v0.11.0
Released November 4, 2026. Supported until May 4, 2027.
v0.11.0 ships 40 behavior changes, 12 security updates, 41 new features, 29 bug fixes, and 1 deprecation. Behavior between the management plane and the data plane changed in this release. The most severe security issue cleared is high.
A fully detailed version of these release notes (including artifact versions) is included in the Admin Console.
The full release notes are opened from the Admin Console, as described in Check the management plane version.
Upgrade and rollback
- The release carries no breaking change. 54 changes name operator steps of their own, given with each change in the full release notes in the Admin Console.
- The upgrade rolls through without dropping traffic.
- Rollback to v0.10.1 is unconditional.
Behavior changes
Gateway
An oauth MCP profile is served as before in 0.11, including an MCP server saved with an empty tool list. Available once the data plane is on 0.11.0 or later.
An MCP profile whose security type means OAuth but is not exactly oauth (for example OAuth, oauth2, custom_oauth, o-auth or oidc) now gets the OAuth token check on the data plane and, like an oauth profile, follows MCP_OAUTH_STRICT_PROFILES: with it set to true, it leaves out an MCP server with an empty tool list, and without an issuer or a key set it serves nothing. Available once the data plane is on 0.11.0 or later.
An oauth MCP profile with no issuer or no key set URL is still served with no token check in 0.11. Available once the data plane is on 0.11.0 or later.
Data planes no longer serve MCP catalog servers at https://<hostname>/mcp/s/<server>, and the Developer Console no longer shows these addresses. Available once the data plane is on 0.11.0 or later.
Management plane API
Attaching an MCP server to an oauth MCP profile returns invalid_argument unless the request lists 1 to 32 distinct tool names or regex: patterns, with regex:* for every tool.
Setting the tools of a server attached to an oauth MCP profile returns invalid_argument unless the request lists 1 to 32 distinct tool names or regex: patterns, with regex:* for every tool.
Updating an MCP profile of type none or api_key to type oauth returns failed_precondition and names the MCP server when an attached MCP server has a tool list an oauth profile refuses, such as an empty list.
Creating an MCP profile with a security type other than oauth, api_key or none returns invalid_argument, and so does an update that changes the type to such a value.
Creating an MCP profile of type oauth returns invalid_argument unless security_policy_value sets issuer and remote_jwks, an absolute http or https URL.
Rotating a legacy API key (a key with no client) in the Developer Console is now recorded by the server as CREATE_USER_TOKEN and DELETE_API_KEY.
Project Owners can list, disable and delete the API keys of their project.
Enabling, disabling, renaming or deleting an API key, from either console or the API, now writes one UPDATE_API_KEY or DELETE_API_KEY audit record per call, in the same transaction, naming the signed-in user.
Creating, changing or deleting an alert destination from the Admin Console, the Developer Console or the API now writes one alert_destinations audit record naming the signed-in user, with success set to false when the change is refused after the sign-in and permission checks; no record holds a credential.
An API key with no stored key type, from before key types were stored, now reports API_KEY_TYPE_MANAGEMENT, the type it works as.
Your API keys with no stored key type, from before key types were stored, now report API_KEY_TYPE_MANAGEMENT, the type they work as.
A custom role counts as organization admin only when it holds every Super Admin permission.
A disabled user token now shows the new DISABLED status, and the active filter no longer returns it.
The management plane API host has a new endpoint for payment events, /v1/billing/stripe/webhook.
Deleting or archiving a project now also hides the API keys that were revoked before it, so a new project with the same name does not list them as its own.
RequestLogsService.QueryRequestLogs now matches only the full request ID, comparing the UUID part without regard to case.
CustomerRequestLogsService.ListCustomerRequestLogs now matches only the full request ID, comparing the UUID part without regard to case.
Consoles
The Developer Console project switcher lists only projects the user can work in: a membership, the built-in Project Member or Project Admin role on the project, a role that manages its members, or organization administrator.
Signing in to an OAuth MCP server from an MCP profile needs a management plane on 0.10.0 or later.
Adding or removing a project's provider, and editing a project, in the Admin Console now go through the management plane, which writes the audit record: ADD_PROJECT_PROVIDER or REMOVE_PROJECT_PROVIDER for the project_provider resource, and UPDATE_PROJECT for the project resource.
Assigning a model to a project, or removing it, in the Admin Console now goes through the management plane, which writes the ASSIGN_MODEL_TO_PROJECT or UNASSIGN_MODEL_FROM_PROJECT audit record for the project_model resource.
The Developer Console now reads each user's API keys from the management plane, as it already does for key changes.
Adding, deleting and changing the routing of a provider key in the Developer Console is now recorded only by the server, as REGISTER_AI_KEY, REVOKE_AI_KEY and UPDATE_AI_KEY_TRAFFIC.
In the Admin Console, only an operator can credit or debit a user: a holder of billing.edit at platform level, or in the deployment's own organization for its members and the users who belong to no organization.
The Admin Console changes email domain policies through the API, with its rules: an import takes at most 100000 rows, and only a holder of the email_domain_policies permissions at platform level, or in the deployment's own organization, can change policies.
Adding or removing a project's MCP server in the Admin Console writes one audit record, ADD_PROJECT_MCP_SERVER or REMOVE_PROJECT_MCP_SERVER, not two.
The Admin Console reads and changes models through the management plane API.
Saving SSO settings in the Admin Console, or in onboarding, writes one audit record, CREATE_SSO_PROVIDER or UPDATE_SSO_PROVIDER, not two.
Test connection and Playground tool calls in the Developer Console now call an MCP catalog server at its own URL from the management plane, instead of through a data plane hostname.
Playground tool calls through an MCP profile, except to OAuth servers, need a management plane on 0.10.0 or later.
tare CLI
tetrate agentrouter doctor exits 3 (unknown) instead of 2 when even its basic liveness checks run out of time, following the Nagios plugin convention: it could not tell the data plane's state, which differs from finding it broken.
Development builds are published every 12 hours, so a change can take up to 12 hours to become available.
The scheduled doctor job no longer emits the taredoctor.runs_total and taredoctor.duration_seconds OpenTelemetry metrics.
Helm charts
The separate auth service is removed, as announced in 0.9: the upgrade deletes it, the release no longer ships the auth image or chart, and the management API now serves every sign-in path, including the auth host so existing identity provider callbacks keep working.
The management plane chart now turns on password sign-in by default (ENABLE_PASSWORD_AUTH "true"), and still turns it off when corporate login is on.
Routing
Attribute routing is now on by default. Available once the data plane is on 0.11.0 or later.
Security updates
Management plane API
On the management plane, the calls that return a stored provider key, look up an API key, sign or verify data and rotate encryption keys now accept only an authorized management-plane service-account credential, judged by the scopes stored for the account.
Unless the auth database is declared as holding one organization (RBAC_AUTH_DB_MODE=single), users no longer receive the empty default organization role for the deployment's own organization.
An Admin Console user with only an organization role can no longer list the API keys of every organization.
An Admin Console user who holds admin only through an organization role can change or delete only the API keys where that role grants API key edit or delete, and a management key only the keys of its own organization.
On a management plane that serves more than one organization, provider key changes no longer reach another organization's data planes.
A disabled project OIDC contract no longer reserves its issuer and audience, so another organization can enable a contract for that pair.
A jwt gateway auth policy must now name at least one audience, and a jit identity mapping rule must set claim_value_template or set match_every_claim_value to true.
Consoles
In the Admin Console, an administrator sees and acts on only the bonus claims of their own organization's members.
Gateway
Data planes route an MCP client to a catalog server only through an MCP profile, which applies the profile's project access, credentials and tool selection. Available once the data plane is on 0.11.0 or later.
A data plane that runs a build older than 0.10.0, or has not reported its build, no longer receives a project's OIDC contract, so it refuses that contract's callers instead of serving them with no API key and no budget or rate limit. Available once the data plane is on 0.10.0 or later.
The management plane now resolves an application's token call to a principal only for a service account of the cluster where the receiving data plane is installed, and only in the project the call names or a project its policy maps a claim value to.
A caller admitted through a project's OIDC contract is now held to the project's accepted_credentials as a token call is, on a hostname where the data plane holds that setting. Available once the data plane is on 0.11.0 or later.
New features
Management plane API
Request logs show the project, provider, and the attribute routing rule that picked the model or the rate limit that refused it, and flag unexplained model changes.
When a data plane's doctor runs separate fast and deep CronJobs, the management plane keeps the deep checks' findings, conditions and status between deep runs, records when the last complete report landed, and resolves an alert for a deep-check finding only once a deep run no longer reports it. Available once the data plane is on 0.11.0 or later.
A new management plane read returns the customer-visible part of the doctor report for a data plane the caller owns: status, conditions, typed findings with their age and runbook link, and the checklist.
SetUserPassword (POST /v1/users/{user_id}/password) lets a Super Admin set another user's password.
GetMe session claims carry platform_permissions, the permissions of the user's platform-level role bindings, held directly or through a group.
ListApiKeys lists the keys of one organization or project, with status, owner, text and ID filters, a filter for the keys that can hold their own fallback policy (override_targetable_only), sorting, counts and the key owners.
UpdateApiKey and DeleteApiKey take an optional customer_id and project_id, so an organization admin or project owner can change the keys of their scope.
Developers can rename, enable, disable and delete their own keys, list their revoked and deleted keys, and delete a client that has no live key.
Listed API keys show the title of their client.
Listed API keys carry standalone, true for a key with no client of its own.
ListAssignableKeyScopes takes an optional project_id and answers for a management key in that project, with the permission check IssueMyKey applies there.
GET /v1/usage/stats takes group_keys, which keeps only the named groups, and subgroup_by, which splits each group by model, user, api_key or usage_mode.
Self-service balance, top-ups, auto top-up and cards through the API.
Administrators read their organization's balances and top-ups; operators adjust credits.
Administrators can review, approve, reject and cancel bonus claims, and reveal contact details, through the API.
The TypeScript example app for the API offers only the security types none, api_key and oauth, and its update form leaves the stored type unchanged when you choose no type.
GetProjectDeletionImpact previews what deleting a live project removes: the project's id, and the number of users, model assignments, API keys, revoked API keys, settings, fallback policies, provider grants, MCP server grants, MCP profiles, OIDC contracts and role bindings granted directly at the project's scope.
AssignModelToProject and UnassignModelFromProject now accept a caller who holds the project.model.edit permission for the project, also when the caller is not one of the project's users.
MCP catalog servers now return their tools, last tool fetch time and error, install examples and metadata, and SetCatalogServerTools saves a server's tools.
CreateCatalogServer adds an MCP catalog server and returns ALREADY_EXISTS for an id in use.
Revoke with legacy revokes one of your own provider keys from before keys belonged to a project.
EnsureDefaultProjectMembership adds a user to the Users of their organization's default project when they are not in it yet, and reports whether they joined.
An admin can now change two management plane address checks without restarting valet.
An Organization's super_admin can now let the management plane accept an identity provider on a private network for that Organization alone, for gateway auth policy keys and for project OIDC contracts, without asking the deployment's operator.
An organization admin can now create a project budget, which applies to every API key in the project. Available once the data plane is on 0.9.0 or later.
Register takes an optional preference ("always", "primary" or "fallback") for a provider's first key in a project, and tetrate agentrouter api byok add takes it as --preference.
Guardrail providers can be Amazon Bedrock Guardrails (kind bedrockguardrails): set region, optional endpoint and timeout, store a static AWS key pair with aws_credentials, and bind each rule to a guardrail ID and version. Available once the data plane is on 0.11.0 or later.
Helm charts
The data plane doctor can run as three CronJobs on one image (tareDoctor.tiers.enabled): fast every tick, read-only with no pod logs; deep hourly, with every check, and on the runs that send a support bundle it also scans pod logs; and events, which forwards install events and is the only doctor account that writes ConfigMaps.
A data plane behind a cloud NAT with a short idle timeout, such as AWS NAT Gateway or Azure NAT Gateway, can stop failing the first requests after a few idle minutes with 503 "connection termination": set egressResources.egress.upstreamIdleTimeout below the NAT's idle timeout, for example 300s on AWS. Available once the data plane is on 0.11.0 or later.
tare CLI
tetrate agentrouter doctor takes --tier fast, deep or events to run one of the scheduled doctor boundaries, and -o sarif to print its typed findings as a SARIF 2.1.0 log.
tare doctor now reports the data plane's release as dp_release: the release tag of the Tetrate-built images its pods run, "mixed" when they differ, or "unknown".
tare api mcp profiles servers add and the new tare api mcp profiles servers set-tools take --tools, which names the tools to enable, as --tools a --tools b or --tools a,b.
tare api catalog providers upsert takes --supported-auth-schemes, which sets the provider's auth scheme, for example --supported-auth-schemes api_key; a new enabled provider needs it.
tetrate agentrouter api mcp catalog create adds an MCP catalog server.
The doctor's --only flag also takes a check category (platform-health, config-validity, connectivity-trust, traffic-usage, drift-detection) to run that group's individually runnable checks at once, checks that only exist inside the full pipeline are not included, and targeted --only runs now report the same findings for a check as the full run does.
tetrate agentrouter api gains clients delete and projects set-preferred-endpoint, which takes one of --address, --target-id or --clear.
tetrate agentrouter api byok list gains --include-legacy, which also lists your own provider keys from before keys belonged to a project.
Consoles
A data plane shows a ComponentImageMismatch finding when one of its components runs an image that its reported release does not ship, such as the egress component still on the previous release after the liaison rolled, or a pinned image.
The Releases page keeps the newest alpha and release candidate separately for each release cycle.
Gateway
The data plane Controller reads MCP_OAUTH_STRICT_PROFILES at start and turns it on only for the exact value true; the 0.11 default is off and becomes on in 0.12. Available once the data plane is on 0.11.0 or later.
A self-managed install can point a gateway auth policy's jwks_uri at an identity provider on its own private network, so the gateway picks up the provider's rotated keys without anyone pasting them into jwks_inline. Available once the data plane is on 0.11.0 or later.
Bug fixes
Management plane API
Changes that check a data plane's version, such as provider overrides, shared and catch-all hostnames, OIDC contracts and the newer rate-limit dimensions, no longer refuse a data plane on 0.11.0 or newer that was just upgraded or has had no configuration change for a day, because it now reports its version on every poll.
UpsertProvider refuses to create an enabled provider with no auth scheme, and refuses to enable a provider that has none.
Listing data planes now returns next_page_token when more remain, and passing it as page_token returns the next page.
A secret keeps the tags it was created with.
A request with a NUL character in a name, description or filter field now returns 400 invalid_argument.
Gateway
A revoked provider key no longer leaves its backend behind on the data plane.
An MCP server that lists exact tool names next to regex: patterns no longer stops the data plane from serving the profile's routes. Available once the data plane is on 0.11.0 or later.
A new MCP profile stays pending until the data plane has accepted the route for its path. Available once the data plane is on 0.11.0 or later.
Chat Completions requests to gpt-6 and later OpenAI models now succeed with max_tokens or max_completion_tokens set, instead of returning 400 unsupported_parameter. Available once the data plane is on 0.11.0 or later.
A provider or BYOK model whose base URL names an IP address (for example http://10.0.0.5:11434) now routes. Available once the data plane is on 0.11.0 or later.
A model request sent in the first minute after an admin assigns a provider or its models to a project no longer fails with an empty 500 when the data plane has not loaded the backend of the new route yet. Available once the data plane is on 0.11.0 or later.
Consoles
Home in the Developer Console loads in about a second, down from up to a minute, for accounts with a long request history that made a successful call in the past year.
Home in the Developer Console stops suggesting fallback policies and traffic-splitting policies once one of your API keys has them.
Where the data plane sends low-balance events to the management plane API's /v1/billing/stripe/webhook, auto top-up no longer charges your card after you turn it off, or a second time when the same low-balance event is delivered again.
Card changes, top-ups and auto top-up settings made through the management plane API are now audited, and such a top-up is refused when its audit entry cannot be written.
The Admin Console shows Argo CD sync status, a “via Argo CD” label and revision badge.
The Admin Console shows the final release version after a stable release when the management plane is deployed from the release tag.
Deployment history now records data plane syncs from Argo CD Applications that use multiple sources, and shows the chart version for Argo CD syncs from a Helm or OCI chart repository.
Deployment history records a data plane's version change even when no install path reported it, such as Argo CD running in another cluster or Flux.
Users without the admin role can open the Admin Console again; it had shown "This page couldn't load" right after sign-in.
The Developer Console asks you to select at least one tool for a server of an OAuth MCP profile before it saves, and explains why it could not save the tools when the API refuses them.
The Developer Console no longer adds an MCP server with no listed tools to an OAuth MCP profile, and tells you why.
A profile stored with a type such as OAuth or oauth2 now shows its issuer and key set in the Developer Console, is labeled as an OAuth profile in the playground picker, and can be saved again; saving changes its stored type to oauth.
The Developer Console marks an MCP server on an OAuth profile whose saved tool list is empty and shows none of its tools turned on; the data plane leaves such a server out once MCP_OAUTH_STRICT_PROFILES is on.
Request Logs no longer freezes on large embeddings responses, because long lists of numbers start folded.
Every Admin Console API key picker, and the usage breakdown table, label a key's UID, the same UID the Developer Console shows.
The Usage and Home pages in the Developer Console show a cost under one cent, such as $0.000139, instead of $0.00.
tare CLI
tetrate agentrouter doctor now reconciles and forwards install events even when the health-report upload fails.
Building a support bundle no longer re-reads every inventoried resource from the Kubernetes API one object at a time.
Deprecations
Helm charts
global.cronSecret and the --cron-secret flag of tetrate agentrouter manage install and upgrade are deprecated and have no effect.