v0.1.0

The initial release: a Kubernetes-aware pprof gateway for Go workloads,
and PGO CPU-profile collection layered on top of it.

Added

• The pprof gateway.
  One HTTP entry point resolves a Kubernetes Service to its backend Pods,
  using EndpointSlice discovery with strict eligibility rules,
  and proxies eight profile types (cpu, trace, heap, allocs, goroutine, mutex, block, threadcreate)
  over a pinned HTTP client that confirms the Pod before it dials.
  The /v1 API lists a Service's eligible targets and fetches a profile from a named or randomly selected Pod,
  with version restriction and a bounded duration for cpu and trace.

• Access realms.
  Authorization is static realms loaded from process configuration:
  which namespaces a caller may reach is decided per realm,
  and nothing the gateway emits reveals a Pod IP, a pprof port,
  or a name the caller's realm denies.

• A read-only Kubernetes footprint.
  Profgate requires no Kubernetes write permissions:
  it observes Services, Pods, and EndpointSlices in authorized namespaces
  and connects only to explicitly permitted application pprof ports.
  The deployment manifests pin the matching read-only RBAC,
  and a startup preflight confirms the granted permissions before serving.

• PGO CPU-profile collection.
  Scheduled and on-demand Collections gather representative CPU profiles for Profile-Guided Optimization:
  multi-round sampling across a Service's Pods,
  an in-memory merge, and retained artifacts.
  Replicas coordinate through dedicated NATS JetStream KV and Object stores,
  with leases, reclaim of Collections whose owner died,
  and a sweeper for expired state,
  while profile bytes stay ephemeral.
  Interactive profiling and PGO sampling share one admission gate,
  and the /v1 API manages per-Service PGO policies and Collections end to end.

• Deployment surfaces.
  A Helm chart and a kustomize base with pinned RBAC,
  NATS account provisioning and credentials mounting for PGO,
  and a release workflow that publishes the image and the chart to GHCR on every tag.

• Observability and operations.
  Prometheus metrics for the gateway and the PGO loops,
  a JSON audit record for every /v1 request,
  a configurable server log level,
  and a CLI with version and config validate.

• End-to-end proof on real clusters.
  kind-based e2e lanes exercise the gateway and PGO collection against real clusters,
  frozen Kubernetes 1.23 and 1.24 images and the current Kubernetes release,
  matching the 1.23 compatibility baseline.

Artifacts

• Image: ghcr.io/arloliu/profgate:v0.1.0
• Chart: oci://ghcr.io/arloliu/charts/profgate version 0.1.0