Skip to content

v0.10.0

Choose a tag to compare

View all tags
@Danny-Wei Danny-Wei released this 17 Apr 16:04
· 126 commits to release-0.10 since this release
v0.10.0
92491dd

Features

  • Added NetworkProxy enforcer for sidecar-based traffic interception and access control (#308)
    • Supports L4 egress rules (IP/CIDR/port matching) and L7 HTTP rules (host/path/method matching).
    • Supports TLS SNI-based domain matching without decryption.
    • Works alongside BPF network rules: BPF executes at the kernel level first, then NetworkProxy evaluates at the application protocol level.
    • Available in both EnhanceProtect and DefenseInDepth modes.
  • Added new built-in rules: disable-access-passwd, disable-access-shadow, disable-access-ssh-dir, and disable-write-skills (#309)

Refactors

  • Adjusted the bucket boundaries of the webhook latency histogram (#300)
  • Upgraded Go and Node.js dependency packages (#304, #311)

Fixes

  • Corrected skipRuleWithModelData logic in policy-advisor to check all conflict types instead of returning after the first (#305)

Docs

  • Updated interface specification for the NetworkProxy enforcer (#310)
  • Updated default value for podEgressControl to disable in installation guide (#301)
  • Updated custom rules documentation with NetworkProxy examples

Full Changelog: v0.9.2...v0.10.0

Assets 2
Loading