Seth Jennings c94cddbfb8 feat(server): separate HTTPS from mTLS authentication (#1351) ...

Make --tls-client-ca optional and make client certificates always
optional when a CA is configured. This decouples HTTPS encryption
from mTLS authentication, allowing mTLS and OIDC bearer tokens to
coexist as parallel authentication mechanisms.

When --tls-client-ca is provided, client certificates are validated
against the CA when presented but never required. Clients may connect
with or without a certificate — authentication is handled at the
application layer (e.g. OIDC).

Two TLS modes are now supported:
- HTTPS with optional mTLS (--tls-client-ca provided)
- HTTPS-only (--tls-client-ca omitted)

The --disable-gateway-auth flag is preserved for backward
compatibility but is now a no-op. The allow_unauthenticated field
has been removed from TlsConfig. The Helm chart conditionally
includes the client-ca volume and env var based on whether
clientCaSecretName is configured.

2026-05-15 09:43:30 -07:00

..

deb

fix(packaging): enable mTLS for local packages (#1271)

2026-05-08 13:02:12 -07:00

docker

Revert "perf(build): speed up local CLI rebuilds (#1387)" (#1395)

2026-05-14 17:45:37 -07:00

helm/openshell

feat(server): separate HTTPS from mTLS authentication (#1351)

2026-05-15 09:43:30 -07:00

kube

feat(server): separate HTTPS from mTLS authentication (#1351)

2026-05-15 09:43:30 -07:00

man

feat(server): separate HTTPS from mTLS authentication (#1351)

2026-05-15 09:43:30 -07:00

rpm

feat(server): separate HTTPS from mTLS authentication (#1351)

2026-05-15 09:43:30 -07:00

sbom

feat(sbom): add SBOM generation, license resolution, and CSV export tooling (#239)

2026-03-11 15:34:00 -07:00

snap

(feat) early snap support (#1238)

2026-05-10 21:12:30 -07:00