BREAKING: Licensing change for official Pomerium builds
Starting with v0.34, official Pomerium binaries and container images use the Pomerium Community Edition License. Source code remains licensed under Apache 2.0.
Review the licensing announcement for eligibility and commercial licensing requirements before upgrading.
What's Changed
Breaking
- remove generated deployment.yaml in favor of
kubectl apply -kby @wasaga in #1501 — install withkubectl apply -k github.com/pomerium/ingress-controller/config/default?ref=v0.34.0instead of applyingdeployment.yaml
New
- ingress: bearer_token_format jwt and identity_providers by @wasaga in #1522
- ingress: add h2c_upstream annotation by @wasaga in #1516
- add request normalization options to Pomerium CRD by @kenjenkins in #1497
- feat(session_recording): configure dyn ext from pomerium ingress CR by @alexandreLamarre in #1468
- feat: add --version subcommand by @alexandreLamarre in #1463
- all-in-one: add hidden --debug-port flag to pin the debug listener port by @wasaga in #1462
Fixes
- sync: make sure to apply namespace ID to settings by @kenjenkins in #1494
- sync: do not reuse previous IDs by @kenjenkins in #1503
- avoid settings reconcile after status update by @kenjenkins in #1502
- fix: resolve all-in-one otel Schema URL startup panic by @wasaga in #1466
Changed
Licensing and builds
- chore: set offical build flags, add license by @calebdoxsey in #1561
- log version and governing license on startup by @wasaga in #1562
- license: fix apache url by @wasaga in #1563
- build: move runtime images to Debian 13 by @desimone in #1547
- docker: use distroless base-nossl image by @wasaga in #1484
Internal
Docs
- docs: standardize PROXY protocol capitalization by @desimone in #1464
- docs: update template and PR script by @kenjenkins in #1488
CI
- ci: repair the workflow linter's own trigger, bump action-validator to 0.9.0 by @wasaga in #1519
- chore(ci): move from pomerium/ingress-controller to gcp by @calebdoxsey in #1526
- ci: use GitHub App tokens instead of a personal access token by @desimone in #1534
- ci: keep dependency pins readable by @desimone in #1548
- fix(ci): various build fixes by @calebdoxsey in #1566
Dependency Updates
- build(deps): bump the k8s group with 6 updates by @dependabot[bot] in #1492
- build(deps): bump the github-actions group with 7 updates by @dependabot[bot] in #1493
- build(deps): bump the go group across 1 directory with 4 updates by @dependabot[bot] in #1505
- build(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 in the github-actions group by @dependabot[bot] in #1510
- build(deps): bump distroless/base-nossl-debian12 from
32d0efdto83b8737in the docker group by @dependabot[bot] in #1509 - build(deps): bump the k8s group across 1 directory with 4 updates by @dependabot[bot] in #1512
- build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #1529
- build(deps): bump the go group with 3 updates by @dependabot[bot] in #1527
- build(deps): bump the k8s group with 7 updates by @dependabot[bot] in #1528
- build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 by @dependabot[bot] in #1549
- build(deps): bump github.com/go-chi/chi/v5 from 5.3.2 to 5.4.0 by @dependabot[bot] in #1540
- build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #1560
- build(deps): bump the k8s group with 7 updates by @dependabot[bot] in #1559
- build(deps): bump the go group with 3 updates by @dependabot[bot] in #1558
- build(deps): bump distroless/base-nossl-debian13 from
68f210bto37b8b2din the docker group across 1 directory by @dependabot[bot] in #1557
Full Changelog: v0.33.6...v0.34.0