscale/github-action to v4, super-linter to v8.3.2, docker/setup-buildx-action to v3.12.0, tj-actions/changed-files to v47.0.1, actions/checkout to v6.0.1, peter-evans/create-pull-request to v8
• deps: update Docker tags: rancher/kubectl to v1.35.0, rust to v1.92
• deps: update helm release reloader to v2.2.7
• deps: update Node.js dependencies: @types/node to ^24.10.7, node to v24.12.0, @vercel/ncc to ^0.38.4
• deps: update Python dependencies: certifi to v2026, pillow to >=12.1.0, allure-pytest to >=2.15.3, playwright to >=1.57.0, pytest to >=9.0.2, python to v3.14.2
• deps: update github artifact actions
• deps-dev: bump k3d version in smoke tests (238bb99)
• release: promote 1.13.1 to stable (c777472)
• release: trigger a new 1.13.1 appliance build (1ca5db0)
• release: bump version to 1.13.1 (eedb446)
• rust: update tokio dependencies together (5c9c4bf)

1.13.1

A small bug fix release to address an nginx image issue.

Bug Fixes

• cluster: include diode proxy in readiness UI display (cead1a4)
• offline: fix nginx image caching, bump version to 1.29.4 (97b9d99)

Build Updates

• release: bump version to 1.13.1 (eedb446)

Versions

This release uses the following upstream software:

• NetBox 4.3.7
• Redis 7.4.3 (if built-in Redis is enabled)
• PostgreSQL 16.11 (if built-in database is enabled)
• Diode 1.11.0
• Diode Pro 1.11.0

Plugins

The following plugins are included in this release:

1.13.0

This release introduces significant new features, bug fixes, and dependency updates. Key highlights include:

• Backup Improvements: Velero backup and restore functionality is improved.
• Appliance Optimization: Reduced appliance image size for airgap installs and improved resource usage.
• High Availability & Scaling: Enhanced multi-node and HA support, including node spread constraints, affinity settings, and per-node replica configuration.
• External Storage & TLS: Added support for external Redis with TLS, custom S3 storage, and improved certificate management across all pods.
• Diode Updates: Upgraded Diode components, added proxy configuration, and improved telemetry defaults.
• Security & Permissions: Refined role permissions, made media and scripts private, and improved secret handling.
• Build & Dependency Updates: Numerous updates to dependencies, build scripts, and plugin versions for improved stability and compatibility.

Features

• appliance: zero extra space in appliance image
• cluster: move ingress configuration from EC config to values; add ingress controller as a sub-chart; scale wait timeout linearly with node count; normalize wait timeouts for various initContainer checks; set spread constraints and affinities to spread across nodes; always disable embedded file storage if HA is licensed; cleanly handle node count when multinode is enabled; skip affinity labels when fs storage is disabled; add worker affinities to match nbe pods; include prometheus CRDs only in EC installs; wipe jobs that are failed or incomplete on upgrade; include env+diode checksums in migration checks; include environment checksum in netbox pods
• config: add extra node info to config screen; use node_count for replicas everywhere; overhaul of kots config to match current expectations; camelCase everything, working out a kots config for operator
• database: (built-in) PGO should only watch our namespace; make sure pgo initializes early when enabled; add Redis and PostgreSQL restore hooks with RBAC permissions and validation scripts
• diode: update reconciler pro to 1.11.0; add diode proxy configuration, deployment, and service; upgrade to 1.9.1 chart; diode defaults for telemetry and other config
• netbox: make nb replicas per-node; make media and scripts private to force querystring auth; custom plugin install now pulls from S3 if configured
• redis: improve handling of sentinel failover; handle checksums to encourage pod restarts on config change
• storage: add config for external s3 storage; ImageSpec trait & macro to clean up image overrides
• tls: make sure all pods use fully-generated cert store
• velero: add Velero backup resources to ClusterRole and example configuration; add backup module to Velero CRD; implement Velero backup and restore functionality; add support for Velero backup and restore resources in NetBox
• crd: crd export so it is on cluster during helm install

Bug Fixes

• actions: update semantic release code to handle release/* and bump versions
• appliance: guard against strict mode
• backups: don't attempt to backup the pending PVC if filesystem storage is disabled; move velero resources to the chart, only deploy if velero is found
• cluster: make sure certificate names don't clobber each other; handle upgrade over previous embedded ingress cleanly; handle airgap/pull-secrets properly for ingress-nginx; simplify HA/multi-node config choices; only mount user-data volume if persistence is enabled; update nbe affinity to pin if media is set, but otherwise spread out; no need to wait since reloader is disabled on upgrade; limit job cleanup to housekeeping and utils; move secret init to separate hook; simplify/reduce upgrade hooks for secrets; make sure init can create secrets during deploy; fix integer compare when lockfile does not exist; propagate global db enable to subchart; always create CA secrets if set; handle update when there are no certs; add environment configmap to checksum; make sure service account is created before pre-upgrade; add batch API group for cronjob; refactor roles into rw and ro to further reduce permissions; reduce permissions for roles to the namespace; remove redundant hydra secret defs to cease post-install redef warnings; separate cert and insecure option logic; pass on redis tls params to diode; complete changeover to insecure_skip_verify; use insecure_skip_tls_verify instead of ssl_self_signed; correct permissions and ensure pre-upgrade doesn't abort; set image pull secrets across all deployments; update embedded cluster configuration for DaemonSet and host networking; remove commented lines for clarity in embedded cluster configuration
• database: ensure post-install waits on right db secrets before running; use generated secret for netbox init; only helm hook n pre-upgrade for db init; set helm hooks on db secret init job because of immutability during upgrade; update image configuration for Redis and PostgreSQL restore hooks
• deployment: reorder imports for consistency
• diode: consolidate OAuth2 endpoint configurations in nginx; add OAuth2 token introspection endpoint to nginx configuration; refactor gRPC service locations and remove upstream definitions; get rid of extraneous optional match; use nginx image pull secrets config; update diode proxy deployment to match others; replicas should scale to the number of nodes; handle both diode protobuf types properly; update upstream server references in diode proxy configuration; show diode/hydra resource status in app console
• netbox: disable persistence when external S3 is being used; ensure SSL config environment matches everywhere; initialize user configs; set AWS_S3_VERIFY for self sign self hosted options; use custom healthcheck against /ht NBE-488; add netbox healthcheck plugin NBE-488; config mounts for maintenance mode pod, hidden rerender addition, bring back the helm hook NBE-486; hidden trigger_render so redeploy will rerender NBE-486; restore-mode becomes maintenance-mode, use nbe-core instead of util NBE-461; use 0.1.5 nbe plugin; use 0.1.4 nbe plugin; use nbe plugin 0.1.2 with SCRIPTS_ROOT change; keep 0.1.1 nbe plugin; set netbox-enterprise-plugin to 0.1.1; strip cache buster code out, set staticfiles to filesystem NBE-347; strip cache buster via middleware NBE-347; disable aws checksum validation for custom s3 endpoints NBE-347; add no-ssl-verify option for s3 NBE-347; region_name to configmap-extra storages NBE-347; s3 region configuration setting NBE-347; improved logic for s3 vs PV storage; invert "Use S3" checkmark to match other settings; s3 access fixes; ensure static files are readable on first install; append netbox_enterprise_plugin to plugins NBE-347; add netbox_enterprise_plugin to managed plugins NBE-347
• redis: handle cacert mounting properly; make sure redis operations have reasonable timeouts; pass TLS config to redis CLI startup checks; mount TLS cert only if it exists; initContainer checks want REDIS_HOST and REDIS_PORT set; refactor redis config and normalize on external secret; create secret for external redis in EC; redis-cli now uses redis ssl cert (and username for redis 6+)
• storage: update S3 secret configuration and disable S3 when embedded file storage is enabled; don't add user-data-volume pvc when s3 enabled; revert check for s3 when creating PV; restore s3 secrets and envs; ensure secrets aren't turned into envs if they don't exist; address nil pointer issue when s3 is not enabled; update persistence settings and S3 configuration for worker scaling in multi-node setups; enhance worker scaling and persistence settings for multi-node setups; standardize helm timeout and improve pod distribution logic for S3 storage; update helm timeout to be dynamic based on node count; increase helm timeout for multinode clusters
• misc: fixing linting errors in renovate.json; updated renovate json to tie pytest and playwright versions together to prevent workflow failures; linting errors resolved (hopefully); changes to fix linting error; updated workflow to get correct channel information; require jfrog user & token for docker build NBE-347; fixed branch sanitisation block so it will find channel name correctly; clean up unwrap and similar errors in operator crate; clean up unwrap and similar errors in k8s crate; makefile fixes for macos

Build Updates

• appliance: update appliance build for 1.12.4/stable (667479d)
• deps: update peter-evans/create-pull-request action to v7.0.11 (#588) (a24d03e)
• deps: update peter-evans/create-pull-request action to v7.0.10 (#585) (560d7a5)
• deps: update alpine docker tag to v3.23 (#578) (135b20c)
• deps: update dependency python to v3.14.1 (#574) (314a1d4)
• deps: update dependency allure-pytest to >=2.15.2 (#572) (e9caf10)
• deps: update actions/setup-node action to v6.1.0 (#569) (72d442d)
• deps: update rust crate log to 0.4.29 (#568) (3923ca8)
• deps: switch to python 3.12 to match nbe runtime (678099c)
• deps: update dependency python to v3.14.1 (ea344bc)
• deps: update dependency django to ~=5.2.9 (#565) (98cdbc5)
• deps: update actions/checkout action to v6.0.1 (8531445)
• deps: update dependency netboxlabs-diode-netbox-plugin to ~=1.6.0 (#563) (5f876dd)
• deps: update super-linter/super-linter action to v8.3.0 (#556) (11e3261)
• deps: update swatinem/rust-cache action to v2.8.2 (#543) (2b307c4)
• deps: update dependency pytest to v9 (#486) (ea7da93)
• deps: update dependency pillow to v12 (#485) (c52f847)
• deps: update actions/setup-python action (fbc1f7a)
• deps: update dependency node to v24 (1fd39de)
• deps: update nginx docker tag to v1.29 (#478) (4b1aa6a)
• deps: update actions/github-script action to v8 (42895fe)
• deps: update actions/checkout action to v6 (fd9f2c6)
• deps: update dependency node to v22.21.1 (e82cddf)
• deps: update pgo docker tag to v5.8.5 (d006c10)
• deps: update actions/github-script action to v7.1.0 (#473) (adf9ea2)
• deps: update rust crate tokio-postgres to 0.7.15 (51678f6)
• deps: update rust crate tokio to 1.48.0 (71a2433)
• deps: update rust crate serde_json to 1.0.145 (5087cfa)
• deps: update rust crate secrecy to 0.10.3 (2aee077)
• deps: update rust crate postgres-native-tls to 0.5.2 (9675e33)
• deps: update rust crate serde_yaml to 0.9.34 (5ffb0cf)
• deps: update actions/checkout action to v5.0.1 (69723ca)
• deps: update rust crate thiserror to 2.0.17 (1161023)
• deps: update rust crate reqwest to 0.12.24 (29b3a56)
• deps: update rust crate rand to 0.9.2 (e97ead2)
• deps: update rust crate passwords to 3.1.16 (4a20a1e)
• deps: update rust crate native-tls to 0.2.14 (4690c67)
• deps: update rust crate log to 0.4.28 (4a54729)
• deps: update rust crate http-body-util to 0.1.3 (#455) (edcfb24)
• deps: update rust crate http to 1.4.0 (#457) (dacc74b)
• deps: update rust crate hex to 0.4.3 (#453) (50efbf7)
• deps: update replicated docker tag to v1.11.2 (#450) (d1876a9)
• deps: update rust crate futures to 0.3.31 (#452) (fa611ca)
• deps: update aws-actions/configure-aws-credentials action to v5.1.1 (eefc71c)
• deps: update rust crate base64 to 0.22.1 (#451) (c87080d)
• deps: update dependency pytest-playwright to >=0.7.2 (651637e)
• deps: update slackapi/slack-github-action digest to 26d9f0a (#445) (7bbd4b4)
• deps: bump deps with cargo update (10e0c34)
• deps: update actions/checkout action to v5.0.1 (#446) (35f52e6)
• deps: let renovate take over actions updates from dependabot (2b93eac)
• deps: update django, assurance, and diode plugins (7a8958c)
• deps: bump peter-evans/create-pull-request from 7.0.8 to 7.0.9 (f10d682)
• deps: bump useblacksmith/setup-docker-builder from 1.1.0 to 1.2.0 (3027245)
• deps: bump dtolnay/rust-toolchain (4c62c44)
• deps: update dependency netboxlabs-diode-netbox-plugin to ~=1.5.1 (#423) (1cc07d1)
• deps: update rust create ipnetwork to dev release with schemars1 support (e873a64)
• deps: update rust crate k8s-openapi to 0.26.0 (dba3976)
• deps: update rust crate schemars to v1 (8a1379a)
• deps: update rust crate kube-derive to v2 (77730fd)
• deps: update rust crate clap to 4.5.53 (43e8a6e)
• deps: update rust crate typed-builder to 0.23.2 (#416) (9136155)
• deps: update rust crate clap to 4.5.52 (#409) (e2f7000)
• deps: update rust crate typed-builder to 0.23.1 (#403) (32618d8)
• deps: bump bridgecrewio/checkov-action (1ce0493)
• deps: update rust crate axum to 0.8.7 (#402) (51c1544)
• deps: update rust crate bytes to 1.11.0 (#400) (cfbc9f6)
• deps: update replicated docker tag to v1.11.1 (6d9b7de)
• deps: update rancher/kubectl docker tag to v1.34.2 (#399) (11d109f)
• deps: bump useblacksmith/setup-docker-builder (fe787a1)
• deps: update rust crate hyper to 1.8.1 (3622963)
• deps: update dependency protobuf to >=6.33.1 (d776c97)
• deps: update rust crate rsa to 0.9.9 (302e182)
• deps: bump bridgecrewio/checkov-action (eb1aad1)
• deps: update dependency playwright to >=1.56.0 (ff36330)
• deps: update rust crate hyper to 1.8.0 (86c50fc)
• deps: update dependency certifi to >=2025.11.12 (4e22e36)
• deps: update dependency xmlsec to >=1.3.17 (160ba65)
• deps: bump bridgecrewio/checkov-action (b9700f6)
• deps: bump dtolnay/rust-toolchain (f1a2f58)
• deps: update rust crate sha2 to 0.10.9 (#378) (cd3a590)
• deps: update rust crate rsa to 0.9.8 (#377) (948cac6)
• deps: update rust crate pem to 3.0.6 (#375) (69642d2)
• deps: update rust crate md-5 to 0.10.6 (#374) (60436f5)
• deps: update pgo docker tag to v5.8.4 (#272) (3bfbf2a)
• deps: bump docker/setup-qemu-action from 3.6.0 to 3.7.0 (cacd282)
• deps: bump helm/chart-testing-action from 2.7.0 to 2.8.0 (ad5712a)
• deps: update helm release reloader to v2.2.5 (7ecd402)
• deps: update replicated docker tag to v1.11.0 (d1e1f1f)
• deps: update dependency brotli to >=1.2.0 (279071f)
• deps: update rust crate chrono to 0.4.42 (569c1fd)
• deps: bump useblacksmith/setup-docker-builder (b830043)
• deps: bump bridgecrewio/checkov-action (90cd780)
• deps: bump docker/metadata-action from 5.8.0 to 5.10.0 (a0566c1)
• deps: bump docker/build-push-action from 6.10.0 to 6.18.0 (e74b9eb)
• deps: update helm release reloader to v2.2.4 (0a2359d)
• deps: bump docker/metadata-action from 5.5.1 to 5.8.0 (4c3807c)
• deps: bump bridgecrewio/checkov-action (daf45f5)
• deps: bump jfrog/setup-jfrog-cli from 4.8.0 to 4.8.1 (5964f59)
• deps: update rust docker tag to v1.91 (11abece)
• deps: update dependency netboxlabs-diode-netbox-plugin to ~=1.5.0 (b4563f7)
• deps: bump actions/upload-artifact from 4 to 5 (2fd5d52)
• deps: bump actions/download-artifact from 5.0.0 to 6.0.0 (e7e6189)
• deps: bump actions/checkout from 4 to 5 (d290874)
• deps: bump slackapi/slack-github-action from 1.27.0 to 2.1.1 (0a258b1)
• deps: update dependency paramiko to v4 (1e8ac63)
• deps: update dependency requests to >=2.32.5 (a810f72)
• deps: update dependency python-dotenv to >=1.2.1 (2f3b5cc)
• deps: update replicated docker tag to v1.10.0 (aa0250b)
• deps: update dependency pytest-playwright to >=0.7.1 (19d4201)
• deps: update dependency paramiko to >=3.5.1 (fef905f)
• docker: skip restricted and multiverse in ubuntu updates (1799975)
• docker: sync build.sh assurance plugin with manifest (8c17e0b)
• release: bump version to 1.12.5, diode chart to 1.10.0 (5d96905)
• renovate: implement 7-day cooldown for dep updates (8dd6e49)
• renovate: let renovate update github actions instead of dependabot (843fbc9)
• renovate: group kubernetes packages (2e7a633)
• renovate: add release/* to renovate watch branches (df1faff)

Versions

This release uses the following upstream software:

• NetBox 4.3.7
• Redis 7.4.3 (if built-in Redis is enabled)
• PostgreSQL 16.11 (if built-in database is enabled)
• Diode 1.11.0
• Diode Pro 1.11.0

Plugins

The following plugins are included in this release:

NetBox Enterprise 1.12.x

1.12.4

This is a small update over 1.12.3, containing a few security and plugin updates.

Versions

This release uses the following upstream software:

• NetBox 4.3.7
• Redis 7.4.3 (if built-in Redis is enabled)
• PostgreSQL 16.10 (if built-in database is enabled)
• Diode 1.8.1
• Diode Pro 1.8.1

Plugins

The following plugins are included in this release:

1.12.3

This update contains a number of bug fixes and a few small features, most notably improvements to Disaster Recovery for embedded cluster installs. It also upgrades Diode and Diode Pro to version 1.8.1, and includes several other plugin updates.

Features

• backups: include PGO CRDs so they're available on restore (d135a9e)
• docs: replace conventional-changelog with cocogitto (b00d64b)
• netbox: increase RSS feed timeout, make configurable (f049984)

Bug Fixes

• backups: tell velero to back up (some) cluster resources (696de3e)
• backups: tag the filter file as a velero resource (b355957)
• backups: resources needs to be in the same namespace as velero (b3ebf08)
• backups: add missing namespace to the backup file (9b6599b)
• backups: filter unnecessary ephemeral volumes (b4ae133)
• cluster: normalize proxied images + JFrog URLs (d13deb4)
• cluster: add embedded cluster registry to pull secrets (0cf60b0)
• database: make sure node count propagates to postgresql config (65baec9)
• diode: make sure all config fields are initialized (1a206eb)
• docs: remove author from commits as well (bfb5c08)
• docs: skip date in CHANGELOG header (1cf165e)

Build Updates

• deps: update replicated docker tag to v1.9.0 (454290a)
• deps: update netboxlabs-diode-netbox-plugin to ~=1.4.1 and netboxlabs-netbox-assurance-plugin to ~=1.2.1 (63cf501)
• deps: update helm release diode to v1.8.1 (dbce017)
• deps: update dependency netboxlabs-diode-netbox-plugin to ~=1.4.0 (49ac529)
• update diode_reconciler_pro_image to version 1.8.1 (041b990)

Versions

This release uses the following upstream software:

• NetBox 4.3.7
• Redis 7.4.3 (if built-in Redis is enabled)
• PostgreSQL 16.10 (if built-in database is enabled)
• Diode 1.8.1
• Diode Pro 1.8.1

Plugins

The following plugins are included in this release:

1.12.2

This update contains a number of bug fixes and improvements. Most notably, it improves support for custom TLS certificates, fixes issues with custom script uploading, and fixes custom environment quoting issues. It also contains some other small internal changes, as well as improvements to the build process.

Bug Fixes

• backups: explicitly tag user-data for backup (NBE-375)
• cluster: clean up isolated links for bundle generation
• cluster: clean up whitespace and unnecessary backup labels
• cluster: extra bounds-checking on redis wait
• cluster: postgresql is not actually ready until service is published
• cluster: update images to point to our jfrog repo
• diode: enable postgresql SSL when applicable (NBE-393)
• docker: switch to rancher kubectl binary
• isolated: do not enable redis metrics for now
• isolated: fix diode image overrides (NBE-354)
• netbox: normalize environment quoting/escaping (NBE-351)
• netbox: read-write scripts on core pod (ENGHLP-527)
• netbox: refactor volume mounts
• test: extend smoke test timeout

Features

• backups: configure newer-style disaster recovery resources
• backups: split backup yaml into backup/restore
• backups: tell velero to backup all volumes by default
• cluster: check for unmerged branches before upgrading
• cluster: make sure imagePullSecrets are explicitly set in values
• database: add sslmode=prefer to generated URIs
• diode: enable postgresql SSL when applicable (NBE-393)
• docker: add packages to match oryd/k8s-toolbox
• docker: fetch ghcr images from jfrog proxy
• docker: parameterize cache dir
• docker: refactor build scripts, separate python lxml/xmlsec build
• netbox: add option for applying extra certs to the netbox pods
• netbox: put custom certs into the system CA store (NBE-373)
• netbox: update init schema to 4.3.7

Versions

This release uses the following upstream software:

• NetBox 4.3.7
• Redis 7.4.3 (if built-in Redis is enabled)
• PostgreSQL 16.10 (if built-in database is enabled)
• Diode 1.5.0
• Diode Pro 1.6.0

Plugins

The following plugins are included in this release:

1.12.1

This is a minor update over 1.12.0, containing several bug fixes and small improvements. Most notable is a fix to tempdir handling in the branching plugin, a minor PostgreSQL upgrade, and an update to NetBox 4.3.7.

Bug Fixes

• cluster: add prometheus volume mount for worker and housekeeping
• cluster: conditionally include netbox-enterprise-worker in statusInformers based on restore_mode
• cluster: fetch kubectl latest stable rather than pulling from a docker image
• cluster: override redis sentinel and perms images correctly
• cluster: skip redis ping when environment not configured
• database: rework postgresql check to honor PG* env vars
• docker: always pull upstream images before building
• netbox: remove ipv6 checkbox and config entirely, ipv4 only inside cluster NBE-334
• netbox: set resourcesPreset via kots for netbox downstream containers NBE-337

Features

• cluster: additional resource-waiting for worker and housekeeping
• cluster: NBE-302: Upgrade Embedded Cluster
• cluster: update housekeeping job to retrigger and clean up old jobs
• database: add wait-for-* scripts suitable for init containers
• netbox: bump to 4.3.7

Versions

This release uses the following upstream software:

• NetBox 4.3.7
• Redis 7.4.3 (if built-in Redis is enabled)
• PostgreSQL 16.10 (if built-in database is enabled)
• Diode 1.5.0
• Diode Pro 1.6.0

Plugins

The following plugins are included in this release:

1.12.0

This is a major update in the NetBox Enterprise series, bringing a number of user-facing features and improvements as well as many under-the-hood changes to improve stability and performance and to facilitate future development.

Notable updates include:

• Upgraded NetBox to version 4.3.
• Updated several plugins to their latest versions.
• Embedded Cluster users will get a number of core improvements including better support for running in various types of restrictive environments.
• Cleaned up internal networking-related code. Manual settings for IPv4-only environments are no longer necessary.
• Many internal refactorings and cleanups targeting future feature development.
• Fixed an issue where the presence of a single quote character in the superuser password could cause NBE to fail.

Versions

This release uses the following upstream software:

• NetBox 4.3.2
• Redis 7.4.3 (if built-in Redis is enabled)
• PostgreSQL 16.9 (if built-in database is enabled)
• Diode 1.5.0
• Diode Pro 1.6.0

Plugins

The following plugins are included in this release:

NetBox Enterprise 1.10.x

1.10.7

This is a rerelease of 1.10.6 to update the Diode plugin to 1.3.1 to avoid model tags which can conflict with other plugins.

No other changes were made.

Versions

This release uses the following upstream software:

• NetBox 4.2.9
• Redis 7.4.3 (if built-in Redis is enabled)
• PostgreSQL 16.8 (if built-in database is enabled)
• Diode 1.5.0
• Diode Pro 1.6.0

Plugins

The following plugins are included in this release:

1.10.6

This release contains a few small fixes to handle upgrades from much older releases, plus support for toggling whether to auto-apply in Diode.

Bug Fixes

• cluster: check permissions before calling kubectl
• cluster: don't wait for secrets to mount
• cluster: fetch secrets without writing to tmp
• cluster: hooks on secrets can cause them to not deploy
• cluster: only validate built-in db
• cluster: parameterize psql cli arguments
• cluster: postgresql lib should source common lib
• cluster: remove generated hook name portion
• cluster: wait for postgresql before validating
• cluster: wait function should re-enable set -e on success
• database: fix configmap definition
• database: psql var interpolation does not happen in -c
• database: query a count when checking databases
• database: query a count when checking roles

Features

• cluster: check dbs on upgrade, create if needed
• cluster: export namespace env for scripts
• cluster: kots diode config section w/ auto apply option NBE-312
• cluster: make admin available for post-upgrade script
• cluster: wait for internal db cluster resource to be ready
• database: also wait for the postgres user to be ready

Versions

This release uses the following upstream software:

• NetBox 4.2.9
• Redis 7.4.3 (if built-in Redis is enabled)
• PostgreSQL 16.8 (if built-in database is enabled)
• Diode 1.5.0
• Diode Pro 1.6.0

Plugins

The following plugins are included in this release:

1.10.5

This release primarily consists of some internal build system improvements, plus support for the latest version of Diode and Assurance. This Assurance update includes deduplication support for licensed installs.

Bug Fixes

• cluster: backport job cleanup from 1.12
• cluster: fix missing diode local image refs (NBE-288)
• cluster: get rid of duplicate mount names
• cluster: make sure diode pro image is included in additionalImages
• cluster: make sure ipv4/ipv6 config overrides default values.yaml
• cluster: make sure webhook patch does not run
• cluster: switch bitnami images to use updated registry
• cluster: update diode ingress values for 1.7.0 chart
• database: sanitize table count var for whitespace
• diode: explicitly enable hydra
• ingress: fix ingress replacement on upgrade
• netbox: extend migration lock to 5 minutes
• netbox: remove broken config_diff plugin from runtime image
• netbox: replace nb-docker entrypoint with our own
• netbox: wait a bit for reloader to settle

Features

• cluster: add extra metadata to reload checksum
• cluster: add reloader config to diode global annotations
• cluster: backport sequence helper from 1.11
• cluster: give reloader a short pause-period so they happen only once
• diode: bump diode chart to 1.6.2 (diode 1.5.0)
• diode: bump reconciler to 1.6.0
• docker: bump version for plugin updates
• netbox: enable branching+changes in isolated installs
• netbox: simplify custom plugin config, use new user-packages dir

Performance Improvements

• netbox: threading config improvements

Versions

This release uses the following upstream software:

• NetBox 4.2.9
• Redis 7.4.3 (if built-in Redis is enabled)
• PostgreSQL 16.8 (if built-in database is enabled)
• Diode 1.5.0
• Diode Pro 1.6.0

Plugins

The following plugins are included in this release:

1.10.4

Bug fixes for isolated/proxy environments, plus a few other small enhancements to make upgrades go more smoothly.

NOTE: This release also removes the netbox-config-diff plugin from the base image, as it conflicts with other plugins at runtime when enabled.

Bug Fixes

• cluster: fix missing diode local image refs (NBE-288)
• cluster: get rid of duplicate mount names
• cluster: make sure diode pro image is included in additionalImages
• cluster: make sure ipv4/ipv6 config overrides default values.yaml
• cluster: make sure webhook patch does not run
• database: sanitize table count var for whitespace
• netbox: extend migration lock to 5 minutes
• netbox: remove broken config_diff plugin from runtime image
• netbox: replace nb-docker entrypoint with our own

Features

• cluster: add extra metadata to reload checksum
• cluster: add reloader config to diode global annotations
• cluster: backport sequence helper from 1.11
• cluster: give reloader a short pause-period so they happen only once
• netbox: enable branching+changes in isolated installs
• netbox: simplify custom plugin config, use new user-packages dir

Versions

This release uses the following upstream software:

• NetBox 4.2.9
• Redis 7.4.3 (if built-in Redis is enabled)
• PostgreSQL 16.8 (if built-in database is enabled)
• Diode 1.2.0

Plugins

The following plugins are included in this release:

1.10.3

Contains a few small bug fixes and enhancements, including reducing the memory footprint of individual NetBox pods and configurable worker replicas, faster initialization on startup, and a new news feed for NBE-specific announcements.

Bug Fixes

• diode: make hydra automigration run during init
• diode: make sure hydra automigrate always runs
• netbox: always (re)apply custom plugin code if wheelhouse exists
• netbox: escape password in db pre-init
• netbox: update feed URL for Enterprise News config
• netbox: we need 2 threads for background processing

Features

• chart: add scripts for running migration atomically
• chart: add utility scripts for logging and redis checks
• chart: use new migration scripts in initContainers
• cluster: bump to nbe-utils 7, add to VERSION file
• cluster: limit unavailable pods during rolling update
• cluster: set nbe-utils version during build
• cluster: set tag as part of build instead of in source
• cluster: support file resources in configmap
• config: make worker replicas configurable
• config: update install to list available features
• docker: bump version to include new utilities
• netbox: add RSS feed widget for Enterprise News in configmap
• netbox: bump default netbox resource memory a tad
• netbox: max 1 unit thread per pod
• netbox: move unit config to values yaml
• netbox: pre-initialize database
• netbox: remove commandbar

Versions

This release uses the following upstream software:

• NetBox 4.2.9
• Redis 7.4.3 (if built-in Redis is enabled)
• PostgreSQL 16.8 (if built-in database is enabled)
• Diode 1.2.0

Plugins

The following plugins are included in this release:

1.10.1/1.10.2

Minor releases to fix a number of issues with Diode and Assurance integration.

Bug Fixes

• db: move postgresql permissions-setting to an init
• diode: backport runtime-secret script from 1.11
• netbox: make sure netbox refreshes when override hostname changes
• redis: remove redis modules no longer needed for diode

Features

• config: add hostname override to the KOTS config
• config: show Diode/Assurance license status in KOTS UI
• diode: add deployments and services for diode components in replicated-app.yaml

Versions

This release uses the following upstream software:

• NetBox 4.2.9
• Redis 7.4.2 (if built-in Redis is enabled)
• PostgreSQL 16.8 (if built-in database is enabled)
• Diode 1.2.0

Plugins

The following plugins are included in this release:

1.10.0

This in the first release to include Diode and the NetBox Assurance plugin.

Features

• cluster: import basic diode chart
• cluster: only pull images if necessary
• diode: add diode chart dependency and enable configuration
• diode: add diode reconciler and ingester configuration to netbox enterprise chart
• diode: add proxy to diode image pull
• diode: auto-configure diode plugin in netbox config
• diode: always update the host secret
• diode: bump assurance plugin to 1.0.1
• diode: change diode/hydra to use NBE PostgreSQL
• diode: configure plugin based on ingress hostname
• diode: don't auto-apply changesets if assurance is enabled
• diode: generate a secret containing the external host reliably
• diode: wait for backend to be running before configuring the diode plugin
• docker: switch chart to use production (1.20.0) nbe image

Versions

This release uses the following upstream software:

• NetBox 4.2.9
• Redis 7.4.2 (if built-in Redis is enabled)
• PostgreSQL 16.8 (if built-in database is enabled)
• Diode 1.2.0

Plugins

The following plugins are included in this release:

NetBox Enterprise 1.9.x

1.9.3

Fix a bug that caused failure to download resources in airgap and proxied environments. Also includes an updated Branching plugin that fixes a number of bugs.

Bug Fixes

• cluster: clean up proxy references for dependencies

Versions

This release uses the following upstream software:

• NetBox 4.2.9
• Redis 7.4.2 (if built-in Redis is enabled)
• PostgreSQL 16.8 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

1.9.2

Updates NetBox to 4.2.9, plus includes an update to the cluster software which improves the handling of upgrades.

NOTE: This update will upgrade NetBox to 4.2.9. If you have custom plugins installed, you will need to upgrade to NetBox Enterprise 1.9.2 and then create a new wheelhouse that contains plugins compatible with 4.2.9.

Please review the upstream NetBox release notes from your current version through 4.2.9 for a complete list of breaking changes, enhancements, and bug fixes.

Features

• cluster: bump to 2.4.0
• netbox: bump to NetBox 4.2.9

Versions

This release uses the following upstream software:

• NetBox 4.2.9
• Redis 7.4.2 (if built-in Redis is enabled)
• PostgreSQL 16.8 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

1.9.1

A minor release that contains build process updates under the covers, plus the Python XML fixes introduced in NetBox Enterprise 1.8.6.

Versions

This release uses the following upstream software:

• NetBox 4.2.6
• Redis 7.4.2 (if built-in Redis is enabled)
• PostgreSQL 16.8 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

1.9.0

Updates the embedded NetBox to 4.2.6. Also upgrades a number of dependencies to their latest versions, adds some extra system consistency validation checks, and reduces the number of proxied domains necessary to install NetBox Enterprise.

Bug Fixes

• netbox: update to docker image with pydantic fix (NBE-185)
• add exit statements for better error handling in configmap-executable.yaml
• adjust formatting in cronjob-backup-labeler.yaml for consistency
• remove branch reference for command bar disabling from CI workflow and update Docker image tag
• remove unnecessary conditional for nodeSelector in cronjob-backup-labeler.yaml
• replace hardcoded imagePullPolicy with configurable value in cronjob-backup-labeler.yaml
• restore TTL and backoff limit in backup labeler CronJob configuration
• update Docker image tag to indicate command bar disabling
• update imagePullPolicy to 'IfNotPresent' in cronjob-backup-labeler.yaml
• update system validation query to use jq and change backup labeler image to netboxlabs/nbe-utils:latest
• update system validation query image version to netboxlabs/nbe-utils:1

Features

• add CronJob for netbox sidecar task to do system validation
• add system validation check CronJob with service account and role binding
• add TTL and backoff limit to backup labeler CronJob configuration
• cluster: add settings for the improved proxy support
• cluster: update to 2.3.1
• config: create some macros for nbe-utils and replace busybox
• deps: update pgo to 5.7.4, replicated-sdk to 1.5.0
• increase replicas for postgres instance to improve availability
• netbox: bump to netbox 4.2.6 and ensure versions are correct
• rename replicas_node_count to node_count for consistency in postgres configuration
• update backup labeler configuration with TTL and backoff limit
• update backup labeler to routines labeler and improve system validation error handling
• update dependencies in Chart.lock for netbox-enterprise
• update netbox sidecar CronJob to run every 5 minutes and improve error handling
• update postgres replica configuration to use dynamic node count

Versions

This release uses the following upstream software:

• NetBox 4.2.6
• Redis 7.4.2 (if built-in Redis is enabled)
• PostgreSQL 16.8 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

NetBox Enterprise 1.8.x

1.8.6

Contains a fix for mismatched XML modules used by some 3rd-party plugins.

Bug Fixes

• docker: ignore low-priority trivy warning about KOTS dep
• docker: make sure lxml and xmlsec match (NBE-193)

Versions

This release uses the following upstream software:

• NetBox 4.1.11
• Redis 7.4.2 (if built-in database is enabled)
• PostgreSQL 16.8 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

1.8.5

Contains a fix for upgrades freezing in some situations.

Bug Fixes

• cluster: remove unnecessary repository entry in ingress-nginx config

Versions

This release uses the following upstream software:

• NetBox 4.1.11
• Redis 7.4.2 (if built-in database is enabled)
• PostgreSQL 16.8 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

1.8.4

Provides a number of updates to custom plugin installation, as well as other small enhancements and bug fixes, included in the 1.7.x series, most notably the security fix for the ingress-nginx controller (CVE-2025-1974).

Bug Fixes

• cluster: properly show "ready" in restore mode
• cluster: remove the admission controller from status checks
• cluster: repair some shellcheck issues, remove vestigial config
• netbox: a few small cosmetic fixes to plugin install
• netbox: improve plugin installation issues for custom tarballs

Versions

This release uses the following upstream software:

• NetBox 4.1.11
• Redis 7.4.2 (if built-in database is enabled)
• PostgreSQL 16.8 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

1.8.3

Provides a number of updates to custom plugin installation, as well as other small enhancements and bug fixes, included in the 1.7.x series, most notably the security fix for the ingress-nginx controller (CVE-2025-1974).

Bug Fixes

• cluster: properly show "ready" in restore mode
• netbox: a few small cosmetic fixes to plugin install
• repair some shellcheck issues, remove vestigial config

Features

• cluster: make a label to tag pods supporting upload

Versions

This release uses the following upstream software:

• NetBox 4.1.11
• Redis 7.4.2 (if built-in database is enabled)
• PostgreSQL 16.6 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

1.8.1

Fixes user creation, password validation, and group/SSO issues in NetBox.

Bug Fixes

• netbox: use proper import location of the OWASP validator
• docker: fix nbce-common install, remove deprecated nbc_auth
• docker: make sure nbc_auth_extensions are in the right place

Versions

This release uses the following upstream software:

• NetBox 4.1.11
• Redis 7.4.2 (if built-in database is enabled)
• PostgreSQL 16.6 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

1.8.0

Improves logging in the NetBox containers, and adds support for uploading custom plugins.

Bug Fixes

• cluster: fixed a few pod label macros
• config: feedback - use bash for extra script safety
• config: remove vestigial validation mount

Features

• config: adding log fixing branch to the CI workflow to create a release in Replicated
• config: allow uploading plugins for pip install

Versions

This release uses the following upstream software:

• NetBox 4.1.11
• Redis 7.4.2 (if built-in database is enabled)
• PostgreSQL 16.6 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

NetBox Enterprise 1.7.x

1.7.6

Contains a fix for incorrect permissions in the media folder after restore from backup.

Bug Fixes

• cluster: remove the admission controller from status checks
• netbox: make sure volume permissions are correct

Versions

This release uses the following upstream software:

• NetBox 4.1.11
• Redis 7.4.2 (if built-in database is enabled)
• PostgreSQL 16.8 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

1.7.5

Contains a security fix for the ingress-nginx controller (CVE-2025-1974).

Bug Fixes

• cluster: disable ingress-nginx admission controller

Versions

This release uses the following upstream software:

• NetBox 4.1.11
• Redis 7.4.2 (if built-in database is enabled)
• PostgreSQL 16.6 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

1.7.4

Fix missing authentication plugins for group and SSO configs.

Bug Fixes

• docker: make sure nbc_auth_extensions are in the right place

Versions

This release uses the following upstream software:

• NetBox 4.1.11
• Redis 7.4.2 (if built-in database is enabled)
• PostgreSQL 16.6 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

1.7.3

Re-release of 1.7.2 with additional password validator fixes, plus reverting to a previous working redis chart.

Bug Fixes

• netbox: use proper import location of the OWASP validator

Versions

This release uses the following upstream software:

• NetBox 4.1.11
• Redis 7.4.2 (if built-in database is enabled)
• PostgreSQL 16.6 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

1.7.2

Fixes a bug where the custom password validator was missing.

Bug Fixes

• docker: fix nbce-common install, remove deprecated nbc_auth

Versions

This release uses the following upstream software:

• NetBox 4.1.11
• Redis 7.4.2 (if built-in database is enabled)
• PostgreSQL 16.6 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

1.7.1

Fixes a bug in downloading the ingress Helm chart when using a proxy for installation.

Bug Fixes

• cluster: use the proxy to download the ingress chart

Versions

This release uses the following upstream software:

• NetBox 4.1.11
• Redis 7.4.2 (if built-in database is enabled)
• PostgreSQL 16.6 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

1.7.0

Updates the embedded NetBox to 4.1.11. Also upgrades the cluster software, which brings many bug fixes and features, including better preflight checks, and a direct link to the NetBox UI from the admin console.

Features

• cluster: update to 1.19.0
• cluster: add a link to the NetBox UI from the admin console
• deps: update to NetBox 4.1.11 + latest NetBox chart

Versions

This release uses the following upstream software:

• NetBox 4.1.11
• Redis 7.4.2
• PostgreSQL 16.6 (if built-in database is enabled)

Plugins

The following plugins are included in this release:

NetBox Enterprise 1.6.x

1.6.5

Fixes a small bug that would cause the admin console to improperly display an error on upgrade. Also updates a few dependencies.

Bug Fixes

• cluster: move ingress back to ingress-nginx namespace

Features

• deps: bump to latest docker image + current plugins
• deps: update bitnami-common and netbox oss charts
• netbox: update to latest 4.0.x-compatible plugins

Plugins

The following plugins are included in this release:

1.6.4

Disable unnecessary Redis persistence and redundant PostgreSQL backups, plus fix an issue with file upload limits and missing static content from enabled plugins.

NetBox Enterprise 1.6.4 includes NetBox 4.1.7, and is anticipated to be a release candidate for stable.

Plugins

The following plugins are included in this release:

1.6.3

Just a few small bug fixes, mostly related to internal changes. Also contains dependency updates.

1.6.2

Primarily internal and build-related changes. No new features.

1.6.1

Fixes a number of bugs related to file uploads and proxy environments.

1.6.0

Adds the changes plugin by default, and upgrades NetBox to 4.1.7. Fixes some small bugs in plugin initialization and proxied installs.

NetBox Enterprise 1.5.x

1.5.0

The 1.5.x series was released internally for development testing of upgrades to NetBox 4.1 and branching plugin inclusion.

NetBox Enterprise 1.4.x

1.4.2

A re-release of 1.4.1 with a fix that makes sure plugin versions that are only compatible with NetBox 4.1 are not included.

Plugins

The following plugins are included in this release:

1.4.1

A small release with some dependency updates and the latest set of NetBox 4.0-compatible plugins.

Plugins

The following plugins are included in this release:

1.4.0

Adds support for supplying custom environment variables (eg, for LDAP config). It also contains a small auth change to allow curly braces and spaces in the new password validator.

A number of included plugins were updated to their latest compatible versions:

• netbox_bgp was updated to 0.13.3
• netbox_floorplan_plugin was updated to 0.4.1
• netbox_plugin_dns was updated to 1.1.3
• netbox_topology_views was updated to 4.0.1
• slurpit_netbox was updated to 0.9.84

NetBox Enterprise 1.3.x

1.3.0

Compatible with any standard Kubernetes ingress controller now in KOTS installs, rather than only Nginx. Also fixes a potential data loss issue with uploaded images, as well as enabling script and report uploads.

NetBox Enterprise 1.2.x

1.2.0

Improves ingress configuration, adds support for inheriting the TLS configuration from the Admin Console configuration, and adds a "restore mode" for restoring manual backup data, plus many dependency updates and internal improvements.

NetBox Enterprise 1.1.x

1.1.0

Simplifies the firewall configuration necessary for installation by making sure all initialization downloads go through our proxy domain.

NetBox Enterprise 1.0.x

1.0.6

Adds support for NetBox resource usage adjustment and some improvements to startup time on a first install.

It also adds support for backup and restore, depending on your environment and license.

1.0.5

Adds support for scraping Prometheus metrics from NetBox, as well as the embedded PostgreSQL, Redis, and SeaweedFS if they are enabled.

Updated to support NetBox v4.0.9, and includes additional bug fixes and startup time improvements.

1.0.4

Adds OWASP password complexity validation to NetBox, and includes dependency updates.

1.0.3

Fixes issues with preflight checks, and includes minor dependency updates.

1.0.2

Provides a number of dependency updates and bug fixes, and includes initial support for backups of built-in Redis and PostgreSQL.

1.0.1

Provides bug fixes encountered during the initial rollout of the NetBox Enterprise application.

1.0.0

Provides final cleanup of the Beta stream in preparation for the wider release.

Provides a number of internal changes, and includes fixes for an issue where annotations could render improperly and cause problems with upgrades. Updated to support NetBox v4.0.7.