gloo

Fixes

• Updates the init-plugin-manager command to match meshctl (no external install script). (https://github.com/solo-io/gloo/issues/4306)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.16.4.
• dgrijalva/jwt-go has been upgraded to v4.0.0-preview1.
• linux/alpine has been upgraded to 3.13.5.

Fixes

• Add helm setting to define envoy runtime override for CVE-2021-29492 (https://github.com/envoyproxy/envoy/security/advisories/GHSA-4987-27fx-x6cf). By default, Envoy's behavior does not change to address this vulnerability. The desired Http Connection Manager runtime setting option must be defined and is exposed as the gatewayProxies.NAME.pathWithEscapedSlashesAction helm value. See https://www.envoyproxy.io/docs/envoy/v1.16.4/configuration/http/http_conn_man/runtime.html for values. (https://github.com/solo-io/gloo/issues/4727)
• Update the Docker Compose docs. (https://github.com/solo-io/gloo/issues/4692)

Dependency Bumps

• envoyproxy/go-control-plane has been upgraded to v0.9.9-0.20210511190911-87d352569d55.
• solo-io/solo-kit has been upgraded to v0.18.5.
• solo-io/envoy-gloo has been upgraded to v1.18.1.
• dgrijalva/jwt-go has been upgraded to v4.0.0-preview1.
• linux/alpine has been upgraded to 3.13.5.

Fixes

• Autogenerate filter types that glooctl proxy served-config depends on to prevent breaking (https://github.com/solo-io/gloo/issues/4665)
• Expose hcm options needed for CVE-2021-29492 (https://github.com/envoyproxy/envoy/security/advisories/GHSA-4987-27fx-x6cf). By default, Envoy's behavior does not change to address this vulnerability. The desired Http Connection Manager PathWithEscapedSlashesAction setting option must be defined on gateways. (https://github.com/solo-io/gloo/issues/4727)

Dependency Bumps

• envoyproxy/go-control-plane has been upgraded to v0.9.9-0.20210511190911-87d352569d55.
• solo-io/solo-kit has been upgraded to v0.17.5.
• solo-io/envoy-gloo has been upgraded to v1.17.3.
• dgrijalva/jwt-go has been upgraded to v4.0.0-preview1.
• linux/alpine has been upgraded to 3.13.5.

Fixes

• Expose hcm options needed for CVE-2021-29492 (https://github.com/envoyproxy/envoy/security/advisories/GHSA-4987-27fx-x6cf). By default, Envoy's behavior does not change to address this vulnerability. The desired Http Connection Manager PathWithEscapedSlashesAction setting option must be defined on gateways. (https://github.com/solo-io/gloo/issues/4727)

New Features

• Exposes envoy functionality to define tracing custom tags based on environment variables and literals. (https://github.com/solo-io/gloo/issues/4699)

Dependency Bumps

• solo-io/go-utils has been upgraded to v0.21.5.

Fixes

• Fix setting of stat server log level when using the LOG_LEVEL environment variable (https://github.com/solo-io/gloo/issues/4648)

New Features

• Exposes envoy functionality to define tracing custom tags based on environment variables and literals. (https://github.com/solo-io/gloo/issues/4699)

New Features

• Exposes envoy functionality to define tracing custom tags based on environment variables and literals. (https://github.com/solo-io/gloo/issues/4699)

Fixes

• Apply alpn protocols when resolving common ssl config to support Istio mtls in permissive mode. (https://github.com/solo-io/gloo/issues/3994)
• Add oneWayTls boolean configuration to the SslConfig (referenced on VirtualServices) to allow users to configure TLS termination to use one-way TLS rather than mTLS even if the root CA is provided (e.g., by default with TLS secrets from cert-manager). (https://github.com/solo-io/gloo/issues/4254)

Helm Changes

• Allow users to set custom annotations on gateway webhook, which enables for example use of cert-manager's ca-injector to inject the caBundle. (https://github.com/solo-io/gloo/issues/3790)
• Allow users to opt-out from using Helm pre-install Hook to install gateway webhook. This can be usefull for GitOps workflows in which case the webhook must be updated (not just installed) via Helm. (https://github.com/solo-io/gloo/issues/2679)

New Features

• Allows configuration of max gRPC message size for Proxy CRD validation from gateway to gloo. (https://github.com/solo-io/gloo/issues/4594)

Fixes

• Fix helm2 installation. (https://github.com/solo-io/gloo/issues/4661)
• Apply alpn protocols when resolving common ssl config to support Istio mtls in permissive mode. (https://github.com/solo-io/gloo/issues/3994)

Fixes

• Fixes the glooctl proxy served-config command, which will now correctly dump the config that Gloo is serving to Envoy (https://github.com/solo-io/gloo/issues/3947)

Fixes

• Apply alpn protocols when resolving common ssl config to support Istio mtls in permissive mode. (https://github.com/solo-io/gloo/issues/3994)

Dependency Bumps

• envoy-gloo/solo-io has been upgraded to v1.19.0-rc1.

Dependency Bumps

• envoy-gloo/solo-io has been upgraded to v1.17.3-patch1.

Helm Changes

• Allow users to set custom annotations on gateway webhook, which enables for example use of cert-manager's ca-injector to inject the caBundle. (https://github.com/solo-io/gloo/issues/3790)
• Allow users to opt-out from using Helm pre-install Hook to install gateway webhook. This can be usefull for GitOps workflows in which case the webhook must be updated (not just installed) via Helm. (https://github.com/solo-io/gloo/issues/2679)

New Features

• Allows configuration of max gRPC message size for Proxy CRD validation from gateway to gloo. (https://github.com/solo-io/gloo/issues/4594)

Dependency Bumps

• golang/go has been upgraded to v1.16.3.

Helm Changes

• Allow users to set custom annotations on gateway webhook, which enables for example use of cert-manager's ca-injector to inject the caBundle. (https://github.com/solo-io/gloo/issues/3790)
• Allow users to opt-out from using Helm pre-install Hook to install gateway webhook. This can be usefull for GitOps workflows in which case the webhook must be updated (not just installed) via Helm. (https://github.com/solo-io/gloo/issues/2679)

New Features

• Allows configuration of max gRPC message size for Proxy CRD validation from gateway to gloo. (https://github.com/solo-io/gloo/issues/4594)
• Staged transformations can be inherited from parent routes (Virtual Host -> Route tables -> Routes). This can be enabled using the inheritTransformation option in StagedTransformations. Parent staged transformations will be appended to a child's Transformations. Only the first transformation to match the route will be evaluated, with child transformations receiving priority over parent transformations. (https://github.com/solo-io/gloo/issues/3798)
• Allows configuration of query parameters to add the the Gloo extauth service's OIDC token request. This can be useful as part of OIDC PKCE to set the code_verifier. (https://github.com/solo-io/gloo/issues/4329)

Fixes

• Apply alpn protocols when resolving common ssl config to support Istio mtls in permissive mode. (https://github.com/solo-io/gloo/issues/3994)

Dependency Bumps

• envoy-gloo/solo-io has been upgraded to v1.16.3.

Fixes

• Fix enterprise install commands to use latest patch version based off of the CLI minor version. (https://github.com/solo-io/gloo/issues/4555)

Dependency Bumps

• envoy-gloo/solo-io has been upgraded to v1.18.0.

Fixes

• Increase burst in the kube client config for glooctl to avoid request throttling when checking secrets (https://github.com/solo-io/gloo/issues/4519)

Dependency Bumps

• envoy-gloo/solo-io has been upgraded to v1.17.2.

Dependency Bumps

• envoy-gloo/solo-io has been upgraded to v1.18.0.

Fixes

• Make upstream failover DNS polling frequency configurable in the Gloo settings (https://github.com/solo-io/gloo/issues/4228)