3 Commits

Include renames

Author	SHA1	Message	Date
Taylor Mutch	a3b16c18ab	feat(auth): per-sandbox authentication to gateway (#1404)	2026-05-21 17:58:55 -07:00
Seth Jennings	c94cddbfb8	feat(server): separate HTTPS from mTLS authentication (#1351) ... Make --tls-client-ca optional and make client certificates always optional when a CA is configured. This decouples HTTPS encryption from mTLS authentication, allowing mTLS and OIDC bearer tokens to coexist as parallel authentication mechanisms. When --tls-client-ca is provided, client certificates are validated against the CA when presented but never required. Clients may connect with or without a certificate — authentication is handled at the application layer (e.g. OIDC). Two TLS modes are now supported: - HTTPS with optional mTLS (--tls-client-ca provided) - HTTPS-only (--tls-client-ca omitted) The --disable-gateway-auth flag is preserved for backward compatibility but is now a no-op. The allow_unauthenticated field has been removed from TlsConfig. The Helm chart conditionally includes the client-ca volume and env var based on whether clientCaSecretName is configured.	2026-05-15 09:43:30 -07:00
Taylor Mutch	909e9034aa	ci(helm): add helm lint workflow and reorganize chart values under ci/ (#1223) ... * test(helm): Reorganize values under /ci, update mise helm:lint task loop WIP * ci: Add a helm lint job to validate helm linting passes on changes	2026-05-07 10:36:27 -07:00