3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-04-28 09:56:31 +02:00
Code Issues Projects Releases Packages Wiki Activity
pomerium/changelogs/v0.29.0.md
Denis Mishin c7ffb95483
add v0.29.0 release notes (#5515)
2025-04-08 11:34:20 -04:00

15 KiB
Raw Permalink Blame History

What's Changed

Breaking

  • Enable seamless request tracing across multiple services with the new OTEL-based tracing system. Users can now easily configure and understand traces, with improved visibility into the flow of requests, even at low sample rates. All previously supported tracing methods are removed. (@kralicky in #5388) and #5447)

New

  • New jwt_issuer_format global setting. (@kenjenkins in #5519)
  • Enable UDP routes with CONNECT-UDP tunneling. (@calebdoxsey in #5390)
  • HTTP/3 Support (@calebdoxsey in #5349)
  • Enable authorization errors to return a JSON response instead of HTML, providing a cleaner and more consistent error format for developers using gRPC services. (@calebdoxsey in #5400 (ENG-1750))
  • Prevent false positive vulnerability reports by only generating a fallback certificate when no other certificate is configured, minimizing unnecessary certificate generation. (@kenjenkins in #5250)
  • Enable precise control over user group claims in JWTs by allowing filtering of groups either globally or per route. This enhancement helps reduce excessive group lists, preventing large headers that can disrupt upstream services while maintaining the integrity of signed JWTs. (@kenjenkins in #5417 (ENG-1802))
  • Enable core Pomerium to access the original PPL policy by adding a source_ppl field to the configuration, ensuring better introspection and compatibility with the Routes Portal. This enhancement allows the raw PPL to be passed alongside the generated Rego, providing more comprehensive policy visibility. (@calebdoxsey in #5419 (ENG-1832))
  • Add names, descriptions, and logos to routes, enhancing route cards with clear identifiers and visual appeal. Enjoy a more informative and engaging interface with route-specific icons and descriptions, and easily connect to services with direct links or command instructions. (@calebdoxsey in #5424 (ENG-1833))
  • Enhance Directory Group query performance by introducing a cache warming feature that preloads records, significantly reducing delays and timeouts. (@calebdoxsey in #5439 (ENG-1915))
  • Access your available routes through a new JSON endpoint at /.pomerium/api/v1/routes, providing a list tailored to your permissions. (@calebdoxsey in #5428 (ENG-1845))
  • Discover available routes with a new HTML page that displays each accessible route as a card. This intuitive interface makes navigation and route management simpler and more efficient. (@calebdoxsey in #5443 (ENG-1871))
  • Discover and display site logos automatically by fetching and embedding favicons from destination addresses, enhancing visual recognition and user experience. (@calebdoxsey in #5448)
  • Enhance user experience with new icons for well-known services, making it easier to identify them at a glance. (@calebdoxsey in #5453)
  • Enable dynamic configuration reloading by handling SIGHUP signals, allowing updates without restarting the application. (@calebdoxsey in #5459)
  • Enable customization of the HTTP/3 advertise port in the Alt-Svc header, enhancing flexibility for configurations using protobuf. (@calebdoxsey in #5466)
  • Authenticate using IdP access and identity tokens, with initial support for Azure AD access tokens. (@calebdoxsey in #5484 (ENG-2001, ENG-2001))
  • Improve file management by setting consistent default directories and logging errors when directory environment variables are unset. Ensure file writes are atomic to prevent redundancy and potential file conflicts, enhancing reliability and reducing clutter in temporary storage. (@calebdoxsey in #5477)
  • Enhance performance by reducing redundant session creation for identical IdP tokens. (@calebdoxsey in #5491 (ENG-2025, ENG-2025))
  • Enhance PPL logic with new not and exclude operators, allowing more flexible string and list matching. Define more precise permissions by excluding specific domains or groups in your policy configurations. (@calebdoxsey in #5490 (ENG-2030, ENG-2030))

Fixes

  • Ensure the "groups" claim in JWTs is serialized as an empty list instead of JSON null, improving compatibility with third-party libraries. (@kenjenkins in #5394)
  • Ensure complete and accurate metrics output by properly flushing the buffered writer. (@kenjenkins in #5398)
  • Ensure custom branding settings are consistently applied across all pages, even when using multiple configuration sources. This resolves an issue where core pages were not displaying the correct branding when using an ingress controller, ensuring a uniform appearance with your chosen colors and logo. (@calebdoxsey in #5401 (ENG-1766))
  • Ensure the HTTP redirect server properly uses the proxy protocol when configured. (@calebdoxsey in #5405)
  • Ensure that logo URLs containing % signs are correctly processed, preventing configuration errors in Envoy. This fix allows branding options with special characters to be used without causing issues. (@kenjenkins in #5460 (ENG-1958))
  • Fix the identity_manager_last_session_refresh_errors metrics view. (@kenjenkins in #5543)
  • Reduce memory usage during metrics output by @wasaga in https://github.com/pomerium/pomerium/pull/5530
  • Ensure Pomerium in Zero mode can connect to the cloud control plane using HTTPS_PROXY egress proxy by @wasaga in https://github.com/pomerium/pomerium/pull/5520

Changed

Dependency Updates

New Contributors

Full Changelog: https://github.com/pomerium/pomerium/compare/v0.28.0...v0.29.0