🚀 Alpha Platform Trinity Asset (1.0.11) Release Notes - 26.03.1.0.11

Neutrinos Platform Product Release Notes
,
1

Release Date: March 26, 2026
Release Channel: Current
Version: 26.03.1.0.11
Trinity Asset Version: 1.0.11

:sparkles: New Features

Kong Ingress Controller Support

The chart now supports Kong Ingress Controller as an alternative to NGINX. When ingressClassName is set to kong, the chart automatically:

  • Renders KongPlugin custom resources for rate limiting, CORS, and security headers (mirroring existing NGINX behavior)
  • Applies Kong-specific Ingress annotations (konghq.com/strip-path, konghq.com/preserve-host, konghq.com/protocols, etc.)
  • Handles the RabbitMQ subchart ingress with unified Prefix path matching for both Kong and NGINX

Switching to Kong: Set global.ingress.ingressClassName: kong in your values file and upgrade. No other changes required — Kong annotation defaults are built into the chart templates.

Rollback to NGINX: Set global.ingress.ingressClassName: nginx and upgrade. NGINX annotations are unchanged.

Istio PeerAuthentication (Optional)

A new optional Istio PeerAuthentication resource can be deployed for strict mTLS between pods in the release namespace. This is for service-to-service traffic only — not for north-south Ingress.

Enable with global.istio.enabled: true. Only use when Istio sidecars are injected in the namespace; otherwise strict mTLS will break pod-to-pod traffic. Disabled by default.

:wrench: Enhancements

  • Ingress annotation refactor: Ingress annotations are now generated from a shared helper template (_ingress.tpl) instead of being duplicated across all four service category Ingress resources. No functional change — same annotations are produced.
  • Kong annotation defaults in templates: Kong annotation defaults (kongAnnotations, kongPlugins) are defined in the chart templates, not in values files. To override, set global.ingress.kongAnnotations (list of {key, value}) or global.ingress.kongPlugins (comma-separated string) in your values file.
  • RabbitMQ ingress unified: Both Kong and NGINX now use Prefix path matching for the RabbitMQ subchart ingress. The NGINX-specific rewrite-target and regex path have been removed. RabbitMQ’s management.path_prefix is now automatically derived from rabbitmq.path — no manual extraConfiguration needed.
  • RabbitMQ health probes: Liveness and readiness probes now use the correct prefixed management API path (e.g., /rabbitmq/api/health/checks/...), derived from rabbitmq.path.

:warning: Breaking Changes

[!CAUTION]
Removed: enableCors flag
The global.ingress.enableCors property has been removed from values files and schema. CORS is now always enabled. If you had enableCors: 'true' in your values file, remove it to avoid schema warnings. No action needed if you were using the default — CORS behavior is unchanged.

:clipboard: Configuration

Kong Ingress Controller

To switch from NGINX to Kong:

global:
    ingress:
        ingressClassName: kong   # was: nginx

To override Kong annotation defaults (optional):

global:
    ingress:
        ingressClassName: kong
        # Override default Kong plugins (optional)
        kongPlugins: alpha-rate-limit,alpha-cors,alpha-security-headers
        # Override default Kong annotations (optional — omit to use template defaults)
        kongAnnotations:
            - key: konghq.com/strip-path
              value: 'false'
            - key: konghq.com/preserve-host
              value: 'true'
            - key: konghq.com/protocols
              value: https
            - key: konghq.com/https-redirect-status-code
              value: '301'
            - key: konghq.com/plugins
              value: alpha-rate-limit,alpha-cors,alpha-security-headers

Istio PeerAuthentication

global:
    istio:
        enabled: true   # default: false — enable only with Istio sidecars present

RabbitMQ with Kong (Staged Migration)

The RabbitMQ subchart ingress follows the global ingressClassName and supports both Kong and NGINX. During a staged Kong migration, you can keep RabbitMQ on NGINX while validating Kong on application services first:

rabbitmq:
    ingress:
        ingressClassName: nginx   # overrides global for this subchart only — remove once Kong is validated

Removed Properties

Property Action
global.ingress.enableCors Remove from your values file. CORS is always enabled.

:package: Docker Images

No application image changes in this release. All images remain at their previous versions.

Category Service Name Image Repository Image Version
backends neutrinos-cm-bpm neutrinos.azurecr.io/alpha/neutrinos-cm-bpm 1.0.0
backends alpha-case-service neutrinos.azurecr.io/alpha/alpha-case-service 26.03.1.0.9-ff079d1d5bbf
backends alpha-request-service neutrinos.azurecr.io/alpha/alpha-request-service 26.03.1.0.9-ff079d1d5bbf
backends alpha-delta-service neutrinos.azurecr.io/alpha/alpha-delta-service 26.03.1.0.9-ff079d1d5bbf
backends admin neutrinos.azurecr.io/alpha/admin 26.03.1.0.9-ff079d1d5bbf
backends alpha-auth-service neutrinos.azurecr.io/alpha/alpha-auth-service 26.03.1.0.9-ff079d1d5bbf
backends alpha-config-service neutrinos.azurecr.io/alpha/alpha-config-service 26.03.1.0.9-ff079d1d5bbf
backends alpha-module-service neutrinos.azurecr.io/alpha/alpha-module-service 26.03.1.0.9-ff079d1d5bbf
backends alpha-dashboard-service neutrinos.azurecr.io/alpha/alpha-dashboard-service 26.03.1.0.9-ff079d1d5bbf
backends marketplace-headless neutrinos.azurecr.io/alpha/marketplace-headless 25.11.0.0.0-49d5909-current
backends alpha-archival neutrinos.azurecr.io/alpha/alpha-archival 26.03.1.0.9-ff079d1d5bbf
frontends alpha-admin-ui neutrinos.azurecr.io/alpha/alpha-admin-ui 26.03.1.0.9-ff079d1d5bbf
frontends alpha-case-manager-ui neutrinos.azurecr.io/alpha/alpha-case-manager-ui 26.03.1.0.9-ff079d1d5bbf
frontends alpha-workflow-studio neutrinos.azurecr.io/alpha/alpha-workflow-studio 26.03.1.0.9-ff079d1d5bbf
frontends alpha-delta-ui neutrinos.azurecr.io/alpha/alpha-delta-ui 26.03.1.0.9-ff079d1d5bbf
adapters alpha-jbpm-service neutrinos.azurecr.io/alpha/alpha-jbpm-service 26.03.1.0.9-ff079d1d5bbf
cron alpha-task-distributor neutrinos.azurecr.io/alpha/alpha-task-distributor 26.03.1.0.9-ff079d1d5bbf
cron gts neutrinos.azurecr.io/alpha/gts 26.03.1.0.9-ff079d1d5bbf

:high_voltage: Known Limitations

  • RabbitMQ management UI logout: Clicking logout in the RabbitMQ management UI redirects to / (root), which returns a 404 since no service is mapped there. This is a RabbitMQ management plugin limitation with path_prefix. Navigate back to /rabbitmq/ to re-access the UI.

:telephone_receiver: Support & Resources