Skip to content

v0.8.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Jun 16:49
v0.8.0
3f1e2ff
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The SaaS-readiness release. 0.8.0 lands the two pillars a multi-tenant,
externally-exposed Toise needs — access security and resilience / HA —
plus a multi-source identity overlay and a major attribute-enrichment pass.

Everything is additive and opt-in: the zero-config single-binary path is
unchanged and now guarded by a CI smoke test. No wire-contract break, no data
migration — a 0.7 deployment upgrades in place.

Highlights

Access security for multi-tenant SaaS (ADR 0028)

Everything needed to expose Toise to external customers, all off by default:

  • derive-only tenant trust mode — the tenant is derived from the scoped token, the client X-Scope-OrgID header is ignored, so a caller can never claim another tenant.
  • Tokens hashed at rest (SHA-256) — a leaked config or memory dump exposes no usable credential.
  • Per-tenant RBAC — role-scoped tenant tokens (read / ingest / full).
  • OIDC / JWT verification on the read surfaces — tenant and role read from claims.
  • mTLS on ingest — authenticate producers by client certificate.
  • Append-only audit log of operator writes.

Resilience & HA (ADR 0029)

  • Scheduled online backups and continuous log shipping to a directory or an S3-compatible store (AWS S3, MinIO, Ceph, R2 — one config shape).
  • restore-log rebuilds a data dir from shipped segments, directly from the configured target (S3 or a directory).
  • Read HA with no clustering — run N identical replicas behind a load balancer; each rebuilds its projection from the same OTLP fan-out.
  • Tenant scaling — a per-node cap (max_tenants) plus horizontal sharding, with a toise_tenants_open gauge to watch headroom. No Raft, no ring.

Multi-source identity (ADR 0020)

Producers can assert that two entities are the same real thing via a same_as
belief edge carrying a confidence and a basis (e.g. a serial match or a Hyper-V
KVP guest id). Above a configurable threshold, get_entity shows the canonical
group and impact_of / find_path treat a machine's facets as one — without
ever merging storage.

Attribute enrichment

  • A cross-cutting governance vocabulary (ownership, criticality, location, lifecycle) advertised on describe_schema.
  • Attribute filtering on the GraphQL entities query — parity with MCP find_entities.
  • Pinned descriptive vocabularies for host, network.device, network.interface, compute.vm, service.listener and the remote-probe entities (AT8–AT13).

Also

  • ADRs 0028 / 0029 / 0030 ratified; a consolidated Deployment tiers & SaaS operations guide; a tier-0 zero-config CI smoke test.
  • go install …/cmd/toise-server@latest works again; the /viz graph no longer truncates at the 200-item page cap; cold subcommands tolerate shipping environment variables.

Install

# Binary (Linux amd64 shown — also darwin/linux × amd64/arm64)
curl -fsSLO https://github.com/toise-dev/toise/releases/download/v0.8.0/toise_v0.8.0_linux_amd64.tar.gz
tar xzf toise_v0.8.0_linux_amd64.tar.gz

# From source
go install github.com/toise-dev/toise/cmd/toise-server@v0.8.0

# Container (multi-arch image on GHCR)
docker pull ghcr.io/toise-dev/toise:v0.8.0
docker run --rm -p 8080:8080 -p 4317:4317 ghcr.io/toise-dev/toise:v0.8.0

Each tarball ships a .sha256 — verify before installing.

Links

Assets 10
Loading