Base image update

Full Changelog: 1.12.0...1.12.1

This release updates the base image.

SQLite WAL and conditional agent TLS verification

Full Changelog: 1.11.2...1.12.0

This release enables SQLite Write-Ahead Log and busy timeout, and (re)introduces conditional agent TLS certificate verification.
The verification is skipped if any Finch service TLS communication is terminated with a self-signed certificate. The decision is made while
agent configuration creation based on the service configuration.

Maintenance

Full Changelog: 1.11.1...1.11.2

This is a maintenance release.

• enable WebSocket origin check
• set proper gRPC error codes
• enable TLS verify check in agent config
• remove obsolete Version usage from config

The enabling of the TLS verify check (alloy) requires a proper certificate chain on the agent side.

Image update and set auth errors

Full Changelog: 1.11.0...1.11.1

This release updates the base container image to the latest version and sets gRPC authentication error codes.

Enable healthz service

Full Changelog: 1.10.0...1.11.0

This release enables an healthz service endpoint, used for deployment and update verification, and Grafana alerting.

Fine-grained dashboard access

Full Changelog: 1.8.0...1.9.0

This release enables creating role and scope based dashboard tokens.

role	permission
viewer	list agents (default)
operator	list agents, view token
admin	list agents, view token, download config

Scope is limited by a list of agent hostnames or resource Ids.

Note

Updating finchctl is recommended.

Migrate agent basic to token auth

Full Changelog: 1.6.4...1.7.0

Warning

This is a breaking change.

This release migrates the observability agent (alloy) basic auth to token auth. This requires the regeneration and redeploy of any agent configuration.

finchctl agent config \
  --agent-rid rid:finch:8d134b24c2541730:agent:fdbb2c56-354e-4da5-9fef-8db349b3989d \
  --agent.config sparrow.example.com.conf finch.example.com
finchctl agent update \
  --agent.config sparrow.example.com.conf --skip.binaries root@sparrow.example.com

Migrate to basic auth service

Full Changelog: 1.6.3...1.6.4

This release migrates basic authentication from controller-generated credential files to a dedicated Auth HTTP service.

Improve and harden dashboard authentication

Full Changelog: 1.6.2...1.6.3

This release improves and hardens the dashboard authentication, login and logout flow.

Fix dashboard error handling

Full Changelog: 1.6.1...1.6.2

This release fixes the handling of expired dahsboard access tokens.