You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Pomerium uses [Semantic Versioning](https://semver.org/). In practice, this means for a given version number **vMAJOR**.**MINOR**.**PATCH** (for example, `v0.1.0`):
4
+
5
+
-**MAJOR** indicates an incompatible API change
6
+
-**MINOR** indicates a new, backwards-compatible functionality
7
+
-**PATCH** indicates a backwards-compatible bug fix
8
+
9
+
As Pomerium is still pre-`v1.0.0`, you should expect breaking changes between releases.
**Before you upgrade:** Set your Core and Enterprise instances to the same **MINOR** version number. For example, if your Core instance is on **v0.22.1**, Enterprise should be set to **v0.22.0**. See [Versioning](/docs/deploy/releases#versioning) for more information.
1
+
**Before you upgrade:** Set your Core and Enterprise instances to the same **MINOR** version number. For example, if your Core instance is on **v0.22.1**, Enterprise should be set to **v0.22.0**.
Copy file name to clipboardexpand all lines: content/docs/capabilities/authentication.mdx
+1-1
Original file line number
Diff line number
Diff line change
@@ -56,7 +56,7 @@ By configuring your applications to route requests to Pomerium’s Proxy service
56
56
57
57
:::enterprise
58
58
59
-
[Enterprise customers](https://www.pomerium.com/enterprise-sales/) can enforce context-aware access with Pomerium’s [external data sources](/docs/integrations) feature (directory sync).
59
+
[Enterprise customers](https://www.pomerium.com/enterprise-sales/) can enforce context-aware access with Pomerium’s [external data sources](/docs/capabilities/integrations) feature (directory sync).
Copy file name to clipboardexpand all lines: content/docs/capabilities/authorization.mdx
+3-3
Original file line number
Diff line number
Diff line change
@@ -108,7 +108,7 @@ In this example, Pomerium will grant a user access if their email address ends i
108
108
109
109
:::enterprise
110
110
111
-
The Enterprise Console provides a policy builder GUI so you can build policies and reapply them to multiple routes and namespaces. See our [**Enterprise**](/docs/deploy/enterprise) page to learn more.
111
+
The Enterprise Console provides a policy builder GUI so you can build policies and reapply them to multiple routes and namespaces. See our [**Enterprise**](/docs/enterprise) page to learn more.
112
112
113
113
:::
114
114
@@ -274,7 +274,7 @@ This example pulls session data from the Databroker service using `type.googleap
274
274
275
275
::::enterprise
276
276
277
-
In the [**Enterprise Console**](/docs/deploy/enterprise), you can write policies in Rego with the PPL builder:
277
+
In the [**Enterprise Console**](/docs/enterprise), you can write policies in Rego with the PPL builder:
278
278
279
279
280
280
@@ -311,7 +311,7 @@ For routes with policies that allow public, unauthenticated access, Pomerium _wi
311
311
312
312
:::enterprise
313
313
314
-
[Device identity](/docs/capabilities/device-identity) is an Enterprise feature. Check out our [Enterprise](/docs/deploy/enterprise) page to learn more.
314
+
[Device identity](/docs/capabilities/device-identity) is an Enterprise feature. Check out our [Enterprise](/docs/enterprise) page to learn more.
Copy file name to clipboardexpand all lines: content/docs/capabilities/device-identity.mdx
+2-2
Original file line number
Diff line number
Diff line change
@@ -32,7 +32,7 @@ Device identity is the unique ID associated with a device. In the context of zer
32
32
33
33
## Device identity with Pomerium
34
34
35
-
Pomerium versions [0.16.0](/docs/deploy/core/upgrading#policy-for-device-identity) and up support the use of device identity as a criteria in authorization policies. Pomerium uses the [Web Authentication](https://www.w3.org/TR/webauthn-2/#registration-extension) (WebAuthn) API to bring authentication and authorization based on device identity into your security framework. With Pomerium’s device identity support, users can register devices and administrators can limit access to devices they trust.
35
+
Pomerium versions [0.16.0](/docs/core/upgrading#policy-for-device-identity) and up support the use of device identity as a criteria in authorization policies. Pomerium uses the [Web Authentication](https://www.w3.org/TR/webauthn-2/#registration-extension) (WebAuthn) API to bring authentication and authorization based on device identity into your security framework. With Pomerium’s device identity support, users can register devices and administrators can limit access to devices they trust.
36
36
37
37
## Device identity features
38
38
@@ -102,7 +102,7 @@ Give the link to the user.
102
102
103
103
If a Pomerium route [requires device authentication](/docs/capabilities/ppl#device-matcher), the user must register a [trusted execution environment](/docs/concepts/device-identity#authenticated-device-types) (**TEE**) device before accessing the route. Registration differs depending on the device.
104
104
105
-
The steps below cover enrollment of a device by a user. This is available for both Pomerium Core and [Pomerium Enterprise](/docs/deploy/enterprise/install) installations. However, Enterprise users may also receive registration links [generated by their administrators](/docs/capabilities/device-identity), which will mark the newly enrolled device as approved in the Enterprise Console.
105
+
The steps below cover enrollment of a device by a user. This is available for both Pomerium Core and [Pomerium Enterprise](/docs/enterprise/install) installations. However, Enterprise users may also receive registration links [generated by their administrators](/docs/capabilities/device-identity), which will mark the newly enrolled device as approved in the Enterprise Console.
106
106
107
107
1. Users are prompted to register a new device when accessing a route that requires device authentication:
Copy file name to clipboardexpand all lines: content/docs/capabilities/getting-users-identity.md
-2
Original file line number
Diff line number
Diff line change
@@ -118,8 +118,6 @@ A single-page javascript application can verify the JWT using the [JavaScript SD
118
118
119
119
<ReactApp />
120
120
121
-
See the [JavaScript SDK guide](/docs/guides/js-sdk) for more information.
122
-
123
121
### Manual verification
124
122
125
123
Though you will likely verify signed headers programmatically in your application's middleware with a third-party JWT library, if you are new to JWT it may be helpful to show what manual verification looks like.
Copy file name to clipboardexpand all lines: content/docs/capabilities/high-availability.mdx
+2-2
Original file line number
Diff line number
Diff line change
@@ -40,7 +40,7 @@ Pomerium's individual components can be divided into two categories; the data pl
40
40
41
41
:::tip
42
42
43
-
Our [Kubernetes](/docs/deploy/k8s/quickstart) supports [Horizontal Pod Autoscaling](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/).
43
+
Our [Kubernetes](/docs/k8s/quickstart) supports [Horizontal Pod Autoscaling](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/).
44
44
45
45
:::
46
46
@@ -92,7 +92,7 @@ In any production deployment, running multiple replicas of each Pomerium service
92
92
93
93
You should deploy Layer 4 load balancing between end users and Pomerium Proxy services to provide high availability and horizontal scaling. Do not use L7 load balancers, since the Proxy service handles redirects, sticky sessions, etc.
94
94
95
-
Note that deployments on Kubernetes can utilize The [Pomerium Ingress Controller](/docs/deploy/k8s/ingress) to simplify configuration.
95
+
Note that deployments on Kubernetes can utilize The [Pomerium Ingress Controller](/docs/k8s/ingress) to simplify configuration.
Copy file name to clipboardexpand all lines: content/docs/capabilities/hosted-authenticate-service.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -36,7 +36,7 @@ Pomerium's hosted services solution removes the tedium of configuring your own i
36
36
37
37
If you're testing Pomerium for the first time, run [Pomerium with Docker](/docs/quickstart) using our hosted services – you can run Pomerium Core in **under 5 minutes** with minimal setup.
38
38
39
-
Current Pomerium users who are interested in our [Enterprise Console](https://www.pomerium.com/enterprise-sales/) can test out the [Docker Enterprise Quickstart](/docs/deploy/enterprise/quickstart) using hosted services as well.
39
+
Current Pomerium users who are interested in our [Enterprise Console](https://www.pomerium.com/enterprise-sales/) can test out the [Docker Enterprise Quickstart](/docs/enterprise/quickstart) using hosted services as well.
Building on top of a standard Kubernetes and Pomerium deployment:
43
43
44
44
1. Pomerium is given access to a Kubernetes service account with [impersonation](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation) permissions
45
45
2. A [route's policy](/docs/reference/routes/policy) is created for the API server and [configured](/docs/reference/routes/kubernetes-service-account-token) to use the service account token
46
46
3. Kubernetes RoleBindings operate against IdP Users and Group subjects
47
-
4. Users access the protected cluster through their standard tools, using [pomerium-cli](/docs/deploy/clients/pomerium-cli) as an auth provider in `~/.kube/config`
47
+
4. Users access the protected cluster through their standard tools, using [pomerium-cli](/docs/clients/pomerium-cli) as an auth provider in `~/.kube/config`
48
48
5. Pomerium authorizes requests and passes the user identity to the API server for fine grained RBAC
49
49
50
50
## Kubeconfig Setup
51
51
52
-
After installing the [pomerium-cli](/docs/deploy/clients/pomerium-cli), you must configure your `kubeconfig` for authentication.
52
+
After installing the [pomerium-cli](/docs/clients/pomerium-cli), you must configure your `kubeconfig` for authentication.
53
53
54
54
Substitute `mycluster.pomerium.io` with your own API Server's `from` in Pomerium's policy:
The directory path can be any location that the `pomerium` system user can write to. The example above uses the default location created by the [OS packages](/docs/deploy/enterprise/quickstart).
79
+
The directory path can be any location that the `pomerium` system user can write to. The example above uses the default location created by the [OS packages](/docs/enterprise/quickstart).
Copy file name to clipboardexpand all lines: content/docs/capabilities/mtls-services.mdx
+1-1
Original file line number
Diff line number
Diff line change
@@ -43,7 +43,7 @@ To provide a general explanation, in this guide you will use [mkcert](https://gi
43
43
44
44
To complete this proof-of-concept guide:
45
45
46
-
- Run Pomerium in [all-in-one mode](/docs/internals/configuration#all-in-one-vs-split-service-mode) as a system service with a configuration file in the [standard location](/docs/deploy/core/from-source#configure)
46
+
- Run Pomerium in [all-in-one mode](/docs/internals/configuration#all-in-one-vs-split-service-mode) as a system service with a configuration file in the [standard location](/docs/core/from-source#configure)
47
47
- Configure an [identity provider](/docs/identity-providers) (IdP) to communicate with your Pomerium instance
48
48
- Run all commands on the same host (You may have to move files or adjust paths and commands to match a different configuration)
49
49
- Install [`mkcert`](https://github.com/FiloSottile/mkcert) to generate self-signed certificates and a root Certificate Authority (CA) (`mkcert` will take the place of your trusted certificate tooling solution)
Copy file name to clipboardexpand all lines: content/docs/capabilities/ppl.mdx
+4-4
Original file line number
Diff line number
Diff line change
@@ -136,7 +136,7 @@ deny:
136
136
137
137
Below is an exhaustive list of PPL criteria.
138
138
139
-
Entries marked with `*` denote criteria that are only available in the [Enterprise Console](/docs/deploy/enterprise) PPL builder. All other entries are available in both Pomerium Core and Pomerium Enterprise.
139
+
Entries marked with `*` denote criteria that are only available in the [Enterprise Console](/docs/enterprise) PPL builder. All other entries are available in both Pomerium Core and Pomerium Enterprise.
140
140
141
141
| Criterion Name | Data Format | Description |
142
142
| --- | --- | --- |
@@ -155,12 +155,12 @@ Entries marked with `*` denote criteria that are only available in the [Enterpri
155
155
| `http_path` | [String Matcher] | Returns true if the HTTP path matches the given value. |
156
156
| `invalid_client_certificate` | Anything. Typically `true`. | Returns true if the incoming request does not have a trusted client certificate. By default, a `deny` rule using this criterion is added to all Pomerium policies when [downstream mTLS] is configured (but this default can be changed using the [Enforcement Mode](/docs/reference/downstream-mtls-settings#enforcement-mode) setting.) |
157
157
| `pomerium_routes` | Anything. Typically `true`. | Returns true if the incoming request is for the special `.pomerium` routes. A default `allow` rule using this criterion is added to all Pomerium policies. |
158
-
| \* `record` | variable | Allows policies to be extended using data from [external data sources](/docs/integrations) |
158
+
| \* `record` | variable | Allows policies to be extended using data from [external data sources](/docs/capabilities/integrations) |
159
159
| `reject` | Anything. Typically `true`. | Always returns false. The opposite of `accept`. |
160
160
| \* `time_of_day` | [Time of Day Matcher] | Returns true if the time of the request (for the current day) matches the constraints. |
161
161
| `user` | [String Matcher] | Returns `true` if the logged-in user's ID matches the supplied value. (The actual value of the user ID claim depends on how the identity provider sets this value.) |
162
162
163
-
Entries marked with `*` denote criteria that are only available in the [Enterprise Console](/docs/deploy/enterprise) PPL builder. All other entries are available in both Pomerium Core and Pomerium Enterprise.
163
+
Entries marked with `*` denote criteria that are only available in the [Enterprise Console](/docs/enterprise) PPL builder. All other entries are available in both Pomerium Core and Pomerium Enterprise.
Copy file name to clipboardexpand all lines: content/docs/capabilities/service-accounts.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -19,7 +19,7 @@ Service accounts offer a protected and standardized method of authenticating mac
19
19
20
20
:::enterprise
21
21
22
-
Service Accounts are a Pomerium Enterprise feature. The steps below show you how to create and use a Service Account in the Enterprise Console. See our [Pomerium Enterprise](/docs/deploy/enterprise) page for more information.
22
+
Service Accounts are a Pomerium Enterprise feature. The steps below show you how to create and use a Service Account in the Enterprise Console. See our [Pomerium Enterprise](/docs/enterprise) page for more information.
Copy file name to clipboardexpand all lines: content/docs/capabilities/tcp.mdx
+1-1
Original file line number
Diff line number
Diff line change
@@ -22,7 +22,7 @@ import LongLivedConnections from '@site/content/docs/admonitions/_long-lived-con
22
22
23
23
# TCP over HTTP Support
24
24
25
-
In addition to managing HTTP based applications, Pomerium can be used to protect non-HTTP systems with the same consistent authorization policy. This is achieved by tunneling TCP over HTTP with the help of a client side command built into [`pomerium-cli`](/docs/deploy/clients/pomerium-cli).
25
+
In addition to managing HTTP based applications, Pomerium can be used to protect non-HTTP systems with the same consistent authorization policy. This is achieved by tunneling TCP over HTTP with the help of a client side command built into [`pomerium-cli`](/docs/clients/pomerium-cli).
26
26
27
27
Operations and engineering teams frequently require access to lower level administrative and data protocols such as SSH, RDP, Postgres, MySQL, Redis, etc.
Copy file name to clipboardexpand all lines: content/docs/capabilities/tcp/examples/git.mdx
+1-1
Original file line number
Diff line number
Diff line change
@@ -23,7 +23,7 @@ This example assumes you've already [created a TCP route](/docs/capabilities/tcp
23
23
24
24
## Basic Connection
25
25
26
-
1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/deploy/clients/pomerium-cli) or the Pomerium Desktop client. These examples use Git connections over SSH:
26
+
1. Create a TCP tunnel, using either [`pomerium-cli`](/docs/clients/pomerium-cli) or the Pomerium Desktop client. These examples use Git connections over SSH:
0 commit comments