Breaking Changes and Deprecations

We plan to deprecate meshStack's API User authentication in a future release in favor of API Keys, which provider a more fine-granular and improved permission model. API Keys already fully replace meshStack API users except for some billing/usage report use cases. This notice is to be transparent about our direction early, even though we do not yet have a confirmed removal date. What is affected API Users are the legacy authentication mechanism for accessing the meshfed API. They are distinct from the newer API Keys, which are workspace-scoped and support shorter-lived credentials. Why no date has been set yet The deprecation timeline is currently blocked. Some meshStack functionality is still served exclusively through internal kraken-api endpoints that require API User credentials and cannot yet be reached via the meshfed-api. Until those endpoints are migrated or replaced, we cannot set a mandatory retirement date without breaking workflows. What this means for you Migrate API Users to API Keys unless you are using kraken-api functionality API Users continue to work normally. We will update this post once a migration path is confirmed and a retirement date is set. Stay informed Subscribe to this post using the "Follow" button to be notified when a date is confirmed or migration guidance is published. You can also contact us at support@meshcloud.io with questions.

We are deprecating the AWS SSO SCIM-based integration for meshStack's AWS IAM Identity Center connectivity. This integration method will be removed on October 1, 2026 . Why We're Deprecating This The SCIM token approach has several drawbacks: Over-privileged: The SCIM token grants more permissions than meshStack needs Requires manual rotation of long-lived secrets Reduced auditability in AWS CloudTrail (shared token with other systems like Entra ID) What Replaces It The AWS Identity Store API integration (available since meshStack v2026.10.0) is the recommended replacement: Uses an IAM role with least-privilege Identity Store permissions Compatible with Workload Identity Federation — fully secret-less operation possible Better CloudTrail auditability per action Supports locally managed IAM Identity Center users Timeline Now: AWS Identity Store API integration is available and recommended for all new AWS platform setups October 1, 2026: AWS SSO SCIM integration will be removed from meshStack Migration To migrate, follow our in-place upgrade guide: Apply the updated terraform-aws-meshplatform v0.7.0 module to add Identity Store IAM permissions to your AWS integrations in addition to existing AWS SSO SCIM permissions. Switch the IAM integration type to "AWS Identity Store API" in your AWS platform configuration. You can do this via meshPanel or you use this opportunity to start managing your meshPlatform via terraform Remove the old SCIM token and permissions after successful validation Full migration documentation is available at https://docs.meshcloud.io/docs/integrations/aws/sso-setup.html If you need help migrating, contact us at support@meshcloud.io or reach out to your Customer Success contact.

meshStack's Location concept is being deprecated. Locations were introduced as a way to group platforms by geography or organizational unit. However, they have proven to create unnecessary complexity. What is changing For existing meshStacks, nothing changes at the moment. However, for new meshStack (or if opted-in for existing ones) you can use the newly introduced autoSelectGlobalLocation configuration. If enabled: New platform instances will automatically be placed in the built-in global location . You no longer need to create or manage custom locations. Location creation via the meshStack panel and meshObject API will be disabled. Existing locations remain readable and operational during the migration window. API integrations using meshLocation as a meshObject (e.g. POST /api/meshobjects with kind: meshLocation ) will need to be updated to reference the global location identifier or remove the location reference entirely. Timeline Now : The autoSelectGlobalLocation config flag is available. New meshStack instances already have locations fully disabled. For existing instances, your platform engineering team can opt in by enabling this flag (ask your Customer Success team) Upcoming : meshcloud will enable this flag by default for all new meshStack instances. End-state : Locations will be fully removed from meshStack. An exact removal date will be communicated with at least 3 months' notice. What you need to do At the moment you don't have to do anything. We will communicate again when there are next steps in the deprecation of meshStack locations for existing meshStacks. Questions or concerns? Please reach out to your customer success manager or contact us at support@meshcloud.io . We are happy to help assess the impact on your specific setup.

Google Cloud Deployment Manager has been deprecated by Google and will be removed from meshStack landing zone support by April 1, 2026. No active tenants rely on this mechanism, but unused landing zones may still reference it and can be cleaned up safely. Please migrate to Building Blocks attached to landing zones for a modern, flexible, and provider-agnostic alternative.

The use of AWS CloudFormation StackSets within meshStack landing zones is planned for deprecation. These setups will be deprecated no earlier than April 1, 2026. StackSets can still be used at the AWS Organization or OU level, as supported by AWS. For landing zone automation in meshStack, we recommend transitioning to Building Blocks, which offer better control and a consistent experience across cloud providers.

Deprecation Announcement: Chargeback Endpoint meshcloud has decided to deprecate the Chargeback endpoint in October 2025. Moving forward, all financial data will be accessible via the Tenant Usage Report endpoint. Please migrate to meshTenantUsageReport.v3which now contains usage and chargeback data for every report. The meshChargeback object as an aggregation of different usage reports will be removed from the meshObject API.Just like the meshChargeback object, the meshTenantUsageReport.v3contains line item data at seller-product-group level aggregation. Additionally, we plan to migrate all financial endpoints currently hosted by the kraken service to meshfed. This transition will enable improved functionality, including the ability to restrict endpoint access to specific workspaces and workspace data. We appreciate your understanding and will provide further updates as we approach the migration.