v1.9.0

What changed

🚀 Features & improvements

• site: landing page and docs on GitHub Pages (#175) @RafPe
• feat(helm): enable ServiceMonitor scraping with one switch (#167) @RafPe

🐛 Fixes

• fix(security): build on Go 1.26.10, bump golang.org/x/net to 0.60.0 (#179) @RafPe
• docs: enrol in the OpenSSF Best Practices Badge (#174) @RafPe
• build(deps): bump grpc 1.83.2, OpenTelemetry 1.45.0 and x/crypto 0.56.0 (#173) @RafPe
• chart: helm test hook image from values so mirrors can redirect it (#171) @RafPe

🧹 Housekeeping

• site: fix npm audit advisories in website dependencies (#180) @RafPe
• site: fluid docs layout and archify diagrams (#178) @RafPe
• site: header navigation links (#177) @RafPe
• docs+test: cover several audiences per issuer (audienceMatchPolicy MatchAny) (#172) @RafPe

Full changelog: v1.8.1...v1.9.0

v1.8.1

What changed

🐛 Fixes

• feat(helm): support single-issuer OIDC from an existing Secret (#164) @RafPe
• Support existing Secrets for multi-issuer OIDC configuration (#163) @RafPe

Full changelog: v1.8.0...v1.8.1

v1.8.0

What changed

🚀 Features & improvements

• Metrics dashboards, data-flow diagram and the kind demo (#158) @RafPe
• Chart: metrics Service, ServiceMonitor, PodMonitor, PrometheusRule, NetworkPolicy and e2e coverage (#157) @RafPe
• Metrics: authentication, review, issuer and audit collectors with a generated reference (#156) @RafPe
• Prometheus metrics endpoint: registry, listener and request metrics (#155) @RafPe

🐛 Fixes

• Prepare for metrics: client_golang floor, 1xx recorder fix, core-group RequestInfo (#154) @RafPe

🧹 Housekeeping

• docs: add a log-shipping page with a node-agent recipe for AWS Kinesis (#146) @RafPe

Full changelog: v1.7.1...v1.8.0

v1.7.1

What changed

🐛 Fixes

• fix(chart): set the release namespace on every namespaced object (#142) @RafPe
• chart: let the ServiceAccount create SubjectAccessReviews (#139) @RafPe
• chart: grant impersonation of every declared userextras key (#138) @RafPe

🧹 Housekeeping

• docs: restructure around reader journeys, fill the production gaps (#140) @RafPe
• ci: check relative links and heading anchors in markdown (#143) @RafPe
• test: deploy the proxy with the chart's RBAC and guard the chart against the code (#141) @RafPe
• docs: auditing page, request-watching recipes, GitHub Actions token walkthrough (#137) @RafPe

Full changelog: v1.7.0...v1.7.1

v1.7.0

What changed

🚀 Features & improvements

• Structured logging pipeline with request correlation (#134) @RafPe

🧹 Housekeeping

• ci: review large PRs area by area instead of skipping them (#135) @RafPe

Full changelog: v1.6.1...v1.7.0

v1.6.1

What changed

🐛 Fixes

• fix(chart): default image tag to appVersion so releases deploy their own image (#132) @RafPe

🧹 Housekeeping

• chore: add graphify knowledge graph outputs (#130) @RafPe
• chore: remove obsolete files from the repository root (#131) @RafPe
• build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#128) @dependabot[bot]
• ci: format release approvals and guard release-PR diffs (#127) @RafPe

Full changelog: v1.6.0...v1.6.1

v1.6.0

What changed

🚀 Features & improvements

• feat(proxy): cache TokenReview results for passthrough tokens (#117) @RafPe
• feat(proxy): cap impersonation header values accepted per request (#118) @RafPe
• feat(proxy): cache SubjectAccessReview impersonation decisions with split TTLs (#119) @RafPe

🐛 Fixes

• Bump cel-go and etcd client/v3 to fix known vulnerabilities (alert #5) (#123) @copilot-swe-agent[bot]

🧹 Housekeeping

• ci: dedupe release-PR approvals and drop dead workflow logic (#126) @RafPe
• ci: add on-demand PR review workflow (#124) @RafPe
• docs: add a dedicated caching and API-server protection guide (#122) @RafPe
• docs(getting-started): use kubelogin for kubectl and point to the local demo (#121) @RafPe
• docs(multi-issuer): add a multi-group GitHub Actions CEL example (#120) @RafPe

Full changelog: v1.5.0...v1.6.0

v1.5.0

What changed

🚀 Features & improvements

• fix(proxy): trustworthy client IPs in audit events; configurable token-review timeout (#114) @RafPe
• feat(proxy): support UID impersonation end to end (#113) @RafPe

🐛 Fixes

• ci: generate the e2e Kubernetes matrix from a committed version manifest (#115) @RafPe
• chore: move e2e and tooling pins to Kubernetes 1.37 (#110) @RafPe
• fix(audit): emit audit events for unauthenticated (401) requests (#112) @RafPe
• chore(deps): catch up the updates Dependabot never delivered (#109) @RafPe

🧹 Housekeeping

• ci: run the e2e suite twice daily instead of on every merge to main (#108) @RafPe
• ci: give every workflow job a colon-namespaced display name (#107) @RafPe
• ci: bound every job with a timeout and supersede stale PR runs (#106) @RafPe

Full changelog: v1.4.0...v1.5.0

v1.4.0

What changed

🚀 Features & improvements

• feat(security): allow named reserved groups instead of a blanket opt-out (#104) @RafPe

Full changelog: v1.3.0...v1.4.0

v1.3.0

What changed

🚀 Features & improvements

• fix(security): refuse reserved system: identities from token claims (#99) @RafPe
• fix(audit): record streaming requests as long-running, and classify core group requests correctly (#97) @RafPe

🐛 Fixes

• fix(probe): stay unready until the proxy is serving (#98) @RafPe
• fix(security): build on Go 1.26.6, unify toolchain source, harden CI (#95) @RafPe

🧹 Housekeeping

• test(fuzz): fuzz attacker-controlled parsers, clear the unfixable OSV advisory (#96) @RafPe
• ci: gate releases behind reviewed release PRs (#94) @RafPe

Full changelog: v1.2.0...v1.3.0