chore(main): release 0.18.0

[github-actions]

🤖 I have created a release beep boop

0.18.0 (2026-04-05)

⚠ BREAKING CHANGES

• certificate.expiry metric changed from UpDownCounter to Gauge (#3088)
• host matching configuration in rules simplified (#2772)
• Helm chart configuration related to CRD and admission controller settings changed (#2772)
• PS256 dropped from the algorithms list allowed by default for signature verification purposes to better align with existing recommendations (#2830)
• generic contextualizer no longer supports continue_pipeline_on_error config property (#2829)
• subject configuration property defined for several authenticator mechanisms renamed to principal (#2825)
• validate rules command renamed to validate ruleset (#2812)
• Support for glob and regex host type expressions removed (#2666)
• allow_fallback_on_error property removed from authenticators (#2665)
• backtracking_enabled removed from the regular rule definition (#2662)

Features

• Subject object redesigned to be a composition of Principal objects (#2827) (9199e20)
• Better error responses for validate config command (#2813) (7968008)
• Better error responses for the serve subcommands (#2814) (5aec9df)
• Fine-grained principal attribute extraction support (#3037) (dcb7020)
• Helm chart extended with PodMonitor support (#2771) (434d65b)
• New convert ruleset command to convert rulesets between versions (#2772) (f7a0fdf)
• New kubernetes webhook for conversion of RuleSet resources between versions (#2772) (f7a0fdf)
• New metrics and spans (#3070) (e37e246)
• Old v1alpha1, v1alpha2, and v1alpha3 ruleset schemas added to the CRD (#2772) (f7a0fdf)
• Support authenticating multiple principals in a single request (#2849) (a1b11d6)

Code Refactorings

• allow_fallback_on_error property removed from authenticators (#2665) (73496bf)
• backtracking_enabled removed from the regular rule definition (#2662) (7775046)
• certificate.expiry metric changed from UpDownCounter to Gauge (#3088) (1faba9e)
• generic contextualizer no longer supports continue_pipeline_on_error config property (#2829) (5643c24)
• host matching configuration in rules simplified (#2772) (f7a0fdf)
• PS256 dropped from the algorithms list allowed by default for signature verification purposes to better align with existing recommendations (#2830) (5860e99)
• subject configuration property defined for several authenticator mechanisms renamed to principal (#2825) (667797f)
• validate rules command renamed to validate ruleset (#2812) (172908f)
• Helm chart configuration related to CRD and admission controller settings changed (#2772) (f7a0fdf)
• Support for glob and regex host type expressions removed (#2666) (d0f7bdb)

Documentation

• Clarified that heimdall config must be supplied via Helm values to the chart (#2835) (850c601)
• Integration guide for KGateway (#2760) (81c8a44)
• New section related to migration of rulesets (#2772) (f7a0fdf)

---

This PR was generated with Release Please. See documentation.