Skip to content

v0.5.0-alpha.2

Pre-release
Pre-release

Choose a tag to compare

View all tags
@huang195 huang195 released this 16 Apr 11:42
v0.5.0-alpha.2
0fb899f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Unified AuthBridge Binary

This release introduces the unified authbridge binary — a single Go binary that replaces three separate codebases (go-processor, waypoint, klaviger) with one codebase supporting multiple deployment modes.

Highlights

  • Single binary, four modes: envoy-sidecar (ext_proc), waypoint (ext_authz), proxy-sidecar (forward/reverse HTTP proxy)
  • authlib/ shared library: Reusable packages for JWT validation, token exchange (RFC 8693), SPIFFE identity, token caching, path bypass, and host-based routing
  • Composition layer (authlib/auth/, authlib/config/): YAML-driven config with ${ENV_VAR} expansion, mode presets, and startup validation
  • Combined container image: Envoy + authbridge in a single container (authbridge-unified), drop-in replacement for envoy-with-processor

Changes since v0.4.0-alpha.13

Features

  • authlib/ — shared token exchange building blocks (Phase 1)
  • auth/ and config/ — composition layer and mode presets (Phase 2)
  • Listeners and single binary — four modes, one codebase (Phase 3)
  • CI/build for unified authbridge, deprecate old components (Phase 4)

Bug Fixes

  • Fix Envoy image SHA pin pulling wrong architecture (ARM64 digest on AMD64 builds)
  • Fix actor cache TTL reset, t.Fatal in httptest handlers, JWKS URL derivation
  • Enforce audience in JWT validation, return generic errors to clients
  • Fix client_credentials audience and waypoint audience derivation
  • Supervise background processes in AuthBridge entrypoints

Documentation

  • Unified authbridge documentation and deprecation notices
  • Updated demo guides for combined AuthBridge sidecar

Container Images

All images published to ghcr.io/kagenti/kagenti-extensions/:

Image Description
authbridge-unified:v0.5.0-alpha.2 New — Envoy + authbridge unified binary
authbridge:v0.5.0-alpha.2 Combined sidecar (Envoy + go-processor + spiffe-helper + client-registration)
auth-proxy:v0.5.0-alpha.2 Go ext_proc processor (legacy)
envoy-with-processor:v0.5.0-alpha.2 Envoy + go-processor (legacy, use authbridge-unified instead)
proxy-init:v0.5.0-alpha.2 iptables init container
spiffe-helper:v0.5.0-alpha.2 SPIFFE credential fetcher
client-registration:v0.5.0-alpha.2 Keycloak client registration
Assets 2
Loading