You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
GatewayArea: what it touches
ImprovementsKind: in v2.1.228,
ImprovementsSection of the release
What
Operator config parsing fails a deployment that enables customer-routed inference with an empty audience list or an empty organization allowlist. oidc is now required unless customer-routed inference is enabled.
Details
The rejection messages spell out the reason: audience binding is what stops a token minted for another organization's gateway from being replayed against yours.
Evidence
oidc is required \u2014 it may be omitted only for a customer-routed-inference-only deployment (cri.enabled: true)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
