[Feat] release 4.4.1

content/latest/_index.md

@@ -4,7 +4,7 @@ weight: 002
 description: User guides, deploy docs, references, and deep dives about the
   Rhize manufacturing data hub.
 cascade:
-  v: "4.4.0"
+  v: "4.4.1"
   type: "docs"
   icon: molecule
 

content/releases/4-4-1.md

@@ -0,0 +1,70 @@
+---
+title: 4.4.1
+date: '2026-09-01T15:15:04-03:00'
+description: Release notes for v4.4.1 of the Rhize application
+categories: ["releases"]
+weight: 1629780914 ## auto-generated, don't change
+---
+
+Release notes for version 4.4.1 of the Rhize application.
+This minor release brings changes to the Agent, Workflow, and ISA-95 services to fix backward compatibility for OIDC client auth and change configuration of event sources.
+
+_Release date:_
+1 Sep 2026
+
+## Changes by service
+
+The following sections document the changes this release brings to each service.
+
+
+
+### Agent
+
+#### Add
+
+- Add username/password client auth (backward compatible with pre-4.4 configs)
+
+
+### Workflow
+
+
+#### Add
+
+- Add username/password client auth (backward compatible with pre-4.4 configs)
+- Allow configuration of event sources by YAML or environment variables
+
+#### Remove 
+
+- Remove versioning from event sources.
+
+### ISA-95
+
+#### Remove 
+
+- Remove versioning from event sources.
+
+
+### Admin
+
+_No changes. Releasing in step with other components._
+
+### BaaS
+
+_No changes. Releasing in step with other components._
+
+
+### Typescript host service
+
+_No changes. Releasing in step with other components._
+
+## Compatibility
+
+{{< compatible "4.4.1" >}}
+
+## Checksums
+
+{{% checksums "v4.4.1-checksums.txt"  %}}
+
+## Upgrade
+
+To upgrade to v4.4.1, follow the [Upgrade instructions](/deploy/upgrade).

content/versions/v4.4.0/_index.md

@@ -0,0 +1,21 @@
+---
+title: Rhize Product documentation
+weight: 002
+description: User guides, deploy docs, references, and deep dives about the
+  Rhize manufacturing data hub.
+cascade:
+  v: "4.4.0"
+  type: "docs"
+  icon: molecule
+
+---
+
+The following topics cover everything you need to know to administrate and use Rhize.
+
+For administrators, the Deploy topics cover everything about deploying Rhize on Kubernetes and maintaining through the cycle.
+For day-to-day users, the product documentation covers everything you need to use Rhize to model production and transform and store data.
+
+
+{{< card-list >}}
+
+

content/versions/v4.4.0/deploy/_index.md

@@ -0,0 +1,41 @@
+---
+title: Deploy
+description: >-
+  A collection of pages to administrate Rhize: install, upgrade, back up, and more.
+weight: 100
+icon: server
+identifier: deploy
+cascade:
+  icon: server
+  domain_name: libremfg.ai
+  brand_name: Libre
+  application_name: libre
+  db: libreBaas
+  pre_reqs: |-
+    - Optional: [kubectx](https://github.com/ahmetb/kubectx) utilities
+        - `kubectx` to manage multiple clusters
+        - `kubens` to switch between and configure namespaces easily
+    - Optional: the [k8 Lens IDE](https://k8slens.dev), if you prefer to use Kubernetes graphically
+  k8s_cluster_ns: |-
+    ```bash
+    ## context
+    kubectl config current-context
+    ## namespace
+    kubectl get namespace
+    ```
+
+    To change the namespace for all subsequent [`kubectl` commands](https://kubernetes.io/docs/reference/kubectl/cheatsheet/) to `libre`, run this command:
+
+    ```bash
+    kubectl config set-context --current --namespace=libre
+    ```
+
+aliases:
+  - /deploy/
+
+---
+
+A collection of pages to administrate Rhize: install, upgrade, back up, and more.
+
+
+{{< card-list >}}

content/versions/v4.4.0/deploy/about-openidconnect.md

@@ -0,0 +1,50 @@
+---
+title: About OpenID connect
+description: The Rhize GraphQL implementation uses OpenIDConnect for
+  Authentication and role-based access control. This section describes how to
+  set up Keycloak
+weight: 999
+categories: ["concepts"]
+db: libreBaas
+aliases:
+  - /explanations/about-openidconnect
+  - /deploy/about-openidconnect
+
+---
+
+Rhize uses [OpenIDConnect](https://openid.net/developers/how-connect-works/) to connect to a [Keycloak](https://www.keycloak.org/) server to authenticate users and manage Role-based access controls.
+
+Open ID Connect is a security architecture that uses JSON Web Tokens (JWTs) to access secured resources.
+JWTs are issued by Keycloak. Users can also be managed in Keycloak.
+Or you can manage users in other services such as LDAP, Google, Azure AD, Facebook, etc.
+
+The general authentication flow is as follows:
+1. When a user accesses the user interface, the UI redirects to Keycloak.
+1. Depending on how it is configured, Keycloak redirects to the authentication provider so that the user can log in.
+1. If the user is successfully authenticated, Keycloak redirects back to the user interface with an authentication code in the URL parameters.
+1. The UI calls a secure API to exchange the authentication code for a JWT.
+1. The UI then uses that JWT to access secure APIs such as the Rhize GraphQL API.
+
+The Rhize DB, {{< param db >}}, has the public key from Keycloak, which can be used to verify the JWT.
+
+```mermaid
+sequenceDiagram
+	actor User
+	participant UI as Web UI
+	participant Rhize as Rhize DB
+	participant KC as Keycloak
+	participant AP as AuthProvider
+	Rhize->>KC: Get Public Key
+	User->>UI: Log In
+	UI-->>KC: Redirect
+	KC-->>AP: Redirect
+	AP->>User: Credentials
+	AP-->>KC: Auth Result
+	KC-->>UI: Redirect with Code
+	UI->>KC: Exchange Code for Token
+	KC->>UI: Reply with id_token and access_token
+	UI->>Rhize: Access API with Bearer Token
+	Rhize->>Rhize: Verify Token with Public Key from Keycloak
+
+```
+

content/versions/v4.4.0/deploy/backup/_index.md

@@ -0,0 +1,24 @@
+---
+date: "2023-09-12T19:35:35+11:00"
+title: Back up
+description: Guides to back up your data on Rhize
+categories: ["how-to"]
+weight: 200
+cascade:
+  icon: database
+aliases:
+  - /deploy/backup/
+
+---
+
+Backup is critical to ensure reliability and recovery.
+
+These guides show you how to back up different services and data on Rhize.
+They also serve as blueprints for automation.
+
+Your organization must determine how frequently you backup services, and how long you store them for.
+The correct practice here is highly contextual,
+depending on the size of the data, the importance of the data, and the general regulatory and governance demands of your industry.
+
+
+{{< card-list >}}

content/versions/v4.4.0/deploy/backup/audit.md

@@ -0,0 +1,55 @@
+---
+title: 'Back up Audit PostgreSQL'
+date: '2024-03-26T11:20:56-03:00'
+categories: ["how-to"]
+description: How to backup Audit PostgreSQL on your Rhize deployment
+weight: 300
+aliases:
+  - /deploy/backup/audit
+
+---
+
+This guide shows you the procedure to backup your Audit PostgreSQL database on your Rhize Kubernetes deployment.
+
+## Prerequisites
+
+Before you start, ensure you have the following:
+
+- A designated backup location, for example `~/rhize-backups/libre-audit`.
+- Access to the [Rhize Kubernetes Environment](/deploy/install/setup-kubernetes)
+{{% param pre_reqs %}}
+
+
+Also, before you start, confirm you are in the right context and namespace.
+
+{{% param k8s_cluster_ns %}}
+
+## Steps
+
+To back up Audit PostgreSQL, follow these steps:
+
+1. Check the logs for the Audit pods, either in Lens or with [`kubectl logs`](https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#logs).
+    Ensure there are no errors.
+
+1. Retrieve the Audit user password using the following command:
+
+
+    ```bash
+    kubectl get secret <SECRET-NAME> -o jsonpath="{.data.<SECRET-KEY>}" | base64 --decode
+    ```
+
+1. Execute a command on the Audit Postgres pod to perform a full backup:
+
+    ```bash
+    kubectl exec -i audit-postgres-0 -- pg_dumpall -U <DB_USER> | gzip > audit-postgres-backup-$(date +"%Y%m%dT%I%M%p").sql.gz
+    ```
+
+On success, the backup creates a GZIP file, `audit-postgres-backup-YYYYMMDDTHHMMSS.sql.gz`.
+To check that the backup succeeded, unzip the files and inspect the data.
+
+## Next Steps
+
+- To back up other Rhize services, read how to backup:
+  - [Keycloak]({{< relref "keycloak" >}}).
+  - [Grafana]({{< relref "grafana" >}}).
+  - [The Graph Database]({{< relref "graphdb" >}}).

content/versions/v4.4.0/deploy/backup/binary.md

@@ -0,0 +1,82 @@
+---
+title: 'Back up the Graph DB to S3'
+date: '2024-11-04T11:01:46-03:00'
+categories: ["how-to"]
+description: How to back up the Rhize graph database to Amazon S3 storage.
+weight: 100
+aliases:
+  - /deploy/backup/binary
+
+---
+
+This guide shows you how to back up the Rhize Graph database to Amazon S3 and S3-compatible storage.
+
+## Prerequisites
+
+Before you start, ensure you have the following:
+
+
+- A designated S3 backup location, for example `s3://s3.<AWS-REGION>.amazonaws.com/<AWS-BUCKET-NAME>`.
+- Access to your [Rhize Kubernetes Environment]({{< relref "../install" >}})
+{{% param pre_reqs %}}.
+
+
+Before you start, confirm you are in the right context and namespace:
+
+{{% param "k8s_cluster_ns" %}}
+
+## Steps
+
+To back up the database, follow these steps:
+
+1. Check the logs for the alpha and zero pods, either in Lens or with [`kubectl logs`](https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#logs).
+    Ensure there are no errors.
+
+    ```bash
+    kubectl logs {{< param application_name >}}-baas-baas-alpha-0 --tail=80
+    ```
+1. Set the following environmental variables:
+   - `AWS_ACCESS_KEY_ID`. Your AWS access key with permissions to write to the destination bucket 
+   - `AWS_SECRET_ACCESS_KEY`. Your AWS access key with permissions to write to the destination bucket
+   - `AWS_SESSION_TOKEN`. Your AWS session token (if required)
+
+1. Make a POST request to your Keycloak `/token` endpoint to get an `access_token` value.
+For example, with `curl` and `jq`:
+
+    ```bash
+    ## replace USERNAME and PASSWORD with your credentials
+    USERNAME=backups@libremfg.com \
+    && PASSWORD=password \
+    && curl --location \
+      --request POST "${BAAS_OIDC_URL}/realms/libre/protocol/openid-connect/token" \
+      --header 'Content-Type\ application/x-www-form-urlencoded' \
+      --data-urlencode 'grant_type=password' \
+      --data-urlencode "username=<USERNAME>" \
+      --data-urlencode "password=<PASSWORD>"  \
+      --data-urlencode "client_id=<BASS_CLIENT_ID>" \
+      --data-urlencode "client_secret=<BASS_CLIENT_SECRET>" | jq .access_token
+    ```
+
+1. Using the token from the previous step, send a POST to `<alpha service>:8080/admin` to create a backup of the node to your S3 bucket.
+For example, with `curl`:
+
+    ```bash
+   curl --location 'http://alpha:8080/admin' \
+   --header 'Content-Type: application/json' \
+   --header 'Authorization: Bearer <TOKEN>' \
+   --data '{"query":"mutation {\n  backup(input: {destination: \"s3://s3.<AWS-REGION>.amazonaws.com/<AWS-BUCKET-NAME>\"}) {\n    response {\n      message\n      code\n    }\n    taskId\n  }\n}","variables":{}}'
+   ```
+
+1. List available backups to confirm your backup succeeded:
+
+    ```bash
+    curl --location 'http://alpha:8080/admin' \
+   --header 'Content-Type: application/json' \
+   --header 'Authorization: Bearer <TOKEN>' \
+   --data '{"query":"query backup {\n\tlistBackups(input: {location: \"s3://s3.<AWS-REGION>>.amazonaws.com/<AWS-BUCKET-NAME>\"}) {\n\t\tbackupId\n\t\tbackupNum\n\t\tpath\n\t\tsince\n\t\ttype\n\t}\n}","variables":{}}'
+    ```
+
+## Next Steps
+
+- Test the [Restore Graph Database From S3]({{< relref "../restore/binary" >}}) procedure to ensure you can recover data from Amazon S3 in case of an emergency.
+- To back up other Rhize services, read how to backup [Grafana]({{< relref "grafana" >}}).