v0.3.0

Documents the project for public use, hardens the chart against values it cannot honor,
and corrects guidance the code contradicted.

Added

• A documentation set for public use.
  A root README positions the gateway and walks a Helm quickstart to a first profile;
  four guides cover the API, the configuration file, deployment, and PGO collection end to end;
  the changelog backfills the released versions;
  and an Apache-2.0 license states the terms the published image and chart carry.

• Chart rendering fails on values it cannot honor.
  The container memory limit is derived from the PGO ceilings,
  so overriding one of those keys through the raw config block or extraEnv now fails rendering,
  naming the supported values key,
  and an explicit null at config.pgo or config.pgo.limits — which would bypass that guard — fails too.
  The same guard covers the file-path keys the Deployment's Secret mounts are built from,
  because a raw or environment override there points the config at files nothing mounts;
  such an override fails rendering rather than shipping a crash-looping Pod,
  a nats.credsFile that does not name the file the Secret mount provides fails the same way,
  and a raw config.nats.url now satisfies the URL requirement the way the docs promise.
  A PodDisruptionBudget with both bounds set, or with neither, no longer ships a budget the operator did not ask for:
  rendering fails and names the fix,
  and maxUnavailable: 0 counts as a set bound rather than reading as unset.

• The informer sync wait logs its progress.
  A Pod waiting for the Kubernetes informer caches warns every 15 seconds with the elapsed time,
  so each of the readiness waits now names itself in the logs.

Changed

• NATS credentials are optional in the chart.
  The chart mounted the credentials Secret and rendered credsFile whenever PGO was enabled,
  though with an empty credsFile the binary skips the JWT credentials file.
  Both now render only when nats.credsFile is non-empty,
  so nats.credsFile: "" skips the Secret mount and authentication, if any, rides in the URL.

Fixed

• The application NetworkPolicy example left deploy/base.
  kubectl apply -k deploy/base also applied the example into the target namespace,
  touching any workload matching its selector.
  It now lives at deploy/ beside the Secret examples,
  as a template to customize per application namespace.

• config validate states what a short PGO grace period costs.
  The output said a shorter grace period loses no work;
  a drain waits through each Collection's deadline and abandons work still running there,
  a cut attempt's samples are dropped,
  and another replica retries only while the deadline and an attempt remain —
  otherwise the Collection fails as deadline_exceeded or attempts_exhausted.

• The chart's install notes print API paths that exist.
  The curl examples used /v1/targets?namespace=<ns>&service=<svc>, which matches no route;
  they now use /v1/namespaces/<ns>/services/<svc>/targets.

Artifacts

• Image: ghcr.io/arloliu/profgate:v0.3.0
• Chart: oci://ghcr.io/arloliu/charts/profgate version 0.3.0

helm install profgate oci://ghcr.io/arloliu/charts/profgate --version 0.3.0

Full changelog: CHANGELOG.md