v2.1.0 — Automated Runbooks, Service Automation, REST API v2 & Enterprise Operations

OpsKnight v2.1.0 is an enterprise release delivering sandboxed Runbooks with native agent orchestration, intelligent Service Automation routing and normalization, public REST API v2 with granular RBAC, Enterprise OIDC and SCIM 2.0 lifecycle management, and PostgreSQL 16 disaster recovery tooling.

---

🚀 Added & Highlights

1. 🤖 Automated Runbooks & Outbound Agents (Beta)

• Safe Runbook Remediation: Reusable remediation workflows with explicit input parameter validation, interactive execution preview, live step log streaming, and human confirmation gates.
• Private Outbound Agents: Secure daemon agents (opsknight-agent) executing in isolated customer infrastructure, communicating outbound-only over mutual-TLS with capability qualification and secret scoping.
• Unattended-Write Authorization: Mutating actions execute unattended only when an administrator explicitly authorizes the exact pinned rule version with verified post-step health checks.
• Timeline Audit Trails: Complete chronological visibility into execution plans, step outputs, responder confirmations, and terminal outcomes.

2. ⚡ Service Automation & Alert Normalization (Beta)

• First-Match Routing Rules: Deterministic alert rule evaluation with immutable, checksum-verified normalization context.
• Alert Enrichment & Triage: Extract payload metadata, normalize severity across disparate monitoring providers, and enrich incidents with tier and diagnostic context before paging.
• Shadow Simulation Mode: Test and evaluate new routing rules against live production alert streams without affecting production response.
• Verified Auto-Recovery: Automatic incident resolution upon verified clean recovery, safely cancelling in-flight escalation.

3. 🌐 REST API v2 & Capability Catalog

• Public REST API v2: Comprehensive, versioned REST API with OpenAPI 3.1 specifications, request signing, idempotency keys, and cursor pagination.
• Granular Scopes & RBAC: Fine-grained API scopes (incidents:read, automation:publish, runbooks:execute, etc.) enforced across Admin, Responder, and Auditor roles.

4. 🔐 Enterprise Identity & SCIM 2.0

• Enterprise OIDC Compatibility: Hardened identity federation compatible with Microsoft Entra ID, Okta, Google Workspace, Keycloak, and Auth0.
• SCIM 2.0 Identity Lifecycle: Automated user and group provisioning, role mapping, deprovisioning, and bearer-token management.
• Emergency Access & Lockout Recovery: Cryptographic hardware-key (WebAuthn/FIDO2) and salted recovery credentials for emergency administrator access during IdP outages.

5. 🛡️ Operational Reliability & Disaster Recovery

• PostgreSQL 16 Disaster Recovery: Rehearsed backup, point-in-time recovery, and verified rollback drill procedures preserving operational data.
• Health Center Redundancy: Real-time visibility into worker pools, scheduler health, queue depth, and database connection poolers.

---

📦 Upgrading to v2.1.0

Warning

Always create a full backup of your PostgreSQL database before upgrading.
Review docs/v2.1.0/operate/upgrades/upgrade.md for zero-downtime rolling upgrade guidance.
If running PgBouncer or connection poolers, ensure DIRECT_DATABASE_URL is configured to point directly to PostgreSQL port 5432 so database migrations run successfully.

Docker / Compose

# 1. Pull the certified v2.1.0 release image
docker pull ghcr.io/opsknight-labs/opsknight:2.1.0

# 2. Restart the stack
docker compose down && docker compose up -d

Kubernetes / Helm

# 1. Update repository
helm repo update

# 2. Upgrade release with v2.1.0 image tag
helm upgrade opsknight opsknight/opsknight \
  --set image.tag=2.1.0 \
  --reuse-values

Docker Swarm

# 1. Pull release image across nodes
docker pull ghcr.io/opsknight-labs/opsknight:2.1.0

# 2. Deploy updated stack
OPSKNIGHT_IMAGE=ghcr.io/opsknight-labs/opsknight:2.1.0 ./deploy/swarm/scripts/deploy.sh

Post-Upgrade Verification Checklist

1. Verify Health Center: Open Administration → Health Center and confirm all database, worker, and scheduler indicators report green.
2. Synthetic Incident Test: Create a test incident manually or via API to verify the incident engine and alert normalization.
3. Runbook Agent Check: Verify connected agents in Settings → Runbooks → Agents report healthy heartbeats and mutual-TLS state.
4. Lifecycle Confirmation: Acknowledge and resolve the incident to verify state machine transitions and audit log entries.
5. Notification Delivery: Verify alerts are dispatched successfully to configured channels (Email, Slack, Teams, Voice, Web Push).
6. Mobile PWA Verification: Open the PWA on responder devices to confirm subscription registration and notification delivery.

---

Full Changelog · Documentation · Upgrade Guide