feat: add audit log object storage (S3/GCS), calendar_aligned fields, force_single_region, and allowOnAllVirtualKeys to Helm chart v2.1.28

[BearTS]

Summary

Adds Helm chart v2.1.28 with several new configuration fields for audit log object storage archival, Vertex AI single-region enforcement, calendar-aligned budget resets, and MCP client key access controls.

Changes

• Audit log object storage (bifrost.auditLogs.objectStorage): New field to archive audit events to S3 or GCS. Supports type, bucket, prefix, compress, and full S3 credential fields (region, endpoint, accessKeyId, secretAccessKey, sessionToken, roleArn, forcePathStyle) as well as GCS fields (projectId, credentialsJson). Renders into audit_logs.object_storage in the generated config.
• force_single_region on Vertex key config: When true, skips automatic promotion of multi-region-only models to a multi-region endpoint. Intended for provisioned throughput use cases. Renders into vertex_key_config.force_single_region.
• calendar_aligned on access profiles: New top-level field on bifrost.accessProfiles[*] that snaps all budget and rate-limit reset windows to calendar boundaries for the profile.
• calendar_aligned on budgets: Added to bifrost.accessProfiles[*].budgets[*] and bifrost.accessProfiles[*].provider_configs[*].budgets[*]. Previously blocked by additionalProperties: false in the schema; now matches parity with governance.budgets[*].calendar_aligned.
• calendar_aligned rendering for virtual keys: Field was accepted by schema but not emitted into the rendered config. Now correctly outputs virtual_keys[*].calendar_aligned.
• allowOnAllVirtualKeys on MCP client configs: Field was already wired in the template but undocumented. Now visible in values.yaml with a description. Renders into mcp.client_configs[*].allow_on_all_virtual_keys.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Validate the Helm template rendering with the new fields:

# Render with object storage enabled (S3)
helm template bifrost ./helm-charts/bifrost \
  --set bifrost.auditLogs.objectStorage.type=s3 \
  --set bifrost.auditLogs.objectStorage.bucket=my-bucket \
  --set bifrost.auditLogs.objectStorage.region=us-east-1

# Verify calendar_aligned renders for virtual keys
helm template bifrost ./helm-charts/bifrost \
  --set 'bifrost.governance.virtualKeys[0].name=test-key' \
  --set 'bifrost.governance.virtualKeys[0].calendar_aligned=true'

# Verify force_single_region renders for Vertex keys
helm template bifrost ./helm-charts/bifrost \
  --set 'bifrost.providers.vertex.keys[0].vertex_key_config.force_single_region=true'

Confirm that audit_logs.object_storage, virtual_keys[*].calendar_aligned, and vertex_key_config.force_single_region appear correctly in the rendered config.json.

Breaking changes

• Yes
• No

Security considerations

The objectStorage configuration accepts sensitive credential fields (accessKeyId, secretAccessKey, sessionToken, roleArn, credentialsJson). These should be provided via Kubernetes secrets or environment variable references rather than plain values in values.yaml to avoid exposing credentials in version control.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 24 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6b0cf3c5-08df-483e-8dd5-382afe5712a0

📥 Commits

Reviewing files that changed from the base of the PR and between e1690e5 and 4bf0254.

📒 Files selected for processing (6)

• docs/changelogs/helm-v2.1.28.mdx
• docs/docs.json
• helm-charts/bifrost/README.md
• helm-charts/bifrost/templates/_helpers.tpl
• helm-charts/bifrost/values.schema.json
• helm-charts/bifrost/values.yaml

📝 Walkthrough

Walkthrough

Helm schemas, examples, and templates now support audit log object storage, calendar-aligned budgets, Vertex regional settings, and related MCP configuration documentation. Changelog content and documentation navigation were updated for Helm v2.1.28.

Changes

Helm configuration updates

Layer / File(s)	Summary
Configuration schemas and examples helm-charts/bifrost/values.schema.json, helm-charts/bifrost/values.yaml	Adds validation and commented examples for audit log S3/GCS storage, calendar_aligned budget fields, and Vertex force_single_region.
Rendered configuration support helm-charts/bifrost/templates/_helpers.tpl	Renders calendar_aligned on governance virtual keys and builds audit_logs.object_storage with S3/GCS-specific fields.
Changelog documentation docs/changelogs/helm-v2.1.28.mdx, helm-charts/bifrost/README.md, docs/docs.json	Documents the new Helm configuration fields and adds the v2.1.28 changelog to navigation.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• maximhq/bifrost#4991: Adds related runtime support for audit log archival configuration using S3/GCS fields.

Suggested reviewers: danpiths, roroghost17, TejasGhatte, akshaydeo

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR does not implement Files API support or POST /v1/files for [#123]; it only updates Helm chart configuration and docs.	Add the Files API implementation for provider uploads, including POST /v1/files support for OpenAI/Anthropic and RAG/fine-tuning use cases.
Out of Scope Changes check	⚠️ Warning	All changed files are Helm chart/docs updates and are unrelated to the linked Files API support request in [#123].	Remove or split the Helm chart/doc changes into a separate PR and keep this one focused on Files API support.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly summarizes the main Helm chart update and matches the changeset.
Description check	✅ Passed	The description covers the main template sections: summary, changes, type, affected areas, testing, breaking changes, security, and checklist.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 07-10-feat_new_calendar_alignment_additions

---

_{Comment @coderabbitai help to get the list of available commands.}

[BearTS]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• chore: release Bifrost Helm chart v2.1.27 #5080
• feat: add bifrost.alerting to Helm chart with declarative channels and CEL-based rules #5079
• feat: add audit log object storage (S3/GCS), calendar_aligned fields, force_single_region, and allowOnAllVirtualKeys to Helm chart v2.1.28 #5077 👈 (View in Graphite)
• adds alerting schema to config.schema.json #5078
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
helm-charts/bifrost/templates/_helpers.tpl	Adds rendering for virtual-key calendar alignment and audit log object storage.
helm-charts/bifrost/values.schema.json	Adds schema entries for audit object storage, calendar alignment, and Vertex single-region settings.
helm-charts/bifrost/values.yaml	Documents the new chart values and examples.
docs/changelogs/helm-v2.1.28.mdx	Adds the Helm v2.1.28 changelog page.
docs/docs.json	Adds the new Helm changelog page to navigation.
helm-charts/bifrost/README.md	Updates the chart changelog with the new fields.

_{Reviews (3): Last reviewed commit: "feat: new calendar alignment additions" | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/changelogs/helm-v2.1.28.mdx`:
- Line 10: The changelog entry for bifrost.auditLogs.objectStorage is
overstating compression support by implying all archived batches are gzipped;
update the description so gzip is clearly controlled by the compress option and
only applies when that flag is enabled. Keep the rest of the field list intact,
and make sure the wording matches the behavior in the Helm helper and the
audit_logs.object_storage rendering.

In `@helm-charts/bifrost/values.yaml`:
- Around line 1070-1077: Clarify the object storage archival comments in
values.yaml so they match the schema semantics: the audit event batches should
be described as JSONL by default, with gzip compression and the .gz suffix only
applied when objectStorage.compress is true. Update the nearby objectStorage
example/comments around the audit-logs configuration to reflect this conditional
behavior and keep the wording aligned with the compress field.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 52b53b3b-117b-466b-a9e3-b0436f4129fd

📥 Commits

Reviewing files that changed from the base of the PR and between 3fbd9a4 and e1690e5.

📒 Files selected for processing (6)

• docs/changelogs/helm-v2.1.28.mdx
• docs/docs.json
• helm-charts/bifrost/README.md
• helm-charts/bifrost/templates/_helpers.tpl
• helm-charts/bifrost/values.schema.json
• helm-charts/bifrost/values.yaml