gloo

Helm Changes

• Added a new accessLoggingService Helm value that allows users to define access logs from helm. (https://github.com/solo-io/gloo/issues/4096)
• Added a new affinity Helm value that allows users to define more fine grained affinity rules. (https://github.com/solo-io/gloo/issues/3995)

New Features

• Provides an enterprise-only option to use the leftmost IP address from the x-forwarded-for header and set it as the downstream address. This is useful if the network topology (load balancers, etc.) prior to gloo is unknown or dynamic. If using this option, be sure to sanitize this header from downstream requests to prevent security risks. (https://github.com/solo-io/gloo/issues/4014)
• Add new regexRewrite option to routes. This new field can be used to substitute matched regex patterns for alternate text in request paths, optionally including capture groups from the regex. (https://github.com/solo-io/gloo/issues/3321)

Helm Changes

• Added a new externalIPs Helm value that allows users to define a list of IP addresses for which nodes in the cluster will also accept traffic. (https://github.com/solo-io/gloo/issues/3791)

Fixes

• Improve error message when outlier detection interval is erroneously configured as nil. (https://github.com/solo-io/gloo/issues/4217)

This release contained no user-facing changes.

Upgrade Notes

• Upgrade gloo's envoy api to remove v2 references. This marks the complete transition from v2 to v3. (https://github.com/solo-io/gloo/issues/4042)

Helm Changes

• Added a new extraVolumes and extraProxyVolumeMounts Helm value that allows users to define additional volumes and volume mounts on the gateway proxy container. (https://github.com/solo-io/gloo/issues/4198)

Dependency Bumps

• solo-io/skv2 has been upgraded to v0.17.2.

New Features

• Add ability for the Gloo Edge Enterprise external auth server to validate OAuth 2.0 access tokens based on access token scopes. The new requiredScopes field of AccessTokenValidation can be used to specify a list of required scopes for a token. Omitting the field means that scope validation is skipped. (https://github.com/solo-io/gloo/issues/4224)

Dependency Bumps

• solo-io/protoc-gen-ext has been upgraded to v0.0.15.

Fixes

• Fixed a bug where some protobufs were erroneously being considered
  equal when comparing values inside of a oneOf interface. This resulted
  in some subtle bugs where sometimes proxies would not receive updates
  when reconciled in certain situations where only very small changes were made.

This bug affected Gloo Edge 1.6.0 to 1.6.6 and 1.7.0-beta1 to 1.7.0-beta11 versions only. (https://github.com/solo-io/gloo/issues/4215)

Dependency Bumps

• solo-io/protoc-gen-ext has been upgraded to v0.0.15.
• solo-io/go-utils has been upgraded to v0.20.2.

Fixes

• Fixed a bug where some protobufs were erroneously being considered
  equal when comparing values inside of a oneOf interface. This resulted
  in some subtle bugs where sometimes proxies would not receive updates
  when reconciled in certain situations where only very small changes were made.

This bug affected Gloo Edge 1.6.0 to 1.6.6 and 1.7.0-beta1 to 1.7.0-beta11 versions only. (https://github.com/solo-io/gloo/issues/4215)

Fixes

• Allow for the configuration of socket options on the envoy listener. This is useful, for example, to set TCP keep alive for downstream connections to envoy (e.g., NLB in front of envoy). (https://github.com/solo-io/gloo/issues/3758)

Fixes

• Allow for the configuration of socket options on the envoy listener. This is useful, for example, to set TCP keep alive for downstream connections to envoy (e.g., NLB in front of envoy). (https://github.com/solo-io/gloo/issues/3758)

New Features

• Allow for the configuration of socket options on the envoy listener. This is useful, for example, to set TCP keep alive for downstream connections to envoy (e.g., NLB in front of envoy). (https://github.com/solo-io/gloo/issues/3758)

Fixes

• Re-enable REST EDS. Change the helm template to avoid this helm issue (https://github.com/Masterminds/sprig/issues/111). (https://github.com/solo-io/gloo/issues/4151)
• Changes helm to make rest_xds_cluster deployment optional. (https://github.com/solo-io/gloo/issues/4164)

New Features

• Added the new transport_api_version field to the extauth settings. The field determines the API version for the ext_authz transport protocol that will be used by Envoy to communicate with the auth server. The currently allowed values are V2 and V3, with the former being the default; this was done to maintain compatibility with existing custom auth servers. Note that in order for the external auth server to be able to emit dynamic metadata the field needs to be set to V3. For more info, see the transport_api_version field here. (https://github.com/solo-io/gloo/issues/4160)

Dependency Bumps

• solo-io/skv1 has been upgraded to v0.7.0.
• solo-io/solo-apis has been upgraded to v0.0.0-20210122142844-ac0df2dce136.
• helm/helm has been upgraded to v3.4.2.
• containerd/containerd has been upgraded to v1.4.3.
• k8s.io/kube-openapi has been upgraded to v0.0.0-20200805222855-6aeccd4b50c6.
• k8s.io/utils has been upgraded to v0.0.0-20201110183641-67b214c5f920.
• k8s.io/controller-runtime has been upgraded to v0.7.0.
• k8s.io/kubernetes has been upgraded to v1.19.6.

New Features

• Added the new envoy_metadata route option. This field can be used to provide additional information which can be consumed by the Envoy filters that process requests that match the route. For more info about metadata, see here. (https://github.com/solo-io/gloo/issues/4160)
• Add support for metadata actions to the rate limit API. The new metadata action type can now be used to generate rate limit descriptors based on both static and dynamic Envoy metadata. (https://github.com/solo-io/gloo/issues/4160)

Fixes

• Re-enable REST EDS. Change the helm template to avoid this helm issue (https://github.com/Masterminds/sprig/issues/111). (https://github.com/solo-io/gloo/issues/4151)
• Changes helm to make rest_xds_cluster deployment optional. (https://github.com/solo-io/gloo/issues/4164)

New Features

• Adds API to support two different instances of JWT validation, before the envoy extauth filter and after. (https://github.com/solo-io/gloo/issues/3207)

Fixes

• Fix a race condition in the gateway-validation-webhook, where resources applied concurrently can avoid validation. (https://github.com/solo-io/gloo/issues/4136)

Fixes

• CPU profile of Gloo at scale (5000+ upstreams) indicated that the generateXDSSnapshot function was taking upwards of 5 seconds of CPU on a ~50 second sample. This change optimizes the code by using creating hashes for the XDS snapshot using deterministic proto marshalling and fnv hashing rather than the reflection-based mitchellh/hashstructure which was benchmarked to be several orders of magnitude slower. (https://github.com/solo-io/gloo/issues/4084)
• CPU profile of Gloo at scale (5000+ upstreams) indicated that the endpointsForUpstream function was taking upwards of 5 seconds of CPU on a ~50 second sample. This change optimizes the code by using a map instead of looping over all endpoints for each upstream. (https://github.com/solo-io/gloo/issues/4084)
• Gloo Edge now proactively reports warnings on virtual services that have matchers that are short-circuited.
  To enable, update the Gloo Settings such that spec.gateway.validation.warnRouteShortCircuiting=true
  The cases now additionally covered are:
  • routes that have simple OR regex header matchers, ensuring each one of the OR'ed matchers can be reached
  • the same logic, but with method matchers
    In addition, we support aggressively reporting errors on virtual services with invalid regex matchers. (no need
    to enable short-circuiting reporting) (https://github.com/solo-io/gloo/issues/3334)
• Fix a race condition in the gateway-validation-webhook, where resources applied concurrently can avoid validation. (https://github.com/solo-io/gloo/issues/4136)

New Features

• On a Gloo OS release, push the open source protos to the solo-apis repository. (https://github.com/solo-io/gloo/issues/3518)

Fixes

• Fix a race condition in the gateway-validation-webhook, where resources applied concurrently can avoid validation. (https://github.com/solo-io/gloo/issues/4136)

New Features

• Add the glooctl get ratelimitconfig command. (https://github.com/solo-io/gloo/issues/4085)
• Add warnings when users try to use enterprise-only Gloo Edge features when running the Open Source edition of Gloo Edge (https://github.com/solo-io/gloo/issues/4020)

Fixes

• Stop leaking memory for a timer in consul EDS. (https://github.com/solo-io/gloo/issues/4112)

New Features

• Adds API to support two different instances of JWT validation, before the extauth filter in envoy and after. (https://github.com/solo-io/gloo/issues/3207)

Fixes

• CPU profile of Gloo at scale (5000+ upstreams) indicated that the generateXDSSnapshot function was taking upwards of 5 seconds of CPU on a ~50 second sample. This change optimizes the code by using creating hashes for the XDS snapshot using deterministic proto marshalling and fnv hashing rather than the reflection-based mitchellh/hashstructure which was benchmarked to be several orders of magnitude slower. (https://github.com/solo-io/gloo/issues/4084)