Skip to main content
​
v2.1.41

​
Changelog

  • Added bifrost.governance.roles[].access_profiles for granting multiple access profiles to a role. The plural list takes precedence over the deprecated singular access_profile; an explicit empty list removes all profile grants.
  • Added bifrost.scim.trustedNetworks — the private IP/CIDR allowlist the SSRF guard consults before the generic provider’s outbound OIDC discovery calls (Discover endpoints / Discover claims), so a self-hosted IdP on 10.x, 172.16-31.x, or 192.168.x is reachable from a declarative install instead of only from the dashboard. Each entry is { cidr, description }: a bare IP is treated as a single host (/32, or /128 for IPv6) and hostnames are rejected. Declaring the key makes Helm own the whole list - it replaces whatever is stored, and an explicit trustedNetworks: [] clears dashboard-added ranges - while omitting it leaves them untouched.