akuity/kargo

Pre-submission checklist I have searched existing issues and confirmed this is not a duplicate. I understand that submitting a feature request does not guarantee it will be implemented. Proposed Feature http gained errorExpression in #6356 / #6414 so a failed request can put something from the response body into the promotion error shown in the UI. http-download still cannot do that. On a non-2xx response it fails with a status code only, and the body is discarded. It would be useful to opt into the same extraction when a download is rejected by the server. Motivation and Use Case We download files from HTTP APIs during promotions. Those APIs often return a useful reason in the body when they refuse the request. Users only see the status code, then watch the step retry up to errorThreshold with the same unhelpful message. That makes download failures hard to act on without fetching controller logs. Alternatives Considered Probe with http, then http-download on success. The probe

Problem The ACR credential provider authenticates only as the controller's own identity. Every Project pulling from a given registry therefore shares one set of permissions: granting access to one Project grants it to all of them. The ECR and GAR providers do not have this problem. Each attempts a Project-specific identity first — an IAM role for AWS, a service account for GCP — and falls back to the controller's own only when no such identity exists. Bringing the ACR provider to parity has been attempted before and did not get far. The mechanism was there to find: Entra's federated credential exchange amounts to the same operation, closest in shape to AWS's AssumeRoleWithWebIdentity. It is simply not presented as one. There is no API called "assume", the SDK spells it as constructing a credential with a different client ID, and the documentation frames federated identity credentials as a way for external systems to authenticate into Azure rather than as a way for one workload to a

Pre-submission checklist I have searched existing issues and confirmed this is not a duplicate. I understand that submitting a feature request does not guarantee it will be implemented. Proposed Feature The ability to extract SemVer from within a Docker tag. A regex group is my first thought - possibly in allowTagsRegexes. Something like this could be useful: allowTagsRegexes: - release-v(?<version>\d+\.\d+\.\d+(-.*)?) - pre-v(?<version>\d+\.\d+\.\d+(-.*)?) Where version is a well-known name for a regex group. I thought about just suggesting a group, but groups can be used for many things (optional components, etc) and could interfere with pattern building if you had to use exactly 1 group. To get around this, you'd perhaps iterate all groups in the regex to find a valid SemVer, but I don't think that's quite as safe (who knows what could be in a (.*) that's intended to be ignored). Adding a named group also means existing patterns with groups would continue to behave exactly a