v0.3.0
Released September 9, 2026. Supported until March 9, 2027.
v0.3.0 ships 1 security update, 21 new features, 26 bug fixes, and 1 deprecation. Two changes lead the release. Budget policies now enforce as designed: an enforcing budget is authored from the Admin Console budget drawer with block and fallback actions (Set a budget and track spend), a budget on an API key binds to the client behind the key and survives credential rotation, and policy changes reach every governed project without waiting for a periodic rebuild. A gateway hostname now answers health and status questions directly: the root of a gateway endpoint returns an unauthenticated JSON status document saying whether the gateway is serving, and GET /v1/status adds per-provider reachability observed from the replica's own traffic (Health and status visibility). Behavior between the management plane and the data plane changed in this release.
Upgrade and rollback
- No breaking changes. No operator action is required before upgrading.
- The upgrade does not roll through without dropping traffic. Plan a maintenance window.
- Rollback to v0.2.1 is conditional. See the note below.
Migration 0131 is forward-only. After rolling the management plane back to an earlier release, creating a budget scoped to a single API key fails until the management plane is rolled forward again; every other budget scope is unaffected.
Security updates
Management plane API
A project can no longer be left with no administrator.
New features
tare CLI
tare manage install and tare manage upgrade can now render a management plane with no GCP dependency anywhere.
tare manage install and tare manage upgrade accept --master-kms-uri, which points the management plane's secret encryption at an external KMS instead of a locally supplied master key. tare install accepts --post-renderer, an executable Helm pipes the rendered manifest through before applying it, for several data planes sharing one cluster.
tare manage gateway install --type aws now installs the management plane's ingress on AWS: an ALB, managed by aws-load-balancer-controller, fronting the management-plane services via --certificate-arn (a required wildcard ACM certificate) and an optional --wafv2-acl-arn.
tare manage gateway install --type azure now installs the management plane's ingress on Azure: five Ingress resources consolidated by the Application Gateway Ingress Controller (AGIC) into one Application Gateway, fronting the management-plane services.
tare install --image-sync can now also mirror the management-plane images (app, auth, dashboard, bootstrapper) with the new --include-manage-images flag.
tare manage install and tare manage upgrade now check, before touching the cluster, that the key-encryption key each tier's --secret-manager-type will actually read resolves in the target secret store: GCP Secret Manager for the valet path's master KEK, or AWS Secrets Manager/Azure Key Vault for the app tier's KEKs when --secret-manager-type is aws or azure.
Consoles
The Admin Console data plane list now reports gateway health and provider health as two separate things.
Both consoles now show the management plane's release version in the user menu, and the Admin Console data plane list gains a Version column showing what each data plane last reported. See Check the management plane version and release notes.
Fallback policies now expose which conditions walk the chain. Available once the data plane is on 0.3.0 or later.
Release process
Release notes now list the CVEs a release fixes as identifiers rather than mentioning them inside a sentence, so a security review can confirm a specific CVE is fixed without reading every entry.
Management plane API
The management plane worker now publishes router_v1models_host_field_cross_writer_overwrites_total on its own metrics endpoint rather than the gateway's, which is a count of how often one gateway took over the per-hostname model list that another gateway last wrote.
The management plane now refuses to serve any operation that needs its key-encryption key when KMS_TYPE is unset or unrecognized, instead of silently falling back to an on-disk store that keeps the key-encryption key protecting BYOK provider keys and telemetry-server credentials in cleartext.
The management plane can now resolve its secrets from Azure Key Vault (SecretManagerType=azure), alongside the existing GCP Secret Manager and AWS Secrets Manager backends.
Request-log archival, the WORM audit anchor, and doctor bundle uploads can now target Amazon S3 (s3://bucket) or Azure Blob Storage (az://account/container), alongside the existing Google Cloud Storage backend, by prefixing the configured bucket with the matching scheme.
The management plane can now fetch the key-encryption key that protects BYOK provider keys and telemetry-server credentials from AWS Secrets Manager (KMS_TYPE=aws) or Azure Key Vault (KMS_TYPE=azure), alongside the existing GCP Secret Manager backend.
Data plane
The egress gateway now exposes a dedicated, route-isolated controller liveness listener alongside the public listener, while each gateway member can serve the published readiness contract at /healthz on its own hostname.
The built-in test provider's mock chat-completions endpoint now honors stream: true and answers with an SSE stream, so streaming code paths in the data plane, SDKs, and end-to-end tests can be exercised against the test provider instead of a real upstream LLM.
A request rejected because its key does not belong to the hostname's project gateway now gets a machine-readable reason alongside the existing explanation, instead of prose alone.
The root of a gateway endpoint now answers with a JSON status document reporting whether the gateway is serving, no API key needed, and a new authenticated endpoint, GET /v1/status, adds per-provider reachability observed from the replica's own recent traffic. The endpoint contract is documented under Health and status visibility, and the walkthrough for telling an outage from a key or request problem is Check whether the gateway is down.
Helm charts
The data-plane CRDs are now published as their own chart, oci://registry.tetrate.ai/dataplane-crds-helm, at the same version as serve-helm.
Gateway
Gateway errors composed before a response starts streaming now carry an x-should-retry header.
Bug fixes
Release process
Released Helm charts now carry the release version exactly, so serve-helm 0.3.0 installs as 0.3.0 and the Registry download is named serve-helm-0.3.0-bundle.tar.gz.
Gateway
A gateway whose configuration repeatedly renders empty, for example after every model is unassigned, no longer leaks a stale internal route deployment on each render.
A gateway whose membership probe was still published under its workspace name instead of its gateway UUID no longer re-asserts the stale one: the probe's response body echoed the workspace name, which a DNS failover health check configured to string-match the gateway UUID reads as red.
Claude Code now works against Vertex AI's Gemini and Anthropic models without client-side workarounds. Available once the data plane is on 0.3.0 or later.
A gateway no longer stops serving traffic because of guardrails that had nothing to check.
Deleting the last project gateway on a data plane no longer turns off its project isolation.
Extended thinking is no longer forwarded, on /v1/messages, to an OpenAI-compatible model the catalog does not report as reasoning-capable, so a session that started on a reasoning model keeps working after switching models. See Request normalization.
A system-role message inside the messages array now reaches an OpenAI-backed model instead of being discarded.
When a request asks an OpenAI-backed model for an Anthropic server tool, the tool is still dropped, and the response now carries an x-tars-dropped-fields header naming each dropped tool instead of staying silent. See Request normalization.
Management plane API
Creating, changing, deleting, or disabling a budget policy now schedules a gateway refresh for every project it governs.
Creating an API key now schedules a budget snapshot refresh instead of waiting for the next periodic rebuild, up to five minutes by default.
A budget policy on a single API key now caps the client behind the key, within the key's project, instead of the key row, so the budget survives a credential rotation: it follows the rotation to the replacement key, and the period's spend is summed across both keys of the pair while both are live. The binding and its write-time rules are documented on Budgets, and the spend-cap scenarios on Enforce budget caps with policies are updated to match.
Budget policies with a block or fallback action are no longer accepted at the user and per-key-default team scopes, where enforcement does not evaluate them: creating one is refused with an error naming the limitation, so a policy that was accepted but never gated a request can no longer be written. An each-user budget accepts the monitor action only.
The combined OpenAPI document and Postman collection published under https://tare.tetrate.ai/tools/sdks/ now carry the product release version in their filename and info.version, and are republished on every release.
Consoles
A transient failure reading an account's request history no longer shows an established user the new-user onboarding screen.
An API key's fallback and traffic-splitting model lists now answer for the key's own project, not whatever the project selector is on.
The Playground model picker now lists the models it will not allow, under "Not available here", each carrying the reason it cannot be picked, instead of leaving them out with no explanation.
Data plane
The gateway membership probe (/healthz/membership, the green signal DNS-level failover health checks point at) no longer thrashes when a gateway has multiple Active route deployments with conflicting hostnames, for example after a gateway URL rename.
A gateway with no inference provider configured (MCP-only) now serves traffic on its data port.
tare CLI
tare doctor no longer reports a healthy route-level BackendTrafficPolicy as Pending.
tare doctor no longer blames itself when it cannot read the egress gateway's traffic metrics.
tare doctor now reports on the data plane's autoscalers.
The supported Kubernetes range now starts at 1.32 rather than 1.30, which matches the Envoy Gateway this release ships.
tare install, tare upgrade and tare doctor now inspect every CRD the release installs.
The scheduled tare-doctor job no longer fails because the report it just delivered has findings in it.
tare doctor no longer reports a healthy data plane's own admin endpoints as shadowed routes.
Deprecations
tare CLI
--serve-url is deprecated on tare install and tare upgrade. The flag is still accepted, prints a notice, and is ignored; the data plane's URL is registered in the Admin Console under System → Settings → Data planes instead.