‍What's New for Enterprise Portal

The new version of Enterprise Portal is approaching Beta, with a dedicated launch post to follow. Several new capabilities landed this month that are worth calling out now. You can try any of these today by contacting your account team for access while it is still in the Alpha phase.

Enterprise Portal delivers a turnkey software delivery portal for your customers on day one. You can further extend and customize that portal experience through custom content and branding, or go headless to incorporate the Enterprise Portal functionality into a customer-facing portal that you already offer.

Headless enablement, for vendors and end customers - The portal can now be driven through APIs in two directions. Vendors can build and manage the portal experience programmatically through the Vendor API, an approach carried over from v1 and extended for v2. New in this version of Enterprise Portal, end customers can automate their own installs and upgrades with a service account instead of an interactive login, which opens the portal to automation-first and agentic enterprise consumers.

A customer authenticates with a service account token, polls for the latest release, and applies upgrades from their own CI/CD pipeline. The docs cover end-customer patterns like an automated upgrade pipeline and pre-staging air gap artifacts, and the exact API calls are available in the in-product API reference when the Automation feature is enabled.

KOTS and kURL install methods now supported - At its June launch the new Enterprise Portal supported Embedded Cluster and Helm CLI. It now also supports KOTS and kURL for air gap use cases. Air gap customers on KOTS or kURL get install and update instructions, version-filtered downloads in the instance card, and instance visibility, matching what Download Portal has traditionally provided for those installer products. Vendors whose end customers are spread across multiple Replicated installer methods can now use one Enterprise Portal as the single source for air gap asset distribution.

What's New for Secuity Center

The Security Center functionality within Vendor Portal is also approaching Beta, with its own announcement to follow. The theme this month is expanding upon release vulnerability data to help vendors answer key "who's impacted?" questions across customer, CVE, and release slices.

‍Customer impact view - Customer Impact is now the default view when you open Security Center. It tells you not just that a release image has a vulnerability, but exactly which customers and instances are exposed to a specific vulnerability. Select a flagged release image and drill down into the blast radius of that image - which other releases contain it, and which customers are exposed to it. You can also filter impact by known CVE.

For each reporting Helm or Embedded Cluster instance, Customer Impact now shows the security benefit of upgrading to the latest release on its channel, including which CVEs an upgrade resolves and which it introduces, with a recommended upgrade per customer. That turns "you have a problem" into "here's exactly what to tell them to do." In addition to an improved user experience in the Vendor Portal Security section, we've improved the API so you can pull customer-impact data into your own support and tooling workflows.

Gate releases on scan results in CI/CD - Release image scan results are now available programmatically through the Vendor API. The same Grype data behind the dashboards can be pulled into a CI/CD pipeline to gate the promotion of a release, for example blocking a promotion when an image still has fixable critical vulnerabilities. This shifts vulnerability detection earlier in the release process, before a release is promoted to a customer-facing channel.

Broader UX improvements - A few additions make the data easier to act on. There is a fixable-only CVE filter to focus on vulnerabilities you can actually remediate, a severity filter on CVE details, and image-source-type classification and filtering so you can separate your own application images from Replicated component images and tell at a glance which CVEs are yours to fix and which are Replicated's responsibility.

What's New for Vendor Portal

Verify signed images through the proxy registry - If you sign the images you distribute with Replicated or attach SBOMs and attestations to them, customers pulling those images through the proxy registry can now verify them with cosign, oras, and other standard tooling. The proxy passes native OCI Referrers API requests through to your registry, so verification works on the images customers pull instead of forcing them around the proxy. This applies when your upstream registry serves the Referrers API.

What's New for Embedded Cluster

Embedded Cluster v3 continues toward GA. This month's additions center on reliability and approachability.

‍Resumable installs - Installs are now resumable, so an install interrupted at any phase can pick up where it left off instead of starting over, making v3 more resilient in the field.

More approachable guided installer - The v3 installer UI and CLI now use plain language instead of Kubernetes jargon, which further lowers the bar for the operators actually running the install in customer environments.

Clearer preflight guidance - New documentation clarifies v1beta2 vs v1beta3 preflights for Embedded Cluster v3, including how external preflight specs render through Helm.

‍

‍