gloo

Fixes

• When a Gateway has an empty httpGateway.virtualServiceNamespaces list, it will now search for virtual services in all the namespaces watched by Gloo. Previously the behavior was to include only virtual services in the same namespace as the gateway, which has proven unintuitive to users. (https://github.com/solo-io/gloo/issues/2156)

Helm Changes

• Allow for gateway-proxy to have a custom service name (https://github.com/solo-io/gloo/issues/2446)

New Features

• Support Consul service registry integration when Consul service endpoints are hostnames not IPs. (https://github.com/solo-io/gloo/issues/2424)

Fixes

• When a Gateway has an empty httpGateway.virtualServiceNamespaces list, it will now search for virtual services in all the namespaces watched by Gloo. Previously the behavior was to include only virtual services in the same namespace as the gateway, which has proven unintuitive to users. (https://github.com/solo-io/gloo/issues/2156)

Dependency Bumps

• solo-io/wasme has been upgraded to v0.0.13-rc1.
• solo-io/solo-kit has been upgraded to v0.13.2.

Helm Changes

• We are introducing a new Helm value global.glooMtls.enabled to enable mTLS between Gloo and Envoy (https://github.com/solo-io/gloo/issues/2134). An example of a helm override file that enables MTLS authentication is:

  glooMtls:
    enabled: true

New Features

• Allow enabling mTLS authentication between the Gloo control plane and Envoy instances. Since the Envoy configuration can contain secret data, plaintext communication between Gloo and Envoy is too insecure in certain scenarios (e.g. if your setup has the Gloo control plane and Envoy instances running in separate clusters). Turning on mTLS will encrypt the xDS communication between Gloo and Envoy. (https://github.com/solo-io/gloo/issues/2134)

Fixes

• Fix issue with multiple wasm filters getting the same config. (https://github.com/solo-io/gloo/issues/2456)
• Fix Helm charts for knative installs so version specific templates only match the provided version (https://github.com/solo-io/gloo/issues/2448)
• Fixes listener config sent to envoy to be idempotent, so that config no longer reloads as "different" when there are no changes. This resolves the issue of the "Average Request Time" graph in grafana showing gaps in the downstream data, among other potential issues. (https://github.com/solo-io/gloo/issues/2185)
• Pin versions of base docker images for Gloo containers (https://github.com/solo-io/gloo/issues/2406)

Fixes

• Fixes listener config sent to envoy to be idempotent, so that config no longer reloads as "different" when there are no changes. This resolves the issue of the "Average Request Time" graph in grafana showing gaps in the downstream data, among other potential issues. (https://github.com/solo-io/gloo/issues/2185)

Fixes

• Expose the disableKubernetesDestinations settings field as a Helm chart value, which if enabled in a Gloo deployment monitoring a large number of kubernetes services, can drastically reduce Gloo memory usage. (https://github.com/solo-io/gloo/issues/2299)

New Features

• Currently, when a delegated route defines a RouteTableSelector that matches multiple route tables, Gloo has no way of determining the order in which to process the route tables; in these cases, to avoid short-circuiting routes (e.g. having a route with a /foo path prefix matcher before one with /foo/bar), Gloo currently automatically sorts the routes by descending specificity of their matchers. While this prevents short-circuiting errors, it can lead to undesired behavior in cases where the user wants complete control over the final ordering of their routes. To prevent this, we are adding an optional weight field to the RouteTable resource. Gloo will now inspect this field to determine the order in which route tables are to be evaluated when a selector matches multiple ones. This will give the user control over the order in which the routes will appear on the final Proxy resource. The field is optional; if no value is specified, the weight defaults to 0 (zero). Gloo will process the route tables matched by a selector in ascending order by weight and collect the routes of each route table in the order they are defined. If multiple route tables define the same weight, Gloo will sort the routes which belong to those tables to avoid short-circuiting. In this scenario, Gloo will also alert the user by adding a warning to the status of the parent resource (the one that specifies the RouteTableSelector). (https://github.com/solo-io/gloo/issues/2233)

Fixes

• Use envoy's SafeRegex in method matching - old style regex match is now deprecated in envoy. (https://github.com/solo-io/gloo/issues/2395)

Dependency Bumps

• solo-io/solo-kit has been upgraded to v0.13.1.
• solo-io/envoy-gloo has been upgraded to v0.1.20.

New Features

• Add name field to Route object for convenience of naming routes. (https://github.com/solo-io/gloo/issues/2234)
• Expose the disableProxyGarbageCollection settings field as a Helm chart value. (https://github.com/solo-io/gloo/issues/2323)
• Gloo now supports enabling the Envoy gzip compression filter by configuring spec.httpGateway.options.gzip of the desired Gateway. (https://github.com/solo-io/gloo/issues/2315)
• Use envoy's SafeRegex feature to have more deterministic regex performance. (https://github.com/solo-io/gloo/issues/2395)

Fixes

• Fix bug which causes Gloo's EDS cache from being flushed when upstreams are updated, leading to temporary 503s from the proxy. (https://github.com/solo-io/gloo/issues/2356)
• Ensure Knative Services are exposed on the internal Knative proxy. currently this assumption is made but not documented by Knative's visibility setting: knative/serving#6642. In order for Knative Eventing to work with Gloo, Gloo must load cluster-local services on the internal proxy as well. (https://github.com/solo-io/gloo/issues/2336)
• Fix validation setting to honor always accept. (https://github.com/solo-io/gloo/issues/2280)
• Ignore opaque metadata when hashing, which can make Gloo & Gateway interactions less noisy and reduce unnecessary resyncs. (https://github.com/solo-io/gloo/issues/2331)
• Fix leaking goroutine in validation. (https://github.com/solo-io/gloo/issues/2313)

Fixes

• Fix bug which causes Gloo's EDS cache from being flushed when upstreams are updated, leading to temporary 503s from the proxy. (https://github.com/solo-io/gloo/issues/2356)
• Fix validation setting to honor always accept. (https://github.com/solo-io/gloo/issues/2280)
• Ignore opaque metadata when hashing, which can make Gloo & Gateway interactions less noisy and reduce unnecessary resyncs. (https://github.com/solo-io/gloo/issues/2331)
• Fix leaking goroutine in validation. (https://github.com/solo-io/gloo/issues/2313)

New Features

• Expose the disableKubernetesDestinations settings field as a Helm chart value. (https://github.com/solo-io/gloo/issues/2299)

Fixes

• Fix cert-gen job for clusters using non-default domain suffix. (https://github.com/solo-io/gloo/issues/2288)
• Fix logic to determine whether we are on the default branch. (https://github.com/solo-io/gloo/issues/2220)
• Fix glooctl install command when -f flag is omitted to no longer error erroneously. (https://github.com/solo-io/gloo/issues/508)
• Remove unnecessary pre-upgrade Helm hooks to avoid failing on upgrades. (https://github.com/solo-io/gloo/issues/2212)
• Remove occurrences of deprecated hash functions. (https://github.com/solo-io/gloo/issues/2275)
• Remove unnecessary unmarshalling in ConfigMap converter. (https://github.com/solo-io/gloo/issues/2277)
• Remove unnecessary post-upgrade Helm hooks. (https://github.com/solo-io/gloo/issues/2212)

Dependency Bumps

• solo-io/solo-kit has been upgraded to v0.11.17.

New Features

• Generate hash functions to improve CPU performance (https://github.com/solo-io/gloo/issues/1711)

Fixes

• Allow updating settings and default gateway resources when upgrading via Helm. (https://github.com/solo-io/gloo/issues/2317)
• Settings and Gateway resources currently get automatically created when the gloo and gateway pods (respectively) start up. This creates a race condition with our installation that we currently solve by creating our default Settings and Gateways as Helm Hook resources, which means that they are not managed as a part of the Helm release lifecycle. With this change removes the automatic generation feature. Note that the default Settings and Gateway resources in the Helm chart are still marked as Helm hooks. (https://github.com/solo-io/gloo/issues/1828)
• Remove unnecessary pre-upgrade Helm hooks to avoid failing on upgrades. (https://github.com/solo-io/gloo/issues/2212)
• Remove occurrences of deprecated hash functions. (https://github.com/solo-io/gloo/issues/2275)
• Remove unnecessary unmarshalling in ConfigMap converter. (https://github.com/solo-io/gloo/issues/2277)
• Remove unnecessary post-upgrade Helm hooks. (https://github.com/solo-io/gloo/issues/2212)

Downgrading this to a pre-release due to the following regressions:

• glooctl install is broken
• glooctl formulas are not updated with release

Dependency Bumps

• solo-io/go-utils has been upgraded to v0.13.1.

New Features

• Add glooctl ui command to open Gloo UI from the command line. (https://github.com/solo-io/gloo/issues/1706)
• Update the Delegation API to support delegating routing decisions to multiple RouteTables. RouteTables to delegate to can be selected by either namespaces, labels, or both, using the new RouteTableSelector field. The routes of all matching RouteTables will be merged and the resulting route set will be sorted by descending specificity of the matchers on each route, e.g. matchers with longer prefixes will appear first. This feature is meant to replace the virtual service merging feature that we deprecated with the stable v1 release of Gloo. Virtual service merging allowed users to define multiple VirtualServices for the same domain, which Gloo would then merge into a single VirtualHost on the Proxy resource. Although useful to many users, this feature could lead to confusion: the API is not self-documenting with respect to the merging behavior and multiple users could inadvertently step on each other's toes when defining routes for the same domain. As of this release, virtual service merging is not supported anymore; defining two virtual services with overlapping domain sets will result in an error. To be able to define the routes for a given domain on different resources, users can now use the Delegation API. With the new RouteTableSelector attribute, the Delegation API now enables the same use cases as virtual service merging and has the advantage of surfacing the fact that multiple resources define routes for the same domains to the API. To give a simple example, a Gloo administrator can define a VirtualService with a single route that delegates all requests for a domain to any RouteTables that have the domain: example.com label (namespaces to search can be configured as well); this will allow users to add routes for that domain by creating their own RouteTables (with a domain: example.com label) without having to request updates to the parent VirtualService. (https://github.com/solo-io/gloo/issues/2054)

Fixes

• fix whitespace issue in helm chart (https://github.com/solo-io/gloo/issues/2159)
• fix glooctl install ingress/knative to nest helm overrides under "gloo" when a GlooE chart is passed with -f flag (https://github.com/solo-io/gloo/issues/1999)
• fix glooctl install gateway enterprise to stop nesting helm overrides under "gloo" when a Gloo open-source chart is passed with the -f flag (https://github.com/solo-io/gloo/issues/2145)
• Fix error (and repetitive logging) when Gateway Notification Channel is closed. This issue can happen when network communication between tthe Gloo and Gateway pods is interrupted. (https://github.com/solo-io/gloo/issues/2070)
• Introduce a feature flag in the Settings CRD named disableProxyGarbageCollection, located under the 'gloo' options. Set this option to determine the state of the envoy configuration when a virtual service is deleted, resulting in a proxy with no configured routes. Set to true if you wish to keep envoy serving the routes from the latest valid configuration. Set to false if you wish to reset the envoy configuration to a clean slate with no routes. disableProxyGarbageCollection defaults to 'false'. (https://github.com/solo-io/gloo/issues/1245)

Fixes

• Fix error (and repetitive logging) when Gateway Notification Channel is closed. This issue can happen when network communication between tthe Gloo and Gateway pods is interrupted. (https://github.com/solo-io/gloo/issues/2070)
• Wire in grpc web into gloo. (https://github.com/solo-io/gloo/issues/555)
• Update the delegation API to support delegating to multiple route tables. Route tables to delegate to can be selected by either namespaces, labels, or both, using the new RouteTableSelector field. The routes of all matching route tables will be merged and the resulting route set will be sorted by descending specificity of the matchers on each route, i.e. matchers with longer prefixes will appear first (delegated routes can only have prefix matchers). (https://github.com/solo-io/gloo/issues/2054)

Dependency Bumps

• solo-io/solo-kit has been upgraded to v0.12.1.

New Features

• Make Gloo fully compatible with go.mod, so that it can be run outside of the GOPATH. As a result of this all of the proto import paths needed to be stripped of the github.com/solo-io prefix, as that is no longer assured outside of the GOPATH. (https://github.com/solo-io/gloo/issues/835)

Fixes

• Wire in grpc web into gloo. (https://github.com/solo-io/gloo/issues/555)
• undo change to /docs/.gitignore which was failing to commit new generated docs, therefore producing broken links (https://github.com/solo-io/gloo/issues/2077)
• If we are searching for resources (e.g. upstreams) in a nonexistent namespace during glooctl get, we now return a helpful error. (https://github.com/solo-io/gloo/issues/1647)

New Features

• Add a new auth_endpoint_query_params field to the AuthConfig CRD. When using the Gloo Enterprise OAuth feature, this allows you to append additional query parameters to the request that Gloo sends to the OIDC authorization endpoint to initiate the authorization code flow. This can be useful to integrate Gloo with some identity providers that require custom parameters to be sent to the authorization endpoint.
  The new field is a map, where each key-value pair will result in an additional query parameter:

  name: google-oidc
  namespace: gloo-system
spec:
  configs:
  - oauth:
      app_url: http://localhost:8080
      callback_path: /callback
      client_id: $CLIENT_ID
      client_secret_ref:
        name: google
        namespace: gloo-system
      issuer_url: https://accounts.google.com
      auth_endpoint_query_params:
        key1 : value1
        key2 : value2

We also added a new --auth-endpoint-query-params flag to the glooctl create authconfig command; the flag takes in a comma-separated list of key value pairs (e.g. a=b,c=d). (https://github.com/solo-io/gloo/issues/2030)

• Allow users to specify which release version to install via glooctl with: glooctl install gateway enterprise --version 0.20.6 or glooctl install gateway --version 1.2.1 (https://github.com/solo-io/gloo/issues/1863)

Marked as a pre-release as it tracks the 1.3.x branch instead of the 1.2.x branch, and has some new features. 1.2.15 will be a patch release for any fixes since 1.2.12 (the v1.2.x branch)

Dependency Bumps

• solo-io/go-utils has been upgraded to v0.11.7.

New Features

• Support Manual configuration of SSL for Knative Services. Using the annotations gloo.networking.knative.dev/ssl.sni_domains and gloo.networking.knative.dev/ssl.secret_name, users can manually configure Gloo to serve TLS for their Knative Services (https://github.com/solo-io/gloo/issues/2048)

This release build failed. (Helm charts failed to publish for this version)

Marked as a pre-release as it tracks the 1.3.x branch instead of the 1.2.x branch, and has some new features. 1.2.15 will be a patch release for any fixes since 1.2.12 (the v1.2.x branch)

Dependency Bumps

• solo-io/go-utils has been upgraded to v0.11.5.

Helm Changes

• Ensure that all stats server settings are consistent across open source and enterprise Gloo by moving the enabled logic into a global helper template. This change introduces a global value that all deployments will use as their default stats server settings: global.glooStats.enabled. This value can be overridden by an individual deployment by setting a field on that deployment. For example, to disable stats on discovery, you can do discovery.deployment.stats.enabled=false. Note that this change has converted the stats field on our deployment objects from a boolean to an object with an enabled boolean field inside of it. (https://github.com/solo-io/gloo/issues/1884)

New Features

• Generate hash functions to improve CPU performance (https://github.com/solo-io/gloo/issues/1711)
• Reduce permissions needed to run glooctl in cluster by removing cross-namespace calls from install command. (https://github.com/solo-io/gloo/issues/1765)
• Add support for multiple envoy wasm filters, as well as specifying placement of said filters within the chain. (https://github.com/solo-io/gloo/issues/1956)
• Support Knative Ingress Class Annotations. If env var REQUIRE_INGRESS_CLASS=true on the Knative Ingress Controller, only ingresses with the annotation 'networking.knative.dev/ingress.class=gloo.ingress.networking.knative.dev' will be processed. Set Helm value Values.settings.integrations.knative.requireIngressClass=true to enable with Helm. (https://github.com/solo-io/gloo/issues/2040)

Fixes

• Don't error on install if gloo installation namespace already exists. (https://github.com/solo-io/gloo/issues/1988)
• Settings and Gateway resources currently get automatically created when the gloo and gateway pods (respectively) start up. This creates a race condition with our installation that we currently solve by creating our default Settings and Gateways as Helm Hook resources, which means that they are not managed as a part of the Helm release lifecycle. This is fixed by no longer creating those resources if they do not exist when the pods start up. (https://github.com/solo-io/gloo/issues/1828)

This release contained no user-facing changes.

This release build failed.

New Features

• Adds the ability to configure WebSocket upgrades on the HTTP Connection Manager and/or as part of a route's options. (https://github.com/solo-io/gloo/issues/1132)

Fixes

• glooctl uninstall now respects all the CLI options when Gloo was not installed via glooctl install or helm install. (https://github.com/solo-io/gloo/issues/1938)
• Don't attempt to reach the knative api server if the user is doing a dry-run installation. (https://github.com/solo-io/gloo/issues/1951)
• Remove glooctl install gateway --upgrade flag, since we have removed the v2 Gateway CRD. (https://github.com/solo-io/gloo/issues/1982)
• Make the code around upgrade configs more defensive (https://github.com/solo-io/gloo/issues/1979)

Fixes

• glooctl assumed a kube-based environment when checking for a client/Server version mismtach. When using Consul, this caused a delay in the glooctl command while the connection to kubernetes timed out and a kubernetes error message. The version check for non-kubernetes environments is now disabled. (https://github.com/solo-io/gloo/issues/1893)

This release build failed.

Fixes

• Bump envoy-wasm to resolve issue for loading non-empty config for remote WASM extensions. (https://github.com/solo-io/gloo/issues/1919)
• Add CRD resources back to the manifest files that are published as part of a Gloo release. (https://github.com/solo-io/gloo/issues/1877)