v2.23.0
Date of release: 12/10/2026
Engine version: 16.12.1
Conform version: 1.3.0
Foresight version: 1.6.0
Genesis version: 0.2.0
We appreciate your continued support and value your feedback. If you encounter any issues or have any questions, please don't hesitate to contact our support team.
Fixes and improvements
- RabbitMQ is upgraded to 4.3.6 and the RabbitMQ cluster operator to 2.23.0. Read the RabbitMQ 4.3 notice under Upgrade notices before you upgrade.
- The Async API now removes a file's results an hour after processing finishes, instead of an hour after submission. Files that produce no clean file or report, for example when the engine returns an error, are removed straight away. Files left behind by interrupted processing are removed after a day.
- Administrators can now set a non-default ICAP profile to Disabled in the Portal. Previously the option could not be selected.
- The Portal no longer asks you to confirm stopping the ICAP server when it is already stopped.
- Upgrading the
cdrplatform-storage-monitorchart now leaves Storage Monitor running or stopped as it was.replicaCountsets only the starting state of a fresh install, so usekubectl scaleorenable_storage_monitor.shto turn Storage Monitor on or off. - Service base images are updated to fix known container vulnerabilities. Third-party components are also updated, including KEDA 2.21.0, MongoDB 7.0.43, MongoDB Controllers for Kubernetes 1.13.0, Prometheus 3.15.0 and External Secrets 2.11.0.
- Cockpit, the RHEL web console, is removed from the Halo VM images. Halo does not use it, and removing it clears a vulnerability scanner finding for CVE-2026-4631.
- On the Azure Marketplace image, the administrator account created at deployment now has passwordless sudo, whether you deploy with a password or an SSH key. Previously an account deployed with an SSH key had no usable sudo. This matches the AWS image and, like it, deviates from STIG rule V-258106.
Upgrade notices
Expand the notices for the version you are upgrading from.
Versions before v2.23.0
RabbitMQ 4.3 upgrade notice
Halo v2.23.0 upgrades RabbitMQ to 4.3, which RabbitMQ supports upgrading to in place only from 4.2. Halo v2.17.0 was the first release on RabbitMQ 4.2.
- From Halo v2.17.0 or later, run the usual upgrade. The
cdrplatform-rabbitmqchart moves RabbitMQ's metadata to Khepri before the upgrade, as RabbitMQ recommends. - From a release before v2.17.0, upgrade to a release from v2.17.0 to v2.22.x first. A RabbitMQ 4.0 or 4.1 cluster upgraded straight to 4.3 breaks and cannot be rolled back, so the chart refuses the upgrade before RabbitMQ changes.
kubectl logs -n cdrplatform job/rabbitmq-khepri-migrationshows the reason.
This release also upgrades the RabbitMQ cluster operator to 2.23.0, which no longer allows the cdrplatform-rabbitmq chart's earlier root init container. Upgrade the cdrplatform-rabbitmq chart before the rabbitmq-cluster-operator chart. If the operator is upgraded first, RabbitMQ stops until the cdrplatform-rabbitmq upgrade runs, so run it straight away. The upgrade removes the old init container and restarts RabbitMQ in either order. If that upgrade fails, kubectl logs -n cdrplatform job/rabbitmq-root-init-removal shows the reason.
RabbitMQ 4.3 cannot be rolled back to 4.2 in place. Rolling back to an earlier Halo release means restoring the RabbitMQ data taken before the upgrade. See the RabbitMQ 4.3 release post for details of the move to Khepri.
Versions before v2.22.0
MongoDB operator upgrade notice
Starting Halo v2.22.0, in-cluster MongoDB is managed by MongoDB Controllers for Kubernetes (MCK, the mongodb-kubernetes chart) in place of the deprecated MongoDB Community Operator (community-operator). This applies only if you run MongoDB inside the cluster. Deployments backed by DocumentDB, Cosmos DB or another external MongoDB are unaffected and need no action.
If you run MongoDB inside the cluster, uninstall the Community Operator first, then install MCK. Your data is preserved if the MongoDBCommunity CRD carries the retain annotation before the uninstall.
Add the MongoDB Helm repository if you have not already:
helm repo add mongodb https://mongodb.github.io/helm-charts
helm repo update
Then, on a cluster running in-cluster MongoDB:
# Protect the data: this annotation stops the uninstall cascading to the CRD, replica set and volumes
kubectl annotate crd mongodbcommunity.mongodbcommunity.mongodb.com helm.sh/resource-policy=keep --overwrite
# Remove the old Community Operator
helm uninstall community-operator -n cdrplatform
# Install MongoDB Controllers for Kubernetes
helm install mongodb-kubernetes-operator mongodb/mongodb-kubernetes -n cdrplatform --version 1.12.0
# Redeploy the MongoDB chart (use the same cloud_provider you deployed with)
helm upgrade -i cdrplatform-mongodb cdrplatform-mongodb -n cdrplatform --atomic --set cloud_provider=<provider>
MCK adopts the existing replica set in place and rolls the MongoDB pod once. Confirm the pod is Ready and the data is intact before continuing the upgrade.
ICAP server upgrade notice
The ICAP server is now operated from the portal: mutual TLS moved out of the chart's configuration block and became a setting an administrator can change, and starting and stopping the server moved there too. Four things need attention when upgrading an existing ICAP install.
configuration.ENABLE_MTLS was replaced by settings.ICAP.MutualTlsEnabled. The chart fails the render on the old key, naming the replacement, rather than accepting it and ignoring it. Update any values overlay or saved helm upgrade command before upgrading:
--set settings.ICAP.MutualTlsEnabled=true
The certificate volume is now always mounted, so enabling mutual TLS no longer changes the pod specification. It still takes effect on the next ICAP server restart, because the listener binds its port at startup. While mutual TLS is off the server does not bind the TLS port at all, where earlier versions bound it and refused every connection, so a port scan of an appliance without certificates no longer reports that port as open.
The ICAP server pod now runs as its own service account, so that it can write its settings to its own ConfigMap, where it previously ran as default. Anything in the namespace bound to default (a workload-identity annotation, an image-pull secret, a NetworkPolicy or an RBAC rule naming it) has to be reapplied to the new account. Set the annotations on the new account:
--set serviceAccount.annotations.<key>=<value>
Or keep the account the install already uses:
--set serviceAccount.name=<existing-account>
The ICAP server is now started and stopped from the Portal. Open Protection settings, click the ICAP tab and use the control under ICAP configuration. The appliance ships with the ICAP server installed but not running, and nothing answers on the ICAP ports until an administrator turns it on. The ICAP settings on that tab can be changed only while the server is on.
Stop the ICAP server once after your first upgrade if you were not running it. The chart no longer fixes the number of ICAP servers, so that the Portal control keeps whatever you set across later upgrades. Upgrading a release installed from an earlier chart starts the server once as part of that change, whatever state it was in beforehand:
kubectl scale deploy icap-server -n cdrplatform --replicas=0
Only the first upgrade needs this. A freshly imaged appliance is unaffected.
Versions before v2.9.0
RabbitMQ upgrade notice
Starting Halo v2.9.0, the RabbitMQ version is upgraded from 3.13 to 4.x. When upgrading from an older version of Halo to any version above 2.9.0 all stable RabbitMQ feature flags should be enabled before performing the usual upgrade process using the following command:
rabbitmqctl enable_feature_flag all
Versions before v2.6.2
Deprecation notice
The cdrplatform-metrics-collation service was deprecated and removed in release 2.6.2. When you upgrade to 2.6.2 or later, uninstall the cdrplatform-metrics-collation Helm chart using this command:
helm delete cdrplatform-metrics-collation -n cdrplatform
Service versions (image tags)
| Service | Container Repository | Version |
|---|---|---|
| cdrplatform-engine | glasswallhub.azurecr.io/cdrplatform-engine | 2.23.0-213632 |
| cdrplatform-sync-api | glasswallhub.azurecr.io/cdrplatform-sync-api | 2.23.0-213632 |
| cdrplatform-report-extractor | glasswallhub.azurecr.io/cdrplatform-report-extractor | 2.23.0-213632 |
| cdrplatform-portal | glasswallhub.azurecr.io/cdrplatform-portal | 2.23.0-213632 |
| cdrplatform-policy-api | glasswallhub.azurecr.io/cdrplatform-policy-api | 2.23.0-213632 |
| cdrplatform-api-access | glasswallhub.azurecr.io/cdrplatform-api-access | 2.23.0-213632 |
| cdrplatform-portal-access | glasswallhub.azurecr.io/cdrplatform-portal-access | 2.23.0-213632 |
| cdrplatform-license-management | glasswallhub.azurecr.io/cdrplatform-license-management | 2.23.0-213632 |
| cdrplatform-cleanup | glasswallhub.azurecr.io/cdrplatform-cleanup | 2.23.0-213632 |
| cdrplatform-async-api | glasswallhub.azurecr.io/cdrplatform-async-api | 2.23.0-213632 |
| cdrplatform-metrics-projection | glasswallhub.azurecr.io/cdrplatform-metrics-projection | 2.23.0-213632 |
| cdrplatform-tally-accumulator | glasswallhub.azurecr.io/cdrplatform-tally-accumulator | 2.23.0-213632 |
| icap-server | glasswallhub.azurecr.io/icap-server | 2.23.0-213632 |
| cdrplatform-rabbitmq | glasswallhub.azurecr.io/cdrplatform-rabbitmq | 2.23.0-213632 |
| cdrplatform-storage-monitor | glasswallhub.azurecr.io/cdrplatform-storage-monitor | 2.23.0-213632 |
| Prompt Injection Detection API | glasswallhub.azurecr.io/pulsar/detection | 2.23.0-213632 |
Helm chart versions
| Chart | Chart Repository | Version |
|---|---|---|
| cdrplatform-rabbitmq | glasswallhub.azurecr.io/helm/cdrplatform-rabbitmq | 0.9.8 |
| cdrplatform-external-secrets | glasswallhub.azurecr.io/helm/cdrplatform-external-secrets | 0.7.0 |
| cdrplatform-storage | glasswallhub.azurecr.io/helm/cdrplatform-storage | 0.8.1 |
| cdrplatform-engine | glasswallhub.azurecr.io/helm/cdrplatform-engine | 0.6.3 |
| cdrplatform-sync-api | glasswallhub.azurecr.io/helm/cdrplatform-sync-api | 0.4.3 |
| prometheus-scaling | glasswallhub.azurecr.io/helm/prometheus-scaling | 0.3.1 |
| cdrplatform-portal | glasswallhub.azurecr.io/helm/cdrplatform-portal | 0.4.4 |
| cdrplatform-policy-api | glasswallhub.azurecr.io/helm/cdrplatform-policy-api | 0.3.3 |
| cdrplatform-api-access | glasswallhub.azurecr.io/helm/cdrplatform-api-access | 1.5.0 |
| cdrplatform-portal-access | glasswallhub.azurecr.io/helm/cdrplatform-portal-access | 0.6.1 |
| cdrplatform-license-management | glasswallhub.azurecr.io/helm/cdrplatform-license-management | 0.4.0 |
| cdrplatform-cleanup | glasswallhub.azurecr.io/helm/cdrplatform-cleanup | 0.4.0 |
| cdrplatform-async-api | glasswallhub.azurecr.io/helm/cdrplatform-async-api | 0.2.5 |
| cdrplatform-metrics-projection | glasswallhub.azurecr.io/helm/cdrplatform-metrics-projection | 0.2.3 |
| cdrplatform-report-extractor | glasswallhub.azurecr.io/helm/cdrplatform-report-extractor | 0.2.2 |
| cdrplatform-tally-accumulator | glasswallhub.azurecr.io/helm/cdrplatform-tally-accumulator | 0.2.5 |
| cdrplatform-mongodb | glasswallhub.azurecr.io/helm/cdrplatform-mongodb | 0.3.1 |
| icap-server | glasswallhub.azurecr.io/helm/icap-server | 2.2.3 |
| cdrplatform-storage-monitor | glasswallhub.azurecr.io/helm/cdrplatform-storage-monitor | 0.3.0 |
| cdrplatform-pulsar | glasswallhub.azurecr.io/helm/cdrplatform-pulsar | 0.1.0 |
Documentation
Swagger documentation Glasswall documentation Clean a file Archive support License management