From 31a9c11c3e917a1fc091765a2c21d52c0c8f02a1 Mon Sep 17 00:00:00 2001 From: adela Date: Thu, 12 Feb 2026 12:36:05 +0100 Subject: [PATCH 1/3] docs: add 3.15.0 changelog --- docs/changelog/bytebase-3-15-0.mdx | 81 ++++++++++++++++++++++++++++++ docs/docs.json | 1 + 2 files changed, 82 insertions(+) create mode 100644 docs/changelog/bytebase-3-15-0.mdx diff --git a/docs/changelog/bytebase-3-15-0.mdx b/docs/changelog/bytebase-3-15-0.mdx new file mode 100644 index 00000000..8664a017 --- /dev/null +++ b/docs/changelog/bytebase-3-15-0.mdx @@ -0,0 +1,81 @@ +--- +title: Bytebase 3.15.0 - Feb 12, 2026 +author: Adela +updated_at: 2026/02/12 18:00:00 +description: 'Project-level Service Accounts & Workload Identities' + +--- + +import InstallUpgrade from '/snippets/install/install-upgrade.mdx'; + +## 🔔 Project-level Service Accounts & Workload Identities + +We introduce project-level Service Accounts and Workload Identities in addition to the existing workspace-level scope. This enables project-scoped machine identities to follow least privilege and reduce automation blast radius, while clearly separating machine identities from users and aligning them with the resource hierarchy. + +- **UI & scope changes** + + - Workspace Members page now has separate tabs for Users&Groups, Service Accounts, and Workload Identities. + - Service accounts and workload identities can now be created at both workspace and project levels, governed by their respective IAM policies. + - Project-level identities are scoped to a single project to enable isolated automation. + - The account selector for role assignment now supports users, groups, service accounts, and workload identities. Service accounts and workload identities require entering the full email address (not searchable). + +- **Breaking changes (API / Terraform users)** + + - Machine identities are managed via dedicated APIs (`ServiceAccountService`, `WorkloadIdentityService`) instead of the User API. + - IAM member prefixes updated: + `user:{email}` → `serviceAccount:{email}` / `workloadIdentity:{email}` + - Workspace-level Service Account and Workload Identity APIs now require explicit parent `workspaces/-` instead of an empty string. + Affected APIs: `CreateServiceAccount`, `ListServiceAccounts`, `CreateWorkloadIdentity`, `ListWorkloadIdentities`. + Endpoint change: + `/v1/serviceAccounts` → `/v1/workspaces/-/serviceAccounts` + - Terraform users must update IAM member prefixes and use the new service account/workload identity resources. + +## 🔔 Other Notable Changes + +- **SQL Editor settings consolidation & policy updates** + - Add a dedicated **SQL Editor** section under **Workspace Settings > General**, consolidating data export, data copying, admin data source access, max result size, max result rows, and max query time. + - **Max result rows** can also be configured at the project level. + - `DataSourceQueryPolicy` is merged into `QueryDataPolicy` and deprecated (auto-migrated). + - DDL/DML execution control is now configured at the project role level using `bb.sql.ddl` and `bb.sql.dml` permissions. The previous `disallow_ddl` / `disallow_dml` environment policy is removed. + +- **Role & permission adjustments** + - Add `bb.taskRuns.create` permission to the **Project Owner** role. + - Remove `bb.rollouts.create` permission from the **Project Developer** role (use **Project Releaser** or **Project Owner**). + - Allow managing project IAM policy without the **Project Owner** role. + +- **Online migration configuration change** + - Move gh-ost configuration from Plan spec to SQL directive in sheet content (`-- gh-ost = { ... }`). + - Remove `enable_ghost` and `ghost_flags` from `ChangeDatabaseConfig` in the Plan API. + +- **Execution & validation improvements** + - Skip DML dry-run checks when DDL statements are present to reduce false positives. + +- **Cleanup & removals** + - Remove the **Archived** page (archived projects and instances now appear directly in the dashboard). + - Remove `auto_enable_backup` and `skip_backup_errors` from project settings. + - Deprecate the legacy issue page and route. + +## 🚀 Features + +- **MongoDB** + - Use native driver for queries by default, with fallback to `mongosh`. + - SQL Editor now supports auto-complete, current statement highlighting, and syntax checking. + - Support statement-type access control in SQL Editor, allowing administrators to control Read and Write permissions. + +- **Elasticsearch** + - Support statement-type access control in SQL Editor, allowing administrators to control Read and Write permissions. + +## 🎄 Enhancements + +- SQL Editor query results support multi-select via Cmd/Ctrl + Click for rows and columns. Copied data now includes column names. +- Improve the SQL Editor database connection panel layout. +- Normalize Unicode emails to prevent creating accounts with visually identical but technically different addresses. + +## 🐞 Bug Fixes + +- Fix access token refresh on SQL Editor LSP websocket reconnection. +- Fix incorrect Learn More link for online migration. +- **Google Cloud SQL** - Fix IAM authentication while creating instances in Bytebase Cloud. +- **PostgreSQL** - Support CTE for Backup. + + diff --git a/docs/docs.json b/docs/docs.json index 74aaabe0..84057acf 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -403,6 +403,7 @@ { "tab": "Changelog", "pages": [ + "changelog/bytebase-3-15-0", "changelog/bytebase-3-14-1", "changelog/bytebase-3-14-0", "changelog/bytebase-3-13-1", From 99f7e51eaa6a2af208127e80009d4b0b3355e9f8 Mon Sep 17 00:00:00 2001 From: adela Date: Thu, 12 Feb 2026 16:15:30 +0100 Subject: [PATCH 2/3] update --- docs/changelog/bytebase-3-15-0.mdx | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/changelog/bytebase-3-15-0.mdx b/docs/changelog/bytebase-3-15-0.mdx index 8664a017..eebc3453 100644 --- a/docs/changelog/bytebase-3-15-0.mdx +++ b/docs/changelog/bytebase-3-15-0.mdx @@ -17,7 +17,7 @@ We introduce project-level Service Accounts and Workload Identities in addition - Workspace Members page now has separate tabs for Users&Groups, Service Accounts, and Workload Identities. - Service accounts and workload identities can now be created at both workspace and project levels, governed by their respective IAM policies. - Project-level identities are scoped to a single project to enable isolated automation. - - The account selector for role assignment now supports users, groups, service accounts, and workload identities. Service accounts and workload identities require entering the full email address (not searchable). + - The account selector for role assignment now supports users, groups, service accounts, and workload identities. Service accounts and workload identities require entering the full email address. - **Breaking changes (API / Terraform users)** @@ -37,6 +37,7 @@ We introduce project-level Service Accounts and Workload Identities in addition - **Max result rows** can also be configured at the project level. - `DataSourceQueryPolicy` is merged into `QueryDataPolicy` and deprecated (auto-migrated). - DDL/DML execution control is now configured at the project role level using `bb.sql.ddl` and `bb.sql.dml` permissions. The previous `disallow_ddl` / `disallow_dml` environment policy is removed. + - For Terraform users, the settings update also affect Terraform, need to update bytebase_policy configuration. [Latest provider documentation](https://registry.terraform.io/providers/bytebase/bytebase/3.15.1/docs/resources/policy) - **Role & permission adjustments** - Add `bb.taskRuns.create` permission to the **Project Owner** role. From 452000d2e84ad0a1fcaf164fb7cda064e065c035 Mon Sep 17 00:00:00 2001 From: adela Date: Thu, 12 Feb 2026 16:33:36 +0100 Subject: [PATCH 3/3] update --- docs/changelog/bytebase-3-15-0.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/changelog/bytebase-3-15-0.mdx b/docs/changelog/bytebase-3-15-0.mdx index eebc3453..19590277 100644 --- a/docs/changelog/bytebase-3-15-0.mdx +++ b/docs/changelog/bytebase-3-15-0.mdx @@ -49,7 +49,7 @@ We introduce project-level Service Accounts and Workload Identities in addition - Remove `enable_ghost` and `ghost_flags` from `ChangeDatabaseConfig` in the Plan API. - **Execution & validation improvements** - - Skip DML dry-run checks when DDL statements are present to reduce false positives. + - Skip DML dry-run checks when DDL statements are present to reduce false positives. Primarily applied to SQL Review rule `Validate the executability of DML statements`. - **Cleanup & removals** - Remove the **Archived** page (archived projects and instances now appear directly in the dashboard).