v0.9.0: deduplication

• Key changes:
  • Added support for deduplication (enabled by default, can be turned off through ENABLE_DEDUPLICATION: false):
    • Previously, a label filter with a positive regexp was always added or replaced if a user had a regexp policy;
    • When deduplication is enabled, these queries will stay unmodified:
      • min.*, stolon, query: request_duration{namespace="minio"} - a non-regexp label filter that matches policy;
      • min.*, stolon, query: request_duration{namespace=~"minio"} - a "fake" regexp (no special symbols) label filter that matches policy;
      • min.*, stolon, query: request_duration{namespace=~"min.*"} - a label filter is a subfilter of the policy;
  • ACLs:
    • ACLs containing one word regexp expressions will have their anchors stripped;
    • Anchors are no longer added to complex ACLs, because Prometheus always treats regex expressions as fully anchored;
    • Fix: if a user had multiple roles, and one of the roles contained .* amongst other entries, getLF would pass all roles to PrepareLF instead of directly returning a full access role. It didn't cause any security issues as PrepareLF would still return a full access label filter, it just made the process lengthier;
  • Logs:
    • GET and POST queries are now logged in unescaped form, so it gets easier for a reader to compare original and modified requests;
    • duration is now logged without unit suffix, time is represented in seconds;
  • Bugfixes:
    • admin POST-requests failed to get proxied to upstream, because logging middleware was not updating Content-Length after reading PostForm. The issue was introduced in 0.7.0;
  • Added more tests.

v0.8.0: runtime metrics

• Key changes:
  • Exposed runtime metrics.

v0.7.0: zerolog

• Key changes:
  • Added some tests;
  • Moved to Go 1.18, Alpine 3.15.1;
  • Moved to zerolog:
    • Pretty formatting by default, JSON is also an option (env: LOG_FORMAT: pretty, json);
    • Optional access log (env LOG_REQUESTS: true);
    • NOTE: Logging format is subject to change.

v0.6.0: graceful shutdown

• Key changes:
  • Added a graceful shutdown mechanism with a configurable timeout.

v0.5.0: expression optimizations

• Key changes:
  • Added support for automatic expression optimizations for non-full access requests;
• Minor changes:
  • lfgw:
    • Slight improvements in code style;
    • Migrated to go 1.17;
    • Fully deprecated non-OIDC modes;
    • Bumped go.mod deps;
    • Updated base images;
    • Enabled more linters for golangci-lint;
  • CI:
    • Simplified Taskfile;
    • Enabled dependabot alerts;
    • Added a workflow to publish docker images.

0.4.0: support for multiple roles

• Added support for multiple roles (previously, only the first one would be picked).

0.3.0: Added support for POST requests

• Added support for POST requests;
• Updated metricsql from v0.10.1 to v0.14.0.

0.2.3

• Added /federate to a list of requests that should be rewritten.