Skip to main content
nx1-deployer image v1.16.1
The September 2026 release for non-web portal users adds API endpoints for audit search, business rules, and crew PDF export. It also adds the Keycloak roles that gate audit search and business rules. NexusOne’s AI features can now run against any OpenAI-compatible model backend. Gravitino runs as a single instance, and a slow Hive metastore no longer fails Spark jobs. This release also fixes Grafana SSO on shared services, makes the built-in Grafana alerts optional, and lets you send Grafana alerts to BigPanda. Airflow’s metrics now follow your monitoring_type setting, and you can point them at your own collector. It also upgrades several NX1 component images.

​
New features

This section contains new features recently added to the NexusOne platform.

​
Audit

Audit is a new NexusOne feature. Its new API endpoints are:

​
Business rules

Business rules is a new NexusOne feature. Its new API endpoints are:

​
Export a crew run or result

You can now download a finished crew run or crew result as a PDF, for sharing or record keeping. The new API endpoints are:

​
Machine-to-machine Iceberg catalog config

A new Get unredacted Iceberg REST catalog config endpoint returns a catalog’s Iceberg REST config with credentials included.

​
New Keycloak roles

The following roles are now available in NexusOne and you can assign them to users:
  • Business rules roles:
    • nx1_decisions_user: Reach the business rules API
    • nx1_decisions_admin: Manage every business rules workspace in NexusOne, including creating new workspaces
  • Audit role: nx1_audit_viewer searches the Ranger access, API, and business rule audit trails

​
Bug fixes

This section contains fixes for issues affecting apps or features on the NexusOne platform.

​
Airflow now only exports metrics when a collector is running

Airflow sent its metrics and traces to a collector no matter how you set monitoring_type, even though a collector only runs when the value is embedded. When you set monitoring_type to none, each scheduler and worker pod kept retrying against a dead collector address for its whole life. That wasted effort and filled the logs with errors. In this release, Airflow’s exporters are active and send metrics and traces to a collector only when you set monitoring_type to embedded.

​
Grafana SSO now uses its own Keycloak roles

On shared services, the Grafana in NexusOne’s built-in monitoring put every SSO user on Viewer. There was no way to sign in with the Admin or Editor role. This release gives Grafana its own Keycloak roles, nx1_grafana_admin for the Admin role and nx1_grafana_ops for the Editor role. On upgrade, on shared services and tenants alike, assign these to anyone who needs more than Viewer. The local Grafana administrator login still works.

​
Gravitino catalog name on hyphenated tenants

Each tenant has its own Iceberg catalog, and NexusOne names it after the tenant. Spark and Trino always write that tenant name with underscores when they call Gravitino. If a tenant’s name has a hyphen, then a query for my_tenant finds nothing, because Gravitino registered the catalog as my-tenant. In this release, Gravitino registers the catalog with underscores, matching what Spark and Trino ask for. For example, on a tenant named my-tenant, a query against my_tenant.sales.orders succeeds.

​
Enhancements

This section contains enhancements to existing app features on the NexusOne platform.

​
A slow metastore no longer fails Spark jobs

Spark queries ask the Hive metastore where a table’s data lives. A brief metastore slowdown or a stale connection used to fail the whole job. Now Spark retries up to five times, ten seconds apart, and waits up to ten minutes for each response.

​
Grafana

This release lets you turn off the built-in alert rules and adds a BigPanda contact point for routing alerts.

​
Built-in alert rules are now optional

NexusOne ships a standard set of Grafana alert rules for the platform. Teams running their own alerting had no way to turn them off, so they ended up with two sets of alerts. In this release, you can turn the built-in rules off. Set grafana_alerts_enabled to false and NexusOne skips them. It defaults to true, so nothing changes unless you ask. Set it in your shared services config to drop the shared alerts, such as Keycloak and the monitoring stack. Set it in a tenant config to drop that tenant’s alerts, such as Airflow, Trino, and Spark. There is no single switch for both.

​
Send alerts to BigPanda

If you use BigPanda for incident management, then NexusOne can now forward Grafana alerts to it. Set these keys in your config:
  • bigpanda_enabled: true to send alerts to BigPanda
  • bigpanda_webhook_url: Your BigPanda webhook URL
  • bigpanda_webhook_token: The webhook’s auth token
  • bigpanda_auth_scheme: The token’s scheme, Bearer by default
  • bigpanda_ca_pem: Optional CA chain for BigPanda’s TLS certificate, defaulting to your platform CA
Setting the keys creates a Grafana contact point named BigPanda-AIOps-integration. To actually send alerts, attach it to a notification policy in Grafana. Set it in the shared services config for the shared alerts, or in a tenant config for that tenant’s alerts.

​
Gravitino now runs as a single instance

NexusOne previously ran two Gravitino instances, one for the per-tenant Iceberg catalog and one for the Hive catalog. Gravitino now serves both catalogs from a single instance. NexusOne components such as Trino and Spark call Gravitino over the Iceberg REST protocol to resolve tables and record writes. With the move to one instance, the in-cluster address for those calls changed from http://gravitino-shared:9001/iceberg to http://gravitino-rest:9001/iceberg. NexusOne repoints Trino and Spark automatically.

​
OpenAI-compatible model backend

NexusOne’s AI features, such as natural-language SQL and AI crews, run against a large language model, such as Anthropic Claude or a self-hosted Ollama model. In this release, the AI features can now run against any OpenAI-compatible endpoint, such as vLLM, Baseten, or OpenRouter. In your tenant Terraform variables, set:
  • llm_provider: openai
  • llm_endpoint: The backend’s base URL, including the /v1 path, for example https://inference.baseten.co/v1
  • llm_api_token: The endpoint’s bearer token
  • llm_model: The model to request
The deploy fails with a clear error if llm_provider is openai and llm_endpoint is empty or doesn’t end in /v1. For the existing LLM providers, leave llm_endpoint empty.

​
Point Airflow’s metrics at your own collector

Airflow used to lose track of a self-managed metrics collector and drop all its metrics. Two new tenant variables point Airflow at your collector:
  • otel_metrics_service: Your collector’s Service name. Leave it unset to keep the built-in collector.
  • otel_metrics_port: Your collector’s port. Defaults to 4318.

​
Upgrades

This section contains version upgrades to existing apps on the NexusOne platform.

​
Gravitino v1.3.0 upgrade

Upgraded Gravitino from v1.2.9 to v1.3.0. As described in the Gravitino now runs as a single instance section, this upgrade lets a single Gravitino instance serve both the Iceberg and Hive catalogs.

​
JupyterHub hub image v4.4 upgrade

Upgraded the jupyterhub-k8s-hub image from v4.2.0.1 to v4.4, a hardened image.

​
Kyuubi etcd v3.6 upgrade

Upgraded the etcd image that backs Kyuubi from v3.5.21 to v3.6, a hardened image.

​
Metastore v3.1.8 upgrade

Upgraded Metastore from v3.1.7 to v3.1.8, a CVE-patched image.

​
S3 Gateway and Ranger-Authz-API v0.21 upgrade

Upgraded the S3 Gateway and Ranger-Authz-API from v0.17 to v0.21. Ranger-Authz-API is a workload in each tenant that the S3 Gateway and Gravitino call to check a request against Ranger policy.

​
Spark v3.5.6-nx1.33 upgrade

Upgraded the Spark image from v3.5.6-nx1.32 to v3.5.6-nx1.33. The new image no longer bundles the MongoDB Spark Connector JAR.