Cerebro v0.11.0

v0.11.0 - 2026-07-31

Breaking Changes

• Replaced the old auth.type + auth.settings configuration format with provider-specific sections: auth.basic, auth.ldap, auth.proxy, auth.entra_id and auth.oauth.
• Basic auth users now live under auth.basic.users; LDAP settings now live under auth.ldap; trusted proxy, Microsoft Entra ID and generic OAuth/OIDC are separate provider sections.

Security

• Added configurable YAML RBAC policies backed by Casbin for backend API authorization.
• Added per-cluster RBAC objects and feature-oriented permissions for Cerebro actions.
• Added profile page visibility for authenticated user, groups, roles and effective permissions.
• Added multi-user basic authentication with backend-only password storage.
• Added bcrypt password hashing for basic authentication checks.
• Added session max lifetime, idle timeout and cookie max-age controls.
• Added LDAP group discovery for RBAC bindings and LDAPS e2e coverage.
• Added trusted proxy authentication for oauth2-proxy and similar reverse proxies.
• Added generic OAuth/OIDC authentication provider support.
• Added direct Microsoft Entra ID authentication through OIDC authorization-code flow.
• Reworked authentication config into independent auth.basic, auth.ldap, auth.proxy, auth.entra_id and auth.oauth provider sections.
• Added short-form single auth providers and named provider maps.
• Added support for multiple named auth providers with globally unique provider IDs.
• Returned both auth provider type and provider ID in auth status/profile responses.
• Added OpenSSF Scorecard analysis with published reports and Code Scanning integration.

Frontend

• Added an overview filter for hiding ILM rolled-over indices marked with index.lifecycle.indexing_complete (#13).
• Added login buttons for configured external auth providers.
• Added user menu in the navbar with profile and logout actions.
• Fixed frontend API client session-cookie handling for Vite and generated-client requests.
• Cleared frontend auth/session stores on login and logout transitions.

Development

• Enabled dev RBAC - admin has full access and user has read-only access.
• docker-compose oauth2-proxy development setup
• Updated the Go toolchain, CI and build images to Go 1.26.5.

Documentation

• Added dedicated RBAC documentation and updated authentication examples to the provider-based config format.
• Added dedicated authentication docs for basic auth, LDAP, trusted proxy, Microsoft Entra ID and generic OAuth/OIDC.
• Added short example READMEs for auth-related example configs.

Chore

• Bump the go-dependencies group with 4 updates (#18)
• Bump the npm-dependencies group with 4 updates (#19)
• Bump actions/download-artifact from 4 to 8 (#21)
• Bump node from 24-alpine to 26-alpine (#22)
• Bump actions/upload-artifact from 4 to 7 (#20)
• Bump actions/setup-go from 6 to 7 (#29)
• Bump actions/setup-node from 6 to 7 (#30)
• Bump postcss from 8.5.16 to 8.5.23 (#32)
• Bump the go-dependencies group across 1 directory with 10 updates (#31)
• Bump the npm-dependencies group across 1 directory with 13 updates (#33)
• Bump actions/setup-go from 6 to 7 (#37)
• Bump lucide-react from 1.26.0 to 1.27.0 in the npm-minor-patch group (#40)

Cerebro v0.11.0-rc1

changelog date

Cerebro v0.10.1

Fixes

• Fixed ad hoc Elasticsearch URLs so /clusters/{cluster} API routes work after connecting with a manually entered node address.

Cerebro v0.10.0

This is the first Go Cerebro release. It is a fork of lmenezes/cerebro, rewritten from the original Java + Angular application to Go + Huma + React + TypeScript.

Rewrite

• Replaced the Java/Play backend with a Go backend.
• Replaced the Angular frontend with a modern React + TypeScript frontend.
• Added Huma-based HTTP API registration and OpenAPI generation.
• Added generated TypeScript API client from openapi/cerebro.json.
• Added TanStack Router for frontend routing.
• Added TanStack Form and TanStack Store where form/app state is needed.
• Reworked frontend styling away from Bootstrap/Angular-era assets while preserving the original Cerebro layout and behavior.
• Replaced Font Awesome usage with modern React icons.
• Removed committed generated frontend bundles from the repository workflow.

Elasticsearch

• Replaced ad hoc Elasticsearch HTTP usage with the official Go Elasticsearch client transport.
• Updated the Elasticsearch Go client to v9 and routed low-level requests through the official transport interface.
• Moved stable Elasticsearch operations to official esapi request builders while keeping raw REST-console requests dynamic.
• Added configurable Elasticsearch TLS trust with es.ca_cert_file.
• Added configurable Elasticsearch mutual TLS with es.client_cert_file and es.client_key_file.
• Added optional AWS SigV4 request signing for Amazon OpenSearch Service.
• Added validation that Elasticsearch client cert/key are configured together.
• Added response size limits for Elasticsearch responses.
• Kept ad hoc Elasticsearch hosts disabled by default through es.allow_ad_hoc_hosts: false.
• Added a two-node Elasticsearch development cluster in Docker Compose.
• Added development sample indices workflow support.

API

• Added schema-aware API responses exposed through Huma/OpenAPI.
• Added OpenAPI generation command: cerebro openapi.
• Added generated frontend client workflow: npm run api:generate.
• Added OpenAPI/client consistency checks in CI.
• Added $schema metadata to API response models where applicable.
• Added typed endpoints for overview, nodes, aliases, templates, snapshots, repositories, REST, cat APIs, analysis, index settings, cluster settings and data explorer.
• Moved Elasticsearch-operating API routes under a global /clusters/{cluster} Huma route group.
• Added backend-generated cluster slugs for configured Elasticsearch hosts, including stable duplicate suffixes.
• Resolved Elasticsearch cluster targets once per request through group middleware instead of passing host data through endpoint bodies.
• Added REST-style detail endpoints for templates so list pages can load lightweight summaries first and fetch full definitions only when editing.
• Added /auth/status for frontend auth/session state without exposing Elasticsearch credentials.

Frontend

• Added Vite development setup with live reload on port 5173.
• Added Vite proxy support for the /clusters API prefix used by the generated client.
• Added build-time version injection and cerebro version.
• Added updated connect screen logo with Go mark.
• Added Cerebro favicon links and /favicon.ico fallback for development and embedded builds.
• Added refresh interval persistence in local storage.
• Added stable cluster loading when opening a non-overview route directly.
• Fixed header/menu regressions after the React rewrite.
• Fixed dropdown behavior for index menus and top navigation.
• Fixed notification rendering and modal z-index issues.
• Standardized modals, close buttons, ESC handling and delete confirmations.
• Added JSON syntax highlighting in read-only/editing modals.
• Improved sorting for aliases and similar list pages.
• Fixed repository form error reporting and type-specific settings templates.
• Expanded cluster and index settings pages with version-aware dynamic setting suggestions.
• Added type-aware cluster and index setting controls for booleans, numbers, sizes, durations and known enum values.
• Normalized scientific-notation numeric setting values in the settings UI and fixed settings group navigation.
• Improved cluster and index settings grouping to reduce one-item groups.
• Added overview detection and subtle highlighting for data stream backing indices.
• Unified cluster and index settings layout around the same header, filter, group navigation and pending-change panels.
• Preserved the original Cerebro overview behavior more closely, including shard controls, affected-index filtering and relocation flow.
• Unified table density, table headers and list section headers across more pages.
• Moved yellow/red cluster health details from the host label into a dedicated header health menu with allocation explanations and safe replica-count fixes.
• Added a shared React table component and reused it across administrative list tables for consistent headers, empty states and row details.
• Added wizard/json editing for legacy and composable index templates, including version-aware mapping field types and nested field mapping generation.
• Added component template listing, creation, editing and deletion with composed_of support in index templates.
• Added template type persistence in the URL and changed component-template composition to an explicit add/remove list.
• Added edited template persistence in the URL and native edit links for templates and ILM policies.
• Split component templates into user and managed tables, and removed the unused pattern column from reusable component templates.
• Split index templates into user and managed tables and added a data-stream indicator for index templates.
• Replaced text sort markers with shared up/down arrow icons across sortable tables.
• Split template loading into a lightweight list response and a separate detail request when editing one template.
• Replaced template action endpoints with REST-style GET, PUT and DELETE /templates/{kind}/{name} routes.
• Removed frontend handling of Elasticsearch username/password overrides; Elasticsearch credentials are resolved only by the backend host configuration.

REST Console

• Reworked the REST page.
• Added request history handling.
• Added cURL copy support.
• Added syntax-highlighted request and response editors.
• Added resizable request/output panes with persisted split size.
• Added better handling for Elasticsearch errors so UI errors do not leak as unhandled console exceptions.
• Added cat API selection support.

Data Explorer

• Added optional data explorer feature, disabled by default and enabled in development config.
• Added per-index browse action.
• Added table-style document browsing similar to a database client.
• Added pagination at the top and bottom.
• Added KQL-like and Lucene query modes.
• Added field/operator suggestions.
• Added insert and edit support.
• Added read-only index detection that disables write actions.
• Added document sorting, including _id sorting.
• Added safer modal behavior for row selection and document editing.

Data Streams

• Added a data streams page under the more menu.
• Added data stream listing with status, generation, backing index count, store size, template and lifecycle details.
• Added backing index details, write-index badges and links to index settings/data explorer.
• Added data stream creation, rollover, Data Stream Lifecycle retention update and delete actions with confirmations.
• Separated ILM-managed data stream status from Data Stream Lifecycle retention editing.
• Added ILM policies page under the more menu with create, update, delete and JSON policy editing.
• Added wizard/json tabs for ILM policy editing, with TanStack Form-backed wizard fields for common lifecycle phases and actions.
• Split ILM policies into managed and not managed tables using Elasticsearch in_use_by metadata.
• Added Data Streams action for attaching an ILM policy by updating the matching composable index template, with optional backing-index update and rollover.
• Data Streams now link ILM policy details to the ILM policies page.
• Added Data Streams action for detaching ILM from the matching composable index template, with optional backing-index cleanup.
• Linked data stream ILM policy labels directly to the matching editable ILM policy form.
• Split Data Streams loading into a lightweight list endpoint and a per-stream detail endpoint selected from the URL.
• Added sortable backing-index details and non-flickering background refresh on the Data Streams page.
• Added ILM policy usage hover details showing concrete indices, data streams and templates.
• Added graceful handling for Elasticsearch versions that do not support data streams.

Security

• Added backend REST method allowlist for proxied Elasticsearch requests.
• Added LDAP ldaps:// requirement by default.
• Added auth.settings.ca_cert_file for custom LDAP CA trust.
• Added explicit insecure_ldap development escape hatch.
• Added first-class HTTPS listener support with server.tls_cert_file and server.tls_key_file.
• Added configurable HSTS when served through HTTPS.
• Added configurable server.csrf_enabled with session-bound CSRF tokens for protected API requests.
• Added frontend API interceptor support for X-Cerebro-CSRF.
• Protected /clusters/{cluster} API routes with the auth/CSRF gate.
• Changed unauthenticated API access from redirects to 401 Unauthorized.
• Added Fetch Metadata plus same-origin Origin/Referer checks for protected API requests.
• Hardened basic-auth credential comparison with hashed constant-time comparison.
• Added Permissions-Policy.
• Kept CSP, referrer policy, frame and content-type protection headers.
• Added REST history body redaction for sensitive keys.
• Added tests for sensitive history redaction and truncation.
• Added gosec and govulnche...

Cerebro v0.10.0-rc3

optimize docker release builds

Cerebro v0.10.0-rc2

embed frontend assets

Cerebro v0.10.0-rc1

preserve cluster settings edits