ClusterGate v1.12.6

ClusterGate v1.12.6

Kubernetes Routing Gateway Platform — expose internal Kubernetes services over public domains.

Security

• Dependency updates for the open Dependabot alerts (#42).
  • Backend: proxy-addr 2.0.8 (critical: IPv4-mapped IPv6 addresses could spoof trusted proxies), follow-redirects 1.16.1 via axios 1.20.0, compression 1.8.2, morgan 1.12.1, @grpc/grpc-js 1.14.6 and several transitive fixes. npm audit reports 0 vulnerabilities.
  • Frontend: next 16.4.2 (critical RCE in next/og, SSRF in image optimization, cache poisoning, information disclosure), sharp 0.35.5, postcss-selector-parser 7.1.6.
  • Known remaining: braces (GHSA without a patched release) via Tailwind CSS 3. It is only used at build time on our own content globs and is not reachable at runtime.

Upgrade notes

• No configuration changes and no database migration. Pull the new images and redeploy.

What's Changed

• chore(release): v1.12.6 (@claude)
• fix(deps): resolve open Dependabot security alerts (@claude)

Docker Images

# Backend
docker pull ghcr.io/No749ah/clustergate-backend:v1.12.6

# Frontend
docker pull ghcr.io/No749ah/clustergate-frontend:v1.12.6

Quick Start

git clone https://github.com/No749ah/ClusterGate.git
cd ClusterGate
cp .env.example .env
# Edit .env — set JWT_SECRET and POSTGRES_PASSWORD
docker compose up -d
docker compose exec backend npm run db:migrate

Frontend: http://localhost:3000
Backend API: http://localhost:3001

On first visit, the Setup Wizard will guide you through creating your admin account.

Kubernetes Deploy

helm upgrade --install clustergate ./helm/clustergate \
  --namespace clustergate \
  --create-namespace \
  --set ingress.host=clustergate.example.com \
  --set backend.secrets.jwtSecret=$(openssl rand -base64 64) \
  --set postgres.credentials.password=$(openssl rand -base64 32) \
  --wait

ClusterGate v1.12.5

ClusterGate v1.12.5

Kubernetes Routing Gateway Platform — expose internal Kubernetes services over public domains.

Fixed

• Request bodies show up in the log again. POST/PUT/PATCH bodies were dropped from the request log unless the route had transforms, so most logs read "no body". They are now recorded, including bodies streamed through to the upstream.
• Streamed responses are no longer cut after a few words. Logged bodies were capped at 5000 characters; an n8n NDJSON stream spends most of that on metadata, so only the first sentence survived. Bodies now keep up to 64 KB, streamed responses up to 256 KB. Buffered responses that hit the limit now end with a visible truncation note instead of being cut silently, and binary bodies are logged as a short placeholder.
• Text view of n8n / OpenAI streams no longer shows JSON fragments. The PII sanitizer masked 13-digit timestamps and UUID tails as phone numbers and bare JSON numbers such as "created":1759830000, which turned every logged frame into invalid JSON. Bare JSON numbers are left alone now and the phone pattern no longer matches inside longer digit runs; phone, card and SSN values in strings and free text are still masked. A frame cut by the log limit is shown as the text written so far.
• Log detail is easier to read. Text wraps at word boundaries instead of mid-word, header names are shown in full, the dialog is wider, and each body has Copy and More/Less buttons. A truncated body says so above the text.
• docker-compose UI could not reach the API after the client-token change in v1.12.4: the X-CG-Client-Token header was missing from the CORS allow list, so every call from the UI on :3000 to the API on :3001 failed. Single-origin setups (Ingress, Helm) were not affected.

Upgrade notes

• New optional settings LOG_BODY_LIMIT (default 65536) and LOG_STREAM_BODY_LIMIT (default 262144) control how many characters of each body the request log keeps. Larger bodies take more space in request_logs; Postgres compresses repetitive stream frames on disk. No database migration.

What's Changed

• fix(logs): full request/response bodies, readable stream text, no JSON-breaking PII masks (@claude)

Docker Images

# Backend
docker pull ghcr.io/No749ah/clustergate-backend:v1.12.5

# Frontend
docker pull ghcr.io/No749ah/clustergate-frontend:v1.12.5

Quick Start

git clone https://github.com/No749ah/ClusterGate.git
cd ClusterGate
cp .env.example .env
# Edit .env — set JWT_SECRET and POSTGRES_PASSWORD
docker compose up -d
docker compose exec backend npm run db:migrate

Frontend: http://localhost:3000
Backend API: http://localhost:3001

On first visit, the Setup Wizard will guide you through creating your admin account.

Kubernetes Deploy

helm upgrade --install clustergate ./helm/clustergate \
  --namespace clustergate \
  --create-namespace \
  --set ingress.host=clustergate.example.com \
  --set backend.secrets.jwtSecret=$(openssl rand -base64 64) \
  --set postgres.credentials.password=$(openssl rand -base64 32) \
  --wait

ClusterGate v1.12.4

ClusterGate v1.12.4

Kubernetes Routing Gateway Platform — expose internal Kubernetes services over public domains.

Fixed

• Traffic map shows live requests again. Incoming requests from the live stream are drawn on the map again, stay in place when the window or sidebar is resized, and the map renders sharply on high-DPI screens. The header shows whether the live stream is connected, and it reconnects on its own after an error.
• Request logs page layout. The route filter dropdown opens aligned under its button, is wider, keeps its checkboxes in one column and shows full route names on hover. Empty date filters read "From" / "To" instead of the browser's date mask, and the calendar icon is no longer clipped.
• No more content running off the right edge. Wide tables now scroll inside their card instead of stretching the whole page, so filter bars and header buttons stay visible (Logs, Routes, Users, archived routes, organization and group details).
• Native controls follow the dark theme (date pickers, scrollbars).
• Ctrl/⌘+K no longer opens two things on the Routes page. It now only opens the global search; the routes shortcut sheet moved to ?. The header hint shows ⌘K on macOS and Ctrl K elsewhere.
• Routes pagination showed an empty page-size selector because its default (20) was not one of the offered sizes. It now defaults to 25.

What's Changed

• docs(release): add traffic map fix to v1.12.4 notes (@claude)
• fix(traffic-map): draw live requests on the map again (@claude)
• fix(ui): one Ctrl/Cmd+K binding, valid routes page size (@claude)
• chore(release): v1.12.4 (@claude)
• fix(ui): stop tables and page headers overflowing on narrow screens (@claude)
• fix(logs): tidy filter bar layout on the request logs page (@claude)

Docker Images

# Backend
docker pull ghcr.io/No749ah/clustergate-backend:v1.12.4

# Frontend
docker pull ghcr.io/No749ah/clustergate-frontend:v1.12.4

Quick Start

git clone https://github.com/No749ah/ClusterGate.git
cd ClusterGate
cp .env.example .env
# Edit .env — set JWT_SECRET and POSTGRES_PASSWORD
docker compose up -d
docker compose exec backend npm run db:migrate

Frontend: http://localhost:3000
Backend API: http://localhost:3001

On first visit, the Setup Wizard will guide you through creating your admin account.

Kubernetes Deploy

helm upgrade --install clustergate ./helm/clustergate \
  --namespace clustergate \
  --create-namespace \
  --set ingress.host=clustergate.example.com \
  --set backend.secrets.jwtSecret=$(openssl rand -base64 64) \
  --set postgres.credentials.password=$(openssl rand -base64 32) \
  --wait

ClusterGate v1.12.3

ClusterGate v1.12.3

Kubernetes Routing Gateway Platform — expose internal Kubernetes services over public domains.

Upgrade notes

• Database migration: 20261005090000_request_log_source adds a source column (TRAFFIC / TEST / HEALTH_CHECK) and an index to request_logs, and backfills existing rows. The backend applies it automatically on startup (prisma migrate deploy). On very large request_logs tables the backfill UPDATE can take a moment.
• Request log defaults changed: route test-panel runs and health-check probes (detected by user agent, e.g. kube-probe, Uptime Kuma, UptimeRobot, ELB, GoogleHC) are now hidden from the request log by default. Use the new source filter on the Activity page, the "Show tests & health checks" switch on a route's log tab, or ?source=all on /api/logs to see them.

New

• Streamed responses are visible in the request log. Instead of [streamed], the log keeps the first 5000 characters of the streamed body (marked when truncated), decompressed and with the usual PII redaction. SSE / NDJSON bodies show the assembled text with a Raw toggle. The proxied stream itself is unchanged.

What's Changed

• chore(release): v1.12.3 (@claude)
• feat(logs): mark test runs and health checks, hide them by default (@claude)
• fix(logs): add LogBody component (logs/ is gitignored, move to common/) (@claude)
• feat(logs): capture streamed response bodies for the request log (@claude)

Docker Images

# Backend
docker pull ghcr.io/No749ah/clustergate-backend:v1.12.3

# Frontend
docker pull ghcr.io/No749ah/clustergate-frontend:v1.12.3

Quick Start

git clone https://github.com/No749ah/ClusterGate.git
cd ClusterGate
cp .env.example .env
# Edit .env — set JWT_SECRET and POSTGRES_PASSWORD
docker compose up -d
docker compose exec backend npm run db:migrate

Frontend: http://localhost:3000
Backend API: http://localhost:3001

On first visit, the Setup Wizard will guide you through creating your admin account.

Kubernetes Deploy

helm upgrade --install clustergate ./helm/clustergate \
  --namespace clustergate \
  --create-namespace \
  --set ingress.host=clustergate.example.com \
  --set backend.secrets.jwtSecret=$(openssl rand -base64 64) \
  --set postgres.credentials.password=$(openssl rand -base64 32) \
  --wait

ClusterGate v1.12.2

ClusterGate v1.12.2

Kubernetes Routing Gateway Platform — expose internal Kubernetes services over public domains.

⚠️ Breaking changes — read before upgrading

• Route targets on localhost, the Kubernetes API and ClusterGate's own database are now blocked by default. Loopback (localhost, 127.0.0.0/8, ::1, 0.0.0.0), kubernetes.default.svc… / KUBERNETES_SERVICE_HOST and the DATABASE_URL host are rejected when a route is saved and again by the proxy on every connection (HTTP and WebSocket). Existing routes pointing there stop working. Set TARGET_DENY_DEFAULTS=false to restore the old behavior; TARGET_DENY_EXTRA adds your own entries. System admins can additionally restrict an organization's routes to an allowlist of namespaces and hosts (off by default).
• Cookie-authenticated /api calls need a UI client token. The UI receives an X-CG-Client-Token at login and keeps it in memory only; on a hard reload it re-obtains it by redirecting through /api/auth/resume, so expect one quick redirect. Scripts that call /api with only the session cookie now get 401; use a bearer token instead (bearer-token clients are unaffected). API_CLIENT_TOKEN_REQUIRED=false turns the check off for debugging only.
• Swagger "Try it out" needs a bearer token. Authorize in Swagger UI with an API token; the browser session cookie alone is no longer accepted there.

Other security changes

• ClusterGate's own cg_* cookies (session, CSRF) are no longer forwarded to upstream services, and upstream responses can no longer set them.
• Apps under /r/ are isolated from the UI and API on the same host; the new per-route Sandbox Pages option serves untrusted apps from an opaque origin.

What's Changed

• chore(release): v1.12.2 with upgrade notes in the GitHub release (#37) (@No749ah)
• fix(security): keep one helmet config and test auth without an express app (@claude)
• feat(security): isolate apps under /r/ from the UI and API on the same host (@claude)
• feat(security): per-organization route target allowlists and global target denylist (@claude)
• fix(proxy): stop forwarding ClusterGate session cookies to upstreams (@claude)

Docker Images

# Backend
docker pull ghcr.io/No749ah/clustergate-backend:v1.12.2

# Frontend
docker pull ghcr.io/No749ah/clustergate-frontend:v1.12.2

Quick Start

git clone https://github.com/No749ah/ClusterGate.git
cd ClusterGate
cp .env.example .env
# Edit .env — set JWT_SECRET and POSTGRES_PASSWORD
docker compose up -d
docker compose exec backend npm run db:migrate

Frontend: http://localhost:3000
Backend API: http://localhost:3001

On first visit, the Setup Wizard will guide you through creating your admin account.

Kubernetes Deploy

helm upgrade --install clustergate ./helm/clustergate \
  --namespace clustergate \
  --create-namespace \
  --set ingress.host=clustergate.example.com \
  --set backend.secrets.jwtSecret=$(openssl rand -base64 64) \
  --set postgres.credentials.password=$(openssl rand -base64 32) \
  --wait

ClusterGate v1.12.1

ClusterGate v1.12.1

Kubernetes Routing Gateway Platform — expose internal Kubernetes services over public domains.

What's Changed

• fix(apikeys): key dialog route list no longer overflows the dialog (@claude)

Docker Images

# Backend
docker pull ghcr.io/No749ah/clustergate-backend:v1.12.1

# Frontend
docker pull ghcr.io/No749ah/clustergate-frontend:v1.12.1

Quick Start

git clone https://github.com/No749ah/ClusterGate.git
cd ClusterGate
cp .env.example .env
# Edit .env — set JWT_SECRET and POSTGRES_PASSWORD
docker compose up -d
docker compose exec backend npm run db:migrate

Frontend: http://localhost:3000
Backend API: http://localhost:3001

On first visit, the Setup Wizard will guide you through creating your admin account.

Kubernetes Deploy

helm upgrade --install clustergate ./helm/clustergate \
  --namespace clustergate \
  --create-namespace \
  --set ingress.host=clustergate.example.com \
  --set backend.secrets.jwtSecret=$(openssl rand -base64 64) \
  --set postgres.credentials.password=$(openssl rand -base64 32) \
  --wait

ClusterGate v1.12.0

ClusterGate v1.12.0

Kubernetes Routing Gateway Platform — expose internal Kubernetes services over public domains.

What's Changed

• feat(folders): route folders with drag & drop, folder-bound API keys, 120s timeout default (@claude)

Docker Images

# Backend
docker pull ghcr.io/No749ah/clustergate-backend:v1.12.0

# Frontend
docker pull ghcr.io/No749ah/clustergate-frontend:v1.12.0

Quick Start

git clone https://github.com/No749ah/ClusterGate.git
cd ClusterGate
cp .env.example .env
# Edit .env — set JWT_SECRET and POSTGRES_PASSWORD
docker compose up -d
docker compose exec backend npm run db:migrate

Frontend: http://localhost:3000
Backend API: http://localhost:3001

On first visit, the Setup Wizard will guide you through creating your admin account.

Kubernetes Deploy

helm upgrade --install clustergate ./helm/clustergate \
  --namespace clustergate \
  --create-namespace \
  --set ingress.host=clustergate.example.com \
  --set backend.secrets.jwtSecret=$(openssl rand -base64 64) \
  --set postgres.credentials.password=$(openssl rand -base64 32) \
  --wait

ClusterGate v1.11.2

ClusterGate v1.11.2

Kubernetes Routing Gateway Platform — expose internal Kubernetes services over public domains.

What's Changed

• fix(security): tenant-scope every route-bound and org-bound endpoint (@claude)
• feat(apikeys): shared keys visible everywhere, group keys from the routes list (@claude)

Docker Images

# Backend
docker pull ghcr.io/No749ah/clustergate-backend:v1.11.2

# Frontend
docker pull ghcr.io/No749ah/clustergate-frontend:v1.11.2

Quick Start

git clone https://github.com/No749ah/ClusterGate.git
cd ClusterGate
cp .env.example .env
# Edit .env — set JWT_SECRET and POSTGRES_PASSWORD
docker compose up -d
docker compose exec backend npm run db:migrate

Frontend: http://localhost:3000
Backend API: http://localhost:3001

On first visit, the Setup Wizard will guide you through creating your admin account.

Kubernetes Deploy

helm upgrade --install clustergate ./helm/clustergate \
  --namespace clustergate \
  --create-namespace \
  --set ingress.host=clustergate.example.com \
  --set backend.secrets.jwtSecret=$(openssl rand -base64 64) \
  --set postgres.credentials.password=$(openssl rand -base64 32) \
  --wait

ClusterGate v1.11.0

ClusterGate v1.11.0

Kubernetes Routing Gateway Platform — expose internal Kubernetes services over public domains.

What's Changed

• feat(apikeys): share one API key across multiple routes (@claude)

Docker Images

# Backend
docker pull ghcr.io/No749ah/clustergate-backend:v1.11.0

# Frontend
docker pull ghcr.io/No749ah/clustergate-frontend:v1.11.0

Quick Start

git clone https://github.com/No749ah/ClusterGate.git
cd ClusterGate
cp .env.example .env
# Edit .env — set JWT_SECRET and POSTGRES_PASSWORD
docker compose up -d
docker compose exec backend npm run db:migrate

Frontend: http://localhost:3000
Backend API: http://localhost:3001

On first visit, the Setup Wizard will guide you through creating your admin account.

Kubernetes Deploy

helm upgrade --install clustergate ./helm/clustergate \
  --namespace clustergate \
  --create-namespace \
  --set ingress.host=clustergate.example.com \
  --set backend.secrets.jwtSecret=$(openssl rand -base64 64) \
  --set postgres.credentials.password=$(openssl rand -base64 32) \
  --wait

ClusterGate v1.10.10

ClusterGate v1.10.10

Kubernetes Routing Gateway Platform — expose internal Kubernetes services over public domains.

What's Changed

• feat(auth): accept route API keys as Authorization: Bearer (@claude)

Docker Images

# Backend
docker pull ghcr.io/No749ah/clustergate-backend:v1.10.10

# Frontend
docker pull ghcr.io/No749ah/clustergate-frontend:v1.10.10

Quick Start

git clone https://github.com/No749ah/ClusterGate.git
cd ClusterGate
cp .env.example .env
# Edit .env — set JWT_SECRET and POSTGRES_PASSWORD
docker compose up -d
docker compose exec backend npm run db:migrate

Frontend: http://localhost:3000
Backend API: http://localhost:3001

On first visit, the Setup Wizard will guide you through creating your admin account.

Kubernetes Deploy

helm upgrade --install clustergate ./helm/clustergate \
  --namespace clustergate \
  --create-namespace \
  --set ingress.host=clustergate.example.com \
  --set backend.secrets.jwtSecret=$(openssl rand -base64 64) \
  --set postgres.credentials.password=$(openssl rand -base64 32) \
  --wait