| IVN-24712 REST API Authentication |
The ML service REST API (/api/v1) now requires API key authentication. API keys and the admin secret are generated at install and kept across upgrades. The Grafana Infinity datasource is provisioned with the API key, so dashboards authenticate automatically |
| IVN-24712 Grafana Hardening |
Anonymous access to datasource configuration is blocked (401 on read and write). Session cookies are now Secure and SameSite. Login rate-limiting is enabled. The Grafana admin password is generated at install instead of using a default |
| IVN-24712 Mutual TLS Between vNetC and Monitoring |
Both vNetC and the monitoring VM verify each other's certificates. Before this release, only the server side was verified |
| IVN-24712 Automatic TLS Provisioning |
Install creates a CA for each deployment (in /be_install/satori_ca/) and issues a server certificate, with no manual certificate steps. The gateway serves this certificate over HTTPS on port 8443. The CA can only sign certificates for the monitoring VM's own IP and hostname (nameConstraints, pathlen:0), so a stolen CA key can't be used for any other host. Server certificates are reissued automatically when they are within 30 days of expiry or the IP changes, and vNetC keeps trusting them. The CA is only regenerated if the hostname changes or regeneration is forced, which requires re-pinning the CA on vNetC |
| IVN-24712 vNetC Certificate Trust (Outbound) |
The monitoring VM checks vNetC's certificate against a pinned CA for announce, NBI, and package download calls. trust_vnetc_ca.sh fetches the certificate chain from VNETC_ROOT_URL, validates it, and installs only the CA. NBI_VERIFY_SSL now points to this CA (/app/certs/vnetc.pem) for every outbound HTTPS call. The CA fingerprint is confirmed once, either at an interactive prompt or by setting VNETC_CA_FINGERPRINT before an unattended install. An unattended install with no pinned fingerprint stops with an error. The pin is stored in /be_install/vnetc_ca.fingerprint and is kept across upgrades. Trust is re-checked on every upgrade: a new vNetC server certificate is accepted automatically, but a changed CA is refused unless forced |
| IVN-24712 Monitoring Certificate Trust on vNetC (Inbound) |
vNetC must trust the monitoring CA before it can connect to the gateway on port 8443. Copy satori_ca.pem, satori_ca.fingerprint, and trust_satori_ca_on_vnetc.sh to the vNetC host and run the script. Alternatively, run the script with --fetch to download the CA and confirm its fingerprint. The script installs the CA in /var/ns/ca-certs-loaded/ and pins its fingerprint in /var/ns/etc/satori_ca.fingerprint. The CA is included in vNetC backups and copied to HA peers automatically. If the monitoring CA is regenerated, run the script again with force to re-pin it |
| IVN-24712 Data Store Authentication |
Redis now requires a password generated at install and no longer exposes a host port. Neo4j credentials are generated at install. APOC is limited to four required procedures. The Neo4j browser route is removed from the gateway |
| IVN-24712 Container Hardening |
Monitoring services now run with reduced privileges, following container security best practices. Access between services and the host is restricted, and gateway routing is tightened. |
| IVN-24712 Pinned Container Images |
Container images are pinned to exact versions instead of floating tags. Builds are reproducible and can't silently pick up unvetted upstream changes |
| IVN-24712 Install Manifest Verification |
Install checks the image and payload manifest before deploying. A tampered bundle fails early |
| IVN-24712 Credential Cleanup |
Hardcoded credentials are removed from the environment files that ship with the product. Those values are now empty placeholders |
| IVN-24712 Documentation Updates |
The monitoring installation and configuration guides now cover automatic TLS setup, key generation, and the updated install flow |