gloo

Marked as pre-release due to mTLS mode regression (detailed in #3191) with v2 -> v3 envoy API migration. Will also remove an unnecessary component from the new Failover API added in this release.

New Features

• Define the API to specify Prioritized Failover in Gloo. This API allows for a user to define a list of endpoint sets which will be used in the case that the main upstream endpoint becomes unhealthy. Failover supports optional locality weighted load balancing which assigns additional weighted load balancing based on the locality assigned to each of the endpoint sets. (https://github.com/solo-io/gloo/issues/3141)
• Default gateway proxy to running as non-root and disabling NET_BIND_SERVICE by default. (https://github.com/solo-io/gloo/issues/3084)
• Enable certgen to run in a fully restricted kubernetes environment. Certgen now runs without root privileges. (https://github.com/solo-io/gloo/issues/3084)

Fixes

• Expose a validation setting (allowWarnings, default true) in the API and in helm that was intended to be exposed. When set to false, the validation webhook will begin rejecting resources that cause warnings in addition to resources that would cause errors. For this to take effect, note that the validation setting alwaysAccept must be set to false. (default true) (https://github.com/solo-io/gloo/issues/3099)
• Fix setting custom runAsUser during helm install via --set (https://github.com/solo-io/gloo/issues/3152)

Fixes

• Add Go tags to the extauth config protos to allow redacting sensitive data in log statements in the extauth server. (https://github.com/solo-io/gloo/issues/3105)

Dependency Bumps

• solo-io/solo-kit has been upgraded to v0.13.8.

New Features

• Add a Gloo golang extension to allow for adding/editing of EDS endpoints before they are sent to envoy. This interface will be called from within the Gloo translator and allow for extension of Gloo EDS programmatically. (https://github.com/solo-io/gloo/issues/3131)
• Gloo now supports enabling the Envoy buffer filter by configuring spec.httpGateway.options.buffer of the desired Gateway. This can also be overridden on virtual services at the virtual host or route level, and on weighted destinations. See envoy buffer for more details. (https://github.com/solo-io/gloo/issues/2444)

Fixes

• Add Go tags to the extauth config protos to allow redacting sensitive data in log statements in the extauth server. (https://github.com/solo-io/gloo/issues/3105)
• Allow for spaces around parameter names in gRPC parameter options (https://github.com/solo-io/gloo/issues/3123)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.4.3.

Helm Changes

• Support for specifying the IP ranges that are allowed to access the load balancer via loadBalancerSourceRanges. Refer to Restrict Access For LoadBalancer Service (https://github.com/solo-io/gloo/issues/2358)
• Setting nodeport numbers in values.yml did not work due to a typo in the gateway-proxy-service template. Fixed the typo. (https://github.com/solo-io/gloo/issues/3015)

Fixes

• Expose perConnectionBufferLimitBytes as a listener option. If left unset, Envoy will continue to use the default 1MiB. (https://github.com/solo-io/gloo/issues/2835)
• Fixes a bug where glooctl check was always reporting that Gloo was out of sync with the rate limiting server when Enterprise Gloo was installed. (https://github.com/solo-io/gloo/issues/3030)
• Expose envoy's core.Http1ProtocolOptions.HeaderKeyFormat in the Gloo API as httpConnectionManager.http_protocol_options.proper_case_header_key_format. By default, all header keys are lower cased. If proper_case_header_key_format is set to true, envoy formats the header by proper casing words: the first character and any character following a special character will be capitalized if it’s an alpha character. For example, “content-type” becomes “Content-Type”, and “foo$b#$are” becomes “Foo$B#$Are”. Note that while this results in most headers following conventional casing, certain headers are not covered. For example, the “TE” header will be formatted as “Te”. (https://github.com/solo-io/gloo/issues/2940)

Helm Changes

• Support for specifying the IP ranges that are allowed to access the load balancer via loadBalancerSourceRanges. Refer to Restrict Access For LoadBalancer Service (https://github.com/solo-io/gloo/issues/2358)
• Setting nodeport numbers in values.yml did not work due to a typo in the gateway-proxy-service template. Fixed the typo. (https://github.com/solo-io/gloo/issues/3015)

New Features

• Added additional metrics reporting and examples to the gRPC access logging service. This service is intended to be built upon to handle specific needs for reporting and observability in different advanced use cases. (https://github.com/solo-io/gloo/issues/2804)
• Adds support for the use of named ports on Kubernetes Ingress objects. (https://github.com/solo-io/gloo/issues/3050)
• Adds the customIngressClass variable to the Gloo Helm Chart, which, when set, will allow overriding the default kubernetes.io/ingress.class Ingress Class used by Gloo. Use in combination with requireIngressClass to allow multiple Gloo controllers to partition the Ingress objects within a cluster. (https://github.com/solo-io/gloo/issues/3047)
• Add extauth and ratelimit settings to Gateway httpGateway.options.extauth and httpGateway.options.ratelimit. This takes precedence over the global extauth and ratelimit settings on the Settings object, and allows users to set per-gateway extauth or rate-limit configuration for a set of virtual services. (https://github.com/solo-io/gloo/issues/2257)
• Expose envoy's core.Http1ProtocolOptions.HeaderKeyFormat in the Gloo API as httpConnectionManager.http_protocol_options.proper_case_header_key_format. By default, all header keys are lower cased. If proper_case_header_key_format is set to true, envoy formats the header by proper casing words: the first character and any character following a special character will be capitalized if it’s an alpha character. For example, “content-type” becomes “Content-Type”, and “foo$b#$are” becomes “Foo$B#$Are”. Note that while this results in most headers following conventional casing, certain headers are not covered. For example, the “TE” header will be formatted as “Te”. (https://github.com/solo-io/gloo/issues/2940)

Fixes

• Fixes a bug where glooctl check was always reporting that Gloo was out of sync with the rate limiting server when Enterprise Gloo was installed. (https://github.com/solo-io/gloo/issues/3030)
• Fixes a bug where the Gloo Ingress Controller (ingress pod) would stop processing Ingress updates when a detected Ingress backend incorrectly referenced a service port. (https://github.com/solo-io/gloo/issues/3051)
• Suppress the usage message for glooctl on error. This makes error messages easier to find. (https://github.com/solo-io/gloo/issues/2880)

Helm Changes

• Add new helm value to disable the validation admission webhook (https://github.com/solo-io/gloo/issues/3016)

New Features

• glooctl check now reports an error when Enterprise Gloo is installed and is reporting a stat indicating it is out of sync with the Rate Limit server. (https://github.com/solo-io/gloo/issues/2832)
• glooctl check now reports an error when Enterprise Gloo is installed and any of the data plane components have reported a nack. (https://github.com/solo-io/gloo/issues/1627)

Fixes

• Gloo no longer reports a warning when route tables share a weight, since that is the default behavior. This means glooctl check no longer errors out on this route table warning. (https://github.com/solo-io/gloo/issues/2793)
• glooctl uninstall now cleans up developer portal resources when Gloo was installed with glooctl install gateway --dry-run | kubectl apply -f -. (https://github.com/solo-io/gloo/issues/2836)

Dependency Bumps

• solo-io/solo-kit has been upgraded to v0.13.7.

Helm Changes

• Add new helm value to disable the validation admission webhook (https://github.com/solo-io/gloo/issues/3016)

New Features

• glooctl check now reports an error when Enterprise Gloo is installed and is reporting a stat indicating it is out of sync with the Rate Limit server. (https://github.com/solo-io/gloo/issues/2832)
• glooctl check now reports an error when Enterprise Gloo is installed and any of the data plane components have reported a nack. (https://github.com/solo-io/gloo/issues/1627)

Fixes

• Gloo pod will now log a clear message when an upstream's port does not match that of its underlying kubernetes service. (https://github.com/solo-io/gloo/issues/2905)
• Gloo no longer reports a warning when route tables share a weight, since that is the default behavior. This means glooctl check no longer errors out on this route table warning. (https://github.com/solo-io/gloo/issues/2793)
• glooctl uninstall now cleans up developer portal resources when Gloo was installed with glooctl install gateway --dry-run | kubectl apply -f -. (https://github.com/solo-io/gloo/issues/2836)

Helm Changes

• Allow nodeport numbers to be pre-defined in the values.yml if setting gateway proxy service to nodeport. (https://github.com/solo-io/gloo/issues/2899)

Fixes

• When AuthConfigs are updated, gloo resyncs, which should trigger a gateway resync as well. (https://github.com/solo-io/gloo/issues/2920)
• When static upstreams are converted to Envoy clusters, add hostnames to each endpoint so that host headers for requests and healthchecks are set to the endpoint hostname rather than the Envoy cluster name. This change only applies if autoHostRewrite is set to true on route routing to the static upstream. (https://github.com/solo-io/gloo/issues/2794)

Helm Changes

• Allow nodeport numbers to be pre-defined in the values.yml if setting gateway proxy service to nodeport. (https://github.com/solo-io/gloo/issues/2899)

Fixes

• When AuthConfigs are updated, gloo resyncs, which should trigger a gateway resync as well. (https://github.com/solo-io/gloo/issues/2920)

Fixes

• Fix Helm chart bug where the gateway.readGatewaysFromAllNamespaces flag was ignored when validation disabled. (https://github.com/solo-io/gloo/issues/2935)
• We allow virtual services, route tables, and upstreams to refer to an upstream by name only, leaving the namespace field empty. Gloo will assume that the upstream's namespace is the namespace of the parent resource (the upstream group, virtual service or route table). Previously, this caused Envoy to be in a bad state, and the route would return a 503 error. (https://github.com/solo-io/gloo/issues/2730)
• When static upstreams are converted to Envoy clusters, add hostnames to each endpoint so that host headers for requests and healthchecks are set to the endpoint hostname rather than the Envoy cluster name. This change only applies if autoHostRewrite is set to true on route routing to the static upstream. (https://github.com/solo-io/gloo/issues/2794)

New Features

• Gloo's validation webhook now validates inja compilation syntax before accepting/rejecting virtual services that use transformations. Note that strict validation is still disabled by default, and must be enabled in the Gloo settings. Users can now rely more on kubectl apply --server-dry-run against live clusters to properly validate whether config is valid before attempting to apply them to their cluster. (https://github.com/solo-io/gloo/issues/2114)

Fixes

• glooctl check no longer hangs while checking secrets if the user doesn't have cluster-wide permissions. (https://github.com/solo-io/gloo/issues/2820)
• glooctl check no longer requires the user to have access to all namespaces. The user must still have access to the namespaces that Gloo watches. (https://github.com/solo-io/gloo/issues/2375)
• glooctl check was always using the default namespace for the version mismatch check. Now it uses the default namespace only if no specific namespace flag was provided. (https://github.com/solo-io/gloo/issues/2581)
• Fix race condition when adding and deleting a virtual service in quick succession caused a race condition in which the validator rewrote the virtual service when it updated its status. (https://github.com/solo-io/gloo/issues/2900)

Fixes

• glooctl check no longer hangs while checking secrets if the user doesn't have cluster-wide permissions. (https://github.com/solo-io/gloo/issues/2820)
• glooctl check no longer requires the user to have access to all namespaces. The user must still have access to the namespaces that Gloo watches. (https://github.com/solo-io/gloo/issues/2375)
• glooctl check was always using the default namespace for the version mismatch check. Now it uses the default namespace only if no specific namespace flag was provided. (https://github.com/solo-io/gloo/issues/2581)
• Fix race condition when adding and deleting a virtual service in quick succession caused a race condition in which the validator rewrote the virtual service when it updated its status. (https://github.com/solo-io/gloo/issues/2900)

Fixes

• Allow creating secret with just ca cert with glooctl. (https://github.com/solo-io/gloo/issues/2823)
• Allow specifying empty ssl configs for clients. (https://github.com/solo-io/gloo/issues/2871)

Helm Changes

• Add a helm chart value settings.integrations.knative.proxy.service.loadBalancerIP. This allows you to assign a static IP to the Knative external proxy. (https://github.com/solo-io/gloo/issues/2778)

Fixes

• Register listener plugin so that listener options are translated to Envoy configuration. (https://github.com/solo-io/gloo/issues/2904)
• Allow creating secret with just ca cert with glooctl. (https://github.com/solo-io/gloo/issues/2823)
• Allow specifying empty ssl configs for clients. (https://github.com/solo-io/gloo/issues/2871)

New Features

• Expose perConnectionBufferLimitBytes as an optional configuration on an upstream connection. If unset, Envoy uses the default of 1MiB. (https://github.com/solo-io/gloo/issues/2861)

Dependency Bumps

• helm/helm has been upgraded to v3.1.2.

New Features

• Expose perConnectionBufferLimitBytes as a new listener option. If left unset, Envoy will continue to use the default 1MiB. (https://github.com/solo-io/gloo/issues/2835)
• Gloo's validation webhook now validates inja compilation syntax before accepting/rejecting virtual services that use transformations. Note that strict validation is still disabled by default, and must be enabled in the Gloo settings. Users can now rely more on kubectl apply --server-dry-run against live clusters to properly validate whether config is valid before attempting to apply them to their cluster. (https://github.com/solo-io/gloo/issues/2114)

Fixes

• Fix an issue where big regexes were rejected, by allowing configuration of the max regex size. (https://github.com/solo-io/gloo/issues/2805)
• Fix upstream status to report when an upstream points to a service that does not exist. (https://github.com/solo-io/gloo/issues/2660)

Dependency Bumps

• helm/helm has been upgraded to v3.1.2.

Fixes

• Fix an issue where big regexes were rejected, by allowing configuration of the max regex size. (https://github.com/solo-io/gloo/issues/2805)

Helm Changes

• Fix documented helm values for gateway proxy resources. Allow ingress resources to be set, and allow access logger resources and custom env to be set, as documented. (https://github.com/solo-io/gloo/issues/2758)

Fixes

• Some users saw commands such as glooctl check or glooctl proxy dump fail due to harsh timeout restrictions on the port-forward glooctl does under the covers. This results in "Connection Refused" errors that could have been avoided. This PR updates the port forward timeouts from 3 to 30 seconds to allow these commands more time to finish. (https://github.com/solo-io/gloo/issues/2771)
• Fix race condition with proxy status and proxy status propagation (e.g., virtual service status) when multiple resources are applied at the same time by copying over the previous proxy status (rather than marking as pending for re-processing) when it changes from the gateway's point of view but hashes to the same thing (i.e., unchanged from gloo's point of view). (https://github.com/solo-io/gloo/issues/2714)