gloo

Helm Changes

• Add possibility to pass image pull secret to all deployments in helm chart (https://github.com/solo-io/gloo/issues/3729)
• Add a helm value for stats prefix rewrite. This allows Gloo to integrate with other monitoring systems instead of just Prometheus, by setting the global.glooStats.routePrefixRewrite helm value. (https://github.com/solo-io/gloo/issues/3752)

Fixes

• Fix an issue where ssl configurations across different virtual services may be incorrectly cached if they ssl configurations only differ by ssl-parameters (e.g., min tls version). After this change, ssl configurations that are only different by ssl parameters must have different sni domains. Prior to this change, such a configuration would not error but could result in one ssl configuration being selected over another; now an explicit error is recorded on the virtual service. (https://github.com/solo-io/gloo/issues/3776)
• Fix the validation API to return all errors encountered while validating a list of resources, rather than immediately returning on the first unmarshal error encountered for a resource in a list resource. (https://github.com/solo-io/gloo/issues/3610)
• Fix the validation API error reporting to include the resource associated with the error returned. (https://github.com/solo-io/gloo/issues/3610)

Fixes

• Fix the validation API to only return proxies that would be generated by proposed resources if requested. This change means the default behavior matches the kubernetes validation webhook API. By including the top-level value returnProxies=true in the json/yaml request to the API, you can signal the endpoint to return the proxies that would be generated (previously, always returning by default). (https://github.com/solo-io/gloo/issues/3613)
• Fix the validation API to return all errors encountered while validating a list of resources, rather than immediately returning on the first unmarshal error encountered for a resource in a list resource. (https://github.com/solo-io/gloo/issues/3610)
• Fix the validation API error reporting to include the resource associated with the error returned. (https://github.com/solo-io/gloo/issues/3610)

Dependency Bumps

• envoy-gloo/solo-io has been upgraded to v1.17.0-rc1.

Helm Changes

• Removed the global.wasm.enabled HELM value for toggling experimental wasm support. Wasm is now enabled by default. This flag is no longer required as there is no more need for a separate gateway-proxy image since wasm support was merged into upstream envoy. (https://github.com/solo-io/gloo/issues/3753)
• Addresses minor issue of adding consul configs into helm. (https://github.com/solo-io/gloo/issues/3698)

New Features

• Use official wasm support from upstream envoy, rather than envoy-wasm fork. (https://github.com/solo-io/gloo/issues/3753)
• Allow automatic discovery of TLS when using consul services. Requires serveral changes to gloo's helm config to use:
  Set the settings.integrations.consul.useTls flag to true.
  Assign a tag for gloo to recognize as the TLS tag if the default (settings.integrations.consul.tlsTagName=glooUseTls) is insufficient.
  Add the consul root CA for gloo to use at settings.integrations.consul.rootCA
  Once these are setup in gloo, adding the tlsTagName value as a tag to consul services should cause upstreams to automatically
  have TLS when discovered by gloo. As part of this change, the behavior of tag matching between gloo upstreams
  and consul service instances was changed from an exact set match to a subset match.
  Now a match is found if an upstream's instanceTags are a subset of a service instance's tags. (https://github.com/solo-io/gloo/issues/2544)

Fixes

• Fix the validation API to only return proxies that would be generated by proposed resources if requested. This change means the default behavior matches the kubernetes validation webhook API. By including the top-level value returnProxies=true in the json/yaml request to the API, you can signal the endpoint to return the proxies that would be generated (previously, always returning by default). (https://github.com/solo-io/gloo/issues/3613)

Helm Changes

• Fix helm chart to honor .Values.settings.replaceInvalidRoutes value. This change makes the default invalid route behavior match what's documented (disabled by default). To enable again, set .Values.settings.replaceInvalidRoutes=true (https://github.com/solo-io/gloo/issues/3619)
• Remove duplicate helm values that are no longer needed to keep hook-created values in helm releases. Backport for v1.5. (https://github.com/solo-io/gloo/issues/3498)

Fixes

• Ensure the rest of our docker containers run with user 10101 rather than root (https://github.com/solo-io/gloo/issues/3346)
• With each release, we will additionally be publishing an alternate set of docker containers (tagged as usual but with the "-extended" suffix) that have some additional dependencies built in (e.g., curl for debugging). You can deploy these images by setting the helm value global.image.extended=true. (https://github.com/solo-io/gloo/issues/3399)
• Fixed the max_connection_duration and max_stream_duration settings not being exposed the Gloo API. See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#config-core-v3-httpprotocoloptions for more details on these settings. (https://github.com/solo-io/gloo/issues/3628)

This release contained no user-facing changes.

Helm Changes

• Fix helm chart to honor .Values.settings.replaceInvalidRoutes value. This change makes the default invalid route behavior match what's documented (disabled by default). To enable again, set .Values.settings.replaceInvalidRoutes=true (https://github.com/solo-io/gloo/issues/3619)
• Remove duplicate helm values that are no longer needed to keep hook-created values in helm releases. (https://github.com/solo-io/gloo/issues/3498)

New Features

• With each release, we will additionally be publishing an alternate set of docker containers (tagged as usual but with the "-extended" suffix) that have some additional dependencies built in (e.g., curl for debugging). You can deploy these images by setting the helm value global.image.extended=true. (https://github.com/solo-io/gloo/issues/3399)
• Expose the max_connection_duration and max_stream_duration settings via the Gloo API. See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#config-core-v3-httpprotocoloptions for more details on these settings. (https://github.com/solo-io/gloo/issues/3628)

Fixes

• Ensure the rest of our docker containers run with user 10101 rather than root (https://github.com/solo-io/gloo/issues/3346)
• Fix misleading message in glooctl install output when the install namespace already exists. (https://github.com/solo-io/gloo/issues/3704)

This release build failed.

Fixes

• Allow compressing the spec for Proxy objects. (https://github.com/solo-io/gloo/issues/3663)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to 1.16.0-rc4.

Fixes

• Upgrade envoy-gloo version to fix seg fault in aws lambda filter (https://github.com/solo-io/gloo/issues/3684)
• Update default remote cluster registration namespace to "gloo-system" to simplify the Gloo Fed cluster registration process for most users. (https://github.com/solo-io/gloo/issues/3689)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to 1.14.3-patch2.

Fixes

• Upgrade envoy-gloo version to handle CVE-2020-25017 and CVE-2020-25018 (https://github.com/solo-io/gloo/issues/3687)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to 1.15.0-patch4.

Fixes

• Upgrade envoy-gloo version to handle CVE-2020-25017 and CVE-2020-25018 (https://github.com/solo-io/gloo/issues/3687)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to 1.16.0-rc3.

Fixes

• Upgrade envoy-gloo version to handle CVE-2020-25017 and CVE-2020-25018 (https://github.com/solo-io/gloo/issues/3687)
• Allow compressing the spec for Proxy objects. (https://github.com/solo-io/gloo/issues/3663)

New Features

• Add API to AuthConfig that allows users to specify a boolean expression to determine how to evaluate auth configs within an auth chain. Previously, each config on an auth config must be authorized for the entire request to be authorized. This remains the default, but now users can additionally specify a boolean expression (the booleanExpr field on an auth config) to reference the auth configs and AND/OR/NOT them together to achieve the desired access policy. (https://github.com/solo-io/gloo/issues/3207)

Fixes

• Fix for Istio mTLS integration for Istio versions 1.6.9+ and Istio 1.7.1+ (https://github.com/solo-io/gloo/issues/3650)
• Update the envoy-wasm version to the latest 1.16.x version, which now replies with a NACK on a wasm image cache miss, fixing several caching issues. (https://github.com/solo-io/gloo/issues/3624)

Fixes

• Generate standard Kubernetes go types and clients for AuthConfig custom resources so users can programmatically manage these objects without having to use our solo-kit based clients. (https://github.com/solo-io/gloo/issues/3643)

Fixes

• Generate standard Kubernetes go types and clients for AuthConfig custom resources so users can programmatically manage these objects without having to use our solo-kit based clients. (https://github.com/solo-io/gloo/issues/3643)

New Features

• Add new field inheritableMatchers boolean field (default false) to virtual services and route tables that, when true, changes how route delegation handles header, method, and query parameter matchers from the parent resource. By default, route tables must have matchers that are a superset of those from the parent, as this improves readability. By setting inheritableMatchers to true, any header, method, and query parameter matchers from the parent that are absent from the child will be automatically included on the generated route. (https://github.com/solo-io/gloo/issues/3327)
• Generate standard Kubernetes go types and clients for AuthConfig custom resources so users can programmatically manage these objects without having to use our solo-kit based clients. (https://github.com/solo-io/gloo/issues/3643)

Fixes

• Fix a bug that was causing glooctl istio inject to use the wrong version for the SDS sidecar in GlooE environments. (https://github.com/solo-io/gloo/issues/3641)

Fixes

• Changes our sni domain checking logic to more broadly check against duplicate filter chain matches in a listener like envoy. Backport for gloo 1.4. (https://github.com/solo-io/gloo/issues/3459)
• Allow changing a label value for ingress proxy to enable multiple ingress proxy instances in the same cluster. (https://github.com/solo-io/gloo/issues/3587)
• Expose Envoy's cluster configuration common_http_protocol_options parameters in the Gloo API. (https://github.com/solo-io/gloo/issues/3560)

Fixes

• Change the tutorial install script to install the latest stable version, instead of possibly installing beta releases. (https://github.com/solo-io/gloo/issues/3589)

Dependency Bumps

• envoyproxy/envoy has been upgraded to v1.16-rc2.
• solo-io/skv2 has been upgraded to v0.8.1.

New Features

• Added improvements to the user experience for using gloo with Istio. Added helper commands for glooctl, so that users can simply perform glooctl istio inject and glooctl istio enable-mtls --upstream foo in order to have Gloo and Istio up and running and communicating together over mTLS. (https://github.com/solo-io/gloo/issues/3532)
• Allow secrets to be added to request headers by referencing a k8s secret resource via its namespace and name. (https://github.com/solo-io/gloo/issues/2751)
• Change the glooctl cluster unregister command to glooctl cluster deregister. The deregister command now deletes the service account, cluster role, and cluster role binding created on the remote cluster during the cluster registration process. Example usage is glooctl cluster deregister --cluster-name kind-remote --remote-context kind-remote. (https://github.com/solo-io/gloo/issues/3369)

Fixes

• Virtual Services with overlapping SNI domains in the same gateway are invalid. This change fixes our matching rules to consider cases where the sni domain is unset, and not allow multiple configs with an unset sni domain. (https://github.com/solo-io/gloo/issues/3459)
• Fix the default clustername in sds to match the name given in the docs. (https://github.com/solo-io/gloo/issues/3573)
• Expose Envoy's cluster configuration common_http_protocol_options parameters in the Gloo API. (https://github.com/solo-io/gloo/issues/3560)

This release contained no user-facing changes.