v0.3.0-alpha.10

What's Changed

• Fix(charts): correct operator controller image to rossoctl-operator by @cwiklik in #493

Full Changelog: v0.3.0-alpha.9...v0.3.0-alpha.10

v0.3.0-alpha.9

What's Changed

• ⚠️ Rename Kagenti → Rossoctl across kagenti-operator (→ operator) by @Ibrahim2595 in #485
• Refactor: Rename rossocortex → cortex + clean residual kagenti refs by @Ibrahim2595 in #489

New Contributors

• @Ibrahim2595 made their first contribution in #485

Full Changelog: v0.3.0-alpha.8...v0.3.0-alpha.9

v0.3.0-alpha.8

What's Changed

• Chore: sunset client-registration sidecar — remove legacy opt-in label by @Alan-Cha in #479
• Fix(controller,webhook): write client-id.txt in federated-jwt mode for inbound JWT validation by @Alan-Cha in #483
• Build(deps): bump the minor-and-patch group across 1 directory with 5 updates by @dependabot[bot] in #480
• Build(deps): bump the minor-and-patch group across 1 directory with 14 updates by @dependabot[bot] in #475
• Build(deps): bump actions/cache from 5.0.5 to 6.1.0 in the major group across 1 directory by @dependabot[bot] in #472

Full Changelog: v0.3.0-alpha.7...v0.3.0-alpha.8

v0.3.0-alpha.7

What's Changed

• Fix: increase SPIRE Helm install timeout from 5m to 10m by @kevincogan in #450
• Build(deps): bump the major group across 1 directory with 2 updates by @dependabot[bot] in #431
• Build(deps): bump the minor-and-patch group in /kagenti-operator with 7 updates by @dependabot[bot] in #430
• Feat: Support Sandbox workloads in AuthBridge owner resolution + ConfigMap GC by @huang195 in #451
• Refactor: remove SPIRE_ENABLED from authbridge-config and per-namespace envoy-config CM by @letv1nnn in #447
• Fix: Restore sigstore-a2a agent card signing workflow by @DeanKelly751 in #459
• Refactor(webhook): remove AgentRuntimeOverrides from injection path by @r3v5 in #427
• Feat(e2e): make tests configurable for pre-installed operator environments by @Bobbins228 in #458
• Feat: add MTLSReady condition to AgentRuntime status by @varshaprasad96 in #461
• Fix(helm): align ClusterRole with controller-gen and add AuthBridge SCC by @Bobbins228 in #456
• Feat: add ValidatingAdmissionPolicy to protect kagenti.io/type label by @rh-dnagornuks in #418
• Refactor: remove IdentitySpec and SPIFFEIdentity from AgentRuntime CRD by @Ygnas in #466
• Build(deps): bump the major group with 2 updates by @dependabot[bot] in #464
• Build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 in the minor-and-patch group by @dependabot[bot] in #463
• Build(deps): bump the minor-and-patch group in /kagenti-operator with 2 updates by @dependabot[bot] in #462
• Feature: absorb spiffe-helper config into global kagenti-platform-config by @r3v5 in #437
• Feat: add SPIRE operand controller for ZTWIM CR and SPIRE CRs lifecycle by @r3v5 in #465
• Docs: Propose AI Gateway CRDs and Controller by @usize in #419
• Feat(operator): implement SPIFFE JWT-SVID authentication for client registration by @Alan-Cha in #473
• Feat: Add token-broker service for OAuth session and token management by @davidhadas in #449
• Fix(charts+controller): SPIFFE auth follow-up — jwtAudience cleanup, credential secret skip, tag fix by @Alan-Cha in #476

New Contributors

• @letv1nnn made their first contribution in #447

Full Changelog: v0.3.0-alpha.6...v0.3.0-alpha.7

v0.2.0-rc.8

Full Changelog: v0.2.0-rc.7...v0.2.0-rc.8

v0.3.0-alpha.6

What's Changed

• Feat: default mTLS to permissive and enable card discovery by @varshaprasad96 in #408
• Feat: Bundle Service serving OPA authorization policy bundles by @davidhadas in #415
• Fix: pin Helm binary to v4.2.0 to unblock E2E tests by @Ygnas in #439
• Feat: Expose configurable iptables backend (IPTABLES_CMD) for proxy-init by @huang195 in #432
• Feat: Add egressEnforcement opt-out for proxy-sidecar mode by @akram in #436
• Fix: preserve explicitly-set authbridge-config keys per namespace (#433) by @pdettori in #434
• Fix: address security audit findings across operator codebase by @varshaprasad96 in #429
• Fix: add retry logic to metrics E2E curl pod to prevent flaky timeouts by @r3v5 in #441
• Fix: add list/watch RBAC verbs for ServiceAccounts by @gracesmith6504 in #444
• Feat: add Kuadrant operand controller by @Bobbins228 in #438
• Feat: Keycloak bootstrap — operand infra and realm import by @ChristianZaccaria in #412
• CI: Increase E2E test timeout from 30m to 45m by @kevincogan in #446
• Feat: AuthBridge TLS bridge — Phase 2 (operator coordination) by @huang195 in #448

New Contributors

• @davidhadas made their first contribution in #415
• @gracesmith6504 made their first contribution in #444

Full Changelog: v0.3.0-alpha.5...v0.3.0-alpha.6

v0.2.0-rc.7

Full Changelog: v0.2.0-rc.6...v0.2.0-rc.7

v0.3.0-alpha.5

What's Changed

• Fix: remove kagenti.io/type label and config-hash on AgentRuntime deletion by @rh-dnagornuks in #396
• feat: patch kagenti-ui-config ConfigMap with MLflow dashboard URL at startup by @ChristianZaccaria in #411
• feat: auto-label namespaces with Istio ambient mesh on AgentRuntime reconcile by @r3v5 in #403
• feat: remove enableTracing and tracingBackend from platform config by @Bobbins228 in #402
• build(deps): bump the minor-and-patch group with 2 updates by @dependabot[bot] in #400
• CI: grant pull-requests:read to pr-verifier caller by @rh-dnagornuks in #379
• Feat: [spec] mTLS transport security for agent communication (003) by @varshaprasad96 in #401
• Feature: 2-layer config merge for AgentRuntime controller by @r3v5 in #405
• Feat: MLflow operand controller for CR lifecycle and OTEL RBAC by @Bobbins228 in #378
• Feat: detect and warn when OVN routingViaHost is not enabled by @Bobbins228 in #386
• Fix: add TLS connectivity probe to webhook readiness checks by @pdettori in #421
• Fix: wrap status update with RetryOnConflict to prevent linkedSkills loss by @pdettori in #423
• Fix: harden controllers against stale objects, orphaned resources, an… by @Ygnas in #424
• Feat: add OpenShift overlay with AuthBridge configs, SCC, and Istio shared trust by @Ygnas in #387
• Build(deps): bump the minor-and-patch group across 1 directory with 2 updates by @dependabot[bot] in #414
• Build(deps): bump github.com/spiffe/go-spiffe/v2 from 2.6.0 to 2.7.0 in /kagenti-operator in the minor-and-patch group across 1 directory by @dependabot[bot] in #413
• Fix: use correct MLflow API group and resource for agent RBAC by @rh-dnagornuks in #404
• Docs: update SPIRE signing demo for Kind and OpenShift by @rh-dnagornuks in #334
• Fix(mlflow): add --mlflow-ca-file flag for custom TLS CA verification by @pdettori in #425
• Feat: add observedGeneration; simplify conditions by @r3v5 in #416
• Feat: Implementing Sigstore-A2A verification for A2A Agent Cards by @DeanKelly751 in #355
• Chore: Retire CLUSTER_CIDRS injection (DNS exemption is resolv.conf-driven) by @huang195 in #428

New Contributors

• @DeanKelly751 made their first contribution in #355

Full Changelog: v0.3.0-alpha.4...v0.3.0-alpha.5

v0.3.0-alpha.4

What's Changed

• fix(chart): grant cert-manager certificates RBAC to the operator ClusterRole by @huang195 in #409

Full Changelog: v0.3.0-alpha.3...v0.3.0-alpha.4

v0.3.0-alpha.3

What's Changed

• ci(release): parallelize image builds + add buildx cache + fix e2e by @huang195 in #374
• Consolidate AgentCard Data Into AgentRuntime Status [Spec] by @rhuss in #372
• Add OCI skill image mounting to AgentRuntime by @cooktheryan in #332
• feat: OTel collector bootstrap as operator startup Runnable by @Bobbins228 in #376
• refactor(api): remove spec.trace from AgentRuntime CRD by @rh-dnagornuks in #377
• feat(webhook): Wire envoy-sidecar mTLS through pod mutator + fix svid-output mount by @huang195 in #381
• ci: cross-compile Go builds instead of QEMU emulation by @huang195 in #382
• chore: update dependencies, pin CI actions, add dependabot by @Ladas in #390
• feat: create SharedTrust controller for cert-manager cacerts reconciliation by @r3v5 in #383
• chore(deps): Bump github/codeql-action from 4.35.3 to 4.36.0 by @dependabot[bot] in #375
• build(deps): bump the minor-and-patch group across 1 directory with 8 updates by @dependabot[bot] in #398
• chore(deps): bump the major group with 2 updates by @dependabot[bot] in #392
• fix(client-registration): attach audience scope to agent's own client by @mrsabath in #395
• Card Discovery Refinement Alignment [Spec + Impl] by @rhuss in #380
• feat: replace spec.skills injection with passive skill discovery by @cooktheryan in #388
• feat: operator auto-discovers and manages identity config by @ChristianZaccaria in #397
• feat: Wire proxy-sidecar egress enforcement (UID fix + enforce-drop) by @huang195 in #406
• feat: Always-on proxy-sidecar egress enforcement (enforce-redirect), remove flag by @huang195 in #407

New Contributors

• @rhuss made their first contribution in #372

Full Changelog: v0.3.0-alpha.2...v0.3.0-alpha.3