> ## Documentation Index > Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt > Use this file to discover all available pages before exploring further. # v2.1.45 > Helm v2.1.45 changelog - 2026-10-15 ## Changelog * Removed `bifrost.agents[].tenant` and `bifrost.agents[].extension_uris` from registration configuration; Agent Gateway discovers supported extensions from the upstream agent card. * Added `bifrost.client.a2aPrivateAllowlist`, rendered as `client.a2a_private_allowlist`, to permit private destinations for Agent Gateway card discovery, OAuth, and runtime connections. Link-local and cloud metadata destinations remain blocked. * Added `bifrost.agents[].credential_origins`, rendered as `agents[].credential_origins`, to permit additional HTTP(S) origins for agent runtime requests. The agent card origin is permitted automatically. * Added `bifrost.client.skillsExternalClientUrl` (`client.skills_external_client_url`) for the public skills marketplace URL, including environment and vault references. When unset, marketplace serving is disabled; skill management and downloads remain available. * Updated `bifrost.client.a2aExternalClientUrl` (`client.a2a_external_client_url`) to accept secret-reference objects and document that an unset URL disables all Agent Gateway protocol endpoints while management remains available. * Added `nodeSelector`, `tolerations` and `affinity` to the chart-managed Redis (`vectorStore.redis.master.*`), Qdrant (`vectorStore.qdrant.*`) and Weaviate (`vectorStore.weaviate.*`) deployments, matching `postgresql.primary.*`. Lets these stateful pods be pinned to dedicated or non-spot nodes. Defaults are empty and render nothing. Pod-spec only, no config.json change. Closes #3440. * Added `azure-key-vault` as a `storage.configStore.vaultStore.type` option (`storage.configStore.vaultStore.azure`: `vaultUrl`, `tenantId`, `clientId`, `clientSecret`). Renders into `config_store.vault_store.azure`. Omit `clientId`/`clientSecret` to use `DefaultAzureCredential` (workload identity, managed identity, or `AZURE_*` env vars) instead of a service principal. * Added Kubernetes auth for the `hashicorp-vault` vault store backend: `storage.configStore.vaultStore.hashicorp.kubernetesRole`, `.kubernetesMountPath` (default `kubernetes`), `.kubernetesTokenPath` (default `/var/run/secrets/kubernetes.io/serviceaccount/token`). Renders into `config_store.vault_store.hashicorp.kubernetes_role` / `kubernetes_mount_path` / `kubernetes_token_path`, letting a pod authenticate with its own service account token instead of a static token or AppRole. Tokens issued via AppRole or Kubernetes auth are now renewed in the background. * Added `auto_rotation_interval` and `next_rotation_at` to `bifrost.accessProfiles[]` (and to `access_profiles` in config.schema.json). Renders into `access_profiles[].auto_rotation_interval` / `next_rotation_at`, scheduling automatic rotation of a profile's managed virtual keys (`"30d"`, `"12h"`; 1h-365d). Previously the schema rejected the field, so it could only be set from the dashboard or API. Setting `next_rotation_at` requires an enabled (non-zero) `auto_rotation_interval`. * Added `bifrost.loadBalancer.rerouteTarget`, `historyEnabled`, `historyRetentionDays` and `snapshotPersistIntervalSeconds`. They render into `load_balancer_config.reroute_target`, `history_enabled`, `history_retention_days` and `snapshot_persist_interval_seconds`; previously these settings had no Helm path. * Removed `bifrost.loadBalancer.trackerConfig` and `bootstrap`, and the `enabled: true` the chart rendered into `load_balancer_config`. Bifrost ignores all three. `bifrost.loadBalancer.enabled` still decides whether `load_balancer_config` is rendered. * `circuitBreakerConfig` policies: `default_cooldown` accepts any Go duration (e.g. `1m30s`) or integer nanoseconds, `condition.operator` is case-insensitive, setting both `header_value` and `header_contains` on a signal is rejected, and name, provider and model fields must be non-empty. * Routing rules: targets and object fallbacks accept `key_id`, setting it together with `provider_key_name` is rejected as config load rejects it, a target key selector requires `provider`, rules accept `chain_rule`, and the example in `values.yaml` no longer uses invalid values (`model: ""`, bare `fallbacks: ["openai"]`). * A provider key's `weight` is now optional, as documented; the chart already defaults it to 1. * Documented `enabled` on provider keys (`bifrost.providers..keys[].enabled`, renders into `providers..keys[].enabled`; also added to config.schema.json). Set `false` to keep a key configured but skip it in key selection, the same as the UI's Enabled toggle. New keys default to `true`; omitting it on an existing key keeps the stored value. Bifrost now saves the value from config.json on restart, so a key whose field was previously unset can be disabled from values; previously the stored value won. * Added `output_mode` to `bifrost.guardrails.rules[]`, rendered as `guardrails_config.guardrail_rules[].output_mode` (`enforce` default, or `monitor`). A monitor rule delivers the response untouched, evaluates it in the background, and records matches on the request's log without enforcing them; it requires `apply_to` `output` or `both`. * Added `bifrost.plugins.datadog.config.llmobs_gateway_mode` (`llmobs_gateway_mode`), default `false`. Follows Datadog's proxy-service pattern for LLM Observability: a `bifrost.request` workflow span per request with the LLM span nested under it, so filtering on that name lists gateway requests rather than raw model calls, plus MCP tool spans so an agentic request shows the tools it ran. Changes the exported LLM Observability span shape, so it is opt-in. * Added `bifrost.plugins.datadog.config.otel_llmobs_conversion` (`otel_llmobs_conversion`), one of `disabled` (default), `inherit` or `enabled`. Controls whether Datadog builds its own LLM Observability spans from Bifrost's APM trace. Datadog resolves this across the whole trace, so the default opt-out also suppresses conversion for upstream services sharing the trace; `inherit` leaves the decision to them. With `inherit` or `enabled` and LLM Observability still on, Bifrost leaves `gen_ai.*` off its own APM spans so nothing is counted twice. **Migrate before upgrading:** a config that still sets `dd_llmobs_enabled` through `custom_tags` is now refused, and the Datadog plugin will not load until that tag is replaced by this setting. * Added `bifrost.governance.virtualKeys[].metadata` (`metadata`), custom key/value metadata copied onto every log entry the key produces, so logs and spend can be filtered by it. Up to 50 entries; keys may use letters, digits, `.`, `_` and `-`. The field existed in Bifrost but had no Helm path, so it could not be set from a declarative install. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.