v0.3.0

0.3.0 (2026-10-06)

Features

• answer an ingress's check, with identity for a domain backend (#42) (fae70b6)

Bug Fixes

• deps: update krm-stream to 0.10.0 (#45) (3d4b8f0)

Documentation

• list the chart on Artifact Hub with its repository ID and widget (#41) (6f4efff)

Install

helm install krm-foyer oci://ghcr.io/configbutler/charts/krm-foyer --version 0.3.0

The image is ghcr.io/configbutler/krm-foyer:0.3.0 (linux/amd64), digest
sha256:6b620d658fdc3ff2fad394d2df27142ff706e8a4d20496ef810e6d45136ff6cf.

Verify this release

The image and the chart are signed with cosign (keyless). The image also carries
SLSA build provenance and an SPDX SBOM as registry attestations.

cosign verify \
  --certificate-identity-regexp '^https://github.com/ConfigButler/krm-foyer/\.github/workflows/release\.yml@refs/heads/main$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/configbutler/krm-foyer:0.3.0

cosign verify \
  --certificate-identity-regexp '^https://github.com/ConfigButler/krm-foyer/\.github/workflows/release\.yml@refs/heads/main$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/configbutler/charts/krm-foyer:0.3.0

gh attestation verify oci://ghcr.io/configbutler/krm-foyer:0.3.0 --repo ConfigButler/krm-foyer

v0.2.0

0.2.0 (2026-10-05)

⚠ BREAKING CHANGES

• -session-keys-file (chart: sessionKeys.secretName) is required, and -session-idle-timeout (bounds.sessionIdleTimeout) is removed. Everyone signs in again after the first upgrade; logout no longer revokes a copied session cookie.

Features

• configure login parameters and expose Kubernetes identity (#37) (f98a49e)
• keep sessions in encrypted cookies across restarts (#36) (9a0731f)

Bug Fixes

• sign and publish releases the way gitops-reverser does (#39) (56f24bd)

Install

helm install krm-foyer oci://ghcr.io/configbutler/charts/krm-foyer --version 0.2.0

The image is ghcr.io/configbutler/krm-foyer:0.2.0 (linux/amd64), digest
sha256:ec94b9deed638ce01c39de50c0adf6e1e5e8d1ff4ea32b9068b40f9818042891.

Verify this release

The image and the chart are signed with cosign (keyless). The image also carries
SLSA build provenance and an SPDX SBOM as registry attestations.

cosign verify \
  --certificate-identity-regexp '^https://github.com/ConfigButler/krm-foyer/\.github/workflows/release\.yml@refs/heads/main$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/configbutler/krm-foyer:0.2.0

cosign verify \
  --certificate-identity-regexp '^https://github.com/ConfigButler/krm-foyer/\.github/workflows/release\.yml@refs/heads/main$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/configbutler/charts/krm-foyer:0.2.0

gh attestation verify oci://ghcr.io/configbutler/krm-foyer:0.2.0 --repo ConfigButler/krm-foyer

v0.1.0

0.1.0 (2026-10-05)

⚠ BREAKING CHANGES

• krm_foyer_upstream_watches_open has an identity label (user or shared); a query on the bare name now sums both.

Features

• a working demo: task demo, the hello example and the browser helper (#17) (8891215)
• bound requests and responses, end open watches with their session, and serve metrics (#22) (2a6f43c)
• build streams on krm-stream 0.5.0, which maps the API server's answers and leaves retries to the browser (#25) (cdf1e23)
• build streams on krm-stream 0.6.0, which refuses redirects and stops reopening early-ending watches (#26) (c746c0c)
• install krm-foyer with a Helm chart, which the e2e suite now installs through (#30) (9571a03)
• interruption pages for browser navigations (#12) (243da5c)
• live notes with krm-stream: user-authenticated streams, closed with their session (#23) (5bf5dfb)
• OIDC login with PKCE, state and nonce, and /k8s behind sessions (#11) (a514dc8)
• proxy /k8s with the user's token, path checking and upstream response rules (#9) (3355231)
• server-side sessions with CSRF and same-origin checks (#10) (047f10c)
• share one watch per scope among every user's streams, with the API server asked about each user (#28) (4b95da1)
• upgrade krm-stream, enforce shared rate limits, and reconcile docs (#31) (50e79c6)

Bug Fixes

• keep issuer error text out of the logs, compare e2e bodies, and keep sessions free of HTTP (#16) (da7efd8)
• resend only krm-foyer's own CSRF refusals, log ID tokens by cause, and encrypt every hop of the demo (#21) (d7bd208)
• stop promptly with streams open, let concurrent logins finish, and harden the chart (#34) (15b3268)

Documentation

• clarify live-resource architecture and frontend integrations (#32) (11c7ecd)
• defer proxy subresources, qualify revocation, and specify decompression (be2b463)
• restructure around a vision and roadmap, and start without an allowlist (#7) (702aa65)