v0.2.0

What's Changed

• feat(ebpf): make BPF verifier-log level configurable, default off by @dhiaayachi in #196
• fix: correct deferred tag TCP seq for forward-scanned TLS records by @dhiaayachi in #145
• chore(tooling): scaffold go-tls offset fixture builder + fix gcm struct name for Go <1.24 by @dhiaayachi in #197
• feat(ebpf): populate Go TLS offset table for 1.20–1.24 + table-driven tests (closes #103) by @dhiaayachi in #198
• chore: remove unused buf protobuf configuration by @dhiaayachi in #202
• test(e2e): two-phase wait + bump timeouts to reduce JS/cipher flakes by @dhiaayachi in #203
• ci: nightly multi-version Go workflow + auto-PR on new Go releases by @dhiaayachi in #201
• chore(deps): bump schneegans/dynamic-badges-action from 1.7.0 to 1.8.0 by @dependabot[bot] in #200
• fix(tooling): add go.mod for offset discoverer so its Dockerfile builds by @dhiaayachi in #207
• fix(demo-js): wait 10s before first TLS request to win uprobe-attach race by @dhiaayachi in #206
• feat(cli): add kloak version subcommand (release tag + commit hash) by @dhiaayachi in #205
• fix(ebpf): Go 1.20-1.23 PDBase off-by-8 — discover crypto/aes.gcmAsm not crypto/cipher.gcm by @dhiaayachi in #208
• fix(ebpf): apply crypto/aes.gcmAsm fix to runtime DWARF detector too by @dhiaayachi in #209
• fix(ci): use LC_ALL=C sort for the comm diff in the new-version watcher by @dhiaayachi in #210
• refactor: isolate eBPF data plane from k8s via a secrets.Source interface by @dhiaayachi in #211
• chore(deps): bump peter-evans/create-pull-request from 7 to 8 by @dependabot[bot] in #212
• chore(deps): bump golang.org/x/net from 0.53.0 to 0.54.0 by @dependabot[bot] in #215
• chore(deps): bump k8s.io/apimachinery from 0.35.3 to 0.36.1 by @dependabot[bot] in #214
• fix(secrets): shadow Huffman tail-tuning bails on no-digit ULID tails by @dhiaayachi in #216
• chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.3 to 0.24.0 by @dependabot[bot] in #199
• chore: gate pkg/ebpf Linux deps behind build tags so macOS unit tests compile by @dhiaayachi in #217
• feat(webhook): rewrite secretKeyRef + envFrom references to shadow secrets (closes #96) by @dhiaayachi in #218
• feat(secrets): YAML source for kloak run + kloak secrets validate (Phase 2) by @dhiaayachi in #219
• feat(cgroups): CreateTransient — kloak.slice/ mkdir + idempotent cleanup (Phase 3a) by @dhiaayachi in #220
• fix(ebpf): per-binary wbio offset — OpenSSL 3.0/3.1 silently broke on hardcoded 88 by @dhiaayachi in #222
• fix(ebpf): //go:generate strips ${KLOAK_TARGET_ARCH:-arm64}, dead-stripping every uprobe's arch-specific code by @dhiaayachi in #223
• feat(runtime): Runtime interface + host backend + klor binary (Phase 3b) by @dhiaayachi in #221
• feat(klor): rootless via install.sh setcap (no sudo per invocation) by @dhiaayachi in #224
• bpf: document 8-byte alignment invariant in hosts_match() by @orbisai0security in #226
• fix(secrets): bit-exact shadow generator closes HTTP/2 HPACK padding bug by @dhiaayachi in #233
• fix(ebpf): recursive lib scan + auto-detect tc egress interface by @dhiaayachi in #235
• chore(deps): bump k8s.io/api from 0.36.0 to 0.36.1 by @dependabot[bot] in #230
• chore(deps): bump k8s.io/client-go from 0.36.0 to 0.36.1 by @dependabot[bot] in #231
• chore(deps): bump sigs.k8s.io/controller-runtime from 0.24.0 to 0.24.1 by @dependabot[bot] in #232
• fix(ebpf): guard TLSUprobeManager.links with a mutex by @dhiaayachi in #237
• fix(ebpf): prevent tc-egress double-attach on partial failure by @dhiaayachi in #238
• fix(ebpf): close TOCTOU race in tc-egress netns dedup by @dhiaayachi in #239
• fix(ebpf): bind PollExecEvents retry goroutines to lifecycle by @dhiaayachi in #240
• fix(ebpf): retire OS thread on netns restore failure by @dhiaayachi in #241
• chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by @dependabot[bot] in #242
• feat(openssl): close discovery loop — drift detection, CI test, results dir (PR 1 of #204) by @dhiaayachi in #244
• chore(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by @dependabot[bot] in #246
• feat(openssl): templated demo Dockerfile, nightly multi-version e2e, auto-PR (PR 2 of #204) by @dhiaayachi in #245
• chore(deps): bump k8s.io/client-go from 0.36.1 to 0.36.2 by @dependabot[bot] in #247
• chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 by @dependabot[bot] in #248
• ci(nightly): fix auto-PR push and capture e2e pod failure cause by @dhiaayachi in #251
• ci(nightly): keep auto-version PRs clean (no scratch files, descending table) by @dhiaayachi in #254
• fix(demo-raw-tls): pin base to bookworm so older OpenSSL loads (fixes nightly e2e) by @dhiaayachi in #252
• chore(openssl): add offset support for OpenSSL 3.6.3,4.0.1 by @dhiaayachi in #255
• fix(e2e): fresh connection per request to de-flake rewrite tests (R2) by @dhiaayachi in #256
• chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #257
• ci(nightly): skip e2e for OpenSSL 4.x (SONAME-incompatible with demo base) by @dhiaayachi in #258
• chore: remove the klor host-CLI experiment by @dhiaayachi in #259
• fix(ebpf): live-H fallback in bpf_h_extract closes OpenSSL cold-start race by @dhiaayachi in #262
• feat(boringssl): offset discovery + AES-based H recovery (#229) by @dhiaayachi in #261
• chore(boringssl): track offsets for 0.20260526.0 by @dhiaayachi in #263
• feat(bun): TLS interception for Bun single-executables via file-offset uprobe by @dhiaayachi in #264
• chore(bun): track offsets for bun-v1.3.12,1.3.13 by @dhiaayachi in #265
• chore(deps): bump github.com/cilium/ebpf from 0.20.0 to 0.22.0 by @dependabot[bot] in #267
• chore(deps): bump alpine from 3.23 to 3.24 by @dependabot[bot] in #268
• fix(controller): regenerate shadow on same-length, different-Huffman secret rotation (#269) by @dhiaayachi in #272
• docs: getkloak.io/hosts is single-value, not comma-separated (#271) by @dhiaayachi in #273
• test(e2e): remove httpbin.org dependency from the Go e2e path by @dhiaayachi in #274
• chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 by @dependabot[bot] in #277
• chore(deps): bump schneegans/dynamic-badges-action from 1.8.0 to 1.9.0 by @dependabot[bot] in #278
• chore(deps): bump fgrosse/go-coverage-report from 1.3.0 to 1.3.1 by @dependabot[bot] in #280
• chore(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #281
• fix(ebpf): move tls_conn_state off the tcp_sendmsg kprobe stack by @dhiaayachi in #285
• fix(ebpf): attach tc patch on host-side veth ingress by @dhiaayachi in #287
• fix(ci): use AUTOMATION_PAT for go-versions-nightly auto-PR by @dhiaayachi in #289
• chore(deps): bump k8s.io/client-go from 0.36.2 to 0.36.4 by @dependabot[bot] in #293
• fix(bun-offsets): fix discover.sh binary selection and SIGPIPE by @dhiaayachi in #294
• fix(boringssl-offsets): resolve SSLImpl/Bio struct names post 0.20260803.0 refactor by @dhiaayachi in #297
• chore(go): add offset support for Go 1.27 by @dhiaayachi in #290
• chore(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 by @dependabot[bot] in #288
• chore(deps): bump golang from 1.26 to 1.27 by @dependabot[bot] in #299
• chore(bun): track offsets for bun-v1.4.0 by @dhiaayachi in #298
• chore(bun): track offsets for bun-v1.4.1 by @dhiaayachi in #302
• chore(boringssl): track offsets for 0.20260903.0,0.20260929.0 by @dhiaayachi in #312
• chore(deps): bump k8s.io/client-go from 0.36.4 to 0.37.1 by @dependabot[bot] in #311
• chore(deps): bump fgrosse/go-coverage-report from 1.3.1 to 1.4.0 by @dependabot[bot] in #309
• chore(boringssl): track offsets for 0.20260813.0,0.20260903.0 by @dhiaayachi in #308
• chore(deps): bump sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.2 by @dependabot[bot] in #307
• chore(deps): bump golang.org/x/net from 0.58.0 to 0.59.0 by @dependabot[bot] in #306
• chore(bun): track offsets for bun-v1.4.1,1.4.2 by @dhiaayachi in #303
• fix(ebpf): recover OpenSSL GCM H from the AVX-512 HashKey_1 slot (#275) by @dhiaayachi in #313
• docs(chart): point install instructions at chart.getkloak.io by @dhiaayachi in #314
• feat(ebpf): fall back to clsact tc attachment on kernels without TCX by @dhiaayachi in #316
• fix(ebpf): patch app data coalesced behind CCS/Finished in tc egress by @dhiaayachi in #317
• fix(chart): set demo getkloak.io/hosts as an annotation by @dhiaayachi in #315
• docs: describe the ciphertext-only data plane accurately (README + CLAUDE.md) by @dhiaayachi in #318
• fix(ebpf): bind secrets to the pods that reference them by @dhiaayachi in #320
• chore(deps): bump fgrosse/go-coverage-report from 1.4.0 to 1.5.0 by @dependabot[bot] in #319

New Contributors

• @orbisai0security made their first contribution in #226

Full Changelog: v0.1.2...v0.2.0