gloo

Fixes

• Migrate from alpine to ubuntu for released version. Backlogged an issue to move fully to distroless on beta branch. Can be found here https://github.com/solo-io/solo-projects/issues/5388 Not migrating prior as this may impact some debugging steps. Forced to migrate per glibc being unable to update. https://nvd.nist.gov/vuln/detail/CVE-2022-23218 https://nvd.nist.gov/vuln/detail/CVE-2022-23219 https://nvd.nist.gov/vuln/detail/CVE-2021-38604 https://nvd.nist.gov/vuln/detail/CVE-2021-3998 See here for glibc on alpine maintainers https://gitlab.alpinelinux.org/alpine/tsc/-/issues/43#note_306270 https://github.com/sgerrand/alpine-pkg-glibc/issues/207#issuecomment-1707209887 https://github.com/sgerrand/alpine-pkg-glibc/issues/176 (https://github.com/solo-io/solo-projects/issues/5344)

This release contained no user-facing changes.

This release contained no user-facing changes.

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.23.12-patch2.

Helm Changes

• Fix TTL not being respected on Helm hook jobs due to deletion policy. (https://github.com/solo-io/gloo/issues/8500)

Fixes

• Support role chaining using EKS ServiceAccounts outside of us-east-1 (https://github.com/solo-io/gloo/issues/8578)

This release contained no user-facing changes.

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.25.9-patch2.

Helm Changes

• Fix TTL not being respected on Helm hook jobs due to deletion policy. (https://github.com/solo-io/gloo/issues/8500)

Fixes

• Add support for most_specific_header_mutations_wins to allow the more specific header mutation to win. Toggling it on would reverse the evaluation order of the header mutations, allowing more specific header mutations to overwrite less specific.
  https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route.proto#envoy-v3-api-field-config-route-v3-routeconfiguration-most-specific-header-mutations-wins (https://github.com/solo-io/gloo/issues/8690)
• Support role chaining using EKS ServiceAccounts outside of us-east-1 (https://github.com/solo-io/gloo/issues/8578)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.26.4-patch3.

Helm Changes

• Fix TTL not being respected on Helm hook jobs due to deletion policy. (https://github.com/solo-io/gloo/issues/8500)

Fixes

• Add support for most_specific_header_mutations_wins to allow the more specific header mutation to win. Toggling it on would reverse the evaluation order of the header mutations, allowing more specific header mutations to overwrite less specific.
  https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route.proto#envoy-v3-api-field-config-route-v3-routeconfiguration-most-specific-header-mutations-wins (https://github.com/solo-io/gloo/issues/8690)
• Support role chaining using EKS ServiceAccounts outside of us-east-1 (https://github.com/solo-io/gloo/issues/8578)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.26.4-patch3.

Helm Changes

• Fix TTL not being respected on Helm hook jobs due to deletion policy. (https://github.com/solo-io/gloo/issues/8500)

New Features

• Add support for most_specific_header_mutations_wins to allow the more specific header mutation to win. Toggling it on would reverse the evaluation order of the header mutations, allowing more specific header mutations to overwrite less specific.
  https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route.proto#envoy-v3-api-field-config-route-v3-routeconfiguration-most-specific-header-mutations-wins (https://github.com/solo-io/gloo/issues/8690)

Fixes

• Support role chaining using EKS ServiceAccounts outside of us-east-1 (https://github.com/solo-io/gloo/issues/8578)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.26.4-patch2.
• solo-io/go-control-plane-fork-v2 has been upgraded to v0.11.1.
• solo-io/k8s-utils has been upgraded to v0.5.1.

Helm Changes

• Fix syntax error in Gateway yaml when using kube overrides. (https://github.com/solo-io/gloo/issues/8648)

Dependency Bumps

• solo-io/k8s-utils has been upgraded to v0.1.11.

Helm Changes

• Fix syntax error in Gateway yaml when using kube overrides. (https://github.com/solo-io/gloo/issues/8648)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.26.2-patch4.
• solo-io/go-control-plane-fork-v2 has been upgraded to v0.11.1.
• solo-io/k8s-utils has been upgraded to v0.5.1.

Helm Changes

• Add new certgen CronJob if validation webhook is enabled (https://github.com/solo-io/gloo/issues/5944)
• Add an option to enable force-rotation flag for certgen job (https://github.com/solo-io/gloo/issues/5944)
• Fix syntax error in Gateway yaml when using kube overrides. (https://github.com/solo-io/gloo/issues/8648)

New Features

• Certgen job will now renew existing certificate if it is expiring soon (90d by default). (https://github.com/solo-io/gloo/issues/5944)

Dependency Bumps

• solo-io/k8s-utils has been upgraded to v0.3.3.

Helm Changes

• Fix syntax error in Gateway yaml when using kube overrides. (https://github.com/solo-io/gloo/issues/8648)
• Added PodDisruptionBudget helm values for the gloo deployment (https://github.com/solo-io/gloo/issues/8445)

This release contained no user-facing changes.

Fixes

• Add field to ExtAuth API's OIDC AuthorizationCode plugin to eventually support mapping claims to headers. (https://github.com/solo-io/gloo-mesh-enterprise/issues/10589)

Helm Changes

• Expose secretOptions in Settings Helm chart. (https://github.com/solo-io/gloo/issues/8533)

Fixes

• Make Vault's AWS credentials optional. This allows users to integrate AWS Security Token Service (STS) or IAM Roles for Service Accounts (IRSA) for temporary credentials. https://developer.hashicorp.com/vault/docs/auth/aws#iam-authentication-inferences (https://github.com/solo-io/gloo/issues/8533)

Helm Changes

• Breakdown Job and their respective RBAC helm values for the gloo deployment (https://github.com/solo-io/gloo/issues/8616)
• Expose secretOptions in Settings Helm chart. (https://github.com/solo-io/gloo/issues/8533)

New Features

• Gloo now supports local limiting. This restricts the rate of connections per gateway, virtual host or route using envoy's own local rate limit filter, thus no longer requiring the need for an external rate limit server. This includes both the network and http local rate limit filter. (https://github.com/solo-io/gloo/issues/7428)

Fixes

• Make Vault's AWS credentials optional. This allows users to integrate AWS Security Token Service (STS) or IAM Roles for Service Accounts (IRSA) for temporary credentials. https://developer.hashicorp.com/vault/docs/auth/aws#iam-authentication-inferences (https://github.com/solo-io/gloo/issues/8533)

Dependency Bumps

• sigs.k8s.io/controller-runtime has been upgraded to v0.15.2.

New Features

• Add field to ExtAuth API's OIDC AuthorizationCode plugin to eventually support mapping claims to headers. (https://github.com/solo-io/gloo-mesh-enterprise/issues/10589)

Fixes

• Prevent error when modifying settings by making sure loggers get initialized. (https://github.com/solo-io/gloo/issues/8627)

Dependency Bumps

• sigs.k8s.io/controller-runtime has been upgraded to v0.15.2.

Helm Changes

• Added PodDisruptionBudget helm values for the gloo deployment (https://github.com/solo-io/gloo/issues/8445)

Fixes

• Prevent error when modifying settings by making sure loggers get initialized. (https://github.com/solo-io/gloo/issues/8627)

Helm Changes

• Added PodDisruptionBudget helm values for the gloo deployment (https://github.com/solo-io/gloo/issues/8445)

New Features

• Update AuthConfig protos to support querying OPA sidecar for policy decisions. (https://github.com/solo-io/gloo-mesh-enterprise/issues/10237)

Fixes

• Expose the ability to overwrite headers in HTTP Passthrough Auth with the added allowedUpstreamHeaderToOverwrite field. (https://github.com/solo-io/gloo/issues/8477)