v0.2.0

[dhiaayachi]

What's Changed

• feat(ebpf): make BPF verifier-log level configurable, default off by @dhiaayachi in feat(ebpf): make BPF verifier-log level configurable, default off #196
• fix: correct deferred tag TCP seq for forward-scanned TLS records by @dhiaayachi in fix: correct deferred tag TCP seq for forward-scanned TLS records #145
• chore(tooling): scaffold go-tls offset fixture builder + fix gcm struct name for Go <1.24 by @dhiaayachi in chore(tooling): scaffold go-tls offset fixture builder + fix gcm struct name for Go <1.24 #197
• feat(ebpf): populate Go TLS offset table for 1.20–1.24 + table-driven tests (closes Support Go versions older than 1.25 for crypto/tls offsets #103) by @dhiaayachi in feat(ebpf): populate Go TLS offset table for 1.20–1.24 + table-driven tests (closes #103) #198
• chore: remove unused buf protobuf configuration by @dhiaayachi in chore: remove unused buf protobuf configuration #202
• test(e2e): two-phase wait + bump timeouts to reduce JS/cipher flakes by @dhiaayachi in test(e2e): two-phase wait + bump timeouts to reduce JS/cipher flakes #203
• ci: nightly multi-version Go workflow + auto-PR on new Go releases by @dhiaayachi in ci: nightly multi-version Go workflow + auto-PR on new Go releases #201
• chore(deps): bump schneegans/dynamic-badges-action from 1.7.0 to 1.8.0 by @dependabot[bot] in chore(deps): bump schneegans/dynamic-badges-action from 1.7.0 to 1.8.0 #200
• fix(tooling): add go.mod for offset discoverer so its Dockerfile builds by @dhiaayachi in fix(tooling): add go.mod for offset discoverer so its Dockerfile builds #207
• fix(demo-js): wait 10s before first TLS request to win uprobe-attach race by @dhiaayachi in fix(demo-js): wait 10s before first TLS request to win uprobe-attach race #206
• feat(cli): add kloak version subcommand (release tag + commit hash) by @dhiaayachi in feat(cli): add kloak version subcommand (release tag + commit hash) #205
• fix(ebpf): Go 1.20-1.23 PDBase off-by-8 — discover crypto/aes.gcmAsm not crypto/cipher.gcm by @dhiaayachi in fix(ebpf): Go 1.20-1.23 PDBase off-by-8 — discover crypto/aes.gcmAsm not crypto/cipher.gcm #208
• fix(ebpf): apply crypto/aes.gcmAsm fix to runtime DWARF detector too by @dhiaayachi in fix(ebpf): apply crypto/aes.gcmAsm fix to runtime DWARF detector too #209
• fix(ci): use LC_ALL=C sort for the comm diff in the new-version watcher by @dhiaayachi in fix(ci): use LC_ALL=C sort for the comm diff in the new-version watcher #210
• refactor: isolate eBPF data plane from k8s via a secrets.Source interface by @dhiaayachi in refactor: isolate eBPF data plane from k8s via a secrets.Source interface #211
• chore(deps): bump peter-evans/create-pull-request from 7 to 8 by @dependabot[bot] in chore(deps): bump peter-evans/create-pull-request from 7 to 8 #212
• chore(deps): bump golang.org/x/net from 0.53.0 to 0.54.0 by @dependabot[bot] in chore(deps): bump golang.org/x/net from 0.53.0 to 0.54.0 #215
• chore(deps): bump k8s.io/apimachinery from 0.35.3 to 0.36.1 by @dependabot[bot] in chore(deps): bump k8s.io/apimachinery from 0.35.3 to 0.36.1 #214
• fix(secrets): shadow Huffman tail-tuning bails on no-digit ULID tails by @dhiaayachi in fix(secrets): shadow Huffman tail-tuning bails on no-digit ULID tails #216
• chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.3 to 0.24.0 by @dependabot[bot] in chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.3 to 0.24.0 #199
• chore: gate pkg/ebpf Linux deps behind build tags so macOS unit tests compile by @dhiaayachi in chore: gate pkg/ebpf Linux deps behind build tags so macOS unit tests compile #217
• feat(webhook): rewrite secretKeyRef + envFrom references to shadow secrets (closes feat: support secretKeyRef env var rewriting in webhook #96) by @dhiaayachi in feat(webhook): rewrite secretKeyRef + envFrom references to shadow secrets (closes #96) #218
• feat(secrets): YAML source for kloak run + kloak secrets validate (Phase 2) by @dhiaayachi in feat(secrets): YAML source for kloak run + kloak secrets validate (Phase 2) #219
• feat(cgroups): CreateTransient — kloak.slice/ mkdir + idempotent cleanup (Phase 3a) by @dhiaayachi in feat(cgroups): CreateTransient — kloak.slice/<name> mkdir + idempotent cleanup (Phase 3a) #220
• fix(ebpf): per-binary wbio offset — OpenSSL 3.0/3.1 silently broke on hardcoded 88 by @dhiaayachi in fix(ebpf): per-binary wbio offset — OpenSSL 3.0/3.1 silently broke on hardcoded 88 #222
• fix(ebpf): //go:generate strips ${KLOAK_TARGET_ARCH:-arm64}, dead-stripping every uprobe's arch-specific code by @dhiaayachi in fix(ebpf): //go:generate strips ${KLOAK_TARGET_ARCH:-arm64}, dead-stripping every uprobe's arch-specific code #223
• feat(runtime): Runtime interface + host backend + klor binary (Phase 3b) by @dhiaayachi in feat(runtime): Runtime interface + host backend + klor binary (Phase 3b) #221
• feat(klor): rootless via install.sh setcap (no sudo per invocation) by @dhiaayachi in feat(klor): rootless via install.sh setcap (no sudo per invocation) #224
• bpf: document 8-byte alignment invariant in hosts_match() by @orbisai0security in bpf: document 8-byte alignment invariant in hosts_match() #226
• fix(secrets): bit-exact shadow generator closes HTTP/2 HPACK padding bug by @dhiaayachi in fix(secrets): bit-exact shadow generator closes HTTP/2 HPACK padding bug #233
• fix(ebpf): recursive lib scan + auto-detect tc egress interface by @dhiaayachi in fix(ebpf): recursive lib scan + auto-detect tc egress interface #235
• chore(deps): bump k8s.io/api from 0.36.0 to 0.36.1 by @dependabot[bot] in chore(deps): bump k8s.io/api from 0.36.0 to 0.36.1 #230
• chore(deps): bump k8s.io/client-go from 0.36.0 to 0.36.1 by @dependabot[bot] in chore(deps): bump k8s.io/client-go from 0.36.0 to 0.36.1 #231
• chore(deps): bump sigs.k8s.io/controller-runtime from 0.24.0 to 0.24.1 by @dependabot[bot] in chore(deps): bump sigs.k8s.io/controller-runtime from 0.24.0 to 0.24.1 #232
• fix(ebpf): guard TLSUprobeManager.links with a mutex by @dhiaayachi in fix(ebpf): guard TLSUprobeManager.links with a mutex #237
• fix(ebpf): prevent tc-egress double-attach on partial failure by @dhiaayachi in fix(ebpf): prevent tc-egress double-attach on partial failure #238
• fix(ebpf): close TOCTOU race in tc-egress netns dedup by @dhiaayachi in fix(ebpf): close TOCTOU race in tc-egress netns dedup #239
• fix(ebpf): bind PollExecEvents retry goroutines to lifecycle by @dhiaayachi in fix(ebpf): bind PollExecEvents retry goroutines to lifecycle #240
• fix(ebpf): retire OS thread on netns restore failure by @dhiaayachi in fix(ebpf): retire OS thread on netns restore failure #241
• chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by @dependabot[bot] in chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 #242
• feat(openssl): close discovery loop — drift detection, CI test, results dir (PR 1 of feat(openssl): apply Go-style multi-version coverage (drift detection, multi-version e2e, auto-PR for new releases) #204) by @dhiaayachi in feat(openssl): close discovery loop — drift detection, CI test, results dir (PR 1 of #204) #244
• chore(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by @dependabot[bot] in chore(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 #246
• feat(openssl): templated demo Dockerfile, nightly multi-version e2e, auto-PR (PR 2 of feat(openssl): apply Go-style multi-version coverage (drift detection, multi-version e2e, auto-PR for new releases) #204) by @dhiaayachi in feat(openssl): templated demo Dockerfile, nightly multi-version e2e, auto-PR (PR 2 of #204) #245
• chore(deps): bump k8s.io/client-go from 0.36.1 to 0.36.2 by @dependabot[bot] in chore(deps): bump k8s.io/client-go from 0.36.1 to 0.36.2 #247
• chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by @dependabot[bot] in chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 #248
• ci(nightly): fix auto-PR push and capture e2e pod failure cause by @dhiaayachi in ci(nightly): fix auto-PR push and capture e2e pod failure cause #251
• ci(nightly): keep auto-version PRs clean (no scratch files, descending table) by @dhiaayachi in ci(nightly): keep auto-version PRs clean (no scratch files, descending table) #254
• fix(demo-raw-tls): pin base to bookworm so older OpenSSL loads (fixes nightly e2e) by @dhiaayachi in fix(demo-raw-tls): pin base to bookworm so older OpenSSL loads (fixes nightly e2e) #252
• chore(openssl): add offset support for OpenSSL 3.6.3,4.0.1 by @dhiaayachi in chore(openssl): add offset support for OpenSSL 3.6.3,4.0.1 #255
• fix(e2e): fresh connection per request to de-flake rewrite tests (R2) by @dhiaayachi in fix(e2e): fresh connection per request to de-flake rewrite tests (R2) #256
• chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in chore(deps): bump actions/checkout from 6 to 7 #257
• ci(nightly): skip e2e for OpenSSL 4.x (SONAME-incompatible with demo base) by @dhiaayachi in ci(nightly): skip e2e for OpenSSL 4.x (SONAME-incompatible with demo base) #258
• chore: remove the klor host-CLI experiment by @dhiaayachi in chore: remove the klor host-CLI experiment #259
• fix(ebpf): live-H fallback in bpf_h_extract closes OpenSSL cold-start race by @dhiaayachi in fix(ebpf): live-H fallback in bpf_h_extract closes OpenSSL cold-start race #262
• feat(boringssl): offset discovery + AES-based H recovery (Claude Code CLI with CLAUDE_CODE_OAUTH_TOKEN does not work #229) by @dhiaayachi in feat(boringssl): offset discovery + AES-based H recovery (#229) #261
• chore(boringssl): track offsets for 0.20260526.0 by @dhiaayachi in chore(boringssl): track offsets for 0.20260526.0 #263
• feat(bun): TLS interception for Bun single-executables via file-offset uprobe by @dhiaayachi in feat(bun): TLS interception for Bun single-executables via file-offset uprobe #264
• chore(bun): track offsets for bun-v1.3.12,1.3.13 by @dhiaayachi in chore(bun): track offsets for bun-v1.3.12,1.3.13 #265
• chore(deps): bump github.com/cilium/ebpf from 0.20.0 to 0.22.0 by @dependabot[bot] in chore(deps): bump github.com/cilium/ebpf from 0.20.0 to 0.22.0 #267
• chore(deps): bump alpine from 3.23 to 3.24 by @dependabot[bot] in chore(deps): bump alpine from 3.23 to 3.24 #268
• fix(controller): regenerate shadow on same-length, different-Huffman secret rotation (bug: same-length secret rotation silently breaks HTTP/2 rewrite (placeholder leaks / stream reset) #269) by @dhiaayachi in fix(controller): regenerate shadow on same-length, different-Huffman secret rotation (#269) #272
• docs: getkloak.io/hosts is single-value, not comma-separated (docs: CLAUDE.md advertises comma-separated getkloak.io/hosts, which is not supported #271) by @dhiaayachi in docs: getkloak.io/hosts is single-value, not comma-separated (#271) #273
• test(e2e): remove httpbin.org dependency from the Go e2e path by @dhiaayachi in test(e2e): remove httpbin.org dependency from the Go e2e path #274
• chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 by @dependabot[bot] in chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 #277
• chore(deps): bump schneegans/dynamic-badges-action from 1.8.0 to 1.9.0 by @dependabot[bot] in chore(deps): bump schneegans/dynamic-badges-action from 1.8.0 to 1.9.0 #278
• chore(deps): bump fgrosse/go-coverage-report from 1.3.0 to 1.3.1 by @dependabot[bot] in chore(deps): bump fgrosse/go-coverage-report from 1.3.0 to 1.3.1 #280
• chore(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in chore(deps): bump actions/setup-go from 6 to 7 #281
• fix(ebpf): move tls_conn_state off the tcp_sendmsg kprobe stack by @dhiaayachi in fix(ebpf): move tls_conn_state off the tcp_sendmsg kprobe stack #285
• fix(ebpf): attach tc patch on host-side veth ingress by @dhiaayachi in fix(ebpf): attach tc patch on host-side veth ingress #287
• fix(ci): use AUTOMATION_PAT for go-versions-nightly auto-PR by @dhiaayachi in fix(ci): use AUTOMATION_PAT for go-versions-nightly auto-PR #289
• chore(deps): bump k8s.io/client-go from 0.36.2 to 0.36.4 by @dependabot[bot] in chore(deps): bump k8s.io/client-go from 0.36.2 to 0.36.4 #293
• fix(bun-offsets): fix discover.sh binary selection and SIGPIPE by @dhiaayachi in fix(bun-offsets): fix discover.sh binary selection and SIGPIPE #294
• fix(boringssl-offsets): resolve SSLImpl/Bio struct names post 0.20260803.0 refactor by @dhiaayachi in fix(boringssl-offsets): resolve SSLImpl/Bio struct names post 0.20260803.0 refactor #297
• chore(go): add offset support for Go 1.27 by @dhiaayachi in chore(go): add offset support for Go 1.27 #290
• chore(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 by @dependabot[bot] in chore(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 #288
• chore(deps): bump golang from 1.26 to 1.27 by @dependabot[bot] in chore(deps): bump golang from 1.26 to 1.27 #299
• chore(bun): track offsets for bun-v1.4.0 by @dhiaayachi in chore(bun): track offsets for bun-v1.4.0 #298
• chore(bun): track offsets for bun-v1.4.1 by @dhiaayachi in chore(bun): track offsets for bun-v1.4.1 #302
• chore(boringssl): track offsets for 0.20260903.0,0.20260929.0 by @dhiaayachi in chore(boringssl): track offsets for 0.20260903.0,0.20260929.0 #312
• chore(deps): bump k8s.io/client-go from 0.36.4 to 0.37.1 by @dependabot[bot] in chore(deps): bump k8s.io/client-go from 0.36.4 to 0.37.1 #311
• chore(deps): bump fgrosse/go-coverage-report from 1.3.1 to 1.4.0 by @dependabot[bot] in chore(deps): bump fgrosse/go-coverage-report from 1.3.1 to 1.4.0 #309
• chore(boringssl): track offsets for 0.20260813.0,0.20260903.0 by @dhiaayachi in chore(boringssl): track offsets for 0.20260813.0,0.20260903.0 #308
• chore(deps): bump sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.2 by @dependabot[bot] in chore(deps): bump sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.2 #307
• chore(deps): bump golang.org/x/net from 0.58.0 to 0.59.0 by @dependabot[bot] in chore(deps): bump golang.org/x/net from 0.58.0 to 0.59.0 #306
• chore(bun): track offsets for bun-v1.4.1,1.4.2 by @dhiaayachi in chore(bun): track offsets for bun-v1.4.1,1.4.2 #303
• fix(ebpf): recover OpenSSL GCM H from the AVX-512 HashKey_1 slot (OpenSSL AES-GCM rewrite silently skipped when H field reads zero (nightly flake + data-plane gap) #275) by @dhiaayachi in fix(ebpf): recover OpenSSL GCM H from the AVX-512 HashKey_1 slot (#275) #313
• docs(chart): point install instructions at chart.getkloak.io by @dhiaayachi in docs(chart): point install instructions at chart.getkloak.io #314
• feat(ebpf): fall back to clsact tc attachment on kernels without TCX by @dhiaayachi in feat(ebpf): fall back to clsact tc attachment on kernels without TCX #316
• fix(ebpf): patch app data coalesced behind CCS/Finished in tc egress by @dhiaayachi in fix(ebpf): patch app data coalesced behind CCS/Finished in tc egress #317
• fix(chart): set demo getkloak.io/hosts as an annotation by @dhiaayachi in fix(chart): set demo getkloak.io/hosts as an annotation #315
• docs: describe the ciphertext-only data plane accurately (README + CLAUDE.md) by @dhiaayachi in docs: describe the ciphertext-only data plane accurately (README + CLAUDE.md) #318
• fix(ebpf): bind secrets to the pods that reference them by @dhiaayachi in fix(ebpf): bind secrets to the pods that reference them #320
• chore(deps): bump fgrosse/go-coverage-report from 1.4.0 to 1.5.0 by @dependabot[bot] in chore(deps): bump fgrosse/go-coverage-report from 1.4.0 to 1.5.0 #319

New Contributors

• @orbisai0security made their first contribution in bpf: document 8-byte alignment invariant in hosts_match() #226

Full Changelog: v0.1.2...v0.2.0

---

This discussion was created from the release v0.2.0.