- Dedicated ServiceAccount for switchboard (appsuite/support#1592)
- switchboard runs under its own ServiceAccount with no Kubernetes API token mounted, for CIS 5.1.5/5.1.6 compliance out of the box
- New serviceAccount.* and automountServiceAccountToken values
- Document PRESENCE_TTL_SECONDS and presence.ttlSeconds 4a4040b
- PodDisruptionBudget for switchboard (appsuite/support#1568)
- New pdb.* values render an optional PodDisruptionBudget for the switchboard pods (disabled by default)
- Presence.ttlSeconds chart value for PRESENCE_TTL_SECONDS 280bbe0
- Expose migrate Job TTL and annotations for Argo CD callers 574fddb
- Sign JWT sub as string; jose 6.2.12 rejects non-strings 2184dbe
- Trigger k6 load tests via k6-operator TestRun manifests bfbda76
- Prune socket registry against the cluster-wide socket set e77bdde
- Comprehensive documentation with VuePress ff10d9e
- Fake-webhook script to send signed push events for testing 031c56b
- Grafana panels for auth-error-by-reason and JWT verify latency 58c7cfb
- Grafana panels for per-pod socket metrics 0b8457f
- Informal language for de_DE e2b4338
- Opt-in migrate.triggerValue to preserve per-deploy rerun 511390b
- Reason label to switchboard_authentication_errors fa3563b
- Switchboard_jwt_verify_duration_seconds histogram 1b0a735
- Switchboard-specific Redis-state metrics and dashboard panels d97be17
- TLS support for mysql/mariadb connection a781c97
- Web push flow diagrams in docs 6b31a90
- Breaking change: Rename switchboard_authentication_errors to _total c54ae15
- Clarify switchboard_connected_users help text 249cff5
- Convert migrate Job to plain manifest with rotation suffix b34cc4f
- Stop logging raw JWTs and user-controlled socket payloads ffe21c3
- Bound Redis growth from offline-state queue and presence keys 1cad762
- Convert migrate Job to Helm hook for GitOps compatibility f138d0f
- Disable jwks by default 935acff
- Drop ky prefixUrl in webpush client so it works with ky v2 d48f107
- Promote chart-managed mysql Secret to pre-install/pre-upgrade hook cc577db
- Redact sensitive fields from webpush/webhook debug logs (support#1388)
- Web push click no longer opens login page in default browser a7fc52e