gloo

Fixes

• Add fields to the API to allow Envoy to set x-fowarded-host and x-forwarded-post headers. (https://github.com/solo-io/gloo/issues/7683)

This release contained no user-facing changes.

New Features

• Expose the ability to overwrite headers in HTTP Passthrough Auth with the added allowedUpstreamHeaderToOverwrite field. (https://github.com/solo-io/gloo/issues/8477)

Fixes

• Fix incorrect CRD generation and overflow caused of proto fileds of type google.protobuf.UInt64Value. Previously fields of this type had an incorrect schema as well as led to overflows which led to them failing being unmarshalled, which is now resolved by changing the type to google.protobuf.UInt32Value, which is backward-forward compatible. Ref. https://protobuf.dev/programming-guides/proto2/#updating point 5. Affected protos include gateway specs httpGateway.options.caching.maxPayloadSize and httpGateway.options.connectionLimit.maxActiveConnections (https://github.com/solo-io/gloo/issues/8568)

Fixes

• Fix incorrect CRD generation and overflow caused of proto fileds of type google.protobuf.UInt64Value. Previously fields of this type had an incorrect schema as well as led to overflows which led to them failing being unmarshalled, which is now resolved by changing the type to google.protobuf.UInt32Value, which is backward-forward compatible. Ref. https://protobuf.dev/programming-guides/proto2/#updating point 5. Affected protos include gateway specs httpGateway.options.caching.maxPayloadSize and httpGateway.options.connectionLimit.maxActiveConnections (https://github.com/solo-io/gloo/issues/8568)

Fixes

• Fix incorrect CRD generation and overflow caused of proto fileds of type google.protobuf.UInt64Value. Previously fields of this type had an incorrect schema as well as led to overflows which led to them failing being unmarshalled, which is now resolved by changing the type to google.protobuf.UInt32Value, which is backward-forward compatible. Ref. https://protobuf.dev/programming-guides/proto2/#updating point 5. Affected protos include gateway specs httpGateway.options.caching.maxPayloadSize and httpGateway.options.connectionLimit.maxActiveConnections (https://github.com/solo-io/gloo/issues/8568)

This release contained no user-facing changes.

Fixes

• Check for empty values in fields that are required by Envoy for RateLimitActions. Previously invalid config would be passed to Envoy. API reference: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-ratelimit-action. (https://github.com/solo-io/gloo/issues/8573)
• Added customInputResource unmarshalling logic to ValidatingAdmissionWebhook for RateLimitConfigs (https://github.com/solo-io/gloo/issues/8042)

Dependency Bumps

• solo-io/cloud-builders has been upgraded to v0.6.4.

Fixes

• Check for empty values in fields that are required by Envoy for RateLimitActions. Previously invalid config would be passed to Envoy. API reference: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-ratelimit-action. (https://github.com/solo-io/gloo/issues/8573)

Dependency Bumps

• solo-io/cloud-builders has been upgraded to v0.6.4.

Fixes

• Check for empty values in fields that are required by Envoy for RateLimitActions. Previously invalid config would be passed to Envoy. API reference: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-ratelimit-action. (https://github.com/solo-io/gloo/issues/8573)
• Added customInputResource unmarshalling logic to ValidatingAdmissionWebhook for RateLimitConfigs (https://github.com/solo-io/gloo/issues/8042)

Fixes

• Add a default case when converting Solo ratelimit actions to Enovy actions. (https://github.com/solo-io/gloo/issues/8573)

Dependency Bumps

• solo-io/cloud-builders has been upgraded to v0.6.4.

Fixes

• Check for empty values in fields that are required by Envoy for RateLimitActions. Previously invalid config would be passed to Envoy. API reference: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-ratelimit-action. (https://github.com/solo-io/gloo/issues/8573)

This release contained no user-facing changes.

This release contained no user-facing changes.

This release contained no user-facing changes.

Fixes

• Adds the ability to pass initial_metadata while configuring a GrpcHealthCheck. It specifies a list of key-value pairs that should be added to the metadata of each GRPC call that is sent to the health checked cluster. (https://github.com/solo-io/gloo/issues/8490)

Dependency Bumps

• golang/go has been upgraded to go1.20.

Fixes

• Bump golang to 1.20. This requires all plugins to be rebuilt. (https://github.com/solo-io/solo-projects/issues/5215)

Dependency Bumps

• solo-io/go-utils has been upgraded to v0.24.6.
• solo-io/k8s-utils has been upgraded to v0.5.0.
• solo-io/skv2 has been upgraded to v0.32.0.
• solo-io/solo-apis has been upgraded to sa-k8s-1.27-bump.
• solo-io/solo-kit has been upgraded to v0.33.0.
• k8s.io/api has been upgraded to v0.27.3.
• k8s.io/apiextensions-apiserver has been upgraded to v0.27.3.
• k8s.io/apimachinery has been upgraded to v0.27.3.
• k8s.io/client-go has been upgraded to v0.27.3.
• k8s.io/code-generator has been upgraded to v0.27.3.
• k8s.io/component-base has been upgraded to v0.27.3.
• k8s.io/kubectl has been upgraded to v0.27.3.
• k8s.io/kube-openapi has been upgraded to v0.0.0-20230501164219-8b0f38b5fd1f.
• k8s.io/metrics has been upgraded to v0.27.3.
• k8s.io/utils has been upgraded to v0.0.0-20230220204549-a5ecb0141aa5.
• sigs.k8s.io/controller-runtime has been upgraded to v0.15.0.

Breaking Changes

• Update Kubernetes API to 1.27 (https://github.com/solo-io/gloo/issues/8214)

New Features

• Adds the ability to pass initial_metadata while configuring a GrpcHealthCheck. It specifies a list of key-value pairs that should be added to the metadata of each GRPC call that is sent to the health checked cluster. (https://github.com/solo-io/gloo/issues/8490)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.25.9-patch1.
• solo-io/k8s-utils has been upgraded to v0.3.2.

Fixes

• Pulls in upstream Envoy v1.25.9-patch1, which resolves CVE-2023-35941, CVE-2023-35942, CVE-2023-35944, and CVE-2023-35945 (https://github.com/solo-io/solo-projects/issues/5138)
• Fix typo in helm template when rendering multiple Gateways. (https://github.com/solo-io/gloo/issues/8404)
• Add an environment variable "HEADER_SECRET_REF_NS_MATCHES_US" that when set in the gloo pod requires that secrets sent in headers to an upstream are in the same namespace as that upstream. This defaults to false and when it is not set, resources can be in any namespaces watched by Gloo. (https://github.com/solo-io/solo-projects/issues/5007)

Dependency Bumps

• solo-io/envoy-gloo has been upgraded to v1.26.3-patch2.
• solo-io/envoy-gloo has been upgraded to v1.26.4-patch1.
• solo-io/k8s-utils has been upgraded to v0.4.1.

New Features

• Add option to preserve escaped characters within an entire TransformationTemplate and a new Inja function for fine-grained control within a template. (https://github.com/solo-io/solo-projects/issues/5155)
• Gloo now supports connection limiting. This restricts the number of active connections per gateway. Useful to protect resources, ensure fair share of resources across gateways, and prevent DoS attacks. Both HTTP and TCP Gateways can now be configured via the options.ConnectionLimit parameter to restrict the number of active connections and wait for an optional delay before closing them. This is based off the envoy Connection Limit Filter (https://www.envoyproxy.io/docs/envoy/latest/configuration/listeners/network_filters/connection_limit_filter) (https://github.com/solo-io/gloo/issues/7428)
• Add an environment variable "HEADER_SECRET_REF_NS_MATCHES_US" that when set in the gloo pod requires that secrets sent in headers to an upstream are in the same namespace as that upstream. This defaults to false and when it is not set, resources can be in any namespaces watched by Gloo. (https://github.com/solo-io/solo-projects/issues/5007)

Fixes

• Fix typo in helm template when rendering multiple Gateways. (https://github.com/solo-io/gloo/issues/8404)