Major new features

HashiCorp Vault / OpenBao secret backends - #2185

Support for fetching passwords and private keys from a Vault-compatible backend without storing them in the database.

Backends are configured under Config → Secret backends.

RDP now negotiates the Graphics Pipeline extension with RemoteFX Progressive and ClearCodec. Adds support for GNOME Remote Desktop and KRDP.

Upload your own logo under Config → Parameters

Cluster peers are authenticated via mTLS instead of a static cluster token in #2698
fixed #2695 - fuzzy search in the target list in #2714
Web SSH and desktop clients now show connection progress state (waiting for approval, connecting, connected) in #2684
Large target lists in the gateway UI are now virtualized (#2642) in #2650
fixed #2633 - the S3 recordings scratch directory is configurable (scratch_path) by @mathieuHa in #2634
Helm: overrides_config is rendered through tpl, so it can reference other chart values by @vitaly-sinev in #2673

Target credentials are now redacted in the admin API responses for admins without the Targets Edit permission in #2685
The session cookie is now always marked Secure by @mtthsbrd in #2675
Added X-Content-Type-Options: nosniff, Referrer-Policy: same-origin and X-Frame-Options: SAMEORIGIN headers by @mtthsbrd in #2676
X-Forwarded-For / -Host / -Proto now use the last value and ignore invalid values in 1d41778

fixed #2658 - SSH port forwarding for RDP with ssh -N was dropped immediately because the forwarded data was mistaken for Ctrl-C by @megative in #2679
HTTP: query parameters are forwarded to the target verbatim; since 0.27.0 they were re-encoded, breaking upstreams that put opaque data (e.g. bare base64) in the query by @Mac898 in #2704
fixed #2702 - web approvals satisfied by the grace period no longer show up as pending in the admin UI in #2719
fixed #2627 - Kubernetes: upstream API clients are reused across requests instead of opening a new connection and TLS handshake for every proxied request by @sthalbert in #2628
Kubernetes: requests are resent when the upstream TCP connect or TLS handshake fails, instead of returning a 500 to kubectl in #2718
Kubernetes: closing a session (admin close, user deletion) now actually ends its in-flight exec/attach/port-forward and watch/log streams in #2720
SSH public keys added through the user profile had their comment stored, which made login with that key fail by @fergusean in #2666
Recordings were marked complete before all of their streams had finished uploading (S3) in #2652
Adding a TOTP credential through the admin API now updates the user's credential policy to require it, as the UI already did in f8590e2

Full Changelog: v0.29.1...v0.30.0-beta.1