gloo

This release build failed.

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.29.2-patch2.

Breaking Changes

• • External Processing servers which mutate the body must also send a header mutation to correctly set the Content-Length. * Removing a query parameter in the ExtAuth filter no longer causes repeats of that query parameter to be removed. * JWT Authentication now validates the entire extracted token instead of only validating up to the first non-base64 character. * TE HTTP header from downstream is sanitized before proxying the request to upstream. * Host header is ignored if :authority header is included in HTTP/2 request, to bring Envoy into compliance with https://www.rfc-editor.org/rfc/rfc9113#section-8.3.1. (https://github.com/solo-io/gloo/issues/9232)
• Set the service_name field used to create the the Envoy OpenTelemetryConfig to the name of the Gateway under which the Gloo OpenTelemetryConfig is defined.
  Breaking changes: * The previous behavior, which was to set the service_name field to an empty string resulting in display name unknown_service:envoy, is no longer available. * The ToEnvoyOpenTelemetryonfiguration function in "github.com/solo-io/gloo/projects/gloo/pkg/api/v1/options/tracing" has been removed and replaced with ToEnvoyOpenTelemetryConfiguration, and the signature has been updated to: ToEnvoyOpenTelemetryConfiguration(clusterName, serviceName string) *envoytrace.OpenTelemetryConfig (https://github.com/solo-io/gloo/issues/7791)

New Features

• Expose the dynamic_stats option on the Envoy router. This flag is only intended to be used for benchmarking purposes - it is NOT RECOMMENDED to set this in production.
  For more information, see https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/router/v3/router.proto (https://github.com/solo-io/gloo/pull/9260)
• Add ability to use %METADATA()% command directives in envoy access log format config. These will eventually replace %DYNAMIC_METADATA()%, %UPSTREAM_METADATA()%, and %CLUSTER_METADATA()% as well as adding support for ROUTE and LISTENER.
  A Gloo user can now access metadata added in the route options via envoyMetadata through this formatter. (https://github.com/solo-io/gloo/issues/9246)

Fixes

• Fixes and improvements to glooctl version command:
• glooctl version previously had a bug displaying the tag when a digest image is used. It would show "latest" instead of showing the actual version.
• Both yaml and json options have been fixed to pretty the output. Previously both options did not format the display.
• This improvement also now includes kubernetes server version information. (https://github.com/solo-io/gloo/issues/9211)

Fixes

• Move resource cleanup job to pre-delete Helm hook. This fixes an issue where Helm uninstall would not complete when the validation webhook's failure policy was set to "Fail". (https://github.com/solo-io/solo-projects/issues/5903)

This release is building...

Dependency Bumps

• envoy-gloo/solo-io has been upgraded to 1.27.3-patch2.

Helm Changes

• Adds a new helm variable global.image.variant to specify the variant of the image to be deployed. Can take the values 'standard', 'fips', 'distroless', 'fips-distroless'. Defaults to 'standard'. (The 'fips' and 'fips-distroless' variants are an Enterprise-only feature). This consequently deprecates the global.image.fips value. Use global.image.variant=fips instead. (https://github.com/solo-io/gloo/issues/8849)

New Features

• Added support for settings.gloo.istioOptions.enableAutoMtls to implement auto mTLS via Envoy transport_socket_match. (https://github.com/solo-io/solo-projects/issues/5695)
• Add support for distroless images. (https://github.com/solo-io/gloo/issues/8849)

Fixes

• Move resource cleanup job to pre-delete Helm hook. This fixes an issue where Helm uninstall would not complete when the validation webhook's failure policy was set to "Fail". (https://github.com/solo-io/solo-projects/issues/5903)

This release is building...

Dependency Bumps

• envoy-gloo/solo-io has been upgraded to 1.27.3-patch2.

Helm Changes

• Adds a new helm variable global.image.variant to specify the variant of the image to be deployed. Can take the values 'standard', 'fips', 'distroless', 'fips-distroless'. Defaults to 'standard'. (The 'fips' and 'fips-distroless' variants are an Enterprise-only feature). This consequently deprecates the global.image.fips value. Use global.image.variant=fips instead. (https://github.com/solo-io/gloo/issues/8849)

New Features

• Added support for settings.gloo.istioOptions.enableAutoMtls to implement auto mTLS via Envoy transport_socket_match. (https://github.com/solo-io/solo-projects/issues/5695)
• Add support for distroless images. (https://github.com/solo-io/gloo/issues/8849)

Fixes

• Move resource cleanup job to pre-delete Helm hook. This fixes an issue where Helm uninstall would not complete when the validation webhook's failure policy was set to "Fail". (https://github.com/solo-io/solo-projects/issues/5903)

Dependency Bumps

• envoy-gloo/solo-io has been upgraded to 1.26.7-patch2.

Dependency Bumps

• envoy-gloo/solo-io has been upgraded to 1.27.3-patch2.

Breaking Changes

• glooctl get proxy will not work if you have persisted Proxy CRs in etcD and you are querying and older server version (1.16 and below). In general, we recommend that you keep your client and server versions in sync. You can verify the client/server versions you are currently running by calling glooctl version. (https://github.com/solo-io/solo-projects/issues/5874)

Fixes

• Expose use_hostname_for_hashing, the hostname will be used for hashing when using maglev for example, useful when using multiple host in the upstreams that resolve to the same IP. (https://github.com/solo-io/gloo/issues/9138)

Dependency Bumps

• helm.sh/helm has been upgraded to v3.14.2.

Dependency Bumps

• helm.sh/helm has been upgraded to v3.14.2.

Dependency Bumps

• rotisserie/eris has been upgraded to v0.5.4.
• solo-io/solo-kit has been upgraded to v0.34.2.

Helm Changes

• Add helm flags for setting log level on sds container .Values.global.glooMtls.sds.logLevel and setting log level on istio-proxy container global.glooMtls.istioProxy.logLevel. (https://github.com/solo-io/gloo/issues/9006)

Fixes

• Update to allow deletion of secrets when warnings or errors are present.
  When the deletion of a secret is validated, the validating admission webhook removes the secret from the current snapshot, runs translations and looks for errors. Previously, the secret would not be deleted if there were errors, or if there were warnings and the ignore_warnings setting was set as false. This casues issues when trying to delete secrets that are unrelated to the warnings or errors.
  The new behavior is to collect all the artifacts of the valdiation process, rerun validation against the original snapshot, and compare the artifacts from that process to the artifacts previously collected. If the artifacts are the same, the secret did not degrade the system and the deletion is allowed. If the artifacts are different, the secret is not deleted and errors are returned.
  Because this is a backport, the new behavior is disabled by default in order not to alter existing behavior. This feature can be turned on by setting the DISABLE_VALIDATION_AGAINST_PREVIOUS_STATE environment variable to false in the gloo deployment. A dedicated helm value has not been added, and the environment variable can be set using gloo.gloo.deployment.customEnv (https://github.com/solo-io/gloo/issues/8931)

This release contained no user-facing changes.

Dependency Bumps

• rotisserie/eris has been upgraded to v0.5.4.
• solo-io/solo-kit has been upgraded to v0.34.2.

New Features

• Update to allow deletion of secrets when warnings or errors are present.
  When the deletion of a secret is validated, the validating admission webhook removes the secret from the current snapshot, runs translations and looks for errors. Previously, the secret would not be deleted if there were errors, or if there were warnings and the ignore_warnings setting was set as false. This casues issues when trying to delete secrets that are unrelated to the warnings or errors.
  The new behavior is to collect all the artifacts of the valdiation process, rerun validation against the original snapshot, and compare the artifacts from that process to the artifacts previously collected. If the artifacts are the same, the secret did not degrade the system and the deletion is allowed. If the artifacts are different, the secret is not deleted and errors are returned.
  Because this may incur a performance hit due to the extra validation and the loss of short-circuiting of the validation process due to the need to collect all artifacts, this feature can be turned off by setting the DISABLE_VALIDATION_AGAINST_PREVIOUS_STATE environment variable to true in the gloo deployment. A dedicated helm value has not been added, and the environment variable can be set using gloo.gloo.deployment.customEnv (https://github.com/solo-io/gloo/issues/8931)
• Expose use_hostname_for_hashing, the hostname will be used for hashing when using maglev for example, useful when using multiple host in the upstreams that resolve to the same IP. (https://github.com/solo-io/gloo/issues/9138)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.27.3-patch1.

Fixes

• Add the option to allow retries for gRPC Passthrough Auth in case the service is unavailable. This can be configured via the new retryPolicy in the PassThroughGrpc AuthConfig. (https://github.com/solo-io/gloo/issues/6804)
• Expose the global.istioIntegration.AppendXForwardedHost Helm value to allow users to toggle off the appending of
  the x-forwarded-host header when using the Istio plugin. This field is true by default. (https://github.com/solo-io/gloo/issues/8855)
• Expose a new ratelimit option grpcService.authority to configure the authority header for the ratelimit gRPC call. (https://github.com/solo-io/gloo/issues/8995)
• Re-enable wget in our gloo and gateway-proxy pods. Wget is currently used in our non-custom probes which are currently not well covered in tests. Caused by https://github.com/solo-io/solo-projects/issues/5344 shift to ubuntu. (https://github.com/solo-io/gloo/issues/9092)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.26.7-patch1.

Fixes

• Add the option to allow retries for gRPC Passthrough Auth in case the service is unavailable. This can be configured via the new retryPolicy in the PassThroughGrpc AuthConfig. (https://github.com/solo-io/gloo/issues/6804)
• Expose the global.istioIntegration.AppendXForwardedHost Helm value to allow users to toggle off the appending of
  the x-forwarded-host header when using the Istio plugin. This field is true by default. (https://github.com/solo-io/gloo/issues/8855)
• Expose a new ratelimit option grpcService.authority to configure the authority header for the ratelimit gRPC call. (https://github.com/solo-io/gloo/issues/8995)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.25.10-patch2.

Fixes

• Add missing required runtime key for aggression in slow start config. (https://github.com/solo-io/gloo/pull/9031)
• Expose a new ratelimit option grpcService.authority to configure the authority header for the ratelimit gRPC call. (https://github.com/solo-io/gloo/issues/8995)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.23.12-patch4.

Fixes

• Add missing required runtime key for aggression in slow start config. (https://github.com/solo-io/gloo/pull/9031)
• Expose a new ratelimit option grpcService.authority to configure the authority header for the ratelimit gRPC call. (https://github.com/solo-io/gloo/issues/8995)

New Features

• Expose a new ratelimit option grpcService.authority to configure the authority header for the ratelimit gRPC call. (https://github.com/solo-io/gloo/issues/8995)

Fixes

• Re-enable wget in our gloo and gateway-proxy pods. Wget is currently used in our non-custom probes which are currently not well covered in tests. Caused by https://github.com/solo-io/solo-projects/issues/5344 shift to ubuntu. (https://github.com/solo-io/gloo/issues/9092)

Breaking Changes

• Disable Istio Envoy proxy from running by default and only rely on proxyless Istio agent mtls integration. Note: Although this is a change to the default behavior of the istio integration, this should not have any impact on most users as the sidecar proxy was unused in the data path. (https://github.com/solo-io/solo-projects/issues/5711)

Helm Changes

• Add helm flags for setting log level on sds container .Values.global.glooMtls.sds.logLevel and setting log level on istio-proxy container global.glooMtls.istioProxy.logLevel. (https://github.com/solo-io/gloo/issues/9006)

New Features

• Expose the global.istioIntegration.AppendXForwardedHost Helm value to allow users to toggle off the appending of
  the x-forwarded-host header when using the Istio plugin. This field is true by default. (https://github.com/solo-io/gloo/issues/8855)

New Features

• Add the option to allow retries for gRPC Passthrough Auth in case the service is unavailable. This can be configured via the new retryPolicy in the PassThroughGrpc AuthConfig. (https://github.com/solo-io/gloo/issues/6804)