Features
- Added egress audit-log persistence for Kata/micro-VM runtimes via an in-sidecar ALS sink, with ConfigMap-driven micro-VM detection (Kata, VCI, ECI) (#359)
- Added iptables backend auto-detection (legacy/nft) in proxy-init, aborting with CONFLICT instead of blackholing traffic (#358)
- Added cluster-wide default sidecar resources via the varmor-config ConfigMap, with independent nonMitm/mitm tiers (#363)
- Enhanced policy-advisor to detect shell usage by file extension, e.g. .sh (#348)
Bug Fixes
- Fixed data races in the auditor subscriber maps and the ProxyConfigPropagator (#352, #355)
- Fixed printk_ratelimit save/restore corruption at the subscriber 0↔1 boundary (#356)
- Fixed NetworkProxyConfig not caching when added to or removed from a policy on update (#351)
- Rejected invalid defaultAction values to prevent a silent whitelist→blacklist flip (#353)
- Rejected mismatched MITM CA cert/key pairs so the reuse path self-heals (#354)
- Fixed BPF mount-flag CRD fields overflowing int32 on stricter API servers (#357)
Refactors
- Simplified the NetworkProxy Secret error flow (#350)
- Upgraded Go/Node.js dependencies (#362) and refreshed the Mozilla CA bundle (#364)
Tests / CI
- Added a scheduled workflow to auto-refresh the Mozilla CA bundle (#361)
Docs
- Added a "Network Egress Control and AI Agent Hardening" practices section (#349)
- Documented varmor-config dynamic configuration and prepared docs/blog for v0.10.4 (#365)
Upgrade Notes
- Requires proxyinit:v0.2 or newer for iptables backend auto-adaptation.
- Micro-VM detection and default sidecar resources are hot-reloadable via the varmor-config ConfigMap.
Full Changelog: v0.10.3...v0.10.4