docs: update session recording and default quickstartingress.pomerium.io

[alexandreLamarre]

• fix: ingress controller switch to new valid default
• update session recording docs

Summary

Updates the default quickstart ingress.pomerium.io CR with the valid settings for hosted authenticate.
Updates session recording capability for ingress-controller and pomerium-enterprise images.

Related

ENG-4246
ENG-4247

ENG-4210

AI disclosure

none

Checklist

• reference any related issues
• disclosed AI usage (or wrote "none") per AI_POLICY.md

[netlify]

✅ Deploy Preview for pomerium-docs ready!

Name	Link
🔨 Latest commit	67e4175
🔍 Latest deploy log	https://app.netlify.com/projects/pomerium-docs/deploys/6a59064d3e11de0008aa29a8
😎 Deploy Preview	https://deploy-preview-2317--pomerium-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[greptile-apps]

Greptile Summary

This PR updates the session recording docs to cover the new enterprise container images (pomerium-enterprise and ingress-controller-enterprise) and adds deployment examples for Kubernetes, Docker Compose, and the Ingress Controller CR. It also fixes the Kubernetes quickstart Pomerium CR to use identityProvider.provider: hosted instead of the deprecated static authenticate.url.

• Enterprise image coverage: Documents ingress-controller-enterprise as the drop-in for pomerium/ingress-controller and pomerium-enterprise as the drop-in for pomerium/pomerium, each with Kubernetes and Docker Compose snippets.
• Extension path update: Corrects the mount target and envoy_dynamic_extensions path from /extensions/session_recording/session_recording_extension.so to /extensions/session_recording_extension.so across all deployment tabs.
• New "Enterprise bootstrap" tab: Adds a quickstart-oriented storage configuration via Console config file, env var, or CLI flag with an appropriate warning about production use.

Confidence Score: 4/5

Safe to merge after fixing the invalid YAML comment in the Kubernetes deployment snippet, which will cause kubectl apply to fail for users copying it directly.

The Kubernetes existing-deployments snippet at line 115 uses // ... as a comment, which is not valid YAML. A user who copies this snippet verbatim and runs kubectl apply will get a parse error. Everything else — the ingress CR quickstart fix, extension path corrections, new enterprise image documentation, and the bootstrap storage tab — is straightforward documentation and looks correct.

content/docs/capabilities/session-recording.mdx — the Kubernetes deployment snippet at line 115 uses an invalid YAML comment syntax that will break kubectl apply for any user who copies it directly.

Important Files Changed

Filename	Overview
content/docs/capabilities/session-recording.mdx	Adds enterprise image references, ingress-controller deployment path, Docker Compose example, and EnterpriseStatic bootstrap tab; contains an invalid YAML // comment in the Kubernetes snippet at line 115 that will cause kubectl apply to fail
content/examples/kubernetes/pomerium-global-settings.md	Replaces the deprecated authenticate.url: https://authenticate.pomerium.app with identityProvider.provider: hosted — a minimal, correct fix for the hosted auth quickstart CR

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Deploy Pomerium with session recording] --> B{Deployment type?}
    B --> C[Kubernetes / Ingress Controller]
    B --> D[Docker Compose]
    B --> E[Manual]

    C --> C1{Use enterprise image?}
    C1 -->|Yes| C2["Replace pomerium/ingress-controller with ingress-controller-enterprise"]
    C1 -->|No| C3["Mount extension via image volume into /extensions/"]

    D --> D1{Use enterprise image?}
    D1 -->|Yes| D2["Use pomerium-enterprise image"]
    D1 -->|No| D2b["Mount extension via image volume into /extensions/"]

    E --> E3["docker export and extract session_recording_extension.so"]

    C2 & C3 & D2 & D2b & E3 --> F["Configure envoy_dynamic_extensions: /extensions/session_recording_extension.so"]
    F --> G[Configure blob storage]
    G --> H["Enable session_recording on routes"]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Deploy Pomerium with session recording] --> B{Deployment type?}
    B --> C[Kubernetes / Ingress Controller]
    B --> D[Docker Compose]
    B --> E[Manual]

    C --> C1{Use enterprise image?}
    C1 -->|Yes| C2["Replace pomerium/ingress-controller with ingress-controller-enterprise"]
    C1 -->|No| C3["Mount extension via image volume into /extensions/"]

    D --> D1{Use enterprise image?}
    D1 -->|Yes| D2["Use pomerium-enterprise image"]
    D1 -->|No| D2b["Mount extension via image volume into /extensions/"]

    E --> E3["docker export and extract session_recording_extension.so"]

    C2 & C3 & D2 & D2b & E3 --> F["Configure envoy_dynamic_extensions: /extensions/session_recording_extension.so"]
    F --> G[Configure blob storage]
    G --> H["Enable session_recording on routes"]

Loading

_{Reviews (4): Last reviewed commit: "update session recording docs" | Re-trigger Greptile}