gloo

Helm Changes

• Removes ratelimit from default values template, which should prevent ratelimit warnings on gloo installation. (https://github.com/solo-io/gloo/issues/3467)

New Features

• Add AWS lambda function discovery using EKS Service Account credentials. (https://github.com/solo-io/gloo/issues/3559)
• Add route table delegation selector expressions. (https://github.com/solo-io/gloo/issues/3586)
• Added support for query parameter matchers, header matchers, and method matchers to the route table delegation API. Delegated routes must still use the prefix matcher, but now they can also leverage the aforementioned matchers so long as the delegated route's matchers are a superset of the parent route's matchers. (https://github.com/solo-io/gloo/issues/3327)

Fixes

• Handle an edge case where the gateway does not publish the status for its resources. (https://github.com/solo-io/gloo/issues/3592)
• Allow changing a label value for ingress proxy to enable multiple ingress proxy instances in the same cluster. (https://github.com/solo-io/gloo/issues/3587)
• Fix opentracing causing envoy failure. Adds type-checking for all envoy go-control-plane data structures. (https://github.com/solo-io/gloo/issues/3496)
• Added a prometheus metric to the gateway pod that indicates whether the validating admission webhook determined that the config was valid. (https://github.com/solo-io/gloo/issues/3408)

Fixes

• Virtual Services with overlapping SNI domains in the same gateway are invalid. This adds some checks to make sure such changes are rejected before they reach envoy. (https://github.com/solo-io/gloo/issues/3459)
• Handle and edge case where the gateway does not publish the status for its resources. (https://github.com/solo-io/gloo/issues/3592)

New Features

• Adds the ability to build Gloo for ARM64 architectures (https://github.com/solo-io/gloo/issues/3486)

Fixes

• Fixes an issue where Istio certificates used in mTLS were not being rotated in envoy. (https://github.com/solo-io/gloo/issues/3295)

Helm Changes

• Add ability to supply arbitrary labels to gloo pods via helm configuration (https://github.com/solo-io/gloo/issues/3441)

New Features

• Expose the raw envoy configuration for the gRPC to JSON transcoding filter, which can be leveraged to expose a gRPC service both as a gRPC service and as a REST API. Exposing the underlying envoy configuration allows users more granular control over the gRPC to JSON mappings than the current Gloo API for gRPC to JSON (that doesn't require explicit protobuf descriptors to be provided since they will be discovered). One example where users may want more granular control of their gRPC to JSON mappings may be to leverage query parameter transcoding. (https://github.com/solo-io/gloo/issues/2188)
• Allow users to specify extra headers for health check requests as secrets. New gloo secret type "header", containing header name-value pairs, can now be created (details here). Health checks can reference header secrets for additional headers to add in addition to specifying them explicitly. (https://github.com/solo-io/gloo/issues/2914)

Fixes

• Virtual Services with overlapping SNI domains in the same gateway are invalid. This adds some checks to make sure such changes are rejected before they reach envoy. (https://github.com/solo-io/gloo/issues/3459)

Dependency Bumps

• solo-io/solo-kit has been upgraded to v0.13.8.

Fixes

• Fix a bug where a virtual service has an inconsistent state, by keeping only the last version of it and reducing the number of go-routines. (https://github.com/solo-io/gloo/issues/3115)

New Features

• Allow users to specify extra headers for health check requests as secrets. New gloo secret type "header", containing header name-value pairs, can now be created (details here). Health checks can reference header secrets for additional headers to add in addition to specifying them explicitly. (https://github.com/solo-io/gloo/issues/2914)

This release contained no user-facing changes.

Dependency Bumps

• solo-io/solo-apis has been upgraded to gloo-fed-v0.0.19.

New Features

• Support a flag "-x" for excluding certain checks with glooctl. (https://github.com/solo-io/gloo/issues/3492)

Fixes

• Update the version of golang Gloo was built with from 1.14.0 to 1.14.6, to pickup patch fixes to go; most notably, a workaround in go for a bug in affected Linux kernels (5.2.x, 5.3.0-5.3.14, 5.4.0-5.4.1) that could result in a corrupted AVX register and crash Gloo. (https://github.com/solo-io/gloo/issues/3493)

Helm Changes

• Add helm value for rate limit descriptors in settings. (https://github.com/solo-io/gloo/issues/3422)

Fixes

• Update the version of golang Gloo was built with from 1.14.0 to 1.14.6, to pickup patch fixes to go; most notably, a workaround in go for a bug in affected Linux kernels (5.2.x, 5.3.0-5.3.14, 5.4.0-5.4.1) that could result in a corrupted AVX register and crash Gloo. (https://github.com/solo-io/gloo/issues/3493)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.16.0-rc1.

Helm Changes

• Add helm value for rate limit descriptors in settings. (https://github.com/solo-io/gloo/issues/3422)

New Features

• Define the API to allow adding arbitrary API key secret data to the headers of successfully authorized requests. (https://github.com/solo-io/gloo/issues/3385)
• Define the API to allow users to change the name of the header that the Gloo Enterprise external auth server inspects for API keys. (https://github.com/solo-io/gloo/issues/3390)
• The API keys can now be provided as simple Kubernetes secrets. Instead of being nested in a YAML document inside the secret data, the key is now simply the value of the api-key data key. This change is backwards compatible, i.e. Gloo will still support existing secrets with the old format. glooctl create secret apikey will now generate secrets with the new format. (https://github.com/solo-io/gloo/issues/3472)
• Support a Kubernetes-style plugin system for glooctl. (See https://kubernetes.io/docs/tasks/extend-kubectl/kubectl-plugins/). This allows users to invoke arbitrary binary plugins via glooctl , where a plugin is defined as any executable on the user's PATH that is prefixed with glooctl-. (https://github.com/solo-io/gloo/issues/3460)

Fixes

• Update envoy to pull in grpc-web fix for safari. (https://github.com/solo-io/gloo/issues/3474)

This release contained no user-facing changes.

This release build failed.

New Features

• Support assuming AWS iam roles for lambda requests via the AWS STS AssumeRoleWithWebToken API. This feature allows Gloo instances running in EKS to use AWS Service Account credentials to authenticate requests directly. (https://github.com/solo-io/gloo/issues/3309)

Helm Changes

• Support a Kubernetes preStop hook to enable a "graceful shutdown" when relying on external loadbalancers. This will allow envoy to fail external facing healthchecks while still processing existing requests. This feature is controlled via a helm value, specifically the gatewayProxies.gatewayProxy.podTemplate.gracefulShutdown object. You can enable the hook via gatewayProxies.gatewayProxy.podTemplate.gracefulShutdown.enabled and control the actual time of the grace period via gatewayProxies.gatewayProxy.podTemplate.gracefulShutdownsleepTimeSeconds (https://github.com/solo-io/gloo/issues/3308)

Fixes

• The gateway validation API now honors dry-run requests. Previously, any dry-run requests could still modify the internal resource cache, making future gateway validation results incorrect. (https://github.com/solo-io/gloo/issues/3437)

Helm Changes

• Support a Kubernetes preStop hook to enable a "graceful shutdown" when relying on external loadbalancers. This will allow envoy to fail external facing healthchecks while still processing existing requests. This feature is controlled via a helm value, specifically the gatewayProxies.gatewayProxy.podTemplate.gracefulShutdown object. You can enable the hook via gatewayProxies.gatewayProxy.podTemplate.gracefulShutdown.enabled and control the actual time of the grace period via gatewayProxies.gatewayProxy.podTemplate.gracefulShutdownsleepTimeSeconds (https://github.com/solo-io/gloo/issues/3308)
• Surface customPorts field in gatewayProxy to allow abritrary port mangement. (https://github.com/solo-io/gloo/issues/3301)
• Add Extra ServiceAccount annotations to helm chart for Gloo, Discovery, and Proxy pods. (https://github.com/solo-io/gloo/issues/2698)

New Features

• Gateway validation API (the API that backs the validating webhook) now handles lists of gateway resources. (https://github.com/solo-io/gloo/issues/3261)
• The gateway validation API now handles yaml admission requests if sent with the application/x-yaml header. (https://github.com/solo-io/gloo/issues/3256)
• Validation API now returns proxies in the webhook response. The proxy returned may be useful to perform diffs between proxies before and after proposed changes to gateway resources (virtual services, route tables, gateways). (https://github.com/solo-io/gloo/issues/3257)

Fixes

• Support temporary AWS credentials for aws lambda discovery and invocation. AWS secrets now support a 3rd optional piece of data which is the AWS_SESSION_TOKEN. The credentials can also be supplied via the Default Credentials Provider. (https://github.com/solo-io/gloo/issues/2373)
• Fix glooctl demo federation command for linux. (https://github.com/solo-io/gloo-fed/issues/239)
• Fix for panic when inspecting no-auth virtual services in glooctl check. (https://github.com/solo-io/gloo/issues/3391)
• Correct validation webhook to respect readGatewaysFromAllNamespaces when examining gateway changes. (https://github.com/solo-io/gloo/issues/3336)
• URL-encoded data can now be extracted verbatim by path and header extractors. (https://github.com/solo-io/gloo/issues/3344)
• The gateway validation API now honors dry-run requests. Previously, any dry-run requests could still modify the internal resource cache, making future gateway validation results incorrect. (https://github.com/solo-io/gloo/issues/3437)

Helm Changes

• Add "Disabled" field to GatewayProxy configuration to allow overriding the existence of Gateway Proxies from previous config files. (https://github.com/solo-io/gloo/issues/1756)

New Features

• Gateway validation API (the API that backs the validating webhook) now handles lists of gateway resources. (https://github.com/solo-io/gloo/issues/3261)
• The gateway validation API now handles yaml admission requests if sent with the application/x-yaml header. (https://github.com/solo-io/gloo/issues/3256)
• Validation API now returns proxies in the webhook response. The proxy returned may be useful to perform diffs between proxies before and after proposed changes to gateway resources (virtual services, route tables, gateways). (https://github.com/solo-io/gloo/issues/3257)

Fixes

• Correct validation webhook to respect readGatewaysFromAllNamespaces when examining gateway changes. (https://github.com/solo-io/gloo/issues/3336)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.15.0-patch1.

Fixes

• Allow specifying transformations at an earlier stage. Also allow response only transformations, that match on response headers. (https://github.com/solo-io/gloo/issues/3028)

Helm Changes

• Add "Disabled" field to GatewayProxy configuration to allow overriding the existence of Gateway Proxies from previous config files. (https://github.com/solo-io/gloo/issues/1756)

New Features

• Add the glooctl demo federation command, which bootstraps a multicluster demo with Gloo Federation (https://github.com/solo-io/gloo/issues/3369)
• If glooctl check detects multicluster resources, it will check those resources as well. (https://github.com/solo-io/gloo/issues/3369)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.15.0-patch1.

Dependency Bumps

• solo-io/envoy-operator has been upgraded to v0.1.4.

Fixes

• Fix default version output type and server type. (https://github.com/solo-io/gloo/issues/3381)
• When wasm is enabled, retry updates so that envoy will accept the config after first cache pass. (https://github.com/solo-io/gloo/issues/3035)

This release contained no user-facing changes.