gloo

Fixes

• CPU profile of Gloo at scale (5000+ upstreams) indicated that the generateXDSSnapshot function was taking upwards of 5 seconds of CPU on a ~50 second sample. This change optimizes the code by using creating hashes for the XDS snapshot using deterministic proto marshalling and fnv hashing rather than the reflection-based mitchellh/hashstructure which was benchmarked to be several orders of magnitude slower. (https://github.com/solo-io/gloo/issues/4084)

Fixes

• CPU profile of Gloo at scale (5000+ upstreams) indicated that the endpointsForUpstream function was taking upwards of 5 seconds of CPU on a ~50 second sample. This change optimizes the code by using a map instead of looping over all endpoints for each upstream. (https://github.com/solo-io/gloo/issues/4084)

Helm Changes

• Add 3 configuration values under global.istioIntegration to control automatic discovery and sidecar injection for Gloo pods by Istio. LabelInstallNamespace adds a label to mark the namespace for Istio discovery if the namespace is designated to be created in the chart. WhitelistDiscovery explicitly annotates Gloo's discovery pod for Istio sidecar injection. DisableAutoinjection annotates all pods that aren't more specifically noted elsewhere never receive Istio sidecar injection. (https://github.com/solo-io/gloo/issues/3924)

Dependency Bumps

• solo-io/protoc-gen-ext has been upgraded to v0.0.14.

New Features

• Possibility to configure custom auth server to retrieve request body as bytes (Support Envoys packAsBytes) (https://github.com/solo-io/gloo/issues/3937)

Fixes

• Gloo Edge now proactively reports warnings on virtual services that have matchers that are short-circuited.
  To enable, update the Gloo Settings such that spec.gateway.validation.warnRouteShortCircuiting=true
  The cases now additionally covered are:
  • routes that have simple OR regex header matchers, ensuring each one of the OR'ed matchers can be reached
  • the same logic, but with method matchers
    In addition, we support aggressively reporting errors on virtual services with invalid regex matchers. (no need
    to enable short-circuiting reporting) (https://github.com/solo-io/gloo/issues/3334)
• Switching CSRF mode from enabled to shadow mode does not apply default enabled value to filter. (https://github.com/solo-io/gloo/issues/4053)

Dependency Bumps

• solo-io/protoc-gen-ext has been upgraded to v0.0.14.

New Features

• Gloo Edge now proactively reports warnings on virtual services that have matchers that are short-circuited.
  To enable, update the Gloo Settings such that spec.gateway.validation.warnRouteShortCircuiting=true
  The cases now additionally covered are:
  • routes that have simple OR regex header matchers, ensuring each one of the OR'ed matchers can be reached
  • the same logic, but with method matchers
    In addition, we support aggressively reporting errors on virtual services with invalid regex matchers. (no need
    to enable short-circuiting reporting) (https://github.com/solo-io/gloo/issues/3334)
• Possibility to configure custom auth server to retrieve request body as bytes (Support Envoys packAsBytes) (https://github.com/solo-io/gloo/issues/3937)

Fixes

• Switching CSRF mode from enabled to shadow mode does not apply default enabled value to filter. (https://github.com/solo-io/gloo/issues/4053)

Fixes

• Introduce LocalityWeightedLb API. This will be used to support locality weighted load balancing on clusters (https://github.com/solo-io/gloo/issues/3038)

Fixes

• Introduce LocalityWeightedLb API. This will be used to support locality weighted load balancing on clusters (https://github.com/solo-io/gloo/issues/3038)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.17.0-rc4.

New Features

• Gloo Edge can now more proactively report warnings on virtual services that are likely misconfigured.
  To enable, update the Gloo Settings such that spec.gateway.validation.warnRouteShortCircuiting=true
  The cases now additionally covered are:
  • routes on the same virtual host that have the same matcher
  • routes that get short-circuited by prefix/regex matchers in earlier routes (https://github.com/solo-io/gloo/issues/3334)

Fixes

• RateLimitConfig CRD is now removed with glooctl uninstall command. (https://github.com/solo-io/gloo/issues/4010)
• Envoy has deprecated gzip filter support in favor of the HTTP Compressor filter. Fixes gloo gzip filter to work with envoy's compressor filter. (https://github.com/solo-io/gloo/issues/4016)
• Kubernetes plugin reports error when encountering upstream with nonexistant ServiceNamespace instead of crashing. (https://github.com/solo-io/gloo/issues/4006)

Upgrade Notes

• Experimental wasm features have been removed from Gloo Edge. Wasm support is now a feature of Gloo Edge Enterprise. (https://github.com/solo-io/gloo/issues/4025)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.17.0-rc3.

Helm Changes

• Add the helm value gatewayProxies.gatewayProxy.readConfigMulticluster, set to false by default. Setting this to true will add a gateway-proxy-config-dump-service Service to the gloo installation namespace. This service allows multicluster management planes to access the envoy config dump on port 8082 of the gateway-proxy. (https://github.com/solo-io/gloo/issues/4012)

New Features

• Adds a new headers_to_append field to the HTTP request transformation API. This allows users to specify headers which can contain multiple values and to specify transformations for each of the values. (https://github.com/solo-io/gloo/issues/3901)

Fixes

• Buffer envoy filter is now added to the filter chain correctly so it can be used other than on the Gateway level. Added end-to-end tests for buffer filter. (https://github.com/solo-io/gloo/issues/4000)
• Disable REST EDS server by default, which is no longer necessary now that upstream envoy has fixed https://github.com/envoyproxy/envoy/issues/13070 (https://github.com/solo-io/gloo/issues/3805)
• Csrf envoy filter shadow mode now gets correctly applied to the envoy config. (https://github.com/solo-io/gloo/issues/3898)

New Features

• Add the defaultDashboardFolderId value to the settings proto definition for use in gloo-E. (https://github.com/solo-io/gloo/issues/3920)
• Gloo now supports enabling the upstream Envoy CSRF filter by configuring spec.httpGateway.options.csrf of the desired Gateway. This can also be overridden on virtual services at the virtual host or route level, and on weighted destinations. See envoy csrf for more details. (https://github.com/solo-io/gloo/issues/3898)

New Features

• Add support for the new inheritablePathMatchers value on Route config. This new setting is similar to the inheritableMatchers boolean value that allows delegated routes (i.e., routes on route tables) to optionally opt into inheriting HTTP header, method, or query parameter matching from the parent route. The new inheritablePathMatchers is used to optionally opt into inheriting HTTP path matcher config from the parent. (https://github.com/solo-io/gloo/issues/3726)

Fixes

• Fix a bug where the inheritableMatchers value itself was being read from the parent route, rather than the child route (as documented and intended). (https://github.com/solo-io/gloo/issues/4008)
• Fix generated resource clients watch functions to not block infinitely, therefore leaking go-routines. (https://github.com/solo-io/gloo/issues/4001)

Dependency Bumps

• solo-io/skv2 has been upgraded to v0.15.2.

Helm Changes

• Update the version of Istio used by the Istio sidecar in the gateway-proxy pod for mTLS cert generation when the helm value global.istioSDS.enabled is set to true. New Istio version is 1.8.1. (https://github.com/solo-io/gloo/issues/3967)

New Features

• Adding case sensitivity option on the path matcher. (https://github.com/solo-io/gloo/issues/3976)
• Allows Jwt authentication to be compatible with other auth mechanisms in enterprise authentication. (https://github.com/solo-io/gloo/issues/3207)
• Introduce an API to support a passthrough grpc ext auth service. This service authorizes requests by delegating to an external service which implements the envoy external auth API: https://github.com/envoyproxy/envoy/blob/ae1ed1fa74f096dabe8dd5b19fc70333621b0309/api/envoy/service/auth/v3/external_auth.proto#L29
  This enables GlooE users to use custom external auth services in addition to GlooE out of the box features, without requiring users to write and maintain extauth go plugins (https://github.com/solo-io/gloo/issues/3645)

Fixes

• Update glooctl cluster register and glooctl cluster deregister commands to use the default Kubernetes config when registering and deregistering clusters. (https://github.com/solo-io/gloo/issues/3972)

This release contained no user-facing changes.

Fixes

• Ripout gogo proto in favor of golang proto (https://github.com/solo-io/gloo/issues/3926)

Fixes

• fixes bug where route validation marks routes with redirect and direct response actions as invalid. (https://github.com/solo-io/gloo/issues/3975)

Dependency Bumps

• solo-io/go-utils has been upgraded to v0.20.1.

Helm Changes

• Add a helm value for setting extauth field for gloo.solo.io.Settings. This allows to configure custom external auth server while installing Helm chart, without need to post-render or patch Settings object after helm chart was installed or upgraded. (https://github.com/solo-io/gloo/issues/1892)

Fixes

• Fix the proxycontroller docs example code, and the corresponding documentation. (https://github.com/solo-io/gloo/issues/3941)
• fixes bug where route validation marks redirect and direct response route destinations as invalid. (https://github.com/solo-io/gloo/issues/3975)
• Changed Istio's default discoveryAddress used by the glooctl istio commands and helm installations when istioSDS is enabled (https://github.com/solo-io/gloo/issues/3908)

Marked as a pre-release to due a regression with redirectActions, see https://github.com/solo-io/gloo/issues/3975

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.16.1-patch1.

Fixes

• Add the ability to configure the propagation of the tracing header x-envoy-decorator-operation, for more info: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto.html?highlight=decorator#config-route-v3-decorator (https://github.com/solo-io/gloo/issues/3931)
• Fixes a bug where routes that use a deleted lambda function as destination causes gloo to crash. (https://github.com/solo-io/gloo/issues/3895)

Marked as a pre-release to due a regression with redirectActions, see https://github.com/solo-io/gloo/issues/3975

New Features

• Add the ability to configure the propagation of the tracing header x-envoy-decorator-operation, for me info: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto.html?highlight=decorator#config-route-v3-decorator (https://github.com/solo-io/gloo/issues/3931)

Fixes

• Fixes a bug where routes that use a deleted lambda function as destination causes gloo to crash. (https://github.com/solo-io/gloo/issues/3895)
• When configuring tracing, you can specify a cluster where traces are collected. If the collector is an upstream, tracing works as expected. However, if the cluster is statically defined in the envoy bootstrap, traces do not get collected. This adds support for statically defined tracing collector clusters. (https://github.com/solo-io/gloo/issues/3954)

Dependency Bumps

• solo-io/go-utils has been upgraded to v0.20.0.

New Features

• Add the ability to add static clusters to the envoy bootstrap config via helm. This option can be accessed via ".envoyStaticClusters". The value should be a list of static clusters which will be passed directly to envoy, so the yaml must be correct. The api can be found here: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#config-cluster-v3-cluster. This is meant to be used for advanced use cases (https://github.com/solo-io/gloo/issues/3905)
• Add the ability to add bootstrap extensions to the envoy bootstrap config via helm. This option can be accessed via ".envoyBootstrapExtensions". The value should be a list of bootstrap extensions which will be passed directly envoy, so the yaml must be correct. The main use case being wasm services, for the purpose of creating singletons. Bootstrap extensions is a list of typed extension config (https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/extension.proto#envoy-v3-api-msg-config-core-v3-typedextensionconfig) so the list must be passed with the name, and type url. The API for the wasm service specfically can be found here: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/wasm/v3/wasm.proto#extensions-wasm-v3-wasmservice. This is meant to be used for advanced use cases (https://github.com/solo-io/gloo/issues/3943)