gloo

New Features

• Add API to support optional OIDC configuration override for ext-auth. OIDC Configuration is discovered at /.well-known/openid-configuration and this configuration can override those discovered values. (https://github.com/solo-io/gloo/issues/3879)
• Support XDS V2/V3 APIs simultaneously from rate-limit server. (https://github.com/solo-io/gloo/issues/2815)

Fixes

• In multi-proxy environments, resources that were invalid on one proxy (error or warning) but valid on another may have a status written of accepted, despite internally calculating (and logging) a warning. This is now fixed. (https://github.com/solo-io/gloo/issues/3935)
• cert-manager can be used to create a Certificate (https://cert-manager.io/docs/concepts/certificate/). This is used to generate a TLS key and certificate, and they are stored in a Kubernetes secret. This can be configured to include an optional property on the secret, ca.crt, which holds a root CA certificate. If cert-manager is used to generate this Kubernetes secret, and the root CA certificate is included, we were not including it when converting to a Gloo secret, causing Gloo to crash. (https://github.com/solo-io/gloo/issues/3652)
• Turn the certgen job into a no-op if the previously generated certs still exist, and are still valid. (https://github.com/solo-io/gloo/issues/3790)

Helm Changes

• When doing a helm install where istioSDS.enabled is set to true, the ISTIO_META_CLUSTER_ID environment variable is now initialized to "Kubernetes". (https://github.com/solo-io/gloo/issues/3881)
• Panic mode allows Envoy load balancing to disregard host's health status. (https://github.com/solo-io/gloo/issues/3747)

Helm Changes

• Fix helm template and documentation for configuring tracing (https://github.com/solo-io/gloo/issues/3896)

Dependency Bumps

• linux/alpine has been upgraded to v3.12.1.

New Features

• Allow an external tracing provider to be configured on a listener via the Gloo API. See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/trace/v3/http_tracer.proto#envoy-v3-api-msg-config-trace-v3-tracing-http for more details on this setting. (https://github.com/solo-io/gloo/issues/3762)

Fixes

• Expose envoy's cluster_header field in the gloo api See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-cluster-header for more details about this field. (https://github.com/solo-io/gloo/issues/3749)

Fixes

• Disable gloo metrics service as it is unused, and CPU intensive. (https://github.com/solo-io/gloo/issues/3849)
• Fixed a bug where a bad authconfig which should invalidate a single virtual service was incorrectly invalidating the entire gateway (https://github.com/solo-io/gloo/issues/3538)
• Fixed a bug where invalid route replacement did not correctly replace routes that referred to a missing UpstreamGroup, which potentially resulted in incorrect config being sent to envoy. Now, the route will be replaced correctly according to the invalid config policy. (https://github.com/solo-io/gloo/issues/3818)

New Features

• Expose envoy's cluster_header field in the gloo api See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-cluster-header for more details about this field. (https://github.com/solo-io/gloo/issues/3749)

New Features

• Add Istio 1.8.x support to the existing glooctl istio integrations. (https://github.com/solo-io/gloo/issues/3855)

Fixes

• Disable gloo metrics service as it is unused, and CPU intensive. (https://github.com/solo-io/gloo/issues/3849)
• Fixed a bug where a bad authconfig which should invalidate a single virtual service was incorrectly invalidating the entire gateway (https://github.com/solo-io/gloo/issues/3538)
• Fixed a bug where invalid route replacement did not correctly replace routes that referred to a missing UpstreamGroup, which potentially resulted in incorrect config being sent to envoy. Now, the route will be replaced correctly according to the invalid config policy. (https://github.com/solo-io/gloo/issues/3818)

New Features

• Expose the server_header_transformation setting via the Gloo API. See https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/filter/network/http_connection_manager/v2/http_connection_manager.proto for more details on this setting. (https://github.com/solo-io/gloo/issues/3769)

Fixes

• fixes glooctl check error messages that are displayed when deployments checks have failed (https://github.com/solo-io/gloo/issues/2952)

Fixes

• Expose the server_header_transformation setting via the Gloo API. See https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/filter/network/http_connection_manager/v2/http_connection_manager.proto for more details on this setting. (https://github.com/solo-io/gloo/issues/3769)

This release contained no user-facing changes.

Helm Changes

• This change stops ConfigMap, Service, and Gateway objects from being created for gateway proxies if "disabled = true" under the helm chart values override. (https://github.com/solo-io/gloo/issues/3751)

Dependency Bumps

• solo-io/solo-apis has been upgraded to rate-limiter-v0.1.2.

New Features

• Define the API to allow for set-style rate limiting. The previous rate-limiting implementation uses a tree structure for descriptors. This adds capability to use a set structure instead, where the descriptors are treated as an unordered set such that a given rule will apply if all the relevant descriptors match, regardless of the values of the other descriptors and regardless of descriptor order. For example, the rule may require type: a and number: 1 but the remote_address descriptor can have any value. This can also be understood as remote_address: * where * is a wildcard. (https://github.com/solo-io/gloo/issues/2695)

This release contained no user-facing changes.

Dependency Bumps

• solo-kit/solo-io has been upgraded to v0.13.14.

Fixes

• Fix EDS so modifying configs on a TLS enabled Upstream no longer results in 503s (https://github.com/solo-io/gloo/issues/3673)
• Gloo will no longer remove upstreams after editing their spec. (https://github.com/solo-io/gloo/issues/3710)
• Fix EDS so modifying health checks on Upstream no longer results in 503s (https://github.com/solo-io/gloo/issues/3219)
• Allow toggling of EDS to rest XDS to avoid the envoy issue described in the following issue: https://github.com/envoyproxy/envoy/issues/13070. Set to true by default starting in version > v1.6.0 (https://github.com/solo-io/gloo/issues/3805)

Dependency Bumps

• solo-kit/solo-io has been upgraded to v0.13.14.

Helm Changes

• This change stops ConfigMap, Service, and Gateway objects from being created for gateway proxies if "disabled = true" under the helm chart values override. (https://github.com/solo-io/gloo/issues/3751)

New Features

• Allow toggling of EDS to rest XDS to avoid the envoy issue described in the following issue: https://github.com/envoyproxy/envoy/issues/13070. Set to true by default starting in version > v1.6.0 (https://github.com/solo-io/gloo/issues/3805)

Fixes

• Fix EDS so modifying configs on a TLS enabled Upstream no longer results in 503s (https://github.com/solo-io/gloo/issues/3673)
• Gloo will no longer remove upstreams after editing their spec. (https://github.com/solo-io/gloo/issues/3710)
• Fix EDS so modifying health checks on Upstream no longer results in 503s (https://github.com/solo-io/gloo/issues/3219)
• Allow static upstream endpoints have individual SNI entries (https://github.com/solo-io/gloo/issues/3806)

Fixes

• Allow static upstream endpoints have individual SNI entries (https://github.com/solo-io/gloo/issues/3806)

Helm Changes

• Adds a two helm values that can be used to configure all sds/envoy-sidecar container resource usages. (https://github.com/solo-io/gloo/issues/2979)

Helm Changes

• Set route prefix_rewrite in ingress proxy and knative proxy configs from global.glooStats.routePrefixRewrite helm value. This allows Gloo to integrate with other monitoring systems instead of just Prometheus. (https://github.com/solo-io/gloo/issues/3752)
• Adds a single helm value that can be used to configure all sds/envoy-sidecar container resource usages. (https://github.com/solo-io/gloo/issues/2979)