gloo

This release contained no user-facing changes.

This release contained no user-facing changes.

This release contained no user-facing changes.

Helm Changes

• Add new certgen CronJob if validation webhook is enabled (https://github.com/solo-io/gloo/issues/5944)
• Add an option to enable force-rotation flag for certgen job (https://github.com/solo-io/gloo/issues/5944)

Fixes

• Make cert rotation more resilient against downtime when mTLS is enabled, by updating the certs in stages and waiting for changes to propagate. A new helm value gateway.certGenJob.rotationDuration (default 65s) can be used the configure the duration to wait for each stage of cert rotation to complete. This value must be tuned according to the performance of the specific environment in which the jobs are run. (https://github.com/solo-io/solo-projects/issues/5252)
• Certgen job will now renew existing certificate if it is expiring soon (90d by default). (https://github.com/solo-io/gloo/issues/5944)
• Unfortunately, the custom readiness probe fix causes issues in deployments via Argo, since the resouce-rollout job is deleted and causes the argo app to go out of sync, as well as missing permissions to watch jobs. Reverted this fix (https://github.com/solo-io/gloo/issues/8809)

Fixes

• Make cert rotation more resilient against downtime when mTLS is enabled, by updating the certs in stages and waiting for changes to propagate. A new helm value gateway.certGenJob.rotationDuration (default 65s) can be used the configure the duration to wait for each stage of cert rotation to complete. This value must be tuned according to the performance of the specific environment in which the jobs are run. (https://github.com/solo-io/solo-projects/issues/5252)
• Unfortunately, the custom readiness probe fix causes issues in deployments via Argo, since the resouce-rollout job is deleted and causes the argo app to go out of sync, as well as missing permissions to watch jobs. Reverted this fix (https://github.com/solo-io/gloo/issues/8809)

Fixes

• Unfortunately, the custom readiness probe fix causes issues in deployments via Argo, since the resouce-rollout job is deleted and causes the argo app to go out of sync, as well as missing permissions to watch jobs. Reverted this fix (https://github.com/solo-io/gloo/issues/8809)

Fixes

• Unfortunately, the custom readiness probe fix causes issues in deployments via Argo, since the resouce-rollout job is deleted and causes the argo app to go out of sync, as well as missing permissions to watch jobs. Reverted this fix (https://github.com/solo-io/gloo/issues/8809)

Fixes

• Gloo now supports local limiting. This restricts the rate of connections per gateway, virtual host or route using envoy's own local rate limit filter, thus no longer requiring the need for an external rate limit server. This includes both the network and http local rate limit filter. (https://github.com/solo-io/gloo/issues/7428)

Dependency Bumps

• solo-io/cloud-builders has been upgraded to v0.6.5.
• solo-io/envoy-gloo has been upgraded to v1.26.5-patch1.
• solo-io/go-control-plane-fork-v2 has been upgraded to v0.11.1/forked-extproc.

Helm Changes

• Adds the helm value gateway.rolloutJob.timeout to specifiy the timeout to wait for the resource rollout job to complete. (https://github.com/solo-io/gloo/issues/8782)

New Features

• Exposes cluster option for preconnect policy. Explicitly scoped to just upstreams as this is RARELY a good feature to use. (https://github.com/solo-io/solo-projects/issues/5411)

Fixes

• Remove the Envoy cluster from the error log when validating clusters, avoiding the exposure of sensitive data (secrets). (https://github.com/solo-io/gloo/issues/8592)
• • Fix issue where the validation webhook did not validate on Secret deletions.
• IMPORTANT: Secret deletions are now being validated. This could cause a slight performance degradation when deleting Secrets. To opt-out, add 'secrets' to gateway.validation.webhook.skipDeleteValidationResources. (https://github.com/solo-io/gloo/issues/8001)

Dependency Bumps

• envoy-gloo/solo-io has been upgraded to v1.23.12-patch3.
• solo-io/cloud-builders has been upgraded to v0.6.5.

Helm Changes

• Adds the helm value gateway.rolloutJob.timeout to specifiy the timeout to wait for the resource rollout job to complete. (https://github.com/solo-io/gloo/issues/8782)

Fixes

• Remove the Envoy cluster from the error log when validating clusters, avoiding the exposure of sensitive data (secrets). (https://github.com/solo-io/gloo/issues/8592)

Dependency Bumps

• envoy-gloo/solo-io has been upgraded to v1.23.12-patch3.

Fixes

• Remove the Envoy cluster from the error log when validating clusters, avoiding the exposure of sensitive data (secrets). (https://github.com/solo-io/gloo/issues/8592)
• Fix istio-proxy container definition in gateway-proxy template Add new e2e tests that handles Istio SDS case, ensuring mTLS occurs as expected (https://github.com/solo-io/gloo/issues/8092)

Dependency Bumps

• solo-io/cloud-builders has been upgraded to v0.6.5.
• solo-io/envoy-gloo has been upgraded to v1.26.5-patch1.
• solo-io/go-control-plane-fork-v2 has been upgraded to v0.11.1/forked-extproc.

Helm Changes

• Adds the helm value gateway.rolloutJob.timeout to specifiy the timeout to wait for the resource rollout job to complete. (https://github.com/solo-io/gloo/issues/8782)

Fixes

• Remove the Envoy cluster from the error log when validating clusters, avoiding the exposure of sensitive data (secrets). (https://github.com/solo-io/gloo/issues/8592)
• • Fix issue where the validation webhook did not validate on Secret deletions.
• IMPORTANT: Secret deletions are now being validated. This could cause a slight performance degradation when deleting Secrets. To opt-out, add 'secrets' to gateway.validation.webhook.skipDeleteValidationResources. (https://github.com/solo-io/gloo/issues/8001)
• Exposes cluster option for preconnect policy. Explicitly scoped to just upstreams as this is RARELY a good feature to use. (https://github.com/solo-io/solo-projects/issues/5411)

Dependency Bumps

• solo-io/cloud-builders has been upgraded to v0.6.5.
• solo-io/envoy-gloo has been upgraded to v1.25.10-patch1.

Helm Changes

• Adds the helm value gateway.rolloutJob.timeout to specifiy the timeout to wait for the resource rollout job to complete. (https://github.com/solo-io/gloo/issues/8782)

Fixes

• Remove the Envoy cluster from the error log when validating clusters, avoiding the exposure of sensitive data (secrets). (https://github.com/solo-io/gloo/issues/8592)

Helm Changes

• Changes the default value of gateway.rolloutJob.ttlSecondsAfterFinished from 60 to 300 to accomodate the fix for the aforementioned custom readiness probe issue. (https://github.com/solo-io/gloo/issues/8288)

Fixes

• Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the --wait flag. (https://github.com/solo-io/gloo/issues/8288)

Helm Changes

• Changes the default value of gateway.rolloutJob.ttlSecondsAfterFinished from 60 to 300 to accomodate the fix for the aforementioned custom readiness probe issue. (https://github.com/solo-io/gloo/issues/8288)

Fixes

• This ensures that a new deployment is rolled if the configmap it references changes. This is done by adding a checksum/<configmap-name> annotation on any deployment that uses a configmap as a container volume. (https://github.com/solo-io/gloo/issues/8392)
• Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the --wait flag. (https://github.com/solo-io/gloo/issues/8288)
• Fix istio-proxy container definition in gateway-proxy template Add new e2e tests that handles Istio SDS case, ensuring mTLS occurs as expected (https://github.com/solo-io/gloo/issues/8092)

Helm Changes

• Changes the default value of gateway.rolloutJob.ttlSecondsAfterFinished from 60 to 300 to accomodate the fix for the aforementioned custom readiness probe issue. (https://github.com/solo-io/gloo/issues/8288)

Fixes

• This ensures that a new deployment is rolled if the configmap it references changes. This is done by adding a checksum/<configmap-name> annotation on any deployment that uses a configmap as a container volume. (https://github.com/solo-io/gloo/issues/8392)
• Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the --wait flag. (https://github.com/solo-io/gloo/issues/8288)
• Fix istio-proxy container definition in gateway-proxy template Add new e2e tests that handles Istio SDS case, ensuring mTLS occurs as expected (https://github.com/solo-io/gloo/issues/8092)

Fixes

• This ensures that a new deployment is rolled if the configmap it references changes. This is done by adding a checksum/<configmap-name> annotation on any deployment that uses a configmap as a container volume. (https://github.com/solo-io/gloo/issues/8392)
• Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the --wait flag. (https://github.com/solo-io/gloo/issues/8288)

Fixes

• This ensures that a new deployment is rolled if the configmap it references changes. This is done by adding a checksum/<configmap-name> annotation on any deployment that uses a configmap as a container volume. (https://github.com/solo-io/gloo/issues/8392)
• Re-enable wget in our gloo and gateway-proxy pods. Wget is currently used in our non-custom probes which are currently not well covered in tests. Caused by https://github.com/solo-io/solo-projects/issues/5344 shift to ubuntu. (https://github.com/solo-io/gloo/issues/8749)

New Features

• Add a clientAuthentication block to the OidcAuthorizationCode config to allow for client secret and private key jwt client authentication methods (https://github.com/solo-io/gloo/issues/7744)

Fixes

• Migrate from alpine to ubuntu for released version. Backlogged an issue to move fully to distroless on beta branch. Can be found here https://github.com/solo-io/solo-projects/issues/5388 Not migrating prior as this may impact some debugging steps. Forced to migrate per glibc being unable to update. https://nvd.nist.gov/vuln/detail/CVE-2022-23218 https://nvd.nist.gov/vuln/detail/CVE-2022-23219 https://nvd.nist.gov/vuln/detail/CVE-2021-38604 https://nvd.nist.gov/vuln/detail/CVE-2021-3998 See here for glibc on alpine maintainers https://gitlab.alpinelinux.org/alpine/tsc/-/issues/43#note_306270 https://github.com/sgerrand/alpine-pkg-glibc/issues/207#issuecomment-1707209887 https://github.com/sgerrand/alpine-pkg-glibc/issues/176 (https://github.com/solo-io/solo-projects/issues/5344)