14 posts tagged with "Security"

An error issue is meant to be one failure with an occurrence count beside it. For errors derived from log lines it had quietly become one issue per request — and chasing that turned up two more fixes.

A namespace row that says STRICT is reporting a claim. A strict policy that is enforced and one that is not — a workload that never enrolled, a selector that matches nothing, a rule disabling TLS underneath — look identical from configuration and from traces. Only the proxy that terminated the connection knows, and until now nothing asked it.

v0.15.0 puts, on one row, what your mesh's configuration says about a workload and what its proxy actually did — and gives every workload the cluster runs a row, whether or not it ever sent a span.

v0.14.0 closes the gaps between what v0.12 claimed for an agent and what an operator actually got — and turns the Mesh screen into a console for the fabric underneath your services.

The MCP server that shipped in v0.12 accepted exactly one credential: a personal API token, in a header. That works for a client you run yourself — Claude Code, the CLI — and it cannot work for a hosted one, which has no way to be handed a token you minted. Which is to say it could not serve the client the module's whole warning was written for.

The hub can now act as an OAuth 2.1 authorization server.

v0.13.0 draws the connections the service page could only list — and finishes the work of making every image an install pulls clean at the source rather than excused by a registry.

avuru obs has known a great deal about agents since v0.11 — the model calls your applications make, what they cost, when they cross a budget. Nothing let an agent know anything about your estate. The new MCP module fixes that direction of travel.

v0.12.0 turns AI spend from a number on a screen into something that reaches you — and opens the estate, read-only and on your switch, to an agent that can investigate it.

v0.11.0 adds no collection at all. Every feature in it reads spans avuru obs has been storing since your first five minutes, and asks them questions the product could not previously ask — so an install that upgrades sees its history, not just what arrives next.

Two gaps closed in Settings → Access: the identity-provider group mapping is no longer a value only a helm upgrade could change, and scripts get a credential of their own instead of a borrowed session cookie.