Skip to main content
​
v2.1.45

​
Changelog

  • Removed bifrost.agents[].tenant and bifrost.agents[].extension_uris from registration configuration; Agent Gateway discovers supported extensions from the upstream agent card.
  • Added bifrost.client.a2aPrivateAllowlist, rendered as client.a2a_private_allowlist, to permit private destinations for Agent Gateway card discovery, OAuth, and runtime connections. Link-local and cloud metadata destinations remain blocked.
  • Added bifrost.agents[].credential_origins, rendered as agents[].credential_origins, to permit additional HTTP(S) origins for agent runtime requests. The agent card origin is permitted automatically.
  • Added bifrost.client.skillsExternalClientUrl (client.skills_external_client_url) for the public skills marketplace URL, including environment and vault references. When unset, marketplace serving is disabled; skill management and downloads remain available.
  • Updated bifrost.client.a2aExternalClientUrl (client.a2a_external_client_url) to accept secret-reference objects and document that an unset URL disables all Agent Gateway protocol endpoints while management remains available.
  • Added nodeSelector, tolerations and affinity to the chart-managed Redis (vectorStore.redis.master.*), Qdrant (vectorStore.qdrant.*) and Weaviate (vectorStore.weaviate.*) deployments, matching postgresql.primary.*. Lets these stateful pods be pinned to dedicated or non-spot nodes. Defaults are empty and render nothing. Pod-spec only, no config.json change. Closes #3440.
  • Added azure-key-vault as a storage.configStore.vaultStore.type option (storage.configStore.vaultStore.azure: vaultUrl, tenantId, clientId, clientSecret). Renders into config_store.vault_store.azure. Omit clientId/clientSecret to use DefaultAzureCredential (workload identity, managed identity, or AZURE_* env vars) instead of a service principal.
  • Added Kubernetes auth for the hashicorp-vault vault store backend: storage.configStore.vaultStore.hashicorp.kubernetesRole, .kubernetesMountPath (default kubernetes), .kubernetesTokenPath (default /var/run/secrets/kubernetes.io/serviceaccount/token). Renders into config_store.vault_store.hashicorp.kubernetes_role / kubernetes_mount_path / kubernetes_token_path, letting a pod authenticate with its own service account token instead of a static token or AppRole. Tokens issued via AppRole or Kubernetes auth are now renewed in the background.
  • Added auto_rotation_interval and next_rotation_at to bifrost.accessProfiles[] (and to access_profiles in config.schema.json). Renders into access_profiles[].auto_rotation_interval / next_rotation_at, scheduling automatic rotation of a profile’s managed virtual keys ("30d", "12h"; 1h-365d). Previously the schema rejected the field, so it could only be set from the dashboard or API. Setting next_rotation_at requires an enabled (non-zero) auto_rotation_interval.
  • Added bifrost.loadBalancer.rerouteTarget, historyEnabled, historyRetentionDays and snapshotPersistIntervalSeconds. They render into load_balancer_config.reroute_target, history_enabled, history_retention_days and snapshot_persist_interval_seconds; previously these settings had no Helm path.
  • Removed bifrost.loadBalancer.trackerConfig and bootstrap, and the enabled: true the chart rendered into load_balancer_config. Bifrost ignores all three. bifrost.loadBalancer.enabled still decides whether load_balancer_config is rendered.
  • circuitBreakerConfig policies: default_cooldown accepts any Go duration (e.g. 1m30s) or integer nanoseconds, condition.operator is case-insensitive, setting both header_value and header_contains on a signal is rejected, and name, provider and model fields must be non-empty.
  • Routing rules: targets and object fallbacks accept key_id, setting it together with provider_key_name is rejected as config load rejects it, a target key selector requires provider, rules accept chain_rule, and the example in values.yaml no longer uses invalid values (model: "", bare fallbacks: ["openai"]).
  • A provider key’s weight is now optional, as documented; the chart already defaults it to 1.
  • Documented enabled on provider keys (bifrost.providers.<name>.keys[].enabled, renders into providers.<name>.keys[].enabled; also added to config.schema.json). Set false to keep a key configured but skip it in key selection, the same as the UI’s Enabled toggle. New keys default to true; omitting it on an existing key keeps the stored value. Bifrost now saves the value from config.json on restart, so a key whose field was previously unset can be disabled from values; previously the stored value won.
  • Added output_mode to bifrost.guardrails.rules[], rendered as guardrails_config.guardrail_rules[].output_mode (enforce default, or monitor). A monitor rule delivers the response untouched, evaluates it in the background, and records matches on the request’s log without enforcing them; it requires apply_to output or both.
  • Added bifrost.plugins.datadog.config.llmobs_gateway_mode (llmobs_gateway_mode), default false. Follows Datadog’s proxy-service pattern for LLM Observability: a bifrost.request workflow span per request with the LLM span nested under it, so filtering on that name lists gateway requests rather than raw model calls, plus MCP tool spans so an agentic request shows the tools it ran. Changes the exported LLM Observability span shape, so it is opt-in.
  • Added bifrost.plugins.datadog.config.otel_llmobs_conversion (otel_llmobs_conversion), one of disabled (default), inherit or enabled. Controls whether Datadog builds its own LLM Observability spans from Bifrost’s APM trace. Datadog resolves this across the whole trace, so the default opt-out also suppresses conversion for upstream services sharing the trace; inherit leaves the decision to them. With inherit or enabled and LLM Observability still on, Bifrost leaves gen_ai.* off its own APM spans so nothing is counted twice. Migrate before upgrading: a config that still sets dd_llmobs_enabled through custom_tags is now refused, and the Datadog plugin will not load until that tag is replaced by this setting.
  • Added bifrost.governance.virtualKeys[].metadata (metadata), custom key/value metadata copied onto every log entry the key produces, so logs and spend can be filtered by it. Up to 50 entries; keys may use letters, digits, ., _ and -. The field existed in Bifrost but had no Helm path, so it could not be set from a declarative install.