gloo

Helm Changes

• Fix documented helm values for gateway proxy resources. Allow ingress resources to be set, and allow access logger resources and custom env to be set, as documented. (https://github.com/solo-io/gloo/issues/2758)

Fixes

• Some users saw commands such as glooctl check or glooctl proxy dump fail due to harsh timeout restrictions on the port-forward glooctl does under the covers. This results in "Connection Refused" errors that could have been avoided. This PR updates the port forward timeouts from 3 to 30 seconds to allow these commands more time to finish. (https://github.com/solo-io/gloo/issues/2771)
• Fix race condition with proxy status and proxy status propagation (e.g., virtual service status) when multiple resources are applied at the same time by copying over the previous proxy status (rather than marking as pending for re-processing) when it changes from the gateway's point of view but hashes to the same thing (i.e., unchanged from gloo's point of view). (https://github.com/solo-io/gloo/issues/2714)

Fixes

• Allow ALPN on the upstream. Istio upstreams seem to require ALPN set, so this fixes the integration with Istio 1.5. (https://github.com/solo-io/gloo/issues/2703)
• With proxy garbage collection enabled (enabled by default via disableProxyGarbageCollection=false), Gloo used to clear the extauth and ratelimit snapshots from the XDS cache, resulting in null configurations temporarily in the extauth and ratelimit services. This caused blips of invalid 403/429 responses. To fix this, Gloo now detects any valid TranslatorSyncerExtension's Envoy Node ID keys through its Sync() function, so Gloo doesn't garbage collect these snapshots anymore. (https://github.com/solo-io/gloo/issues/2721)

Fixes

• With proxy garbage collection enabled (enabled by default via disableProxyGarbageCollection=false), Gloo used to clear the extauth and ratelimit snapshots from the XDS cache, resulting in null configurations temporarily in the extauth and ratelimit services. This caused blips of invalid 403/429 responses. To fix this, Gloo now detects any valid TranslatorSyncerExtension's Envoy Node ID keys through its Sync() function, so Gloo doesn't garbage collect these snapshots anymore. (https://github.com/solo-io/gloo/issues/2721)

Dependency Bumps

• k8s.io/api has been upgraded to kubernetes-1.17.1.
• k8s.io/client-go has been upgraded to kubernetes-1.17.1.
• k8s.io/kubectl has been upgraded to kubernetes-1.17.1.
• k8s.io/apimachinery has been upgraded to kubernetes-1.17.1.
• k8s.io/apiextensions-apiserver has been upgraded to kubernetes-1.17.1.
• k8s.io/apiserver has been upgraded to kubernetes-1.17.1.

Fixes

• In active (event-heavy) kubernetes environments, if events come in too quickly, they can lead to memory usage growing without bound in Gloo and Discovery. Fix the leak by de-duplicating and processing events immediately. (https://github.com/solo-io/gloo/issues/2361)
• The helm chart value gatewayProxies.$gatewayProxy.gatewaySettings.ipv4Only changes the Gateway spec's bindAddress to '0.0.0.0' instead of '::' for both the non-ssl and ssl Gateways. (https://github.com/solo-io/gloo/issues/2425)

Dependency Bumps

• k8s.io/api has been upgraded to kubernetes-1.17.1.
• k8s.io/client-go has been upgraded to kubernetes-1.17.1.
• k8s.io/kubectl has been upgraded to kubernetes-1.17.1.
• k8s.io/apimachinery has been upgraded to kubernetes-1.17.1.
• k8s.io/apiextensions-apiserver has been upgraded to kubernetes-1.17.1.
• k8s.io/apiserver has been upgraded to kubernetes-1.17.1.

Fixes

• In active (event-heavy) kubernetes environments, if events come in too quickly, they can lead to memory usage growing without bound in Gloo and Discovery. Fix the leak by de-duplicating and processing events immediately. (https://github.com/solo-io/gloo/issues/2361)
• The helm chart value gatewayProxies.$gatewayProxy.gatewaySettings.ipv4Only changes the Gateway spec's bindAddress to '0.0.0.0' instead of '::' for both the non-ssl and ssl Gateways. (https://github.com/solo-io/gloo/issues/2425)

Dependency Bumps

• envoy-gloo/solo-io has been upgraded to v1.4.2.

Helm Changes

• Allow users to override the Service type as an alternative to Load Balancer for Ingress Proxy and Knative (https://github.com/solo-io/gloo/pull/2683)

Fixes

• Updated envoy-gloo based, which includes fixes to support auto host rewrite on EDS clusters. (i.e., fixing auto host rewrite for gloo with consul) (https://github.com/solo-io/gloo/issues/2552)
• Fix an issue with consul EDS where error were sent to a closed channel. (https://github.com/solo-io/gloo/issues/2736)

Dependency Bumps

• envoy-gloo/solo-io has been upgraded to v1.4.2.

Helm Changes

• Allow users to override the Service type as an alternative to Load Balancer for Ingress Proxy and Knative (https://github.com/solo-io/gloo/pull/2683)

New Features

• Allow ALPN on the upstream. Istio upstreams seem to require ALPN set. (https://github.com/solo-io/gloo/issues/2703)
• Updated envoy to envoy-gloo based on upstream envoy (b5a3405b2725e979a93e7410fce7c57a0c66d8db), which includes auto host rewrite on EDS clusters. (https://github.com/solo-io/gloo/issues/2552)

Fixes

• Fix glooctl add route so that the --dry-run flag does not create a route table or virtual service. (https://github.com/solo-io/gloo/issues/2715)
• Fix an issue with consul EDS where error were sent to a closed channel. (https://github.com/solo-io/gloo/issues/2736)
• glooctl uninstall --all and glooctl uninstall --delete-crds will now properly delete CRDs for enterprise Gloo. (https://github.com/solo-io/gloo/issues/2219)

Helm Changes

• Added the option to have annotation specified for ingress proxy (https://github.com/solo-io/gloo/issues/2685)

Fixes

• In glooctl 1.3.16, there was a regression with the glooctl add route command that prevented it from working if the --name flag was omitted, which was common in our documented tutorials. Pre 1.3.16, glooctl add route would search all namespaces for a virtual service with * for domain (all domains) to add the route to. This would require cluster-scoped permissions on the virtual service by the user.
  This change defaults glooctl add route to use a namespaced virtual service client, which requires fewer permissions, but also only searches a single namespace for virtual services to add the route to, before creating a new virtual service. glooctl add route now supports the cluster-scoped-vs-client boolean flag, which supports the original, pre 1.3.16 behavior. (https://github.com/solo-io/gloo/issues/2708)

Fixes

• Change the how Gloo handles an unset endpoint warming timeout to make upgrades safer by default. Previously, by default Gloo wouldn't wait for endpoints to warm before propagating config to Envoy. With this change, Gloo will wait up to five minutes (configurable) for discovery and EDS to warm before propagating config to Envoy, and panic if this doesn't happen within the warming timeout. This helps prevent unnecessary downtime in upgrade scenarios. If EndpointsWarmingTimeout is set to zero on the Gloo settings, the old default behavior is used (Gloo doesn't wait for EDS or discovery to be ready before propagating config). (https://github.com/solo-io/gloo/issues/2673)
• glooctl commands such as glooctl get vs now work without cluster-scoped rbac permissions. (https://github.com/solo-io/gloo/issues/2375)
• glooctl uninstall --all will now properly delete ClusterRoles and ClusterRoleBindings associated with prometheus. (https://github.com/solo-io/gloo/issues/2419)
• glooctl check now reports Gloo custom resource status warnings. (https://github.com/solo-io/gloo/issues/2659)
• In active (event-heavy) kubernetes environments, if events come in too quickly, they can lead to memory usage growing without bound in Gloo and Discovery. Mitigate and slow the leak by de-duplicating events received when possible. (https://github.com/solo-io/gloo/issues/2361)
• Propagate all warnings and errors from delegate route tables to the top level Virtual Service status field. For example, if we have a long chain of delegated route tables like vs1 -> rt1 -> rt2 -> rt3, and rt3 has a warning, that warning will show up on the parent route table rt2 and the top level Virtual Service vs1, but not any intermediary route tables like rt1. (https://github.com/solo-io/gloo/issues/2628)

Dependency Bumps

• solo-io/solo-kit has been upgraded to v0.13.3.

Helm Changes

• Allow un-setting replicas, to support flux usage of deployment with the HPA. (https://github.com/solo-io/gloo/issues/2650)
• Add quote to envoyExtgraArgs in the gatewayProxy deployment. This allows using values that start with %. This is useful for stackdriver log ingestion (https://github.com/solo-io/gloo/issues/2647)

Fixes

• With disableProxyCollection: false (the default), extauth had a race condition where it could recevie nil config. This could result in 403s that shouldn't happen. This change pulls in a fix from solo-kit where GetStatusKeys was returning a slice with an empty string, which caused an empty snapshot to be added with an empty version. Fixing this issue means that this nil config should no longer occur. (https://github.com/solo-io/gloo/issues/2645)
• Check auth configs with glooctl check. (https://github.com/solo-io/gloo/issues/2036)
• If a Virtual Service refers to a missing Auth Config, this error will now show up in the Virtual Service and the Proxy statuses as errors. (https://github.com/solo-io/gloo/issues/2017)
• Shrink the footprint of discovery significantly by removing upstream creation based on pod labels, which was originally used for (and no longer needed by) subset routing. This can drastically reduce the number of upstreams created, which in turn will reduce the size of upstreams stored in Gloo in-memory, reducing Gloo's memory footprint. (https://github.com/solo-io/gloo/issues/2619)

Helm Changes

• Add a helm chart value gatewayProxies.$gatewayProxy.gatewaySettings.ipv4Only. This changes the Gateway spec's bindAddress to '0.0.0.0' instead of '::', which is ipv6 by default. Use this helm value if your network allows ipv4 addresses only. (https://github.com/solo-io/gloo/issues/2425)

Fixes

• Fix an issue with CORS and regex. (https://github.com/solo-io/gloo/issues/2614)

Fixes

• Fix an issue with CORS and regex. (https://github.com/solo-io/gloo/issues/2614)

Helm Changes

• List HTTPS port first to avoid failing health check on AWS (https://github.com/solo-io/gloo/issues/2571)

Fixes

• Fix issue where Consul endpoints were given a similar name, due to them having the same ID. (https://github.com/solo-io/gloo/issues/2567)
• When not empty, only consul service instances that match all of the tags will be selected for this upstream. (https://github.com/solo-io/gloo/issues/2567)
• Fix Gloo linker compatibility in go 1.14; now we properly link the client version in glooctl when building on go 1.14 (this just fixes our homebrew formula, as the shipped binary had always been built with go 1.13). (https://github.com/solo-io/gloo/issues/2532)
• Fix issue where two ssl certs with the same name but different namespaces were merged. (https://github.com/solo-io/gloo/issues/2605)
• glooctl check now additionally checks that gloo and envoy are connected and that the gloo config is not rejected by envoy. (https://github.com/solo-io/gloo/issues/1627)
• Fix upgrade from Gloo 1.2.22+ to 1.3.x. The alwaysSortRouteTableRoutes setting was added to the Gloo Settings API in the 1.2.x stable branch to fix a regression from desired behavior, while enabling users that depended on the wrong behavior to enable it. This PR adds and ignores alwaysSortRouteTableRoutes to Gloo 1.3.x so upgrades from Gloo 1.2.x settings can be parsed by Gloo 1.3.x. (https://github.com/solo-io/gloo/issues/2554)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to 1.2.0.
• solo-io/envoy-gloo has been upgraded to v0.1.20.

Fixes

• Use envoy's SafeRegex feature to have more deterministic regex performance. (https://github.com/solo-io/gloo/issues/2395)

Fixes

• glooctl get vs no longer panics when certain sections are not present in the settings. (https://github.com/solo-io/gloo/issues/2550)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to 1.3.0.

Helm Changes

• Can add extra custom env vars to gloo, discovery, gateway, gateway-proxy, ingress, and ingress-proxy deployments (https://github.com/solo-io/gloo/issues/2435)
• Allow for adding custom options for the default HTTP and HTTPS gateways (https://github.com/solo-io/gloo/issues/2535)

Fixes

• Fix noisy logging on duplicate upgrade websocket config when using Gloo with SSL & SNI. (https://github.com/solo-io/gloo/issues/2500)
• Gloo currently sorts routes that originate from a single route table. This is not intended behavior. Gloo should sort routes only when a route delegates to multiple route tables, because in these cases we want to avoid short-circuiting (e.g. having /foo come before /foo/bar). This change fixes the behavior and adds a new alwaysSortRouteTableRoutes setting for users who might be depending on the current behavior. If this flag is set to true (default is false), it will force Gloo to sort the routes even when they come from a single route table. (https://github.com/solo-io/gloo/issues/2529)

New Features

• Make ALPN configurable, so that you can configure gloo to only allow http 1.1 over TLS. (https://github.com/solo-io/gloo/issues/2525)

Fixes

• When the gateway-proxy is in an unhealthy state, it will now display a clearer and more helpful "STATUS" in glooctl get vs. (https://github.com/solo-io/gloo/issues/2228)
• Fix noisy logging on duplicate upgrade websocket config when using Gloo with SSL & SNI. (https://github.com/solo-io/gloo/issues/2500)

Dependency Bumps

• solo-io/solo-kit has been upgraded to v0.11.18.

Fixes

• Fix reconciler and resource status reporter to retry more than once on resource version conflict errors. (https://github.com/solo-io/gloo/issues/2498)

Dependency Bumps

• solo-io/go-utils has been upgraded to v0.14.1.