xDP 5.0.0

Product build: 5.0.0-28

This release strengthens how xDP connects, secures, and automates access to your platform. It introduces Cloudbridge (Tunnel Server v2) for zero-ingress, mutually-authenticated control-plane–to–data-plane connectivity, a tenant-scoped Role-Based Access Control (RBAC) model managed from XDP Admin Central, and first-class Service Users for programmatic, non-human access.

Highlights

• Cloudbridge (Tunnel v2): control-plane → data-plane traffic now runs over a mutually-authenticated (mTLS) tunnel — no inbound firewall openings required.

• RBAC: access to xDP is governed by per-tenant roles, with users and roles managed from Admin Central.

• Service Users: create non-human identities with API access keys for automation, integrations, and data-plane installation.

What's New

1. Cloudbridge (Tunnel Server v2)

Cloudbridge is xDP's secure connection layer between the Acceldata control plane and the data plane running in your infrastructure — a private, encrypted channel that lets the control plane reach the data plane without any inbound (ingress) access to your network. It replaces Tunnel v1 while remaining backward compatible during migration.

What's new

• Mutual TLS (mTLS): each data-plane connection is authenticated with an Acceldata-signed client certificate and key, adding client-identity validation on top of the existing TLS server verification and encrypted channel.

• PKI-backed certificates: certificates are issued and managed by the new Certz service (control plane), with signing/storage backed by cloud KMS + object storage and revocation tracked in Redis.

• Instant revocation: a data plane can be cut off by revoking its client certificate — no need to deactivate an ingest key.

• Long-lived outbound channel: the data-plane Cloudbridge client opens one persistent outbound mTLS connection; per-request encrypted sub-channels are created and torn down for each action, keeping the main tunnel untouched.

Action required

• Whitelist the new Cloudbridge (v2) egress URL for your environment in your firewall, and keep the existing Tunnel v1 URL in place until all data planes are upgraded. (New endpoints follow the cloudbridge-xdp.acceldata.app pattern per environment.)

• Upgrade data planes to the Cloudbridge-enabled build to move off Tunnel v1.

2. Role-Based Access Control (RBAC)

xDP access is now governed by an explicit, per-tenant role model. Users must hold an XDP tenant role to use and administer xDP — ADOC access alone no longer grants xDP permissions.

What's new

• XDP tenant roles, managed independently from ADOC, including a tenant_admin role for tenant-level administration.

• Admin Central (/ui/admin) for all user and role management — assign roles and manage users and groups from Control Center → Access Management.

• Custom tenant roles: tenant admins can define custom roles with tailored permissions when the defaults don't fit.

Action required (post-upgrade)

• After upgrading, users are not automatically granted xDP permissions. A tenant admin assigns the appropriate XDP tenant roles to users from Admin Central.

• If no tenant admin is available for your tenant after the upgrade, contact Acceldata support to re-establish initial admin access.

3. Service Users

Service Users are non-human identities for programmatic access — automation, CI/CD, integrations, and headless data-plane operations — kept separate from interactive user accounts.

What's new

• Create and manage service users from Settings → Credentials, including generating credentials with an optional expiry.

• API access keys: each service user authenticates with an access key / secret key pair rather than interactive login.

• RBAC-integrated: service users can be assigned XDP tenant roles just like human users.

• Service-user-driven data-plane installation: data-plane installs and key rotation can run under a dedicated service user (e.g. dataplane-service-user) instead of the installing person's identity.

Action required

• Assign the XDP tenant_admin role to the service user. A service user must hold tenant_admin permissions for its operations (including data-plane installation and management) to work.

• For service-user-driven data-plane installation, provision the service user before install — the installer resolves it by name and will fail if it does not exist.

Component versions

Upgrade checklist

• [ ] Whitelist the new Cloudbridge (v2) egress URL; leave Tunnel v1 whitelisted until all data planes are migrated.

• [ ] Confirm a tenant admin exists for your tenant; if not, contact Acceldata support.

• [ ] Assign appropriate XDP tenant roles to users in Admin Central.

• [ ] Provision any required service users (including the data-plane service user) before running data-plane installs.