DQ&C 17.2.0 Upgrade Notes
Operational database permissions for pushdown
In pushdown on Snowflake, Databricks, BigQuery, and IOMETE, DQ jobs that collect invalid record samples or export invalid records now create tables in the operational database of the connection. On Snowflake, this is the working database.
After upgrading, check that the credentials on these connections can create tables in the operational database. Otherwise, the jobs still return correct results but take longer to complete.
For details, see How pushdown for DQ evaluation works.
Upgrading from versions earlier than 17.0.0
The secured environment for self-managed Data Processing Engine (DPE) changed significantly in version 17.0.0. The Java Security Manager, removed in Java 25, was replaced by a narrower mechanism that restricts file-system access only:
-
File-system access is denied by default and re-enabled only through explicit, narrowly scoped rules. Previously, blanket read access was granted to entire directory trees, such as
/opt/ataccama. -
Network, reflection, and other runtime permissions from the previous policy are no longer checked at all. If you relied on the previous policy to restrict network access, enforce those restrictions at the container or cluster network level instead.
-
If you have customized the previous Security Manager policy through the
serverPolicyHelm value, it is not compatible with the new policy format and must be rewritten. For the new syntax, see Configuring custom policy rules.
|
If self-managed DPE custom JDBC drivers are deployed by mounting them directly to Before upgrading, ask your cluster admin to migrate any such drivers to the supported deployment process. |
For full details, see Secured environment: Security Manager replaced in 17.0.0 upgrade notes.
Search index update for term suggestions
By default, the Term Suggestions screen now displays only the suggestions you have permission to accept or reject. This is controlled by the Only suggestions I can approve switch. See View only suggestions you can approve.
The switch relies on permission data, which is now stored in the search index. After the upgrade, the index entries for term suggestions are updated automatically in the background. No manual action is required.
The update keeps running after the upgrade completes. It has the lowest indexing priority, so on a busy system, expect it to take longer.
Behavior during the index update
While the index is being updated:
-
The Only suggestions I can approve switch is unavailable and shows the tooltip "This filter isn’t available right now. Search is still preparing the permission data it needs."
The screen lists all pending suggestions. After the update finishes, reload the page to make the switch available.
-
Users with the
MMM_adminrole are not affected, because their list is never filtered.
How long the index update takes
The duration depends on the version you upgrade from and the number of term suggestions.
-
If you upgrade from 17.0.x or earlier, the full index rebuild runs instead of the term suggestion update. On large catalogs, this takes hours. Term suggestions are rebuilt near the end, so until then, some suggestions are missing from the Term Suggestions list.
-
If you upgrade from 17.1.x, only the term suggestion update runs. The following estimates assume default settings on a system with no other indexing activity. Actual times vary by environment.
Term suggestions Estimated duration 1,000
Seconds
100,000
5 to 10 minutes
1,000,000
30 to 75 minutes
Several million
Hours
Speed up the index update
To reduce the duration of the update:
-
Set the following properties in the Metadata Management Module (MMM) configuration file
mmm-backend/etc/application.properties:-
plugin.catalog-search.ataccama.one.eventqueue.worker-pool-size: Raise from the default5to a higher value, for example,10. -
plugin.catalog-search.ataccama.one.eventqueue.worker-high-priority-count: Keep at1or higher, so that at least one worker stays reserved for user edits. -
plugin.catalog-search.ataccama.one.engine.elasticsearch.index.settings.dynamic.index.refresh_interval: Set to30s.
-
-
Restart MMM.
Check the update progress
To check whether the update is still running, use the ataccama_one_mmm_catalogsearch_reindex_pending metric on the MMM Prometheus endpoint (/actuator/prometheus).
It shows how many search index entries are still waiting to be updated.
It rises shortly after MMM starts and falls to 0 when the update is done.
Right after MMM starts, the metric can still show 0 until the update is queued.
If the switch stays unavailable
If the pending metric (see Check the update progress) stays at 0 for a few minutes, and the switch is still unavailable after you reload the page, the update did not complete.
To find the cause, check the MMM log from the last time MMM started. If this log is no longer available, restart MMM and check the new log.
-
If the MMM log contains
elasticsearch-startup-evolution-failed, the index mapping update failed. Restart MMM to retry it.If the message still appears after two restarts, contact Ataccama Support.
-
If the MMM log doesn’t contain this message, the index update most likely failed partially, for example, due to an Elasticsearch or OpenSearch outage during the update.
To fix it, run search recovery. Recovery rebuilds the entire search index, so search is unavailable or limited for up to several hours on large catalogs. If the switch is still unavailable after the recovery finishes, contact Ataccama Support.
Reindexing does not fix this, because the affected suggestions did not change.
Fewer automatic term assignments
Detection rules now assign a term only if at least one user has access to both the term and the catalog item. See Term detection requires shared access to the term and the catalog item.
No action is required during the upgrade, but you might see fewer automatic term assignments.
What changes after the upgrade
Terms are no longer assigned automatically in the following cases:
-
The term and the catalog item are shared with different users or groups, and no user has access to both.
-
Only users with the
MMM_adminidentity provider role have access to the term or the catalog item.
Terms assigned before the upgrade are kept, even after the catalog item is profiled again. You can remove them manually.
Monitor skipped assignments
To see how often assignments are skipped, use the ataccama_one_mmm_term_assignment_skipped_no_shared_user_total metric on the MMM Prometheus endpoint (/actuator/prometheus).
To find the affected terms and catalog items, search the MMM log for the message ID term-assignment-skipped-no-shared-user.
Each entry contains the IDs of the term and the catalog item.
If you don’t see the metric, no term assignments have been skipped since MMM last started.
Restore the previous behavior
Set ataccama.one.metadata.processing.termAssignmentPermissionCheck.enabled=false in the MMM configuration file mmm-backend/etc/application.properties and restart MMM.
See Term detection.
| If you are using an Ataccama Cloud environment, contact Ataccama Support for configuration assistance. |
Attribute data types are stored in uppercase
The data type of a catalog item attribute is now always stored in uppercase, for example, STRING instead of string.
This is true whether the attribute is imported from a source, edited in the web application, or written through the GraphQL API.
In earlier versions, the value was stored exactly as provided, and a value such as string could break features that match attributes by data type, such as rule input matching.
During the upgrade, existing values are converted, including in historical versions of attributes.
Data types that ONE doesn’t recognize, such as the source-specific varchar, stay as they are.
Ataccama Query Language (AQL) filters need no update: a filter such as dataType = 'string' keeps matching, because recognized data types are compared regardless of letter case.
Reindex catalog items if the data type is indexed
If the dataType property of attributes was added to the search configuration in your environment, reindex the catalogItem configuration after the upgrade.
The default search configuration doesn’t index this property, so most environments require no action.
Until you reindex, searching catalog items by data type returns no results and any search filter on the property isn’t displayed.
To reindex:
-
Go to Global Settings > Search Configurations.
-
Find and select the
catalogItemconfiguration. -
In the ribbon that appears, select Reindex.
Reindexing can take hours on large catalogs, and search is limited while it runs. See Reindex search.
Audit API changes
The following changes to the Audit API can break scripts and integrations that query audit records directly. The audit log in the Ataccama ONE web application is not affected.
The size argument is required
The assets and operations queries now require the size argument, which must be between 1 and 10000.
A query that omits size fails with a validation error, and a query that requests a larger page is rejected.
Previously, a query without size returned all matching records at once, which could exhaust the memory of the Audit module on instances with a large audit history.
Before upgrading, add size to every assets and operations query you run against the Audit API.
To retrieve more records than fit in a single page, use pagination.
Also restrict queries to a time range and omit totalCount unless you need it.
Without these, the query scans the whole audit history.
The assetNames and assetActions queries are removed
The root queries assetNames and assetActions no longer exist.
They returned every distinct asset name and asset action ever recorded, which required scanning the whole audit database.
If a script calls either query, update it:
-
The set of asset actions is fixed:
CREATE,READ,UPDATE, andHARD_DELETE. -
Asset names cannot be enumerated. To find assets by name, filter the
assetsquery byassetName.
The operationNames, operationActions, users, violations, and moduleNames queries aren’t affected.
The catalogSearch query supports only skip and size pagination
The catalogSearch GraphQL query no longer accepts the cursor argument or returns the pageInfo and edges.cursor fields.
A query that passes cursor or selects either field fails with a GraphQL validation error.
Cursor pagination on this query didn’t work in any earlier version: pageInfo.hasNextPage returned true even on the last page, and pageInfo.endCursor stayed the same from page to page, so a client that paginated by cursor kept receiving the same page.
Before upgrading, update every catalogSearch query that uses the removed argument or fields: paginate with the skip and size arguments instead, which work as before, and remove pageInfo and edges.cursor from the selection.
Cursor pagination on other queries, such as catalogItems and terms, is not affected and works correctly.
Review and Request Data Access workflows apply to ONE API clients
The ONE API now follows the same Review and Request Data Access workflows as the web application. As a result, the following changes can break scripts and integrations that publish assets or approve or reject requests through the API.
Publishing an asset that requires review fails
If any asset that you publish through the API requires review under the Review workflow configuration, the publish mutation, such as termPublish or termBulkPublish, fails with error code PUBLISH_FAILED and reason REVIEW_REQUIRED.
No assets are published, including those that don’t require review.
Unpublished changes in child assets, such as the attributes of a catalog item, are published together with the parent, so they are checked too.
To find the assets that require review, check reviewRequiredNodes in the error.
Request a review for those assets in the web application, and publish the remaining assets in a separate call.
Bulk publish mutations are limited to 1000 assets
If a bulk publish mutation selects more than 1000 assets, it fails with error code PUBLISH_FAILED and reason SELECTION_TOO_LARGE.
This applies however the assets are selected: by a filter without the size argument, by a size over 1000, or by listing more than 1000 asset IDs.
Unpublished changes in child assets count toward the limit.
To publish the assets, split them into smaller selections.
Publishing requires a running Workflow service
If the Workflow service can’t be reached, publishing in the web application and through the API fails with error code PUBLISH_FAILED and reason WORKFLOW_CHECK_UNAVAILABLE, even for assets that don’t require review.
Only asset types that are published directly, without drafts, such as sources and connections, are published as before.
By default, publishing is blocked while the Workflow service can’t be reached.
To change this, set one of the following properties in the MMM configuration file mmm-backend/etc/application.properties and restart MMM:
-
plugin.tasks.ataccama.one.workflow-service.publish-guard.fail-on-unreachable=false: Publishing proceeds when the Workflow service can’t be reached, and assets that require review are published without a review during the outage. -
plugin.tasks.ataccama.one.workflow-service.publish-guard.enabled=false: Publishing no longer checks whether assets require review, so it isn’t blocked when the Workflow service can’t be reached. Assets that require review can be published without a review.
| If you are using an Ataccama Cloud environment, contact Ataccama Support for configuration assistance. |
Only approvers can approve or reject review and access requests
Each approval step of a review or access request has its own subtask.
To approve or reject a step through the API, update its subtask with the updateSubtask mutation, and set state to DONE and resolution to APPROVED or DENIED in the same call.
A call that sets only state or only resolution fails, and a subtask that is already approved or rejected can’t be changed.
If the user who makes the call isn’t an approver for the subtask, the call fails, so make the call with an approver’s account. Approvers are:
-
Users with the
MMM_adminrole. -
The workflow’s fallback assignees.
-
The users the subtask is assigned to, directly or through a group or role. If the subtask is assigned to both a group and a role, the user must be in the group and have the role.
The task of a review or access request and its subtasks can’t be deleted, and the task’s state and type can’t be changed.
Stewardship changes follow the Review workflow
Assigning or transferring stewardship now follows the Review workflow configured for the asset type, like other edits of an asset. In earlier versions, the new owner group took effect immediately.
What happens after you save the change depends on the asset:
-
If the asset’s type is published directly, without drafts, such as sources and connections, the change is published immediately, as before.
-
If the asset requires review under the Review workflow configuration, the change must be approved through a review request.
-
If the asset doesn’t require review, you publish the change yourself.
The new and previous owner groups get their new access levels only when the change is published.
See Transfer stewardship.
Stewardship changes made through the API must be published
Before upgrading, update scripts that call <entity>TransferStewardship or <entity>BulkTransferStewardship, such as termTransferStewardship, so that they also publish the change with a publish mutation, such as termPublish.
For asset types that are published directly, the transfer call publishes the change.
If the publish mutation fails with error code PUBLISH_FAILED and reason REVIEW_REQUIRED, request a review for the asset in the web application.
The onConflict argument is removed from bulk transfer stewardship mutations
In earlier versions, the onConflict argument decided what happened when owner group access couldn’t be granted during the transfer.
Owner group access is now checked when the change is published, so the <entity>BulkTransferStewardship mutations, such as termBulkTransferStewardship, no longer accept the argument.
A call that passes onConflict fails with a GraphQL validation error, so before upgrading, remove the argument from existing calls.
The conflicts field in the mutation result is deprecated and always empty, so remove the field from the selection in existing calls.
If the new owner group can’t be assigned to the asset, or the access level selected for the previous owner group can’t be shared, publishing the change fails and the draft stays. If the asset’s type is published directly, the transfer call fails instead.
To fix the failure, transfer stewardship again with an owner group and access level that the asset allows. You don’t need to discard the draft first.
The Workflow service memory limit uses a new property
Submitting a review request for a catalog item with many related assets no longer fails with the Exceeded limit on max bytes to buffer : 5242880 error.
The limit is now set by the Workflow service property ataccama.one.workflow-service.mmm-be-max-in-memory-size, which defaults to 24MB and replaces spring.codec.max-in-memory-size.
If you have set a custom value for spring.codec.max-in-memory-size, move it to the new property.
Obsolete JSON functions in ONE expressions
ONE expressions now include a JSON type and a set of json.* functions for working with structured values.
The functions str.jsonParse, str.toObject, and str.toArray are obsolete and replaced by json.parse, json.toObject, and json.toArray.
Expressions that use these functions continue to work in the current release, though we recommend upgrading them at your convenience.
str.jsonParse and json.parse
When replacing str.jsonParse, keep in mind that json.parse accepts only valid JSON syntax and returns null otherwise.
str.jsonParse also accepts invalid JSON syntax, such as unquoted field names or single quotes instead of double quotes.
If your data contains such strings, correct it before switching to json.parse.
In BigQuery pushdown, str.jsonParse is not supported and rules using it are treated as not supported in pushdown.
Use json.parse instead.
For details, see JSON functions.
DPM license and concurrent job limit
Starting from 17.2.0, Data Processing Module (DPM) limits the number of jobs that run at the same time across the whole environment. See Environment-wide limit on concurrent jobs in the 17.2.0 release notes.
What you need to do before upgrading depends on how your environment is deployed.
Self-managed deployments
In self-managed deployments, DPM runs on your side and the limit is granted by your DPM license through the parallelJobLimit field.
DPM refuses to start if it doesn’t find a valid license that grants a limit, and licenses issued before 17.2.0 don’t contain this field.
Before you upgrade:
-
Open your DPM license file (
.plf) and check that it contains aparallelJobLimitvalue.If it doesn’t, request a new license from Ataccama and put it in place before you upgrade. Setting
plugin.executor.ataccama.one.global-parallel-job-limitisn’t a substitute: configuration can only lower the limit granted by the license but not grant one. -
Make sure DPM can find the license. Either list the file in
plugin.executor.ataccama.one.licensesin the DPMetc/application.propertiesfile, or keep it in the home directory of the user running DPM, which DPM scans as a fallback. -
(Optional) To run with a lower limit than your license grants, set
plugin.executor.ataccama.one.global-parallel-job-limit. Leave the property unset to use the licensed limit as it is.
After the upgrade, DPM logs the resolved limit at startup, and the License tab in DPM Admin Console shows the same value. See License.
Keep in mind the following:
-
DPM also refuses to start if the license file has been modified, has expired, or was issued for a different major version.
-
If the license expires while DPM is running, DPM stops admitting new jobs until a valid license is in place. Jobs that are already running aren’t interrupted.
-
Licensing of Data Processing Engines (DPEs) doesn’t change: each engine keeps verifying its own
.plflicense file.
For details about the properties, see Concurrent job limit and license.
Ataccama Cloud deployments
No action is needed on your side. The limit is set for each environment according to your contract, and jobs beyond it wait in the queue.
If you run hybrid DPEs on your own infrastructure, you no longer need a license file on them once both the platform and the DPE are on 17.2.0 or later. DPEs on earlier versions keep using their license file.
DQ&C MCP server URL changed
Starting from 17.2.0, the Data Quality & Catalog (DQ&C) MCP server is served from the /mcp path on your Ataccama ONE hostname, for example one.example.com/mcp.
In earlier versions, the server used a separate mcp- subdomain, for example mcp-one.example.com.
In most environments, the mcp- URL stops working after the upgrade.
If users connected AI clients to the server before upgrading, they need to update the server URL in their client configuration.
The authentication flow and the available tools are not affected.
In Ataccama Cloud environments, the server is also enabled by default from 17.2.0, so environments that previously had it turned off get it after the upgrade.
For details, see Data Quality & Catalog MCP Server.
gRPC reflection turned off by default on DQ firewalls
As part of security improvements in DQ firewalls, gRPC server reflection is turned off by default starting with version 17.2.0.
No action is required during the upgrade.
If you rely on reflection, for example when debugging a DQ firewall or using tools that discover its gRPC services at runtime, enable it explicitly by setting com.ataccama.dqf.grpc.reflection.enabled=true in the DQ firewall configuration.
| If you are using an Ataccama Cloud environment, contact Ataccama Support for configuration assistance. |
Reports with a custom preview show the live preview
When a report has a custom preview set, the custom image is now displayed only on the Reports screen, and the report details show the live preview. In earlier versions, the custom preview replaced the live preview in both places.
This behavior is controlled by the new Keep live preview with custom thumbnail connection setting.
After the upgrade, the setting is selected on all connections. Reports that previously showed only a custom preview now show the live preview to anyone who can open the report, regardless of their access to the connection.
To keep hiding the live preview, clear the setting on the affected connections. See Hide the live preview.
Was this page useful?