guacamole changelog

0.1.1

Released 2026-10-25.

Changes

Extra labels on the Route

route.labels adds labels to the Route, next to route.annotations. A platform can select the Route that way, for example to register an OpenID Connect client for its host.

0.1.0

Released 2026-10-17.

Changes

Add guacamole chart (#8)

Apache Guacamole 1.6.0 as a marketplace chart: web application and guacd in one pod, a CloudNativePG database, optional OpenID Connect sign-in, session recording to a volume and an optional copy of the recordings to an ObjectBucketClaim bucket.

A post-install/post-upgrade Job creates the schema once and then sets the guacadmin password and the declared connections on every run, so values stay authoritative and an Argo CD PostSync rerun is harmless. Connection users get READ on their connection and nothing else. guacd listens on localhost only, since it authenticates nobody.

A Firefox kiosk behind TigerVNC, built in the project, as the target of a Guacamole VNC connection. Firefox enterprise policy blocks every URL outside kiosk.allowedUrls, file:// included, and turns off developer tools, about:config, printing, extensions, password reveal and Firefox accounts; downloads go to a temporary directory. Saved logins stay in a profile volume. An optional EgressFirewall limits the project to the listed names and ranges, and a NetworkPolicy opens VNC to the Guacamole pod only.