Lakekeeper+ Release Notes

Unreleased

Features

• Cedar: grants decide access. Privileges granted in the catalog now reach Cedar policies. Every resource entity carries direct_privileges (granted on it) and inherited_privileges (granted above it), so a policy can read resource.direct_privileges.select. GET /management/v1/grants/grantable-privileges lists the grantable names per resource type. A grant on the server is in no project, so Cedar reads the caller's roles from every project when one decides a request.

Breaking Changes

• Admission gate: idp_id must name a provider the server authenticates. Startup checks it against the configured authenticators and refuses to start when it matches none, naming what is available. An id matching nothing governs nobody: every request counts as being from another IdP and is admitted untouched, while the gate makes no upstream call and so still reports itself healthy. A deployment whose idp_id has a typo has not been enforcing anything.
• Admission gate: unknown configuration keys are refused. A misspelled key under admission_enforce — cache_ttl_sec for cache_ttl_secs, role_source for role_source_id — previously applied its default silently. Startup now names it and stops. Check your configuration against the documented keys before upgrading.
• Admission gate: a request with no authenticated principal is rejected. It reaches the gate only if the authentication middleware changes, and a gate that cannot see who is calling cannot enforce anything.
• OpenFGA: revoking a privilege requires manage_grants. pass_grants means handing others the privileges you hold; taking one back is administration. Both directions previously asked the same relation, so a holder of pass_grants plus a privilege could clear every other principal's copy of it, logged as ordinary grant administration. Applies to both the /grants diff and the older /permissions/{type}/{id}/assignments deletes.
• OpenFGA: membership of a system-provider role requires an instance admin. Membership of a catalog-managed system role is provisioning, not self-service, and role-type members are rejected on them — closing the path where a role conferring ManageRoleAssignments could appoint more of its own members. Removing an existing role-type member remains available to instance admins. Ordinary and lakekeeper-provider roles are unaffected.
• Cedar: seeing another principal's access needs its own grant. Introspect<X>Authorization left ServerActions, RoleActions and the <X>ModifyActions groups, and is now in ReadGrantsActions and the level's <X>GrantActions. Policies granting those older groups no longer confer it; grant Read<X>Grants, or name the action, where you want it.
• Cedar: requests must name the project their resources are in. Addressing a warehouse outside the project in x-project-id — or outside the default project, if the header is absent — now returns 400. One request cannot span two projects. Single-project deployments are unaffected.
• Cedar: a replaced schema file must declare the privilege records. With LAKEKEEPER__CEDAR__SCHEMA_FILE set, startup fails unless every resource entity declares direct_privileges and inherited_privileges, naming what is missing.
• Cedar: external entity files must declare the privilege records. Entity JSON is validated against the schema, so a resource entity without both records fails to load and the server does not start.
• Cedar: with externally managed identity, the entity file must declare every principal a request names. Under LAKEKEEPER__CEDAR__EXTERNALLY_MANAGED_USER_AND_ROLES, a request naming a user or role your file omits is refused rather than answered — Cedar skips policies about entities it cannot find, which can turn a forbid into an allow. Declare everyone you authenticate, every role callers assume or manage, and the roles those sit inside.

Upgrade Notes

• Cedar, multi-project deployments: check that clients send x-project-id. Before this release a request could be answered using a different project's roles, so a policy meant to deny could permit. If your clients omitted the header, treat past cross-project decisions as unreliable.
• Cedar with externally managed identity: grant users, not roles. A grant held by a user applies. One held by a role does not, because your entity file owns role membership — and the role nesting a forbid on a parent role reads. Authorization in this mode now reads the catalog for grants, where it previously read nothing.

v0.13.5 (2026-08-26)

Based on Lakekeeper OSS v0.13.3.

Highlights

• Improved memory behaviour on long-running instances. Conditions that could, under some circumstances, prevent freed memory from being returned to the OS are addressed.

Features

• New memory metrics. lakekeeper_jemalloc_* separates live heap from memory the allocator is holding back; lakekeeper_http_connections reports open connections.
• The table maintenance cache reports what it holds: lakekeeper_cache_weighted_bytes{cache_type="table_metadata"} and lakekeeper_cache_instances, with hits and misses in the shared lakekeeper_cache_* series.

Bug Fixes

• Transparent huge pages could prevent freed memory from being returned to the OS. On nodes with THP=always, the default on common EKS AMIs, resident memory could grow for the life of the process.
• The manifest cache under-counted its entries, so under some circumstances its 128 MiB budget did not bind during table maintenance.
• The UI asset cache keyed on an unvalidated header, so variants of x-forwarded-prefix could each add an entry to a cache with no expiry.
• Allocator metrics now report on every serving path, including LAKEKEEPER__DEBUG__AUTO_SERVE. Memory behaviour itself was unaffected.

Upgrade Notes

• Idle HTTP connections now close after 75 seconds and carry TCP keepalive probes. Standard Iceberg and S3 clients retry; previously a connection whose peer had vanished could be held for the life of the process.
• Request headers above 64 KiB are rejected with 431. Request bodies are unaffected.
• Shutdown drains for at most 10 seconds before abandoning connections still open.
• Unmatched request paths report endpoint="unmatched" in metrics instead of each creating a permanent series. Dashboards that group by raw path lose those values.

v0.13.4 (2026-08-14)

Based on Lakekeeper OSS v0.13.3.

Bug Fixes

• Audit log fields are emitted as structured JSON. actor, action/actions, entity/entities, authorizations and context were emitted as strings containing escaped pseudo-JSON, so audit pipelines could not read them as objects without decoding each field first. They are now nested JSON objects, as documented. See Upgrade Notes.
• Reduced memory growth from allocator fragmentation. The server now uses jemalloc as its global allocator. Deployments that saw container_memory_working_set_bytes climb steadily without returning to baseline — a glibc malloc fragmentation pattern — should see flatter memory use. The effect depends on workload, and this changes the allocator only.
• JSON logs no longer carry duplicate span data. Every line included both a span object and a spans array with the same content; only spans is emitted now. Applies to lakekeeper-plus and lakekeeper-maintenance.
• LAKEKEEPER__DEBUG__LOG_AUTHORIZATION_HEADER now applies to UI-server routes. The setting was silently ignored there, so enabling it produced no authorization field on those request spans.

Upgrade Notes

• Audit log consumers must read objects, not strings. If your pipeline JSON-decodes the audit fields a second time to get at their contents, that step now fails or double-decodes — read them directly instead. The previous string form parsed only by luck: Rust Debug escapes non-ASCII as \u{1F600}, which is not valid JSON, so any field carrying such text would have broken the parse outright. Consumers that already tolerate both shapes need no change, and rollout order does not matter for them.

v0.13.3 (2026-07-24)

Based on Lakekeeper OSS v0.13.3.

Highlights

• Admission-gate roles now take effect. Roles granted by a role_granting admission check are finally evaluated by authorization — completing the external admission gate shipped in v0.13.0, whose granted roles previously never reached Cedar.

Features

• Apply admission-gate roles in Cedar authorization. A new AdmissionRoleProvider (an uncached role-provider-chain leaf, mirroring the token role provider) serves the caller's admission-granted roles under their configured provider id; Cedar materialises them as Role entities and evaluates policies against them. Plus wires one provider per role-provider id the gate can mint under, so a gate-only deployment still resolves roles.
• No-Access page for instance-level 403. An authenticated caller denied access to the instance (e.g. rejected by the admission gate) now lands on a dedicated No-Access page with proper 403 routing, instead of a broken view. (console v0.16.4)

Upgrade Notes

• Conflicting role-provider ids now fail fast. A gate-minted role_provider_id that collides with a configured or token role-provider id is rejected at startup with ExtraProviderIdConflict — give the gate's minted roles a distinct provider id.
• Admission roles apply under Cedar only. With the OpenFGA authorizer, or Cedar in externally-managed mode, admission-granted roles are not applied; the server logs a warning at startup so a misconfiguration is visible.

v0.13.2 (2026-07-23)

Based on Lakekeeper OSS v0.13.3.

Bug Fixes

• Maintenance page. Console bump to 0.16.3 (console-components 0.17.2, console-plus-components 0.11.0). Redesigned maintenance date-range filters, suppressed spurious 403 notifications for maintenance tasks, and fixed the Home page chart title.

v0.13.1 (2026-07-20)

Based on Lakekeeper OSS v0.13.3.

Highlights

• Okta role provider. Resolve a user's Okta group memberships to Lakekeeper roles via the Okta management API — private-key-JWT client auth with DPoP (RFC 9449) proofs enabled by default.
• Provider-synced roles are now protected. Roles owned by a configured role provider (Okta, Entra, LDAP, or token IdP) can no longer be mutated through the management API, so the next provider sync can't silently clobber manual edits.

Features

• Okta role provider (with DPoP). Group memberships resolved via GET /users/{id}/groups (Link-header pagination, keyed by immutable group id). OAuth2 client-credentials + private-key-JWT (JWK or PEM key); DPoP on by default with ephemeral P-256 proofs and nonce challenge/replay handling — opt out to Bearer. Requires the okta.users.read scope; wrapped in the shared role cache. See the Okta role-provider docs.
• Managed-role write protection. The Cedar authorizer now reports its configured provider namespaces to the management-API guard, so create / update / delete / source-system rebind / member (un)assignment on a provider-owned role is rejected with 400 ManagedRoleImmutable. Native lakekeeper roles and the reserved system namespace are never included, so API-native and catalog-managed roles stay writable. Active only when a role provider is configured.
• Post-logout redirect controls. Two new UI env vars — LAKEKEEPER__UI__OPENID_POST_LOGOUT_REDIRECT_URL and LAKEKEEPER__UI__OPENID_POST_LOGOUT_REDIRECT_DISABLED.
• Static-asset caching in the UI server. Per-class Cache-Control plus weak ETag/304 on bundled assets: content-hashed assets/* are cached immutably and the DuckDB WASM is no longer re-downloaded on every load, while index.html stays uncached so runtime config placeholders remain fresh.

Bug Fixes

• Maintenance page for warehouse-only permissions. Console bump to 0.16.1 (console-components 0.17.1) fixes the maintenance view for users who hold only warehouse-level permissions.

Upgrade Notes

• Provider-role edits now return 400 ManagedRoleImmutable. If you previously edited provider-synced roles (Okta/Entra/LDAP/token) through the management API, those calls are now rejected — such edits were overwritten by the next sync anyway. Manage those roles at the source. No migration.
• Building Plus from source: the Kubernetes client stack moved to k8s-openapi 0.28 / kube 4.0 (pulled in by the upstream limes 0.4.2 bump). Prebuilt binaries and images are unaffected.

Upstream Lakekeeper changes (up to Lakekeeper v0.13.3)

Notable for Plus users: - Configurable Kubernetes subject source. LAKEKEEPER__KUBERNETES_AUTHENTICATION_SUBJECT_SOURCE=username derives a service account's Lakekeeper user id from system:serviceaccount:<namespace>:<name> (stable across clusters) instead of the per-cluster uid (default, unchanged), so Kubernetes roles and instance admins can be pre-provisioned (lakekeeper#1899). - Reject role writes in provider-managed namespaces — the upstream API guard behind the managed-role protection above (lakekeeper#1891). - Stop evaluating a discarded Select on target-view load, avoiding a spurious authorization check (lakekeeper#1886).

v0.13.0 (2026-07-02)

Based on Lakekeeper OSS v0.13.1.

Highlights

• Microsoft Entra ID (Graph) role provider. Resolve a user's transitive Entra group memberships into Lakekeeper roles — with secret, certificate, managed-identity, and workload-identity credentials, sovereign-cloud support, and built-in throttling/retry.
• External admission gate. A new post-authentication seam can ask your control plane whether an already-authenticated caller may use this instance — for IdPs that issue broad, non-instance-scoped tokens — and contribute the caller's resolved roles.
• Console overhaul. The bundled UI jumps to v0.13.2: a Files/storage explorer with in-browser Parquet/Avro/CSV preview, per-entity action menus, datasets as a first-class entity, redesigned view and table-health pages, a Role Members tab, and an enterprise usage-report builder.

Features

• Entra ID / Microsoft Graph role provider. Paged transitiveMemberOf resolution; credential methods secret / certificate / managed-identity / workload-identity; public, US-gov, and China clouds; retries on 429 (honoring Retry-After) and transient 5xx.
• AD range retrieval for LDAP attribute-mode groups. Active Directory returns >1500 group values under a ranged memberOf;range=… key; attribute mode now walks the range windows, so users in many groups are no longer silently truncated. OpenLDAP/389-DS behavior is unchanged.
• External enforce-endpoint admission gate (lakekeeper-admission-enforce). Configurable named checks POST to your endpoint; the HTTP status is the decision (2xx allows and grants the check's role, 403 denies, anything else fails closed with 503 + Retry-After). Allow and deny are both cached; caller bearer-token relay is opt-in and never logged.
• Persist OIDC token roles for DEFINER views. Opt-in via LAKEKEEPER__ROLE_PROVIDER_CHAIN__PERSIST_TOKEN_ROLES (default off) — mirrors a user's OIDC-token roles into the catalog so authorization can evaluate them when the user isn't the live caller, e.g. a DEFINER view running as its owner. Write-gated; no migration.
• Generic-table parity in Cedar authorization. Non-Iceberg generic tables (e.g. Lance, Delta) now resolve and authorize through the Cedar surface exactly like tables and views.
• Destructive-delete context for Cedar policies. force / purge / recursive and a warehouse soft_delete_enabled attribute are now in the Cedar request context, so a policy can forbid hard deletes that would bypass configured soft-deletion.
• Role-membership actions in Cedar. The new manage/read role-assignment actions map to dedicated fine-grained Cedar actions, so policy authors control their bundling.
• Destination-aware role source-system rebind. A dedicated update_source_system Cedar action exposes the target provider/source, so rebinds can be gated by destination — something the coarse upstream OpenFGA relation cannot express.
• Per-decision policy trace in authorization audit. Audit events and the /check endpoint now record which Cedar policies determined each allow/deny outcome.
• Schedule maintenance directly. expire_snapshots and remove_orphan_files can be triggered per table via the task-queue schedule endpoint, without waiting for a commit hook.

Bug Fixes

• Corrupt-manifest orphan-files task no longer retries forever. A permanent failure (e.g. a corrupt Avro manifest) is now classified permanent and not requeued, instead of failing silently and re-running every day. Maintenance workers (remove_orphan_files, expire_snapshots) also persist a readable failure reason, surfaced in the task-details API — no server-log access required.

Breaking Changes

• Default storage layout is now flat (inherited from upstream Lakekeeper 0.13): new namespaces use <base>/<tabular-uuid> instead of nesting tabulars under the parent-namespace UUID. Not retroactive — existing namespaces and paths are unchanged — so explicitly configure the full-hierarchy layout if you need the old behavior for new namespaces (lakekeeper#1853).

Upgrade Notes

• Encrypted tables are skipped by maintenance. expire_snapshots and remove_orphan_files now detect Iceberg native encryption (format v3) via the immutable encryption.key-id property and skip such tables — Lakekeeper cannot read their encrypted manifests, and processing anyway risked deleting live data. Manually scheduling either task on an encrypted table returns 400.
• Downgrade protection (upstream): serve refuses to start against a database already migrated by a newer binary. After a rollback, start the older binary with serve --force-start, accepting the schema-incompatibility risk (lakekeeper#1861).
• Docker base images moved from Debian 12 (bookworm) to Debian 13 (trixie).
• Building Plus from source: the catalog Postgres backend and the NATS/Kafka event backends are now separate upstream crates (lakekeeper-storage-postgres, lakekeeper-events-nats, lakekeeper-events-kafka). Prebuilt binaries and images are unaffected (lakekeeper#1812, lakekeeper#1814).

Upstream Lakekeeper changes (up to Lakekeeper v0.13.1)

Rolls up OSS v0.12.4, v0.13.0, and v0.13.1 (full list in the Lakekeeper release notes). Notable for Plus users: - Generic Table API — register non-Iceberg tables (Lance, Delta) as first-class generic tables with credential vending and full authorization (lakekeeper#1673, lakekeeper#1813); surfaced in Plus through the Cedar generic-table parity above. - Operator-owned warehouses. A managed_by marker locks warehouse spec mutations (delete, rename, (de)activate, storage profile, protection, format-version policy) to instance admins (lakekeeper#1828). - Authorizer-independent role-membership API — one management surface to list/add/remove a role's members regardless of the configured authorizer (lakekeeper#1829). - Multiple OIDC providers at once via LAKEKEEPER__OPENID_PROVIDERS (e.g. Okta for users + a cloud issuer for service accounts) (lakekeeper#1760). - Microsoft OneLake / Fabric storage profile, including workspace private-link endpoints (lakekeeper#1852). - Per-warehouse table format-version policy — allowed Iceberg format versions and an optional default per warehouse (lakekeeper#1786). - Customer-managed KMS encryption — warehouses with aws-kms-key-arn advertise s3.sse.type=kms, so vended-credential writes use your KMS key (lakekeeper#1847). - Cache hardening for large fleets — single-flight read-throughs and TTL jitter cut thundering-herd load on the database and on rate-limited STS/SAS endpoints (lakekeeper#1833, lakekeeper#1837). - /health now returns 503 (not 200) when unhealthy, so Kubernetes HTTP probes detect it (lakekeeper#1802). - Postgres migration locks are transaction-scoped, so a failed migration can't leak an advisory lock that blocks future migrations (lakekeeper#1790).

v0.12.2 (2026-05-26)

Highlights

• Orphan-file cleanup now schedules itself adaptively per table — running more often where files accumulate and backing off where they don't — with a new dry-run mode.
• The LDAP role provider can resolve groups via subtree Search and conditional Branching, not just the memberOf attribute.

Features

• Adaptive orphan-file scheduling. The remove-orphan-files worker now self-tunes its cadence based on how fast reclaimable data builds up, and adds a dry-run mode that reports what it would delete. Orphan removal is now opt-in via enable-remove-orphan-files; default retention raised from 3 to 7 days. See the Table Maintenance docs for full config.
• LDAP group resolution modes. Resolve group memberships via Search (paged subtree) or Branching (per-user-DN rules) in addition to the memberOf attribute; the resolution mode is recorded in audit logs.
• Build metadata in Server Info. Server Info now reports Lakekeeper, Enterprise, and Console versions and commit SHAs, so deployed builds are easy to identify.

Breaking Changes

• The orphan-files task-queue API was renamed remove_orphaned_files → remove_orphan_files (paths, config schemas, and worker/enable fields).

Upgrade Notes

• Update any automation/IaC to the new remove_orphan_files task-queue path and schema names.
• Orphan removal is now opt-in (it ran by default in 0.12.1): set enable-remove-orphan-files=true to keep it active. Default retention is now 7 days.

Upstream Lakekeeper changes (bump to v0.12.3)

• Core and extension database migrations now apply atomically — no partial-migration state (lakekeeper#1768).
• Fixed table property removal being lost when no properties remained (lakekeeper#1767).
• New read-only maintenance mode for the server (lakekeeper#1765).
• Users may now share an email address — the unique-email constraint was dropped (lakekeeper#1755).
• New LAKEKEEPER__UI__ENABLE_SURVEYS flag to opt out of in-console surveys (lakekeeper#1750).

v0.12.1 (2026-05-10)

Features

• Remove Orphan Files. New maintenance capability that reclaims storage by deleting data, manifest, and metadata files no longer referenced by any snapshot — available as a server background worker and as a remove-orphan-files subcommand (with dry-run). Enabled by default; set LAKEKEEPER__TASK_REMOVE_ORPHANED_FILES_WORKERS=0 to disable. Respects gc.enabled and per-table opt-out properties. See the Table Maintenance docs for full config.
• Bounded orphan-files runtime. Cap how long a single orphan-files run may take with a configurable max run time.

Bug Fixes

• Warehouse rename no longer leaves a stale name in the UI table preview (bundled UI 0.7.12).

Upgrade Notes

• The orphan-files worker is enabled by default (2 workers); set LAKEKEEPER__TASK_REMOVE_ORPHANED_FILES_WORKERS=0 to disable. By default it only deletes files older than 3 days and honors gc.enabled / per-table opt-out.

Upstream Lakekeeper changes (bump to v0.12.2)

• OpenFGA: rebuild/reconcile authorization tuples from the catalog, and support switching an existing server to OpenFGA (lakekeeper#1731, lakekeeper#1733).
• OPA Trino batch authorization gains a broad-access fast path for warehouses/namespaces (lakekeeper#1727).
• Storage: dropped the opendal dependency and now validates vended credentials via lakekeeper_io (lakekeeper#1737).
• ADLS fixes: correct SAS-token key removal and %-encoding in blob names (lakekeeper#1746).

v0.12.0 (2026-04-21)

Highlights

• Cedar authorization matured into a configurable, inspectable system: derive user attributes from identity fields, reference roles by global ID, and use a new resolve-entities API + Console tabs to see exactly what drives a decision.
• Role providers resolve user roles from external sources — including LDAP groups and table properties — with caching, metrics, and audit.
• Console: a visual Cedar Policy Builder (beta) with a Cedar-aware editor, authorization-inspection tabs, and new statistics dashboards.
• Container images now default to ubi10 (breaking — see below).

Features

• Cedar user identity derivations. Extract attributes from identity fields with named-capture regex rules (optional lowercase/uppercase transform) and match policies on the derived values.
• Global role IDs in policies. Reference provider-scoped global role IDs as Cedar property values, and use short-form roles without a default provider.
• Resolve-entities API. POST /management/v1/permissions/cedar/resolve-entities returns the Cedar entities for any resource — for debugging why a decision was reached.
• SelectView action. Adds select / SelectView (and grant_select) for views, aligning with the upstream data-plane authorization split.
• Role-provider subsystem. LDAP Group Provider + token-provider chain, roles parsed from table properties, caching with stale-fallback and metrics, and an opt-in audit event for resolved roles — wired into the Cedar authorizer. Configure via ROLE_PROVIDER_FILE (TOML), overridable per-field by env vars.
• Richer permission-introspection audit. introspect_permissions logs now include the inner check tuples and their individual decisions.
• Console: Cedar Policy Builder (beta). Visual editor/builder with a CodeMirror Cedar editor (highlighting, autocomplete, inline diagnostics, format/validate via cedar-wasm) and live Evaluate.
• Console: authorization inspection + dashboards. Tabs for entity/policy sources, schema, and resolve-entities; new Home and Warehouse statistics dashboards; storage-layout configuration.

Bug Fixes

• Cedar: correctness fixes around short-form role tags, per-request provider-ID derivation, Role subjects, and resolve-entities server gating.
• Maintenance: expire-snapshots now removes statistics / partition-statistics from metadata, avoiding dangling references to deleted files.
• TLS: added webpki and native root certs to the S3 client and UBI images, fixing handshake failures in some environments.
• Console: correct handling of sub-namespaces containing dots; per-tab 403 keeps the navigation rail visible.

Breaking Changes

• Container images now default to ubi10; the ubi9-based image remains available under a separate tag.

Upgrade Notes

• If you pin the ubi9 base image (e.g. FIPS/compliance), switch to the dedicated ubi9 tag — the default is now ubi10.
• Role-provider config can be supplied via ROLE_PROVIDER_FILE (TOML), with env vars overriding per field — review precedence if you set both.

Upstream Lakekeeper changes

• Instance Admins — server-wide admin role independent of project membership (lakekeeper#1716).
• Idempotency keys for safely retrying mutating requests (lakekeeper#1671).
• referenced-by to discover views referencing a table/view (lakekeeper#1627).
• Configurable trusted engines in request metadata for authorization (lakekeeper#1629).
• Protect immutable table properties (e.g. encryption.key-id) during commits (lakekeeper#1700).
• Faster list namespaces/tables/views (lakekeeper#1618).