CHANGELOG.yml

# The YAML in this file should contain:
#
# changelog: An (optional) URL to the CHANGELOG for the product.
# items: An array of releases with the following attributes:
#     - version: The (optional) version number of the release, if applicable.
#     - date: The date of the release in the format YYYY-MM-DD.
#     - notes: An array of noteworthy changes included in the release, each having the following attributes:
#         - type: The type of change, one of `bugfix`, `feature`, `security` or `change`.
#         - title: A short title of the noteworthy change.
#         - body: >-
#             Two or three sentences describing the change and why it
#             is noteworthy.  This is HTML, not plain text or
#             markdown.  It is handy to use YAML's ">-" feature to
#             allow line-wrapping.
#         - image: >-
#             The URL of an image that visually represents the
#             noteworthy change.  This path is relative to the
#             `release-notes` directory; if this file is
#             `FOO/releaseNotes.yml`, then the image paths are
#             relative to `FOO/release-notes/`.
#         - docs: The path to the documentation page where additional information can be found.
#         - href: A path from the root to a resource on the getambassador website, takes precedence over a docs link.
#
# For older changes, see CHANGELOG.OLD.md
docTitle: Telepresence Release Notes
docDescription: >-
  Release notes for Telepresence by Ambassador Labs, a CNCF project
  that enables developers to iterate rapidly on Kubernetes
  microservices by arming them with infinite-scale development
  environments, access to instantaneous feedback loops, and highly
  customizable development environments.
items:
  - version: 2.20.0
    date: (TBD)
    notes:
      - type: feature
        title: Add timestamp to telepresence_logs.zip filename.
        body: >-
          Telepresence is now capable of easily find telepresence gather-logs by certain timestamp.
      - type: feature
        title: Enable intercepts of workloads that have no service.
        body: >-
          Telepresence is now capable of intercepting workloads that have no associated service. The intercept will then target container port
          instead of a service port. The new behavior is enabled by adding a <code>telepresence.getambassador.io/inject-container-ports</code>
          annotation where the value is a comma separated list of port identifiers consisting of either the name or the port number of a container
          port, optionally suffixed with <code>/TCP</code> or <code>/UDP</code>.
      - type: feature
        title: Publish the OSS version of the telepresence Helm chart
        body: >-
          The OSS version of the telepresence helm chart is now available at ghcr.io/telepresenceio/telepresence-oss, and
          can be installed using the command:<br>
          <code>helm install traffic-manager oci://ghcr.io/telepresenceio/telepresence-oss --namespace ambassador --version 2.20.0</code>
          The chart documentation is published at <a href="https://artifacthub.io/packages/helm/telepresence-oss/telepresence-oss">ArtifactHUB</a>.
      - type: feature
        title: Control the syntax of the environment file created with the intercept flag --env-file
        body: >-
          A new <code>--env-syntax &lt;syntax&gt;</code> was introduced to allow control over the syntax of the file created when using the intercept
          flag <code>--env-file &lt;file&gt;</code>. Valid syntaxes are &quot;docker&quot;, &quot;compose&quot;, &quot;sh&quot;, &quot;csh&quot;, &quot;cmd&quot;,
          and &quot;ps&quot;; where &quot;sh&quot;, &quot;csh&quot;, and &quot;ps&quot; can be suffixed with &quot;:export&quot;.
      - type: feature
        title: Add support for Argo Rollout workloads.
        body: >-
          Telepresence now has an opt-in support for Argo Rollout workloads.
          The behavior is controlled by `workloads.argoRollouts.enabled` Helm chart value.
          It is recommended to set the following annotation <code>telepresence.getambassador.io/inject-traffic-agent: enabled</code>
          to avoid creation of unwanted revisions.
      - type: change
        title: Use ghcr.io/telepresenceio instead of docker.io/datawire for OSS images and the telemount Docker volume plugin.
        body: >-
          All OSS telepresence images and the telemount Docker plugin are now published at the public registry ghcr.io/telepresenceio
          and all references from the client and traffic-manager has been updated to use this registry
          instead of the one at docker.io/datawire.
      - title: Use nftables instead of iptables-legacy
        type: change
        body: >-
          Some time ago, we introduced iptables-legacy because users had problems using Telepresence with Fly.io where nftables
          wasn't supported by the kernel. Fly.io has since fixed this, so Telepresence will now use nftables again. This in turn,
          ensures that modern systems that lack support iptables-legacy will work.
      - type: bugfix
        title: Root daemon wouldn't start when sudo timeout was zero.
        body: >-
          The root daemon refused to start when <code>sudo</code> was configured with a <code>timestamp_timeout=0</code>.
          This was due to logic that first requested root privileges using a sudo call, and then relied on that these
          privileges were cached, so that a subsequent call using <code>--non-interactive</code> was guaranteed to succeed.
          This logic will now instead do one single sudo call, and rely solely on sudo to print an informative prompt and
          start the daemon in the background.
      - type: bugfix
        title: Detect minikube network when connecting with --docker
        body: >-
          A <code>telepresence connect --docker</code> failed when attempting to connect to a minikube that
          uses a docker driver because the containerized daemon did not have access to the <code>minikube</code>
          docker network. Telepresence will now detect an attempt to connect to that network and attach it to
          the daemon container as needed.
  - version: 2.19.1
    date: "2024-07-12"
    notes:
      - type: feature
        title: Add brew support for the OSS version of Telepresence.
        body: >-
          The Open-Source Software version of Telepresence can now be installed using the brew formula
          via <code>brew install datawire/blackbird/telepresence-oss</code>.
        docs: https://github.com/telepresenceio/telepresence/issues/3609
      - type: feature
        title: Add --create-namespace flag to the telepresence helm install command.
        body: >-
          A <code>--create-namespace</code> (default <code>true</code>) flag was added to the <code>telepresence helm
          install</code> command. No attempt will be made to create a namespace for the traffic-manager if it is explicitly
          set to <code>false</code>. The command will then fail if the namespace is missing.
      - type: feature
        title: Introduce DNS fallback on Windows.
        body: >-
          A <code>network.defaultDNSWithFallback</code> config option has been introduced on Windows. It will cause the
          DNS-resolver to fall back to the resolver that was first in the list prior to when Telepresence establishes a
          connection. The option is default <code>true</code> since it is believed to give the best experience but can be
          set to <code>false</code> to restore the old behavior.
      - type: feature
        title: Brew now supports MacOS (amd64/arm64) / Linux (amd64)
        body: >-
          The brew formula can now dynamically support MacOS (amd64/arm64) / Linux (amd64) in a single formula
        docs: https://github.com/datawire/homebrew-blackbird/issues/19
      - type: feature
        title: Add ability to provide an externally-provisioned webhook secret
        body: >-
          Added <code>supplied</code> as a new option for <code>agentInjector.certificate.method</code>.
          This fully disables the generation of the Mutating Webhook's secret, allowing the chart to use the values of a
          pre-existing secret named <code>agentInjector.secret.name</code>. Previously, the install would fail when it
          attempted to create or update the externally-managed secret.
      - type: feature
        title: Let PTR query for DNS server return the cluster domain.
        body: >-
          The <code>nslookup</code> program on Windows uses a PTR query to retrieve its displayed "Server" property.
          This Telepresence DNS resolver will now return the cluster domain on such a query.
      - type: feature
        title: Add scheduler name to PODs templates.
        body: >-
          A new Helm chart value <code>schedulerName</code> has been added. With this feature, we are
          able to define some particular schedulers from Kubernetes to apply some different strategies to allocate telepresence resources,
          including the Traffic Manager and hooks pods.
      - type: bugfix
        title: Race in traffic-agent injector when using inject annotation
        body: >-
          Applying multiple deployments that used the <code>telepresence.getambassador.io/inject-traffic-agent: enabled</code> would cause
          a race condition, resulting in a large number of created pods that eventually had to be deleted, or sometimes in
          pods that didn't contain a traffic agent.
      - type: bugfix
        title: Fix configuring custom agent security context
        body: ->
          The traffic-manager helm chart will now correctly use a custom agent security context if one is provided.
  - version: 2.19.0
    date: "2024-06-15"
    notes:
      - type: feature
        title: Warn when an Open Source Client connects to an Enterprise Traffic Manager.
        body: >-
          The difference between the OSS and the Enterprise offering is not well understood, and OSS users often install
          a traffic-manager using the Helm chart published at getambassador.io. This Helm chart installs an enterprise
          traffic-manager, which is probably not what the user would expect. Telepresence will now warn when an OSS client
          connects to an enterprise traffic-manager and suggest switching to an enterprise client, or use
          <code>telepresence helm install</code> to install an OSS traffic-manager.
      - type: feature
        title: Add scheduler name to PODs templates.
        body: >-
          A new Helm chart value <code>schedulerName</code> has been added. With this feature, we are
          able to define some particular schedulers from Kubernetes to apply some different strategies to allocate telepresence resources,
          including the Traffic Manager and hooks pods.
      - type: bugfix
        title: Improve traffic-manager performance in very large clusters.
        body: ->
          The traffic-manager will now use a shared-informer when keeping track of deployments. This will significantly
          reduce the load on the Kublet in large clusters and therefore lessen the risk for the traffic-manager being
          throttled, which can lead to other problems.
      - type: bugfix
        title: Kubeconfig exec authentication failure when connecting with --docker from a WSL linux host
        body: >-
          Clusters like Amazon EKS often use a special authentication binary that is declared in the kubeconfig using an
          <code>exec</code> authentication strategy. This binary is normally not available inside a container. Consequently,
          a modified kubeconfig is used when <code>telepresence connect --docker</code> executes, appointing a <code>kubeauth
          </code> binary which instead retrieves the authentication from a port on the Docker host that communicates with another
          process outside of Docker. This process then executes the original <code>exec</code> command to retrieve the necessary
          credentials.

          This setup was problematic when using WSL, because even though <code>telepresence connect --docker</code> was executed on
          a Linux host, the Docker host available from <code>host.docker.internal</code> that the <code>kubeauth</code> connected to
          was the Windows host running Docker Desktop. The fix for this was to use the local IP of the default route instead of
          <code>host.docker.internal</code> when running under WSL..
  - version: 2.18.6
    date: (TBD)
    notes:
      - type: bugfix
        title: Fix bug in workload cache, causing endless recursion when a workload uses the same name as its owner.
        body: >-
          The workload cache was keyed by name and namespace, but not by kind, so a workload named the same as its
          owner workload would be found using the same key. This led to the workload finding itself when looking up
          its owner, which in turn resulted in an endless recursion when searching for the topmost owner.
      - type: bugfix
        title: FailedScheduling events mentioning node availability considered fatal when waiting for agent to arrive.
        body: >-
          The traffic-manager considers some events as fatal when waiting for a traffic-agent to arrive after an injection
          has been initiated. This logic would trigger on events like &quot;Warning FailedScheduling 0/63 nodes are
          available&quot; although those events indicate a recoverable condition and kill the wait. This is now fixed so
          that the events are logged but the wait continues.
  - version: 2.18.5
    date: (TBD)
    notes:
      - type: bugfix
        title: Improve how the traffic-manager resolves DNS when no agent is installed.
        body: >-
          The traffic-manager is typically installed into a namespace different from the one that clients are
          connected to. It's therefore important that the traffic-manager adds the client's namespace when
          resolving single label names in situations where there are any agents to dispatch the DNS query to.
      - type: change
        title: Removal of ability import legacy artifact into Helm.
        body: >-
          A helm install would make attempts to find manually installed artifacts and make them managed by
          Helm by adding the necessary labels and annotations. This was important when the Helm chart was first
          introduced but is far less so today, and this legacy import was therefore removed.
      - type: bugfix
        title: Docker aliases deprecation caused failure to detect Kind cluster.
        body: >-
          The logic for detecting if a cluster is a local Kind cluster, and therefore needs some special attention when
          using <code>telepresence connect --docker</code>, relied on the presence of <code>Aliases</code> in the Docker
          network that a Kind cluster sets up. In Docker versions from 26 and up, this value is no longer used, but the
          corresponding info can instead be found in the new <code>DNSNames</code> field.
        docs: https://docs.docker.com/engine/deprecated/#container-short-id-in-network-aliases-field
      - type: bugfix
        title: Include svc as a top-level domain in the DNS resolver.
        body: >-
          It's not uncommon that use-cases involving Kafka or other middleware use FQNs that end with
          &quot;svc&quot;. The core-DNS resolver in Kubernetes can resolve such names. With this bugfix,
          the Telepresence DNS resolver will also be able to resolve them, and thereby remove the need
          to add &quot;.svc&quot; to the include-suffix list.
        docs: https://github.com/telepresenceio/telepresence/issues/2814
      - type: feature
        title: Add ability to enable/disable the mutating webhook.
        body: >-
          A new Helm chart boolean value <code>agentInjector.enable</code> has been added that controls the agent-injector
          service and its associated mutating webhook. If set to <code>false</code>, the service, the webhook, and the
          secrets and certificates associated with it, will no longer be installed.
      - type: feature
        title: Add ability to mount a webhook secret.
        body: >-
          A new Helm chart value <code>agentInjector.certificate.accessMethod</code> which can be set to <code>watch</code>
          (the default) or <code>mount</code> has been added. The <code>mount</code> setting is intended for clusters with
          policies that prevent containers from doing a <code>get</code>, <code>list</code> or <code>watch</code> of a
          <code>Secret</code>, but where a latency of up to 90 seconds is acceptable between the time the secret is
          regenerated and the agent-injector picks it up.
      - type: feature
        title: Make it possible to specify ignored volume mounts using path prefix.
        body: >-
          Volume mounts like <code>/var/run/secrets/kubernetes.io</code> are not declared in the workload. Instead, they
          are injected during pod-creation and their names are generated. It is now possible to ignore such mounts using a
          matching path prefix.
      - type: feature
        title: Make the telemount Docker Volume plugin configurable
        body: >-
          A <code>telemount</code> object was added to the <code>intercept</code> object in <code>config.yml</code>
          (or Helm value <code>client.intercept</code>), so that the automatic download and installation of this plugin can
          be fully customised.
      - type: feature
        title: Add option to load the kubeconfig yaml from stdin during connect.
        body: >-
          This allows another process with a kubeconfig already loaded in memory
          to directly pass it to <code>telepresence connect</code> without needing a separate
          file. Simply use a dash "-" as the filename for the <code>--kubeconfig</code> flag.
      - type: feature
        title: Add ability to specify agent security context.
        body: >-
          A new Helm chart value <code>agent.securityContext</code> that will allow configuring the security context of
          the injected traffic agent.  The value can be set to a valid Kubernetes securityContext object, or can be set
          to an empty value (<code>{}</code>) to ensure the agent has no defined security context.  If no value is specified,
          the traffic manager will set the agent's security context to the same as the first container's of the workload
          being injected into.
      - type: change
        title: Tracing is no longer enabled by default.
        body: >-
          Tracing must now be enabled explicitly in order to use the <code>telepresence gather-traces</code>
          command.
      - type: change
        title: Removal of timeouts that are no longer in use
        body: >-
          The <code>config.yml</code> values <code>timeouts.agentInstall</code> and <code>timeouts.apply</code> haven't
          been in use since versions prior to 2.6.0, when the client was responsible for installing the traffic-agent.
          These timeouts are now removed from the code-base, and a warning will be printed when attempts are made to use
          them.
      - type: bugfix
        title: Search all private subnets to find one open for dnsServerSubnet
        body: >-
          This resolves a bug that did not test all subnets in a private range, sometimes resulting in the warning,
          "DNS doesn't seem to work properly."
  - version: 2.18.4
    date: (TBD)
    notes:
      - type: bugfix
        title: Docker aliases deprecation caused failure to detect Kind cluster.
        body: >-
          The logic for detecting if a cluster is a local Kind cluster, and therefore needs some special attention when
          using <code>telepresence connect --docker</code>, relied on the presence of <code>Aliases</code> in the Docker
          network that a Kind cluster sets up. In Docker versions from 26 and up, this value is no longer used, but the
          corresponding info can instead be found in the new <code>DNSNames</code> field.
  - version: 2.18.3
    date: (TBD)
    notes:
      - type: bugfix
        title: Creation of individual pods was blocked by the agent-injector webhook.
        body: >-
          An attempt to create a pod was blocked unless it was provided by a workload. Hence, commands like
          <code>kubectl run -i busybox --rm --image=curlimages/curl --restart=Never -- curl echo-easy.default</code>
          would be blocked from executing.
  - version: 2.18.2
    date: (TBD)
    notes:
      - type: bugfix
        title: Fix panic due to root daemon not running.
        body: >-
          If a <code>telepresence connect</code> was made at a time when the root daemon was not running (an abnormal
          condition) and a subsequent intercept was then made, a panic would occur when the port-forward to the agent
          was set up. This is now fixed so that the initial <code>telepresence connect</code> is refused unless the root
          daemon is running.
  - version: 2.18.1
    date: (TBD)
    notes:
      - type: bugfix
        title: Get rid of telemount plugin stickiness
        body: >-
          The <code>datawire/telemount</code> that is automatically downloaded and installed, would never be
          updated once the installation was made. Telepresence will now check for the latest release of the
          plugin and cache the result of that check for 24 hours. If a new version arrives, it will be
          installed and used.
      - type: bugfix
        title: Use route instead of address for CIDRs with masks that don't allow "via"
        body: >-
          A CIDR with a mask that leaves less than two bits (/31 or /32 for IPv4)
          cannot be added as an address to the VIF, because such addresses must
          have bits allowing a "via" IP.

          The logic was modified to allow such CIDRs to become static routes, using the
          VIF base address as their "via", rather than being VIF addresses in their own right.
      - type: bugfix
        title: Containerized daemon created cache files owned by root
        body: >-
          When using <code>telepresence connect --docker</code> to create a containerized daemon, that
          daemon would sometimes create files in the cache that were owned by root, which then caused
          problems when connecting without the <code>--docker</code> flag.
      - type: bugfix
        title: Remove large number of requests when traffic-manager is used in large clusters.
        body: >-
          The traffic-manager would make a very large number of API requests during cluster start-up
          or when many services were changed for other reasons. The logic that did this was refactored
          and the number of queries were significantly reduced.
      - type: bugfix
        title: Don't patch probes on replaced containers.
        body: >-
          A container that is being replaced by a <code>telepresence intercept --replace</code>
          invocation will have no liveness-, readiness, nor startup-probes. Telepresence didn't
          take this into consideration when injecting the traffic-agent, but now it will refrain
          from patching symbolic port names of those probes.
      - type: bugfix
        title: Don't rely on context name when deciding if a kind cluster is used.
        body: >-
          The code that auto-patches the kubeconfig when connecting to a kind cluster from within
          a docker container, relied on the context name starting with "kind-", but although all
          contexts created by kind have that name, the user is still free to rename it or to create
          other contexts using the same connection properties. The logic was therefore changed
          to instead look for a loopback service address.
  - version: 2.18.0
    date: "2024-02-09"
    notes:
      - type: feature
        title: Include the image for the traffic-agent in the output of the version and status commands.
        body: >-
          The version and status commands will now output the image that the traffic-agent will be using when injected
          by the agent-injector.
      - type: feature
        title: Custom DNS using the client DNS resolver.
        body: >-
          <p>A new <code>telepresence connect --proxy-via CIDR=WORKLOAD</code> flag was introduced, allowing Telepresence
          to translate DNS responses matching specific subnets into virtual IPs that are used locally. Those virtual IPs
          are then routed (with reverse translation) via the pod's of a given workload. This makes it possible to handle
          custom DNS servers that resolve domains into loopback IPs. The flag may also be used in cases where the
          cluster's subnets are in conflict with the workstation's VPN.</p>
          <p>The CIDR can also be a symbolic name that identifies a subnet or list of subnets:<table>
          <tr><td><code>also</code></td><td>All subnets added with --also-proxy</td></tr>
          <tr><td><code>service</code></td><td>The cluster's service subnet</td></tr>
          <tr><td><code>pods</code></td><td>The cluster's pod subnets.</td></tr>
          <tr><td><code>all</code></td><td>All of the above.</td></tr>
          </table></p>
      - type: bugfix
        title: Ensure that agent.appProtocolStrategy is propagated correctly.
        body: >-
          The <code>agent.appProtocolStrategy</code> was inadvertently dropped when moving license related code fromm the
          OSS repository the repository for the Enterprise version of Telepresence. It has now been restored.
      - type: bugfix
        title: Include non-default zero values in output of telepresence config view.
        body: >-
          The <code>telepresence config view</code> command will now print zero values in the output when
          the default for the value is non-zero.
      - type: bugfix
        title: Restore ability to run the telepresence CLI in a docker container.
        body: >-
          The improvements made to be able to run the telepresence daemon in docker
          using <code>telepresence connect --docker</code> made it impossible to run
          both the CLI and the daemon in docker. This commit fixes that and
          also ensures that the user- and root-daemons are merged in this
          scenario when the container runs as root.
      - type: bugfix
        title: Remote mounts when intercepting with the --replace flag.
        body: >-
          A <code>telepresence intercept --replace</code> did not correctly mount all volumes, because when the
          intercepted container was removed, its mounts were no longer visible to the agent-injector when it
          was subjected to a second invocation. The container is now kept in place, but with an image that
          just sleeps infinitely.
      - type: bugfix
        title: Intercepting with the --replace flag will no longer require all subsequent intercepts to use --replace.
        body: >-
          A <code>telepresence intercept --replace</code> will no longer switch the mode of the intercepted workload,
          forcing all subsequent intercepts on that workload to use <code>--replace</code> until the agent is
          uninstalled. Instead, <code>--replace</code> can be used interchangeably just like any other intercept flag.
      - type: bugfix
        title: Kubeconfig exec authentication with context names containing colon didn't work on Windows
        body: >-
          The logic added to allow the root daemon to connect directly to the cluster using the user daemon as a proxy
          for exec type authentication in the kube-config, didn't take into account that a context name sometimes
          contains the colon ":" character. That character cannot be used in filenames on windows because it is the
          drive letter separator.
      - type: bugfix
        title: Provide agent name and tag as separate values in Helm chart
        body: >-
          The <code>AGENT_IMAGE</code> was a concatenation of the agent's name and tag. This is now changed so that the
          env instead contains an <code>AGENT_IMAGE_NAME</code> and <code>AGENT_INAGE_TAG</code>. The <code>AGENT_IMAGE
          </code> is removed. Also, a new env <code>REGISTRY</code> is added, where the registry of the traffic-
          manager image is provided. The <code>AGENT_REGISTRY</code> is no longer required
          and will default to <code>REGISTRY</code> if not set.
      - type: bugfix
        title: Environment interpolation expressions were prefixed twice.
        body: >-
          Telepresence would sometimes prefix environment interpolation expressions in the traffic-agent twice so
          that an expression that looked like <code>$(SOME_NAME)</code> in the app-container, ended up as <code>
          $(_TEL_APP_A__TEL_APP_A_SOME_NAME)</code> in the corresponding expression in the traffic-agent.
      - type: bugfix
        title: Panic in root-daemon on darwin workstations with full access to cluster network.
        body: >-
          A darwin machine with full access to the cluster's subnets will never create a TUN-device, and a check was
          missing if the device actually existed, which caused a panic in the root daemon.
      - type: bugfix
        title: Show allow-conflicting-subnets in telepresence status and telepresence config view.
        body: >-
          The <code>telepresence status</code> and <code>telepresence config view</code> commands didn't show the
          <code>allowConflictingSubnets</code> CIDRs because the value wasn't propagated correctly to the CLI.
      - type: feature
        title: It is now possible use a host-based connection and containerized connections simultaneously.
        body: >-
          Only one host-based connection can exist because that connection will alter the DNS to reflect the namespace
          of the connection. but it's now possible to create additional connections using <code>--docker</code> while
          retaining the host-based connection.
      - type: feature
        title: Ability to set the hostname of a containerized daemon.
        body: >-
          The hostname of a containerized daemon defaults to be the container's ID in Docker. You now can override the
          hostname using <code>telepresence connect --docker --hostname &lt;a name&gt;</code>.
      - type: feature
        title: New <code>--multi-daemon</code>flag to enforce a consistent structure for the status command output.
        body: >-
          The output of the <code>telepresence status</code> when using <code>--output json</code> or <code>--output
          yaml</code> will either show an object where the <code>user_daemon</code> and <code>root_daemon</code>
          are top level elements, or when multiple connections are used, an object where a <code>connections</code>
          list contains objects with those daemons. The flag <code>--multi-daemon</code> will enforce the latter
          structure even when only one daemon is connected so that the output can be parsed consistently. The reason
          for keeping the former structure is to retain backward compatibility with existing parsers.
      - type: bugfix
        title: Make output from telepresence quit more consistent.
        body: >-
          A quit (without -s) just disconnects the host user and root daemons but will quit a container based daemon.
          The message printed was simplified to remove some have/has is/are errors caused by the difference.
      - type: bugfix
        title: "Fix &quot;tls: bad certificate&quot; errors when refreshing the mutator-webhook secret"
        body: >-
          The <code>agent-injector</code> service will now refresh the secret used by the <code>mutator-webhook</code>
          each time a new connection is established, thus preventing the certificates to go out-of-sync when
          the secret is regenerated.
      - type: bugfix
        title: Keep telepresence-agents configmap in sync with pod states.
        body: >-
          An intercept attempt that resulted in a timeout due to failure of injecting the traffic-agent left the
          <code>telepresence-agents</code> configmap in a state that indicated that an agent had been added, which
          caused problems for subsequent intercepts after the problem causing the first failure had been fixed.
      - type: bugfix
        title: The <code>telepresence status</code> command will now report the status of all running daemons.
        body: >-
          A <code>telepresence status</code>, issued when multiple containerized daemons were active, would error with
          &quot;multiple daemons are running, please select one using the --use &lt;match&gt; flag&quot;. This is now
          fixed so that the command instead reports the status of all running daemons.
      - type: bugfix
        title: The <code>telepresence version</code> command will now report the version of all running daemons.
        body: >-
          A <code>telepresence version</code>, issued when multiple containerized daemons were active, would error with
          &quot;multiple daemons are running, please select one using the --use &lt;match&gt; flag&quot;. This is now
          fixed so that the command instead reports the version of all running daemons.
      - type: bugfix
        title: Multiple containerized daemons can now be disconnected using <code>telepresence quit -s</code>
        body: >-
          A <code>telepresence quit -s</code>, issued when multiple containerized daemons were active, would error with
          &quot;multiple daemons are running, please select one using the --use &lt;match&gt; flag&quot;. This is now
          fixed so that the command instead quits all daemons.
      - type: bugfix
        title: The DNS search path on Windows is now restored when Telepresence quits
        body: >-
          The DNS search path that Telepresence uses to simulate the DNS lookup functionality in the connected
          cluster namespace was not removed by a <code>telepresence quit</code>, resulting in connectivity problems
          from the workstation. Telepresence will now remove the entries that it has added to the search list when
          it quits.
      - type: bugfix
        title: The user-daemon would sometimes get killed when used by multiple simultaneous CLI clients.
        body: >-
          The user-daemon would die with a fatal &quot;fatal error: concurrent map writes&quot; error in the
          <code>connector.log</code>, effectively killing the ongoing connection.
      - type: bugfix
        title: Multiple services ports using the same target port would not get intercepted correctly.
        body: >-
          Intercepts didn't work when multiple service ports were using the same container port. Telepresence would
          think that one of the ports wasn't intercepted and therefore disable the intercept of the container port.
      - type: bugfix
        title: Root daemon refuses to disconnect.
        body: >-
          The root daemon would sometimes hang forever when attempting to disconnect due to a deadlock in
          the VIF-device.
      - type: bugfix
        title: Fix panic in user daemon when traffic-manager was unreachable
        body: >-
          The user daemon would panic if the traffic-manager was unreachable. It will now instead report
          a proper error to the client.
      - type: change
        title: Removal of backward support for versions predating 2.6.0
        body: >-
          The telepresence helm installer will no longer discover and convert workloads that were modified by versions
          prior to 2.6.0. The traffic manager will and no longer support the muxed tunnels used in versions prior to
          2.5.0.
  - version: 2.17.0
    date: "2023-11-14"
    notes:
      - type: feature
        title: Additional Prometheus metrics to track intercept/connect activity
        body: >-
          This feature adds the following metrics to the Prometheus endpoint: <code>connect_count</code>,
          <code>connect_active_status</code>, <code>intercept_count</code>, and <code>intercept_active_status</code.
          These are labeled by client/install_id.
          Additionally, the <code>intercept_count</code> metric has been renamed to <code>active_intercept_count</code>
          for clarity.
      - type: feature
        title: Make the Telepresence client docker image configurable.
        body: >-
          The docker image used when running a Telepresence intercept in docker mode can now be configured using
          the setting <code>images.clientImage</code> and will default first to the value of the environment <code>
          TELEPRESENCE_CLIENT_IMAGE</code>, and then to the value preset by the telepresence binary. This
          configuration setting is primarily intended for testing purposes.
      - type: feature
        title: Use traffic-agent port-forwards for outbound and intercepted traffic.
        body: >-
          The telepresence TUN-device is now capable of establishing direct port-forwards to a traffic-agent in the
          connected namespace. That port-forward is then used for all outbound traffic to the device, and also for
          all traffic that arrives from intercepted workloads. Getting rid of the extra hop via the traffic-manager
          improves performance and reduces the load on the traffic-manager. The feature can only be used if the client
          has Kubernetes port-forward permissions to the connected namespace. It can be disabled by setting <code>
          cluster.agentPortForward</code> to <code>false</code> in <code>config.yml</code>.
      - type: feature
        title: Improve outbound traffic performance.
        body: >-
          The root-daemon now communicates directly with the traffic-manager instead of routing all outbound traffic
          through the user-daemon. The root-daemon uses a patched kubeconfig where <code>exec</code> configurations to
          obtain credentials are dispatched to the user-daemon. This to ensure that all authentication plugins will
          execute in user-space. The old behavior of routing everything through the user-daemon can be restored by
          setting <code>cluster.connectFromRootDaemon</code> to <code>false</code> in <code>config.yml</code>.
      - type: feature
        title: New networking CLI flag --allow-conflicting-subnets
        body: >-
          telepresence connect (and other commands that kick off a connect) now accepts an --allow-conflicting-subnets
          CLI flag. This is equivalent to client.routing.allowConflictingSubnets in the helm chart, but can be specified
          at connect time. It will be appended to any configuration pushed from the traffic manager.
      - type: change
        title: Warn if large version mismatch between traffic manager and client.
        body: >-
          Print a warning if the minor version diff between the client and the traffic manager is greater than three.
      - type: change
        title: The authenticator binary was removed from the docker image.
        body: >-
          The <code>authenticator</code> binary, used when serving proxied <code>exec</code> kubeconfig credential
          retrieval, has been removed. The functionality was instead added as a subcommand to the <code>telepresence
          </code> binary.
  - version: 2.16.1
    date: "2023-10-12"
    notes:
      - type: feature
        title: Add --docker-debug flag to the telepresence intercept command.
        body: >-
          This flag is similar to <code>--docker-build</code> but will start the container with more relaxed security
          using the <code>docker run</code> flags <code>--security-opt apparmor=unconfined --cap-add SYS_PTRACE</code>.
      - type: feature
        title: Add a --export option to the telepresence connect command.
        body: >-
          In some situations it is necessary to make some ports available to the
          host from a containerized telepresence daemon. This commit adds a
          repeatable <code>--expose &lt;docker port exposure&gt;</code> flag to the connect
          command.
      - type: feature
        title: Prevent agent-injector webhook from selecting from kube-xxx namespaces.
        body: >-
          The <code>kube-system</code> and <code>kube-node-lease</code> namespaces should not be affected by a
          global agent-injector webhook by default. A default <code>namespaceSelector</code> was therefore added
          to the Helm Chart <code>agentInjector.webhook</code> that contains a <code>NotIn</code> preventing those
          namespaces from being selected.
      - type: bugfix
        title: Backward compatibility for pod template TLS annotations.
        body: >-
          Users of Telepresence < 2.9.0 that make use of the pod template TLS annotations were unable to upgrade because
          the annotation names have changed (now prefixed by "telepresence."), and the environment expansion of the
          annotation values was dropped. This fix restores support for the old names (while retaining the new ones) and
          the environment expansion.
      - type: security
        title: Built with go 1.21.3
        body: >-
          Built Telepresence with go 1.21.3 to address CVEs.
      - type: bugfix
        title: Match service selector against pod template labels
        body: >-
          When listing intercepts (typically by calling <code>telepresence list</code>) selectors of services are matched
          against workloads. Previously the match was made against the labels of the workload, but now they are matched
          against the labels pod template of the workload. Since the service would actually be matched against pods this
          is more correct. The most common case when this makes a difference is that statefulsets now are listed when they should.
  - version: 2.16.0
    date: "2023-10-02"
    notes:
      - type: bugfix
        title: The helm sub-commands will no longer start the user daemon.
        body: >-
          The <code>telepresence helm install/upgrade/uninstall</code> commands will no longer start the telepresence
          user daemon because there's no need to connect to the traffic-manager in order for them to execute.
      - type: bugfix
        title: Routing table race condition
        body: >-
          A race condition would sometimes occur when a Telepresence TUN device was deleted and another created in rapid
          succession that caused the routing table to reference interfaces that no longer existed.
      - type: bugfix
        title: Stop lingering daemon container
        body: >-
          When using <code>telepresence connect --docker</code>, a lingering container could be present, causing errors
          like &quot;The container name NN is already in use by container XX ...&quot;. When this happens, the connect
          logic will now give the container some time to stop and then call <code>docker stop NN</code> to stop it
          before retrying to start it.
      - type: bugfix
        title: Add file locking to the Telepresence cache
        body: >-
          Files in the Telepresence cache are accesses by multiple processes. The processes will now use advisory
          locks on the files to guarantee consistency.
      - type: change
        title: Lock connection to namespace
        body: >-
          The behavior changed so that a connected Telepresence client is bound to a namespace. The namespace can then
          not be changed unless the client disconnects and reconnects. A connection is also given a name. The default
          name is composed from <code>&lt;kube context name&gt;-&lt;namespace&gt;</code> but can be given explicitly
          when connecting using <code>--name</code>. The connection can optionally be identified using the option
          <code>--use &lt;name match&gt;</code> (only needed when docker is used and more than one connection is active).
      - type: change
        title: Deprecation of global --context and --docker flags.
        body: >-
          The global flags <code>--context</code> and <code>--docker</code> will now be considered deprecated unless used
          with commands that accept the full set of Kubernetes flags (e.g. <code>telepresence connect</code>).
      - type: change
        title: Deprecation of the --namespace flag for the intercept command.
        body: >-
          The <code>--namespace</code> flag is now deprecated for <code>telepresence intercept</code> command. The flag can instead
          be used with all commands that accept the full set of Kubernetes flags (e.g. <code>telepresence connect</code>).
      - type: change
        title: Legacy code predating version 2.6.0 was removed.
        body: >-
          The telepresence code-base still contained a lot of code that would modify workloads instead of relying on
          the mutating webhook installer when a traffic-manager version predating version 2.6.0 was discovered. This
          code has now been removed.
      - type: feature
        title: Add `telepresence list-namespaces` and `telepresence list-contexts` commands
        body: >-
          These commands can be used to check accessible namespaces and for automation.
      - type: change
        title: Implicit connect warning
        body: >-
          A deprecation warning will be printed if a command other than <code>telepresence connect</code> causes an
          implicit connect to happen. Implicit connects will be removed in a future release.
  - version: 2.15.1
    date: "2023-09-06"
    notes:
      - type: security
        title: Rebuild with go 1.21.1
        body: >-
          Rebuild Telepresence with go 1.21.1 to address CVEs.
      - type: security
        title: Set security context for traffic agent
        body: >-
          Openshift users reported that the traffic agent injection was failing due to a missing security context.
  - version: 2.15.0
    date: "2023-08-29"
    notes:
      - type: security
        title: Add ASLR to telepresence binaries
        body: >-
          ASLR hardens binary sercurity against fixed memory attacks.
      - type: feature
        title: Added client builds for arm64 architecture.
        body: >-
          Updated the release workflow files in github actions to including building and publishing the client binaries for arm64 architecture.
        docs: https://github.com/telepresenceio/telepresence/issues/3259
      - type: bugfix
        title: KUBECONFIG env var can now be used with the docker mode.
        body: >-
          If provided, the KUBECONFIG environment variable was passed to the kubeauth-foreground service as a parameter.
          However, since it didn't exist, the CLI was throwing an error when using <code>telepresence connect --docker</code>.
        docs: https://github.com/telepresenceio/telepresence/pull/3300
      - type: bugfix
        title: Fix deadlock while watching workloads
        body: >-
          The <code>telepresence list --output json-stream</code> wasn't releasing the session's lock after being
          stopped, including with a <code>telepresence quit</code>. The user could be blocked as a result.
        docs: https://github.com/telepresenceio/telepresence/pull/3298
      - type: bugfix
        title: Change json output of telepresence list command
        body: >-
          Replace deprecated info in the JSON output of the telepresence list command.
  - version: 2.14.4
    date: "2023-08-21"
    notes:
      - type: bugfix
        title: Nil pointer exception when upgrading the traffic-manager.
        body: >-
          Upgrading the traffic-manager using <code>telepresence helm upgrade</code> would sometimes
          result in a helm error message <q>executing "telepresence/templates/intercept-env-configmap.yaml"
          at <.Values.intercept.environment.excluded>: nil pointer evaluating interface {}.excluded"</q>
        docs: https://github.com/telepresenceio/telepresence/issues/3313
  - version: 2.14.2
    date: "2023-07-26"
    notes:
      - type: bugfix
        title: Telepresence now use the OSS agent in its latest version by default.
        body: >-
          The traffic manager admin was forced to set it manually during the chart installation.
        docs: https://github.com/telepresenceio/telepresence/issues/3271
  - version: 2.14.1
    date: "2023-07-07"
    notes:
      - type: feature
        title: Envoy's http idle timout is now configurable.
        body: >-
          A new <code>agent.helm.httpIdleTimeout</code> setting was added to the Helm chart that controls
          the proprietary Traffic agent's http idle timeout. The default of one hour, which in some situations
          would cause a lot of resource consuming and lingering connections, was changed to 70 seconds.
      - type: feature
        title: Add more gauges to the Traffic manager's Prometheus client.
        body: >-
          Several gauges were added to the Prometheus client to make it easier to monitor
          what the Traffic manager spends resources on.
      - type: feature
        title: Agent Pull Policy
        body: >-
          Add option to set traffic agent pull policy in helm chart.
      - type: bugfix
        title: Resource leak in the Traffic manager.
        body: >-
          Fixes a resource leak in the Traffic manager caused by lingering tunnels between the clients and
          Traffic agents. The tunnels are now closed correctly when terminated from the side that created them.
      - type: bugfix
        title: Fixed problem setting traffic manager namespace using the kubeconfig extension.
        body: >-
          Fixes a regression introduced in version 2.10.5, making it impossible to set the traffic-manager namespace
          using the telepresence.io kubeconfig extension.
        docs: https://www.getambassador.io/docs/telepresence/latest/reference/config#manager
  - version: 2.14.0
    date: "2023-06-12"
    notes:
      - type: feature
        title: DNS configuration now supports excludes and mappings.
        body: >-
          The DNS configuration now supports two new fields, excludes and mappings. The excludes field allows you to
          exclude a given list of hostnames from resolution, while the mappings field can be used to resolve a hostname with
          another.
        docs: https://github.com/telepresenceio/telepresence/pull/3172

      - type: feature
        title: Added the ability to exclude environment variables
        body: >-
          Added a new config map that can take an array of environment variables that will
          then be excluded from an intercept that retrieves the environment of a pod.

      - type: bugfix
        title: Fixed traffic-agent backward incompatibility issue causing lack of remote mounts
        body: >-
          A traffic-agent of version 2.13.3 (or 1.13.15) would not propagate the directories under
          <code>/var/run/secrets</code> when used with a traffic manager older than 2.13.3.

      - type: bugfix
        title: Fixed race condition causing segfaults on rare occasions when a tunnel stream timed out.
        body: >-
          A context cancellation could sometimes be trapped in a stream reader, causing it to incorrectly return
          an undefined message which in turn caused the parent reader to panic on a <code>nil</code> pointer reference.
        docs: https://github.com/telepresenceio/telepresence/pull/2963

      - type: change
        title: Routing conflict reporting.
        body: >-
          Telepresence will now attempt to detect and report routing conflicts with other running VPN software on client machines.
          There is a new configuration flag that can be tweaked to allow certain CIDRs to be overridden by Telepresence.

      - type: change
        title: test-vpn command deprecated
        body: >-
          Running telepresence test-vpn will now print a deprecation warning and exit. The command will be removed in a future release.
          Instead, please configure telepresence for your VPN's routes.
  - version: 2.13.3
    date: "2023-05-25"
    notes:
      - type: feature
        title: Add imagePullSecrets to hooks
        body: >-
          Add .Values.hooks.curl.imagePullSecrets and .Values.hooks curl.imagePullSecrets to Helm values.
        docs: https://github.com/telepresenceio/telepresence/pull/3079

      - type: change
        title: Change reinvocation policy to Never for the mutating webhook
        body: >-
          The default setting of the reinvocationPolicy for the mutating webhook dealing with agent injections changed from Never to IfNeeded.

      - type: bugfix
        title: Fix mounting fail of IAM roles for service accounts web identity token
        body: >-
          The eks.amazonaws.com/serviceaccount volume injected by EKS is now exported and remotely mounted during an intercept.
        docs: https://github.com/telepresenceio/telepresence/issues/3166

      - type: bugfix
        title: Correct namespace selector for cluster versions with non-numeric characters
        body: >-
          The mutating webhook now correctly applies the namespace selector even if the cluster version contains non-numeric characters. For example, it can now handle versions such as Major:"1", Minor:"22+".
        docs: https://github.com/telepresenceio/telepresence/pull/3184

      - type: bugfix
        title: Enable IPv6 on the telepresence docker network
        body: >-
          The "telepresence" Docker network will now propagate DNS AAAA queries to the Telepresence DNS resolver when it runs in a Docker container.
        docs: https://github.com/telepresenceio/telepresence/issues/3179

      - type: bugfix
        title: Fix the crash when intercepting with --local-only and --docker-run
        body: >-
          Running telepresence intercept --local-only --docker-run no longer  results in a panic.
        docs: https://github.com/telepresenceio/telepresence/issues/3171

      - type: bugfix
        title: Fix incorrect error message with local-only mounts
        body: >-
          Running telepresence intercept --local-only --mount false no longer results in an incorrect error message saying "a local-only intercept cannot have mounts".
        docs: https://github.com/telepresenceio/telepresence/issues/3171

      - type: bugfix
        title: specify port in hook urls
        body: >-
          The helm chart now correctly handles custom agentInjector.webhook.port that was not being set in hook URLs.
        docs: https://github.com/telepresenceio/telepresence/pull/3161

      - type: bugfix
        title: Fix wrong default value for disableGlobal and agentArrival
        body: >-
          Params .intercept.disableGlobal and .timeouts.agentArrival are now correctly honored.