What's Changed
New
- ingress-controller/routes: add support for the upstream tunnel option by @calebdoxsey in #1343
- ingress-controller/config: add support for allow_upgrades by @calebdoxsey in #1374
- add ingress annotation for native ssh by @kenjenkins in #1413
- feat(session_recording): configure dyn ext from pomerium ingress CR by @backport-actions-token[bot] in #1469
- add support for syncing via unified API by @kenjenkins in #1342
Fixes
- ingress-controller/gateway: fix missing source ppl by @calebdoxsey in #1323
- fix(deployment): incorrect containerPort for QUIC by @weisdd in #1372
- fix standalone mode health checks by @kenjenkins in #1380
- fix: resolve all-in-one otel Schema URL startup panic by @backport-actions-token[bot] in #1470
Changed
- translate Ingress to unified API Policy entity by @kenjenkins in #1344
- feat(mcp): expose mcp_allowed_as_metadata_domains, authorization_server_url, and oauth2_auth_style by @nickytonline in #1353
- ingress/config: update clustered-databroker config to use all-in-one with a statefulset by @calebdoxsey in #1355
- model: add logic for tracking secret dependencies by @kenjenkins in #1357
- sync generated mock code by @kenjenkins in #1362
- ingress-controller: fix protobuf conflict by @calebdoxsey in #1382
- api sync: recover from a failed metadata update by @kenjenkins in #1384
- deps: upgrade pomerium core to pick up MCP PRM port-normalization fix by @wasaga in #1390
- add support for k8s leader election by @kenjenkins in #1386
- rework settings sync to apply Core defaults by @kenjenkins in #1391
- ingress-controller/config: add certificate auto provision setting by @calebdoxsey in #1402
- ingress-controller: add new certificate name index by @calebdoxsey in #1403
- ingress-controller: add certificate matcher by @calebdoxsey in #1404
- ingress-controller/config: remove quic port, add configs for eks and gke by @calebdoxsey in #1401
- ingress-controller: extract certificate and route names from config by @calebdoxsey in #1405
- ingress-controller: add certificate controller by @calebdoxsey in #1407
- ingress-controller: add enable_google_cloud_serverless_authentication annotation by @wasaga in #1416
- support hosted authenticate OIDC mode by @kenjenkins in #1414
- Makefile: rerun npm ci when node_modules is missing by @wasaga in #1417
- clustered-databroker: production-hardening defaults by @wasaga in #1422
- update core by @kralicky in #1425
- ingress-controller: add more docs for the certificate auto provisioning by @calebdoxsey in #1418
- crd: identityProvider <-> authenticate constraints by @kenjenkins in #1423
- ingress-controller: delay starting the certificate controller until all required CRDs exist by @calebdoxsey in #1424
- Allowing to have 2 pomerium ICs in a same cluster by @wasaga in #1388
- update core by @kralicky in #1429
- Update config initialization to use config.New by @kralicky in #1430
- ingress-controller: update sdk by @calebdoxsey in #1432
- bump pomerium/pomerium by @wasaga in #1440
- cmd: --debug-pomerium raises only core log level, not envoy by @wasaga in #1441
- sync: query filter should use snake_case by @kenjenkins in #1442
- sync: do not clobber bootstrap settings by @kenjenkins in #1447
- sync: fix missing policy annotations by @kenjenkins in #1446
- Add CRD-less kustomize variants + CRD sync to install by @wasaga in #1444
- sync: add bootstrap ingress support by @kenjenkins in #1449
- sync: handle route failed_precondition error by @kenjenkins in #1452
- sync: add --sync-api-namespace-id option by @kenjenkins in #1454
- feat: add --version subcommand by @backport-actions-token[bot] in #1467
Dependency Updates
- build(deps): bump sigs.k8s.io/controller-runtime from 0.22.4 to 0.23.1 in the k8s group by @dependabot[bot] in #1315
- build(deps): bump the github-actions group with 5 updates by @dependabot[bot] in #1316
- build(deps): bump the go group with 2 updates by @dependabot[bot] in #1314
- build(deps): bump distroless/base-debian12 from
d26c2eetoaa786eain the docker group by @dependabot[bot] in #1313 - build(deps): bump the go group with 4 updates by @dependabot[bot] in #1335
- build(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #1336
- build(deps): bump distroless/base-debian12 from
aa786eato8ad5380in the docker group by @dependabot[bot] in #1334 - build(deps): bump the k8s group with 6 updates by @dependabot[bot] in #1337
- build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 by @dependabot[bot] in #1349
- build(deps): bump github.com/modelcontextprotocol/go-sdk from 1.4.0 to 1.4.1 by @dependabot[bot] in #1351
- build(deps): bump the github-actions group with 6 updates by @dependabot[bot] in #1360
- build(deps): bump the k8s group with 7 updates by @dependabot[bot] in #1361
- build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 by @dependabot[bot] in #1363
- build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #1364
- build(deps): bump the go group across 1 directory with 5 updates by @dependabot[bot] in #1359
- build(deps): bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 by @dependabot[bot] in #1367
- build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 by @dependabot[bot] in #1366
- build(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 by @dependabot[bot] in #1387
- build(deps): bump the k8s group with 6 updates by @dependabot[bot] in #1396
- build(deps): bump the github-actions group with 4 updates by @dependabot[bot] in #1397
- build(deps): bump distroless/base-debian12 from
8ad5380toe196d04in the docker group by @dependabot[bot] in #1394 - build(deps): bump the go group across 1 directory with 6 updates by @dependabot[bot] in #1398
- build(deps): bump the go group with 3 updates by @dependabot[bot] in #1436
- build(deps): bump the github-actions group with 6 updates by @dependabot[bot] in #1438
- build(deps): bump the k8s group with 6 updates by @dependabot[bot] in #1437
- build(deps): bump distroless/base-debian12 from
e196d04to63c73a9in the docker group by @dependabot[bot] in #1435 - build(deps): bump distroless/base-debian12 from
63c73a9toddd86b7in the docker group by @dependabot[bot] in #1456 - build(deps): bump the github-actions group with 5 updates by @dependabot[bot] in #1458
- build(deps): bump the go group across 1 directory with 2 updates by @dependabot[bot] in #1460
- build(deps): bump the k8s group across 1 directory with 6 updates by @dependabot[bot] in #1459
- bump pomerium/pomerium by @kralicky in #1420
- ci: update Go toolchain to 1.26.5 by @desimone in #1471
- ci: upgrade to Go 1.26.0 by @wasaga in #1326
New Contributors
- @nickytonline made their first contribution in #1353
- @weisdd made their first contribution in #1372
Full Changelog: v0.32.0...v0.33.0