1.2.0

LibreDB Studio 1.2.0 brings Studio to Red Hat OpenShift and Rancher: sign-in with the cluster's own accounts, databases discovered from the cluster's operators with every user seeing only what Kubernetes lets them read, an operator for OperatorHub, and a console plugin.

Action required: Kubernetes-discovered connection ids change from 12 to 32 hex characters, and old seed:k8s-<slug>-<12 hex> links stop resolving.
Action required: on a cluster whose domain is not cluster.local, set discovery.kubernetes.clusterDomain (or SEED_KUBERNETES_DISCOVERY_CLUSTER_DOMAIN); otherwise no discovered database is listed.
Action required (operator): before approving an upgrade's InstallPlan, check every stored LibreDBStudio against the upgrade checks in docs/OPENSHIFT.md, "Upgrading the operator"; a dropped backup key deletes the backup claim and its dumps.
Action required (operator): the operator now installs for its own namespace only, and OLM cannot move a 1.1.0 install there, so a 1.1.0 install is uninstalled and reinstalled as docs/OPENSHIFT.md, "Moving from operator 1.1.0", describes.
Behaviour change: an unknown NEXT_PUBLIC_AUTH_PROVIDER value now refuses boot instead of falling back.
Behaviour change: on HTTPS, Studio's cookies use __Host- names (for example __Host-auth-token); everyone signs in once more after the upgrade, and scripts that send a saved session cookie over HTTPS must use the new name.

OpenShift

• NEXT_PUBLIC_AUTH_PROVIDER=openshift signs people in through the cluster's OAuth server, with Studio's ServiceAccount as the OAuth client and one consent screen; no Studio password.
• Each request on a discovered connection is reviewed with the signed-in user's own token, so a user lists and opens only the databases whose credential Secret they may read; a denied id answers exactly like an unknown one. Admin is whoever may update Studio's Deployment, or the LibreDBStudio resource under the operator.
• The chart renders this mode with authProvider: openshift: the OAuth client annotations, a projected client token, the cluster CA, an OpenShift Route with a fixed host, a ConsoleLink in the console's application menu, and, with discovery on, a NetworkPolicy that limits database egress to the discovered namespaces.
• The OLM operator runs the same chart for the cluster Studio namespace, installs for its own namespace only, and validates LibreDBStudio resources (the bundled PostgreSQL and route settings accept only what Studio needs).
• The console plugin libredb/libredb-studio-openshift-plugin 0.1.0 adds a Databases page and a details item that open a database in Studio in a new tab; the chart and operator install it, pinned by digest, and OperatorHub's toggle enables it.
• The image runs under an arbitrary UID in group 0, as restricted-v2 requires.
• Setup, upgrade and uninstall: docs/OPENSHIFT.md. Supported: OpenShift 4.16 and later with the built-in OAuth server, tested on 4.22.

Kubernetes discovery and Rancher

• Databases managed by CloudNativePG, EDB Postgres for Kubernetes, Crunchy PGO (v1beta1) and MongoDB Community appear as connections, through an exporter that reads only their credential Secrets; each row checks its Service, uses an absolute host name with its own TLS setting, and gets a 32-hex id.
• Rancher mode gates discovered connections and admin with a SubjectAccessReview, and the chart ships the access review, the discovery exporter, a NavLink and Rancher's install questions.

Agent

• The read-only agent now runs statements on Oracle, Db2 LUW, ClickHouse, libSQL, InfluxDB 3 and InfluxQL, Elasticsearch, OpenSearch, Cassandra, Couchbase, Druid, LibreDB and Neo4j Enterprise, and reads metadata on Redis, etcd, Oxia, Milvus, Qdrant and Weaviate.
• A run read allowance that every budgeted read charges, and clearer refusals when a statement was refused before it was sent.

Fixes and hardening

• Hardening of the operator and of Studio's cookies; the PostgreSQL row bound sits before locking clauses and the query limiter reads more FETCH forms; masked columns stay masked in charts, pivot and pivot export; the account store's outage answers 503.
• The chart connects to the bundled PostgreSQL without TLS while it serves none, keeps the console's form view working (route.main in the schema), and stops the old pod first when one pod holds the volume claim.

Helm chart: 0.1.119

The chart moves to appVersion 1.2.0. OpenShift mode, the console plugin values and the Rancher-mode values are all off by default, so a default install renders as before.

Full changelog: 1.1.0...1.2.0