diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 043f9bd50..4ce352921 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -7,9 +7,9 @@ jobs:
pre-commit:
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v3
with:
fetch-depth: 0
- - uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507
+ - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd #3.0.1
with:
extra_args: --show-diff-on-failure --from-ref ${{ github.event.pull_request.base.sha }} --to-ref ${{ github.event.pull_request.head.sha }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 346fc7c53..ed3b668e0 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -4,10 +4,10 @@ repos:
hooks:
- id: prettier
additional_dependencies:
- - 'prettier@2.7.1'
+ - 'prettier@3.4.2'
files: ^content\/.*$
- exclude: content/docs/k8s/reference.md
+ exclude: content/docs/deploy/k8s/reference.md
- repo: https://github.com/streetsidesoftware/cspell-cli
- rev: v6.2.0
+ rev: v8.17.0
hooks:
- id: cspell
diff --git a/README.md b/README.md
index b28e2e3af..2bb4b9e7a 100644
--- a/README.md
+++ b/README.md
@@ -6,8 +6,6 @@ Pomerium's documentation is built using [Docusaurus 2](https://docusaurus.io/).
## Contributing
-See [Contributing](https://pomerium.com/docs/community/contributing) for more information on contributing to this project.
-
The steps below detail the installation of this site locally for development.
### Installation
diff --git a/content/_generate-recovery-token.md b/content/docs/admonitions/_generate-recovery-token.md
similarity index 93%
rename from content/_generate-recovery-token.md
rename to content/docs/admonitions/_generate-recovery-token.md
index fce2b2717..c8340fc98 100644
--- a/content/_generate-recovery-token.md
+++ b/content/docs/admonitions/_generate-recovery-token.md
@@ -1,6 +1,6 @@
In the event that you lose access to the console via delegated access (the policy defined in Pomerium), there exists a fallback procedure to regain access to the console via a generated recovery token.
-![Pomerium Enterprise Recovery Sign In](docs/img/recovery-token.png)
+![Pomerium Enterprise Recovery Sign In](./img/recovery-token.png)
To generate a token, run the `pomerium-console generate-recovery token` command with the following flags:
diff --git a/content/docs/admonitions/_handle-self-signed-certificate-warning.mdx b/content/docs/admonitions/_handle-self-signed-certificate-warning.mdx
index 6f46af73f..ba24bf8b2 100644
--- a/content/docs/admonitions/_handle-self-signed-certificate-warning.mdx
+++ b/content/docs/admonitions/_handle-self-signed-certificate-warning.mdx
@@ -1 +1 @@
-If you notice a self-signed certificate warning, see [Handle Self-Signed Certificate Warning](/docs/troubleshooting#handle-self-signed-certificate-warning) to bypass it.
+If you notice a self-signed certificate warning, see [Handle Self-Signed Certificate Warning](/docs/internals/troubleshooting) to bypass it.
diff --git a/content/docs/admonitions/_import-core-config-to-zero.mdx b/content/docs/admonitions/_import-core-config-to-zero.mdx
index 66cbe1900..d40f21920 100644
--- a/content/docs/admonitions/_import-core-config-to-zero.mdx
+++ b/content/docs/admonitions/_import-core-config-to-zero.mdx
@@ -1,3 +1,3 @@
Pomerium Zero provides a hosted configuration UI for managing your Pomerium configurations. You can migrate to Pomerium Zero by importing your existing configuration.
-See [**Import Core Config to Zero**](/docs/zero/import) for more information.
+See [**Import Core Config to Zero**](/docs/deploy/cloud/import) for more information.
diff --git a/content/_install-mkcert.md b/content/docs/admonitions/_install-mkcert.md
similarity index 100%
rename from content/_install-mkcert.md
rename to content/docs/admonitions/_install-mkcert.md
diff --git a/content/docs/admonitions/_long-lived-connections.mdx b/content/docs/admonitions/_long-lived-connections.mdx
index b5ab1b295..86d376bf3 100644
--- a/content/docs/admonitions/_long-lived-connections.mdx
+++ b/content/docs/admonitions/_long-lived-connections.mdx
@@ -1,3 +1,3 @@
-When you create a [TCP](/docs/capabilities/tcp) or [Websocket](/docs/reference/routes/timeouts#websocket-connections) connection, Pomerium validates the access policy at the time the connection is made.
+When you create a [TCP](/docs/capabilities/non-http) or [Websocket](/docs/reference/routes/timeouts#websocket-connections) connection, Pomerium validates the access policy at the time the connection is made.
Currently, there is no mechanism in place to terminate long-running connections if a policy becomes invalid.
diff --git a/content/docs/admonitions/_pomerium-authenticate-services.mdx b/content/docs/admonitions/_pomerium-authenticate-services.mdx
index 876ee5e0b..00ca75b05 100644
--- a/content/docs/admonitions/_pomerium-authenticate-services.mdx
+++ b/content/docs/admonitions/_pomerium-authenticate-services.mdx
@@ -1,3 +1,3 @@
-Pomerium will use the [**Hosted Authenticate Service**](/docs/capabilities/hosted-authenticate-service) by default in configurations that don't specify an authenticate service URL.
+Pomerium will use the [**Hosted Authenticate Service**](/docs/capabilities/authentication) by default in configurations that don't specify an authenticate service URL.
-See the [**Self-Hosted Authenticate Service**](/docs/capabilities/self-hosted-authenticate-service) page if you prefer to use your own authenticate service.
+See the [**Self-Hosted Authenticate Service**](/docs/capabilities/authentication) page if you prefer to use your own authenticate service.
diff --git a/content/docs/admonitions/img/recovery-token.png b/content/docs/admonitions/img/recovery-token.png
new file mode 100644
index 000000000..0144ebdc1
Binary files /dev/null and b/content/docs/admonitions/img/recovery-token.png differ
diff --git a/content/docs/capabilities/audit-logs.mdx b/content/docs/capabilities/audit-logs.mdx
index 9a4a23af9..e742b5671 100644
--- a/content/docs/capabilities/audit-logs.mdx
+++ b/content/docs/capabilities/audit-logs.mdx
@@ -1,8 +1,8 @@
---
-title: Audit Logs
+title: Auditing & Privilege Access Management
description: Learn how to read Pomerium authorization logs.
lang: en-US
-sidebar_label: Audit logs
+sidebar_label: 'Audit logging'
keywords: [pomerium, troubleshooting, auth, authorization, logs]
sidebar_class_name: enterprise
---
@@ -126,6 +126,6 @@ The keys described below usually contain the relevant information when debugging
## Understanding Authorization Logs
-The most confusing keys for new users to understand are likely `allow-why-false` and `deny-why-false`. To better understand them, we should first discuss how [Pomerium Policy Language](/docs/capabilities/ppl) (**PPL**) works.
+The most confusing keys for new users to understand are likely `allow-why-false` and `deny-why-false`. To better understand them, we should first discuss how [Pomerium Policy Language](/docs/internals/ppl) (**PPL**) works.
PPL allows a request to a route if the claim matches at least one **allow** policy rule, and matches zero **deny** policy rules. With that in mind, `allow-why-false` and `allow-why-true` will describe a situation where the request either does or not not meet the requirements of an **allow** block a policy applied to that route. Conversely, `deny-why-true` and `deny-why-false` will describe why a request did or did not match a **deny** block for a policy assigned to the route.
diff --git a/content/docs/capabilities/authentication.mdx b/content/docs/capabilities/authentication.mdx
index 41d405bd7..4d69456d4 100644
--- a/content/docs/capabilities/authentication.mdx
+++ b/content/docs/capabilities/authentication.mdx
@@ -22,7 +22,7 @@ While Pomerium itself is not an IdP, it supports conventional IdP solutions and
:::tip
-See [identity providers](/docs/identity-providers) for step-by-step guides on how to integrate supported IdPs with Pomerium.
+See [identity providers](/docs/integrations/user-identity/identity-providers) for step-by-step guides on how to integrate supported IdPs with Pomerium.
:::
@@ -34,11 +34,11 @@ After Pomerium has verified and authenticated the user, the Authentication servi
### JWT verification and upstream applications
-After Pomerium’s Authentication service obtains OAuth and ID tokens and OIDC claims from your IdP, it stores that session data in the Databroker service, never leaking it to the client or the upstream application. This provides an extra layer of security, as it prevents the application from using OAuth tokens provided by the IdP.
+After Pomerium's Authentication service obtains OAuth and ID tokens and OIDC claims from your IdP, it stores that session data in the Databroker service, never leaking it to the client or the upstream application. This provides an extra layer of security, as it prevents the application from using OAuth tokens provided by the IdP.
Pomerium mints a new Pomerium JWT based on the claims and scopes in the OAuth and ID tokens and signs the JWT with a private key so the upstream application can verify the incoming request came from Pomerium.
-Although [JWT verification](/docs/guides/verify-jwt) is optional, Pomerium provides a way for you to [verify a user’s identity](/docs/capabilities/getting-users-identity) on the application level by forwarding [JWT claim headers](/docs/reference/jwt-claim-headers) with proxied requests to upstream applications.
+Although [JWT verification](/docs/capabilities/getting-users-identity.mdx) is optional, Pomerium provides a way for you to [verify a user's identity](/docs/capabilities/getting-users-identity) on the application level by forwarding [JWT claim headers](/docs/reference/jwt-claim-headers) with proxied requests to upstream applications.
Pomerium offers frontend and backend SDKs to simplify JWT verification for application developers:
@@ -50,14 +50,265 @@ Pomerium offers frontend and backend SDKs to simplify JWT verification for appli
Legacy apps that may not directly support SSO are still compatible with Pomerium. As a reverse proxy, Pomerium is designed to sit in front of your applications.
-By configuring your applications to route requests to Pomerium’s Proxy service, Pomerium can manage the authentication flow and secure your legacy app with minimal to no work on your end.
+By configuring your applications to route requests to Pomerium's Proxy service, Pomerium can manage the authentication flow and secure your legacy app with minimal to no work on your end.
## External data sources (Enterprise)
:::enterprise
-[Enterprise customers](https://www.pomerium.com/enterprise-sales/) can enforce context-aware access with Pomerium’s [external data sources](/docs/capabilities/integrations) feature (directory sync).
+[Enterprise customers](https://www.pomerium.com/enterprise-sales/) can enforce context-aware access with Pomerium's [external data sources](/docs/capabilities/integrations) feature (directory sync).
:::
From the Enterprise Console, you can import external data from sources other than your IdP. User identity context such as users, groups, roles, language, time zones, location, and more can be included into your authorization policy so you can make granular access control decisions.
+
+## Hosted Authenticate Service
+
+Pomerium's **Hosted Authenticate Service** provides a hosted alternative to the self-hosted authenticate service.
+
+Introduced in Pomerium v0.22, the hosted authenticate service is available for open-source Pomerium, Pomerium Zero, and Pomerium Enterprise.
+
+## How the hosted authenticate service works
+
+Pomerium's hosted authenticate service includes a **Hosted Authenticate Service URL** and a **Hosted Identity Provider** that handle authentication and authorization using OAuth 2.0 and OIDC protocols.
+
+Pomerium Zero, Core, and Enterprise configurations that do not include the self-hosted authenticate service URL or identity provider settings default to the hosted authenticate service settings. See [Configure the hosted authenticate service](#configure-the-hosted-authenticate-service) section for more information.
+
+## Why use the hosted authenticate service
+
+The hosted authenticate service offers a quicker way for users to deploy and test Pomerium.
+
+### No configuration
+
+The hosted authenticate service doesn't require an authenticate service URL or identity provider settings to use.
+
+### Less time to deploy
+
+Pomerium's hosted authenticate service removes the tedium of configuring your own identity provider (IdP) and authenticate service URL so you can deploy Pomerium in less time.
+
+### Faster proof of concept
+
+If you're testing Pomerium for the first time, run [Pomerium with Docker](/docs/get-started/fundamentals/core/get-started) using our hosted authenticate service – you can run Pomerium Core in **under 5 minutes** with minimal setup.
+
+:::enterprise
+
+Pomerium users who are interested in [Pomerium Enterprise](https://www.pomerium.com/enterprise-sales/) can test out the [Docker Enterprise quickstart](/docs/deploy/enterprise/quickstart) using our hosted authenticate service as well.
+
+:::
+
+## Configure the hosted authenticate service
+
+The hosted authenticate service requires no configuration to use.
+
+Add the following route and policy to your configuration file:
+
+```yaml title="pomerium-config.yaml"
+routes:
+ - from: https://verify.localhost.pomerium.io
+ to: http://verify:8000
+ policy:
+ - allow:
+ or:
+ - email:
+ is: user@example.com
+ pass_identity_headers: true
+```
+
+This minimal configuration is all you need to connect to an upstream service with Pomerium's hosted services.
+
+If you want, you can still include the hosted URL in your configuration:
+
+```yaml title="pomerium-config.yaml"
+authenticate_service_url: https://authenticate.pomerium.app
+
+routes:
+ - from: https://verify.localhost.pomerium.io
+ to: http://verify:8000
+ policy:
+ - allow:
+ or:
+ - email:
+ is: user@example.com
+ pass_identity_headers: true
+```
+
+If you use the hosted URL and include your own IdP settings, Pomerium will override your IdP configuration and use the hosted IdP instead:
+
+```yaml title="pomerium-config.yaml"
+authenticate_service_url: https://authenticate.pomerium.app
+
+idp_provider: google
+idp_client_id: my_client_id
+idp_client_secret: my_client_secret
+
+routes:
+ - from: https://verify.localhost.pomerium.io
+ to: http://verify:8000
+ policy:
+ - allow:
+ or:
+ - email:
+ is: user@example.com
+ pass_identity_headers: true
+```
+
+## Limitations
+
+**Limited sign-in options**
+
+Currently, you can only authenticate with Google single-sign on or with email and password credentials.
+
+**Session management**
+
+The hosted authenticate service is separate from your Pomerium installation. This means you can't refresh session tokens, so users must re-authenticate after roughly one hour.
+
+**Uptime commitment**
+
+We make no commitments to uptime for our free hosted authenticate service.
+
+## Privacy considerations
+
+Users that take advantage of our hosted authenticate service should review the [Terms of Service agreement](https://www.pomerium.com/pomerium-zero-user-agreement/).
+
+Specifically, you should be aware that by using our hosted services, you agree to Pomerium collecting the following data:
+
+- IP address
+- OS version
+- Internal domain name
+- Session details (email, name, and domain)
+
+We collect this information to better understand how our users interact with and use Pomerium's services.
+
+## Self-Hosted Authenticate Service
+
+Pomerium's **Self-Hosted Authenticate Service** allows you to configure Pomerium with the identity provider of your choice.
+
+The self-hosted authenticate service is available for open-source Pomerium, Pomerium Zero, and Pomerium Enterprise.
+
+:::info
+
+The _authenticate service_ is one of the [four logical services](/docs/internals/architecture#component-level) that make up Pomerium. The authenticate service is unique in that Pomerium can either run this service itself, or instead use the [Hosted Authenticate Service](/docs/capabilities/authentication).
+
+:::
+
+## How the self-hosted authenticate service works
+
+To configure the self-hosted authenticate service, you will need to set up:
+
+- a URL for the authenticate service
+- an identity provider (IdP)
+
+### Authenticate service URL
+
+The authenticate service URL is a public-facing URL that should resolve to your Pomerium instance. (If running in split service mode, this URL should resolve to the authenticate service.) Whenever a user is required to log in to access a route, Pomerium will redirect the user to the authenticate service using this URL.
+
+This URL should not contain a path or query parameters. For example, `https://authenticate.corp.example.com`.
+
+This URL must be different from any of the route URLs you use with Pomerium.
+
+See the [Authenticate Service URL](/docs/reference/service-urls#authenticate-service-url) reference page for details on how to configure this setting.
+
+:::info Why does Pomerium use a separate authenticate service URL?
+
+In a typical OIDC authentication flow, all redirect URLs must be pre-registered with the IdP. Pomerium uses a single authenticate service URL so that you need to register only one redirect URL with your IdP. This way, Pomerium can protect multiple upstream services without requiring you to update your IdP client whenever you add a new service.
+
+:::
+
+### Identity provider
+
+Pomerium relies on an IdP to authenticate users. Pomerium can use any IdP that implements the OpenID Connect (OIDC) protocol.
+
+The steps to configure your IdP will vary depending on the specific provider. See [**Identity Providers**](/docs/integrations/user-identity/identity-providers) for a list of guides to configure commonly-used IdPs.
+
+You will generally need to configure your IdP client to allow an OAuth redirect URL based on your chosen authenticate service URL, with the path `/oauth2/callback` appended to it.
+
+For example, if your authenticate service URL is `https://authenticate.corp.example.com`, you should configure your identity provider to allow the redirect URI `https://authenticate.corp.example.com/oauth2/callback`.
+
+:::tip
+
+If you require a different callback path than `/oauth2/callback`, you can use the [Authenticate Callback Path](/docs/reference/authenticate-callback-path) setting to change the callback path.
+
+:::
+
+Once you have set up an IdP client, you will need to configure Pomerium with the IdP name, client ID and client secret, and possibly a URL assigned to your individual IdP client.
+
+See the [Identity Provider Settings](/docs/reference/identity-provider-settings#identity-provider-client-id) reference page for details on how to configure these settings.
+
+## Single sign-out (SSO)
+
+signs a user out of a secured application and clears both the remote application session generated by the identity provider and the local Pomerium session.
+
+## OIDC Front-Channel Logout
+
+Pomerium supports Front-Channel Logout as described in [OpenID Connect Front-Channel Logout 1.0](https://openid.net/specs/openid-connect-frontchannel-1_0.html).
+
+### Identity provider support
+
+See if your identity provider (IdP) supports Front-Channel Logout by checking your IdP's `/.well-known/openid-configuration` endpoint. If your IdP supports it, you may see something similar to the JSON data below:
+
+```json
+{
+ "frontchannel_logout_session_supported": true
+}
+```
+
+### Configure single sign-out
+
+To correctly implement SSO, you must register a `frontchannel_logout_uri` for your application that includes the path `/.pomerium/sign_out`.
+
+The `frontchannel_logout_uri` must match the external route in your policy. For example, `app.corp.example.com/.pomerium/sign_out`.
+
+If configured correctly, the following actions occur:
+
+1. The proxy service receives the sign-out request and clears the local Pomerium session
+2. The proxy service redirects the request to the authenticate service URL's `/.pomerium/sign_out` endpoint
+3. The authentication service clears the remote application session
+
+![Single sign-out flow](./img/single-sign-out/sign-out-flow.svg)
+
+:::caution
+
+While it is possible to implement SSO using the **authenticate service URL** and the `/.pomerium/sign_out` endpoint, this method is not recommended.
+
+Signing out with the authenticate service URL won't delete the session cookie on the route itself. To terminate the remote application and Pomerium sessions, you must point sign-out requests to the external route.
+
+:::
+
+
+ Well-known Pomerium endpoint
+
+
+See Pomerium's `/.well-known/pomerium` endpoint to view OAuth, OIDC, and JWKS data.
+
+For example:
+
+```json
+{
+ "authentication_callback_endpoint": "https://authenticate.localhost.pomerium.io/oauth2/callback",
+ "jwks_uri": "https://authenticate.localhost.pomerium.io/.well-known/pomerium/jwks.json",
+ "frontchannel_logout_uri": "https://authenticate.localhost.pomerium.io/.pomerium/sign_out"
+}
+```
+
+Note, a CSRF token is required for the single sign out endpoint (despite supporting `GET` and `POST`) and can be retrieved from the `X-CSRF-Token` response header on the well known endpoint above or using the `_pomerium_csrf` session set.
+
+
+
+
+### Single sign-out example with Pomerium
+
+The example below demonstrates how to correctly implement SSO using the [JavaScript SDK](/docs/capabilities/getting-users-identity.mdx):
+
+```js
+export const signOut = (redirectUrl) => {
+ let location = window.location.origin + '/.pomerium/sign_out';
+ if (redirectUrl) {
+ location += '?pomerium_redirect_uri=' + encodeURIComponent(redirectUrl);
+ }
+ window.location.href = location;
+};
+```
+
+In the example above, the `signOut` function appends the `/.pomerium/sign_out` endpoint to the external route URL, then redirects the user.
+
+From here, the proxy service clears the external route session and redirects the user to the authenticate service URL to clear the Pomerium session.
diff --git a/content/docs/capabilities/authorization.mdx b/content/docs/capabilities/authorization.mdx
index 71ac701d8..4ead23a62 100644
--- a/content/docs/capabilities/authorization.mdx
+++ b/content/docs/capabilities/authorization.mdx
@@ -1,162 +1,183 @@
---
-# cSpell:ignore abac, gset, nxon, unvalidated
-
-title: Authorization & Policy
+title: 'Authorization and Policy Enforcement with Pomerium'
+sidebar_label: 'Authorization'
lang: en-US
-sidebar_label: Authorization
-description: Build authorization policy with Pomerium and apply them to routes and namespaces.
+description: 'Learn how Pomerium enforces context-aware, continuous authorization using route-level policies, namespaces, device-based constraints, and more.'
keywords:
[
pomerium,
- context-aware proxy,
- authorization proxy,
- access decision point,
- rbac,
- abac,
- dynamic access,
+ authorization,
+ zero trust,
+ policy enforcement,
ppl,
+ rego,
namespaces,
+ device identity,
+ clusters,
]
---
import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
+import SelfSignedCertWarning from '@site/content/docs/admonitions/_handle-self-signed-certificate-warning.mdx';
-# Authorization Policy
+
-An authorization policy defines what resources a user or group can access within an organization. When applying an authorization policy, factors like access management to on-premises or cloud services, authentication flows, and device identity introduce complexity that only scales with organization size.
+Pomerium enforces dynamic, context-aware authorization on every request. This capability extends across deployments of any size or complexity, from single-route use cases to multi-namespace or multi-cluster enterprise environments.
-Pomerium meets you where you are by allowing you to configure granular policies that support or extend your existing policies on a per-route, per-request basis.
+Below, we cover how to write and apply policies with **Pomerium Policy Language (PPL)**, when to use **Rego**, and how **Namespaces** (Enterprise) and **Clusters** (Pomerium Zero) fit into the picture.
-## Pomerium authorization policy
+## Introduction: Authorization at Every Layer
-You can apply policies in Pomerium to [Namespaces](/docs/capabilities/namespacing) or [Routes](/docs/capabilities/routing).
+Pomerium's approach to authorization is continuous and context-aware, integrating identity information from your IdP, device identity, or external data sources.
-### Namespaces
+- **Route-based** control in all editions
+- **Namespace-based** and **cluster-based** organization in Enterprise and Zero
+- **Policy languages**: [PPL](#pomerium-policy-language-ppl) for most use cases, [Rego](#rego-policies) for advanced logic
-:::enterprise
+## Where Policies Live
-Namespace support is available only for [Enterprise customers](https://www.pomerium.com/enterprise-sales/).
+1. **Routes**
+ Policies can be attached to each route, controlling who and what can access the upstream service.
-:::
+2. **Namespaces**
+ A namespace is an organizational unit. Policy can be applied once and inherited by child namespaces or routes. Admins can delegate control so teams manage their own routes without harming global security.
-Administrators can create a namespace, add users, groups, and routes to it, and configure a policy that applies to that specific namespace.
+3. **Clusters**
+ Zero-managed clusters pull their config (routes, policies, certificates) from a hosted control plane. Each cluster has its own environment. You can define policies in the Zero console, and they're synced to local Pomerium Core replicas.
-### Routes
+## Policy Configuration Approaches
-You can build TLS-encrypted routes to upstream applications and configure policy that restricts access based on the policy criteria.
-
-Pomerium Enterprise and Core customers can configure and apply policies to routes.
+### Pomerium Policy Language (PPL)
-### Continuous verification
+[Pomerium Policy Language](/docs/internals/ppl) is YAML-based and covers the majority of use cases.
+
+- **Actions**: `allow` or `deny`
+- **Logical Operators**: `and`, `or`, `not`, `nor`
+- **Criteria**: email, domain, groups, day of week, device, etc.
+
+A minimal example:
+
+```yaml
+allow:
+ and:
+ - domain:
+ is: example.com
+deny:
+ or:
+ - email:
+ is: spammer@example.com
+ - email:
+ is: malicious@example.com
+```
-
+**Deny** overrides **allow**. Requests must pass at least one `allow` rule and no `deny` rules.
-Pomerium continuously evaluates policy on every request.
+#### PPL in Pomerium Enterprise
-Policy applied to any route or namespace will enforce authorization checks throughout a session, ensuring that only the intended user with the right context can access a protected resource.
+Enterprise adds a visual **Policy Builder** and extended criteria (like time-of-day or external data records). You can build policy via GUI or raw PPL:
-## Apply authorization policy
+![Build an authorization policy with PPL in the Enterprise Console](./img/authorization/ppl-edit-policy.png)
-Pomerium offers three methods to configure and apply policies:
+Reapply policies across multiple routes or namespaces:
-- [Pomerium Policy Language (PPL)](#pomerium-policy-language-ppl)
-- [Enterprise Console GUI](#enterprise-console-gui)
-- [Rego](/docs/capabilities/rego)
+![Reapply policies to multiple routes or namespaces](./img/authorization/apply-policies-to-routes.png)
-### Pomerium Policy Language (PPL)
+### Rego Policies
-[Pomerium Policy Language (PPL)](/docs/capabilities/ppl) is a declarative, YAML-based access control policy language you can use to configure authorization policies.
+:::enterprise
-PPL is intuitive by design and defines policy with one or more rules composed of actions, logical operators, and criteria. Each criterion has a name and corresponding data.
+**Rego** is available to Enterprise customers who need advanced, custom logic beyond what PPL offers.
-
-
+:::
-In Pomerium Core, you can build a policy with PPL and apply it to a route in your configuration file:
+[Rego](https://www.openpolicyagent.org/docs/latest/#rego) is the language used by [Open Policy Agent (OPA)](https://www.openpolicyagent.org/). In Pomerium, you can write Rego modules that produce `allow` or `deny` outcomes. For example:
-```yaml title="pomerium-config.yaml"
-policy:
- - allow:
- or:
- - email:
- is: user@example.com
+```rego
+allow := true
```
-In this example, only a user with the email `user@example.com` can access the target application.
-
-
-
+or:
-In the Enterprise Console, you can use the **EDITOR** to manually configure policy with PPL:
+```rego
+deny := [true, "unauthorized"]
+```
-![Build an authorization policy with PPL in the Enterprise Console](./img/authorization/ppl-edit-policy.png)
+You can inspect request data under `input.http` (method, headers, path), or session details under `input.http.session`. Learn more in the [Rego docs](/docs/internals/ppl#rego).
-In this example, Pomerium will grant a user access if their email address ends in `example.com` and their `groups` ID matches `00gso9nxonHI4YfbM4x6`. Pomerium will deny the user access on Saturdays and Sundays.
+![Apply Rego in Console editor](./img/authorization/ppl-rego-policy.png)
-
-
+## Enterprise Features
-### Enterprise Console GUI
+### Namespaces
:::enterprise
-The Enterprise Console provides a policy builder GUI so you can build policies and reapply them to multiple routes and namespaces. See our [**Enterprise**](/docs/enterprise) page to learn more.
+Namespaces group resources and teams in a hierarchical structure. A parent namespace can enforce global rules while child namespaces add local restrictions.
:::
-Use the **BUILDER** tab to build your policy:
+Key benefits:
-![Build policy with Console GUI](./img/authorization/ppl-gui-policy.png)
+- **Self-Service**: Team leads can manage their own routes and policies.
+- **Hierarchical**: Global admins set top-level constraints (like requiring a `@yourcompany.com` email).
+- **RBAC**: Access is granted via roles: **Guest**, **Viewer**, **Manager**, **Admin**.
-In this example, a user will have access if their email address ends in `example.com` and their device ID matches the ID in the **Value** field.
+## Pomerium Zero & Clusters
-#### Reapply policies
+**Pomerium Zero** uses a _cluster_ model. Each cluster is a local deployment of Pomerium Core, connected to a hosted control plane. Clusters fetch routes, policies, and certificates from the Zero console:
-Reapply policies as necessary to any route or namespace:
+- **Starter domain**: Each cluster gets a unique domain with automatic TLS.
+- **Custom domains**: Switch from the starter domain to your own.
+- **Scalability**: Add more replicas to handle more traffic.
+- **Storage**: Use a persistent PostgreSQL database in production for reliability.
-![Reapply policies to multiple routes or namespaces](./img/authorization/apply-policies-to-routes.png)
+For more details, see the [**Clusters**](/docs/internals/clusters) documentation.
-### Policy overrides
+## Policy Overrides
-Pomerium Core and Enterprise offer the following options for overriding your authorization policy:
+Regardless of PPL or Rego, Pomerium provides quick overrides:
-- **Any Authenticated User**: Allows access to a route with this policy attached to any user who can authenticate to your identity provider
-- **CORS Preflight**: Allows unauthenticated HTTP OPTIONS requests as per the CORS spec
-- **Public Access**: Allows complete, unrestricted access to an associated route (use this setting with caution)
+- **Any Authenticated User**: Bypasses all other policy logic and admits any logged-in user.
+- **CORS Preflight**: Lets `OPTIONS` requests pass unauthenticated.
+- **Public Access**: No authentication required. Use with caution.
:::note robots.txt behavior
-By default, Pomerium serves a **robots.txt** response directly, instructing search engines _not_ to crawl the route domain:
-
-```txt
-User-agent: *
-Disallow: /
-```
-
-For routes with policies that allow public, unauthenticated access, Pomerium _will not_ serve **robots.txt** directly. Instead, Pomerium will proxy requests for `/robots.txt` to the upstream service.
+If a route is fully public, `robots.txt` will be proxied from upstream (instead of returning a disallow-by-default).
:::
-## Manage devices
+## Putting It All Together
-:::enterprise
+1. **Plan Your Structure**
-[Device identity](/docs/capabilities/device-identity) is an Enterprise feature. Check out our [Enterprise](/docs/enterprise) page to learn more.
+ - Small setups: attach a PPL policy directly to each route in Core.
+ - Larger orgs: use **Namespaces** (Enterprise) to group resources.
+ - Multi-deployment: use **Clusters** (Pomerium Zero) to unify config.
-:::
+2. **Decide on Language**
+
+ - **PPL**: YAML, easy to read, covers most use cases.
+ - **Rego** (Enterprise): advanced logic, OPA-based.
-The **Manage Devices** feature in the Enterprise Console allows you to enroll and manage user devices for policy-based authorization.
+3. **Continuously Verify**
+ - Pomerium reevaluates the user's context (IdP claims, device posture, location) on every request.
-![Enroll devices](./img/authorization/enroll-device.png)
+## Learn More
-The **Devices List** displays enrolled devices for each user and the approval status. Administrators can inspect, approve, or delete registered devices from this table.
+- [**Routing**](/docs/capabilities/routing)
+- [**Policy Language (PPL)**](/docs/internals/ppl)
+- [**Rego**](/docs/internals/ppl)
+- [**Namespaces**](/docs/internals/namespacing)
+- [**Clusters**](/docs/internals/clusters)
+- [**Device Identity**](/docs/integrations/device-context/device-identity)
-![List of user devices](./img/authorization/console-devices.png)
+Use Pomerium's robust, context-driven authorization to unify your security posture, whether you're looking to secure a few routes or an entire global infrastructure.
diff --git a/content/docs/capabilities/branding.md b/content/docs/capabilities/branding.md
index 25a49235f..e1f56a078 100644
--- a/content/docs/capabilities/branding.md
+++ b/content/docs/capabilities/branding.md
@@ -1,83 +1,62 @@
---
-description: Add custom colors, logos, and error messages.
+title: 'Whitelabeling'
+sidebar_label: 'Whitelabeling'
+description: "Customize Pomerium's user-facing and administrative UI with your organization's branding."
+keywords:
+ - 'pomerium'
+ - 'custom branding'
+ - 'white labeling'
+ - 'beyondcorp'
+ - 'zero trust'
+ - 'compliance'
---
-# Custom Branding (White Labeling)
+# White Labeling
:::enterprise
-This article describes a use case available to [Pomerium Enterprise](/docs/enterprise/install) customers.
+This article describes a use case available to [Pomerium Enterprise](/docs/deploy/enterprise/install) customers.
:::
-Pomerium's user and administrative facing GUI and error messages can be customized to meet your organization's needs.
+## Overview
-## Settings
-
-Most of the Branding settings are located in the Branding Tab of the main Settings Page.
-
-![Branding Settings in Pomerium Enterprise](./img/branding/no_branding_settings.png)
-
-There is also a setting to enable Error Details on Edit Route's General Tab.
+Pomerium Enterprise allows you to visually align your identity-aware proxy with your organization's brand identity. You can replace Pomerium's default logos, change color themes, and add your own favicon to ensure that all administrative pages and user-facing prompts feel like a natural extension of your existing portals.
-![Enable Error Details on a Route](./img/branding/enable_error_details.png)
+For instructions on customizing error pages and enabling user self-remediation, see [Self-Remediation & Custom Error Pages](/docs/capabilities/self-remediation).
-Policies have two new fields, explanation and remediation.
+## Settings
-Explanation is an optional short description of why the user would have been denied. Likewise, remediation is an optional field to cover how the user can self-remediate their state. Oftentimes, this will be a link to your internal help desk support site or knowledge base repo.
+Most Branding options reside in the **Branding** tab of the **Settings** page:
-![Add custom error messages.](./img/branding/policy_with_explanation_and_remediation.png)
+![Branding Settings in Pomerium Enterprise](./img/branding/no_branding_settings.png)
-## Colors
+### Colors
-Adding a [hex code](https://color.adobe.com/create/color-wheel) to the Primary Color setting will affect the majority of the theming on the console. For more details on how the types of colors will impact the look and feel of Pomerium, see Material Designs' [color documentation](https://material.io/resources/color/#!/?view.left=0&view.right=0)'s color documentation.
+By adding a [hex code](https://color.adobe.com/create/color-wheel) in **Primary Color** and **Secondary Color**, you can seamlessly alter the console's UI to match your brand guidelines.
![Primary Color Pomerium Enterprise](./img/branding/branded_colors_console.png)
-There is also a secondary color that is used for a few things such as certain button colors.
-
-![Secondary Color Pomerium Enterprise](./img/branding/secondary_color.png)
-
-Choosing colors also affects the majority of webpages served by Pomerium Core.
-
-![Error Pages and User Info](./img/branding/branded_colors_error_details.png)
-
-You can also set different colors for users using dark mode.
+If you have users who prefer dark mode, you can add a different primary/secondary palette for dark mode:
![Dark Mode Colors](./img/branding/branded_colors_darkmode_console.png)
-## Logo
+This ensures a consistent brand experience whether someone is an admin in the console or a user landing on Pomerium's sign-in pages.
-You may add a URL to link to your logo and favicon which will replace the Pomerium defaults.
+### Logo
+
+You can replace Pomerium's default logo and favicon by specifying a custom URL:
![Replace the Logo and Favicon in Pomerium Enterprise](./img/branding/svg_logo_console.png)
-It will also appear for all the user-facing webpages too.
+Both administrative and user-facing pages will use your organization's imagery:
![Replace the Logo and Favicon in Open Source webpages](./img/branding/svg_logo_error_details.png)
-## Error Details
-
-It is possible to customize the error messages displayed on 403 unauthorized pages.
-
-This feature is enabled on a per Route basis by toggling the setting in the General Tab of the Route settings.
-
-![Enable Error Details](./img/branding/enable_error_details.png)
-
-Error Message will appear similar to this example.
-
-![Extra Error Details](./img/branding/error_details_enabled.png)
-
-Policies without an explanation or remediation field will show the policy ID.
-
-If the explanation or remediation fields are added to the policy they will show up in the error details.
-
-![Policy Settings](./img/branding/policy_with_explanation_and_remediation.png)
-
-You can additionally add a Header paragraph that supports markdown to all error pages in the General Settings (same place you add colors and logos).
-
-![Markdown Header](./img/branding/first_paragraph_setting.png)
+## Why White Labeling?
-You can see the link added to the Error Page.
+- **Professional Appearance**: Present a unified front to end users, ensuring they associate your secure portal with your organization's branding.
+- **Trust & Familiarity**: A consistent identity lowers user confusion, especially for teams already accustomed to your internal brand or product suite.
+- **Easier User Adoption**: When Pomerium “feels” like part of your standard workflow, employees are more likely to comply with zero-trust and security measures.
-![Markdown Header](./img/branding/includes_first_paragraph.png)
+White labeling is not merely cosmetic; it's a critical step to assure teams that they're accessing official, trusted corporate resources—enhancing user confidence and security posture.
diff --git a/content/docs/capabilities/custom-domains.mdx b/content/docs/capabilities/custom-domains.mdx
index b53e913fc..e7da7ead0 100644
--- a/content/docs/capabilities/custom-domains.mdx
+++ b/content/docs/capabilities/custom-domains.mdx
@@ -1,8 +1,8 @@
---
# cSpell:ignore mycorp
id: custom-domains
-title: Custom Domains
-sidebar_label: Custom Domains
+title: Custom Domains in Pomerium Zero
+sidebar_label: 'Automatic Certs & Domains'
description: The Custom Domains page teaches you how to add your own domain in Pomerium Zero and how to use it to build routes to your services.
---
@@ -34,7 +34,7 @@ The **Custom Domains** feature helps simplify these steps.
:::info
-See the [**Clusters Concepts**](/docs/concepts/clusters) page for more information about clusters in Pomerium Zero.
+See the [**Clusters Concepts**](/docs/internals/clusters) page for more information about clusters in Pomerium Zero.
:::
@@ -58,7 +58,7 @@ Add a **wildcard CNAME record** that points to your starter domain. For example:
If you're using a DNS provider like Google's Cloud DNS, you can add the wildcard CNAME record without code:
-![Add a CNAME record in GCP](../capabilities/img/custom-domains/gcp-cname-record.png)
+![Add a CNAME record in GCP](./img/custom-domains/gcp-cname-record.png)
Add the custom domain in **Cluster Settings > Domains**:
@@ -67,15 +67,15 @@ Add the custom domain in **Cluster Settings > Domains**:
1. In the **Custom Domains** field, select the **+** icon to add a domain name
1. Enter your custom domain
-![Entering the fully qualified domain name in the Zero Console](../capabilities/img/custom-domains/add-custom-domain.gif)
+![Entering the fully qualified domain name in the Zero Console](./img/custom-domains/add-custom-domain.gif)
If added successfully, you will be able to build routes with your custom domain instead of the starter domain. Pomerium will automatically provision and renew TLS certificates for this custom domain, which you can verify by the Common Name found in the certificate:
-![Reviewing the Let's Encrypt certificate for a custom domain](../capabilities/img/custom-domains/custom-domain-certificates.png)
+![Reviewing the Let's Encrypt certificate for a custom domain](./img/custom-domains/custom-domain-certificates.png)
You can also review the certificate in the **Certificates** dashboard:
-![Review certificate details in the Certificate dashboard in the Zero Console](../capabilities/img/custom-domains/certificate-details.gif)
+![Review certificate details in the Certificate dashboard in the Zero Console](./img/custom-domains/certificate-details.gif)
### How custom domains work
diff --git a/content/docs/capabilities/device-identity.mdx b/content/docs/capabilities/device-identity.mdx
deleted file mode 100644
index 3d4987505..000000000
--- a/content/docs/capabilities/device-identity.mdx
+++ /dev/null
@@ -1,155 +0,0 @@
----
-title: Device Identity
-description: Learn about how WebAuthn is used to authenticate and authorize access using Device ID and state.
-lang: en-US
-keywords:
- [
- pomerium,
- identity access proxy,
- webauthn,
- device id,
- enroll,
- enrollment,
- authentication,
- authorization,
- enterprise,
- ]
----
-
-import Tabs from '@theme/Tabs';
-import TabItem from '@theme/TabItem';
-
-Device identity is the unique ID associated with a device. In the context of zero trust, device identity can be used to authenticate and authorize users and to determine if a device can be trusted before granting a user access to a protected application or service.
-
-
-
-## Device identity with Pomerium
-
-Pomerium versions [0.16.0](/docs/core/upgrading#policy-for-device-identity) and up support the use of device identity as a criteria in authorization policies. Pomerium uses the [Web Authentication](https://www.w3.org/TR/webauthn-2/#registration-extension) (WebAuthn) API to bring authentication and authorization based on device identity into your security framework. With Pomerium’s device identity support, users can register devices and administrators can limit access to devices they trust.
-
-## Device identity features
-
-Pomerium Enterprise and Core both support device identity, but Enterprise users can enroll and manage devices in the Enterprise Console.
-
-| Features (Enterprise) | Device Identity |
-| --- | :-: |
-| **Pre-approved device enrollment** | Administrators can enroll a new device and generate a registration link for a specific user. |
-| **Device management** | Administrators can view and manage approved and pending devices in the Enterprise Console. |
-| **User-initiated device enrollment** | Users can register their device if a route requires device identity authentication, but can only access the route if their device is approved in the Enterprise Console. |
-| **Features (Core)** | **Device Identity** |
-| **User-initiated device enrollment** | Users can register their device if a route requires device identity authentication and access the route without device approval. |
-
-## New enrollment (Enterprise)
-
-Device identity with Pomerium relies on a [trust on first use](https://en.wikipedia.org/wiki/Trust_on_first_use) (TOFU) authentication scheme:
-
-- Administrators can enroll a device and generate a custom registration link for a specific user. (Registration links are only valid for the selected user.)
-- When a user registers their device with a registration link, the device will automatically be approved following the TOFU authentication scheme.
-
-## Manage devices (Enterprise)
-
-When an administrator enrolls a device, the Enterprise Console displays the device's status as **Pending Enrollment**.
-
-When a user visits the registration link and registers their device, the Enterprise Console updates the device’s status to **Approved**.
-
-If an administrator deletes a device, the device will be revoked and the link becomes invalid.
-
-## Enroll devices as an administrator (Enterprise)
-
-Enterprise users can build policies that only grant access to a route if a user’s device is approved in the Enterprise Console. (See [Device Matcher](/docs/capabilities/ppl#device-matcher) for more information.)
-
-The Enterprise Console’s **Manage Devices** GUI provides a dashboard where administrators can enroll devices and generate custom registration links for users in their directory.
-
-:::enterprise
-
-Before you can generate device registration links for users within your directory, you must sync your directory data first.
-
-See [**Directory Sync**](/docs/capabilities/directory-sync) for more information.
-
-:::
-
-To enroll a new device:
-
-1. In the Console sidebar, select **Devices**
-
-2. Select **NEW ENROLLMENT**
-
-![Enroll devices](./img/webauthn/admin-enroll-1.png)
-
-3. In the **New Enrollment** window:
-
-**Select Users**: Select a user to send a registration link (the link is only valid for the selected user) **Route**: Enter a pre-configured route from your Console; Pomerium will use this route to create the custom registration link **Redirect URL** (optional): Enter a route that users will redirect to after registering their device **Enrollment Type**:
-
-- Select **Any** to allow a user to register any device
-- Select **Secure Enclave Only** to restrict the user to secure enclaves
-
-![Select new enrollment](./img/webauthn/new-enrollment.png)
-
-4. Select **SUBMIT** to get the registration link
-
-![Enrollment created](./img/webauthn/enrollment-created.png)
-
-Give the link to the user.
-
-## Enroll device as a user
-
-If a Pomerium route [requires device authentication](/docs/capabilities/ppl#device-matcher), the user must register a [trusted execution environment](/docs/concepts/device-identity#authenticated-device-types) (**TEE**) device before accessing the route. Registration differs depending on the device.
-
-The steps below cover enrollment of a device by a user. This is available for both Pomerium Core and [Pomerium Enterprise](/docs/enterprise/install) installations. However, Enterprise users may also receive registration links [generated by their administrators](/docs/capabilities/device-identity), which will mark the newly enrolled device as approved in the Enterprise Console.
-
-1. Users are prompted to register a new device when accessing a route that requires device authentication:
-
- ![The WebAuthn Registration page with no devices registered](img/webauthn/no-device.png)
-
- Users can also access the registration page from the special `.pomerium` endpoint available on any route at the bottom of the page:
-
- ![The Device Credentials section of the .pomerium endpoint with the WebAuthn link highlighted](img/webauthn/device-credentials-empty-highlight.png)
-
-1. Select **Register New Device**. Your browser will prompt you to provide access to a device. This will look different depending on the browser, operating system, and device type:
-
-
-
-
-
- ![The device authentication prompt on Windows](img/webauthn/security-key-windows.png)
-
-
-
-
-
- ![The device authentication prompt in Google Chrome](img/webauthn/security-key-google.png)
-
-
-
-
-
- ![The device authentication prompt in Firefox](img/webauthn/security-key-firefox.png)
-
-
-
-
-
- ![The device authentication prompt on ChromeOS](img/webauthn/security-key-chromebook.png)
-
-
-
-
-
-### Find the device ID
-
-If a route's policy is configured to only allow specific device IDs, you will see a `450` error even after registering:
-
-![450 device not authorized error screen](img/webauthn/450-error.png)
-
-From the `.pomerium` endpoint you can copy your device ID to provide to your Pomerium administrator.
-
-![Device ID list at /.pomerium](img/webauthn/device-id-list.png)
-
-You can also delete the ID for devices that should no longer be associated with your account.
diff --git a/content/docs/capabilities/getting-users-identity.md b/content/docs/capabilities/getting-users-identity.md
deleted file mode 100644
index 01f0c9935..000000000
--- a/content/docs/capabilities/getting-users-identity.md
+++ /dev/null
@@ -1,236 +0,0 @@
----
-# cSpell:ignore ecparam genkey noout pubout secp256r1 QCN7adG2AmIK3UdHJvVJkldsUc6XeBRz83Z4rXX8Va4 ary66nrvA55TpaiWADq8b3O1CYIbvjqIHpXCY
-
-title: JWT Authentication
-description: Learn how Pomerium supports single sign-on (SSO) and identity verification with JWT authentication and signed HTTP headers.
-sidebar_label: JWT Authentication
-keywords:
- [
- jwt assertion header,
- jwt authentication,
- jwt,
- single sign-on,
- sso,
- identity verification,
- request verification,
- pomerium jwt,
- jwt validation,
- jwt claims,
- ]
----
-
-import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; import GoApp from '../../examples/go-sdk/go-app.md'; import ReactApp from '../../examples/js-sdk/react-app.md';
-
-# JWT Authentication
-
-This document describes how Pomerium supports JWT authentication in upstream services with JSON web tokens (JWTs).
-
-
-
-## Overview
-
-JWTs provide a secure and efficient means to authenticate and authorize users before they can access upstream services behind Pomerium. When configured for JWT authentication, Pomerium sends its own JWT to the upstream service. By verifying the Pomerium JWT, the upstream service can:
-
-- Confirm that the Pomerium Proxy service handled the client request before forwarding it.
-- Make application-level authorization decisions based on the user's associated identity information.
-
-## Why JWT authentication?
-
-### Identity verification
-
-JWT authentication through Pomerium enables an upstream service to verify a user's identity based on claims contained in the JWT. Pomerium signs and issues a new JWT based on the ID token received from the service's configured identity provider.
-
-### Request verification
-
-Pomerium places the newly minted JWT in a [JWT assertion header](#jwt-assertion-header). The upstream service should only accept the incoming request if it satisfies all [JWT validation](#jwt-validation) conditions.
-
-By validating the JWT, the upstream service can assert that:
-
-- The request originated from Pomerium.
-- The user was authenticated.
-- The request was authorized in accordance with the route's authorization policy.
-
-:::note
-
-The Pomerium JWT does not contain any path information for an upstream service. If you've configured multiple routes with different paths for the same upstream service (such as an `/admin` route that grants access to a limited set of users), the application can't determine which Pomerium route the JWT corresponds to.
-
-:::
-
-### Single Sign-on (SSO)
-
-You can configure upstream services to accept the Pomerium JWT to achieve an SSO authentication flow. This capability is completely free and relatively easy to configure depending on the upstream service and your [identity provider](/docs/identity-providers).
-
-:::info Implement SSO with Pomerium
-
-See our [**Grafana**](/docs/guides/grafana) guide for a real-world example of how configuring both Pomerium and and an upstream service can provide easy SSO access for your end users.
-
-:::
-
-## JWT authentication flow
-
-![A diagram that shows how Pomerium forwards JWTs to an upstream application](./img/jwt-authn/jwt-authentication.svg)
-
-### Identity provider authentication
-
-Pomerium requires users to authenticate against an OIDC-compliant identity provider before authorizing or denying a request to an upstream service.
-
-After successful authentication, Pomerium mints a new [**Pomerium JWT**](#pomerium-jwt) based on the **ID token** generated by the identity provider. (This is Pomerium's default behavior, even if you haven't configured Pomerium to support JWT authentication.)
-
-### JWT assertion header
-
-Pomerium signs its JWT with a [signing key](/docs/reference/signing-key). If the [pass identity headers](/docs/reference/routes/pass-identity-headers-per-route) setting is enabled, Pomerium will place the JWT into a special HTTP header called the JWT assertion header. Pomerium includes the JWT assertion header in every request it forwards to the upstream service.
-
-:::info JWT assertion header field
-
-Pomerium passes the JWT in the `X-Pomerium-Jwt-Assertion` HTTP header, and encodes it according to [RFC7519](https://datatracker.ietf.org/doc/html/rfc7519).
-
-:::
-
-### JWT validation
-
-The upstream service receives the `X-Pomerium-Jwt-Assertion-Header` with the encrypted JWT. To validate a JWT, the service should check the following items:
-
-- [JWT signature](#jwt-signature)
-- [Audience (`aud`) and issuer (`iss`) claims](#aud-and-iss-claims)
-- [JWT timestamps](#jwt-timestamps)
-
-#### JWT signature
-
-The upstream service should validate that the JWT was signed by the issuing authority.
-
-Pomerium issues and signs the new JWT with a private signing key. To validate the signature, the upstream service must fetch the corresponding public key from Pomerium's [JSON web key set](https://datatracker.ietf.org/doc/html/rfc7517#section-5) (JWKS) endpoint.
-
-To configure an upstream service to fetch the public key:
-
-1. Get the hostname from the JWT's `iss` claim
-1. Append the `/.well-known/pomerium/jwks.json` path to the hostname
-1. Prepend the `https://` scheme to the URL
-1. Set the `Accept: application/json` header in the request
-
-For example:
-
-
-
-
-```bash
-curl https://service.corp.example.com/.well-known/pomerium/jwks.json \
--H 'Accept: application/json'
-```
-
-
-
-
-```bash
-curl https:///.well-known/pomerium/jwks.json \
--H 'Accept: application/json'
-```
-
-
-
-
-The returned JWK key set contains Pomerium's public keys. Use the `kid` claim provided in the Pomerium JWT header to identify the correct key in the returned key set.
-
-```json title="JWKS response"
-{
- "keys": [
- {
- "use": "sig",
- "kty": "EC",
- // highlight-start
- "kid": "ccc5bc9d835ff3c8f7075ed4a7510159cf440fd7bf7b517b5caeb1fa419ee6a1",
- // highlight-end
- "crv": "P-256",
- "alg": "ES256",
- "x": "QCN7adG2AmIK3UdHJvVJkldsUc6XeBRz83Z4rXX8Va4",
- "y": "PI95b-ary66nrvA55TpaiWADq8b3O1CYIbvjqIHpXCY"
- }
- ]
-}
-```
-
-If the JWT signature can't be validated, the JWT is invalid and can't be trusted.
-
-#### Aud and iss claims
-
-The upstream service should verify that the `aud` and `iss` claims match the domain used to serve your application.
-
-The `aud` claim identifies the recipient the JWT is intended for. In the context of a service behind Pomerium, the `aud` claim should always be set as the upstream service's domain name.
-
-Since v0.22, Pomerium sets the `iss` claim also to the domain of the target upstream service. (In previous versions, this was instead set to the [authenticate service](/docs/reference/service-urls#authenticate-service-url) domain.)
-
-If the domain provided in the `aud` and `iss` claims doesn't match the upstream service's domain name, the JWT is invalid and can't be trusted.
-
-```json title="Valid aud and iss claims"
-{
- "aud": "verify.pomerium.app",
- "iss": "verify.pomerium.app"
-}
-```
-
-#### JWT timestamps
-
-The upstream service should verify that the Pomerium JWT has not expired.
-
-The `iat` claim informs you at what time the JWT was issued. The `exp` claim specifies the expiration time on or after which the JWT must be considered invalid. By default, Pomerium sets the `exp` claim to expire 5 minutes after the time it was issued.
-
-By comparing the current time with the timestamps in the `exp` and `iat` claims, you can verify if the JWT has expired or not. We recommend allowing up to a 1-minute leeway when comparing the `exp` and `iat` timestamps to account for [clock skew](https://en.wikipedia.org/wiki/Clock_skew) between Pomerium and the upstream service.
-
-If the JWT has expired, it is invalid and can't be trusted.
-
-:::tip JWT Verification with Pomerium SDKs
-
-Pomerium's [**JWT Verification**](/docs/guides/verify-jwt) guide shows you how to use our custom JWT libraries to parse and validate the Pomerium JWT in an upstream service.
-
-:::
-
-After the upstream service validates the JWT, it can accept the request and trust other claims present in the JWT.
-
-## The Pomerium JWT
-
-Pomerium generates a new **Pomerium JWT** based on the claims data contained in the original ID token. In addition to including standard claims as defined in [RFC7519](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1), Pomerium also injects its own claims into the Pomerium JWT as well. (See [JWT claims data](#jwt-claims-data) below for more details.)
-
-:::note
-
-The original ID token sourced from an identity provider is never modified or leaked to end users or upstream services.
-
-:::
-
-### Pomerium JWT claims data
-
-When Pomerium is configured for JWT authentication with the [pass identity headers](#jwt-settings) setting, the user's associated identity information will be included in the JWT assertion header in each upstream request.
-
-The Pomerium JWT contains at least the following claims:
-
-| JWT Claim | Description |
-| :-: | --- |
-| `jti` | A randomly generated UUID that represents the JWT ID. |
-| `exp` | Expiration time in seconds since the UNIX epoch. Set to expire 5 minutes after `iat` time. |
-| `iat` | Issued-at time in seconds since the UNIX epoch. |
-| `aud` | The domain for the upstream application (for example, `httpbin.corp.example.com`). |
-| `iss` | Same as the `aud` claim. |
-| `sub` | The user's ID, as specified by the identity provider. |
-| `email` | The user's email address. |
-| `groups` | The user's group memberships (if supported for the identity provider). |
-| `name` | The user's full name, as specified by the identity provider. |
-
-:::tip Prevent session replay attempts
-
-The `jti` claim (the JWT ID) contains a unique identifier assigned to each Pomerium JWT. If you can implement a system that checks the `jti` value in real time, you can prevent session replay attempts. Or, if you persist the `jti` value in your logs, you can detect replayed JWTs after the fact.
-
-:::
-
-### JWT Settings
-
-Use these settings to configure Pomerium to forward the Pomerium JWT to upstream services:
-
-- [Pass Identity Headers (global)](/docs/reference/pass-identity-headers)
-- [Pass Identity Headers (per route)](/docs/reference/routes/pass-identity-headers-per-route)
-
-If your identity provider provides other claims not included in the Pomerium JWT that you would like to pass to your application, you can use the [JWT Claims Headers](/docs/reference/jwt-claim-headers) option to include them in the JWT as well.
diff --git a/content/docs/capabilities/getting-users-identity.mdx b/content/docs/capabilities/getting-users-identity.mdx
new file mode 100644
index 000000000..af50d3428
--- /dev/null
+++ b/content/docs/capabilities/getting-users-identity.mdx
@@ -0,0 +1,201 @@
+---
+# cSpell:ignore ecparam genkey noout pubout secp256r1 QCN7adG2AmIK3UdHJvVJkldsUc6XeBRz83Z4rXX8Va4 ary66nrvA55TpaiWADq8b3O1CYIbvjqIHpXCY envoyproxy Jklds Tpai Ibvjq Lamda
+
+title: Continious Identity Verification at the Application Layer
+description: Learn how Pomerium uses JWTs for identity and context verification, how it fits into a zero trust environment, and four ways to validate the JWT in your upstream service.
+sidebar_label: Continious Identity Verification
+keywords:
+ - jwt
+ - jwt authentication
+ - sso
+ - single sign-on
+ - identity verification
+ - request verification
+ - pomerium
+ - zero trust
+ - pass identity headers
+ - jwks
+ - envoy
+ - go
+ - node
+ - sidecar
+---
+
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+import GoApp from '/content/examples/go-sdk/go-app.md';
+import ExpressApp from '/content/examples/js-sdk/express-server.md';
+
+
+
+Pomerium uses JSON Web Tokens (JWTs) to help your upstream services verify a user's identity and additional context (like group membership) at the **application layer**. In a zero trust environment, verifying that **both** the client and server are who they say they are is crucial. Pomerium handles user authentication, then mints a **signed JWT** for every verified and authorized request.
+
+By validating that JWT, your application or service confirms:
+
+- The request came from Pomerium (a trusted policy enforcement point).
+- The user's identity is legitimate and authorized, according to policy.
+- The JWT is specifically intended for the service (not some other application).
+
+This article explains **why** identity & context verification at the application layer is important, **how** JWT-based verification works, and **four different approaches** you can use to verify JWTs:
+
+1. **Manually** (to understand the process)
+2. **3rd-party app** with built-in JWT support (like Grafana)
+3. **Custom application** (using an existing JWT library or Pomerium's SDK)
+4. **Sidecar** (no code changes, e.g. Envoy proxy)
+
+## JWT Authentication Flow
+
+![A diagram that shows how Pomerium forwards JWTs to an upstream application](./img/jwt-authn/jwt-authentication.svg)
+
+1. **User authenticates**
+ Pomerium redirects the user to your OIDC-compliant identity provider (IdP).
+2. **Pomerium issues a signed JWT**
+ After the user is authenticated, Pomerium mints a **new** JWT.
+3. **JWT assertion header**
+ The JWT goes in the `X-Pomerium-Jwt-Assertion` header, following [RFC7519](https://datatracker.ietf.org/doc/html/rfc7519) encoding.
+4. **Upstream service verifies**
+ Your application (or a helper process) confirms the JWT's signature, audience, issuer, and timestamps.
+
+If everything checks out, your service can trust the identity data in the token for additional authorization or logging.
+
+## Why JWT-Based Verification?
+
+- **Zero Trust**: Enforces that _every_ request is from a legitimate, authenticated user.
+- **Application Layer**: Even if TLS terminates at Pomerium, the downstream service can verify the request is valid.
+- **Single Sign-On**: A single IdP login flows downstream. Your app can read the user's email, groups, etc., from the JWT.
+- **Local Validation**: JWTs are stateless. After an initial login, your service doesn't need to call the IdP again; it simply verifies the token signature.
+
+## JWT Details
+
+A Pomerium-issued JWT typically has standard fields plus additional claims:
+
+- **`exp`** (expiration), **`iat`** (issued-at), **`sub`** (user ID), **`aud`**, **`iss`**
+- **`email`** (from IdP), **`groups`** (if available), **`name`** (if provided)
+
+The **original** ID token from your IdP is never forwarded. Instead, Pomerium reissues a fresh token under its own signing key.
+
+## Verifying a JWT
+
+Your upstream must ensure:
+
+1. **Signature**: The JWT was signed by Pomerium's private key.
+2. **Audience & Issuer**: `aud` and `iss` match your service domain.
+3. **Expiration**: The token is still valid (`exp` > now).
+
+### Fetch the Public Key (JWKS)
+
+Your upstream can automatically fetch Pomerium's public key:
+
+```bash
+curl https:///.well-known/pomerium/jwks.json \
+ -H 'Accept: application/json'
+```
+
+Pick the key matching the `kid` claim in the JWT header to verify its signature.
+
+## Four Approaches to JWT Validation
+
+### 1. Manual Verification
+
+Useful for learning or debugging:
+
+1. **Provide Pomerium a private key**:
+ ```bash
+ openssl ecparam -genkey -name prime256v1 -noout -out ec_private.pem
+ openssl ec -in ec_private.pem -pubout -out ec_public.pem
+ cat ec_private.pem | base64 # copy to SIGNING_KEY in Pomerium config
+ ```
+2. **Inspect the header** (`X-Pomerium-Jwt-Assertion`) in a request after you've logged in.
+3. **Decode** the token on a site like [jwt.io](https://jwt.io/) or a local JWT decoder library.
+4. **Paste** your `ec_public.pem` into the decoder's “verify signature” field. If it's valid, the user claims are genuine.
+
+:::info Example Screenshots
+
+If you use `httpbin` to inspect headers, you might see:
+
+![httpbin displaying jwt headers](./img/jwt/inspect-headers.png)
+
+Decoded, you'll see the claims:
+
+![httpbin displaying decoded jwt](./img/jwt/verifying-headers-1.png)
+
+After adding your public key, you should see a verified signature:
+
+![httpbin displaying verified jwt](./img/jwt/jwt-payload.png)
+
+:::
+
+### 2. 3rd-Party App with Built-In JWT Support
+
+Many modern platforms (for example, **Grafana**) allow you to configure JWT-based SSO. Once you enable JWT authentication in Grafana (and point it to Pomerium's JWKS endpoint), all inbound requests with a valid `X-Pomerium-Jwt-Assertion` token are accepted for user identity. Grafana (or your chosen app) sees the user's email, groups, etc., and can apply its own RBAC logic.
+
+For a real-world example, see our [Grafana](/docs/guides/grafana) guide.
+
+### 3. Custom Application (JWT Libraries or Pomerium SDK)
+
+If you're building a custom in-house app, you can parse and validate the JWT using a standard library or one of Pomerium's SDKs:
+
+**Go Example**
+
+
+
+**Node/JS Example**
+
+
+
+Your application:
+
+1. Extracts the token from the `X-Pomerium-Jwt-Assertion` header.
+2. Uses a JWT library (or Pomerium's SDK) to verify the signature via the JWKS URL.
+3. Confirms `aud`, `iss`, and `exp`.
+4. Trusts the user claims (like `email`, `groups`, etc.) if valid.
+
+**Tip:** In Pomerium's JS SDK, if you don't specify `issuer` and `audience`, it applies trust-on-first-use (TOFU) logic. We recommend explicitly setting these in production.
+
+### 4. Sidecar (Envoy)
+
+If you can't modify your app's code, run a [Envoy](https://www.envoyproxy.io/) sidecar to check JWTs before requests reach the app. Envoy's [JWT Authn filter](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/jwt_authn_filter) automatically retrieves Pomerium's JWKS and enforces valid tokens.
+
+```yaml
+http_filters:
+ - name: envoy.filters.http.jwt_authn
+ typed_config:
+ '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
+ providers:
+ pomerium:
+ issuer: myapp.localhost.pomerium.io
+ audiences:
+ - myapp.localhost.pomerium.io
+ from_headers:
+ - name: X-Pomerium-Jwt-Assertion
+ remote_jwks:
+ http_uri:
+ uri: https://myapp.localhost.pomerium.io/.well-known/pomerium/jwks.json
+ cluster: egress-authenticate
+ timeout: 1s
+ rules:
+ - match:
+ prefix: /
+ requires:
+ provider_name: pomerium
+```
+
+With a sidecar, your main application doesn't need to be JWT-aware. Envoy rejects bad tokens and only forwards valid requests.
+
+## Conclusion
+
+JWT-based identity & context verification lets your upstream service confirm each request is coming from a trusted policy enforcement point (Pomerium) and that the user's identity is valid. You can choose whichever approach fits best:
+
+- **Manual** for debugging or demonstration.
+- **3rd-Party app** if it already supports JWT.
+- **Custom app** with libraries or Pomerium's SDK.
+- **Sidecar** if you can't modify your code.
+
+Regardless of approach, the result is the same: a zero trust environment where your application is confident every incoming request is from a legitimate user, with valid identity claims. Once verified, you can apply your own additional rules (RBAC, logging, or anything else that uses user context) without re-checking the IdP.
diff --git a/content/docs/capabilities/hosted-authenticate-service.md b/content/docs/capabilities/hosted-authenticate-service.md
deleted file mode 100644
index bb119c7a4..000000000
--- a/content/docs/capabilities/hosted-authenticate-service.md
+++ /dev/null
@@ -1,124 +0,0 @@
----
-id: hosted-authenticate-service
-title: Hosted Authenticate Service
-sidebar_label: Hosted Authenticate Service
-keywords: [hosted authenticate service url, hosted identity provider]
-description: Use Pomerium's Hosted Authenticate Service to set up and deploy Pomerium quickly.
----
-
-# Hosted Authenticate Service
-
-Pomerium's **Hosted Authenticate Service** provides a hosted alternative to the self-hosted authenticate service.
-
-Introduced in Pomerium v0.22, the hosted authenticate service is available for open-source Pomerium, Pomerium Zero, and Pomerium Enterprise.
-
-## How the hosted authenticate service works
-
-Pomerium's hosted authenticate service includes a **Hosted Authenticate Service URL** and a **Hosted Identity Provider** that handle authentication and authorization using OAuth 2.0 and OIDC protocols.
-
-Pomerium Zero, Core, and Enterprise configurations that do not include the self-hosted authenticate service URL or identity provider settings default to the hosted authenticate service settings. See [Configure the hosted authenticate service](#configure-the-hosted-authenticate-service) section for more information.
-
-## Why use the hosted authenticate service
-
-The hosted authenticate service offers a quicker way for users to deploy and test Pomerium.
-
-### No configuration
-
-The hosted authenticate service doesn't require an authenticate service URL or identity provider settings to use.
-
-### Less time to deploy
-
-Pomerium's hosted authenticate service removes the tedium of configuring your own identity provider (IdP) and authenticate service URL so you can deploy Pomerium in less time.
-
-### Faster proof of concept
-
-If you're testing Pomerium for the first time, run [Pomerium with Docker](/docs/core/quickstart) using our hosted authenticate service – you can run Pomerium Core in **under 5 minutes** with minimal setup.
-
-:::enterprise
-
-Pomerium users who are interested in [Pomerium Enterprise](https://www.pomerium.com/enterprise-sales/) can test out the [Docker Enterprise quickstart](/docs/enterprise/quickstart) using our hosted authenticate service as well.
-
-:::
-
-## Configure the hosted authenticate service
-
-The hosted authenticate service requires no configuration to use.
-
-Add the following route and policy to your configuration file:
-
-```yaml title="pomerium-config.yaml"
-routes:
- - from: https://verify.localhost.pomerium.io
- to: http://verify:8000
- policy:
- - allow:
- or:
- - email:
- is: user@example.com
- pass_identity_headers: true
-```
-
-This minimal configuration is all you need to connect to an upstream service with Pomerium's hosted services.
-
-If you want, you can still include the hosted URL in your configuration:
-
-```yaml title="pomerium-config.yaml"
-authenticate_service_url: https://authenticate.pomerium.app
-
-routes:
- - from: https://verify.localhost.pomerium.io
- to: http://verify:8000
- policy:
- - allow:
- or:
- - email:
- is: user@example.com
- pass_identity_headers: true
-```
-
-If you use the hosted URL and include your own IdP settings, Pomerium will override your IdP configuration and use the hosted IdP instead:
-
-```yaml title="pomerium-config.yaml"
-authenticate_service_url: https://authenticate.pomerium.app
-
-idp_provider: google
-idp_client_id: my_client_id
-idp_client_secret: my_client_secret
-
-routes:
- - from: https://verify.localhost.pomerium.io
- to: http://verify:8000
- policy:
- - allow:
- or:
- - email:
- is: user@example.com
- pass_identity_headers: true
-```
-
-## Limitations
-
-**Limited sign-in options**
-
-Currently, you can only authenticate with Google single-sign on or with email and password credentials.
-
-**Session management**
-
-The hosted authenticate service is separate from your Pomerium installation. This means you can't refresh session tokens, so users must re-authenticate after roughly one hour.
-
-**Uptime commitment**
-
-We make no commitments to uptime for our free hosted authenticate service.
-
-## Privacy considerations
-
-Users that take advantage of our hosted authenticate service should review the [Terms of Service agreement](https://www.pomerium.com/pomerium-zero-user-agreement/).
-
-Specifically, you should be aware that by using our hosted services, you agree to Pomerium collecting the following data:
-
-- IP address
-- OS version
-- Internal domain name
-- Session details (email, name, and domain)
-
-We collect this information to better understand how our users interact with and use Pomerium's services.
diff --git a/content/docs/capabilities/img/authorization/apply-policies-to-routes.png b/content/docs/capabilities/img/authorization/apply-policies-to-routes.png
index 8a2a6df62..12baf5ca2 100644
Binary files a/content/docs/capabilities/img/authorization/apply-policies-to-routes.png and b/content/docs/capabilities/img/authorization/apply-policies-to-routes.png differ
diff --git a/content/docs/capabilities/img/authorization/console-devices.png b/content/docs/capabilities/img/authorization/console-devices.png
index 3e9de4bae..fedea3ca8 100644
Binary files a/content/docs/capabilities/img/authorization/console-devices.png and b/content/docs/capabilities/img/authorization/console-devices.png differ
diff --git a/content/docs/capabilities/img/authorization/enroll-device.png b/content/docs/capabilities/img/authorization/enroll-device.png
index a6289e48d..d6835f5ef 100644
Binary files a/content/docs/capabilities/img/authorization/enroll-device.png and b/content/docs/capabilities/img/authorization/enroll-device.png differ
diff --git a/content/docs/capabilities/img/authorization/ppl-edit-policy.png b/content/docs/capabilities/img/authorization/ppl-edit-policy.png
index a9d859f69..d19fe53f6 100644
Binary files a/content/docs/capabilities/img/authorization/ppl-edit-policy.png and b/content/docs/capabilities/img/authorization/ppl-edit-policy.png differ
diff --git a/content/docs/capabilities/img/authorization/ppl-gui-policy.png b/content/docs/capabilities/img/authorization/ppl-gui-policy.png
index 2ad563284..79a2e2069 100644
Binary files a/content/docs/capabilities/img/authorization/ppl-gui-policy.png and b/content/docs/capabilities/img/authorization/ppl-gui-policy.png differ
diff --git a/content/docs/capabilities/img/authorization/ppl-rego-policy.png b/content/docs/capabilities/img/authorization/ppl-rego-policy.png
index 8cb91ed95..0842fa805 100644
Binary files a/content/docs/capabilities/img/authorization/ppl-rego-policy.png and b/content/docs/capabilities/img/authorization/ppl-rego-policy.png differ
diff --git a/content/docs/capabilities/img/branding/branded_colors_console.png b/content/docs/capabilities/img/branding/branded_colors_console.png
index ffb542305..d666787cb 100644
Binary files a/content/docs/capabilities/img/branding/branded_colors_console.png and b/content/docs/capabilities/img/branding/branded_colors_console.png differ
diff --git a/content/docs/capabilities/img/branding/branded_colors_darkmode_console.png b/content/docs/capabilities/img/branding/branded_colors_darkmode_console.png
index 7b1bedae1..e935bae84 100644
Binary files a/content/docs/capabilities/img/branding/branded_colors_darkmode_console.png and b/content/docs/capabilities/img/branding/branded_colors_darkmode_console.png differ
diff --git a/content/docs/capabilities/img/branding/branded_colors_error_details.png b/content/docs/capabilities/img/branding/branded_colors_error_details.png
index 955901cba..13594cb89 100644
Binary files a/content/docs/capabilities/img/branding/branded_colors_error_details.png and b/content/docs/capabilities/img/branding/branded_colors_error_details.png differ
diff --git a/content/docs/capabilities/img/branding/enable_error_details.png b/content/docs/capabilities/img/branding/enable_error_details.png
index 2cf38cfc7..4ea4dea66 100644
Binary files a/content/docs/capabilities/img/branding/enable_error_details.png and b/content/docs/capabilities/img/branding/enable_error_details.png differ
diff --git a/content/docs/capabilities/img/branding/error_details_enabled.png b/content/docs/capabilities/img/branding/error_details_enabled.png
index dd7cc1e10..d3e767211 100644
Binary files a/content/docs/capabilities/img/branding/error_details_enabled.png and b/content/docs/capabilities/img/branding/error_details_enabled.png differ
diff --git a/content/docs/capabilities/img/branding/first_paragraph_setting.png b/content/docs/capabilities/img/branding/first_paragraph_setting.png
index 4dd6032f4..fc1b5871b 100644
Binary files a/content/docs/capabilities/img/branding/first_paragraph_setting.png and b/content/docs/capabilities/img/branding/first_paragraph_setting.png differ
diff --git a/content/docs/capabilities/img/branding/includes_first_paragraph.png b/content/docs/capabilities/img/branding/includes_first_paragraph.png
index 9c9979d36..fcc860c4b 100644
Binary files a/content/docs/capabilities/img/branding/includes_first_paragraph.png and b/content/docs/capabilities/img/branding/includes_first_paragraph.png differ
diff --git a/content/docs/capabilities/img/branding/no_branding_settings.png b/content/docs/capabilities/img/branding/no_branding_settings.png
index 41e266a38..17f1ca643 100644
Binary files a/content/docs/capabilities/img/branding/no_branding_settings.png and b/content/docs/capabilities/img/branding/no_branding_settings.png differ
diff --git a/content/docs/capabilities/img/branding/policy_with_explanation_and_remediation.png b/content/docs/capabilities/img/branding/policy_with_explanation_and_remediation.png
index 25dedf054..63de4b41d 100644
Binary files a/content/docs/capabilities/img/branding/policy_with_explanation_and_remediation.png and b/content/docs/capabilities/img/branding/policy_with_explanation_and_remediation.png differ
diff --git a/content/docs/capabilities/img/branding/secondary_color.png b/content/docs/capabilities/img/branding/secondary_color.png
index 9840cc13e..f74fd00be 100644
Binary files a/content/docs/capabilities/img/branding/secondary_color.png and b/content/docs/capabilities/img/branding/secondary_color.png differ
diff --git a/content/docs/capabilities/img/branding/svg_logo_console.png b/content/docs/capabilities/img/branding/svg_logo_console.png
index e0ee38098..8db5dd4df 100644
Binary files a/content/docs/capabilities/img/branding/svg_logo_console.png and b/content/docs/capabilities/img/branding/svg_logo_console.png differ
diff --git a/content/docs/capabilities/img/branding/svg_logo_error_details.png b/content/docs/capabilities/img/branding/svg_logo_error_details.png
index 133d6fcf3..91901fd37 100644
Binary files a/content/docs/capabilities/img/branding/svg_logo_error_details.png and b/content/docs/capabilities/img/branding/svg_logo_error_details.png differ
diff --git a/content/docs/capabilities/img/branding/unbranded_error_page.png b/content/docs/capabilities/img/branding/unbranded_error_page.png
index c856e51cb..202a625eb 100644
Binary files a/content/docs/capabilities/img/branding/unbranded_error_page.png and b/content/docs/capabilities/img/branding/unbranded_error_page.png differ
diff --git a/content/docs/capabilities/img/custom-domains/add-custom-domain.gif b/content/docs/capabilities/img/custom-domains/add-custom-domain.gif
index 8a8a3c964..80ef9e16a 100644
Binary files a/content/docs/capabilities/img/custom-domains/add-custom-domain.gif and b/content/docs/capabilities/img/custom-domains/add-custom-domain.gif differ
diff --git a/content/docs/capabilities/img/custom-domains/certificate-details.gif b/content/docs/capabilities/img/custom-domains/certificate-details.gif
index cc6ec6677..2d271800a 100644
Binary files a/content/docs/capabilities/img/custom-domains/certificate-details.gif and b/content/docs/capabilities/img/custom-domains/certificate-details.gif differ
diff --git a/content/docs/capabilities/img/custom-domains/custom-domain-certificates.png b/content/docs/capabilities/img/custom-domains/custom-domain-certificates.png
index 82b0a8343..03f6f1900 100644
Binary files a/content/docs/capabilities/img/custom-domains/custom-domain-certificates.png and b/content/docs/capabilities/img/custom-domains/custom-domain-certificates.png differ
diff --git a/content/docs/capabilities/img/custom-domains/gcp-cname-record.png b/content/docs/capabilities/img/custom-domains/gcp-cname-record.png
index 36ad2f09a..98f85d581 100644
Binary files a/content/docs/capabilities/img/custom-domains/gcp-cname-record.png and b/content/docs/capabilities/img/custom-domains/gcp-cname-record.png differ
diff --git a/content/docs/capabilities/img/directory-sync/device-enrollment.png b/content/docs/capabilities/img/directory-sync/device-enrollment.png
deleted file mode 100644
index bde6cf0e5..000000000
Binary files a/content/docs/capabilities/img/directory-sync/device-enrollment.png and /dev/null differ
diff --git a/content/docs/capabilities/img/directory-sync/directory-sync-group-criteria.png b/content/docs/capabilities/img/directory-sync/directory-sync-group-criteria.png
deleted file mode 100644
index 70bce5637..000000000
Binary files a/content/docs/capabilities/img/directory-sync/directory-sync-group-criteria.png and /dev/null differ
diff --git a/content/docs/capabilities/img/directory-sync/directory-sync-idp-tab.gif b/content/docs/capabilities/img/directory-sync/directory-sync-idp-tab.gif
deleted file mode 100644
index d0535f629..000000000
Binary files a/content/docs/capabilities/img/directory-sync/directory-sync-idp-tab.gif and /dev/null differ
diff --git a/content/docs/capabilities/img/impersonation/add-service-account-to-policy.gif b/content/docs/capabilities/img/impersonation/add-service-account-to-policy.gif
index c02c7213c..1971e0e8a 100644
Binary files a/content/docs/capabilities/img/impersonation/add-service-account-to-policy.gif and b/content/docs/capabilities/img/impersonation/add-service-account-to-policy.gif differ
diff --git a/content/docs/capabilities/img/impersonation/create-service-account.gif b/content/docs/capabilities/img/impersonation/create-service-account.gif
index 66392bb91..e0a5baa39 100644
Binary files a/content/docs/capabilities/img/impersonation/create-service-account.gif and b/content/docs/capabilities/img/impersonation/create-service-account.gif differ
diff --git a/content/docs/capabilities/img/impersonation/impersonation.gif b/content/docs/capabilities/img/impersonation/impersonation.gif
index fcfea1ceb..7752a58dc 100644
Binary files a/content/docs/capabilities/img/impersonation/impersonation.gif and b/content/docs/capabilities/img/impersonation/impersonation.gif differ
diff --git a/content/docs/capabilities/img/jwt-authn/jwt-authentication.svg b/content/docs/capabilities/img/jwt-authn/jwt-authentication.svg
index 8764aee91..7a7bdecc7 100644
--- a/content/docs/capabilities/img/jwt-authn/jwt-authentication.svg
+++ b/content/docs/capabilities/img/jwt-authn/jwt-authentication.svg
@@ -1 +1 @@
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/content/docs/capabilities/img/jwt/inspect-headers.png b/content/docs/capabilities/img/jwt/inspect-headers.png
new file mode 100644
index 000000000..26ad49b04
Binary files /dev/null and b/content/docs/capabilities/img/jwt/inspect-headers.png differ
diff --git a/content/docs/capabilities/img/jwt/jwt-payload.png b/content/docs/capabilities/img/jwt/jwt-payload.png
new file mode 100644
index 000000000..3e8905487
Binary files /dev/null and b/content/docs/capabilities/img/jwt/jwt-payload.png differ
diff --git a/content/docs/capabilities/img/jwt/verifying-headers-1.png b/content/docs/capabilities/img/jwt/verifying-headers-1.png
new file mode 100644
index 000000000..3e5b196f2
Binary files /dev/null and b/content/docs/capabilities/img/jwt/verifying-headers-1.png differ
diff --git a/content/docs/capabilities/img/kubernetes/kubernetes-auth-jwt.svg b/content/docs/capabilities/img/kubernetes/kubernetes-auth-jwt.svg
index f2974ebeb..f0cd1494b 100644
--- a/content/docs/capabilities/img/kubernetes/kubernetes-auth-jwt.svg
+++ b/content/docs/capabilities/img/kubernetes/kubernetes-auth-jwt.svg
@@ -1 +1 @@
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/content/docs/capabilities/img/kubernetes/kubernetes-integration.svg b/content/docs/capabilities/img/kubernetes/kubernetes-integration.svg
index d80842a95..3dfad2220 100644
--- a/content/docs/capabilities/img/kubernetes/kubernetes-integration.svg
+++ b/content/docs/capabilities/img/kubernetes/kubernetes-integration.svg
@@ -1,3 +1 @@
-
-
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/content/docs/capabilities/img/logged-in-as.png b/content/docs/capabilities/img/logged-in-as.png
index 7de800a74..3eef6af88 100644
Binary files a/content/docs/capabilities/img/logged-in-as.png and b/content/docs/capabilities/img/logged-in-as.png differ
diff --git a/content/docs/capabilities/img/metrics/enterprise-authorized-requests.png b/content/docs/capabilities/img/metrics/enterprise-authorized-requests.png
deleted file mode 100644
index b840f5ff6..000000000
Binary files a/content/docs/capabilities/img/metrics/enterprise-authorized-requests.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/enterprise-filter-traffic.gif b/content/docs/capabilities/img/metrics/enterprise-filter-traffic.gif
deleted file mode 100644
index 64ebdae34..000000000
Binary files a/content/docs/capabilities/img/metrics/enterprise-filter-traffic.gif and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/enterprise-healthy-upstream-endpoints-graph.png b/content/docs/capabilities/img/metrics/enterprise-healthy-upstream-endpoints-graph.png
deleted file mode 100644
index b6baf1fd4..000000000
Binary files a/content/docs/capabilities/img/metrics/enterprise-healthy-upstream-endpoints-graph.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/enterprise-metrics-namespaces.gif b/content/docs/capabilities/img/metrics/enterprise-metrics-namespaces.gif
deleted file mode 100644
index 11be1dbc8..000000000
Binary files a/content/docs/capabilities/img/metrics/enterprise-metrics-namespaces.gif and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/enterprise-percentile-ranges.gif b/content/docs/capabilities/img/metrics/enterprise-percentile-ranges.gif
deleted file mode 100644
index 7695de2b4..000000000
Binary files a/content/docs/capabilities/img/metrics/enterprise-percentile-ranges.gif and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/enterprise-request-duration.png b/content/docs/capabilities/img/metrics/enterprise-request-duration.png
deleted file mode 100644
index b5c371a5e..000000000
Binary files a/content/docs/capabilities/img/metrics/enterprise-request-duration.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/enterprise-request-rate.png b/content/docs/capabilities/img/metrics/enterprise-request-rate.png
deleted file mode 100644
index 4840d79d9..000000000
Binary files a/content/docs/capabilities/img/metrics/enterprise-request-rate.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/enterprise-request-size.png b/content/docs/capabilities/img/metrics/enterprise-request-size.png
deleted file mode 100644
index 7daf84b20..000000000
Binary files a/content/docs/capabilities/img/metrics/enterprise-request-size.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/enterprise-response-status-codes.gif b/content/docs/capabilities/img/metrics/enterprise-response-status-codes.gif
deleted file mode 100644
index 9bb7a357d..000000000
Binary files a/content/docs/capabilities/img/metrics/enterprise-response-status-codes.gif and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/enterprise-total-requests.png b/content/docs/capabilities/img/metrics/enterprise-total-requests.png
deleted file mode 100644
index 79e5e0af4..000000000
Binary files a/content/docs/capabilities/img/metrics/enterprise-total-requests.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/reports-runtime-fullpage.png b/content/docs/capabilities/img/metrics/reports-runtime-fullpage.png
deleted file mode 100644
index d48cc46eb..000000000
Binary files a/content/docs/capabilities/img/metrics/reports-runtime-fullpage.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/reports-runtime.png b/content/docs/capabilities/img/metrics/reports-runtime.png
deleted file mode 100644
index 061518029..000000000
Binary files a/content/docs/capabilities/img/metrics/reports-runtime.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/reports-sessions-fullpage.png b/content/docs/capabilities/img/metrics/reports-sessions-fullpage.png
deleted file mode 100644
index fbdb39a38..000000000
Binary files a/content/docs/capabilities/img/metrics/reports-sessions-fullpage.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/zero-authorized-and-denied-chart.png b/content/docs/capabilities/img/metrics/zero-authorized-and-denied-chart.png
deleted file mode 100644
index d053c919c..000000000
Binary files a/content/docs/capabilities/img/metrics/zero-authorized-and-denied-chart.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/zero-bytes-sent-received.png b/content/docs/capabilities/img/metrics/zero-bytes-sent-received.png
deleted file mode 100644
index bc6626245..000000000
Binary files a/content/docs/capabilities/img/metrics/zero-bytes-sent-received.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/zero-changesets.png b/content/docs/capabilities/img/metrics/zero-changesets.png
deleted file mode 100644
index 538fd8c46..000000000
Binary files a/content/docs/capabilities/img/metrics/zero-changesets.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/zero-deployments-changesets.gif b/content/docs/capabilities/img/metrics/zero-deployments-changesets.gif
deleted file mode 100644
index 2504c6e00..000000000
Binary files a/content/docs/capabilities/img/metrics/zero-deployments-changesets.gif and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/zero-filter-traffic.gif b/content/docs/capabilities/img/metrics/zero-filter-traffic.gif
deleted file mode 100644
index b2f034fec..000000000
Binary files a/content/docs/capabilities/img/metrics/zero-filter-traffic.gif and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/zero-find-metrics.gif b/content/docs/capabilities/img/metrics/zero-find-metrics.gif
deleted file mode 100644
index 81a4f8efd..000000000
Binary files a/content/docs/capabilities/img/metrics/zero-find-metrics.gif and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/zero-find-traffic-dashboard.png b/content/docs/capabilities/img/metrics/zero-find-traffic-dashboard.png
deleted file mode 100644
index 6a3a04c3c..000000000
Binary files a/content/docs/capabilities/img/metrics/zero-find-traffic-dashboard.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/zero-request-duration-second-chart.png b/content/docs/capabilities/img/metrics/zero-request-duration-second-chart.png
deleted file mode 100644
index ce82f4192..000000000
Binary files a/content/docs/capabilities/img/metrics/zero-request-duration-second-chart.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/zero-request-duration.png b/content/docs/capabilities/img/metrics/zero-request-duration.png
deleted file mode 100644
index 18b83d588..000000000
Binary files a/content/docs/capabilities/img/metrics/zero-request-duration.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/zero-requests-per-second.png b/content/docs/capabilities/img/metrics/zero-requests-per-second.png
deleted file mode 100644
index 3970421f6..000000000
Binary files a/content/docs/capabilities/img/metrics/zero-requests-per-second.png and /dev/null differ
diff --git a/content/docs/capabilities/img/metrics/zero-total-and-authorized-requests.png b/content/docs/capabilities/img/metrics/zero-total-and-authorized-requests.png
deleted file mode 100644
index 2cc0cf884..000000000
Binary files a/content/docs/capabilities/img/metrics/zero-total-and-authorized-requests.png and /dev/null differ
diff --git a/content/docs/capabilities/img/mtls/01-chrome-settings-certificates.png b/content/docs/capabilities/img/mtls/01-chrome-settings-certificates.png
deleted file mode 100644
index a5a38359d..000000000
Binary files a/content/docs/capabilities/img/mtls/01-chrome-settings-certificates.png and /dev/null differ
diff --git a/content/docs/capabilities/img/mtls/02-import-client-certificate.png b/content/docs/capabilities/img/mtls/02-import-client-certificate.png
deleted file mode 100644
index 1f96e3426..000000000
Binary files a/content/docs/capabilities/img/mtls/02-import-client-certificate.png and /dev/null differ
diff --git a/content/docs/capabilities/img/mtls/03-enter-certificate-password.png b/content/docs/capabilities/img/mtls/03-enter-certificate-password.png
deleted file mode 100644
index 9b1fa24ae..000000000
Binary files a/content/docs/capabilities/img/mtls/03-enter-certificate-password.png and /dev/null differ
diff --git a/content/docs/capabilities/img/mtls/04-certificate-list.png b/content/docs/capabilities/img/mtls/04-certificate-list.png
deleted file mode 100644
index 6f04e3be8..000000000
Binary files a/content/docs/capabilities/img/mtls/04-certificate-list.png and /dev/null differ
diff --git a/content/docs/capabilities/img/mtls/05-select-client-certificate.png b/content/docs/capabilities/img/mtls/05-select-client-certificate.png
deleted file mode 100644
index d71b628c7..000000000
Binary files a/content/docs/capabilities/img/mtls/05-select-client-certificate.png and /dev/null differ
diff --git a/content/docs/capabilities/img/mtls/openssl-test1.png b/content/docs/capabilities/img/mtls/openssl-test1.png
deleted file mode 100644
index 76ad069fd..000000000
Binary files a/content/docs/capabilities/img/mtls/openssl-test1.png and /dev/null differ
diff --git a/content/docs/capabilities/img/ppl/exists-operator.png b/content/docs/capabilities/img/ppl/exists-operator.png
deleted file mode 100644
index 9a95d19d9..000000000
Binary files a/content/docs/capabilities/img/ppl/exists-operator.png and /dev/null differ
diff --git a/content/docs/capabilities/img/ppl/numerical-comparison-operators.png b/content/docs/capabilities/img/ppl/numerical-comparison-operators.png
deleted file mode 100644
index 1140e5e76..000000000
Binary files a/content/docs/capabilities/img/ppl/numerical-comparison-operators.png and /dev/null differ
diff --git a/content/docs/capabilities/img/reports/reports-deployments-diff.png b/content/docs/capabilities/img/reports/reports-deployments-diff.png
index cd5738de9..c1ea9241b 100644
Binary files a/content/docs/capabilities/img/reports/reports-deployments-diff.png and b/content/docs/capabilities/img/reports/reports-deployments-diff.png differ
diff --git a/content/docs/capabilities/img/reports/reports-traffic-fullpage.png b/content/docs/capabilities/img/reports/reports-traffic-fullpage.png
index 8c8055bb6..fc97119db 100644
Binary files a/content/docs/capabilities/img/reports/reports-traffic-fullpage.png and b/content/docs/capabilities/img/reports/reports-traffic-fullpage.png differ
diff --git a/content/docs/capabilities/img/routing/migrate-routes.png b/content/docs/capabilities/img/routing/migrate-routes.png
index cd4eb0361..8a9fff08a 100644
Binary files a/content/docs/capabilities/img/routing/migrate-routes.png and b/content/docs/capabilities/img/routing/migrate-routes.png differ
diff --git a/content/docs/capabilities/img/service-accounts/add-service-account.png b/content/docs/capabilities/img/service-accounts/add-service-account.png
index bbdccdd5b..ebb1e3f55 100644
Binary files a/content/docs/capabilities/img/service-accounts/add-service-account.png and b/content/docs/capabilities/img/service-accounts/add-service-account.png differ
diff --git a/content/docs/capabilities/img/service-accounts/console-service-account.png b/content/docs/capabilities/img/service-accounts/console-service-account.png
index b78fb4656..28d1c6c1c 100644
Binary files a/content/docs/capabilities/img/service-accounts/console-service-account.png and b/content/docs/capabilities/img/service-accounts/console-service-account.png differ
diff --git a/content/docs/capabilities/img/service-accounts/create-policy-1.png b/content/docs/capabilities/img/service-accounts/create-policy-1.png
index 62138b390..a2d4f3fc4 100644
Binary files a/content/docs/capabilities/img/service-accounts/create-policy-1.png and b/content/docs/capabilities/img/service-accounts/create-policy-1.png differ
diff --git a/content/docs/capabilities/img/service-accounts/create-policy-2.png b/content/docs/capabilities/img/service-accounts/create-policy-2.png
index 32f9c221f..e064006ec 100644
Binary files a/content/docs/capabilities/img/service-accounts/create-policy-2.png and b/content/docs/capabilities/img/service-accounts/create-policy-2.png differ
diff --git a/content/docs/capabilities/img/service-accounts/create-service-account.png b/content/docs/capabilities/img/service-accounts/create-service-account.png
index 2d5505b7e..ddb2d3c8f 100644
Binary files a/content/docs/capabilities/img/service-accounts/create-service-account.png and b/content/docs/capabilities/img/service-accounts/create-service-account.png differ
diff --git a/content/docs/capabilities/img/service-accounts/service-account-jwt.png b/content/docs/capabilities/img/service-accounts/service-account-jwt.png
index 7aa664734..d072c8d53 100644
Binary files a/content/docs/capabilities/img/service-accounts/service-account-jwt.png and b/content/docs/capabilities/img/service-accounts/service-account-jwt.png differ
diff --git a/content/docs/capabilities/img/single-sign-out/sign-out-flow.svg b/content/docs/capabilities/img/single-sign-out/sign-out-flow.svg
index d2ab55d3d..f155933f6 100644
--- a/content/docs/capabilities/img/single-sign-out/sign-out-flow.svg
+++ b/content/docs/capabilities/img/single-sign-out/sign-out-flow.svg
@@ -1,5240 +1 @@
-
-
-
+
\ No newline at end of file
diff --git a/content/docs/capabilities/img/verifying-headers-2.png b/content/docs/capabilities/img/verifying-headers-2.png
index 67883ef7a..74164a2e0 100644
Binary files a/content/docs/capabilities/img/verifying-headers-2.png and b/content/docs/capabilities/img/verifying-headers-2.png differ
diff --git a/content/docs/capabilities/img/webauthn/450-error.png b/content/docs/capabilities/img/webauthn/450-error.png
deleted file mode 100644
index be361bafd..000000000
Binary files a/content/docs/capabilities/img/webauthn/450-error.png and /dev/null differ
diff --git a/content/docs/capabilities/img/webauthn/admin-enroll-1.png b/content/docs/capabilities/img/webauthn/admin-enroll-1.png
deleted file mode 100644
index 7cdc2e80b..000000000
Binary files a/content/docs/capabilities/img/webauthn/admin-enroll-1.png and /dev/null differ
diff --git a/content/docs/capabilities/img/webauthn/device-credentials-empty-highlight.png b/content/docs/capabilities/img/webauthn/device-credentials-empty-highlight.png
deleted file mode 100644
index e2e09d548..000000000
Binary files a/content/docs/capabilities/img/webauthn/device-credentials-empty-highlight.png and /dev/null differ
diff --git a/content/docs/capabilities/img/webauthn/device-id-list.png b/content/docs/capabilities/img/webauthn/device-id-list.png
deleted file mode 100644
index 3bc3597c3..000000000
Binary files a/content/docs/capabilities/img/webauthn/device-id-list.png and /dev/null differ
diff --git a/content/docs/capabilities/img/webauthn/enrollment-created.png b/content/docs/capabilities/img/webauthn/enrollment-created.png
deleted file mode 100644
index b53c2df92..000000000
Binary files a/content/docs/capabilities/img/webauthn/enrollment-created.png and /dev/null differ
diff --git a/content/docs/capabilities/img/webauthn/new-enrollment.png b/content/docs/capabilities/img/webauthn/new-enrollment.png
deleted file mode 100644
index bc06cbd01..000000000
Binary files a/content/docs/capabilities/img/webauthn/new-enrollment.png and /dev/null differ
diff --git a/content/docs/capabilities/img/webauthn/no-device.png b/content/docs/capabilities/img/webauthn/no-device.png
deleted file mode 100644
index b2cd41967..000000000
Binary files a/content/docs/capabilities/img/webauthn/no-device.png and /dev/null differ
diff --git a/content/docs/capabilities/img/webauthn/security-key-chromebook.png b/content/docs/capabilities/img/webauthn/security-key-chromebook.png
deleted file mode 100644
index 47565fd78..000000000
Binary files a/content/docs/capabilities/img/webauthn/security-key-chromebook.png and /dev/null differ
diff --git a/content/docs/capabilities/img/webauthn/security-key-firefox.png b/content/docs/capabilities/img/webauthn/security-key-firefox.png
deleted file mode 100644
index 488b0f580..000000000
Binary files a/content/docs/capabilities/img/webauthn/security-key-firefox.png and /dev/null differ
diff --git a/content/docs/capabilities/img/webauthn/security-key-google.png b/content/docs/capabilities/img/webauthn/security-key-google.png
deleted file mode 100644
index 9176f024b..000000000
Binary files a/content/docs/capabilities/img/webauthn/security-key-google.png and /dev/null differ
diff --git a/content/docs/capabilities/img/webauthn/security-key-windows.png b/content/docs/capabilities/img/webauthn/security-key-windows.png
deleted file mode 100644
index 3b54dadcf..000000000
Binary files a/content/docs/capabilities/img/webauthn/security-key-windows.png and /dev/null differ
diff --git a/content/docs/capabilities/kubernetes-access.mdx b/content/docs/capabilities/kubernetes-access.mdx
index 29d032de8..dc1429af8 100644
--- a/content/docs/capabilities/kubernetes-access.mdx
+++ b/content/docs/capabilities/kubernetes-access.mdx
@@ -2,7 +2,7 @@
# cSpell:ignore kubeconfig mycluster
title: Kubernetes `kubectl` Integration
-sidebar_label: Kubernetes Access
+sidebar_label: Kubernetes Access Management
description: This article describes Pomerium's integration with the Kubernetes API Server
---
@@ -83,7 +83,7 @@ rules:
2. A [route's policy](/docs/reference/routes/policy) is created for the API server and [configured](/docs/reference/routes/kubernetes-service-account-token) to use the service account token
3. Kubernetes RoleBindings operate against IdP Users and Group subjects
-4. Users access the protected cluster through their standard tools, using [pomerium-cli](/docs/clients/pomerium-cli) as an auth provider in `~/.kube/config`
+4. Users access the protected cluster through their standard tools, using [pomerium-cli](/docs/deploy/clients) as an auth provider in `~/.kube/config`
5. Pomerium authorizes requests and passes the user identity to the API server for fine grained RBAC
@@ -215,7 +215,7 @@ Then, your user should be authorized:
## Kubeconfig Setup
-Edit your kubeconfig to use [pomerium-cli](/docs/clients/pomerium-cli) as a [credential plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins):
+Edit your kubeconfig to use [pomerium-cli](/docs/deploy/clients) as a [credential plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins):
```yaml
apiVersion: v1
diff --git a/content/docs/capabilities/load-balancing.md b/content/docs/capabilities/load-balancing.md
deleted file mode 100644
index e072b530b..000000000
--- a/content/docs/capabilities/load-balancing.md
+++ /dev/null
@@ -1,95 +0,0 @@
----
-title: Upstream Load Balancing
-sidebar_label: Load Balancing
-description: This article covers Pomerium built-in load balancing capabilities in presence of multiple upstream servers.
----
-
-# Upstream Load Balancing
-
-This article covers Pomerium built-in load balancing capabilities in presence of multiple upstream servers.
-
-## Multiple Upstream Servers
-
-You may specify multiple servers for your upstream application, and Pomerium would load balance user requests between them.
-
-```yaml
-routes:
- - from: https://myapp.localhost.pomerium.io
- to:
- - http://myapp-srv-1:8080
- - http://myapp-srv-2:8080
-```
-
-:::tip
-
-In the presence of multiple upstream servers, make sure to specify either an active or passive health check, or both, to avoid requests being served to an unhealthy backend.
-
-:::
-
-## Active Health Checks
-
-Active health checks issue periodic requests to each upstream to determine its health. See the [Envoy Health Checking documentation](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/health_checking) for a comprehensive overview.
-
-For example configurations in Pomerium, see the [Load Balancing](/docs/reference/routes/load-balancing#health-checks) reference page.
-
-## Passive Health Checks
-
-Passive health check tries to deduce upstream server health based on recent observed responses. See [Outlier Detection](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/outlier) for comprehensive overview.
-
-```yaml
-routes:
- - from: https://myapp.localhost.pomerium.io
- to:
- - http://myapp-srv-1:8080
- - http://myapp-srv-2:8080
- outlier_detection: {}
-```
-
-## Load Balancing Method
-
-`lb_policy` should be set to [one of the values](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers):
-
-- [`ROUND_ROBIN`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-round-robin) (default)
-- [`LEAST_REQUEST`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-least-request) and may be further configured using [`least_request_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig)
-- [`RING_HASH`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#ring-hash) and may be further configured using [`ring_hash_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-ringhashlbconfig) option
-- [`RANDOM`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#random)
-- [`MAGLEV`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#maglev) and may be further configured using [`maglev_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-maglevlbconfig) option
-
-### Example
-
-```yaml
-routes:
- - from: https://myapp.localhost.pomerium.io
- to:
- - http://myapp-srv-1:8080
- - http://myapp-srv-2:8080
- - http://myapp-srv-3:8080
- - http://myapp-srv-4:8080
- - http://myapp-srv-5:8080
- lb_policy: LEAST_REQUEST
- least_request_lb_config:
- choice_count: 2 # current envoy default
-```
-
-## Load Balancing Weight
-
-When a list of upstream URLs is specified in the `to` field, you may append an optional load balancing weight parameter. The individual [`lb_policy`](#load-balancing-method) settings will take this weighting into account when making routing decisions.
-
-### Example
-
-This configuration uses the default `round_robin` load balancer policy but specifies different frequency of selection be applied to the upstream servers.
-
-```yaml
-routes:
- - from: https://myapp.localhost.pomerium.io
- to:
- - http://myapp-srv-1:8080,10
- - http://myapp-srv-2:8080,20
- - http://myapp-srv-3:8080,30
- - http://myapp-srv-4:8080,20
- - http://myapp-srv-5:8080,10
-```
-
-## Further reading
-
-- [Introduction to modern network load balancing and proxying](https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying-a57f6ff80236)
diff --git a/content/docs/capabilities/mtls-clients.mdx b/content/docs/capabilities/mtls-clients.mdx
deleted file mode 100644
index f8d183335..000000000
--- a/content/docs/capabilities/mtls-clients.mdx
+++ /dev/null
@@ -1,186 +0,0 @@
----
-# cSpell:ignore caroot changeit
-
-title: Downstream mutual TLS (mTLS) with Pomerium
-sidebar_label: Downstream mTLS (clients)
-lang: en-US
-keywords:
- [
- pomerium,
- identity access proxy,
- mtls,
- client certificate,
- mutual authentication,
- server certificate,
- tls certificate,
- ]
-description: This guide covers how to use Pomerium to require mutual TLS authentication (mTLS) for end users, using client certificates with a custom certificate authority.
----
-
-import Tabs from '@theme/Tabs';
-import TabItem from '@theme/TabItem';
-
-Downstream mutual TLS (mTLS) refers to a requirement that end users must present a trusted client certificate when connecting to services secured by Pomerium.
-
-With ordinary TLS, only the server presents a certificate. This allows the client to verify the identity of the server before proceeding with the connection, ensuring that the connection between the client and server is not only private (encrypted) but also authenticated.
-
-With mTLS, the client must also present a certificate. The server will allow requests only when the client presents a certificate that it recognizes as trusted. This capability can be used to provide an additional layer of security.
-
-:::note
-
-Pomerium uses the term "downstream mTLS" when referring to the connection between end users and Pomerium, and "upstream mTLS" when referring to the connection between Pomerium and the services protected by Pomerium. (See [Upstream mTLS](/docs/capabilities/mtls-services) for more information on the latter.)
-
-:::
-
-Enabling downstream mTLS in Pomerium requires all clients to authenticate themselves by providing a trusted client certificate during the initial connection. Only after Pomerium successfully verifies the client certificate will it permit access to the configured routes.
-
-This guide shows you how to configure Pomerium to enable mTLS using client certificates issued by a private certificate authority.
-
-## Before You Begin
-
-To complete this guide, you will need:
-
-- A working Pomerium instance. Complete the [Pomerium Core quickstart](/docs/quickstart) with Docker for a quick proof of concept to test with this guide.
-- [`mkcert`](https://github.com/FiloSottile/mkcert#installation) to issue certificates from a locally-trusted certificate authority (CA)
-
-:::caution
-
-The `mkcert` tool is designed for testing: It creates a locally-trusted root certificate for development purposes. This guide uses `mkcert` for a proof-of-concept example, but a production deployment will require a more sophisticated certificate management solution.
-
-:::
-
-## Configure Pomerium with a server certificate
-
-:::tip **Note**
-
-If your Pomerium instance already has a server certificate configured, you can skip to the [Create a client certificate](#create-client-cert) step.
-
-:::
-
-This guide uses the domain `localhost.pomerium.io` as Pomerium's root domain (all subdomains under `localhost.pomerium.io` resolve to localhost).
-
-### Create a root CA
-
-If you haven’t yet, install `mkcert` following [these instructions](https://github.com/FiloSottile/mkcert#installation).
-
-Create a trusted **root CA**:
-
-```bash
-mkcert -install
-```
-
-### Create a wildcard TLS certificate
-
-Run the following command to create a wildcard server certificate for `*.localhost.pomerium.io`:
-
-```bash
-mkcert '*.localhost.pomerium.io'
-```
-
-This creates two files in the current working directory:
-
-- `_wildcard.localhost.pomerium.io.pem`
-- `_wildcard.localhost.pomerium.io-key.pem`
-
-`_wildcard.localhost.pomerium.io.pem` is the certificate, which contains a public key bound to the DNS name `*.localhost.pomerium.io`.
-
-`_wildcard.localhost.pomerium.io-key.pem` is the corresponding private key.
-
-### Update Pomerium configuration
-
-Update the `config.yaml` file or environment variables with your wildcard certificate. If running Pomerium in Docker, you will need to bind mount these files or copy them into the container and update the file paths accordingly.
-
-
-
-
-```yaml
-certificate_file: '_wildcard.localhost.pomerium.io.pem'
-certificate_key_file: '_wildcard.localhost.pomerium.io-key.pem'
-```
-
-
-
-
-```bash
-CERTIFICATE_FILE="_wildcard.localhost.pomerium.io.pem"
-CERTIFICATE_KEY_FILE="_wildcard.localhost.pomerium.io-key.pem"
-```
-
-
-
-
-## Create a client certificate {#create-client-cert}
-
-If you haven’t yet, install `mkcert` following [these instructions](https://github.com/FiloSottile/mkcert#installation).
-
-Then, to create a client certificate, run the following command:
-
-```bash
-mkcert -client -pkcs12 'yourUsername@localhost.pomerium.io'
-```
-
-This creates a new file in the current working directory, containing both the client certificate and the corresponding private key:
-
-- `yourUsername@localhost.pomerium.io-client.p12`
-
-(Note that the root CA created by `mkcert` does not need to be installed into the system trust store in order to be used as a trusted CA by Pomerium.)
-
-## Configure Pomerium to require mTLS
-
-Update the `config.yaml` file or environment variables to trust only certificates issued by your `mkcert` root CA. To find the path to the root CA certificate created by `mkcert`, run the following command:
-
-```bash
-echo "$(mkcert -CAROOT)/rootCA.pem"
-```
-
-If running Pomerium in Docker, you will need to bind mount this file or copy it into the container (and update the file path accordingly).
-
-
-
-
-```yaml
-downstream_mtls:
- ca_file: '/YOUR/MKCERT/CAROOT/rootCA.pem'
-```
-
-
-
-
-```bash
-DOWNSTREAM_MTLS_CA_FILE="/YOUR/MKCERT/CAROOT/rootCA.pem"
-```
-
-
-
-
-(See the [Downstream mTLS Settings](/docs/reference/downstream-mtls-settings) reference page for more details about the available mTLS settings.)
-
-Your Pomerium instance should now require a client certificate in order to access any configured routes. If you attempt to access any route from your browser, you should now see a Pomerium error page.
-
-## Install your client certificate
-
-Now you'll need to install the client certificate you created earlier. The following instructions are for Chrome on Linux, but client certificates are supported in all major browsers.
-
-1. Go to `chrome://settings/certificates`:
-
- ![chrome settings](img/mtls/01-chrome-settings-certificates.png)
-
-1. Click on **Import** and browse to the directory where you created the certificates above. Choose `yourUsername@localhost.pomerium.io-client.p12`:
-
- ![import client certificate](img/mtls/02-import-client-certificate.png)
-
-1. You will be prompted for the certificate password. The default password set by `mkcert` is **`changeit`**:
-
- ![enter certificate password](img/mtls/03-enter-certificate-password.png)
-
-1. The **org-mkcert development certificate** should now be in your list of certificates:
-
- ![certificate list](img/mtls/04-certificate-list.png)
-
-## Using the client certificate
-
-Visit https://verify.localhost.pomerium.io (or another route you've defined). You should be prompted to choose a client certificate:
-
-![choose client certificate](img/mtls/05-select-client-certificate.png)
-
-After selecting this certificate, Pomerium should now allow you to access this route.
diff --git a/content/docs/capabilities/mtls-services.mdx b/content/docs/capabilities/mtls-services.mdx
deleted file mode 100644
index ba44acf30..000000000
--- a/content/docs/capabilities/mtls-services.mdx
+++ /dev/null
@@ -1,195 +0,0 @@
----
-title: Upstream mutual TLS (mTLS) with Pomerium
-sidebar_label: Upstream mTLS (services)
-lang: en-US
-keywords:
- [
- pomerium,
- identity access proxy,
- mtls,
- client certificate,
- mutual authentication,
- upstream mTLS,
- ]
-description: This guide covers how to configure Pomerium to provide mutual authentication (mTLS) to an upstream service, using client certificates with a custom certificate authority.
----
-
-import InstallMkcert from '@site/content/_install-mkcert.md';
-
-
-
-As a reverse proxy, Pomerium is designed to manage access to your applications and services. At a minimum, Pomerium authenticates and authorizes each request to access these upstream resources.
-
-While this will keep unauthorized users from accessing your upstream applications, it does not authenticate the upstream service itself. Part of creating a zero-trust security model means securing communication between your identity-aware access proxy (Pomerium) and the upstream service it provides access to.
-
-This means Pomerium and the upstream service should authenticate each other.
-
-## How Pomerium authenticates upstream services
-
-Pomerium confirms the identity of an upstream service by verifying the service’s TLS certificate. (See [tls_custom_ca_file](/docs/reference/routes/tls#tls-custom-certificate-authority) and [tls_upstream_server_name](/docs/reference/routes/tls#tls-upstream-server-name) for more information on configuring Pomerium to accept an upstream's TLS certificate.)
-
-Generally, every organization has a preferred method of managing internal certificates. How an upstream service is configured to validate and accept client certificates is entirely up to that specific service and how it's configured.
-
-To provide a general explanation, in this guide you will use [mkcert](https://github.com/FiloSottile/mkcert) to provide the client certificate to Pomerium, and [OpenSSL](https://www.openssl.org/) as the upstream service.
-
-## Before you begin
-
-To complete this proof-of-concept guide:
-
-- Run Pomerium in [all-in-one mode](/docs/internals/configuration#all-in-one-vs-split-service-mode) as a system service with a configuration file in the [standard location](/docs/core/from-source#configure)
-- Configure an [identity provider](/docs/identity-providers) (IdP) to communicate with your Pomerium instance
-- Run all commands on the same host (You may have to move files or adjust paths and commands to match a different configuration)
-- Install [`mkcert`](https://github.com/FiloSottile/mkcert) to generate self-signed certificates and a root Certificate Authority (CA) (`mkcert` will take the place of your trusted certificate tooling solution)
-- Use `*.localhost.pomerium.io` as the placeholder for the Pomerium domain space
-
-## Create certificates
-
-This guide uses the `localhost.pomerium.io` domain as the root domain (all subdomains on `localhost.pomerium.io` point to localhost).
-
-### Create a root CA
-
-
-
-### Create OpenSSL certificate and key
-
-1. Create a certificate and key for your example upstream service, OpenSSL:
-
- ```shell-session
- $ mkcert openssl.localhost
-
- Created a new certificate valid for the following names 📜
- - "openssl.localhost"
-
- The certificate is at "./openssl.localhost.pem" and the key at "./openssl.localhost-key.pem" ✅
-
- It will expire on 10 March 2024 🗓
- ```
-
-1. Create a client certificate and key for Pomerium to use:
-
- ```shell-session
- $ mkcert -client 'pomerium@localhost'
-
- Created a new certificate valid for the following names 📜
- - "pomerium@localhost"
-
- The certificate is at "./pomerium@localhost-client.pem" and the key at "./pomerium@localhost-client-key.pem" ✅
-
- It will expire on 10 March 2024 🗓
- ```
-
-1. Change ownership of the client certificate files and move them to Pomerium's configuration directory:
-
- ```shell-session
- $ sudo chown pomerium:pomerium pomerium@localhost-client*pem /etc/pomerium
- $ sudo mv pomerium@localhost-client*pem /etc/pomerium/
- ```
-
-## Configure OpenSSL server
-
-OpenSSL is installed or easily available for most 'nix-based operating systems like macOS and Linux. In this demo, it will take the place of an upstream service with mTLS support.
-
-1. In a terminal environment and the same directory where you created the certificate files, start an OpenSSL server process. Note that it will run in the foreground until stopped, so you will need another terminal environment to run additional commands:
-
- ```shell-session
- $ openssl s_server -key ./openssl.localhost-key.pem -cert ./openssl.localhost.pem -accept 44330 -www
- ```
-
- You can confirm that the server is responding using `curl`:
-
- ```shell-session
- $ curl -k https://localhost:44330
-
-
-
- s_server -key ./openssl.localhost-key.pem -cert ./openssl.localhost.pem -accept 44330 -www
- Secure Renegotiation IS supported
- Ciphers supported in s_server binary
- ...
- ```
-
- :::tip
-
- Even though OpenSSL is providing a certificate signed by a CA in your trust store, you need the `-k` flag because the domain name `localhost` doesn't match `openssl.localhost` defined in your certificate.
-
- :::
-
-## Configure Pomerium
-
-1. Update the `config.yaml` file in `/etc/pomerium` with a new route for this upstream service:
-
- ```yaml title="config.yaml"
- - from: https://openssl.localhost.pomerium.io
- to: https://localhost:44330
- tls_upstream_server_name: openssl.localhost
- policy:
- - allow:
- or:
- - email:
- is: user@example.com
- ```
-
- Pomerium should automatically process changes when the configuration file is updated.
-
-1. Visit [https://openssl.localhost.pomerium.io](https://openssl.localhost.pomerium.io) in your browser to confirm the route:
-
- ![OpenSSL Upstream without client certificate verification](./img/mtls/openssl-test1.png)
-
- Note the last line:
-
- > no client certificate available
-
- In the next section, you'll adjust the OpenSSL server to require a client certificate and edit your Pomerium configuration to provide one.
-
-## Install Pomerium client certificate
-
-1. Stop the OpenSSL server process (**Ctrl+C**) and start a new one with the additional flag `-Verify 1`:
-
- ```shell-session
- $ openssl s_server -Verify 1 -key ./openssl.localhost-key.pem -cert ./openssl.localhost.pem -accept 44330 -www
- ```
-
-1. When you refresh [https://openssl.localhost.pomerium.io](https://openssl.localhost.pomerium.io) in your browser, the connection will fail. Back in the terminal, the OpenSSL server should output errors containing:
-
- ```log
- SSL routines:tls_process_client_certificate:peer did not return a certificate
- ```
-
- This confirms that the upstream service is now requiring a trusted client certificate to allow connections.
-
-1. Update the Pomerium route block to provide the client certificate:
-
- ```yaml title="config.yaml"
- - from: https://openssl.pomerium.localhost.io
- to: https://localhost:44330
- tls_upstream_server_name: openssl.localhost
- tls_client_cert_file: /etc/pomerium/pomerium@localhost-client.pem
- tls_client_key_file: /etc/pomerium/pomerium@localhost-client-key.pem
- policy:
- - allow:
- or:
- - email:
- is: user@example.com
- ```
-
-Now when you visit [https://openssl.localhost.pomerium.io](https://openssl.localhost.pomerium.io) you should see additional output under **Client certificate**, confirming that the upstream service has read and validated Pomerium's client certificate. Your upstream service is now using mTLS for mutual authentication!
-
-Obviously, the OpenSSL server is a trivial upstream service, and is purpose-built to work with encryption and not much else. Practical mutual authenticate can be a much more complex setup depending on the service, and may require a sidecar or service mesh. This exercise merely serves to demonstrate how easy it is to configure Pomerium to provide client certificates to the upstream service.
-
-## More Resources
-
-- [Mutual Authentication: A Component of Zero Trust](/docs/concepts/mutual-auth)
-- [Client-Side mTLS With Pomerium](/docs/concepts/mutual-auth.md)
-- [JWT Verification](/docs/guides/jwt-verification-with-envoy)
-
-[mkcert]: https://github.com/FiloSottile/mkcert
-[openssl]: https://www.openssl.org/
-[`tls_custom_ca_file`]: /docs/reference/routes/tls#tls-custom-certificate-authority
-[`tls_upstream_server_name`]: /docs/reference/routes/tls#tls-upstream-server-name
diff --git a/content/docs/capabilities/namespacing.mdx b/content/docs/capabilities/namespacing.mdx
deleted file mode 100644
index f6f575b1e..000000000
--- a/content/docs/capabilities/namespacing.mdx
+++ /dev/null
@@ -1,105 +0,0 @@
----
-# cSpell:ignore yourcompany
-
-title: Namespacing
-sidebar: Namespaces
-lang: en-US
-keywords:
- [
- pomerium,
- identity access proxy,
- namespacing,
- namespaces,
- self-service,
- policy,
- pomerium enterprise,
- rbac,
- abac,
- ]
-description: This page describes the concept of namespaces and why it's important for enabling self-service and RBAC.
----
-
-## Namespaces
-
-In Pomerium Enterprise, a **Namespace** is a cornerstone organization unit. They are container objects that behave similar to a unix directory structure.
-
-In each Namespace, administrators can create organizational units where users and groups can be added. Namespaces enable fine-grained role based access control and management (**RBAC**) to managing Pomerium. The structure and hierarchy of namespaces empower teams to self-service the routes and policies pertinent to them. Namespaces can can also be used to optionally or mandatorily inherit from their parent permission or policies.
-
-Namespaces enable:
-
-- Self-Service.
-- Hierarchical policy enforcement (both enforced, and optional),
-- Policy organization.
-- [RBAC](https://en.wikipedia.org/wiki/Role-based_access_control) for the Enterprise Console itself.
-
-Each of these sub-concepts are related and build on each other to form a unified security model.
-
-### Self-Service Capabilities
-
-One of the benefits of an identity-aware access proxy is that, once in place, developers and owners of enterprise applications have an incentive to configure their services to be accessible via the proxy.
-
-Self-service has [several benefits](https://www.usenix.org/system/files/login/articles/login_winter16_05_cittadini.pdf):
-
-- Frees global administrators from continuously modifying the configuration per user requests
-- Encourages service owners to own their own route configuration and policy
-- Ensures a reasonable compromise between development velocity and security controls
-
-Unlike with a VPN, or network driven access control mechanisms, application owners (with limited access permissions managed through namespaces) can maintain route and policy configuration for their own services, while higher level operations, security, and identity teams are able to enforce higher level authorization and access policies.
-
-### Hierarchical Policy Enforcement
-
-Hierarchical policy lets administrators enforce inheritable authorization policy. Policies can be optional (self-select), or mandatory.
-
-Identities and their group memberships are defined by your Identity Provider (**IdP**). Pomerium looks to your IdP for identity information, so policies defined using groups are always up-to-date with the access management defined upstream.
-
-:::tip
-
-When using an IdP without directory sync or when working with non-domain users, they will not show up in the look-ahead search. See [Non-Domain Users](/docs/concepts/access-control#non-domain-users) for more information.
-
-:::
-
-Consider this scenario: you want to enable your security team to manage high level corporate policy while enabling application owners to set finer grained user access to their specific applications. Pomerium can help you do that!
-
-Your security team can enact top level security policies to ensure, everyone:
-
-- has a `yourcompany.com` email account,
-- isn't coming from a known bad actor IP address,
-
-From there, the security team delegates management of child [Namespaces](#namespaces) to application teams, providing flexibility to self-manage their own application [Routes](/docs/capabilities/routing) and [Policies](/docs/capabilities/ppl).
-
-For example, a developer group can be given control to determine who has access to their Namespace, and create or edit Routes within it. They can provide authentication and authorization to their WiP app without writing new authorization code.
-
-Meanwhile, the CFO is given [manager](#manager) permissions over the "Accounting" Namespace, and can set enforced or optional policies for the services within.
-
-### RBAC for Enterprise Console Users
-
-- Namespaces are also used to achieve Role Based Access Control (**RBAC**) in the console itself.
-- There are three different roles:
-
-#### Guest (no role)
-
-Users who are authenticated by your IdP but do not have a role assigned in Pomerium Enterprise can still view the list of Namespaces, but nothing else.
-
-#### Viewer
-
-A user with the Viewer role can:
-
-- view all resources in a Namespace (Routes, Policies, Certificates), including child Namespaces
-- view traffic dashboard for routes in the Namespace, including child Namespaces
-- view the activity log for a namespace.
-
-#### Manager
-
-In addition to the access provided by the Viewer role, a Manager can create, read, update, and delete routes, policies, and certificates in a Namespace (as well as its children). A Manager may also reference policies and certificates in the parent Namespace.
-
-:::caution
-
-Managers in any Namespace should note: while creating a route for an [upstream](/docs/internals/glossary#upstream--downstream) path prevents additional routes to that path _in the same namespace_, Managers in other namespaces can create alternate routes to the same path.
-
-If you need to ensure that access to a service is only accessible from a single route, consider implementing [Mutual Authentication](/docs/concepts/mutual-auth) between Pomerium and the upstream service. This can be achieved using one of several methods, including [mTLS](/docs/capabilities/mtls-services) and [JWT verification](/docs/guides/jwt-verification-with-envoy). You can also utilize a service mesh like [Istio](/docs/guides/istio)
-
-:::
-
-#### Admin
-
-An Admin user has permissions across all Namespaces. They can manage global settings, sessions, and [service accounts](/docs/capabilities/service-accounts), as well as view events and runtime data.
diff --git a/content/docs/capabilities/non-http.mdx b/content/docs/capabilities/non-http.mdx
new file mode 100644
index 000000000..49c746716
--- /dev/null
+++ b/content/docs/capabilities/non-http.mdx
@@ -0,0 +1,49 @@
+---
+title: Tunneling Non-HTTP Protocols
+sidebar_label: Tunneling Non-HTTP Protocols
+description: 'Consolidated documentation for using Pomerium to protect and access non-HTTP protocols (TCP and UDP) over HTTP.'
+keywords:
+ - pomerium
+ - identity access proxy
+ - pomerium desktop
+ - pomerium cli
+ - tcp
+ - udp
+ - ssh
+ - redis
+ - mysql
+ - rdp
+ - database
+ - bastion
+sidebar_position: 0
+lang: en-US
+---
+
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# Non-HTTP Protocols
+
+Pomerium supports tunneling **non-HTTP protocols** (such as TCP- and UDP-based services) over HTTP, allowing you to secure and authenticate connections to those services using your existing identity provider.
+
+Common uses include:
+
+- Administrative connections (SSH, RDP)
+- Data services (Redis, MySQL, Postgres)
+- UDP-based protocols (e.g., time servers, Factorio game server)
+
+Below, you'll find details on how it works, how to create routes, and how to use the Pomerium CLI or Desktop client to connect.
+
+## How It Works
+
+Pomerium uses HTTP tunneling methods described in relevant RFCs:
+
+- **TCP**: Uses the [`CONNECT`](https://httpwg.org/specs/rfc9110.html#CONNECT) method to establish a tunnel.
+- **UDP**: Uses [`CONNECT-UDP`](https://datatracker.ietf.org/doc/html/rfc9298) to tunnel UDP traffic over HTTP/2 or HTTP/3.
+
+:::caution
+
+To minimize issues with TCP support, **do not** place Pomerium behind another HTTP proxy.
+Instead, configure your load balancer in L4/TCP mode. If you must proxy HTTP to Pomerium, the upstream proxy must support forwarding `CONNECT` or `CONNECT-UDP` traffic.
+
+:::
diff --git a/content/docs/capabilities/non-http/_cli-client-certificates.mdx b/content/docs/capabilities/non-http/_cli-client-certificates.mdx
new file mode 100644
index 000000000..e05f4a534
--- /dev/null
+++ b/content/docs/capabilities/non-http/_cli-client-certificates.mdx
@@ -0,0 +1,37 @@
+import CodeBlock from '@theme/CodeBlock';
+
+### Client Certificates
+
+If Pomerium is configured to require client certificates, you will also need to provide a client certificate and private key when invoking the `pomerium-cli` command.
+
+You can specify these either by using PEM files, or (new in [v0.23.0](https://github.com/pomerium/cli/releases/tag/v0.23.0)) by searching for a certificate in the system trust store (on **macOS** and **Windows** only).
+
+To specify a client certificate and key using PEM files:
+
+
+ {`pomerium-cli ${props.protocol} --client-cert cert.pem --client-key key.pem route.corp.example.com:1234`}
+
+
+To search for a client certificate in the system trust store:
+
+
+ {`pomerium-cli ${props.protocol} --client-cert-from-store route.corp.example.com:1234`}
+
+
+This will search the Keychain (on macOS) or the Windows certificate store (on Windows) for a client certificate and private key, based on the trusted CA names advertised by Pomerium in the TLS handshake.
+
+If you need to select between multiple matching client certificates, you can additionally filter based on the Distinguished Name of the certificate's Issuer and/or the certificate Subject.
+
+For example, to filter for a certificate directly issued by a CA with the Common Name "My Trusted CA":
+
+
+ {`pomerium-cli ${props.protocol} --client-cert-from-store --client-cert-issuer "CN=My Trusted CA" route.corp.example.com:1234`}
+
+
+Or, to filter for a certificate whose Subject contains the Organizational Unit Name "My Department":
+
+
+ {`pomerium-cli ${props.protocol} --client-cert-from-store --client-cert-subject "OU=My Department" route.corp.example.com:1234`}
+
+
+See the [reference page](/docs/capabilities/non-http#certificate-name-filters) for more details about the certificate name filter syntax.
diff --git a/content/docs/capabilities/tcp/examples/_category_.json b/content/docs/capabilities/non-http/examples/_category_.json
similarity index 100%
rename from content/docs/capabilities/tcp/examples/_category_.json
rename to content/docs/capabilities/non-http/examples/_category_.json
diff --git a/content/docs/capabilities/tcp/examples/_service-template.mdx b/content/docs/capabilities/non-http/examples/_service-template.mdx
similarity index 92%
rename from content/docs/capabilities/tcp/examples/_service-template.mdx
rename to content/docs/capabilities/non-http/examples/_service-template.mdx
index 73dd98586..8e96080e4 100644
--- a/content/docs/capabilities/tcp/examples/_service-template.mdx
+++ b/content/docs/capabilities/non-http/examples/_service-template.mdx
@@ -15,13 +15,13 @@ Replace the paragraph above with a brief description of the service, and/or why
:::tip
-This example assumes you've already [created a TCP route](/docs/capabilities/tcp#configure-tcp-routes) for this service.
+This example assumes you've already [created a TCP route](/docs/capabilities/non-http#configure-tcp-routes) for this service.
:::
## Basic Connection
- 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client:
+ 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client:
diff --git a/content/docs/capabilities/non-http/examples/ethr.mdx b/content/docs/capabilities/non-http/examples/ethr.mdx
new file mode 100644
index 000000000..866d0361c
--- /dev/null
+++ b/content/docs/capabilities/non-http/examples/ethr.mdx
@@ -0,0 +1,68 @@
+---
+title: Ethr
+description: Testing Pomerium UDP Tunnels with Ethr
+---
+
+# Testing Pomerium UDP Tunnels with Ethr
+
+Since v0.29.0 Pomerium supports tunneling UDP traffic. This example demonstrates how to do this using [Ethr](https://github.com/microsoft/ethr), a network performance measurement tool.
+
+You will need two machines: one running the Ethr client and the Pomerium CLI, and another running the Ethr server and Pomerium. Replace __`ethr.corp.example.com`__ with your domain name.
+
+## Server
+
+1. Install Pomerium
+2. [Install Ethr](https://github.com/microsoft/ethr?tab=readme-ov-file#installation)
+3. Enable QUIC by setting [`codec_type`](/docs/reference/codec-type) to `http3`
+
+ ```yaml
+ codec_type: http3
+ ```
+ :::tip QUIC
+
+ Pomerium also supports UDP tunneling with `http1` or `auto` (the default), but using `http3` significantly improves performance.
+
+ :::
+
+4. Add a UDP route on port 8888
+
+ ```yaml
+ - routes:
+ from: udp+https://ethr.corp.example.com:8888
+ to: udp://127.0.0.1:8888
+ allow_any_authenticated_user: true
+ ```
+
+5. Run Pomerium
+6. Run the Ethr server
+
+ ```bash
+ ethr -s
+ ```
+
+## Client
+
+1. Install the Pomerium CLI
+2. [Install Ethr](https://github.com/microsoft/ethr?tab=readme-ov-file#installation)
+3. Start a UDP tunnel
+
+ ```bash
+ pomerium-cli udp ethr.corp.example.com:8888 --listen :8888
+ ```
+
+ :::tip TLS issues
+
+ If you don't have a valid certificate use `--disable-tls-verification`.
+
+ :::
+4. Run the Ethr client
+
+ ```bash
+ ethr -c localhost -p udp -b 1M -l 1k -d 5s
+ ```
+
+You should see packets arrive at the Ethr server demonstrating that UDP tunneling is working.
+
+## More Resources
+
+- [Ethr](https://github.com/microsoft/ethr)
diff --git a/content/docs/capabilities/non-http/examples/factorio.mdx b/content/docs/capabilities/non-http/examples/factorio.mdx
new file mode 100644
index 000000000..f485e21c6
--- /dev/null
+++ b/content/docs/capabilities/non-http/examples/factorio.mdx
@@ -0,0 +1,78 @@
+---
+title: Factorio
+description: Testing Pomerium UDP Tunnels with Factorio
+---
+
+# Testing Pomerium UDP Tunnels with Factorio
+
+Since v0.29.0 Pomerium supports tunneling UDP traffic. This example demonstrates how to do this using [Factorio](https://www.factorio.com/), a popular game where you build and maintain factories with multiplayer support. Like many games Factorio uses a custom UDP protocol for multiplayer.
+
+You will need two machines: one running Factorio and the Pomerium CLI, and another running the Factorio headless server and Pomerium. Replace __`factorio.corp.example.com`__ with your domain name.
+
+## Server
+
+1. Install Pomerium
+2. Download the Linux Factorio headless server
+
+ ```bash
+ curl -L -o factorio.tar.xz https://factorio.com/get-download/stable/headless/linux64
+ tar -xJf factorio.tar.xz
+ cd factorio
+ ```
+
+3. Enable QUIC by setting [`codec_type`](/docs/reference/codec-type) to `http3`
+
+ ```yaml
+ codec_type: http3
+ ```
+ :::tip QUIC
+
+ Pomerium also supports UDP tunneling with `http1` or `auto` (the default), but using `http3` significantly improves performance.
+
+ :::
+
+4. Add a UDP route on port 34197
+
+ ```yaml
+ - routes:
+ from: udp+https://factorio.corp.example.com:34197
+ to: udp://127.0.0.1:34197
+ allow_any_authenticated_user: true
+ ```
+
+
+5. Run Pomerium
+6. Create a new Factorio save
+
+ ```bash
+ ./bin/x64/factorio --create ./saves/pomerium-example.zip
+ ```
+
+7. Run the Factorio headless server
+
+ ```bash
+ ./bin/x64/factorio --start-server ./saves/pomerium-example.zip
+ ```
+
+## Client
+
+1. Install the Pomerium CLI
+2. [Install Factorio](https://www.factorio.com/download)
+3. Start a UDP tunnel
+
+ ```bash
+ pomerium-cli udp factorio.corp.example.com:34197 --listen :34197
+ ```
+
+ :::tip TLS issues
+
+ If you don't have a valid certificate use `--disable-tls-verification`.
+
+ :::
+4. Run Factorio, click _Multiplayer_, then _Connect to Address_, and enter `127.0.0.1:34197` as the server address and click _Connect_.
+
+ ![Connect to Localhost](img/factorio-connect.png)
+
+You should now be connected to the server.
+
+![Factorio](img/factorio-ticks.png)
diff --git a/content/docs/capabilities/tcp/examples/git.mdx b/content/docs/capabilities/non-http/examples/git.mdx
similarity index 87%
rename from content/docs/capabilities/tcp/examples/git.mdx
rename to content/docs/capabilities/non-http/examples/git.mdx
index 7b058fd1f..4b19fab48 100644
--- a/content/docs/capabilities/tcp/examples/git.mdx
+++ b/content/docs/capabilities/non-http/examples/git.mdx
@@ -18,12 +18,12 @@ When hosting a self-hosted Git server like [GitLab](/docs/guides/gitlab) behind
:::
:::tip
-This example assumes you've already [created a TCP route](/docs/capabilities/tcp#configure-tcp-routes) for this service.
+This example assumes you've already [created a TCP route](/docs/capabilities/non-http#configure-tcp-routes) for this service.
:::
## Basic Connection
- 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client. These examples use Git connections over SSH:
+ 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client. These examples use Git connections over SSH:
@@ -76,7 +76,7 @@ Because Git uses the SSH protocol, we can define a `Host` block in our local SSH
```
:::tip
-If you've already defined an SSH configuration for all domains managed by Pomerium as described in our [SSH Example](/docs/capabilities/tcp/examples/ssh#always-tunnel-through-pomerium), you can skip the first step above and define your new remote with the Git server's domain name.
+If you've already defined an SSH configuration for all domains managed by Pomerium as described in our [SSH Example](/docs/capabilities/non-http/examples/ssh#always-tunnel-through-pomerium), you can skip the first step above and define your new remote with the Git server's domain name.
:::
## More Resources
diff --git a/content/docs/capabilities/non-http/examples/img/desktop/advanced-settings.png b/content/docs/capabilities/non-http/examples/img/desktop/advanced-settings.png
new file mode 100644
index 000000000..3a73e16f7
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/desktop/advanced-settings.png differ
diff --git a/content/docs/capabilities/non-http/examples/img/desktop/desktop-new-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/desktop-new-connection.png
new file mode 100644
index 000000000..51d8b9fe0
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/desktop/desktop-new-connection.png differ
diff --git a/content/docs/capabilities/non-http/examples/img/desktop/example-git-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/example-git-connection.png
new file mode 100644
index 000000000..c90001813
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/desktop/example-git-connection.png differ
diff --git a/content/docs/capabilities/non-http/examples/img/desktop/example-mssql-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/example-mssql-connection.png
new file mode 100644
index 000000000..80718a4de
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/desktop/example-mssql-connection.png differ
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/example-mysql-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/example-mysql-connection.png
similarity index 100%
rename from content/docs/capabilities/tcp/examples/img/desktop/example-mysql-connection.png
rename to content/docs/capabilities/non-http/examples/img/desktop/example-mysql-connection.png
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/example-rdp-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/example-rdp-connection.png
similarity index 100%
rename from content/docs/capabilities/tcp/examples/img/desktop/example-rdp-connection.png
rename to content/docs/capabilities/non-http/examples/img/desktop/example-rdp-connection.png
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/example-redis-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/example-redis-connection.png
similarity index 100%
rename from content/docs/capabilities/tcp/examples/img/desktop/example-redis-connection.png
rename to content/docs/capabilities/non-http/examples/img/desktop/example-redis-connection.png
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/example-ssh-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/example-ssh-connection.png
similarity index 100%
rename from content/docs/capabilities/tcp/examples/img/desktop/example-ssh-connection.png
rename to content/docs/capabilities/non-http/examples/img/desktop/example-ssh-connection.png
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/new-ssh-connection.png b/content/docs/capabilities/non-http/examples/img/desktop/new-ssh-connection.png
similarity index 100%
rename from content/docs/capabilities/tcp/examples/img/desktop/new-ssh-connection.png
rename to content/docs/capabilities/non-http/examples/img/desktop/new-ssh-connection.png
diff --git a/content/docs/capabilities/non-http/examples/img/desktop/pomerium-desktop-postgres.png b/content/docs/capabilities/non-http/examples/img/desktop/pomerium-desktop-postgres.png
new file mode 100644
index 000000000..8c3084793
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/desktop/pomerium-desktop-postgres.png differ
diff --git a/content/docs/capabilities/non-http/examples/img/desktop/zero-ssh-route-example.png b/content/docs/capabilities/non-http/examples/img/desktop/zero-ssh-route-example.png
new file mode 100644
index 000000000..c77967d23
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/desktop/zero-ssh-route-example.png differ
diff --git a/content/docs/capabilities/non-http/examples/img/factorio-connect.png b/content/docs/capabilities/non-http/examples/img/factorio-connect.png
new file mode 100644
index 000000000..7a62bdfbe
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/factorio-connect.png differ
diff --git a/content/docs/capabilities/non-http/examples/img/factorio-ticks.png b/content/docs/capabilities/non-http/examples/img/factorio-ticks.png
new file mode 100644
index 000000000..1a98fc493
Binary files /dev/null and b/content/docs/capabilities/non-http/examples/img/factorio-ticks.png differ
diff --git a/content/docs/capabilities/tcp/examples/img/remmina-connection-profile.png b/content/docs/capabilities/non-http/examples/img/remmina-connection-profile.png
similarity index 100%
rename from content/docs/capabilities/tcp/examples/img/remmina-connection-profile.png
rename to content/docs/capabilities/non-http/examples/img/remmina-connection-profile.png
diff --git a/content/docs/capabilities/tcp/examples/img/remmina-connection-scripted.png b/content/docs/capabilities/non-http/examples/img/remmina-connection-scripted.png
similarity index 100%
rename from content/docs/capabilities/tcp/examples/img/remmina-connection-scripted.png
rename to content/docs/capabilities/non-http/examples/img/remmina-connection-scripted.png
diff --git a/content/docs/capabilities/tcp/examples/ms-sql.mdx b/content/docs/capabilities/non-http/examples/ms-sql.mdx
similarity index 91%
rename from content/docs/capabilities/tcp/examples/ms-sql.mdx
rename to content/docs/capabilities/non-http/examples/ms-sql.mdx
index 62dc6d59b..493541b0f 100644
--- a/content/docs/capabilities/tcp/examples/ms-sql.mdx
+++ b/content/docs/capabilities/non-http/examples/ms-sql.mdx
@@ -20,13 +20,13 @@ This document explains how to connect to a Microsoft SQL database through an enc
:::
:::tip
-This example assumes you've already [created a TCP route](/docs/capabilities/tcp#configure-tcp-routes) for this service.
+This example assumes you've already [created a TCP route](/docs/capabilities/non-http#configure-tcp-routes) for this service.
:::
## Basic Connection
- 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client:
+ 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client:
diff --git a/content/docs/capabilities/tcp/examples/mysql.mdx b/content/docs/capabilities/non-http/examples/mysql.mdx
similarity index 94%
rename from content/docs/capabilities/tcp/examples/mysql.mdx
rename to content/docs/capabilities/non-http/examples/mysql.mdx
index 52007377f..f4cdba67c 100644
--- a/content/docs/capabilities/tcp/examples/mysql.mdx
+++ b/content/docs/capabilities/non-http/examples/mysql.mdx
@@ -18,12 +18,12 @@ This document explains how to connect to a MySQL or MariaDB database through an
:::
:::tip
-This example assumes you've already [created a TCP route](/docs/capabilities/tcp#configure-tcp-routes) for this service.
+This example assumes you've already [created a TCP route](/docs/capabilities/non-http#configure-tcp-routes) for this service.
:::
## Basic Connection
- 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client:
+ 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client:
diff --git a/content/docs/capabilities/tcp/examples/postgres.mdx b/content/docs/capabilities/non-http/examples/postgres.mdx
similarity index 91%
rename from content/docs/capabilities/tcp/examples/postgres.mdx
rename to content/docs/capabilities/non-http/examples/postgres.mdx
index 11651094a..8a00be352 100644
--- a/content/docs/capabilities/tcp/examples/postgres.mdx
+++ b/content/docs/capabilities/non-http/examples/postgres.mdx
@@ -11,7 +11,7 @@ PostgreSQL is a popular relational database used in many modern applications. Th
## Basic Connection
-1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client:
+1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client:
diff --git a/content/docs/capabilities/tcp/examples/rdp.mdx b/content/docs/capabilities/non-http/examples/rdp.mdx
similarity index 94%
rename from content/docs/capabilities/tcp/examples/rdp.mdx
rename to content/docs/capabilities/non-http/examples/rdp.mdx
index a91cc0c72..b4265e8a3 100644
--- a/content/docs/capabilities/tcp/examples/rdp.mdx
+++ b/content/docs/capabilities/non-http/examples/rdp.mdx
@@ -19,12 +19,12 @@ Remote Desktop Protocol (**RDP**) is a standard for using a desktop computer rem
:::
:::tip
-This example assumes you've already [created a TCP route](/docs/capabilities/tcp#configure-tcp-routes) for this service.
+This example assumes you've already [created a TCP route](/docs/capabilities/non-http#configure-tcp-routes) for this service.
:::
## Basic Connection
-1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client:
+1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client:
diff --git a/content/docs/capabilities/tcp/examples/redis.mdx b/content/docs/capabilities/non-http/examples/redis.mdx
similarity index 91%
rename from content/docs/capabilities/tcp/examples/redis.mdx
rename to content/docs/capabilities/non-http/examples/redis.mdx
index 48dedc1db..88c4bf15c 100644
--- a/content/docs/capabilities/tcp/examples/redis.mdx
+++ b/content/docs/capabilities/non-http/examples/redis.mdx
@@ -18,12 +18,12 @@ Redis is a popular in-memory data structure store. It can be run locally or conf
:::
:::tip
-This example assumes you've already [created a TCP route](/docs/capabilities/tcp#configure-tcp-routes) for this service.
+This example assumes you've already [created a TCP route](/docs/capabilities/non-http#configure-tcp-routes) for this service.
:::
## Basic Connection
- 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client:
+ 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client:
diff --git a/content/docs/capabilities/tcp/examples/ssh.mdx b/content/docs/capabilities/non-http/examples/ssh.mdx
similarity index 94%
rename from content/docs/capabilities/tcp/examples/ssh.mdx
rename to content/docs/capabilities/non-http/examples/ssh.mdx
index 21d756fb0..8d7bcb695 100644
--- a/content/docs/capabilities/tcp/examples/ssh.mdx
+++ b/content/docs/capabilities/non-http/examples/ssh.mdx
@@ -25,12 +25,12 @@ By tunneling SSH connections through your Pomerium service:
:::
:::tip
-This example assumes you've already [created a TCP route](/docs/capabilities/tcp#configure-tcp-routes) for this service.
+This example assumes you've already [created a TCP route](/docs/capabilities/non-http#configure-tcp-routes) for this service.
:::
## Basic Connection
- 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client:
+ 1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients) or the Pomerium Desktop client:
diff --git a/content/docs/capabilities/tcp/img/tcp-ssh-route.png b/content/docs/capabilities/non-http/img/tcp-ssh-route.png
similarity index 100%
rename from content/docs/capabilities/tcp/img/tcp-ssh-route.png
rename to content/docs/capabilities/non-http/img/tcp-ssh-route.png
diff --git a/content/docs/capabilities/tcp.mdx b/content/docs/capabilities/non-http/tcp.mdx
similarity index 93%
rename from content/docs/capabilities/tcp.mdx
rename to content/docs/capabilities/non-http/tcp.mdx
index 31b6cadaf..c66a61393 100644
--- a/content/docs/capabilities/tcp.mdx
+++ b/content/docs/capabilities/non-http/tcp.mdx
@@ -1,5 +1,7 @@
---
description: This article describes how to leverage pomerium for TCP proxying.
+sidebar_label: TCP
+sidebar_position: 1
keywords:
[
pomerium,
@@ -22,7 +24,7 @@ import LongLivedConnections from '@site/content/docs/admonitions/_long-lived-con
# TCP over HTTP Support
-In addition to managing HTTP based applications, Pomerium can be used to protect non-HTTP systems with the same consistent authorization policy. This is achieved by tunneling TCP over HTTP with the help of a client side command built into [`pomerium-cli`](/docs/clients/pomerium-cli).
+In addition to managing HTTP based applications, Pomerium can be used to protect non-HTTP systems with the same consistent authorization policy. This is achieved by tunneling TCP over HTTP with the help of a client side command built into [`pomerium-cli`](/docs/deploy/clients).
Operations and engineering teams frequently require access to lower level administrative and data protocols such as SSH, RDP, Postgres, MySQL, Redis, etc.
@@ -63,7 +65,7 @@ When creating TCP routes, note the following:
## Connect to TCP Routes
-While HTTP routes can be consumed with just a normal browser, `pomerium-cli` or Pomerium Desktop must serve as a proxy for TCP routes. See [Pomerium Desktop and CLI Clients](tcp/client) for more information.
+While HTTP routes can be consumed with just a normal browser, `pomerium-cli` or Pomerium Desktop must serve as a proxy for TCP routes. See [Pomerium Desktop and CLI Clients](/docs/deploy/clients) for more information.
To connect, you normally need just the external hostname and port of your TCP route:
@@ -95,7 +97,7 @@ localhost:52046>
You may specify an optional address and port for the `tcp` command to listen on.
-`-` specifies that STDIN and STDOUT should be directly attached to the remote TCP connection. This is useful for [SSH](tcp/examples/ssh#tunnel-and-connect-simultaneously) or for sending data through a shell pipe.
+`-` specifies that STDIN and STDOUT should be directly attached to the remote TCP connection. This is useful for [SSH](./examples/ssh#tunnel-and-connect-simultaneously) or for sending data through a shell pipe.
### Bastion host
@@ -167,11 +169,11 @@ routes:
The guides below demonstrate how to proxy TCP tunnels with Pomerium to well-known services:
-- [**Git**](tcp/examples/git)
-- [**Microsoft SQL**](tcp/examples/ms-sql)
-- [**MySQL and MariaDB**](tcp/examples/mysql)
-- [**RDP**](tcp/examples/rdp)
-- [**Redis**](tcp/examples/redis)
-- [**SSH**](tcp/examples/ssh)
+- [**Git**](./examples/git)
+- [**Microsoft SQL**](./examples/ms-sql)
+- [**MySQL and MariaDB**](./examples/mysql)
+- [**RDP**](./examples/rdp)
+- [**Redis**](./examples/redis)
+- [**SSH**](./examples/ssh)
:::
diff --git a/content/docs/capabilities/non-http/udp.mdx b/content/docs/capabilities/non-http/udp.mdx
new file mode 100644
index 000000000..6ee94a072
--- /dev/null
+++ b/content/docs/capabilities/non-http/udp.mdx
@@ -0,0 +1,71 @@
+---
+description: This article describes how to leverage pomerium for UDP proxying.
+sidebar_label: UDP
+sidebar_position: 2
+keywords:
+ [
+ pomerium,
+ pomerium-cli,
+ proxy,
+ identity access proxy,
+ ssh,
+ udp,
+ application,
+ non http,
+ tunnel,
+ ]
+---
+
+import CLIClientCertificates from './_cli-client-certificates.mdx';
+
+# UDP over HTTP Support
+
+Starting in v0.29, Pomerium can be used to protect UDP systems with the same consistent authorization policy. This is achieved by tunneling UDP over HTTP with the help of a client side command built into [`pomerium-cli`](/docs/deploy/clients).
+
+Internally, Pomerium uses [`CONNECT-UDP`](https://datatracker.ietf.org/doc/html/rfc9298) to establish the UDP tunnel.
+
+## Configure UDP Routes
+
+UDP configuration is simple. Just specify the correct scheme and ports in your route [`to`](/docs/reference/routes/to) and [`from`](/docs/reference/routes/from) fields.
+
+Example:
+
+```yaml
+routes:
+ - from: udp+https://time.corp.example.com:13
+ to: udp://time.internal.example.com:13
+ policy:
+ - allow:
+ or:
+ - email:
+ is: contractor@not-example.com
+ - claim/groups: 'datascience@example.com'
+```
+
+When creating UDP routes, note the following:
+
+- When configuring a UDP route, any HTTP specific settings such as `regex_rewrite_pattern` or `set_request_headers` have no effect.
+- The port defined in `from` does not dictate what port the tunneled traffic uses. This will always be the port defined by [`address`](/docs/reference/address) in your Pomerium configuration (`443` by default). The port instead differentiates multiple routes to the same hostname for different services.
+
+## Connect to UDP Routes
+
+While HTTP routes can be consumed with just a normal browser, `pomerium-cli` or Pomerium Desktop must serve as a proxy for UDP routes.
+
+To connect, you normally need just the external hostname and port of your UDP route:
+
+```shell-session
+$ pomerium-cli udp udp.localhost.pomerium.io:1234
+2023/10/02 11:19:59 listening on 127.0.0.1:52046
+```
+
+By default, `pomerium-cli` will start a listener on loopback on a random port.
+
+On first connection, you will be sent through a standard Pomerium HTTP authentication flow. After completing this, your UDP connection should be established!
+
+## Advanced capabilities
+
+### Listen configuration
+
+You may specify an optional address and port for the `udp` command to listen on.
+
+
diff --git a/content/docs/capabilities/original-request-context.md b/content/docs/capabilities/original-request-context.md
index 2847cf531..5bdb5c3b5 100644
--- a/content/docs/capabilities/original-request-context.md
+++ b/content/docs/capabilities/original-request-context.md
@@ -9,7 +9,7 @@ description: This article describes how the original user context is passed seco
:::enterprise
-This article describes a use case available to [Pomerium Enterprise](/docs/enterprise/install) customers.
+This article describes a use case available to [Pomerium Enterprise](/docs/deploy/enterprise/install) customers.
:::
diff --git a/content/docs/capabilities/rego.mdx b/content/docs/capabilities/rego.mdx
deleted file mode 100644
index 38dc98546..000000000
--- a/content/docs/capabilities/rego.mdx
+++ /dev/null
@@ -1,165 +0,0 @@
----
-# cSpell:ignore unvalidated, gset
-id: rego
-title: Custom Rego Policies
-description: Learn how Pomerium Enterprise supports custom Rego policies.
----
-
-# Custom Rego Policies
-
-Pomerium supports policies expressed in [Rego](https://www.openpolicyagent.org/docs/latest/#rego) for organizations that prefer to use [OPA](https://www.openpolicyagent.org/).
-
-See the [Outputs](#outputs), [Inputs](#inputs), and [Functions](#functions) reference sections below to learn how Rego policies apply to policy evaluation.
-
-:::enterprise
-
-Custom Rego policies is a [Pomerium Enterprise](/docs/enterprise) feature.
-
-:::
-
-In the [Enterprise Console](/docs/enterprise#enterprise-console), you can write custom Rego policies in the Rego Editor:
-
-![Apply Rego in Console editor](./img/authorization/ppl-rego-policy.png)
-
-:::note
-
-A policy can only support PPL or Rego. Once one is set, the other tab is disabled.
-
-:::
-
-## Outputs
-
-Authorization policy written in Rego is expected to return results in `allow` and/or `deny` rules:
-
-```rego
-# a policy that always allows access
-allow := true
-```
-
-```rego
-# a policy that always denies access
-deny := true
-```
-
-Pomerium grants access according to the same rules as [PPL](/docs/capabilities/ppl#actions):
-
-> Only two actions are supported: allow and deny. deny takes precedence over allow. More precisely: a user will have access to a route if at least one allow rule matches and no deny rules match.
-
-`allow` and `deny` rules support four forms:
-
-1. A simple boolean:
-
-```rego
-allow := true
-```
-
-2. An array with a single boolean value:
-
-```rego
-deny := [true]
-```
-
-3. An array with two values: a boolean and a **reason**:
-
-```rego
-allow := [false, "user-unauthorized"]
-```
-
-4. An array with three values: a boolean, a reason, and additional data:
-
-```rego
-allow := [false, "user-unauthorized", { "key": "value" }]
-```
-
-The **reason** value is useful for debugging, since it appears in [authorization logs](/docs/reference/authorize-log-fields#find-authorize-logs). There are two special reasons that trigger functionality in Pomerium:
-
-- `user-unauthenticated` indicates that the user needs to sign in, and results in a redirect to the Authenticate service
-- `device-unauthenticated` indicates that the user needs to register a new device
-
-## Inputs
-
-Rego scripts are evaluated with inputs available on the `input` object:
-
-```rego
-allow if input.http.method == "POST"
-```
-
-Rego defines the following inputs:
-
-| **Input name** | **Type** | **Description** |
-| :-- | :-- | :-- |
-| `http` | Object | Represents the HTTP request |
-| `http.method` | String | The method used in the HTTP request |
-| `http.hostname` | String | The hostname in the HTTP request |
-| `http.path` | String | The path in the HTTP request |
-| `http.url` | String | The full URL in the HTTP request |
-| `http.headers` | Object | The headers in the HTTP request |
-| `http.client_certificate` | Object | The client certificate details |
-| `http.client_certificate.presented` | Boolean | `true` if the client presented a certificate |
-| `http.client_certificate.leaf` | String | The leaf certificated provided by the client (unvalidated) |
-| `http.client_certificate.intermediates` | String | The remainder of the client certificate chain |
-| `http.ip` | String | The user's IP address |
-| `http.session` | Object | Represents the user's session |
-| `http.session.id` | String | The session ID |
-| `http.is_valid_client_certificate` | Boolean | `true` if the presented client certificate is valid |
-
-## Functions
-
-The function below is available in Rego scripts:
-
-- `get_databroker_record(record_type, record_id)`: Returns data from the Databroker service.
-
-For example:
-
-```rego
-session := get_databroker_record("type.googleapis.com/session.Session", input.session.id)
-```
-
-### Example Rego policy
-
-This example policy compares the `given_name` claim from a user's session against a list of popular first names, and only allows the 100 most popular first names.
-
-```rego
-package pomerium.policy
-session = s {
- s = gset_databroker_record("type.googleapis.com/user.ServiceAccount", input.session.id)
- s != null
-} else = s {
- s = get_databroker_record("type.googleapis.com/session.Session", input.session.id)
- s != null
-} else = {} {
- true
-}
-user = u {
- u = get_databroker_record("type.googleapis.com/user.User", session.user_id)
-} else = {} {
- true
-}
-allow = [true, {"custom-rego-authorized"}] {
- # grab all the claims from the user and session objects
- session_claims := object.get(session, "claims", {})
- user_claims := object.get(user, "claims", {})
- all_claims := object.union(session_claims, user_claims)
- # get the given_name claim. claim values are always an array of strings
- given_names := object.get(all_claims, "given_name", [])
- # query a JSON dump of the most popular baby names from 2020
- response := http.send({
- "method": "GET",
- "url": "https://raw.githubusercontent.com/aruljohn/popular-baby-names/master/2020/boy_names_2020.json",
- "force_json_decode": true,
- })
- # only include the top 100 names
- all_names := response.body.names
- popular_names := array.slice(all_names, 0, 99)
- # check that there's a given name in the popular names
- some i
- some j
- popular_names[i] == given_names[j]
-} else = [false, {"custom-rego-unauthorized"}] {
- session.id != ""
-} else = [false, {"user-unauthenticated"}] {
- true
-}
-```
-
-This example pulls session data from the Databroker service using `type.googleapis.com/session.Session` for users and `type.googleapis.com/user.ServiceAccount` for service accounts.
diff --git a/content/docs/capabilities/routing.mdx b/content/docs/capabilities/routing.mdx
index 458920b0b..95da48ff3 100644
--- a/content/docs/capabilities/routing.mdx
+++ b/content/docs/capabilities/routing.mdx
@@ -1,9 +1,9 @@
---
# cSpell:ignore cm9vdDpodW50ZXI0Mg
-title: Routing
+title: Routing, Proxying, and Load Balancing with Pomerium
lang: en-US
-sidebar_label: Routing
+sidebar_label: 'Proxying & Routing'
description: How to get Pomerium's CLI which be used to proxy TCP services and kubernetes commands
keywords:
[
@@ -20,19 +20,17 @@ keywords:
]
---
-# Routing, Proxying, and Load Balancing
-
-## Routes
-
+## Routing
+
A **Route** defines how to access a service running behind Pomerium. This includes authentication (both for Pomerium and passed through to the service), rewrites, header management, load balancing, etc.
When first installing Pomerium Enterprise, users may want to import existing routes from the open-source Pomerium core. The **Migrate Routes** button accepts the open-source `config.yaml` file and imports routes from it to Pomerium Enterprise.
@@ -51,7 +49,7 @@ The sections below cover the options available when creating or editing a route.
### General
-The **General** tab defines the route path, both from the internet and to the internal service, and the policies attached. Note that policies enforced on a [Namespace](/docs/capabilities/namespacing#hierarchical-policy-enforcement) the route resides in will also be applied.
+The **General** tab defines the route path, both from the internet and to the internal service, and the policies attached. Note that policies enforced on a [Namespace](/docs/internals/namespacing#hierarchical-policy-enforcement) the route resides in will also be applied.
#### Name
@@ -61,7 +59,7 @@ This value is only visible in the Console UI.
`From` is the externally accessible URL for the proxied request.
-Specifying `tcp+https` for the scheme enables [TCP proxying](/docs/capabilities/tcp) support for the route. You may map more than one port through the same hostname by specifying a different `:port` in the URL.
+Specifying `tcp+https` or `udp+https` for the scheme enables [TCP proxying](/docs/capabilities/non-http) or [UDP proxying](/docs/capabilities/non-http/udp) support for the route. You may map more than one port through the same hostname by specifying a different `:port` in the URL.
:::warning
@@ -84,13 +82,13 @@ Once a Route is created, the Metric Name field will populate. You can use this n
- https://b.example.com
```
-A load balancing weight may be associated with a particular upstream by appending `,[weight]` to the URL. The exact behavior depends on your [`lb_policy`](/docs/reference/routes/load-balancing#load-balancing-policy) setting. See [Load Balancing](/docs/capabilities/load-balancing) for example [configurations](/docs/capabilities/load-balancing#load-balancing-weight).
+A load balancing weight may be associated with a particular upstream by appending `,[weight]` to the URL. The exact behavior depends on your [`lb_policy`](#load-balancing-method) setting.
-Must be `tcp` if `from` is `tcp+https`.
+> **For more details and examples, see our dedicated [Upstream Load Balancing page](/docs/capabilities/routing).**
-:::warning
+Should be `tcp://` if `from` is `tcp+https://`, or `udp://` if `from` is `udp+https://`.
-Be careful with trailing slash.
+:::warning Be careful with trailing slash.
With rule:
@@ -99,7 +97,8 @@ With rule:
to: https://verify.pomerium.com/anything
```
-Requests to `https://verify.corp.example.com` will be forwarded to `https://verify.pomerium.com/anything`, while requests to `https://verify.corp.example.com/foo` will be forwarded to `https://verify.pomerium.com/anythingfoo`.To make the request forwarded to `https://httbin.org/anything/foo`, you can use double slashes in your request `https://httbin.corp.example.com//foo`.
+Requests to `https://verify.corp.example.com` will be forwarded to `https://verify.pomerium.com/anything`, while requests to `https://verify.corp.example.com/foo` will be forwarded to `https://verify.pomerium.com/anythingfoo`.
+To make the request forwarded to `https://httbin.org/anything/foo`, you can use double slashes in your request `https://httbin.corp.example.com//foo`.
While the rule:
@@ -108,7 +107,7 @@ While the rule:
to: https://verify.pomerium.com/anything/
```
-All requests to `https://verify.corp.example.com/*` will be forwarded to `https://verify.pomerium.com/anything/*`. That means accessing to `https://verify.corp.example.com` will be forwarded to `https://verify.pomerium.com/anything/`. That said, if your application does not handle trailing slash, the request will end up with 404 not found.
+All requests to `https://verify.corp.example.com/*` will be forwarded to `https://verify.pomerium.com/anything/*`. That means accessing `https://verify.corp.example.com` will be forwarded to `https://verify.pomerium.com/anything/`. That said, if your application does not handle trailing slash, the request will end up with 404 not found.
Either `redirect` or `to` must be set.
@@ -140,13 +139,9 @@ When enabled, this option will pass identity headers to upstream applications. T
Add or remove Policies to be applied to the Route. Note that Policies enforced in the Route's Namespace will be applied automatically.
-:::note
-
-See the [**Policy setting**](/docs/reference/routes/policy) page to learn how to apply a PPL policy to a route.
+:::note See the [**Policy setting**](/docs/reference/routes/policy) page to learn how to apply a PPL policy to a route.
-For information and examples related to PPL, see [**Policy Language**](/docs/capabilities/ppl).
-
-:::
+For information and examples related to PPL, see [**Policy Language**](/docs/internals/ppl). :::
#### Enable Google Cloud Serverless Authentication
@@ -313,15 +308,16 @@ routes:
:::tip
-In the presence of multiple upstream servers, make sure to specify either an active or passive health check, or both, to avoid requests being served to an unhealthy backend.
+In the presence of multiple upstream servers, make sure to specify either an **active** or **passive** health check, or both, to avoid requests being served to an unhealthy backend.
:::
-###### Active Health Checks
+#### Active Health Checks
-Active health checks issue periodic requests to each upstream to determine its health. See [Health Checking](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/health_checking) for a comprehensive overview.
+Active health checks issue periodic requests to each upstream to determine its health. See [Envoy Health Checking](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/health_checking) for more details.
-#### HTTP Example
+
+HTTP Example
```yaml
routes:
@@ -338,7 +334,10 @@ routes:
path: '/'
```
-#### TCP Example
+
+
+
+TCP Example
```yaml
routes:
@@ -358,9 +357,11 @@ routes:
text: '504F4E47' #PONG
```
+
+
#### Passive Health Checks
-Passive health check tries to deduce upstream server health based on recent observed responses. See [Outlier Detection](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/outlier) for comprehensive overview.
+Passive health check tries to deduce upstream server health based on recent observed responses. See [Outlier Detection](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/outlier) for a comprehensive overview.
```yaml
routes:
@@ -376,12 +377,17 @@ routes:
`lb_policy` should be set to [one of the values](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers):
- [`ROUND_ROBIN`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-round-robin) (default)
-- [`LEAST_REQUEST`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-least-request) and may be further configured using [`least_request_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig)
-- [`RING_HASH`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#ring-hash) and may be further configured using [`ring_hash_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-ringhashlbconfig) option
+- [`LEAST_REQUEST`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-least-request)
+ _May be further configured via [`least_request_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig)._
+- [`RING_HASH`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#ring-hash)
+ _May be further configured via [`ring_hash_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-ringhashlbconfig)._
- [`RANDOM`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#random)
-- [`MAGLEV`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#maglev) and may be further configured using [`maglev_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-maglevlbconfig) option
+- [`MAGLEV`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#maglev)
+ _May be further configured via [`maglev_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-maglevlbconfig)._
+
+> **Some policy types support additional advanced configuration**, such as [least request randomization](/docs/reference/routes/load-balancing-policy-config). See [Load Balancing Policy Config](/docs/reference/routes/load-balancing-policy-config) for details.
-#### Example
+##### Example
```yaml
routes:
@@ -401,9 +407,7 @@ routes:
When a list of upstream URLs is specified in the `to` field, you may append an optional load balancing weight parameter. The individual [`lb_policy`](#load-balancing-method) settings will take this weighting into account when making routing decisions.
-#### Example
-
-This configuration uses the default `round_robin` load balancer policy but specifies different frequency of selection be applied to the upstream servers.
+##### Example
```yaml
routes:
@@ -416,7 +420,7 @@ routes:
- http://myapp-srv-5:8080,10
```
-## Route matching order
+### Route matching order
Pomerium matches routes in a specific order; an incoming request will be sent to the first route that matches.
@@ -425,9 +429,9 @@ Pomerium considers routes defined in a configuration file first, in the order in
Routes from the Enterprise Console or Ingress Controller are sorted in the following order:
1. Ascending by `host`
-1. Descending by `path`
-1. Descending by `regex`
-1. Descending by `prefix`
+2. Descending by `path`
+3. Descending by `regex`
+4. Descending by `prefix`
The example below defines two routes in a configuration file that both point to the same domain. The first route contains a prefix (`api`).
@@ -444,24 +448,6 @@ If Pomerium receives a request to access `https://a.example.com:8080`, Pomerium
allow_any_authenticated_user: true
```
-## Further reading
-
-- [Introduction to modern network load balancing and proxying](https://blog.envoyproxy.io/introduction-to-modern-network-load-balancing-and-proxying-a57f6ff80236)
-
-#### Load Balancing Policy
-
-In presence of multiple upstream servers, defines load balancing strategy between them.
-
-See [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-enum-config-cluster-v3-cluster-lbpolicy) for more details.
-
-- [`ROUND_ROBIN`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-round-robin) (default)
-- [`LEAST_REQUEST`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#weighted-least-request) and may be further configured using [`least_request_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-leastrequestlbconfig)
-- [`RING_HASH`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#ring-hash) and may be further configured using [`ring_hash_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster-ringhashlbconfig) option
-- [`RANDOM`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#random)
-- [`MAGLEV`](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#maglev) and may be further configured using [`maglev_lb_config`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-msg-config-cluster-v3-cluster-maglevlbconfig) option
-
-Some policy types support additional [configuration](/docs/reference/routes/load-balancing-policy-config).
-
## Certificates
Certificates are the x509 _public-key_ and _private-key_ used to establish secure HTTP and gRPC connections. Any combination of the above can be used together, and are additive. You can also use any of these settings in conjunction with `Autocert` to get OCSP stapling.
diff --git a/content/docs/capabilities/self-hosted-authenticate-service.md b/content/docs/capabilities/self-hosted-authenticate-service.md
deleted file mode 100644
index b9f9cfb46..000000000
--- a/content/docs/capabilities/self-hosted-authenticate-service.md
+++ /dev/null
@@ -1,62 +0,0 @@
----
-id: self-hosted-authenticate-service
-title: Self-Hosted Authenticate Service
-sidebar_label: Self-Hosted Authenticate Service
-keywords: [self-hosted authenticate service url, self-hosted identity provider]
-description: Use Pomerium's Self-Hosted Authenticate Service to deploy Pomerium with your own identity provider.
----
-
-# Self-Hosted Authenticate Service
-
-Pomerium's **Self-Hosted Authenticate Service** allows you to configure Pomerium with the identity provider of your choice.
-
-The self-hosted authenticate service is available for open-source Pomerium, Pomerium Zero, and Pomerium Enterprise.
-
-:::info
-
-The _authenticate service_ is one of the [four logical services](/docs/internals/architecture#component-level) that make up Pomerium. The authenticate service is unique in that Pomerium can either run this service itself, or instead use the [Hosted Authenticate Service](/docs/capabilities/hosted-authenticate-service).
-
-:::
-
-## How the self-hosted authenticate service works
-
-To configure the self-hosted authenticate service, you will need to set up:
-
-- a URL for the authenticate service
-- an identity provider (IdP)
-
-### Authenticate service URL
-
-The authenticate service URL is a public-facing URL that should resolve to your Pomerium instance. (If running in split service mode, this URL should resolve to the authenticate service.) Whenever a user is required to log in to access a route, Pomerium will redirect the user to the authenticate service using this URL.
-
-This URL should not contain a path or query parameters. For example, `https://authenticate.corp.example.com`.
-
-This URL must be different from any of the route URLs you use with Pomerium.
-
-See the [Authenticate Service URL](/docs/reference/service-urls#authenticate-service-url) reference page for details on how to configure this setting.
-
-:::info Why does Pomerium use a separate authenticate service URL?
-
-In a typical OIDC authentication flow, all redirect URLs must be pre-registered with the IdP. Pomerium uses a single authenticate service URL so that you need to register only one redirect URL with your IdP. This way, Pomerium can protect multiple upstream services without requiring you to update your IdP client whenever you add a new service.
-
-:::
-
-### Identity provider
-
-Pomerium relies on an IdP to authenticate users. Pomerium can use any IdP that implements the OpenID Connect (OIDC) protocol.
-
-The steps to configure your IdP will vary depending on the specific provider. See [**Identity Providers**](/docs/identity-providers) for a list of guides to configure commonly-used IdPs.
-
-You will generally need to configure your IdP client to allow an OAuth redirect URL based on your chosen authenticate service URL, with the path `/oauth2/callback` appended to it.
-
-For example, if your authenticate service URL is `https://authenticate.corp.example.com`, you should configure your identity provider to allow the redirect URI `https://authenticate.corp.example.com/oauth2/callback`.
-
-:::tip
-
-If you require a different callback path than `/oauth2/callback`, you can use the [Authenticate Callback Path](/docs/reference/authenticate-callback-path) setting to change the callback path.
-
-:::
-
-Once you have set up an IdP client, you will need to configure Pomerium with the IdP name, client ID and client secret, and possibly a URL assigned to your individual IdP client.
-
-See the [Identity Provider Settings](/docs/reference/identity-provider-settings#identity-provider-client-id) reference page for details on how to configure these settings.
diff --git a/content/docs/capabilities/self-remediation.mdx b/content/docs/capabilities/self-remediation.mdx
new file mode 100644
index 000000000..cfe809295
--- /dev/null
+++ b/content/docs/capabilities/self-remediation.mdx
@@ -0,0 +1,76 @@
+---
+title: 'Self-Remediation & Custom Error Pages'
+sidebar_label: 'Self-Remediation'
+description: "Enable user-driven fixes with custom explanations and remediation steps directly on Pomerium's denial pages."
+keywords:
+ - 'pomerium'
+ - 'error messages'
+ - 'self-remediation'
+ - 'beyondcorp'
+ - 'device compliance'
+ - 'zero trust'
+---
+
+# Self-Remediation & Custom Error Pages
+
+:::enterprise
+
+This article describes a use case available to [Pomerium Enterprise](/docs/deploy/enterprise/install) customers.
+
+:::
+
+## Overview
+
+Pomerium can transform a typical “Access Denied” screen into an actionable self-help workflow. Rather than simply blocking users with a generic error, you can provide a direct explanation of **why** a request was denied and specific **remediation** steps they can follow to fix the issue. This approach not only streamlines user support but also dramatically speeds up your response to new security vulnerabilities or non-compliant devices.
+
+Consider a scenario where a user's OS is missing an important patch. Instead of seeing a cryptic error, they encounter a branded page that says:
+
+> “You need patch KB12345. Click here to download.”
+
+Once updated, they can immediately retry access—no waiting on IT, and no protracted back-and-forth with help desk tickets.
+
+## Error Details Setting
+
+To enable these expanded messages, toggle **Error Details** for a particular route. Go to the **General** tab of that route and activate “Error Details”:
+
+![Enable Error Details on a Route](./img/branding/enable_error_details.png)
+
+If you leave it off, users only see a generic 403 error without any additional instructions.
+
+## Explanation & Remediation Fields
+
+Each policy can include:
+
+- **Explanation**: A quick, human-readable note on why the policy denied access (e.g. “Your browser version is outdated.”).
+- **Remediation**: Concrete steps to resolve it (e.g. “Download the latest Chrome update.”).
+
+![Add custom error messages.](./img/branding/policy_with_explanation_and_remediation.png)
+
+Pomerium displays these fields on denial pages. If a field is left blank, Pomerium shows the **Policy ID** to aid in troubleshooting.
+
+## Custom Header & Markdown
+
+You can define a global Header in the Branding settings, which appears at the top of every denial page. This header supports basic Markdown, allowing you to include help desk links, disclaimers, or even images.
+
+![Markdown Header](./img/branding/first_paragraph_setting.png)
+
+Use this to highlight urgent security notices, direct employees to an internal status page, or provide a quick path to open a help desk ticket.
+
+## Example Workflow
+
+1. **New Zero-Day Vulnerability**: A critical exploit is discovered in an outdated browser version.
+2. **Policy Update**: Security updates the Pomerium policy to deny access unless users are on the patched browser.
+3. **Explanation & Remediation**:
+ - Explanation: “Your browser is missing patch version 105.3.”
+ - Remediation: “Download the latest update from our software portal.”
+4. **Real-Time Enforcement**: Any user on an unpatched browser sees a custom denial page. A single click takes them to the correct download.
+5. **Instant Self-Fix**: The user installs the update, refreshes the page, and is granted access—no waiting on support.
+
+## Benefits of Self-Remediation
+
+- **Speedy Fixes**: Users solve common issues themselves without opening tickets or waiting on email responses.
+- **Reduced Risk**: Admins can quickly enforce mandatory patching. Users have no workaround except to comply.
+- **Lower IT Load**: Repetitive issues (outdated antivirus, missing OS patches) no longer flood the help desk queue.
+- **Improved User Experience**: A direct, helpful message fosters trust, demonstrating that security policies exist to protect them—not block them arbitrarily.
+
+Coupled with [White Labeling](/docs/capabilities/branding), you can present these remediation messages in a fully branded interface, strengthening user confidence in your zero-trust security posture. By offering immediate guidance at the point of denial, you'll see fewer escalations, faster compliance, and a safer network overall.
diff --git a/content/docs/capabilities/service-accounts.md b/content/docs/capabilities/service-accounts.md
index c39a87815..855494da5 100644
--- a/content/docs/capabilities/service-accounts.md
+++ b/content/docs/capabilities/service-accounts.md
@@ -19,7 +19,7 @@ Service accounts offer a protected and standardized method of authenticating mac
:::enterprise
-Service Accounts are a Pomerium Enterprise feature. The steps below show you how to create and use a Service Account in the Enterprise Console. See our [Pomerium Enterprise](/docs/enterprise) page for more information.
+Service Accounts are a Pomerium Enterprise feature. The steps below show you how to create and use a Service Account in the Enterprise Console. See our [Pomerium Enterprise](/docs/deploy/enterprise) page for more information.
:::
@@ -45,7 +45,7 @@ Before you begin, confirm you are in the correct Namespace. You can only use a s
See the following pages for more information:
- - [**Directory Sync**](/docs/capabilities/directory-sync)
+ - [**Directory Sync**](/docs/integrations/user-standing/directory-sync)
- [**User Impersonation**](/docs/capabilities/impersonation)
:::
diff --git a/content/docs/capabilities/single-sign-out.md b/content/docs/capabilities/single-sign-out.md
deleted file mode 100644
index 147a18532..000000000
--- a/content/docs/capabilities/single-sign-out.md
+++ /dev/null
@@ -1,82 +0,0 @@
----
-title: Single Sign-out
-description: This article describes Pomerium's support for Single Sign-out according to OpenID Connect Front-Channel Logout 1.0.
-pagination_next: null
----
-
-Single sign-out (SSO) signs a user out of a secured application and clears both the remote application session generated by the identity provider and the local Pomerium session.
-
-## OIDC Front-Channel Logout
-
-Pomerium supports Front-Channel Logout as described in [OpenID Connect Front-Channel Logout 1.0](https://openid.net/specs/openid-connect-frontchannel-1_0.html).
-
-### Identity provider support
-
-See if your identity provider (IdP) supports Front-Channel Logout by checking your IdP’s `/.well-known/openid-configuration` endpoint. If your IdP supports it, you may see something similar to the JSON data below:
-
-```json
-{
- "frontchannel_logout_session_supported": true
-}
-```
-
-### Configure single sign-out
-
-To correctly implement SSO, you must register a `frontchannel_logout_uri` for your application that includes the path `/.pomerium/sign_out`.
-
-The `frontchannel_logout_uri` must match the external route in your policy. For example, `app.corp.example.com/.pomerium/sign_out`.
-
-If configured correctly, the following actions occur:
-
-1. The proxy service receives the sign-out request and clears the local Pomerium session
-2. The proxy service redirects the request to the authenticate service URL’s `/.pomerium/sign_out` endpoint
-3. The authentication service clears the remote application session
-
-![Single sign-out flow](./img/single-sign-out/sign-out-flow.svg)
-
-:::caution
-
-While it is possible to implement SSO using the **authenticate service URL** and the `/.pomerium/sign_out` endpoint, this method is not recommended.
-
-Signing out with the authenticate service URL won’t delete the session cookie on the route itself. To terminate the remote application and Pomerium sessions, you must point sign-out requests to the external route.
-
-:::
-
-
- Well-known Pomerium endpoint
-
-
-See Pomerium's `/.well-known/pomerium` endpoint to view OAuth, OIDC, and JWKS data.
-
-For example:
-
-```json
-{
- "authentication_callback_endpoint": "https://authenticate.localhost.pomerium.io/oauth2/callback",
- "jwks_uri": "https://authenticate.localhost.pomerium.io/.well-known/pomerium/jwks.json",
- "frontchannel_logout_uri": "https://authenticate.localhost.pomerium.io/.pomerium/sign_out"
-}
-```
-
-Note, a CSRF token is required for the single sign out endpoint (despite supporting `GET` and `POST`) and can be retrieved from the `X-CSRF-Token` response header on the well known endpoint above or using the `_pomerium_csrf` session set.
-
-
-
-
-### Single sign-out example with Pomerium
-
-The example below demonstrates how to correctly implement SSO using the [JavaScript SDK](/docs/guides/verify-jwt):
-
-```js
-export const signOut = (redirectUrl) => {
- let location = window.location.origin + '/.pomerium/sign_out';
- if (redirectUrl) {
- location += '?pomerium_redirect_uri=' + encodeURIComponent(redirectUrl);
- }
- window.location.href = location;
-};
-```
-
-In the example above, the `signOut` function appends the `/.pomerium/sign_out` endpoint to the external route URL, then redirects the user.
-
-From here, the proxy service clears the external route session and redirects the user to the authenticate service URL to clear the Pomerium session.
diff --git a/content/docs/capabilities/tcp/client.mdx b/content/docs/capabilities/tcp/client.mdx
deleted file mode 100644
index 76509f2c1..000000000
--- a/content/docs/capabilities/tcp/client.mdx
+++ /dev/null
@@ -1,160 +0,0 @@
----
-# cSpell:ignore windowscentral
-
-title: Pomerium TCP Clients
-sidebar_label: Desktop & CLI Clients
-lang: en-US
-keywords:
- [
- pomerium,
- identity access proxy,
- pomerium desktop,
- pomerium cli,
- pomerium tcp over http,
- ]
-description: Learn how to create secured TCP connections to services behind Pomerium.
-sidebar_position: 0
----
-
-import Tabs from '@theme/Tabs';
-import TabItem from '@theme/TabItem';
-
-# Pomerium Desktop and CLI Clients
-
-This document describes how to use Pomerium's Desktop and CLI clients to connect to TCP routes in Pomerium.
-
-:::info What's a TCP route?
-
-A TCP route is for use with upstream services that don't speak HTTP — for example SSH, Redis, or MySQL. With a TCP route, the entire connection is proxied to the upstream service, rather than each individual request separately.
-
-In Pomerium, TCP routes are denoted with a `tcp+` prefix in the route's **From** URL.
-
-:::
-
-## Create a TCP route
-
-1. Specify this new Route as a TCP Route by prefixing `tcp+` in the **From** field, along with a port number
-1. Set the **To** field using `tcp://` as the scheme, along with the address and port that the upstream service is listening on
-
-The example below demonstrates a route to an SSH service on the host running Pomerium:
-
-
-
-
-![Creating a TCP route in the Zero Console](./examples/img/desktop/zero-ssh-route-example.png)
-
-
-
-
-![Example TCP route for SSH](./img/tcp-ssh-route.png)
-
-
-
-
-```yaml
-- from: tcp+https://ssh.localhost.pomerium.io:22
- to: tcp://127.0.0.1:22
- policy:
- - allow:
- or:
- - email:
- is: user@companydomain.com
-```
-
-
-
-
-:::tip
-
-The port number in the route **From** URL is not used in the initial connection to Pomerium itself. This connection will still use port 443, unless you use a bastion host (see [**Advanced configuration**](#advanced-configuration) below).
-
-Rather, the port defined in **From** is part of the mapping to the individual route. In this way, you can create multiple routes that share a DNS entry, differentiated by the port to determine which route they use.
-
-For example, suppose we have a server called `augur` running behind Pomerium that has a MySQL server and also listens for SSH connections. We can create routes for `tcp+https://augur.example.com:22` and `tcp+https://augur.example.com:3306`.
-
-:::
-
-:::info
-
-To learn about building TCP routes, see:
-
-- [**Configure TCP Routes**](/docs/capabilities/tcp#configure-tcp-routes)
-- [**Advanced TCP usage**](/docs/capabilities/tcp#advanced-capabilities)
-
-:::
-
-## Access TCP routes with a client
-
-You can connect to this route with either the Pomerium CLI or Pomerium Desktop client.
-
-### Desktop client steps
-
-If you haven't, install [Pomerium Desktop](/docs/clients/pomerium-desktop).
-
-Then, add a connection by filling in the fields defined below:
-
-- **Name**: A local name for the route
-- **Destination**: Matches the [From](/docs/reference/routes/from) value of the route, without the protocol. Always include the port specified in the route, and do not include the `https://` protocol.
-- **Local Address**: The local address and port number from which to access the service locally. If left blank, the client will choose a random port to listen to on the loopback address.
-- **Tags**: Customizable tags to sort and organize TCP routes
-
-![Adding a new connection in the Pomerium Desktop client](./examples/img/desktop/desktop-new-connection.png)
-
-#### Advanced Settings
-
-- **Pomerium URL**: The Pomerium Proxy service address. This is required if the **Destination URL** can't be resolved from DNS or a local `hosts` entry, or if the Proxy service uses a non-standard port.
-- **Disable TLS Verification**: Allows untrusted certificates from the Pomerium gateway
-- **Client Certificates**: For routes that enforce [mTLS](/docs/concepts/mutual-auth), you can **set a client certificate manually** or automatically [**search the OS certificate store**](/docs/capabilities/tcp#client-certificates) for a trusted certificate (note: macOS and Windows only).
-
-![Reviewing the Advanced Settings in the Pomerium Desktop client](./examples/img/desktop/advanced-settings.png)
-
-### Pomerium CLI steps
-
-If you haven't, install [Pomerium CLI](/docs/clients/pomerium-cli).
-
-Then, connect to a TCP route:
-
-1. Invoke `pomerium-cli` with the `tcp` option, and provide the route to your service (as defined in [`from`](/docs/reference/routes/from) in your Route specification).
-
- ```shell-session
- $ pomerium-cli tcp ssh.localhost.pomerium.io:22
- 2023/10/02 11:29:22 listening on 127.0.0.1:53656
- ```
-
- You can optionally supply an address and/or port to the `listen` flag:
-
- ```shell-session
- $ pomerium-cli tcp ssh.localhost.pomerium.io:22 --listen :2222
- 2023/10/02 11:30:03 listening on [::]:2222
- ```
-
-1. Connect to your service using the local address and port specified in the output of `pomerium-cli`:
-
- ```bash
- ssh 127.0.0.1 -p 2222
- ```
-
-1. When the connection starts, the CLI will open your browser and direct you to your Identity Provider to authenticate your session. Once authenticated, the connection will continue and you can close the browser window.
-
-1. In this example, since we are using SSH we can consolidate the TCP and SSH connections into a single command:
-
- ```bash
- ssh -o ProxyCommand='pomerium-cli tcp --listen - %h:%p' ssh.localhost.pomerium.io
- ```
-
-:::info
-
-For more examples and detailed usage information, see the following docs:
-
-- [**TCP Reference**](/docs/capabilities/tcp/reference)
-- [**Securing TCP-based Services**](/docs/capabilities/tcp)
-
-:::
-
-## Advanced configuration
-
-If Pomerium is listening on a port other than `443` (set with the [`address` key](/docs/reference/address)), the full TCP URL can be specified with a bastion host:
-
-```bash
-pomerium-cli tcp tcp+https://ssh.localhost:pomerium.io:8443/ssh.localhost.pomerium.io:2222 --listen :2222
-```
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/advanced-settings.png b/content/docs/capabilities/tcp/examples/img/desktop/advanced-settings.png
deleted file mode 100644
index a3f1d1a8b..000000000
Binary files a/content/docs/capabilities/tcp/examples/img/desktop/advanced-settings.png and /dev/null differ
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/desktop-new-connection.png b/content/docs/capabilities/tcp/examples/img/desktop/desktop-new-connection.png
deleted file mode 100644
index d06353c2e..000000000
Binary files a/content/docs/capabilities/tcp/examples/img/desktop/desktop-new-connection.png and /dev/null differ
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/example-git-connection.png b/content/docs/capabilities/tcp/examples/img/desktop/example-git-connection.png
deleted file mode 100644
index d1ca8fc8b..000000000
Binary files a/content/docs/capabilities/tcp/examples/img/desktop/example-git-connection.png and /dev/null differ
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/example-mssql-connection.png b/content/docs/capabilities/tcp/examples/img/desktop/example-mssql-connection.png
deleted file mode 100644
index ada93a136..000000000
Binary files a/content/docs/capabilities/tcp/examples/img/desktop/example-mssql-connection.png and /dev/null differ
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/pomerium-desktop-postgres.png b/content/docs/capabilities/tcp/examples/img/desktop/pomerium-desktop-postgres.png
deleted file mode 100644
index bc7c4fa98..000000000
Binary files a/content/docs/capabilities/tcp/examples/img/desktop/pomerium-desktop-postgres.png and /dev/null differ
diff --git a/content/docs/capabilities/tcp/examples/img/desktop/zero-ssh-route-example.png b/content/docs/capabilities/tcp/examples/img/desktop/zero-ssh-route-example.png
deleted file mode 100644
index 977436413..000000000
Binary files a/content/docs/capabilities/tcp/examples/img/desktop/zero-ssh-route-example.png and /dev/null differ
diff --git a/content/docs/capabilities/tcp/reference.md b/content/docs/capabilities/tcp/reference.md
deleted file mode 100644
index 4495daeac..000000000
--- a/content/docs/capabilities/tcp/reference.md
+++ /dev/null
@@ -1,59 +0,0 @@
----
-title: Pomerium-CLI TCP Reference
-sidebar_label: Reference
-hide_table_of_contents: false
-description: Manage your TCP connections from the command line with Pomerium-CLI.
-keywords: [tcp, cli, pomerium]
----
-
-# TCP reference for pomerium-cli
-
-This TCP reference covers `pomerium-cli` commands you can use to manage TCP connections in Pomerium.
-
-## Usage
-
-```shell
-pomerium-cli tcp [destination] [flags]
-```
-
-## Flags
-
-| Flags | Description | Type |
-| :-- | :-- | --- |
-| #--alternate-ca-path | Path to CA certificate to use for HTTP requests. | string |
-| #--browser-cmd | Custom browser command to run when opening a URL. | string |
-| #--ca-cert | Path to CA certificate to use for HTTP requests. | string |
-| #--client-cert | (optional) PEM-encoded client certificate. | string |
-| # --client-key | (optional) PEM-encoded client certificate key. | string |
-| # --client-cert-from-store | (optional) If provided, pomerium-cli will attempt to use a client certificate from the system trust store (macOS and Windows only), searching for a certificate based on the trusted CA names advertised by Pomerium in the TLS handshake. | none |
-| # --client-cert-issuer | (optional) When used in combination with --client-cert-from-store, restricts the client certificate search based on a particular attribute of the certificate's [Issuer name](#certificate-name-filters). | string |
-| # --client-cert-subject | (optional) When used in combination with --client-cert-from-store, restricts the client certificate search based on a particular attribute of the certificate's [Subject name](#certificate-name-filters). | string |
-| #--disable-tls-verification | Disables TLS verification. | none |
-| #-h, --help | Help for tcp. | none |
-| #--listen | Local address to start a listener on (default "127.0.0.1:0"). | string |
-| #--pomerium-url | The URL of the Pomerium server to connect to. | string |
-| #-v, --version | Version for pomerium-cli. | none |
-
-### Certificate name filters
-
-The certificate name filter syntax is `attribute=value`. A name filter can accept only one name attribute. The value must be an exact match (not a substring match). Make sure to quote name filters as appropriate for your shell.
-
-For example, `--client-cert-issuer "CN=My Trusted CA"` would filter for a certificate directly issued by a CA with the Common Name "My Trusted CA".
-
-Or, `--client-cert-subject "OU=My Department"` would filter for a certificate whose Subject name contains the Organizational Unit Name "My Department".
-
-The supported name attributes are:
-
-- commonName (CN)
-- countryName (C)
-- localityName (L)
-- organizationName (O)
-- organizationalUnitName (OU)
-- postalCode
-- serialNumber
-- stateOrProvinceName (ST)
-- streetAddress (STREET)
-
-Either the long or abbreviated attribute name may be used (for example, `localityName=New York` or `L=New York`).
-
-Values are case sensitive: `L=new york` will not match the Locality Name "New York".
diff --git a/content/docs/clients.md b/content/docs/clients.md
deleted file mode 100644
index a69f0f2da..000000000
--- a/content/docs/clients.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-id: clients
-title: Pomerium Core Clients
-sidebar_label: Clients
----
-
-# Pomerium Core Clients
-
-Pomerium offers optional CLI and Desktop clients:
-
-- [Pomerium CLI](/docs/clients/pomerium-cli)
-- [Pomerium Desktop](/docs/clients/pomerium-desktop)
-
-Both the CLI and Desktop clients act as an authentication helper for tools like kubectl and TCP-based connections.
-
-See the [Pomerium Desktop and CLI Clients](/docs/capabilities/tcp/client) page for more information.
diff --git a/content/docs/clients/pomerium-cli.mdx b/content/docs/clients/pomerium-cli.mdx
deleted file mode 100644
index 58d933501..000000000
--- a/content/docs/clients/pomerium-cli.mdx
+++ /dev/null
@@ -1,119 +0,0 @@
----
-# cSpell:ignore commandline armv abnf gpgcheck gpgkey sslverify dockerhub
-
-title: Pomerium CLI
-lang: en-US
-pagination_prev: null
-pagination_next: null
-description: How to get Pomerium's CLI which be used to proxy TCP services and kubernetes commands
-keywords:
- [
- pomerium,
- cli,
- commandline,
- command line interface,
- kubectl,
- tcp,
- tcp over http,
- ]
-sidebar_label: Pomerium CLI
-sidebar_position: 3
----
-
-import Tabs from '@theme/Tabs';
-import TabItem from '@theme/TabItem';
-
-# Pomerium's Command Line Interface
-
-Pomerium CLI is an optional command-line client that works as an authentication helper for tools like [kubectl](/docs/k8s/configure.md) and [TCP-based applications](/docs/capabilities/tcp/).
-
-- Supported Operating Systems: `linux`, `darwin`, `windows`, `freebsd`
-- Supported Architectures: `amd64`, `arm64`, `armv6`, `armv7`
-
-### Binaries
-
-You can find official binaries on our [GitHub Releases](https://github.com/pomerium/cli/releases) page.
-
-```shell
-ARCH=[your arch]
-OS=[your os]
-VERSION=[desired version]
-curl -L https://github.com/pomerium/cli/releases/download/${VERSION}/pomerium-cli-${OS}-${ARCH}.tar.gz \
- | tar -z -x
-```
-
-### Packages
-
-Supported formats include `rpm` and `deb`.
-
-You can find official packages on our [GitHub Releases](https://github.com/pomerium/cli/releases) page or from [Cloudsmith](https://cloudsmith.io/~pomerium/repos/pomerium/packages/).
-
-- [RPM Instructions](https://cloudsmith.io/~pomerium/repos/pomerium/setup/#formats-rpm)
-- [Deb Instructions](https://cloudsmith.io/~pomerium/repos/pomerium/setup/#formats-deb)
-
-
-
-
-
-```abnf title="/etc/yum.repos.d/pomerium-cli.repo"
-[pomerium-pomerium]
-name=pomerium-pomerium
-baseurl=https://dl.cloudsmith.io/public/pomerium/pomerium/rpm/el/$releasever/$basearch
-repo_gpgcheck=1
-enabled=1
-gpgkey=https://dl.cloudsmith.io/public/pomerium/pomerium/gpg.6E388440B94E1407.key
-gpgcheck=1
-sslverify=1
-pkg_gpgcheck=1
-```
-
-
-
-
-```bash
-curl -1sLf 'https://dl.cloudsmith.io/public/pomerium/pomerium/gpg.6E388440B94E1407.key' | apt-key add -
-echo "deb https://dl.cloudsmith.io/public/pomerium/pomerium/deb/debian buster main" > /etc/apt/sources.list.d/pomerium-pomerium.list
-```
-
-
-
-
-### Homebrew
-
-```shell
-brew tap pomerium/tap
-brew install pomerium-cli
-```
-
-### Docker Image
-
-Pomerium CLI uses a [minimal](https://github.com/GoogleContainerTools/distroless) Docker container. You can find the CLI image on [Docker Hub](https://hub.docker.com/r/pomerium/cli), and pull it in several flavors and architectures. Refer to the example commands below to pull specific versions of Pomerium CLI.
-
-- The `:vX.Y.Z` tag pulls a [specific tagged release](https://github.com/pomerium/cli/tags).
-
- ```bash {2}
- docker run cr.pomerium.com/pomerium/cli:v0.1.0 --version
- v0.1.0+53bfa4e
- ```
-
-- The `:latest` tag pulls the [most recent tagged release](https://github.com/pomerium/cli/releases).
-
- ```bash {2}
- docker run cr.pomerium.com/pomerium/cli:latest --version
- v0.2.0+87e214b
- ```
-
-- The `:main` tag pulls an image in sync with git's [main](https://github.com/pomerium/pomerium/tree/main) branch.
-
- ```bash
- docker pull cr.pomerium.com/pomerium/cli:main
- ```
-
-### Source
-
-```shell
-git clone git@github.com:pomerium/cli.git
-cd pomerium
-make build
-./bin/pomerium-cli --help
-```
diff --git a/content/docs/clients/pomerium-desktop.mdx b/content/docs/clients/pomerium-desktop.mdx
deleted file mode 100644
index ccc2fc20e..000000000
--- a/content/docs/clients/pomerium-desktop.mdx
+++ /dev/null
@@ -1,48 +0,0 @@
----
-# cSpell:ignore commandline armv
-
-title: Pomerium Desktop
-lang: en-US
-sidebar_label: Pomerium Desktop
-pagination_prev: null
-pagination_next: null
-description: How to get Pomerium's CLI which be used to proxy TCP services and kubernetes commands
-keywords:
- [
- pomerium,
- cli,
- commandline,
- command line interface,
- kubectl,
- tcp,
- tcp over http,
- gui,
- ]
-sidebar_position: 4
----
-
-# Pomerium Desktop
-
-Pomerium Desktop does everything `pomerium-cli` does, but is designed for users who prefer a graphical user interface.
-
-Functions include acting as an authentication helper for tools like [kubectl](/docs/k8s/configure.md) or TCP [based applications](/docs/capabilities/tcp/).
-
-- Supported Operating Systems: `linux`, `darwin`, `windows`,
-- Supported Architectures: `amd64`, `arm64`, `armv6`, `armv7`
-
-## Packages
-
-Download the latest release from [GitHub](https://github.com/pomerium/desktop-client/releases).
-
-- **Windows**: The installer `.exe` file will install and open the Desktop Client. Right click on the system tray icon to interact with it.
-- **Linux**: We provide Linux binaries as `.AppImage` files, which can be executed in place or managed with a tool like [AppImageLauncher](https://github.com/TheAssassin/AppImageLauncher). Interact with the client from the system tray icon.
-- **macOS**: Open the `dmg` and move the binary to **Applications**. Interact with the client from the system tray icon.
-
-## Brew (OSX)
-
-Alternatively, on Mac.
-
-```shell
-brew tap pomerium/tap
-brew install pomerium-desktop
-```
diff --git a/content/docs/community.mdx b/content/docs/community.mdx
deleted file mode 100644
index bd8af7170..000000000
--- a/content/docs/community.mdx
+++ /dev/null
@@ -1,38 +0,0 @@
----
-title: Community
-lang: en-US
-keywords: [pomerium, community, help, bugs, updates, features]
-description: This document describes how you users can stay up to date with pomerium, report issues, get help, and suggest new features.
----
-
-import {CommunityNewsletterForm} from '../../src/components/Newsletter';
-
-## Get updates
-
-- [Pomerium-announce](https://groups.google.com/forum/#!forum/pomerium-announce) is a low traffic mailing list for important releases and security announcements.
-
-- Follow us on Twitter [@pomerium_io](https://twitter.com/pomerium_io) or [LinkedIn](https://www.linkedin.com/company/pomerium-inc) for the latest updates and industry news.
-
-- Check out our forum, [Discuss](https://discuss.pomerium.com/), where the community explores Pomerium's uses and shares their best practices.
-
-- Want updates delivered directly to your inbox? Sign up for our newsletter here:
-
-
-
-## Get help
-
-For general help and configuration questions, discussions about integrations or complex setups, or anything else related to Pomerium, head to our [Discuss](https://discuss.pomerium.com/) forum, where you can search for open threads or start a new one.
-
-## Report bugs
-
-Like every software, Pomerium has its flaws. If you find one, [search the issues](https://github.com/pomerium/pomerium/issues) to see if it has already been reported. If not, [open a new issue](https://github.com/pomerium/pomerium/issues/new) and describe the bug, and somebody will look into it!
-
-Please follow the issue template so we have all the needed information. We need to be able to repeat the bug using your instructions. Please simplify the issue as much as possible. The more detailed and specific you are, the faster we will be able to help you!
-
-We suggest reading [How to Report Bugs Effectively](http://www.chiark.greenend.org.uk/~sgtatham/bugs.html).
-
-## Suggest features
-
-First, search to see if your feature has already been requested on [GitHub](https://github.com/pomerium/pomerium/issues) or [Discuss](https://discuss.pomerium.com/). If it has, you can add a :+1: reaction to vote for it. If your feature idea is new, open an issue to request the feature. You don't have to follow the bug template for feature requests. Please describe your idea thoroughly so that we know how to implement it! Really vague requests may not be helpful or actionable and without clarification will have to be closed.
-
-While we really do value your requests and implement many of them, not all features are a good fit for Pomerium. If a feature is not in the best interest of the Pomerium project or its users in general, we may politely decline to implement it.
diff --git a/content/docs/community/code-of-conduct.md b/content/docs/community/code-of-conduct.md
deleted file mode 100644
index 0acaec7e1..000000000
--- a/content/docs/community/code-of-conduct.md
+++ /dev/null
@@ -1,52 +0,0 @@
----
-title: Contributor Covenant Code of Conduct
-sidebar_label: Code of Conduct
-lang: en-US
-keywords: [pomerium, community, contributing, code of conduct]
----
-
-## Our Pledge
-
-In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
-
-## Our Standards
-
-Examples of behavior that contributes to creating a positive environment include:
-
-- Using welcoming and inclusive language
-- Being respectful of differing viewpoints and experiences
-- Gracefully accepting constructive criticism
-- Focusing on what is best for the community
-- Showing empathy towards other community members
-
-Examples of unacceptable behavior by participants include:
-
-- The use of sexualized language or imagery and unwelcome sexual attention or advances
-- Trolling, insulting/derogatory comments, and personal or political attacks
-- Public or private harassment
-- Publishing others' private information, such as a physical or electronic address, without explicit permission
-- Other conduct which could reasonably be considered inappropriate in a professional setting
-
-## Our Responsibilities
-
-Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
-
-Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
-
-## Scope
-
-This Code of Conduct applies within all project spaces, and it also applies when an individual is representing the project or its community in public spaces. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at info@pomerium.io. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
-
-Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
-
-[homepage]: https://www.contributor-covenant.org
-
-For answers to common questions about this code of conduct, see https://www.contributor-covenant.org/faq
diff --git a/content/docs/community/contributing.md b/content/docs/community/contributing.md
deleted file mode 100644
index 60251419f..000000000
--- a/content/docs/community/contributing.md
+++ /dev/null
@@ -1,172 +0,0 @@
----
-# cSpell:ignore zerolog jsonnet
-title: Contributing
-lang: en-US
-keywords: [pomerium, community, contributing, pr, code]
-description: This document describes how you can find issues to work on, fix/add documentation, and how setup Pomerium for local development.
----
-
-First of all, thank you for considering contributing to Pomerium! You can have a direct impact on Pomerium by helping with its code or documentation.
-
-- To contribute to Pomerium, open a [pull request](https://github.com/pomerium/pomerium/pulls) (PR) to the Pomerium repository
-- To contribute to the documentation, open a PR to the documentation repository
-
-If you're new to our community, that's okay: **we gladly welcome pull requests from anyone, regardless of your native language or coding experience.**
-
-## General
-
-We try to hold contributions to a high standard for quality, so don't be surprised if we ask for revisions--even if it seems small or insignificant. Please don't take it personally. If your change is on the right track, we can guide you to make it mergeable.
-
-Here are some of the expectations we have of contributors:
-
-- If your change is more than just a minor alteration, **open an issue to propose your change first.** This way we can avoid confusion, coordinate what everyone is working on, and ensure that changes are in-line with the project's goals and the best interests of its users. If there's already an issue about it, comment on the existing issue to claim it.
-
-- **Keep pull requests small.** Smaller PRs are more likely to be merged because they are easier to review! We might ask you to break up large PRs into smaller ones. [An example of what we DON'T do.](https://twitter.com/iamdevloper/status/397664295875805184)
-
-- **Keep related commits together in a PR.** We do want pull requests to be small, but you should also keep multiple related commits in the same PR if they rely on each other.
-
-- **Write tests.** Tests are essential! Written properly, they ensure your change works, and that other changes in the future won't break your change. CI checks should pass.
-
-- **Benchmarks should be included for optimizations.** Optimizations sometimes make code harder to read or have changes that are less than obvious. They should be proven with benchmarks or profiling.
-
-- **[Squash](http://gitready.com/advanced/2009/02/10/squashing-commits-with-rebase.html) insignificant commits.** Every commit should be significant. Commits which merely rewrite a comment or fix a typo can be combined into another commit that has more substance. Interactive rebase can do this, or a simpler way is `git reset --soft ` then `git commit -s`.
-
-- **Own your contributions.** Pomerium is a growing project, and it's much better when individual contributors help maintain their change after it is merged.
-
-- **Use comments properly.** We expect good godoc comments for package-level functions, types, and values. Comments are also useful whenever the purpose for a line of code is not obvious.
-
-:::info **Recommended reading**
-
-- [**CodeReviewComments**](https://github.com/golang/go/wiki/CodeReviewComments)
-- [**Linus Torvalds describes a good commit message**](https://gist.github.com/matthewhudson/1475276)
-- [**Best Practices for Maintainers**](https://opensource.guide/best-practices/)
-- [**Shrinking Code Review**](https://alexgaynor.net/2015/dec/29/shrinking-code-review/)
-
-:::
-
-### Versioning
-
-Pomerium uses [Semantic Versioning](https://semver.org/). In practice, this means for a given version number **vMAJOR**.**MINOR**.**PATCH** (for example, `v0.1.0`):
-
-- **MAJOR** indicates an incompatible API change
-- **MINOR** indicates a new, backwards-compatible functionality
-- **PATCH** indicates a backwards-compatible bug fix
-
-As Pomerium is still pre-`v1.0.0`, you should expect breaking changes between releases.
-
-### Development
-
-See [Building Pomerium From Source](/docs/core/from-source) for information on getting started developing for Pomerium.
-
-To run the unit tests locally:
-
-```bash
-make test
-```
-
-The instrumentation tests run using [Docker Compose]. To run the instrumentation tests locally, first build a development Docker image:
-
-```bash
-./scripts/build-dev-docker.bash
-```
-
-Next pick a configuration from the `integration/clusters` directory, for example `single-stateful`, and use Docker Compose to start that configuration. Use the `POMERIUM_TAG` environment variable to specify the `dev` docker image built in the previous step:
-
-```bash
-cd integration/clusters/single-stateful
-env POMERIUM_TAG=dev docker compose up -V
-```
-
-Once that's up and running you can run the integration tests from another terminal:
-
-```bash
-go test -count=1 -v ./integration/...
-```
-
-If you need to make a change to the test configuration itself, there's a [tpl](https://github.com/pomerium/pomerium/tree/main/integration/tpl) folder that contains `jsonnet` files. Make a change and then rebuild the configuration by running:
-
-```bash
-go run ./integration/cmd/pomerium-integration-tests/ generate-configuration
-```
-
-### Logging
-
-Pomerium uses the [zerolog](https://github.com/rs/zerolog) package for logging. Guidelines for log levels:
-
-| Level | When to use |
-| --- | --- |
-| Panic | _Do not use._ Use Fatal instead. |
-| Fatal | For unrecoverable errors at startup, or extremely exceptional circumstances at normal runtime. |
-| Error | Something has failed, and an operator should know about it. |
-| Warning | _Do not use._ Use Info or Error instead. |
-| Info | An operator should want to see this during normal operation or routine inspection. |
-| Debug | Verbose operational information that might be useful during troubleshooting. |
-| Trace | Information that you would care about only when trying to understand code behavior/ordering/interaction. Intended for someone looking at or familiar with the code, not most end users. |
-
-## Docs
-
-Pomerium's documentation is available at [https://www.pomerium.io/docs](https://www.pomerium.io/docs). If you find a typo, feel a section could be better described, or have an idea for a totally new application or section, don't hesitate to make a PR change. There are few ways you can do this.
-
-### Simple edits
-
-The easiest way to fix minor documentation issues in Pomerium is to click on the **Edit this page** link at the bottom of any page.
-
-![Selecting the Edit this page link on a docs page](./img/contributing-edit-this-page.png)
-
-Doing so will redirect you to the the respective file in the Documentation repository. Here, you can [update the page](https://guides.github.com/features/mastering-markdown/) and commit your changes.
-
-Committing your changes will create a new branch and start a PR.
-
-![Adding proposed changes in the docs repository](./img/contributing-proposed-changes.png)
-
-### Bigger changes
-
-If you need to add a new page, or would like greater control over the editing process you can edit the docs similar to how you would make changes to the source code.
-
-#### Prerequisites
-
-We use [Docusaurus](https://docusaurus.io/) to generate our docs. Docusaurus is a React-powered static-site generator designed for documentation.
-
-Before building the docs, you'll need the following packages:
-
-- [Node.js](https://nodejs.org/en/download/)
-- [Yarn](https://yarnpkg.com/lang/en/docs)
-
-#### Make changes
-
-Once you've installed Node and Yarn, in a terminal run the following command:
-
-```bash
-yarn start
-```
-
-You should see a link to the development server:
-
-```bash
-[INFO] Starting the development server...
-[SUCCESS] Docusaurus website is running at: http://localhost:3001/
-```
-
-Once you have the development server up and running, any changes you make will automatically be reloaded and accessible in your browser.
-
-To add a new document, simply add a new file with the `.md` markdown extension. For example, this document would be `docs/community/contributing.md`.
-
-To make changes to the sidebar or navigation, see the following Docusaurus docs for instructions:
-
-- [Sidebar](https://docusaurus.io/docs/sidebar)
-- [Navbar](https://docusaurus.io/docs/api/themes/configuration#navbar)
-
-### PR previews
-
-We use [Netlify](https://www.netlify.com) to build and host our docs. A nice feature of Netlify is the [Deploy Preview URL](https://docs.netlify.com/site-deploys/deploy-previews/#deploy-preview-urls), which generates a link for PRs. This is helpful if you want to compare your local changes to what will ultimately be deployed in production.
-
-After you've pushed your PR, a member of the documentation team will review your PR and communicate any next steps or suggestions before the PR is merged.
-
-[configuration variables]: /docs/reference
-[docker compose]: https://docs.docker.com/compose/
-[download]: https://github.com/pomerium/pomerium/releases
-[environmental configuration variables]: https://12factor.net/config
-[verify]: https://verify.pomerium.com/
-[identity provider]: /docs/identity-providers
-[make]: https://en.wikipedia.org/wiki/Make_(software)
-[tls certificates]: /docs/guides/certificates
diff --git a/content/docs/community/img/contributing-edit-this-page.png b/content/docs/community/img/contributing-edit-this-page.png
deleted file mode 100644
index 68c7c64cd..000000000
Binary files a/content/docs/community/img/contributing-edit-this-page.png and /dev/null differ
diff --git a/content/docs/community/img/contributing-proposed-changes.png b/content/docs/community/img/contributing-proposed-changes.png
deleted file mode 100644
index 4646ba1e4..000000000
Binary files a/content/docs/community/img/contributing-proposed-changes.png and /dev/null differ
diff --git a/content/docs/concepts/access-control.mdx b/content/docs/concepts/access-control.mdx
deleted file mode 100644
index c36502774..000000000
--- a/content/docs/concepts/access-control.mdx
+++ /dev/null
@@ -1,90 +0,0 @@
----
-title: Identity and Access Control (IAM)
-sidebar_label: Identity & Access Management (IAM)
-lang: en-US
-keywords:
- [
- access,
- authentication,
- authorization,
- Users,
- groups,
- rbac,
- access control,
- namespacing,
- ]
----
-
-# Identity and Access Management (IAM)
-
-## What is identity and access management?
-
-Identity and access management (IAM) is the process of verifying a user’s identity and determining what resources they can access. By enforcing an IAM policy within your organization, you can control what permissions a user has, where they can access resources from, and when.
-
-This degree of fine-grained access control is key to implementing a zero-trust security framework within your organization. Learn how Pomerium helps organizations adopt zero trust starting with IAM.
-
-If you're unfamiliar with IAM, review the following core concepts below:
-
-- [OAuth 2.0 and OIDC](#oauth-20-and-open-id-connect-oidc)
-- [Identity providers](#identity-provider-idp)
-- [Authentication and authorization](#how-pomerium-handles-authentication-and-authorization)
-
-### OAuth 2.0 and Open ID Connect (OIDC)
-
-[OAuth 2.0](https://www.rfc-editor.org/rfc/rfc6749) is an authorization protocol that defines how a user can grant an application limited access to their resources without exchanging details like their username or password. Instead, the application uses an authorization grant to request access to the user's resources from a resource server.
-
-[Open ID Connect](https://openid.net/specs/openid-connect-core-1_0.html#toc) (OIDC) is an authentication protocol built on top of OAuth 2.0. In the case of OIDC, an authorization server verifies the identity of the user and stores that information in an ID token (JWT). The ID token contains identity-related data in the form of claims, and the ID token is passed from the server to the application.
-
-Together, these protocols offer a secure and scalable method for organizations to authenticate and authorize users.
-
-### Identity provider (IdP)
-
-An identity provider (IdP) is a service, like Google or Okta, that stores digital identities (information about a user). When an application needs to verify a user’s identity (OIDC) or request resources on behalf of a user (OAuth 2.0), it speaks to the IdP first. This way, the user only needs to authenticate against the IdP, not the application they want to access.
-
-In the case of Pomerium, the proxy service routes requests to upstream applications and relies on other Pomerium services, like the authentication and authorization services, to handle identity verification with your IdP and to process policy to make access control decisions.
-
-## How Pomerium handles authentication and authorization
-
-Two core concepts within IAM are [**authentication** vs. **authorization**](https://www.pomerium.com/blog/authentication-v-authorization/):
-
-- **Authentication** (AuthN) verifies your identity (Are you who you say you are?)
-- **Authorization** (AuthZ) determines if you’re allowed to do what you’re trying to do (Do you have permission to access the resource?)
-
-Pomerium provides a standardized interface to add access control, regardless if an application itself has authorization or authentication baked in. This allows developers to focus on their app's functionality, not reinventing access control.
-
-### Authentication (AuthN)
-
-Pomerium provides authentication through your existing IdP and supports all major [single sign-on](/docs/identity-providers) (SSO) providers, including Okta, Google, Azure AD, AuthO, Ping, and GitHub.
-
-### Authorization (AuthZ)
-
-Pomerium handles authorization with its high-level, declarative [Pomerium Policy Language](/docs/capabilities/ppl) (PPL). You can configure an authorization policy using PPL to enforce attribute-based access control (ABAC), role-based access control (RBAC), or any other governance policy controls.
-
-Pomerium can make holistic policy and authorization decisions using external data and request context factors such as user groups, roles, time, day, location, and vulnerability status.
-
-### Zero-trust access
-
-Pomerium enables zero-trust access. This means trust flows from identity, device state, and context – not network connection.
-
-With Pomerium:
-
-- Requests are continuously re-evaluated on a per-request basis
-- Authorization is context- and identity-aware: You can use Pomerium to integrate data from any source into authorization policy decisions
-- Trust flows from user and device identity, meaning you can authenticate, authorize, and encrypt communication between every user, device, and application
-
-### Audit logs
-
-Pomerium provides detailed [audit logs](/docs/capabilities/audit-logs) for all activity in your environment. This enables you to quickly detect anomalies to mitigate bad actors and revoke access.
-
-### Users and groups
-
-Pomerium populates users and groups from your IdP. This data is cached to prevent hitting API rate-limits, ensure policy enforcement performance, and provide look-ahead support when adding users or groups to [Namespaces](/docs/capabilities/namespacing) and [Policies](/docs/capabilities/ppl).
-
-### Non-domain users
-
-You may encounter a situation where you may want to add users that are not directly associated with your corporate IdP service. For example, if you have a corporate Google Workspace account and want to add a contractor with a Gmail account, you would have two options:
-
-- Create a group within your IdP directly with the non-domain users in it. This group can be found and added to Namespaces and Policies.
-- Manually add the user's unique ID. Identify the ID from a user's **Session Details** page, or the [Sessions](/docs/capabilities/metrics#sessions-enterprise) page in [Pomerium Enterprise](/docs/enterprise). A user can see their session ID by navigating to the special `/.pomerium` URL endpoint from any Pomerium-managed route. The unique ID is listed as **Sub** under User Details:
-
- ![The User Details page, showing the "sub" data](img/access-control/session-details.png)
diff --git a/content/docs/concepts/img/access-control/session-details.png b/content/docs/concepts/img/access-control/session-details.png
deleted file mode 100644
index 47648f81a..000000000
Binary files a/content/docs/concepts/img/access-control/session-details.png and /dev/null differ
diff --git a/content/docs/concepts/img/auth-flow-diagram.svg b/content/docs/concepts/img/auth-flow-diagram.svg
deleted file mode 100644
index f361156fe..000000000
--- a/content/docs/concepts/img/auth-flow-diagram.svg
+++ /dev/null
@@ -1,399 +0,0 @@
-
\ No newline at end of file
diff --git a/content/docs/concepts/img/clusters/cluster-ip-address-settings.png b/content/docs/concepts/img/clusters/cluster-ip-address-settings.png
deleted file mode 100644
index 000a2fe1f..000000000
Binary files a/content/docs/concepts/img/clusters/cluster-ip-address-settings.png and /dev/null differ
diff --git a/content/docs/concepts/img/clusters/cluster-name-table.png b/content/docs/concepts/img/clusters/cluster-name-table.png
deleted file mode 100644
index e3b9e100c..000000000
Binary files a/content/docs/concepts/img/clusters/cluster-name-table.png and /dev/null differ
diff --git a/content/docs/concepts/img/clusters/clusters-architecture.png b/content/docs/concepts/img/clusters/clusters-architecture.png
deleted file mode 100644
index b3b97e069..000000000
Binary files a/content/docs/concepts/img/clusters/clusters-architecture.png and /dev/null differ
diff --git a/content/docs/concepts/img/clusters/replica-status.png b/content/docs/concepts/img/clusters/replica-status.png
deleted file mode 100644
index e539710bb..000000000
Binary files a/content/docs/concepts/img/clusters/replica-status.png and /dev/null differ
diff --git a/content/docs/concepts/img/clusters/update-cluster-token.png b/content/docs/concepts/img/clusters/update-cluster-token.png
deleted file mode 100644
index 7fa5495b1..000000000
Binary files a/content/docs/concepts/img/clusters/update-cluster-token.png and /dev/null differ
diff --git a/content/docs/concepts/img/clusters/zero-databroker-connection-string.png b/content/docs/concepts/img/clusters/zero-databroker-connection-string.png
deleted file mode 100644
index d5e0c836c..000000000
Binary files a/content/docs/concepts/img/clusters/zero-databroker-connection-string.png and /dev/null differ
diff --git a/content/docs/concepts/img/jaeger.png b/content/docs/concepts/img/jaeger.png
deleted file mode 100644
index ea1b1b53d..000000000
Binary files a/content/docs/concepts/img/jaeger.png and /dev/null differ
diff --git a/content/docs/concepts/img/mutual-authentication/jwt-verification.svg b/content/docs/concepts/img/mutual-authentication/jwt-verification.svg
deleted file mode 100644
index 27e446796..000000000
--- a/content/docs/concepts/img/mutual-authentication/jwt-verification.svg
+++ /dev/null
@@ -1,16 +0,0 @@
-
\ No newline at end of file
diff --git a/content/docs/concepts/img/mutual-authentication/pomerium-basic-hacker.svg b/content/docs/concepts/img/mutual-authentication/pomerium-basic-hacker.svg
deleted file mode 100644
index b52f29753..000000000
--- a/content/docs/concepts/img/mutual-authentication/pomerium-basic-hacker.svg
+++ /dev/null
@@ -1,16 +0,0 @@
-
\ No newline at end of file
diff --git a/content/docs/concepts/img/mutual-authentication/pomerium-basic.svg b/content/docs/concepts/img/mutual-authentication/pomerium-basic.svg
deleted file mode 100644
index 06e08d67c..000000000
--- a/content/docs/concepts/img/mutual-authentication/pomerium-basic.svg
+++ /dev/null
@@ -1,16 +0,0 @@
-
\ No newline at end of file
diff --git a/content/docs/concepts/img/verge-apple.png b/content/docs/concepts/img/verge-apple.png
deleted file mode 100644
index b014cf0b4..000000000
Binary files a/content/docs/concepts/img/verge-apple.png and /dev/null differ
diff --git a/content/docs/core.mdx b/content/docs/core.mdx
deleted file mode 100644
index 28fb22043..000000000
--- a/content/docs/core.mdx
+++ /dev/null
@@ -1,141 +0,0 @@
----
-# cSpell:ignore nonroot gpgcheck sslverify gpgkey abnf
-
-title: Pomerium Core (server)
-lang: en-US
-id: core
-sidebar_label: Pomerium Core
-pagination_prev: null
-pagination_next: null
-description: How to get the open-source core component of Pomerium
-keywords: [pomerium, server, proxy, context-aware proxy, open source]
-sidebar_position: 1
----
-
-import Tabs from '@theme/Tabs';
-import TabItem from '@theme/TabItem';
-
-# Pomerium Core (Server)
-
-Pomerium Core (sometimes referred to as _Pomerium Open Source_) is the primary server component. Pomerium Core is open source, and all other components build on top of it.
-
-- Supported Operating Systems: Linux and macOS
-- Supported Architectures: `amd64`, `arm64`
-
-### Binaries
-
-Official binaries can be found on our [GitHub Releases](https://github.com/pomerium/pomerium/releases) page.
-
-- The Linux binaries require glibc 2.30 or later.
-- The macOS binaries require macOS 12 (Monterey) or later.
-
-```shell
-ARCH=[your arch]
-OS=[your os]
-VERSION=[desired version]
-curl -L https://github.com/pomerium/pomerium/releases/download/${VERSION}/pomerium-${OS}-${ARCH}.tar.gz \
- | tar -z -x
-```
-
-### Linux Packages {#packages}
-
-- Supported formats: `rpm`, `deb`
-- Requires `systemd` support
-
-Official packages can be found on our [GitHub Releases](https://github.com/pomerium/pomerium/releases) page or from [Cloudsmith](https://cloudsmith.io/~pomerium/repos/pomerium/packages/).
-
-- [RPM Instructions](https://cloudsmith.io/~pomerium/repos/pomerium/setup/#formats-rpm)
-- [Deb Instructions](https://cloudsmith.io/~pomerium/repos/pomerium/setup/#formats-deb)
-
-
-
-
-
-```abnf title="/etc/yum.repos.d/pomerium-pomerium.repo"
-[pomerium-pomerium]
-name=pomerium-pomerium
-baseurl=https://dl.cloudsmith.io/public/pomerium/pomerium/rpm/el/$releasever/$basearch
-repo_gpgcheck=1
-enabled=1
-gpgkey=https://dl.cloudsmith.io/public/pomerium/pomerium/gpg.6E388440B94E1407.key
-gpgcheck=1
-sslverify=1
-pkg_gpgcheck=1
-```
-
-
-
-
-```bash
-curl -1sLf 'https://dl.cloudsmith.io/public/pomerium/pomerium/gpg.6E388440B94E1407.key' | apt-key add -
-echo "deb https://dl.cloudsmith.io/public/pomerium/pomerium/deb/debian buster main" > /etc/apt/sources.list.d/pomerium-pomerium.list
-```
-
-
-
-
-### Docker Image
-
-Pomerium also provides [Docker container images](https://www.docker.com/resources/what-container). You can find Pomerium's images on [Docker Hub](https://hub.docker.com/r/pomerium/pomerium). Pomerium can be pulled in several flavors and architectures.
-
-- `:vX.Y.Z` corresponds to a [specific tagged release](https://github.com/pomerium/pomerium/tags).
-
- ```shell-session
- $ docker run pomerium/pomerium:v0.27.2 --version
- pomerium version pomerium: 0.27.2+788017f1
- envoy: 1.31.0+d879aa604b9bdfcb2ed669098a7d062862dc5ea1e90e540338b2e532554bb0a6
- ```
-
-- `:vX.Y` corresponds to the latest patch release for a specific minor version (starting with v0.25).
-
- ```shell-session
- $ docker pull cr.pomerium.com/pomerium/pomerium:v0.27
- ```
-
-- `:latest` corresponds to the [most recent tagged release](https://github.com/pomerium/pomerium/releases/latest).
-
- ```shell-session
- $ docker pull cr.pomerium.com/pomerium/pomerium:latest
- ```
-
-- `:main` corresponds to the most recent development build from the [main](https://github.com/pomerium/pomerium/tree/main) git branch.
-
- ```shell-session
- $ docker pull cr.pomerium.com/pomerium/pomerium:main
- ```
-
-Rootless images for official releases are also published to provide additional security. In these images, Pomerium runs as the `nonroot` user. Depending on your deployment environment, you may need to grant the container additional [capabilities](https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/) or change the [listen address](/docs/reference/address) to use a port number other than 443.
-
-- `:nonroot-vX.Y.Z` is the rootless image for a specific release.
-- `:nonroot` is the rootless equivalent to the `:latest` tag.
-
-All of the above images use a [minimal base image](https://github.com/GoogleContainerTools/distroless#readme), but "debug" images are also available. Debug images include a shell environment, to allow operators to perform debugging steps from inside the container. Prepend `debug-` to any other image tag to obtain the corresponding debug image. For example:
-
-- `:debug-vX.Y.Z` is the debug image for a specific release.
-- `:debug-nonroot` is the debug image for the latest `:nonroot` image.
-- `:debug` is the debug equivalent of the `:latest` tag.
-
-### Kubernetes
-
-:::warning
-
-As of v0.19.0, Pomerium no longer supports Helm for Kubernetes deployments.
-
-:::
-
-We recommend following the steps in the Kubernetes [Installation](/docs/k8s/install) guide to deploy Pomerium with Kubernetes, or see the Kubernetes [Quickstart](/docs/k8s/quickstart) for a proof of concept of how to configure and deploy Pomerium with Kubernetes.
-
-### Source
-
-:::note
-
-Officially supported build platforms are limited by [envoy proxy](https://www.envoyproxy.io/).
-
-:::
-
-```shell
-git clone git@github.com:pomerium/pomerium.git
-cd pomerium
-make
-./bin/pomerium --version
-```
diff --git a/content/docs/core/_category_.json b/content/docs/core/_category_.json
deleted file mode 100644
index faa8b6a80..000000000
--- a/content/docs/core/_category_.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
- "label": "Pomerium Core"
-}
diff --git a/content/docs/core/binary.mdx b/content/docs/core/binary.mdx
deleted file mode 100644
index e606c3c4f..000000000
--- a/content/docs/core/binary.mdx
+++ /dev/null
@@ -1,85 +0,0 @@
----
-title: Binaries
-lang: en-US
-keywords:
- - pomerium
- - identity access proxy
- - identity aware proxy
- - reverse proxy
- - deployment
- - pre-built binaries
-pagination_prev: null
-pagination_next: null
-sidebar_label: Binaries
----
-
-import ConfigMinimal from '@site/content/examples/config/config.minimal.yaml.md';
-
-# Pre-built binaries
-
-This document covers how to configure and run Pomerium using the official prebuilt binaries.
-
-## Prerequisites
-
-- A configured [identity provider]
-- [TLS certificates]
-
-## Download
-
-You can download the latest release from [GitHub][download], or use the repositories we provide through [Cloudsmith][cloudsmith-repo]. In addition to the easy updates provided by the package manager, the `deb` and `rpm` packages include systemd service unit configurations.
-
-### Operating System Packages
-
-Through [Cloudsmith][cloudsmith-repo], we provide OS packages for Linux distributions using `deb` and `rpm` style package managers. Select your system's package format and architecture, then use the **Setup** tab to add the repository to your package manager.
-
-### Standalone Binary
-
-[Download] the latest release of Pomerium for your machine's operating system and architecture.
-
-## Configure
-
-Pomerium supports setting [configuration variables] using both environmental variables and using a configuration file.
-
-When using our OS packages, we provide a default configuration at `/etc/pomerium/config.yaml`. Otherwise, create the config file (`config.yaml`) in your preferred location.
-
-This file will be used to determine Pomerium's configuration settings, routes, and access-policies. Consider the following example:
-
-
-
-You can also set some or all of your configuration keys as environment variables, in an `env` file for example. See the [Reference] page to identify the environment variable for each configuration option.
-
-## Run
-
-### OS Package
-
-1. The following command allows the Pomerium systemd service to bind to [privileged port] `443`:
-
- ```bash
- echo -e "[Service]\nAmbientCapabilities=CAP_NET_BIND_SERVICE" | sudo SYSTEMD_EDITOR=tee systemctl edit pomerium
- ```
-
-1. Enable and start the service:
-
- ```bash
- sudo systemctl enable --now pomerium.service
- ```
-
-### Manual Installation
-
-Source the configuration `env` file, if present, and run pomerium specifying the `config.yaml` .
-
-```bash
-./bin/pomerium -config config.yaml
-```
-
-Browse to `external-verify.your.domain.example`. Connections between you and [verify] will now be proxied and managed by Pomerium.
-
-[configuration variables]: /docs/reference
-[download]: https://github.com/pomerium/pomerium/releases
-[verify]: https://verify.pomerium.com/
-[identity provider]: /docs/identity-providers
-[tls certificates]: /docs/guides/certificates
-[cloudsmith]: https://cloudsmith.io
-[cloudsmith-repo]: https://cloudsmith.io/~pomerium/repos/pomerium/groups/
-[reference]: /docs/reference
-[privileged port]: https://www.w3.org/Daemon/User/Installation/PrivilegedPorts.html
diff --git a/content/docs/core/changelog.mdx b/content/docs/core/changelog.mdx
deleted file mode 100644
index e60cb16f7..000000000
--- a/content/docs/core/changelog.mdx
+++ /dev/null
@@ -1,5868 +0,0 @@
----
-title: Changelog
-lang: en-US
-sidebar_position: 2
-# cSpell:disable
----
-
-import Versioning from '../admonitions/_semantic-versioning.mdx';
-
-# Core Changelog
-
-Please refer to the [upgrade guide](/docs/core/upgrading) before upgrading.
-
-:::note
-
-
-
-:::
-
-## [v0.28.0](https://github.com/pomerium/pomerium/tree/v0.28.0) (2024-11-11)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.27.2...v0.28.0)
-
-### New
-
-- More flexible PPL string matchers.
-- Add new jwt issuer format route option.
-- Add an 'issuer' field to the /.well-known/pomerium endpoint.
-- Add new request header variable 'pomerium.jwt'.
-
-### Changed
-
-- Better error serialization for requests from kubectl.
-- Improved header evaluation performance in the authorize service.
-- Improved RouteID calculation performance (used for generating configuration with large numbers of routes).
-
-### Bug Fixes
-
-- Fix enterprise detection in the dashboard.
-- Fix response code redirect option.
-
-## [v0.27.2](https://github.com/pomerium/pomerium/tree/v0.27.2) (2024-10-22)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.27.1...v0.27.2)
-
-### Pomerium Zero
-
-- Add a Pomerium Core to Pomerium Zero import tool, allowing you to bring your existing Pomerium configuration into Pomerium Zero.
-- Add active users reporting, for self-serve billing in Pomerium Zero. End user information is pseudonymized and reported to Pomerium Zero, in order to bill paid organizations according to the number of active users across the organization as a whole.
-
-### Fixed
-
-- Improve handling of transient errors from the databroker.
-- Fix a data race in the in-memory databroker storage backend.
-- Remove an incorrect “unknown config option” warning message when the `set_response_headers` config file key is present.
-
-### Changes
-
-- For any routes where the [Kubernetes Service Account Token](https://www.pomerium.com/docs/reference/routes/kubernetes-service-account-token) option is set, allow both websockets and SPDY connection upgrades. (One of these is necessary for commands like `kubectl exec` and `kubectl port-forward` to work correctly, depending on your version of Kubernetes.)
-- Previously, the [Log Level](https://www.pomerium.com/docs/reference/log-level) option could affect the default value of the [Authorize Log Fields](https://www.pomerium.com/docs/reference/authorize-log-fields) option: setting the main log level to `debug` would change the default set of authorize log fields to include `headers` (logging all HTTP request headers). This undocumented behavior has been removed, and these two options are now entirely independent.
-- Remove some currently-unused configuration options:
- - `databroker_storage_cert_file`
- - `databroker_storage_key_file`
- - `databroker_storage_ca_file`
- - `databroker_storage_tls_skip_verify`
- - `grpc_client_dns_roundrobin`
-- Various other minor code clean-up.
-
-## [v0.27.1](https://github.com/pomerium/pomerium/tree/v0.27.1) (2024-09-26)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.27.0...v0.27.1)
-
-Pomerium v0.27.1 includes a fix to the databroker service API authorization logic. Certain service account tokens from Pomerium Zero or Pomerium Enterprise could grant unintended authorization to the databroker service API. See the [CVE-2024-47616](https://github.com/pomerium/pomerium/security/advisories/GHSA-r7rh-jww5-5fjr) for more information.
-
-### Security
-
-- Additional validation checks for gRPC API authorization. This update resolves a security vulnerability that we believe affects only certain Pomerium Enterprise and Pomerium Zero deployments.
-
-### Fixed
-
-- The user info dashboard page (at URL path `/.pomerium/`) now provides user info also for the [programmatic access](https://www.pomerium.com/docs/capabilities/programmatic-access) flow (see issue [#5246](https://github.com/pomerium/pomerium/issues/5246)).
-- The user info dashboard page now correctly displays group membership info for Pomerium Enterprise deployments with [directory sync](https://www.pomerium.com/docs/capabilities/directory-sync) configured.
-
-## [v0.27.0](https://github.com/pomerium/pomerium/tree/v0.27.0) (2024-09-10)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.26.1...v0.27.0)
-
-## What's Changed
-
-### Breaking
-
-- **proxy**: deprecate the /.pomerium/jwt endpoint by @kenjenkins in https://github.com/pomerium/pomerium/pull/5254
-- **zero/k8s**: use Deployment instead of StatefulSet by @wasaga in https://github.com/pomerium/pomerium/pull/5248
-
-### New
-
-- **authorize**: use uuid for jti, current time for iat and exp by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5147
-- **config**: add `databroker_storage_connection_string_file` by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5242
-- **config**: add mTLS UserPrincipalName SAN match by @kenjenkins in https://github.com/pomerium/pomerium/pull/5177
-- **config**: add runtime flag to allow disabling config hot-reload (#5079) by @kralicky in https://github.com/pomerium/pomerium/pull/5112
-- **envoy**: allow TLS 1.3 for upstream connections by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5263
-- **envoy**: log TLS connection failures in the mTLS `reject_connection` mode by @kralicky in https://github.com/pomerium/pomerium/pull/5210
-- **envoy**: resource monitoring & overload manager configuration by @kralicky in https://github.com/pomerium/pomerium/pull/5106
-- **envoy**: support http2 prior knowledge for insecure upstream targets (h2c://) by @kralicky in https://github.com/pomerium/pomerium/pull/5205
-- **ui**: add "Policy ID" label to error details page by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5127
-- **ui**: add request id to upstream error page by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5166
-- **ui**: add user info link to error page by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5158
-- **ui**: user info dashboard improvements by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5128
-- **zero/connect**: add re-run health checks command by @wasaga in https://github.com/pomerium/pomerium/pull/5219
-- **zero/k8s**: write bootstrap configuration to a secret by @kralicky in https://github.com/pomerium/pomerium/pull/5114
-
-### Fixes
-
-- **authorize**: require new login when authenticate url changes by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5165
-- **controlplane**: avoid calling Close on nil listener by @kenjenkins in https://github.com/pomerium/pomerium/pull/5156
-- **databroker/leaser**: set timeout on ReleaseLease by @wasaga in https://github.com/pomerium/pomerium/pull/5208
-- **logging**: add support for using the standard grpc env vars to control log severity and verbosity by @kralicky in https://github.com/pomerium/pomerium/pull/5120
-- **session**: do not invalidate based on ID token by @kenjenkins in https://github.com/pomerium/pomerium/pull/5182
-- **ui**: fix cycle in profile data by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5168
-- **ui**: set Cache-Control: no-cache, tweak sign-out cancel button behavior by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5264
-- **zero/connect**: ignore unknown message types by @wasaga in https://github.com/pomerium/pomerium/pull/5223
-- **zero/health-checks**: fix early checks sometimes missing by @wasaga in https://github.com/pomerium/pomerium/pull/5229
-- **zero/health-checks**: zero route availability improvements by @wasaga in https://github.com/pomerium/pomerium/pull/5111
-
-### Changed
-
-- **authenticate**: rework session ID token handling by @kenjenkins in https://github.com/pomerium/pomerium/pull/5178
-- **authorize**: add request-id to error messages by @wasaga in https://github.com/pomerium/pomerium/pull/5267
-- **ci**: do not include timestamp into buildmeta by @wasaga in https://github.com/pomerium/pomerium/pull/5215
-- **config**: optimize policy iterators by @kralicky in https://github.com/pomerium/pomerium/pull/5184
-- **config**: sort runtime flags, name consistency by @kenjenkins in https://github.com/pomerium/pomerium/pull/5255
-- **envoy**: upgrade to v1.31.0 by @kenjenkins in https://github.com/pomerium/pomerium/pull/5183
-- **github**: update README.md by @cmo-pomerium in https://github.com/pomerium/pomerium/pull/5163
-- **github**: update README.md by @nikhil-pomerium in https://github.com/pomerium/pomerium/pull/5253
-- **go**: update to Go 1.23 by @kralicky in https://github.com/pomerium/pomerium/pull/5216
-- **logging**: change log.Error function by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5251
-- **logging**: convert warnings to info or error by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5235
-- **proto**: update protoc dependencies by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5218
-- **ui**: update logo by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5249
-- **zero**: refactor controller by @wasaga in https://github.com/pomerium/pomerium/pull/5134
-- **zero/api**: generate error methods for response types by @kralicky in https://github.com/pomerium/pomerium/pull/5252
-- **zero/api**: reset token and url cache if 401 is received by @wasaga in https://github.com/pomerium/pomerium/pull/5256
-- **zero/api**: switch to github.com/oapi-codegen/oapi-codegen by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5226
-- **zero/bundle-download**: update metadata by @wasaga in https://github.com/pomerium/pomerium/pull/5212
-- **zero/cmd**: make it more evident what caused shutdown by @wasaga in https://github.com/pomerium/pomerium/pull/5209
-- **zero/connect**: add telemetry request command by @wasaga in https://github.com/pomerium/pomerium/pull/5131
-- **zero/k8s**: set externalTrafficPolicy: Local by @wasaga in https://github.com/pomerium/pomerium/pull/5266
-- **zero/telemetry**: add hostname and version by @wasaga in https://github.com/pomerium/pomerium/pull/5146
-- **zero/telemetry**: add prometheus streaming converter to OTLP by @wasaga in https://github.com/pomerium/pomerium/pull/5132
-- **zero/telemetry**: collect limited core metrics by @wasaga in https://github.com/pomerium/pomerium/pull/5142
-- **zero/telemetry**: internal envoy stats scraper and metrics producer by @wasaga in https://github.com/pomerium/pomerium/pull/5136
-- **zero/telemetry**: refactor telemetry and controller by @wasaga in https://github.com/pomerium/pomerium/pull/5135
-
-### Dependency Updates
-
-- bump busybox from `5eef5ed` to `9ae97d3` in /.github in the docker group by @dependabot in https://github.com/pomerium/pomerium/pull/5161
-- bump busybox from `9ae97d3` to `8274294` in /.github in the docker group by @dependabot in https://github.com/pomerium/pomerium/pull/5260
-- bump braces from 3.0.2 to 3.0.3 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/5139
-- bump the docker group in /.github with 3 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5124
-- bump the docker group in /.github with 2 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5202
-- bump the docker group with 3 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5123
-- bump the docker group with 2 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5159
-- bump the docker group with 3 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5201
-- bump the docker group with 2 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5258
-- bump the github-actions group with 9 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5121
-- bump the github-actions group with 4 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5160
-- bump the github-actions group with 9 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5200
-- bump the github-actions group with 6 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5259
-- bump the go group with 27 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5122
-- bump the go group with 21 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5162
-- bump the go group across 1 directory with 26 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5207
-- bump the go group across 1 directory with 28 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5262
-- bump github.com/docker/docker from 27.0.3+incompatible to 27.1.0+incompatible by @dependabot in https://github.com/pomerium/pomerium/pull/5193
-- bump github.com/opencontainers/runc from 1.1.12 to 1.1.14 by @dependabot in https://github.com/pomerium/pomerium/pull/5261
-- bump google.golang.org/grpc from 1.64.0 to 1.64.1 by @dependabot in https://github.com/pomerium/pomerium/pull/5169
-- bump micromatch from 4.0.5 to 4.0.8 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/5240
-- replace usages of x/exp/maps + bump golang.org/x/exp by @kralicky in https://github.com/pomerium/pomerium/pull/5221
-
-## [v0.26.1](https://github.com/pomerium/pomerium/tree/v0.26.1) (2024-07-01)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.26.0...v0.26.1)
-
-Pomerium v0.26.1 includes multiple security updates:
-
-- The Pomerium user info page (at `/.pomerium`) unintentionally included serialized OAuth 2.0 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users, and have now been removed. For more details, please see the official [CVE statement](https://github.com/pomerium/pomerium/security/advisories/GHSA-rrqr-7w59-637v).
-
- Credit to Vadim Sheydaev, also known as Enr1g for reporting this issue.
-
-- This release includes an update from Envoy 1.30.1 to Envoy 1.30.3 to address the following security issues:
-
- - [CVE-2024-34362](https://github.com/envoyproxy/envoy/security/advisories/GHSA-hww5-43gv-35jv): Crash (use-after-free) in EnvoyQuicServerStream
- - [CVE-2024-34363](https://github.com/envoyproxy/envoy/security/advisories/GHSA-g979-ph9j-5gg4): Crash due to uncaught nlohmann JSON exception
- - [CVE-2024-34364](https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcj3-h7vf-fw26): Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response, and other components
- - [CVE-2024-32974](https://github.com/envoyproxy/envoy/security/advisories/GHSA-mgxp-7hhp-8299): Crash in EnvoyQuicServerStream::OnInitialHeadersComplete()
- - [CVE-2024-32975](https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9mq-6v96-cpqc): Crash in QuicheDataReader::PeekVarInt62Length()
- - [CVE-2024-32976](https://github.com/envoyproxy/envoy/security/advisories/GHSA-7wp5-c2vq-4f8m): Endless loop while decompressing Brotli data with extra input
- - [CVE-2024-23326](https://github.com/envoyproxy/envoy/security/advisories/GHSA-vcf8-7238-v74c): Envoy incorrectly accepts HTTP 200 response for entering upgrade mode
- - [CVE-2024-38525](https://github.com/envoyproxy/envoy/security/advisories/GHSA-8mq4-c2v5-3h39): datadog tracer does not handle trace headers with unicode characters
-
-- The release also removes a transitive dependency on the gopkg.in/square/go-jose.v2 library which is vulnerable to https://github.com/advisories/GHSA-c5q2-7r4c-mv6g.
-
-### Security
-
-- envoy: upgrade to v1.30.3 by @kenjenkins in https://github.com/pomerium/pomerium/pull/5155
-- userinfo: remove excess userinfo data by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5148
-- update the pomerium/webauthn dependency (#5125) by @kenjenkins in https://github.com/pomerium/pomerium/pull/5157
-
-### Fixed
-
-- autocert: fix filter chain, handshake by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5151
-
-## [v0.26.0](https://github.com/pomerium/pomerium/tree/v0.26.0) (2024-05-17)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.25.2...v0.26.0)
-
-### Breaking
-
-Changes that are expected to cause an incompatibility.
-
-- **config**: remove deprecated client_ca option by @kenjenkins in https://github.com/pomerium/pomerium/pull/4918
-- **envoy**: set explicit hostname on cluster endpoints by @kenjenkins in https://github.com/pomerium/pomerium/pull/5018
-
-### New
-
-- **authenticate**: apply branding to sign out pages by @kenjenkins in https://github.com/pomerium/pomerium/pull/5044
-- **authorize**: add support for rego print statements by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5049
-- **authorize**: log service account user ID by @kenjenkins in https://github.com/pomerium/pomerium/pull/4964
-- **authorize**: return non-html errors on denied by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4904
-- **config**: add runtime flags by @wasaga in https://github.com/pomerium/pomerium/pull/5050
-- **config**: add support for TCP proxy chaining by @kenjenkins in https://github.com/pomerium/pomerium/pull/5053
-- **config**: add support for stripping the port for matching routes by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5085
-- **config**: disable gRPC ingress when address is the empty string by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5058
-- **config**: implement direct response by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4960
-- **databroker**: disable identity manager user refresh when hosted authenticate is used by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4905
-- **envoy**: clean up temporary directory on start by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4914
-- **envoy**: format envoy local replies by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5067
-- **envoy**: only enable port reuse on linux by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5066
-- **identity**: add enabler by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5084
-- **identity**: dynamic authenticator registration by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5105
-- **identity**: refactor identity manager by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5091
-- **logging**: less verbose logs by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5040
-- **ppl**: add client cert SAN match criteria by @kenjenkins in https://github.com/pomerium/pomerium/pull/4913
-- **ppl**: add groups criterion by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4916
-- **ui**: fix page title by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4957
-- **zero**: add route reachability health check by @wasaga in https://github.com/pomerium/pomerium/pull/5093
-- **zero**: add service accounts support by @wasaga in https://github.com/pomerium/pomerium/pull/5031
-- **zero**: add storage health check by @wasaga in https://github.com/pomerium/pomerium/pull/5074
-- **zero**: health check building config from databroker source by @wasaga in https://github.com/pomerium/pomerium/pull/5104
-- **zero**: lower log level by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5065
-- **zero**: upgrade oapi-codegen by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4953
-
-### Fixed
-
-- **authenticate**: redirect to /.pomerium/signed_out when no signout redirect url is defined by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5060
-- **envoy**: exclude unauthorized access from local replies by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5108
-- **kubernetes**: fix impersonate group header by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5090
-- **zero**: add gRPC keep-alive by @wasaga in https://github.com/pomerium/pomerium/pull/4961
-- **zero**: fix bootstrap config path by @wasaga in https://github.com/pomerium/pomerium/pull/5035
-- **zero**: fix ticker usage by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4969
-
-### Changed
-
-- **authenticate**: rework CORS headers log entry by @kenjenkins in https://github.com/pomerium/pomerium/pull/4900
-- **authorize**: result denied improvements by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4952
-- **config**: remove cookie secure option by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4907
-- **config**: fix typo by @wasaga in https://github.com/pomerium/pomerium/pull/4963
-- **core**: move telemetry requestid to pkg directory by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4911
-- **core**: switch to uber mock by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5073
-- **core**: use context.WithoutCancel by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4959
-- **envoy**: address strconv.Atoi warnings by @kenjenkins in https://github.com/pomerium/pomerium/pull/5076
-- **envoy**: enable TCP keepalive for internal clusters by @kenjenkins in https://github.com/pomerium/pomerium/pull/4902
-- **envoy**: migrate deprecated overload setting by @kenjenkins in https://github.com/pomerium/pomerium/pull/5082
-- **envoy**: preserve Go's max file limit for Envoy by @kenjenkins in https://github.com/pomerium/pomerium/pull/5102
-- **envoy**: upgrade to v1.30.1 by @kenjenkins in https://github.com/pomerium/pomerium/pull/5080
-- **logging**: use standard logger by @wasaga in https://github.com/pomerium/pomerium/pull/5096
-- **opa**: update for rego 1.0 by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4895
-- **ui**: adds upstream error page by @nhayfield in https://github.com/pomerium/pomerium/pull/5113
-- **ui**: improve frontend build size by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5109
-- **zero**: add user-agent to requests by @wasaga in https://github.com/pomerium/pomerium/pull/5078
-- **zero**: add checks for ability to save bootstrap parameter and bundle status reporting by @wasaga in https://github.com/pomerium/pomerium/pull/5064
-- **zero**: add connect health check by @wasaga in https://github.com/pomerium/pomerium/pull/5086
-- **zero**: add common healthcheck package, zero reporter and first xds check by @wasaga in https://github.com/pomerium/pomerium/pull/5059
-- **zero**: add shared secret to the cluster bootstrap params by @wasaga in https://github.com/pomerium/pomerium/pull/5030
-- **zero**: only report healthcheck transitions by @wasaga in https://github.com/pomerium/pomerium/pull/5068
-- **zero**: remove unused changeset code by @wasaga in https://github.com/pomerium/pomerium/pull/4915
-- **zero**: reset back to inmem databroker if connection string is empty by @wasaga in https://github.com/pomerium/pomerium/pull/4955
-- **zero**: simplify control loop lease retry code by @wasaga in https://github.com/pomerium/pomerium/pull/4979
-- **zero**: update oapi-codegen by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4898
-
-### Dependency Updates
-
-- chore(deps): bump actions/setup-node from 4.0.1 to 4.0.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4974
-- chore(deps): bump actions/upload-artifact from 4.0.0 to 4.3.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4922
-- chore(deps): bump actions/upload-artifact from 4.3.0 to 4.3.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4972
-- chore(deps): bump busybox from `ba76950` to `6d9ac92` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4950
-- chore(deps): bump cloud.google.com/go/storage from 1.36.0 to 1.37.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4926
-- chore(deps): bump cloud.google.com/go/storage from 1.37.0 to 1.39.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4989
-- chore(deps): bump distroless/base-debian12 from `0a93daa` to `5eae9ef` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4970
-- chore(deps): bump distroless/base-debian12 from `996c583` to `1d91d5f` by @dependabot in https://github.com/pomerium/pomerium/pull/4980
-- chore(deps): bump distroless/base from `6c1e34e` to `9d4e568` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4971
-- chore(deps): bump docker/metadata-action from 5.4.0 to 5.5.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4923
-- chore(deps): bump docker/setup-buildx-action from 3.0.0 to 3.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4978
-- chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.26.2 to 1.26.6 by @dependabot in https://github.com/pomerium/pomerium/pull/4932
-- chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.26.6 to 1.27.6 by @dependabot in https://github.com/pomerium/pomerium/pull/5015
-- chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.24.0 to 1.24.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4930
-- chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.24.1 to 1.25.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4992
-- chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.48.1 to 1.51.3 by @dependabot in https://github.com/pomerium/pomerium/pull/5016
-- chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.47.7 to 1.48.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4939
-- chore(deps): bump github.com/docker/docker from 24.0.7+incompatible to 25.0.2+incompatible by @dependabot in https://github.com/pomerium/pomerium/pull/4942
-- chore(deps): bump github.com/docker/docker from 25.0.4+incompatible to 25.0.5+incompatible by @dependabot in https://github.com/pomerium/pomerium/pull/5032
-- chore(deps): bump github.com/docker/docker from 26.0.0+incompatible to 26.0.2+incompatible by @dependabot in https://github.com/pomerium/pomerium/pull/5075
-- chore(deps): bump github.com/envoyproxy/go-control-plane from 0.11.1 to 0.12.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4935
-- chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 1.0.2 to 1.0.4 by @dependabot in https://github.com/pomerium/pomerium/pull/4945
-- chore(deps): bump github.com/google/uuid from 1.5.0 to 1.6.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4933
-- chore(deps): bump github.com/go-chi/chi/v5 from 5.0.11 to 5.0.12 by @dependabot in https://github.com/pomerium/pomerium/pull/4986
-- chore(deps): bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4984
-- chore(deps): bump github.com/jackc/pgx/v5 from 5.5.1 to 5.5.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4944
-- chore(deps): bump github.com/jackc/pgx/v5 from 5.5.2 to 5.5.3 by @dependabot in https://github.com/pomerium/pomerium/pull/5000
-- chore(deps): bump github.com/klauspost/compress from 1.17.4 to 1.17.5 by @dependabot in https://github.com/pomerium/pomerium/pull/4940
-- chore(deps): bump github.com/klauspost/compress from 1.17.5 to 1.17.7 by @dependabot in https://github.com/pomerium/pomerium/pull/4995
-- chore(deps): bump github.com/minio/minio-go/v7 from 7.0.66 to 7.0.67 by @dependabot in https://github.com/pomerium/pomerium/pull/4996
-- chore(deps): bump github.com/opencontainers/runc from 1.1.5 to 1.1.12 by @dependabot in https://github.com/pomerium/pomerium/pull/4919
-- chore(deps): bump github.com/open-policy-agent/opa from 0.60.0 to 0.61.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4937
-- chore(deps): bump github.com/open-policy-agent/opa from 0.61.0 to 0.62.1 by @dependabot in https://github.com/pomerium/pomerium/pull/5017
-- chore(deps): bump github.com/prometheus/common from 0.45.0 to 0.46.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4949
-- chore(deps): bump github.com/prometheus/common from 0.46.0 to 0.49.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4998
-- chore(deps): bump github.com/prometheus/client_golang from 1.18.0 to 1.19.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4999
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.23.12 to 3.24.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4928
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.24.1 to 3.24.2 by @dependabot in https://github.com/pomerium/pomerium/pull/5001
-- chore(deps): bump github.com/stretchr/testify from 1.8.4 to 1.9.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4990
-- chore(deps): bump github.com/rs/zerolog from 1.31.0 to 1.32.0 by @dependabot in https://github.com/pomerium/pomerium/pull/5004
-- chore(deps): bump golang from 1.21.5-bookworm to 1.21.6-bookworm by @dependabot in https://github.com/pomerium/pomerium/pull/4920
-- chore(deps): bump golang.org/x/crypto from 0.18.0 to 0.21.0 by @dependabot in https://github.com/pomerium/pomerium/pull/5013
-- chore(deps): bump golang.org/x/net from 0.22.0 to 0.23.0 by @dependabot in https://github.com/pomerium/pomerium/pull/5077
-- chore(deps): bump golang.org/x/oauth2 from 0.16.0 to 0.18.0 by @dependabot in https://github.com/pomerium/pomerium/pull/5012
-- chore(deps): bump google-github-actions/setup-gcloud from 2.0.1 to 2.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4924
-- chore(deps): bump google-github-actions/auth from 2.0.0 to 2.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4925
-- chore(deps): bump google-github-actions/auth from 2.1.0 to 2.1.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4976
-- chore(deps): bump google.golang.org/api from 0.154.0 to 0.161.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4938
-- chore(deps): bump google.golang.org/api from 0.161.0 to 0.168.0 by @dependabot in https://github.com/pomerium/pomerium/pull/5010
-- chore(deps): bump google.golang.org/grpc from 1.60.1 to 1.61.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4948
-- chore(deps): bump google.golang.org/grpc from 1.61.0 to 1.62.1 by @dependabot in https://github.com/pomerium/pomerium/pull/5011
-- chore(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0 by @kenjenkins in https://github.com/pomerium/pomerium/pull/5009
-- chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4975
-- chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 0.44.0 to 0.45.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4947
-- chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 0.45.0 to 1.24.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4983
-- chore(deps): bump go.opentelemetry.io/otel/sdk/metric from 1.21.0 to 1.22.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4946
-- chore(deps): bump go.opentelemetry.io/otel/sdk/metric from 1.22.0 to 1.24.0 by @dependabot in https://github.com/pomerium/pomerium/pull/5003
-- chore(deps): bump go.uber.org/zap from 1.26.0 to 1.27.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4987
-- chore(deps): bump mikefarah/yq from 4.40.5 to 4.42.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4977
-- chore(deps): bump node from `8d0f16f` to `fd01154` by @dependabot in https://github.com/pomerium/pomerium/pull/4921
-- chore(deps): bump node from `fd01154` to `f3299f1` by @dependabot in https://github.com/pomerium/pomerium/pull/4981
-- chore(deps): bump pre-commit/action from 3.0.0 to 3.0.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4973
-- chore(deps): bump the docker group with 2 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5024
-- chore(deps): bump the docker group in /.github with 2 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5023
-- chore(deps): bump the docker group with 3 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5045
-- chore(deps): bump the docker group in /.github with 3 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5046
-- chore(deps): bump the docker group in /.github with 3 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5095
-- chore(deps): bump the docker group with 3 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5098
-- chore(deps): bump the github-actions group with 1 update by @dependabot in https://github.com/pomerium/pomerium/pull/5025
-- chore(deps): bump the github-actions group with 6 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5047
-- chore(deps): bump the github-actions group with 5 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5094
-- chore(deps): bump the go group with 10 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5026
-- chore(deps): bump the go group with 15 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5048
-- chore(deps): bump the go group with 29 updates by @dependabot in https://github.com/pomerium/pomerium/pull/5097
-- chore(deps): update UI dependencies by @kenjenkins in https://github.com/pomerium/pomerium/pull/5088
-- chore(deps): bump @trivago/prettier-plugin-sort-imports from 2.0.4 to 4.3.0 by @kenjenkins in https://github.com/pomerium/pomerium/pull/5054
-- chore(deps): bump @babel/traverse from 7.16.10 to 7.23.2 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/5055
-- ci: upgrade to Go 1.22 by @wasaga in https://github.com/pomerium/pomerium/pull/4967
-- core/lint: upgrade golangci-lint, replace interface{} with any by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5099
-- envoy: set to v1.29.2 by @wasaga in https://github.com/pomerium/pomerium/pull/5042
-- envoy: upgrade to v1.29.3 by @wasaga in https://github.com/pomerium/pomerium/pull/5056
-- update dev Dockerfiles to use Go 1.22.2 by @kenjenkins in https://github.com/pomerium/pomerium/pull/5063
-
-## [v0.25.2](https://github.com/pomerium/pomerium/tree/v0.25.2) (2024-04-05)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.25.1...v0.25.2)
-
-### Changed
-
-- **envoy**: upgrade to v1.28.2 by @wasaga in https://github.com/pomerium/pomerium/pull/5057
-
-## [v0.25.1](https://github.com/pomerium/pomerium/tree/v0.25.1) (2024-03-13)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.25.0...v0.25.1)
-
-### Changed
-
-- **ci**: bump Go to 1.21.8 in docker by @wasaga in https://github.com/pomerium/pomerium/pull/5027
-- **connect**: add gRPC keep-alive by @wasaga in https://github.com/pomerium/pomerium/pull/4962
-- **core/ci**: check docker base images by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5028
-- **core/zero**: fix ticker usage by @calebdoxsey in https://github.com/pomerium/pomerium/pull/5019
-
-## [v0.25.0](https://github.com/pomerium/pomerium/tree/v0.25.0) (2024-01-10)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.24.0...v0.25.0)
-
-### Breaking
-
-- **config**: remove support for base64 encoded certificates in the [`certificates`](https://www.pomerium.com/docs/reference/certificates#certificates) field. It may only contain file locations. See https://github.com/pomerium/pomerium/pull/4718 by @calebdoxsey for details.
-- **config**: remove [`debug`](https://www.pomerium.com/docs/reference/debug#summary) option, always use json logs by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4857
-
-### New
-
-- **authenticate**: Refactoring identity authenticators to initiate redirect. For AWS Cognito, please allow the following sign out `https://{AUTHENTICATE_DOMAIN}/.pomerium/signed_out` URL. See more details in https://github.com/pomerium/pomerium/pull/4858 by @calebdoxsey.
-- Initial support for the [Pomerium Zero](https://www.pomerium.com/pomerium-zero/) closed beta is included in this release.
-
-### Fixed
-
-- **config**: add support for maps in environments, i.e. `env IDP_REQUEST_PARAMS='{"x":"y"}' ...` by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4717
-- **core**: fix graceful stop by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4865
-- **databroker**: fix nil data unmarshal by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4734
-- **databroker**: fix Patch() error handling for in-memory databroker backend by @kenjenkins in https://github.com/pomerium/pomerium/pull/4838
-- **databroker**: hijack connections for notification listeners by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4806
-- **databroker**: prevent `nil` data in the databroker deleted records by @wasaga in https://github.com/pomerium/pomerium/pull/4736
-- **databroker**: REDIS backend has been removed in the previous release, https://github.com/pomerium/pomerium/pull/4768 by @calebdoxsey cleans up some remaining references.
-- **envoy**: Rewrite the remove_pomerium_cookie lua function to handle `=` inside of cookie values. by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4641
-- **metrics**: enforce `text/plain` metric format by @kenjenkins in https://github.com/pomerium/pomerium/pull/4774
-- **zero**: group funcs that need run within a lease by @wasaga in https://github.com/pomerium/pomerium/pull/4862
-
-### Changed
-
-- **authenticate**: add stateful flow by @kenjenkins in https://github.com/pomerium/pomerium/pull/4822
-- **authenticate**: change how sessions are deleted by @kenjenkins in https://github.com/pomerium/pomerium/pull/4893
-- **authenticate**: getUserInfoData() cleanup by @kenjenkins in https://github.com/pomerium/pomerium/pull/4818
-- **authenticate**: move events.go out of internal/authenticateflow by @kenjenkins in https://github.com/pomerium/pomerium/pull/4852
-- **authenticate**: move stateless flow logic by @kenjenkins in https://github.com/pomerium/pomerium/pull/4820
-- **authenticate**: move logAuthenticateEvent by @kenjenkins in https://github.com/pomerium/pomerium/pull/4821
-- **authenticate**: remove extra UpdateUserInfo() call by @kenjenkins in https://github.com/pomerium/pomerium/pull/4813
-- **authenticate**: Update the initialization logic for the authenticate, authorize, and proxy services to automatically select between the stateful authentication flow and the stateless authentication flow, depending on whether Pomerium is configured to use the hosted authenticate service. This change ensures a single IdP session is maintained for all user visits, enabling a single sign out behaviour for installations with IdP configured. @kenjenkins in https://github.com/pomerium/pomerium/pull/4765
-- **authenticate**: verify redirect in Callback test by @kenjenkins in https://github.com/pomerium/pomerium/pull/4894
-- **config**: Add a global config option for pass_identity_headers, in addition to existing per-route option by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4720
-- **config**: disable strict-transport-security header with staging autocert by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4741
-- **config**: no longer stub out HPKE public key fetch by @kenjenkins in https://github.com/pomerium/pomerium/pull/4853
-- **config**: remove unnecessary authenticate route when using hosted authenticate (authenticate.pomerium.app) by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4719
-- **runtime**: automatically determine goroutine max cap by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4766
-- **runtime**: update to Go 1.21.4 by @kenjenkins in https://github.com/pomerium/pomerium/pull/4770
-- **session**: add unit tests for gRPC wrapper methods by @kenjenkins in https://github.com/pomerium/pomerium/pull/4713
-- **tests**: add tool for renewing test certs by @kenjenkins in https://github.com/pomerium/pomerium/pull/4742
-- **tests**: check for profile cookies by @kenjenkins in https://github.com/pomerium/pomerium/pull/4847
-- **tests**: renew test certs by @kenjenkins in https://github.com/pomerium/pomerium/pull/4738
-- **tests**: re-generate test configurations by @kenjenkins in https://github.com/pomerium/pomerium/pull/4816
-- **zero**: add linear probabilistic counter for MAU estimation by @wasaga in https://github.com/pomerium/pomerium/pull/4776
-- **zero**: add more verbose logging about background control loops by @wasaga in https://github.com/pomerium/pomerium/pull/4815
-- **zero**: add reporter by @wasaga in https://github.com/pomerium/pomerium/pull/4855
-- **zero**: add support for managed mode from config file by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4756
-- **zero**: better code reuse by @wasaga in https://github.com/pomerium/pomerium/pull/4758
-- **zero**: calculate DAU and MAU by @wasaga in https://github.com/pomerium/pomerium/pull/4810
-- **zero**: fix restart behavior by @kenjenkins in https://github.com/pomerium/pomerium/pull/4753
-- **zero**: rebase and merge feature/zero branch by @kenjenkins in https://github.com/pomerium/pomerium/pull/4745
-- **zero**: set drwx------ for cache dir by @wasaga in https://github.com/pomerium/pomerium/pull/4764
-- **zero**: support gzipped blobs by @wasaga in https://github.com/pomerium/pomerium/pull/4767
-- **zero**: use os.UserCacheDir for boostrap config path by @kenjenkins in https://github.com/pomerium/pomerium/pull/4744
-- **zero**: use production urls by default by @wasaga in https://github.com/pomerium/pomerium/pull/4814
-
-### Dependency
-
-- bump actions/checkout from 4.1.0 to 4.1.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4692
-- bump actions/setup-go from 4.1.0 to 5.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4830
-- bump actions/setup-node from 3.8.1 to 4.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4694
-- bump actions/setup-node from 4.0.0 to 4.0.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4888
-- bump actions/setup-python from 4.7.0 to 5.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4827
-- bump actions/stale from 8.0.0 to 9.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4825
-- bump actions/upload-artifact from 3.1.3 to 4.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4889
-- bump busybox from `3fbc632` to `1ceb872` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4824
-- bump busybox from `1ceb872` to `ba76950` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4884
-- bump cloud.google.com/go/storage from 1.33.0 to 1.35.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4750
-- bump cloud.google.com/go/storage from 1.35.1 to 1.36.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4873
-- bump distroless/base from `46c5b9b` to `b31a6e0` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4670
-- bump distroless/base from `b31a6e0` to `6c1e34e` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4885
-- bump distroless/base-debian12 from `5e24c7a` to `996c583` by @dependabot in https://github.com/pomerium/pomerium/pull/4882
-- bump distroless/base-debian12 from `d2890b2` to `5e24c7a` by @dependabot in https://github.com/pomerium/pomerium/pull/4658
-- bump distroless/base-debian12 from `d64f548` to `1dfdb5e` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4671
-- bump distroless/base-debian12 from `1dfdb5e` to `0a93daa` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4886
-- bump docker/build-push-action from 5.0.0 to 5.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4777
-- bump docker/metadata-action from 5.0.0 to 5.3.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4826
-- bump docker/metadata-action from 5.3.0 to 5.4.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4891
-- bump github.com/aws/aws-sdk-go-v2 from 1.22.2 to 1.24.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4840
-- bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.40.0 to 1.42.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4751
-- bump github.com/bits-and-blooms/bitset from 1.11.0 to 1.13.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4876
-- bump github.com/caddyserver/certmagic from 0.19.2 to 0.20.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4836
-- bump github.com/cloudflare/circl from 1.3.3 to 1.3.6 by @dependabot in https://github.com/pomerium/pomerium/pull/4674
-- bump github.com/coreos/go-oidc/v3 from 3.6.0 to 3.8.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4791
-- bump github.com/coreos/go-oidc/v3 from 3.8.0 to 3.9.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4880
-- bump github.com/fsnotify/fsnotify from 1.6.0 to 1.7.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4680
-- bump github.com/google/go-cmp from 0.5.9 to 0.6.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4685
-- bump github.com/google/uuid from 1.3.1 to 1.4.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4677
-- bump github.com/google/uuid from 1.4.0 to 1.5.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4878
-- bump github.com/gorilla/mux from 1.8.0 to 1.8.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4790
-- bump github.com/gorilla/websocket from 1.5.0 to 1.5.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4793
-- bump github.com/go-chi/chi/v5 from 5.0.10 to 5.0.11 by @dependabot in https://github.com/pomerium/pomerium/pull/4875
-- bump github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4760
-- bump github.com/jackc/pgx/v5 from 5.4.3 to 5.5.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4803
-- bump github.com/jackc/pgx/v5 from 5.5.0 to 5.5.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4871
-- bump github.com/klauspost/compress from 1.17.0 to 1.17.4 by @dependabot in https://github.com/pomerium/pomerium/pull/4798
-- bump github.com/mattn/go-isatty from 0.0.19 to 0.0.20 by @dependabot in https://github.com/pomerium/pomerium/pull/4801
-- bump github.com/minio/minio-go/v7 from 7.0.63 to 7.0.65 by @dependabot in https://github.com/pomerium/pomerium/pull/4812
-- bump github.com/minio/minio-go/v7 from 7.0.65 to 7.0.66 by @dependabot in https://github.com/pomerium/pomerium/pull/4868
-- bump github.com/oapi-codegen/runtime from 1.0.0 to 1.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4870
-- bump github.com/open-policy-agent/opa from 0.57.0 to 0.59.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4799
-- bump github.com/open-policy-agent/opa from 0.59.0 to 0.60.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4879
-- bump github.com/prometheus/client_golang from 1.17.0 to 1.18.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4872
-- bump github.com/prometheus/client_model from 0.4.1-0.20230718164431-9a2bf3000d16 to 0.5.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4672
-- bump github.com/prometheus/common from 0.44.0 to 0.45.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4686
-- bump github.com/shirou/gopsutil/v3 from 3.23.9 to 3.23.11 by @dependabot in https://github.com/pomerium/pomerium/pull/4794
-- bump github.com/shirou/gopsutil/v3 from 3.23.11 to 3.23.12 by @dependabot in https://github.com/pomerium/pomerium/pull/4874
-- bump github.com/spf13/viper from 1.16.0 to 1.18.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4861
-- bump github.com/VictoriaMetrics/fastcache from 1.12.1 to 1.12.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4802
-- bump github.com/yuin/gopher-lua from 1.1.0 to 1.1.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4832
-- bump golang from 1.21.4-bookworm to 1.21.5-bookworm by @dependabot in https://github.com/pomerium/pomerium/pull/4828
-- bump golang from `a6b787c` to `1415bb0` by @dependabot in https://github.com/pomerium/pomerium/pull/4883
-- bump golang.org/x/crypto from 0.16.0 to 0.17.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4860. This includes a patch for [GO-2023-2402](https://pkg.go.dev/vuln/GO-2023-2402) / [CVE-2023-48795](https://github.com/advisories/GHSA-45x7-px36-x8w8) (Terrapin). Note that Pomerium does not use the affected [golang.org/x/crypto/ssh](https://pkg.go.dev/golang.org/x/crypto/ssh) package from this module.
-- bump golang.org/x/net from 0.17.0 to 0.19.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4792
-- bump golang.org/x/oauth2 from 0.12.0 to 0.15.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4797
-- bump golang.org/x/sync from 0.3.0 to 0.5.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4748
-- bump golang.org/x/time from 0.3.0 to 0.5.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4796
-- bump google-github-actions/auth from 1.1.1 to 2.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4778
-- bump google-github-actions/setup-gcloud from 1.1.1 to 2.0.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4890
-- bump google.golang.org/api from 0.143.0 to 0.153.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4835
-- bump google.golang.org/api from 0.153.0 to 0.154.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4867
-- bump google.golang.org/protobuf from 1.31.1-0.20231027082548-f4a6c1f6e5c1 to 1.32.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4877
-- bump mikefarah/yq from 4.35.2 to 4.40.3 by @dependabot in https://github.com/pomerium/pomerium/pull/4780
-- bump mikefarah/yq from 4.40.3 to 4.40.4 by @dependabot in https://github.com/pomerium/pomerium/pull/4829
-- bump mikefarah/yq from 4.40.4 to 4.40.5 by @dependabot in https://github.com/pomerium/pomerium/pull/4887
-- bump node from `42a4d97` to `5f21943` by @dependabot in https://github.com/pomerium/pomerium/pull/4659
-- bump node from `445acd9` to `8d0f16f` by @dependabot in https://github.com/pomerium/pomerium/pull/4881
-- bump sigs.k8s.io/yaml from 1.3.0 to 1.4.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4688
-- bump stefanzweifel/git-auto-commit-action from 4.16.0 to 5.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4693
-- zero/openapi: pin v1.0.0 of a runtime by @wasaga in https://github.com/pomerium/pomerium/pull/4851
-
-## [v0.24.0](https://github.com/pomerium/pomerium/tree/v0.24.0) (2023-11-16)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.23.0...v0.24.0)
-
-### Breaking
-
-- config: remove set_authorization_header option by @kenjenkins in https://github.com/pomerium/pomerium/pull/4489
-- core/config: remove support for base64 encoded certificates by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4725
-- databroker: remove redis storage backend by @kenjenkins in https://github.com/pomerium/pomerium/pull/4699
-
-### New
-
-- databroker: build config concurrently, option to bypass validation by @wasaga in https://github.com/pomerium/pomerium/pull/4655
-
-### Fixed
-
-- core/authenticate: refactor idp sign out by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4582
-- core/authenticate: validate the identity profile by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4545
-- core/authorize: check for expired tokens by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4543
-- core/identity: fix slow restart by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4542
-- core/storage: fix nil data unmarshal by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4739
-
-### Changed
-
-- Add metric request error in log by @sylr in https://github.com/pomerium/pomerium/pull/4585
-- authorize: build evaluators cache in parallel by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4731
-- authorize: reuse policy evaluators where possible by @kenjenkins in https://github.com/pomerium/pomerium/pull/4710
-- config: do not add route headers to global map by @kenjenkins in https://github.com/pomerium/pomerium/pull/4629
-- core/config: add config version, additional telemetry by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4645
-- core/config: add support for maps in environments by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4728
-- core/config: refactor change dispatcher by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4657
-- core/config: refactor file watcher by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4702
-- core/config: remove version by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4653
-- core/controlplane: apply configuration changes in a background thread by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4649
-- core/envoy: fix remove cookie lua script by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4732
-- core/events: refactor the events.Target to use mutexes instead of a background goroutine by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4700
-- core/filemgr: use xxhash instead of sha512 for filenames by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4697
-- core/hpke: reduce memory usage from zstd by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4650
-- cryptutil: remove unused functions by @kenjenkins in https://github.com/pomerium/pomerium/pull/4541
-- databroker: add patch method by @kenjenkins in https://github.com/pomerium/pomerium/pull/4704
-- databroker: add reconciler by @wasaga in https://github.com/pomerium/pomerium/pull/4709
-- databroker: add utility recordset and changeset by @wasaga in https://github.com/pomerium/pomerium/pull/4701
-- databroker: changeset: prevent nil data in the deleted records by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4737
-- Docs: remove tcp example by @ZPain8464 in https://github.com/pomerium/pomerium/pull/4616
-- identity: override TokenSource expiry behavior by @kenjenkins in https://github.com/pomerium/pomerium/pull/4632
-- identity: preserve session refresh schedule by @kenjenkins in https://github.com/pomerium/pomerium/pull/4633
-- identity: rework session refresh error handling by @kenjenkins in https://github.com/pomerium/pomerium/pull/4638
-- integration: renew test certs by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4740
-- proto: add id to certificate by @wasaga in https://github.com/pomerium/pomerium/pull/4706
-- protoutil: add OverwriteMasked method by @kenjenkins in https://github.com/pomerium/pomerium/pull/4651
-- reconciler: allow custom comparison function by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4727
-- rework session updates to use new patch method by @kenjenkins in https://github.com/pomerium/pomerium/pull/4705
-- storage/inmemory: implement patch operation by @kenjenkins in https://github.com/pomerium/pomerium/pull/4654
-- storage/postgres: implement patch operation by @kenjenkins in https://github.com/pomerium/pomerium/pull/4656
-- upgrade envoy to v1.28.0 by @kenjenkins in https://github.com/pomerium/pomerium/pull/4635
-- xds: add type url to log by @wasaga in https://github.com/pomerium/pomerium/pull/4696
-
-### Dependency
-
-- chore(deps): bump actions/checkout from 3.5.3 to 3.6.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4496
-- chore(deps): bump actions/checkout from 3.6.0 to 4.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4562
-- chore(deps): bump actions/checkout from 4.0.0 to 4.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4611
-- chore(deps): bump actions/setup-go from 4.0.1 to 4.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4497
-- chore(deps): bump actions/setup-node from 3.7.0 to 3.8.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4501
-- chore(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 by @dependabot in https://github.com/pomerium/pomerium/pull/4557
-- chore(deps): bump busybox from `caa382c` to `3fbc632` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4549
-- chore(deps): bump cloud.google.com/go/storage from 1.31.0 to 1.32.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4518
-- chore(deps): bump cloud.google.com/go/storage from 1.32.0 to 1.33.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4579
-- chore(deps): bump coverallsapp/github-action from 2.2.1 to 2.2.3 by @dependabot in https://github.com/pomerium/pomerium/pull/4560
-- chore(deps): bump distroless/base from `b0216a3` to `46c5b9b` in /.github by @dependabot in https://github.com/pomerium/pomerium/pull/4550
-- chore(deps): bump docker/build-push-action from 4.1.1 to 5.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4554
-- chore(deps): bump docker/login-action from 2.2.0 to 3.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4552
-- chore(deps): bump docker/metadata-action from 4.6.0 to 5.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4553
-- chore(deps): bump docker/setup-buildx-action from 2.9.1 to 2.10.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4498
-- chore(deps): bump docker/setup-buildx-action from 2.10.0 to 3.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4555
-- chore(deps): bump docker/setup-qemu-action from 2.2.0 to 3.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4559
-- chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.18.32 to 1.18.38 by @dependabot in https://github.com/pomerium/pomerium/pull/4522
-- chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.18.38 to 1.18.40 by @dependabot in https://github.com/pomerium/pomerium/pull/4581
-- chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.18.40 to 1.18.42 by @dependabot in https://github.com/pomerium/pomerium/pull/4599
-- chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.20.0 to 1.21.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4524
-- chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.38.1 to 1.38.5 by @dependabot in https://github.com/pomerium/pomerium/pull/4521
-- chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.38.5 to 1.40.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4600
-- chore(deps): bump github.com/caddyserver/certmagic from 0.19.1 to 0.19.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4526
-- chore(deps): bump github.com/CAFxX/httpcompression from 0.0.8 to 0.0.9 by @dependabot in https://github.com/pomerium/pomerium/pull/4572
-- chore(deps): bump github.com/docker/docker from 24.0.2+incompatible to 24.0.6+incompatible by @dependabot in https://github.com/pomerium/pomerium/pull/4570
-- chore(deps): bump github.com/docker/docker from 24.0.6+incompatible to 24.0.7+incompatible by @dependabot in https://github.com/pomerium/pomerium/pull/4646
-- chore(deps): bump github.com/google/uuid from 1.3.0 to 1.3.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4517
-- chore(deps): bump github.com/hashicorp/golang-lru/v2 from 2.0.4 to 2.0.6 by @dependabot in https://github.com/pomerium/pomerium/pull/4528
-- chore(deps): bump github.com/hashicorp/golang-lru/v2 from 2.0.6 to 2.0.7 by @dependabot in https://github.com/pomerium/pomerium/pull/4607
-- chore(deps): bump github.com/jackc/pgx/v5 from 5.4.2 to 5.4.3 by @dependabot in https://github.com/pomerium/pomerium/pull/4531
-- chore(deps): bump github.com/klauspost/compress from 1.16.7 to 1.17.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4566
-- chore(deps): bump github.com/minio/minio-go/v7 from 7.0.61 to 7.0.63 by @dependabot in https://github.com/pomerium/pomerium/pull/4527
-- chore(deps): bump github.com/open-policy-agent/opa from 0.55.0 to 0.56.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4530
-- chore(deps): bump github.com/open-policy-agent/opa from 0.56.0 to 0.57.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4606
-- chore(deps): bump github.com/openzipkin/zipkin-go from 0.4.1 to 0.4.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4523
-- chore(deps): bump github.com/prometheus/client_golang from 1.16.0 to 1.17.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4603
-- chore(deps): bump github.com/prometheus/procfs from 0.11.1 to 0.12.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4602
-- chore(deps): bump github.com/rs/cors from 1.9.0 to 1.10.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4574
-- chore(deps): bump github.com/rs/cors from 1.10.0 to 1.10.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4601
-- chore(deps): bump github.com/rs/zerolog from 1.30.0 to 1.31.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4598
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.23.7 to 3.23.8 by @dependabot in https://github.com/pomerium/pomerium/pull/4519
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.23.8 to 3.23.9 by @dependabot in https://github.com/pomerium/pomerium/pull/4605
-- chore(deps): bump golangci/golangci-lint-action from 3.6.0 to 3.7.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4499
-- chore(deps): bump google.golang.org/api from 0.134.0 to 0.138.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4532
-- chore(deps): bump google.golang.org/api from 0.138.0 to 0.141.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4578
-- chore(deps): bump google.golang.org/api from 0.141.0 to 0.143.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4608
-- chore(deps): bump google.golang.org/grpc from 1.57.0 to 1.58.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4575
-- chore(deps): bump google.golang.org/grpc from 1.58.2 to 1.58.3 by @dependabot in https://github.com/pomerium/pomerium/pull/4640
-- chore(deps): bump golang.org/x/net from 0.15.0 to 0.17.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4626
-- chore(deps): bump golang.org/x/oauth2 from 0.11.0 to 0.12.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4580
-- chore(deps): bump goreleaser/goreleaser-action from 4.3.0 to 4.4.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4502
-- chore(deps): bump goreleaser/goreleaser-action from 4.4.0 to 5.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4563
-- chore(deps): bump go.uber.org/zap from 1.24.0 to 1.25.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4516
-- chore(deps): bump go.uber.org/zap from 1.25.0 to 1.26.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4577
-- chore(deps): bump mikefarah/yq from 4.34.2 to 4.35.1 by @dependabot in https://github.com/pomerium/pomerium/pull/4503
-- chore(deps): bump mikefarah/yq from 4.35.1 to 4.35.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4610
-- chore(deps): bump node from `f41231b` to `7923c64` by @dependabot in https://github.com/pomerium/pomerium/pull/4551
-- chore(deps): bump node from `7923c64` to `2daec43` by @dependabot in https://github.com/pomerium/pomerium/pull/4609
-- chore(deps): bump node from `850d8e1` to `f41231b` by @dependabot in https://github.com/pomerium/pomerium/pull/4533
-- chore(deps): bump tibdex/github-app-token from 1.8.0 to 1.8.2 by @dependabot in https://github.com/pomerium/pomerium/pull/4505
-- chore(deps): bump tibdex/github-app-token from 1.8.2 to 2.0.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4556
-- chore(deps): bump tibdex/github-app-token from 2.0.0 to 2.1.0 by @dependabot in https://github.com/pomerium/pomerium/pull/4612
-- chore(deps): bump @fontsource/dm-mono from 4.5.2 to 5.0.11 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4515
-- chore(deps): bump @fontsource/dm-mono from 5.0.11 to 5.0.12 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4573
-- chore(deps): bump @fontsource/dm-mono from 5.0.12 to 5.0.14 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4619
-- chore(deps): bump @fontsource/dm-sans from 5.0.3 to 5.0.11 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4508
-- chore(deps): bump @fontsource/dm-sans from 5.0.11 to 5.0.12 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4561
-- chore(deps): bump @fontsource/dm-sans from 5.0.12 to 5.0.13 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4593
-- chore(deps): bump @mui/icons-material from 5.3.1 to 5.14.9 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4567
-- chore(deps-dev): bump ts-node from 10.4.0 to 10.9.1 in /ui by @dependabot in https://github.com/pomerium/pomerium/pull/4279
-- core/go: upgrade go.mod by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4711
-
-## [v0.23.0](https://github.com/pomerium/pomerium/tree/v0.23.0) (2023-08-24)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.22.3...v0.23.0)
-
-### New
-
-- adds success colors for statuses in the 200 range [\#4314](https://github.com/pomerium/pomerium/pull/4314) (@nhayfield)
-- authenticate: add aws cognito [\#4137](https://github.com/pomerium/pomerium/pull/4137) (@wasaga)
-- authorize: log id token claims separately from id token [\#4394](https://github.com/pomerium/pomerium/pull/4394) (@calebdoxsey)
-- config: add cookie_same_site option [\#4148](https://github.com/pomerium/pomerium/pull/4148) (@calebdoxsey)
-- hpke: compress query string [\#4147](https://github.com/pomerium/pomerium/pull/4147) (@calebdoxsey)
-
-### Fixed
-
-- autocert: suppress OCSP stapling errors [\#4371](https://github.com/pomerium/pomerium/pull/4371) (@calebdoxsey)
-- config: update logic for checking overlapping certificates [\#4216](https://github.com/pomerium/pomerium/pull/4216) (@calebdoxsey)
-- config: validate log levels [\#4367](https://github.com/pomerium/pomerium/pull/4367) (@calebdoxsey)
-- databroker: fix fast forward [\#4192](https://github.com/pomerium/pomerium/pull/4192) (@calebdoxsey)
-- databroker: sort configs [\#4190](https://github.com/pomerium/pomerium/pull/4190) (@calebdoxsey)
-- envoy: set re2 limits very high [\#4187](https://github.com/pomerium/pomerium/pull/4187) (@calebdoxsey)
-- envoyconfig: disable validation context when no client certificates are required [\#4151](https://github.com/pomerium/pomerium/pull/4151) (@calebdoxsey)
-- fix WillHaveCertificateForServerName check to be strict match for derived cert name [\#4167](https://github.com/pomerium/pomerium/pull/4167) (@wasaga)
-
-### Dependency
-
-- chore\(deps\): bump actions/checkout from 3.5.0 to 3.5.2 [\#4153](https://github.com/pomerium/pomerium/pull/4153) (@dependabot[bot])
-- chore\(deps\): bump actions/checkout from 3.5.2 to 3.5.3 [\#4239](https://github.com/pomerium/pomerium/pull/4239) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-go from 4.0.0 to 4.0.1 [\#4176](https://github.com/pomerium/pomerium/pull/4176) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-node from 3.6.0 to 3.7.0 [\#4432](https://github.com/pomerium/pomerium/pull/4432) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-python from 4.6.0 to 4.6.1 [\#4203](https://github.com/pomerium/pomerium/pull/4203) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-python from 4.6.1 to 4.7.0 [\#4429](https://github.com/pomerium/pomerium/pull/4429) (@dependabot[bot])
-- chore\(deps\): bump cloud.google.com/go/storage from 1.29.0 to 1.30.1 [\#4221](https://github.com/pomerium/pomerium/pull/4221) (@dependabot[bot])
-- chore\(deps\): bump cloud.google.com/go/storage from 1.30.1 to 1.31.0 [\#4332](https://github.com/pomerium/pomerium/pull/4332) (@dependabot[bot])
-- chore\(deps\): bump coverallsapp/github-action from 2.1.2 to 2.2.0 [\#4241](https://github.com/pomerium/pomerium/pull/4241) (@dependabot[bot])
-- chore\(deps\): bump coverallsapp/github-action from 2.2.0 to 2.2.1 [\#4430](https://github.com/pomerium/pomerium/pull/4430) (@dependabot[bot])
-- chore\(deps\): bump debian from `1fbdbcf` to `4291be2` [\#4160](https://github.com/pomerium/pomerium/pull/4160) (@dependabot[bot])
-- chore\(deps\): bump debian from `4291be2` to `cd9b6e7` [\#4206](https://github.com/pomerium/pomerium/pull/4206) (@dependabot[bot])
-- chore\(deps\): bump docker/build-push-action from 4.0.0 to 4.1.1 [\#4264](https://github.com/pomerium/pomerium/pull/4264) (@dependabot[bot])
-- chore\(deps\): bump docker/login-action from 2.1.0 to 2.2.0 [\#4274](https://github.com/pomerium/pomerium/pull/4274) (@dependabot[bot])
-- chore\(deps\): bump docker/metadata-action from 4.4.0 to 4.5.0 [\#4242](https://github.com/pomerium/pomerium/pull/4242) (@dependabot[bot])
-- chore\(deps\): bump docker/metadata-action from 4.5.0 to 4.6.0 [\#4273](https://github.com/pomerium/pomerium/pull/4273) (@dependabot[bot])
-- chore\(deps\): bump docker/setup-buildx-action from 2.4.1 to 2.5.0 [\#4154](https://github.com/pomerium/pomerium/pull/4154) (@dependabot[bot])
-- chore\(deps\): bump docker/setup-buildx-action from 2.5.0 to 2.7.0 [\#4262](https://github.com/pomerium/pomerium/pull/4262) (@dependabot[bot])
-- chore\(deps\): bump docker/setup-buildx-action from 2.7.0 to 2.8.0 [\#4330](https://github.com/pomerium/pomerium/pull/4330) (@dependabot[bot])
-- chore\(deps\): bump docker/setup-buildx-action from 2.8.0 to 2.9.1 [\#4433](https://github.com/pomerium/pomerium/pull/4433) (@dependabot[bot])
-- chore\(deps\): bump docker/setup-qemu-action from 2.1.0 to 2.2.0 [\#4263](https://github.com/pomerium/pomerium/pull/4263) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.21 to 1.18.25 [\#4208](https://github.com/pomerium/pomerium/pull/4208) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.25 to 1.18.27 [\#4286](https://github.com/pomerium/pomerium/pull/4286) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.27 to 1.18.32 [\#4436](https://github.com/pomerium/pomerium/pull/4436) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.31.2 to 1.33.0 [\#4139](https://github.com/pomerium/pomerium/pull/4139) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.33.0 to 1.34.0 [\#4260](https://github.com/pomerium/pomerium/pull/4260) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.34.0 to 1.34.1 [\#4290](https://github.com/pomerium/pomerium/pull/4290) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.34.1 to 1.36.0 [\#4323](https://github.com/pomerium/pomerium/pull/4323) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.36.0 to 1.38.1 [\#4435](https://github.com/pomerium/pomerium/pull/4435) (@dependabot[bot])
-- chore\(deps\): bump github.com/caddyserver/certmagic from 0.17.2 to 0.18.0 [\#4291](https://github.com/pomerium/pomerium/pull/4291) (@dependabot[bot])
-- chore\(deps\): bump github.com/caddyserver/certmagic from 0.18.0 to 0.18.2 [\#4334](https://github.com/pomerium/pomerium/pull/4334) (@dependabot[bot])
-- chore\(deps\): bump github.com/caddyserver/certmagic from 0.18.2 to 0.19.1 [\#4401](https://github.com/pomerium/pomerium/pull/4401) (@dependabot[bot])
-- chore\(deps\): bump github.com/cenkalti/backoff/v4 from 4.2.0 to 4.2.1 [\#4156](https://github.com/pomerium/pomerium/pull/4156) (@dependabot[bot])
-- chore\(deps\): bump github.com/cloudflare/circl from 1.3.2 to 1.3.3 [\#4158](https://github.com/pomerium/pomerium/pull/4158) (@dependabot[bot])
-- chore\(deps\): bump github.com/coreos/go-oidc/v3 from 3.5.0 to 3.6.0 [\#4226](https://github.com/pomerium/pomerium/pull/4226) (@dependabot[bot])
-- chore\(deps\): bump github.com/docker/distribution from 2.8.1+incompatible to 2.8.2+incompatible [\#4170](https://github.com/pomerium/pomerium/pull/4170) (@dependabot[bot])
-- chore\(deps\): bump github.com/docker/docker from 23.0.3+incompatible to 23.0.5+incompatible [\#4141](https://github.com/pomerium/pomerium/pull/4141) (@dependabot[bot])
-- chore\(deps\): bump github.com/docker/docker from 23.0.5+incompatible to 23.0.6+incompatible [\#4164](https://github.com/pomerium/pomerium/pull/4164) (@dependabot[bot])
-- chore\(deps\): bump github.com/docker/docker from 23.0.6+incompatible to 24.0.1+incompatible [\#4183](https://github.com/pomerium/pomerium/pull/4183) (@dependabot[bot])
-- chore\(deps\): bump github.com/docker/docker from 24.0.1+incompatible to 24.0.2+incompatible [\#4205](https://github.com/pomerium/pomerium/pull/4205) (@dependabot[bot])
-- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 1.0.0 to 1.0.1 [\#4185](https://github.com/pomerium/pomerium/pull/4185) (@dependabot[bot])
-- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 1.0.1 to 1.0.2 [\#4329](https://github.com/pomerium/pomerium/pull/4329) (@dependabot[bot])
-- chore\(deps\): bump github.com/envoyproxy/go-control-plane from 0.11.0 to 0.11.1 [\#4247](https://github.com/pomerium/pomerium/pull/4247) (@dependabot[bot])
-- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.10.1 to 1.0.0 [\#4155](https://github.com/pomerium/pomerium/pull/4155) (@dependabot[bot])
-- chore\(deps\): bump github.com/go-chi/chi/v5 from 5.0.8 to 5.0.10 [\#4407](https://github.com/pomerium/pomerium/pull/4407) (@dependabot[bot])
-- chore\(deps\): bump github.com/hashicorp/golang-lru/v2 from 2.0.2 to 2.0.3 [\#4267](https://github.com/pomerium/pomerium/pull/4267) (@dependabot[bot])
-- chore\(deps\): bump github.com/hashicorp/golang-lru/v2 from 2.0.3 to 2.0.4 [\#4327](https://github.com/pomerium/pomerium/pull/4327) (@dependabot[bot])
-- chore\(deps\): bump github.com/jackc/pgx/v5 from 5.3.1 to 5.4.0 [\#4293](https://github.com/pomerium/pomerium/pull/4293) (@dependabot[bot])
-- chore\(deps\): bump github.com/jackc/pgx/v5 from 5.4.0 to 5.4.1 [\#4324](https://github.com/pomerium/pomerium/pull/4324) (@dependabot[bot])
-- chore\(deps\): bump github.com/jackc/pgx/v5 from 5.4.1 to 5.4.2 [\#4409](https://github.com/pomerium/pomerium/pull/4409) (@dependabot[bot])
-- chore\(deps\): bump github.com/klauspost/compress from 1.16.0 to 1.16.5 [\#4177](https://github.com/pomerium/pomerium/pull/4177) (@dependabot[bot])
-- chore\(deps\): bump github.com/klauspost/compress from 1.16.5 to 1.16.6 [\#4281](https://github.com/pomerium/pomerium/pull/4281) (@dependabot[bot])
-- chore\(deps\): bump github.com/mholt/acmez from 1.1.0 to 1.1.1 [\#4184](https://github.com/pomerium/pomerium/pull/4184) (@dependabot[bot])
-- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.52 to 7.0.55 [\#4202](https://github.com/pomerium/pomerium/pull/4202) (@dependabot[bot])
-- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.55 to 7.0.56 [\#4243](https://github.com/pomerium/pomerium/pull/4243) (@dependabot[bot])
-- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.56 to 7.0.57 [\#4280](https://github.com/pomerium/pomerium/pull/4280) (@dependabot[bot])
-- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.57 to 7.0.59 [\#4333](https://github.com/pomerium/pomerium/pull/4333) (@dependabot[bot])
-- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.59 to 7.0.61 [\#4415](https://github.com/pomerium/pomerium/pull/4415) (@dependabot[bot])
-- chore\(deps\): bump github.com/open-policy-agent/opa from 0.51.0 to 0.52.0 [\#4142](https://github.com/pomerium/pomerium/pull/4142) (@dependabot[bot])
-- chore\(deps\): bump github.com/open-policy-agent/opa from 0.52.0 to 0.53.1 [\#4235](https://github.com/pomerium/pomerium/pull/4235) (@dependabot[bot])
-- chore\(deps\): bump github.com/open-policy-agent/opa from 0.54.0 to 0.55.0 [\#4404](https://github.com/pomerium/pomerium/pull/4404) (@dependabot[bot])
-- chore\(deps\): bump github.com/prometheus/procfs from 0.10.1 to 0.11.0 [\#4276](https://github.com/pomerium/pomerium/pull/4276) (@dependabot[bot])
-- chore\(deps\): bump github.com/prometheus/procfs from 0.11.0 to 0.11.1 [\#4400](https://github.com/pomerium/pomerium/pull/4400) (@dependabot[bot])
-- chore\(deps\): bump github.com/prometheus/client_golang from 1.15.0 to 1.15.1 [\#4157](https://github.com/pomerium/pomerium/pull/4157) (@dependabot[bot])
-- chore\(deps\): bump github.com/prometheus/client_golang from 1.15.1 to 1.16.0 [\#4268](https://github.com/pomerium/pomerium/pull/4268) (@dependabot[bot])
-- chore\(deps\): bump github.com/prometheus/client_model from 0.3.0 to 0.4.0 [\#4162](https://github.com/pomerium/pomerium/pull/4162) (@dependabot[bot])
-- chore\(deps\): bump github.com/prometheus/common from 0.42.0 to 0.43.0 [\#4172](https://github.com/pomerium/pomerium/pull/4172) (@dependabot[bot])
-- chore\(deps\): bump github.com/prometheus/common from 0.43.0 to 0.44.0 [\#4244](https://github.com/pomerium/pomerium/pull/4244) (@dependabot[bot])
-- chore\(deps\): bump github.com/peterbourgon/ff/v3 from 3.3.0 to 3.3.1 [\#4204](https://github.com/pomerium/pomerium/pull/4204) (@dependabot[bot])
-- chore\(deps\): bump github.com/peterbourgon/ff/v3 from 3.3.1 to 3.3.2 [\#4248](https://github.com/pomerium/pomerium/pull/4248) (@dependabot[bot])
-- chore\(deps\): bump github.com/peterbourgon/ff/v3 from 3.3.2 to 3.4.0 [\#4399](https://github.com/pomerium/pomerium/pull/4399) (@dependabot[bot])
-- chore\(deps\): bump github.com/rs/cors from 1.8.3 to 1.9.0 [\#4179](https://github.com/pomerium/pomerium/pull/4179) (@dependabot[bot])
-- chore\(deps\): bump github.com/rs/zerolog from 1.29.1 to 1.30.0 [\#4406](https://github.com/pomerium/pomerium/pull/4406) (@dependabot[bot])
-- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.23.3 to 3.23.4 [\#4165](https://github.com/pomerium/pomerium/pull/4165) (@dependabot[bot])
-- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.23.4 to 3.23.5 [\#4225](https://github.com/pomerium/pomerium/pull/4225) (@dependabot[bot])
-- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.23.5 to 3.23.6 [\#4328](https://github.com/pomerium/pomerium/pull/4328) (@dependabot[bot])
-- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.23.6 to 3.23.7 [\#4402](https://github.com/pomerium/pomerium/pull/4402) (@dependabot[bot])
-- chore\(deps\): bump github.com/spf13/viper from 1.15.0 to 1.16.0 [\#4296](https://github.com/pomerium/pomerium/pull/4296) (@dependabot[bot])
-- chore\(deps\): bump github.com/stretchr/testify from 1.8.2 to 1.8.3 [\#4200](https://github.com/pomerium/pomerium/pull/4200) (@dependabot[bot])
-- chore\(deps\): bump golangci/golangci-lint-action from 3.5.0 to 3.6.0 [\#4238](https://github.com/pomerium/pomerium/pull/4238) (@dependabot[bot])
-- chore\(deps\): bump golang from 1.20.3-buster to 1.20.4-buster [\#4161](https://github.com/pomerium/pomerium/pull/4161) (@dependabot[bot])
-- chore\(deps\): bump golang from 1.20.4-buster to 1.20.5-buster [\#4227](https://github.com/pomerium/pomerium/pull/4227) (@dependabot[bot])
-- chore\(deps\): bump golang from `b0f97bf` to `eb3f9ac` [\#4271](https://github.com/pomerium/pomerium/pull/4271) (@dependabot[bot])
-- chore\(deps\): bump golang from `4cf6dc4` to `6be6011` [\#4207](https://github.com/pomerium/pomerium/pull/4207) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.118.0 to 0.120.0 [\#4143](https://github.com/pomerium/pomerium/pull/4143) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.120.0 to 0.121.0 [\#4159](https://github.com/pomerium/pomerium/pull/4159) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.121.0 to 0.125.0 [\#4222](https://github.com/pomerium/pomerium/pull/4222) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.121.0 to 0.126.0 [\#4236](https://github.com/pomerium/pomerium/pull/4236) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.126.0 to 0.128.0 [\#4283](https://github.com/pomerium/pomerium/pull/4283) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.128.0 to 0.130.0 [\#4348](https://github.com/pomerium/pomerium/pull/4348) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.130.0 to 0.134.0 [\#4403](https://github.com/pomerium/pomerium/pull/4403) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/grpc from 1.54.0 to 1.55.0 [\#4166](https://github.com/pomerium/pomerium/pull/4166) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/grpc from 1.55.0 to 1.56.0 [\#4278](https://github.com/pomerium/pomerium/pull/4278) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/grpc from 1.56.1 to 1.57.0 [\#4411](https://github.com/pomerium/pomerium/pull/4411) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/protobuf from 1.30.0 to 1.31.0 [\#4325](https://github.com/pomerium/pomerium/pull/4325) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/crypto from 0.8.0 to 0.9.0 [\#4182](https://github.com/pomerium/pomerium/pull/4182) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/crypto from 0.9.0 to 0.10.0 [\#4266](https://github.com/pomerium/pomerium/pull/4266) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/net from 0.9.0 to 0.10.0 [\#4174](https://github.com/pomerium/pomerium/pull/4174) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/oauth2 from 0.7.0 to 0.8.0 [\#4178](https://github.com/pomerium/pomerium/pull/4178) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/oauth2 from 0.8.0 to 0.9.0 [\#4287](https://github.com/pomerium/pomerium/pull/4287) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/sync from 0.1.0 to 0.2.0 [\#4163](https://github.com/pomerium/pomerium/pull/4163) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/sync from 0.2.0 to 0.3.0 [\#4294](https://github.com/pomerium/pomerium/pull/4294) (@dependabot[bot])
-- chore\(deps\): bump google-github-actions/auth from 1.1.0 to 1.1.1 [\#4173](https://github.com/pomerium/pomerium/pull/4173) (@dependabot[bot])
-- chore\(deps\): bump google-github-actions/setup-gcloud from 1.1.0 to 1.1.1 [\#4175](https://github.com/pomerium/pomerium/pull/4175) (@dependabot[bot])
-- chore\(deps\): bump goreleaser/goreleaser-action from 4.2.0 to 4.3.0 [\#4240](https://github.com/pomerium/pomerium/pull/4240) (@dependabot[bot])
-- chore\(deps\): bump markdown-to-jsx from 7.1.7 to 7.2.1 in /ui [\#4297](https://github.com/pomerium/pomerium/pull/4297) (@dependabot[bot])
-- chore\(deps\): bump mikefarah/yq from 4.33.3 to 4.34.1 [\#4201](https://github.com/pomerium/pomerium/pull/4201) (@dependabot[bot])
-- chore\(deps\): bump mikefarah/yq from 4.34.1 to 4.34.2 [\#4431](https://github.com/pomerium/pomerium/pull/4431) (@dependabot[bot])
-- chore\(deps\): bump node from `3801c22` to `850d8e1` [\#4416](https://github.com/pomerium/pomerium/pull/4416) (@dependabot[bot])
-- chore\(deps\): bump node from `05824f7` to `3801c22` [\#4322](https://github.com/pomerium/pomerium/pull/4322) (@dependabot[bot])
-- chore\(deps\): bump node from `f658ece` to `05824f7` [\#4272](https://github.com/pomerium/pomerium/pull/4272) (@dependabot[bot])
-- chore\(deps\): bump node from `df5a66e` to `f658ece` [\#4252](https://github.com/pomerium/pomerium/pull/4252) (@dependabot[bot])
-- chore\(deps\): bump react-feather from 2.0.9 to 2.0.10 in /ui [\#4306](https://github.com/pomerium/pomerium/pull/4306) (@dependabot[bot])
-- chore\(deps\): bump semver from 6.3.0 to 6.3.1 in /ui [\#4350](https://github.com/pomerium/pomerium/pull/4350) (@dependabot[bot])
-- chore\(deps\): bump word-wrap from 1.2.3 to 1.2.4 in /ui [\#4369](https://github.com/pomerium/pomerium/pull/4369) (@dependabot[bot])
-- chore\(deps\): bump @emotion/styled from 11.6.0 to 11.11.0 in /ui [\#4277](https://github.com/pomerium/pomerium/pull/4277) (@dependabot[bot])
-- chore\(deps\): bump @fontsource/dm-sans from 4.5.1 to 5.0.3 in /ui [\#4307](https://github.com/pomerium/pomerium/pull/4307) (@dependabot[bot])
-- chore\(deps-dev\): bump typescript from 4.5.5 to 5.1.3 in /ui [\#4289](https://github.com/pomerium/pomerium/pull/4289) (@dependabot[bot])
-- chore\(deps-dev\): bump @typescript-eslint/parser from 5.10.2 to 5.59.11 in /ui [\#4282](https://github.com/pomerium/pomerium/pull/4282) (@dependabot[bot])
-- dependencies: pin node to lts [\#4218](https://github.com/pomerium/pomerium/pull/4218) (@wasaga)
-- dependencies: upgrade otel [\#4395](https://github.com/pomerium/pomerium/pull/4395) (@calebdoxsey)
-
-### Changed
-
-- add downstream mTLS integration test cases \(main\) [\#4234](https://github.com/pomerium/pomerium/pull/4234) (@kenjenkins)
-- add integration test for client_crl setting [\#4384](https://github.com/pomerium/pomerium/pull/4384) (@kenjenkins)
-- add integration test for https IP address route [\#4476](https://github.com/pomerium/pomerium/pull/4476) (@kenjenkins)
-- add integration test for Pomerium JWT [\#4472](https://github.com/pomerium/pomerium/pull/4472) (@kenjenkins)
-- add JWT timestamp formatting workaround [\#4270](https://github.com/pomerium/pomerium/pull/4270) (@kenjenkins)
-- authenticate: remove extraneous error log [\#4319](https://github.com/pomerium/pomerium/pull/4319) (@kenjenkins)
-- authorize: add support for logging id token [\#4392](https://github.com/pomerium/pomerium/pull/4392) (@calebdoxsey)
-- authorize: allow client certificate intermediates [\#4451](https://github.com/pomerium/pomerium/pull/4451) (@kenjenkins)
-- authorize: check CRLs only for leaf certificates [\#4480](https://github.com/pomerium/pomerium/pull/4480) (@kenjenkins)
-- authorize: do not redirect if invalid client cert [\#4344](https://github.com/pomerium/pomerium/pull/4344) (@kenjenkins)
-- authorize: do not rely on Envoy client cert validation [\#4438](https://github.com/pomerium/pomerium/pull/4438) (@kenjenkins)
-- authorize: fix policy numbers in evaluator test [\#4387](https://github.com/pomerium/pomerium/pull/4387) (@kenjenkins)
-- authorize: implement client certificate CRL check [\#4439](https://github.com/pomerium/pomerium/pull/4439) (@kenjenkins)
-- authorize: incorporate mTLS validation from Envoy [\#4374](https://github.com/pomerium/pomerium/pull/4374) (@kenjenkins)
-- authorize: remove a nolint directive [\#4375](https://github.com/pomerium/pomerium/pull/4375) (@kenjenkins)
-- authorize: remove incorrect "valid-client-certificate" reason [\#4470](https://github.com/pomerium/pomerium/pull/4470) (@kenjenkins)
-- authorize: remove JWT timestamp format workaround [\#4321](https://github.com/pomerium/pomerium/pull/4321) (@kenjenkins)
-- authorize: rework token substitution in headers [\#4456](https://github.com/pomerium/pomerium/pull/4456) (@kenjenkins)
-- autocert: use new OCSP error type [\#4437](https://github.com/pomerium/pomerium/pull/4437) (@kenjenkins)
-- chore: unnecessary use of fmt.Sprintf [\#4349](https://github.com/pomerium/pomerium/pull/4349) (@testwill)
-- ci: updates [\#4269](https://github.com/pomerium/pomerium/pull/4269) (@calebdoxsey)
-- config: add decode hook for the SANMatcher type [\#4464](https://github.com/pomerium/pomerium/pull/4464) (@kenjenkins)
-- config: deprecate tls_downstream_client_ca [\#4461](https://github.com/pomerium/pomerium/pull/4461) (@kenjenkins)
-- config: simplify default set response headers [\#4196](https://github.com/pomerium/pomerium/pull/4196) (@calebdoxsey)
-- config: support client certificate SAN match [\#4453](https://github.com/pomerium/pomerium/pull/4453) (@kenjenkins)
-- config: support arbitrary nested config structs [\#4440](https://github.com/pomerium/pomerium/pull/4440) (@kenjenkins)
-- config: validate cookie_secure option [\#4484](https://github.com/pomerium/pomerium/pull/4484) (@kenjenkins)
-- cryptutil: update CRL parsing [\#4454](https://github.com/pomerium/pomerium/pull/4454) (@kenjenkins)
-- dependabot: improvements [\#4261](https://github.com/pomerium/pomerium/pull/4261) (@calebdoxsey)
-- envoy: add a filter to store client cert info [\#4372](https://github.com/pomerium/pomerium/pull/4372) (@kenjenkins)
-- envoy: check for nil ssl\(\) in client cert script [\#4466](https://github.com/pomerium/pomerium/pull/4466) (@kenjenkins)
-- envoy: configure upstream IP SAN match as needed [\#4380](https://github.com/pomerium/pomerium/pull/4380) (@kenjenkins)
-- envoy: separate gRPC listener configuration [\#4365](https://github.com/pomerium/pomerium/pull/4365) (@kenjenkins)
-- fix lint warning in pkg/envoy [\#4181](https://github.com/pomerium/pomerium/pull/4181) (@kenjenkins)
-- improve certificate matching performance [\#4186](https://github.com/pomerium/pomerium/pull/4186) (@calebdoxsey)
-- logs: add ip address to access logs [\#4391](https://github.com/pomerium/pomerium/pull/4391) (@calebdoxsey)
-- organize go.mod [\#4320](https://github.com/pomerium/pomerium/pull/4320) (@kenjenkins)
-- pin to a debian:latest image for casource base image [\#4250](https://github.com/pomerium/pomerium/pull/4250) (@kenjenkins)
-- replace docker publish action ::set-output usage [\#4359](https://github.com/pomerium/pomerium/pull/4359) (@kenjenkins)
-- storage: add indexes for postgres [\#4479](https://github.com/pomerium/pomerium/pull/4479) (@calebdoxsey)
-- stub out HPKE public key fetch for self-hosted authenticate [\#4360](https://github.com/pomerium/pomerium/pull/4360) (@kenjenkins)
-- upgrade main [\#4457](https://github.com/pomerium/pomerium/pull/4457) (@wasaga)
-- Update README.md [\#4146](https://github.com/pomerium/pomerium/pull/4146) (@desimone)
-- Update SECURITY.md [\#4144](https://github.com/pomerium/pomerium/pull/4144) (@desimone)
-
-## [v0.22.3](https://github.com/pomerium/pomerium/tree/v0.22.3) (2023-08-21)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.22.2...v0.22.3)
-
-### Changed
-
-- add integration test for https IP address route [\#4477](https://github.com/pomerium/pomerium/pull/4477) (@kenjenkins)
-- add integration test for Pomerium JWT [\#4473](https://github.com/pomerium/pomerium/pull/4473) (@kenjenkins)
-- add JWT timestamp formatting workaround [\#4309](https://github.com/pomerium/pomerium/pull/4309) (@backport-actions-token[bot])
-- authorize: populate issuer even when policy is nil [\#4213](https://github.com/pomerium/pomerium/pull/4213) (@backport-actions-token[bot])
-- autocert: suppress OCSP stapling errors [\#4373](https://github.com/pomerium/pomerium/pull/4373) (@backport-actions-token[bot])
-- backport [\#4368](https://github.com/pomerium/pomerium/pull/4368) (@calebdoxsey)
-- ci: fix lint workflow \(\#4229\) [\#4311](https://github.com/pomerium/pomerium/pull/4311) (@kenjenkins)
-- config: update logic for checking overlapping certificates \(\#4216\) [\#4217](https://github.com/pomerium/pomerium/pull/4217) (@calebdoxsey)
-- config: simplify default set response headers [\#4212](https://github.com/pomerium/pomerium/pull/4212) (@backport-actions-token[bot])
-- envoy: configure upstream IP SAN match as needed [\#4382](https://github.com/pomerium/pomerium/pull/4382) (@backport-actions-token[bot])
-- github-actions: remove license check [\#4475](https://github.com/pomerium/pomerium/pull/4475) (@kenjenkins)
-- pin to a debian:latest image for casource base image \(\#4250\) [\#4310](https://github.com/pomerium/pomerium/pull/4310) (@kenjenkins)
-
-## [v0.22.2](https://github.com/pomerium/pomerium/tree/v0.22.2) (2023-05-26)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.22.1...v0.22.2)
-
-### Security
-
-- This release fixes a bug whereby specially crafted requests could result in incorrect authorization decisions made by Pomerium. [CVE-2023-33189](https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p).
-
-### Changed
-
-- databroker: sort configs by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4191
-- databroker: fix fast forward by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4194
-- envoy: set re2 limits very high by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4189
-- fix WillHaveCertificateForServerName check to be strict match for derived cert name by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4169
-- improve certificate matching performance by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4188
-
-## [v0.22.1](https://github.com/pomerium/pomerium/tree/v0.22.1) (2023-05-04)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.22.0...v0.22.1)
-
-### Changed
-
-- envoyconfig: disable validation context when no client certificates are required by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4152
-
-## [v0.22.0](https://github.com/pomerium/pomerium/tree/v0.22.0) (2023-05-01)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.21.3...v0.22.0)
-
-### Security
-
-- Pomerium upgraded to [Go v1.20.3](https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8/m/OV40vnafAwAJ) and [Envoy v1.24.5](https://groups.google.com/g/envoy-announce/c/o_W9gYVU2js/m/kU77ha6tBAAJ) to address security issues exposed in these packages. See the release notes in the links for more information.
-
-### Changed
-
-- add google cloud creds to ignore [\#3906](https://github.com/pomerium/pomerium/pull/3906) (@wasaga)
-- apple: fix userinfo [\#3974](https://github.com/pomerium/pomerium/pull/3974) (@calebdoxsey)
-- Appleid [\#3959](https://github.com/pomerium/pomerium/pull/3959) (@mnestor)
-- authenticate: add events [\#4051](https://github.com/pomerium/pomerium/pull/4051) (@wasaga)
-- authenticate: don't require a session for sign_out [\#4009](https://github.com/pomerium/pomerium/pull/4009) (@backport-actions-token[bot])
-- authenticate: fix callback handler for split mode [\#4008](https://github.com/pomerium/pomerium/pull/4008) (@wasaga)
-- chore\(deps\): bump actions/checkout from 3.4.0 to 3.5.0 [\#4078](https://github.com/pomerium/pomerium/pull/4078) (@dependabot[bot])
-- chore\(deps\): bump docker/setup-buildx-action from 2.2.1 to 2.4.0 [\#3924](https://github.com/pomerium/pomerium/pull/3924) (@dependabot[bot])
-- config: remove source, remove deadcode, fix linting issues [\#4118](https://github.com/pomerium/pomerium/pull/4118) (@calebdoxsey)
-- databroker: add list types method [\#3937](https://github.com/pomerium/pomerium/pull/3937) (@calebdoxsey)
-- envoy: optimize listener [\#3952](https://github.com/pomerium/pomerium/pull/3952) (@wasaga)
-- maybe fix flaky test [\#3929](https://github.com/pomerium/pomerium/pull/3929) (@calebdoxsey)
-- move hpke public key handler out of internal [\#4065](https://github.com/pomerium/pomerium/pull/4065) (@wasaga)
-- remove log message when no provider defined [\#3936](https://github.com/pomerium/pomerium/pull/3936) (@calebdoxsey)
-- Update SECURITY.md [\#4145](https://github.com/pomerium/pomerium/pull/4145) (@backport-actions-token[bot])
-- webauthn: only return known device credentials that match the given type [\#3981](https://github.com/pomerium/pomerium/pull/3981) (@calebdoxsey)
-
-### New
-
-- authenticate: fix authenticate_internal_service_url for all in one [\#4003](https://github.com/pomerium/pomerium/pull/4003) (@wasaga)
-- authenticate: have an option to trim the contents of the callback [\#4090](https://github.com/pomerium/pomerium/pull/4090) (@wasaga)
-- authenticate: only use csrf none for apple [\#3979](https://github.com/pomerium/pomerium/pull/3979) (@calebdoxsey)
-- config: default to authenticate.pomerium.app when authenticate url is not specified [\#4132](https://github.com/pomerium/pomerium/pull/4132) (@calebdoxsey)
-- cryptutil: generate certificates from deriveca [\#3992](https://github.com/pomerium/pomerium/pull/3992) (@calebdoxsey)
-- envoyconfig: preserve case of HTTP headers when using HTTP/1 [\#3956](https://github.com/pomerium/pomerium/pull/3956) (@calebdoxsey)
-- support loading route configuration via rds [\#4098](https://github.com/pomerium/pomerium/pull/4098) (@calebdoxsey)
-- urlutil: add version to query string [\#4028](https://github.com/pomerium/pomerium/pull/4028) (@calebdoxsey)
-
-### Fixed
-
-- authenticate: always trust the passed in idp [\#3917](https://github.com/pomerium/pomerium/pull/3917) (@calebdoxsey)
-- authenticate: don't require a session for sign_out [\#4007](https://github.com/pomerium/pomerium/pull/4007) (@calebdoxsey)
-- authenticate: fix identity provider id in encrypted query string [\#4006](https://github.com/pomerium/pomerium/pull/4006) (@calebdoxsey)
-- authenticate: save the session cookie with a different name [\#3978](https://github.com/pomerium/pomerium/pull/3978) (@calebdoxsey)
-- authorize: allow access to /.pomerium/webauthn when policy denies access [\#4015](https://github.com/pomerium/pomerium/pull/4015) (@calebdoxsey)
-- authorize: move sign out and jwks urls to route, update issuer for JWT [\#4046](https://github.com/pomerium/pomerium/pull/4046) (@calebdoxsey)
-- autocert: fix certmagic cache logging [\#4134](https://github.com/pomerium/pomerium/pull/4134) (@calebdoxsey)
-- config: fix set_response_headers [\#4026](https://github.com/pomerium/pomerium/pull/4026) (@calebdoxsey)
-- derivecert: fix ecdsa code to be deterministic [\#3989](https://github.com/pomerium/pomerium/pull/3989) (@calebdoxsey)
-- fix webauthn url [\#3983](https://github.com/pomerium/pomerium/pull/3983) (@calebdoxsey)
-- hpke: move published public keys to a new endpoint [\#4044](https://github.com/pomerium/pomerium/pull/4044) (@calebdoxsey)
-- identity: fix nil reference error when there is no authenticator [\#3930](https://github.com/pomerium/pomerium/pull/3930) (@calebdoxsey)
-- lua: fix rewrite response headers to handle dashes in URLs [\#3980](https://github.com/pomerium/pomerium/pull/3980) (@calebdoxsey)
-- store authenticate state on creation [\#4064](https://github.com/pomerium/pomerium/pull/4064) (@wasaga)
-- tls: wildcard catch-all cert must be at the end of cert list [\#4119](https://github.com/pomerium/pomerium/pull/4119) (@wasaga)
-
-### Dependency
-
-- chore\(deps\): bump actions/cache from 3.2.3 to 3.2.4 [\#3923](https://github.com/pomerium/pomerium/pull/3923) (@dependabot[bot])
-- chore\(deps\): bump actions/cache from 3.2.4 to 3.2.5 [\#3962](https://github.com/pomerium/pomerium/pull/3962) (@dependabot[bot])
-- chore\(deps\): bump actions/cache from 3.2.5 to 3.2.6 [\#4019](https://github.com/pomerium/pomerium/pull/4019) (@dependabot[bot])
-- chore\(deps\): bump actions/cache from 3.2.6 to 3.3.1 [\#4054](https://github.com/pomerium/pomerium/pull/4054) (@dependabot[bot])
-- chore\(deps\): bump actions/checkout from 3.3.0 to 3.4.0 [\#4068](https://github.com/pomerium/pomerium/pull/4068) (@dependabot[bot])
-- chore\(deps\): bump actions/checkout from 3.5.0 to 3.5.2 [\#4108](https://github.com/pomerium/pomerium/pull/4108) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-go from 3.5.0 to 4.0.0 [\#4067](https://github.com/pomerium/pomerium/pull/4067) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-python from 4.5.0 to 4.6.0 [\#4123](https://github.com/pomerium/pomerium/pull/4123) (@dependabot[bot])
-- chore\(deps\): bump actions/stale from 7.0.0 to 8.0.0 [\#4077](https://github.com/pomerium/pomerium/pull/4077) (@dependabot[bot])
-- chore\(deps\): bump cloud.google.com/go/storage from 1.28.1 to 1.29.0 [\#3912](https://github.com/pomerium/pomerium/pull/3912) (@dependabot[bot])
-- chore\(deps\): bump coverallsapp/github-action from 1.1.3 to 1.2.2 [\#4017](https://github.com/pomerium/pomerium/pull/4017) (@dependabot[bot])
-- chore\(deps\): bump coverallsapp/github-action from 1.2.2 to 1.2.4 [\#4041](https://github.com/pomerium/pomerium/pull/4041) (@dependabot[bot])
-- chore\(deps\): bump coverallsapp/github-action from 1.2.4 to 2.0.0 [\#4069](https://github.com/pomerium/pomerium/pull/4069) (@dependabot[bot])
-- chore\(deps\): bump coverallsapp/github-action from 2.0.0 to 2.1.0 [\#4100](https://github.com/pomerium/pomerium/pull/4100) (@dependabot[bot])
-- chore\(deps\): bump coverallsapp/github-action from 2.1.0 to 2.1.2 [\#4124](https://github.com/pomerium/pomerium/pull/4124) (@dependabot[bot])
-- chore\(deps\): bump debian from `12931ad` to `50cf570` [\#3950](https://github.com/pomerium/pomerium/pull/3950) (@dependabot[bot])
-- chore\(deps\): bump debian from `50cf570` to `7b16406` [\#3970](https://github.com/pomerium/pomerium/pull/3970) (@dependabot[bot])
-- chore\(deps\): bump debian from `7b16406` to `c1c4bb9` [\#4042](https://github.com/pomerium/pomerium/pull/4042) (@dependabot[bot])
-- chore\(deps\): bump debian from `c1c4bb9` to `d4bbca2` [\#4085](https://github.com/pomerium/pomerium/pull/4085) (@dependabot[bot])
-- chore\(deps\): bump debian from `d4bbca2` to `1fbdbcf` [\#4115](https://github.com/pomerium/pomerium/pull/4115) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `4f9fe94` to `9687cd3` [\#3968](https://github.com/pomerium/pomerium/pull/3968) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `5812871` to `357bc96` [\#4102](https://github.com/pomerium/pomerium/pull/4102) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `76b0529` to `4f9fe94` [\#3948](https://github.com/pomerium/pomerium/pull/3948) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `8e770ae` to `5812871` [\#4025](https://github.com/pomerium/pomerium/pull/4025) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `9687cd3` to `8e770ae` [\#3995](https://github.com/pomerium/pomerium/pull/3995) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `9eeffdc` to `76b0529` [\#3928](https://github.com/pomerium/pomerium/pull/3928) (@dependabot[bot])
-- chore\(deps\): bump docker/build-push-action from 3.3.0 to 4.0.0 [\#3942](https://github.com/pomerium/pomerium/pull/3942) (@dependabot[bot])
-- chore\(deps\): bump docker/metadata-action from 4.3.0 to 4.4.0 [\#4122](https://github.com/pomerium/pomerium/pull/4122) (@dependabot[bot])
-- chore\(deps\): bump docker/setup-buildx-action from 2.4.0 to 2.4.1 [\#3941](https://github.com/pomerium/pomerium/pull/3941) (@dependabot[bot])
-- chore\(deps\): bump docker/setup-buildx-action from 2.4.1 to 2.5.0 [\#4055](https://github.com/pomerium/pomerium/pull/4055) (@dependabot[bot])
-- chore\(deps\): bump fossa-contrib/fossa-action from 1.2.0 to 2.0.0 [\#3961](https://github.com/pomerium/pomerium/pull/3961) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2 from 1.17.3 to 1.17.4 [\#3946](https://github.com/pomerium/pomerium/pull/3946) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2 from 1.17.5 to 1.17.6 [\#4059](https://github.com/pomerium/pomerium/pull/4059) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.10 to 1.18.14 [\#4002](https://github.com/pomerium/pomerium/pull/4002) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.14 to 1.18.15 [\#4018](https://github.com/pomerium/pomerium/pull/4018) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.15 to 1.18.18 [\#4070](https://github.com/pomerium/pomerium/pull/4070) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.18 to 1.18.19 [\#4080](https://github.com/pomerium/pomerium/pull/4080) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.19 to 1.18.21 [\#4126](https://github.com/pomerium/pomerium/pull/4126) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.8 to 1.18.10 [\#3927](https://github.com/pomerium/pomerium/pull/3927) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.30.0 to 1.30.1 [\#3925](https://github.com/pomerium/pomerium/pull/3925) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.30.1 to 1.30.2 [\#3944](https://github.com/pomerium/pomerium/pull/3944) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.30.2 to 1.30.3 [\#3998](https://github.com/pomerium/pomerium/pull/3998) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.30.3 to 1.30.5 [\#4024](https://github.com/pomerium/pomerium/pull/4024) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.30.5 to 1.31.2 [\#4106](https://github.com/pomerium/pomerium/pull/4106) (@dependabot[bot])
-- chore\(deps\): bump github.com/cloudflare/circl from 1.3.1 to 1.3.2 [\#3947](https://github.com/pomerium/pomerium/pull/3947) (@dependabot[bot])
-- chore\(deps\): bump github.com/docker/docker from 20.10.22+incompatible to 20.10.23+incompatible [\#3911](https://github.com/pomerium/pomerium/pull/3911) (@dependabot[bot])
-- chore\(deps\): bump github.com/docker/docker from 20.10.23+incompatible to 23.0.1+incompatible [\#3967](https://github.com/pomerium/pomerium/pull/3967) (@dependabot[bot])
-- chore\(deps\): bump github.com/docker/docker from 23.0.1+incompatible to 23.0.3+incompatible [\#4101](https://github.com/pomerium/pomerium/pull/4101) (@dependabot[bot])
-- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.10.0 to 0.10.1 [\#4083](https://github.com/pomerium/pomerium/pull/4083) (@dependabot[bot])
-- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.9.1 to 0.10.0 [\#4074](https://github.com/pomerium/pomerium/pull/4074) (@dependabot[bot])
-- chore\(deps\): bump github.com/golangci/golangci-lint from 1.50.1 to 1.51.2 [\#4020](https://github.com/pomerium/pomerium/pull/4020) (@dependabot[bot])
-- chore\(deps\): bump github.com/google/go-jsonnet from 0.19.1 to 0.20.0 [\#4140](https://github.com/pomerium/pomerium/pull/4140) (@dependabot[bot])
-- chore\(deps\): bump github.com/hashicorp/golang-lru/v2 from 2.0.1 to 2.0.2 [\#4073](https://github.com/pomerium/pomerium/pull/4073) (@dependabot[bot])
-- chore\(deps\): bump github.com/jackc/pgx/v5 from 5.2.0 to 5.3.0 [\#3964](https://github.com/pomerium/pomerium/pull/3964) (@dependabot[bot])
-- chore\(deps\): bump github.com/jackc/pgx/v5 from 5.3.0 to 5.3.1 [\#4039](https://github.com/pomerium/pomerium/pull/4039) (@dependabot[bot])
-- chore\(deps\): bump github.com/mholt/acmez from 1.0.4 to 1.1.0 [\#4000](https://github.com/pomerium/pomerium/pull/4000) (@dependabot[bot])
-- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.47 to 7.0.50 [\#4081](https://github.com/pomerium/pomerium/pull/4081) (@dependabot[bot])
-- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.50 to 7.0.52 [\#4128](https://github.com/pomerium/pomerium/pull/4128) (@dependabot[bot])
-- chore\(deps\): bump github.com/natefinch/atomic from 0.0.0-20200526193002-18c0533a5b09 to 1.0.1 [\#4021](https://github.com/pomerium/pomerium/pull/4021) (@dependabot[bot])
-- chore\(deps\): bump github.com/open-policy-agent/opa from 0.48.0 to 0.49.2 [\#4023](https://github.com/pomerium/pomerium/pull/4023) (@dependabot[bot])
-- chore\(deps\): bump github.com/open-policy-agent/opa from 0.49.2 to 0.50.0 [\#4056](https://github.com/pomerium/pomerium/pull/4056) (@dependabot[bot])
-- chore\(deps\): bump github.com/open-policy-agent/opa from 0.49.2 to 0.51.0 [\#4130](https://github.com/pomerium/pomerium/pull/4130) (@dependabot[bot])
-- chore\(deps\): bump github.com/open-policy-agent/opa from 0.50.0 to 0.50.1 [\#4072](https://github.com/pomerium/pomerium/pull/4072) (@dependabot[bot])
-- chore\(deps\): bump github.com/open-policy-agent/opa from 0.50.1 to 0.51.0 [\#4093](https://github.com/pomerium/pomerium/pull/4093) (@dependabot[bot])
-- chore\(deps\): bump github.com/opencontainers/runc from 1.1.2 to 1.1.5 [\#4088](https://github.com/pomerium/pomerium/pull/4088) (@dependabot[bot])
-- chore\(deps\): bump github.com/ory/dockertest/v3 from 3.9.1 to 3.10.0 [\#4111](https://github.com/pomerium/pomerium/pull/4111) (@dependabot[bot])
-- chore\(deps\): bump github.com/prometheus/client_golang from 1.14.0 to 1.15.0 [\#4110](https://github.com/pomerium/pomerium/pull/4110) (@dependabot[bot])
-- chore\(deps\): bump github.com/prometheus/common from 0.39.0 to 0.41.0 [\#4035](https://github.com/pomerium/pomerium/pull/4035) (@dependabot[bot])
-- chore\(deps\): bump github.com/rs/zerolog from 1.28.0 to 1.29.0 [\#3920](https://github.com/pomerium/pomerium/pull/3920) (@dependabot[bot])
-- chore\(deps\): bump github.com/rs/zerolog from 1.29.0 to 1.29.1 [\#4127](https://github.com/pomerium/pomerium/pull/4127) (@dependabot[bot])
-- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.23.1 to 3.23.2 [\#4037](https://github.com/pomerium/pomerium/pull/4037) (@dependabot[bot])
-- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.23.2 to 3.23.3 [\#4129](https://github.com/pomerium/pomerium/pull/4129) (@dependabot[bot])
-- chore\(deps\): bump github.com/spf13/viper from 1.14.0 to 1.15.0 [\#3910](https://github.com/pomerium/pomerium/pull/3910) (@dependabot[bot])
-- chore\(deps\): bump github.com/VictoriaMetrics/fastcache from 1.12.0 to 1.12.1 [\#4057](https://github.com/pomerium/pomerium/pull/4057) (@dependabot[bot])
-- chore\(deps\): bump github.com/yuin/gopher-lua from 0.0.0-20200816102855-ee81675732da to 1.1.0 [\#4022](https://github.com/pomerium/pomerium/pull/4022) (@dependabot[bot])
-- chore\(deps\): bump golang from `413cd9e` to `73c225b` [\#4114](https://github.com/pomerium/pomerium/pull/4114) (@dependabot[bot])
-- chore\(deps\): bump golang from `4447a7f` to `f8fbd74` [\#3969](https://github.com/pomerium/pomerium/pull/3969) (@dependabot[bot])
-- chore\(deps\): bump golang from `57dbdd5` to `97c3e1d` [\#4084](https://github.com/pomerium/pomerium/pull/4084) (@dependabot[bot])
-- chore\(deps\): bump golang from `d99d361` to `9628a1a` [\#4043](https://github.com/pomerium/pomerium/pull/4043) (@dependabot[bot])
-- chore\(deps\): bump golang from 1.19.5-buster to 1.20.0-buster [\#3949](https://github.com/pomerium/pomerium/pull/3949) (@dependabot[bot])
-- chore\(deps\): bump golang from 1.20.0-buster to 1.20.1-buster [\#3997](https://github.com/pomerium/pomerium/pull/3997) (@dependabot[bot])
-- chore\(deps\): bump golang from 1.20.1-buster to 1.20.2-buster [\#4060](https://github.com/pomerium/pomerium/pull/4060) (@dependabot[bot])
-- chore\(deps\): bump golang from 1.20.2-buster to 1.20.3-buster [\#4103](https://github.com/pomerium/pomerium/pull/4103) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/crypto from 0.6.0 to 0.7.0 [\#4038](https://github.com/pomerium/pomerium/pull/4038) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/crypto from 0.7.0 to 0.8.0 [\#4105](https://github.com/pomerium/pomerium/pull/4105) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/net from 0.6.0 to 0.7.0 [\#3993](https://github.com/pomerium/pomerium/pull/3993) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/oauth2 from 0.4.0 to 0.5.0 [\#3963](https://github.com/pomerium/pomerium/pull/3963) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/oauth2 from 0.5.0 to 0.6.0 [\#4036](https://github.com/pomerium/pomerium/pull/4036) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/oauth2 from 0.6.0 to 0.7.0 [\#4113](https://github.com/pomerium/pomerium/pull/4113) (@dependabot[bot])
-- chore\(deps\): bump google-github-actions/auth from 1.0.0 to 1.1.0 [\#4121](https://github.com/pomerium/pomerium/pull/4121) (@dependabot[bot])
-- chore\(deps\): bump google-github-actions/setup-gcloud from 1.0.1 to 1.1.0 [\#3943](https://github.com/pomerium/pomerium/pull/3943) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.107.0 to 0.108.0 [\#3913](https://github.com/pomerium/pomerium/pull/3913) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.108.0 to 0.109.0 [\#3940](https://github.com/pomerium/pomerium/pull/3940) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.109.0 to 0.110.0 [\#3999](https://github.com/pomerium/pomerium/pull/3999) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.112.0 to 0.114.0 [\#4096](https://github.com/pomerium/pomerium/pull/4096) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.114.0 to 0.116.0 [\#4104](https://github.com/pomerium/pomerium/pull/4104) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.116.0 to 0.118.0 [\#4112](https://github.com/pomerium/pomerium/pull/4112) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/grpc from 1.52.0 to 1.52.3 [\#3926](https://github.com/pomerium/pomerium/pull/3926) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/grpc from 1.52.3 to 1.53.0 [\#3965](https://github.com/pomerium/pomerium/pull/3965) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/grpc from 1.53.0 to 1.54.0 [\#4082](https://github.com/pomerium/pomerium/pull/4082) (@dependabot[bot])
-- chore\(deps\): bump goreleaser/goreleaser-action from 4.1.1 to 4.2.0 [\#3921](https://github.com/pomerium/pomerium/pull/3921) (@dependabot[bot])
-- chore\(deps\): bump mikefarah/yq from 4.30.8 to 4.31.1 [\#3994](https://github.com/pomerium/pomerium/pull/3994) (@dependabot[bot])
-- chore\(deps\): bump mikefarah/yq from 4.31.1 to 4.31.2 [\#4040](https://github.com/pomerium/pomerium/pull/4040) (@dependabot[bot])
-- chore\(deps\): bump mikefarah/yq from 4.31.2 to 4.32.2 [\#4066](https://github.com/pomerium/pomerium/pull/4066) (@dependabot[bot])
-- chore\(deps\): bump mikefarah/yq from 4.32.2 to 4.33.1 [\#4079](https://github.com/pomerium/pomerium/pull/4079) (@dependabot[bot])
-- chore\(deps\): bump mikefarah/yq from 4.33.1 to 4.33.3 [\#4109](https://github.com/pomerium/pomerium/pull/4109) (@dependabot[bot])
-- chore\(deps\): bump tibdex/github-app-token from 1.7.0 to 1.8.0 [\#3922](https://github.com/pomerium/pomerium/pull/3922) (@dependabot[bot])
-- dependencies: upgrade go and envoy [\#4116](https://github.com/pomerium/pomerium/pull/4116) (@calebdoxsey)
-
-## [v0.21.4](https://github.com/pomerium/pomerium/tree/v0.21.4) (2023-05-26)
-
-### Security
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.21.3...v0.21.4)
-
-- This release fixes a bug whereby specially crafted requests could result in incorrect authorization decisions made by Pomerium. [CVE-2023-33189](https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p).
-
-### Changed
-
-- authorize: fix IsInternal check by @calebdoxsey in https://github.com/pomerium/pomerium/pull/4199
-- autocert: fix certmagic cache logging by @backport-actions-token in https://github.com/pomerium/pomerium/pull/4135
-
-## [v0.21.3](https://github.com/pomerium/pomerium/tree/v0.21.3) (2023-03-23)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.21.2...v0.21.3)
-
-### Changed
-
-- authorize: move sign out and jwks urls to route, update issuer for JWT [\#4049](https://github.com/pomerium/pomerium/pull/4049) (@backport-actions-token[bot])
-- ci: build version branch images [\#4062](https://github.com/pomerium/pomerium/pull/4062) (@backport-actions-token[bot])
-- hpke: move published public keys to a new endpoint [\#4048](https://github.com/pomerium/pomerium/pull/4048) (@backport-actions-token[bot])
-
-## [v0.21.2](https://github.com/pomerium/pomerium/tree/v0.21.2) (2023-02-23)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.21.1...v0.21.2)
-
-### Changed
-
-- authenticate: fix identity provider id in encrypted query string [\#4011](https://github.com/pomerium/pomerium/pull/4011) (@backport-actions-token[bot])
-- authenticate: fix callback handler for split mode [\#4010](https://github.com/pomerium/pomerium/pull/4010) (@backport-actions-token[bot])
-- authenticate: don't require a session for sign_out [\#4009](https://github.com/pomerium/pomerium/pull/4009) (@backport-actions-token[bot])
-- authenticate: fix authenticate_internal_service_url for all in one [\#4005](https://github.com/pomerium/pomerium/pull/4005) (@backport-actions-token[bot])
-- derivecert: fix ecdsa code to be deterministic [\#3991](https://github.com/pomerium/pomerium/pull/3991) (@backport-actions-token[bot])
-- fix webauthn url [\#3988](https://github.com/pomerium/pomerium/pull/3988) (@backport-actions-token[bot])
-- webauthn: only return known device credentials that match the given type [\#3987](https://github.com/pomerium/pomerium/pull/3987) (@backport-actions-token[bot])
-
-## [v0.21.1](https://github.com/pomerium/pomerium/releases/tag/v0.21.1) (2023-02-16)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.21.0...v0.21.1)
-
-### Changed
-
-- authenticate: save the session cookie with a different name by @calebdoxsey in https://github.com/pomerium/pomerium/pull/3984
-- lua: fix rewrite response headers to handle dashes in URLs by @calebdoxsey in https://github.com/pomerium/pomerium/pull/3986
-
-## [v0.21.0](https://github.com/pomerium/pomerium/tree/v0.21.0) (2023-02-09)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.21.0-rc2...v0.21.0)
-
-### Changed
-
-- add google cloud creds to ignore [\#3907](https://github.com/pomerium/pomerium/pull/3907) (@backport-actions-token[bot])
-- authenticate: always trust the passed in idp [\#3931](https://github.com/pomerium/pomerium/pull/3931) (@backport-actions-token[bot])
-- controlplane: remove gorilla handlers dependency [\#3813](https://github.com/pomerium/pomerium/pull/3813) (@calebdoxsey)
-- docker: switch to debian [\#3939](https://github.com/pomerium/pomerium/pull/3939) (@backport-actions-token[bot])
-- envoyconfig: clean up filter chain construction [\#3844](https://github.com/pomerium/pomerium/pull/3844) (@calebdoxsey)
-- events: remove xds configuraton update [\#3792](https://github.com/pomerium/pomerium/pull/3792) (@wasaga)
-- identity: fix nil reference error when there is no authenticator [\#3933](https://github.com/pomerium/pomerium/pull/3933) (@backport-actions-token[bot])
-- tls_derive: rename for consistency [\#3905](https://github.com/pomerium/pomerium/pull/3905) (@wasaga)
-- use tlsClientConfig instead of custom dialer [\#3830](https://github.com/pomerium/pomerium/pull/3830) (@wasaga)
-
-### Breaking
-
-- proxy: add userinfo and webauthn endpoints [\#3755](https://github.com/pomerium/pomerium/pull/3755) (@calebdoxsey)
-- remove forward auth [\#3628](https://github.com/pomerium/pomerium/pull/3628) (@calebdoxsey)
-
-### New
-
-- authenticate: add additional error details for hmac errors [\#3878](https://github.com/pomerium/pomerium/pull/3878) (@calebdoxsey)
-- authenticate: implement hpke-based login flow [\#3779](https://github.com/pomerium/pomerium/pull/3779) (@calebdoxsey)
-- authorize: log check\(\) error [\#3846](https://github.com/pomerium/pomerium/pull/3846) (@wasaga)
-- auto tls [\#3856](https://github.com/pomerium/pomerium/pull/3856) (@wasaga)
-- config: add option for tls renegotiation [\#3773](https://github.com/pomerium/pomerium/pull/3773) (@calebdoxsey)
-- config: add support for extended TCP route URLs [\#3845](https://github.com/pomerium/pomerium/pull/3845) (@calebdoxsey)
-- derive CA from pre-shared key [\#3815](https://github.com/pomerium/pomerium/pull/3815) (@wasaga)
-- explicitly list gRPC services accessible via the gRPC listener [\#3879](https://github.com/pomerium/pomerium/pull/3879) (@wasaga)
-- hpke: add HPKE key to JWKS endpoint [\#3762](https://github.com/pomerium/pomerium/pull/3762) (@calebdoxsey)
-- hpke: add hpke package [\#3761](https://github.com/pomerium/pomerium/pull/3761) (@calebdoxsey)
-- httputil: add cookie chunker [\#3775](https://github.com/pomerium/pomerium/pull/3775) (@calebdoxsey)
-- httputil: ignore errors \< 400 [\#3781](https://github.com/pomerium/pomerium/pull/3781) (@calebdoxsey)
-- identity: add identity profile [\#3777](https://github.com/pomerium/pomerium/pull/3777) (@calebdoxsey)
-- mTLS: allow gRPC TLS for all in one [\#3854](https://github.com/pomerium/pomerium/pull/3854) (@wasaga)
-- scripts: update get-envoy script to download all binaries [\#3886](https://github.com/pomerium/pomerium/pull/3886) (@calebdoxsey)
-- urlutil: add time validation functions [\#3776](https://github.com/pomerium/pomerium/pull/3776) (@calebdoxsey)
-
-### Fixed
-
-- autocert: use atomic pointer to allow nil [\#3816](https://github.com/pomerium/pomerium/pull/3816) (@calebdoxsey)
-- config: add missing options [\#3882](https://github.com/pomerium/pomerium/pull/3882) (@calebdoxsey)
-- config: generate derived certificates instead of self-signed certificates [\#3860](https://github.com/pomerium/pomerium/pull/3860) (@calebdoxsey)
-- config: use insecure skip verify if derived certificates are not used [\#3861](https://github.com/pomerium/pomerium/pull/3861) (@calebdoxsey)
-- dashboard: fix missing avatar and logout menu [\#3819](https://github.com/pomerium/pomerium/pull/3819) (@calebdoxsey)
-- identity: fix expired session deletion [\#3855](https://github.com/pomerium/pomerium/pull/3855) (@calebdoxsey)
-- jwt: require logged in user to return .pomerium/jwt [\#3807](https://github.com/pomerium/pomerium/pull/3807) (@calebdoxsey)
-- oidc: fix token revocation [\#3810](https://github.com/pomerium/pomerium/pull/3810) (@calebdoxsey)
-- postgres: return unknown records instead of skipping them [\#3876](https://github.com/pomerium/pomerium/pull/3876) (@calebdoxsey)
-- proxy: fix sign out redirect [\#3827](https://github.com/pomerium/pomerium/pull/3827) (@calebdoxsey)
-- storage: ignore removed fields when deserializing the data [\#3768](https://github.com/pomerium/pomerium/pull/3768) (@wasaga)
-- webauthn: require session when accessing /.pomerium/webauthn [\#3814](https://github.com/pomerium/pomerium/pull/3814) (@calebdoxsey)
-
-### Dependency
-
-- bump goreleaser to v4.1.1 [\#3919](https://github.com/pomerium/pomerium/pull/3919) (@backport-actions-token[bot])
-- chore\(deps\): bump actions/cache from 3.0.11 to 3.2.2 [\#3851](https://github.com/pomerium/pomerium/pull/3851) (@dependabot[bot])
-- chore\(deps\): bump actions/cache from 3.2.2 to 3.2.3 [\#3870](https://github.com/pomerium/pomerium/pull/3870) (@dependabot[bot])
-- chore\(deps\): bump actions/checkout from 3.1.0 to 3.2.0 [\#3833](https://github.com/pomerium/pomerium/pull/3833) (@dependabot[bot])
-- chore\(deps\): bump actions/checkout from 3.2.0 to 3.3.0 [\#3867](https://github.com/pomerium/pomerium/pull/3867) (@dependabot[bot])
-- chore\(deps\): bump actions/download-artifact from 3.0.1 to 3.0.2 [\#3872](https://github.com/pomerium/pomerium/pull/3872) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-go from 3.3.1 to 3.4.0 [\#3788](https://github.com/pomerium/pomerium/pull/3788) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-go from 3.4.0 to 3.5.0 [\#3836](https://github.com/pomerium/pomerium/pull/3836) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-node from 3.5.1 to 3.6.0 [\#3869](https://github.com/pomerium/pomerium/pull/3869) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-python from 4.3.0 to 4.3.1 [\#3800](https://github.com/pomerium/pomerium/pull/3800) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-python from 4.3.1 to 4.4.0 [\#3834](https://github.com/pomerium/pomerium/pull/3834) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-python from 4.4.0 to 4.5.0 [\#3896](https://github.com/pomerium/pomerium/pull/3896) (@dependabot[bot])
-- chore\(deps\): bump actions/stale from 5.1.1 to 6.0.1 [\#3790](https://github.com/pomerium/pomerium/pull/3790) (@dependabot[bot])
-- chore\(deps\): bump actions/stale from 6.0.1 to 7.0.0 [\#3852](https://github.com/pomerium/pomerium/pull/3852) (@dependabot[bot])
-- chore\(deps\): bump actions/upload-artifact from 3.1.1 to 3.1.2 [\#3871](https://github.com/pomerium/pomerium/pull/3871) (@dependabot[bot])
-- chore\(deps\): bump alpine from `8914eb5` to `f271e74` [\#3901](https://github.com/pomerium/pomerium/pull/3901) (@dependabot[bot])
-- chore\(deps\): bump alpine from `b95359c` to `8914eb5` [\#3802](https://github.com/pomerium/pomerium/pull/3802) (@dependabot[bot])
-- chore\(deps\): bump alpine from `bc41182` to `b95359c` [\#3751](https://github.com/pomerium/pomerium/pull/3751) (@dependabot[bot])
-- chore\(deps\): bump azure/docker-login from 81744f9799e7eaa418697cb168452a2882ae844a to 1.0.1 [\#3770](https://github.com/pomerium/pomerium/pull/3770) (@dependabot[bot])
-- chore\(deps\): bump debian from `7ca0fec` to `12931ad` [\#3904](https://github.com/pomerium/pomerium/pull/3904) (@dependabot[bot])
-- chore\(deps\): bump debian from `880aa5f` to `7ca0fec` [\#3841](https://github.com/pomerium/pomerium/pull/3841) (@dependabot[bot])
-- chore\(deps\): bump debian from `9583740` to `880aa5f` [\#3803](https://github.com/pomerium/pomerium/pull/3803) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `8848703` to `8ee3d86` [\#3874](https://github.com/pomerium/pomerium/pull/3874) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `8ee3d86` to `9eeffdc` [\#3903](https://github.com/pomerium/pomerium/pull/3903) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `9283685` to `8848703` [\#3842](https://github.com/pomerium/pomerium/pull/3842) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `cd1bf87` to `9283685` [\#3804](https://github.com/pomerium/pomerium/pull/3804) (@dependabot[bot])
-- chore\(deps\): bump docker/build-push-action from 3.2.0 to 3.3.0 [\#3894](https://github.com/pomerium/pomerium/pull/3894) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.4 to 1.18.5 [\#3825](https://github.com/pomerium/pomerium/pull/3825) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.5 to 1.18.7 [\#3838](https://github.com/pomerium/pomerium/pull/3838) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/config from 1.18.7 to 1.18.8 [\#3900](https://github.com/pomerium/pomerium/pull/3900) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.29.5 to 1.29.6 [\#3847](https://github.com/pomerium/pomerium/pull/3847) (@dependabot[bot])
-- chore\(deps\): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.29.6 to 1.30.0 [\#3866](https://github.com/pomerium/pomerium/pull/3866) (@dependabot[bot])
-- chore\(deps\): bump github.com/cenkalti/backoff/v4 from 4.1.3 to 4.2.0 [\#3756](https://github.com/pomerium/pomerium/pull/3756) (@dependabot[bot])
-- chore\(deps\): bump github.com/cespare/xxhash/v2 from 2.1.2 to 2.2.0 [\#3786](https://github.com/pomerium/pomerium/pull/3786) (@dependabot[bot])
-- chore\(deps\): bump github.com/cloudflare/circl from 1.3.0 to 1.3.1 [\#3831](https://github.com/pomerium/pomerium/pull/3831) (@dependabot[bot])
-- chore\(deps\): bump github.com/coreos/go-oidc/v3 from 3.4.0 to 3.5.0 [\#3868](https://github.com/pomerium/pomerium/pull/3868) (@dependabot[bot])
-- chore\(deps\): bump github.com/docker/docker from 20.10.21+incompatible to 20.10.22+incompatible [\#3839](https://github.com/pomerium/pomerium/pull/3839) (@dependabot[bot])
-- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.8.0 to 0.9.0 [\#3744](https://github.com/pomerium/pomerium/pull/3744) (@dependabot[bot])
-- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.9.0 to 0.9.1 [\#3798](https://github.com/pomerium/pomerium/pull/3798) (@dependabot[bot])
-- chore\(deps\): bump github.com/go-chi/chi/v5 from 5.0.7 to 5.0.8 [\#3795](https://github.com/pomerium/pomerium/pull/3795) (@dependabot[bot])
-- chore\(deps\): bump github.com/jackc/pgtype from 1.12.0 to 1.13.0 [\#3784](https://github.com/pomerium/pomerium/pull/3784) (@dependabot[bot])
-- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.39 to 7.0.45 [\#3796](https://github.com/pomerium/pomerium/pull/3796) (@dependabot[bot])
-- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.45 to 7.0.46 [\#3864](https://github.com/pomerium/pomerium/pull/3864) (@dependabot[bot])
-- chore\(deps\): bump github.com/minio/minio-go/v7 from 7.0.46 to 7.0.47 [\#3899](https://github.com/pomerium/pomerium/pull/3899) (@dependabot[bot])
-- chore\(deps\): bump github.com/open-policy-agent/opa from 0.46.1 to 0.47.0 [\#3782](https://github.com/pomerium/pomerium/pull/3782) (@dependabot[bot])
-- chore\(deps\): bump github.com/open-policy-agent/opa from 0.47.0 to 0.47.3 [\#3824](https://github.com/pomerium/pomerium/pull/3824) (@dependabot[bot])
-- chore\(deps\): bump github.com/open-policy-agent/opa from 0.47.3 to 0.47.4 [\#3832](https://github.com/pomerium/pomerium/pull/3832) (@dependabot[bot])
-- chore\(deps\): bump github.com/open-policy-agent/opa from 0.47.4 to 0.48.0 [\#3898](https://github.com/pomerium/pomerium/pull/3898) (@dependabot[bot])
-- chore\(deps\): bump github.com/prometheus/client_golang from 1.13.1 to 1.14.0 [\#3745](https://github.com/pomerium/pomerium/pull/3745) (@dependabot[bot])
-- chore\(deps\): bump github.com/prometheus/common from 0.37.0 to 0.39.0 [\#3823](https://github.com/pomerium/pomerium/pull/3823) (@dependabot[bot])
-- chore\(deps\): bump github.com/prometheus/procfs from 0.8.0 to 0.9.0 [\#3850](https://github.com/pomerium/pomerium/pull/3850) (@dependabot[bot])
-- chore\(deps\): bump github.com/rs/cors from 1.8.2 to 1.8.3 [\#3848](https://github.com/pomerium/pomerium/pull/3848) (@dependabot[bot])
-- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.22.10 to 3.22.11 [\#3783](https://github.com/pomerium/pomerium/pull/3783) (@dependabot[bot])
-- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.22.11 to 3.22.12 [\#3849](https://github.com/pomerium/pomerium/pull/3849) (@dependabot[bot])
-- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.22.9 to 3.22.10 [\#3747](https://github.com/pomerium/pomerium/pull/3747) (@dependabot[bot])
-- chore\(deps\): bump go.uber.org/zap from 1.23.0 to 1.24.0 [\#3785](https://github.com/pomerium/pomerium/pull/3785) (@dependabot[bot])
-- chore\(deps\): bump golang from `e464bb0` to `7c97bae` [\#3843](https://github.com/pomerium/pomerium/pull/3843) (@dependabot[bot])
-- chore\(deps\): bump golang from 1.19.3-buster to 1.19.4-buster [\#3801](https://github.com/pomerium/pomerium/pull/3801) (@dependabot[bot])
-- chore\(deps\): bump golang from 1.19.4-buster to 1.19.5-buster [\#3902](https://github.com/pomerium/pomerium/pull/3902) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/crypto from 0.1.0 to 0.2.0 [\#3746](https://github.com/pomerium/pomerium/pull/3746) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/crypto from 0.2.0 to 0.3.0 [\#3757](https://github.com/pomerium/pomerium/pull/3757) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/crypto from 0.3.0 to 0.4.0 [\#3822](https://github.com/pomerium/pomerium/pull/3822) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/crypto from 0.4.0 to 0.5.0 [\#3873](https://github.com/pomerium/pomerium/pull/3873) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/net from 0.1.0 to 0.2.0 [\#3748](https://github.com/pomerium/pomerium/pull/3748) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/net from 0.2.0 to 0.4.0 [\#3799](https://github.com/pomerium/pomerium/pull/3799) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/net from 0.4.0 to 0.5.0 [\#3863](https://github.com/pomerium/pomerium/pull/3863) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/oauth2 from 0.3.0 to 0.4.0 [\#3865](https://github.com/pomerium/pomerium/pull/3865) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.102.0 to 0.103.0 [\#3758](https://github.com/pomerium/pomerium/pull/3758) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.103.0 to 0.104.0 [\#3797](https://github.com/pomerium/pomerium/pull/3797) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.104.0 to 0.105.0 [\#3840](https://github.com/pomerium/pomerium/pull/3840) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.105.0 to 0.107.0 [\#3897](https://github.com/pomerium/pomerium/pull/3897) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/grpc from 1.50.1 to 1.51.0 [\#3759](https://github.com/pomerium/pomerium/pull/3759) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/grpc from 1.51.0 to 1.52.0 [\#3893](https://github.com/pomerium/pomerium/pull/3893) (@dependabot[bot])
-- chore\(deps\): bump json5 from 2.2.0 to 2.2.3 in /ui [\#3853](https://github.com/pomerium/pomerium/pull/3853) (@dependabot[bot])
-- chore\(deps\): bump luxon from 2.3.0 to 2.5.2 in /ui [\#3862](https://github.com/pomerium/pomerium/pull/3862) (@dependabot[bot])
-- chore\(deps\): bump mikefarah/yq from 4.29.2 to 4.30.2 [\#3749](https://github.com/pomerium/pomerium/pull/3749) (@dependabot[bot])
-- chore\(deps\): bump mikefarah/yq from 4.30.2 to 4.30.5 [\#3787](https://github.com/pomerium/pomerium/pull/3787) (@dependabot[bot])
-- chore\(deps\): bump mikefarah/yq from 4.30.5 to 4.30.6 [\#3837](https://github.com/pomerium/pomerium/pull/3837) (@dependabot[bot])
-- chore\(deps\): bump mikefarah/yq from 4.30.6 to 4.30.8 [\#3895](https://github.com/pomerium/pomerium/pull/3895) (@dependabot[bot])
-- chore\(deps\): bump minimatch from 3.0.4 to 3.1.2 in /ui [\#3760](https://github.com/pomerium/pomerium/pull/3760) (@dependabot[bot])
-- chore\(deps\): bump stefanzweifel/git-auto-commit-action from 4.15.4 to 4.16.0 [\#3791](https://github.com/pomerium/pomerium/pull/3791) (@dependabot[bot])
-- chore\(deps\): bump tibdex/github-app-token from 1.6.0 to 1.7.0 [\#3789](https://github.com/pomerium/pomerium/pull/3789) (@dependabot[bot])
-- postgres: upgrade to pgx v5 [\#3826](https://github.com/pomerium/pomerium/pull/3826) (@calebdoxsey)
-- upgrade to golang-lru v2 [\#3771](https://github.com/pomerium/pomerium/pull/3771) (@calebdoxsey)
-
-## [v0.20.1](https://github.com/pomerium/pomerium/tree/v0.20.1) (2023-05-26)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.20.0...v0.20.1)
-
-### Security
-
-- This release fixes a bug whereby specially crafted requests could result in incorrect authorization decisions made by Pomerium. [CVE-2023-33189](https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p).
-
-### Changed
-
-- autocert: use atomic pointer to allow nil by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3817
-- identity: fix expired session deletion by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3857
-- identity: fix nil reference error when there is no authenticator by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3932
-- jwt: require logged in user to return .pomerium/jwt by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3809
-- oidc: fix token revocation by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3818
-- postgres: return unknown records instead of skipping them (#3876) by @calebdoxsey in https://github.com/pomerium/pomerium/pull/3877
-- storage: ignore removed fields when deserializing the data by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3772
-
-## [v0.20.0](https://github.com/pomerium/pomerium/tree/v0.20.0) (2022-11-14)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.19.1...v0.20.0)
-
-### Breaking
-
-- envoyconfig: add all routes to all filter chains [\#3596](https://github.com/pomerium/pomerium/pull/3596) (@calebdoxsey)
-- groups via directory sync are no longer supported [\#3633](https://github.com/pomerium/pomerium/pull/3633) (@calebdoxsey)
-
-### Security
-
-- httputil: remove error details [\#3703](https://github.com/pomerium/pomerium/pull/3703) (@calebdoxsey)
-
-### New
-
-- authorize: fix user caching [\#3734](https://github.com/pomerium/pomerium/pull/3734) (@calebdoxsey)
-- authorize: performance improvements [\#3723](https://github.com/pomerium/pomerium/pull/3723) (@calebdoxsey)
-- config: disable Strict-Transport-Security when using a self-signed certificate [\#3743](https://github.com/pomerium/pomerium/pull/3743) (@calebdoxsey)
-- config: generate cookie secret if not set in all-in-one mode [\#3742](https://github.com/pomerium/pomerium/pull/3742) (@calebdoxsey)
-- config: default to http2 [\#3660](https://github.com/pomerium/pomerium/pull/3660) (@calebdoxsey)
-- controlplane: move jwks.json endpoint to control plane [\#3691](https://github.com/pomerium/pomerium/pull/3691) (@calebdoxsey)
-- postgres: increase record batch size [\#3708](https://github.com/pomerium/pomerium/pull/3708) (@calebdoxsey)
-- sessions: check idp id to detect provider changes to force session invalidation [\#3707](https://github.com/pomerium/pomerium/pull/3707) (@calebdoxsey)
-
-### Fixed
-
-- authenticate: get/set identity provider id for all sessions [\#3597](https://github.com/pomerium/pomerium/pull/3597) (@calebdoxsey)
-- authorize: enforce service account expiration [\#3661](https://github.com/pomerium/pomerium/pull/3661) (@calebdoxsey)
-- config: allow blank identity providers when loading sessions for service account support [\#3709](https://github.com/pomerium/pomerium/pull/3709) (@calebdoxsey)
-- config: disable envoy admin by default, expose stats via envoy route [\#3677](https://github.com/pomerium/pomerium/pull/3677) (@calebdoxsey)
-- controlplane: fix /.well-known/pomerium missing CORS headers [\#3738](https://github.com/pomerium/pomerium/pull/3738) (@calebdoxsey)
-- fileutil: update watcher to use fsnotify and polling [\#3663](https://github.com/pomerium/pomerium/pull/3663) (@calebdoxsey)
-- postgres: return an empty list of addresses on dns errors [\#3637](https://github.com/pomerium/pomerium/pull/3637) (@calebdoxsey)
-- ppl: support special characters in claim keys [\#3639](https://github.com/pomerium/pomerium/pull/3639) (@calebdoxsey)
-
-### Changed
-
-- add config option check logging [\#3722](https://github.com/pomerium/pomerium/pull/3722) (@wasaga)
-- authenticate: remove ecjson [\#3688](https://github.com/pomerium/pomerium/pull/3688) (@calebdoxsey)
-- authenticate: update user info dashboard to show group info for enterprise [\#3736](https://github.com/pomerium/pomerium/pull/3736) (@calebdoxsey)
-- device: add generic methods for working with user+session devices [\#3710](https://github.com/pomerium/pomerium/pull/3710) (@calebdoxsey)
-- envoyconfig: fix databroker health checks [\#3706](https://github.com/pomerium/pomerium/pull/3706) (@calebdoxsey)
-- fix unused key warnings in routes [\#3711](https://github.com/pomerium/pomerium/pull/3711) (@wasaga)
-- keep trace span context [\#3724](https://github.com/pomerium/pomerium/pull/3724) (@wasaga)
-- postgres: handle unknown types [\#3632](https://github.com/pomerium/pomerium/pull/3632) (@calebdoxsey)
-- test: use `T.TempDir` to create temporary test directory [\#3725](https://github.com/pomerium/pomerium/pull/3725) (@Juneezee)
-- upgrade envoy to v1.23.1 [\#3599](https://github.com/pomerium/pomerium/pull/3599) (@calebdoxsey)
-
-### Dependency
-
-- bump Envoy to 1.23.2 [\#3739](https://github.com/pomerium/pomerium/pull/3739) (@wasaga)
-- bump protoc to 3.21.7 [\#3646](https://github.com/pomerium/pomerium/pull/3646) (@wasaga)
-- chore\(deps\): bump actions/cache from 3.0.10 to 3.0.11 [\#3671](https://github.com/pomerium/pomerium/pull/3671) (@dependabot[bot])
-- chore\(deps\): bump actions/cache from 3.0.8 to 3.0.10 [\#3642](https://github.com/pomerium/pomerium/pull/3642) (@dependabot[bot])
-- chore\(deps\): bump actions/checkout from 3.0.2 to 3.1.0 [\#3652](https://github.com/pomerium/pomerium/pull/3652) (@dependabot[bot])
-- chore\(deps\): bump actions/download-artifact from 3.0.0 to 3.0.1 [\#3700](https://github.com/pomerium/pomerium/pull/3700) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-go from 3.3.0 to 3.3.1 [\#3681](https://github.com/pomerium/pomerium/pull/3681) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-node from 3.4.1 to 3.5.0 [\#3641](https://github.com/pomerium/pomerium/pull/3641) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-node from 3.5.0 to 3.5.1 [\#3672](https://github.com/pomerium/pomerium/pull/3672) (@dependabot[bot])
-- chore\(deps\): bump actions/setup-python from 4.2.0 to 4.3.0 [\#3651](https://github.com/pomerium/pomerium/pull/3651) (@dependabot[bot])
-- chore\(deps\): bump actions/upload-artifact from 3.1.0 to 3.1.1 [\#3698](https://github.com/pomerium/pomerium/pull/3698) (@dependabot[bot])
-- chore\(deps\): bump alpine from `bc41182` to `b95359c` [\#3751](https://github.com/pomerium/pomerium/pull/3751) (@dependabot[bot])
-- chore\(deps\): bump debian from `1b1d158` to `9583740` [\#3719](https://github.com/pomerium/pomerium/pull/3719) (@dependabot[bot])
-- chore\(deps\): bump debian from `3d2aa50` to `6005bd9` [\#3625](https://github.com/pomerium/pomerium/pull/3625) (@dependabot[bot])
-- chore\(deps\): bump debian from `6005bd9` to `1b1d158` [\#3656](https://github.com/pomerium/pomerium/pull/3656) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `4689543` to `6ef742b` [\#3654](https://github.com/pomerium/pomerium/pull/3654) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `59fe963` to `8a7afd5` [\#3627](https://github.com/pomerium/pomerium/pull/3627) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `65afaf8` to `59fe963` [\#3616](https://github.com/pomerium/pomerium/pull/3616) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `6ef742b` to `9681f07` [\#3676](https://github.com/pomerium/pomerium/pull/3676) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `856944e` to `cd1bf87` [\#3732](https://github.com/pomerium/pomerium/pull/3732) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `8a7afd5` to `4689543` [\#3647](https://github.com/pomerium/pomerium/pull/3647) (@dependabot[bot])
-- chore\(deps\): bump distroless/base from `9681f07` to `856944e` [\#3702](https://github.com/pomerium/pomerium/pull/3702) (@dependabot[bot])
-- chore\(deps\): bump docker/build-push-action from 3.1.1 to 3.2.0 [\#3673](https://github.com/pomerium/pomerium/pull/3673) (@dependabot[bot])
-- chore\(deps\): bump docker/login-action from 2.0.0 to 2.1.0 [\#3682](https://github.com/pomerium/pomerium/pull/3682) (@dependabot[bot])
-- chore\(deps\): bump docker/setup-buildx-action from 2.0.0 to 2.2.1 [\#3679](https://github.com/pomerium/pomerium/pull/3679) (@dependabot[bot])
-- chore\(deps\): bump docker/setup-qemu-action from 2.0.0 to 2.1.0 [\#3675](https://github.com/pomerium/pomerium/pull/3675) (@dependabot[bot])
-- chore\(deps\): bump github.com/caddyserver/certmagic from 0.16.3 to 0.17.0 [\#3604](https://github.com/pomerium/pomerium/pull/3604) (@dependabot[bot])
-- chore\(deps\): bump github.com/caddyserver/certmagic from 0.17.0 to 0.17.1 [\#3619](https://github.com/pomerium/pomerium/pull/3619) (@dependabot[bot])
-- chore\(deps\): bump github.com/caddyserver/certmagic from 0.17.1 to 0.17.2 [\#3644](https://github.com/pomerium/pomerium/pull/3644) (@dependabot[bot])
-- chore\(deps\): bump github.com/coreos/go-oidc/v3 from 3.2.0 to 3.3.0 [\#3605](https://github.com/pomerium/pomerium/pull/3605) (@dependabot[bot])
-- chore\(deps\): bump github.com/coreos/go-oidc/v3 from 3.3.0 to 3.4.0 [\#3612](https://github.com/pomerium/pomerium/pull/3612) (@dependabot[bot])
-- chore\(deps\): bump github.com/docker/docker from 20.10.17+incompatible to 20.10.18+incompatible [\#3614](https://github.com/pomerium/pomerium/pull/3614) (@dependabot[bot])
-- chore\(deps\): bump github.com/docker/docker from 20.10.18+incompatible to 20.10.19+incompatible [\#3666](https://github.com/pomerium/pomerium/pull/3666) (@dependabot[bot])
-- chore\(deps\): bump github.com/docker/docker from 20.10.19+incompatible to 20.10.20+incompatible [\#3694](https://github.com/pomerium/pomerium/pull/3694) (@dependabot[bot])
-- chore\(deps\): bump github.com/docker/docker from 20.10.20+incompatible to 20.10.21+incompatible [\#3712](https://github.com/pomerium/pomerium/pull/3712) (@dependabot[bot])
-- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.6.10 to 0.6.13 [\#3648](https://github.com/pomerium/pomerium/pull/3648) (@dependabot[bot])
-- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.6.13 to 0.8.0 [\#3731](https://github.com/pomerium/pomerium/pull/3731) (@dependabot[bot])
-- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.6.7 to 0.6.8 [\#3624](https://github.com/pomerium/pomerium/pull/3624) (@dependabot[bot])
-- chore\(deps\): bump github.com/envoyproxy/protoc-gen-validate from 0.6.8 to 0.6.10 [\#3630](https://github.com/pomerium/pomerium/pull/3630) (@dependabot[bot])
-- chore\(deps\): bump github.com/fsnotify/fsnotify from 1.5.4 to 1.6.0 [\#3713](https://github.com/pomerium/pomerium/pull/3713) (@dependabot[bot])
-- chore\(deps\): bump github.com/golangci/golangci-lint from 1.48.0 to 1.50.0 [\#3667](https://github.com/pomerium/pomerium/pull/3667) (@dependabot[bot])
-- chore\(deps\): bump github.com/golangci/golangci-lint from 1.50.0 to 1.50.1 [\#3697](https://github.com/pomerium/pomerium/pull/3697) (@dependabot[bot])
-- chore\(deps\): bump github.com/google/go-cmp from 0.5.8 to 0.5.9 [\#3611](https://github.com/pomerium/pomerium/pull/3611) (@dependabot[bot])
-- chore\(deps\): bump github.com/google/go-jsonnet from 0.18.0 to 0.19.1 [\#3715](https://github.com/pomerium/pomerium/pull/3715) (@dependabot[bot])
-- chore\(deps\): bump github.com/jackc/pgx/v4 from 4.17.1 to 4.17.2 [\#3603](https://github.com/pomerium/pomerium/pull/3603) (@dependabot[bot])
-- chore\(deps\): bump github.com/open-policy-agent/opa from 0.43.0 to 0.44.0 [\#3620](https://github.com/pomerium/pomerium/pull/3620) (@dependabot[bot])
-- chore\(deps\): bump github.com/open-policy-agent/opa from 0.44.0 to 0.45.0 [\#3650](https://github.com/pomerium/pomerium/pull/3650) (@dependabot[bot])
-- chore\(deps\): bump github.com/open-policy-agent/opa from 0.45.0 to 0.46.1 [\#3729](https://github.com/pomerium/pomerium/pull/3729) (@dependabot[bot])
-- chore\(deps\): bump github.com/openzipkin/zipkin-go from 0.4.0 to 0.4.1 [\#3668](https://github.com/pomerium/pomerium/pull/3668) (@dependabot[bot])
-- chore\(deps\): bump github.com/prometheus/client_model from 0.2.0 to 0.3.0 [\#3696](https://github.com/pomerium/pomerium/pull/3696) (@dependabot[bot])
-- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.22.7 to 3.22.8 [\#3606](https://github.com/pomerium/pomerium/pull/3606) (@dependabot[bot])
-- chore\(deps\): bump github.com/shirou/gopsutil/v3 from 3.22.8 to 3.22.9 [\#3643](https://github.com/pomerium/pomerium/pull/3643) (@dependabot[bot])
-- chore\(deps\): bump github.com/spf13/viper from 1.12.0 to 1.13.0 [\#3613](https://github.com/pomerium/pomerium/pull/3613) (@dependabot[bot])
-- chore\(deps\): bump github.com/spf13/viper from 1.13.0 to 1.14.0 [\#3728](https://github.com/pomerium/pomerium/pull/3728) (@dependabot[bot])
-- chore\(deps\): bump github.com/stretchr/testify from 1.8.0 to 1.8.1 [\#3695](https://github.com/pomerium/pomerium/pull/3695) (@dependabot[bot])
-- chore\(deps\): bump github.com/VictoriaMetrics/fastcache from 1.10.0 to 1.12.0 [\#3623](https://github.com/pomerium/pomerium/pull/3623) (@dependabot[bot])
-- chore\(deps\): bump go.opencensus.io from 0.23.0 to 0.24.0 [\#3727](https://github.com/pomerium/pomerium/pull/3727) (@dependabot[bot])
-- chore\(deps\): bump golang from `403f389` to `b448089` [\#3718](https://github.com/pomerium/pomerium/pull/3718) (@dependabot[bot])
-- chore\(deps\): bump golang from `d71125b` to `4b2498d` [\#3626](https://github.com/pomerium/pomerium/pull/3626) (@dependabot[bot])
-- chore\(deps\): bump golang from 1.19.0-buster to 1.19.1-buster [\#3617](https://github.com/pomerium/pomerium/pull/3617) (@dependabot[bot])
-- chore\(deps\): bump golang from 1.19.1-buster to 1.19.2-buster [\#3655](https://github.com/pomerium/pomerium/pull/3655) (@dependabot[bot])
-- chore\(deps\): bump golang from 1.19.2-buster to 1.19.3-buster [\#3733](https://github.com/pomerium/pomerium/pull/3733) (@dependabot[bot])
-- chore\(deps\): bump golang.org/x/net from 0.1.0 to 0.2.0 [\#3748](https://github.com/pomerium/pomerium/pull/3748) (@dependabot[bot])
-- chore\(deps\): bump google-github-actions/setup-gcloud from 0.6.0 to 0.6.2 [\#3674](https://github.com/pomerium/pomerium/pull/3674) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.100.0 to 0.101.0 [\#3714](https://github.com/pomerium/pomerium/pull/3714) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.94.0 to 0.95.0 [\#3618](https://github.com/pomerium/pomerium/pull/3618) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.95.0 to 0.96.0 [\#3622](https://github.com/pomerium/pomerium/pull/3622) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.96.0 to 0.97.0 [\#3629](https://github.com/pomerium/pomerium/pull/3629) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.97.0 to 0.98.0 [\#3645](https://github.com/pomerium/pomerium/pull/3645) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.98.0 to 0.99.0 [\#3670](https://github.com/pomerium/pomerium/pull/3670) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/api from 0.99.0 to 0.100.0 [\#3693](https://github.com/pomerium/pomerium/pull/3693) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/grpc from 1.49.0 to 1.50.0 [\#3649](https://github.com/pomerium/pomerium/pull/3649) (@dependabot[bot])
-- chore\(deps\): bump google.golang.org/grpc from 1.50.0 to 1.50.1 [\#3669](https://github.com/pomerium/pomerium/pull/3669) (@dependabot[bot])
-- chore\(deps\): bump goreleaser/goreleaser-action from 3.1.0 to 3.2.0 [\#3680](https://github.com/pomerium/pomerium/pull/3680) (@dependabot[bot])
-- chore\(deps\): bump mikefarah/yq from 4.27.3 to 4.27.5 [\#3615](https://github.com/pomerium/pomerium/pull/3615) (@dependabot[bot])
-- chore\(deps\): bump mikefarah/yq from 4.27.5 to 4.28.1 [\#3653](https://github.com/pomerium/pomerium/pull/3653) (@dependabot[bot])
-- chore\(deps\): bump mikefarah/yq from 4.28.1 to 4.28.2 [\#3690](https://github.com/pomerium/pomerium/pull/3690) (@dependabot[bot])
-- chore\(deps\): bump mikefarah/yq from 4.28.2 to 4.29.2 [\#3717](https://github.com/pomerium/pomerium/pull/3717) (@dependabot[bot])
-- chore\(deps\): bump stefanzweifel/git-auto-commit-action from 4.14.1 to 4.15.0 [\#3631](https://github.com/pomerium/pomerium/pull/3631) (@dependabot[bot])
-- chore\(deps\): bump stefanzweifel/git-auto-commit-action from 4.15.0 to 4.15.1 [\#3658](https://github.com/pomerium/pomerium/pull/3658) (@dependabot[bot])
-- chore\(deps\): bump stefanzweifel/git-auto-commit-action from 4.15.1 to 4.15.2 [\#3699](https://github.com/pomerium/pomerium/pull/3699) (@dependabot[bot])
-- chore\(deps\): bump stefanzweifel/git-auto-commit-action from 4.15.2 to 4.15.3 [\#3716](https://github.com/pomerium/pomerium/pull/3716) (@dependabot[bot])
-- chore\(deps\): bump stefanzweifel/git-auto-commit-action from 4.15.3 to 4.15.4 [\#3726](https://github.com/pomerium/pomerium/pull/3726) (@dependabot[bot])
-
-## [v0.19.2](https://github.com/pomerium/pomerium/tree/v0.19.2) (2023-05-26)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.19.1...v0.19.2)
-
-### Security
-
-- This release fixes a bug whereby specially crafted requests could result in incorrect authorization decisions made by Pomerium. [CVE-2023-33189](https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p).
-
-### Changed
-
-- authorize: enforce service account expiration by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3662
-- config: disable envoy admin by default, expose stats via envoy route by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3684
-- fileutil: update watcher to use fsnotify and polling (#3663) by @calebdoxsey in https://github.com/pomerium/pomerium/pull/3685
-- httputil: remove error details by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3705
-- postgres: return an empty list of addresses on dns errors by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3638
-- ppl: support special characters in claim keys by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3640
-
-## [v0.19.1](https://github.com/pomerium/pomerium/tree/v0.19.1) (2022-09-08)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.19.0...v0.19.1)
-
-### Changed
-
-- [`c0a88707`](https://github.com/pomerium/pomerium/commit/c0a8870717ffc02f3083cdb191faa43c74077288) authenticate: get/set identity provider id for all sessions (#3608)
-- [`c3ef43cd`](https://github.com/pomerium/pomerium/commit/c3ef43cdeda9a3dda88b82d69fc6c69059a71c5f) upgrade envoy to v1.23.1 (#3600)
-
-### Docker images
-
-- `docker pull pomerium/pomerium:v0.19.1`
-- `docker pull pomerium/pomerium:nonroot-v0.19.1`
-- `docker pull pomerium/pomerium:debug-v0.19.1`
-- `docker pull pomerium/pomerium:debug-nonroot-v0.19.1`
-
-## [v0.19.0](https://github.com/pomerium/pomerium/tree/v0.19.0) (2022-09-01)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.18.0...v0.19.0)
-
-### New
-
-- add the traces error details [#3557](https://github.com/pomerium/pomerium/pull/3557) (@nhayfield)
-- authorize: add policy error details for custom error messages [#3542](https://github.com/pomerium/pomerium/pull/3542) (@calebdoxsey)
-- autocert: add support for ACME TLS-ALPN [#3590](https://github.com/pomerium/pomerium/pull/3590) (@calebdoxsey)
-- config: add branding settings [#3558](https://github.com/pomerium/pomerium/pull/3558) (@calebdoxsey)
-- controlplane: add well-known endpoint to the controlplane http handler [#3555](https://github.com/pomerium/pomerium/pull/3555) (@calebdoxsey)
-- Dynamic style changes [#3544](https://github.com/pomerium/pomerium/pull/3544) (@nhayfield)
-- envoy: upgrade to 1.23.0 [#3560](https://github.com/pomerium/pomerium/pull/3560) (@calebdoxsey)
-- envoyconfig: add virtual host domains for certificates in addition to routes [#3593](https://github.com/pomerium/pomerium/pull/3593) (@calebdoxsey)
-
-### Fixed
-
-- add front end support for optional first paragraph of markdown on err... [#3546](https://github.com/pomerium/pomerium/pull/3546) (@nhayfield)
-- atomicutil: use atomicutil.Value wherever possible [#3517](https://github.com/pomerium/pomerium/pull/3517) (@calebdoxsey)
-- authenticate: add CORS headers to jwks endpoint [#3574](https://github.com/pomerium/pomerium/pull/3574) (@calebdoxsey)
-- authenticate: fix branding for webauthn device registration page [#3572](https://github.com/pomerium/pomerium/pull/3572) (@calebdoxsey)
-- authorize: handle user-unauthenticated response for deny blocks [#3559](https://github.com/pomerium/pomerium/pull/3559) (@calebdoxsey)
-- envoyconfig: add authority header to outbound gRPC requests [#3545](https://github.com/pomerium/pomerium/pull/3545) (@calebdoxsey)
-- Fix typos [#3575](https://github.com/pomerium/pomerium/pull/3575) (@alexrudd2)
-- postgres: remove not null constraint on data column of record changes table [#3594](https://github.com/pomerium/pomerium/pull/3594) (@calebdoxsey)
-- publish to any-distro [#3570](https://github.com/pomerium/pomerium/pull/3570) (@calebdoxsey)
-- sets: convert set types to generics [#3519](https://github.com/pomerium/pomerium/pull/3519) (@calebdoxsey)
-- Update README.md [#3569](https://github.com/pomerium/pomerium/pull/3569) (@cmo-pomerium)
-
-### Dependency
-
-- chore(deps): bump actions/cache from 3.0.5 to 3.0.6 [#3537](https://github.com/pomerium/pomerium/pull/3537) (@dependabot[bot])
-- chore(deps): bump actions/cache from 3.0.6 to 3.0.7 [#3552](https://github.com/pomerium/pomerium/pull/3552) (@dependabot[bot])
-- chore(deps): bump actions/cache from 3.0.7 to 3.0.8 [#3565](https://github.com/pomerium/pomerium/pull/3565) (@dependabot[bot])
-- chore(deps): bump actions/setup-go from 3.2.1 to 3.3.0 [#3583](https://github.com/pomerium/pomerium/pull/3583) (@dependabot[bot])
-- chore(deps): bump actions/setup-python from 4.1.0 to 4.2.0 [#3535](https://github.com/pomerium/pomerium/pull/3535) (@dependabot[bot])
-- chore(deps): bump actions/stale from 5.1.0 to 5.1.1 [#3513](https://github.com/pomerium/pomerium/pull/3513) (@dependabot[bot])
-- chore(deps): bump alpine from `6af1b11` to `7580ece` [#3512](https://github.com/pomerium/pomerium/pull/3512) (@dependabot[bot])
-- chore(deps): bump alpine from `7580ece` to `bc41182` [#3553](https://github.com/pomerium/pomerium/pull/3553) (@dependabot[bot])
-- chore(deps): bump contrib.go.opencensus.io/exporter/prometheus from 0.4.1 to 0.4.2 [#3586](https://github.com/pomerium/pomerium/pull/3586) (@dependabot[bot])
-- chore(deps): bump debian from `1c34464` to `4567e1e` [#3508](https://github.com/pomerium/pomerium/pull/3508) (@dependabot[bot])
-- chore(deps): bump debian from `4567e1e` to `b9b1f4a` [#3538](https://github.com/pomerium/pomerium/pull/3538) (@dependabot[bot])
-- chore(deps): bump debian from `b9b1f4a` to `3d2aa50` [#3588](https://github.com/pomerium/pomerium/pull/3588) (@dependabot[bot])
-- chore(deps): bump distroless/base from `3a62194` to `ec73486` [#3554](https://github.com/pomerium/pomerium/pull/3554) (@dependabot[bot])
-- chore(deps): bump distroless/base from `d6db599` to `3a62194` [#3511](https://github.com/pomerium/pomerium/pull/3511) (@dependabot[bot])
-- chore(deps): bump distroless/base from `ec73486` to `65afaf8` [#3568](https://github.com/pomerium/pomerium/pull/3568) (@dependabot[bot])
-- chore(deps): bump docker/build-push-action from 3.1.0 to 3.1.1 [#3536](https://github.com/pomerium/pomerium/pull/3536) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.16.0 to 0.16.2 [#3532](https://github.com/pomerium/pomerium/pull/3532) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.16.2 to 0.16.3 [#3563](https://github.com/pomerium/pomerium/pull/3563) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.46.2 to 1.47.2 [#3499](https://github.com/pomerium/pomerium/pull/3499) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.47.2 to 1.47.3 [#3522](https://github.com/pomerium/pomerium/pull/3522) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.47.3 to 1.48.0 [#3541](https://github.com/pomerium/pomerium/pull/3541) (@dependabot[bot])
-- chore(deps): bump github.com/jackc/pgx/v4 from 4.16.1 to 4.17.0 [#3533](https://github.com/pomerium/pomerium/pull/3533) (@dependabot[bot])
-- chore(deps): bump github.com/jackc/pgx/v4 from 4.17.0 to 4.17.1 [#3582](https://github.com/pomerium/pomerium/pull/3582) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.42.2 to 0.43.0 [#3523](https://github.com/pomerium/pomerium/pull/3523) (@dependabot[bot])
-- chore(deps): bump github.com/peterbourgon/ff/v3 from 3.1.2 to 3.3.0 [#3540](https://github.com/pomerium/pomerium/pull/3540) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/client_golang from 1.12.2 to 1.13.0 [#3530](https://github.com/pomerium/pomerium/pull/3530) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/procfs from 0.7.3 to 0.8.0 [#3516](https://github.com/pomerium/pomerium/pull/3516) (@dependabot[bot])
-- chore(deps): bump github.com/rs/zerolog from 1.27.0 to 1.28.0 [#3587](https://github.com/pomerium/pomerium/pull/3587) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.22.6 to 3.22.7 [#3524](https://github.com/pomerium/pomerium/pull/3524) (@dependabot[bot])
-- chore(deps): bump go.uber.org/zap from 1.21.0 to 1.22.0 [#3551](https://github.com/pomerium/pomerium/pull/3551) (@dependabot[bot])
-- chore(deps): bump go.uber.org/zap from 1.22.0 to 1.23.0 [#3581](https://github.com/pomerium/pomerium/pull/3581) (@dependabot[bot])
-- chore(deps): bump golang from `6960d62` to `477b10a` [#3527](https://github.com/pomerium/pomerium/pull/3527) (@dependabot[bot])
-- chore(deps): bump golang from `a7a23f1` to `d84495e` [#3589](https://github.com/pomerium/pomerium/pull/3589) (@dependabot[bot])
-- chore(deps): bump golang from 1.18-buster to 1.18.4-buster [#3509](https://github.com/pomerium/pomerium/pull/3509) (@dependabot[bot])
-- chore(deps): bump golang from 1.18.4-buster to 1.19.0-buster [#3539](https://github.com/pomerium/pomerium/pull/3539) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.88.0 to 0.89.0 [#3514](https://github.com/pomerium/pomerium/pull/3514) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.89.0 to 0.90.0 [#3525](https://github.com/pomerium/pomerium/pull/3525) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.90.0 to 0.91.0 [#3531](https://github.com/pomerium/pomerium/pull/3531) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.91.0 to 0.92.0 [#3550](https://github.com/pomerium/pomerium/pull/3550) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.92.0 to 0.93.0 [#3562](https://github.com/pomerium/pomerium/pull/3562) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.93.0 to 0.94.0 [#3580](https://github.com/pomerium/pomerium/pull/3580) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.48.0 to 1.49.0 [#3579](https://github.com/pomerium/pomerium/pull/3579) (@dependabot[bot])
-- chore(deps): bump google.golang.org/protobuf from 1.28.0 to 1.28.1 [#3515](https://github.com/pomerium/pomerium/pull/3515) (@dependabot[bot])
-- chore(deps): bump goreleaser/goreleaser-action from 3.0.0 to 3.1.0 [#3585](https://github.com/pomerium/pomerium/pull/3585) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.26.1 to 4.27.2 [#3526](https://github.com/pomerium/pomerium/pull/3526) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.27.2 to 4.27.3 [#3584](https://github.com/pomerium/pomerium/pull/3584) (@dependabot[bot])
-- chore(deps): bump pomerium/backport from a2e620de9fc4166f774ee2a389e170046cfad426 to 1.1.1 [#3564](https://github.com/pomerium/pomerium/pull/3564) (@dependabot[bot])
-- chore(deps): bump pre-commit/action from 876132a3c26aa072b09eab6c5395b4749eeb2435 to 3.0.0 [#3567](https://github.com/pomerium/pomerium/pull/3567) (@dependabot[bot])
-- chore(deps): bump tibdex/github-app-token from 1.5.1 to 1.6 [#3566](https://github.com/pomerium/pomerium/pull/3566) (@dependabot[bot])
-- deployment: update RELEASING.md [#3503](https://github.com/pomerium/pomerium/pull/3503) (@desimone)
-
-## [v0.18.1](https://github.com/pomerium/pomerium/tree/v0.18.1) (2023-05-26)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.18.0...v0.18.1)
-
-### Security
-
-- This release fixes a bug whereby specially crafted requests could result in incorrect authorization decisions made by Pomerium. [CVE-2023-33189](https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p).
-
-### Changed
-
-- publish to any-distro (#3570) by @calebdoxsey in https://github.com/pomerium/pomerium/pull/3571
-- postgres: remove not null constraint on data column of record changes table by @backport-actions-token in https://github.com/pomerium/pomerium/pull/3595
-
-## [v0.18.0](https://github.com/pomerium/pomerium/tree/v0.18.0) (2022-07-27)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.17.3...v0.18.0)
-
-### New
-
-- add databroker multi lease handlers [#3255](https://github.com/pomerium/pomerium/pull/3255) (@wasaga)
-- add lease name to the log [#3498](https://github.com/pomerium/pomerium/pull/3498) (@wasaga)
-- add metrics aggregation [#3452](https://github.com/pomerium/pomerium/pull/3452) (@wasaga)
-- add x-request-id in responses [#3366](https://github.com/pomerium/pomerium/pull/3366) (@wasaga)
-- allow pomerium to be embedded as a library [#3415](https://github.com/pomerium/pomerium/pull/3415) (@wasaga)
-- authenticate: allow changing the authenticate service URL at runtime [#3378](https://github.com/pomerium/pomerium/pull/3378) (@calebdoxsey)
-- authenticate: show the device enrolled page as the user info page [#3151](https://github.com/pomerium/pomerium/pull/3151) (@calebdoxsey)
-- authorize: add name claim [#3238](https://github.com/pomerium/pomerium/pull/3238) (@calebdoxsey)
-- authorize: track session and service account access date [#3220](https://github.com/pomerium/pomerium/pull/3220) (@calebdoxsey)
-- authorize: use query instead of sync for databroker data [#3377](https://github.com/pomerium/pomerium/pull/3377) (@calebdoxsey)
-- databroker: add support for field masks on Put [#3210](https://github.com/pomerium/pomerium/pull/3210) (@calebdoxsey)
-- databroker: add support for putting multiple records [#3291](https://github.com/pomerium/pomerium/pull/3291) (@calebdoxsey)
-- databroker: add support for query filtering [#3369](https://github.com/pomerium/pomerium/pull/3369) (@calebdoxsey)
-- databroker: add support for syncing by type [#3412](https://github.com/pomerium/pomerium/pull/3412) (@calebdoxsey)
-- directory: support non-base64 encoded service accounts [#3150](https://github.com/pomerium/pomerium/pull/3150) (@calebdoxsey)
-- do not require idp set in the bootstrap config, as it may be later configured via the databroker [#3386](https://github.com/pomerium/pomerium/pull/3386) (@wasaga)
-- eliminate global events manager [#3422](https://github.com/pomerium/pomerium/pull/3422) (@wasaga)
-- envoy: upgrade to 1.21.1 [#3186](https://github.com/pomerium/pomerium/pull/3186) (@calebdoxsey)
-- envoy: use typed extension protocol options for static bootstrap cluster [#3268](https://github.com/pomerium/pomerium/pull/3268) (@calebdoxsey)
-- Expand PR template [#3403](https://github.com/pomerium/pomerium/pull/3403) (@alexfornuto)
-- github: pin github actions [#3183](https://github.com/pomerium/pomerium/pull/3183) (@calebdoxsey)
-- grpc: regenerate protobuf code [#3208](https://github.com/pomerium/pomerium/pull/3208) (@calebdoxsey)
-- grpc: wait for connect to be ready before making calls [#3253](https://github.com/pomerium/pomerium/pull/3253) (@calebdoxsey)
-- identity: batch directory updates [#3411](https://github.com/pomerium/pomerium/pull/3411) (@calebdoxsey)
-- integration: add test for query string params [#3302](https://github.com/pomerium/pomerium/pull/3302) (@calebdoxsey)
-- postgres: databroker storage backend [#3370](https://github.com/pomerium/pomerium/pull/3370) (@calebdoxsey)
-- postgres: registry support [#3454](https://github.com/pomerium/pomerium/pull/3454) (@calebdoxsey)
-- storage: add filter expressions, upgrade go to 1.18.1 [#3365](https://github.com/pomerium/pomerium/pull/3365) (@calebdoxsey)
-- storage: add filtering to SyncLatest [#3368](https://github.com/pomerium/pomerium/pull/3368) (@calebdoxsey)
-- try pinning docker dependency [#3185](https://github.com/pomerium/pomerium/pull/3185) (@calebdoxsey)
-- ui: remove version [#3184](https://github.com/pomerium/pomerium/pull/3184) (@calebdoxsey)
-
-### Fixed
-
-- authenticate: fix debug and metrics endpoints [#3212](https://github.com/pomerium/pomerium/pull/3212) (@calebdoxsey)
-- authenticate: fix internal service URL CORS check [#3279](https://github.com/pomerium/pomerium/pull/3279) (@calebdoxsey)
-- authenticate: fix internal service URL dashboard redirect [#3305](https://github.com/pomerium/pomerium/pull/3305) (@calebdoxsey)
-- authenticate: fix internal url with webauthn [#3194](https://github.com/pomerium/pomerium/pull/3194) (@calebdoxsey)
-- authenticate: save session for bare webauthn redirects, consider external service URL to be a pomerium url [#3280](https://github.com/pomerium/pomerium/pull/3280) (@calebdoxsey)
-- authorize: add request id to context [#3497](https://github.com/pomerium/pomerium/pull/3497) (@calebdoxsey)
-- authorize: allow missing user for authorization [#3421](https://github.com/pomerium/pomerium/pull/3421) (@calebdoxsey)
-- authorize: fix device synchronization [#3482](https://github.com/pomerium/pomerium/pull/3482) (@calebdoxsey)
-- authorize: fix not found check [#3410](https://github.com/pomerium/pomerium/pull/3410) (@calebdoxsey)
-- authorize: fix x-forwarded-uri [#3479](https://github.com/pomerium/pomerium/pull/3479) (@calebdoxsey)
-- authorize: pass idp id for webauthn url, allow unauthenticated access to static files [#3282](https://github.com/pomerium/pomerium/pull/3282) (@calebdoxsey)
-- authorize: show plain text error page for traefik and nginx [#3477](https://github.com/pomerium/pomerium/pull/3477) (@calebdoxsey)
-- autocert: continue on error [#3476](https://github.com/pomerium/pomerium/pull/3476) (@calebdoxsey)
-- config: fix DefaultTransport so it is still a \*http.Transport [#3257](https://github.com/pomerium/pomerium/pull/3257) (@calebdoxsey)
-- databroker: fix in-memory backend deadlock [#3300](https://github.com/pomerium/pomerium/pull/3300) (@calebdoxsey)
-- deployment: update syntax installing `dlv` in debug image [#3179](https://github.com/pomerium/pomerium/pull/3179) (@travisgroth)
-- device enrollment: fix ip address [#3430](https://github.com/pomerium/pomerium/pull/3430) (@calebdoxsey)
-- envoyconfig: prevent nil reproxy handler [#3345](https://github.com/pomerium/pomerium/pull/3345) (@wasaga)
-- fix: close the ticker after opened [#3318](https://github.com/pomerium/pomerium/pull/3318) (@clwluvw)
-- fix: The built binary file is missing "ui/dist/index.js" and "ui/dist... [#3391](https://github.com/pomerium/pomerium/pull/3391) (@cfanbo)
-- github: fix missing groups [#3171](https://github.com/pomerium/pomerium/pull/3171) (@calebdoxsey)
-- httputil/reproxy: fix policy transport [#3322](https://github.com/pomerium/pomerium/pull/3322) (@calebdoxsey)
-- options: fix overlapping certificate test [#3492](https://github.com/pomerium/pomerium/pull/3492) (@calebdoxsey)
-- postgres: fix CIDR query [#3389](https://github.com/pomerium/pomerium/pull/3389) (@calebdoxsey)
-- postgres: fix record deletion [#3446](https://github.com/pomerium/pomerium/pull/3446) (@calebdoxsey)
-- userinfo: embed assets as data URLs for forward auth [#3460](https://github.com/pomerium/pomerium/pull/3460) (@calebdoxsey)
-- userinfo: fix missing profile picture [#3154](https://github.com/pomerium/pomerium/pull/3154) (@calebdoxsey)
-
-### Dependency
-
-- bump envoy to 1.21.3 [#3413](https://github.com/pomerium/pomerium/pull/3413) (@wasaga)
-- chore(deps): bump actions/cache from 2 to 3 [#3167](https://github.com/pomerium/pomerium/pull/3167) (@dependabot[bot])
-- chore(deps): bump actions/cache from 3.0.0 to 3.0.1 [#3235](https://github.com/pomerium/pomerium/pull/3235) (@dependabot[bot])
-- chore(deps): bump actions/cache from 3.0.1 to 3.0.2 [#3265](https://github.com/pomerium/pomerium/pull/3265) (@dependabot[bot])
-- chore(deps): bump actions/cache from 3.0.2 to 3.0.3 [#3399](https://github.com/pomerium/pomerium/pull/3399) (@dependabot[bot])
-- chore(deps): bump actions/cache from 3.0.3 to 3.0.4 [#3440](https://github.com/pomerium/pomerium/pull/3440) (@dependabot[bot])
-- chore(deps): bump actions/cache from 3.0.4 to 3.0.5 [#3489](https://github.com/pomerium/pomerium/pull/3489) (@dependabot[bot])
-- chore(deps): bump actions/checkout from 3.0.0 to 3.0.1 [#3275](https://github.com/pomerium/pomerium/pull/3275) (@dependabot[bot])
-- chore(deps): bump actions/checkout from 3.0.1 to 3.0.2 [#3297](https://github.com/pomerium/pomerium/pull/3297) (@dependabot[bot])
-- chore(deps): bump actions/download-artifact from 2.1.0 to 3 [#3202](https://github.com/pomerium/pomerium/pull/3202) (@dependabot[bot])
-- chore(deps): bump actions/setup-go from 2.2.0 to 3 [#3204](https://github.com/pomerium/pomerium/pull/3204) (@dependabot[bot])
-- chore(deps): bump actions/setup-go from 3.0.0 to 3.1.0 [#3362](https://github.com/pomerium/pomerium/pull/3362) (@dependabot[bot])
-- chore(deps): bump actions/setup-go from 3.1.0 to 3.2.0 [#3384](https://github.com/pomerium/pomerium/pull/3384) (@dependabot[bot])
-- chore(deps): bump actions/setup-go from 3.2.0 to 3.2.1 [#3470](https://github.com/pomerium/pomerium/pull/3470) (@dependabot[bot])
-- chore(deps): bump actions/setup-node from 3.0.0 to 3.1.0 [#3236](https://github.com/pomerium/pomerium/pull/3236) (@dependabot[bot])
-- chore(deps): bump actions/setup-node from 3.1.0 to 3.1.1 [#3267](https://github.com/pomerium/pomerium/pull/3267) (@dependabot[bot])
-- chore(deps): bump actions/setup-node from 3.1.1 to 3.2.0 [#3363](https://github.com/pomerium/pomerium/pull/3363) (@dependabot[bot])
-- chore(deps): bump actions/setup-node from 3.2.0 to 3.3.0 [#3400](https://github.com/pomerium/pomerium/pull/3400) (@dependabot[bot])
-- chore(deps): bump actions/setup-node from 3.3.0 to 3.4.0 [#3471](https://github.com/pomerium/pomerium/pull/3471) (@dependabot[bot])
-- chore(deps): bump actions/setup-node from 3.4.0 to 3.4.1 [#3490](https://github.com/pomerium/pomerium/pull/3490) (@dependabot[bot])
-- chore(deps): bump actions/setup-python from 3.0.0 to 3.1.0 [#3234](https://github.com/pomerium/pomerium/pull/3234) (@dependabot[bot])
-- chore(deps): bump actions/setup-python from 3.1.0 to 3.1.2 [#3266](https://github.com/pomerium/pomerium/pull/3266) (@dependabot[bot])
-- chore(deps): bump actions/setup-python from 3.1.2 to 4 [#3439](https://github.com/pomerium/pomerium/pull/3439) (@dependabot[bot])
-- chore(deps): bump actions/setup-python from 4.0.0 to 4.1.0 [#3472](https://github.com/pomerium/pomerium/pull/3472) (@dependabot[bot])
-- chore(deps): bump actions/stale from 5.0.0 to 5.1.0 [#3488](https://github.com/pomerium/pomerium/pull/3488) (@dependabot[bot])
-- chore(deps): bump actions/upload-artifact from 2.3.1 to 3 [#3203](https://github.com/pomerium/pomerium/pull/3203) (@dependabot[bot])
-- chore(deps): bump actions/upload-artifact from 3.0.0 to 3.1.0 [#3374](https://github.com/pomerium/pomerium/pull/3374) (@dependabot[bot])
-- chore(deps): bump async from 2.6.3 to 2.6.4 [#3278](https://github.com/pomerium/pomerium/pull/3278) (@dependabot[bot])
-- chore(deps): bump contrib.go.opencensus.io/exporter/prometheus from 0.4.0 to 0.4.1 [#3164](https://github.com/pomerium/pomerium/pull/3164) (@dependabot[bot])
-- chore(deps): bump docker/build-push-action from 2.10.0 to 3 [#3336](https://github.com/pomerium/pomerium/pull/3336) (@dependabot[bot])
-- chore(deps): bump docker/build-push-action from 3.0.0 to 3.1.0 [#3501](https://github.com/pomerium/pomerium/pull/3501) (@dependabot[bot])
-- chore(deps): bump docker/login-action from 1.14.1 to 2 [#3338](https://github.com/pomerium/pomerium/pull/3338) (@dependabot[bot])
-- chore(deps): bump docker/setup-buildx-action from 1.6.0 to 1.7.0 [#3317](https://github.com/pomerium/pomerium/pull/3317) (@dependabot[bot])
-- chore(deps): bump docker/setup-buildx-action from 1.7.0 to 2 [#3337](https://github.com/pomerium/pomerium/pull/3337) (@dependabot[bot])
-- chore(deps): bump docker/setup-qemu-action from 1.2.0 to 2 [#3339](https://github.com/pomerium/pomerium/pull/3339) (@dependabot[bot])
-- chore(deps): bump eventsource from 1.1.0 to 1.1.1 [#3388](https://github.com/pomerium/pomerium/pull/3388) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.15.3 to 0.15.4 [#3143](https://github.com/pomerium/pomerium/pull/3143) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.15.4 to 0.16.0 [#3198](https://github.com/pomerium/pomerium/pull/3198) (@dependabot[bot])
-- chore(deps): bump github.com/cenkalti/backoff/v4 from 4.1.2 to 4.1.3 [#3264](https://github.com/pomerium/pomerium/pull/3264) (@dependabot[bot])
-- chore(deps): bump github.com/coreos/go-oidc/v3 from 3.1.0 to 3.2.0 [#3360](https://github.com/pomerium/pomerium/pull/3360) (@dependabot[bot])
-- chore(deps): bump github.com/docker/docker from 20.10.12+incompatible to 20.10.13+incompatible [#3142](https://github.com/pomerium/pomerium/pull/3142) (@dependabot[bot])
-- chore(deps): bump github.com/docker/docker from 20.10.13+incompatible to 20.10.14+incompatible [#3199](https://github.com/pomerium/pomerium/pull/3199) (@dependabot[bot])
-- chore(deps): bump github.com/docker/docker from 20.10.14+incompatible to 20.10.15+incompatible [#3335](https://github.com/pomerium/pomerium/pull/3335) (@dependabot[bot])
-- chore(deps): bump github.com/docker/docker from 20.10.15+incompatible to 20.10.16+incompatible [#3359](https://github.com/pomerium/pomerium/pull/3359) (@dependabot[bot])
-- chore(deps): bump github.com/docker/docker from 20.10.16+incompatible to 20.10.17+incompatible [#3417](https://github.com/pomerium/pomerium/pull/3417) (@dependabot[bot])
-- chore(deps): bump github.com/fsnotify/fsnotify from 1.5.1 to 1.5.4 [#3312](https://github.com/pomerium/pomerium/pull/3312) (@dependabot[bot])
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.4 to 8.11.5 [#3166](https://github.com/pomerium/pomerium/pull/3166) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.44.2 to 1.45.0 [#3162](https://github.com/pomerium/pomerium/pull/3162) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.45.0 to 1.45.2 [#3200](https://github.com/pomerium/pomerium/pull/3200) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.45.2 to 1.46.0 [#3334](https://github.com/pomerium/pomerium/pull/3334) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.46.0 to 1.46.1 [#3357](https://github.com/pomerium/pomerium/pull/3357) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.46.1 to 1.46.2 [#3373](https://github.com/pomerium/pomerium/pull/3373) (@dependabot[bot])
-- chore(deps): bump github.com/google/btree from 1.0.1 to 1.1.1 [#3402](https://github.com/pomerium/pomerium/pull/3402) (@dependabot[bot])
-- chore(deps): bump github.com/google/btree from 1.1.1 to 1.1.2 [#3434](https://github.com/pomerium/pomerium/pull/3434) (@dependabot[bot])
-- chore(deps): bump github.com/google/go-cmp from 0.5.7 to 0.5.8 [#3315](https://github.com/pomerium/pomerium/pull/3315) (@dependabot[bot])
-- chore(deps): bump github.com/martinlindhe/base36 from 1.1.0 to 1.1.1 [#3437](https://github.com/pomerium/pomerium/pull/3437) (@dependabot[bot])
-- chore(deps): bump github.com/mholt/acmez from 1.0.2 to 1.0.3 [#3469](https://github.com/pomerium/pomerium/pull/3469) (@dependabot[bot])
-- chore(deps): bump github.com/mitchellh/mapstructure from 1.4.3 to 1.5.0 [#3292](https://github.com/pomerium/pomerium/pull/3292) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.38.0 to 0.38.1 [#3144](https://github.com/pomerium/pomerium/pull/3144) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.38.1 to 0.39.0 [#3232](https://github.com/pomerium/pomerium/pull/3232) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.39.0 to 0.40.0 [#3311](https://github.com/pomerium/pomerium/pull/3311) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.40.0 to 0.41.0 [#3395](https://github.com/pomerium/pomerium/pull/3395) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.41.0 to 0.42.1 [#3468](https://github.com/pomerium/pomerium/pull/3468) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.42.1 to 0.42.2 [#3483](https://github.com/pomerium/pomerium/pull/3483) (@dependabot[bot])
-- chore(deps): bump github.com/ory/dockertest/v3 from 3.8.1 to 3.9.1 [#3381](https://github.com/pomerium/pomerium/pull/3381) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/client_golang from 1.12.1 to 1.12.2 [#3358](https://github.com/pomerium/pomerium/pull/3358) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.32.1 to 0.33.0 [#3230](https://github.com/pomerium/pomerium/pull/3230) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.33.0 to 0.34.0 [#3298](https://github.com/pomerium/pomerium/pull/3298) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.34.0 to 0.35.0 [#3438](https://github.com/pomerium/pomerium/pull/3438) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.35.0 to 0.37.0 [#3486](https://github.com/pomerium/pomerium/pull/3486) (@dependabot[bot])
-- chore(deps): bump github.com/rs/zerolog from 1.26.1 to 1.27.0 [#3418](https://github.com/pomerium/pomerium/pull/3418) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.22.2 to 3.22.3 [#3231](https://github.com/pomerium/pomerium/pull/3231) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.22.3 to 3.22.4 [#3313](https://github.com/pomerium/pomerium/pull/3313) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.22.4 to 3.22.5 [#3396](https://github.com/pomerium/pomerium/pull/3396) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.22.5 to 3.22.6 [#3464](https://github.com/pomerium/pomerium/pull/3464) (@dependabot[bot])
-- chore(deps): bump github.com/spf13/viper from 1.10.1 to 1.11.0 [#3273](https://github.com/pomerium/pomerium/pull/3273) (@dependabot[bot])
-- chore(deps): bump github.com/spf13/viper from 1.11.0 to 1.12.0 [#3380](https://github.com/pomerium/pomerium/pull/3380) (@dependabot[bot])
-- chore(deps): bump github.com/stretchr/testify from 1.7.0 to 1.7.1 [#3165](https://github.com/pomerium/pomerium/pull/3165) (@dependabot[bot])
-- chore(deps): bump github.com/stretchr/testify from 1.7.1 to 1.7.2 [#3397](https://github.com/pomerium/pomerium/pull/3397) (@dependabot[bot])
-- chore(deps): bump github.com/stretchr/testify from 1.7.2 to 1.7.3 [#3435](https://github.com/pomerium/pomerium/pull/3435) (@dependabot[bot])
-- chore(deps): bump github.com/stretchr/testify from 1.7.3 to 1.7.5 [#3448](https://github.com/pomerium/pomerium/pull/3448) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.70.0 to 0.72.0 [#3152](https://github.com/pomerium/pomerium/pull/3152) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.72.0 to 0.73.0 [#3163](https://github.com/pomerium/pomerium/pull/3163) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.73.0 to 0.74.0 [#3233](https://github.com/pomerium/pomerium/pull/3233) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.74.0 to 0.75.0 [#3296](https://github.com/pomerium/pomerium/pull/3296) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.75.0 to 0.77.0 [#3314](https://github.com/pomerium/pomerium/pull/3314) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.77.0 to 0.79.0 [#3347](https://github.com/pomerium/pomerium/pull/3347) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.79.0 to 0.80.0 [#3372](https://github.com/pomerium/pomerium/pull/3372) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.80.0 to 0.81.0 [#3382](https://github.com/pomerium/pomerium/pull/3382) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.81.0 to 0.82.0 [#3401](https://github.com/pomerium/pomerium/pull/3401) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.82.0 to 0.83.0 [#3416](https://github.com/pomerium/pomerium/pull/3416) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.83.0 to 0.84.0 [#3436](https://github.com/pomerium/pomerium/pull/3436) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.84.0 to 0.85.0 [#3447](https://github.com/pomerium/pomerium/pull/3447) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.85.0 to 0.86.0 [#3463](https://github.com/pomerium/pomerium/pull/3463) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.86.0 to 0.87.0 [#3484](https://github.com/pomerium/pomerium/pull/3484) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.87.0 to 0.88.0 [#3500](https://github.com/pomerium/pomerium/pull/3500) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.44.0 to 1.45.0 [#3141](https://github.com/pomerium/pomerium/pull/3141) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.45.0 to 1.46.0 [#3294](https://github.com/pomerium/pomerium/pull/3294) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.46.0 to 1.46.2 [#3361](https://github.com/pomerium/pomerium/pull/3361) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.46.2 to 1.47.0 [#3393](https://github.com/pomerium/pomerium/pull/3393) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.47.0 to 1.48.0 [#3487](https://github.com/pomerium/pomerium/pull/3487) (@dependabot[bot])
-- chore(deps): bump google.golang.org/protobuf from 1.27.1 to 1.28.0 [#3197](https://github.com/pomerium/pomerium/pull/3197) (@dependabot[bot])
-- chore(deps): bump gopkg.in/yaml.v3 from 3.0.0 to 3.0.1 [#3394](https://github.com/pomerium/pomerium/pull/3394) (@dependabot[bot])
-- chore(deps): bump goreleaser/goreleaser-action from 2.9.1 to 3 [#3375](https://github.com/pomerium/pomerium/pull/3375) (@dependabot[bot])
-- chore(deps): bump jandelgado/gcov2lcov-action from 1.0.8 to 1.0.9 [#3376](https://github.com/pomerium/pomerium/pull/3376) (@dependabot[bot])
-- chore(deps): bump jandelgado/gcov2lcov-action from fc567b789b78d676959759edfb9b7a30e884fc1d to 1.0.9 [#3385](https://github.com/pomerium/pomerium/pull/3385) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.21.1 to 4.22.1 [#3145](https://github.com/pomerium/pomerium/pull/3145) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.22.1 to 4.23.1 [#3168](https://github.com/pomerium/pomerium/pull/3168) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.23.1 to 4.24.2 [#3201](https://github.com/pomerium/pomerium/pull/3201) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.24.2 to 4.24.5 [#3276](https://github.com/pomerium/pomerium/pull/3276) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.24.5 to 4.25.1 [#3316](https://github.com/pomerium/pomerium/pull/3316) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.25.1 to 4.25.2 [#3383](https://github.com/pomerium/pomerium/pull/3383) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.25.2 to 4.25.3 [#3449](https://github.com/pomerium/pomerium/pull/3449) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.25.3 to 4.26.1 [#3491](https://github.com/pomerium/pomerium/pull/3491) (@dependabot[bot])
-- chore(deps): bump minimist from 1.2.5 to 1.2.6 [#3189](https://github.com/pomerium/pomerium/pull/3189) (@dependabot[bot])
-- chore(deps): bump minimist from 1.2.5 to 1.2.6 in /ui [#3188](https://github.com/pomerium/pomerium/pull/3188) (@dependabot[bot])
-- chore(deps): bump stefanzweifel/git-auto-commit-action from 4.14.0 to 4.14.1 [#3274](https://github.com/pomerium/pomerium/pull/3274) (@dependabot[bot])
-- deps: bump backport action version [#3224](https://github.com/pomerium/pomerium/pull/3224) (@travisgroth)
-- use generic version of btree [#3404](https://github.com/pomerium/pomerium/pull/3404) (@wasaga)
-
-### Changes
-
-- Allow docs changes without review [#3242](https://github.com/pomerium/pomerium/pull/3242) (@alexfornuto)
-- ci: use forked backport to copy original PR labels [#3223](https://github.com/pomerium/pomerium/pull/3223) (@travisgroth)
-- databroker: support rotating shared secret [#3502](https://github.com/pomerium/pomerium/pull/3502) (@calebdoxsey)
-- deployment: remove vals based entrypoint [#3254](https://github.com/pomerium/pomerium/pull/3254) (@travisgroth)
-- deployment: remove vals based entrypoint [#3254](https://github.com/pomerium/pomerium/pull/3254) (@travisgroth)
-- docs: fix a typo in auth0 config example [#3332](https://github.com/pomerium/pomerium/pull/3332) (@imlonghao)
-- docs: update changelog and upgrade notes for enterprise v0.17 [#3105](https://github.com/pomerium/pomerium/pull/3105) (@travisgroth)
-- github-actions: build docker platforms together [#3426](https://github.com/pomerium/pomerium/pull/3426) (@calebdoxsey)
-- replace fmt.Sprintf with net.JoinHostPort [#3407](https://github.com/pomerium/pomerium/pull/3407) (@cfanbo)
-- Revert "databroker: add support for field masks on Put" [#3217](https://github.com/pomerium/pomerium/pull/3217) (@calebdoxsey)
-- Revert "userinfo: embed assets as data URLs for forward auth" [#3474](https://github.com/pomerium/pomerium/pull/3474) (@calebdoxsey)
-
-## [v0.17.4](https://github.com/pomerium/pomerium/tree/v0.17.4) (2023-05-26)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.17.3...v0.17.4)
-
-### Security
-
-- This release fixes a bug whereby specially crafted requests could result in incorrect authorization decisions made by Pomerium. [CVE-2023-33189](https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p).
-
-## [v0.17.3](https://github.com/pomerium/pomerium/tree/v0.17.3) (2023-05-05)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.17.2...v0.17.3)
-
-### Changes
-
-- authenticate: fix internal service URL CORS check by @calebdoxsey in [https://github.com/pomerium/pomerium/pull/3328](https://github.com/pomerium/pomerium/pull/3328)
-- authenticate: fix internal service URL dashboard redirect by @calebdoxsey in [https://github.com/pomerium/pomerium/pull/3306](https://github.com/pomerium/pomerium/pull/3306)
-- DOCS: Add device identity video [https://github.com/pomerium/pomerium/pull/3307](https://github.com/pomerium/pomerium/pull/3307)
-- DOCS: Update changelog [https://github.com/pomerium/pomerium/pull/3308](https://github.com/pomerium/pomerium/pull/3308)
-- DOCS: update helm values file [https://github.com/pomerium/pomerium/pull/3287](https://github.com/pomerium/pomerium/pull/3287)
-- fix: close the ticker after opened by @clwluvw [https://github.com/pomerium/pomerium/pull/3323](https://github.com/pomerium/pomerium/pull/3323)
-- httputil/reproxy: fix policy transport by @calebdoxsey [https://github.com/pomerium/pomerium/pull/3324](https://github.com/pomerium/pomerium/pull/3324)
-- Update docs for supported Ingress annotations [https://github.com/pomerium/pomerium/pull/3325](https://github.com/pomerium/pomerium/pull/3325)
-
-**Full Changelog**: `https://github.com/pomerium/pomerium/compare/v0.17.2...v0.17.3`
-
-## [v0.17.2](https://github.com/pomerium/pomerium/tree/v0.17.2) (2022-04-22)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.17.1...v0.17.2)
-
-### Fixed
-
-- Add UUID to docs yaml blocks (#3251) [#3259] (@alexfornuto)
-- authorize: pass idp id for webauthn url, allow unauthenticated access to static files [#3284] (@calebdoxsey)
-- config: fix DefaultTransport so it is still a \*http.Transport [#3260] (@calebdoxsey)
-
-### Dependency
-
-- chore(deps): bump actions/setup-python from 3.1.0 to 3.1.2 [#3266]
-
-## [v0.17.1](https://github.com/pomerium/pomerium/tree/v0.17.1) (2022-03-30)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.17.0...v0.17.1)
-
-### Security Notice
-
-This release includes a fix to a medium severity [security issue](https://github.com/pomerium/pomerium/security/advisories/GHSA-q98f-2x4p-prjr).
-
-We recommend that all users upgrade.
-
-### Security
-
-- authenticate: fix debug and metrics endpoints [#3215](https://github.com/pomerium/pomerium/pull/3215) (@backport-actions-token[bot])
-
-### Fixed
-
-- authenticate: fix internal url with webauthn [#3195](https://github.com/pomerium/pomerium/pull/3195) (@backport-actions-token[bot])
-- github: fix missing groups [#3176](https://github.com/pomerium/pomerium/pull/3176) (@backport-actions-token[bot])
-
-## [v0.17.0](https://github.com/pomerium/pomerium/tree/v0.17.0) (2022-03-04)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.16.4...v0.17.0)
-
-### New
-
-- adds pomerium version to the user info endpoint [#3093](https://github.com/pomerium/pomerium/pull/3093) (@nhayfield)
-- authenticate: add device-enrolled page [#2892](https://github.com/pomerium/pomerium/pull/2892) (@calebdoxsey)
-- authenticate: fix expiring user info endpoint [#2976](https://github.com/pomerium/pomerium/pull/2976) (@calebdoxsey)
-- controlplane: add compression middleware [#3000](https://github.com/pomerium/pomerium/pull/3000) (@calebdoxsey)
-- directory: save IDP errors to databroker, put event handling in dedicated package [#2957](https://github.com/pomerium/pomerium/pull/2957) (@calebdoxsey)
-- frontend: react+mui [#3004](https://github.com/pomerium/pomerium/pull/3004) (@calebdoxsey)
-- google: support groups for users outside of the organization [#2950](https://github.com/pomerium/pomerium/pull/2950) (@calebdoxsey)
-- grpc: remove ptypes references [#3078](https://github.com/pomerium/pomerium/pull/3078) (@calebdoxsey)
-- last known metric error [#2974](https://github.com/pomerium/pomerium/pull/2974) (@wasaga)
-- remove deprecated ioutil usages [#2877](https://github.com/pomerium/pomerium/pull/2877) (@cfanbo)
-- return explicit error when directory sync is disabled [#2949](https://github.com/pomerium/pomerium/pull/2949) (@wasaga)
-- session: remove unused session state properties [#3022](https://github.com/pomerium/pomerium/pull/3022) (@calebdoxsey)
-- Style update for User Info Endpoint [#3055](https://github.com/pomerium/pomerium/pull/3055) (@nhayfield)
-- userinfo: add webauthn buttons to user info page [#3075](https://github.com/pomerium/pomerium/pull/3075) (@calebdoxsey)
-
-### Fixed
-
-- auth0: support explicit domains in the service account [#2980](https://github.com/pomerium/pomerium/pull/2980) (@calebdoxsey)
-- auth0: support explicit domains in the service account [#2996](https://github.com/pomerium/pomerium/pull/2996) (@backport-actions-token[bot])
-- authenticate: add callback endpoint [#2931](https://github.com/pomerium/pomerium/pull/2931) (@calebdoxsey)
-- authenticate: support webauthn redirects to non-pomerium domains [#2936](https://github.com/pomerium/pomerium/pull/2936) (@calebdoxsey)
-- config: fix httptest local certificate [#3056](https://github.com/pomerium/pomerium/pull/3056) (@calebdoxsey)
-- config: fix policy matching for regular expressions [#2966](https://github.com/pomerium/pomerium/pull/2966) (@calebdoxsey)
-- config: fix TLS config when address and grpc_address are the same [#2975](https://github.com/pomerium/pomerium/pull/2975) (@calebdoxsey)
-- databroker: use contextual logging for errors, use original record type for encryption [#3096](https://github.com/pomerium/pomerium/pull/3096) (@calebdoxsey)
-- deployment: enable goreleaser buildx [#2968](https://github.com/pomerium/pomerium/pull/2968) (@travisgroth)
-- deployment: fix distroless base arch [#2925](https://github.com/pomerium/pomerium/pull/2925) (@travisgroth)
-- deployment: only include pomerium binary [#3007](https://github.com/pomerium/pomerium/pull/3007) (@travisgroth)
-- devices: shrink credentials by removing unnecessary data [#2951](https://github.com/pomerium/pomerium/pull/2951) (@calebdoxsey)
-- devices: treat undefined device types as any [#2927](https://github.com/pomerium/pomerium/pull/2927) (@calebdoxsey)
-- envoy: check certificates for must-staple flag and drop them if they are missing the response [#2909](https://github.com/pomerium/pomerium/pull/2909) (@calebdoxsey)
-- fix link for picture in avatar [#3066](https://github.com/pomerium/pomerium/pull/3066) (@nhayfield)
-- fix: frontend html tag mismatch [#2954](https://github.com/pomerium/pomerium/pull/2954) (@cfanbo)
-- handle device states in deny block, fix default device type [#2919](https://github.com/pomerium/pomerium/pull/2919) (@calebdoxsey)
-- integration: fix default port for verify service [#2895](https://github.com/pomerium/pomerium/pull/2895) (@calebdoxsey)
-- proxy: fix error page [#3020](https://github.com/pomerium/pomerium/pull/3020) (@calebdoxsey)
-- Remove spurious \ tags [#2946](https://github.com/pomerium/pomerium/pull/2946) (@sylr)
-- userinfo: fix logout button, add sign out confirm page [#3058](https://github.com/pomerium/pomerium/pull/3058) (@calebdoxsey)
-- webauthn: use absolute URL for delete redirect [#2935](https://github.com/pomerium/pomerium/pull/2935) (@calebdoxsey)
-
-### Dependency
-
-- chore(deps): bump actions/setup-node from 2 to 3 [#3089](https://github.com/pomerium/pomerium/pull/3089) (@dependabot[bot])
-- chore(deps): bump actions/setup-python from 2 to 3 [#3088](https://github.com/pomerium/pomerium/pull/3088) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.20.2 to 4.21.1 [#3087](https://github.com/pomerium/pomerium/pull/3087) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.69.0 to 0.70.0 [#3086](https://github.com/pomerium/pomerium/pull/3086) (@dependabot[bot])
-- chore(deps): bump url-parse from 1.5.7 to 1.5.10 [#3085](https://github.com/pomerium/pomerium/pull/3085) (@dependabot[bot])
-- chore(deps): bump prismjs from 1.26.0 to 1.27.0 [#3084](https://github.com/pomerium/pomerium/pull/3084) (@dependabot[bot])
-- deps: bump envoy to v1.20.2 [#3082](https://github.com/pomerium/pomerium/pull/3082) (@travisgroth)
-- chore(deps): bump mikefarah/yq from 4.20.1 to 4.20.2 [#3072](https://github.com/pomerium/pomerium/pull/3072) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.68.0 to 0.69.0 [#3071](https://github.com/pomerium/pomerium/pull/3071) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.44.0 to 1.44.2 [#3070](https://github.com/pomerium/pomerium/pull/3070) (@dependabot[bot])
-- chore(deps): bump url-parse from 1.5.1 to 1.5.7 [#3068](https://github.com/pomerium/pomerium/pull/3068) (@dependabot[bot])
-- chore(deps): bump github.com/gorilla/websocket from 1.4.2 to 1.5.0 [#3052](https://github.com/pomerium/pomerium/pull/3052) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.18.1 to 4.20.1 [#3051](https://github.com/pomerium/pomerium/pull/3051) (@dependabot[bot])
-- chore(deps): bump follow-redirects from 1.14.7 to 1.14.8 [#3043](https://github.com/pomerium/pomerium/pull/3043) (@dependabot[bot])
-- chore(deps): bump go.uber.org/zap from 1.20.0 to 1.21.0 [#3041](https://github.com/pomerium/pomerium/pull/3041) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.37.1 to 0.37.2 [#3040](https://github.com/pomerium/pomerium/pull/3040) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.66.0 to 0.68.0 [#3033](https://github.com/pomerium/pomerium/pull/3033) (@dependabot[bot])
-- deps: increase yarn network timeout [#3018](https://github.com/pomerium/pomerium/pull/3018) (@travisgroth)
-- chore(deps): bump github.com/caddyserver/certmagic from 0.15.2 to 0.15.3 [#3014](https://github.com/pomerium/pomerium/pull/3014) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.36.1 to 0.37.1 [#3013](https://github.com/pomerium/pomerium/pull/3013) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.12 to 3.22.1 [#3012](https://github.com/pomerium/pomerium/pull/3012) (@dependabot[bot])
-- chore(deps): bump github.com/mholt/acmez from 1.0.1 to 1.0.2 [#3011](https://github.com/pomerium/pomerium/pull/3011) (@dependabot[bot])
-- chore(deps): bump mermaid from 8.12.1 to 8.13.10 [#3010](https://github.com/pomerium/pomerium/pull/3010) (@dependabot[bot])
-- chore(deps): bump follow-redirects from 1.14.1 to 1.14.7 [#3009](https://github.com/pomerium/pomerium/pull/3009) (@dependabot[bot])
-- chore(deps): bump prismjs from 1.24.1 to 1.26.0 [#3008](https://github.com/pomerium/pomerium/pull/3008) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.17.2 to 4.18.1 [#2989](https://github.com/pomerium/pomerium/pull/2989) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.43.0 to 1.44.0 [#2988](https://github.com/pomerium/pomerium/pull/2988) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.43.0 to 1.44.0 [#2987](https://github.com/pomerium/pomerium/pull/2987) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.65.0 to 0.66.0 [#2986](https://github.com/pomerium/pomerium/pull/2986) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/client_golang from 1.12.0 to 1.12.1 [#2985](https://github.com/pomerium/pomerium/pull/2985) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.16.2 to 4.17.2 [#2963](https://github.com/pomerium/pomerium/pull/2963) (@dependabot[bot])
-- chore(deps): bump github.com/google/go-cmp from 0.5.6 to 0.5.7 [#2962](https://github.com/pomerium/pomerium/pull/2962) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/client_golang from 1.11.0 to 1.12.0 [#2961](https://github.com/pomerium/pomerium/pull/2961) (@dependabot[bot])
-- chore(deps): bump github.com/openzipkin/zipkin-go from 0.3.0 to 0.4.0 [#2942](https://github.com/pomerium/pomerium/pull/2942) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.64.0 to 0.65.0 [#2941](https://github.com/pomerium/pomerium/pull/2941) (@dependabot[bot])
-- chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.6.2 to 0.6.3 [#2940](https://github.com/pomerium/pomerium/pull/2940) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.36.0 to 0.36.1 [#2939](https://github.com/pomerium/pomerium/pull/2939) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.63.0 to 0.64.0 [#2913](https://github.com/pomerium/pomerium/pull/2913) (@dependabot[bot])
-- chore(deps): bump go.uber.org/zap from 1.19.1 to 1.20.0 [#2912](https://github.com/pomerium/pomerium/pull/2912) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.35.0 to 0.36.0 [#2911](https://github.com/pomerium/pomerium/pull/2911) (@dependabot[bot])
-- chore(deps): bump github.com/go-chi/chi from 1.5.4 to 4.1.2+incompatible [#2910](https://github.com/pomerium/pomerium/pull/2910) (@dependabot[bot])
-- envoy: upgrade to 1.20.1 [#2902](https://github.com/pomerium/pomerium/pull/2902) (@calebdoxsey)
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.11 to 3.21.12 [#2886](https://github.com/pomerium/pomerium/pull/2886) (@dependabot[bot])
-- chore(deps): bump github.com/rs/cors from 1.8.0 to 1.8.2 [#2855](https://github.com/pomerium/pomerium/pull/2855) (@dependabot[bot])
-- chore(deps): bump github.com/google/go-jsonnet from 0.17.0 to 0.18.0 [#2854](https://github.com/pomerium/pomerium/pull/2854) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.16.1 to 4.16.2 [#2853](https://github.com/pomerium/pomerium/pull/2853) (@dependabot[bot])
-
-#### Deployment
-
-- deployment: remove DST cert workaround from debug image [#2958](https://github.com/pomerium/pomerium/pull/2958) (@travisgroth)
-- deployment: multi-arch master images [#2896](https://github.com/pomerium/pomerium/pull/2896) (@travisgroth)
-
-### Changed
-
-- config: add idp_client_id and idp_client_secret to protobuf [#3060](https://github.com/pomerium/pomerium/pull/3060) (@calebdoxsey)
-- Extract email for active directory users that don't have access to exchange [#3053](https://github.com/pomerium/pomerium/pull/3053) (@JBodkin-Amphora)
-- disable blank github issues [#2898](https://github.com/pomerium/pomerium/pull/2898) (@travisgroth)
-
-## [v0.16.4](https://github.com/pomerium/pomerium/tree/v0.16.4) (2022-02-25)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.16.3...v0.16.4)
-
-### Dependency
-
-- deps: update envoy to v1.19.3 [#3083](https://github.com/pomerium/pomerium/pull/3083) (@travisgroth)
-
-## [v0.16.3](https://github.com/pomerium/pomerium/tree/v0.16.3) (2022-02-11)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.16.2...v0.16.3)
-
-### Fixed
-
-- deployment: only include pomerium binary [#3007](https://github.com/pomerium/pomerium/pull/3007) (@travisgroth)
-- auth0: support explicit domains in the service account [#2996](https://github.com/pomerium/pomerium/pull/2996) (@backport-actions-token[bot])
-
-## [v0.16.2](https://github.com/pomerium/pomerium/tree/v0.16.2) (2022-01-25)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.16.1...v0.16.2)
-
-### Fixed
-
-- config: fix policy matching for regular expressions [#2969](https://github.com/pomerium/pomerium/pull/2969) (@backport-actions-token[bot])
-
-## [v0.16.1](https://github.com/pomerium/pomerium/tree/v0.16.1) (2022-01-19)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.16.0...v0.16.1)
-
-### Fixed
-
-- webauthn: use absolute URL for delete redirect [#2937](https://github.com/pomerium/pomerium/pull/2937) (@backport-actions-token[bot])
-- handle device states in deny block, fix default device type [#2924](https://github.com/pomerium/pomerium/pull/2924) (@backport-actions-token[bot])
-- integration: fix default port for verify service [#2908](https://github.com/pomerium/pomerium/pull/2908) (@backport-actions-token[bot])
-
-## [v0.16.0](https://github.com/pomerium/pomerium/tree/v0.16.0) (2021-12-22)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.8...v0.16.0)
-
-### Breaking
-
-- identity: only assign `access\_type` uri params to google. [#2782](https://github.com/pomerium/pomerium/pull/2782) (@desimone)
-- tls: fallback to self-signed certificate [#2760](https://github.com/pomerium/pomerium/pull/2760) (@calebdoxsey)
-- github: use GraphQL API to reduce number of API calls for directory sync [#2715](https://github.com/pomerium/pomerium/pull/2715) (@calebdoxsey)
-
-### New
-
-- more idp metrics [#2842](https://github.com/pomerium/pomerium/pull/2842) (@wasaga)
-- devices: add experimental icon [#2836](https://github.com/pomerium/pomerium/pull/2836) (@calebdoxsey)
-- devices: switch "default" device type to two built-in default device types [#2835](https://github.com/pomerium/pomerium/pull/2835) (@calebdoxsey)
-- dashboard: improve display of device credentials, allow deletion [#2829](https://github.com/pomerium/pomerium/pull/2829) (@calebdoxsey)
-- ppl: add support for http_path and http_method [#2813](https://github.com/pomerium/pomerium/pull/2813) (@calebdoxsey)
-- config: add internal service URLs [#2801](https://github.com/pomerium/pomerium/pull/2801) (@calebdoxsey)
-- envoy: add hash policy and routing key for hash-based load balancers [#2791](https://github.com/pomerium/pomerium/pull/2791) (@calebdoxsey)
-- authorize: support X-Pomerium-Authorization in addition to Authorization [#2780](https://github.com/pomerium/pomerium/pull/2780) (@calebdoxsey)
-- envoy: treat configuration errors as fatal [#2777](https://github.com/pomerium/pomerium/pull/2777) (@calebdoxsey)
-- envoy: add support for bind_config bootstrap options [#2772](https://github.com/pomerium/pomerium/pull/2772) (@calebdoxsey)
-- authenticate: redirect / to /.pomerium/ [#2770](https://github.com/pomerium/pomerium/pull/2770) (@calebdoxsey)
-- device: add type id and credential id to enrollment for easier referencing [#2749](https://github.com/pomerium/pomerium/pull/2749) (@calebdoxsey)
-- databroker: add additional log for config source [#2718](https://github.com/pomerium/pomerium/pull/2718) (@calebdoxsey)
-- grpc: remove peer field from logs [#2712](https://github.com/pomerium/pomerium/pull/2712) (@calebdoxsey)
-- desktop client api [#2711](https://github.com/pomerium/pomerium/pull/2711) (@wasaga)
-- telemetry: improve zipkin error logs [#2710](https://github.com/pomerium/pomerium/pull/2710) (@calebdoxsey)
-- authorize: add support for webauthn device policy enforcement [#2700](https://github.com/pomerium/pomerium/pull/2700) (@calebdoxsey)
-- webauthn: update session to support device credentials per type [#2699](https://github.com/pomerium/pomerium/pull/2699) (@calebdoxsey)
-- ppl: add support for additional data [#2696](https://github.com/pomerium/pomerium/pull/2696) (@calebdoxsey)
-- Add additional ACME CA (autocert) options [#2695](https://github.com/pomerium/pomerium/pull/2695) (@hslatman)
-- skip configuration updates to the most recent one [#2690](https://github.com/pomerium/pomerium/pull/2690) (@wasaga)
-- authenticate: add support for webauthn [#2688](https://github.com/pomerium/pomerium/pull/2688) (@calebdoxsey)
-- webauthnutil: add helpers for webauthn [#2686](https://github.com/pomerium/pomerium/pull/2686) (@calebdoxsey)
-- devices: add device protobuf types [#2682](https://github.com/pomerium/pomerium/pull/2682) (@calebdoxsey)
-- cryptutil: add SecureToken [#2681](https://github.com/pomerium/pomerium/pull/2681) (@calebdoxsey)
-- config/envoyconfig: better duplicate message [#2661](https://github.com/pomerium/pomerium/pull/2661) (@desimone)
-- pomerium-cli: add support for a custom browser command [#2617](https://github.com/pomerium/pomerium/pull/2617) (@calebdoxsey)
-- ppl: pass contextual information through policy [#2612](https://github.com/pomerium/pomerium/pull/2612) (@calebdoxsey)
-- add description to service accounts [#2611](https://github.com/pomerium/pomerium/pull/2611) (@nhayfield)
-- DOCS: Add copy button to code snippets [#2597](https://github.com/pomerium/pomerium/pull/2597) (@alexfornuto)
-- pomerium-cli: use cache dir instead of config dir [#2588](https://github.com/pomerium/pomerium/pull/2588) (@calebdoxsey)
-- cli: update tcp log output format [#2586](https://github.com/pomerium/pomerium/pull/2586) (@travisgroth)
-- directory: implement exponential backoff for refresh [#2570](https://github.com/pomerium/pomerium/pull/2570) (@calebdoxsey)
-- google: support provider URL [#2567](https://github.com/pomerium/pomerium/pull/2567) (@calebdoxsey)
-- config: remove signature_key_algorithm [#2557](https://github.com/pomerium/pomerium/pull/2557) (@calebdoxsey)
-- allow pomerium to start without certs [#2555](https://github.com/pomerium/pomerium/pull/2555) (@wasaga)
-- integration: kubernetes support [#2536](https://github.com/pomerium/pomerium/pull/2536) (@calebdoxsey)
-- integration: nginx [#2532](https://github.com/pomerium/pomerium/pull/2532) (@calebdoxsey)
-- integration: add traefik tests [#2530](https://github.com/pomerium/pomerium/pull/2530) (@calebdoxsey)
-- envoy: remove deprecated access_log_path [#2523](https://github.com/pomerium/pomerium/pull/2523) (@calebdoxsey)
-- config: remove headers [#2522](https://github.com/pomerium/pomerium/pull/2522) (@calebdoxsey)
-- integration: add multi test [#2519](https://github.com/pomerium/pomerium/pull/2519) (@calebdoxsey)
-- Remove api from GitLab defaultScope [#2518](https://github.com/pomerium/pomerium/pull/2518) (@alexfornuto)
-- integration: add single-cluster integration tests [#2516](https://github.com/pomerium/pomerium/pull/2516) (@calebdoxsey)
-- integration: remove tests [#2514](https://github.com/pomerium/pomerium/pull/2514) (@calebdoxsey)
-- github: support provider URL [#2490](https://github.com/pomerium/pomerium/pull/2490) (@calebdoxsey)
-- protoutil: add NewAny method for deterministic serialization [#2462](https://github.com/pomerium/pomerium/pull/2462) (@calebdoxsey)
-- fix go get, improve redis test [#2450](https://github.com/pomerium/pomerium/pull/2450) (@calebdoxsey)
-- all: remove unused handler code [#2439](https://github.com/pomerium/pomerium/pull/2439) (@desimone)
-
-### Security
-
-- identity: fix user refresh [#2724](https://github.com/pomerium/pomerium/pull/2724) (@calebdoxsey)
-- deps: update envoy to 1.19.1 [#2526](https://github.com/pomerium/pomerium/pull/2526) (@travisgroth)
-
-### Fixed
-
-- add docs for ingress regex path [#2822](https://github.com/pomerium/pomerium/pull/2822) (@wasaga)
-- Add docs team as a code owner of packages.json [#2605](https://github.com/pomerium/pomerium/pull/2605) (@alexfornuto)
-- Add redirect for installation [#2618](https://github.com/pomerium/pomerium/pull/2618) (@alexfornuto)
-- add service account redirects [#2664](https://github.com/pomerium/pomerium/pull/2664) (@alexfornuto)
-- adjust comment blocking [#2488](https://github.com/pomerium/pomerium/pull/2488) (@alexfornuto)
-- adjust sidebarDepths and document Desktop Client releases [#2643](https://github.com/pomerium/pomerium/pull/2643) (@alexfornuto)
-- adjust sidebarDepths and document Desktop Client releases [#2645](https://github.com/pomerium/pomerium/pull/2645) (@backport-actions-token[bot])
-- Auth0 Doc Refresh [#2494](https://github.com/pomerium/pomerium/pull/2494) (@alexfornuto)
-- config: allow specifying auto codec type in all-in-one mode [#2846](https://github.com/pomerium/pomerium/pull/2846) (@calebdoxsey)
-- config: detect changes to the kubernetes service account token file [#2767](https://github.com/pomerium/pomerium/pull/2767) (@calebdoxsey)
-- Copy edit to changelog entry [#2786](https://github.com/pomerium/pomerium/pull/2786) (@alexfornuto)
-- dashboard: add confirmation dialog, fix button in firefox [#2841](https://github.com/pomerium/pomerium/pull/2841) (@calebdoxsey)
-- deps: update goreleaser [#2757](https://github.com/pomerium/pomerium/pull/2757) (@travisgroth)
-- DOC: Copy edits to Okta IdP doc. [#2623](https://github.com/pomerium/pomerium/pull/2623) (@alexfornuto)
-- Docs: Add Grafana Integration Guide [#2742](https://github.com/pomerium/pomerium/pull/2742) (@alexfornuto)
-- DOCS: add Grafana to Guides index [#2808](https://github.com/pomerium/pomerium/pull/2808) (@alexfornuto)
-- Docs: Add spdy annotation [#2747](https://github.com/pomerium/pomerium/pull/2747) (@alexfornuto)
-- docs: add updated icon asset [#2580](https://github.com/pomerium/pomerium/pull/2580) (@travisgroth)
-- Docs: Batch Updates [#2628](https://github.com/pomerium/pomerium/pull/2628) (@alexfornuto)
-- docs: clarify custom request header limitations [#2471](https://github.com/pomerium/pomerium/pull/2471) (@desimone)
-- DOCS: Collapse IDP Header [#2641](https://github.com/pomerium/pomerium/pull/2641) (@alexfornuto)
-- Docs: Correct Claim Example [#2689](https://github.com/pomerium/pomerium/pull/2689) (@alexfornuto)
-- DOCS: CORS preflight in console [#2642](https://github.com/pomerium/pomerium/pull/2642) (@alexfornuto)
-- DOCS: Create Consolidated Troubleshooting Guide and Replace FAQ [#2797](https://github.com/pomerium/pomerium/pull/2797) (@alexfornuto)
-- Docs: cross-reference links between concepts and reference [#2648](https://github.com/pomerium/pomerium/pull/2648) (@alexfornuto)
-- docs: enterprise console v0.15.2 changelog [#2564](https://github.com/pomerium/pomerium/pull/2564) (@travisgroth)
-- docs: enterprise v0.15.1 changelog [#2542](https://github.com/pomerium/pomerium/pull/2542) (@travisgroth)
-- DOCS: Fix indentation in API doc [#2798](https://github.com/pomerium/pomerium/pull/2798) (@alexfornuto)
-- Docs: Fix merged PR [#2546](https://github.com/pomerium/pomerium/pull/2546) (@alexfornuto)
-- Docs: Reference gRPC API Docs [#2717](https://github.com/pomerium/pomerium/pull/2717) (@alexfornuto)
-- docs: remove extra word / updated docs link [#2638](https://github.com/pomerium/pomerium/pull/2638) (@cmo-pomerium)
-- docs: rename updated icon image [#2582](https://github.com/pomerium/pomerium/pull/2582) (@travisgroth)
-- DOCS: Standardize Relative Links [#2651](https://github.com/pomerium/pomerium/pull/2651) (@alexfornuto)
-- docs: update branding [#2435](https://github.com/pomerium/pomerium/pull/2435) (@desimone)
-- docs: update branding, concepts [#2445](https://github.com/pomerium/pomerium/pull/2445) (@desimone)
-- docs: update codeowners [#2451](https://github.com/pomerium/pomerium/pull/2451) (@travisgroth)
-- Docs: Update Community Page [#2713](https://github.com/pomerium/pomerium/pull/2713) (@cmo-pomerium)
-- docs: update default version to v0.15 [#2437](https://github.com/pomerium/pomerium/pull/2437) (@travisgroth)
-- docs: update enterprise helm instructions to use main repo [#2463](https://github.com/pomerium/pomerium/pull/2463) (@travisgroth)
-- DOCS: Update Enterprise Reference Docs [#2599](https://github.com/pomerium/pomerium/pull/2599) (@alexfornuto)
-- Docs: Update JWT Verification Guide [#2746](https://github.com/pomerium/pomerium/pull/2746) (@alexfornuto)
-- Docs: Update Kubernetes Dashboard Guide [#2759](https://github.com/pomerium/pomerium/pull/2759) (@alexfornuto)
-- docs: update pomerium-cli location [#2790](https://github.com/pomerium/pomerium/pull/2790) (@travisgroth)
-- Docs: Update Securing Kubernetes Guide [#2758](https://github.com/pomerium/pomerium/pull/2758) (@alexfornuto)
-- Docs: Update Traefik Example Headers [#2732](https://github.com/pomerium/pomerium/pull/2732) (@alexfornuto)
-- docs: use generic email [#2484](https://github.com/pomerium/pomerium/pull/2484) (@alexfornuto)
-- Docs/batch link fixes [#2621](https://github.com/pomerium/pomerium/pull/2621) (@alexfornuto)
-- document binding service to 443 [#2487](https://github.com/pomerium/pomerium/pull/2487) (@alexfornuto)
-- Document Enterprise API [#2595](https://github.com/pomerium/pomerium/pull/2595) (@alexfornuto)
-- Document moving routes [#2460](https://github.com/pomerium/pomerium/pull/2460) (@alexfornuto)
-- Document Pomerium Policy Language [#2784](https://github.com/pomerium/pomerium/pull/2784) (@alexfornuto)
-- Document Pomerium Policy Language [#2789](https://github.com/pomerium/pomerium/pull/2789) (@backport-actions-token[bot])
-- Document recovery token generation [#2579](https://github.com/pomerium/pomerium/pull/2579) (@alexfornuto)
-- Document tracing sample rate in console [#2461](https://github.com/pomerium/pomerium/pull/2461) (@alexfornuto)
-- Enterprise Upgrade & Changelog Pages [#2453](https://github.com/pomerium/pomerium/pull/2453) (@alexfornuto)
-- envoyconfig: fix tls_downstream_client_ca for non-standard ports [#2802](https://github.com/pomerium/pomerium/pull/2802) (@calebdoxsey)
-- Fix IdP client metrics [#2810](https://github.com/pomerium/pomerium/pull/2810) (@travisgroth)
-- Fix typo in docs [#2683](https://github.com/pomerium/pomerium/pull/2683) (@nihaals)
-- fix typo in docs [#2819](https://github.com/pomerium/pomerium/pull/2819) (@wasaga)
-- fix: Fixed return description error [#2825](https://github.com/pomerium/pomerium/pull/2825) (@cfanbo)
-- Fixed 'kubtctl' typo on releases page [#2673](https://github.com/pomerium/pomerium/pull/2673) (@ChaosInTheCRD)
-- internal/telemetry: fix grpc server metrics [#2811](https://github.com/pomerium/pomerium/pull/2811) (@travisgroth)
-- Minor fix in routes documentation [#2714](https://github.com/pomerium/pomerium/pull/2714) (@Kerwood)
-- New Topic Page: Original Request Context [#2569](https://github.com/pomerium/pomerium/pull/2569) (@alexfornuto)
-- Refresh and Update TCP documentation [#2627](https://github.com/pomerium/pomerium/pull/2627) (@alexfornuto)
-- Remove forward_auth_url from Enterprise [#2779](https://github.com/pomerium/pomerium/pull/2779) (@alexfornuto)
-- specify expected audience in Console config [#2442](https://github.com/pomerium/pomerium/pull/2442) (@alexfornuto)
-- TCP Client Doc [#2561](https://github.com/pomerium/pomerium/pull/2561) (@alexfornuto)
-- typo [#2644](https://github.com/pomerium/pomerium/pull/2644) (@alexfornuto)
-- Update AWS cognito IdP doc [#2498](https://github.com/pomerium/pomerium/pull/2498) (@alexfornuto)
-- Update Azure IdP Doc [#2497](https://github.com/pomerium/pomerium/pull/2497) (@alexfornuto)
-- Update binary install doc [#2447](https://github.com/pomerium/pomerium/pull/2447) (@alexfornuto)
-- Update CODEOWNERS [#2603](https://github.com/pomerium/pomerium/pull/2603) (@alexfornuto)
-- Update create TLS command to quote strings. [#2694](https://github.com/pomerium/pomerium/pull/2694) (@FutureMatt)
-- Update Docker Quickstart [#2482](https://github.com/pomerium/pomerium/pull/2482) (@alexfornuto)
-- update GitHub IdP doc [#2503](https://github.com/pomerium/pomerium/pull/2503) (@alexfornuto)
-- Update GitLab IdP doc [#2520](https://github.com/pomerium/pomerium/pull/2520) (@alexfornuto)
-- Update Helm Instructions [#2467](https://github.com/pomerium/pomerium/pull/2467) (@alexfornuto)
-- Update IdP Overview Page [#2493](https://github.com/pomerium/pomerium/pull/2493) (@alexfornuto)
-- Update Okta IdP doc [#2491](https://github.com/pomerium/pomerium/pull/2491) (@alexfornuto)
-- update OneLogin IdP doc [#2533](https://github.com/pomerium/pomerium/pull/2533) (@alexfornuto)
-- Update overview/architecture.md [#2701](https://github.com/pomerium/pomerium/pull/2701) (@cmo-pomerium)
-- Update Ping Identity IdP [#2537](https://github.com/pomerium/pomerium/pull/2537) (@alexfornuto)
-- Updates to Enterprise Quickstart instructions [#2480](https://github.com/pomerium/pomerium/pull/2480) (@alexfornuto)
-- wrap header example values as inline code. [#2474](https://github.com/pomerium/pomerium/pull/2474) (@alexfornuto)
-- Wrap mkcert command in quotes [#2481](https://github.com/pomerium/pomerium/pull/2481) (@alexfornuto)
-
-### Dependency
-
-- chore(deps): bump google.golang.org/api from 0.62.0 to 0.63.0 [#2834](https://github.com/pomerium/pomerium/pull/2834) (@dependabot[bot])
-- chore(deps): bump github.com/rs/zerolog from 1.26.0 to 1.26.1 [#2833](https://github.com/pomerium/pomerium/pull/2833) (@dependabot[bot])
-- chore(deps): bump github.com/spf13/viper from 1.10.0 to 1.10.1 [#2832](https://github.com/pomerium/pomerium/pull/2832) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.42.0 to 1.43.0 [#2831](https://github.com/pomerium/pomerium/pull/2831) (@dependabot[bot])
-- chore(deps): bump github.com/docker/docker from 20.10.11+incompatible to 20.10.12+incompatible [#2817](https://github.com/pomerium/pomerium/pull/2817) (@dependabot[bot])
-- chore(deps): bump github.com/spf13/viper from 1.9.0 to 1.10.0 [#2816](https://github.com/pomerium/pomerium/pull/2816) (@dependabot[bot])
-- dev build support for darwin-arm64 from envoy tip [#2815](https://github.com/pomerium/pomerium/pull/2815) (@wasaga)
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.10 to 3.21.11 [#2807](https://github.com/pomerium/pomerium/pull/2807) (@dependabot[bot])
-- chore(deps): bump github.com/mitchellh/mapstructure from 1.4.2 to 1.4.3 [#2806](https://github.com/pomerium/pomerium/pull/2806) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.60.0 to 0.61.0 [#2805](https://github.com/pomerium/pomerium/pull/2805) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.34.2 to 0.35.0 [#2804](https://github.com/pomerium/pomerium/pull/2804) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.15.1 to 4.16.1 [#2803](https://github.com/pomerium/pomerium/pull/2803) (@dependabot[bot])
-- chore(deps): bump github.com/ory/dockertest/v3 from 3.8.0 to 3.8.1 [#2785](https://github.com/pomerium/pomerium/pull/2785) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.14.2 to 4.15.1 [#2783](https://github.com/pomerium/pomerium/pull/2783) (@dependabot[bot])
-- chore(deps): bump github.com/docker/docker from 20.10.10+incompatible to 20.10.11+incompatible [#2776](https://github.com/pomerium/pomerium/pull/2776) (@dependabot[bot])
-- chore(deps): bump coverallsapp/github-action from 1.1.2 to 1.1.3 [#2775](https://github.com/pomerium/pomerium/pull/2775) (@dependabot[bot])
-- chore(deps): bump mikefarah/yq from 4.6.3 to 4.14.2 [#2774](https://github.com/pomerium/pomerium/pull/2774) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.15.1 to 0.15.2 [#2769](https://github.com/pomerium/pomerium/pull/2769) (@dependabot[bot])
-- chore(deps): bump github.com/cenkalti/backoff/v4 from 4.1.1 to 4.1.2 [#2768](https://github.com/pomerium/pomerium/pull/2768) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.34.1 to 0.34.2 [#2765](https://github.com/pomerium/pomerium/pull/2765) (@dependabot[bot])
-- chore(deps): bump github.com/mholt/acmez from 1.0.0 to 1.0.1 [#2764](https://github.com/pomerium/pomerium/pull/2764) (@dependabot[bot])
-- chore(deps): bump gopkg.in/auth0.v5 from 5.21.0 to 5.21.1 [#2763](https://github.com/pomerium/pomerium/pull/2763) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.42.1 to 1.43.0 [#2756](https://github.com/pomerium/pomerium/pull/2756) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.34.0 to 0.34.1 [#2755](https://github.com/pomerium/pomerium/pull/2755) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.41.0 to 1.42.0 [#2754](https://github.com/pomerium/pomerium/pull/2754) (@dependabot[bot])
-- chore(deps): bump github.com/rs/zerolog from 1.25.0 to 1.26.0 [#2753](https://github.com/pomerium/pomerium/pull/2753) (@dependabot[bot])
-- chore(deps): bump gopkg.in/auth0.v5 from 5.20.0 to 5.21.0 [#2752](https://github.com/pomerium/pomerium/pull/2752) (@dependabot[bot])
-- dependencies: vendor base58, remove shortuuid [#2739](https://github.com/pomerium/pomerium/pull/2739) (@calebdoxsey)
-- chore(deps): bump google.golang.org/api from 0.58.0 to 0.60.0 [#2737](https://github.com/pomerium/pomerium/pull/2737) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.9 to 3.21.10 [#2736](https://github.com/pomerium/pomerium/pull/2736) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.33.1 to 0.34.0 [#2735](https://github.com/pomerium/pomerium/pull/2735) (@dependabot[bot])
-- chore(deps): bump github.com/openzipkin/zipkin-go from 0.2.5 to 0.3.0 [#2734](https://github.com/pomerium/pomerium/pull/2734) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.31.1 to 0.32.1 [#2706](https://github.com/pomerium/pomerium/pull/2706) (@dependabot[bot])
-- chore(deps): bump github.com/docker/docker from 20.10.9+incompatible to 20.10.10+incompatible [#2705](https://github.com/pomerium/pomerium/pull/2705) (@dependabot[bot])
-- chore(deps): bump gopkg.in/auth0.v5 from 5.19.2 to 5.20.0 [#2704](https://github.com/pomerium/pomerium/pull/2704) (@dependabot[bot])
-- chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.6.1 to 0.6.2 [#2703](https://github.com/pomerium/pomerium/pull/2703) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.14.5 to 0.15.1 [#2685](https://github.com/pomerium/pomerium/pull/2685) (@dependabot[bot])
-- chore(deps): bump github.com/peterbourgon/ff/v3 from 3.1.0 to 3.1.2 [#2672](https://github.com/pomerium/pomerium/pull/2672) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.8 to 3.21.9 [#2671](https://github.com/pomerium/pomerium/pull/2671) (@dependabot[bot])
-- chore(deps): bump github.com/docker/docker from 20.10.8+incompatible to 20.10.9+incompatible [#2670](https://github.com/pomerium/pomerium/pull/2670) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.57.0 to 0.58.0 [#2660](https://github.com/pomerium/pomerium/pull/2660) (@dependabot[bot])
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.3 to 8.11.4 [#2659](https://github.com/pomerium/pomerium/pull/2659) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.32.1 to 0.33.1 [#2658](https://github.com/pomerium/pomerium/pull/2658) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.31.0 to 0.31.1 [#2656](https://github.com/pomerium/pomerium/pull/2656) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.32.0 to 0.32.1 [#2633](https://github.com/pomerium/pomerium/pull/2633) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.40.0 to 1.41.0 [#2632](https://github.com/pomerium/pomerium/pull/2632) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.30.0 to 0.31.0 [#2631](https://github.com/pomerium/pomerium/pull/2631) (@dependabot[bot])
-- chore(deps): bump sigs.k8s.io/yaml from 1.2.0 to 1.3.0 [#2630](https://github.com/pomerium/pomerium/pull/2630) (@dependabot[bot])
-- chore(deps): bump github.com/ory/dockertest/v3 from 3.7.0 to 3.8.0 [#2629](https://github.com/pomerium/pomerium/pull/2629) (@dependabot[bot])
-- chore(deps): bump github.com/spf13/viper from 1.8.1 to 1.9.0 [#2616](https://github.com/pomerium/pomerium/pull/2616) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.56.0 to 0.57.0 [#2615](https://github.com/pomerium/pomerium/pull/2615) (@dependabot[bot])
-- chore(deps): bump github.com/coreos/go-oidc/v3 from 3.0.0 to 3.1.0 [#2614](https://github.com/pomerium/pomerium/pull/2614) (@dependabot[bot])
-- bump protoc-validate [#2606](https://github.com/pomerium/pomerium/pull/2606) (@wasaga)
-- chore(deps): bump go.uber.org/zap from 1.19.0 to 1.19.1 [#2592](https://github.com/pomerium/pomerium/pull/2592) (@dependabot[bot])
-- chore(deps): bump github.com/rs/zerolog from 1.24.0 to 1.25.0 [#2591](https://github.com/pomerium/pomerium/pull/2591) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.7 to 3.21.8 [#2577](https://github.com/pomerium/pomerium/pull/2577) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.42.0 to 1.42.1 [#2576](https://github.com/pomerium/pomerium/pull/2576) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.14.4 to 0.14.5 [#2575](https://github.com/pomerium/pomerium/pull/2575) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.54.0 to 0.56.0 [#2574](https://github.com/pomerium/pomerium/pull/2574) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.31.0 to 0.32.0 [#2573](https://github.com/pomerium/pomerium/pull/2573) (@dependabot[bot])
-- chore(deps): bump github.com/fsnotify/fsnotify from 1.5.0 to 1.5.1 [#2554](https://github.com/pomerium/pomerium/pull/2554) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.14.3 to 0.14.4 [#2553](https://github.com/pomerium/pomerium/pull/2553) (@dependabot[bot])
-- chore(deps): bump github.com/rs/zerolog from 1.23.0 to 1.24.0 [#2552](https://github.com/pomerium/pomerium/pull/2552) (@dependabot[bot])
-- chore(deps): bump github.com/docker/docker from 20.10.7+incompatible to 20.10.8+incompatible [#2551](https://github.com/pomerium/pomerium/pull/2551) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.14.1 to 0.14.3 [#2550](https://github.com/pomerium/pomerium/pull/2550) (@dependabot[bot])
-- chore(deps): bump contrib.go.opencensus.io/exporter/prometheus from 0.3.0 to 0.4.0 [#2549](https://github.com/pomerium/pomerium/pull/2549) (@dependabot[bot])
-- chore(deps): bump github.com/cespare/xxhash/v2 from 2.1.1 to 2.1.2 [#2548](https://github.com/pomerium/pomerium/pull/2548) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/procfs from 0.7.2 to 0.7.3 [#2512](https://github.com/pomerium/pomerium/pull/2512) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.41.1 to 1.42.0 [#2511](https://github.com/pomerium/pomerium/pull/2511) (@dependabot[bot])
-- chore(deps): bump github.com/fsnotify/fsnotify from 1.4.9 to 1.5.0 [#2510](https://github.com/pomerium/pomerium/pull/2510) (@dependabot[bot])
-- ci: use go 1.17.x [#2492](https://github.com/pomerium/pomerium/pull/2492) (@desimone)
-- chore(deps): bump google.golang.org/grpc from 1.39.1 to 1.40.0 [#2478](https://github.com/pomerium/pomerium/pull/2478) (@dependabot[bot])
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.2 to 8.11.3 [#2477](https://github.com/pomerium/pomerium/pull/2477) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.52.0 to 0.54.0 [#2476](https://github.com/pomerium/pomerium/pull/2476) (@dependabot[bot])
-- chore(deps): bump go.uber.org/zap from 1.18.1 to 1.19.0 [#2475](https://github.com/pomerium/pomerium/pull/2475) (@dependabot[bot])
-- ci: support darwn/arm64 aka m1 for cli [#2473](https://github.com/pomerium/pomerium/pull/2473) (@desimone)
-- chore(deps): bump google.golang.org/grpc from 1.39.0 to 1.39.1 [#2457](https://github.com/pomerium/pomerium/pull/2457) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/procfs from 0.7.1 to 0.7.2 [#2456](https://github.com/pomerium/pomerium/pull/2456) (@dependabot[bot])
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.1 to 8.11.2 [#2455](https://github.com/pomerium/pomerium/pull/2455) (@dependabot[bot])
-- Hadolint [#2363](https://github.com/pomerium/pomerium/pull/2363) (@stephengroat)
-
-### Deployment
-
-- deployment: migrate pomerium-cli automation to new repo [#2771](https://github.com/pomerium/pomerium/pull/2771) (@travisgroth)
-- deployment: remove DST_Root_CA_X3 from docker images [#2677](https://github.com/pomerium/pomerium/pull/2677) (@travisgroth)
-- deployment: update goreleaser syntax [#2524](https://github.com/pomerium/pomerium/pull/2524) (@travisgroth)
-
-### Changed
-
-- move NewGRPCClientConn to public package [#2826](https://github.com/pomerium/pomerium/pull/2826) (@wasaga)
-- rm cli code [#2824](https://github.com/pomerium/pomerium/pull/2824) (@wasaga)
-- ci: remove hadolint [#2726](https://github.com/pomerium/pomerium/pull/2726) (@travisgroth)
-- ci: ignore multiple run commands [#2566](https://github.com/pomerium/pomerium/pull/2566) (@travisgroth)
-- redirect logo to the marketing site [#2441](https://github.com/pomerium/pomerium/pull/2441) (@alexfornuto)
-- ci: use github app for backport credentials [#2369](https://github.com/pomerium/pomerium/pull/2369) (@travisgroth)
-
-## [v0.15.8](https://github.com/pomerium/pomerium/tree/v0.15.8) (2021-12-17)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.7...v0.15.8)
-
-### Fixed
-
-- authorize: fix nginx infinite redirect [#2812](https://github.com/pomerium/pomerium/pull/2812) (@calebdoxsey)
-
-### Documentation
-
-- DOCS: add Grafana to Guides index [#2809](https://github.com/pomerium/pomerium/pull/2809) (@backport-actions-token[bot])
-- DOCS: Fix indentation in API doc [#2799](https://github.com/pomerium/pomerium/pull/2799) (@backport-actions-token[bot])
-- Docs: Update Kubernetes Dashboard Guide [#2795](https://github.com/pomerium/pomerium/pull/2795) (@backport-actions-token[bot])
-- Docs: Update Securing Kubernetes Guide [#2792](https://github.com/pomerium/pomerium/pull/2792) (@backport-actions-token[bot])
-- Docs: Update JWT Verification Guide [#2787](https://github.com/pomerium/pomerium/pull/2787) (@backport-actions-token[bot])
-
-### Dependency
-
-- deps: pin release to latest go version [#2827](https://github.com/pomerium/pomerium/pull/2827) (@travisgroth)
-
-## [v0.15.7](https://github.com/pomerium/pomerium/tree/v0.15.7) (2021-11-15)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.6...v0.15.7)
-
-### Fixed
-
-- autocert: remove log [#2750](https://github.com/pomerium/pomerium/pull/2750) (@backport-actions-token[bot])
-
-### Security
-
-- identity: fix user refresh [#2725](https://github.com/pomerium/pomerium/pull/2725) (@backport-actions-token[bot])
-
-### Documentation
-
-- Docs: Add Grafana Integration Guide [#2762](https://github.com/pomerium/pomerium/pull/2762) (@backport-actions-token[bot])
-- Docs: Add spdy annotation [#2751](https://github.com/pomerium/pomerium/pull/2751) (@backport-actions-token[bot])
-- Docs: Ingress Controller [#2745](https://github.com/pomerium/pomerium/pull/2745) (@backport-actions-token[bot])
-- Docs: Update Traefik Example Headers [#2741](https://github.com/pomerium/pomerium/pull/2741) (@backport-actions-token[bot])
-- Docs: Update Community Page [#2731](https://github.com/pomerium/pomerium/pull/2731) (@backport-actions-token[bot])
-- Minor fix in routes documentation [#2721](https://github.com/pomerium/pomerium/pull/2721) (@backport-actions-token[bot])
-- Docs: Reference gRPC API Docs [#2720](https://github.com/pomerium/pomerium/pull/2720) (@backport-actions-token[bot])
-- Update overview/architecture.md [#2707](https://github.com/pomerium/pomerium/pull/2707) (@backport-actions-token[bot])
-
-## [v0.15.6](https://github.com/pomerium/pomerium/tree/v0.15.6) (2021-11-04)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.5...v0.15.6)
-
-### Breaking
-
-- github: use GraphQL API to reduce number of API calls for directory sync [#2715](https://github.com/pomerium/pomerium/pull/2715) (@calebdoxsey)
-
-### New
-
-- Add additional ACME CA (autocert) options [#2695](https://github.com/pomerium/pomerium/pull/2695) (@hslatman)
-- add description to service accounts [#2611](https://github.com/pomerium/pomerium/pull/2611) (@nhayfield)
-- all: remove unused handler code [#2439](https://github.com/pomerium/pomerium/pull/2439) (@desimone)
-- allow pomerium to start without certs [#2555](https://github.com/pomerium/pomerium/pull/2555) (@wasaga)
-- authenticate: add support for webauthn [#2688](https://github.com/pomerium/pomerium/pull/2688) (@calebdoxsey)
-- authorize: add support for webauthn device policy enforcement [#2700](https://github.com/pomerium/pomerium/pull/2700) (@calebdoxsey)
-- cli: update tcp log output format [#2586](https://github.com/pomerium/pomerium/pull/2586) (@travisgroth)
-- config: remove headers [#2522](https://github.com/pomerium/pomerium/pull/2522) (@calebdoxsey)
-- config/envoyconfig: better duplicate message [#2661](https://github.com/pomerium/pomerium/pull/2661) (@desimone)
-- cryptutil: add SecureToken [#2681](https://github.com/pomerium/pomerium/pull/2681) (@calebdoxsey)
-- databroker: add additional log for config source [#2718](https://github.com/pomerium/pomerium/pull/2718) (@calebdoxsey)
-- desktop client api [#2711](https://github.com/pomerium/pomerium/pull/2711) (@wasaga)
-- devices: add device protobuf types [#2682](https://github.com/pomerium/pomerium/pull/2682) (@calebdoxsey)
-- directory: implement exponential backoff for refresh [#2570](https://github.com/pomerium/pomerium/pull/2570) (@calebdoxsey)
-- DOCS: Add copy button to code snippets [#2597](https://github.com/pomerium/pomerium/pull/2597) (@alexfornuto)
-- envoy: remove deprecated access_log_path [#2523](https://github.com/pomerium/pomerium/pull/2523) (@calebdoxsey)
-- fix go get, improve redis test [#2450](https://github.com/pomerium/pomerium/pull/2450) (@calebdoxsey)
-- github: support provider URL [#2490](https://github.com/pomerium/pomerium/pull/2490) (@calebdoxsey)
-- google: support provider URL [#2567](https://github.com/pomerium/pomerium/pull/2567) (@calebdoxsey)
-- grpc: remove peer field from logs [#2712](https://github.com/pomerium/pomerium/pull/2712) (@calebdoxsey)
-- integration: add multi test [#2519](https://github.com/pomerium/pomerium/pull/2519) (@calebdoxsey)
-- integration: add single-cluster integration tests [#2516](https://github.com/pomerium/pomerium/pull/2516) (@calebdoxsey)
-- integration: add traefik tests [#2530](https://github.com/pomerium/pomerium/pull/2530) (@calebdoxsey)
-- integration: kubernetes support [#2536](https://github.com/pomerium/pomerium/pull/2536) (@calebdoxsey)
-- integration: nginx [#2532](https://github.com/pomerium/pomerium/pull/2532) (@calebdoxsey)
-- integration: remove tests [#2514](https://github.com/pomerium/pomerium/pull/2514) (@calebdoxsey)
-- pomerium-cli: add support for a custom browser command [#2617](https://github.com/pomerium/pomerium/pull/2617) (@calebdoxsey)
-- pomerium-cli: use cache dir instead of config dir [#2588](https://github.com/pomerium/pomerium/pull/2588) (@calebdoxsey)
-- ppl: add support for additional data [#2696](https://github.com/pomerium/pomerium/pull/2696) (@calebdoxsey)
-- ppl: pass contextual information through policy [#2612](https://github.com/pomerium/pomerium/pull/2612) (@calebdoxsey)
-- protoutil: add NewAny method for deterministic serialization [#2462](https://github.com/pomerium/pomerium/pull/2462) (@calebdoxsey)
-- Remove api from GitLab defaultScope [#2518](https://github.com/pomerium/pomerium/pull/2518) (@alexfornuto)
-- skip configuration updates to the most recent one [#2690](https://github.com/pomerium/pomerium/pull/2690) (@wasaga)
-- telemetry: improve zipkin error logs [#2710](https://github.com/pomerium/pomerium/pull/2710) (@calebdoxsey)
-- webauthn: update session to support device credentials per type [#2699](https://github.com/pomerium/pomerium/pull/2699) (@calebdoxsey)
-- webauthnutil: add helpers for webauthn [#2686](https://github.com/pomerium/pomerium/pull/2686) (@calebdoxsey)
-
-### Fixed
-
-- add host-rewrite options to config.proto [#2668](https://github.com/pomerium/pomerium/pull/2668) (@wasaga)
-- authclient: clone TLS configuration to prevent overriding NextProtos [#2594](https://github.com/pomerium/pomerium/pull/2594) (@calebdoxsey)
-- authenticate: add databroker versions to session cookie [#2709](https://github.com/pomerium/pomerium/pull/2709) (@calebdoxsey)
-- authenticate: always update user record on login [#2719](https://github.com/pomerium/pomerium/pull/2719) (@calebdoxsey)
-- authorize: fix google cloudrun header audience [#2558](https://github.com/pomerium/pomerium/pull/2558) (@calebdoxsey)
-- authorize: fix X-Pomerium-Claim-Groups [#2539](https://github.com/pomerium/pomerium/pull/2539) (@calebdoxsey)
-- authorize: use session.user_id in headers [#2571](https://github.com/pomerium/pomerium/pull/2571) (@calebdoxsey)
-- autocert: remove log [#2584](https://github.com/pomerium/pomerium/pull/2584) (@calebdoxsey)
-- deployment: relocate pomerium-cli to /usr/bin [#2727](https://github.com/pomerium/pomerium/pull/2727) (@travisgroth)
-- fix forward-auth, logging [#2509](https://github.com/pomerium/pomerium/pull/2509) (@calebdoxsey)
-- grpc: disable gRPC connection re-use across services [#2515](https://github.com/pomerium/pomerium/pull/2515) (@calebdoxsey)
-- grpc: send client traffic through envoy [#2469](https://github.com/pomerium/pomerium/pull/2469) (@calebdoxsey)
-- options: remove refresh_cooldown, add allow_spdy to proto [#2446](https://github.com/pomerium/pomerium/pull/2446) (@calebdoxsey)
-- ppl: use session.user_id instead of user.id for user criterion [#2562](https://github.com/pomerium/pomerium/pull/2562) (@calebdoxsey)
-- protoc: add xds repo [#2687](https://github.com/pomerium/pomerium/pull/2687) (@calebdoxsey)
-- tcptunnel: force the use of HTTP/1.1 during ALPN [#2593](https://github.com/pomerium/pomerium/pull/2593) (@calebdoxsey)
-- userinfo: format exp, iat and updated_at [#2585](https://github.com/pomerium/pomerium/pull/2585) (@calebdoxsey)
-
-### Security
-
-- identity: fix user refresh [#2724](https://github.com/pomerium/pomerium/pull/2724) (@calebdoxsey)
-- deps: update envoy to 1.19.1 [#2526](https://github.com/pomerium/pomerium/pull/2526) (@travisgroth)
-
-### Documentation
-
-- Add docs team as a code owner of packages.json [#2605](https://github.com/pomerium/pomerium/pull/2605) (@alexfornuto)
-- Add redirect for installation [#2618](https://github.com/pomerium/pomerium/pull/2618) (@alexfornuto)
-- add service account redirects [#2664](https://github.com/pomerium/pomerium/pull/2664) (@alexfornuto)
-- adjust comment blocking [#2488](https://github.com/pomerium/pomerium/pull/2488) (@alexfornuto)
-- adjust sidebarDepths and document Desktop Client releases [#2643](https://github.com/pomerium/pomerium/pull/2643) (@alexfornuto)
-- Auth0 Doc Refresh [#2494](https://github.com/pomerium/pomerium/pull/2494) (@alexfornuto)
-- DOC: Copy edits to Okta IdP doc. [#2623](https://github.com/pomerium/pomerium/pull/2623) (@alexfornuto)
-- docs: add updated icon asset [#2580](https://github.com/pomerium/pomerium/pull/2580) (@travisgroth)
-- Docs: Batch Updates [#2628](https://github.com/pomerium/pomerium/pull/2628) (@alexfornuto)
-- docs: clarify custom request header limitations [#2471](https://github.com/pomerium/pomerium/pull/2471) (@desimone)
-- DOCS: Collapse IDP Header [#2641](https://github.com/pomerium/pomerium/pull/2641) (@alexfornuto)
-- Docs: Correct Claim Example [#2689](https://github.com/pomerium/pomerium/pull/2689) (@alexfornuto)
-- DOCS: CORS preflight in console [#2642](https://github.com/pomerium/pomerium/pull/2642) (@alexfornuto)
-- Docs: cross-reference links between concepts and reference [#2648](https://github.com/pomerium/pomerium/pull/2648) (@alexfornuto)
-- docs: enterprise console v0.15.2 changelog [#2564](https://github.com/pomerium/pomerium/pull/2564) (@travisgroth)
-- docs: enterprise v0.15.1 changelog [#2542](https://github.com/pomerium/pomerium/pull/2542) (@travisgroth)
-- Docs: Fix merged PR [#2546](https://github.com/pomerium/pomerium/pull/2546) (@alexfornuto)
-- Docs: Ingress Controller [#2667](https://github.com/pomerium/pomerium/pull/2667) (@alexfornuto)
-- Docs: Reference gRPC API Docs [#2717](https://github.com/pomerium/pomerium/pull/2717) (@alexfornuto)
-- docs: remove extra word / updated docs link [#2638](https://github.com/pomerium/pomerium/pull/2638) (@cmo-pomerium)
-- docs: rename updated icon image [#2582](https://github.com/pomerium/pomerium/pull/2582) (@travisgroth)
-- DOCS: Standardize Relative Links [#2651](https://github.com/pomerium/pomerium/pull/2651) (@alexfornuto)
-- docs: update branding [#2435](https://github.com/pomerium/pomerium/pull/2435) (@desimone)
-- docs: update branding, concepts [#2445](https://github.com/pomerium/pomerium/pull/2445) (@desimone)
-- docs: update codeowners [#2451](https://github.com/pomerium/pomerium/pull/2451) (@travisgroth)
-- Docs: Update Community Page [#2713](https://github.com/pomerium/pomerium/pull/2713) (@cmo-pomerium)
-- docs: update default version to v0.15 [#2437](https://github.com/pomerium/pomerium/pull/2437) (@travisgroth)
-- docs: update enterprise helm instructions to use main repo [#2463](https://github.com/pomerium/pomerium/pull/2463) (@travisgroth)
-- DOCS: Update Enterprise Reference Docs [#2599](https://github.com/pomerium/pomerium/pull/2599) (@alexfornuto)
-- Docs: Update Traefik Example Headers [#2732](https://github.com/pomerium/pomerium/pull/2732) (@alexfornuto)
-- docs: use generic email [#2484](https://github.com/pomerium/pomerium/pull/2484) (@alexfornuto)
-- Docs/batch link fixes [#2621](https://github.com/pomerium/pomerium/pull/2621) (@alexfornuto)
-- document binding service to 443 [#2487](https://github.com/pomerium/pomerium/pull/2487) (@alexfornuto)
-- Document Enterprise API [#2595](https://github.com/pomerium/pomerium/pull/2595) (@alexfornuto)
-- Document moving routes [#2460](https://github.com/pomerium/pomerium/pull/2460) (@alexfornuto)
-- Document recovery token generation [#2579](https://github.com/pomerium/pomerium/pull/2579) (@alexfornuto)
-- Document tracing sample rate in console [#2461](https://github.com/pomerium/pomerium/pull/2461) (@alexfornuto)
-- Enterprise Upgrade & Changelog Pages [#2453](https://github.com/pomerium/pomerium/pull/2453) (@alexfornuto)
-- Fix typo in docs [#2683](https://github.com/pomerium/pomerium/pull/2683) (@nihaals)
-- Fixed 'kubtctl' typo on releases page [#2673](https://github.com/pomerium/pomerium/pull/2673) (@ChaosInTheCRD)
-- Minor fix in routes documentation [#2714](https://github.com/pomerium/pomerium/pull/2714) (@Kerwood)
-- New Topic Page: Original Request Context [#2569](https://github.com/pomerium/pomerium/pull/2569) (@alexfornuto)
-- Refresh and Update TCP documentation [#2627](https://github.com/pomerium/pomerium/pull/2627) (@alexfornuto)
-- specify expected audience in Console config [#2442](https://github.com/pomerium/pomerium/pull/2442) (@alexfornuto)
-- TCP Client Doc [#2561](https://github.com/pomerium/pomerium/pull/2561) (@alexfornuto)
-- typo [#2644](https://github.com/pomerium/pomerium/pull/2644) (@alexfornuto)
-- Update AWS cognito IdP doc [#2498](https://github.com/pomerium/pomerium/pull/2498) (@alexfornuto)
-- Update Azure IdP Doc [#2497](https://github.com/pomerium/pomerium/pull/2497) (@alexfornuto)
-- Update binary install doc [#2447](https://github.com/pomerium/pomerium/pull/2447) (@alexfornuto)
-- Update CODEOWNERS [#2603](https://github.com/pomerium/pomerium/pull/2603) (@alexfornuto)
-- Update create TLS command to quote strings. [#2694](https://github.com/pomerium/pomerium/pull/2694) (@FutureMatt)
-- Update Docker Quickstart [#2482](https://github.com/pomerium/pomerium/pull/2482) (@alexfornuto)
-- update GitHub IdP doc [#2503](https://github.com/pomerium/pomerium/pull/2503) (@alexfornuto)
-- Update GitLab IdP doc [#2520](https://github.com/pomerium/pomerium/pull/2520) (@alexfornuto)
-- Update Helm Instructions [#2467](https://github.com/pomerium/pomerium/pull/2467) (@alexfornuto)
-- Update IdP Overview Page [#2493](https://github.com/pomerium/pomerium/pull/2493) (@alexfornuto)
-- Update Okta IdP doc [#2491](https://github.com/pomerium/pomerium/pull/2491) (@alexfornuto)
-- update OneLogin IdP doc [#2533](https://github.com/pomerium/pomerium/pull/2533) (@alexfornuto)
-- Update overview/architecture.md [#2701](https://github.com/pomerium/pomerium/pull/2701) (@cmo-pomerium)
-- Update Ping Identity IdP [#2537](https://github.com/pomerium/pomerium/pull/2537) (@alexfornuto)
-- Updates to Enterprise Quickstart instructions [#2480](https://github.com/pomerium/pomerium/pull/2480) (@alexfornuto)
-- wrap header example values as inline code. [#2474](https://github.com/pomerium/pomerium/pull/2474) (@alexfornuto)
-- Wrap mkcert command in quotes [#2481](https://github.com/pomerium/pomerium/pull/2481) (@alexfornuto)
-
-### Dependency
-
-- dependencies: vendor base58, remove shortuuid [#2739](https://github.com/pomerium/pomerium/pull/2739) (@calebdoxsey)
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.9 to 3.21.10 [#2736](https://github.com/pomerium/pomerium/pull/2736) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.33.1 to 0.34.0 [#2735](https://github.com/pomerium/pomerium/pull/2735) (@dependabot[bot])
-- chore(deps): bump github.com/openzipkin/zipkin-go from 0.2.5 to 0.3.0 [#2734](https://github.com/pomerium/pomerium/pull/2734) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.31.1 to 0.32.1 [#2706](https://github.com/pomerium/pomerium/pull/2706) (@dependabot[bot])
-- chore(deps): bump github.com/docker/docker from 20.10.9+incompatible to 20.10.10+incompatible [#2705](https://github.com/pomerium/pomerium/pull/2705) (@dependabot[bot])
-- chore(deps): bump gopkg.in/auth0.v5 from 5.19.2 to 5.20.0 [#2704](https://github.com/pomerium/pomerium/pull/2704) (@dependabot[bot])
-- chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.6.1 to 0.6.2 [#2703](https://github.com/pomerium/pomerium/pull/2703) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.14.5 to 0.15.1 [#2685](https://github.com/pomerium/pomerium/pull/2685) (@dependabot[bot])
-- chore(deps): bump github.com/peterbourgon/ff/v3 from 3.1.0 to 3.1.2 [#2672](https://github.com/pomerium/pomerium/pull/2672) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.8 to 3.21.9 [#2671](https://github.com/pomerium/pomerium/pull/2671) (@dependabot[bot])
-- chore(deps): bump github.com/docker/docker from 20.10.8+incompatible to 20.10.9+incompatible [#2670](https://github.com/pomerium/pomerium/pull/2670) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.57.0 to 0.58.0 [#2660](https://github.com/pomerium/pomerium/pull/2660) (@dependabot[bot])
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.3 to 8.11.4 [#2659](https://github.com/pomerium/pomerium/pull/2659) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.32.1 to 0.33.1 [#2658](https://github.com/pomerium/pomerium/pull/2658) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.31.0 to 0.31.1 [#2656](https://github.com/pomerium/pomerium/pull/2656) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.32.0 to 0.32.1 [#2633](https://github.com/pomerium/pomerium/pull/2633) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.40.0 to 1.41.0 [#2632](https://github.com/pomerium/pomerium/pull/2632) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.30.0 to 0.31.0 [#2631](https://github.com/pomerium/pomerium/pull/2631) (@dependabot[bot])
-- chore(deps): bump sigs.k8s.io/yaml from 1.2.0 to 1.3.0 [#2630](https://github.com/pomerium/pomerium/pull/2630) (@dependabot[bot])
-- chore(deps): bump github.com/ory/dockertest/v3 from 3.7.0 to 3.8.0 [#2629](https://github.com/pomerium/pomerium/pull/2629) (@dependabot[bot])
-- chore(deps): bump github.com/spf13/viper from 1.8.1 to 1.9.0 [#2616](https://github.com/pomerium/pomerium/pull/2616) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.56.0 to 0.57.0 [#2615](https://github.com/pomerium/pomerium/pull/2615) (@dependabot[bot])
-- chore(deps): bump github.com/coreos/go-oidc/v3 from 3.0.0 to 3.1.0 [#2614](https://github.com/pomerium/pomerium/pull/2614) (@dependabot[bot])
-- bump protoc-validate [#2606](https://github.com/pomerium/pomerium/pull/2606) (@wasaga)
-- chore(deps): bump go.uber.org/zap from 1.19.0 to 1.19.1 [#2592](https://github.com/pomerium/pomerium/pull/2592) (@dependabot[bot])
-- chore(deps): bump github.com/rs/zerolog from 1.24.0 to 1.25.0 [#2591](https://github.com/pomerium/pomerium/pull/2591) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.7 to 3.21.8 [#2577](https://github.com/pomerium/pomerium/pull/2577) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.42.0 to 1.42.1 [#2576](https://github.com/pomerium/pomerium/pull/2576) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.14.4 to 0.14.5 [#2575](https://github.com/pomerium/pomerium/pull/2575) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.54.0 to 0.56.0 [#2574](https://github.com/pomerium/pomerium/pull/2574) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.31.0 to 0.32.0 [#2573](https://github.com/pomerium/pomerium/pull/2573) (@dependabot[bot])
-- chore(deps): bump github.com/fsnotify/fsnotify from 1.5.0 to 1.5.1 [#2554](https://github.com/pomerium/pomerium/pull/2554) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.14.3 to 0.14.4 [#2553](https://github.com/pomerium/pomerium/pull/2553) (@dependabot[bot])
-- chore(deps): bump github.com/rs/zerolog from 1.23.0 to 1.24.0 [#2552](https://github.com/pomerium/pomerium/pull/2552) (@dependabot[bot])
-- chore(deps): bump github.com/docker/docker from 20.10.7+incompatible to 20.10.8+incompatible [#2551](https://github.com/pomerium/pomerium/pull/2551) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.14.1 to 0.14.3 [#2550](https://github.com/pomerium/pomerium/pull/2550) (@dependabot[bot])
-- chore(deps): bump contrib.go.opencensus.io/exporter/prometheus from 0.3.0 to 0.4.0 [#2549](https://github.com/pomerium/pomerium/pull/2549) (@dependabot[bot])
-- chore(deps): bump github.com/cespare/xxhash/v2 from 2.1.1 to 2.1.2 [#2548](https://github.com/pomerium/pomerium/pull/2548) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/procfs from 0.7.2 to 0.7.3 [#2512](https://github.com/pomerium/pomerium/pull/2512) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.41.1 to 1.42.0 [#2511](https://github.com/pomerium/pomerium/pull/2511) (@dependabot[bot])
-- chore(deps): bump github.com/fsnotify/fsnotify from 1.4.9 to 1.5.0 [#2510](https://github.com/pomerium/pomerium/pull/2510) (@dependabot[bot])
-- ci: use go 1.17.x [#2492](https://github.com/pomerium/pomerium/pull/2492) (@desimone)
-- chore(deps): bump google.golang.org/grpc from 1.39.1 to 1.40.0 [#2478](https://github.com/pomerium/pomerium/pull/2478) (@dependabot[bot])
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.2 to 8.11.3 [#2477](https://github.com/pomerium/pomerium/pull/2477) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.52.0 to 0.54.0 [#2476](https://github.com/pomerium/pomerium/pull/2476) (@dependabot[bot])
-- chore(deps): bump go.uber.org/zap from 1.18.1 to 1.19.0 [#2475](https://github.com/pomerium/pomerium/pull/2475) (@dependabot[bot])
-- ci: support darwn/arm64 aka m1 for cli [#2473](https://github.com/pomerium/pomerium/pull/2473) (@desimone)
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.1 to 8.11.2 [#2459](https://github.com/pomerium/pomerium/pull/2459) (@backport-actions-token[bot])
-- chore(deps): bump google.golang.org/grpc from 1.39.0 to 1.39.1 [#2457](https://github.com/pomerium/pomerium/pull/2457) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/procfs from 0.7.1 to 0.7.2 [#2456](https://github.com/pomerium/pomerium/pull/2456) (@dependabot[bot])
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.1 to 8.11.2 [#2455](https://github.com/pomerium/pomerium/pull/2455) (@dependabot[bot])
-- Hadolint [#2363](https://github.com/pomerium/pomerium/pull/2363) (@stephengroat)
-
-### Changed
-
-- ci: remove hadolint [#2726](https://github.com/pomerium/pomerium/pull/2726) (@travisgroth)
-- ci: ignore multiple run commands [#2566](https://github.com/pomerium/pomerium/pull/2566) (@travisgroth)
-- redirect logo to the marketing site [#2441](https://github.com/pomerium/pomerium/pull/2441) (@alexfornuto)
-- deployment: remove DST_Root_CA_X3 from docker images [#2677](https://github.com/pomerium/pomerium/pull/2677) (@travisgroth)
-- deployment: update goreleaser syntax [#2524](https://github.com/pomerium/pomerium/pull/2524) (@travisgroth)
-
-## [v0.15.5](https://github.com/pomerium/pomerium/tree/v0.15.5) (2021-10-22)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.4...v0.15.5)
-
-### New
-
-- skip configuration updates to the most recent one [#2692](https://github.com/pomerium/pomerium/pull/2692) (@backport-actions-token[bot])
-
-### Changed
-
-- Update create TLS command to quote strings. [#2697](https://github.com/pomerium/pomerium/pull/2697) (@backport-actions-token[bot])
-- DOCS: CORS preflight in console [#2693](https://github.com/pomerium/pomerium/pull/2693) (@backport-actions-token[bot])
-- Docs: Correct Claim Example [#2691](https://github.com/pomerium/pomerium/pull/2691) (@backport-actions-token[bot])
-- Fix typo in docs [#2684](https://github.com/pomerium/pomerium/pull/2684) (@backport-actions-token[bot])
-- deployment: remove DST_Root_CA_X3 from docker images [#2698](https://github.com/pomerium/pomerium/pull/2698) (@travisgroth)
-
-## [v0.15.4](https://github.com/pomerium/pomerium/tree/v0.15.4) (2021-10-14)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.3...v0.15.4)
-
-### New
-
-- protoutil: add NewAny method for deterministic serialization [#2662](https://github.com/pomerium/pomerium/pull/2662) (@backport-actions-token[bot])
-
-### Fixed
-
-- backport: host rewrite [#2669](https://github.com/pomerium/pomerium/pull/2669) (@wasaga)
-
-### Documentation
-
-- Add redirect for installation [#2620](https://github.com/pomerium/pomerium/pull/2620) (@backport-actions-token[bot])
-- add service account redirects [#2665](https://github.com/pomerium/pomerium/pull/2665) (@backport-actions-token[bot])
-- DOC: Copy edits to Okta IdP doc. [#2625](https://github.com/pomerium/pomerium/pull/2625) (@backport-actions-token[bot])
-- Docs: Batch Updates [#2640](https://github.com/pomerium/pomerium/pull/2640) (@backport-actions-token[bot])
-- DOCS: Collapse IDP Header [#2649](https://github.com/pomerium/pomerium/pull/2649) (@backport-actions-token[bot])
-- Docs: cross-reference links between concepts and reference [#2650](https://github.com/pomerium/pomerium/pull/2650) (@backport-actions-token[bot])
-- Docs: Ingress Controller [#2667](https://github.com/pomerium/pomerium/pull/2667) (@alexfornuto)
-- docs: remove extra word / updated docs link [#2639](https://github.com/pomerium/pomerium/pull/2639) (@backport-actions-token[bot])
-- DOCS: Standardize Relative Links (#2651) [#2654](https://github.com/pomerium/pomerium/pull/2654) (@alexfornuto)
-- DOCS: Update Enterprise Reference Docs [#2624](https://github.com/pomerium/pomerium/pull/2624) (@backport-actions-token[bot])
-- Docs/batch link fixes [#2622](https://github.com/pomerium/pomerium/pull/2622) (@backport-actions-token[bot])
-- Document Enterprise API [#2619](https://github.com/pomerium/pomerium/pull/2619) (@backport-actions-token[bot])
-- Fixed 'kubtctl' typo on releases page [#2680](https://github.com/pomerium/pomerium/pull/2680) (@backport-actions-token[bot])
-- Refresh and Update TCP documentation [#2679](https://github.com/pomerium/pomerium/pull/2679) (@backport-actions-token[bot])
-- TCP Client Doc [#2626](https://github.com/pomerium/pomerium/pull/2626) (@backport-actions-token[bot])
-- typo [#2646](https://github.com/pomerium/pomerium/pull/2646) (@backport-actions-token[bot])
-
-## [v0.15.3](https://github.com/pomerium/pomerium/tree/v0.15.3) (2021-09-17)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.2...v0.15.3)
-
-### New
-
-- cli: update tcp log output format [#2587](https://github.com/pomerium/pomerium/pull/2587) (@travisgroth)
-
-### Fixed
-
-- backport 2593 and 2594 to 0.15 [#2598](https://github.com/pomerium/pomerium/pull/2598) (@calebdoxsey)
-
-### Documentation
-
-- Add docs team as a code owner of packages.json [#2607](https://github.com/pomerium/pomerium/pull/2607) (@backport-actions-token[bot])
-- DOCS: Add copy button to code snippets [#2600](https://github.com/pomerium/pomerium/pull/2600) (@backport-actions-token[bot])
-- docs: add updated icon asset [#2581](https://github.com/pomerium/pomerium/pull/2581) (@backport-actions-token[bot])
-- docs: rename updated icon image [#2583](https://github.com/pomerium/pomerium/pull/2583) (@backport-actions-token[bot])
-- Document recovery token generation [#2601](https://github.com/pomerium/pomerium/pull/2601) (@backport-actions-token[bot])
-- New Topic Page: Original Request Context [#2602](https://github.com/pomerium/pomerium/pull/2602) (@backport-actions-token[bot])
-
-### Changed
-
-- Update CODEOWNERS [#2604](https://github.com/pomerium/pomerium/pull/2604) (@backport-actions-token[bot])
-
-## [v0.15.2](https://github.com/pomerium/pomerium/tree/v0.15.2) (2021-09-03)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.8...v0.15.2)
-
-### New
-
-- allow pomerium to start without certs [#2556](https://github.com/pomerium/pomerium/pull/2556) (@backport-actions-token[bot])
-
-### Fixed
-
-- authorize: use session.user_id in headers [#2572](https://github.com/pomerium/pomerium/pull/2572) (@backport-actions-token[bot])
-- ppl: use session.user_id instead of user.id for user criterion [#2563](https://github.com/pomerium/pomerium/pull/2563) (@backport-actions-token[bot])
-- authorize: fix google cloudrun header audience [#2560](https://github.com/pomerium/pomerium/pull/2560) (@backport-actions-token[bot])
-- authorize: fix X-Pomerium-Claim-Groups [#2540](https://github.com/pomerium/pomerium/pull/2540) (@backport-actions-token[bot])
-
-### Documentation
-
-- docs: enterprise console v0.15.2 changelog [#2565](https://github.com/pomerium/pomerium/pull/2565) (@backport-actions-token[bot])
-- Docs: Fix merged PR [#2547](https://github.com/pomerium/pomerium/pull/2547) (@backport-actions-token[bot])
-- Update Ping Identity IdP [#2545](https://github.com/pomerium/pomerium/pull/2545) (@backport-actions-token[bot])
-- update OneLogin IdP doc [#2544](https://github.com/pomerium/pomerium/pull/2544) (@backport-actions-token[bot])
-- docs: enterprise v0.15.1 changelog [#2543](https://github.com/pomerium/pomerium/pull/2543) (@backport-actions-token[bot])
-- Updates to Enterprise Quickstart instructions [#2531](https://github.com/pomerium/pomerium/pull/2531) (@backport-actions-token[bot])
-
-## [v0.15.0](https://github.com/pomerium/pomerium/tree/v0.15.0) (2021-08-05)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.7...v0.15.0)
-
-### Breaking
-
-- config: remove support for ed25519 signing keys [#2430](https://github.com/pomerium/pomerium/pull/2430) (@calebdoxsey)
-
-### New
-
-- authorize: add additional tracing for rego evaluation [#2381](https://github.com/pomerium/pomerium/pull/2381) (@calebdoxsey)
-- authorize: log additional session details [#2419](https://github.com/pomerium/pomerium/pull/2419) (@calebdoxsey)
-- authorize: log service account and impersonation details [#2354](https://github.com/pomerium/pomerium/pull/2354) (@calebdoxsey)
-- authorize: remove service account impersonate user id, email and groups [#2365](https://github.com/pomerium/pomerium/pull/2365) (@calebdoxsey)
-- ci: use revive instead of golint [#2370](https://github.com/pomerium/pomerium/pull/2370) (@calebdoxsey)
-- config: add support for embedded PPL policy [#2401](https://github.com/pomerium/pomerium/pull/2401) (@calebdoxsey)
-- config: add warning about http URLs [#2358](https://github.com/pomerium/pomerium/pull/2358) (@calebdoxsey)
-- directory: add logging http client to help with debugging outbound http requests [#2385](https://github.com/pomerium/pomerium/pull/2385) (@calebdoxsey)
-- envoyconfig: add bootstrap layered runtime configuration [#2343](https://github.com/pomerium/pomerium/pull/2343) (@calebdoxsey)
-- envoyconfig: default zipkin path to / when empty [#2359](https://github.com/pomerium/pomerium/pull/2359) (@calebdoxsey)
-- envoyconfig: improvements [#2402](https://github.com/pomerium/pomerium/pull/2402) (@calebdoxsey)
-- evaluator: use `cryptutil.Hash` for script spans [#2384](https://github.com/pomerium/pomerium/pull/2384) (@desimone)
-- k8s: add flush-credentials command [#2379](https://github.com/pomerium/pomerium/pull/2379) (@calebdoxsey)
-- ppl: remove support for aliases [#2400](https://github.com/pomerium/pomerium/pull/2400) (@calebdoxsey)
-- registry/redis: call publish from within lua function [#2337](https://github.com/pomerium/pomerium/pull/2337) (@calebdoxsey)
-- sessions: add impersonate_session_id, remove legacy impersonation [#2407](https://github.com/pomerium/pomerium/pull/2407) (@calebdoxsey)
-- telemetry: add nonce and make explicit ack/nack [#2434](https://github.com/pomerium/pomerium/pull/2434) (@wasaga)
-- telemetry: try guess hostname or external IP addr for metrics [#2412](https://github.com/pomerium/pomerium/pull/2412) (@wasaga)
-- tools: add tools.go to pin go run apps [#2344](https://github.com/pomerium/pomerium/pull/2344) (@calebdoxsey)
-- urlutil: improve error message for urls with port in path [#2377](https://github.com/pomerium/pomerium/pull/2377) (@calebdoxsey)
-
-### Fixed
-
-- authorize: add sid to JWT claims [#2420](https://github.com/pomerium/pomerium/pull/2420) (@calebdoxsey)
-- authorize: allow redirects on deny [#2361](https://github.com/pomerium/pomerium/pull/2361) (@calebdoxsey)
-- authorize: decode CheckRequest path for redirect [#2357](https://github.com/pomerium/pomerium/pull/2357) (@calebdoxsey)
-- authorize: support boolean deny results [#2338](https://github.com/pomerium/pomerium/pull/2338) (@calebdoxsey)
-- ci: update gcloud action [#2393](https://github.com/pomerium/pomerium/pull/2393) (@travisgroth)
-- config: remove grpc server max connection age options [#2427](https://github.com/pomerium/pomerium/pull/2427) (@calebdoxsey)
-- disable http/2 for websockets [#2399](https://github.com/pomerium/pomerium/pull/2399) (@calebdoxsey)
-- envoy: only check for pid with monitor [#2355](https://github.com/pomerium/pomerium/pull/2355) (@calebdoxsey)
-- envoyconfig: only delete cached files, ignore noisy error [#2356](https://github.com/pomerium/pomerium/pull/2356) (@calebdoxsey)
-- fix: timeout in protobuf [#2341](https://github.com/pomerium/pomerium/pull/2341) (@wasaga)
-- google: remove WithHTTPClient [#2391](https://github.com/pomerium/pomerium/pull/2391) (@calebdoxsey)
-- telemetry: support b3 headers on gRPC server calls [#2376](https://github.com/pomerium/pomerium/pull/2376) (@calebdoxsey)
-
-### Security
-
-- envoy: only allow embedding [#2368](https://github.com/pomerium/pomerium/pull/2368) (@calebdoxsey)
-
-### Documentation
-
-- doc updates [#2433](https://github.com/pomerium/pomerium/pull/2433) (@calebdoxsey)
-- Docs bug fixes [#2362](https://github.com/pomerium/pomerium/pull/2362) (@alexfornuto)
-- Docs sorting [#2346](https://github.com/pomerium/pomerium/pull/2346) (@alexfornuto)
-- docs: clarify device identity, not state via client certs [#2428](https://github.com/pomerium/pomerium/pull/2428) (@desimone)
-- docs: only secure schemes are supported [#2408](https://github.com/pomerium/pomerium/pull/2408) (@desimone)
-- docs/reference: Clarify use of idp_service_account [#2431](https://github.com/pomerium/pomerium/pull/2431) (@the-maldridge)
-- Enterprise Docs [#2390](https://github.com/pomerium/pomerium/pull/2390) (@alexfornuto)
-- Installation Docs Restructuring [#2406](https://github.com/pomerium/pomerium/pull/2406) (@alexfornuto)
-- symlink security policy to root of project [#2396](https://github.com/pomerium/pomerium/pull/2396) (@desimone)
-- Update Console installs to match signing_key [#2432](https://github.com/pomerium/pomerium/pull/2432) (@alexfornuto)
-- Update installation source for mkcert [#2340](https://github.com/pomerium/pomerium/pull/2340) (@alexfornuto)
-- update v0.15 changelog [#2436](https://github.com/pomerium/pomerium/pull/2436) (@travisgroth)
-- v0.15 release notes [#2409](https://github.com/pomerium/pomerium/pull/2409) (@travisgroth)
-
-### Dependency
-
-- chore(deps): bump github.com/caddyserver/certmagic from 0.14.0 to 0.14.1 [#2352](https://github.com/pomerium/pomerium/pull/2352) (@dependabot[bot])
-
-- chore(deps): bump github.com/go-jose/go-jose/v3 from 3.0.0-rc.1 to 3.0.0 [#2421](https://github.com/pomerium/pomerium/pull/2421) (@dependabot[bot])
-
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.10.0 to 8.11.0 [#2329](https://github.com/pomerium/pomerium/pull/2329) (@dependabot[bot])
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.0 to 8.11.1 [#2413](https://github.com/pomerium/pomerium/pull/2413) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.40.1 to 1.41.1 [#2353](https://github.com/pomerium/pomerium/pull/2353) (@dependabot[bot])
-- chore(deps): bump github.com/google/uuid from 1.2.0 to 1.3.0 [#2374](https://github.com/pomerium/pomerium/pull/2374) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.29.4 to 0.30.1 [#2323](https://github.com/pomerium/pomerium/pull/2323) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.30.1 to 0.30.2 [#2373](https://github.com/pomerium/pomerium/pull/2373) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.30.2 to 0.31.0 [#2416](https://github.com/pomerium/pomerium/pull/2416) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.29.0 to 0.30.0 [#2417](https://github.com/pomerium/pomerium/pull/2417) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/procfs from 0.6.0 to 0.7.0 [#2328](https://github.com/pomerium/pomerium/pull/2328) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/procfs from 0.7.0 to 0.7.1 [#2395](https://github.com/pomerium/pomerium/pull/2395) (@dependabot[bot])
-- chore(deps): bump github.com/rs/cors from 1.7.0 to 1.8.0 [#2334](https://github.com/pomerium/pomerium/pull/2334) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.5 to 3.21.6 [#2326](https://github.com/pomerium/pomerium/pull/2326) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.6 to 3.21.7 [#2414](https://github.com/pomerium/pomerium/pull/2414) (@dependabot[bot])
-- chore(deps): bump github.com/spf13/cobra from 1.1.3 to 1.2.1 [#2330](https://github.com/pomerium/pomerium/pull/2330) (@dependabot[bot])
-- chore(deps): bump go.uber.org/zap from 1.17.0 to 1.18.1 [#2325](https://github.com/pomerium/pomerium/pull/2325) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.49.0 to 0.50.0 [#2333](https://github.com/pomerium/pomerium/pull/2333) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.50.0 to 0.51.0 [#2394](https://github.com/pomerium/pomerium/pull/2394) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.51.0 to 0.52.0 [#2415](https://github.com/pomerium/pomerium/pull/2415) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.38.0 to 1.39.0 [#2324](https://github.com/pomerium/pomerium/pull/2324) (@dependabot[bot])
-- chore(deps): bump gopkg.in/auth0.v5 from 5.19.1 to 5.19.2 [#2422](https://github.com/pomerium/pomerium/pull/2422) (@dependabot[bot])
-- chore(deps): upgrade kind action to v1.2.0 [#2331](https://github.com/pomerium/pomerium/pull/2331) (@travisgroth)
-- ci: convert to FOSSA scan [#2371](https://github.com/pomerium/pomerium/pull/2371) (@travisgroth)
-
-### Changed
-
-- build: add envoy files to `make clean` [#2411](https://github.com/pomerium/pomerium/pull/2411) (@travisgroth)
-
-- ci: use github app for backport credentials [#2369](https://github.com/pomerium/pomerium/pull/2369) (@travisgroth)
-
-- databroker: tests [#2367](https://github.com/pomerium/pomerium/pull/2367) (@calebdoxsey)
-
-- envoy: bump to 1.19 [#2392](https://github.com/pomerium/pomerium/pull/2392) (@travisgroth)
-- redis: increase timeout on test [#2425](https://github.com/pomerium/pomerium/pull/2425) (@calebdoxsey)
-- redis: refactor change signal test to be more deterministic [#2335](https://github.com/pomerium/pomerium/pull/2335) (@calebdoxsey)
-- storage/inmemory: add tests for close behavior [#2336](https://github.com/pomerium/pomerium/pull/2336) (@calebdoxsey)
-
-## [v0.14.8](https://github.com/pomerium/pomerium/tree/v0.14.8) (2021-08-26)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.1...v0.14.8)
-
-### Security
-
-- deps: bump envoy to v0.17.4 [#2535](https://github.com/pomerium/pomerium/pull/2535) (@travisgroth)
-
-### Documentation
-
-- Docs backporting [#2351](https://github.com/pomerium/pomerium/pull/2351) (@alexfornuto)
-- Docs bug fixes [#2364](https://github.com/pomerium/pomerium/pull/2364) (@github-actions[bot])
-- docs: google gcp / workspace instructions [#2350](https://github.com/pomerium/pomerium/pull/2350) (@github-actions[bot])
-- docs: only secure schemes are supported [#2410](https://github.com/pomerium/pomerium/pull/2410) (@backport-actions-token[bot])
-
-### Dependency
-
-- chore(deps): upgrade kind action to v1.2.0 (#2281) [#2366](https://github.com/pomerium/pomerium/pull/2366) (@travisgroth)
-
-### Changed
-
-- ci: update gcloud action [#2538](https://github.com/pomerium/pomerium/pull/2538) (@backport-actions-token[bot])
-
-## [v0.15.1](https://github.com/pomerium/pomerium/tree/v0.15.1) (2021-08-25)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.15.0...v0.15.1)
-
-### Fixed
-
-- options: remove refresh_cooldown, add allow_spdy to proto [#2448](https://github.com/pomerium/pomerium/pull/2448) (@backport-actions-token[bot])
-
-### Security
-
-- deps: update envoy to 1.19.1 [#2527](https://github.com/pomerium/pomerium/pull/2527) (@backport-actions-token[bot])
-
-### Documentation
-
-- adjust comment blocking [#2489](https://github.com/pomerium/pomerium/pull/2489) (@backport-actions-token[bot])
-- Auth0 Doc Refresh [#2500](https://github.com/pomerium/pomerium/pull/2500) (@backport-actions-token[bot])
-- docs: clarify custom request header limitations [#2472](https://github.com/pomerium/pomerium/pull/2472) (@backport-actions-token[bot])
-- docs: update branding [#2440](https://github.com/pomerium/pomerium/pull/2440) (@backport-actions-token[bot])
-- docs: update branding, concepts [#2449](https://github.com/pomerium/pomerium/pull/2449) (@backport-actions-token[bot])
-- docs: update codeowners [#2506](https://github.com/pomerium/pomerium/pull/2506) (@backport-actions-token[bot])
-- docs: update default version to v0.15 [#2438](https://github.com/pomerium/pomerium/pull/2438) (@backport-actions-token[bot])
-- docs: update enterprise helm instructions to use main repo [#2464](https://github.com/pomerium/pomerium/pull/2464) (@backport-actions-token[bot])
-- docs: use generic email [#2485](https://github.com/pomerium/pomerium/pull/2485) (@backport-actions-token[bot])
-- document binding service to 443 [#2499](https://github.com/pomerium/pomerium/pull/2499) (@backport-actions-token[bot])
-- Document moving routes [#2466](https://github.com/pomerium/pomerium/pull/2466) (@backport-actions-token[bot])
-- Document tracing sample rate in console [#2465](https://github.com/pomerium/pomerium/pull/2465) (@backport-actions-token[bot])
-- Enterprise Upgrade & Changelog Pages [#2458](https://github.com/pomerium/pomerium/pull/2458) (@backport-actions-token[bot])
-- redirect logo to the marketing site [#2443](https://github.com/pomerium/pomerium/pull/2443) (@backport-actions-token[bot])
-- Remove api from GitLab defaultScope [#2528](https://github.com/pomerium/pomerium/pull/2528) (@backport-actions-token[bot])
-- specify expected audience in Console config [#2444](https://github.com/pomerium/pomerium/pull/2444) (@backport-actions-token[bot])
-- Update AWS cognito IdP doc [#2501](https://github.com/pomerium/pomerium/pull/2501) (@backport-actions-token[bot])
-- Update Azure IdP Doc [#2504](https://github.com/pomerium/pomerium/pull/2504) (@backport-actions-token[bot])
-- Update binary install doc [#2452](https://github.com/pomerium/pomerium/pull/2452) (@backport-actions-token[bot])
-- Update Docker Quickstart (#2482) [#2486](https://github.com/pomerium/pomerium/pull/2486) (@alexfornuto)
-- update GitHub IdP doc [#2508](https://github.com/pomerium/pomerium/pull/2508) (@backport-actions-token[bot])
-- Update GitLab IdP doc [#2529](https://github.com/pomerium/pomerium/pull/2529) (@backport-actions-token[bot])
-- Update Helm Instructions [#2505](https://github.com/pomerium/pomerium/pull/2505) (@backport-actions-token[bot])
-- Update IdP Overview Page [#2502](https://github.com/pomerium/pomerium/pull/2502) (@backport-actions-token[bot])
-- Update Okta IdP doc [#2495](https://github.com/pomerium/pomerium/pull/2495) (@backport-actions-token[bot])
-- wrap header example values as inline code. [#2479](https://github.com/pomerium/pomerium/pull/2479) (@backport-actions-token[bot])
-
-### Dependency
-
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.1 to 8.11.2 [#2459](https://github.com/pomerium/pomerium/pull/2459) (@backport-actions-token[bot])
-
-### Deployment
-
-- deployment: update goreleaser syntax [#2525](https://github.com/pomerium/pomerium/pull/2525) (@backport-actions-token[bot])
-- ci: support darwn/arm64 aka m1 for cli [#2521](https://github.com/pomerium/pomerium/pull/2521) (@travisgroth)
-
-## [v0.15.0](https://github.com/pomerium/pomerium/tree/v0.15.0) (2021-08-05)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.7...v0.15.0)
-
-### Breaking
-
-- config: remove support for ed25519 signing keys [#2430](https://github.com/pomerium/pomerium/pull/2430) (@calebdoxsey)
-
-### New
-
-- authorize: add additional tracing for rego evaluation [#2381](https://github.com/pomerium/pomerium/pull/2381) (@calebdoxsey)
-- authorize: do not send redirects to gRPC [#2314](https://github.com/pomerium/pomerium/pull/2314) (@wasaga)
-- authorize: handle grpc-web content types like json [#2268](https://github.com/pomerium/pomerium/pull/2268) (@calebdoxsey)
-- authorize: log additional session details [#2419](https://github.com/pomerium/pomerium/pull/2419) (@calebdoxsey)
-- authorize: log service account and impersonation details [#2354](https://github.com/pomerium/pomerium/pull/2354) (@calebdoxsey)
-- authorize: preserve original context [#2247](https://github.com/pomerium/pomerium/pull/2247) (@wasaga)
-- authorize: remove service account impersonate user id, email and groups [#2365](https://github.com/pomerium/pomerium/pull/2365) (@calebdoxsey)
-- certs: reject certs from databroker if they conflict with local [#2309](https://github.com/pomerium/pomerium/pull/2309) (@wasaga)
-- ci: use revive instead of golint [#2370](https://github.com/pomerium/pomerium/pull/2370) (@calebdoxsey)
-- cli: use proxy from environment [#2316](https://github.com/pomerium/pomerium/pull/2316) (@tskinn)
-- config: add enable_google_cloud_serverless_authentication to config protobuf [#2306](https://github.com/pomerium/pomerium/pull/2306) (@calebdoxsey)
-- config: add support for embedded PPL policy [#2401](https://github.com/pomerium/pomerium/pull/2401) (@calebdoxsey)
-- config: add warning about http URLs [#2358](https://github.com/pomerium/pomerium/pull/2358) (@calebdoxsey)
-- databroker: implement leases [#2172](https://github.com/pomerium/pomerium/pull/2172) (@calebdoxsey)
-- directory: add logging http client to help with debugging outbound http requests [#2385](https://github.com/pomerium/pomerium/pull/2385) (@calebdoxsey)
-- envoy: add full version [#2287](https://github.com/pomerium/pomerium/pull/2287) (@calebdoxsey)
-- envoy: disable timeouts for kubernetes [#2189](https://github.com/pomerium/pomerium/pull/2189) (@calebdoxsey)
-- envoy: refactor envoy embedding [#2296](https://github.com/pomerium/pomerium/pull/2296) (@calebdoxsey)
-- envoyconfig: add bootstrap layered runtime configuration [#2343](https://github.com/pomerium/pomerium/pull/2343) (@calebdoxsey)
-- envoyconfig: default zipkin path to / when empty [#2359](https://github.com/pomerium/pomerium/pull/2359) (@calebdoxsey)
-- envoyconfig: improvements [#2402](https://github.com/pomerium/pomerium/pull/2402) (@calebdoxsey)
-- envoyconfig: use zipkin tracer [#2265](https://github.com/pomerium/pomerium/pull/2265) (@calebdoxsey)
-- evaluator: use `cryptutil.Hash` for script spans [#2384](https://github.com/pomerium/pomerium/pull/2384) (@desimone)
-- k8s: add flush-credentials command [#2379](https://github.com/pomerium/pomerium/pull/2379) (@calebdoxsey)
-- Pomerium Policy Language [#2202](https://github.com/pomerium/pomerium/pull/2202) (@calebdoxsey)
-- ppl: add data type, implement string and list matchers [#2228](https://github.com/pomerium/pomerium/pull/2228) (@calebdoxsey)
-- ppl: convert config policy to ppl [#2218](https://github.com/pomerium/pomerium/pull/2218) (@calebdoxsey)
-- ppl: refactor authorize to evaluate PPL [#2224](https://github.com/pomerium/pomerium/pull/2224) (@calebdoxsey)
-- ppl: remove support for aliases [#2400](https://github.com/pomerium/pomerium/pull/2400) (@calebdoxsey)
-- proxy: add idle timeout [#2319](https://github.com/pomerium/pomerium/pull/2319) (@wasaga)
-- registry: implement redis backend [#2179](https://github.com/pomerium/pomerium/pull/2179) (@calebdoxsey)
-- registry/redis: call publish from within lua function [#2337](https://github.com/pomerium/pomerium/pull/2337) (@calebdoxsey)
-- report instance hostname in xds events [#2175](https://github.com/pomerium/pomerium/pull/2175) (@wasaga)
-- sessions: add impersonate_session_id, remove legacy impersonation [#2407](https://github.com/pomerium/pomerium/pull/2407) (@calebdoxsey)
-- telemetry: add hostname tag to metrics [#2191](https://github.com/pomerium/pomerium/pull/2191) (@wasaga)
-- telemetry: add nonce and make explicit ack/nack [#2434](https://github.com/pomerium/pomerium/pull/2434) (@wasaga)
-- telemetry: try guess hostname or external IP addr for metrics [#2412](https://github.com/pomerium/pomerium/pull/2412) (@wasaga)
-- tools: add tools.go to pin go run apps [#2344](https://github.com/pomerium/pomerium/pull/2344) (@calebdoxsey)
-- urlutil: improve error message for urls with port in path [#2377](https://github.com/pomerium/pomerium/pull/2377) (@calebdoxsey)
-- xds: retry storing configuration events [#2266](https://github.com/pomerium/pomerium/pull/2266) (@calebdoxsey)
-
-### Fixed
-
-- authorize: add sid to JWT claims [#2420](https://github.com/pomerium/pomerium/pull/2420) (@calebdoxsey)
-- authorize: allow redirects on deny [#2361](https://github.com/pomerium/pomerium/pull/2361) (@calebdoxsey)
-- authorize: decode CheckRequest path for redirect [#2357](https://github.com/pomerium/pomerium/pull/2357) (@calebdoxsey)
-- authorize: grpc health check [#2200](https://github.com/pomerium/pomerium/pull/2200) (@wasaga)
-- authorize: only redirect for HTML pages [#2264](https://github.com/pomerium/pomerium/pull/2264) (@calebdoxsey)
-- authorize: round timestamp [#2258](https://github.com/pomerium/pomerium/pull/2258) (@wasaga)
-- authorize: support boolean deny results [#2338](https://github.com/pomerium/pomerium/pull/2338) (@calebdoxsey)
-- ci: update gcloud action [#2393](https://github.com/pomerium/pomerium/pull/2393) (@travisgroth)
-- config: remove grpc server max connection age options [#2427](https://github.com/pomerium/pomerium/pull/2427) (@calebdoxsey)
-- config: warn about unrecognized keys [#2256](https://github.com/pomerium/pomerium/pull/2256) (@wasaga)
-- darwin: use gopsutil v3 to fix arm issue [#2245](https://github.com/pomerium/pomerium/pull/2245) (@calebdoxsey)
-- databroker: only tag contexts used for UpdateRecords [#2269](https://github.com/pomerium/pomerium/pull/2269) (@wasaga)
-- deployment: fix empty version on master builds [#2193](https://github.com/pomerium/pomerium/pull/2193) (@travisgroth)
-- directory/azure: add paging support to user group members call [#2311](https://github.com/pomerium/pomerium/pull/2311) (@calebdoxsey)
-- disable http/2 for websockets [#2399](https://github.com/pomerium/pomerium/pull/2399) (@calebdoxsey)
-- envoy: add global response headers to local replies [#2217](https://github.com/pomerium/pomerium/pull/2217) (@calebdoxsey)
-- envoy: always set jwt claim headers even if no value is available [#2261](https://github.com/pomerium/pomerium/pull/2261) (@calebdoxsey)
-- envoy: disable hot-reload for macos [#2259](https://github.com/pomerium/pomerium/pull/2259) (@calebdoxsey)
-- envoy: exit if envoy exits [#2240](https://github.com/pomerium/pomerium/pull/2240) (@calebdoxsey)
-- envoy: fix usage of codec_type with alpn [#2277](https://github.com/pomerium/pomerium/pull/2277) (@calebdoxsey)
-- envoy: only check for pid with monitor [#2355](https://github.com/pomerium/pomerium/pull/2355) (@calebdoxsey)
-- envoyconfig: fallback to global custom ca when no policy ca is defined [#2235](https://github.com/pomerium/pomerium/pull/2235) (@calebdoxsey)
-- envoyconfig: only delete cached files, ignore noisy error [#2356](https://github.com/pomerium/pomerium/pull/2356) (@calebdoxsey)
-- fix: timeout in protobuf [#2341](https://github.com/pomerium/pomerium/pull/2341) (@wasaga)
-- forward auth: don't strip query parameters [#2216](https://github.com/pomerium/pomerium/pull/2216) (@wasaga)
-- google: remove WithHTTPClient [#2391](https://github.com/pomerium/pomerium/pull/2391) (@calebdoxsey)
-- ocsp: reload on response changes [#2286](https://github.com/pomerium/pomerium/pull/2286) (@wasaga)
-- options: s/shared-key/shared secret [#2257](https://github.com/pomerium/pomerium/pull/2257) (@desimone)
-- policy: fix allowed idp claims PPL generation [#2243](https://github.com/pomerium/pomerium/pull/2243) (@calebdoxsey)
-- PPL: bubble up values, bug fixes [#2213](https://github.com/pomerium/pomerium/pull/2213) (@calebdoxsey)
-- ppl: fix not/nor rules [#2313](https://github.com/pomerium/pomerium/pull/2313) (@calebdoxsey)
-- proxy / controplane: use old upstream cipher suite [#2196](https://github.com/pomerium/pomerium/pull/2196) (@desimone)
-- redis: enforce capacity via ZREVRANGE to avoid race [#2267](https://github.com/pomerium/pomerium/pull/2267) (@calebdoxsey)
-- Revert "authenticate,proxy: add same site lax to cookies" [#2203](https://github.com/pomerium/pomerium/pull/2203) (@desimone)
-- telemetry: support b3 headers on gRPC server calls [#2376](https://github.com/pomerium/pomerium/pull/2376) (@calebdoxsey)
-- tracing: support dynamic reloading, more aggressive envoy restart [#2262](https://github.com/pomerium/pomerium/pull/2262) (@calebdoxsey)
-
-### Security
-
-- envoy: only allow embedding [#2368](https://github.com/pomerium/pomerium/pull/2368) (@calebdoxsey)
-- deps: bump envoy to v1.17.3 [#2198](https://github.com/pomerium/pomerium/pull/2198) (@travisgroth)
-
-### Documentation
-
-- add support for latest version of code-server [#2229](https://github.com/pomerium/pomerium/pull/2229) (@bpmct)
-- doc updates [#2433](https://github.com/pomerium/pomerium/pull/2433) (@calebdoxsey)
-- Docs bug fixes [#2362](https://github.com/pomerium/pomerium/pull/2362) (@alexfornuto)
-- Docs sorting [#2346](https://github.com/pomerium/pomerium/pull/2346) (@alexfornuto)
-- docs: add v0.14 feature highlights [#2183](https://github.com/pomerium/pomerium/pull/2183) (@travisgroth)
-- docs: add v0.14 feature highlights [#2184](https://github.com/pomerium/pomerium/pull/2184) (@github-actions[bot])
-- docs: clarify device identity, not state via client certs [#2428](https://github.com/pomerium/pomerium/pull/2428) (@desimone)
-- docs: google gcp / workspace instructions [#2272](https://github.com/pomerium/pomerium/pull/2272) (@desimone)
-- docs: Match Tenses [#2214](https://github.com/pomerium/pomerium/pull/2214) (@alexfornuto)
-- docs: only secure schemes are supported [#2408](https://github.com/pomerium/pomerium/pull/2408) (@desimone)
-- docs: rm broken link [#2215](https://github.com/pomerium/pomerium/pull/2215) (@alexfornuto)
-- docs: update \_redirects [#2237](https://github.com/pomerium/pomerium/pull/2237) (@desimone)
-- docs: update helm values for chart v20.0.0 [#2242](https://github.com/pomerium/pomerium/pull/2242) (@travisgroth)
-- docs: update slack link to vanity url [#2177](https://github.com/pomerium/pomerium/pull/2177) (@travisgroth)
-- docs/reference: Clarify use of idp_service_account [#2431](https://github.com/pomerium/pomerium/pull/2431) (@the-maldridge)
-- Enterprise Docs [#2390](https://github.com/pomerium/pomerium/pull/2390) (@alexfornuto)
-- fix(docs): use correct name for code-server [#2223](https://github.com/pomerium/pomerium/pull/2223) (@jsjoeio)
-- Helm Quickstart Update [#2380](https://github.com/pomerium/pomerium/pull/2380) (@alexfornuto)
-- Installation Docs Restructuring [#2406](https://github.com/pomerium/pomerium/pull/2406) (@alexfornuto)
-- symlink security policy to root of project [#2396](https://github.com/pomerium/pomerium/pull/2396) (@desimone)
-- Transmission BitTorrent Client Guide [#2281](https://github.com/pomerium/pomerium/pull/2281) (@alexfornuto)
-- Update Console installs to match signing_key [#2432](https://github.com/pomerium/pomerium/pull/2432) (@alexfornuto)
-- Update installation source for mkcert [#2340](https://github.com/pomerium/pomerium/pull/2340) (@alexfornuto)
-- Update kubernetes-dashboard.md [#2285](https://github.com/pomerium/pomerium/pull/2285) (@WeeHong)
-- Update programmatic-access.md [#2190](https://github.com/pomerium/pomerium/pull/2190) (@yyolk)
-- v0.15 release notes [#2409](https://github.com/pomerium/pomerium/pull/2409) (@travisgroth)
-
-### Dependency
-
-- chore(deps): bump github.com/caddyserver/certmagic from 0.13.0 to 0.13.1 [#2188](https://github.com/pomerium/pomerium/pull/2188) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.13.1 to 0.14.0 [#2291](https://github.com/pomerium/pomerium/pull/2291) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.14.0 to 0.14.1 [#2352](https://github.com/pomerium/pomerium/pull/2352) (@dependabot[bot])
-- chore(deps): bump github.com/cenkalti/backoff/v4 from 4.1.0 to 4.1.1 [#2252](https://github.com/pomerium/pomerium/pull/2252) (@dependabot[bot])
-- chore(deps): bump github.com/go-jose/go-jose/v3 from 3.0.0-rc.1 to 3.0.0 [#2421](https://github.com/pomerium/pomerium/pull/2421) (@dependabot[bot])
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.10.0 to 8.11.0 [#2329](https://github.com/pomerium/pomerium/pull/2329) (@dependabot[bot])
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.11.0 to 8.11.1 [#2413](https://github.com/pomerium/pomerium/pull/2413) (@dependabot[bot])
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.8.2 to 8.8.3 [#2232](https://github.com/pomerium/pomerium/pull/2232) (@dependabot[bot])
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.8.3 to 8.9.0 [#2249](https://github.com/pomerium/pomerium/pull/2249) (@dependabot[bot])
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.9.0 to 8.10.0 [#2276](https://github.com/pomerium/pomerium/pull/2276) (@dependabot[bot])
-- chore(deps): bump github.com/golang/mock from 1.5.0 to 1.6.0 [#2290](https://github.com/pomerium/pomerium/pull/2290) (@dependabot[bot])
-- chore(deps): bump github.com/golangci/golangci-lint from 1.40.1 to 1.41.1 [#2353](https://github.com/pomerium/pomerium/pull/2353) (@dependabot[bot])
-- chore(deps): bump github.com/google/go-cmp from 0.5.5 to 0.5.6 [#2253](https://github.com/pomerium/pomerium/pull/2253) (@dependabot[bot])
-- chore(deps): bump github.com/google/uuid from 1.2.0 to 1.3.0 [#2374](https://github.com/pomerium/pomerium/pull/2374) (@dependabot[bot])
-- chore(deps): bump github.com/lithammer/shortuuid/v3 from 3.0.6 to 3.0.7 [#2211](https://github.com/pomerium/pomerium/pull/2211) (@dependabot[bot])
-- chore(deps): bump github.com/mitchellh/hashstructure/v2 from 2.0.1 to 2.0.2 [#2251](https://github.com/pomerium/pomerium/pull/2251) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.28.0 to 0.29.4 [#2255](https://github.com/pomerium/pomerium/pull/2255) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.29.4 to 0.30.1 [#2323](https://github.com/pomerium/pomerium/pull/2323) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.30.1 to 0.30.2 [#2373](https://github.com/pomerium/pomerium/pull/2373) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.30.2 to 0.31.0 [#2416](https://github.com/pomerium/pomerium/pull/2416) (@dependabot[bot])
-- chore(deps): bump github.com/ory/dockertest/v3 from 3.6.5 to 3.7.0 [#2303](https://github.com/pomerium/pomerium/pull/2303) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/client_golang from 1.10.0 to 1.11.0 [#2294](https://github.com/pomerium/pomerium/pull/2294) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.23.0 to 0.24.0 [#2210](https://github.com/pomerium/pomerium/pull/2210) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.24.0 to 0.25.0 [#2234](https://github.com/pomerium/pomerium/pull/2234) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.25.0 to 0.29.0 [#2289](https://github.com/pomerium/pomerium/pull/2289) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.29.0 to 0.30.0 [#2417](https://github.com/pomerium/pomerium/pull/2417) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/procfs from 0.6.0 to 0.7.0 [#2328](https://github.com/pomerium/pomerium/pull/2328) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/procfs from 0.7.0 to 0.7.1 [#2395](https://github.com/pomerium/pomerium/pull/2395) (@dependabot[bot])
-- chore(deps): bump github.com/rs/cors from 1.7.0 to 1.8.0 [#2334](https://github.com/pomerium/pomerium/pull/2334) (@dependabot[bot])
-- chore(deps): bump github.com/rs/zerolog from 1.21.0 to 1.22.0 [#2209](https://github.com/pomerium/pomerium/pull/2209) (@dependabot[bot])
-- chore(deps): bump github.com/rs/zerolog from 1.22.0 to 1.23.0 [#2293](https://github.com/pomerium/pomerium/pull/2293) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.4 to 3.21.5 [#2274](https://github.com/pomerium/pomerium/pull/2274) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.5 to 3.21.6 [#2326](https://github.com/pomerium/pomerium/pull/2326) (@dependabot[bot])
-- chore(deps): bump github.com/shirou/gopsutil/v3 from 3.21.6 to 3.21.7 [#2414](https://github.com/pomerium/pomerium/pull/2414) (@dependabot[bot])
-- chore(deps): bump github.com/spf13/cobra from 1.1.3 to 1.2.1 [#2330](https://github.com/pomerium/pomerium/pull/2330) (@dependabot[bot])
-- chore(deps): bump github.com/spf13/viper from 1.7.1 to 1.8.0 [#2305](https://github.com/pomerium/pomerium/pull/2305) (@dependabot[bot])
-- chore(deps): bump github.com/spf13/viper from 1.8.0 to 1.8.1 [#2317](https://github.com/pomerium/pomerium/pull/2317) (@dependabot[bot])
-- chore(deps): bump go.uber.org/zap from 1.16.0 to 1.17.0 [#2254](https://github.com/pomerium/pomerium/pull/2254) (@dependabot[bot])
-- chore(deps): bump go.uber.org/zap from 1.17.0 to 1.18.1 [#2325](https://github.com/pomerium/pomerium/pull/2325) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.45.0 to 0.46.0 [#2186](https://github.com/pomerium/pomerium/pull/2186) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.46.0 to 0.47.0 [#2233](https://github.com/pomerium/pomerium/pull/2233) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.47.0 to 0.48.0 [#2295](https://github.com/pomerium/pomerium/pull/2295) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.48.0 to 0.49.0 [#2315](https://github.com/pomerium/pomerium/pull/2315) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.49.0 to 0.50.0 [#2333](https://github.com/pomerium/pomerium/pull/2333) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.50.0 to 0.51.0 [#2394](https://github.com/pomerium/pomerium/pull/2394) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.51.0 to 0.52.0 [#2415](https://github.com/pomerium/pomerium/pull/2415) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.37.0 to 1.37.1 [#2207](https://github.com/pomerium/pomerium/pull/2207) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.37.1 to 1.38.0 [#2231](https://github.com/pomerium/pomerium/pull/2231) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.38.0 to 1.39.0 [#2324](https://github.com/pomerium/pomerium/pull/2324) (@dependabot[bot])
-- chore(deps): bump google.golang.org/protobuf from 1.26.0 to 1.27.0 [#2318](https://github.com/pomerium/pomerium/pull/2318) (@dependabot[bot])
-- chore(deps): bump gopkg.in/auth0.v5 from 5.15.0 to 5.16.0 [#2187](https://github.com/pomerium/pomerium/pull/2187) (@dependabot[bot])
-- chore(deps): bump gopkg.in/auth0.v5 from 5.16.0 to 5.17.0 [#2208](https://github.com/pomerium/pomerium/pull/2208) (@dependabot[bot])
-- chore(deps): bump gopkg.in/auth0.v5 from 5.17.0 to 5.18.0 [#2292](https://github.com/pomerium/pomerium/pull/2292) (@dependabot[bot])
-- chore(deps): bump gopkg.in/auth0.v5 from 5.18.0 to 5.19.1 [#2304](https://github.com/pomerium/pomerium/pull/2304) (@dependabot[bot])
-- chore(deps): bump gopkg.in/auth0.v5 from 5.19.1 to 5.19.2 [#2422](https://github.com/pomerium/pomerium/pull/2422) (@dependabot[bot])
-- chore(deps): bump gopkg.in/square/go-jose.v2 from 2.5.1 to 2.6.0 [#2273](https://github.com/pomerium/pomerium/pull/2273) (@dependabot[bot])
-- chore(deps): upgrade kind action to v1.2.0 [#2331](https://github.com/pomerium/pomerium/pull/2331) (@travisgroth)
-- ci: convert to FOSSA scan [#2371](https://github.com/pomerium/pomerium/pull/2371) (@travisgroth)
-- darwin: use x86 envoy build for arm64 [#2246](https://github.com/pomerium/pomerium/pull/2246) (@calebdoxsey)
-- dependency: update /x/net [#2227](https://github.com/pomerium/pomerium/pull/2227) (@desimone)
-- deps: upgrade to go-jose v3 [#2284](https://github.com/pomerium/pomerium/pull/2284) (@calebdoxsey)
-
-### Changed
-
-- build: add envoy files to `make clean` [#2411](https://github.com/pomerium/pomerium/pull/2411) (@travisgroth)
-- ci: add coveralls [#2279](https://github.com/pomerium/pomerium/pull/2279) (@travisgroth)
-- ci: use github app for backport credentials [#2369](https://github.com/pomerium/pomerium/pull/2369) (@travisgroth)
-- databroker: tests [#2367](https://github.com/pomerium/pomerium/pull/2367) (@calebdoxsey)
-- envoy: bump to 1.19 [#2392](https://github.com/pomerium/pomerium/pull/2392) (@travisgroth)
-- internal/envoy: add debugging information if envoy is no longer running [#2320](https://github.com/pomerium/pomerium/pull/2320) (@travisgroth)
-- redis: increase timeout on test [#2425](https://github.com/pomerium/pomerium/pull/2425) (@calebdoxsey)
-- redis: refactor change signal test to be more deterministic [#2335](https://github.com/pomerium/pomerium/pull/2335) (@calebdoxsey)
-- storage/inmemory: add tests for close behavior [#2336](https://github.com/pomerium/pomerium/pull/2336) (@calebdoxsey)
-
-## [v0.14.7](https://github.com/pomerium/pomerium/tree/v0.14.7) (2021-06-24)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.6...v0.14.7)
-
-### Fixed
-
-- directory/azure: add paging support to user group members call [#2312](https://github.com/pomerium/pomerium/pull/2312) (@github-actions[bot])
-
-## [v0.14.6](https://github.com/pomerium/pomerium/tree/v0.14.6) (2021-06-16)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.5...v0.14.6)
-
-### Fixed
-
-- authorize: only redirect for HTML pages (#2264) [#2298](https://github.com/pomerium/pomerium/pull/2298) (@calebdoxsey)
-
-## [v0.14.5](https://github.com/pomerium/pomerium/tree/v0.14.5) (2021-06-07)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.4...v0.14.5)
-
-### Fixed
-
-- envoy: fix usage of codec_type with alpn [#2278](https://github.com/pomerium/pomerium/pull/2278) (@github-actions[bot])
-- authorize: round JWT claim timestamps [#2260](https://github.com/pomerium/pomerium/pull/2260) (@wasaga)
-
-### Documentation
-
-- docs: update helm values for chart v20.0.0 [#2244](https://github.com/pomerium/pomerium/pull/2244) (@github-actions[bot])
-- docs: update \_redirects [#2238](https://github.com/pomerium/pomerium/pull/2238) (@github-actions[bot])
-
-## [v0.14.4](https://github.com/pomerium/pomerium/tree/v0.14.4) (2021-05-24)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.3...v0.14.4)
-
-### Fixed
-
-- authorize: add rego functions to custom evaluator [#2236](https://github.com/pomerium/pomerium/pull/2236) (@calebdoxsey)
-
-## [v0.14.3](https://github.com/pomerium/pomerium/tree/v0.14.3) (2021-05-21)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.2...v0.14.3)
-
-### Fixed
-
-- authorize: fix custom rego panic [#2226](https://github.com/pomerium/pomerium/pull/2226) (@calebdoxsey)
-
-### Changed
-
-- envoy: add global response headers to local replies [#2225](https://github.com/pomerium/pomerium/pull/2225) (@github-actions[bot])
-
-## [v0.14.2](https://github.com/pomerium/pomerium/tree/v0.14.2) (2021-05-17)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.1...v0.14.2)
-
-### Fixed
-
-- Revert "authenticate,proxy: add same site lax to cookies" [#2204](https://github.com/pomerium/pomerium/pull/2204) (@github-actions[bot])
-
-### Documentation
-
-- Update programmatic-access.md [#2205](https://github.com/pomerium/pomerium/pull/2205) (@github-actions[bot])
-
-## [v0.14.1](https://github.com/pomerium/pomerium/tree/v0.14.1) (2021-05-13)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.0...v0.14.1)
-
-### Fixed
-
-- proxy / controplane: use old upstream cipher suite [#2197](https://github.com/pomerium/pomerium/pull/2197) (@github-actions[bot])
-
-### Security
-
-- deps: bump envoy to v1.17.3 [#2199](https://github.com/pomerium/pomerium/pull/2199) (@github-actions[bot])
-
-### Documentation
-
-- docs: update slack link to vanity url [#2178](https://github.com/pomerium/pomerium/pull/2178) (@github-actions[bot])
-
-## [v0.14.0](https://github.com/pomerium/pomerium/tree/v0.14.0) (2021-05-04)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.0-rc2...v0.14.0)
-
-### New
-
-- assets: use embed instead of statik [#1960](https://github.com/pomerium/pomerium/pull/1960) (@calebdoxsey)
-- authenticate,proxy: add same site lax to cookies [#2159](https://github.com/pomerium/pomerium/pull/2159) (@calebdoxsey)
-- authenticate: fix default sign out url [#2061](https://github.com/pomerium/pomerium/pull/2061) (@calebdoxsey)
-- authenticate: validate origin of signout [#1876](https://github.com/pomerium/pomerium/pull/1876) (@desimone)
-- authorize: add databroker server and record version to result, force sync via polling [#2024](https://github.com/pomerium/pomerium/pull/2024) (@calebdoxsey)
-- authorize: additional tracing, add benchmark for encryptor [#2059](https://github.com/pomerium/pomerium/pull/2059) (@calebdoxsey)
-- authorize: audit log had duplicate "message" key [#2141](https://github.com/pomerium/pomerium/pull/2141) (@desimone)
-- authorize: audit logging [#2050](https://github.com/pomerium/pomerium/pull/2050) (@calebdoxsey)
-- authorize: bypass data in rego for databroker data [#2041](https://github.com/pomerium/pomerium/pull/2041) (@calebdoxsey)
-- authorize: fix empty sub policy arrays [#2119](https://github.com/pomerium/pomerium/pull/2119) (@calebdoxsey)
-- authorize: fix unsigned URL [#2118](https://github.com/pomerium/pomerium/pull/2118) (@calebdoxsey)
-- authorize: move headers and jwt signing to rego [#1856](https://github.com/pomerium/pomerium/pull/1856) (@calebdoxsey)
-- authorize: refactor store locking [#2151](https://github.com/pomerium/pomerium/pull/2151) (@calebdoxsey)
-- authorize: set JWT to expire after 5 minutes [#1980](https://github.com/pomerium/pomerium/pull/1980) (@calebdoxsey)
-- authorize: support arbitrary jwt claims [#2102](https://github.com/pomerium/pomerium/pull/2102) (@calebdoxsey)
-- authorize: support arbitrary jwt claims [#2106](https://github.com/pomerium/pomerium/pull/2106) (@github-actions[bot])
-- autocert: add metrics for renewal count, total and next expiration [#2019](https://github.com/pomerium/pomerium/pull/2019) (@calebdoxsey)
-- autocert: remove non-determinism [#1932](https://github.com/pomerium/pomerium/pull/1932) (@calebdoxsey)
-- change require_proxy_protocol to use_proxy_protocol [#2043](https://github.com/pomerium/pomerium/pull/2043) (@contrun)
-- ci: pin goreleaser version [#1900](https://github.com/pomerium/pomerium/pull/1900) (@travisgroth)
-- cmd/pomerium: exit 0 for normal shutdown [#1958](https://github.com/pomerium/pomerium/pull/1958) (@travisgroth)
-- config: add CertificateFiles to FileWatcherSource list [#1878](https://github.com/pomerium/pomerium/pull/1878) (@travisgroth)
-- config: add client_crl [#2157](https://github.com/pomerium/pomerium/pull/2157) (@calebdoxsey)
-- config: add headers to config proto [#1996](https://github.com/pomerium/pomerium/pull/1996) (@calebdoxsey)
-- config: add metrics_basic_auth option [#1917](https://github.com/pomerium/pomerium/pull/1917) (@calebdoxsey)
-- config: add rewrite_response_headers option [#1961](https://github.com/pomerium/pomerium/pull/1961) (@calebdoxsey)
-- config: add rewrite_response_headers to protobuf [#1962](https://github.com/pomerium/pomerium/pull/1962) (@calebdoxsey)
-- config: add support for codec_type [#2156](https://github.com/pomerium/pomerium/pull/2156) (@calebdoxsey)
-- config: add support for set_response_headers in a policy [#2171](https://github.com/pomerium/pomerium/pull/2171) (@calebdoxsey)
-- config: allow customization of envoy boostrap admin options [#1872](https://github.com/pomerium/pomerium/pull/1872) (@calebdoxsey)
-- config: don't change address value on databroker or authorize [#2092](https://github.com/pomerium/pomerium/pull/2092) (@travisgroth)
-- config: fix redirect routes from protobuf [#1930](https://github.com/pomerium/pomerium/pull/1930) (@travisgroth)
-- config: log config source changes [#1959](https://github.com/pomerium/pomerium/pull/1959) (@calebdoxsey)
-- config: multiple endpoints for authorize and databroker [#1957](https://github.com/pomerium/pomerium/pull/1957) (@calebdoxsey)
-- config: remove validate side effects [#2109](https://github.com/pomerium/pomerium/pull/2109) (@calebdoxsey)
-- config: rename headers to set_response_headers [#2081](https://github.com/pomerium/pomerium/pull/2081) (@calebdoxsey)
-- config: support map of jwt claim headers [#1906](https://github.com/pomerium/pomerium/pull/1906) (@calebdoxsey)
-- config: use getters for authenticate, signout and forward auth urls [#2000](https://github.com/pomerium/pomerium/pull/2000) (@calebdoxsey)
-- config: use getters for certificates [#2001](https://github.com/pomerium/pomerium/pull/2001) (@calebdoxsey)
-- config: use tls_custom_ca from policy when available [#2077](https://github.com/pomerium/pomerium/pull/2077) (@calebdoxsey)
-- control plane: add request id to all error pages [#2149](https://github.com/pomerium/pomerium/pull/2149) (@desimone)
-- controlplane: add global headers to virtualhost [#1861](https://github.com/pomerium/pomerium/pull/1861) (@desimone)
-- controlplane: save configuration events to databroker [#2153](https://github.com/pomerium/pomerium/pull/2153) (@calebdoxsey)
-- crypto: use actual bytes of shared secret, not the base64 encoded representation [#2075](https://github.com/pomerium/pomerium/pull/2075) (@calebdoxsey)
-- cryptutil: add envelope encryption w/key encryption key and data encryption key [#2020](https://github.com/pomerium/pomerium/pull/2020) (@calebdoxsey)
-- cryptutil: always use kek public id, add x509 support [#2066](https://github.com/pomerium/pomerium/pull/2066) (@calebdoxsey)
-- cryptutil: use bytes for hmac [#2067](https://github.com/pomerium/pomerium/pull/2067) (@calebdoxsey)
-- databroker: add options for maximum capacity [#2095](https://github.com/pomerium/pomerium/pull/2095) (@calebdoxsey)
-- databroker: refactor databroker to sync all changes [#1879](https://github.com/pomerium/pomerium/pull/1879) (@calebdoxsey)
-- databroker: remove unused installation id, close streams when backend is closed [#2062](https://github.com/pomerium/pomerium/pull/2062) (@calebdoxsey)
-- databroker: return server version in Get [#2039](https://github.com/pomerium/pomerium/pull/2039) (@wasaga)
-- databroker: store issued at timestamp with session [#2173](https://github.com/pomerium/pomerium/pull/2173) (@calebdoxsey)
-- databroker: store server version in backend [#2142](https://github.com/pomerium/pomerium/pull/2142) (@calebdoxsey)
-- deployment: update alpine debug image dependencies [#2154](https://github.com/pomerium/pomerium/pull/2154) (@travisgroth)
-- Drop tun.cfg.dstHost from jwtCacheKey [#2115](https://github.com/pomerium/pomerium/pull/2115) (@bl0m1)
-- envoy: re-implement recommended defaults [#2123](https://github.com/pomerium/pomerium/pull/2123) (@calebdoxsey)
-- envoy: refactor controlplane xds to new envoyconfig package [#2086](https://github.com/pomerium/pomerium/pull/2086) (@calebdoxsey)
-- envoy: upgrade to v1.17.1 [#1993](https://github.com/pomerium/pomerium/pull/1993) (@calebdoxsey)
-- envoy: validate binary checksum [#1908](https://github.com/pomerium/pomerium/pull/1908) (@calebdoxsey)
-- envoyconfig: fix metrics ingress listener name [#2124](https://github.com/pomerium/pomerium/pull/2124) (@calebdoxsey)
-- envoyconfig: move most bootstrap config to shared package [#2088](https://github.com/pomerium/pomerium/pull/2088) (@calebdoxsey)
-- Fix process cpu usage metric [#1979](https://github.com/pomerium/pomerium/pull/1979) (@wasaga)
-- fix registry test [#1911](https://github.com/pomerium/pomerium/pull/1911) (@wasaga)
-- google: fix default provider URL [#1928](https://github.com/pomerium/pomerium/pull/1928) (@calebdoxsey)
-- httputil: fix SPDY support with reverse proxy [#2134](https://github.com/pomerium/pomerium/pull/2134) (@calebdoxsey)
-- identity: infer email from mail claim [#1977](https://github.com/pomerium/pomerium/pull/1977) (@calebdoxsey)
-- identity: record metric for last refresh [#1936](https://github.com/pomerium/pomerium/pull/1936) (@calebdoxsey)
-- let pass custom dial opts [#2144](https://github.com/pomerium/pomerium/pull/2144) (@wasaga)
-- log context [#2107](https://github.com/pomerium/pomerium/pull/2107) (@wasaga)
-- metrics_address should be optional parameter [#2087](https://github.com/pomerium/pomerium/pull/2087) (@wasaga)
-- metrics: add TLS options [#1939](https://github.com/pomerium/pomerium/pull/1939) (@calebdoxsey)
-- middleware: basic auth equalize lengths of input [#1934](https://github.com/pomerium/pomerium/pull/1934) (@desimone)
-- onelogin: fix default scopes for v2 [#1896](https://github.com/pomerium/pomerium/pull/1896) (@calebdoxsey)
-- options: header only applies to routes and authN [#1862](https://github.com/pomerium/pomerium/pull/1862) (@desimone)
-- ping: identity and directory providers [#1975](https://github.com/pomerium/pomerium/pull/1975) (@calebdoxsey)
-- propagate changes back from encrypted backend [#2079](https://github.com/pomerium/pomerium/pull/2079) (@wasaga)
-- protoutil: add generic transformer [#2023](https://github.com/pomerium/pomerium/pull/2023) (@calebdoxsey)
-- proxy: add nil check for fix-misdirected [#2040](https://github.com/pomerium/pomerium/pull/2040) (@calebdoxsey)
-- proxy: implement pass-through for authenticate backend [#1870](https://github.com/pomerium/pomerium/pull/1870) (@calebdoxsey)
-- proxy: redirect to dashboard for logout [#1944](https://github.com/pomerium/pomerium/pull/1944) (@calebdoxsey)
-- redis: add redis cluster support [#1992](https://github.com/pomerium/pomerium/pull/1992) (@calebdoxsey)
-- redis: add support for redis-sentinel [#1991](https://github.com/pomerium/pomerium/pull/1991) (@calebdoxsey)
-- redis: fix deletion versioning [#1871](https://github.com/pomerium/pomerium/pull/1871) (@calebdoxsey)
-- Remove internal/protoutil. [#1893](https://github.com/pomerium/pomerium/pull/1893) (@yegle)
-- support host:port in metrics_address [#2042](https://github.com/pomerium/pomerium/pull/2042) (@wasaga)
-- telemetry: add installation id [#2017](https://github.com/pomerium/pomerium/pull/2017) (@calebdoxsey)
-- telemetry: add process collector for envoy [#1948](https://github.com/pomerium/pomerium/pull/1948) (@calebdoxsey)
-- unique envoy cluster ids [#1858](https://github.com/pomerium/pomerium/pull/1858) (@wasaga)
-- use build_info as liveness gauge metric [#1940](https://github.com/pomerium/pomerium/pull/1940) (@wasaga)
-- xds extended event [#2158](https://github.com/pomerium/pomerium/pull/2158) (@wasaga)
-- xds: fix misdirected script [#1895](https://github.com/pomerium/pomerium/pull/1895) (@calebdoxsey)
-- xds: use ALPN Auto config for upstream protocol when possible [#1995](https://github.com/pomerium/pomerium/pull/1995) (@calebdoxsey)
-- xdsmgr: update resource versions on NACK [#2093](https://github.com/pomerium/pomerium/pull/2093) (@calebdoxsey)
-
-### Security
-
-- authenticate: validate signature on /.pomerium, /.pomerium/sign_in and /.pomerium/sign_out [#2048](https://github.com/pomerium/pomerium/pull/2048) (@travisgroth)
-
-- ci: remove codecov [#2161](https://github.com/pomerium/pomerium/pull/2161) (@travisgroth)
-
-- deps: bump envoy to 1.17.2 [#2113](https://github.com/pomerium/pomerium/pull/2113) (@travisgroth)
-
-- deps: bump envoy to 1.17.2 [#2114](https://github.com/pomerium/pomerium/pull/2114) (@github-actions[bot])
-- internal/envoy: always extract envoy [#2160](https://github.com/pomerium/pomerium/pull/2160) (@travisgroth)
-- proxy: restrict programmatic URLs to localhost [#2049](https://github.com/pomerium/pomerium/pull/2049) (@travisgroth)
-
-### Documentation
-
-- docs: add breaking sa changes in v0.13 [#1919](https://github.com/pomerium/pomerium/pull/1919) (@desimone)
-- docs: add info note to set_response_headers [#2162](https://github.com/pomerium/pomerium/pull/2162) (@calebdoxsey)
-- docs: add inline instructions to generate signing-key [#2164](https://github.com/pomerium/pomerium/pull/2164) (@desimone)
-- docs: add JWT Verification w/Envoy guide [#1974](https://github.com/pomerium/pomerium/pull/1974) (@calebdoxsey)
-- docs: add load balancing weight documentation [#1883](https://github.com/pomerium/pomerium/pull/1883) (@travisgroth)
-- docs: add threat model to security page [#2097](https://github.com/pomerium/pomerium/pull/2097) (@desimone)
-- docs: add v0.13 to docs site menu [#1913](https://github.com/pomerium/pomerium/pull/1913) (@travisgroth)
-- docs: additional load balancing documentation [#1875](https://github.com/pomerium/pomerium/pull/1875) (@travisgroth)
-- docs: fix query param name [#1920](https://github.com/pomerium/pomerium/pull/1920) (@calebdoxsey)
-- docs: mention alternative bearer token header format [#2155](https://github.com/pomerium/pomerium/pull/2155) (@travisgroth)
-- docs: misc upgrade notes and changelog [#1884](https://github.com/pomerium/pomerium/pull/1884) (@travisgroth)
-- docs: update changelog for v0.13.0 [#1909](https://github.com/pomerium/pomerium/pull/1909) (@desimone)
-- docs: update community slack link [#2063](https://github.com/pomerium/pomerium/pull/2063) (@travisgroth)
-- docs: update security policy [#1897](https://github.com/pomerium/pomerium/pull/1897) (@desimone)
-- docs: upgrade notes on `allowed\_users` by ID [#2133](https://github.com/pomerium/pomerium/pull/2133) (@travisgroth)
-- ping: add documentation [#1976](https://github.com/pomerium/pomerium/pull/1976) (@calebdoxsey)
-- Update data-storage.md [#1941](https://github.com/pomerium/pomerium/pull/1941) (@TanguyPatte)
-- Update local-oidc.md [#1994](https://github.com/pomerium/pomerium/pull/1994) (@dharmendrakariya)
-
-### Dependency
-
-- chore(deps): bump github.com/caddyserver/certmagic from 0.12.0 to 0.13.0 [#2074](https://github.com/pomerium/pomerium/pull/2074) (@dependabot[bot])
-- chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.5.1 to 0.6.0 [#2129](https://github.com/pomerium/pomerium/pull/2129) (@dependabot[bot])
-- chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.6.0 to 0.6.1 [#2166](https://github.com/pomerium/pomerium/pull/2166) (@dependabot[bot])
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.8.0 to 8.8.2 [#2099](https://github.com/pomerium/pomerium/pull/2099) (@dependabot[bot])
-- chore(deps): bump github.com/open-policy-agent/opa from 0.27.1 to 0.28.0 [#2165](https://github.com/pomerium/pomerium/pull/2165) (@dependabot[bot])
-- chore(deps): bump github.com/ory/dockertest/v3 from 3.6.3 to 3.6.5 [#2168](https://github.com/pomerium/pomerium/pull/2168) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.20.0 to 0.21.0 [#2130](https://github.com/pomerium/pomerium/pull/2130) (@dependabot[bot])
-- chore(deps): bump github.com/prometheus/common from 0.21.0 to 0.23.0 [#2167](https://github.com/pomerium/pomerium/pull/2167) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.43.0 to 0.44.0 [#2073](https://github.com/pomerium/pomerium/pull/2073) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.44.0 to 0.45.0 [#2128](https://github.com/pomerium/pomerium/pull/2128) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.36.1 to 1.37.0 [#2072](https://github.com/pomerium/pomerium/pull/2072) (@dependabot[bot])
-- chore(deps): bump gopkg.in/auth0.v5 from 5.13.0 to 5.14.1 [#2071](https://github.com/pomerium/pomerium/pull/2071) (@dependabot[bot])
-- chore(deps): bump gopkg.in/auth0.v5 from 5.14.1 to 5.15.0 [#2098](https://github.com/pomerium/pomerium/pull/2098) (@dependabot[bot])
-- chore(deps): update codecov/codecov-action action to v1.3.1 [#1985](https://github.com/pomerium/pomerium/pull/1985) (@renovate[bot])
-- chore(deps): update golang.org/x/oauth2 commit hash to 0101308 [#1863](https://github.com/pomerium/pomerium/pull/1863) (@renovate[bot])
-- chore(deps): update golang.org/x/oauth2 commit hash to 6667018 [#1886](https://github.com/pomerium/pomerium/pull/1886) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to bba0dbe [#1864](https://github.com/pomerium/pomerium/pull/1864) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to e7f2df4 [#1887](https://github.com/pomerium/pomerium/pull/1887) (@renovate[bot])
-- chore(deps): update mikefarah/yq action to v4.5.0 [#1865](https://github.com/pomerium/pomerium/pull/1865) (@renovate[bot])
-- chore(deps): update mikefarah/yq action to v4.5.1 [#1888](https://github.com/pomerium/pomerium/pull/1888) (@renovate[bot])
-- chore(deps): update mikefarah/yq action to v4.6.1 [#1951](https://github.com/pomerium/pomerium/pull/1951) (@renovate[bot])
-- chore(deps): update mikefarah/yq action to v4.6.2 [#2007](https://github.com/pomerium/pomerium/pull/2007) (@renovate[bot])
-- chore(deps): update mikefarah/yq action to v4.6.3 [#2031](https://github.com/pomerium/pomerium/pull/2031) (@renovate[bot])
-- chore(deps): update module auth0 to v5 [#1868](https://github.com/pomerium/pomerium/pull/1868) (@renovate[bot])
-- chore(deps): update module go-redis/redis/v8 to v8.5.0 [#1866](https://github.com/pomerium/pomerium/pull/1866) (@renovate[bot])
-- chore(deps): update module google.golang.org/api to v0.39.0 [#1867](https://github.com/pomerium/pomerium/pull/1867) (@renovate[bot])
-- chore(deps): update module google.golang.org/api to v0.40.0 [#1889](https://github.com/pomerium/pomerium/pull/1889) (@renovate[bot])
-- chore(deps): update module spf13/cobra to v1.1.3 [#1890](https://github.com/pomerium/pomerium/pull/1890) (@renovate[bot])
-- chore(deps): update vuepress monorepo to v1.8.1 [#1891](https://github.com/pomerium/pomerium/pull/1891) (@renovate[bot])
-- chore(deps): update vuepress monorepo to v1.8.2 [#1952](https://github.com/pomerium/pomerium/pull/1952) (@renovate[bot])
-- chore(deps): update yaml v2 to v3 [#1927](https://github.com/pomerium/pomerium/pull/1927) (@desimone)
-- deps: bundle all patch upgrades in a single group [#2016](https://github.com/pomerium/pomerium/pull/2016) (@travisgroth)
-- deps: switch from renovate to dependabot [#2069](https://github.com/pomerium/pomerium/pull/2069) (@travisgroth)
-- do not require project be in GOPATH/src [#2078](https://github.com/pomerium/pomerium/pull/2078) (@wasaga)
-- fix(deps): update github.com/nsf/jsondiff commit hash to 6ea3239 [#1965](https://github.com/pomerium/pomerium/pull/1965) (@renovate[bot])
-- fix(deps): update golang.org/x/crypto commit hash to 0c34fe9 [#2027](https://github.com/pomerium/pomerium/pull/2027) (@renovate[bot])
-- fix(deps): update golang.org/x/crypto commit hash to 513c2a4 [#1982](https://github.com/pomerium/pomerium/pull/1982) (@renovate[bot])
-- fix(deps): update golang.org/x/net commit hash to 0fccb6f [#2052](https://github.com/pomerium/pomerium/pull/2052) (@renovate[bot])
-- fix(deps): update golang.org/x/net commit hash to 61e0566 [#2028](https://github.com/pomerium/pomerium/pull/2028) (@renovate[bot])
-- fix(deps): update golang.org/x/net commit hash to d523dce [#2005](https://github.com/pomerium/pomerium/pull/2005) (@renovate[bot])
-- fix(deps): update golang.org/x/net commit hash to e18ecbb [#1949](https://github.com/pomerium/pomerium/pull/1949) (@renovate[bot])
-- fix(deps): update golang.org/x/oauth2 commit hash to 22b0ada [#2029](https://github.com/pomerium/pomerium/pull/2029) (@renovate[bot])
-- fix(deps): update golang.org/x/oauth2 commit hash to 2e8d934 [#2053](https://github.com/pomerium/pomerium/pull/2053) (@renovate[bot])
-- fix(deps): update golang.org/x/oauth2 commit hash to cd4f82c [#1983](https://github.com/pomerium/pomerium/pull/1983) (@renovate[bot])
-- fix(deps): update google.golang.org/genproto commit hash to 5f0e893 [#2006](https://github.com/pomerium/pomerium/pull/2006) (@renovate[bot])
-- fix(deps): update google.golang.org/genproto commit hash to 679c6ae [#2030](https://github.com/pomerium/pomerium/pull/2030) (@renovate[bot])
-- fix(deps): update google.golang.org/genproto commit hash to 6c239bb [#2054](https://github.com/pomerium/pomerium/pull/2054) (@renovate[bot])
-- fix(deps): update google.golang.org/genproto commit hash to 8812039 [#1984](https://github.com/pomerium/pomerium/pull/1984) (@renovate[bot])
-- fix(deps): update google.golang.org/genproto commit hash to 9728d6b [#1966](https://github.com/pomerium/pomerium/pull/1966) (@renovate[bot])
-- fix(deps): update google.golang.org/genproto commit hash to ab064af [#1950](https://github.com/pomerium/pomerium/pull/1950) (@renovate[bot])
-- fix(deps): update module contrib.go.opencensus.io/exporter/prometheus to v0.3.0 [#1986](https://github.com/pomerium/pomerium/pull/1986) (@renovate[bot])
-- fix(deps): update module github.com/envoyproxy/protoc-gen-validate to v0.5.0 [#2008](https://github.com/pomerium/pomerium/pull/2008) (@renovate[bot])
-- fix(deps): update module github.com/envoyproxy/protoc-gen-validate to v0.5.1 [#2056](https://github.com/pomerium/pomerium/pull/2056) (@renovate[bot])
-- fix(deps): update module github.com/go-chi/chi to v5 [#1956](https://github.com/pomerium/pomerium/pull/1956) (@renovate[bot])
-- fix(deps): update module github.com/go-redis/redis/v8 to v8.7.1 [#1967](https://github.com/pomerium/pomerium/pull/1967) (@renovate[bot])
-- fix(deps): update module github.com/go-redis/redis/v8 to v8.8.0 [#2032](https://github.com/pomerium/pomerium/pull/2032) (@renovate[bot])
-- fix(deps): update module github.com/golang/protobuf to v1.5.1 [#2009](https://github.com/pomerium/pomerium/pull/2009) (@renovate[bot])
-- fix(deps): update module github.com/golang/protobuf to v1.5.2 [#2057](https://github.com/pomerium/pomerium/pull/2057) (@renovate[bot])
-- fix(deps): update module github.com/google/btree to v1.0.1 [#2010](https://github.com/pomerium/pomerium/pull/2010) (@renovate[bot])
-- fix(deps): update module github.com/google/go-cmp to v0.5.5 [#1968](https://github.com/pomerium/pomerium/pull/1968) (@renovate[bot])
-- fix(deps): update module github.com/hashicorp/go-multierror to v1.1.1 [#1987](https://github.com/pomerium/pomerium/pull/1987) (@renovate[bot])
-- fix(deps): update module github.com/lithammer/shortuuid/v3 to v3.0.6 [#1953](https://github.com/pomerium/pomerium/pull/1953) (@renovate[bot])
-- fix(deps): update module github.com/open-policy-agent/opa to v0.27.1 [#1988](https://github.com/pomerium/pomerium/pull/1988) (@renovate[bot])
-- fix(deps): update module github.com/prometheus/client_golang to v1.10.0 [#2011](https://github.com/pomerium/pomerium/pull/2011) (@renovate[bot])
-- fix(deps): update module github.com/prometheus/common to v0.20.0 [#2033](https://github.com/pomerium/pomerium/pull/2033) (@renovate[bot])
-- fix(deps): update module github.com/prometheus/procfs to v0.6.0 [#1969](https://github.com/pomerium/pomerium/pull/1969) (@renovate[bot])
-- fix(deps): update module github.com/rs/zerolog to v1.21.0 [#2034](https://github.com/pomerium/pomerium/pull/2034) (@renovate[bot])
-- fix(deps): update module go.opencensus.io to v0.23.0 [#1954](https://github.com/pomerium/pomerium/pull/1954) (@renovate[bot])
-- fix(deps): update module google.golang.org/api to v0.42.0 [#1989](https://github.com/pomerium/pomerium/pull/1989) (@renovate[bot])
-- fix(deps): update module google.golang.org/api to v0.43.0 [#2035](https://github.com/pomerium/pomerium/pull/2035) (@renovate[bot])
-- fix(deps): update module google.golang.org/grpc to v1.36.0 [#1955](https://github.com/pomerium/pomerium/pull/1955) (@renovate[bot])
-- fix(deps): update module google.golang.org/grpc to v1.36.1 [#2036](https://github.com/pomerium/pomerium/pull/2036) (@renovate[bot])
-- fix(deps): update module google.golang.org/protobuf to v1.26.0 [#2012](https://github.com/pomerium/pomerium/pull/2012) (@renovate[bot])
-- fix(deps): update module gopkg.in/auth0.v5 to v5.13.0 [#2037](https://github.com/pomerium/pomerium/pull/2037) (@renovate[bot])
-- skip REDIS cluster test if GOOS != linux [#2045](https://github.com/pomerium/pomerium/pull/2045) (@wasaga)
-- use cached envoy [#2132](https://github.com/pomerium/pomerium/pull/2132) (@wasaga)
-
-### Deployment
-
-- ci: cache build and test binaries [#1938](https://github.com/pomerium/pomerium/pull/1938) (@desimone)
-- ci: go 1.16.x, cached tests [#1937](https://github.com/pomerium/pomerium/pull/1937) (@desimone)
-- deployment: Publish OS packages to cloudsmith [#2105](https://github.com/pomerium/pomerium/pull/2105) (@travisgroth)
-- deployment: Publish OS packages to cloudsmith [#2108](https://github.com/pomerium/pomerium/pull/2108) (@github-actions[bot])
-- deployment: update get-envoy script and release hooks [#2111](https://github.com/pomerium/pomerium/pull/2111) (@travisgroth)
-- deployment: update get-envoy script and release hooks [#2112](https://github.com/pomerium/pomerium/pull/2112) (@github-actions[bot])
-
-### Changed
-
-- Add `xff\_num\_trusted\_hops` config option [#2003](https://github.com/pomerium/pomerium/pull/2003) (@ntoofu)
-
-- add default gitlab url [#2044](https://github.com/pomerium/pomerium/pull/2044) (@contrun)
-
-- authorize: remove log [#2122](https://github.com/pomerium/pomerium/pull/2122) (@calebdoxsey)
-- ci: deploy latest release to test environment [#1916](https://github.com/pomerium/pomerium/pull/1916) (@travisgroth)
-- ci: deploy master to integration environments [#1973](https://github.com/pomerium/pomerium/pull/1973) (@travisgroth)
-- config related metrics [#2065](https://github.com/pomerium/pomerium/pull/2065) (@wasaga)
-- config: expose viper policy hooks [#1947](https://github.com/pomerium/pomerium/pull/1947) (@calebdoxsey)
-- controlplane: maybe fix flaky test [#1873](https://github.com/pomerium/pomerium/pull/1873) (@calebdoxsey)
-- envoy: restrict permissions on embedded envoy binary [#1999](https://github.com/pomerium/pomerium/pull/1999) (@calebdoxsey)
-- in-memory service registry [#1892](https://github.com/pomerium/pomerium/pull/1892) (@wasaga)
-- logs: strip query string [#1894](https://github.com/pomerium/pomerium/pull/1894) (@calebdoxsey)
-- oidc: use groups claim from ID token if present [#1970](https://github.com/pomerium/pomerium/pull/1970) (@bonifaido)
-- proxy: support re-proxying request through control plane for kubernetes [#2051](https://github.com/pomerium/pomerium/pull/2051) (@calebdoxsey)
-- remove generated code from code coverage metrics [#1857](https://github.com/pomerium/pomerium/pull/1857) (@travisgroth)
-- Updating Doc for Pomerium-Dex Exercise [#2018](https://github.com/pomerium/pomerium/pull/2018) (@dharmendrakariya)
-
-## [v0.14.0-rc2](https://github.com/pomerium/pomerium/tree/v0.14.0-rc2) (2021-04-29)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.14.0-rc1...v0.14.0-rc2)
-
-### New
-
-- config: remove validate side effects [#2109](https://github.com/pomerium/pomerium/pull/2109) (@calebdoxsey)
-- control plane: add request id to all error pages [#2149](https://github.com/pomerium/pomerium/pull/2149) (@desimone)
-- controlplane: save configuration events to databroker [#2153](https://github.com/pomerium/pomerium/pull/2153) (@calebdoxsey)
-- databroker: add options for maximum capacity [#2095](https://github.com/pomerium/pomerium/pull/2095) (@calebdoxsey)
-- Drop tun.cfg.dstHost from jwtCacheKey [#2115](https://github.com/pomerium/pomerium/pull/2115) (@bl0m1)
-- envoy: re-implement recommended defaults [#2123](https://github.com/pomerium/pomerium/pull/2123) (@calebdoxsey)
-- let pass custom dial opts [#2144](https://github.com/pomerium/pomerium/pull/2144) (@wasaga)
-- log context [#2107](https://github.com/pomerium/pomerium/pull/2107) (@wasaga)
-
-### Fixed
-
-- deployment: update alpine debug image dependencies [#2154](https://github.com/pomerium/pomerium/pull/2154) (@travisgroth)
-
-- authorize: refactor store locking [#2151](https://github.com/pomerium/pomerium/pull/2151) (@calebdoxsey)
-
-- databroker: store server version in backend [#2142](https://github.com/pomerium/pomerium/pull/2142) (@calebdoxsey)
-
-- authorize: audit log had duplicate "message" key [#2141](https://github.com/pomerium/pomerium/pull/2141) (@desimone)
-- httputil: fix SPDY support with reverse proxy [#2134](https://github.com/pomerium/pomerium/pull/2134) (@calebdoxsey)
-- envoyconfig: fix metrics ingress listener name [#2124](https://github.com/pomerium/pomerium/pull/2124) (@calebdoxsey)
-- authorize: fix empty sub policy arrays [#2119](https://github.com/pomerium/pomerium/pull/2119) (@calebdoxsey)
-- authorize: fix unsigned URL [#2118](https://github.com/pomerium/pomerium/pull/2118) (@calebdoxsey)
-- authorize: support arbitrary jwt claims [#2102](https://github.com/pomerium/pomerium/pull/2102) (@calebdoxsey)
-
-### Security
-
-- deps: bump envoy to 1.17.2 [#2113](https://github.com/pomerium/pomerium/pull/2113) (@travisgroth)
-
-### Documentation
-
-- docs: mention alternative bearer token header format [#2155](https://github.com/pomerium/pomerium/pull/2155) (@travisgroth)
-- docs: upgrade notes on `allowed\_users` by ID [#2133](https://github.com/pomerium/pomerium/pull/2133) (@travisgroth)
-
-### Dependency
-
-- use cached envoy [#2132](https://github.com/pomerium/pomerium/pull/2132) (@wasaga)
-- chore(deps): bump github.com/prometheus/common from 0.20.0 to 0.21.0 [#2130](https://github.com/pomerium/pomerium/pull/2130) (@dependabot[bot])
-- chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.5.1 to 0.6.0 [#2129](https://github.com/pomerium/pomerium/pull/2129) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.44.0 to 0.45.0 [#2128](https://github.com/pomerium/pomerium/pull/2128) (@dependabot[bot])
-- chore(deps): bump github.com/caddyserver/certmagic from 0.12.0 to 0.13.0 [#2074](https://github.com/pomerium/pomerium/pull/2074) (@dependabot[bot])
-
-### Deployment
-
-- deployment: update get-envoy script and release hooks [#2111](https://github.com/pomerium/pomerium/pull/2111) (@travisgroth)
-- deployment: Publish OS packages to cloudsmith [#2105](https://github.com/pomerium/pomerium/pull/2105) (@travisgroth)
-
-### Changed
-
-- authorize: remove log [#2122](https://github.com/pomerium/pomerium/pull/2122) (@calebdoxsey)
-
-## [v0.14.0-rc1](https://github.com/pomerium/pomerium/tree/v0.14.0-rc1) (2021-04-22)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.13.6...v0.14.0-rc1)
-
-### Breaking
-
-- directory: remove provider from user id [#2068](https://github.com/pomerium/pomerium/pull/2068) (@calebdoxsey)
-
-### New
-
-- assets: use embed instead of statik [#1960](https://github.com/pomerium/pomerium/pull/1960) (@calebdoxsey)
-- authorize: add databroker server and record version to result, force sync via polling [#2024](https://github.com/pomerium/pomerium/pull/2024) (@calebdoxsey)
-- authorize: additional tracing, add benchmark for encryptor [#2059](https://github.com/pomerium/pomerium/pull/2059) (@calebdoxsey)
-- authorize: audit logging [#2050](https://github.com/pomerium/pomerium/pull/2050) (@calebdoxsey)
-- authorize: move headers and jwt signing to rego [#1856](https://github.com/pomerium/pomerium/pull/1856) (@calebdoxsey)
-- authorize: set JWT to expire after 5 minutes [#1980](https://github.com/pomerium/pomerium/pull/1980) (@calebdoxsey)
-- autocert: add metrics for renewal count, total and next expiration [#2019](https://github.com/pomerium/pomerium/pull/2019) (@calebdoxsey)
-- autocert: remove non-determinism [#1932](https://github.com/pomerium/pomerium/pull/1932) (@calebdoxsey)
-- config: add CertificateFiles to FileWatcherSource list [#1878](https://github.com/pomerium/pomerium/pull/1878) (@travisgroth)
-- config: add metrics_basic_auth option [#1917](https://github.com/pomerium/pomerium/pull/1917) (@calebdoxsey)
-- config: add rewrite_response_headers option [#1961](https://github.com/pomerium/pomerium/pull/1961) (@calebdoxsey)
-- config: add rewrite_response_headers to protobuf [#1962](https://github.com/pomerium/pomerium/pull/1962) (@calebdoxsey)
-- config: allow customization of envoy boostrap admin options [#1872](https://github.com/pomerium/pomerium/pull/1872) (@calebdoxsey)
-- config: log config source changes [#1959](https://github.com/pomerium/pomerium/pull/1959) (@calebdoxsey)
-- config: multiple endpoints for authorize and databroker [#1957](https://github.com/pomerium/pomerium/pull/1957) (@calebdoxsey)
-- config: rename headers to set_response_headers [#2081](https://github.com/pomerium/pomerium/pull/2081) (@calebdoxsey)
-- config: support map of jwt claim headers [#1906](https://github.com/pomerium/pomerium/pull/1906) (@calebdoxsey)
-- config: use getters for authenticate, signout and forward auth urls [#2000](https://github.com/pomerium/pomerium/pull/2000) (@calebdoxsey)
-- config: use getters for certificates [#2001](https://github.com/pomerium/pomerium/pull/2001) (@calebdoxsey)
-- crypto: use actual bytes of shared secret, not the base64 encoded representation [#2075](https://github.com/pomerium/pomerium/pull/2075) (@calebdoxsey)
-- cryptutil: add envelope encryption w/key encryption key and data encryption key [#2020](https://github.com/pomerium/pomerium/pull/2020) (@calebdoxsey)
-- cryptutil: always use kek public id, add x509 support [#2066](https://github.com/pomerium/pomerium/pull/2066) (@calebdoxsey)
-- cryptutil: use bytes for hmac [#2067](https://github.com/pomerium/pomerium/pull/2067) (@calebdoxsey)
-- databroker: refactor databroker to sync all changes [#1879](https://github.com/pomerium/pomerium/pull/1879) (@calebdoxsey)
-- databroker: return server version in Get [#2039](https://github.com/pomerium/pomerium/pull/2039) (@wasaga)
-- envoy: refactor controlplane xds to new envoyconfig package [#2086](https://github.com/pomerium/pomerium/pull/2086) (@calebdoxsey)
-- envoy: upgrade to v1.17.1 [#1993](https://github.com/pomerium/pomerium/pull/1993) (@calebdoxsey)
-- envoy: validate binary checksum [#1908](https://github.com/pomerium/pomerium/pull/1908) (@calebdoxsey)
-- envoyconfig: move most bootstrap config to shared package [#2088](https://github.com/pomerium/pomerium/pull/2088) (@calebdoxsey)
-- identity: infer email from mail claim [#1977](https://github.com/pomerium/pomerium/pull/1977) (@calebdoxsey)
-- identity: record metric for last refresh [#1936](https://github.com/pomerium/pomerium/pull/1936) (@calebdoxsey)
-- metrics: add TLS options [#1939](https://github.com/pomerium/pomerium/pull/1939) (@calebdoxsey)
-- middleware: basic auth equalize lengths of input [#1934](https://github.com/pomerium/pomerium/pull/1934) (@desimone)
-- ping: identity and directory providers [#1975](https://github.com/pomerium/pomerium/pull/1975) (@calebdoxsey)
-- protoutil: add generic transformer [#2023](https://github.com/pomerium/pomerium/pull/2023) (@calebdoxsey)
-- proxy: implement pass-through for authenticate backend [#1870](https://github.com/pomerium/pomerium/pull/1870) (@calebdoxsey)
-- redis: add redis cluster support [#1992](https://github.com/pomerium/pomerium/pull/1992) (@calebdoxsey)
-- redis: add support for redis-sentinel [#1991](https://github.com/pomerium/pomerium/pull/1991) (@calebdoxsey)
-- Remove internal/protoutil. [#1893](https://github.com/pomerium/pomerium/pull/1893) (@yegle)
-- support host:port in metrics_address [#2042](https://github.com/pomerium/pomerium/pull/2042) (@wasaga)
-- telemetry: add installation id [#2017](https://github.com/pomerium/pomerium/pull/2017) (@calebdoxsey)
-- telemetry: add process collector for envoy [#1948](https://github.com/pomerium/pomerium/pull/1948) (@calebdoxsey)
-- use build_info as liveness gauge metric [#1940](https://github.com/pomerium/pomerium/pull/1940) (@wasaga)
-- xds: use ALPN Auto config for upstream protocol when possible [#1995](https://github.com/pomerium/pomerium/pull/1995) (@calebdoxsey)
-
-### Fixed
-
-- authenticate: fix default sign out url [#2061](https://github.com/pomerium/pomerium/pull/2061) (@calebdoxsey)
-- authenticate: validate origin of signout [#1876](https://github.com/pomerium/pomerium/pull/1876) (@desimone)
-- authorize: bypass data in rego for databroker data [#2041](https://github.com/pomerium/pomerium/pull/2041) (@calebdoxsey)
-- authorize: support arbitrary jwt claims [#2106](https://github.com/pomerium/pomerium/pull/2106) (@github-actions[bot])
-- change require_proxy_protocol to use_proxy_protocol [#2043](https://github.com/pomerium/pomerium/pull/2043) (@contrun)
-- ci: pin goreleaser version [#1900](https://github.com/pomerium/pomerium/pull/1900) (@travisgroth)
-- cmd/pomerium: exit 0 for normal shutdown [#1958](https://github.com/pomerium/pomerium/pull/1958) (@travisgroth)
-- config: add headers to config proto [#1996](https://github.com/pomerium/pomerium/pull/1996) (@calebdoxsey)
-- config: don't change address value on databroker or authorize [#2092](https://github.com/pomerium/pomerium/pull/2092) (@travisgroth)
-- config: fix redirect routes from protobuf [#1930](https://github.com/pomerium/pomerium/pull/1930) (@travisgroth)
-- config: use tls_custom_ca from policy when available [#2077](https://github.com/pomerium/pomerium/pull/2077) (@calebdoxsey)
-- controlplane: add global headers to virtualhost [#1861](https://github.com/pomerium/pomerium/pull/1861) (@desimone)
-- databroker: remove unused installation id, close streams when backend is closed [#2062](https://github.com/pomerium/pomerium/pull/2062) (@calebdoxsey)
-- Fix process cpu usage metric [#1979](https://github.com/pomerium/pomerium/pull/1979) (@wasaga)
-- fix registry test [#1911](https://github.com/pomerium/pomerium/pull/1911) (@wasaga)
-- google: fix default provider URL [#1928](https://github.com/pomerium/pomerium/pull/1928) (@calebdoxsey)
-- metrics_address should be optional parameter [#2087](https://github.com/pomerium/pomerium/pull/2087) (@wasaga)
-- onelogin: fix default scopes for v2 [#1896](https://github.com/pomerium/pomerium/pull/1896) (@calebdoxsey)
-- options: header only applies to routes and authN [#1862](https://github.com/pomerium/pomerium/pull/1862) (@desimone)
-- propagate changes back from encrypted backend [#2079](https://github.com/pomerium/pomerium/pull/2079) (@wasaga)
-- proxy: add nil check for fix-misdirected [#2040](https://github.com/pomerium/pomerium/pull/2040) (@calebdoxsey)
-- proxy: redirect to dashboard for logout [#1944](https://github.com/pomerium/pomerium/pull/1944) (@calebdoxsey)
-- redis: fix deletion versioning [#1871](https://github.com/pomerium/pomerium/pull/1871) (@calebdoxsey)
-- unique envoy cluster ids [#1858](https://github.com/pomerium/pomerium/pull/1858) (@wasaga)
-- xds: fix misdirected script [#1895](https://github.com/pomerium/pomerium/pull/1895) (@calebdoxsey)
-- xdsmgr: update resource versions on NACK [#2093](https://github.com/pomerium/pomerium/pull/2093) (@calebdoxsey)
-
-### Security
-
-- authenticate: validate signature on /.pomerium, /.pomerium/sign_in and /.pomerium/sign_out [#2048](https://github.com/pomerium/pomerium/pull/2048) (@travisgroth)
-- deps: bump envoy to 1.17.2 [#2114](https://github.com/pomerium/pomerium/pull/2114) (@github-actions[bot])
-- proxy: restrict programmatic URLs to localhost [#2049](https://github.com/pomerium/pomerium/pull/2049) (@travisgroth)
-
-### Documentation
-
-- docs: add breaking sa changes in v0.13 [#1919](https://github.com/pomerium/pomerium/pull/1919) (@desimone)
-
-- docs: add JWT Verification w/Envoy guide [#1974](https://github.com/pomerium/pomerium/pull/1974) (@calebdoxsey)
-
-- docs: add load balancing weight documentation [#1883](https://github.com/pomerium/pomerium/pull/1883) (@travisgroth)
-
-- docs: add threat model to security page [#2097](https://github.com/pomerium/pomerium/pull/2097) (@desimone)
-- docs: add v0.13 to docs site menu [#1913](https://github.com/pomerium/pomerium/pull/1913) (@travisgroth)
-- docs: additional load balancing documentation [#1875](https://github.com/pomerium/pomerium/pull/1875) (@travisgroth)
-- docs: fix query param name [#1920](https://github.com/pomerium/pomerium/pull/1920) (@calebdoxsey)
-- docs: misc upgrade notes and changelog [#1884](https://github.com/pomerium/pomerium/pull/1884) (@travisgroth)
-- docs: update changelog for v0.13.0 [#1909](https://github.com/pomerium/pomerium/pull/1909) (@desimone)
-- docs: update community slack link [#2063](https://github.com/pomerium/pomerium/pull/2063) (@travisgroth)
-- docs: update security policy [#1897](https://github.com/pomerium/pomerium/pull/1897) (@desimone)
-- ping: add documentation [#1976](https://github.com/pomerium/pomerium/pull/1976) (@calebdoxsey)
-- Update data-storage.md [#1941](https://github.com/pomerium/pomerium/pull/1941) (@TanguyPatte)
-- Update local-oidc.md [#1994](https://github.com/pomerium/pomerium/pull/1994) (@dharmendrakariya)
-
-### Dependency
-
-- chore(deps): bump github.com/go-redis/redis/v8 from 8.8.0 to 8.8.2 [#2099](https://github.com/pomerium/pomerium/pull/2099) (@dependabot[bot])
-- chore(deps): bump google.golang.org/api from 0.43.0 to 0.44.0 [#2073](https://github.com/pomerium/pomerium/pull/2073) (@dependabot[bot])
-- chore(deps): bump google.golang.org/grpc from 1.36.1 to 1.37.0 [#2072](https://github.com/pomerium/pomerium/pull/2072) (@dependabot[bot])
-- chore(deps): bump gopkg.in/auth0.v5 from 5.13.0 to 5.14.1 [#2071](https://github.com/pomerium/pomerium/pull/2071) (@dependabot[bot])
-- chore(deps): bump gopkg.in/auth0.v5 from 5.14.1 to 5.15.0 [#2098](https://github.com/pomerium/pomerium/pull/2098) (@dependabot[bot])
-- chore(deps): update codecov/codecov-action action to v1.3.1 [#1985](https://github.com/pomerium/pomerium/pull/1985) (@renovate[bot])
-- chore(deps): update golang.org/x/oauth2 commit hash to 0101308 [#1863](https://github.com/pomerium/pomerium/pull/1863) (@renovate[bot])
-- chore(deps): update golang.org/x/oauth2 commit hash to 6667018 [#1886](https://github.com/pomerium/pomerium/pull/1886) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to bba0dbe [#1864](https://github.com/pomerium/pomerium/pull/1864) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to e7f2df4 [#1887](https://github.com/pomerium/pomerium/pull/1887) (@renovate[bot])
-- chore(deps): update mikefarah/yq action to v4.5.0 [#1865](https://github.com/pomerium/pomerium/pull/1865) (@renovate[bot])
-- chore(deps): update mikefarah/yq action to v4.5.1 [#1888](https://github.com/pomerium/pomerium/pull/1888) (@renovate[bot])
-- chore(deps): update mikefarah/yq action to v4.6.1 [#1951](https://github.com/pomerium/pomerium/pull/1951) (@renovate[bot])
-- chore(deps): update mikefarah/yq action to v4.6.2 [#2007](https://github.com/pomerium/pomerium/pull/2007) (@renovate[bot])
-- chore(deps): update mikefarah/yq action to v4.6.3 [#2031](https://github.com/pomerium/pomerium/pull/2031) (@renovate[bot])
-- chore(deps): update module auth0 to v5 [#1868](https://github.com/pomerium/pomerium/pull/1868) (@renovate[bot])
-- chore(deps): update module go-redis/redis/v8 to v8.5.0 [#1866](https://github.com/pomerium/pomerium/pull/1866) (@renovate[bot])
-- chore(deps): update module google.golang.org/api to v0.39.0 [#1867](https://github.com/pomerium/pomerium/pull/1867) (@renovate[bot])
-- chore(deps): update module google.golang.org/api to v0.40.0 [#1889](https://github.com/pomerium/pomerium/pull/1889) (@renovate[bot])
-- chore(deps): update module spf13/cobra to v1.1.3 [#1890](https://github.com/pomerium/pomerium/pull/1890) (@renovate[bot])
-- chore(deps): update vuepress monorepo to v1.8.1 [#1891](https://github.com/pomerium/pomerium/pull/1891) (@renovate[bot])
-- chore(deps): update vuepress monorepo to v1.8.2 [#1952](https://github.com/pomerium/pomerium/pull/1952) (@renovate[bot])
-- chore(deps): update yaml v2 to v3 [#1927](https://github.com/pomerium/pomerium/pull/1927) (@desimone)
-- deps: bundle all patch upgrades in a single group [#2016](https://github.com/pomerium/pomerium/pull/2016) (@travisgroth)
-- deps: switch from renovate to dependabot [#2069](https://github.com/pomerium/pomerium/pull/2069) (@travisgroth)
-- do not require project be in GOPATH/src [#2078](https://github.com/pomerium/pomerium/pull/2078) (@wasaga)
-- fix(deps): update github.com/nsf/jsondiff commit hash to 6ea3239 [#1965](https://github.com/pomerium/pomerium/pull/1965) (@renovate[bot])
-- fix(deps): update golang.org/x/crypto commit hash to 0c34fe9 [#2027](https://github.com/pomerium/pomerium/pull/2027) (@renovate[bot])
-- fix(deps): update golang.org/x/crypto commit hash to 513c2a4 [#1982](https://github.com/pomerium/pomerium/pull/1982) (@renovate[bot])
-- fix(deps): update golang.org/x/net commit hash to 0fccb6f [#2052](https://github.com/pomerium/pomerium/pull/2052) (@renovate[bot])
-- fix(deps): update golang.org/x/net commit hash to 61e0566 [#2028](https://github.com/pomerium/pomerium/pull/2028) (@renovate[bot])
-- fix(deps): update golang.org/x/net commit hash to d523dce [#2005](https://github.com/pomerium/pomerium/pull/2005) (@renovate[bot])
-- fix(deps): update golang.org/x/net commit hash to e18ecbb [#1949](https://github.com/pomerium/pomerium/pull/1949) (@renovate[bot])
-- fix(deps): update golang.org/x/oauth2 commit hash to 22b0ada [#2029](https://github.com/pomerium/pomerium/pull/2029) (@renovate[bot])
-- fix(deps): update golang.org/x/oauth2 commit hash to 2e8d934 [#2053](https://github.com/pomerium/pomerium/pull/2053) (@renovate[bot])
-- fix(deps): update golang.org/x/oauth2 commit hash to cd4f82c [#1983](https://github.com/pomerium/pomerium/pull/1983) (@renovate[bot])
-- fix(deps): update google.golang.org/genproto commit hash to 5f0e893 [#2006](https://github.com/pomerium/pomerium/pull/2006) (@renovate[bot])
-- fix(deps): update google.golang.org/genproto commit hash to 679c6ae [#2030](https://github.com/pomerium/pomerium/pull/2030) (@renovate[bot])
-- fix(deps): update google.golang.org/genproto commit hash to 6c239bb [#2054](https://github.com/pomerium/pomerium/pull/2054) (@renovate[bot])
-- fix(deps): update google.golang.org/genproto commit hash to 8812039 [#1984](https://github.com/pomerium/pomerium/pull/1984) (@renovate[bot])
-- fix(deps): update google.golang.org/genproto commit hash to 9728d6b [#1966](https://github.com/pomerium/pomerium/pull/1966) (@renovate[bot])
-- fix(deps): update google.golang.org/genproto commit hash to ab064af [#1950](https://github.com/pomerium/pomerium/pull/1950) (@renovate[bot])
-- fix(deps): update module contrib.go.opencensus.io/exporter/prometheus to v0.3.0 [#1986](https://github.com/pomerium/pomerium/pull/1986) (@renovate[bot])
-- fix(deps): update module github.com/envoyproxy/protoc-gen-validate to v0.5.0 [#2008](https://github.com/pomerium/pomerium/pull/2008) (@renovate[bot])
-- fix(deps): update module github.com/envoyproxy/protoc-gen-validate to v0.5.1 [#2056](https://github.com/pomerium/pomerium/pull/2056) (@renovate[bot])
-- fix(deps): update module github.com/go-chi/chi to v5 [#1956](https://github.com/pomerium/pomerium/pull/1956) (@renovate[bot])
-- fix(deps): update module github.com/go-redis/redis/v8 to v8.7.1 [#1967](https://github.com/pomerium/pomerium/pull/1967) (@renovate[bot])
-- fix(deps): update module github.com/go-redis/redis/v8 to v8.8.0 [#2032](https://github.com/pomerium/pomerium/pull/2032) (@renovate[bot])
-- fix(deps): update module github.com/golang/protobuf to v1.5.1 [#2009](https://github.com/pomerium/pomerium/pull/2009) (@renovate[bot])
-- fix(deps): update module github.com/golang/protobuf to v1.5.2 [#2057](https://github.com/pomerium/pomerium/pull/2057) (@renovate[bot])
-- fix(deps): update module github.com/google/btree to v1.0.1 [#2010](https://github.com/pomerium/pomerium/pull/2010) (@renovate[bot])
-- fix(deps): update module github.com/google/go-cmp to v0.5.5 [#1968](https://github.com/pomerium/pomerium/pull/1968) (@renovate[bot])
-- fix(deps): update module github.com/hashicorp/go-multierror to v1.1.1 [#1987](https://github.com/pomerium/pomerium/pull/1987) (@renovate[bot])
-- fix(deps): update module github.com/lithammer/shortuuid/v3 to v3.0.6 [#1953](https://github.com/pomerium/pomerium/pull/1953) (@renovate[bot])
-- fix(deps): update module github.com/open-policy-agent/opa to v0.27.1 [#1988](https://github.com/pomerium/pomerium/pull/1988) (@renovate[bot])
-- fix(deps): update module github.com/prometheus/client_golang to v1.10.0 [#2011](https://github.com/pomerium/pomerium/pull/2011) (@renovate[bot])
-- fix(deps): update module github.com/prometheus/common to v0.20.0 [#2033](https://github.com/pomerium/pomerium/pull/2033) (@renovate[bot])
-- fix(deps): update module github.com/prometheus/procfs to v0.6.0 [#1969](https://github.com/pomerium/pomerium/pull/1969) (@renovate[bot])
-- fix(deps): update module github.com/rs/zerolog to v1.21.0 [#2034](https://github.com/pomerium/pomerium/pull/2034) (@renovate[bot])
-- fix(deps): update module go.opencensus.io to v0.23.0 [#1954](https://github.com/pomerium/pomerium/pull/1954) (@renovate[bot])
-- fix(deps): update module google.golang.org/api to v0.42.0 [#1989](https://github.com/pomerium/pomerium/pull/1989) (@renovate[bot])
-- fix(deps): update module google.golang.org/api to v0.43.0 [#2035](https://github.com/pomerium/pomerium/pull/2035) (@renovate[bot])
-- fix(deps): update module google.golang.org/grpc to v1.36.0 [#1955](https://github.com/pomerium/pomerium/pull/1955) (@renovate[bot])
-- fix(deps): update module google.golang.org/grpc to v1.36.1 [#2036](https://github.com/pomerium/pomerium/pull/2036) (@renovate[bot])
-- fix(deps): update module google.golang.org/protobuf to v1.26.0 [#2012](https://github.com/pomerium/pomerium/pull/2012) (@renovate[bot])
-- fix(deps): update module gopkg.in/auth0.v5 to v5.13.0 [#2037](https://github.com/pomerium/pomerium/pull/2037) (@renovate[bot])
-- skip REDIS cluster test if GOOS != linux [#2045](https://github.com/pomerium/pomerium/pull/2045) (@wasaga)
-
-### Deployment
-
-- ci: cache build and test binaries [#1938](https://github.com/pomerium/pomerium/pull/1938) (@desimone)
-- ci: go 1.16.x, cached tests [#1937](https://github.com/pomerium/pomerium/pull/1937) (@desimone)
-- deployment: Publish OS packages to cloudsmith [#2108](https://github.com/pomerium/pomerium/pull/2108) (@github-actions[bot])
-- deployment: update get-envoy script and release hooks [#2112](https://github.com/pomerium/pomerium/pull/2112) (@github-actions[bot])
-
-### Changed
-
-- Add `xff\_num\_trusted\_hops` config option [#2003](https://github.com/pomerium/pomerium/pull/2003) (@ntoofu)
-
-- add default gitlab url [#2044](https://github.com/pomerium/pomerium/pull/2044) (@contrun)
-
-- ci: deploy latest release to test environment [#1916](https://github.com/pomerium/pomerium/pull/1916) (@travisgroth)
-
-- ci: deploy master to integration environments [#1973](https://github.com/pomerium/pomerium/pull/1973) (@travisgroth)
-- config related metrics [#2065](https://github.com/pomerium/pomerium/pull/2065) (@wasaga)
-- config: expose viper policy hooks [#1947](https://github.com/pomerium/pomerium/pull/1947) (@calebdoxsey)
-- controlplane: maybe fix flaky test [#1873](https://github.com/pomerium/pomerium/pull/1873) (@calebdoxsey)
-- envoy: restrict permissions on embedded envoy binary [#1999](https://github.com/pomerium/pomerium/pull/1999) (@calebdoxsey)
-- in-memory service registry [#1892](https://github.com/pomerium/pomerium/pull/1892) (@wasaga)
-- logs: strip query string [#1894](https://github.com/pomerium/pomerium/pull/1894) (@calebdoxsey)
-- oidc: use groups claim from ID token if present [#1970](https://github.com/pomerium/pomerium/pull/1970) (@bonifaido)
-- proxy: support re-proxying request through control plane for kubernetes [#2051](https://github.com/pomerium/pomerium/pull/2051) (@calebdoxsey)
-- remove generated code from code coverage metrics [#1857](https://github.com/pomerium/pomerium/pull/1857) (@travisgroth)
-- Updating Doc for Pomerium-Dex Exercise [#2018](https://github.com/pomerium/pomerium/pull/2018) (@dharmendrakariya)
-
-## [v0.13.6](https://github.com/pomerium/pomerium/tree/v0.13.6) (2021-04-17)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.13.5...v0.13.6)
-
-### Security
-
-- deps: upgrade envoy to 1.16.3 [#2096](https://github.com/pomerium/pomerium/pull/2096) (@travisgroth)
-
-### Documentation
-
-- docs: update community slack link [#2064](https://github.com/pomerium/pomerium/pull/2064) (@github-actions[bot])
-
-## [v0.13.5](https://github.com/pomerium/pomerium/tree/v0.13.5) (2021-04-06)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.13.4...v0.13.5)
-
-### Fixed
-
-- change require_proxy_protocol to use_proxy_protocol [#2058](https://github.com/pomerium/pomerium/pull/2058) (@github-actions[bot])
-
-## [v0.13.4](https://github.com/pomerium/pomerium/tree/v0.13.4) (2021-03-31)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.13.3...v0.13.4)
-
-### Security
-
-- proxy: restrict programmatic URLs to localhost [#2047](https://github.com/pomerium/pomerium/pull/2047) (@travisgroth)
-- authenticate: validate signature on /.pomerium, /.pomerium/sign_in and /.pomerium/sign_out [#2046](https://github.com/pomerium/pomerium/pull/2046) (@travisgroth)
-
-## [v0.13.3](https://github.com/pomerium/pomerium/tree/v0.13.3) (2021-03-12)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.13.2...v0.13.3)
-
-### New
-
-- identity: infer email from mail claim [#1978](https://github.com/pomerium/pomerium/pull/1978) (@github-actions[bot])
-
-## [v0.13.2](https://github.com/pomerium/pomerium/tree/v0.13.2) (2021-02-25)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.13.1...v0.13.2)
-
-### Documentation
-
-- Update data-storage.md [#1942](https://github.com/pomerium/pomerium/pull/1942) (@github-actions[bot])
-
-### Changed
-
-- proxy: redirect to dashboard for logout [#1945](https://github.com/pomerium/pomerium/pull/1945) (@github-actions[bot])
-
-## [v0.13.1](https://github.com/pomerium/pomerium/tree/v0.13.1) (2021-02-22)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.13.0...v0.13.1)
-
-### Fixed
-
-- config: fix redirect routes from protobuf [#1931](https://github.com/pomerium/pomerium/pull/1931) (@github-actions[bot])
-- google: fix default provider URL [#1929](https://github.com/pomerium/pomerium/pull/1929) (@github-actions[bot])
-
-### Documentation
-
-- docs: fix query param name [#1923](https://github.com/pomerium/pomerium/pull/1923) (@github-actions[bot])
-- docs: add breaking sa changes in v0.13 [#1921](https://github.com/pomerium/pomerium/pull/1921) (@github-actions[bot])
-- docs: add v0.13 to docs site menu [#1914](https://github.com/pomerium/pomerium/pull/1914) (@github-actions[bot])
-
-### Changed
-
-- ci: deploy releases to test environment (#1916) [#1918](https://github.com/pomerium/pomerium/pull/1918) (@travisgroth)
-
-* _This Changelog was automatically generated by [github_changelog_generator](https://github.com/github-changelog-generator/github-changelog-generator)_
-
-## [v0.13.0](https://github.com/pomerium/pomerium/tree/v0.13.0) (2021-02-17)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.12.2...v0.13.0)
-
-### Breaking
-
-- authorize: remove admin [#1833](https://github.com/pomerium/pomerium/pull/1833) (@calebdoxsey)
-- remove user impersonation and service account cli [#1768](https://github.com/pomerium/pomerium/pull/1768) (@calebdoxsey)
-
-### New
-
-- authorize: allow access by user id [#1850](https://github.com/pomerium/pomerium/pull/1850) (@calebdoxsey)
-- authorize: remove DataBrokerData input [#1847](https://github.com/pomerium/pomerium/pull/1847) (@calebdoxsey)
-- opa: format rego files [#1845](https://github.com/pomerium/pomerium/pull/1845) (@calebdoxsey)
-- policy: add new certificate-authority option for downstream mTLS client certificates [#1835](https://github.com/pomerium/pomerium/pull/1835) (@calebdoxsey)
-- metrics: human readable cluster name [#1834](https://github.com/pomerium/pomerium/pull/1834) (@wasaga)
-- upstream endpoints load balancer weights [#1830](https://github.com/pomerium/pomerium/pull/1830) (@wasaga)
-- controlplane: only add listener virtual domains for addresses matching the current TLS domain [#1823](https://github.com/pomerium/pomerium/pull/1823) (@calebdoxsey)
-- authenticate: delay evaluation of OIDC provider [#1802](https://github.com/pomerium/pomerium/pull/1802) (@calebdoxsey)
-- config: require shared key if using redis backed databroker [#1801](https://github.com/pomerium/pomerium/pull/1801) (@travisgroth)
-- upstream health check config [#1796](https://github.com/pomerium/pomerium/pull/1796) (@wasaga)
-- new skip_xff_append option [#1788](https://github.com/pomerium/pomerium/pull/1788) (@wasaga)
-- policy: add outlier_detection [#1786](https://github.com/pomerium/pomerium/pull/1786) (@calebdoxsey)
-- reduce memory usage by handling http/2 coalescing via a lua script [#1779](https://github.com/pomerium/pomerium/pull/1779) (@calebdoxsey)
-- add support for proxy protocol on HTTP listener [#1777](https://github.com/pomerium/pomerium/pull/1777) (@calebdoxsey)
-- config: support redirect actions [#1776](https://github.com/pomerium/pomerium/pull/1776) (@calebdoxsey)
-- config: detect underlying file changes [#1775](https://github.com/pomerium/pomerium/pull/1775) (@calebdoxsey)
-- authenticate: update user info screens [#1774](https://github.com/pomerium/pomerium/pull/1774) (@desimone)
-- jws: remove issuer [#1754](https://github.com/pomerium/pomerium/pull/1754) (@calebdoxsey)
-
-### Fixed
-
-- redis: fix deletion versioning [#1874](https://github.com/pomerium/pomerium/pull/1874) (@github-actions[bot])
-- rego: handle null [#1853](https://github.com/pomerium/pomerium/pull/1853) (@calebdoxsey)
-- config: fix data race [#1851](https://github.com/pomerium/pomerium/pull/1851) (@calebdoxsey)
-- deployment: set maintainer field in packages [#1848](https://github.com/pomerium/pomerium/pull/1848) (@travisgroth)
-- xds: fix always requiring client certificates [#1844](https://github.com/pomerium/pomerium/pull/1844) (@calebdoxsey)
-- fix go:generate for envoy config [#1826](https://github.com/pomerium/pomerium/pull/1826) (@calebdoxsey)
-- controlplane: only enable STATIC dns when all adresses are IP addresses [#1822](https://github.com/pomerium/pomerium/pull/1822) (@calebdoxsey)
-- config: fix databroker policies [#1821](https://github.com/pomerium/pomerium/pull/1821) (@calebdoxsey)
-- config: fix hot-reloading [#1820](https://github.com/pomerium/pomerium/pull/1820) (@calebdoxsey)
-- Revert "reduce memory usage by handling http/2 coalescing via a lua script" [#1785](https://github.com/pomerium/pomerium/pull/1785) (@calebdoxsey)
-- google: fix nil name [#1771](https://github.com/pomerium/pomerium/pull/1771) (@calebdoxsey)
-- autocert: improve logging [#1767](https://github.com/pomerium/pomerium/pull/1767) (@travisgroth)
-
-### Documentation
-
-- github: add tag suggestion to checklist [#1819](https://github.com/pomerium/pomerium/pull/1819) (@desimone)
-- docs: add reference to the go-sdk [#1800](https://github.com/pomerium/pomerium/pull/1800) (@desimone)
-- updated host rewrite docs [#1799](https://github.com/pomerium/pomerium/pull/1799) (@vihardesu)
-- docs: update menu for v0.12 [#1755](https://github.com/pomerium/pomerium/pull/1755) (@travisgroth)
-- Update GitLab provider docs [#1591](https://github.com/pomerium/pomerium/pull/1591) (@bradjones1)
-- Fix command in Kubernetes Quick start docs [#1582](https://github.com/pomerium/pomerium/pull/1582) (@wesleyw72)
-
-### Dependency
-
-- chore(deps): update module go.opencensus.io to v0.22.6 [#1842](https://github.com/pomerium/pomerium/pull/1842) (@renovate[bot])
-- chore(deps): update module go-redis/redis/v8 to v8.4.11 [#1841](https://github.com/pomerium/pomerium/pull/1841) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 44e461b [#1840](https://github.com/pomerium/pomerium/pull/1840) (@renovate[bot])
-- chore(deps): update golang.org/x/oauth2 commit hash to f9ce19e [#1839](https://github.com/pomerium/pomerium/pull/1839) (@renovate[bot])
-- chore(deps): update module stretchr/testify to v1.7.0 [#1816](https://github.com/pomerium/pomerium/pull/1816) (@renovate[bot])
-- chore(deps): update module open-policy-agent/opa to v0.26.0 [#1815](https://github.com/pomerium/pomerium/pull/1815) (@renovate[bot])
-- chore(deps): update module mitchellh/mapstructure to v1.4.1 [#1814](https://github.com/pomerium/pomerium/pull/1814) (@renovate[bot])
-- chore(deps): update module google/uuid to v1.2.0 [#1813](https://github.com/pomerium/pomerium/pull/1813) (@renovate[bot])
-- chore(deps): update module google.golang.org/grpc to v1.35.0 [#1812](https://github.com/pomerium/pomerium/pull/1812) (@renovate[bot])
-- chore(deps): update module go-redis/redis/v8 to v8.4.10 [#1811](https://github.com/pomerium/pomerium/pull/1811) (@renovate[bot])
-- chore(deps): update mikefarah/yq action to v4.4.1 [#1810](https://github.com/pomerium/pomerium/pull/1810) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 8081c04 [#1809](https://github.com/pomerium/pomerium/pull/1809) (@renovate[bot])
-- chore(deps): update golang.org/x/oauth2 commit hash to d3ed898 [#1808](https://github.com/pomerium/pomerium/pull/1808) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to 5f4716e [#1807](https://github.com/pomerium/pomerium/pull/1807) (@renovate[bot])
-- chore(deps): update oidc to v3 [#1783](https://github.com/pomerium/pomerium/pull/1783) (@desimone)
-- chore(deps): update vuepress monorepo to v1.8.0 [#1761](https://github.com/pomerium/pomerium/pull/1761) (@renovate[bot])
-- chore(deps): update module go-redis/redis/v8 to v8.4.8 [#1760](https://github.com/pomerium/pomerium/pull/1760) (@renovate[bot])
-- chore(deps): update mikefarah/yq action to v4.3.1 [#1759](https://github.com/pomerium/pomerium/pull/1759) (@renovate[bot])
-- chore(deps): update codecov/codecov-action action to v1.2.1 [#1758](https://github.com/pomerium/pomerium/pull/1758) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to c7d5778 [#1757](https://github.com/pomerium/pomerium/pull/1757) (@renovate[bot])
-- chore(deps): update module google.golang.org/api to v0.38.0 [#1656](https://github.com/pomerium/pomerium/pull/1656) (@renovate[bot])
-
-#### Deployment
-
-- ci: fix usage of env variable in latest tag [#1791](https://github.com/pomerium/pomerium/pull/1791) (@travisgroth)
-- databroker: rename cache service [#1790](https://github.com/pomerium/pomerium/pull/1790) (@calebdoxsey)
-- ci: fix deprecated command in latestTag step [#1763](https://github.com/pomerium/pomerium/pull/1763) (@travisgroth)
-
-### Changed
-
-- docs: additional load balancing documentation [#1882](https://github.com/pomerium/pomerium/pull/1882) (@github-actions[bot])
-- authenticate: validate origin of signout [#1881](https://github.com/pomerium/pomerium/pull/1881) (@github-actions[bot])
-- config: add CertificateFiles to FileWatcherSource list [#1880](https://github.com/pomerium/pomerium/pull/1880) (@github-actions[bot])
-- ci: enable backporting from forks [#1854](https://github.com/pomerium/pomerium/pull/1854) (@travisgroth)
-- ci: fix version metadata in non-releases [#1836](https://github.com/pomerium/pomerium/pull/1836) (@travisgroth)
-- protobuf: upgrade protoc to 3.14 [#1832](https://github.com/pomerium/pomerium/pull/1832) (@calebdoxsey)
-- Update codeowners [#1831](https://github.com/pomerium/pomerium/pull/1831) (@travisgroth)
-- config: return errors on invalid URLs, fix linting [#1829](https://github.com/pomerium/pomerium/pull/1829) (@calebdoxsey)
-- grpc: use custom resolver [#1828](https://github.com/pomerium/pomerium/pull/1828) (@calebdoxsey)
-- controlplane: return errors in xds build methods [#1827](https://github.com/pomerium/pomerium/pull/1827) (@calebdoxsey)
-- include envoy's proto specs into config.proto [#1817](https://github.com/pomerium/pomerium/pull/1817) (@wasaga)
-- expose all envoy cluster options in policy [#1804](https://github.com/pomerium/pomerium/pull/1804) (@wasaga)
-- autocert: store certificates separately from config certificates [#1794](https://github.com/pomerium/pomerium/pull/1794) (@calebdoxsey)
-- move file change detection before autocert [#1793](https://github.com/pomerium/pomerium/pull/1793) (@calebdoxsey)
-- config: support multiple destination addresses [#1789](https://github.com/pomerium/pomerium/pull/1789) (@calebdoxsey)
-- ci: license check action [#1773](https://github.com/pomerium/pomerium/pull/1773) (@travisgroth)
-- authorize: move impersonation into session/service account [#1765](https://github.com/pomerium/pomerium/pull/1765) (@calebdoxsey)
-
- ### [v0.12.2](https://github.com/pomerium/pomerium/tree/v0.12.2) (2021-02-02)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.12.1...v0.12.2)
-
-### Fixed
-
-- [Backport 0-12-0] deployment: set maintainer field in packages [#1849](https://github.com/pomerium/pomerium/pull/1849) (@github-actions[bot])
-
-### Changed
-
-- [Backport 0-12-0] ci: fix usage of env variable in latest tag [#1806](https://github.com/pomerium/pomerium/pull/1806) (@github-actions[bot])
-- [Backport 0-12-0] docs: add reference to the go-sdk [#1803](https://github.com/pomerium/pomerium/pull/1803) (@github-actions[bot])
-
- ### [v0.12.1](https://github.com/pomerium/pomerium/tree/v0.12.1) (2021-01-13)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.12.0...v0.12.1)
-
-### Fixed
-
-- [Backport 0-12-0] google: fix nil name [#1772](https://github.com/pomerium/pomerium/pull/1772) (@github-actions[bot])
-- [Backport 0-12-0] autocert: improve logging [#1769](https://github.com/pomerium/pomerium/pull/1769) (@travisgroth)
-
-### Documentation
-
-- [Backport 0-12-0] docs: update menu for v0.12 [#1762](https://github.com/pomerium/pomerium/pull/1762) (@github-actions[bot])
-
-#### Deployment
-
-- [Backport 0-12-0] ci: fix deprecated command in latestTag step [#1764](https://github.com/pomerium/pomerium/pull/1764) (@github-actions[bot])
-
-## [v0.12.0](https://github.com/pomerium/pomerium/tree/v0.12.0) (2021-01-07)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.11.1...v0.12.0)
-
-### New
-
-- tcp: prevent idle stream timeouts for TCP and Websocket routes [#1744](https://github.com/pomerium/pomerium/pull/1744) (@calebdoxsey)
-- telemetry: add support for datadog tracing [#1743](https://github.com/pomerium/pomerium/pull/1743) (@calebdoxsey)
-- use incremental API for envoy xDS [#1732](https://github.com/pomerium/pomerium/pull/1732) (@calebdoxsey)
-- cli: add version command [#1726](https://github.com/pomerium/pomerium/pull/1726) (@desimone)
-- add TLS flags for TCP tunnel [#1725](https://github.com/pomerium/pomerium/pull/1725) (@calebdoxsey)
-- k8s cmd: use authclient package [#1722](https://github.com/pomerium/pomerium/pull/1722) (@calebdoxsey)
-- internal/controlplane: 0s default timeout for tcp routes [#1716](https://github.com/pomerium/pomerium/pull/1716) (@travisgroth)
-- use impersonate groups if impersonate email is set [#1701](https://github.com/pomerium/pomerium/pull/1701) (@calebdoxsey)
-- unimpersonate button [#1700](https://github.com/pomerium/pomerium/pull/1700) (@calebdoxsey)
-- TCP client command [#1696](https://github.com/pomerium/pomerium/pull/1696) (@calebdoxsey)
-- add support for TCP routes [#1695](https://github.com/pomerium/pomerium/pull/1695) (@calebdoxsey)
-- internal/directory: use gitlab provider url option [#1689](https://github.com/pomerium/pomerium/pull/1689) (@nghnam)
-- improve ca cert error message, use GetCertPool for databroker storage [#1666](https://github.com/pomerium/pomerium/pull/1666) (@calebdoxsey)
-- implement new redis storage backend with go-redis package [#1649](https://github.com/pomerium/pomerium/pull/1649) (@calebdoxsey)
-- authenticate: oidc frontchannel-logout endpoint [#1586](https://github.com/pomerium/pomerium/pull/1586) (@pflipp)
-
-### Fixed
-
-- remove :443 or :80 from proxy URLs in authclient [#1733](https://github.com/pomerium/pomerium/pull/1733) (@calebdoxsey)
-- tcptunnel: handle invalid http response codes [#1727](https://github.com/pomerium/pomerium/pull/1727) (@calebdoxsey)
-- update azure docs [#1723](https://github.com/pomerium/pomerium/pull/1723) (@calebdoxsey)
-- config: fix ignored yaml fields [#1698](https://github.com/pomerium/pomerium/pull/1698) (@travisgroth)
-- fix concurrency race [#1675](https://github.com/pomerium/pomerium/pull/1675) (@calebdoxsey)
-- don't create users when updating sessions [#1671](https://github.com/pomerium/pomerium/pull/1671) (@calebdoxsey)
-
-### Documentation
-
-- update google docs [#1738](https://github.com/pomerium/pomerium/pull/1738) (@calebdoxsey)
-- docs: add TCP guide [#1714](https://github.com/pomerium/pomerium/pull/1714) (@travisgroth)
-- docs: tcp support [#1712](https://github.com/pomerium/pomerium/pull/1712) (@travisgroth)
-- docs: replace httpbin with verify [#1702](https://github.com/pomerium/pomerium/pull/1702) (@desimone)
-- docs: fix nginx config [#1691](https://github.com/pomerium/pomerium/pull/1691) (@desimone)
-- remove "see policy" phrase in settings docs [#1668](https://github.com/pomerium/pomerium/pull/1668) (@calebdoxsey)
-- docs: add allowed_idp_claims docs [#1665](https://github.com/pomerium/pomerium/pull/1665) (@travisgroth)
-- docs: add v0.11 link to version menu [#1663](https://github.com/pomerium/pomerium/pull/1663) (@travisgroth)
-
-### Dependency
-
-- chore(deps): update module google/uuid to v1.1.4 [#1729](https://github.com/pomerium/pomerium/pull/1729) (@renovate[bot])
-- dev: update linter [#1728](https://github.com/pomerium/pomerium/pull/1728) (@desimone)
-- chore(deps): update codecov/codecov-action action to v1.1.1 [#1720](https://github.com/pomerium/pomerium/pull/1720) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to 6772e93 [#1719](https://github.com/pomerium/pomerium/pull/1719) (@renovate[bot])
-- chore(deps): update golang.org/x/crypto commit hash to eec23a3 [#1718](https://github.com/pomerium/pomerium/pull/1718) (@renovate[bot])
-- chore(deps): update precommit hook pre-commit/pre-commit-hooks to v3.4.0 [#1710](https://github.com/pomerium/pomerium/pull/1710) (@renovate[bot])
-- chore(deps): update module prometheus/client_golang to v1.9.0 [#1709](https://github.com/pomerium/pomerium/pull/1709) (@renovate[bot])
-- chore(deps): update module ory/dockertest/v3 to v3.6.3 [#1708](https://github.com/pomerium/pomerium/pull/1708) (@renovate[bot])
-- chore(deps): update module go-redis/redis/v8 to v8.4.4 [#1707](https://github.com/pomerium/pomerium/pull/1707) (@renovate[bot])
-- chore(deps): update codecov/codecov-action action to v1.1.0 [#1706](https://github.com/pomerium/pomerium/pull/1706) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 8c77b98 [#1705](https://github.com/pomerium/pomerium/pull/1705) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to 986b41b [#1704](https://github.com/pomerium/pomerium/pull/1704) (@renovate[bot])
-- chore(deps): update golang.org/x/crypto commit hash to 9d13527 [#1703](https://github.com/pomerium/pomerium/pull/1703) (@renovate[bot])
-- chore(deps): update module open-policy-agent/opa to v0.25.2 [#1685](https://github.com/pomerium/pomerium/pull/1685) (@renovate[bot])
-- chore(deps): update module go-redis/redis/v8 to v8.4.2 [#1684](https://github.com/pomerium/pomerium/pull/1684) (@renovate[bot])
-- chore(deps): update module envoyproxy/go-control-plane to v0.9.8 [#1683](https://github.com/pomerium/pomerium/pull/1683) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 40ec1c2 [#1682](https://github.com/pomerium/pomerium/pull/1682) (@renovate[bot])
-- chore(deps): update golang.org/x/sync commit hash to 09787c9 [#1681](https://github.com/pomerium/pomerium/pull/1681) (@renovate[bot])
-- chore(deps): update golang.org/x/oauth2 commit hash to 08078c5 [#1680](https://github.com/pomerium/pomerium/pull/1680) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to ac852fb [#1679](https://github.com/pomerium/pomerium/pull/1679) (@renovate[bot])
-- chore(deps): update golang.org/x/crypto commit hash to 5f87f34 [#1678](https://github.com/pomerium/pomerium/pull/1678) (@renovate[bot])
-
-#### Deployment
-
-- ci: upgrade yq syntax for v4 [#1745](https://github.com/pomerium/pomerium/pull/1745) (@travisgroth)
-- deployment: Fix docker and rpm workflows [#1687](https://github.com/pomerium/pomerium/pull/1687) (@travisgroth)
-- ci: fix pomerium-cli rpm name [#1661](https://github.com/pomerium/pomerium/pull/1661) (@travisgroth)
-
-### Changed
-
-- ci: fix typo in yq image [#1746](https://github.com/pomerium/pomerium/pull/1746) (@travisgroth)
-- fix coverage [#1741](https://github.com/pomerium/pomerium/pull/1741) (@calebdoxsey)
-- fix error wrapping [#1737](https://github.com/pomerium/pomerium/pull/1737) (@calebdoxsey)
-- Revert "set recommended defaults" [#1735](https://github.com/pomerium/pomerium/pull/1735) (@calebdoxsey)
-- set recommended defaults [#1734](https://github.com/pomerium/pomerium/pull/1734) (@calebdoxsey)
-- internal/telemetry/metrics: update redis metrics for go-redis [#1694](https://github.com/pomerium/pomerium/pull/1694) (@travisgroth)
-
-## [v0.11.1](https://github.com/pomerium/pomerium/tree/v0.11.1) (2020-12-11)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.11.0...v0.11.1)
-
-### Fixed
-
-- [Backport 0-11-0] fix concurrency race [#1676](https://github.com/pomerium/pomerium/pull/1676) (@github-actions[bot])
-- [Backport 0-11-0] don't create users when updating sessions [#1672](https://github.com/pomerium/pomerium/pull/1672) (@github-actions[bot])
-
-### Documentation
-
-- [Backport 0-11-0] remove "see policy" phrase in settings docs [#1669](https://github.com/pomerium/pomerium/pull/1669) (@github-actions[bot])
-- [Backport 0-11-0] docs: add allowed_idp_claims docs [#1667](https://github.com/pomerium/pomerium/pull/1667) (@github-actions[bot])
-- [Backport 0-11-0] docs: add v0.11 link to version menu [#1664](https://github.com/pomerium/pomerium/pull/1664) (@github-actions[bot])
-
-#### Deployment
-
-- [Backport 0-11-0] ci: fix pomerium-cli rpm name [#1662](https://github.com/pomerium/pomerium/pull/1662) (@travisgroth)
-
-## [v0.11.0](https://github.com/pomerium/pomerium/tree/v0.11.0) (2020-12-04)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.6...v0.11.0)
-
-### Breaking
-
-- remove deprecated cache_service_url config option [#1614](https://github.com/pomerium/pomerium/pull/1614) (@calebdoxsey)
-- add flag to enable user impersonation [#1514](https://github.com/pomerium/pomerium/pull/1514) (@calebdoxsey)
-
-### New
-
-- microsoft: add support for common endpoint [#1648](https://github.com/pomerium/pomerium/pull/1648) (@desimone)
-- use the directory email when provided for the jwt [#1647](https://github.com/pomerium/pomerium/pull/1647) (@calebdoxsey)
-- fix profile image on dashboard [#1637](https://github.com/pomerium/pomerium/pull/1637) (@calebdoxsey)
-- wait for initial sync to complete before starting control plane [#1636](https://github.com/pomerium/pomerium/pull/1636) (@calebdoxsey)
-- authorize: add signature algo support (RSA / EdDSA) [#1631](https://github.com/pomerium/pomerium/pull/1631) (@desimone)
-- replace GetAllPages with InitialSync, improve merge performance [#1624](https://github.com/pomerium/pomerium/pull/1624) (@calebdoxsey)
-- cryptutil: more explicit decryption error [#1607](https://github.com/pomerium/pomerium/pull/1607) (@desimone)
-- add paging support to GetAll [#1601](https://github.com/pomerium/pomerium/pull/1601) (@calebdoxsey)
-- attach version to gRPC server metadata [#1598](https://github.com/pomerium/pomerium/pull/1598) (@calebdoxsey)
-- use custom default http transport [#1576](https://github.com/pomerium/pomerium/pull/1576) (@calebdoxsey)
-- update user info in addition to refreshing the token [#1572](https://github.com/pomerium/pomerium/pull/1572) (@calebdoxsey)
-- databroker: add audience to session [#1557](https://github.com/pomerium/pomerium/pull/1557) (@calebdoxsey)
-- authorize: implement allowed_idp_claims [#1542](https://github.com/pomerium/pomerium/pull/1542) (@calebdoxsey)
-- autocert: support certificate renewal [#1516](https://github.com/pomerium/pomerium/pull/1516) (@calebdoxsey)
-- add policy to allow any authenticated user [#1515](https://github.com/pomerium/pomerium/pull/1515) (@pflipp)
-- debug: add pprof endpoints [#1504](https://github.com/pomerium/pomerium/pull/1504) (@calebdoxsey)
-- databroker: require JWT for access [#1503](https://github.com/pomerium/pomerium/pull/1503) (@calebdoxsey)
-- authenticate: remove unused paths, generate cipher at startup, remove qp store [#1495](https://github.com/pomerium/pomerium/pull/1495) (@desimone)
-- forward-auth: use envoy's ext_authz check [#1482](https://github.com/pomerium/pomerium/pull/1482) (@desimone)
-- auth0: implement directory provider [#1479](https://github.com/pomerium/pomerium/pull/1479) (@grounded042)
-- azure: incremental sync [#1471](https://github.com/pomerium/pomerium/pull/1471) (@calebdoxsey)
-- auth0: implement identity provider [#1470](https://github.com/pomerium/pomerium/pull/1470) (@calebdoxsey)
-- dashboard: format timestamps [#1468](https://github.com/pomerium/pomerium/pull/1468) (@calebdoxsey)
-- directory: additional user info [#1467](https://github.com/pomerium/pomerium/pull/1467) (@calebdoxsey)
-- directory: add explicit RefreshUser endpoint for faster sync [#1460](https://github.com/pomerium/pomerium/pull/1460) (@calebdoxsey)
-- config: add support for host header rewriting [#1457](https://github.com/pomerium/pomerium/pull/1457) (@calebdoxsey)
-- proxy: preserve path and query string for http->https redirect [#1456](https://github.com/pomerium/pomerium/pull/1456) (@calebdoxsey)
-- redis: use pubsub instead of keyspace events [#1450](https://github.com/pomerium/pomerium/pull/1450) (@calebdoxsey)
-- proxy: add support for /.pomerium/jwt [#1446](https://github.com/pomerium/pomerium/pull/1446) (@calebdoxsey)
-- databroker: add support for querying the databroker [#1443](https://github.com/pomerium/pomerium/pull/1443) (@calebdoxsey)
-- config: add dns_lookup_family option to customize DNS IP resolution [#1436](https://github.com/pomerium/pomerium/pull/1436) (@calebdoxsey)
-- okta: handle deleted groups [#1418](https://github.com/pomerium/pomerium/pull/1418) (@calebdoxsey)
-- controlplane: support P-384 / P-512 EC curves [#1409](https://github.com/pomerium/pomerium/pull/1409) (@desimone)
-- azure: add support for nested groups [#1408](https://github.com/pomerium/pomerium/pull/1408) (@calebdoxsey)
-- authorize: add support for service accounts [#1374](https://github.com/pomerium/pomerium/pull/1374) (@calebdoxsey)
-- Cuonglm/improve timeout error message [#1373](https://github.com/pomerium/pomerium/pull/1373) (@cuonglm)
-- internal/directory/okta: remove rate limiter [#1370](https://github.com/pomerium/pomerium/pull/1370) (@cuonglm)
-- proxy/controlplane: make health checks debug level [#1368](https://github.com/pomerium/pomerium/pull/1368) (@desimone)
-- databroker: add tracing for rego evaluation and databroker sync, fix bug in databroker config source [#1367](https://github.com/pomerium/pomerium/pull/1367) (@calebdoxsey)
-- authorize: use impersonate email/groups in JWT [#1364](https://github.com/pomerium/pomerium/pull/1364) (@calebdoxsey)
-- config: support explicit prefix and regex path rewriting [#1363](https://github.com/pomerium/pomerium/pull/1363) (@calebdoxsey)
-- proxy: support websocket timeouts [#1362](https://github.com/pomerium/pomerium/pull/1362) (@calebdoxsey)
-- proxy: disable control-plane robots.txt for public unauthenticated routes [#1361](https://github.com/pomerium/pomerium/pull/1361) (@calebdoxsey)
-- certmagic: improve logging [#1358](https://github.com/pomerium/pomerium/pull/1358) (@calebdoxsey)
-- logs: add new log scrubber [#1346](https://github.com/pomerium/pomerium/pull/1346) (@calebdoxsey)
-- Allow setting the shared secret via an environment variable. [#1337](https://github.com/pomerium/pomerium/pull/1337) (@rspier)
-- authorize: add jti to JWT payload [#1328](https://github.com/pomerium/pomerium/pull/1328) (@calebdoxsey)
-- all: add signout redirect url [#1324](https://github.com/pomerium/pomerium/pull/1324) (@cuonglm)
-- proxy: remove unused handlers [#1317](https://github.com/pomerium/pomerium/pull/1317) (@desimone)
-- azure: support deriving credentials from client id, client secret and provider url [#1300](https://github.com/pomerium/pomerium/pull/1300) (@calebdoxsey)
-- cache: support databroker option changes [#1294](https://github.com/pomerium/pomerium/pull/1294) (@calebdoxsey)
-- authenticate: move databroker connection to state [#1292](https://github.com/pomerium/pomerium/pull/1292) (@calebdoxsey)
-- authorize: use atomic state for properties [#1290](https://github.com/pomerium/pomerium/pull/1290) (@calebdoxsey)
-- proxy: move properties to atomically updated state [#1280](https://github.com/pomerium/pomerium/pull/1280) (@calebdoxsey)
-- Improving okta API requests [#1278](https://github.com/pomerium/pomerium/pull/1278) (@cuonglm)
-- authenticate: move properties to atomically updated state [#1277](https://github.com/pomerium/pomerium/pull/1277) (@calebdoxsey)
-- authenticate: support reloading IDP settings [#1273](https://github.com/pomerium/pomerium/pull/1273) (@calebdoxsey)
-- Rate limit for okta [#1271](https://github.com/pomerium/pomerium/pull/1271) (@cuonglm)
-- config: allow dynamic configuration of cookie settings [#1267](https://github.com/pomerium/pomerium/pull/1267) (@calebdoxsey)
-- internal/directory/okta: increase default batch size to 200 [#1264](https://github.com/pomerium/pomerium/pull/1264) (@cuonglm)
-- envoy: add support for hot-reloading bootstrap configuration [#1259](https://github.com/pomerium/pomerium/pull/1259) (@calebdoxsey)
-- config: allow reloading of telemetry settings [#1255](https://github.com/pomerium/pomerium/pull/1255) (@calebdoxsey)
-- databroker: add support for config settings [#1253](https://github.com/pomerium/pomerium/pull/1253) (@calebdoxsey)
-- config: warn if custom scopes set for builtin providers [#1252](https://github.com/pomerium/pomerium/pull/1252) (@cuonglm)
-- authorize: add databroker url check [#1228](https://github.com/pomerium/pomerium/pull/1228) (@desimone)
-- internal/databroker: make Sync send data in smaller batches [#1226](https://github.com/pomerium/pomerium/pull/1226) (@cuonglm)
-
-### Fixed
-
-- fix config race [#1660](https://github.com/pomerium/pomerium/pull/1660) (@calebdoxsey)
-- fix ordering of autocert config source [#1640](https://github.com/pomerium/pomerium/pull/1640) (@calebdoxsey)
-- pkg/storage/redis: Prevent connection churn [#1603](https://github.com/pomerium/pomerium/pull/1603) (@travisgroth)
-- forward-auth: fix special character support for nginx [#1578](https://github.com/pomerium/pomerium/pull/1578) (@desimone)
-- proxy/forward_auth: copy response headers as request headers [#1577](https://github.com/pomerium/pomerium/pull/1577) (@desimone)
-- fix querying claim data on the dashboard [#1560](https://github.com/pomerium/pomerium/pull/1560) (@calebdoxsey)
-- github: fix retrieving team id with graphql API (#1554) [#1555](https://github.com/pomerium/pomerium/pull/1555) (@toshipp)
-- store raw id token so it can be passed to the logout url [#1543](https://github.com/pomerium/pomerium/pull/1543) (@calebdoxsey)
-- fix databroker requiring signed jwt [#1538](https://github.com/pomerium/pomerium/pull/1538) (@calebdoxsey)
-- authorize: add redirect url to debug page [#1533](https://github.com/pomerium/pomerium/pull/1533) (@desimone)
-- internal/frontend: resolve authN helper url [#1521](https://github.com/pomerium/pomerium/pull/1521) (@desimone)
-- fwd-auth: match nginx-ingress config [#1505](https://github.com/pomerium/pomerium/pull/1505) (@desimone)
-- authenticate: protect /.pomerium/admin endpoint [#1500](https://github.com/pomerium/pomerium/pull/1500) (@calebdoxsey)
-- ci: ensure systemd unit file is in packages [#1481](https://github.com/pomerium/pomerium/pull/1481) (@travisgroth)
-- identity manager: fix directory sync timing [#1455](https://github.com/pomerium/pomerium/pull/1455) (@calebdoxsey)
-- proxy/forward_auth: don't reset forward auth path if X-Forwarded-Uri is not set [#1447](https://github.com/pomerium/pomerium/pull/1447) (@whs)
-- httputil: remove retry button [#1438](https://github.com/pomerium/pomerium/pull/1438) (@desimone)
-- proxy: always use https for application callback [#1433](https://github.com/pomerium/pomerium/pull/1433) (@travisgroth)
-- controplane: remove p-521 EC [#1420](https://github.com/pomerium/pomerium/pull/1420) (@desimone)
-- redirect-server: add config headers to responses [#1416](https://github.com/pomerium/pomerium/pull/1416) (@calebdoxsey)
-- proxy: remove impersonate headers for kubernetes [#1394](https://github.com/pomerium/pomerium/pull/1394) (@calebdoxsey)
-- Desimone/authenticate default logout [#1390](https://github.com/pomerium/pomerium/pull/1390) (@desimone)
-- proxy: for filter matches only include bare domain name [#1389](https://github.com/pomerium/pomerium/pull/1389) (@calebdoxsey)
-- internal/envoy: start epoch from 0 [#1387](https://github.com/pomerium/pomerium/pull/1387) (@travisgroth)
-- internal/directory/okta: acceept non-json service account [#1359](https://github.com/pomerium/pomerium/pull/1359) (@cuonglm)
-- internal/controlplane: add telemetry http handler [#1353](https://github.com/pomerium/pomerium/pull/1353) (@travisgroth)
-- autocert: fix locking issue [#1310](https://github.com/pomerium/pomerium/pull/1310) (@calebdoxsey)
-- authorize: log users and groups [#1303](https://github.com/pomerium/pomerium/pull/1303) (@desimone)
-- proxy: fix wrong applied middleware [#1298](https://github.com/pomerium/pomerium/pull/1298) (@cuonglm)
-- internal/directory/okta: fix wrong API query filter [#1296](https://github.com/pomerium/pomerium/pull/1296) (@cuonglm)
-- autocert: fix bootstrapped cache store path [#1283](https://github.com/pomerium/pomerium/pull/1283) (@desimone)
-- config: validate databroker settings [#1260](https://github.com/pomerium/pomerium/pull/1260) (@calebdoxsey)
-- internal/autocert: re-use cert if renewing failed but cert not expired [#1237](https://github.com/pomerium/pomerium/pull/1237) (@cuonglm)
-
-### Security
-
-- chore(deps): update envoy 1.16.1 [#1613](https://github.com/pomerium/pomerium/pull/1613) (@desimone)
-
-### Documentation
-
-- move signing key algorithm documentation into yaml file [#1646](https://github.com/pomerium/pomerium/pull/1646) (@calebdoxsey)
-- update docs [#1645](https://github.com/pomerium/pomerium/pull/1645) (@desimone)
-- docs: update build badge [#1635](https://github.com/pomerium/pomerium/pull/1635) (@travisgroth)
-- docs: add cache_service_url upgrade notice [#1621](https://github.com/pomerium/pomerium/pull/1621) (@travisgroth)
-- docs: use standard language for lists [#1590](https://github.com/pomerium/pomerium/pull/1590) (@desimone)
-- Fix command in Kubernetes Quick start docs [#1582](https://github.com/pomerium/pomerium/pull/1582) (@wesleyw72)
-- move docs to settings.yaml [#1579](https://github.com/pomerium/pomerium/pull/1579) (@calebdoxsey)
-- docs: add round logo [#1574](https://github.com/pomerium/pomerium/pull/1574) (@desimone)
-- add settings.yaml file [#1540](https://github.com/pomerium/pomerium/pull/1540) (@calebdoxsey)
-- update the documentation for auth0 to include group/role information [#1502](https://github.com/pomerium/pomerium/pull/1502) (@grounded042)
-- examples: fix nginx example [#1478](https://github.com/pomerium/pomerium/pull/1478) (@desimone)
-- docs: add architecture diagram for cloudrun [#1444](https://github.com/pomerium/pomerium/pull/1444) (@travisgroth)
-- fix(examples): Use X-Pomerium-Claim headers [#1422](https://github.com/pomerium/pomerium/pull/1422) (@tdorsey)
-- chore(docs): Fix typo in example policy [#1419](https://github.com/pomerium/pomerium/pull/1419) (@tdorsey)
-- docs: fix grammar [#1412](https://github.com/pomerium/pomerium/pull/1412) (@shinebayar-g)
-- docs: Add Traefik + Kubernetes example [#1411](https://github.com/pomerium/pomerium/pull/1411) (@travisgroth)
-- Remove typo on remove_request_headers docs [#1388](https://github.com/pomerium/pomerium/pull/1388) (@whs)
-- docs: update azure docs [#1377](https://github.com/pomerium/pomerium/pull/1377) (@desimone)
-- docs: add nginx example [#1329](https://github.com/pomerium/pomerium/pull/1329) (@travisgroth)
-- docs: use .com sitemap hostname [#1274](https://github.com/pomerium/pomerium/pull/1274) (@desimone)
-- docs: fix in-action video [#1268](https://github.com/pomerium/pomerium/pull/1268) (@travisgroth)
-- docs: image, sitemap and redirect fixes [#1263](https://github.com/pomerium/pomerium/pull/1263) (@travisgroth)
-- Fix broken logo link in README.md [#1261](https://github.com/pomerium/pomerium/pull/1261) (@cuonglm)
-- docs/docs: fix wrong okta service account field [#1251](https://github.com/pomerium/pomerium/pull/1251) (@cuonglm)
-- [Backport latest] Docs/enterprise button [#1247](https://github.com/pomerium/pomerium/pull/1247) (@github-actions[bot])
-- Docs/enterprise button [#1245](https://github.com/pomerium/pomerium/pull/1245) (@desimone)
-- remove rootDomain from examples [#1244](https://github.com/pomerium/pomerium/pull/1244) (@karelbilek)
-- docs: add / redirect [#1241](https://github.com/pomerium/pomerium/pull/1241) (@desimone)
-- docs: prepare for enterprise / oss split [#1238](https://github.com/pomerium/pomerium/pull/1238) (@desimone)
-
-### Dependency
-
-- chore(deps): update module open-policy-agent/opa to v0.25.1 [#1659](https://github.com/pomerium/pomerium/pull/1659) (@renovate[bot])
-- chore(deps): update module lithammer/shortuuid/v3 to v3.0.5 [#1658](https://github.com/pomerium/pomerium/pull/1658) (@renovate[bot])
-- chore(deps): update module google.golang.org/grpc to v1.34.0 [#1657](https://github.com/pomerium/pomerium/pull/1657) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 9ee31aa [#1655](https://github.com/pomerium/pomerium/pull/1655) (@renovate[bot])
-- chore(deps): update golang.org/x/oauth2 commit hash to 9317641 [#1654](https://github.com/pomerium/pomerium/pull/1654) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to c7110b5 [#1653](https://github.com/pomerium/pomerium/pull/1653) (@renovate[bot])
-- chore(deps): update golang.org/x/crypto commit hash to be400ae [#1652](https://github.com/pomerium/pomerium/pull/1652) (@renovate[bot])
-- deps: update hashstructure v2 [#1632](https://github.com/pomerium/pomerium/pull/1632) (@desimone)
-- chore(deps): update precommit hook pre-commit/pre-commit-hooks to v3 [#1630](https://github.com/pomerium/pomerium/pull/1630) (@renovate[bot])
-- chore(deps): update module yaml to v2.4.0 [#1629](https://github.com/pomerium/pomerium/pull/1629) (@renovate[bot])
-- chore(deps): update module google/go-cmp to v0.5.4 [#1628](https://github.com/pomerium/pomerium/pull/1628) (@renovate[bot])
-- chore(deps): update golang.org/x/crypto commit hash to c8d3bf9 [#1627](https://github.com/pomerium/pomerium/pull/1627) (@renovate[bot])
-- chore(deps): update module google/go-jsonnet to v0.17.0 [#1611](https://github.com/pomerium/pomerium/pull/1611) (@renovate[bot])
-- chore(deps): update codecov/codecov-action action to v1.0.15 [#1610](https://github.com/pomerium/pomerium/pull/1610) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 9b1e624 [#1609](https://github.com/pomerium/pomerium/pull/1609) (@renovate[bot])
-- chore(deps): update golang.org/x/crypto commit hash to c1f2f97 [#1608](https://github.com/pomerium/pomerium/pull/1608) (@renovate[bot])
-- chore(deps): update module google/go-cmp to v0.5.3 [#1597](https://github.com/pomerium/pomerium/pull/1597) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to ce600e9 [#1596](https://github.com/pomerium/pomerium/pull/1596) (@renovate[bot])
-- chore(deps): update golang.org/x/oauth2 commit hash to 9fd6049 [#1595](https://github.com/pomerium/pomerium/pull/1595) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to 69a7880 [#1594](https://github.com/pomerium/pomerium/pull/1594) (@renovate[bot])
-- chore(deps): update golang.org/x/crypto commit hash to 0c6587e [#1593](https://github.com/pomerium/pomerium/pull/1593) (@renovate[bot])
-- chore(deps): update module google.golang.org/grpc to v1.33.2 [#1585](https://github.com/pomerium/pomerium/pull/1585) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to f9bfe23 [#1583](https://github.com/pomerium/pomerium/pull/1583) (@renovate[bot])
-- chore(deps): update mikefarah/yq action to v3.4.1 [#1567](https://github.com/pomerium/pomerium/pull/1567) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 24207fd [#1566](https://github.com/pomerium/pomerium/pull/1566) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to ff519b6 [#1565](https://github.com/pomerium/pomerium/pull/1565) (@renovate[bot])
-- chore(deps): update olegtarasov/get-tag action to v2 [#1552](https://github.com/pomerium/pomerium/pull/1552) (@renovate[bot])
-- chore(deps): update goreleaser/goreleaser-action action to v2 [#1551](https://github.com/pomerium/pomerium/pull/1551) (@renovate[bot])
-- chore(deps): update actions/setup-go action to v2 [#1550](https://github.com/pomerium/pomerium/pull/1550) (@renovate[bot])
-- chore(deps): update toolmantim/release-drafter action to v5.12.1 [#1549](https://github.com/pomerium/pomerium/pull/1549) (@renovate[bot])
-- chore(deps): update module google.golang.org/grpc to v1.33.1 [#1548](https://github.com/pomerium/pomerium/pull/1548) (@renovate[bot])
-- chore(deps): update codecov/codecov-action action to v1.0.14 [#1547](https://github.com/pomerium/pomerium/pull/1547) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 0ff5f38 [#1546](https://github.com/pomerium/pomerium/pull/1546) (@renovate[bot])
-- chore(deps): update golang.org/x/sync commit hash to 67f06af [#1545](https://github.com/pomerium/pomerium/pull/1545) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to be3efd7 [#1544](https://github.com/pomerium/pomerium/pull/1544) (@renovate[bot])
-- chore(deps): update vuepress monorepo to v1.7.1 [#1531](https://github.com/pomerium/pomerium/pull/1531) (@renovate[bot])
-- chore(deps): update module spf13/cobra to v1.1.1 [#1530](https://github.com/pomerium/pomerium/pull/1530) (@renovate[bot])
-- chore(deps): update module prometheus/client_golang to v1.8.0 [#1529](https://github.com/pomerium/pomerium/pull/1529) (@renovate[bot])
-- chore(deps): update module ory/dockertest/v3 to v3.6.2 [#1528](https://github.com/pomerium/pomerium/pull/1528) (@renovate[bot])
-- chore(deps): update module open-policy-agent/opa to v0.24.0 [#1527](https://github.com/pomerium/pomerium/pull/1527) (@renovate[bot])
-- chore(deps): update module golang/protobuf to v1.4.3 [#1525](https://github.com/pomerium/pomerium/pull/1525) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 32ed001 [#1524](https://github.com/pomerium/pomerium/pull/1524) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to 7b1cca2 [#1523](https://github.com/pomerium/pomerium/pull/1523) (@renovate[bot])
-- chore(deps): update golang.org/x/crypto commit hash to 9e8e0b3 [#1522](https://github.com/pomerium/pomerium/pull/1522) (@renovate[bot])
-- chore(deps): upgrade envoy to v0.16.0 [#1519](https://github.com/pomerium/pomerium/pull/1519) (@desimone)
-- deployment: run go mod tidy [#1512](https://github.com/pomerium/pomerium/pull/1512) (@desimone)
-- chore(deps): update module ory/dockertest/v3 to v3.6.1 [#1511](https://github.com/pomerium/pomerium/pull/1511) (@renovate[bot])
-- chore(deps): update module go.opencensus.io to v0.22.5 [#1510](https://github.com/pomerium/pomerium/pull/1510) (@renovate[bot])
-- chore(deps): update module cenkalti/backoff/v4 to v4.1.0 [#1509](https://github.com/pomerium/pomerium/pull/1509) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 4d944d3 [#1508](https://github.com/pomerium/pomerium/pull/1508) (@renovate[bot])
-- chore(deps): update golang.org/x/sync commit hash to b3e1573 [#1507](https://github.com/pomerium/pomerium/pull/1507) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to 4f7140c [#1506](https://github.com/pomerium/pomerium/pull/1506) (@renovate[bot])
-- deployment: pin /x/sys to fix dockertest [#1491](https://github.com/pomerium/pomerium/pull/1491) (@desimone)
-- chore(deps): update module openzipkin/zipkin-go to v0.2.5 [#1488](https://github.com/pomerium/pomerium/pull/1488) (@renovate[bot])
-- chore(deps): update module envoyproxy/go-control-plane to v0.9.7 [#1487](https://github.com/pomerium/pomerium/pull/1487) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to bcad7cf [#1486](https://github.com/pomerium/pomerium/pull/1486) (@renovate[bot])
-- chore(deps): update golang.org/x/sync commit hash to 3042136 [#1485](https://github.com/pomerium/pomerium/pull/1485) (@renovate[bot])
-- chore(deps): update golang.org/x/crypto commit hash to 7f63de1 [#1483](https://github.com/pomerium/pomerium/pull/1483) (@renovate[bot])
-- deps: update envoy arm64 to v1.15.1 [#1475](https://github.com/pomerium/pomerium/pull/1475) (@travisgroth)
-- chore(deps): envoy 1.15.1 [#1473](https://github.com/pomerium/pomerium/pull/1473) (@desimone)
-- chore(deps): update vuepress monorepo to v1.6.0 [#1463](https://github.com/pomerium/pomerium/pull/1463) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to c2d885f [#1462](https://github.com/pomerium/pomerium/pull/1462) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to 5d4f700 [#1461](https://github.com/pomerium/pomerium/pull/1461) (@renovate[bot])
-- deps: go mod tidy [#1434](https://github.com/pomerium/pomerium/pull/1434) (@travisgroth)
-- chore(deps): update module rs/zerolog to v1.20.0 [#1431](https://github.com/pomerium/pomerium/pull/1431) (@renovate[bot])
-- chore(deps): update module caddyserver/certmagic to v0.12.0 [#1429](https://github.com/pomerium/pomerium/pull/1429) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to d0d6055 [#1428](https://github.com/pomerium/pomerium/pull/1428) (@renovate[bot])
-- chore(deps): update module openzipkin/zipkin-go to v0.2.4 [#1407](https://github.com/pomerium/pomerium/pull/1407) (@renovate[bot])
-- chore(deps): update module gorilla/handlers to v1.5.1 [#1406](https://github.com/pomerium/pomerium/pull/1406) (@renovate[bot])
-- chore(deps): update module google.golang.org/grpc to v1.32.0 [#1405](https://github.com/pomerium/pomerium/pull/1405) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 645f7a4 [#1404](https://github.com/pomerium/pomerium/pull/1404) (@renovate[bot])
-- Run go mod tidy [#1384](https://github.com/pomerium/pomerium/pull/1384) (@cuonglm)
-- chore(deps): update module go.uber.org/zap to v1.16.0 [#1381](https://github.com/pomerium/pomerium/pull/1381) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 0bd0a95 [#1380](https://github.com/pomerium/pomerium/pull/1380) (@renovate[bot])
-- chore(deps): update golang.org/x/oauth2 commit hash to 5d25da1 [#1379](https://github.com/pomerium/pomerium/pull/1379) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to 62affa3 [#1378](https://github.com/pomerium/pomerium/pull/1378) (@renovate[bot])
-- deps: ensure renovate runs `go mod tidy` [#1357](https://github.com/pomerium/pomerium/pull/1357) (@travisgroth)
-- deps: go mod tidy [#1356](https://github.com/pomerium/pomerium/pull/1356) (@travisgroth)
-- Update module open-policy-agent/opa to v0.23.2 [#1351](https://github.com/pomerium/pomerium/pull/1351) (@renovate[bot])
-- Update module google/uuid to v1.1.2 [#1350](https://github.com/pomerium/pomerium/pull/1350) (@renovate[bot])
-- Update module google/go-cmp to v0.5.2 [#1349](https://github.com/pomerium/pomerium/pull/1349) (@renovate[bot])
-- Update module google.golang.org/grpc to v1.31.1 [#1348](https://github.com/pomerium/pomerium/pull/1348) (@renovate[bot])
-- Update google.golang.org/genproto commit hash to 2bf3329 [#1347](https://github.com/pomerium/pomerium/pull/1347) (@renovate[bot])
-- chore(deps): update vuepress monorepo to v1.5.4 [#1323](https://github.com/pomerium/pomerium/pull/1323) (@renovate[bot])
-- chore(deps): update module open-policy-agent/opa to v0.23.1 [#1322](https://github.com/pomerium/pomerium/pull/1322) (@renovate[bot])
-- chore(deps): update module gorilla/mux to v1.8.0 [#1321](https://github.com/pomerium/pomerium/pull/1321) (@renovate[bot])
-- chore(deps): update module gorilla/handlers to v1.5.0 [#1320](https://github.com/pomerium/pomerium/pull/1320) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to c890458 [#1319](https://github.com/pomerium/pomerium/pull/1319) (@renovate[bot])
-- chore(deps): update golang.org/x/crypto commit hash to 5c72a88 [#1318](https://github.com/pomerium/pomerium/pull/1318) (@renovate[bot])
-- Upgrade zipkin-go to v0.2.3 [#1288](https://github.com/pomerium/pomerium/pull/1288) (@cuonglm)
-- chore(deps): update google.golang.org/genproto commit hash to f69a880 [#1286](https://github.com/pomerium/pomerium/pull/1286) (@renovate[bot])
-- chore(deps): update golang.org/x/time commit hash to 3af7569 [#1285](https://github.com/pomerium/pomerium/pull/1285) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to 3edf25e [#1284](https://github.com/pomerium/pomerium/pull/1284) (@renovate[bot])
-- .github/workflows: upgrade to go1.15 [#1258](https://github.com/pomerium/pomerium/pull/1258) (@cuonglm)
-- Fix tests failed with go115 [#1257](https://github.com/pomerium/pomerium/pull/1257) (@cuonglm)
-- chore(deps): update dependency @vuepress/plugin-google-analytics to v1.5.3 [#1236](https://github.com/pomerium/pomerium/pull/1236) (@renovate[bot])
-- Update module google.golang.org/api to v0.30.0 [#1235](https://github.com/pomerium/pomerium/pull/1235) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to a062522 [#1234](https://github.com/pomerium/pomerium/pull/1234) (@renovate[bot])
-
-#### Deployment
-
-- deployment: enable multi-arch release images [#1643](https://github.com/pomerium/pomerium/pull/1643) (@travisgroth)
-- ci: add bintray publishing [#1618](https://github.com/pomerium/pomerium/pull/1618) (@travisgroth)
-- ci: remove bad quoting in publish steps [#1617](https://github.com/pomerium/pomerium/pull/1617) (@travisgroth)
-- ci: update tag parsing step [#1616](https://github.com/pomerium/pomerium/pull/1616) (@travisgroth)
-- remove memberlist [#1615](https://github.com/pomerium/pomerium/pull/1615) (@calebdoxsey)
-- ci: automatically update test environment with master [#1562](https://github.com/pomerium/pomerium/pull/1562) (@travisgroth)
-- deployment: add debug build / container / docs [#1513](https://github.com/pomerium/pomerium/pull/1513) (@travisgroth)
-- deployment: Generate deb and rpm packages [#1458](https://github.com/pomerium/pomerium/pull/1458) (@travisgroth)
-- deployment: bump release go to v1.15.x [#1439](https://github.com/pomerium/pomerium/pull/1439) (@desimone)
-- ci: publish cloudrun latest tag [#1398](https://github.com/pomerium/pomerium/pull/1398) (@travisgroth)
-- deployment: fully split release archives and brews [#1365](https://github.com/pomerium/pomerium/pull/1365) (@travisgroth)
-- Include pomerium-cli in the docker image by default. Fixes #1343\. [#1345](https://github.com/pomerium/pomerium/pull/1345) (@rspier)
-- Use apt-get instead of apt to eliminate warning. [#1344](https://github.com/pomerium/pomerium/pull/1344) (@rspier)
-- deployment: add goimports with path awareness [#1316](https://github.com/pomerium/pomerium/pull/1316) (@desimone)
-
-### Changed
-
-- identity/oidc/azure: goimports [#1651](https://github.com/pomerium/pomerium/pull/1651) (@travisgroth)
-- fix panic when deleting a record twice from the inmemory data store [#1639](https://github.com/pomerium/pomerium/pull/1639) (@calebdoxsey)
-- ci: improve release snapshot name template [#1602](https://github.com/pomerium/pomerium/pull/1602) (@travisgroth)
-- ci: fix release workflow syntax [#1592](https://github.com/pomerium/pomerium/pull/1592) (@travisgroth)
-- ci: update changelog generation to script [#1589](https://github.com/pomerium/pomerium/pull/1589) (@travisgroth)
-- [Backport 0-10-0] docs: add round logo [#1575](https://github.com/pomerium/pomerium/pull/1575) (@github-actions[bot])
-- tidy [#1494](https://github.com/pomerium/pomerium/pull/1494) (@desimone)
-- dev: add remote container debug configs [#1459](https://github.com/pomerium/pomerium/pull/1459) (@desimone)
-- ci: add stale issue automation [#1366](https://github.com/pomerium/pomerium/pull/1366) (@travisgroth)
-- internal/urlutil: remove un-used constants [#1326](https://github.com/pomerium/pomerium/pull/1326) (@cuonglm)
-- integration: add forward auth test [#1312](https://github.com/pomerium/pomerium/pull/1312) (@cuonglm)
-- pkg/storage/redis: update tests to use local certs + upstream image [#1306](https://github.com/pomerium/pomerium/pull/1306) (@travisgroth)
-- config: omit empty subpolicies in yaml/json [#1229](https://github.com/pomerium/pomerium/pull/1229) (@travisgroth)
-- Cuonglm/increase coverrage 1 [#1227](https://github.com/pomerium/pomerium/pull/1227) (@cuonglm)
-
-## [v0.11.0-rc2](https://github.com/pomerium/pomerium/tree/v0.11.0-rc2) (2020-11-19)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.11.0-rc1...v0.11.0-rc2)
-
-### New
-
-- add paging support to GetAll [#1601](https://github.com/pomerium/pomerium/pull/1601) (@calebdoxsey)
-- attach version to gRPC server metadata [#1598](https://github.com/pomerium/pomerium/pull/1598) (@calebdoxsey)
-
-### Fixed
-
-- pkg/storage/redis: Prevent connection churn [#1603](https://github.com/pomerium/pomerium/pull/1603) (@travisgroth)
-
-### Dependency
-
-- chore(deps): update module google/go-cmp to v0.5.3 [#1597](https://github.com/pomerium/pomerium/pull/1597) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to ce600e9 [#1596](https://github.com/pomerium/pomerium/pull/1596) (@renovate[bot])
-- chore(deps): update golang.org/x/oauth2 commit hash to 9fd6049 [#1595](https://github.com/pomerium/pomerium/pull/1595) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to 69a7880 [#1594](https://github.com/pomerium/pomerium/pull/1594) (@renovate[bot])
-- chore(deps): update golang.org/x/crypto commit hash to 0c6587e [#1593](https://github.com/pomerium/pomerium/pull/1593) (@renovate[bot])
-
-### Changed
-
-- ci: improve release snapshot name template [#1602](https://github.com/pomerium/pomerium/pull/1602) (@travisgroth)
-
-## [v0.11.0-rc1](https://github.com/pomerium/pomerium/tree/v0.11.0-rc1) (2020-11-13)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.6...v0.11.0-rc1)
-
-### Breaking
-
-- add flag to enable user impersonation [#1514](https://github.com/pomerium/pomerium/pull/1514) (@calebdoxsey)
-
-### New
-
-- use custom default http transport [#1576](https://github.com/pomerium/pomerium/pull/1576) (@calebdoxsey)
-- update user info in addition to refreshing the token [#1572](https://github.com/pomerium/pomerium/pull/1572) (@calebdoxsey)
-- databroker: add audience to session [#1557](https://github.com/pomerium/pomerium/pull/1557) (@calebdoxsey)
-- authorize: implement allowed_idp_claims [#1542](https://github.com/pomerium/pomerium/pull/1542) (@calebdoxsey)
-- autocert: support certificate renewal [#1516](https://github.com/pomerium/pomerium/pull/1516) (@calebdoxsey)
-- add policy to allow any authenticated user [#1515](https://github.com/pomerium/pomerium/pull/1515) (@pflipp)
-- debug: add pprof endpoints [#1504](https://github.com/pomerium/pomerium/pull/1504) (@calebdoxsey)
-- databroker: require JWT for access [#1503](https://github.com/pomerium/pomerium/pull/1503) (@calebdoxsey)
-- authenticate: remove unused paths, generate cipher at startup, remove qp store [#1495](https://github.com/pomerium/pomerium/pull/1495) (@desimone)
-- forward-auth: use envoy's ext_authz check [#1482](https://github.com/pomerium/pomerium/pull/1482) (@desimone)
-- auth0: implement directory provider [#1479](https://github.com/pomerium/pomerium/pull/1479) (@grounded042)
-- azure: incremental sync [#1471](https://github.com/pomerium/pomerium/pull/1471) (@calebdoxsey)
-- auth0: implement identity provider [#1470](https://github.com/pomerium/pomerium/pull/1470) (@calebdoxsey)
-- dashboard: format timestamps [#1468](https://github.com/pomerium/pomerium/pull/1468) (@calebdoxsey)
-- directory: additional user info [#1467](https://github.com/pomerium/pomerium/pull/1467) (@calebdoxsey)
-- directory: add explicit RefreshUser endpoint for faster sync [#1460](https://github.com/pomerium/pomerium/pull/1460) (@calebdoxsey)
-- config: add support for host header rewriting [#1457](https://github.com/pomerium/pomerium/pull/1457) (@calebdoxsey)
-- proxy: preserve path and query string for http->https redirect [#1456](https://github.com/pomerium/pomerium/pull/1456) (@calebdoxsey)
-- redis: use pubsub instead of keyspace events [#1450](https://github.com/pomerium/pomerium/pull/1450) (@calebdoxsey)
-- proxy: add support for /.pomerium/jwt [#1446](https://github.com/pomerium/pomerium/pull/1446) (@calebdoxsey)
-- databroker: add support for querying the databroker [#1443](https://github.com/pomerium/pomerium/pull/1443) (@calebdoxsey)
-- config: add dns_lookup_family option to customize DNS IP resolution [#1436](https://github.com/pomerium/pomerium/pull/1436) (@calebdoxsey)
-- okta: handle deleted groups [#1418](https://github.com/pomerium/pomerium/pull/1418) (@calebdoxsey)
-- controlplane: support P-384 / P-512 EC curves [#1409](https://github.com/pomerium/pomerium/pull/1409) (@desimone)
-- azure: add support for nested groups [#1408](https://github.com/pomerium/pomerium/pull/1408) (@calebdoxsey)
-- authorize: add support for service accounts [#1374](https://github.com/pomerium/pomerium/pull/1374) (@calebdoxsey)
-- Cuonglm/improve timeout error message [#1373](https://github.com/pomerium/pomerium/pull/1373) (@cuonglm)
-- internal/directory/okta: remove rate limiter [#1370](https://github.com/pomerium/pomerium/pull/1370) (@cuonglm)
-- proxy/controlplane: make health checks debug level [#1368](https://github.com/pomerium/pomerium/pull/1368) (@desimone)
-- databroker: add tracing for rego evaluation and databroker sync, fix bug in databroker config source [#1367](https://github.com/pomerium/pomerium/pull/1367) (@calebdoxsey)
-- authorize: use impersonate email/groups in JWT [#1364](https://github.com/pomerium/pomerium/pull/1364) (@calebdoxsey)
-- config: support explicit prefix and regex path rewriting [#1363](https://github.com/pomerium/pomerium/pull/1363) (@calebdoxsey)
-- proxy: support websocket timeouts [#1362](https://github.com/pomerium/pomerium/pull/1362) (@calebdoxsey)
-- proxy: disable control-plane robots.txt for public unauthenticated routes [#1361](https://github.com/pomerium/pomerium/pull/1361) (@calebdoxsey)
-- certmagic: improve logging [#1358](https://github.com/pomerium/pomerium/pull/1358) (@calebdoxsey)
-- logs: add new log scrubber [#1346](https://github.com/pomerium/pomerium/pull/1346) (@calebdoxsey)
-- Allow setting the shared secret via an environment variable. [#1337](https://github.com/pomerium/pomerium/pull/1337) (@rspier)
-- authorize: add jti to JWT payload [#1328](https://github.com/pomerium/pomerium/pull/1328) (@calebdoxsey)
-- all: add signout redirect url [#1324](https://github.com/pomerium/pomerium/pull/1324) (@cuonglm)
-- proxy: remove unused handlers [#1317](https://github.com/pomerium/pomerium/pull/1317) (@desimone)
-- azure: support deriving credentials from client id, client secret and provider url [#1300](https://github.com/pomerium/pomerium/pull/1300) (@calebdoxsey)
-- cache: support databroker option changes [#1294](https://github.com/pomerium/pomerium/pull/1294) (@calebdoxsey)
-- authenticate: move databroker connection to state [#1292](https://github.com/pomerium/pomerium/pull/1292) (@calebdoxsey)
-- authorize: use atomic state for properties [#1290](https://github.com/pomerium/pomerium/pull/1290) (@calebdoxsey)
-- proxy: move properties to atomically updated state [#1280](https://github.com/pomerium/pomerium/pull/1280) (@calebdoxsey)
-- Improving okta API requests [#1278](https://github.com/pomerium/pomerium/pull/1278) (@cuonglm)
-- authenticate: move properties to atomically updated state [#1277](https://github.com/pomerium/pomerium/pull/1277) (@calebdoxsey)
-- authenticate: support reloading IDP settings [#1273](https://github.com/pomerium/pomerium/pull/1273) (@calebdoxsey)
-- Rate limit for okta [#1271](https://github.com/pomerium/pomerium/pull/1271) (@cuonglm)
-- config: allow dynamic configuration of cookie settings [#1267](https://github.com/pomerium/pomerium/pull/1267) (@calebdoxsey)
-- internal/directory/okta: increase default batch size to 200 [#1264](https://github.com/pomerium/pomerium/pull/1264) (@cuonglm)
-- envoy: add support for hot-reloading bootstrap configuration [#1259](https://github.com/pomerium/pomerium/pull/1259) (@calebdoxsey)
-- config: allow reloading of telemetry settings [#1255](https://github.com/pomerium/pomerium/pull/1255) (@calebdoxsey)
-- databroker: add support for config settings [#1253](https://github.com/pomerium/pomerium/pull/1253) (@calebdoxsey)
-- config: warn if custom scopes set for builtin providers [#1252](https://github.com/pomerium/pomerium/pull/1252) (@cuonglm)
-- authorize: add databroker url check [#1228](https://github.com/pomerium/pomerium/pull/1228) (@desimone)
-- internal/databroker: make Sync send data in smaller batches [#1226](https://github.com/pomerium/pomerium/pull/1226) (@cuonglm)
-
-### Fixed
-
-- forward-auth: fix special character support for nginx [#1578](https://github.com/pomerium/pomerium/pull/1578) (@desimone)
-- proxy/forward_auth: copy response headers as request headers [#1577](https://github.com/pomerium/pomerium/pull/1577) (@desimone)
-- fix querying claim data on the dashboard [#1560](https://github.com/pomerium/pomerium/pull/1560) (@calebdoxsey)
-- github: fix retrieving team id with graphql API (#1554) [#1555](https://github.com/pomerium/pomerium/pull/1555) (@toshipp)
-- store raw id token so it can be passed to the logout url [#1543](https://github.com/pomerium/pomerium/pull/1543) (@calebdoxsey)
-- fix databroker requiring signed jwt [#1538](https://github.com/pomerium/pomerium/pull/1538) (@calebdoxsey)
-- authorize: add redirect url to debug page [#1533](https://github.com/pomerium/pomerium/pull/1533) (@desimone)
-- internal/frontend: resolve authN helper url [#1521](https://github.com/pomerium/pomerium/pull/1521) (@desimone)
-- fwd-auth: match nginx-ingress config [#1505](https://github.com/pomerium/pomerium/pull/1505) (@desimone)
-- authenticate: protect /.pomerium/admin endpoint [#1500](https://github.com/pomerium/pomerium/pull/1500) (@calebdoxsey)
-- ci: ensure systemd unit file is in packages [#1481](https://github.com/pomerium/pomerium/pull/1481) (@travisgroth)
-- identity manager: fix directory sync timing [#1455](https://github.com/pomerium/pomerium/pull/1455) (@calebdoxsey)
-- proxy/forward_auth: don't reset forward auth path if X-Forwarded-Uri is not set [#1447](https://github.com/pomerium/pomerium/pull/1447) (@whs)
-- httputil: remove retry button [#1438](https://github.com/pomerium/pomerium/pull/1438) (@desimone)
-- proxy: always use https for application callback [#1433](https://github.com/pomerium/pomerium/pull/1433) (@travisgroth)
-- controplane: remove p-521 EC [#1420](https://github.com/pomerium/pomerium/pull/1420) (@desimone)
-- redirect-server: add config headers to responses [#1416](https://github.com/pomerium/pomerium/pull/1416) (@calebdoxsey)
-- proxy: remove impersonate headers for kubernetes [#1394](https://github.com/pomerium/pomerium/pull/1394) (@calebdoxsey)
-- Desimone/authenticate default logout [#1390](https://github.com/pomerium/pomerium/pull/1390) (@desimone)
-- proxy: for filter matches only include bare domain name [#1389](https://github.com/pomerium/pomerium/pull/1389) (@calebdoxsey)
-- internal/envoy: start epoch from 0 [#1387](https://github.com/pomerium/pomerium/pull/1387) (@travisgroth)
-- internal/directory/okta: acceept non-json service account [#1359](https://github.com/pomerium/pomerium/pull/1359) (@cuonglm)
-- internal/controlplane: add telemetry http handler [#1353](https://github.com/pomerium/pomerium/pull/1353) (@travisgroth)
-- autocert: fix locking issue [#1310](https://github.com/pomerium/pomerium/pull/1310) (@calebdoxsey)
-- authorize: log users and groups [#1303](https://github.com/pomerium/pomerium/pull/1303) (@desimone)
-- proxy: fix wrong applied middleware [#1298](https://github.com/pomerium/pomerium/pull/1298) (@cuonglm)
-- internal/directory/okta: fix wrong API query filter [#1296](https://github.com/pomerium/pomerium/pull/1296) (@cuonglm)
-- autocert: fix bootstrapped cache store path [#1283](https://github.com/pomerium/pomerium/pull/1283) (@desimone)
-- config: validate databroker settings [#1260](https://github.com/pomerium/pomerium/pull/1260) (@calebdoxsey)
-- internal/autocert: re-use cert if renewing failed but cert not expired [#1237](https://github.com/pomerium/pomerium/pull/1237) (@cuonglm)
-
-### Documentation
-
-- docs: use standard language for lists [#1590](https://github.com/pomerium/pomerium/pull/1590) (@desimone)
-- Fix command in Kubernetes Quick start docs [#1582](https://github.com/pomerium/pomerium/pull/1582) (@wesleyw72)
-- move docs to settings.yaml [#1579](https://github.com/pomerium/pomerium/pull/1579) (@calebdoxsey)
-- docs: add round logo [#1574](https://github.com/pomerium/pomerium/pull/1574) (@desimone)
-- add settings.yaml file [#1540](https://github.com/pomerium/pomerium/pull/1540) (@calebdoxsey)
-- update the documentation for auth0 to include group/role information [#1502](https://github.com/pomerium/pomerium/pull/1502) (@grounded042)
-- examples: fix nginx example [#1478](https://github.com/pomerium/pomerium/pull/1478) (@desimone)
-- docs: add architecture diagram for cloudrun [#1444](https://github.com/pomerium/pomerium/pull/1444) (@travisgroth)
-- fix(examples): Use X-Pomerium-Claim headers [#1422](https://github.com/pomerium/pomerium/pull/1422) (@tdorsey)
-- chore(docs): Fix typo in example policy [#1419](https://github.com/pomerium/pomerium/pull/1419) (@tdorsey)
-- docs: fix grammar [#1412](https://github.com/pomerium/pomerium/pull/1412) (@shinebayar-g)
-- docs: Add Traefik + Kubernetes example [#1411](https://github.com/pomerium/pomerium/pull/1411) (@travisgroth)
-- Remove typo on remove_request_headers docs [#1388](https://github.com/pomerium/pomerium/pull/1388) (@whs)
-- docs: update azure docs [#1377](https://github.com/pomerium/pomerium/pull/1377) (@desimone)
-- docs: add nginx example [#1329](https://github.com/pomerium/pomerium/pull/1329) (@travisgroth)
-- docs: use .com sitemap hostname [#1274](https://github.com/pomerium/pomerium/pull/1274) (@desimone)
-- docs: fix in-action video [#1268](https://github.com/pomerium/pomerium/pull/1268) (@travisgroth)
-- docs: image, sitemap and redirect fixes [#1263](https://github.com/pomerium/pomerium/pull/1263) (@travisgroth)
-- Fix broken logo link in README.md [#1261](https://github.com/pomerium/pomerium/pull/1261) (@cuonglm)
-- docs/docs: fix wrong okta service account field [#1251](https://github.com/pomerium/pomerium/pull/1251) (@cuonglm)
-- [Backport latest] Docs/enterprise button [#1247](https://github.com/pomerium/pomerium/pull/1247) (@github-actions[bot])
-- Docs/enterprise button [#1245](https://github.com/pomerium/pomerium/pull/1245) (@desimone)
-- remove rootDomain from examples [#1244](https://github.com/pomerium/pomerium/pull/1244) (@karelbilek)
-- docs: add / redirect [#1241](https://github.com/pomerium/pomerium/pull/1241) (@desimone)
-- docs: prepare for enterprise / oss split [#1238](https://github.com/pomerium/pomerium/pull/1238) (@desimone)
-
-### Dependency
-
-- chore(deps): update module google.golang.org/grpc to v1.33.2 [#1585](https://github.com/pomerium/pomerium/pull/1585) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to f9bfe23 [#1583](https://github.com/pomerium/pomerium/pull/1583) (@renovate[bot])
-- chore(deps): update mikefarah/yq action to v3.4.1 [#1567](https://github.com/pomerium/pomerium/pull/1567) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 24207fd [#1566](https://github.com/pomerium/pomerium/pull/1566) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to ff519b6 [#1565](https://github.com/pomerium/pomerium/pull/1565) (@renovate[bot])
-- chore(deps): update olegtarasov/get-tag action to v2 [#1552](https://github.com/pomerium/pomerium/pull/1552) (@renovate[bot])
-- chore(deps): update goreleaser/goreleaser-action action to v2 [#1551](https://github.com/pomerium/pomerium/pull/1551) (@renovate[bot])
-- chore(deps): update actions/setup-go action to v2 [#1550](https://github.com/pomerium/pomerium/pull/1550) (@renovate[bot])
-- chore(deps): update toolmantim/release-drafter action to v5.12.1 [#1549](https://github.com/pomerium/pomerium/pull/1549) (@renovate[bot])
-- chore(deps): update module google.golang.org/grpc to v1.33.1 [#1548](https://github.com/pomerium/pomerium/pull/1548) (@renovate[bot])
-- chore(deps): update codecov/codecov-action action to v1.0.14 [#1547](https://github.com/pomerium/pomerium/pull/1547) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 0ff5f38 [#1546](https://github.com/pomerium/pomerium/pull/1546) (@renovate[bot])
-- chore(deps): update golang.org/x/sync commit hash to 67f06af [#1545](https://github.com/pomerium/pomerium/pull/1545) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to be3efd7 [#1544](https://github.com/pomerium/pomerium/pull/1544) (@renovate[bot])
-- chore(deps): update vuepress monorepo to v1.7.1 [#1531](https://github.com/pomerium/pomerium/pull/1531) (@renovate[bot])
-- chore(deps): update module spf13/cobra to v1.1.1 [#1530](https://github.com/pomerium/pomerium/pull/1530) (@renovate[bot])
-- chore(deps): update module prometheus/client_golang to v1.8.0 [#1529](https://github.com/pomerium/pomerium/pull/1529) (@renovate[bot])
-- chore(deps): update module ory/dockertest/v3 to v3.6.2 [#1528](https://github.com/pomerium/pomerium/pull/1528) (@renovate[bot])
-- chore(deps): update module open-policy-agent/opa to v0.24.0 [#1527](https://github.com/pomerium/pomerium/pull/1527) (@renovate[bot])
-- chore(deps): update module golang/protobuf to v1.4.3 [#1525](https://github.com/pomerium/pomerium/pull/1525) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 32ed001 [#1524](https://github.com/pomerium/pomerium/pull/1524) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to 7b1cca2 [#1523](https://github.com/pomerium/pomerium/pull/1523) (@renovate[bot])
-- chore(deps): update golang.org/x/crypto commit hash to 9e8e0b3 [#1522](https://github.com/pomerium/pomerium/pull/1522) (@renovate[bot])
-- chore(deps): upgrade envoy to v0.16.0 [#1519](https://github.com/pomerium/pomerium/pull/1519) (@desimone)
-- deployment: run go mod tidy [#1512](https://github.com/pomerium/pomerium/pull/1512) (@desimone)
-- chore(deps): update module ory/dockertest/v3 to v3.6.1 [#1511](https://github.com/pomerium/pomerium/pull/1511) (@renovate[bot])
-- chore(deps): update module go.opencensus.io to v0.22.5 [#1510](https://github.com/pomerium/pomerium/pull/1510) (@renovate[bot])
-- chore(deps): update module cenkalti/backoff/v4 to v4.1.0 [#1509](https://github.com/pomerium/pomerium/pull/1509) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 4d944d3 [#1508](https://github.com/pomerium/pomerium/pull/1508) (@renovate[bot])
-- chore(deps): update golang.org/x/sync commit hash to b3e1573 [#1507](https://github.com/pomerium/pomerium/pull/1507) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to 4f7140c [#1506](https://github.com/pomerium/pomerium/pull/1506) (@renovate[bot])
-- deployment: pin /x/sys to fix dockertest [#1491](https://github.com/pomerium/pomerium/pull/1491) (@desimone)
-- chore(deps): update module openzipkin/zipkin-go to v0.2.5 [#1488](https://github.com/pomerium/pomerium/pull/1488) (@renovate[bot])
-- chore(deps): update module envoyproxy/go-control-plane to v0.9.7 [#1487](https://github.com/pomerium/pomerium/pull/1487) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to bcad7cf [#1486](https://github.com/pomerium/pomerium/pull/1486) (@renovate[bot])
-- chore(deps): update golang.org/x/sync commit hash to 3042136 [#1485](https://github.com/pomerium/pomerium/pull/1485) (@renovate[bot])
-- chore(deps): update golang.org/x/crypto commit hash to 7f63de1 [#1483](https://github.com/pomerium/pomerium/pull/1483) (@renovate[bot])
-- deps: update envoy arm64 to v1.15.1 [#1475](https://github.com/pomerium/pomerium/pull/1475) (@travisgroth)
-- chore(deps): envoy 1.15.1 [#1473](https://github.com/pomerium/pomerium/pull/1473) (@desimone)
-- chore(deps): update vuepress monorepo to v1.6.0 [#1463](https://github.com/pomerium/pomerium/pull/1463) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to c2d885f [#1462](https://github.com/pomerium/pomerium/pull/1462) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to 5d4f700 [#1461](https://github.com/pomerium/pomerium/pull/1461) (@renovate[bot])
-- deps: go mod tidy [#1434](https://github.com/pomerium/pomerium/pull/1434) (@travisgroth)
-- chore(deps): update module rs/zerolog to v1.20.0 [#1431](https://github.com/pomerium/pomerium/pull/1431) (@renovate[bot])
-- chore(deps): update module caddyserver/certmagic to v0.12.0 [#1429](https://github.com/pomerium/pomerium/pull/1429) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to d0d6055 [#1428](https://github.com/pomerium/pomerium/pull/1428) (@renovate[bot])
-- chore(deps): update module openzipkin/zipkin-go to v0.2.4 [#1407](https://github.com/pomerium/pomerium/pull/1407) (@renovate[bot])
-- chore(deps): update module gorilla/handlers to v1.5.1 [#1406](https://github.com/pomerium/pomerium/pull/1406) (@renovate[bot])
-- chore(deps): update module google.golang.org/grpc to v1.32.0 [#1405](https://github.com/pomerium/pomerium/pull/1405) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 645f7a4 [#1404](https://github.com/pomerium/pomerium/pull/1404) (@renovate[bot])
-- Run go mod tidy [#1384](https://github.com/pomerium/pomerium/pull/1384) (@cuonglm)
-- chore(deps): update module go.uber.org/zap to v1.16.0 [#1381](https://github.com/pomerium/pomerium/pull/1381) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to 0bd0a95 [#1380](https://github.com/pomerium/pomerium/pull/1380) (@renovate[bot])
-- chore(deps): update golang.org/x/oauth2 commit hash to 5d25da1 [#1379](https://github.com/pomerium/pomerium/pull/1379) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to 62affa3 [#1378](https://github.com/pomerium/pomerium/pull/1378) (@renovate[bot])
-- deps: ensure renovate runs `go mod tidy` [#1357](https://github.com/pomerium/pomerium/pull/1357) (@travisgroth)
-- deps: go mod tidy [#1356](https://github.com/pomerium/pomerium/pull/1356) (@travisgroth)
-- Update module open-policy-agent/opa to v0.23.2 [#1351](https://github.com/pomerium/pomerium/pull/1351) (@renovate[bot])
-- Update module google/uuid to v1.1.2 [#1350](https://github.com/pomerium/pomerium/pull/1350) (@renovate[bot])
-- Update module google/go-cmp to v0.5.2 [#1349](https://github.com/pomerium/pomerium/pull/1349) (@renovate[bot])
-- Update module google.golang.org/grpc to v1.31.1 [#1348](https://github.com/pomerium/pomerium/pull/1348) (@renovate[bot])
-- Update google.golang.org/genproto commit hash to 2bf3329 [#1347](https://github.com/pomerium/pomerium/pull/1347) (@renovate[bot])
-- chore(deps): update vuepress monorepo to v1.5.4 [#1323](https://github.com/pomerium/pomerium/pull/1323) (@renovate[bot])
-- chore(deps): update module open-policy-agent/opa to v0.23.1 [#1322](https://github.com/pomerium/pomerium/pull/1322) (@renovate[bot])
-- chore(deps): update module gorilla/mux to v1.8.0 [#1321](https://github.com/pomerium/pomerium/pull/1321) (@renovate[bot])
-- chore(deps): update module gorilla/handlers to v1.5.0 [#1320](https://github.com/pomerium/pomerium/pull/1320) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to c890458 [#1319](https://github.com/pomerium/pomerium/pull/1319) (@renovate[bot])
-- chore(deps): update golang.org/x/crypto commit hash to 5c72a88 [#1318](https://github.com/pomerium/pomerium/pull/1318) (@renovate[bot])
-- Upgrade zipkin-go to v0.2.3 [#1288](https://github.com/pomerium/pomerium/pull/1288) (@cuonglm)
-- chore(deps): update google.golang.org/genproto commit hash to f69a880 [#1286](https://github.com/pomerium/pomerium/pull/1286) (@renovate[bot])
-- chore(deps): update golang.org/x/time commit hash to 3af7569 [#1285](https://github.com/pomerium/pomerium/pull/1285) (@renovate[bot])
-- chore(deps): update golang.org/x/net commit hash to 3edf25e [#1284](https://github.com/pomerium/pomerium/pull/1284) (@renovate[bot])
-- .github/workflows: upgrade to go1.15 [#1258](https://github.com/pomerium/pomerium/pull/1258) (@cuonglm)
-- Fix tests failed with go115 [#1257](https://github.com/pomerium/pomerium/pull/1257) (@cuonglm)
-- chore(deps): update dependency @vuepress/plugin-google-analytics to v1.5.3 [#1236](https://github.com/pomerium/pomerium/pull/1236) (@renovate[bot])
-- Update module google.golang.org/api to v0.30.0 [#1235](https://github.com/pomerium/pomerium/pull/1235) (@renovate[bot])
-- chore(deps): update google.golang.org/genproto commit hash to a062522 [#1234](https://github.com/pomerium/pomerium/pull/1234) (@renovate[bot])
-
-#### Deployment
-
-- ci: automatically update test environment with master [#1562](https://github.com/pomerium/pomerium/pull/1562) (@travisgroth)
-- deployment: add debug build / container / docs [#1513](https://github.com/pomerium/pomerium/pull/1513) (@travisgroth)
-- deployment: Generate deb and rpm packages [#1458](https://github.com/pomerium/pomerium/pull/1458) (@travisgroth)
-- deployment: bump release go to v1.15.x [#1439](https://github.com/pomerium/pomerium/pull/1439) (@desimone)
-- ci: publish cloudrun latest tag [#1398](https://github.com/pomerium/pomerium/pull/1398) (@travisgroth)
-- deployment: fully split release archives and brews [#1365](https://github.com/pomerium/pomerium/pull/1365) (@travisgroth)
-- Include pomerium-cli in the docker image by default. Fixes #1343\. [#1345](https://github.com/pomerium/pomerium/pull/1345) (@rspier)
-- Use apt-get instead of apt to eliminate warning. [#1344](https://github.com/pomerium/pomerium/pull/1344) (@rspier)
-- deployment: add goimports with path awareness [#1316](https://github.com/pomerium/pomerium/pull/1316) (@desimone)
-
-### Changed
-
-- ci: fix release workflow syntax [#1592](https://github.com/pomerium/pomerium/pull/1592) (@travisgroth)
-- ci: update changelog generation to script [#1589](https://github.com/pomerium/pomerium/pull/1589) (@travisgroth)
-- [Backport 0-10-0] docs: add round logo [#1575](https://github.com/pomerium/pomerium/pull/1575) (@github-actions[bot])
-- tidy [#1494](https://github.com/pomerium/pomerium/pull/1494) (@desimone)
-- dev: add remote container debug configs [#1459](https://github.com/pomerium/pomerium/pull/1459) (@desimone)
-- ci: add stale issue automation [#1366](https://github.com/pomerium/pomerium/pull/1366) (@travisgroth)
-- internal/urlutil: remove un-used constants [#1326](https://github.com/pomerium/pomerium/pull/1326) (@cuonglm)
-- integration: add forward auth test [#1312](https://github.com/pomerium/pomerium/pull/1312) (@cuonglm)
-- pkg/storage/redis: update tests to use local certs + upstream image [#1306](https://github.com/pomerium/pomerium/pull/1306) (@travisgroth)
-- config: omit empty subpolicies in yaml/json [#1229](https://github.com/pomerium/pomerium/pull/1229) (@travisgroth)
-- Cuonglm/increase coverrage 1 [#1227](https://github.com/pomerium/pomerium/pull/1227) (@cuonglm)
-
-## [v0.10.6](https://github.com/pomerium/pomerium/tree/v0.10.6) (2020-09-30)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.5...v0.10.6)
-
-### Changed
-
-- docs: Update changelog for v0.10.6 [#1477](https://github.com/pomerium/pomerium/pull/1477) (@travisgroth)
-- [Backport 0-10-0] deps: update envoy arm64 to v1.15.1 [#1476](https://github.com/pomerium/pomerium/pull/1476) (@github-actions[bot])
-- [Backport 0-10-0] chore(deps): envoy 1.15.1 [#1474](https://github.com/pomerium/pomerium/pull/1474) (@github-actions[bot])
-
-## [v0.10.5](https://github.com/pomerium/pomerium/tree/v0.10.5) (2020-09-28)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.4...v0.10.5)
-
-### Documentation
-
-- docs: Update changelog for v0.10.5 [#1469](https://github.com/pomerium/pomerium/pull/1469) (@travisgroth)
-
-### Changed
-
-- redis: use pubsub instead of keyspace events [#1451](https://github.com/pomerium/pomerium/pull/1451) (@calebdoxsey)
-
-## [v0.10.4](https://github.com/pomerium/pomerium/tree/v0.10.4) (2020-09-22)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.3...v0.10.4)
-
-### Documentation
-
-- docs: update 0.10.4 changelog [#1441](https://github.com/pomerium/pomerium/pull/1441) (@travisgroth)
-- Add v0.10.4 changelog entry [#1437](https://github.com/pomerium/pomerium/pull/1437) (@travisgroth)
-
-### Changed
-
-- [Backport 0-10-0] httputil: remove retry button [#1440](https://github.com/pomerium/pomerium/pull/1440) (@github-actions[bot])
-- [Backport 0-10-0] proxy: always use https for application callback [#1435](https://github.com/pomerium/pomerium/pull/1435) (@github-actions[bot])
-- [Backport 0-10-0] redirect-server: add config headers to responses [#1427](https://github.com/pomerium/pomerium/pull/1427) (@github-actions[bot])
-- [Backport 0-10-0] controplane: remove p-521 EC [#1423](https://github.com/pomerium/pomerium/pull/1423) (@github-actions[bot])
-- [Backport 0-10-0] controlplane: support P-384 / P-512 EC curves [#1410](https://github.com/pomerium/pomerium/pull/1410) (@github-actions[bot])
-
-## [v0.10.3](https://github.com/pomerium/pomerium/tree/v0.10.3) (2020-09-11)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.2...v0.10.3)
-
-### Changed
-
-- Update changelog for v0.10.3 [#1401](https://github.com/pomerium/pomerium/pull/1401) (@travisgroth)
-- [Backport 0-10-0] ci: publish cloudrun latest tag [#1399](https://github.com/pomerium/pomerium/pull/1399) (@github-actions[bot])
-- [Backport 0-10-0] proxy: remove impersonate headers for kubernetes [#1396](https://github.com/pomerium/pomerium/pull/1396) (@travisgroth)
-- [Backport 0-10-0] docs: update azure docs [#1385](https://github.com/pomerium/pomerium/pull/1385) (@github-actions[bot])
-- internal/directory/okta: remove rate limiter (#1370) [#1371](https://github.com/pomerium/pomerium/pull/1371) (@cuonglm)
-- [Backport 0-10-0] internal/directory/okta: acceept non-json service account [#1360](https://github.com/pomerium/pomerium/pull/1360) (@github-actions[bot])
-- [Backport 0-10-0] internal/controlplane: add telemetry http handler [#1355](https://github.com/pomerium/pomerium/pull/1355) (@github-actions[bot])
-- [Backport 0-10-0] docs: add nginx example [#1339](https://github.com/pomerium/pomerium/pull/1339) (@github-actions[bot])
-
-## [v0.10.2](https://github.com/pomerium/pomerium/tree/v0.10.2) (2020-08-26)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.1...v0.10.2)
-
-### Documentation
-
-- docs: update change log for 0.10.2 [#1330](https://github.com/pomerium/pomerium/pull/1330) (@travisgroth)
-
-### Changed
-
-- Backport go 1.15 changes for 0-10-0 [#1334](https://github.com/pomerium/pomerium/pull/1334) (@travisgroth)
-- [Backport 0-10-0] internal/directory/okta: improve API requests [#1332](https://github.com/pomerium/pomerium/pull/1332) (@travisgroth)
-- autocert: fix locking issue (#1310) [#1311](https://github.com/pomerium/pomerium/pull/1311) (@calebdoxsey)
-
-## [v0.10.1](https://github.com/pomerium/pomerium/tree/v0.10.1) (2020-08-20)
-
-[Full Changelog](https://github.com/pomerium/pomerium/compare/v0.10.0...v0.10.1)
-
-### Documentation
-
-- [Backport 0-10-0] Docs/enterprise button [#1246](https://github.com/pomerium/pomerium/pull/1246) (@github-actions[bot])
-- [Backport 0-10-0] docs: add / redirect [#1242](https://github.com/pomerium/pomerium/pull/1242) (@github-actions[bot])
-
-### Changed
-
-- docs: v0.10.1 changelog [#1308](https://github.com/pomerium/pomerium/pull/1308) (@travisgroth)
-- [Backport 0-10-0] pkg/storage/redis: update tests to use local certs + upstream image [#1307](https://github.com/pomerium/pomerium/pull/1307) (@github-actions[bot])
-- azure: support deriving credentials from client id, client secret and... [#1301](https://github.com/pomerium/pomerium/pull/1301) (@calebdoxsey)
-- [Backport 0-10-0] autocert: fix bootstrapped cache store path [#1291](https://github.com/pomerium/pomerium/pull/1291) (@github-actions[bot])
-- [Backport 0-10-0] docs: use .com sitemap hostname [#1275](https://github.com/pomerium/pomerium/pull/1275) (@github-actions[bot])
-- [Backport 0-10-0] docs: fix in-action video [#1269](https://github.com/pomerium/pomerium/pull/1269) (@github-actions[bot])
-- [Backport 0-10-0] docs: image, sitemap and redirect fixes [#1265](https://github.com/pomerium/pomerium/pull/1265) (@github-actions[bot])
-- [Backport 0-10-0] docs: prepare for enterprise / oss split [#1239](https://github.com/pomerium/pomerium/pull/1239) (@github-actions[bot])
-- [Backport 0-10-0] authorize: add databroker url check [#1231](https://github.com/pomerium/pomerium/pull/1231) (@github-actions[bot])
-- [Backport 0-10-0] config: omit empty subpolicies in yaml/json [#1230](https://github.com/pomerium/pomerium/pull/1230) (@github-actions[bot])
-
-## v0.10.0
-
-### Changes
-
-- Add storage backend interface @cuonglm GH-1072
-- all: update outdated comments about OptionsUpdater interface @cuonglm GH-1207
-- Allow specify go executable in Makefile @cuonglm GH-1008
-- audit: add protobuf definitions @calebdoxsey GH-1047
-- authenticate: hide impersonation form from non-admin users @cuonglm GH-979
-- authenticate: move impersonate from proxy to authenticate @calebdoxsey GH-965
-- authenticate: remove useless/duplicated code block @cuonglm GH-962
-- authenticate: revoke current session oauth token before sign out @cuonglm GH-964
-- authorize,proxy: allow traefik forward auth without uri query @cuonglm GH-1103
-- authorize: add evaluator store @calebdoxsey GH-1105
-- authorize: add test for denied response @cuonglm GH-1197
-- authorize: avoid serializing databroker data map to improve performance @calebdoxsey GH-995
-- authorize: clear session state if session was deleted in databroker @cuonglm GH-1053
-- authorize: derive check response message from reply message @cuonglm GH-1193
-- authorize: include "kid" in JWT header @cuonglm GH-1049
-- authorize: store policy evaluator on success only @cuonglm GH-1206
-- authorize/evaluator: add more test cases @cuonglm GH-1198
-- authorize/evaluator: fix wrong custom policies decision @cuonglm GH-1199
-- authorize/evaluator/opa: use route policy object instead of array index @cuonglm GH-1001
-- cache: add client telemetry @travisgroth GH-975
-- cache: add test for runMemberList @cuonglm GH-1007
-- cache: attempt to join memberlist cluster for sanity check @travisgroth GH-1004
-- cache: fix missing parameter @travisgroth GH-1005
-- cache: only run memberlist for in-memory databroker @travisgroth GH-1224
-- ci: Add cloudrun build @travisgroth GH-1097
-- ci: support rc releases @travisgroth GH-1011
-- cmd/pomerium-cli: do not require terminal with cached creds @travisgroth GH-1196
-- config: add check to assert service account is required for policies with allowed_groups @desimone GH-997
-- config: add support for policies stored in the databroker @calebdoxsey GH-1099
-- config: additional kubernetes token source support @travisgroth GH-1200
-- config: allow setting directory sync interval and timeout @cuonglm GH-1098
-- config: default to google idp credentials for serverless @travisgroth GH-1170
-- config: fix loading storage client cert from wrong location @travisgroth GH-1212
-- config: Set loopback address by ipv4 IP @travisgroth GH-1116
-- cryptutil: move to pkg dir, add token generator @calebdoxsey GH-1029
-- deployment: fix brew creation for pomerium-cli @travisgroth GH-1192
-- directory.Group entry for groups @calebdoxsey GH-1118
-- docs/docs: update upgrading to mention redis storage backend @cuonglm GH-1172
-- envoy: disable idle timeouts to controlplane @travisgroth GH-1000
-- grpc: rename internal/grpc to pkg/grpc @calebdoxsey GH-1010
-- grpc: use relative paths in codegen @desimone GH-1106
-- grpcutil: add functions for JWTs in gRPC metadata @calebdoxsey GH-1165
-- Increasing authorize coverage @cuonglm GH-1221
-- integration: add dummy value for idp_service_account @cuonglm GH-1009
-- internal/controlplane: set envoy prefix rewrite if present @cuonglm GH-1034
-- internal/controlplane: using envoy strip host port matching @cuonglm GH-1126
-- internal/databroker: handle new db error @cuonglm GH-1129
-- internal/databroker: store server version @cuonglm GH-1121
-- internal/directory: improve google user groups list @cuonglm GH-1092
-- internal/directory: use both id and name for group @cuonglm GH-1086
-- internal/directory/google: return both group e-mail and id @travisgroth GH-1083
-- internal/frontend/assets/html: make timestamp human readable @cuonglm GH-1107
-- internal/sessions: handle claims "ver" field generally @cuonglm GH-990
-- internal/urlutil: add tests for GetDomainsForURL @cuonglm GH-1183
-- memberlist: use bufio reader instead of scanner @calebdoxsey GH-1002
-- config: options refactor @calebdoxsey GH-1088
-- pkg: add grpcutil package @calebdoxsey GH-1032
-- pkg/storage: add package docs @cuonglm GH-1078
-- pkg/storage: change backend interface to return error @cuonglm GH-1131
-- pkg/storage: introduce storage.Backend Watch method @cuonglm GH-1135
-- pkg/storage: make Watch returns receive only channel @cuonglm GH-1211
-- pkg/storage/redis: do not use timeout to signal redis conn to stop @cuonglm GH-1155
-- pkg/storage/redis: fix multiple data race @cuonglm GH-1210
-- pkg/storage/redis: metrics updates @travisgroth GH-1195
-- pkg/storage/redis: move last version to redis @cuonglm GH-1134
-- proxy: add support for spdy upgrades @travisgroth GH-1203
-- proxy: avoid second policy validation @travisgroth GH-1204
-- proxy: refactor handler setup code @travisgroth GH-1205
-- set session state expiry @calebdoxsey GH-1215
-- Sleep longer before running integration tests @cuonglm GH-968
-- telemetry: add tracing spans to cache and databroker @travisgroth GH-987
-
-### New
-
-- authenticate: allow hot reloaded admin users config @cuonglm [GH-984]
-- authenticate: support hot reloaded config @cuonglm GH-984
-- authorize: custom rego policies @calebdoxsey GH-1123
-- authorize: include "kid" in JWT headers @cuonglm [GH-1046]
-- azure: use OID for user id in session @calebdoxsey GH-985
-- config: add pass_identity_headers @cuonglm [GH-903]
-- config: add remove_request_headers @cuonglm [GH-822]
-- config: both base64 and file reference can be used for "certificates" @dmitrif [GH-1055]
-- config: change config key parsing to attempt Base64 decoding first. @dmitrif GH-1055
-- config: change default log level to INFO @cuonglm [GH-902]
-- custom rego in databroker @calebdoxsey GH-1124
-- databroker server backend config @cuonglm GH-1127
-- databroker: add encryption for records @calebdoxsey GH-1168
-- deploy: Add homebrew tap publishing @travisgroth GH-1179
-- deployment: cut separate archive for cli @desimone GH-1177
-- directory: add service account struct and parsing method @calebdoxsey GH-971
-- envoy: enable strip host port matching @cuonglm [GH-1126]
-- github: implement github directory provider @calebdoxsey GH-963
-- google: store directory information by user id @calebdoxsey GH-988
-- identity: support custom code flow request params @desimone GH-998
-- implement google cloud serverless authentication @calebdoxsey GH-1080
-- internal/directory/okta: store directory information by user id @cuonglm GH-991
-- internal/directory/onelogin: store directory information by user id @cuonglm GH-992
-- kubernetes apiserver integration @calebdoxsey GH-1063
-- pkg/storage/redis: add authentication support @cuonglm GH-1159
-- pkg/storage/redis: add redis TLS support @cuonglm GH-1163
-- pomerium-cli k8s exec-credential @calebdoxsey GH-1073
-- redis storage backend @cuonglm GH-1082
-- telmetry: add databroker storage metrics and tracing @travisgroth GH-1161
-- use custom binary for arm64 linux release @calebdoxsey GH-1065
-
-### Fixed
-
-- authenticate: fix wrong condition checking in VerifySession @cuonglm GH-1146
-- authenticate: fix wrong SignIn telemetry name @cuonglm GH-1038
-- authorize: Force redirect scheme to https @travisgroth GH-1075
-- authorize: strip port from host header if necessary @cuonglm GH-1175
-- authorize/evaluator/opa: set client tls cert usage explicitly @travisgroth GH-1026
-- authorize/evaluator/opa/policy: fix allow rules with impersonate @cuonglm GH-1094
-- cache: fix data race in NotifyJoin @cuonglm GH-1028
-- ci: fix arm docker image releases @travisgroth GH-1178
-- ci: Prevent dirty git state @travisgroth GH-1117
-- ci: release fixes @travisgroth GH-1181
-- config: fix deep copy of config @calebdoxsey GH-1089
-- controlplane: add robots route @desimone GH-966
-- deploy: ensure pomerium-cli is built correctly @travisgroth GH-1180
-- deployment: fix pomerium-cli release @desimone GH-1104
-- envoy: Set ExtAuthz Cluster name to URL Host @travisgroth GH-1132
-- fix databroker restart versioning, handle missing sessions @calebdoxsey GH-1145
-- fix lint errors @travisgroth GH-1171
-- fix redirect loop, remove user/session services, remove duplicate deleted_at fields @calebdoxsey GH-1162
-- handle example.com and example.com:443 @calebdoxsey GH-1153
-- internal/controlplane: enable envoy use remote address @cuonglm GH-1023
-- internal/databroker: fix wrong server version init @cuonglm GH-1125
-- pkg/grpc: fix wrong audit protoc gen file @cuonglm GH-1048
-- pkg/storage/redis: handling connection to redis backend failure @cuonglm GH-1174
-- pomerium-cli: fix kubernetes token caching @calebdoxsey GH-1169
-- pomerium-cli: kubernetes fixes @calebdoxsey GH-1176
-- proxy: do not set X-Pomerium-Jwt-Assertion/X-Pomerium-Claim-\* headers by default @cuonglm [GH-903]
-- proxy: fix invalid session after logout in forward auth mode @cuonglm GH-1062
-- proxy: fix redirect url with traefik forward auth @cuonglm GH-1037
-- proxy: fix wrong forward auth request @cuonglm GH-1030
-
-### Documentation
-
-- docs: Update synology.md @roulesse GH-1219
-- docs: add installation section @travisgroth GH-1223
-- docs: add kubectl config commands @travisgroth GH-1152
-- docs: add kubernetes docs @calebdoxsey GH-1087
-- docs: add recipe for TiddlyWiki on Node.js @favadi GH-1143
-- docs: add required in cookie_secret @mig4ng GH-1142
-- docs: add warnings cones around requiring IdP Service Accounts @travisgroth GH-999
-- docs: cloud Run / GCP Serverless @travisgroth GH-1101
-- docs: document preserve_host_header with policy routes to static ip @cuonglm GH-1024
-- docs: fix incorrect example middleware @travisgroth GH-1128
-- docs: fix links, clarify upgrade guide for v0.10 @desimone GH-1220
-- docs: fix minor errors @travisgroth GH-1214
-- docs: Kubernetes topic @travisgroth GH-1222
-- docs: Move examples repo into main repo @travisgroth GH-1102
-- docs: Redis and stateful storage docs @travisgroth GH-1173
-- docs: refactor sections, consolidate examples @desimone GH-1164
-- docs: rename docs/reference to docs/conceptststststststststs @desimone GH-1182
-- docs: service account instructions for azure @calebdoxsey GH-969
-- docs: service account instructions for gitlab @calebdoxsey GH-970
-- docs: update architecture diagrams + descriptions @travisgroth GH-1218
-- docs: update GitHub documentation for service account @calebdoxsey GH-967
-- docs: Update Istio VirtualService example @jeffhubLR GH-1006
-- docs: update okta service account docs to match new format @calebdoxsey GH-972
-- Docs: Update README stating specific requirements for SIGNING_KEY @bradjones1 GH-1217
-- docs: update reference docs @desimone GH-1208
-- docs: update service account instructions for OneLogin @calebdoxsey GH-973
-- docs: update upgrading document for breaking changes @calebdoxsey GH-974
-- docs/.vuepress: fix missing local-oidc recipes section @cuonglm GH-1147
-- docs/configuration: add doc for trailing slash limitation in "To" field @cuonglm GH-1040
-- docs/docs: add changelog for #1055 @cuonglm GH-1084
-- docs/identity-providers: document gitlab default scopes changed @cuonglm GH-980
-- docs/recipes: add local oidc example @cuonglm GH-1045
-
-### Dependency
-
-- chore(deps): bump envoy to 1.15.0 @desimone GH-1119
-- chore(deps): google.golang.org/genproto commit hash to da3ae01 @renovate GH-1138
-- chore(deps): module google/go-cmp to v0.5.1 @renovate GH-1139
-- chore(deps): update envoy to 1.14.4 @desimone GH-1076
-- chore(deps): update github.com/skratchdot/open-golang commit hash to eef8423 @renovate GH-1108
-- chore(deps): update golang.org/x/crypto commit hash to 123391f @renovate GH-1184
-- chore(deps): update golang.org/x/crypto commit hash to 948cd5f @renovate GH-1056
-- chore(deps): update golang.org/x/net commit hash to 4c52546 @renovate GH-1017
-- chore(deps): update golang.org/x/net commit hash to ab34263 @renovate GH-1057
-- chore(deps): update golang.org/x/sync commit hash to 6e8e738 @renovate GH-1018
-- chore(deps): update google.golang.org/genproto commit hash to 11fb19a @renovate GH-1109
-- chore(deps): update google.golang.org/genproto commit hash to 8145dea @renovate GH-1185
-- chore(deps): update google.golang.org/genproto commit hash to 8698661 @renovate GH-1058
-- chore(deps): update google.golang.org/genproto commit hash to 8e8330b @renovate GH-1039
-- chore(deps): update google.golang.org/genproto commit hash to ee7919e @renovate GH-1019
-- chore(deps): update google.golang.org/genproto commit hash to fbb79ea @renovate GH-945
-- chore(deps): update module cenkalti/backoff/v4 to v4.0.2 @renovate GH-946
-- chore(deps): update module contrib.go.opencensus.io/exporter/jaeger to v0.2.1 @renovate GH-1186
-- chore(deps): update module contrib.go.opencensus.io/exporter/zipkin to v0.1.2 @renovate GH-1187
-- chore(deps): update module envoyproxy/go-control-plane to v0.9.6 @renovate GH-1059
-- chore(deps): update module go.opencensus.io to v0.22.4 @renovate GH-948
-- chore(deps): update module golang/mock to v1.4.4 @renovate GH-1188
-- chore(deps): update module google.golang.org/api to v0.28.0 @renovate GH-949
-- chore(deps): update module google.golang.org/api to v0.29.0 @renovate GH-1060
-- chore(deps): update module google.golang.org/grpc to v1.30.0 @renovate GH-1020
-- chore(deps): update module google.golang.org/grpc to v1.31.0 @renovate GH-1189
-- chore(deps): update module google.golang.org/protobuf to v1.25.0 @renovate GH-1021
-- chore(deps): update module google/go-cmp to v0.5.0 @renovate GH-950
-- chore(deps): update module hashicorp/memberlist to v0.2.2 @renovate GH-951
-- chore(deps): update module open-policy-agent/opa to v0.21.0 @renovate GH-952
-- chore(deps): update module open-policy-agent/opa to v0.21.1 @renovate GH-1061
-- chore(deps): update module open-policy-agent/opa to v0.22.0 @renovate GH-1110
-- chore(deps): update module prometheus/client_golang to v1.7.0 @renovate GH-953
-- chore(deps): update module prometheus/client_golang to v1.7.1 @renovate GH-1022
-- chore(deps): update module spf13/cobra to v1 @renovate GH-1111
-- chore(deps): update module spf13/viper to v1.7.1 @renovate GH-1190
-- chore(deps):s bump opa v0.21.0 @desimone GH-993
-
-## v0.9.1
-
-### Security
-
-- envoy: fixes CVE-2020-11080 by rejecting HTTP/2 SETTINGS frames with too many parameters
-
-## v0.9.0
-
-### New
-
-- proxy: envoy is now used to handle proxying
-- authenticate: add jwks and .well-known endpoint @desimone [GH-745]
-- authorize: add client mTLS support @calebdoxsey [GH-751]
-
-### Fixed
-
-- cache: fix closing too early @calebdoxsey [GH-791]
-- authenticate: fix insecure gRPC connection string default port @calebdoxsey [GH-795]
-- authenticate: fix user-info call for AWS cognito @calebdoxsey [GH-792]
-- authenticate: clear session if ctx fails @desimone [GH-806]
-- telemetry: fix autocache labels @travisgroth [GH-805]
-- telemetry: fix missing/incorrect grpc labels @travisgroth [GH-804]
-- authorize: fix authorization panic caused by logging a nil reference @desimone [GH-704]
-
-### Changes
-
-- authenticate: remove authorize url validate check @calebdoxsey [GH-790]
-- authorize: reduce log noise for empty jwt @calebdoxsey [GH-793]
-- authorize: refactor and add additional unit tests @calebdoxsey [GH-757]
-- envoy: add GRPC stats handler to control plane service @travisgroth [GH-744]
-- envoy: enable zipkin tracing @travisgroth [GH-737]
-- envoy: improvements to logging @calebdoxsey [GH-742]
-- envoy: remove 'accept-encoding' header from proxied metric requests @travisgroth [GH-750]
-- envoy: support ports in hosts for routing @calebdoxsey [GH-748]
-- forward-auth: support x-forwarded-uri @calebdoxsey [GH-780]
-- proxy/forward-auth: block expired request prior to 302 @desimone [GH-773]
-- sessions/state: add nickname claim @BenoitKnecht [GH-755]
-- state: infer user (`user`) from subject (`sub`) @desimone [GH-772]
-- telemetry: refactor GRPC Server Handler @travisgroth [GH-756]
-- telemetry: service label updates @travisgroth [GH-802]
-- xds: add catch-all for pomerium routes @calebdoxsey [GH-789]
-- xds: disable cluster validation to handle out-of-order updates @calebdoxsey [GH-783]
-
-### Documentation
-
-- docs: add mTLS recipe @calebdoxsey [GH-807]
-- docs: add argo recipe @calebdoxsey [GH-803]
-- docs: update dockerfiles for v0.9.0 @calebdoxsey [GH-801]
-- docs: typo on configuration doc @kintoandar [GH-800]
-- docs: docs regarding claim headers @strideynet [GH-782]
-- docs: update traefik example and add note about forwarded headers @calebdoxsey [GH-784]
-- docs: add note about unsupported platforms @calebdoxsey [GH-799]
-- docs: expose config parameters in sidebar @travisgroth [GH-797]
-- docs: update examples @travisgroth [GH-796]
-
-## v0.8.3
-
-### Changes
-
-- state: infer user (`user`) from subject (`sub`) @desimone GH-772
-- proxy/forward-auth: block expired request prior to 302 @desimone GH-773
-
-## v0.8.2
-
-### Security
-
-This release includes a fix for a bug that, under certain circumstances, could allow a user with a valid but expired session to resend a request to an upstream application. The repeated request would not return a response, but could reach the upstream application. Thank you to @selaux for reporting this issue! [GH-762]
-
-## v0.8.1
-
-### Fixed
-
-- authorize: fix authorization panic caused by logging a nil reference @desimone [GH-704]
-
-## v0.8.0
-
-To see a complete list of changes [see the diff](https://github.com/pomerium/pomerium/compare/v0.7.0...v0.8.0).
-
-### New
-
-- cryptutil: add automatic certificate management @desimone [GH-644]
-- implement path-based route matching @calebdoxsey [GH-615]
-- internal/identity: implement github provider support @Lumexralph [GH-582]
-- proxy: add configurable JWT claim headers @travisgroth (#596)
-- proxy: remove extra session unmarshalling @desimone (#592)
-
-### Changes
-
-- ci: Switch integration tests from minikube to kind @travisgroth [GH-656]
-- integration-tests: add CORS test @calebdoxsey [GH-662]
-- integration-tests: add websocket enabled/disabled test @calebdoxsey [GH-661]
-- integration-tests: set_request_headers and preserve_host_header options @calebdoxsey [GH-668]
-- pre-commit: add pre-commit configuration @calebdoxsey [GH-666]
-- proxy: improve JWT header behavior @travisgroth [GH-642]
-
-### Fixed
-
-- authorize: fix authorization check for allowed_domains to only match current route @calebdoxsey [GH-624]
-- authorize: fix unexpected panic on reload @travisgroth [GH-652]
-- site: fix site on mobile @desimone [GH-597]
-
-### Documentation
-
-- deploy: autocert documentation and defaults @travisgroth [GH-658]
-
-## v0.7.5
-
-### Fixed
-
-- authorize: fix authorization check for allowed_domains to only match current route @calebdoxsey [GH-624]
-
-## v0.7.4
-
-### Fixed
-
-- pomerium-cli: fix service account cli @desimone [GH-613]
-
-## v0.7.3
-
-### Fixed
-
-- Upgrade gRPC to 1.27.1 @travisgroth [GH-609]
-
-## v0.7.2
-
-### Changes
-
-- proxy: remove extra session unmarshalling @desimone [GH-592]
-- proxy: add configurable JWT claim headers @travisgroth [GH-596]
-- grpcutil: remove unused pkg @desimone [GH-593]
-
-### Fixed
-
-- site: fix site on mobile @desimone [GH-597]
-
-### Documentation
-
-- site: fix site on mobile @desimone [GH-597]
-
-### Dependency
-
-- chore(deps): update vuepress monorepo to v1.4.0 @renovate [GH-559]
-
-## v0.7.1
-
-There were no changes in the v0.7.1 release, but we updated the build process slightly.
-
-## v0.7.0
-
-### New
-
-- \*: remove import path comments @desimone [GH-545]
-- authenticate: make callback path configurable @desimone [GH-493]
-- authenticate: return 401 for some specific error codes @cuonglm [GH-561]
-- authorization: log audience claim failure @desimone [GH-553]
-- authorize: use jwt instead of state struct @desimone [GH-514]
-- authorize: use opa for policy engine @desimone [GH-474]
-- cmd: add cli to generate service accounts @desimone [GH-552]
-- config: Expose and set default GRPC Server Keepalive Parameters @travisgroth [GH-509]
-- config: Make IDP_PROVIDER env var mandatory @mihaitodor [GH-536]
-- config: Remove superfluous Options.Checksum type conversions @travisgroth [GH-522]
-- gitlab/identity: change group unique identifier to ID @Lumexralph [GH-571]
-- identity: support oidc UserInfo Response @desimone [GH-529]
-- internal/cryptutil: standardize leeway to 5 mins @desimone [GH-476]
-- metrics: Add storage metrics @travisgroth [GH-554]
-
-### Fixed
-
-- cache: add option validations @desimone [GH-468]
-- config: Add proper yaml tag to Options.Policies @travisgroth [GH-475]
-- ensure correct service name on GRPC related metrics @travisgroth [GH-510]
-- fix group impersonation @desimone [GH-569]
-- fix sign-out bug , fixes #530 @desimone [GH-544]
-- proxy: move set request headers before handle allow public access @ohdarling [GH-479]
-- use service port for session audiences @travisgroth [GH-562]
-
-### Documentation
-
-- fix `the` typo @ilgooz [GH-566]
-- fix kubernetes dashboard recipe docs @desimone [GH-504]
-- make from source quickstart @desimone [GH-519]
-- update background @desimone [GH-505]
-- update helm for v3 @desimone [GH-469]
-- various fixes @desimone [GH-478]
-- fix cookie_domain @nitper [GH-472]
-
-### Dependency
-
-- chore(deps): update github.com/pomerium/autocache commit hash to 6c66ed5 @renovate [GH-480]
-- chore(deps): update github.com/pomerium/autocache commit hash to 227c993 @renovate [GH-537]
-- chore(deps): update golang.org/x/crypto commit hash to 0ec3e99 @renovate [GH-574]
-- chore(deps): update golang.org/x/crypto commit hash to 1b76d66 @renovate [GH-538]
-- chore(deps): update golang.org/x/crypto commit hash to 78000ba @renovate [GH-481]
-- chore(deps): update golang.org/x/crypto commit hash to 891825f @renovate [GH-556]
-- chore(deps): update module fatih/color to v1.9.0 @renovate [GH-575]
-- chore(deps): update module fsnotify/fsnotify to v1.4.9 @renovate [GH-539]
-- chore(deps): update module go.etcd.io/bbolt to v1.3.4 @renovate [GH-557]
-- chore(deps): update module go.opencensus.io to v0.22.3 @renovate [GH-483]
-- chore(deps): update module golang/mock to v1.4.0 @renovate [GH-470]
-- chore(deps): update module golang/mock to v1.4.3 @renovate [GH-540]
-- chore(deps): update module golang/protobuf to v1.3.4 @renovate [GH-485]
-- chore(deps): update module golang/protobuf to v1.3.5 @renovate [GH-541]
-- chore(deps): update module google.golang.org/api to v0.20.0 @renovate [GH-495]
-- chore(deps): update module google.golang.org/grpc to v1.27.1 @renovate [GH-496]
-- chore(deps): update module gorilla/mux to v1.7.4 @renovate [GH-506]
-- chore(deps): update module open-policy-agent/opa to v0.17.1 @renovate [GH-497]
-- chore(deps): update module open-policy-agent/opa to v0.17.3 @renovate [GH-513]
-- chore(deps): update module open-policy-agent/opa to v0.18.0 @renovate [GH-558]
-- chore(deps): update module prometheus/client_golang to v1.4.1 @renovate [GH-498]
-- chore(deps): update module prometheus/client_golang to v1.5.0 @renovate [GH-531]
-- chore(deps): update module prometheus/client_golang to v1.5.1 @renovate [GH-543]
-- chore(deps): update module rakyll/statik to v0.1.7 @renovate [GH-517]
-- chore(deps): update module rs/zerolog to v1.18.0 @renovate [GH-507]
-- chore(deps): update module yaml to v2.2.8 @renovate [GH-471]
-- ci: Consolidate matrix build parameters @travisgroth [GH-521]
-- dependency: use go mod redis @desimone [GH-528]
-- deployment: throw away golanglint-ci defaults @desimone [GH-439]
-- deployment: throw away golanglint-ci defaults @desimone [GH-439]
-- deps: enable automerge and set labels on renovate PRs @travisgroth [GH-527]
-- Roll back grpc to v1.25.1 @travisgroth [GH-484]
-
-## v0.6.0
-
-### New
-
-- authenticate: support backend refresh @desimone [GH-438]
-- cache: add cache service @desimone [GH-457]
-
-### Changed
-
-- authorize: consolidate gRPC packages @desimone [GH-443]
-- config: added yaml tags to all options struct fields @travisgroth [GH-394],[gh-397]
-- config: improved config validation for `shared_secret` @travisgroth [GH-427]
-- config: Remove CookieRefresh [GH-428] @u5surf [GH-436]
-- config: validate that `shared_key` does not contain whitespace @travisgroth [GH-427]
-- httputil : wrap handlers for additional context @desimone [GH-413]
-- forward-auth: validate using forwarded uri header @branchmispredictor [GH-600]
-
-### Fixed
-
-- proxy: fix unauthorized redirect loop for forward auth @desimone [GH-448]
-- proxy: fixed regression preventing policy reload [GH-396](https://github.com/pomerium/pomerium/pull/396)
-
-### Documentation
-
-- add cookie settings @danderson [GH-429]
-- fix typo in forward auth nginx example @travisgroth [GH-445]
-- improved sentence flow and other stuff @Rio [GH-422]
-- rename fwdauth to be forwardauth @desimone [GH-447]
-
-### Dependency
-
-- chore(deps): update golang.org/x/crypto commit hash to 61a8779 @renovate [GH-452]
-- chore(deps): update golang.org/x/crypto commit hash to 530e935 @renovate [GH-458]
-- chore(deps): update golang.org/x/crypto commit hash to 53104e6 @renovate [GH-431]
-- chore(deps): update golang.org/x/crypto commit hash to e9b2fee @renovate [GH-414]
-- chore(deps): update golang.org/x/oauth2 commit hash to 858c2ad @renovate [GH-415]
-- chore(deps): update golang.org/x/oauth2 commit hash to bf48bf1 @renovate [GH-453]
-- chore(deps): update module google.golang.org/grpc to v1.26.0 @renovate [GH-433]
-- chore(deps): update module google/go-cmp to v0.4.0 @renovate [GH-454]
-- chore(deps): update module spf13/viper to v1.6.1 @renovate [GH-423]
-- chore(deps): update module spf13/viper to v1.6.2 @renovate [GH-459]
-- chore(deps): update module square/go-jose to v2.4.1 @renovate [GH-435]
-
-## v0.5.0
-
-### New
-
-- Session state is now route-scoped. Each managed route uses a transparent, signed JSON Web Token (JWT) to assert identity.
-- Managed routes no longer need to be under the same subdomain! Access can be delegated to any route, on any domain.
-- Programmatic access now also uses JWT tokens. Access tokens are now generated via a standard oauth2 token flow, and credentials can be refreshed for as long as is permitted by the underlying identity provider.
-- User dashboard now pulls in additional user context fields (where supported) like the profile picture, first and last name, and so on.
-
-### Security
-
-- Some identity providers (Okta, Onelogin, and Azure) previously used mutable signifiers to set and assert group membership. Group membership for all providers now use globally unique and immutable identifiers when available.
-
-### Changed
-
-- Azure AD identity provider now uses globally unique and immutable `ID` for [group membership](https://docs.microsoft.com/en-us/graph/api/group-get?view=graph-rest-1.0&tabs=http).
-- Okta no longer uses tokens to retrieve group membership. Group membership is now fetched using Okta's HTTP API. [Group membership](https://developer.okta.com/docs/reference/api/groups/) is now determined by the globally unique and immutable `ID` field.
-- Okta now requires an additional set of credentials to be used to query for group membership set as a service account.
-- URLs are no longer validated to be on the same domain-tree as the authenticate service. Managed routes can live on any domain.
-- OneLogin no longer uses tokens to retrieve group membership. Group membership is now fetched using OneLogin's HTTP API. [Group membership](https://developers.onelogin.com/openid-connect/api/user-info/) is now determined by the globally unique and immutable `ID` field.
-
-### Removed
-
-- Force refresh has been removed from the dashboard.
-- Previous programmatic authentication endpoints (`/api/v1/token`) has been removed and is no longer supported.
-
-### Fixed
-
-- Fixed an issue where cookie sessions would not clear on error.[GH-376]
-
-## v0.4.2
-
-### Security
-
-- Fixes vulnerabilities fixed in [1.13.2](https://groups.google.com/forum/#!topic/golang-announce/lVEm7llp0w0) including CVE-2019-17596.
-
-## v0.4.1
-
-### Fixed
-
-- Fixed an issue where requests handled by forward-auth would not be redirected back to the underlying route after successful authentication and authorization. [GH-363]
-- Fixed an issue where requests handled by forward-auth would add an extraneous query-param following sign-in causing issues in some configurations. [GH-366]
-
-## v0.4.0
-
-### New
-
-- Allow setting request headers on a per route basis in policy. [GH-308]
-- Support "forward-auth" integration with third-party ingresses and proxies. [nginx](https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-subrequest-authentication/), [nginx-ingress](https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/), and [Traefik](https://docs.traefik.io/middlewares/forwardauth/) are currently supported. [GH-324]
-- Add insecure transport / TLS termination support. [GH-328]
-- Add setting to override a route's TLS Server Name. [GH-297]
-- Pomerium's session can now be passed as a [bearer-auth header](https://tools.ietf.org/html/rfc6750) or [query string](https://en.wikipedia.org/wiki/Query_string) in addition to as a session cookie.
-- Add host to the main request logger middleware. [GH-308]
-- Add AWS cognito identity provider settings. [GH-314]
-
-### Security
-
-- The user's original intended location before completing the authentication process is now encrypted and kept confidential from the identity provider. [GH-316]
-- Under certain circumstances, where debug logging was enabled, pomerium's shared secret could be leaked to http access logs as a query param. [GH-338]
-
-### Fixed
-
-- Fixed an issue where CSRF would fail if multiple tabs were open. [GH-306]
-- Fixed an issue where pomerium would clean double slashes from paths. [GH-262]
-- Fixed a bug where the impersonate form would persist an empty string for groups value if none set. [GH-303]
-- Fixed HTTP redirect server which was not redirecting the correct hostname.
-
-### Changed
-
-- The healthcheck endpoints (`/ping`) now returns the http status `405` StatusMethodNotAllowed for non-`GET` requests.
-- Authenticate service no longer uses gRPC.
-- The global request logger now captures the full array of proxies from `X-Forwarded-For`, in addition to just the client IP.
-- Options code refactored to eliminate global Viper state. [GH-332]
-- Pomerium will no longer default to looking for certificates in the root directory. [GH-328]
-- Pomerium will validate that either `insecure_server`, or a valid certificate bundle is set. [GH-328]
-
-### Removed
-
-- Removed `AUTHENTICATE_INTERNAL_URL`/`authenticate_internal_url` which is no longer used.
-
-## v0.3.1
-
-### Security
-
-- Fixes vulnerabilities fixed in [Go 1.13.1](https://groups.google.com/forum/m/#!msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJ) including CVE-2019-16276.
-
-## v0.3.0
-
-### New
-
-- GRPC Improvements. [GH-261] / [GH-69]
-
- - Enable WaitForReady to allow background retries through transient failures
- - Expose a configurable timeout for backend requests to Authorize and Authenticate
- - Enable DNS round_robin load balancing to Authorize and Authenticate services by default
-
-- Add ability to set client certificates for downstream connections. [GH-259]
-
-### Fixed
-
-- Fixed non-`amd64` based docker images.[GH-284]
-- Fixed an issue where stripped cookie headers would result in a cookie full of semi-colons (`Cookie: ;;;`). [GH-285]
-- HTTP status codes now better adhere to [RFC7235](https://tools.ietf.org/html/rfc7235). In particular, authentication failures reply with [401 Unauthorized](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401) while authorization failures reply with [403 Forbidden](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403). [GH-272]
-
-### Changed
-
-- Pomerium will now strip `_csrf` cookies in addition to session cookies. [GH-285]
-- Disabled gRPC service config. [GH-280]
-- A policy's custom certificate authority can set as a file or a base64 encoded blob(`tls_custom_ca`/`tls_custom_ca_file`). [GH-259]
-
-- Remove references to [service named ports](https://golang.org/src/net/lookup.go) and instead use their numeric equivalent. [GH-266]
-
-## v0.2.1
-
-### Security
-
-- Fixes vulnerabilities fixed in [Go 1.12.8](https://groups.google.com/forum/#!topic/golang-nuts/fCQWxqxP8aA) including CVE-2019-9512, CVE-2019-9514 and CVE-2019-14809.
-
-## v0.2.0
-
-### New
-
-### Telemetry [GH-35]
-
-- **Tracing** [GH-230] aka distributed tracing, provides insight into the full lifecycles, aka traces, of requests to the system, allowing you to pinpoint failures and performance issues.
-
- - Add [Jaeger](https://opencensus.io/exporters/supported-exporters/go/jaeger/) support. [GH-230]
-
-- **Metrics** provide quantitative information about processes running inside the system, including counters, gauges, and histograms.
-
- - Add informational metrics. [GH-227]
- - GRPC Metrics Implementation. [GH-218]
-
- - Additional GRPC server metrics and request sizes
- - Improved GRPC metrics implementation internals
- - The GRPC method label is now 'grpc_method' and GRPC status is now `grpc_client_status` and `grpc_server_status`
-
- - HTTP Metrics Implementation. [GH-220]
-
- - Support HTTP request sizes on client and server side of proxy
- - Improved HTTP metrics implementation internals
- - The HTTP method label is now `http_method`, and HTTP status label is now `http_status`
-
-### Changed
-
-- GRPC version upgraded to v1.22 [GH-219]
-- Add support for large cookie sessions by chunking. [GH-211]
-- Prefer [curve](https://wiki.mozilla.org/Security/Server_Side_TLS) X25519 to P256 for TLS connections. [GH-233]
-- Pomerium and its services will gracefully shutdown on [interrupt signal](http://man7.org/linux/man-pages/man7/signal.7.html). [GH-230]
-- [Google](https://developers.google.com/identity/protocols/OpenIDConnect) now prompts the user to select a user account (by adding `select_account` to the sign in url). This allows a user who has multiple accounts at the authorization server to select amongst the multiple accounts that they may have current sessions for.
-
-### Fixed
-
-- Fixed potential race condition when signing requests. [GH-240]
-- Fixed panic when reloading configuration in single service mode [GH-247]
-
-## v0.1.0
-
-### New
-
-- Add programmatic authentication support. [GH-177]
-- Add Prometheus format metrics endpoint. [GH-35]
-- Add policy setting to enable self-signed certificate support. [GH-179]
-- Add policy setting to skip tls certificate verification. [GH-179]
-
-### CHANGED
-
-- Policy `to` and `from` settings must be set to valid HTTP URLs including [schemes](https://en.wikipedia.org/wiki/Uniform_Resource_Identifier) and hostnames (e.g. `http.corp.domain.example` should now be `https://http.corp.domain.example`).
-- Proxy's sign out handler `{}/.pomerium/sign_out` now accepts an optional `redirect_uri` parameter which can be used to specify a custom redirect page, so long as it is under the same top-level domain. [GH-183]
-- Policy configuration can now be empty at startup. [GH-190]
-- Websocket support is now set per-route instead of globally. [GH-204]
-- Golint removed from amd64 container. [GH-215]
-- Pomerium will error if a session cookie is over 4096 bytes, instead of failing silently. [GH-212]
-
-### Fixed
-
-- Fixed HEADERS environment variable parsing. [GH-188]
-- Fixed Azure group lookups. [GH-190]
-- If a session is too large (over 4096 bytes) Pomerium will no longer fail silently. [GH-211]
-- Internal URLs like dashboard now start auth process to login a user if no session is found. [GH-205].
-- When set,`CookieDomain` lets a user set the scope of the user session. CSRF cookies will still always be scoped at the individual route level. [GH-181]
-
-## v0.0.5
-
-### New
-
-- Add ability to detect changes and reload policy configuration files. [GH-150]
-- Add user dashboard containing information about the current user's session. [GH-123]
-- Add functionality allowing users to initiate manual refresh of their session. This is helpful when a user's access control details are updated but their session hasn't updated yet. To prevent abuse, manual refresh is gated by a cooldown (`REFRESH_COOLDOWN`) which defaults to five minutes. [GH-73]
-- Add Administrator (super user) account support (`ADMINISTRATORS`). [GH-110]
-- Add feature that allows Administrators to impersonate / sign-in as another user from the user dashboard. [GH-110]
-- Add docker images and builds for ARM. [GH-95]
-- Add support for public, unauthenticated routes. [GH-129]
-
-### CHANGED
-
-- Add Request ID to error pages. [GH-144]
-- Refactor configuration handling to use spf13/viper bringing a variety of additional supported storage formats.[GH-115]
-- Changed config `AUTHENTICATE_INTERNAL_URL` to be a URL containing both a valid hostname and schema. [GH-153]
-- User state is now maintained and scoped at the domain level vs at the route level. [GH-128]
-- Error pages contain a link to sign out from the current user session. [GH-100]
-- Removed `LifetimeDeadline` from `sessions.SessionState`.
-- Removed favicon specific request handling. [GH-131]
-- Headers are now configurable via the `HEADERS` configuration variable. [GH-108]
-- Refactored proxy and authenticate services to share the same session state cookie. [GH-131]
-- Removed instances of extraneous session state saves. [GH-131]
-- Changed default behavior when no session is found. Users are now redirected to login instead of being shown an error page.[GH-131]
-- Updated routes such that all http handlers are now wrapped with a standard set of middleware. Headers, request id, loggers, and health checks middleware are now applied to all routes including 4xx and 5xx responses. [GH-116]
-- Changed docker images to be built from [distroless](https://github.com/GoogleContainerTools/distroless). This fixed an issue with `nsswitch` [GH-97], includes `ca-certificates` and limits the attack surface area of our images. [GH-101]
-- Changed HTTP to HTTPS redirect server to be user configurable via `HTTP_REDIRECT_ADDR`. [GH-103]
-- `Content-Security-Policy` hash updated to match new UI assets.
-
-### Fixed
-
-- Fixed websocket support. [GH-151]
-- Fixed an issue where policy and routes were being pre-processed incorrectly. [GH-132]
-- Fixed an issue where `golint` was not being found in our docker image. [GH-121]
-
-## v0.0.4
-
-### CHANGED
-
-- HTTP [Strict Transport Security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) is included by default and set to one year. [GH-92]
-- HTTP now redirects to HTTPS. [GH-92]
-- Removed extraneous `AUTHORIZE_INTERNAL_URL` config option since authorization has no public http handlers, only a gRPC service endpoint. [GH-93]
-- Removed `PROXY_ROOT_DOMAIN` config option which is now inferred from `AUTHENTICATE_SERVICE_URL`. Only callback requests originating from a URL on the same sub-domain are permitted. [GH-83]
-- Removed `REDIRECT_URL` config option which is now inferred from `AUTHENTICATE_SERVICE_URL` (e.g. `https://$AUTHENTICATE_SERVICE_URL/oauth2/callback`). [GH-83]
-
-### Fixed
-
-- Fixed a bug in the Google provider implementation where the `refresh_token`. Updated the google implementation to use the new `prompt=consent` oauth2 parameters. Reported and fixed by @chemhack [GH-81]
-
-### DOCUMENTATION
-
-- Added [synology tutorial]. [GH-96]
-- Added [certificates documentation]. [GH-79]
-
-## v0.0.3
-
-### FEATURES
-
-- **Authorization** : The authorization module adds support for per-route access policy. In this release we support the most common forms of identity based access policy: `allowed_users`, `allowed_groups`, and `allowed_domains`. In future versions, the authorization module will also support context and device based authorization policy and decisions. See website documentation for more details.
-- **Group Support** : The authenticate service now retrieves a user's group membership information during authentication and refresh. This change may require additional identity provider configuration; all of which are described in the [updated docs](https://www.pomerium.com/docs/identity-providers.html). A brief summary of the requirements for each IdP are as follows:
-
- - Google requires the [Admin SDK](https://developers.google.com/admin-sdk/directory/) to enabled, a service account with properly delegated access, and `IDP_SERVICE_ACCOUNT` to be set to the base64 encoded value of the service account's key file.
- - Okta requires a `groups` claim to be added to both the `id_token` and `access_token`. No additional API calls are made.
- - Microsoft Azure Active Directory requires the application be given an [additional API permission](https://docs.microsoft.com/en-us/graph/api/user-list-memberof?view=graph-rest-1.0), `Directory.Read.All`.
- - Onelogin requires the [groups](https://developers.onelogin.com/openid-connect/scopes) was supplied during authentication and that groups parameter has been mapped. Group membership is validated on refresh with the [user-info api endpoint](https://developers.onelogin.com/openid-connect/api/user-info).
-
-- **WebSocket Support** : With [Go 1.12](https://golang.org/doc/go1.12#net/http/httputil) pomerium automatically proxies WebSocket requests.
-
-### CHANGED
-
-- Added `LOG_LEVEL` config setting that allows for setting the desired minimum log level for an event to be logged. [GH-74]
-- Changed `POMERIUM_DEBUG` config setting to just do console-pretty printing. No longer sets log level. [GH-74]
-- Updated `generate_wildcard_cert.sh` to generate a elliptic curve 256 cert by default.
-- Updated `env.example` to include a `POLICY` setting example.
-- Added `IDP_SERVICE_ACCOUNT` to `env.example` .
-- Removed `ALLOWED_DOMAINS` settings which has been replaced by `POLICY`. Authorization is now handled by the authorization service and is defined in the policy configuration files.
-- Removed `ROUTES` settings which has been replaced by `POLICY`.
-- Add refresh endpoint `${url}/.pomerium/refresh` which forces a token refresh and responds with the json result.
-- Group membership added to proxy headers (`x-pomerium-authenticated-user-groups`) and (`x-pomerium-jwt-assertion`).
-- Default Cookie lifetime (`COOKIE_EXPIRE`) changed from 7 days to 14 hours ~ roughly one business day.
-- Moved identity (`authenticate/providers`) into its own internal identity package as third party identity providers are going to authorization details (group membership, user role, etc) in addition to just authentication attributes.
-- Removed circuit breaker package. Calls that were previously wrapped with a circuit breaker fall under gRPC timeouts; which are gated by relatively short timeouts.
-- Session expiration times are truncated at the second.
-- **Removed gitlab provider**. We can't support groups until [this gitlab bug](https://gitlab.com/gitlab-org/gitlab-ce/issues/44435#note_88150387) is fixed.
-- Request context is now maintained throughout request-flow via the [context package](https://golang.org/pkg/context/) enabling timeouts, request tracing, and cancellation.
-
-### Fixed
-
-- `http.Server` and `httputil.NewSingleHostReverseProxy` now uses pomerium's logging package instead of the standard library's built in one. [GH-58]
-
-[certificates documentation]: /docs/guides/certificates
-[gh-1]: https://github.com/pomerium/pomerium/issues/1
-[gh-10]: https://github.com/pomerium/pomerium/issues/10
-[gh-100]: https://github.com/pomerium/pomerium/issues/100
-[gh-101]: https://github.com/pomerium/pomerium/issues/101
-[gh-102]: https://github.com/pomerium/pomerium/issues/102
-[gh-103]: https://github.com/pomerium/pomerium/issues/103
-[gh-104]: https://github.com/pomerium/pomerium/issues/104
-[gh-105]: https://github.com/pomerium/pomerium/issues/105
-[gh-106]: https://github.com/pomerium/pomerium/issues/106
-[gh-107]: https://github.com/pomerium/pomerium/issues/107
-[gh-108]: https://github.com/pomerium/pomerium/issues/108
-[gh-109]: https://github.com/pomerium/pomerium/issues/109
-[gh-11]: https://github.com/pomerium/pomerium/issues/11
-[gh-110]: https://github.com/pomerium/pomerium/issues/110
-[gh-111]: https://github.com/pomerium/pomerium/issues/111
-[gh-112]: https://github.com/pomerium/pomerium/issues/112
-[gh-113]: https://github.com/pomerium/pomerium/issues/113
-[gh-114]: https://github.com/pomerium/pomerium/issues/114
-[gh-115]: https://github.com/pomerium/pomerium/issues/115
-[gh-116]: https://github.com/pomerium/pomerium/issues/116
-[gh-117]: https://github.com/pomerium/pomerium/issues/117
-[gh-118]: https://github.com/pomerium/pomerium/issues/118
-[gh-119]: https://github.com/pomerium/pomerium/issues/119
-[gh-12]: https://github.com/pomerium/pomerium/issues/12
-[gh-120]: https://github.com/pomerium/pomerium/issues/120
-[gh-121]: https://github.com/pomerium/pomerium/issues/121
-[gh-122]: https://github.com/pomerium/pomerium/issues/122
-[gh-123]: https://github.com/pomerium/pomerium/issues/123
-[gh-124]: https://github.com/pomerium/pomerium/issues/124
-[gh-125]: https://github.com/pomerium/pomerium/issues/125
-[gh-126]: https://github.com/pomerium/pomerium/issues/126
-[gh-127]: https://github.com/pomerium/pomerium/issues/127
-[gh-128]: https://github.com/pomerium/pomerium/issues/128
-[gh-129]: https://github.com/pomerium/pomerium/issues/129
-[gh-13]: https://github.com/pomerium/pomerium/issues/13
-[gh-130]: https://github.com/pomerium/pomerium/issues/130
-[gh-131]: https://github.com/pomerium/pomerium/issues/131
-[gh-132]: https://github.com/pomerium/pomerium/issues/132
-[gh-133]: https://github.com/pomerium/pomerium/issues/133
-[gh-134]: https://github.com/pomerium/pomerium/issues/134
-[gh-135]: https://github.com/pomerium/pomerium/issues/135
-[gh-136]: https://github.com/pomerium/pomerium/issues/136
-[gh-137]: https://github.com/pomerium/pomerium/issues/137
-[gh-138]: https://github.com/pomerium/pomerium/issues/138
-[gh-139]: https://github.com/pomerium/pomerium/issues/139
-[gh-14]: https://github.com/pomerium/pomerium/issues/14
-[gh-140]: https://github.com/pomerium/pomerium/issues/140
-[gh-141]: https://github.com/pomerium/pomerium/issues/141
-[gh-142]: https://github.com/pomerium/pomerium/issues/142
-[gh-143]: https://github.com/pomerium/pomerium/issues/143
-[gh-144]: https://github.com/pomerium/pomerium/issues/144
-[gh-145]: https://github.com/pomerium/pomerium/issues/145
-[gh-146]: https://github.com/pomerium/pomerium/issues/146
-[gh-147]: https://github.com/pomerium/pomerium/issues/147
-[gh-148]: https://github.com/pomerium/pomerium/issues/148
-[gh-149]: https://github.com/pomerium/pomerium/issues/149
-[gh-15]: https://github.com/pomerium/pomerium/issues/15
-[gh-150]: https://github.com/pomerium/pomerium/issues/150
-[gh-151]: https://github.com/pomerium/pomerium/issues/151
-[gh-152]: https://github.com/pomerium/pomerium/issues/152
-[gh-153]: https://github.com/pomerium/pomerium/issues/153
-[gh-154]: https://github.com/pomerium/pomerium/issues/154
-[gh-155]: https://github.com/pomerium/pomerium/issues/155
-[gh-156]: https://github.com/pomerium/pomerium/issues/156
-[gh-157]: https://github.com/pomerium/pomerium/issues/157
-[gh-158]: https://github.com/pomerium/pomerium/issues/158
-[gh-159]: https://github.com/pomerium/pomerium/issues/159
-[gh-16]: https://github.com/pomerium/pomerium/issues/16
-[gh-160]: https://github.com/pomerium/pomerium/issues/160
-[gh-161]: https://github.com/pomerium/pomerium/issues/161
-[gh-162]: https://github.com/pomerium/pomerium/issues/162
-[gh-163]: https://github.com/pomerium/pomerium/issues/163
-[gh-164]: https://github.com/pomerium/pomerium/issues/164
-[gh-165]: https://github.com/pomerium/pomerium/issues/165
-[gh-166]: https://github.com/pomerium/pomerium/issues/166
-[gh-167]: https://github.com/pomerium/pomerium/issues/167
-[gh-168]: https://github.com/pomerium/pomerium/issues/168
-[gh-169]: https://github.com/pomerium/pomerium/issues/169
-[gh-17]: https://github.com/pomerium/pomerium/issues/17
-[gh-170]: https://github.com/pomerium/pomerium/issues/170
-[gh-171]: https://github.com/pomerium/pomerium/issues/171
-[gh-172]: https://github.com/pomerium/pomerium/issues/172
-[gh-173]: https://github.com/pomerium/pomerium/issues/173
-[gh-174]: https://github.com/pomerium/pomerium/issues/174
-[gh-175]: https://github.com/pomerium/pomerium/issues/175
-[gh-176]: https://github.com/pomerium/pomerium/issues/176
-[gh-177]: https://github.com/pomerium/pomerium/issues/177
-[gh-178]: https://github.com/pomerium/pomerium/issues/178
-[gh-179]: https://github.com/pomerium/pomerium/issues/179
-[gh-18]: https://github.com/pomerium/pomerium/issues/18
-[gh-180]: https://github.com/pomerium/pomerium/issues/180
-[gh-181]: https://github.com/pomerium/pomerium/issues/181
-[gh-182]: https://github.com/pomerium/pomerium/issues/182
-[gh-183]: https://github.com/pomerium/pomerium/issues/183
-[gh-184]: https://github.com/pomerium/pomerium/issues/184
-[gh-185]: https://github.com/pomerium/pomerium/issues/185
-[gh-186]: https://github.com/pomerium/pomerium/issues/186
-[gh-187]: https://github.com/pomerium/pomerium/issues/187
-[gh-188]: https://github.com/pomerium/pomerium/issues/188
-[gh-189]: https://github.com/pomerium/pomerium/issues/189
-[gh-19]: https://github.com/pomerium/pomerium/issues/19
-[gh-190]: https://github.com/pomerium/pomerium/issues/190
-[gh-191]: https://github.com/pomerium/pomerium/issues/191
-[gh-192]: https://github.com/pomerium/pomerium/issues/192
-[gh-193]: https://github.com/pomerium/pomerium/issues/193
-[gh-194]: https://github.com/pomerium/pomerium/issues/194
-[gh-195]: https://github.com/pomerium/pomerium/issues/195
-[gh-196]: https://github.com/pomerium/pomerium/issues/196
-[gh-197]: https://github.com/pomerium/pomerium/issues/197
-[gh-198]: https://github.com/pomerium/pomerium/issues/198
-[gh-199]: https://github.com/pomerium/pomerium/issues/199
-[gh-2]: https://github.com/pomerium/pomerium/issues/2
-[gh-20]: https://github.com/pomerium/pomerium/issues/20
-[gh-200]: https://github.com/pomerium/pomerium/issues/200
-[gh-201]: https://github.com/pomerium/pomerium/issues/201
-[gh-202]: https://github.com/pomerium/pomerium/issues/202
-[gh-203]: https://github.com/pomerium/pomerium/issues/203
-[gh-204]: https://github.com/pomerium/pomerium/issues/204
-[gh-205]: https://github.com/pomerium/pomerium/issues/205
-[gh-206]: https://github.com/pomerium/pomerium/issues/206
-[gh-207]: https://github.com/pomerium/pomerium/issues/207
-[gh-208]: https://github.com/pomerium/pomerium/issues/208
-[gh-209]: https://github.com/pomerium/pomerium/issues/209
-[gh-21]: https://github.com/pomerium/pomerium/issues/21
-[gh-210]: https://github.com/pomerium/pomerium/issues/210
-[gh-211]: https://github.com/pomerium/pomerium/issues/211
-[gh-212]: https://github.com/pomerium/pomerium/issues/212
-[gh-213]: https://github.com/pomerium/pomerium/issues/213
-[gh-214]: https://github.com/pomerium/pomerium/issues/214
-[gh-215]: https://github.com/pomerium/pomerium/issues/215
-[gh-216]: https://github.com/pomerium/pomerium/issues/216
-[gh-217]: https://github.com/pomerium/pomerium/issues/217
-[gh-218]: https://github.com/pomerium/pomerium/issues/218
-[gh-219]: https://github.com/pomerium/pomerium/issues/219
-[gh-22]: https://github.com/pomerium/pomerium/issues/22
-[gh-220]: https://github.com/pomerium/pomerium/issues/220
-[gh-221]: https://github.com/pomerium/pomerium/issues/221
-[gh-222]: https://github.com/pomerium/pomerium/issues/222
-[gh-223]: https://github.com/pomerium/pomerium/issues/223
-[gh-224]: https://github.com/pomerium/pomerium/issues/224
-[gh-225]: https://github.com/pomerium/pomerium/issues/225
-[gh-226]: https://github.com/pomerium/pomerium/issues/226
-[gh-227]: https://github.com/pomerium/pomerium/issues/227
-[gh-228]: https://github.com/pomerium/pomerium/issues/228
-[gh-229]: https://github.com/pomerium/pomerium/issues/229
-[gh-23]: https://github.com/pomerium/pomerium/issues/23
-[gh-230]: https://github.com/pomerium/pomerium/issues/230
-[gh-231]: https://github.com/pomerium/pomerium/issues/231
-[gh-232]: https://github.com/pomerium/pomerium/issues/232
-[gh-233]: https://github.com/pomerium/pomerium/issues/233
-[gh-234]: https://github.com/pomerium/pomerium/issues/234
-[gh-235]: https://github.com/pomerium/pomerium/issues/235
-[gh-236]: https://github.com/pomerium/pomerium/issues/236
-[gh-237]: https://github.com/pomerium/pomerium/issues/237
-[gh-238]: https://github.com/pomerium/pomerium/issues/238
-[gh-239]: https://github.com/pomerium/pomerium/issues/239
-[gh-24]: https://github.com/pomerium/pomerium/issues/24
-[gh-240]: https://github.com/pomerium/pomerium/issues/240
-[gh-241]: https://github.com/pomerium/pomerium/issues/241
-[gh-242]: https://github.com/pomerium/pomerium/issues/242
-[gh-243]: https://github.com/pomerium/pomerium/issues/243
-[gh-244]: https://github.com/pomerium/pomerium/issues/244
-[gh-245]: https://github.com/pomerium/pomerium/issues/245
-[gh-246]: https://github.com/pomerium/pomerium/issues/246
-[gh-247]: https://github.com/pomerium/pomerium/issues/247
-[gh-248]: https://github.com/pomerium/pomerium/issues/248
-[gh-249]: https://github.com/pomerium/pomerium/issues/249
-[gh-25]: https://github.com/pomerium/pomerium/issues/25
-[gh-250]: https://github.com/pomerium/pomerium/issues/250
-[gh-251]: https://github.com/pomerium/pomerium/issues/251
-[gh-252]: https://github.com/pomerium/pomerium/issues/252
-[gh-253]: https://github.com/pomerium/pomerium/issues/253
-[gh-254]: https://github.com/pomerium/pomerium/issues/254
-[gh-255]: https://github.com/pomerium/pomerium/issues/255
-[gh-256]: https://github.com/pomerium/pomerium/issues/256
-[gh-257]: https://github.com/pomerium/pomerium/issues/257
-[gh-258]: https://github.com/pomerium/pomerium/issues/258
-[gh-259]: https://github.com/pomerium/pomerium/issues/259
-[gh-26]: https://github.com/pomerium/pomerium/issues/26
-[gh-260]: https://github.com/pomerium/pomerium/issues/260
-[gh-261]: https://github.com/pomerium/pomerium/issues/261
-[gh-262]: https://github.com/pomerium/pomerium/issues/262
-[gh-263]: https://github.com/pomerium/pomerium/issues/263
-[gh-264]: https://github.com/pomerium/pomerium/issues/264
-[gh-265]: https://github.com/pomerium/pomerium/issues/265
-[gh-266]: https://github.com/pomerium/pomerium/issues/266
-[gh-267]: https://github.com/pomerium/pomerium/issues/267
-[gh-268]: https://github.com/pomerium/pomerium/issues/268
-[gh-269]: https://github.com/pomerium/pomerium/issues/269
-[gh-27]: https://github.com/pomerium/pomerium/issues/27
-[gh-270]: https://github.com/pomerium/pomerium/issues/270
-[gh-271]: https://github.com/pomerium/pomerium/issues/271
-[gh-272]: https://github.com/pomerium/pomerium/issues/272
-[gh-273]: https://github.com/pomerium/pomerium/issues/273
-[gh-274]: https://github.com/pomerium/pomerium/issues/274
-[gh-275]: https://github.com/pomerium/pomerium/issues/275
-[gh-276]: https://github.com/pomerium/pomerium/issues/276
-[gh-277]: https://github.com/pomerium/pomerium/issues/277
-[gh-278]: https://github.com/pomerium/pomerium/issues/278
-[gh-279]: https://github.com/pomerium/pomerium/issues/279
-[gh-28]: https://github.com/pomerium/pomerium/issues/28
-[gh-280]: https://github.com/pomerium/pomerium/issues/280
-[gh-281]: https://github.com/pomerium/pomerium/issues/281
-[gh-282]: https://github.com/pomerium/pomerium/issues/282
-[gh-283]: https://github.com/pomerium/pomerium/issues/283
-[gh-284]: https://github.com/pomerium/pomerium/issues/284
-[gh-285]: https://github.com/pomerium/pomerium/issues/285
-[gh-286]: https://github.com/pomerium/pomerium/issues/286
-[gh-287]: https://github.com/pomerium/pomerium/issues/287
-[gh-288]: https://github.com/pomerium/pomerium/issues/288
-[gh-289]: https://github.com/pomerium/pomerium/issues/289
-[gh-29]: https://github.com/pomerium/pomerium/issues/29
-[gh-290]: https://github.com/pomerium/pomerium/issues/290
-[gh-291]: https://github.com/pomerium/pomerium/issues/291
-[gh-292]: https://github.com/pomerium/pomerium/issues/292
-[gh-293]: https://github.com/pomerium/pomerium/issues/293
-[gh-294]: https://github.com/pomerium/pomerium/issues/294
-[gh-295]: https://github.com/pomerium/pomerium/issues/295
-[gh-296]: https://github.com/pomerium/pomerium/issues/296
-[gh-297]: https://github.com/pomerium/pomerium/issues/297
-[gh-298]: https://github.com/pomerium/pomerium/issues/298
-[gh-299]: https://github.com/pomerium/pomerium/issues/299
-[gh-3]: https://github.com/pomerium/pomerium/issues/3
-[gh-30]: https://github.com/pomerium/pomerium/issues/30
-[gh-300]: https://github.com/pomerium/pomerium/issues/300
-[gh-301]: https://github.com/pomerium/pomerium/issues/301
-[gh-302]: https://github.com/pomerium/pomerium/issues/302
-[gh-303]: https://github.com/pomerium/pomerium/issues/303
-[gh-304]: https://github.com/pomerium/pomerium/issues/304
-[gh-305]: https://github.com/pomerium/pomerium/issues/305
-[gh-306]: https://github.com/pomerium/pomerium/issues/306
-[gh-307]: https://github.com/pomerium/pomerium/issues/307
-[gh-308]: https://github.com/pomerium/pomerium/issues/308
-[gh-309]: https://github.com/pomerium/pomerium/issues/309
-[gh-31]: https://github.com/pomerium/pomerium/issues/31
-[gh-310]: https://github.com/pomerium/pomerium/issues/310
-[gh-311]: https://github.com/pomerium/pomerium/issues/311
-[gh-312]: https://github.com/pomerium/pomerium/issues/312
-[gh-313]: https://github.com/pomerium/pomerium/issues/313
-[gh-314]: https://github.com/pomerium/pomerium/issues/314
-[gh-315]: https://github.com/pomerium/pomerium/issues/315
-[gh-316]: https://github.com/pomerium/pomerium/issues/316
-[gh-317]: https://github.com/pomerium/pomerium/issues/317
-[gh-318]: https://github.com/pomerium/pomerium/issues/318
-[gh-319]: https://github.com/pomerium/pomerium/issues/319
-[gh-32]: https://github.com/pomerium/pomerium/issues/32
-[gh-320]: https://github.com/pomerium/pomerium/issues/320
-[gh-321]: https://github.com/pomerium/pomerium/issues/321
-[gh-322]: https://github.com/pomerium/pomerium/issues/322
-[gh-323]: https://github.com/pomerium/pomerium/issues/323
-[gh-324]: https://github.com/pomerium/pomerium/issues/324
-[gh-325]: https://github.com/pomerium/pomerium/issues/325
-[gh-326]: https://github.com/pomerium/pomerium/issues/326
-[gh-327]: https://github.com/pomerium/pomerium/issues/327
-[gh-328]: https://github.com/pomerium/pomerium/issues/328
-[gh-329]: https://github.com/pomerium/pomerium/issues/329
-[gh-33]: https://github.com/pomerium/pomerium/issues/33
-[gh-330]: https://github.com/pomerium/pomerium/issues/330
-[gh-331]: https://github.com/pomerium/pomerium/issues/331
-[gh-332]: https://github.com/pomerium/pomerium/issues/332
-[gh-333]: https://github.com/pomerium/pomerium/issues/333
-[gh-334]: https://github.com/pomerium/pomerium/issues/334
-[gh-335]: https://github.com/pomerium/pomerium/issues/335
-[gh-336]: https://github.com/pomerium/pomerium/issues/336
-[gh-337]: https://github.com/pomerium/pomerium/issues/337
-[gh-338]: https://github.com/pomerium/pomerium/issues/338
-[gh-339]: https://github.com/pomerium/pomerium/issues/339
-[gh-34]: https://github.com/pomerium/pomerium/issues/34
-[gh-340]: https://github.com/pomerium/pomerium/issues/340
-[gh-341]: https://github.com/pomerium/pomerium/issues/341
-[gh-342]: https://github.com/pomerium/pomerium/issues/342
-[gh-343]: https://github.com/pomerium/pomerium/issues/343
-[gh-344]: https://github.com/pomerium/pomerium/issues/344
-[gh-345]: https://github.com/pomerium/pomerium/issues/345
-[gh-346]: https://github.com/pomerium/pomerium/issues/346
-[gh-347]: https://github.com/pomerium/pomerium/issues/347
-[gh-348]: https://github.com/pomerium/pomerium/issues/348
-[gh-349]: https://github.com/pomerium/pomerium/issues/349
-[gh-35]: https://github.com/pomerium/pomerium/issues/35
-[gh-350]: https://github.com/pomerium/pomerium/issues/350
-[gh-351]: https://github.com/pomerium/pomerium/issues/351
-[gh-352]: https://github.com/pomerium/pomerium/issues/352
-[gh-353]: https://github.com/pomerium/pomerium/issues/353
-[gh-354]: https://github.com/pomerium/pomerium/issues/354
-[gh-355]: https://github.com/pomerium/pomerium/issues/355
-[gh-356]: https://github.com/pomerium/pomerium/issues/356
-[gh-357]: https://github.com/pomerium/pomerium/issues/357
-[gh-358]: https://github.com/pomerium/pomerium/issues/358
-[gh-359]: https://github.com/pomerium/pomerium/issues/359
-[gh-36]: https://github.com/pomerium/pomerium/issues/36
-[gh-360]: https://github.com/pomerium/pomerium/issues/360
-[gh-361]: https://github.com/pomerium/pomerium/issues/361
-[gh-362]: https://github.com/pomerium/pomerium/issues/362
-[gh-363]: https://github.com/pomerium/pomerium/issues/363
-[gh-364]: https://github.com/pomerium/pomerium/issues/364
-[gh-365]: https://github.com/pomerium/pomerium/issues/365
-[gh-366]: https://github.com/pomerium/pomerium/issues/366
-[gh-367]: https://github.com/pomerium/pomerium/issues/367
-[gh-368]: https://github.com/pomerium/pomerium/issues/368
-[gh-369]: https://github.com/pomerium/pomerium/issues/369
-[gh-37]: https://github.com/pomerium/pomerium/issues/37
-[gh-370]: https://github.com/pomerium/pomerium/issues/370
-[gh-371]: https://github.com/pomerium/pomerium/issues/371
-[gh-372]: https://github.com/pomerium/pomerium/issues/372
-[gh-373]: https://github.com/pomerium/pomerium/issues/373
-[gh-374]: https://github.com/pomerium/pomerium/issues/374
-[gh-375]: https://github.com/pomerium/pomerium/issues/375
-[gh-376]: https://github.com/pomerium/pomerium/issues/376
-[gh-377]: https://github.com/pomerium/pomerium/issues/377
-[gh-378]: https://github.com/pomerium/pomerium/issues/378
-[gh-379]: https://github.com/pomerium/pomerium/issues/379
-[gh-38]: https://github.com/pomerium/pomerium/issues/38
-[gh-380]: https://github.com/pomerium/pomerium/issues/380
-[gh-381]: https://github.com/pomerium/pomerium/issues/381
-[gh-382]: https://github.com/pomerium/pomerium/issues/382
-[gh-383]: https://github.com/pomerium/pomerium/issues/383
-[gh-384]: https://github.com/pomerium/pomerium/issues/384
-[gh-385]: https://github.com/pomerium/pomerium/issues/385
-[gh-386]: https://github.com/pomerium/pomerium/issues/386
-[gh-387]: https://github.com/pomerium/pomerium/issues/387
-[gh-388]: https://github.com/pomerium/pomerium/issues/388
-[gh-389]: https://github.com/pomerium/pomerium/issues/389
-[gh-39]: https://github.com/pomerium/pomerium/issues/39
-[gh-390]: https://github.com/pomerium/pomerium/issues/390
-[gh-391]: https://github.com/pomerium/pomerium/issues/391
-[gh-392]: https://github.com/pomerium/pomerium/issues/392
-[gh-393]: https://github.com/pomerium/pomerium/issues/393
-[gh-394]: https://github.com/pomerium/pomerium/issues/394
-[gh-395]: https://github.com/pomerium/pomerium/issues/395
-[gh-396]: https://github.com/pomerium/pomerium/issues/396
-[gh-397]: https://github.com/pomerium/pomerium/issues/397
-[gh-398]: https://github.com/pomerium/pomerium/issues/398
-[gh-399]: https://github.com/pomerium/pomerium/issues/399
-[gh-4]: https://github.com/pomerium/pomerium/issues/4
-[gh-40]: https://github.com/pomerium/pomerium/issues/40
-[gh-400]: https://github.com/pomerium/pomerium/issues/400
-[gh-401]: https://github.com/pomerium/pomerium/issues/401
-[gh-402]: https://github.com/pomerium/pomerium/issues/402
-[gh-403]: https://github.com/pomerium/pomerium/issues/403
-[gh-404]: https://github.com/pomerium/pomerium/issues/404
-[gh-405]: https://github.com/pomerium/pomerium/issues/405
-[gh-406]: https://github.com/pomerium/pomerium/issues/406
-[gh-407]: https://github.com/pomerium/pomerium/issues/407
-[gh-408]: https://github.com/pomerium/pomerium/issues/408
-[gh-409]: https://github.com/pomerium/pomerium/issues/409
-[gh-41]: https://github.com/pomerium/pomerium/issues/41
-[gh-410]: https://github.com/pomerium/pomerium/issues/410
-[gh-411]: https://github.com/pomerium/pomerium/issues/411
-[gh-412]: https://github.com/pomerium/pomerium/issues/412
-[gh-413]: https://github.com/pomerium/pomerium/issues/413
-[gh-414]: https://github.com/pomerium/pomerium/issues/414
-[gh-415]: https://github.com/pomerium/pomerium/issues/415
-[gh-416]: https://github.com/pomerium/pomerium/issues/416
-[gh-417]: https://github.com/pomerium/pomerium/issues/417
-[gh-418]: https://github.com/pomerium/pomerium/issues/418
-[gh-419]: https://github.com/pomerium/pomerium/issues/419
-[gh-42]: https://github.com/pomerium/pomerium/issues/42
-[gh-420]: https://github.com/pomerium/pomerium/issues/420
-[gh-421]: https://github.com/pomerium/pomerium/issues/421
-[gh-422]: https://github.com/pomerium/pomerium/issues/422
-[gh-423]: https://github.com/pomerium/pomerium/issues/423
-[gh-424]: https://github.com/pomerium/pomerium/issues/424
-[gh-425]: https://github.com/pomerium/pomerium/issues/425
-[gh-426]: https://github.com/pomerium/pomerium/issues/426
-[gh-427]: https://github.com/pomerium/pomerium/issues/427
-[gh-428]: https://github.com/pomerium/pomerium/issues/428
-[gh-429]: https://github.com/pomerium/pomerium/issues/429
-[gh-43]: https://github.com/pomerium/pomerium/issues/43
-[gh-430]: https://github.com/pomerium/pomerium/issues/430
-[gh-431]: https://github.com/pomerium/pomerium/issues/431
-[gh-432]: https://github.com/pomerium/pomerium/issues/432
-[gh-433]: https://github.com/pomerium/pomerium/issues/433
-[gh-434]: https://github.com/pomerium/pomerium/issues/434
-[gh-435]: https://github.com/pomerium/pomerium/issues/435
-[gh-436]: https://github.com/pomerium/pomerium/issues/436
-[gh-437]: https://github.com/pomerium/pomerium/issues/437
-[gh-438]: https://github.com/pomerium/pomerium/issues/438
-[gh-439]: https://github.com/pomerium/pomerium/issues/439
-[gh-44]: https://github.com/pomerium/pomerium/issues/44
-[gh-440]: https://github.com/pomerium/pomerium/issues/440
-[gh-441]: https://github.com/pomerium/pomerium/issues/441
-[gh-442]: https://github.com/pomerium/pomerium/issues/442
-[gh-443]: https://github.com/pomerium/pomerium/issues/443
-[gh-444]: https://github.com/pomerium/pomerium/issues/444
-[gh-445]: https://github.com/pomerium/pomerium/issues/445
-[gh-446]: https://github.com/pomerium/pomerium/issues/446
-[gh-447]: https://github.com/pomerium/pomerium/issues/447
-[gh-448]: https://github.com/pomerium/pomerium/issues/448
-[gh-449]: https://github.com/pomerium/pomerium/issues/449
-[gh-45]: https://github.com/pomerium/pomerium/issues/45
-[gh-450]: https://github.com/pomerium/pomerium/issues/450
-[gh-451]: https://github.com/pomerium/pomerium/issues/451
-[gh-452]: https://github.com/pomerium/pomerium/issues/452
-[gh-453]: https://github.com/pomerium/pomerium/issues/453
-[gh-454]: https://github.com/pomerium/pomerium/issues/454
-[gh-455]: https://github.com/pomerium/pomerium/issues/455
-[gh-456]: https://github.com/pomerium/pomerium/issues/456
-[gh-457]: https://github.com/pomerium/pomerium/issues/457
-[gh-458]: https://github.com/pomerium/pomerium/issues/458
-[gh-459]: https://github.com/pomerium/pomerium/issues/459
-[gh-46]: https://github.com/pomerium/pomerium/issues/46
-[gh-460]: https://github.com/pomerium/pomerium/issues/460
-[gh-461]: https://github.com/pomerium/pomerium/issues/461
-[gh-462]: https://github.com/pomerium/pomerium/issues/462
-[gh-463]: https://github.com/pomerium/pomerium/issues/463
-[gh-464]: https://github.com/pomerium/pomerium/issues/464
-[gh-465]: https://github.com/pomerium/pomerium/issues/465
-[gh-466]: https://github.com/pomerium/pomerium/issues/466
-[gh-467]: https://github.com/pomerium/pomerium/issues/467
-[gh-468]: https://github.com/pomerium/pomerium/issues/468
-[gh-469]: https://github.com/pomerium/pomerium/issues/469
-[gh-47]: https://github.com/pomerium/pomerium/issues/47
-[gh-470]: https://github.com/pomerium/pomerium/issues/470
-[gh-471]: https://github.com/pomerium/pomerium/issues/471
-[gh-472]: https://github.com/pomerium/pomerium/issues/472
-[gh-473]: https://github.com/pomerium/pomerium/issues/473
-[gh-474]: https://github.com/pomerium/pomerium/issues/474
-[gh-475]: https://github.com/pomerium/pomerium/issues/475
-[gh-476]: https://github.com/pomerium/pomerium/issues/476
-[gh-477]: https://github.com/pomerium/pomerium/issues/477
-[gh-478]: https://github.com/pomerium/pomerium/issues/478
-[gh-479]: https://github.com/pomerium/pomerium/issues/479
-[gh-48]: https://github.com/pomerium/pomerium/issues/48
-[gh-480]: https://github.com/pomerium/pomerium/issues/480
-[gh-481]: https://github.com/pomerium/pomerium/issues/481
-[gh-482]: https://github.com/pomerium/pomerium/issues/482
-[gh-483]: https://github.com/pomerium/pomerium/issues/483
-[gh-484]: https://github.com/pomerium/pomerium/issues/484
-[gh-485]: https://github.com/pomerium/pomerium/issues/485
-[gh-486]: https://github.com/pomerium/pomerium/issues/486
-[gh-487]: https://github.com/pomerium/pomerium/issues/487
-[gh-488]: https://github.com/pomerium/pomerium/issues/488
-[gh-489]: https://github.com/pomerium/pomerium/issues/489
-[gh-49]: https://github.com/pomerium/pomerium/issues/49
-[gh-490]: https://github.com/pomerium/pomerium/issues/490
-[gh-491]: https://github.com/pomerium/pomerium/issues/491
-[gh-492]: https://github.com/pomerium/pomerium/issues/492
-[gh-493]: https://github.com/pomerium/pomerium/issues/493
-[gh-494]: https://github.com/pomerium/pomerium/issues/494
-[gh-495]: https://github.com/pomerium/pomerium/issues/495
-[gh-496]: https://github.com/pomerium/pomerium/issues/496
-[gh-497]: https://github.com/pomerium/pomerium/issues/497
-[gh-498]: https://github.com/pomerium/pomerium/issues/498
-[gh-499]: https://github.com/pomerium/pomerium/issues/499
-[gh-5]: https://github.com/pomerium/pomerium/issues/5
-[gh-50]: https://github.com/pomerium/pomerium/issues/50
-[gh-500]: https://github.com/pomerium/pomerium/issues/500
-[gh-501]: https://github.com/pomerium/pomerium/issues/501
-[gh-502]: https://github.com/pomerium/pomerium/issues/502
-[gh-503]: https://github.com/pomerium/pomerium/issues/503
-[gh-504]: https://github.com/pomerium/pomerium/issues/504
-[gh-505]: https://github.com/pomerium/pomerium/issues/505
-[gh-506]: https://github.com/pomerium/pomerium/issues/506
-[gh-507]: https://github.com/pomerium/pomerium/issues/507
-[gh-508]: https://github.com/pomerium/pomerium/issues/508
-[gh-509]: https://github.com/pomerium/pomerium/issues/509
-[gh-51]: https://github.com/pomerium/pomerium/issues/51
-[gh-510]: https://github.com/pomerium/pomerium/issues/510
-[gh-511]: https://github.com/pomerium/pomerium/issues/511
-[gh-512]: https://github.com/pomerium/pomerium/issues/512
-[gh-513]: https://github.com/pomerium/pomerium/issues/513
-[gh-514]: https://github.com/pomerium/pomerium/issues/514
-[gh-515]: https://github.com/pomerium/pomerium/issues/515
-[gh-516]: https://github.com/pomerium/pomerium/issues/516
-[gh-517]: https://github.com/pomerium/pomerium/issues/517
-[gh-518]: https://github.com/pomerium/pomerium/issues/518
-[gh-519]: https://github.com/pomerium/pomerium/issues/519
-[gh-52]: https://github.com/pomerium/pomerium/issues/52
-[gh-520]: https://github.com/pomerium/pomerium/issues/520
-[gh-521]: https://github.com/pomerium/pomerium/issues/521
-[gh-522]: https://github.com/pomerium/pomerium/issues/522
-[gh-523]: https://github.com/pomerium/pomerium/issues/523
-[gh-524]: https://github.com/pomerium/pomerium/issues/524
-[gh-525]: https://github.com/pomerium/pomerium/issues/525
-[gh-526]: https://github.com/pomerium/pomerium/issues/526
-[gh-527]: https://github.com/pomerium/pomerium/issues/527
-[gh-528]: https://github.com/pomerium/pomerium/issues/528
-[gh-529]: https://github.com/pomerium/pomerium/issues/529
-[gh-53]: https://github.com/pomerium/pomerium/issues/53
-[gh-530]: https://github.com/pomerium/pomerium/issues/530
-[gh-531]: https://github.com/pomerium/pomerium/issues/531
-[gh-532]: https://github.com/pomerium/pomerium/issues/532
-[gh-533]: https://github.com/pomerium/pomerium/issues/533
-[gh-534]: https://github.com/pomerium/pomerium/issues/534
-[gh-535]: https://github.com/pomerium/pomerium/issues/535
-[gh-536]: https://github.com/pomerium/pomerium/issues/536
-[gh-537]: https://github.com/pomerium/pomerium/issues/537
-[gh-538]: https://github.com/pomerium/pomerium/issues/538
-[gh-539]: https://github.com/pomerium/pomerium/issues/539
-[gh-54]: https://github.com/pomerium/pomerium/issues/54
-[gh-540]: https://github.com/pomerium/pomerium/issues/540
-[gh-541]: https://github.com/pomerium/pomerium/issues/541
-[gh-542]: https://github.com/pomerium/pomerium/issues/542
-[gh-543]: https://github.com/pomerium/pomerium/issues/543
-[gh-544]: https://github.com/pomerium/pomerium/issues/544
-[gh-545]: https://github.com/pomerium/pomerium/issues/545
-[gh-546]: https://github.com/pomerium/pomerium/issues/546
-[gh-547]: https://github.com/pomerium/pomerium/issues/547
-[gh-548]: https://github.com/pomerium/pomerium/issues/548
-[gh-549]: https://github.com/pomerium/pomerium/issues/549
-[gh-55]: https://github.com/pomerium/pomerium/issues/55
-[gh-550]: https://github.com/pomerium/pomerium/issues/550
-[gh-551]: https://github.com/pomerium/pomerium/issues/551
-[gh-552]: https://github.com/pomerium/pomerium/issues/552
-[gh-553]: https://github.com/pomerium/pomerium/issues/553
-[gh-554]: https://github.com/pomerium/pomerium/issues/554
-[gh-555]: https://github.com/pomerium/pomerium/issues/555
-[gh-556]: https://github.com/pomerium/pomerium/issues/556
-[gh-557]: https://github.com/pomerium/pomerium/issues/557
-[gh-558]: https://github.com/pomerium/pomerium/issues/558
-[gh-559]: https://github.com/pomerium/pomerium/issues/559
-[gh-56]: https://github.com/pomerium/pomerium/issues/56
-[gh-560]: https://github.com/pomerium/pomerium/issues/560
-[gh-561]: https://github.com/pomerium/pomerium/issues/561
-[gh-562]: https://github.com/pomerium/pomerium/issues/562
-[gh-563]: https://github.com/pomerium/pomerium/issues/563
-[gh-564]: https://github.com/pomerium/pomerium/issues/564
-[gh-565]: https://github.com/pomerium/pomerium/issues/565
-[gh-566]: https://github.com/pomerium/pomerium/issues/566
-[gh-567]: https://github.com/pomerium/pomerium/issues/567
-[gh-568]: https://github.com/pomerium/pomerium/issues/568
-[gh-569]: https://github.com/pomerium/pomerium/issues/569
-[gh-57]: https://github.com/pomerium/pomerium/issues/57
-[gh-570]: https://github.com/pomerium/pomerium/issues/570
-[gh-571]: https://github.com/pomerium/pomerium/issues/571
-[gh-572]: https://github.com/pomerium/pomerium/issues/572
-[gh-573]: https://github.com/pomerium/pomerium/issues/573
-[gh-574]: https://github.com/pomerium/pomerium/issues/574
-[gh-575]: https://github.com/pomerium/pomerium/issues/575
-[gh-576]: https://github.com/pomerium/pomerium/issues/576
-[gh-577]: https://github.com/pomerium/pomerium/issues/577
-[gh-578]: https://github.com/pomerium/pomerium/issues/578
-[gh-579]: https://github.com/pomerium/pomerium/issues/579
-[gh-58]: https://github.com/pomerium/pomerium/issues/58
-[gh-580]: https://github.com/pomerium/pomerium/issues/580
-[gh-581]: https://github.com/pomerium/pomerium/issues/581
-[gh-582]: https://github.com/pomerium/pomerium/issues/582
-[gh-583]: https://github.com/pomerium/pomerium/issues/583
-[gh-584]: https://github.com/pomerium/pomerium/issues/584
-[gh-585]: https://github.com/pomerium/pomerium/issues/585
-[gh-586]: https://github.com/pomerium/pomerium/issues/586
-[gh-587]: https://github.com/pomerium/pomerium/issues/587
-[gh-588]: https://github.com/pomerium/pomerium/issues/588
-[gh-589]: https://github.com/pomerium/pomerium/issues/589
-[gh-59]: https://github.com/pomerium/pomerium/issues/59
-[gh-590]: https://github.com/pomerium/pomerium/issues/590
-[gh-591]: https://github.com/pomerium/pomerium/issues/591
-[gh-592]: https://github.com/pomerium/pomerium/issues/592
-[gh-593]: https://github.com/pomerium/pomerium/issues/593
-[gh-594]: https://github.com/pomerium/pomerium/issues/594
-[gh-595]: https://github.com/pomerium/pomerium/issues/595
-[gh-596]: https://github.com/pomerium/pomerium/issues/596
-[gh-597]: https://github.com/pomerium/pomerium/issues/597
-[gh-598]: https://github.com/pomerium/pomerium/issues/598
-[gh-599]: https://github.com/pomerium/pomerium/issues/599
-[gh-6]: https://github.com/pomerium/pomerium/issues/6
-[gh-60]: https://github.com/pomerium/pomerium/issues/60
-[gh-600]: https://github.com/pomerium/pomerium/issues/600
-[gh-601]: https://github.com/pomerium/pomerium/issues/601
-[gh-602]: https://github.com/pomerium/pomerium/issues/602
-[gh-603]: https://github.com/pomerium/pomerium/issues/603
-[gh-604]: https://github.com/pomerium/pomerium/issues/604
-[gh-605]: https://github.com/pomerium/pomerium/issues/605
-[gh-606]: https://github.com/pomerium/pomerium/issues/606
-[gh-607]: https://github.com/pomerium/pomerium/issues/607
-[gh-608]: https://github.com/pomerium/pomerium/issues/608
-[gh-609]: https://github.com/pomerium/pomerium/issues/609
-[gh-61]: https://github.com/pomerium/pomerium/issues/61
-[gh-610]: https://github.com/pomerium/pomerium/issues/610
-[gh-611]: https://github.com/pomerium/pomerium/issues/611
-[gh-612]: https://github.com/pomerium/pomerium/issues/612
-[gh-613]: https://github.com/pomerium/pomerium/issues/613
-[gh-614]: https://github.com/pomerium/pomerium/issues/614
-[gh-615]: https://github.com/pomerium/pomerium/issues/615
-[gh-616]: https://github.com/pomerium/pomerium/issues/616
-[gh-617]: https://github.com/pomerium/pomerium/issues/617
-[gh-618]: https://github.com/pomerium/pomerium/issues/618
-[gh-619]: https://github.com/pomerium/pomerium/issues/619
-[gh-62]: https://github.com/pomerium/pomerium/issues/62
-[gh-620]: https://github.com/pomerium/pomerium/issues/620
-[gh-621]: https://github.com/pomerium/pomerium/issues/621
-[gh-622]: https://github.com/pomerium/pomerium/issues/622
-[gh-623]: https://github.com/pomerium/pomerium/issues/623
-[gh-624]: https://github.com/pomerium/pomerium/issues/624
-[gh-625]: https://github.com/pomerium/pomerium/issues/625
-[gh-626]: https://github.com/pomerium/pomerium/issues/626
-[gh-627]: https://github.com/pomerium/pomerium/issues/627
-[gh-628]: https://github.com/pomerium/pomerium/issues/628
-[gh-629]: https://github.com/pomerium/pomerium/issues/629
-[gh-63]: https://github.com/pomerium/pomerium/issues/63
-[gh-630]: https://github.com/pomerium/pomerium/issues/630
-[gh-631]: https://github.com/pomerium/pomerium/issues/631
-[gh-632]: https://github.com/pomerium/pomerium/issues/632
-[gh-633]: https://github.com/pomerium/pomerium/issues/633
-[gh-634]: https://github.com/pomerium/pomerium/issues/634
-[gh-635]: https://github.com/pomerium/pomerium/issues/635
-[gh-636]: https://github.com/pomerium/pomerium/issues/636
-[gh-637]: https://github.com/pomerium/pomerium/issues/637
-[gh-638]: https://github.com/pomerium/pomerium/issues/638
-[gh-639]: https://github.com/pomerium/pomerium/issues/639
-[gh-64]: https://github.com/pomerium/pomerium/issues/64
-[gh-640]: https://github.com/pomerium/pomerium/issues/640
-[gh-641]: https://github.com/pomerium/pomerium/issues/641
-[gh-642]: https://github.com/pomerium/pomerium/issues/642
-[gh-643]: https://github.com/pomerium/pomerium/issues/643
-[gh-644]: https://github.com/pomerium/pomerium/issues/644
-[gh-645]: https://github.com/pomerium/pomerium/issues/645
-[gh-646]: https://github.com/pomerium/pomerium/issues/646
-[gh-647]: https://github.com/pomerium/pomerium/issues/647
-[gh-648]: https://github.com/pomerium/pomerium/issues/648
-[gh-649]: https://github.com/pomerium/pomerium/issues/649
-[gh-65]: https://github.com/pomerium/pomerium/issues/65
-[gh-650]: https://github.com/pomerium/pomerium/issues/650
-[gh-651]: https://github.com/pomerium/pomerium/issues/651
-[gh-652]: https://github.com/pomerium/pomerium/issues/652
-[gh-653]: https://github.com/pomerium/pomerium/issues/653
-[gh-654]: https://github.com/pomerium/pomerium/issues/654
-[gh-655]: https://github.com/pomerium/pomerium/issues/655
-[gh-656]: https://github.com/pomerium/pomerium/issues/656
-[gh-657]: https://github.com/pomerium/pomerium/issues/657
-[gh-658]: https://github.com/pomerium/pomerium/issues/658
-[gh-659]: https://github.com/pomerium/pomerium/issues/659
-[gh-66]: https://github.com/pomerium/pomerium/issues/66
-[gh-660]: https://github.com/pomerium/pomerium/issues/660
-[gh-661]: https://github.com/pomerium/pomerium/issues/661
-[gh-662]: https://github.com/pomerium/pomerium/issues/662
-[gh-663]: https://github.com/pomerium/pomerium/issues/663
-[gh-664]: https://github.com/pomerium/pomerium/issues/664
-[gh-665]: https://github.com/pomerium/pomerium/issues/665
-[gh-666]: https://github.com/pomerium/pomerium/issues/666
-[gh-667]: https://github.com/pomerium/pomerium/issues/667
-[gh-668]: https://github.com/pomerium/pomerium/issues/668
-[gh-669]: https://github.com/pomerium/pomerium/issues/669
-[gh-67]: https://github.com/pomerium/pomerium/issues/67
-[gh-670]: https://github.com/pomerium/pomerium/issues/670
-[gh-671]: https://github.com/pomerium/pomerium/issues/671
-[gh-672]: https://github.com/pomerium/pomerium/issues/672
-[gh-673]: https://github.com/pomerium/pomerium/issues/673
-[gh-674]: https://github.com/pomerium/pomerium/issues/674
-[gh-675]: https://github.com/pomerium/pomerium/issues/675
-[gh-676]: https://github.com/pomerium/pomerium/issues/676
-[gh-677]: https://github.com/pomerium/pomerium/issues/677
-[gh-678]: https://github.com/pomerium/pomerium/issues/678
-[gh-679]: https://github.com/pomerium/pomerium/issues/679
-[gh-68]: https://github.com/pomerium/pomerium/issues/68
-[gh-69]: https://github.com/pomerium/pomerium/issues/69
-[gh-7]: https://github.com/pomerium/pomerium/issues/7
-[gh-70]: https://github.com/pomerium/pomerium/issues/70
-[gh-71]: https://github.com/pomerium/pomerium/issues/71
-[gh-72]: https://github.com/pomerium/pomerium/issues/72
-[gh-73]: https://github.com/pomerium/pomerium/issues/73
-[gh-74]: https://github.com/pomerium/pomerium/issues/74
-[gh-75]: https://github.com/pomerium/pomerium/issues/75
-[gh-76]: https://github.com/pomerium/pomerium/issues/76
-[gh-77]: https://github.com/pomerium/pomerium/issues/77
-[gh-78]: https://github.com/pomerium/pomerium/issues/78
-[gh-79]: https://github.com/pomerium/pomerium/issues/79
-[gh-8]: https://github.com/pomerium/pomerium/issues/8
-[gh-80]: https://github.com/pomerium/pomerium/issues/80
-[gh-81]: https://github.com/pomerium/pomerium/issues/81
-[gh-82]: https://github.com/pomerium/pomerium/issues/82
-[gh-83]: https://github.com/pomerium/pomerium/issues/83
-[gh-84]: https://github.com/pomerium/pomerium/issues/84
-[gh-85]: https://github.com/pomerium/pomerium/issues/85
-[gh-86]: https://github.com/pomerium/pomerium/issues/86
-[gh-87]: https://github.com/pomerium/pomerium/issues/87
-[gh-88]: https://github.com/pomerium/pomerium/issues/88
-[gh-89]: https://github.com/pomerium/pomerium/issues/89
-[gh-9]: https://github.com/pomerium/pomerium/issues/9
-[gh-90]: https://github.com/pomerium/pomerium/issues/90
-[gh-91]: https://github.com/pomerium/pomerium/issues/91
-[gh-92]: https://github.com/pomerium/pomerium/issues/92
-[gh-93]: https://github.com/pomerium/pomerium/issues/93
-[gh-94]: https://github.com/pomerium/pomerium/issues/94
-[gh-95]: https://github.com/pomerium/pomerium/issues/95
-[gh-96]: https://github.com/pomerium/pomerium/issues/96
-[gh-97]: https://github.com/pomerium/pomerium/issues/97
-[gh-98]: https://github.com/pomerium/pomerium/issues/98
-[gh-99]: https://github.com/pomerium/pomerium/issues/99
-[synology tutorial]: /docs/guides/synology.md
diff --git a/content/docs/core/from-source.mdx b/content/docs/core/from-source.mdx
deleted file mode 100644
index bdec2aa88..000000000
--- a/content/docs/core/from-source.mdx
+++ /dev/null
@@ -1,88 +0,0 @@
----
-# cSpell:ignore filippo
-
-title: From Source
-lang: en-US
-keywords:
- [
- pomerium,
- identity access proxy,
- oidc,
- reverse proxy,
- from source,
- identity aware proxy,
- ]
-sidebar_label: From Source
-sidebar_position: 4
----
-
-import ConfigMinimal from '@site/content/examples/config/config.minimal.yaml.md';
-
-# Building Pomerium From Source
-
-This document covers how to retrieve and build Pomerium from its source code as well as how to run Pomerium using a minimal but complete configuration.
-
-## Prerequisites
-
-- [git](https://git-scm.com/)
-- [go](https://golang.org/doc/install) programming language
-- A configured [identity provider]
-
-## Download
-
-Retrieve the latest copy of Pomerium's source code by cloning the repository.
-
-```bash
-git clone https://github.com/pomerium/pomerium.git $HOME/pomerium
-```
-
-## Create local certs
-
-In production, we'd use a public certificate authority such as LetsEncrypt. For local development, we can use [mkcert](https://mkcert.dev/) to make locally trusted development certificates with any names you'd like.
-
-```bash
-# Install mkcert.
-go install filippo.io/mkcert@latest
-# Bootstrap mkcert's root certificate into your operating system's trust store.
-mkcert -install
-# Create your wildcard domain.
-# *.localhost.pomerium.io is helper domain we've hard-coded to route to localhost
-mkcert "*.localhost.pomerium.io"
-```
-
-## Build
-
-Build Pomerium from source in a single step using make.
-
-```bash
-cd $HOME/pomerium
-make
-```
-
-[Make] will run all the tests, some code linters, then build the binary. If all is good, you should now have a freshly built Pomerium binary for your architecture and operating system in the `pomerium/bin` directory.
-
-If you don't have the prerequisites for the tests (Docker, Redis, etc) locally, you can instead run `make build` to just create the binary.
-
-## Configure
-
-Pomerium supports setting [configuration variables] using both environmental variables and using a configuration file. Here, we'll use a file.
-
-Create a config file (`config.yaml`). This file will be use to determine Pomerium's configuration settings, routes, and access-policies. Consider the following example:
-
-
-
-## Run
-
-Finally, run Pomerium specifying the configuration file `config.yaml`.
-
-```bash
-./bin/pomerium -config config.yaml
-```
-
-Browse to `verify.localhost.pomerium.io`. Connections between you and [verify] will now be proxied and managed by Pomerium.
-
-[configuration variables]: /docs/reference
-[verify]: https://verify.pomerium.com/
-[identity provider]: /docs/identity-providers
-[make]: https://en.wikipedia.org/wiki/Make_(software)
-[tls certificates]: /docs/guides/certificates
diff --git a/content/docs/core/img/verify-service.png b/content/docs/core/img/verify-service.png
deleted file mode 100644
index 91153015c..000000000
Binary files a/content/docs/core/img/verify-service.png and /dev/null differ
diff --git a/content/docs/core/quickstart.md b/content/docs/core/quickstart.md
deleted file mode 100644
index 7c8295dc7..000000000
--- a/content/docs/core/quickstart.md
+++ /dev/null
@@ -1,97 +0,0 @@
----
-# cSpell:ignore thisisunsafe, genkey, noout
-
-title: Run Pomerium Core With Docker
-lang: en-US
-sidebar_label: Quickstart
-sidebar_position: 1
-pagination_prev: null
-pagination_next: null
-description: Get Pomerium up and running quickly with Docker.
-keywords:
- [
- pomerium,
- identity access proxy,
- oidc,
- docker,
- reverse proxy,
- containers,
- identity aware proxy,
- quickstart pomerium,
- docker,
- docker-compose,
- ]
----
-
-import ConfigDocker from '@site/content/examples/config/config.docker.yaml.md'; import DockerCompose from '@site/content/examples/docker/basic.docker-compose.yml.md';
-
-# Run Pomerium Core With Docker
-
-Run Pomerium Core with Docker containers in **under 5 minutes**.
-
-The Core quickstart uses Pomerium's [**Hosted Authenticate Service**](/docs/capabilities/hosted-authenticate-service), but you can also configure a [**self-hosted authenticate service**](/docs/capabilities/self-hosted-authenticate-service) to integrate with Pomerium.
-
-## Prerequisites
-
-[Docker] and [Docker Compose]
-
-## Configure Pomerium
-
-Create a `config.yaml` file in the root of your project.
-
-Add the configuration below to `config.yaml`:
-
-
-
-Replace `user@example.com` with your email address.
-
-## Configure Docker
-
-Create a `docker-compose.yaml` file in the root of your project.
-
-Add the configuration below to `docker-compose.yaml`:
-
-
-
-## Run Docker Compose
-
-```bash
-docker compose up
-```
-
-Access the **verify route** you built in your policy: `https://verify.localhost.pomerium.io`
-
-If you get a self-signed certificate warning, see [Handle Self-Signed Certificate Warning](/docs/troubleshooting#handle-self-signed-certificate-warning) to bypass it.
-
-You should be redirected to the **verify** service. You'll see a page like this:
-
-![Verify page](./img/verify-service.png)
-
-Although identity verification failed, you successfully integrated Pomerium with the upstream verify service.
-
-:::tip
-
-Because this guide doesn't include a [signing key](/docs/reference/signing-key) in the configuration, identity verification will fail.
-
-See [Identity Verification](/docs/capabilities/getting-users-identity) for more information on how Pomerium can use JWTs for authentication.
-
-:::
-
-## Next Steps
-
-If you want to [try Enterprise](https://www.pomerium.com/enterprise-sales/), check out the [Enterprise with Docker quickstart](/docs/enterprise/quickstart).
-
-If you want to try connecting Pomerium with other services, see some of our [Guides](/docs/guides).
-
-**Did you finish this quickstart guide?** We'd love to hear what you think. Get in touch with us on our [Discuss forum](https://discuss.pomerium.com/), message us on [Twitter](https://twitter.com/pomerium_io), [LinkedIn](https://www.linkedin.com/company/pomerium-inc), or check out our [Community](https://www.pomerium.com/docs/community) page.
-
-:::caution
-
-This is a test environment! If you followed all the steps in this doc your Pomerium environment is not using trusted certificates. Remember to use a valid certificate solution before moving this configuration to a production environment. See [Certificates](/docs/reference/certificates) for more information.
-
-:::
-
-[configuration file]: /docs/reference
-[container images]: https://hub.docker.com/r/pomerium/pomerium
-[docker]: https://docs.docker.com/install/
-[docker compose]: https://docs.docker.com/compose/install/
diff --git a/content/docs/core/upgrading.mdx b/content/docs/core/upgrading.mdx
deleted file mode 100644
index 9b62c6467..000000000
--- a/content/docs/core/upgrading.mdx
+++ /dev/null
@@ -1,911 +0,0 @@
----
-# cSpell:ignore privkey cooldown certbot httpchk autocache forwardauth signin healthcheck GITHASH statefulset
-
-title: Upgrading
-description: >-
- This page contains the list of deprecations and important or breaking changes for Pomerium. Please read it carefully.
-
-
-pagination_prev: null
-pagination_next: null
-sidebar_position: 3
----
-
-# Upgrade guide
-
-## 0.28.0
-
-There are no breaking changes in v0.28.
-
-## 0.27.0
-
-### Breaking
-
-#### Deprecated JWT endpoint
-
-The /.pomerium/jwt endpoint is now deprecated and disabled by default. (To temporarily opt out of this deprecation, set the runtime flag [`pomerium_jwt_endpoint`](/docs/reference/runtime-flags) to true. This flag will be removed in a future release.)
-
-This endpoint was originally added for single-page web apps to get information about the currently signed-in user, but for this use case it is not necessary to receive this information as a signed JWT.
-
-Furthermore, this endpoint is incompatible with the desired security properties for the Pomerium JWT. We intend for the Pomerium JWT to represent that a specific request to an upstream service was duly authorized by Pomerium. The JWTs issued by the /.pomerium/jwt endpoint do not satisfy this property.
-
-There is a new /.pomerium/user endpoint to provide the same user data, but as a plaintext JSON response. If you are using the Pomerium [JavaScript SDK](https://github.com/pomerium/js-sdk), version 1.1.0 includes a new `getBrowserUser()` method to replace the existing `verifyBrowserUser()` method.
-
-#### Upgrading Pomerium Zero deployments in Kubernetes
-
-For Pomerium Zero deployments in Kubernetes, we updated the Kubernetes manifest to use a [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) instead of a StatefulSet. Before you upgrade, you need to delete your existing StatefulSet with a command like:
-
-```bash
-kubectl delete statefulset/pomerium -n pomerium-zero
-```
-
-Once you’ve removed your StatefulSet, run the following command to update Pomerium in Kubernetes:
-
-```bash
-kubectl apply -k github.com/pomerium/pomerium/k8s/zero
-```
-
-## 0.26.0
-
-#### Routes port matching
-
-Pomerium’s route matching behavior has changed with regards to port numbers in incoming requests. Previously, when matching an incoming request against the defined routes, Pomerium would require that the request’s `Host` (or `:authority`) header match the route’s `from` URL including any port number. This can cause problems in deployments with a NAT with port mapping in front of Pomerium.
-
-As of v0.26, if a Pomerium route’s `from` URL does not include an explicit port number, the matching behavior is more lenient: the route will match an incoming request with any port number. For example, take a route with the `from` URL `https://app.example.com`. Incoming requests with a host header of `app.example.com` , `app.example.com:443`, and `app.example.com:1234` would all match this route.
-
-However, if you specify a port number explicitly in the `from` URL, then incoming requests must include the same port number in the host header in order to match that route.
-
-You can temporarily revert this change in behavior by setting the [runtime flag](https://www.pomerium.com/docs/reference/runtime-flags) `match_any_incoming_port` to false.
-
-#### Host header rewrite behavior
-
-Pomerium will now consistently rewrite the host header of an incoming request to match the host and port specified in the route `to` URL. (Previously Pomerium would never include a port number even if specified, and Pomerium would not rewrite the host header for any `to` URLs with a host of `localhost` or an IP address.) The new behavior is intended to be more consistent and predictable.
-
-Please set the [Preserve Host Header](https://www.pomerium.com/docs/reference/routes/headers#1-preserve-host-header) option for any routes where Pomerium should not rewrite the host header.
-
-#### Improved session refresh reliability
-
-We’ve updated the way Pomerium refreshes OAuth access tokens in order to improve reliability. Previously, Pomerium could fall behind on access token refresh, leading to users being prompted to sign in again before their Pomerium session should have expired. This may result in a higher rate of requests to your configured identity provider.
-
-If you suspect this is causing any problems for your deployment, you can temporarily revert to the previous implementation by setting the runtime flag `legacy_identity_manager` to true.
-
-#### Deprecations
-
-Support for the deprecated `client_ca` config file key (and `CLIENT_CA` environment variable) is now removed. Please update any remaining usage to `downstream_mtls.ca` or the `DOWNSTREAM_MTLS_CA` environment variable. See [https://www.pomerium.com/docs/reference/downstream-mtls-settings#ca](https://www.pomerium.com/docs/reference/downstream-mtls-settings#ca) for more information about this option.
-
-## 0.25.0
-
-### Breaking
-
-#### Base64-encoded Certificates
-
-Previously, the `certificates` key supported base64-encoded certificates as a value (this option was not documented). We've removed support for base64-encoded certificates for this setting and now require that you only use the certificate file location. To avoid incompatibilities between versions, please update these values accordingly.
-
-**Note:** The `certificates` key is distinct from the `certificate` key. The `certificate` key setting still supports base64-encoded certificates; the `certificates` _list_ does not.
-
-#### Remove Debug Option
-
-We've removed support for the Debug setting, which changed the format of logs from JSON to a pretty-print format. If you prefer to review logs in a pretty-print format, you can use a command-line processing tool like `jq`.
-
-### New
-
-#### Authentication Flows
-
-In v0.21, we modified the Core authentication flow to support the [Hosted Authenticate](https://www.pomerium.com/docs/capabilities/hosted-authenticate-service) service. However, this flow posed some limitations for self-hosted deployments (see [#4819](https://github.com/pomerium/pomerium/issues/4819) for more details). In v0.25, we’ve updated the Core authentication flow so that it’s more versatile: Deployments configured to use the Hosted Authenticate service will use the newer authentication flow introduced in v0.21, while self-hosted deployments will use the older flow.
-
-## 0.24.0
-
-### Breaking
-
-#### Set Authorization Header
-
-The deprecated `set_authorization_header` configuration setting has been removed. You can use the [Set Request Headers](/docs/reference/routes/headers#set-request-headers) setting to pass IdP tokens to upstream services in any header.
-
-#### Base64-encoded Certificates
-
-Previously, the `certificates` key supported base64-encoded certificates as a value (this option was not documented). We've removed support for base64-encoded certificates for this setting and now require that you only use the relative file location.
-
-**Note:** The `certificates` key is distinct from the `certificate` key. The `certificate` key setting still supports base64-encoded certificates; the `certificates` _list_ does not.
-
-See [Certificates](/docs/reference/certificates#certificates) for more information.
-
-#### Redis Storage Backend
-
-PostgreSQL has been the recommended databroker storage backend since v0.18. Support for Redis has now been removed.
-
-See [Persistence](/docs/internals/data-storage#postgres) for more information.
-
-### Performance
-
-v0.24.0 includes several performance enhancements for Pomerium Core. See the sections below for more information.
-
-#### Policy evaluator reuse
-
-The authorize service maintains one policy evaluator object for each route, which is responsible for all authorization decisions for that route.
-
-Previously, the authorize service would recreate all policy evaluator objects in response to a configuration change.
-
-Now, it will avoid recreating policy evaluator objects for any policies that have not changed, provided that the overall settings are compatible between the old and new configuration. (Some settings affect all routes, e.g. the [downstream_mtls](https://www.pomerium.com/docs/reference/downstream-mtls-settings) options, and changes to these options will still require all policy evaluators to be recreated.)
-
-#### Parallelization
-
-Core will now build route configuration objects and policy evaluator objects in parallel, each using up to half the number of available CPU cores.
-
-## 0.23.0
-
-### New
-
-#### Logging Configurations
-
-The new [Access Log Fields](/docs/reference/access-log-fields) and [Authorize Log Fields](/docs/reference/authorize-log-fields) settings allow you to customize the fields logged in the access and authorize logs. You can now opt to log ID tokens or specific ID token claims, custom request headers, and the request query params. See the linked reference pages for details.
-
-
- How the new Logging Configurations work
-
-
-**1. Configure logs** Specify which fields you want to log (omitting the setting will display all the default fields):
-
-```yaml
-# Access logs from Proxy service
-access_log_fields:
- - authority
- - path
-
-# Authorize logs from Authorize service
-authorize_log_fields:
- - request-id
- - method
- - path
-```
-
-**2. Access a route** For example, Pomerium’s Verify service:
-
-```yaml
-routes:
- - from: https://verify.localhost.pomerium.io
- to: http://verify:8000
-```
-
-**3. Find logs** After you access a route, filter your logs by searching for `“http-request”` and `“authorize check”`:
-
-```json
-// Search for “message”: “http-request”
-{
- "level": "info",
- "service": "envoy",
- "authority": "verify.pomerium.com",
- "path": "/img/json.svg",
- "time": "2023-08-04T12:12:35-04:00",
- "message": "http-request"
-}
-// Search for “message”: “authorize check”
-{
- "level": "info",
- "service": "authorize",
- "request-id": "c9afae5a-ec5a-4242-864f-df4189f20e99",
- "method": "GET",
- "path": "/index.css",
- "allow": true,
- "allow-why-true": ["domain-ok"],
- "deny": false,
- "deny-why-false": [],
- "time": "2023-08-07T10:26:33-04:00",
- "message": "authorize check"
-}
-```
-
-
-
-
-#### New Downstream mTLS Settings
-
-Downstream mTLS refers to the requirement that end users connecting to Pomerium-managed routes must present a trusted client certificate. The options for configuring downstream mTLS have been expanded and moved to a new settings group, under a new `downstream_mtls` configuration file key.
-
-The existing [Certificate Authority](/docs/reference/downstream-mtls-settings#ca) setting has moved from `client_ca` to `downstream_mtls.ca`. The `client_ca` configuration file key will continue to function as an alias for the new setting (but will be removed in a future release).
-
-Support for certificate revocation via CRLs is newly introduced. Please see the [CRL](/docs/reference/downstream-mtls-settings#crl) reference for more information and some important limitations.
-
-A new [Enforcement Mode](/docs/reference/downstream-mtls-settings#enforcement-mode) option has been added, to control the behavior when a client does not present a trusted certificate. The default setting preserves the behavior of previous Pomerium releases: client certificates are required only for user-configured Pomerium routes, and Pomerium will serve an HTML error page for requests without a trusted certificate. The new `reject_connection` setting allows for stricter client certificate enforcement: in this mode any attempt to make a TLS connection without a trusted client certificate will be rejected. Naturally, this means that client certificates will be required not only for user-configured Pomerium routes, but also for internal Pomerium routes. This mode allows you to use mTLS as an isolated security layer, entirely separate from Pomerium policy enforcement. Please review the [reference page](/docs/reference/downstream-mtls-settings#enforcement-mode) carefully before enabling this mode.
-
-To give further control over which specific client certificates are allowed, Pomerium now also offers a [Match Subject Alt Names](/docs/reference/downstream-mtls-settings#match-sans) setting. This allows you to trust only those client certificates containing a Subject Alternative Name (SAN) of a specific type, matching a particular regular expression.
-
-When the new [Max Verify Depth](/docs/reference/downstream-mtls-settings#max-verify-depth) option is set, Pomerium will consider client-supplied intermediate CA certificates when verifying a client certificate. The default setting preserves the behavior of previous Pomerium releases: all client certificates must be issued directly by a certificate authority included in the CA setting (no client-supplied intermediate CA certificates are allowed). This default behavior may change in a future release.
-
-#### Certificate Matcher PPL Criteria (beta)
-
-The new [Certificate Matcher](/docs/capabilities/ppl#certificate-matcher) can be used with the new PPL criterion `client_certificate` to build policies that grant or deny access based on the client certificate’s fingerprint or Subject Public Key Info (SPKI) hash. Both of these options allow you to create an allowlist or denylist of specific certificates.
-
-See the [Certificate Matcher](/docs/capabilities/ppl#certificate-matcher) policy page for more information and examples.
-
-#### Set Request Headers options
-
-You can configure the [Set Request Headers](/docs/reference/routes/headers#pass-dynamic-tokens-in-headers) setting to send the client certificate fingerprint (downstream mTLS must be enabled) to the upstream application or service. The fingerprint can be built into your authorization policy with the new Certificate Matcher (beta) PPL criteria to grant or deny users based on the fingerprint’s value.
-
-See the [Set Request Headers](/docs/reference/routes/headers#pass-dynamic-tokens-in-headers) settings page for more information and examples.
-
-### Deprecated
-
-#### Set Authorization Header
-
-The [Set Authorization Header](/docs/reference/routes/headers#set-request-headers) option is deprecated in favor of the new variable substitution support in the Set Request Headers option. This new support allows you to pass IdP tokens to upstream services in any header, not just the `Authorization` header.
-
-The Set Authorization Header option will be removed in a future release.
-
-#### TLS Downstream Client Certificate Authority
-
-The [TLS Downstream Client Certificate Authority](/docs/reference/routes/tls#tls-downstream-client-certificate-authority) option is deprecated, and will be removed in a future release.
-
-If you previously used this setting to require client certificates only on certain routes, you can achieve this same behavior by setting the new downstream mTLS [Enforcement Mode](/docs/reference/downstream-mtls-settings#enforcement-mode) option to the value `policy` and adding a policy deny rule with the `invalid_client_certificate` criterion on all routes that should require client certificates.
-
-If you want to enforce an allowlist or denylist of specific certificates on a particular route, you can use the new [`client_certificate`](/docs/capabilities/ppl#certificate-matcher) policy criterion.
-
-If you do need to set completely different trusted client CAs for different routes, we recommend running separate Pomerium clusters for each set of trusted client CAs.
-
-### Breaking
-
-#### Set Request Headers options
-
-To prevent a ‘$’ character from being treated as the start of a variable substitution, you may need to replace it with ‘$$’.
-
-## 0.22.0
-
-### New
-
-#### Hosted Authenticate Service
-
-- [Hosted Authenticate Service](/docs/capabilities/hosted-authenticate-service.md) will now be used by default to handle single-sign-on. Pomerium hosts this service as a convenience to its users; no identity provider configuration or authenticate service URL needs to be specified if the hosted authenticate service is used. The [Self-Hosted Authenticate Service](/docs/capabilities/self-hosted-authenticate-service), which requires a self-hosted authenticate service URL and identity provider, is still supported for users that prefer to host these services themselves.
-
-#### Wildcard From Routes
-
-- [Wildcard From Routes](/docs/reference/routes/from#wildcard-from-routes) is a Beta support feature that allows you to define a wildcard route that points matching external routes to a single destination.
-
-#### Better Memory performance
-
-- Internal [RDS changes](https://github.com/pomerium/pomerium/pull/4098) reduce memory consumption, especially for environments where configuration changes rapidly.
-
-## 0.21.0
-
-### Upgrading
-
-There are several data model changes in this release that are not backward compatible. Please make sure you back up your Postgres database before performing an upgrade.
-
-### Breaking
-
-#### Devices need to be re-enrolled
-
-The [Device Identity (beta)](/docs/capabilities/device-identity) data model had an internal change that is not forward compatible. Your enrolled devices will need be re-registered. Your existing policies may need to be updated.
-
-#### Forward Auth (deprecated, removed in this release)
-
-Forward auth was introduced in early versions of Pomerium to provide a gradual migration path for users of other reverse proxies to Pomerium. Since then, Pomerium has come a long way - it is now based around first class reverse proxy core (Envoy) and has been battle tested for many years. Unfortunately, supporting forward authentication mode provides a subpar experience in security (cookies cannot be stripped from upstream requests), configuration (misconfiguration issues are common and hard to troubleshoot), and it is not compatible with many of Pomerium's newer features and deployment scenarios.
-
-### New
-
-#### Bastion Host support for TCP routes
-
-See [Bastion Host](/docs/capabilities/tcp#bastion-host)
-
-#### Internal TLS by default
-
-If you run Pomerium Enterprise, you may set up a secure HTTPS connection between Pomerium Core and Enterprise without need to explicitly supply certificates. See [`tls_derive`](/docs/reference/tls-derive)
-
-## 0.20.0
-
-### Breaking
-
-#### IdP Groups Policy
-
-A deprecated `routes.allowed_groups` and `groups` PPL criteria were removed.
-
-For Open Source, please use IdP Claims passed by your IdP.
-
-- Please visit your IdP provider admin console to adjust group membership propagation to Claims.
- - [Okta](https://developer.okta.com/docs/guides/customize-tokens-groups-claim/main)
- - [Auth0](https://auth0.com/docs/customize/extensions/authorization-extension/configure-authorization-extension#add-authorization-information-to-the-token-issued)
- - [Azure](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-group-claims)
- - [Cognito](/docs/identity-providers/cognito#getting-groups)
-- You may need adjust requested scopes via `idp_scopes` config option.
-- visit your authenticate endpoint `/.pomerium` route to check the group claims are passed by your IdP.
-- use `claim/` [PPL criteria](/docs/capabilities/ppl#criteria)
-
-```yaml
-routes:
- - from: https://httpbin.localhost.pomerium.io
- to: https://httpbin.org
- pass_identity_headers: true
- policy:
- allow:
- and:
- - claim/groups: admins
-```
-
-For Enterprise, use PPL Builder ![policy_groups_enterprise](../enterprise/img/upgrading/policy_groups_enterprise.png)
-
-### IdP Directory Sync
-
-IdP directory sync has been moved to https://github.com/pomerium/datasource and becomes part of the [External Data Sources integration](/docs/capabilities/integrations/), in order to provide unification with other external data sources, consolidate job scheduling and monitoring.
-
-Setting the below options in Pomerium config file would now result in an error. In Pomerium Enterprise Console, please navigate to Settings > Identity Provider and configure directory sync there.
-
-- `idp_service_account`: use IdP provider specific options in the UI.
-- `idp_refresh_directory_timeout`: use [Polling Min Delay](/docs/reference/identity-provider-settings#identity-provider-polling-minmax-delay).
-- `idp_refresh_directory_interval`: replaced by [Polling Max Delay](/docs/reference/identity-provider-settings#identity-provider-polling-minmax-delay).
-- `idp_qps`: not required, IdP providers adjust their qps rate.
-
-Pomerium Core would only perform user authentication and session refresh with the IdP provider, and would not try to synchronize user details and groups, which is now part of [External Data Sources](/docs/capabilities/integrations/).
-
-![idp_enterprise](../enterprise/img/upgrading/policy_groups_enterprise.png)
-
-## 0.19.0
-
-### No changes required to upgrade
-
-- This release has no breaking changes. Review the [v19 Changelog](/docs/core/changelog#v0190-2022-09-01) for more information.
-
-## 0.18.0
-
-### No changes required to upgrade
-
-- This release has no breaking changes. Review the [v18 Changelog](/docs/core/changelog#v0180-2022-07-27) for more information.
-
-## 0.17.0
-
-### New
-
-#### Per Route OIDC Credentials
-
-This release of Pomerium adds the ability to bind a route to unique OIDC credentials. This allows Identity Provider administrators to view Pomerium protected applications individually rather than as a single shared application.
-
-See [idp_client_id](/docs/reference/routes/identity-provider-client-id-per-route) and [idp_client_secret](/docs/reference/routes/identity-provider-client-secret-per-route) for configuration details.
-
-#### Updated User Info Page
-
-The `.pomerium` user info page has been redesigned to better structure data around user identity, group, and device information.
-
-#### External Google Groups
-
-Pomerium policy now supports group members from outside of your organization.
-
-## 0.16.0
-
-### New
-
-#### Policy for Device Identity
-
-This release of Pomerium adds the ability to set policy based on system registration via [WebAuthN](https://en.wikipedia.org/wiki/WebAuthn).
-
-See [Device Identity](/docs/concepts/device-identity) for more details.
-
-#### HTTP PPL Criteria
-
-`http_path` and `http_method` are now supported for matching HTTP requests in policies. See [Pomerium Policy Language](/docs/capabilities/ppl#criteria) for more details.
-
-### Breaking
-
-#### Self-signed fallback certificates
-
-When selecting a TLS certificate for a listener, Pomerium attempts to locate one by iterating through the provided certs and searching for a SAN match. This applies to all listeners, including internal service URLs like `databroker_service_url` and public endpoints like `authenticate.example.com`.
-
-Previously, when no match was found, Pomerium would select the "first" certificate in the list. However, the definition of "first" might change based on runtime configuration, so the certificate selection was non-deterministic.
-
-Starting in v0.16, Pomerium will instead generate a self-signed certificate if it cannot locate an appropriate certificate from the provided configuration or system key/trust store. If you discover that you are receiving a self-signed certificate rather than a certificate from [`certificate`/`certificates`/`certificate_file`](/docs/reference/certificates) or the trust store, you have a mismatch between your service URL and the names covered in your certificates.
-
-#### OIDC flow no longer sets default uri params
-
-Previously, Pomerium would default to setting the uri param `access_type` to `offline` for all OpenID Connect based identity providers. However, using uri params to ensure offline access (e.g. `refresh_tokens` used to keep user's sessions alive) [is unique to Google](https://developers.google.com/identity/protocols/oauth2/web-server#offline). Those query params will now only be set for Google. Other OIDC based IdP's should continue to work using [OIDC's](https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess) `offline_access` scope.
-
-#### Removed options
-
-The deprecated `headers` option has been removed. Use [`set_response_headers`](/docs/reference/set-response-headers) instead.
-
-The `signing_key_algorithm` option has been removed and will now be inferred from `signing_key`.
-
-#### Changed GitHub Team IDs
-
-To improve performance, IdP directory synchronization for GitHub now uses the GraphQL API. This API returns the same information as the REST API, except that the GraphQL node IDs are different. Where we previously used the team integer ID from the REST API, we now use the team slug instead. Most policies should already use the team slug for group based rules, which should continue to work. However, if the integer ID is used it will no longer work. Update those policies to use the team slug instead.
-
-#### CLI Source and Packaging Update
-
-`pomerium-cli` has been factored out of the core repository and now resides at [https://github.com/pomerium/cli](https://github.com/pomerium/cli). If you currently install the CLI tool from [Packages](/docs/clients/pomerium-cli#packages) or [Homebrew](/docs/clients/pomerium-cli#homebrew), no changes should be required to your process. However, users of docker images or direct github release downloads will need to update their references.
-
-Please see the [updated install instructions](/docs/clients/pomerium-cli) for additional details.
-
-## 0.15.0
-
-### Breaking
-
-#### Removed options
-
-The unused `grpc_server_max_connection_age`, `grpc_server_max_connection_age_grace` and `refresh_cooldown` options were removed.
-
-#### Removed support for Ed25519 Signing Keys
-
-Ed25519 is no longer supported for `signing_key` since OPA Rego only supports ECDSA and RSA.
-
-### New
-
-#### Updated and expanded policy syntax
-
-Routes and policies may now be configured under a new top level key - `routes`
-
-- This more closely aligns to how policies and routes are conceptually related
-- The `routes` block supports a more powerful syntax for defining policies with conditionals and various criteria
-
-#### Support environmental proxy settings
-
-`pomerium-cli` now respects proxy related environmental variables.
-
-## 0.14.0
-
-### New
-
-#### Ping Identity
-
-[Ping Identity](https://www.pingidentity.com/) is supported as a directory provider. See [the documentation](https://www.pomerium.com/docs/identity-providers/ping.html) for details.
-
-#### Customized Identity Headers
-
-With the v0.14 release, the names of `X-Pomerium-Claim-{Name}` headers can now be [customized](https://www.pomerium.com/reference/#jwt-claim-headers). This enables broader 3rd party application support for Pomerium's identity headers.
-
-#### Redis High Availability
-
-Databroker now supports redis [sentinel](https://redis.io/topics/sentinel) and [cluster](https://redis.io/topics/cluster-spec) for increased availability. See the databroker [documentation](https://www.pomerium.com/reference/#data-broker-storage-connection-string) for details.
-
-#### Rewrite Response Headers
-
-Policies may now [rewrite response headers](https://www.pomerium.com/reference/#rewrite-response-headers) from upstream services. This can be especially useful when upstream servers attempt to redirect users to unreachable internal host names.
-
-### Breaking
-
-#### Programmatic login domain whitelist
-
-Programmatic login now restricts the allowed redirect URL domains. By default this is set to `localhost`, but can be changed via the `programmatic_redirect_domain_whitelist` option.
-
-#### `allowed_users` ID format
-
-When specifying `allowed_users` by ID, the identity provider is no longer part of the ID format. This does not impact users specified by e-mail.
-
-To update your policies for v0.14, please remove any identity provider prefix. Example: `okta/00usi7mc8XC8SwFxT4x6` becomes `00usi7mc8XC8SwFxT4x6`.
-
-## 0.13.0
-
-### New
-
-#### Upstream load balancing
-
-With the v0.13 release, routes may contain [multiple `to` URLs](/docs/reference/routes/to), and Pomerium will load balance between the endpoints. This allows Pomerium to fill the role of an edge proxy without the need for additional HTTP load balancers.
-
-- Active [health checks](/docs/reference/routes/load-balancing#health-checks) and passive [outlier detection](/docs/reference/routes/outlier-detection)
-- Configurable [load balancing policies](/docs/reference/routes/load-balancing#load-balancing-policy)
-- Configurable [load balancing weight](/docs/reference/routes/to)
-
-See [Load Balancing](/docs/capabilities/load-balancing) for more information on using this feature set.
-
-#### Dynamic certificate updates
-
-With the v0.13 release, all TLS files referenced from Pomerium's configuration are reloaded automatically when updating. This improves availability in environments which automate short lived TLS certificate rotation via [certbot](https://certbot.eff.org/) or similar tools.
-
-#### Proxy Protocol support
-
-The Pomerium HTTP listener now [supports](/docs/reference/use-proxy-protocol) HAPROXY's [proxy protocol](https://www.haproxy.org/download/1.9/doc/proxy-protocol.txt) to update `X-Forwarded-For` accurately when behind another proxy service.
-
-### Breaking
-
-#### Sign-out endpoint requires CSRF Token
-
-The frontchannel-logout endpoint will now require a CSRF token for both `GET` and `POST` requests.
-
-#### User impersonation removed
-
-Prior to the v0.13 release, it was possible for an administrative user to temporarily impersonate another user. This was done by adding an additional set of claims to that user's session token. Having additional identity state stored client-side significantly expands the attack surface of Pomerium and complicates policy enforcement by having multiple sources of truth for identity. User impersonation was removed from Pomerium Core to shrink that attack surface and simplify policy enforcement. Pomerium now stores all identity state server-side and encrypted in the databroker.
-
-Pomerium Enterprise customers can still impersonate users with Service Accounts and the web interface. See the [Management API](/docs/capabilities/enterprise-api#create-a-service-account) and [Service Accounts](/docs/capabilities/service-accounts) capabilities pages for more information on impersonating users with Service Accounts.
-
-#### Client-side service accounts removed
-
-Prior to the v0.13 release, it was possible to create service accounts via Pomerium's CLI tool. These service accounts were signed with Pomerium's shared secret key. As with user impersonation, having session state stored client-side significantly expands the attack surface of Pomerium and complicates policy enforcement. Client side service accounts were removed to shrink that attack surface area, and to simplify policy enforcement.
-
-#### Administrators option removed
-
-The `administrators` configuration option has been removed.
-
-## 0.12.0
-
-### New
-
-#### TCP Proxying
-
-Pomerium can now be used for non-HTTP services. See [documentation](/docs/capabilities/tcp) for more details.
-
-#### Datadog Tracing
-
-Datadog has been added as a natively supported [tracing backend](/docs/reference/tracing#datadog)
-
-## 0.11.0
-
-### Breaking
-
-#### User impersonation disabled by default
-
-With the v0.11.0 release, the ability to do user user impersonation is **disabled by default**. To enable user impersonation, set `enable_user_impersonation` to true in the configuration options.
-
-#### `cache_service_url` has been renamed to `databroker_service_url`
-
-The `cache_service_url` parameter has been deprecated since v0.10.0 and is now removed. Please replace it with `databroker_service_url` in your yaml configuration, or `DATABROKER_SERVICE_URL` as an environment variable.
-
-### New
-
-#### Docker Multi-Arch Images
-
-With the v0.11.0 release, Pomerium docker images are multi-arch for `arm64` and `amd64`. Individual images for each architecture will continue to be published.
-
-## 0.10.0
-
-### Breaking
-
-#### Service accounts required for groups and directory data
-
-With the v0.10.0 release, Pomerium now queries group information asynchronously using a service account. While a service account was already required for a few identity providers like Google's GSuite, an Identity Provider Service Account is now required for all other providers as well. The format of this field varies and is specified in each identity provider's documentation.
-
-:::warning
-
-If no Identity Provider Service Account is supplied, policies using groups (e.g. `allowed_groups` will not work).
-
-:::
-
-#### Cache service builds stateful context
-
-With the v0.10 release, Pomerium now asynchronously fetches associated authorization context (e.g. identity provider directory context, groups, user-data, session data, etc) in the `cache` service. In previous versions, Pomerium used session cookies to associated identity state which authorization policy was evaluated against. While using session tokens had the advantage of making Pomerium a relatively stateless application, that approach has many shortcomings which is more extensively covered in the [data storage docs](/docs/internals/data-storage).
-
-There are two [storage backend types] available: `memory` or `redis`. You can see the existing [storage backend configuration settings in the docs][cache service docs].
-
-#### Memory Storage Backend
-
-For `memory` storage, restarting the cache service will result in all users having to re-login. Code for the in-memory database used by the cache service can be found here: [internal/databroker/memory](https://github.com/pomerium/pomerium/tree/main/internal/databroker/memory).
-
-:::warning
-
-Running more than one instance of the `memory` type cache service is not supported.
-
-:::
-
-#### Redis Storage Backend
-
-In production deployments, we recommend using the `redis` storage backend. Unlike the `memory` backend, `redis` can be used for persistent data.
-
-#### Implementing your own storage backend
-
-Please see the following interfaces for reference to implement your storage backend interface.
-
-- [databroker gRPC interface](https://github.com/pomerium/pomerium/blob/main/pkg/grpc/databroker/databroker.proto)
-- [storage backend interface](https://github.com/pomerium/pomerium/blob/main/pkg/storage/storage.go)
-
-### Identity headers
-
-With this release, pomerium will not insert identity headers (X-Pomerium-Jwt-Assertion/X-Pomerium-Claim-\*) by default. To get pre 0.9.0 behavior, you can set `pass_identity_headers` to true on a per-policy basis.
-
-## 0.9.0
-
-### Breaking
-
-#### Default log level
-
-With this release, default log level has been changed to INFO.
-
-#### HTTP 1.0
-
-HTTP 1.0 (not to be confused with HTTP 1.1) is not supported anymore. If you relied on it make sure to upgrade to HTTP 1.1 or higher.
-
-Example for HAProxy health check, in pre `0.9.0`:
-
-```sh
-shell script option httpchk GET /ping
-```
-
-In `0.9.0`:
-
-```sh
-option httpchk GET /ping HTTP/1.1\r\nHost:pomerium
-```
-
-#### `preserve_host_header` option
-
-With this release, Pomerium uses an embedded envoy proxy instead hand-written one. Thus, we defer the preserve host header functionality to [envoys auto_host_rewrite](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-auto-host-rewrite), which does not affect if the policy routes to a static IP.
-
-To preserve 0.8.x behavior, you can use the `set_request_headers` option to explicitly set the Host header.
-
-#### Unsupported platforms
-
-- With this release we now use an embedded [envoy](https://www.envoyproxy.io/) binary as our proxy server. Due to this change we now only build and support Linux and MacOS binaries with the AMD64 architecture. We plan on supporting more platforms and architectures in future releases.
-
-#### Observability
-
-- The `service` label on metrics and tracing no longer reflects the `Services` configuration option directly. `pomerium` will be used for all-in-one mode, and `pomerium-[service]` will be used for distributed services
-
-#### Tracing
-
-- Jaeger tracing support is no longer end-to-end in the Proxy service. We recommend updating to the Zipkin provider for proper tracing support. Jaeger will continue to work but will not have coverage in the data plane.
-- Option `tracing_debug` is no longer supported. Use `tracing_sampling_rate` instead. [Details](/docs/reference/tracing#shared-tracing-settings).
-
-#### Metrics
-
-With this release we now use an embedded [envoy](https://www.envoyproxy.io/) binary as our proxy server.
-
-- Due to this change, data plane metric names and labels have changed to adopt envoy's internal data model. [Details](https://www.pomerium.io/configuration/#envoy-proxy-metrics)
-
-## 0.8.0
-
-### Breaking
-
-#### Using paths in from URLs
-
-Although it's unlikely anyone ever used it, prior to 0.8.0 the policy configuration allowed you to specify a `from` field with a path component:
-
-```yaml
-policy:
- - from: 'https://example.com/some/path'
-```
-
-The proxy and authorization server would simply ignore the path and route/authorize based on the host name.
-
-With the introduction of `prefix`, `path` and `regex` fields to the policy route configuration, we decided not to support using a path in the `from` url, since the behavior was somewhat ambiguous and better handled by the explicit fields.
-
-To avoid future confusion, the application will now declare any configuration which contains a `from` field with a path as invalid, with this error message:
-
-```
-config: policy source url (%s) contains a path, but it should be set using the path field instead
-```
-
-If you see this error you can fix it by simply removing the path from the `from` field and moving it to a `prefix` field.
-
-In other words, this configuration:
-
-```yaml
-policy:
- - from: 'http://example.com/some/path'
-```
-
-Should be written like this:
-
-```yaml
-policy:
- - from: 'http://example.com'
- prefix: '/some/path'
-```
-
-## 0.7.0
-
-### Breaking
-
-#### Getting user's identity
-
-:::warning
-
-This changed was partially reverted in v0.7.2\. Session details like `user`, `email`, and `groups` can still be explicitly extracted by setting the [jwt_claims_header](/docs/reference/jwt-claim-headers) configuration option.
-
-:::
-
-User detail headers ( `x-pomerium-authenticated-user-id` / `x-pomerium-authenticated-user-email` / `x-pomerium-authenticated-user-groups`) have been removed in favor of using the more secure, more data rich attestation jwt header (`x-pomerium-jwt-assertion`).
-
-If you still rely on individual claim headers, please see the `jwt_claims_headers` option [here](https://www.pomerium.io/configuration/#jwt-claim-headers).
-
-#### Non-standard port users
-
-Non-standard port users (e.g. those not using `443`/`80` where the port _would_ be part of the client's request) will have to clear their user's session before upgrading. Starting with version v0.7.0, audience (`aud`) and issuer (`iss`) claims will be port specific.
-
-## 0.6.0
-
-### Breaking
-
-#### New cache service
-
-A back-end cache service was added to support session refreshing from [single-page-apps](https://en.wikipedia.org/wiki/Single-page_application).
-
-- For all-in-one deployments, _no changes are required_. The cache will be embedded in the binary. By default, autocache an in-memory LRU cache will be used to temporarily store user session data. If you wish to persist session data, it's also possible to use bolt or redis.
-- For split-service deployments, you will need to deploy an additional service called cache. By default, pomerium will use autocache as a distributed, automatically managed cache. It is also possible to use redis as backend in this mode.
-
-For a concrete example of the required changes, consider the following changes for those running split service mode,:
-
-```diff
-...
- pomerium-authenticate:
- environment:
- - SERVICES=authenticate
-+ - CACHE_SERVICE_URL=http://pomerium-cache:443
-...
-+ pomerium-cache:
-+ image: pomerium/pomerium
-+ environment:
-+ - SERVICES=cache
-+ volumes:
-+ - .config/config.example.yaml:/pomerium/config.yaml:ro
-+ expose:
-+ - 443
-```
-
-Please see the updated examples, and [cache service docs] as a reference and for the available cache stores. For more details as to why this was necessary, please see [PR438](https://github.com/pomerium/pomerium/pull/438) and [PR457](https://github.com/pomerium/pomerium/pull/457).
-
-## Since 0.5.0
-
-### Breaking
-
-#### Subdomain requirement dropped
-
-- Pomerium services and managed routes are no longer required to be on the same domain-tree root. Access can be delegated to any route, on any domain (that you have access to, of course).
-
-#### Azure AD
-
-- Azure Active Directory now uses the globally unique and immutable`ID` instead of `group name` to attest a user's [group membership](https://docs.microsoft.com/en-us/graph/api/group-get?view=graph-rest-1.0&tabs=http). Please update your policies to use group `ID` instead of group name.
-
-#### Okta
-
-- Okta no longer uses tokens to retrieve group membership. [Group membership](https://developer.okta.com/docs/reference/api/groups/) is now fetched using Okta's API.
-- Okta's group membership is now determined by the globally unique and immutable ID field. Please update your policies to use group `ID` instead of group name.
-- Okta now requires an additional set of credentials to be used to query for group membership set as a service account.
-
-#### OneLogin
-
-- OneLogin [group membership](https://developers.onelogin.com/openid-connect/api/user-info) is now determined by the globally unique and immutable ID field. Please update your policies to use group `ID` instead of group name.
-
-#### Force Refresh Removed
-
-Force refresh has been removed from the dashboard. Logging out and back in again should have the equivalent desired effect.
-
-#### Programmatic Access API changed
-
-Previous programmatic authentication endpoints (`/api/v1/token`) has been removed and has been replaced by a per-route, oauth2 based auth flow. Please see updated [programmatic documentation](/docs/capabilities/programmatic-access) how to use the new programmatic access api.
-
-#### Forward-auth route change
-
-Previously, routes were verified by taking the downstream applications hostname in the form of a path `(e.g. ${forwardauth}/.pomerium/verify/verify.some.example`) variable. The new method for verifying a route using forward authentication is to pass the entire requested url in the form of a query string `(e.g. ${forwardauth}/.pomerium/verify?url=https://verify.some.example)` where the routed domain is the value of the `uri` key.
-
-Note that the verification URL is no longer nested under the `.pomerium` endpoint.
-
-For example, in nginx this would look like:
-
-```diff
-- nginx.ingress.kubernetes.io/auth-url: https://forwardauth.corp.example.com/.pomerium/verify/verify.corp.example.com?no_redirect=true
-- nginx.ingress.kubernetes.io/auth-signin: https://forwardauth.corp.example.com/.pomerium/verify/verify.corp.example.com
-+ nginx.ingress.kubernetes.io/auth-url: https://forwardauth.corp.example.com/verify?uri=$scheme://$host$request_uri
-+ nginx.ingress.kubernetes.io/auth-signin: https://forwardauth.corp.example.com?uri=$scheme://$host$request_uri
-```
-
-## 0.4.0
-
-### Breaking
-
-#### Authorize Service URL no longer used in all-in-one mode
-
-Pomerium no longer handles both gRPC and HTTPS traffic from the same network listener (port). As a result, all-in-one mode configurations will default to serving gRPC traffic over loopback on port `5443` and will serve HTTPS traffic as before on port `443`. In previous versions, it was recommended to configure authorize in this mode which will now break. The error will typically look something like:
-
-```
-rpc error: code = DeadlineExceeded desc = latest connection error: connection closed
-```
-
-To upgrade, simply remove the `AUTHORIZE_SERVICE_URL` setting.
-
-#### Removed Authenticate Internal URL
-
-The authenticate service no longer uses gRPC to do back channel communication. As a result, `AUTHENTICATE_INTERNAL_URL`/`authenticate_internal_url` is no longer required.
-
-#### No default certificate location
-
-In previous versions, if no explicit certificate pair (in base64 or file form) was set, Pomerium would make a last ditch effort to check for certificate files (`cert.key`/`privkey.pem`) in the root directory. With the introduction of insecure server configuration, we've removed that functionality. If there settings for certificates and insecure server mode are unset, pomerium will give a appropriate error instead of a failed to find/open certificate error.
-
-#### Authorize service health-check is non-http
-
-The Authorize service will no longer respond to `HTTP`-based healthcheck queries when run as a distinct service (vs all-in-one). As an alternative, you can used on TCP based checks. For example, if using [Kubernetes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-tcp-liveness-probe):
-
-```yaml
----
-readinessProbe:
- tcpSocket:
- port: 443
- initialDelaySeconds: 5
- periodSeconds: 10
-livenessProbe:
- tcpSocket:
- port: 443
- initialDelaySeconds: 15
- periodSeconds: 20
-```
-
-### Non-breaking changes
-
-#### All-in-one
-
-If service mode (`SERVICES`/`services`) is set to `all`, gRPC communication with the Authorize service will by default occur over localhost, on port `:5443`.
-
-## 0.3.0
-
-Pomerium `v0.3.0` has no known breaking changes compared to `v0.2.0`.
-
-## 0.2.0
-
-Pomerium `v0.2.0` has no known breaking changes compared to `v0.1.0`.
-
-## 0.1.0
-
-This page contains the list of deprecations and important or breaking changes for pomerium `v0.1.0` compared to `v0.0.5`. Please read it carefully.
-
-### Semantic versioning changes
-
-Starting with `v0.1.0` we've changed our [releases](https://semver.org/) are versioned (`MAJOR.MINOR.PATCH+GITHASH`). Planned, monthly releases will now bump `MINOR` and any security or stability releases required prior will bump `PATCH`.
-
-Please note however that we are still pre `1.0.0` so breaking changes can and will happen at any release though we will do our best to document them.
-
-### Breaking: Policy must be valid URLs
-
-Previously, it was allowable to define a policy without a schema (e.g. `http`/`https`). Starting with version `v0.1.0` all `to` and `from` [policy] URLS must contain valid schema and host-names. For example:
-
-```yaml
-policy:
- - from: verify.corp.domain.example
- to: http://verify
- allowed_domains:
- - pomerium.io
- - from: external-verify.corp.domain.example
- to: https://verify.pomerium.com
- allow_public_unauthenticated_access: true
-```
-
-Should now be:
-
-```yaml
-policy:
- - from: https://verify.corp.domain.example
- to: http://verify
- allowed_domains:
- - pomerium.io
- - from: https://external-verify.corp.domain.example
- to: https://verify.pomerium.com
- allow_public_unauthenticated_access: true
-```
-
-## 0.0.5
-
-This page contains the list of deprecations and important or breaking changes for pomerium `v0.0.5` compared to `v0.0.4`. Please read it carefully.
-
-### Breaking: POLICY_FILE removed
-
-Usage of the POLICY_FILE envvar is no longer supported. Support for file based policy configuration has been shifted into the new unified config file.
-
-### Important: Configuration file support added
-
-- Pomerium now supports an optional -config flag. This flag specifies a file from which to read all configuration options. It supports yaml, json, toml and properties formats.
-- All options which can be specified via MY_SETTING style envvars can now be specified within your configuration file as key/value. The key is generally the same as the envvar name, but lower cased. See Reference Documentation for exact names.
-- Options precedence is `environmental variables` > `configuration file` > `defaults`
-- The options file supports a policy key, which contains policy in the same format as `POLICY_FILE`. To convert an existing policy.yaml into a config.yaml, just move your policy under a policy key.
-
- Old:
-
- ```yaml
- - from: verify.localhost.pomerium.io
- to: http://verify
- allowed_domains:
- - pomerium.io
- cors_allow_preflight: true
- timeout: 30s
- ```
-
- New:
-
- ```yaml
- policy:
- - from: verify.localhost.pomerium.io
- to: http://verify
- allowed_domains:
- - pomerium.io
- cors_allow_preflight: true
- timeout: 30s
- ```
-
-### Authenticate Internal Service Address
-
-The configuration variable [Authenticate Internal Service URL] must now be a valid [URL](https://golang.org/pkg/net/url/#URL) type and contain both a hostname and valid `https` schema.
-
-[authenticate internal service url]: /docs/reference/service-urls#authenticate-service-url
-[cache service docs]: /docs/reference/databroker
-[policy]: /docs/reference/routes/policy
-[storage backend configuration here]: /docs/reference/databroker
-[storage backend types]: /docs/reference/databroker
diff --git a/content/docs/courses.mdx b/content/docs/courses.mdx
index b4c79674e..7f9b2f09e 100644
--- a/content/docs/courses.mdx
+++ b/content/docs/courses.mdx
@@ -11,6 +11,6 @@ description: Welcome to Pomerium Fundamentals, a series of courses designed to t
We'll cover routing, policies, TLS certificates, identity verification, and more.
-To get started, complete the [**Quickstart guide**](/docs/quickstart) first.
+To get started, complete the [**Quickstart guide**](/docs/get-started/quickstart) first.
-When you're finished, learn how to [**Build Routes**](/docs/courses/fundamentals/zero-build-routes.mdx) in Pomerium Zero.
+When you're finished, learn how to [**Build Routes**](/docs/get-started/fundamentals/zero/zero-build-routes.mdx) in Pomerium Zero.
diff --git a/content/docs/courses/fundamentals/_category_.json b/content/docs/courses/fundamentals/_category_.json
deleted file mode 100644
index 3d3a48f26..000000000
--- a/content/docs/courses/fundamentals/_category_.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
- "label": "Fundamentals"
-}
diff --git a/content/docs/courses/fundamentals/img/advanced-routes/httpbin-jwt-claims-headers.png b/content/docs/courses/fundamentals/img/advanced-routes/httpbin-jwt-claims-headers.png
deleted file mode 100644
index 691e2654c..000000000
Binary files a/content/docs/courses/fundamentals/img/advanced-routes/httpbin-jwt-claims-headers.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/advanced-routes/node-admin-only.png b/content/docs/courses/fundamentals/img/advanced-routes/node-admin-only.png
deleted file mode 100644
index 8521af43a..000000000
Binary files a/content/docs/courses/fundamentals/img/advanced-routes/node-admin-only.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/advanced-routes/node-hello-world.png b/content/docs/courses/fundamentals/img/advanced-routes/node-hello-world.png
deleted file mode 100644
index a11d83396..000000000
Binary files a/content/docs/courses/fundamentals/img/advanced-routes/node-hello-world.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/advanced-routes/response-header.png b/content/docs/courses/fundamentals/img/advanced-routes/response-header.png
deleted file mode 100644
index e53acb4cf..000000000
Binary files a/content/docs/courses/fundamentals/img/advanced-routes/response-header.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/build-routes/grafana-login-screen.png b/content/docs/courses/fundamentals/img/build-routes/grafana-login-screen.png
deleted file mode 100644
index 90f30458f..000000000
Binary files a/content/docs/courses/fundamentals/img/build-routes/grafana-login-screen.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/get-started/pomerium-file-structure.png b/content/docs/courses/fundamentals/img/get-started/pomerium-file-structure.png
deleted file mode 100644
index 0e39f4580..000000000
Binary files a/content/docs/courses/fundamentals/img/get-started/pomerium-file-structure.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/get-started/verify-state.png b/content/docs/courses/fundamentals/img/get-started/verify-state.png
deleted file mode 100644
index dc1035afe..000000000
Binary files a/content/docs/courses/fundamentals/img/get-started/verify-state.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/jwt-verification/00-root-project-files.png b/content/docs/courses/fundamentals/img/jwt-verification/00-root-project-files.png
deleted file mode 100644
index ffea3fe8c..000000000
Binary files a/content/docs/courses/fundamentals/img/jwt-verification/00-root-project-files.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/jwt-verification/01-jwt-claims.png b/content/docs/courses/fundamentals/img/jwt-verification/01-jwt-claims.png
deleted file mode 100644
index 1cf97ea2d..000000000
Binary files a/content/docs/courses/fundamentals/img/jwt-verification/01-jwt-claims.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/jwt-verification/02-jwt-payload.png b/content/docs/courses/fundamentals/img/jwt-verification/02-jwt-payload.png
deleted file mode 100644
index 6842dbe71..000000000
Binary files a/content/docs/courses/fundamentals/img/jwt-verification/02-jwt-payload.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/jwt-verification/03-jwt-decoded.png b/content/docs/courses/fundamentals/img/jwt-verification/03-jwt-decoded.png
deleted file mode 100644
index 8be315da6..000000000
Binary files a/content/docs/courses/fundamentals/img/jwt-verification/03-jwt-decoded.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/jwt-verification/04-jwt-signature-verified.png b/content/docs/courses/fundamentals/img/jwt-verification/04-jwt-signature-verified.png
deleted file mode 100644
index ff65f2d80..000000000
Binary files a/content/docs/courses/fundamentals/img/jwt-verification/04-jwt-signature-verified.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/production-certificates/autocert-certificate.png b/content/docs/courses/fundamentals/img/production-certificates/autocert-certificate.png
deleted file mode 100644
index 2cf177bd2..000000000
Binary files a/content/docs/courses/fundamentals/img/production-certificates/autocert-certificate.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/self-hosted-pomerium/user-details-page.png b/content/docs/courses/fundamentals/img/self-hosted-pomerium/user-details-page.png
deleted file mode 100644
index e2d93847b..000000000
Binary files a/content/docs/courses/fundamentals/img/self-hosted-pomerium/user-details-page.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-policies/change-and-to-or-operator.gif b/content/docs/courses/fundamentals/img/zero-advanced-policies/change-and-to-or-operator.gif
deleted file mode 100644
index cc0bcf5ff..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-policies/change-and-to-or-operator.gif and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-policies/email-allowlist.png b/content/docs/courses/fundamentals/img/zero-advanced-policies/email-allowlist.png
deleted file mode 100644
index 6bc858c5a..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-policies/email-allowlist.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-policies/email-claim.png b/content/docs/courses/fundamentals/img/zero-advanced-policies/email-claim.png
deleted file mode 100644
index c8b0dc728..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-policies/email-claim.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-policies/matching-domain.png b/content/docs/courses/fundamentals/img/zero-advanced-policies/matching-domain.png
deleted file mode 100644
index 0386be18e..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-policies/matching-domain.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-policies/multiple-deny-blocks.png b/content/docs/courses/fundamentals/img/zero-advanced-policies/multiple-deny-blocks.png
deleted file mode 100644
index 706f6b501..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-policies/multiple-deny-blocks.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-policies/multiple-policies.png b/content/docs/courses/fundamentals/img/zero-advanced-policies/multiple-policies.png
deleted file mode 100644
index 0a87ab26c..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-policies/multiple-policies.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-policies/user-data.png b/content/docs/courses/fundamentals/img/zero-advanced-policies/user-data.png
deleted file mode 100644
index 3f93fdb45..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-policies/user-data.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/add-redirects-in-zero-console.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/add-redirects-in-zero-console.png
deleted file mode 100644
index 92b17f5c0..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/add-redirects-in-zero-console.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/host-rewrite-to-literal-value.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/host-rewrite-to-literal-value.png
deleted file mode 100644
index 10b675323..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/host-rewrite-to-literal-value.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-assertion-header.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-assertion-header.png
deleted file mode 100644
index 088008e9f..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-assertion-header.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-claim-headers.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-claim-headers.png
deleted file mode 100644
index 1f8fdf8ae..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-claim-headers.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-claims-response.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-claims-response.png
deleted file mode 100644
index b6e4a5923..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/jwt-claims-response.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/node-server-route.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/node-server-route.png
deleted file mode 100644
index 4b50d7d69..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/node-server-route.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/nodeserver-prefix-rewrite-setting.gif b/content/docs/courses/fundamentals/img/zero-advanced-routes/nodeserver-prefix-rewrite-setting.gif
deleted file mode 100644
index aa2178d9e..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/nodeserver-prefix-rewrite-setting.gif and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/nodeserver-prefix-setting.gif b/content/docs/courses/fundamentals/img/zero-advanced-routes/nodeserver-prefix-setting.gif
deleted file mode 100644
index 1e2b9fa8e..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/nodeserver-prefix-setting.gif and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/pz-redirect.gif b/content/docs/courses/fundamentals/img/zero-advanced-routes/pz-redirect.gif
deleted file mode 100644
index 8230462ae..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/pz-redirect.gif and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/server-endpoints.gif b/content/docs/courses/fundamentals/img/zero-advanced-routes/server-endpoints.gif
deleted file mode 100644
index 795cc4912..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/server-endpoints.gif and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/set-and-remove-headers-response-body.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/set-and-remove-headers-response-body.png
deleted file mode 100644
index aba9b68b3..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/set-and-remove-headers-response-body.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-advanced-routes/set-and-remove-request-headers.png b/content/docs/courses/fundamentals/img/zero-advanced-routes/set-and-remove-request-headers.png
deleted file mode 100644
index b82edf367..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-advanced-routes/set-and-remove-request-headers.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-idp/idp-flow.gif b/content/docs/courses/fundamentals/img/zero-idp/idp-flow.gif
deleted file mode 100644
index 5e6b696d7..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-idp/idp-flow.gif and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-idp/zero-idp-settings.png b/content/docs/courses/fundamentals/img/zero-idp/zero-idp-settings.png
deleted file mode 100644
index 84763f2fd..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-idp/zero-idp-settings.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-editor.png b/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-editor.png
deleted file mode 100644
index 953e669bb..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-editor.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-example-1.png b/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-example-1.png
deleted file mode 100644
index d38dd0a17..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-example-1.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-example-2.png b/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-example-2.png
deleted file mode 100644
index fceebdb75..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-policies/pz-courses-ppl-example-2.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-routes/from-and-to-urls.png b/content/docs/courses/fundamentals/img/zero-routes/from-and-to-urls.png
deleted file mode 100644
index d362630aa..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-routes/from-and-to-urls.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-routes/pz-courses-first-route.png b/content/docs/courses/fundamentals/img/zero-routes/pz-courses-first-route.png
deleted file mode 100644
index 5b2d3e977..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-routes/pz-courses-first-route.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-routes/pz-courses-route-details.png b/content/docs/courses/fundamentals/img/zero-routes/pz-courses-route-details.png
deleted file mode 100644
index bb7bf5b43..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-routes/pz-courses-route-details.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-sso/jwt-flow.svg b/content/docs/courses/fundamentals/img/zero-sso/jwt-flow.svg
deleted file mode 100644
index 0028bd114..000000000
--- a/content/docs/courses/fundamentals/img/zero-sso/jwt-flow.svg
+++ /dev/null
@@ -1 +0,0 @@
-
\ No newline at end of file
diff --git a/content/docs/courses/fundamentals/img/zero-sso/pz-courses-apply-pass-id-headers.gif b/content/docs/courses/fundamentals/img/zero-sso/pz-courses-apply-pass-id-headers.gif
deleted file mode 100644
index d1b0b9c54..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-sso/pz-courses-apply-pass-id-headers.gif and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-sso/pz-courses-jwt-synced.png b/content/docs/courses/fundamentals/img/zero-sso/pz-courses-jwt-synced.png
deleted file mode 100644
index 509fe967c..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-sso/pz-courses-jwt-synced.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-tcp/redis-service.png b/content/docs/courses/fundamentals/img/zero-tcp/redis-service.png
deleted file mode 100644
index 6663299e9..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-tcp/redis-service.png and /dev/null differ
diff --git a/content/docs/courses/fundamentals/img/zero-tcp/ssh-server.png b/content/docs/courses/fundamentals/img/zero-tcp/ssh-server.png
deleted file mode 100644
index 36388be52..000000000
Binary files a/content/docs/courses/fundamentals/img/zero-tcp/ssh-server.png and /dev/null differ
diff --git a/content/docs/deploy/clients/clients.mdx b/content/docs/deploy/clients/clients.mdx
new file mode 100644
index 000000000..cde65ae36
--- /dev/null
+++ b/content/docs/deploy/clients/clients.mdx
@@ -0,0 +1,442 @@
+---
+description: 'Consolidated guide to installing Pomerium CLI/Desktop and configuring TCP+UDP routes in Pomerium.'
+sidebar_label: 'Clients for TCP & UDP'
+title: 'Pomerium Clients for Tunneling Non-HTTP Protocols'
+keywords:
+ [
+ pomerium,
+ tcp,
+ udp,
+ connect,
+ connect-udp,
+ non-http,
+ identity access proxy,
+ zero trust,
+ cli,
+ desktop,
+ rdp,
+ ssh,
+ database,
+ redis,
+ mysql,
+ dns,
+ bastion,
+ policy,
+ ]
+lang: en-US
+---
+
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+import LongLivedConnections from '@site/content/docs/admonitions/_long-lived-connections.mdx';
+
+# Pomerium Clients for Tunneling Non-HTTP Protocols
+
+Pomerium can secure non-HTTP protocols such as SSH, RDP, MySQL, Redis, or DNS with the same identity-aware policy enforcement used for HTTP. This document merges several references to provide a comprehensive guide covering:
+
+- **TCP Over HTTP** and **UDP Over HTTP** capabilities
+- How to configure **routes** for TCP and UDP
+- **Pomerium CLI** and **Desktop** usage and installation details
+- Advanced configurations, best practices, and enterprise considerations
+
+
+
+Pomerium's non-HTTP proxying allows you to secure SSH, MySQL, DNS, or any other TCP/UDP-based service behind Pomerium's identity-aware access control. When a user connects through **Pomerium CLI** or **Pomerium Desktop**, they:
+
+1. Are redirected to the IdP to authenticate (if they aren't already).
+2. Receive an authorized tunnel for the requested port/protocol.
+3. Enjoy zero trust-style security without needing a separate VPN or dedicated tunnels.
+
+### Why Use Pomerium for TCP and UDP?
+
+- **Single Sign-On (SSO)**: Unified authentication with your existing IdP.
+- **Granular Authorization**: Leverage Pomerium's policies (e.g. allow by email, group membership).
+- **Audit & Visibility**: Centralize logs and control for non-HTTP traffic.
+- **Consistent Security**: Enforce the same policies for both HTTP and non-HTTP connections.
+
+## Install Pomerium CLI and Desktop
+
+Pomerium offers a command-line interface (CLI) and a graphical Desktop client for connecting to non-HTTP routes.
+
+### CLI Installation
+
+
+
+
+```bash
+ARCH=[your-arch]
+OS=[your-os]
+VERSION=[desired-version]
+curl -L https://github.com/pomerium/cli/releases/download/${VERSION}/pomerium-cli-${OS}-${ARCH}.tar.gz \
+ | tar -z -x
+```
+
+See [GitHub Releases](https://github.com/pomerium/cli/releases) for a full list.
+
+
+
+
+
+Install from [Cloudsmith](https://cloudsmith.io/~pomerium/repos/pomerium/packages/) or GitHub:
+
+```abnf title="/etc/yum.repos.d/pomerium-cli.repo"
+[pomerium-pomerium]
+name=pomerium-pomerium
+baseurl=https://dl.cloudsmith.io/public/pomerium/pomerium/rpm/el/$releasever/$basearch
+repo_gpgcheck=1
+enabled=1
+gpgkey=https://dl.cloudsmith.io/public/pomerium/pomerium/gpg.6E388440B94E1407.key
+gpgcheck=1
+sslverify=1
+pkg_gpgcheck=1
+```
+
+
+
+
+
+```bash
+brew tap pomerium/tap
+brew install pomerium-cli
+```
+
+
+
+
+
+```bash
+docker run pomerium.com/pomerium/cli:latest --version
+```
+
+
+
+
+
+```bash
+git clone https://github.com/pomerium/cli.git
+cd cli
+make build
+./bin/pomerium-cli --help
+```
+
+
+
+
+### Desktop Installation
+
+
+
+
+Download the `.exe` from [Desktop Releases](https://github.com/pomerium/desktop-client/releases).
+Run the installer. Right-click the tray icon to manage connections.
+
+
+
+
+```bash
+brew tap pomerium/tap
+brew install pomerium-desktop
+```
+
+Or download the `.dmg` and drag it into Applications. Interact with it via the menu bar icon.
+
+
+
+
+Download the `.AppImage` from [Desktop Releases](https://github.com/pomerium/desktop-client/releases).
+Execute it in place or use [AppImageLauncher](https://github.com/TheAssassin/AppImageLauncher). Manage connections from the system tray icon.
+
+
+
+
+## Create TCP Routes
+
+
+
+Use `tcp+https://` in the route **From** field and `tcp://` in **To**. Example:
+
+```yaml
+routes:
+ - from: tcp+https://redis.corp.example.com:6379
+ to: tcp://redis.internal.example.com:6379
+ policy:
+ - allow:
+ or:
+ - email:
+ is: contractor@notexample.com
+ - claim/groups: 'datascience@example.com'
+```
+
+Points to remember:
+
+- HTTP-specific settings (like `regex_rewrite_pattern`) do not apply to TCP routes.
+- Pomerium encrypts traffic from user to proxy. If you want full end-to-end encryption, ensure the upstream also runs TLS or mTLS.
+- The port in **From** (e.g., `:6379`) differentiates multiple routes on the same domain, even though requests typically arrive on port `443`.
+
+
+
+
+Create a **New Route** and select **TCP**. Fill in **From** (for example, `tcp+https://ssh.example.com:22`) and **To** (`tcp://127.0.0.1:22`), then define policy. Click **Publish** to apply changes.
+
+![Example TCP route for SSH](./img/tcp-ssh-route.png)
+
+
+
+
+Set **From** = `tcp+https://`..., define a port (e.g. `:22`).
+![Creating a TCP route in the Zero Console](./img/desktop/zero-ssh-route-example.png)
+
+
+
+
+```yaml
+- from: tcp+https://ssh.localhost.pomerium.io:22
+ to: tcp://127.0.0.1:22
+ policy:
+ - allow:
+ or:
+ - email:
+ is: user@yourcompany.com
+```
+
+
+
+
+:::info
+
+Long-lived
+
+connections
+
+
+:::
+
+### Advanced TCP Usage
+
+
+
+#### Listen configuration
+
+When using the CLI, specify `--listen` to set a custom local address/port. If you use `-`, the CLI pipes STDIN/STDOUT directly (useful for `ssh -o ProxyCommand`).
+
+#### Bastion host style
+
+If the route is not publicly resolvable or Pomerium is on a non-standard port:
+
+```yaml
+from: tcp+https://proxy.corp.example.com:8443/redis.internal.example.com:6379
+```
+
+Then:
+
+```bash
+pomerium-cli tcp tcp+https://proxy.corp.example.com:8443/redis.internal.example.com:6379
+```
+
+#### Proxy chaining
+
+If you want Pomerium to send an HTTP CONNECT to another proxy, use an HTTP scheme in **To**:
+
+```yaml
+routes:
+ - from: tcp+https://example.corp.com:10002
+ to: http://another-proxy.corp.com:10003
+```
+
+## Create UDP Routes
+
+Starting with v0.29, Pomerium supports UDP. Use `udp+https://` in **From** and `udp://` in **To**:
+
+```yaml
+routes:
+ - from: udp+https://time.corp.example.com:13
+ to: udp://time.internal.example.com:13
+ policy:
+ - allow:
+ or:
+ - email:
+ is: contractor@notexample.com
+ - claim/groups: 'datascience@example.com'
+```
+
+- `CONNECT-UDP` is used internally, so no HTTP-specific settings apply.
+- The port in **From** (e.g. `:13`) is for route selection; inbound traffic is usually on `443`.
+- Latency can matter for DNS or real-time apps. Keep Pomerium near users to minimize round-trip times.
+
+## Connecting via Pomerium CLI
+
+### TCP Example
+
+```bash
+pomerium-cli tcp ssh.example.com:22
+# listening on 127.0.0.1:52672
+ssh 127.0.0.1 -p 52672
+```
+
+Or set your own local port:
+
+```bash
+pomerium-cli tcp ssh.example.com:22 --listen :2222
+ssh 127.0.0.1 -p 2222
+```
+
+If you are not logged in yet, your browser opens for IdP authentication.
+
+#### SSH ProxyCommand
+
+```bash
+ssh -o ProxyCommand='pomerium-cli tcp --listen - %h:%p' ssh.example.com
+```
+
+### UDP Example
+
+```bash
+pomerium-cli udp dns.example.com:53
+# listening on 127.0.0.1:52544
+dig @127.0.0.1 -p 52544 google.com
+```
+
+```shell
+pomerium-cli tcp [destination] [flags]
+```
+
+### Flags
+
+| Flags | Description | Type |
+| :-- | :-- | --- |
+| #--alternate-ca-path | Path to CA certificate to use for HTTP requests. | string |
+| #--browser-cmd | Custom browser command to run when opening a URL. | string |
+| #--ca-cert | Path to CA certificate to use for HTTP requests. | string |
+| #--client-cert | (optional) PEM-encoded client certificate. | string |
+| # --client-key | (optional) PEM-encoded client certificate key. | string |
+| # --client-cert-from-store | (optional) If provided, pomerium-cli will attempt to use a client certificate from the system trust store (macOS and Windows only), searching for a certificate based on the trusted CA names advertised by Pomerium in the TLS handshake. | none |
+| # --client-cert-issuer | (optional) When used in combination with --client-cert-from-store, restricts the client certificate search based on a particular attribute of the certificate's [Issuer name](#certificate-name-filters). | string |
+| # --client-cert-subject | (optional) When used in combination with --client-cert-from-store, restricts the client certificate search based on a particular attribute of the certificate's [Subject name](#certificate-name-filters). | string |
+| #--disable-tls-verification | Disables TLS verification. | none |
+| #-h, --help | Help for tcp. | none |
+| #--listen | Local address to start a listener on (default "127.0.0.1:0"). | string |
+| #--pomerium-url | The URL of the Pomerium server to connect to. | string |
+| #-v, --version | Version for pomerium-cli. | none |
+
+#### Certificate name filters
+
+The certificate name filter syntax is `attribute=value`. A name filter can accept only one name attribute. The value must be an exact match (not a substring match). Make sure to quote name filters as appropriate for your shell.
+
+For example, `--client-cert-issuer "CN=My Trusted CA"` would filter for a certificate directly issued by a CA with the Common Name "My Trusted CA".
+
+Or, `--client-cert-subject "OU=My Department"` would filter for a certificate whose Subject name contains the Organizational Unit Name "My Department".
+
+The supported name attributes are:
+
+- commonName (CN)
+- countryName (C)
+- localityName (L)
+- organizationName (O)
+- organizationalUnitName (OU)
+- postalCode
+- serialNumber
+- stateOrProvinceName (ST)
+- streetAddress (STREET)
+
+Either the long or abbreviated attribute name may be used (for example, `localityName=New York` or `L=New York`).
+
+Values are case sensitive: `L=new york` will not match the Locality Name "New York".
+
+### Desktop client steps
+
+If you haven't, install [Pomerium Desktop](/docs/deploy/clients).
+
+Then, add a connection by filling in the fields defined below:
+
+- **Name**: A local name for the route
+- **Destination**: Matches the [From](/docs/reference/routes/from) value of the route, without the protocol. Always include the port specified in the route, and do not include the `https://` protocol.
+- **Local Address**: The local address and port number from which to access the service locally. If left blank, the client will choose a random port to listen to on the loopback address.
+- **Tags**: Customizable tags to sort and organize TCP routes
+
+![Adding a new connection in the Pomerium Desktop client](./img/desktop/desktop-new-connection.png)
+
+#### Advanced Settings
+
+- **Pomerium URL**: The Pomerium Proxy service address. This is required if the **Destination URL** can't be resolved from DNS or a local `hosts` entry, or if the Proxy service uses a non-standard port.
+- **Disable TLS Verification**: Allows untrusted certificates from the Pomerium gateway
+- **Client Certificates**: For routes that enforce [mTLS](/docs/internals/mutual-auth), you can **set a client certificate manually** or automatically [**search the OS certificate store**](/docs/capabilities/non-http#client-certificates) for a trusted certificate (note: macOS and Windows only).
+
+![Reviewing the Advanced Settings in the Pomerium Desktop client](./img/desktop/advanced-settings.png)
+
+### Pomerium CLI steps
+
+If you haven't, install [Pomerium CLI](/docs/deploy/clients).
+
+Then, connect to a TCP route:
+
+1. Invoke `pomerium-cli` with the `tcp` option, and provide the route to your service (as defined in [`from`](/docs/reference/routes/from) in your Route specification).
+
+ ```shell-session
+ $ pomerium-cli tcp ssh.localhost.pomerium.io:22
+ 2023/10/02 11:29:22 listening on 127.0.0.1:53656
+ ```
+
+ You can optionally supply an address and/or port to the `listen` flag:
+
+ ```shell-session
+ $ pomerium-cli tcp ssh.localhost.pomerium.io:22 --listen :2222
+ 2023/10/02 11:30:03 listening on [::]:2222
+ ```
+
+1. Connect to your service using the local address and port specified in the output of `pomerium-cli`:
+
+ ```bash
+ ssh 127.0.0.1 -p 2222
+ ```
+
+1. When the connection starts, the CLI will open your browser and direct you to your Identity Provider to authenticate your session. Once authenticated, the connection will continue and you can close the browser window.
+
+1. In this example, since we are using SSH we can consolidate the TCP and SSH connections into a single command:
+
+ ```bash
+ ssh -o ProxyCommand='pomerium-cli tcp --listen - %h:%p' ssh.localhost.pomerium.io
+ ```
+
+## Best Practices
+
+- **mTLS**
+ If the upstream requires mutual TLS, both CLI and Desktop can supply client certs.
+- **Multiple services on one domain**
+ Use different ports in **From** (e.g. `:22`, `:6379`, `:3306`, `:53`).
+- **Performance**
+ For latency-sensitive protocols (like DNS over UDP), minimize round trips by placing Pomerium near users.
+- **Logging and Audit**
+ Pomerium logs each connection attempt, including identity. This provides an audit trail.
+- **Long-lived sessions**
+ Non-HTTP connections remain open as long as your Pomerium session is valid.
+
+## Further Reading
+
+- [TCP Non-HTTP Reference](/docs/capabilities/non-http/tcp)
+- [UDP Non-HTTP Reference](/docs/capabilities/non-http/udp)
+- [Mutual Authentication](/docs/internals/mutual-auth)
+- [CLI Releases](https://github.com/pomerium/cli/releases)
+- [Desktop Releases](https://github.com/pomerium/desktop-client/releases)
+
+Pomerium unifies access for HTTP, TCP, and UDP behind a single identity-based control plane. This gives you SSO, granular authorization, and consistent security logs for all your applications and services, without needing a separate VPN or manual tunnels.
diff --git a/content/docs/deploy/clients/img/desktop/advanced-settings.png b/content/docs/deploy/clients/img/desktop/advanced-settings.png
new file mode 100644
index 000000000..3a73e16f7
Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/advanced-settings.png differ
diff --git a/content/docs/deploy/clients/img/desktop/desktop-new-connection.png b/content/docs/deploy/clients/img/desktop/desktop-new-connection.png
new file mode 100644
index 000000000..51d8b9fe0
Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/desktop-new-connection.png differ
diff --git a/content/docs/deploy/clients/img/desktop/example-git-connection.png b/content/docs/deploy/clients/img/desktop/example-git-connection.png
new file mode 100644
index 000000000..c90001813
Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/example-git-connection.png differ
diff --git a/content/docs/deploy/clients/img/desktop/example-mssql-connection.png b/content/docs/deploy/clients/img/desktop/example-mssql-connection.png
new file mode 100644
index 000000000..80718a4de
Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/example-mssql-connection.png differ
diff --git a/content/docs/deploy/clients/img/desktop/example-mysql-connection.png b/content/docs/deploy/clients/img/desktop/example-mysql-connection.png
new file mode 100644
index 000000000..44b37363b
Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/example-mysql-connection.png differ
diff --git a/content/docs/deploy/clients/img/desktop/example-rdp-connection.png b/content/docs/deploy/clients/img/desktop/example-rdp-connection.png
new file mode 100644
index 000000000..b140df34e
Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/example-rdp-connection.png differ
diff --git a/content/docs/deploy/clients/img/desktop/example-redis-connection.png b/content/docs/deploy/clients/img/desktop/example-redis-connection.png
new file mode 100644
index 000000000..9801ba477
Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/example-redis-connection.png differ
diff --git a/content/docs/deploy/clients/img/desktop/example-ssh-connection.png b/content/docs/deploy/clients/img/desktop/example-ssh-connection.png
new file mode 100644
index 000000000..24a867b77
Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/example-ssh-connection.png differ
diff --git a/content/docs/deploy/clients/img/desktop/new-ssh-connection.png b/content/docs/deploy/clients/img/desktop/new-ssh-connection.png
new file mode 100644
index 000000000..85ec26998
Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/new-ssh-connection.png differ
diff --git a/content/docs/deploy/clients/img/desktop/pomerium-desktop-postgres.png b/content/docs/deploy/clients/img/desktop/pomerium-desktop-postgres.png
new file mode 100644
index 000000000..8c3084793
Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/pomerium-desktop-postgres.png differ
diff --git a/content/docs/deploy/clients/img/desktop/zero-ssh-route-example.png b/content/docs/deploy/clients/img/desktop/zero-ssh-route-example.png
new file mode 100644
index 000000000..c77967d23
Binary files /dev/null and b/content/docs/deploy/clients/img/desktop/zero-ssh-route-example.png differ
diff --git a/content/docs/deploy/clients/img/tcp-ssh-route.png b/content/docs/deploy/clients/img/tcp-ssh-route.png
new file mode 100644
index 000000000..88562a3a3
Binary files /dev/null and b/content/docs/deploy/clients/img/tcp-ssh-route.png differ
diff --git a/content/docs/zero/billing.md b/content/docs/deploy/cloud/billing.md
similarity index 90%
rename from content/docs/zero/billing.md
rename to content/docs/deploy/cloud/billing.md
index 17af1d3e0..8190eac45 100644
--- a/content/docs/zero/billing.md
+++ b/content/docs/deploy/cloud/billing.md
@@ -75,9 +75,9 @@ See the [Pricing page](https://www.pomerium.com/pricing) for a thorough breakdow
At some point, you may require higher quotas to accommodate your use case.
-If you’re using a professional account and you need to increase the quota for a given entity, [contact us](/docs/community). We will increase quotas on an as-needed basis.
+If you're using a professional account and you need to increase the quota for a given entity contact us. We will increase quotas on an as-needed basis.
-If you’re using a personal account, you must upgrade to increase quotas.
+If you're using a personal account, you must upgrade to increase quotas.
## How billing works
@@ -150,10 +150,10 @@ Upgrading does not replace your personal account. It creates an additional profe
### Downgrade subscription
-You can downgrade your subscription from a Business plan to a Free plan. If you do, you’ll be charged at the end of the billing period for any usage up to the time you downgraded.
+You can downgrade your subscription from a Business plan to a Free plan. If you do, you'll be charged at the end of the billing period for any usage up to the time you downgraded.
### Missed payments
-If you can’t pay your bill for any reason, your subscription will lapse and Pomerium Zero will switch into read-only mode. In read-only mode, your clusters will continue to work, but you won’t be able to make changes to your configuration.
+If you can't pay your bill for any reason, your subscription will lapse and Pomerium Zero will switch into read-only mode. In read-only mode, your clusters will continue to work, but you won't be able to make changes to your configuration.
When Pomerium receives full payment for any outstanding bills under your account, you can resume using Pomerium Zero as normal.
diff --git a/content/docs/deploy/cloud/img/billing/billing-org-dropdown.png b/content/docs/deploy/cloud/img/billing/billing-org-dropdown.png
new file mode 100644
index 000000000..738a7ac71
Binary files /dev/null and b/content/docs/deploy/cloud/img/billing/billing-org-dropdown.png differ
diff --git a/content/docs/deploy/cloud/img/billing/zero-pay-wall.png b/content/docs/deploy/cloud/img/billing/zero-pay-wall.png
new file mode 100644
index 000000000..8e67f21a2
Binary files /dev/null and b/content/docs/deploy/cloud/img/billing/zero-pay-wall.png differ
diff --git a/content/docs/deploy/cloud/img/billing/zero-usage-dash.png b/content/docs/deploy/cloud/img/billing/zero-usage-dash.png
new file mode 100644
index 000000000..6e4769d30
Binary files /dev/null and b/content/docs/deploy/cloud/img/billing/zero-usage-dash.png differ
diff --git a/content/docs/deploy/cloud/img/core-to-zero/add-cluster.png b/content/docs/deploy/cloud/img/core-to-zero/add-cluster.png
new file mode 100644
index 000000000..57afe3c8b
Binary files /dev/null and b/content/docs/deploy/cloud/img/core-to-zero/add-cluster.png differ
diff --git a/content/docs/deploy/cloud/img/core-to-zero/docker-import-command.png b/content/docs/deploy/cloud/img/core-to-zero/docker-import-command.png
new file mode 100644
index 000000000..7958f7e31
Binary files /dev/null and b/content/docs/deploy/cloud/img/core-to-zero/docker-import-command.png differ
diff --git a/content/docs/deploy/cloud/img/core-to-zero/import-existing-config-button.png b/content/docs/deploy/cloud/img/core-to-zero/import-existing-config-button.png
new file mode 100644
index 000000000..deebd524b
Binary files /dev/null and b/content/docs/deploy/cloud/img/core-to-zero/import-existing-config-button.png differ
diff --git a/content/docs/deploy/cloud/img/core-to-zero/import-successful.png b/content/docs/deploy/cloud/img/core-to-zero/import-successful.png
new file mode 100644
index 000000000..08c650dd0
Binary files /dev/null and b/content/docs/deploy/cloud/img/core-to-zero/import-successful.png differ
diff --git a/content/docs/deploy/cloud/img/core-to-zero/import-terminal-command.png b/content/docs/deploy/cloud/img/core-to-zero/import-terminal-command.png
new file mode 100644
index 000000000..044d33ba5
Binary files /dev/null and b/content/docs/deploy/cloud/img/core-to-zero/import-terminal-command.png differ
diff --git a/content/docs/deploy/cloud/img/core-to-zero/zero-onboarding-import-ui.png b/content/docs/deploy/cloud/img/core-to-zero/zero-onboarding-import-ui.png
new file mode 100644
index 000000000..1c0a5ddd1
Binary files /dev/null and b/content/docs/deploy/cloud/img/core-to-zero/zero-onboarding-import-ui.png differ
diff --git a/content/docs/zero/import.mdx b/content/docs/deploy/cloud/import.mdx
similarity index 98%
rename from content/docs/zero/import.mdx
rename to content/docs/deploy/cloud/import.mdx
index fa7fd9673..ad99158be 100644
--- a/content/docs/zero/import.mdx
+++ b/content/docs/deploy/cloud/import.mdx
@@ -40,7 +40,7 @@ This guide shows you how to import an existing Core configuration to Pomerium Ze
To complete this guide, you need a:
- [Pomerium Zero](https://console.pomerium.app/create-account) account
-- [Pomerium Core](/docs/core/quickstart) configuration
+- [Pomerium Core](/docs/get-started/fundamentals/core/get-started) configuration
:::note
diff --git a/content/docs/zero/install.mdx b/content/docs/deploy/cloud/install.mdx
similarity index 94%
rename from content/docs/zero/install.mdx
rename to content/docs/deploy/cloud/install.mdx
index a7611c819..0914a6112 100644
--- a/content/docs/zero/install.mdx
+++ b/content/docs/deploy/cloud/install.mdx
@@ -68,7 +68,7 @@ Save the following configuration as `compose.yaml`:
```yaml title="compose.yaml"
services:
pomerium:
- image: pomerium/pomerium:v0.28.0
+ image: pomerium/pomerium:latest
ports:
- 443:443
restart: always
@@ -82,7 +82,7 @@ services:
aliases:
- verify..pomerium.app
verify:
- image: cr.pomerium.com/pomerium/verify:latest
+ image: pomerium.com/pomerium/verify:latest
networks:
main:
aliases:
@@ -137,7 +137,7 @@ helm upgrade pomerium-zero oci://docker.io/pomerium/pomerium-zero \
:::note
-In v0.27, we updated the Kubernetes installation manifest to use a Deployment instead of a StatefulSet. Before upgrading, you must remove your existing StatefulSet. See the [v0.27 Upgrade guide](/docs/core/upgrading#upgrading-pomerium-zero-deployments-in-kubernetes) for specific instructions.
+In v0.27, we updated the Kubernetes installation manifest to use a Deployment instead of a StatefulSet. Before upgrading, you must remove your existing StatefulSet. See the [v0.27 Upgrade guide](/docs/deploy/upgrading.mdx#upgrading-pomerium-zero-deployments-in-kubernetes) for specific instructions.
:::
@@ -156,7 +156,7 @@ To update Pomerium in Docker:
```yaml
pomerium:
- image: pomerium/pomerium:v0.28.0
+ image: pomerium/pomerium:latest
```
1. Run the following command:
@@ -168,7 +168,7 @@ $ docker compose up -d
Docker should automatically pull the new image of Pomerium before running the container. If for some reason Docker doesn't pull the image, you can manually run:
```bash
-$ docker pull pomerium/pomerium:v0.28.0
+$ docker pull pomerium/pomerium:latest
```
diff --git a/content/docs/deploy/core.mdx b/content/docs/deploy/core.mdx
new file mode 100644
index 000000000..9c715d8ae
--- /dev/null
+++ b/content/docs/deploy/core.mdx
@@ -0,0 +1,192 @@
+---
+title: 'Pomerium Core (Self-managed)'
+description: 'Learn how to obtain, configure, and run the open-source Pomerium server through pre-built binaries, Linux packages, Docker images, or building from source.'
+sidebar_label: 'Pomerium Core'
+lang: en-US
+keywords:
+ - pomerium
+ - server
+ - proxy
+ - context-aware proxy
+ - open source
+ - identity aware proxy
+ - deployment
+ - pre-built binaries
+ - from source
+ - reverse proxy
+sidebar_position: 1
+pagination_prev: null
+pagination_next: null
+---
+
+# Pomerium Core (Self-managed)
+
+Pomerium Core (often referred to as _Pomerium Open Source_) is the primary server component in a self-hosted environment. All other Pomerium products build upon it. This document describes several ways to install and run Pomerium Core:
+
+1. **Pre-Built Binaries** (manual or OS-package installations)
+2. **Docker Images**
+3. **Building from Source**
+
+## Pre-Built Binaries
+
+We publish official binaries for Linux and macOS on our [GitHub Releases](https://github.com/pomerium/pomerium/releases) page, as well as OS packages (`deb` and `rpm`) via [Cloudsmith](https://cloudsmith.io/~pomerium/repos/pomerium/packages/).
+
+### Standalone Binary
+
+1. **Download**
+ Go to [GitHub Releases](https://github.com/pomerium/pomerium/releases) and look for the tarball corresponding to your operating system and architecture. For example:
+
+ ```bash
+ ARCH=[amd64 or arm64]
+ OS=[linux or darwin]
+ VERSION=[desired version]
+ curl -L https://github.com/pomerium/pomerium/releases/download/${VERSION}/pomerium-${OS}-${ARCH}.tar.gz \
+ | tar -z -x
+ ```
+
+2. **Run**
+ Once extracted, you have a `pomerium` binary. Supply configuration via environment variables or a config file:
+
+ ```bash
+ ./pomerium -config config.yaml
+ ```
+
+### Linux Packages
+
+We provide OS packages via [Cloudsmith](https://cloudsmith.io/~pomerium/repos/pomerium/setup/). Supported formats:
+
+- `rpm` (Yum, DNF)
+- `deb` (Apt)
+
+For example, to add a Yum repo (`rpm`-based):
+
+```abnf title="/etc/yum.repos.d/pomerium-pomerium.repo"
+[pomerium-pomerium]
+name=pomerium-pomerium
+baseurl=https://dl.cloudsmith.io/public/pomerium/pomerium/rpm/el/$releasever/$basearch
+repo_gpgcheck=1
+enabled=1
+gpgkey=https://dl.cloudsmith.io/public/pomerium/pomerium/gpg.6E388440B94E1407.key
+gpgcheck=1
+sslverify=1
+pkg_gpgcheck=1
+```
+
+Or for Debian/Ubuntu (`deb`-based):
+
+```bash
+curl -1sLf 'https://dl.cloudsmith.io/public/pomerium/pomerium/gpg.6E388440B94E1407.key' | apt-key add -
+echo "deb https://dl.cloudsmith.io/public/pomerium/pomerium/deb/debian buster main" > /etc/apt/sources.list.d/pomerium-pomerium.list
+```
+
+Then install Pomerium via your package manager:
+
+```bash
+# For yum-based systems:
+yum install pomerium
+
+# For apt-based systems:
+apt-get update && apt-get install pomerium
+```
+
+## Docker Images
+
+We also provide container images on [Docker Hub](https://hub.docker.com/r/pomerium/pomerium) and [GitHub Packages](https://github.com/pomerium/pomerium/pkgs/container/pomerium). Common tags:
+
+- **`:latest`** → The most recent stable release
+- **`:vX.Y.Z`** → A specific release
+- **`:main`** → Nightly builds from the main branch
+- **`:nonroot-*`** → Variants that run Pomerium as a `nonroot` user
+- **`:debug-*`** → Variants that include extra debugging utilities
+
+Example usage:
+
+```bash
+docker pull pomerium/pomerium:latest
+docker run --rm -it -p 443:443 pomerium/pomerium:latest --version
+```
+
+If you plan to run on port 443 in a rootless environment, you may need extra [capabilities](https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/) or choose a non-privileged port.
+
+## Building From Source (~~Hard~~ Fun mode!)
+
+If you prefer building from source:
+
+1. **Clone the Repository**
+ ```bash
+ git clone https://github.com/pomerium/pomerium.git $HOME/pomerium
+ cd $HOME/pomerium
+ ```
+2. **(Optional) Generate Local Certs**
+ For local development, use [mkcert](https://mkcert.dev/):
+ ```bash
+ go install filippo.io/mkcert@latest
+ mkcert -install
+ mkcert '*.localhost.pomerium.io'
+ ```
+3. **Build**
+ ```bash
+ make
+ ```
+ This compiles the `pomerium` binary under `./bin`. If you don't have test prerequisites installed (Docker, Redis, etc.), run `make build` to skip them.
+4. **Run**
+ ```bash
+ ./bin/pomerium -config config.yaml
+ ```
+
+## Configuration
+
+Pomerium is configured via [configuration variables](/docs/reference) (environment variables) or a YAML file (`config.yaml`). Below is a minimal example referencing a single route and an identity provider:
+
+```yaml title="config.yaml"
+# Minimal example route
+shared_secret: REPLACE_ME
+cookie_secret: REPLACE_ME
+idp_provider: google
+idp_client_id: REPLACE_ME
+idp_client_secret: REPLACE_ME
+address: :443
+
+routes:
+ - from: https://verify.localhost.pomerium.io
+ to: https://verify.pomerium.com
+ policy:
+ - allow:
+ or:
+ - domain:
+ is: myorg.com
+```
+
+:::info
+
+For local testing, specify the `certificate_file` and `certificate_key_file` if using mkcert or other local certs. In production, you may rely on Let's Encrypt or external cert manager. See [TLS certificates](/docs/internals/certificates-and-tls) for details.
+
+:::
+
+## Running Pomerium
+
+### Systemd Service (OS Packages)
+
+If you installed via `rpm` or `deb`, we ship a systemd service unit:
+
+1. **Bind to Port 443**
+ Allow the `pomerium` service to listen on a privileged port:
+ ```bash
+ echo -e "[Service]\nAmbientCapabilities=CAP_NET_BIND_SERVICE" | sudo SYSTEMD_EDITOR=tee systemctl edit pomerium
+ ```
+2. **Enable & Start**
+ ```bash
+ sudo systemctl enable --now pomerium.service
+ ```
+
+### Manual Launch
+
+If using the standalone binary (or building from source):
+
+```bash
+./pomerium -config config.yaml
+```
+
+Any environment variables or custom settings can be set before this command.
+
+Once deployed and configured, you can verify that Pomerium is running by accessing the domain of one of your routes. If your logs show successful user authentication, you're ready to protect more apps with Pomerium Core.
diff --git a/content/docs/enterprise/_category_.json b/content/docs/deploy/enterprise/_category_.json
similarity index 100%
rename from content/docs/enterprise/_category_.json
rename to content/docs/deploy/enterprise/_category_.json
diff --git a/content/docs/enterprise/configure-metrics.mdx b/content/docs/deploy/enterprise/configure-metrics.mdx
similarity index 88%
rename from content/docs/enterprise/configure-metrics.mdx
rename to content/docs/deploy/enterprise/configure-metrics.mdx
index ad3d69d33..c9025ad5c 100644
--- a/content/docs/enterprise/configure-metrics.mdx
+++ b/content/docs/deploy/enterprise/configure-metrics.mdx
@@ -20,8 +20,8 @@ This guide explains what the [external](#external-prometheus) and [embedded](#em
To complete this guide, you need:
-- [Pomerium Enterprise](/docs/enterprise)
-- [Pomerium Core](/docs/core)
+- [Pomerium Enterprise](/docs/deploy/enterprise)
+- [Pomerium Core](/docs/deploy/core)
This guide runs both Pomerium instances on localhost (`127.0.0.1`).
@@ -71,7 +71,7 @@ For production deployments, we suggest using a dedicated Prometheus instance.
curl -i -XPOST path.to.prometheus:port/-/reload
```
-1. In your Pomerium Enterprise configuration file, define the [`prometheus_url`](/docs/enterprise/configure#prometheus-url) key to point to your Prometheus instance. The example below uses port 9090, the default [Prometheus port](https://prometheus.io/docs/introduction/first_steps/).
+1. In your Pomerium Enterprise configuration file, define the [`prometheus_url`](/docs/deploy/enterprise/configure#prometheus-url) key to point to your Prometheus instance. The example below uses port 9090, the default [Prometheus port](https://prometheus.io/docs/introduction/first_steps/).
```yaml title="pomerium-enterprise.yaml"
prometheus_url: http://192.168.122.50:9090
@@ -95,7 +95,7 @@ For production deployments, we suggest using a dedicated Prometheus instance.
Pomerium Enterprise supports an embedded Prometheus instance that you configure only in Pomerium. Use this option if you don't want to maintain an external Prometheus instance, or if you're testing metrics.
-To configure an embedded Prometheus instance, add the [`prometheus_data_dir`](/docs/enterprise/configure#prometheus-data-dir) key and file path in your Pomerium Enterprise configuration file:
+To configure an embedded Prometheus instance, add the [`prometheus_data_dir`](/docs/deploy/enterprise/configure#prometheus-data-dir) key and file path in your Pomerium Enterprise configuration file:
```yaml title="pomerium-enterprise.yaml"
prometheus_data_dir: /var/lib/pomerium-console/tsdb
@@ -103,7 +103,7 @@ prometheus_data_dir: /var/lib/pomerium-console/tsdb
:::note
-The directory path can be any location that you have permissions to write to. This example uses the default location created if you install Pomerium Enterprise with the [OS Packages](/docs/enterprise/install#install-pomerium-enterprise) option.
+The directory path can be any location that you have permissions to write to. This example uses the default location created if you install Pomerium Enterprise with the [OS Packages](/docs/deploy/enterprise/install#install-pomerium-enterprise) option.
:::
diff --git a/content/docs/enterprise/configure.mdx b/content/docs/deploy/enterprise/configure.mdx
similarity index 100%
rename from content/docs/enterprise/configure.mdx
rename to content/docs/deploy/enterprise/configure.mdx
diff --git a/content/docs/deploy/enterprise/enterprise.md b/content/docs/deploy/enterprise/enterprise.md
new file mode 100644
index 000000000..2e3e0880c
--- /dev/null
+++ b/content/docs/deploy/enterprise/enterprise.md
@@ -0,0 +1,107 @@
+---
+title: Pomerium Enterprise
+description: Learn what features come with Pomerium Enterprise, including a Console GUI where you can manage your policies, namespaces, groups, routes, and more.
+keywords:
+ [
+ Pomerium Enterprise,
+ PPL Builder,
+ Console GUI,
+ namespaces,
+ directory sync,
+ device management,
+ groups,
+ programmatic api,
+ branding,
+ ]
+---
+
+import ClearIcon from '@mui/icons-material/Clear';
+
+# Pomerium Enterprise
+
+Pomerium Enterprise is built on our open-source Pomerium Core offering. Pomerium Enterprise makes Pomerium easier to manage at scale, and adds additional functionality aimed at organizations with auditing, compliance, governance, and risk management needs.
+
+## Pomerium Enterprise Features
+
+Pomerium Enterprise comes with all the capabilities in Pomerium Core, plus the following features:
+
+### Enterprise Console
+
+The **Enterprise Console** provides a dashboard where you can view traffic and logs, manage routes and policies, import external data, configure global and namespaced settings, and more.
+
+![An overview animation of the Pomerium Enterprise Console](./img/enterprise-console-overview.gif)
+
+### Enterprise API
+
+The **Enterprise API** helps you manage your configuration with your preferred programming language or infrastructure management tool.
+
+Everything that is manageable in the Enterprise Console can also be driven programmatically through the [Enterprise API](/docs/internals/management-api-enterprise).
+
+### Session Management
+
+The **Sessions** dashboard allows you to view and manage sessions within your organization. Admin members can export session data and revoke sessions in real time.
+
+![View and manage sessions in the Enterprise Console's Sessions dashboard](./img/manage-sessions.png)
+
+:::enterprise
+
+Ready to upgrade to Pomerium Enterprise? [**Contact us**](https://www.pomerium.com/enterprise-sales/) today to get started.
+
+:::
+
+### Namespaces and Self-Service
+
+The **Namespaces** dashboard is where you configure user roles and permissions for routes, policies, and the Enterprise Console itself. Once you've configured a [Namespace](/docs/internals/namespacing), members of that namespace can self-manage access to the infrastructure they build from or depend on.
+
+Pomerium Enterprise allows you to import groups defined by your identity provider. This allows you to build stable policies that don't require adjustments as your company changes.
+
+![Manage Namespaces in the Enterprise Console's Namespaces dashboard](./img/manage-namespaces.gif)
+
+### Deployment History and Audit Logs
+
+The **Deployments** dashboard allows you to view and export change logs from the Enterprise Console. Select a change to review which user applied it and when.
+
+![View deployments in the Enterprise Console's Deployments dashboard](./img/deployments-dashboard.gif)
+
+### Directory Sync
+
+Pomerium Enterprise's [**Directory Sync**](/docs/integrations/user-standing/directory-sync) feature allows you to import your identity provider's directory data. After a successful sync, you can use your internal groups and teams data when building policies. ![Viewing the Identity Providers settings for a directory sync in the Enterprise Console](./img/directory-sync-2.png)
+
+### External Data Sources
+
+In the **External Data** dashboard, you can import, view, and manage [external data sources](/docs/capabilities/integrations). After a successful sync, you can use data unique to your organization to serve as context in your authorization policies. ![Using the External Data Source Record type in a policy](./img/external-data-as-context.gif)
+
+## Pomerium Enterprise features comparison
+
+| Features | Pomerium Core | Pomerium Enterprise |
+| :-- | :-- | :-- |
+| Identity-based Access | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+| SSO Support | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+| Declarative Authorization Policy | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+| TCP Support | ![Pomerium checkmark](./img/pomerium-checkmark.svg) | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+| Enterprise Console | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+| [Enterprise API](/docs/internals/management-api-enterprise) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+| [Session Management](/docs/internals/metrics#sessions) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+| [Namespaces](/docs/internals/namespacing) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+| [Directory Sync](/docs/integrations/user-standing/directory-sync) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+| [User Impersonation](/docs/capabilities/impersonation) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+| [Deployment History](/docs/internals/metrics#changesets-and-deployments) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+| [Device Identity](/docs/integrations/device-context/device-identity) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+| [Custom Branding](/docs/capabilities/branding) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+| [Service Accounts](/docs/capabilities/service-accounts) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+| [Metrics](/docs/internals/metrics) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+| [External Data Sources](/docs/capabilities/integrations) | | ![Pomerium checkmark](./img/pomerium-checkmark.svg) |
+
+## Next Steps
+
+:::enterprise
+
+Already upgraded to Pomerium Enterprise, but need some help setting up the Enterprise Console?
+
+The following docs can help:
+
+- [**Install Pomerium Enterprise**](/docs/deploy/enterprise/install)
+- [**Pomerium Enterprise Configuration**](/docs/deploy/enterprise/configure)
+- [**Pomerium Enterprise Quickstart**](/docs/deploy/enterprise/quickstart)
+
+:::
diff --git a/content/docs/deploy/enterprise/img/auth-flow-diagram.svg b/content/docs/deploy/enterprise/img/auth-flow-diagram.svg
new file mode 100644
index 000000000..5c15ae073
--- /dev/null
+++ b/content/docs/deploy/enterprise/img/auth-flow-diagram.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/content/docs/enterprise/img/certificates-ssl-report.png b/content/docs/deploy/enterprise/img/certificates-ssl-report.png
similarity index 100%
rename from content/docs/enterprise/img/certificates-ssl-report.png
rename to content/docs/deploy/enterprise/img/certificates-ssl-report.png
diff --git a/content/docs/deploy/enterprise/img/certificates-valid-secure-certificate.png b/content/docs/deploy/enterprise/img/certificates-valid-secure-certificate.png
new file mode 100644
index 000000000..2b248e73c
Binary files /dev/null and b/content/docs/deploy/enterprise/img/certificates-valid-secure-certificate.png differ
diff --git a/content/docs/deploy/enterprise/img/cluster-cert-details.png b/content/docs/deploy/enterprise/img/cluster-cert-details.png
new file mode 100644
index 000000000..42b61a331
Binary files /dev/null and b/content/docs/deploy/enterprise/img/cluster-cert-details.png differ
diff --git a/content/docs/deploy/enterprise/img/compare-changes.png b/content/docs/deploy/enterprise/img/compare-changes.png
new file mode 100644
index 000000000..22183db76
Binary files /dev/null and b/content/docs/deploy/enterprise/img/compare-changes.png differ
diff --git a/content/docs/deploy/enterprise/img/console-route-traffic.png b/content/docs/deploy/enterprise/img/console-route-traffic.png
new file mode 100644
index 000000000..b7c386f5d
Binary files /dev/null and b/content/docs/deploy/enterprise/img/console-route-traffic.png differ
diff --git a/content/docs/deploy/enterprise/img/create-external-data-source.png b/content/docs/deploy/enterprise/img/create-external-data-source.png
new file mode 100644
index 000000000..bcb9ba220
Binary files /dev/null and b/content/docs/deploy/enterprise/img/create-external-data-source.png differ
diff --git a/content/docs/deploy/enterprise/img/deployments-dashboard.gif b/content/docs/deploy/enterprise/img/deployments-dashboard.gif
new file mode 100644
index 000000000..31cacf758
Binary files /dev/null and b/content/docs/deploy/enterprise/img/deployments-dashboard.gif differ
diff --git a/content/docs/deploy/enterprise/img/directory-sync-2.png b/content/docs/deploy/enterprise/img/directory-sync-2.png
new file mode 100644
index 000000000..87285a801
Binary files /dev/null and b/content/docs/deploy/enterprise/img/directory-sync-2.png differ
diff --git a/content/docs/deploy/enterprise/img/directory-sync.png b/content/docs/deploy/enterprise/img/directory-sync.png
new file mode 100644
index 000000000..3fdbd5493
Binary files /dev/null and b/content/docs/deploy/enterprise/img/directory-sync.png differ
diff --git a/content/docs/deploy/enterprise/img/enterprise-console-overview.gif b/content/docs/deploy/enterprise/img/enterprise-console-overview.gif
new file mode 100644
index 000000000..b7e7c8279
Binary files /dev/null and b/content/docs/deploy/enterprise/img/enterprise-console-overview.gif differ
diff --git a/content/docs/deploy/enterprise/img/external-data-as-context.gif b/content/docs/deploy/enterprise/img/external-data-as-context.gif
new file mode 100644
index 000000000..256618d6a
Binary files /dev/null and b/content/docs/deploy/enterprise/img/external-data-as-context.gif differ
diff --git a/content/docs/deploy/enterprise/img/jaeger.png b/content/docs/deploy/enterprise/img/jaeger.png
new file mode 100644
index 000000000..9ab8dbb6e
Binary files /dev/null and b/content/docs/deploy/enterprise/img/jaeger.png differ
diff --git a/content/docs/deploy/enterprise/img/manage-namespaces.gif b/content/docs/deploy/enterprise/img/manage-namespaces.gif
new file mode 100644
index 000000000..cc37293f2
Binary files /dev/null and b/content/docs/deploy/enterprise/img/manage-namespaces.gif differ
diff --git a/content/docs/deploy/enterprise/img/manage-sessions.png b/content/docs/deploy/enterprise/img/manage-sessions.png
new file mode 100644
index 000000000..5339b01b8
Binary files /dev/null and b/content/docs/deploy/enterprise/img/manage-sessions.png differ
diff --git a/content/docs/deploy/enterprise/img/metrics/external-data-sources-dashboard.png b/content/docs/deploy/enterprise/img/metrics/external-data-sources-dashboard.png
new file mode 100644
index 000000000..7dd0bf5e9
Binary files /dev/null and b/content/docs/deploy/enterprise/img/metrics/external-data-sources-dashboard.png differ
diff --git a/content/docs/deploy/enterprise/img/metrics/traffic-dashboard.png b/content/docs/deploy/enterprise/img/metrics/traffic-dashboard.png
new file mode 100644
index 000000000..af977ccb8
Binary files /dev/null and b/content/docs/deploy/enterprise/img/metrics/traffic-dashboard.png differ
diff --git a/content/docs/deploy/enterprise/img/new-enrollment.png b/content/docs/deploy/enterprise/img/new-enrollment.png
new file mode 100644
index 000000000..83a716958
Binary files /dev/null and b/content/docs/deploy/enterprise/img/new-enrollment.png differ
diff --git a/content/docs/deploy/enterprise/img/pomerium-checkmark.svg b/content/docs/deploy/enterprise/img/pomerium-checkmark.svg
new file mode 100644
index 000000000..948b1fd3c
--- /dev/null
+++ b/content/docs/deploy/enterprise/img/pomerium-checkmark.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/content/docs/enterprise/img/security-headers.png b/content/docs/deploy/enterprise/img/security-headers.png
similarity index 100%
rename from content/docs/enterprise/img/security-headers.png
rename to content/docs/deploy/enterprise/img/security-headers.png
diff --git a/content/docs/deploy/enterprise/img/upgrading/idp_enterprise.png b/content/docs/deploy/enterprise/img/upgrading/idp_enterprise.png
new file mode 100644
index 000000000..4acc69bd7
Binary files /dev/null and b/content/docs/deploy/enterprise/img/upgrading/idp_enterprise.png differ
diff --git a/content/docs/deploy/enterprise/img/upgrading/policy_groups_enterprise.png b/content/docs/deploy/enterprise/img/upgrading/policy_groups_enterprise.png
new file mode 100644
index 000000000..f69678bc4
Binary files /dev/null and b/content/docs/deploy/enterprise/img/upgrading/policy_groups_enterprise.png differ
diff --git a/content/docs/deploy/enterprise/img/upgrading/v23/cookie-samesite.gif b/content/docs/deploy/enterprise/img/upgrading/v23/cookie-samesite.gif
new file mode 100644
index 000000000..fc84889d7
Binary files /dev/null and b/content/docs/deploy/enterprise/img/upgrading/v23/cookie-samesite.gif differ
diff --git a/content/docs/deploy/enterprise/img/upgrading/v23/logging-configs.gif b/content/docs/deploy/enterprise/img/upgrading/v23/logging-configs.gif
new file mode 100644
index 000000000..df63053a3
Binary files /dev/null and b/content/docs/deploy/enterprise/img/upgrading/v23/logging-configs.gif differ
diff --git a/content/docs/deploy/enterprise/img/upgrading/v23/set-request-headers-fingerprint.png b/content/docs/deploy/enterprise/img/upgrading/v23/set-request-headers-fingerprint.png
new file mode 100644
index 000000000..9e7139e2a
Binary files /dev/null and b/content/docs/deploy/enterprise/img/upgrading/v23/set-request-headers-fingerprint.png differ
diff --git a/content/docs/deploy/enterprise/img/user-id.png b/content/docs/deploy/enterprise/img/user-id.png
new file mode 100644
index 000000000..3b02e8cce
Binary files /dev/null and b/content/docs/deploy/enterprise/img/user-id.png differ
diff --git a/content/docs/deploy/enterprise/img/view-deployments.png b/content/docs/deploy/enterprise/img/view-deployments.png
new file mode 100644
index 000000000..6f7d5b3e7
Binary files /dev/null and b/content/docs/deploy/enterprise/img/view-deployments.png differ
diff --git a/content/docs/enterprise/install.mdx b/content/docs/deploy/enterprise/install.mdx
similarity index 95%
rename from content/docs/enterprise/install.mdx
rename to content/docs/deploy/enterprise/install.mdx
index ab3cbb8f0..b7d696985 100644
--- a/content/docs/enterprise/install.mdx
+++ b/content/docs/deploy/enterprise/install.mdx
@@ -59,7 +59,7 @@ Password:
docker pull docker.cloudsmith.io/pomerium/enterprise/pomerium-console:${vX.X.X}
```
-See the [Enterprise Quickstart](/docs/enterprise/quickstart) for instructions to run and deploy the Enterprise Console with Docker Compose.
+See the [Enterprise Quickstart](/docs/deploy/enterprise/quickstart) for instructions to run and deploy the Enterprise Console with Docker Compose.
@@ -207,9 +207,9 @@ kubectl apply -k ./config
```
-[pomerium kustomize]: /docs/k8s/install
-[environment variables]: /docs/enterprise/configure
-[ingress]: /docs/k8s/ingress
+[pomerium kustomize]: /docs/deploy/k8s/install
+[environment variables]: /docs/deploy/enterprise/configure
+[ingress]: /docs/deploy/k8s/ingress
diff --git a/content/docs/enterprise/quickstart.mdx b/content/docs/deploy/enterprise/quickstart.mdx
similarity index 86%
rename from content/docs/enterprise/quickstart.mdx
rename to content/docs/deploy/enterprise/quickstart.mdx
index 301524dc6..5c979fc5e 100644
--- a/content/docs/enterprise/quickstart.mdx
+++ b/content/docs/deploy/enterprise/quickstart.mdx
@@ -9,22 +9,22 @@ sidebar_position: 1
import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
-import HostedConfig from '../../examples/enterprise/hosted-auth-config.yaml.md';
-import HostedCompose from '../../examples/enterprise/hosted-auth-docker.yaml.md';
+import HostedConfig from '/content/examples/enterprise/hosted-auth-config.yaml.md';
+import HostedCompose from '/content/examples/enterprise/hosted-auth-docker.yaml.md';
# Run Pomerium Enterprise With Docker
Run Pomerium Enterprise with Docker containers and connect to the Console.
-This guide uses our [**Hosted Authenticate Service**](/docs/capabilities/hosted-authenticate-service). If you use our hosted service and have a license key, you can complete this guide in **under 5 minutes**.
+This guide uses our [**Hosted Authenticate Service**](/docs/capabilities/authentication). If you use our hosted service and have a license key, you can complete this guide in **under 5 minutes**.
-See the [Self-Hosted Authenticate Service](/docs/capabilities/self-hosted-authenticate-service) page if you want to self-host Pomerium.
+See the [Self-Hosted Authenticate Service](/docs/capabilities/authentication) page if you want to self-host Pomerium.
## Prerequisites
To complete this guide, you need:
-- [Pomerium Core](/docs/quickstart)
+- [Pomerium Core](/docs/get-started/quickstart)
- [Docker](https://docs.docker.com/get-docker/) and [Docker Compose](https://docs.docker.com/compose/install/)
:::note
@@ -101,4 +101,4 @@ Go to `https://console.localhost.pomerium.io` to access your Console.
If you want to try connecting Pomerium with other services, see some of our [Guides](/docs/guides).
-**Did you finish this quickstart guide?** We'd love to hear what you think. Get in touch with us on our [Discuss forum](https://discuss.pomerium.com/), message us on [Twitter](https://twitter.com/pomerium_io), [LinkedIn](https://www.linkedin.com/company/pomerium-inc), or check out our [Community](https://www.pomerium.com/docs/community) page.
+**Did you finish this quickstart guide?** We'd love to hear what you think. Get in touch with us on our [Discuss forum](https://discuss.pomerium.com/), message us on [Twitter](https://twitter.com/pomerium_io), [LinkedIn](https://www.linkedin.com/company/pomerium-inc), or check out our [Community](https://discuss.pomerium.com/) page.
diff --git a/content/docs/k8s/_category_.json b/content/docs/deploy/k8s/_category_.json
similarity index 100%
rename from content/docs/k8s/_category_.json
rename to content/docs/deploy/k8s/_category_.json
diff --git a/content/docs/k8s/configure.md b/content/docs/deploy/k8s/configure.md
similarity index 88%
rename from content/docs/k8s/configure.md
rename to content/docs/deploy/k8s/configure.md
index 5f1c9fce3..3fee2fc5b 100644
--- a/content/docs/k8s/configure.md
+++ b/content/docs/deploy/k8s/configure.md
@@ -40,15 +40,15 @@ spec:
### Bootstrap Secrets
-Bootstrap secrets are provisioned via `secrets` property of the [CRD](/docs/k8s/ingress#tls-certificates). The default installation would run a one-off Job that would generate them and store into `bootstrap` Secret of the `pomerium` namespace.
+Bootstrap secrets are provisioned via `secrets` property of the [CRD](/docs/deploy/k8s/ingress#tls-certificates). The default installation would run a one-off Job that would generate them and store into `bootstrap` Secret of the `pomerium` namespace.
### Identity Provider
-Integration with your Identity Provider is configured using [`identityProvider`](/docs/identity-providers) parameter.
+Integration with your Identity Provider is configured using [`identityProvider`](/docs/integrations/user-identity/identity-providers) parameter.
### Authenticate endpoint
-Each Pomerium installation has a special route that unauthenticated users are redirected to that handles sign-in via your Identity Provider. It is configured via the [`authenticate`](/docs/k8s/reference#authenticate) parameter of the [CRD](./reference#authenticate).
+Each Pomerium installation has a special route that unauthenticated users are redirected to that handles sign-in via your Identity Provider. It is configured via the [`authenticate`](/docs/deploy/k8s/reference#authenticate) parameter of the [CRD](./reference#authenticate).
The authenticate endpoint DNS address should resolve to an external IP address assigned by your Kubernetes Load Balancer to the `pomerium-proxy` service. If you use `external-dns`, that may be [done automatically](#external-dns).
@@ -72,7 +72,7 @@ See [Configuration Reference](./reference) for full description of all CRD confi
## Status
-Pomerium posts updates about its internal state to the [`/status` section of the `Pomerium CRD`](/docs/k8s/ingress#view-event-history).
+Pomerium posts updates about its internal state to the [`/status` section of the `Pomerium CRD`](/docs/deploy/k8s/ingress#view-event-history).
```console
Name: global
diff --git a/content/docs/k8s/gateway-api.mdx b/content/docs/deploy/k8s/gateway-api.mdx
similarity index 97%
rename from content/docs/k8s/gateway-api.mdx
rename to content/docs/deploy/k8s/gateway-api.mdx
index 1400ab66f..5703f2586 100644
--- a/content/docs/k8s/gateway-api.mdx
+++ b/content/docs/deploy/k8s/gateway-api.mdx
@@ -48,7 +48,7 @@ spec:
is: your-company-domain.com
```
-See [Pomerium Policy Language](/docs/capabilities/ppl) for complete details about policy syntax.
+See [Pomerium Policy Language](/docs/internals/ppl) for complete details about policy syntax.
:::caution
@@ -74,7 +74,7 @@ To install the Pomerium Ingress Controller with support for Gateway API:
This installs and configures the Ingress Controller, and adds a [GatewayClass](https://gateway-api.sigs.k8s.io/concepts/api-overview/#gatewayclass) named `pomerium-gateway` for use with the Gateway API.
-1. You will also need to set up a [global Pomerium configuration](/docs/k8s/configure). This is a minimal example for use with Gateway API:
+1. You will also need to set up a [global Pomerium configuration](/docs/deploy/k8s/configure). This is a minimal example for use with Gateway API:
```yaml title="pomerium-global.yaml"
apiVersion: ingress.pomerium.io/v1
diff --git a/content/docs/deploy/k8s/img/httpbin.png b/content/docs/deploy/k8s/img/httpbin.png
new file mode 100644
index 000000000..c3adda593
Binary files /dev/null and b/content/docs/deploy/k8s/img/httpbin.png differ
diff --git a/content/docs/k8s/img/kubernetes-gke.png b/content/docs/deploy/k8s/img/kubernetes-gke.png
similarity index 100%
rename from content/docs/k8s/img/kubernetes-gke.png
rename to content/docs/deploy/k8s/img/kubernetes-gke.png
diff --git a/content/docs/deploy/k8s/img/logged-in-as.png b/content/docs/deploy/k8s/img/logged-in-as.png
new file mode 100644
index 000000000..3eef6af88
Binary files /dev/null and b/content/docs/deploy/k8s/img/logged-in-as.png differ
diff --git a/content/docs/deploy/k8s/img/verify-app.png b/content/docs/deploy/k8s/img/verify-app.png
new file mode 100644
index 000000000..c9bde05c8
Binary files /dev/null and b/content/docs/deploy/k8s/img/verify-app.png differ
diff --git a/content/docs/k8s/ingress.md b/content/docs/deploy/k8s/ingress.md
similarity index 93%
rename from content/docs/k8s/ingress.md
rename to content/docs/deploy/k8s/ingress.md
index 598b8d060..4ac19b2ee 100644
--- a/content/docs/k8s/ingress.md
+++ b/content/docs/deploy/k8s/ingress.md
@@ -17,24 +17,24 @@ keywords:
pagination_next: null
---
-The [Pomerium Kubernetes Ingress Controller](https://github.com/pomerium/ingress-controller) is Pomerium’s official, open-source controller for Kubernetes environments. Pomerium's Ingress Controller builds secure access to Kubernetes Services by enforcing access control policies based on user identity; Enterprise users can build access control policies that include criteria like device, location, and other contextual factors."
+The [Pomerium Kubernetes Ingress Controller](https://github.com/pomerium/ingress-controller) is Pomerium's official, open-source controller for Kubernetes environments. Pomerium's Ingress Controller builds secure access to Kubernetes Services by enforcing access control policies based on user identity; Enterprise users can build access control policies that include criteria like device, location, and other contextual factors."
## How Pomerium Ingress Controller works
-Pomerium’s Ingress Controller for Kubernetes enables you to dynamically provision routes from Ingress resources and set authorization policy on those routes with Ingress annotations. By defining routes as Ingress resources in the Kubernetes API, you can easily create and remove those routes from your Pomerium configuration.
+Pomerium's Ingress Controller for Kubernetes enables you to dynamically provision routes from Ingress resources and set authorization policy on those routes with Ingress annotations. By defining routes as Ingress resources in the Kubernetes API, you can easily create and remove those routes from your Pomerium configuration.
-If you've tested Pomerium using the [all-in-one binary](/docs/core), you're probably familiar with configuring routes in Pomerium's [`config.yaml`](/docs/internals/configuration) file. When using the Pomerium Ingress Controller, each route is defined as an Ingress resource in the Kubernetes API.
+If you've tested Pomerium using the [all-in-one binary](/docs/deploy/core), you're probably familiar with configuring routes in Pomerium's [`config.yaml`](/docs/internals/configuration) file. When using the Pomerium Ingress Controller, each route is defined as an Ingress resource in the Kubernetes API.
-This document shows you how to configure an Ingress resource that’s compatible with the Pomerium Ingress Controller.
+This document shows you how to configure an Ingress resource that's compatible with the Pomerium Ingress Controller.
**Before you start:**
-This document assumes you've installed the Pomerium Ingress Controller and added global configuration settings with the [Pomerium CRD](/docs/k8s/configure).
+This document assumes you've installed the Pomerium Ingress Controller and added global configuration settings with the [Pomerium CRD](/docs/deploy/k8s/configure).
If you haven't completed these steps, see the following docs:
-- [Install Pomerium Ingress Controller](/docs/k8s/install)
-- [Global Configuration](/docs/k8s/configure)
+- [Install Pomerium Ingress Controller](/docs/deploy/k8s/install)
+- [Global Configuration](/docs/deploy/k8s/configure)
## Configure an Ingress resource
@@ -87,7 +87,7 @@ spec:
The default installation adds `pomerium` [IngressClass](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class) to your cluster. In order for Pomerium to service your Ingress objects, please set `spec.ingressClassName` to `pomerium`.
-It is also possible to [set Pomerium to be a default ingress controller](/docs/k8s/install#set-pomerium-as-default-ingressclass) cluster-wide.
+It is also possible to [set Pomerium to be a default ingress controller](/docs/deploy/k8s/install#set-pomerium-as-default-ingressclass) cluster-wide.
### Set Ingress annotations
@@ -175,17 +175,17 @@ The remaining annotations are specific to or behave differently than they do whe
| `ingress.pomerium.io/set_request_headers_secret` | Name of Kubernetes Secret containing the contents of the request header to send upstream. When used, `ingress.pomerium.io/set_request_headers` should not contain overlapping keys. |
| `ingress.pomerium.io/set_response_headers_secret` | Name of Kubernetes Secret containing the contents of the response header to send downstream. When used, `ingress.pomerium.io/set_response_headers` should not contain overlapping keys. |
| `ingress.pomerium.io/service_proxy_upstream` | When set to `"true"` forces Pomerium to connect to upstream servers through the k8s service proxy, and not individual endpoints. This is useful when deploying Pomerium inside a service mesh. |
-| `ingress.pomerium.io/tcp_upstream` | When set to `"true"`, defines the route as supporting a TCP tunnel. See the [example below](/docs/k8s/ingress#tcp-services) for more information. |
+| `ingress.pomerium.io/tcp_upstream` | When set to `"true"`, defines the route as supporting a TCP tunnel. See the [example below](/docs/deploy/k8s/ingress#tcp-services) for more information. |
| `ingress.pomerium.io/tls_client_secret` | Name of Kubernetes `tls` Secret containing a [client certificate][tls_client_certificate] for connecting to the upstream. |
| `ingress.pomerium.io/tls_custom_ca_secret` | Name of Kubernetes `tls` Secret containing a custom [CA certificate][`tls_custom_ca_secret`] for the upstream. |
| `ingress.pomerium.io/tls_downstream_client_ca_secret` | Name of Kubernetes `tls` Secret containing a [Client CA][client-certificate-authority] for validating downstream clients. |
-| `ingress.pomerium.io/policy` | [Pomerium Policy Language](/docs/capabilities/ppl) YAML or JSON block (as string) |
+| `ingress.pomerium.io/policy` | [Pomerium Policy Language](/docs/internals/ppl) YAML or JSON block (as string) |
| `ingress.pomerium.io/allow_any_authenticated_user` | When set to `"true"`, allows access to any user that was successfully authenticated with your Identity Provider. |
| `ingress.pomerium.io/allow_public_unauthenticated_access` | When set to `"true"`, does not require authentication, grants public access |
### Set authorization policy
-The `ingress.pomerium.io/policy` annotation allows you to build an authorization policy and apply it to a route. To build your authorization policy, apply [Pomerium Policy Language (PPL)](https://www.pomerium.com/docs/capabilities/ppl) inside a YAML or JSON block (as strings).
+The `ingress.pomerium.io/policy` annotation allows you to build an authorization policy and apply it to a route. To build your authorization policy, apply [Pomerium Policy Language (PPL)](https://www.pomerium.com/docs/internals/ppl) inside a YAML or JSON block (as strings).
#### Ingress authorization policy examples
@@ -323,7 +323,7 @@ Each Ingress should be backed by a Service. Pomerium supports certain extensions
Pomerium is capable of creating secure connections to services like SSH, Databases, and more by creating a TCP tunnel to the service with a local client.
-The example route below defines a route providing a tunneled TCP connection to an upstream service listening for non-web traffic. Pomerium provides [command line and GUI](/docs/capabilities/tcp/client) clients to interact with the TCP services.
+The example route below defines a route providing a tunneled TCP connection to an upstream service listening for non-web traffic. Pomerium provides [command line and GUI](/docs/deploy/clients) clients to interact with the TCP services.
```yaml
apiVersion: networking.k8s.io/v1
@@ -351,7 +351,7 @@ The important points to note in this example:
- The annotation `ingress.pomerium.io/tcp_upstream:` is set to `"true"`,
- `spec.rules.[].http.paths.[].path` is omitted,
- `spec.rules.[].http.paths.[].pathType` is set to `ImplementationSpecific`,
-- `spec.rules.[].host` and `spec.rules.[].paths.[].backend.service.port.name/number` together define the address used when connecting to the route using the [Pomerium Desktop or CLI clients](/docs/capabilities/tcp/client),
+- `spec.rules.[].host` and `spec.rules.[].paths.[].backend.service.port.name/number` together define the address used when connecting to the route using the [Pomerium Desktop or CLI clients](/docs/deploy/clients),
- You may apply standard access control annotations to define access restrictions to the service.
:::note
@@ -370,7 +370,7 @@ ingress.pomerium.io/service_proxy_upstream: 'true'
### Load Balancing
-Unless you disabled direct traffic to Endpoints, Pomerium would load balance the requests to the upstream endpoints. See the [Load Balancing](/docs/capabilities/load-balancing) guide for details, and use relevant Ingress annotations to fine tune load balancing and health checks.
+Unless you disabled direct traffic to Endpoints, Pomerium would load balance the requests to the upstream endpoints. See the [Load Balancing](/docs/capabilities/routing) guide for details, and use relevant Ingress annotations to fine tune load balancing and health checks.
```yaml
ingress.pomerium.io/lb_policy: 'lb_policy_option'
@@ -544,7 +544,7 @@ spec:
## Metrics
-Pomerium [exposes](/docs/k8s/install#metrics) a number of Prometheus style metrics that you may use to monitor your Ingress.
+Pomerium [exposes](/docs/deploy/k8s/install#metrics) a number of Prometheus style metrics that you may use to monitor your Ingress.
In order to filter out metrics for a particular Ingress, use `envoy_cluster_name` metric label, that has a `ingressnamespace-ingressname-host-domain-com` format.
diff --git a/content/docs/k8s/install.md b/content/docs/deploy/k8s/install.md
similarity index 100%
rename from content/docs/k8s/install.md
rename to content/docs/deploy/k8s/install.md
diff --git a/content/docs/k8s/quickstart.mdx b/content/docs/deploy/k8s/quickstart.mdx
similarity index 92%
rename from content/docs/k8s/quickstart.mdx
rename to content/docs/deploy/k8s/quickstart.mdx
index f9c377979..f39134140 100644
--- a/content/docs/k8s/quickstart.mdx
+++ b/content/docs/deploy/k8s/quickstart.mdx
@@ -20,14 +20,14 @@ keywords:
import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
-import InstallMkcert from '@site/content/_install-mkcert.md';
+import InstallMkcert from '@site/content/docs/admonitions/_install-mkcert.md';
import GlobalExample from '@site/content/examples/kubernetes/pomerium-global-settings.md';
Deploy Pomerium Core with [Kubernetes].
-This quickstart guide uses our [**Hosted Authenticate Service**](/docs/capabilities/hosted-authenticate-service) so you don't need to configure an identity provider or authenticate service URL.
+This quickstart guide uses our [**Hosted Authenticate Service**](/docs/capabilities/authentication) so you don't need to configure an identity provider or authenticate service URL.
-If you want to self-host, see the [**Self-Hosted Authenticate Service**](/docs/capabilities/self-hosted-authenticate-service) page.
+If you want to self-host, see the [**Self-Hosted Authenticate Service**](/docs/capabilities/authentication) page.
## Prerequisites
@@ -188,7 +188,7 @@ See the [**Verify examples**](https://github.com/pomerium/verify/blob/main/examp
number: 8000
```
- Note that in **Line 8**, we include the [annotation](/docs/k8s/ingress#supported-annotations) `ingress.pomerium.io/pass_identity_headers`, which provides a [JWT](/docs/internals/glossary#json-web-token) to the Verify service.
+ Note that in **Line 8**, we include the [annotation](/docs/deploy/k8s/ingress#supported-annotations) `ingress.pomerium.io/pass_identity_headers`, which provides a [JWT](/docs/internals/glossary#json-web-token) to the Verify service.
Deploy the service with `kubectl apply -f verify-ingress.yaml`, and visit the path in your browser:
@@ -246,10 +246,10 @@ Events:
```
[cert-manager]: https://cert-manager.io/docs/
-[identity provider]: /docs/identity-providers
+[identity provider]: /docs/integrations/user-identity/identity-providers
[ingress controller]: ./ingress.md
[install kubectl]: https://kubernetes.io/docs/tasks/tools/install-kubectl/
[kubernetes]: https://kubernetes.io
[mkcert]: https://github.com/FiloSottile/mkcert
[organizing cluster access using kubeconfig files]: https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/
-[tls certificates]: /docs/guides/certificates
+[tls certificates]: /docs/internals/certificates-and-tls
diff --git a/content/docs/k8s/reference.md b/content/docs/deploy/k8s/reference.md
similarity index 97%
rename from content/docs/k8s/reference.md
rename to content/docs/deploy/k8s/reference.md
index 5c5032587..fcb5cca85 100644
--- a/content/docs/k8s/reference.md
+++ b/content/docs/deploy/k8s/reference.md
@@ -135,7 +135,7 @@ PomeriumSpec defines Pomerium-specific configuration parameters.
- IdentityProvider configure single-sign-on authentication and user identity details by integrating with your Identity Provider
+ IdentityProvider configure single-sign-on authentication and user identity details by integrating with your Identity Provider
- Expire sets cookie and Pomerium session expiration time. Once session expires, users would have to re-login. If you change this parameter, existing sessions are not affected.
See Session Management (Enterprise) for a more fine-grained session controls.
Defaults to 14 hours.
+ Expire sets cookie and Pomerium session expiration time. Once session expires, users would have to re-login. If you change this parameter, existing sessions are not affected.
See Session Management (Enterprise) for a more fine-grained session controls.
Defaults to 14 hours.
Format: a duration string like "22s" as parsed by Golang time.ParseDuration.
@@ -437,7 +437,7 @@ Cookie defines Pomerium session cookie options.
### `identityProvider`
-IdentityProvider configure single-sign-on authentication and user identity details by integrating with your Identity Provider
+IdentityProvider configure single-sign-on authentication and user identity details by integrating with your Identity Provider
@@ -574,7 +574,7 @@ IdentityProvider configure single-sign-on authentication and user identity detai
- URL is the base path to an identity provider's OpenID connect discovery document. See Identity Providers guides for details.
+ URL is the base path to an identity provider's OpenID connect discovery document. See Identity Providers guides for details.