gloo

Dependency Bumps

• docker/distribution has been upgraded to v2.8.2+incompatible.

Dependency Bumps

• docker/distribution has been upgraded to v2.8.2+incompatible.

Dependency Bumps

• docker/distribution has been upgraded to v2.8.2+incompatible.
• envoy-gloo/solo-io has been upgraded to v1.25.6-patch4.

Fixes

• The following AccessLogFilters now require the following values to be set: FractionalPercent.RuntimeKey on RuntimeFilter, ComparisonFilter.Value and ComparisonFilter.Value.RuntimeKey on StatusCodeFilter ComparisonFilter.Value and ComparisonFilter.Value.RuntimeKey on DurationFilter (https://github.com/solo-io/solo-projects/issues/4991)

Dependency Bumps

• gohugoio/hugo has been upgraded to v0.81.0.
• docker/distribution has been upgraded to v2.8.2+incompatible.
• envoy-gloo/solo-io has been upgraded to v1.25.6-patch4.

Fixes

• The following AccessLogFilters now require the following values to be set: FractionalPercent.RuntimeKey on RuntimeFilter, ComparisonFilter.Value and ComparisonFilter.Value.RuntimeKey on StatusCodeFilter ComparisonFilter.Value and ComparisonFilter.Value.RuntimeKey on DurationFilter (https://github.com/solo-io/solo-projects/issues/4991)

Helm Changes

• Fixes some Helm indent spacing issues. (https://github.com/solo-io/gloo/issues/8268)

Fixes

• Add a field for the enterprise passthrough feature. The new field allows for a subsection of ciphers to be considered for tls termination. (https://github.com/solo-io/solo-projects/issues/5044)
• Envoy rejects headerManipulation.responseHeadersToAdd headers where the key start with a ':' and Host headers. We will now reject those headers in gloo validation instead of passing the invalid config to envoy. (https://github.com/solo-io/gloo/issues/8225)
• Allow configuring secrets resource clients with multiple underlying source clients. This will allow Gloo Edge to List and Watch secrets from any number of the currently supported sources (i.e. Directory, Kubernetes, Vault). It is the responsibility of the user to ensure there are no namespace+name collisions across all configured sources. (https://github.com/solo-io/solo-projects/issues/4892)

Fixes

• Added customInputResource unmarshalling logic to ValidatingAdmissionWebhook for RateLimitConfigs (https://github.com/solo-io/gloo/issues/8042)

New Features

• Envoy rejects headerManipulation.responseHeadersToAdd headers where the key start with a ':' and Host headers. We will now reject those headers in gloo validation instead of passing the invalid config to envoy. (https://github.com/solo-io/gloo/issues/8225)
• Allow configuring secrets resource clients with multiple underlying source clients. This will allow Gloo Edge to List and Watch secrets from any number of the currently supported sources (i.e. Directory, Kubernetes, Vault). It is the responsibility of the user to ensure there are no namespace+name collisions across all configured sources. (https://github.com/solo-io/solo-projects/issues/4892)

Helm Changes

• Allow resource types listed in the gateway.validation.webhook.skipDeleteValidationResources array to be deleted without validation. Use "*" to skip validation for all resource types. (https://github.com/solo-io/gloo/issues/8282)

Fixes

• Update to support tcp when isolating on filterchains on virtual services. Previously when not isolating filter chains tcp and http could coexist by matcher. Now when isolated tcp is not ignored (previously ignored on delegated and warned on inline). (https://github.com/solo-io/solo-projects/issues/4982)
• When gRPC is defined on an Upstream, only create filters on Listeners that reference that US. (https://github.com/solo-io/gloo/issues/7477)
• Fixes an issue when setting proxyprotocol on an upstream that was also static. (https://github.com/solo-io/solo-projects/issues/4760)
• Fixes overlapping sni when using the new matcher framework for filters (https://github.com/solo-io/solo-projects/issues/4982)

Dependency Bumps

• solo-io/go-utils has been upgraded to v0.24.2.
• solo-io/k8s-utils has been upgraded to v0.4.0.
• solo-io/skv2 has been upgraded to v0.30.0.
• solo-io/solo-apis has been upgraded to sa-k8s-1.26-bump.
• solo-io/solo-kit has been upgraded to v0.32.0.
• k8s.io/api has been upgraded to v0.26.4.
• k8s.io/apiextensions-apiserver has been upgraded to v0.26.4.
• k8s.io/apimachinery has been upgraded to v0.26.4.
• k8s.io/client-go has been upgraded to v0.26.4.
• k8s.io/code-generator has been upgraded to v0.26.4.
• k8s.io/component-base has been upgraded to v0.26.4.
• k8s.io/kubectl has been upgraded to v0.26.4.
• k8s.io/kube-openapi has been upgraded to v0.0.0-20221012153701-172d655c2280.
• k8s.io/metrics has been upgraded to v0.26.4.
• k8s.io/utils has been upgraded to v0.0.0-20221128185143-99ec85e7a448.
• sigs.k8s.io/controller-runtime has been upgraded to v0.14.6.

Breaking Changes

• Update Kubernetes API to 1.26. (https://github.com/solo-io/gloo/issues/8164)

Helm Changes

• Allow resource types listed in the gateway.validation.webhook.skipDeleteValidationResources array to be deleted without validation. Use "*" to skip validation for all resource types. (https://github.com/solo-io/gloo/issues/8282)

Fixes

• When gRPC is defined on an Upstream, only create filters on Listeners that reference that US. (https://github.com/solo-io/gloo/issues/7477)

Helm Changes

• Allow custom securityContext definitions to be merged with the default definition instead of overwriting with the use of the merge field. Original PR: https://github.com/solo-io/gloo/pull/8192 (https://github.com/solo-io/gloo/issues/7912)

Fixes

• Updates glooctl check to use the GPRC endpoint for proxy validation.
  This fixes an issue where the check would report false-positives
  for invalid proxies that were not persisted. (https://github.com/solo-io/gloo/issues/7697)

Fixes

• Updates glooctl check to use the GPRC endpoint for proxy validation.
  This fixes an issue where the check would report false-positives
  for invalid proxies that were not persisted. (https://github.com/solo-io/gloo/issues/7697)

Fixes

• Static upstream support for setting proxy protocol https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.proto.html (https://github.com/solo-io/solo-projects/issues/4760)
• Changed the static upstream useTls field from a bool to google.protobuf.BoolValue, to allow explicitly disabling TLS autodetection based on port. (https://github.com/solo-io/solo-projects/issues/4795)
• Expose the access log flush duration option in Envoy to enable flushing to the access log on a periodic basis. The default behaviour is to only write to the access log when a connection is closed meaning that long-running tcp connections may take a long time to get written to the access log. (https://github.com/solo-io/solo-projects/issues/4895)
• Updates glooctl check to use the GPRC endpoint for proxy validation.
  This fixes an issue where the check would report false-positives
  for invalid proxies that were not persisted. (https://github.com/solo-io/gloo/issues/7697)
• Backport change to support mismatched versions of the gRPC transcoding API to make upgrade/migration without downtime possible. (https://github.com/solo-io/gloo/issues/8080)

New Features

• Static upstream support for setting proxy protocol https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.proto.html (https://github.com/solo-io/solo-projects/issues/4760)
• Expose the access log flush duration option in Envoy to enable flushing to the access log on a periodic basis. The default behaviour is to only write to the access log when a connection is closed meaning that long-running tcp connections may take a long time to get written to the access log. (https://github.com/solo-io/solo-projects/issues/4895)

Fixes

• Changed the static upstream useTls field from a bool to google.protobuf.BoolValue, to allow explicitly disabling TLS autodetection based on port. (https://github.com/solo-io/solo-projects/issues/4795)
• Updates glooctl check to use the GPRC endpoint for proxy validation.
  This fixes an issue where the check would report false-positives
  for invalid proxies that were not persisted. (https://github.com/solo-io/gloo/issues/7697)

Helm Changes

• Allow custom securityContext definitions to be merged with the default definition instead of overwriting with the use of the merge field (https://github.com/solo-io/gloo/issues/7912)
• Add helm value for ratelimitServer in settings. (https://github.com/solo-io/gloo/issues/4379)
• Gloo edge will now use 1024 as the default value for settings.regexMaxProgramSize Envoy has a default of 100 and this is often not large enough for users. This size gives users more headroom for their regex patterns (https://github.com/solo-io/gloo/issues/8184)

Fixes

• fixes flake in generated_kube_types_test.go (https://github.com/solo-io/gloo/issues/8099)
• Support mismatched versions of the gRPC transcoding API to make migration without downtime possible. (https://github.com/solo-io/gloo/issues/8080)
• Adds regex validation to gloo.solo.io.RouteOptions.prefixRewrite and gloo.solo.io.RouteOptions.hostRewritePathRegex to prevent leaking invalid regex to envoy (https://github.com/solo-io/gloo/issues/8091)

Helm Changes

• Add helm value for ratelimitServer in settings. (https://github.com/solo-io/gloo/issues/4379)

Fixes

• (Enterprise Only) Introduce ability to configure timeouts for individual resolutions within a GraphQL query. Additionally, default the resolver timeout to that configured on the upstream, if any. The per-resolution timeout will overwrite the upstream timeout, and if neither are set then the default timeout of 1 second will be applied. (https://github.com/solo-io/gloo/issues/7950)

Helm Changes

• Add helm value for ratelimitServer in settings. (https://github.com/solo-io/gloo/issues/4379)

Fixes

• (Enterprise Only) Introduce ability to configure timeouts for individual resolutions within a GraphQL query. Additionally, default the resolver timeout to that configured on the upstream, if any. The per-resolution timeout will overwrite the upstream timeout, and if neither are set then the default timeout of 1 second will be applied. (https://github.com/solo-io/gloo/issues/7950)

Fixes

• fixes flake in generated_kube_types_test.go (https://github.com/solo-io/gloo/issues/8099)
• Adds regex validation to gloo.solo.io.RouteOptions.prefixRewrite to prevent leaking invalid regex to envoy (https://github.com/solo-io/gloo/issues/8091)

Fixes

• fixes flake in generated_kube_types_test.go (https://github.com/solo-io/gloo/issues/8099)
• Adds regex validation to gloo.solo.io.RouteOptions.prefixRewrite to prevent leaking invalid regex to envoy (https://github.com/solo-io/gloo/issues/8091)

New Features

• Expose Envoy's OCSP Stapling support through two new fields: ocsp_staple and ocsp_staple_policy. OCSP responses can be stored in TLS secrets through glooctl create secret tls, or by manually storing the OCSP response in a k8s tls secret under the data field: tls.ocsp-staple. The tls.ocsp-staple secret field name is subject to change, and is currently based off of the naming used by cert-manager in this WIP PR. (https://github.com/solo-io/gloo/issues/5605)

Fixes

• Adds regex validation to gloo.solo.io.RouteOptions.prefixRewrite and gloo.solo.io.RouteOptions.hostRewritePathRegex to prevent leaking invalid regex to envoy (https://github.com/solo-io/gloo/issues/8091)
• Added the ability to create EncryptionSecrets via glooctl create secret. (https://github.com/solo-io/gloo/issues/8094)