v0.6.0-alpha.12

What's Changed

• docs: Simplify ibac demo — drop redundant authbridge rebuild step by @huang195 in #433
• feat(authbridge): Allow empty pipeline plugin lists by @huang195 in #438
• feat(authbridge): Add envoy-sidecar mTLS demo by @huang195 in #440
• fix(mtls-demo): Patch namespace CM + align permissive across modes by @huang195 in #441
• fix(ibac): Guard nil Session and bypass MCP housekeeping by @kellyaa in #443
• feat(abctl): Add built-in Namespaces → Pods picker with auto port-forward by @huang195 in #445
• fix(ibac): Self-heal make demo-ibac on stale local images by @huang195 in #444
• feat(abctl): Picker polish and post-#445 cleanup by @huang195 in #446
• feat(abctl): Surface plugin runtime config in plugin-detail pane by @huang195 in #447
• feat(abctl): In-place pipeline editor with hot-reload by @huang195 in #448
• feat: Plugin catalog + abctl visibility & validation by @huang195 in #449
• fix(ibac): Bypass transport-layer calls and let agents take self-actions by @huang195 in #450
• fix(ibac): Bypass MCP session-terminate DELETE as transport_stream by @huang195 in #451
• refactor(plugins): Push protocol classification down to parsers by @huang195 in #452
• broker plugin: Adding logs by @davidhadas in #454
• import tokenbroker by @davidhadas in #460
• Feat: Inline plugin-config templates in abctl edit by @huang195 in #461
• fix(ibac): Raise judge token cap and request JSON mode by @kellyaa in #462
• refactor(authbridge): simplify PluginCapabilities — remove unused fields by @huang195 in #463
• chore(deps): Bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #437
• chore(deps): Bump docker/build-push-action from 7.1.0 to 7.2.0 by @dependabot[bot] in #436
• chore(deps): Bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #435
• chore(deps): Bump github/codeql-action from 4.35.3 to 4.36.0 by @dependabot[bot] in #434
• build(deps): Bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in #402
• chore(deps): Bump github.com/charmbracelet/x/ansi from 0.11.6 to 0.11.7 in /authbridge/cmd/abctl by @dependabot[bot] in #415
• feat(authbridge): credential placeholder swap (hide real tokens from the agent) by @huang195 in #464
• fix(authbridge): post-#464 follow-ups — abctl pipeline panic + echo demo preflight by @huang195 in #470
• docs(weather-agent): UI-first rewrite of advanced demo + LLM setup by @mrsabath in #466
• build(deps): bump Go 1.24→1.25, grpc to v1.81.1, fsnotify to v1.10.1 by @pdettori in #465
• build(deps): Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #473
• build(deps): Bump github/codeql-action from 4.36.0 to 4.36.1 by @dependabot[bot] in #475
• fix(authbridge): record inbound allow events without requiring a2a-parser by @huang195 in #471
• epic: add SPARC pre-tool reflection plugin, service, and demo by @OsherElhadad in #478
• docs(weather-agent): fix installer secret namespace in demo-ui by @mrsabath in #439
• feat(sparc-service): one-command install; deploy SPARC via a shared i… by @OsherElhadad in #479
• Adding an opa plugin by @davidhadas in #427
• fix(authbridge): Stream text/event-stream responses frame-by-frame by @kellyaa in #480
• feat(proxy-init): add enforce-drop mode for proxy-sidecar egress enforcement by @huang195 in #484
• feat: Add transparent listener + enforce-redirect for proxy-sidecar egress by @huang195 in #485
• CI: grant pull-request read permission for verify-pr-title job to pr-verifier caller by @rh-dnagornuks in #495
• Feat(opa): implement singleton OPA SDK to eliminate duplicate bundle … by @davidhadas in #491
• Fix: Capture in-cluster TCP egress in enforce-redirect (keep DNS direct) by @huang195 in #498
• Fix: Exempt DNS by resolv.conf nameservers, retire CLUSTER_CIDRS by @huang195 in #499
• Fix: remediate security audit findings in authbridge by @varshaprasad96 in #496
• Fix: Pin IBAC user intent against FIFO eviction; add listener.skip_hosts by @kellyaa in #500
• Fix: Render MCP-protocol error frame on outbound deny by @kellyaa in #501
• Fix: Select iptables backend by kernel module, fail loud on misprogram by @huang195 in #518
• Feat: Add build-tag based plugin selection for authbridge binaries by @Schimuneck in #520
• Feat: IdP-agnostic token exchange plugin interface by @akram in #521
• Feat: Outbound TLS bridge (Phase 1) — decrypt agent egress HTTPS into the pipeline by @huang195 in #522
• Fix: Run the TLS bridge without SPIRE (need-driven SPIFFE provider; drop in-process trust self-check) by @huang195 in #523
• Feat: Add Anthropic Messages API support to inference-parser by @huang195 in #526
• Feat: Add AI-assisted GitHub issue agent POC by @omerboehm in #492
• Feat(abctl): one row per network message, show every message by @huang195 in #527
• Fix(bypass): add /metrics to default JWT bypass paths by @jordigilh in #534
• Docs: update demos to use AgentRuntime to enroll agents/tools instead of manual labeling by @rh-dnagornuks in #494
• Fix: Forward-proxy inference SSE event: lines + outbound session pinning by @huang195 in #618
• Refactor: Collapse authbridge-lite into a build-tag variant of authbridge-proxy by @huang195 in #621
• Fix: Gate TLS-bridge leaf cache on wall-clock validity (survive suspend) by @huang195 in #622
• Feat/GitHub issue agent rbac scope gating by @omerboehm in #619
• chore: 🔧 Update PR review workflow for title case insensitivity by @evaline-ju in #627
• build(deps): Bump docker/metadata-action from 6.0.0 to 6.1.0 by @dependabot[bot] in #472
• build(deps): Bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #474
• build(deps): Bump github/codeql-action from 4.36.1 to 4.36.2 by @dependabot[bot] in #487
• build(deps): Bump rojopolis/spellcheck-github-actions from 0.60.0 to 0.62.0 by @dependabot[bot] in #536
• build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #535
• Docs: Diagram of AuthBridge plugin decision sequence by @esnible in #629
• build(deps): Bump library/alpine from 3.23 to 3.24 in /authbridge/proxy-init by @dependabot[bot] in #517
• build(deps): Bump rojopolis/spellcheck-github-actions from 0.62.0 to 0.63.0 by @dependabot[bot] in #631
• build(deps): Bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by @dependabot[bot] in #636
• build(deps): Bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #632
• Docs: Quote curl command so that link is not rendered by @esnible in #649
• build(deps): Bump langchain-core from 1.4.7 to 1.4.8 by @dependabot[bot] in #537
• build(deps): Update python-dotenv requirement from >=1 to >=1.2.2 by @dependabot[bot] in #540
• build(deps): Bump langchain-openai from 1.3.2 to 1.3.4 by @dependabot[bot] in #538
• Feat: litellm-budget-track plugin for daily spend enforcement by @aslom in #654
• Fix reverse-proxy SSE/streaming fidelity (event: lines, gzip, header propagation, Host) by @pdettori in #657
• Feat: add static-inject AuthBridge plugin for static credential injection by @pdettori in https://github.c...

v0.6.0-alpha.4

What's Changed

• feat(images): Unify combined sidecar images, drop client-registration by @huang195 in #409
• refactor(cmd): split unified authbridge binary into 3 mode-specific binaries by @huang195 in #411
• refactor(authlib): proxy listeners session-event parity with extproc by @huang195 in #412
• fix: sweep post-#411 stale references (dead labels, dead images, dead docs) by @huang195 in #414
• fix(weather-demo): teach pick_log_container the proxy-sidecar container name by @huang195 in #420
• feat: Support AllowedAudiences for inbound JWT validation by @akram in #356
• feat(authbridge): Add ibac plugin + end-to-end demo by @huang195 in #421
• refactor(authlib): Extract LLM-judge boilerplate into authlib/llmclient by @huang195 in #422
• feat(abctl): Events-table PHASE rendering — hide skips, tree glyphs, lifecycle-only PHASE by @huang195 in #423
• feat(authbridge): mTLS between proxy-sidecar listeners via SPIRE X.509 SVIDs by @huang195 in #424
• fix(plugins): Drop mutex between token-exchange and token-broker by @huang195 in #404
• 🌱 refactor(authlib): drop unused actor-token-chaining plumbing by @huang195 in #429
• ✨ feat(forwardproxy): support HTTPS CONNECT as raw TCP passthrough by @huang195 in #430
• feat(authbridge): replace spiffe-helper with in-process go-spiffe SDK Provider by @huang195 in #432

Full Changelog: v0.5.0-rc.3...v0.6.0-alpha.4

v0.5.0-rc.3

What's Changed

• ci: Add org-wide project automation workflow by @rubambiza in #315
• 🐛 Start gRPC listener before credential resolution by @huang195 in #323
• refactor: Remove deprecated go-processor and migrate combined sidecar by @huang195 in #327
• Promote auth success logs from Debug to Info by @huang195 in #326
• ⚡ Shrink authbridge images: UBI9-micro for Envoy variant, distroless for lightweight by @huang195 in #324
• docs: document deployment modes, image variants, and port-stealing by @huang195 in #331
• build(deps): Bump envoy to v1.37.2 and ubi-minimal digest in authproxy by @pdettori in #321
• fix: Rename SERVICE_PORT to PORT in github-issue demo manifest by @huang195 in #334
• feat: Add dynamic log level via LOG_LEVEL env var and SIGUSR1 toggle by @huang195 in #335
• docs: Update weather demo — proxy-sidecar mode, debug logging by @huang195 in #337
• build(deps): Bump golang from 1.24.5-alpine to 1.26.2-alpine in /authbridge/authproxy by @dependabot[bot] in #329
• build(deps): Bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in #328
• Feat: Support gRPC Reflection API by @esnible in #344
• feat(demos): Advanced Weather + AuthBridge demo (token exchange, tool inbound, verify script) by @mrsabath in #343
• fix(demos): Kind CI rollout timeouts for weather advanced E2E by @mrsabath in #346
• authbridge(weather): fix Kind E2E (Deployment progress deadline) by @mrsabath in #347
• Feat: Collect and serve Kagenti Authbridge statistics and configuration by @esnible in #349
• Style: Pass 'make lint' by @esnible in #353
• build(deps): Bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by @dependabot[bot] in #350
• build(deps): Update pyyaml requirement from >=6.0 to >=6.0.3 by @dependabot[bot] in #351
• feat: Add pipeline package with typed extension slots by @huang195 in #358
• feat: Wire built-in plugins into pipeline and listeners by @huang195 in #359
• fix: Pin cryptography<47 to fix ARM64 crash in client-registration by @huang195 in #360
• feat: Add MCP parser plugin and body access infrastructure by @huang195 in #361
• fix: Correct ext_proc body-phase responses and enable allow_mode_override by @huang195 in #362
• refactor(mcp-parser): Generic method handling and improved logging by @huang195 in #364
• feat: Add A2A parser plugin for inbound request inspection by @huang195 in #363
• feat: Add inference-parser plugin for outbound LLM traffic by @huang195 in #365
• build(deps): Bump github/codeql-action from 4.35.2 to 4.35.3 by @dependabot[bot] in #368
• feat: Add session-aware pipeline infrastructure by @huang195 in #366
• feat: Add response-side parsers and session enrichment by @huang195 in #370
• feat: HTTP session events API (snapshots + SSE stream) by @huang195 in #371
• feat: abctl — interactive TUI for session events by @huang195 in #372
• feat: Capture A2A response summary in session events by @huang195 in #373
• feat(abctl): Identity banner + token columns + plugin state helpers by @huang195 in #374
• fix(authbridge): robust credential provisioning with continuous polling by @pdettori in #375
• feat(pipeline): Structured rejections + lifecycle hooks + plugin spec docs by @huang195 in #377
• feat(plugins): Per-plugin config + /readyz aggregation + /stats merge by @huang195 in #378
• CI: Add PR title verifier workflow by @rubambiza in #355
• feat(plugins): Add keycloak_url + keycloak_realm to jwt-validation for internal JWKS derivation by @huang195 in #383
• feat(session): Plugin invocation contract + 5-value action vocabulary + abctl row-per-plugin renderer by @huang195 in #385
• refactor(plugins): Open plugin registry + pctx.Record helpers (DX improvements) by @huang195 in #386
• feat(pipeline): Config hot-reload via fsnotify + atomic pipeline swap by @huang195 in #388
• feat(pipeline): Body mutation via WritesBody capability + SetBody helpers by @huang195 in #389
• refactor(pipeline): Detype framework + consolidate single-owner authlib packages by @huang195 in #392
• feat(authlib): Add ContentSource capability for guardrail plugins by @huang195 in #393
• feat: Guardrail prerequisites — outbound deny recording + on_error policy by @huang195 in #395
• feat: Add token broker plugin by @davidhadas in #391
• feat(pipeline): Add Scheme to Context and plumb through listeners by @huang195 in #399
• feat: Plugin relationship declarations + token-exchange/token-broker claim migration by @huang195 in #400
• feat(pipeline): Add Finisher lifecycle hook for stateful plugin cleanup by @huang195 in #401
• feat(cmd): Add authbridge-proxy and authbridge-envoy lite binaries by @huang195 in #407
• fix: a2a-parser reads contextId from params.message by @huang195 in #408

New Contributors

• @esnible made their first contribution in #344
• @davidhadas made their first contribution in #391

Full Changelog: v0.5.0-alpha.2...v0.5.0-rc.3

v0.5.0-alpha.2

Unified AuthBridge Binary

This release introduces the unified authbridge binary — a single Go binary that replaces three separate codebases (go-processor, waypoint, klaviger) with one codebase supporting multiple deployment modes.

Highlights

• Single binary, four modes: envoy-sidecar (ext_proc), waypoint (ext_authz), proxy-sidecar (forward/reverse HTTP proxy)
• authlib/ shared library: Reusable packages for JWT validation, token exchange (RFC 8693), SPIFFE identity, token caching, path bypass, and host-based routing
• Composition layer (authlib/auth/, authlib/config/): YAML-driven config with ${ENV_VAR} expansion, mode presets, and startup validation
• Combined container image: Envoy + authbridge in a single container (authbridge-unified), drop-in replacement for envoy-with-processor

Changes since v0.4.0-alpha.13

Features

• authlib/ — shared token exchange building blocks (Phase 1)
• auth/ and config/ — composition layer and mode presets (Phase 2)
• Listeners and single binary — four modes, one codebase (Phase 3)
• CI/build for unified authbridge, deprecate old components (Phase 4)

Bug Fixes

• Fix Envoy image SHA pin pulling wrong architecture (ARM64 digest on AMD64 builds)
• Fix actor cache TTL reset, t.Fatal in httptest handlers, JWKS URL derivation
• Enforce audience in JWT validation, return generic errors to clients
• Fix client_credentials audience and waypoint audience derivation
• Supervise background processes in AuthBridge entrypoints

Documentation

• Unified authbridge documentation and deprecation notices
• Updated demo guides for combined AuthBridge sidecar

Container Images

All images published to ghcr.io/kagenti/kagenti-extensions/:

Image	Description
authbridge-unified:v0.5.0-alpha.2	New — Envoy + authbridge unified binary
authbridge:v0.5.0-alpha.2	Combined sidecar (Envoy + go-processor + spiffe-helper + client-registration)
auth-proxy:v0.5.0-alpha.2	Go ext_proc processor (legacy)
envoy-with-processor:v0.5.0-alpha.2	Envoy + go-processor (legacy, use authbridge-unified instead)
proxy-init:v0.5.0-alpha.2	iptables init container
spiffe-helper:v0.5.0-alpha.2	SPIFFE credential fetcher
client-registration:v0.5.0-alpha.2	Keycloak client registration

v0.4.0-alpha.12

Changelog

• 8716f7e Merge pull request #282 from huang195/use-client-id-for-audience-validation
• e39cff1 Merge pull request #284 from cwiklik/docs/webhook-deprecation-notice
• 397174b docs: Add deprecation notice to kagenti-webhook README
• 61ca04c feat(authproxy): use CLIENT_ID for inbound audience validation, remove EXPECTED_AUDIENCE
• 310d1ed Merge pull request #283 from huang195/fix-token-url-derivation
• cca2b44 fix: restore TOKEN_URL and ISSUER auto-derivation from KEYCLOAK_URL + KEYCLOAK_REALM
• 1eeb77e Merge pull request #277 from kagenti/dependabot/go_modules/AuthBridge/AuthProxy/google.golang.org/grpc-1.80.0
• 9204c77 Merge pull request #255 from kagenti/dependabot/go_modules/kagenti-webhook/k8s.io/client-go-0.35.3
• 603c0cb Merge pull request #276 from kagenti/dependabot/github_actions/docker/login-action-4.1.0
• c9ddf60 Merge pull request #265 from kagenti/dependabot/github_actions/github/codeql-action-4.35.1
• 02e5aec Merge pull request #264 from kagenti/dependabot/github_actions/actions/setup-go-6.4.0
• 6eb98f5 Merge pull request #252 from rh-dnagornuks/fix/demo-agent-ollama-local-env
• 48bf1aa Merge pull request #259 from kagenti/dependabot/github_actions/azure/setup-helm-5.0.0
• b88c047 build(deps): Bump google.golang.org/grpc in /AuthBridge/AuthProxy
• e0014f5 build(deps): Bump docker/login-action from 4.0.0 to 4.1.0
• 088f1a5 Merge pull request #273 from aslom/patch-2
• 1de31ef docs: Fix typos and revise deployment instructions in demo-ui.md
• f331e71 build(deps): Bump github/codeql-action from 4.33.0 to 4.35.1
• 20e800e build(deps): Bump actions/setup-go from 6.3.0 to 6.4.0
• e7f27da build(deps): Bump azure/setup-helm from 4.3.1 to 5.0.0
• 23ff744 build(deps): Bump k8s.io/client-go in /kagenti-webhook
• 6422850 docs: Update Ollama verification step in GitHub issue agent manual demo
• 758ed3a fix: Default LLM env variables to local Ollama instance

v0.4.0-alpha.13

Changelog

• 8716f7e Merge pull request #282 from huang195/use-client-id-for-audience-validation
• e39cff1 Merge pull request #284 from cwiklik/docs/webhook-deprecation-notice
• 397174b docs: Add deprecation notice to kagenti-webhook README
• 61ca04c feat(authproxy): use CLIENT_ID for inbound audience validation, remove EXPECTED_AUDIENCE
• 310d1ed Merge pull request #283 from huang195/fix-token-url-derivation
• cca2b44 fix: restore TOKEN_URL and ISSUER auto-derivation from KEYCLOAK_URL + KEYCLOAK_REALM
• 1eeb77e Merge pull request #277 from kagenti/dependabot/go_modules/AuthBridge/AuthProxy/google.golang.org/grpc-1.80.0
• 9204c77 Merge pull request #255 from kagenti/dependabot/go_modules/kagenti-webhook/k8s.io/client-go-0.35.3
• 603c0cb Merge pull request #276 from kagenti/dependabot/github_actions/docker/login-action-4.1.0
• c9ddf60 Merge pull request #265 from kagenti/dependabot/github_actions/github/codeql-action-4.35.1
• 02e5aec Merge pull request #264 from kagenti/dependabot/github_actions/actions/setup-go-6.4.0
• 6eb98f5 Merge pull request #252 from rh-dnagornuks/fix/demo-agent-ollama-local-env
• 48bf1aa Merge pull request #259 from kagenti/dependabot/github_actions/azure/setup-helm-5.0.0
• b88c047 build(deps): Bump google.golang.org/grpc in /AuthBridge/AuthProxy
• e0014f5 build(deps): Bump docker/login-action from 4.0.0 to 4.1.0
• 088f1a5 Merge pull request #273 from aslom/patch-2
• 1de31ef docs: Fix typos and revise deployment instructions in demo-ui.md
• f331e71 build(deps): Bump github/codeql-action from 4.33.0 to 4.35.1
• 20e800e build(deps): Bump actions/setup-go from 6.3.0 to 6.4.0
• e7f27da build(deps): Bump azure/setup-helm from 4.3.1 to 5.0.0
• 23ff744 build(deps): Bump k8s.io/client-go in /kagenti-webhook
• 6422850 docs: Update Ollama verification step in GitHub issue agent manual demo
• 758ed3a fix: Default LLM env variables to local Ollama instance

v0.4.0-alpha.11

Changelog

• 915c267 Merge pull request #268 from cooktheryan/webhook_perms
• ac3aea6 Merge pull request #270 from cwiklik/fix/spiffe-helper-image-tag
• 8f931a4 fix: Correct spiffe-helper image tag to use latest
• 7c9aa66 additional perms for agentruntime crd
• a3c797b Merge pull request #262 from akram/feature/operator-managed-client-registration
• a9ca995 test(e2e): align webhook injection tests with client-registration opt-in
• 02d61e8 feat(webhook): default operator-managed client registration; legacy sidecar opt-in
• 8a25d04 Address review comments
• e796bc8 webhook: align authbridge handler with Keycloak client credentials API
• 2a9123e webhook: rename Keycloak client credentials mount path and logging
• 4ae2148 feat(kagenti-webhook): coordinate operator-managed Keycloak client registration

v0.4.0-alpha.10

Changelog

• a6082ff Merge pull request #263 from cooktheryan/image_sha_patch
• db5d38c update of sha
• 76f712a Merge pull request #261 from cooktheryan/fix/openshift-scc-ubi-images
• 6f474bb fix: OpenShift SCC compatibility — UBI images and hardened SecurityContext
• a39d271 Merge pull request #238 from Alan-Cha/spiffe-keycloak-consolidation
• 76e648f Merge branch 'main' into spiffe-keycloak-consolidation
• 7c40841 Merge pull request #254 from huang195/feat/combined-sidecar
• f9b2d87 fix: Address PR review — harden entrypoint and pin Go image
• 18c21b7 feat: Add combined AuthBridge sidecar mode
• 493d57a Merge pull request #253 from huang195/fix/demo-realm-to-kagenti
• 934caf1 chore: add test-jwt-rotation.sh to .gitignore
• 4f6b1f4 fix: missed doc refs and add teardown safety for kagenti realm
• 14a0033 fix: change default Keycloak realm from "demo" to "kagenti"
• 6ad6baa refactor: improve go-processor config handling
• aaa65aa test: fix exchangeToken test calls after signature change
• ad56660 fix: add missing /shared volume mount to test deployment
• be956a1 Consolidate keycloak-webhook-config into authbrid ge-config
• 8fddaf8 Respond to comments
• 96fb4e7 Revert UID changes
• a9d0a9e Remove extraneous file
• 7e631f1 Address Go CI error
• 1c801e3 Update LOCAL_TESTING_GUIDE
• d1c723e Client registration gets KEYCLAOK_URL and KEYCLOAK_REALM
• de05f53 Update verification script
• ba3ae0f Change demo realm to Kagenti realm
• d1cba85 docs: Emphasize using build script and add troubleshooting
• 44033b4 Add fsGroup to allow shared volume access
• 2a9ce48 Enable SPIRE in Keycloak
• 5991d42 Add federated auth testing docs
• 345e09e Add federated auth testing scripts
• 7d133f0 Merge pull request #244 from kagenti/dependabot/github_actions/actions/upload-artifact-7.0.0
• 33315d7 Merge pull request #245 from kagenti/dependabot/github_actions/rojopolis/spellcheck-github-actions-0.60.0
• 4e44c79 Merge pull request #246 from kagenti/dependabot/github_actions/github/codeql-action-4.33.0
• bbaf1d8 Merge pull request #247 from kagenti/dependabot/pip/AuthBridge/client-registration/pyjwt-2.12.1
• 631f468 Merge pull request #251 from mrsabath/fix/demo-users-admin-role
• 3d00af3 Merge pull request #243 from mrsabath/docs/weather-demo-cleanup
• e37f8ff docs: Use more specific example prompt in github-issue demo
• 9343d1a docs: Add missing comma in port exclusion sentence
• 2c50c61 fix: Handle KeycloakGetError when admin role is missing
• eb88701 fix: Assign admin realm role to demo users in github-issue setup
• bdc5138 Merge pull request #231 from pavelanni/feat/actor-token-exchange
• cf47969 Merge pull request #217 from cwiklik/feat/webhook-config-resolution
• 5e030dd Merge remote-tracking branch 'upstream/main' into feat/webhook-config-resolution
• 288e86b fix: default ACTOR_TOKEN_ENABLED to false (opt-in)
• 8b5ea19 docs: Align design doc with authbridge-config consolidation
• 274d0a1 fix: Read all config from authbridge-config ConfigMap in resolved path
• 64145dd fix: Address second review findings from pdettori
• f0a6d1c fix: Clean up self-review findings for config resolution pipeline
• 220dd6f fix: Address PR review findings for config resolution pipeline
• 177f5f7 fix: Address PR review findings from pdettori
• c3a051b fix: Address self-review findings on config resolution pipeline
• 4071789 feat: Add per-workload config resolution pipeline for webhook
• 33601d5 fix: address PR review feedback on actor token and client registration
• 529c589 docs: Clean up GitHub Issue Agent demo guide
• 24e7261 build(deps): Bump pyjwt in /AuthBridge/client-registration
• e7bdaa7 build(deps): Bump github/codeql-action from 4.32.6 to 4.33.0
• 7806408 build(deps): Bump rojopolis/spellcheck-github-actions
• 0c05a68 build(deps): Bump actions/upload-artifact from 4.6.2 to 7.0.0
• 09e97e8 docs: Clean up weather agent demo guide
• 6da6aaa fix: handle 409 conflict in client registration for SPIFFE IDs
• 8738046 fix: add docker.io prefix for Podman compatibility
• 2dc09ee feat: add RFC 8693 actor token support for act claim chaining

v0.4.0-alpha.9

Changelog

• feea30d Merge pull request #248 from mrsabath/feat/inbound-ports-exclude-ambient-mesh
• 53cb0f1 refactor: address review comments on port exclusion
• 9458098 Merge pull request #250 from huang195/ci/build-latest-on-merge
• 267fcd9 ci: Apply latest image tag on PR merges and manual triggers
• b3ef820 feat: Add inbound port exclusion annotation and Istio ambient mesh fix
• 9eb014b Merge pull request #242 from huang195/feat/remove-privileged-init
• 7f5c5df docs: Update documentation to reflect DNAT and capabilities changes
• a5607f9 remove the need to give root access to init container

v0.4.0-alpha.8

Re-tagged at current main to include recent fixes:

• feat: Add kagenti.io/outbound-ports-exclude annotation for proxy-init (#240)
• docs: Remove redundant keycloak-admin-secret + add OpenAI/Ollama sections (#236)
• docs: Fix CLAUDE.md documentation drift (#241)

Previous tag included commits up to #226 (Kind e2e workflow).