v0.11.0

[0.11.0] - 2026-11-04

Added

• Templates can decode JSON with parse_json and parse URL components with parse_url.
• Templates can convert JSON Web Key Sets to PEM public keys with jwks_public_keys.
• json_string_array_pattern produces a regular expression for exact membership in JSON string arrays.

Fixed

• HAProxy reloads keep runtime inventories consistent with the serving worker, preventing stale map updates during WAF policy rotation (#635).
• Live config changes retry timed-out validation tests and keep the last good config active until the full suite passes (#631).
• Preflight resource checks fetch HTTP inputs, including JWKS URLs, and preserve non-critical fetch failure behavior (#619).
• HTTP input refreshes can withdraw signing keys when unrelated routing inputs are invalid, and retry unchanged content after transient validation failures.
• Admission accepts new HTTP inputs when templates handle fetch errors; rendering checks the full configuration before reporting a template error.
• Replacing an active render with a newer resource snapshot no longer reports a configuration failure.

Helm chart

Added

• haproxy-haptic.org/jwt-jwks-url refreshes signing keys from an approved HTTPS JWKS endpoint and selects the token's kid, supporting overlapping keys during rotation (#608).
• JWT routes can require group membership through jwt-allowed-groups and jwt-groups-claim, or route-policy allowedGroups and groupsClaim; verified tokens without a permitted group receive 403 (#610).
• JWT routes can serve OAuth protected-resource metadata from a ConfigMap and advertise it with Bearer challenges that distinguish missing and invalid tokens (#611).

Fixed

• An unavailable OTLP collector no longer blocks access logs or request metrics in the Vector sidecar (#622).
• JWT requests without a Bearer token log denied_by=jwt_missing separately from invalid tokens (#623).
• JWT audience validation accepts an exact member of a string-array aud claim and rejects non-string values (#609).
• Validation tests use the deployed resource names and selectors with nameOverride, fullnameOverride, and aliased chart dependencies (#618).