Skip to content

Changelog

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.5.0] - 2026-08-21

Added

  • Added a top-level extraObjects value (list or name-keyed map) to render arbitrary Kubernetes resources.

[1.4.0] - 2026-07-27

Added

  • Added routes.inbound.<route-name>.serviceEntry.enabled to opt individual inbound routes out of automatic ServiceEntry generation (#106).

[1.3.1] - 2026-07-27

Changed

  • Classified bb-common under the bb_integrated maintenance track and confirmed that its image inventory remains explicitly empty because the shared chart has no application versions or owned container images (#100).

[1.3.0] - 2026-07-23

Added

  • Generate Istio AuthorizationPolicies from compatible ingress NetworkPolicy definitions, including built-in definitions (#99).

[1.2.0] - 2026-07-14

Added

  • Waypoint mirroring: ingress k8s netpol entries whose workload is fronted by an authservice-protected route (ambient mode) now also generate a waypoint NetworkPolicy (HBONE 15008) and a Service-targetRefs AuthorizationPolicy, so declared in-mesh clients are admitted at the waypoint instead of being default-denied. The entry↔route join is derived by selector + containerPort match — no new values keys. Rendering fails on ambiguous matches; mirrors carry from-route provenance annotations.

Fixed

  • Authservice-protected routes now emit a <route>-authservice-allow-in-ns AuthorizationPolicy to mirror allow-all-in-ns policy
  • The authservice waypoint now gets a NetworkPolicy allowing prometheus to scrape its metrics port (15020), gated on networkPolicies.ingress.defaults.enabled like the sidecar scrape default (#103)

[1.1.1] - 2026-07-14

Changed

  • Updated service entries created with routes.outbound to be scoped to namespace.
  • Added overridable exportTo to routes.outbound to allow customization of visibility.
  • Updated auto-generated resources created from routes.inbound to respect multiple gateways when specified.

[1.1.0] - 2026-07-01

Added

  • Added per-route authservice (OIDC ext_authz) protection via routes.inbound.<name>.authservice
  • Auto-create a shared ambient waypoint Gateway and its supporting network policies when a route enables authservice.

[1.0.2] - 2026-06-17

Changed

  • Relocate Helm unittests for CI

[1.0.1] - 2026-06-03

Changed

  • Reverted default for networkPolicies and istio for time being
  • Updated tests to reflect updates

[1.0.0] - 2026-05-27

Changed

  • Updated default values for istio, network policies, authorization policies, and mTLS
  • Tightened schema validation across istio, network policies, and route configurations

[0.15.0] - 2026-04-28

Added

  • Added ambient-mode effective behavior so istio.ambient.enabled derives AuthorizationPolicy generation.
  • Added a render warning when istio.ambient.enabled=true is combined with istio.sidecar.enabled=true.

Changed

  • Suppressed Sidecar resources and sidecar-specific Prometheus NetworkPolicies when ambient mode is enabled.
  • Suppressed sidecar-specific Istiod egress NetworkPolicies when ambient mode is enabled.
  • Removed the unused istio.injection value from chart values and schema.

[0.14.2] - 2026-03-26

Added

  • Support for wildcard hostnames

[0.14.1] - 2026-02-20

Added

  • Added prependReleaseName toggle for istio and routes sections to support deploying multiple packages in the same namespace
  • Consolidated prepend-release-name helper into a single shared utility function

[0.14.0] - 2026-01-27

Added

  • Added ability to create virtual services used by passthrough gateways

[0.13.0] - 2026-01-14

Added

  • Added a deduplication mechanism for all generated resources

[0.12.3] - 2026-1-08

Fixed

  • Fixed an issue where AuthorizationPolicy generation from NetworkPolicy definitions were not respecting istio enablement flags

[0.12.2] - 2026-1-06

Added

  • Added routes.inbound.<route>.containerPort to support service pod port discrepency

[0.12.1] - 2025-12-30

Fixed

  • Fixed default ambient netpol logic so it doesn’t error out when istio section does not exist in chart

[0.12.0] - 2025-12-18

Added

  • Added initial support for outbound routing with ServiceEntry resource generation

[0.11.3] - 2025-12-16

Fixed

  • Updated CIDR exclusion logic to handle cases where the CIDR is identical to the exclusion

[0.11.2] - 2025-12-12

Fixed

  • Updated hbone port injection to skip netpol rules without a k8s selector

[0.11.1] - 2025-12-08

Fixed

  • Fixed naming conventions of authorization policies to avoid invalid characters and make naming more consistent
  • Updated associated documentation and added tests to validate authorization policy naming and rules

[0.11.0] - 2025-11-07

Fixed

  • Added ambient specific network policies and associated tests and schema updates
  • Added ability to inject TCP port 15008 into network policies in support of ambient communication requirements

[0.10.0] - 2025-10-24

Fixed

  • Remove istio.hardened flag in favor of explicit sidecar configuration.
  • Move customAuthorizationPolicies and customServiceEntries to istio.authorizationPolicies.custom and istio.serviceEntries.custom
  • Ensure global enabled flags for NetworkPolicies and AuthorizationPolicies are respected by routes

[0.9.1] - 2025-10-22

Fixed

  • Handle when Istio configuration is not present

[0.9.0] - 2025-10-20

Added

  • Added default authorization policies, as well as enhanced authorization policy generation
  • Handle Istio package configuration (Sidecar / PeerAuthentication)

[0.8.3] - 2025-10-17

Fixed

  • Fixed issue where custom label selectors for NetworkPolicies were being serialized into annotations and generated invalid resources

[0.8.2] - 2025-09-30

Changed

  • Updated routes NetworkPolicy selectors to use kubernetes.io/metadata.name for namespace selector and app.kubernetes.io/name for pod selector to align with Kubernetes standards

[0.8.1] - 2025-09-15

Added

  • Prevent routes resources (VirtualServices/AuthorizationPolicy) from being created if Istio is not available.

[0.8.0] - 2025-09-15

Added

  • Added support for VirtualService generated resources

[0.7.1] - 2025-09-15

Changed

  • Fixed the behavior of egress netpols when more than one policy is specified under the same wildcard ("*") local key

[0.7.0] - 2025-09-10

Added

  • Configured the default egress policies to be available during helm hook phases
  • Added documentation about the self-test feature
  • Updated the self-test feature to make it more versatile and usable in more situations

[0.6.1] - 2025-09-04

Changed

[0.6.0] - 2025-09-04

Added

  • Added the ability to set custom labels and annotations for generated resources

[0.5.2] - 2025-08-22

Added

  • Added the ability to test individual templates in isolation

[0.5.1] - 2025-08-14

Added

  • Added default ingress policy to permit prometheus sidecar scraping

[0.5.0] - 2025-08-13

Added

  • Added a port lookup to the default kubeAPI egress definition in the NetworkPolicy implementation

[0.4.3] - 2025-08-07

Changed

  • Removed 15014 port as that is only required for apps that monitor istio
  • Updated unit test to reflect changes

[0.4.2] - 2025-08-06

Changed

  • Updated istiod egress default rule to include port 15014 and updated pod selector label used
  • Updated unit test to reflect changes

[0.4.1] - 2025-07-30

Changed

[0.4.0] - 2025-07-30

Changed

  • Refactored the network-policy implementation to use shorthand pattern

Added

  • Authorization Policy generation from netpol shorthand

[0.3.1] - 2025-07-14

Changed

  • Separated helpers into sub-directories

[0.3.0] - 2025-07-11

Changed

  • Updated istio ingress gateway network policy generation to support label selectors and multiple policies

[0.2.0] - 2025-07-11

Added

  • Added support for templating values in package policies

[0.1.5] - 2025-07-10

Added

  • Added support for targeting specific pods for KubeAPI network policy

[0.1.4] - 2025-06-27

Added

  • Added network policies for minio and updated documentation

[0.1.3] - 2025-06-27

Added

  • Fixed bug in new netpols where delimiter was missing
  • Added migration documentation

[0.1.2] - 2025-06-23

Added

  • Added two new network policies and corresponding tests
  • Updated existing network policy and test
  • Added missing tests
  • Updated values.yaml to include defaults that are common across packages

[0.1.1] - 2025-06-12

Added

  • Added unittests for pipeline
  • Converted chart from library to application

[0.1.0] - 2025-05-28

Added

  • Initial templating for network policies
  • Documentation on new library chart