Gloo Gateway Enterprise Release Feed

v1.22.0-beta2 (v1.22.0)

Fri, 22 May 2026 20:03:53 GMT

Breaking Changes
- Fixed helm template for proxy deployment kind check to correctly detect empty map/object. While this is technically a fix but if any user relies on the existing behavior that has deployed the proxy as daemonset, this can be a breaking change. (https://github.com/solo-io/solo-projects/issues/8948)
Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.80.1.
- solo-io/rate-limiter has been upgraded to v0.18.5.
- nginx/nginx has been upgraded to 1.30.0-alpine.
- solo-io/gloo has been upgraded to v1.22.0-beta5.
- alpine/alpine has been upgraded to 3.23.4.
- solo-io/cloud-builders has been upgraded to v0.15.2.
- solo-io/ext-auth-service has been upgraded to v0.82.0.
- solo-io/solo-apis has been upgraded to gloo-v1.22.0-beta5.
- solo-io/gloo has been upgraded to v1.22.0-beta5.
Fixes
- Update AI extension Python dependencies and runtime base images to address reported CVEs, and pin the Kubernetes client/config loading behavior so the extension pod starts correctly in cluster. (https://github.com/solo-io/solo-projects/issues/8960)
- Validate the entire API key string for valid UTF-8 instead of only the first rune, so apiKeyAuth AuthConfigs continue to translate gracefully when a selected secret's api-key contains an invalid UTF-8 byte after a valid prefix. (https://github.com/kgateway-dev/kgateway/issues/10143)
- Add mkdir -p in push-docs workflow before copying CLI reference docs to ensure destination directory exists for new minor versions. (https://github.com/solo-io/gloo/pull/11225)
New Features
- "Add support for audiences in JWT validation configuration for the external auth service" (https://github.com/solo-io/gloo-gateway/issues/1494)
- "Add support for connection pool configuration in the HTTP passthrough auth service plugin" (https://github.com/solo-io/solo-projects/issues/8888)
- Add `audiences` field to `JwtValidation` in the extauth API. When set, the JWT's `aud` claim must intersect this list; when empty or unset, audience validation is skipped. (https://github.com/solo-io/gloo-gateway/issues/1494)

v1.22.0-beta1 (v1.22.0)

Thu, 30 Apr 2026 13:13:18 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.22.0-beta2.
- golang/go has been upgraded to v1.26.2.
- go-jose/go-jose has been upgraded to v3.0.5.
- go-jose/go-jose has been upgraded to v4.1.4.
- open-telemetry/opentelemetry-go has been upgraded to v1.43.0.
- jackc/pgx has been upgraded to v5.9.0.
Fixes
- Fix a regression in ExtAuth Passthrough TLS configuration where configuration was silently dropped when no secretRef was configured. (https://github.com/solo-io/solo-projects/issues/8864)
- "Fixes issue with dashboard not querying the correct proxy for api_gloo_solo_io_translator_resources" (https://github.com/solo-io/solo-projects/issues/8870)
- Fixes a counter leak in the nack detector that caused the glooe_solo_io_xds_outofsync metric to drift permanently upward. During bursts of xDS activity the bounded internal channel would fill up and drop state-change events with a warning when full; when the dropped event was the InSync transition that should have decremented the OutOfSync gauge, the -1 was lost and the metric stayed inflated until the process restarted. The channel is replaced with a per-envoy coalescing pending map so each envoy's latest state always reaches the notification consumer, the paired +1/-1 increments stay balanced, and xDS callback paths never block on notification backpressure. (https://github.com/solo-io/solo-projects/issues/8858)
New Features
- "generate certgen-fips image" (https://github.com/solo-io/solo-projects/issues/8887)
- Add ipV4Only Setting for Gateway API Mode which sets the bind address to `0.0.0.0` instead of `::`. Defaults to false (https://github.com/solo-io/solo-projects/issues/8916)

v1.21.6 (v1.21.0)

Sat, 13 Jun 2026 03:24:38 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.36.8-patch1.
- go dependences update for CVE's
- solo-io/envoy-gloo has been upgraded to v1.36.8-patch1.
Fixes
- Fix grpcjson plugin to reject invalid protoDescriptorBin bytes instead of passing them directly to Envoy. (https://github.com/solo-io/solo-projects/issues/8979)
- Fix grpcjson plugin to validate protoDescriptorBin bytes form a valid FileDescriptorSet before passing them to Envoy. Before this, invalid bytes would cause Envoy to NACK the RouteConfiguration while the Upstream falsely reported state: Accepted. (https://github.com/solo-io/solo-projects/issues/8979)

v1.21.5 (v1.21.0)

Wed, 10 Jun 2026 01:52:07 GMT

Dependency Bumps
- golang/go has been upgraded to v1.26.4.
Fixes
- Add support for disableShadowHostSuffixAppend in the shadowing plugin, allowing users to prevent the -shadow suffix from being appended to the Host header of mirrored requests. (https://github.com/solo-io/solo-projects/issues/8699)
- Fix the arm64 gloo-ee and gloo-ee-fips images crashing with a segmentation fault (exit 139) on startup. The gloo and gloo-fed-apiserver binaries were statically linked, which on arm64 overflows the GOT for a binary this large and produces an image that crashes in glibc's static thread-local-storage setup before main. These binaries are now linked dynamically against glibc on all architectures; a dynamic binary built against Bookworm glibc runs on all of our runtime base images. Added container structure tests that run the built images on both amd64 and arm64 to guard against startup crashes in the future. (https://github.com/solo-io/solo-projects/issues/9001)

v1.21.4 (v1.21.0)

Tue, 09 Jun 2026 22:24:39 GMT

Dependency Bumps
- golang/go has been upgraded to v1.26.4.
- solo-io/envoy-gloo has been upgraded to v1.36.7-patch1.
Extra Notes
- Skipped due to CI pipeline failure.

v1.21.3 (v1.21.0)

Thu, 04 Jun 2026 16:13:15 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.36.7-patch1.
Fixes
- "upgraded envoy to enforce cookie limit" (https://github.com/solo-io/solo-projects/issues/8986)

v1.21.2 (v1.21.0)

Sat, 23 May 2026 00:38:24 GMT

Dependency Bumps
- nginx/nginx has been upgraded to 1.30.0-alpine.
- solo-io/gloo has been upgraded to v1.21.5.
- alpine/alpine has been upgraded to 3.23.4.
- solo-io/cloud-builders has been upgraded to v0.15.2.
- alpine/alpine has been upgraded to 3.23.4.
Fixes
- Update AI extension Python dependencies and runtime base images to address reported CVEs, and pin the Kubernetes client/config loading behavior so the extension pod starts correctly in cluster. (https://github.com/solo-io/solo-projects/issues/8960)
- Update certgen dependency versions for security fixes. (https://github.com/solo-io/gloo/issues/9034)

v1.21.1 (v1.21.0)

Thu, 30 Apr 2026 22:26:45 GMT

Dependency Bumps
- golang/go has been upgraded to v1.26.2.
- go-jose/go-jose has been upgraded to v3.0.5.
- go-jose/go-jose has been upgraded to v4.1.4.
- open-telemetry/opentelemetry-go has been upgraded to v1.43.0.
- jackc/pgx has been upgraded to v5.9.0.
- solo.io/gloo has been upgraded to v1.21.4.
- golang/go has been upgraded to v1.26.2.
- open-telemetry/opentelemetry-go has been upgraded to v1.43.0.
Fixes
- Fix a regression in ExtAuth Passthrough TLS configuration where configuration was silently dropped when no secretRef was configured. (https://github.com/solo-io/solo-projects/issues/8864)
- Add ipV4Only Setting for Gateway API Mode which sets the bind address to `0.0.0.0` instead of `::`. Defaults to false (https://github.com/solo-io/solo-projects/issues/8916)
- Fixes a counter leak in the nack detector that caused the glooe_solo_io_xds_outofsync metric to drift permanently upward. During bursts of xDS activity the bounded internal channel would fill up and drop state-change events with a warning when full; when the dropped event was the InSync transition that should have decremented the OutOfSync gauge, the -1 was lost and the metric stayed inflated until the process restarted. The channel is replaced with a per-envoy coalescing pending map so each envoy's latest state always reaches the notification consumer, the paired +1/-1 increments stay balanced, and xDS callback paths never block on notification backpressure. (https://github.com/solo-io/solo-projects/issues/8858)
- "generate certgen-fips image" (https://github.com/solo-io/solo-projects/issues/8887)
- "Fixes issue with dashboard not querying the correct proxy for api_gloo_solo_io_translator_resources" (https://github.com/solo-io/solo-projects/issues/8870)
- Add ipV4Only Setting for Gateway API Mode which sets the bind address to `0.0.0.0` instead of `::`. Defaults to false (https://github.com/solo-io/solo-projects/issues/8916)
- Make SDS cert rotation more resilient to non-atomic Istio cert writes by debouncing file watcher reloads and retrying until the certificate and key form a valid pair before publishing a new snapshot. (https://github.com/solo-io/solo-projects/issues/8911)
- Fixes protobuf registration panic when building glooctl with homebrew. (https://github.com/solo-io/gloo/issues/11195)

v1.21.0 (v1.21.0)

Thu, 26 Mar 2026 00:13:38 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.36.5-patch1.
- golang/go has been upgraded to 1.26.1.
- open-policy-agent/opa has been upgraded to v1.4.0.
- alpine/alpine has been upgraded to 3.24.
- solo-io/envoy-gloo-ee has been upgraded to v1.36.5-patch2.
- solo-io/gloo has been upgraded to v1.21.1.
- solo-io/solo-apis has been upgraded to v1.21.1.
- solo-io/cloud-builders has been upgraded to v0.15.0.
- k8s.io/api has been upgraded to v0.35.2.
- k8s.io/apiextensions-apiserver has been upgraded to v0.35.2.
- k8s.io/apimachinery has been upgraded to v0.35.2.
- k8s.io/apiserver has been upgraded to v0.35.2.
- k8s.io/cli-runtime has been upgraded to v0.35.2.
- k8s.io/client-go has been upgraded to v0.35.2.
- k8s.io/code-generator has been upgraded to v0.35.2.
- k8s.io/component-base has been upgraded to v0.35.2.
- k8s.io/component-helpers has been upgraded to v0.35.2.
- k8s.io/kubectl has been upgraded to v0.35.2.
- k8s.io/metrics has been upgraded to v0.35.2.
- sigs.k8s.io/gateway-api has been upgraded to v1.4.1.
- istio/istio has been upgraded to v1.29.1.
- solo-io/go-utils has been upgraded to v0.30.0.
- solo-io/k8s-utils has been upgraded to v0.13.0.
- solo-io/skv2 has been upgraded to v0.46.0.
- solo-io/solo-kit has been upgraded to v0.41.0.
- solo-io/gloo has been upgraded to v1.21.0-beta18.
- solo-io/rate-limiter has been upgraded to v0.18.0.
- solo-io/ext-auth-service has been upgraded to v0.77.0.
- solo-io/caching-service has been upgraded to v0.13.0.
- sigs.k8s.io/gateway-api has been upgraded to v1.4.1.
- solo-io/cloud-builders has been upgraded to v0.15.0.
- k8s.io/api has been upgraded to v0.35.2.
- k8s.io/apiextensions-apiserver has been upgraded to v0.35.2.
- k8s.io/apimachinery has been upgraded to v0.35.2.
- k8s.io/apiserver has been upgraded to v0.35.2.
- k8s.io/cli-runtime has been upgraded to v0.35.2.
- k8s.io/client-go has been upgraded to v0.35.2.
- k8s.io/code-generator has been upgraded to v0.35.2.
- k8s.io/component-base has been upgraded to v0.35.2.
- k8s.io/component-helpers has been upgraded to v0.35.2.
- k8s.io/kubectl has been upgraded to v0.35.2.
- k8s.io/metrics has been upgraded to v0.35.2.
- solo-io/go-utils has been upgraded to v0.30.0.
- solo-io/k8s-utils has been upgraded to v0.13.0.
- solo-io/skv2 has been upgraded to v0.46.0.
- solo-io/solo-kit has been upgraded to v0.41.0.
- solo-io/envoy-gloo has been upgraded to v1.36.5-patch1.
- golang/go has been upgraded to v1.26.1.
- golang/net has been upgraded to v0.51.0.
- containerd/containerd has been upgraded to v1.7.30.
- open-telemetry/opentelemetry-go has been upgraded to v1.41.0.
Fixes
- re-enable envoy-wrapper fips-debug build (https://github.com/solo-io/solo-projects/issues/8818)
- CVE updates (https://github.com/solo-io/solo-projects/issues/8848)
- CVE updates (https://github.com/solo-io/solo-projects/issues/8848)
- Add only one wait UpstreamHTTPFilter if multiple have been specified. (https://github.com/solo-io/gloo/issues/11142)

v1.21.0-beta1 (v1.21.0)

Wed, 04 Mar 2026 14:24:27 GMT

Breaking Changes
- Mark XSLT transformation as deprecated. (https://github.com/solo-io/solo-projects/issues/8658)
Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.35.2-patch3.
- solo-io/gloo has been upgraded to v1.21.0-beta4.
- solo-io/solo-apis has been upgraded to gloo-v1.21.0-beta4.
- solo-io/envoy-gloo-ee has been upgraded to v1.36.2-patch1.
- solo-io/gloo has been upgraded to v1.21.0-beta5.
- solo-io/solo-apis has been upgraded to gloo-v1.21.0-beta5.
- solo-io/envoy-gloo-ee has been upgraded to v1.36.3-patch1.
- solo-io/solo-apis has been upgraded to gloo-v1.21.0-beta6.
- solo-io/envoy-gloo-ee has been upgraded to v1.36.4-patch1.
- solo-io/gloo has been upgraded to v1.21.0-beta12.
- solo-io/ext-auth-service has been upgraded to v0.75.1.
- solo-io/gloo has been upgraded to v1.21.0-beta16.
- solo-io/solo-apis has been upgraded to gloo-v1.21.0-beta16.
- golang/go has been upgraded to v1.24.9.
- solo-io/cloud-builders has been upgraded to v0.13.2.
- solo-io/rate-limiter has been upgraded to v0.16.4.
- solo-io/ext-auth-service has been upgraded to v0.71.3.
- golang/go has been upgraded to v1.25.5.
- kubernetes/api has been upgraded to v0.34.2.
- kubernetes/apiextensions-apiserver has been upgraded to v0.34.2.
- kubernetes/apimachinery has been upgraded to v0.34.2.
- kubernetes/client-go has been upgraded to v0.34.2.
- kubernetes/code-generator has been upgraded to v0.34.2.
- kubernetes/apiserver has been upgraded to v0.34.2.
- kubernetes/cli-runtime has been upgraded to v0.34.2.
- kubernetes/component-base has been upgraded to v0.34.2.
- kubernetes/component-helpers has been upgraded to v0.34.2.
- kubernetes/kubectl has been upgraded to v0.34.2.
- kubernetes/kube-openapi has been upgraded to v0.0.0-20250814151709-d7b6acb124c3.
- kubernetes/gengo has been upgraded to v2.0.0-20250820003526-c297c0c1eb9d.
- kubernetes-sigs/controller-runtime has been upgraded to v0.22.4.
- kubernetes-sigs/gateway-api has been upgraded to v1.4.0.
- kubernetes-sigs/controller-tools has been upgraded to v0.19.0.
- solo-io/caching-service has been upgraded to v0.12.0.
- solo-io/rate-limiter has been upgraded to v0.17.2.
- solo-io/gloo has been upgraded to v1.21.0-beta13.
- solo-io/solo-apis has been upgraded to gloo-v1.21.0-beta13.
- solo-io/gloo has been upgraded to v1.21.0-beta1.
- solo-io/solo-apis has been upgraded to gloo-v1.21.0-beta1.
- istio.io/istio has been upgraded to v1.27.0.
- istio.io/client-go has been upgraded to v1.27.0.
- istio.io/api has been upgraded to v1.27.0.
- solo-io/gloo has been upgraded to v1.21.0-beta3.
- solo-io/solo-apis has been upgraded to gloo-v1.21.0-beta3.
- solo-io/envoy-gloo-ee has been upgraded to v1.35.2-patch2.
Fixes
- increase default grpc_max_receive_message_length to 200MB configurable through env GRPC_MAX_RECEIVE_MESSAGE_LENGTH (https://github.com/solo-io/solo-projects/issues/8671)
- Bump ai dependencies to resolve CVEs (https://github.com/solo-io/solo-projects/issues/8559)
- Bump jsonpath to fix CVE-2026-1615 (https://github.com/solo-io/solo-projects/issues/8778)
- Reduced UI CVEs from 59 to 9. Updated parent packages: node-gyp, puppeteer, graphql-request. Added targeted resolutions for CVE-2025-7783 and other high-severity vulnerabilities where parent package updates where critically breaking or did not exist. Removed twin.macro as it was barely used (https://github.com/solo-io/solo-projects/issues/8559)
- Bump UI dependencies to fix CVEs (https://github.com/solo-io/solo-projects/issues/8559)
- Change order of locking mutexes in failover plugin to avoid deadlocks. (https://github.com/solo-io/solo-projects/issues/8548)
- Fix potential runtime crashes in arm64 distroless images (gloo-ee, gloo-ee-fips) caused by building against glibc 2.39 (ubuntu-go) but running on glibc 2.36 (distroless/base-debian12). (https://github.com/solo-io/solo-projects/issues/8776)
- updated ui docker base image to address CVE's (https://github.com/solo-io/solo-projects/issues/8614)
Helm Changes
- Fix Helm chart to use the correct signing-key field name and add existingSecret field to values.yaml for extauth signing key secret. (https://github.com/solo-io/solo-projects/issues/7734)
- Upgrade the default Redis image to 7.2.11-alpine to address CVEs. Users can still override the image tag to use a different version. (https://github.com/solo-io/solo-projects/issues/8641)
New Features
- Support customhost and path override in all AI providers (https://github.com/solo-io/solo-projects/issues/8438)
- Add the ability to add two new ExtProc configs, `ExtProcEarly` and `ExtProcLate`. The former can be run at a specified stage, but the latter runs as the final filter before a request leaves envoy and the first filter when the response enters envoy. It adds them to the global settings, vhost and route options, which mimics the existing extProc fields. (https://github.com/solo-io/gloo-gateway/issues/1495)
- Added support for OpenAI RealTime API in bypass mode in AI Exenstion (https://github.com/solo-io/solo-projects/issues/8530)
- Supports OpenAI Responses API in passthrough mode (https://github.com/solo-io/solo-projects/issues/8562)
- Added support for configuring the scrape interval for PodMonitor resources via the helm value global.glooStats.podMonitor.interval. This allows users to customize the metrics scraping frequency. The default remains 15s to preserve existing behavior. (https://github.com/solo-io/solo-projects/issues/8542)
- Added support for configuring admin group claims in the Portal backend server. Users can now specify which OIDC group claim values grant admin access via the ADMIN_GROUP_VALUES and CUSTOM_GROUP_CLAIM_KEY environment variables. This allows organizations to map their existing identity provider groups (e.g., Okta groups) to Portal admin privileges without code changes. (https://github.com/solo-io/solo-projects/issues/8651)
- Allow claims with regexes in the Gloo Edge Virtual Service RBAC (https://github.com/solo-io/solo-projects/issues/8612)

v1.20.15 (v1.20.0)

Sat, 13 Jun 2026 03:21:59 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.35.12-patch1.
- go dependences update for CVE's
- golang/go has been upgraded to v1.25.11.
Fixes
- Fix grpcjson plugin to reject invalid protoDescriptorBin bytes instead of passing them directly to Envoy. (https://github.com/solo-io/solo-projects/issues/8979)
- Fix grpcjson plugin to validate protoDescriptorBin bytes form a valid FileDescriptorSet before passing them to Envoy. Before this, invalid bytes would cause Envoy to NACK the RouteConfiguration while the Upstream falsely reported state: Accepted. (https://github.com/solo-io/solo-projects/issues/8979)

v1.20.14 (v1.20.0)

Wed, 10 Jun 2026 03:05:08 GMT

Dependency Bumps
- golang/go has been upgraded to v1.25.11.
Fixes
- Add support for disableShadowHostSuffixAppend in the shadowing plugin, allowing users to prevent the -shadow suffix from being appended to the Host header of mirrored requests. (https://github.com/solo-io/solo-projects/issues/8699)
- Fix the arm64 gloo-ee and gloo-ee-fips images crashing with a segmentation fault (exit 139) on startup. The gloo and gloo-fed-apiserver binaries were statically linked, which on arm64 overflows the GOT for a binary this large and produces an image that crashes in glibc's static thread-local-storage setup before main. These binaries are now linked dynamically against glibc on all architectures; a dynamic binary built against Bookworm glibc runs on all of our runtime base images. Added container structure tests that run the built images on both amd64 and arm64 to guard against startup crashes in the future. (https://github.com/solo-io/solo-projects/issues/9001)

v1.20.13 (v1.20.0)

Tue, 09 Jun 2026 22:24:50 GMT

Extra Notes
- Skipped due to CI pipeline failure.

v1.20.12 (v1.20.0)

Thu, 04 Jun 2026 16:13:26 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.35.11-patch1.
Fixes
- "upgraded envoy to enforce cookie limit" (https://github.com/solo-io/solo-projects/issues/8986)

v1.20.11 (v1.20.0)

Sat, 23 May 2026 12:06:00 GMT

Dependency Bumps
- nginx/nginx has been upgraded to 1.30.0-alpine.
- solo-io/gloo has been upgraded to v1.20.15.
- alpine/alpine has been upgraded to 3.23.4.
- alpine/alpine has been upgraded to 3.23.4.
Fixes
- Update AI extension Python dependencies and runtime base images to address reported CVEs, and pin the Kubernetes client/config loading behavior so the extension pod starts correctly in cluster. (https://github.com/solo-io/solo-projects/issues/8960)
- Update certgen dependency versions for security fixes. (https://github.com/solo-io/gloo/issues/9034)

v1.20.10 (v1.20.0)

Thu, 30 Apr 2026 22:26:53 GMT

Dependency Bumps
- golang/go has been upgraded to v1.25.9.
- go-jose/go-jose has been upgraded to v3.0.5.
- go-jose/go-jose has been upgraded to v4.1.4.
- open-telemetry/opentelemetry-go has been upgraded to v1.43.0.
- jackc/pgx has been upgraded to v5.9.0.
- golang/go has been upgraded to v1.25.9.
- grpc/grpc-go has been upgraded to v1.79.3.
- open-telemetry/opentelemetry-go has been upgraded to v1.43.0.
- rancher/kubectl has been upgraded to v1.34.5.
Fixes
- Add ipV4Only Setting for Gateway API Mode which sets the bind address to `0.0.0.0` instead of `::`. Defaults to false (https://github.com/solo-io/solo-projects/issues/8916)
- "generate certgen-fips image" (https://github.com/solo-io/solo-projects/issues/8887)
- Fix a regression in ExtAuth Passthrough TLS configuration where configuration was silently dropped when no secretRef was configured. (https://github.com/solo-io/solo-projects/issues/8864)
- "Fixes issue with dashboard not querying the correct proxy for api_gloo_solo_io_translator_resources" (https://github.com/solo-io/solo-projects/issues/8870)
- Fixes a counter leak in the nack detector that caused the glooe_solo_io_xds_outofsync metric to drift permanently upward. During bursts of xDS activity the bounded internal channel would fill up and drop state-change events with a warning when full; when the dropped event was the InSync transition that should have decremented the OutOfSync gauge, the -1 was lost and the metric stayed inflated until the process restarted. The channel is replaced with a per-envoy coalescing pending map so each envoy's latest state always reaches the notification consumer, the paired +1/-1 increments stay balanced, and xDS callback paths never block on notification backpressure. (https://github.com/solo-io/solo-projects/issues/8858)
- Fix potential runtime crashes in arm64 distroless images (gloo-ee, gloo-ee-fips) caused by building against glibc 2.39 (ubuntu-go) but running on glibc 2.36 (distroless/base-debian12). (https://github.com/solo-io/solo-projects/issues/8776)
- Add ipV4Only Setting for Gateway API Mode which sets the bind address to `0.0.0.0` instead of `::`. Defaults to false (https://github.com/solo-io/solo-projects/issues/8916)
- Make SDS cert rotation more resilient to non-atomic Istio cert writes by debouncing file watcher reloads and retrying until the certificate and key form a valid pair before publishing a new snapshot. (https://github.com/solo-io/solo-projects/issues/8911)

v1.20.9 (v1.20.0)

Fri, 27 Mar 2026 08:54:40 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.35.9-patch2.
Fixes
- "CVE fixes" (https://github.com/solo-io/solo-projects/issues/8848)

v1.20.8 (v1.20.0)

Thu, 12 Mar 2026 19:16:08 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.35.9-patch1.
- golang/go has been upgraded to 1.25.8.
- open-policy-agent/opa has been upgraded to v1.4.0.
- solo-io/gloo has been upgraded to v1.20.11.
- solo-io/solo-apis has been upgraded to gloo-v1.20.11.
- solo-io/envoy-gloo has been upgraded to v1.35.9-patch1.
- golang/go has been upgraded to v1.25.8.
- golang/net has been upgraded to v0.51.0.
- containerd/containerd has been upgraded to v1.7.30.
- open-telemetry/opentelemetry-go has been upgraded to v1.41.0.
Fixes
- re-enable envoy-wrapper fips-debug build (https://github.com/solo-io/solo-projects/issues/8818)
- Add the ability to add two new ExtProc configs, `ExtProcEarly` and `ExtProcLate`. The former can be run at a specified stage, but the latter runs as the final filter before a request leaves envoy and the first filter when the response enters envoy. It adds them to the global settings, vhost and route options, which mimics the existing extProc fields. (https://github.com/solo-io/gloo-gateway/issues/1495)
- Add only one wait UpstreamHTTPFilter if multiple have been specified. (https://github.com/solo-io/gloo/issues/11142)
- Add two new configs, ExtProcEarly && ExtProcLate. The former can be run at a specified stage, but the latter runs as the final filter before a request leaves envoy and the first filter when the response enters envoy. (https://github.com/solo-io/gloo-gateway/issues/1495)
New Features
- Add connect_terminate support for CONNECT protocol termination in Dynamic Forward Proxy. This enables TCP tunneling for HTTPS traffic through DFP by setting Envoy's connect_config on route upgrade configurations. Users can configure connectTerminate in protocol upgrades to enable HTTPS proxying through CONNECT tunnels. (https://github.com/solo-io/solo-projects/issues/8746)

v1.20.7 (v1.20.0)

Fri, 27 Feb 2026 00:02:15 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.20.10.
- solo-io/solo-apis has been upgraded to gloo-v1.20.10.
- golang/go has been upgraded to v1.25.7.
- solo-io/cloud-builders has been upgraded to v0.14.2.
Fixes
- fixed snapshot out of sync with envoy when upstream points to invalid service (https://github.com/solo-io/solo-projects/issues/8668)
- Enable HPA support by making replicas optional in the Gateway proxy deployment. When replicas is not set in GatewayParameters, the replicas field is omitted from the deployment spec, allowing HorizontalPodAutoscaler to manage scaling. A minimum replicas validation is enforced when the field is set. (https://github.com/solo-io/gloo/issues/11133)

v1.20.6 (v1.20.0)

Wed, 28 Jan 2026 19:30:15 GMT

Fixes
- Added support for configuring admin group claims in the Portal backend server. Users can now specify which OIDC group claim values grant admin access via the ADMIN_GROUP_VALUES and CUSTOM_GROUP_CLAIM_KEY environment variables. This allows organizations to map their existing identity provider groups (e.g., Okta groups) to Portal admin privileges without code changes. (https://github.com/solo-io/solo-projects/issues/8651)

v1.20.5 (v1.20.0)

Wed, 14 Jan 2026 02:00:36 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.35.8-patch1.
- solo-io/gloo has been upgraded to v1.20.8.
- solo-io/solo-apis has been upgraded to gloo-v1.20.8.
- solo-io/gloo has been upgraded to v1.20.9.
- solo-io/solo-apis has been upgraded to gloo-v1.20.9.
- golang/go has been upgraded to v1.24.11.
- solo-io/gloo has been upgraded to v1.20.7.
- solo-io/solo-apis has been upgraded to gloo-v1.20.7.
- rancher/kubectl has been upgraded to v1.34.3.
- solo-io/envoy-gloo has been upgraded to v1.35.8-patch1.
- golang/go has been upgraded to v1.24.11.
Fixes
- increase default grpc_max_receive_message_length to 200MB configurable through env GRPC_MAX_RECEIVE_MESSAGE_LENGTH (https://github.com/solo-io/solo-projects/issues/8671)
- updated ui docker base image to address CVE's (https://github.com/solo-io/solo-projects/issues/8614)
- When oneWayTls is set to true, the ValidationContext is removed to prevent Envoy from requesting a client certificate during the TLS handshake. (https://github.com/solo-io/solo-projects/issues/8654)

v1.20.4 (v1.20.0)

Fri, 05 Dec 2025 20:37:25 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.35.7-patch1.
- solo-io/solo-apis has been upgraded to gloo-v1.20.4.
- solo-io/envoy-gloo has been upgraded to v1.35.7-patch1.
Extra Notes
- *This release is building...*

v1.20.3 (v1.20.0)

Wed, 22 Oct 2025 22:26:18 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.35.6-patch1.
- solo-io/gloo has been upgraded to v1.20.3.
- solo-io/solo-apis has been upgraded to gloo-v1.20.3.
- golang/go has been upgraded to v1.24.9.
- solo-io/cloud-builders has been upgraded to v0.13.2.
- solo-io/rate-limiter has been upgraded to v0.16.4.
- solo-io/ext-auth-service has been upgraded to v0.71.3.
- solo-io/envoy-gloo has been upgraded to v1.35.6-patch1.
- golang/go has been upgraded to v1.24.9.
- solo-io/cloud-builders has been upgraded to v0.13.2.
Fixes
- Bump the alpine base container image to 3.21.5 (https://github.com/solo-io/solo-projects/issues/8620)
- Bump the alpine base container image to 3.21.5 (https://github.com/solo-io/solo-projects/issues/8620)
- Fixes a bug where the the default gatewayProxy when disabled would create invalid helm templates for custom proxies. (https://github.com/solo-io/solo-projects/issues/8613)

v1.20.2 (v1.20.0)

Thu, 16 Oct 2025 17:43:38 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.20.2.
- solo-io/solo-apis has been upgraded to gloo-v1.20.2.
Fixes
- Fixes a crash caused by missing rbac during upgrades from 1.19 (https://github.com/solo-io/solo-projects/issues/8609)
- Fixes a crash caused by missing rbac during upgrades from 1.19 (https://github.com/solo-io/solo-projects/issues/8609)

v1.20.1 (v1.20.0)

Tue, 30 Sep 2025 21:46:48 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.35.2-patch3.
- solo-io/gloo has been upgraded to v1.20.1.
- solo-io/solo-apis has been upgraded to gloo-v1.20.1.
- solo-io/envoy-gloo has been upgraded to v1.35.2-patch3.
Fixes
- Bump ai dependencies to resolve CVEs (https://github.com/solo-io/solo-projects/issues/8559)
- Bump UI dependencies to fix CVEs (https://github.com/solo-io/solo-projects/issues/8559)

v1.20.0 (v1.20.0)

Tue, 23 Sep 2025 17:26:27 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.20.0.
- solo-io/solo-apis has been upgraded to gloo-v1.20.0.
- solo-io/solo-kit has been upgraded to v0.39.4.
- solo-io/gloo has been upgraded to v1.20.0-rc2.
- solo-io/solo-apis has been upgraded to gloo-v1.20.0-rc2.
- istio.io/istio has been upgraded to v1.27.0.
- istio.io/client-go has been upgraded to v1.27.0.
- istio.io/api has been upgraded to v1.27.0.
- solo-io/gloo has been upgraded to v1.20.0-rc4.
- solo-io/solo-apis has been upgraded to gloo-v1.20.0-rc4.
- solo-io/envoy-gloo-ee has been upgraded to v1.35.2-patch2.
- solo-io/solo-kit has been upgraded to v0.39.4.
- solo-io/envoy-gloo has been upgraded to v1.35.2-patch2.
- solo-io/envoy-gloo has been upgraded to v1.35.2-patch1.
- istio/istio has been upgraded to v1.27.0.
- kubernetes/kubernetes has been upgraded to v1.34.0.
Fixes
- Change order of locking mutexes in failover plugin to avoid deadlocks. (https://github.com/solo-io/solo-projects/issues/8548)
New Features
- Support customhost and path override in all AI providers (https://github.com/solo-io/solo-projects/issues/8438)
- Added support for OpenAI RealTime API in bypass mode in AI Exenstion (https://github.com/solo-io/solo-projects/issues/8530)
- Supports OpenAI Responses API in passthrough mode (https://github.com/solo-io/solo-projects/issues/8562)
- Added support for configuring the scrape interval for PodMonitor resources via the helm value global.glooStats.podMonitor.interval, this allows users to customize the metrics scraping frequency. The default remains 15s to preserve existing behavior. (https://github.com/solo-io/solo-projects/issues/8542)
- updated ai.proto to support customhost in all AI providers (https://github.com/solo-io/solo-projects/issues/8438)
- Updated transformation.proto to add auto_websocket_passthrough option. Added gloo setting enableAutoWebsocketTransformationPassthrough to control the behavior (default false) (https://github.com/solo-io/solo-projects/issues/8530)

v1.20.0-rc1 (v1.20.0)

Fri, 22 Aug 2025 22:16:21 GMT

Breaking Changes
- Remove GraphQL support from Gloo Gateway.
- Remove GraphQL support from Gloo Gateway. GraphQL functionality has been fully removed after being deprecated in v1.18.0. The GraphQL CRDs, client code, discovery functionality, and route processing have been removed. Some proto files remain to prevent future use of these names and fields. (https://github.com/solo-io/solo-projects/issues/7162)
Dependency Bumps
- golang/go has been upgraded to v1.24.6.
- solo-io/cloud-builders has been upgraded to v0.13.1.
- solo-io/go-utils has been upgraded to v0.28.6.
- solo-io/gloo has been upgraded to v1.20.0-beta5.
- solo-io/solo-apis has been upgraded to gloo-1.20.0-beta5.
- solo-io/rate-limiter has been upgraded to v0.16.1.
- solo-io/ext-auth-service has been upgraded to v0.71.0.
- solo-io/gloo has been upgraded to v1.20.0-rc1.
- solo-io/solo-apis has been upgraded to v0.0.0-20250822195859-8d1f9ec1ec9a.
- solo-io/gloo has been upgraded to v1.20.0-beta12.
- solo-io/ext-auth-service has been upgraded to v0.71.1.
- bitnami/kubectl has been upgraded to v1.33.3.
- envoyproxy v0.13.5-0.20250805143705-d51f8590a549/go-control-plane has been upgraded to v0.13.5-0.20250805143705-d51f8590a549.
- envoyproxy v0.13.5-0.20250805143705-d51f8590a549/go-control-plane/envoy has been upgraded to v1.32.5-0.20250805143705-d51f8590a549.
- opentelemetry v1.7.1/proto/otlp has been upgraded to v1.7.1.
- golang/crypto has been upgraded to v0.40.0.
- golang/sync has been upgraded to v0.16.0.
- golang/tools has been upgraded to v0.34.0.
- golang/grpc has been upgraded to v1.74.2.
- golang/go has been upgraded to v1.24.6.
- solo-io/cloud-builders has been upgraded to v0.13.1.
- solo-io/go-utils has been upgraded to v0.28.6.
- solo-io/k8s-utils has been upgraded to v0.11.1.
- solo-io/skv2 has been upgraded to v0.44.1.
- solo-io/solo-kit has been upgraded to v0.39.1.
- bitnami/kubectl has been upgraded to v1.33.3.
- helm.sh/helm has been upgraded to v3.18.4.
Fixes
- Mark the cache filter as deprecated.
- Mark the cache filter as deprecated.
- Ensure that when one-way TLS is enabled, the upstream TLS context is configured correctly to validate the server certificate. (https://github.com/solo-io/solo-projects/issues/8499)
Helm Changes
- Prevent HPA creation when a gateway proxy is disabled. (https://github.com/solo-io/solo-projects/issues/8520)
New Features
- Add support for rate limited retry backoff with reset headers. This is available on the RouteOptions API as a new field `rate_limited_retry_backoff`. (https://github.com/kgateway-dev/kgateway/issues/4316)
- Expose the max cache size for the OpenTelemetry collector in the tracing settings. (https://github.com/solo-io/gloo/issues/10950)

v1.20.0-beta3 (v1.20.0)

Thu, 07 Aug 2025 19:48:19 GMT

Breaking Changes
- ExtProc tracing changes: When the `mode_override` fields of the headers/trailer modes have the value `DEFAULT` (unset), no change will be made to the processing mode set in the filter configuration.
- If the `x-request-id` header is empty, `generate_request_id` will generate a request id on the request. Previously, it would only generate an id if the header was missing. (https://github.com/solo-io/solo-projects/issues/8103)
- The Envoy FIPS build is updated to use the same version of BoringSSL as the regular build, per the revised FedRAMP policy. It is possible that default values may have changed in the crypto settings due to the large version bump. (https://github.com/solo-io/solo-projects/issues/8103)
- The formatter `%CEL%` and `%METADATA%` will be treated as built-in formatters and could be used directly in the substitution format string if the related extensions are linked. (https://github.com/solo-io/solo-projects/issues/8103)
Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.70.0.
- solo-io/gloo has been upgraded to v1.20.0-beta9.
- solo-io/solo-apis has been upgraded to gloo-v1.20.0-beta9.
- solo-io/envoy-gloo-ee has been upgraded to 1.34.1-patch4.
- solo-io/gloo has been upgraded to v1.20.0-beta8.
- solo-io/solo-apis has been upgraded to gloo-v1.20.0-beta8.
- solo-io/envoy-gloo-ee has been upgraded to v1.35.0-patch1.
- solo-io/gloo has been upgraded to v1.20.0-beta10.
- solo-io/solo-apis has been upgraded to gloo-v1.20.0-beta10.
- solo-io/envoy-gloo has been upgraded to v1.35.0-patch1.
- solo-io/envoy-gloo has been upgraded to 1.34.1-patch4.
Fixes
- Fixed ai_rate_limited_tokens stats (https://github.com/solo-io/solo-projects/issues/8295)
- Bumped the nginx version in Dockerfile to resolve CVE. (https://github.com/solo-io/solo-projects/issues/8487)
- Fixes a potential cause of increased memory pressure when the using Portal's API Discovery feature where frequent changes in services, replicaSets or pods could lead to excessive reconciliation and memory usage in the control plane. Also improve reconciliation detection for services by only triggering reconciliation when the service annotations change. (https://github.com/solo-io/solo-projects/issues/8442)
- Improves memory consumption during Portal translation by optimizing the fetching of relevant resources and reducing cached objects. (https://github.com/solo-io/solo-projects/issues/8442)
New Features
- Adds TLS support to gRPC and HTTP passthrough. `AuthConfig` now allows users to reference a client-side TLS secret with tls.crt, tls.key & ca.crt to configure mTLS or standard TLS. (https://github.com/solo-io/ext-auth-service/issues/867)
- Support embeddings api usage and model dynamic metadata (https://github.com/solo-io/solo-projects/issues/8425)
- Expose additional dynamic_metadata in AI Gateway (https://github.com/solo-io/solo-projects/issues/8273)
- [AI] bedrock custom path override support (https://github.com/solo-io/solo-projects/issues/8315)
- Added support for mTLS in passthrough authentication. This provides the ability to configure simple TLS or mTLS for both HTTP and gRPC passthrough authentication. (https://github.com/solo-io/ext-auth-service/issues/867)
- Expose ecdh-curves TLS settings for listeners (https://github.com/solo-io/solo-projects/issues/8456)

v1.20.0-beta2 (v1.20.0)

Fri, 27 Jun 2025 14:14:56 GMT

Breaking Changes
- Bump dependencies to support Kubernetes 1.33.1 (https://github.com/solo-io/solo-projects/issues/8102)
- Removed the deprecated ExtAuth Plugin feature. Use ExtAuth Passthrough instead. (https://github.com/solo-io/solo-projects/issues/6962)
- Bump dependencies to support Kubernetes 1.33.1 (https://github.com/solo-io/solo-projects/issues/8102)
Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.33.3-patch2.
- solo-io/gloo has been upgraded to v1.20.0-beta4.
- solo-io/solo-apis has been upgraded to gloo-v1.20.0-beta4.
- solo-io/envoy-gloo-ee has been upgraded to v1.33.3-patch3.
- getkin/kin-openapi has been upgraded to v0.131.0.
- solo-io/protoc-gen-openapi has been upgraded to v0.3.1.
- oapi-codegen/oapi-codegen has been upgraded to v2.4.1.
- solo-io/gloo has been upgraded to v1.20.0-beta7.
- solo-io/solo-apis has been upgraded to v0.0.0-20250626220036-6936aca61552.
- solo-io/envoy-gloo-ee has been upgraded to v1.34.1-patch3.
- k8s.io/api has been upgraded to v0.33.1.
- k8s.io/apimachinery has been upgraded to v0.33.1.
- k8s.io/apiextensions-apiserver has been upgraded to v0.33.1.
- k8s.io/client-go has been upgraded to v0.33.1.
- k8s.io/kubectl has been upgraded to v0.33.1.
- google/protobuf has been upgraded to v1.36.5.
- solo-io/go-utils has been upgraded to v0.28.5.
- controller-runtime/controller-runtime has been upgraded to v0.22.1.
- solo-io/k8s-utils has been upgraded to v0.11.0.
- solo-io/skv2 has been upgraded to v0.44.0.
- solo-io/solo-kit has been upgraded to v0.39.0.
- solo-io/solo-apis has been upgraded to v0.0.0-20240616171238-dd7b8dbf6a9b.
- solo-io/cloud-builders has been upgraded to v0.13.0.
- solo-io/gloo has been upgraded to v1.20.0-beta6.
- solo-io/rate-limiter has been upgraded to v0.16.0.
- solo-io/ext-auth-service has been upgraded to v0.69.2.
- golang/go has been upgraded to v1.24.4.
- k8s.io/api has been upgraded to v0.33.1.
- k8s.io/apimachinery has been upgraded to v0.33.1.
- k8s.io/apiextensions-apiserver has been upgraded to v0.33.1.
- k8s.io/client-go has been upgraded to v0.33.1.
- k8s.io/kubectl has been upgraded to v0.33.1.
- helm/helm has been upgraded to v3.17.3.
- google/protobuf has been upgraded to v1.36.5.
- solo-io/go-utils has been upgraded to v0.28.5.
- controller-runtime/controller-runtime has been upgraded to v0.22.1.
- solo-io/k8s-utils has been upgraded to v0.11.0.
- solo-io/skv2 has been upgraded to v0.44.0.
- solo-io/solo-kit has been upgraded to v0.39.0.
- solo-io/solo-apis has been upgraded to v0.0.0-20240616171238-dd7b8dbf6a9b.
- solo-io/cloud-builders has been upgraded to v0.13.0.
- solo-io/envoy-gloo has been upgraded to 1.34.1-patch3.
- envoyproxy/go-control-plane has been upgraded to v0.13.5-0.20250507123352-93990c5ec02f.
Fixes
- For clusters generated for the dynamic forward proxy, the circuit breakers are now generated from the dfp config, if provided, otherwise from the settings. If the circuitBreakers are not provided in either location, envoy will use the default circuit breakers. (https://github.com/solo-io/solo-projects/issues/8094)
- Setting the `uuidRequestIdConfig` in the `HttpConnectionManagerSettings` now correctly sets the `RequestIdExtension` in the `HttpConnectionManager` filter.
Helm Changes
- Removed the deprected `global.extensions.extAuth.plugins` value from the helm chart. (https://github.com/solo-io/solo-projects/issues/6962)
New Features
- Add support for customHost pathOverride in AI upstream (https://github.com/solo-io/solo-projects/issues/8305)
- Basic AWS Bedrock Support (no streaming guardrail yet) (https://github.com/solo-io/solo-projects/issues/7291)
- This adds a cli command 'glooctl usage' to collect usage stats from Gloo Edge APIs. (https://github.com/solo-io/solo-projects/issues/10820)
- [AI] proto file change to support path override in custom host (https://github.com/solo-io/solo-projects/issues/8305)

v1.20.0-beta1 (v1.20.0)

Tue, 03 Jun 2025 20:58:56 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.33.2-patch2.
- solo-io/gloo has been upgraded to v1.20.0-beta2.
- solo-io/solo-apis has been upgraded to gloo-v1.20.0-beta2.
- solo-io/gloo has been upgraded to v1.20.0-beta1.
- solo-io/solo-apis has been upgraded to gloo-v1.20.0-beta1.
- solo-io/skv2 has been upgraded to v0.43.2.
- solo-io/gloo has been upgraded to v1.20.0-beta3.
Fixes
- Patch modsecurity to remove calls to `xmlCleanupParser()`. Calling `xmlCleanupParser` from Envoy contexts where listeners are draining during configuration updates can cause Envoy to crash because `xmlCleanupParser` modifies global memory that may be in use while listeners are draining, so configuration updates could possibly cause Envoy to crash without this patch.
- Fix a bug causing the observability Grafana dashboard syncer to incorrectly delete snapshots in Grafana which it did not create. This change uses the dashboard default tags to determine whether a dashboard was created by the syncer and can correctly be deleted when the associated upstream has been removed. It performs the same check when deleting snapshots to ensure only snapshots associated with dashboards created by the syncer are deleted. (https://github.com/solo-io/solo-projects/issues/8118)
New Features
- Switched to aiohttp for webhook performance and persistent connections (https://github.com/solo-io/solo-projects/issues/8214)

v1.19.21 (v1.19.0)

Fri, 12 Jun 2026 23:17:45 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.33.14-patch5.
- go dependences update for CVE's

v1.19.20 (v1.19.0)

Tue, 09 Jun 2026 23:25:31 GMT

Dependency Bumps
- golang/go has been upgraded to v1.25.11.
Fixes
- Fix the arm64 gloo-ee and gloo-ee-fips images crashing with a segmentation fault (exit 139) on startup. The gloo and gloo-fed-apiserver binaries were statically linked, which on arm64 overflows the GOT for a binary this large and produces an image that crashes in glibc's static thread-local-storage setup before main. These binaries are now linked dynamically against glibc on all architectures; a dynamic binary built against Bookworm glibc runs on all of our runtime base images. Added container structure tests that run the built images on both amd64 and arm64 to guard against startup crashes in the future. (https://github.com/solo-io/solo-projects/issues/9001)

v1.19.19 (v1.19.0)

Tue, 09 Jun 2026 15:33:02 GMT

Extra Notes
- Skipped due to CI pipeline failure.

v1.19.18 (v1.19.0)

Thu, 04 Jun 2026 16:37:30 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.33.14-patch4.
Fixes
- "upgraded envoy to enforce cookie limit" (https://github.com/solo-io/solo-projects/issues/8986)

v1.19.17 (v1.19.0)

Sat, 23 May 2026 15:57:56 GMT

Dependency Bumps
- nginx/nginx has been upgraded to 1.30.0-alpine.
- solo-io/gloo has been upgraded to v1.19.16.
- alpine/alpine has been upgraded to 3.23.4.
- alpine/alpine has been upgraded to 3.23.4.
Fixes
- Update AI extension Python dependencies and runtime base images to address reported CVEs, and pin the Kubernetes client/config loading behavior so the extension pod starts correctly in cluster. (https://github.com/solo-io/solo-projects/issues/8960)
- Update certgen dependency versions for security fixes. (https://github.com/solo-io/gloo/issues/9034)

v1.19.16 (v1.19.0)

Thu, 30 Apr 2026 21:45:05 GMT

v1.19.15 (v1.19.0)

Fri, 27 Mar 2026 12:33:12 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.33.14-patch3.
Fixes
- "cve updates" (https://github.com/solo-io/solo-projects/issues/8849)

v1.19.14 (v1.19.0)

Thu, 12 Mar 2026 19:05:17 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.33.14-patch2.
- golang/go has been upgraded to 1.25.8.
- open-policy-agent/opa has been upgraded to v1.4.0.
- golang/go has been upgraded to v1.25.7.
- solo-io/cloud-builders has been upgraded to v0.14.2.
- solo-io/gloo has been upgraded to v1.19.12.
- solo-io/solo-apis has been upgraded to gloo-v1.19.12.
- golang/go has been upgraded to v1.25.8.
- golang/net has been upgraded to v0.51.0.
- containerd/containerd has been upgraded to v1.7.30.
- open-telemetry/opentelemetry-go has been upgraded to v1.41.0.
Fixes
- re-enable envoy-wrapper fips-debug build (https://github.com/solo-io/solo-projects/issues/8818)
- Add the ability to add two new ExtProc configs, `ExtProcEarly` and `ExtProcLate`. The former can be run at a specified stage, but the latter runs as the final filter before a request leaves envoy and the first filter when the response enters envoy. It adds them to the global settings, vhost and route options, which mimics the existing extProc fields. (https://github.com/solo-io/gloo-gateway/issues/1495)
- Add only one wait UpstreamHTTPFilter if multiple have been specified. (https://github.com/solo-io/gloo/issues/11142)
- fixed snapshot out of sync with envoy when upstream points to invalid service (https://github.com/solo-io/solo-projects/issues/8668)
- Add two new configs, ExtProcEarly && ExtProcLate. The former can be run at a specified stage, but the latter runs as the final filter before a request leaves envoy and the first filter when the response enters envoy. (https://github.com/solo-io/gloo-gateway/issues/1495)

v1.19.13 (v1.19.0)

Mon, 19 Jan 2026 23:51:55 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.33.14-patch1.
- solo-io/gloo has been upgraded to v1.19.11.
- solo-io/solo-apis has been upgraded to gloo-v1.19.11.
- golang/go has been upgraded to v1.24.11.
- solo-io/gloo has been upgraded to v1.19.10.
- solo-io/solo-apis has been upgraded to gloo-v1.19.10.
- solo-io/envoy-gloo has been upgraded to v1.33.14-patch1.
- rancher/kubectl has been upgraded to v1.34.3.
- golang/go has been upgraded to v1.24.11.

v1.19.12 (v1.19.0)

Fri, 05 Dec 2025 21:06:42 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.33.13-patch1.
- solo-io/solo-apis has been upgraded to gloo-v1.19.9.
- solo-io/envoy-gloo has been upgraded to v1.33.13-patch1.

v1.19.11 (v1.19.0)

Wed, 22 Oct 2025 20:32:25 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.33.12-patch1.
- solo-io/gloo has been upgraded to v1.19.8.
- solo-io/solo-apis has been upgraded to gloo-v1.19.8.
- golang/go has been upgraded to v1.24.9.
- solo-io/cloud-builders has been upgraded to v0.13.2.
- solo-io/envoy-gloo has been upgraded to v1.33.12-patch1.
- golang/go has been upgraded to v1.24.9.
- solo-io/cloud-builders has been upgraded to v0.13.2.
Fixes
- Bump the alpine base container image to 3.21.5 (https://github.com/solo-io/solo-projects/issues/8620)
- Bump the alpine base container image to 3.21.5 (https://github.com/solo-io/solo-projects/issues/8620)
- Fixes a bug where the the default gatewayProxy when disabled would create invalid helm templates for custom proxies. (https://github.com/solo-io/solo-projects/issues/8613)

v1.19.10 (v1.19.0)

Tue, 30 Sep 2025 19:45:39 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.33.8-patch2.
- solo-io/gloo has been upgraded to v1.19.7.
- solo-io/solo-apis has been upgraded to gloo-v1.19.7.
- solo-io/envoy-gloo has been upgraded to v1.33.8-patch2.

v1.19.9 (v1.19.0)

Thu, 04 Sep 2025 15:08:07 GMT

Fixes
- Change order of locking mutexes in failover plugin to avoid deadlocks. (https://github.com/solo-io/solo-projects/issues/8548)

v1.19.8 (v1.19.0)

Wed, 13 Aug 2025 20:13:35 GMT

Dependency Bumps
- golang/go has been upgraded to v1.24.6.
- solo-io/cloud-builders has been upgraded to v0.13.1.
- solo-io/go-utils has been upgraded to v0.28.6.
- solo-io/gloo has been upgraded to v1.19.6.
- solo-io/solo-apis has been upgraded to gloo-1.19.6.
- bitnami/kubectl has been upgraded to v1.33.3.
- golang/go has been upgraded to v1.24.6.
- solo-io/cloud-builders has been upgraded to v0.13.1.
- solo-io/go-utils has been upgraded to v0.28.6.
- bitnami/kubectl has been upgraded to v1.33.3.
Fixes
- Ensure that when one-way TLS is enabled, the upstream TLS context is configured correctly to validate the server certificate. (https://github.com/solo-io/solo-projects/issues/8499)

v1.19.7 (v1.19.0)

Tue, 29 Jul 2025 19:07:46 GMT

Fixes
- Bumped the nginx version in Dockerfile to resolve CVE. (https://github.com/solo-io/solo-projects/issues/8487)

v1.19.6 (v1.19.0)

Thu, 24 Jul 2025 20:08:16 GMT

Fixes
- Improves memory consumption during Portal translation by optimizing the fetching of relevant resources and reducing cached objects. (https://github.com/solo-io/solo-projects/issues/8442)

v1.19.5 (v1.19.0)

Fri, 18 Jul 2025 15:41:22 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.19.3.
- solo-io/solo-apis has been upgraded to gloo-v1.19.3.
- solo-io/gloo has been upgraded to v1.19.4.
- helm/helm has been upgraded to v3.18.4.
- helm/helm has been upgraded to v3.18.4.
Fixes
- Support embeddings api usage and model dynamic metadata (https://github.com/solo-io/solo-projects/issues/8425)
- Fixed ai_rate_limited_tokens stats (https://github.com/solo-io/solo-projects/issues/8295)
- Expose additional dynamic_metadata in AI Gateway (https://github.com/solo-io/solo-projects/issues/8273)
- Expose ecdh-curves TLS settings for listeners (https://github.com/solo-io/solo-projects/issues/8456)

v1.19.4 (v1.19.0)

Tue, 08 Jul 2025 15:44:53 GMT

Fixes
- Fixes a potential cause of increased memory pressure when the using Portal's API Discovery feature where frequent changes in services, replicaSets or pods could lead to excessive reconciliation and memory usage in the control plane. Also improve reconciliation detection for services by only triggering reconciliation when the service annotations change. (https://github.com/solo-io/solo-projects/issues/8442)
- Fixed prompt enrichment role case sensitivity (https://github.com/solo-io/solo-projects/issues/8347)

v1.19.3 (v1.19.0)

Fri, 27 Jun 2025 20:17:58 GMT

Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.67.3-patch1.
- solo-io/skv2 has been upgraded to v0.43.2.
- getkin/kin-openapi has been upgraded to v0.131.0.
- solo-io/protoc-gen-openapi has been upgraded to v0.3.1.
- oapi-codegen/oapi-codegen has been upgraded to v2.4.1.
- solo-io/envoy-gloo-ee has been upgraded to v1.33.3-patch4.
- solo-io/gloo has been upgraded to v1.19.2.
- solo-io/cloudbuilders has been upgraded to v0.13.0.
- golang/go has been upgraded to v1.24.4.
Fixes
- For clusters generated for the dynamic forward proxy, the circuit breakers are now generated from the dfp config, if provided, otherwise from the settings. If the circuitBreakers are not provided in either location, envoy will use the default circuit breakers. (https://github.com/solo-io/solo-projects/issues/8094)
- Setting the `uuidRequestIdConfig` in the `HttpConnectionManagerSettings` now correctly sets the `RequestIdExtension` in the `HttpConnectionManager` filter.

v1.19.2 (v1.19.0)

Fri, 13 Jun 2025 15:37:40 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.33.3-patch3.

v1.19.1 (v1.19.0)

Thu, 05 Jun 2025 15:25:32 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.33.3-patch2.
- solo-io/gloo has been upgraded to v1.19.1.
- solo-io/solo-apis has been upgraded to gloo-v1.19.1.
Fixes
- Add support for customHost pathOverride in AI upstream (https://github.com/solo-io/solo-projects/issues/8305)
- Fix a bug causing the observability Grafana dashboard syncer to incorrectly delete snapshots in Grafana which it did not create. This change uses the dashboard default tags to determine whether a dashboard was created by the syncer and can correctly be deleted when the associated upstream has been removed. It performs the same check when deleting snapshots to ensure only snapshots associated with dashboards created by the syncer are deleted. (https://github.com/solo-io/solo-projects/issues/8118)
- [AI] proto file change to support url override in custom host (https://github.com/solo-io/solo-projects/issues/8305)
- Fix a bug in the gloo_solo_io_namespaces_watched metric that errors when the list of namespaces watched is large. (https://github.com/solo-io/solo-projects/issues/8319)

v1.19.0 (v1.19.0)

Wed, 14 May 2025 14:05:42 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.19.0.
- solo-io/solo-apis has been upgraded to gloo-v1.19.0.

v1.19.0-rc3 (v1.19.0)

Thu, 08 May 2025 22:56:20 GMT

Dependency Bumps
- sigs.k8s.io/gateway-api has been upgraded to v1.3.0.
- sigs.k8s.io/controller-runtime has been upgraded to v0.20.4.
- golang.org/x/crypto has been upgraded to v0.37.0.
- golang.org/x/sync has been upgraded to v0.13.0.
- google.golang.org/grpc has been upgraded to v1.71.1.
- solo.io/gloo has been upgraded to v1.19.0-rc5.
- solo.io/solo-apis has been upgraded to gloo-v1.19.0-rc5.
- sigs.k8s.io/gateway-api has been upgraded to v1.3.0.
- sigs.k8s.io/controller-runtime has been upgraded to v0.20.4.
- golang.org/x/crypto has been upgraded to v0.37.0.
- golang.org/x/sync has been upgraded to v0.13.0.
- google.golang.org/grpc has been upgraded to v1.71.1.

v1.19.0-rc2 (v1.19.0)

Thu, 01 May 2025 21:53:34 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.33.2-patch2.
- solo-io/gloo has been upgraded to v1.19.0-rc3.
- solo-io/solo-apis has been upgraded to gloo-v1.19.0-rc3.
- solo-io/gloo has been upgraded to v1.19.0-rc4.
- solo-io/solo-apis has been upgraded to gloo-v1.19.0-rc4.
- solo-io/gloo has been upgraded to v1.19.0-rc2.
- solo-io/solo-apis has been upgraded to gloo-v1.19.0-rc2.
Fixes
- Patch modsecurity to remove calls to `xmlCleanupParser()`. Calling `xmlCleanupParser` from Envoy contexts where listeners are draining during configuration updates can cause Envoy to crash because `xmlCleanupParser` modifies global memory that may be in use while listeners are draining, so configuration updates could possibly cause Envoy to crash without this patch.
- Fix a bug where the gloo pod crashes if the install and write namespace are different. (https://github.com/solo-io/solo-projects/issues/8183)
New Features
- Switched to aiohttp for webhook performance and persistent connections (https://github.com/solo-io/solo-projects/issues/8214)
- Added support for sending gateway access logs to an OpenTelemetry collector. (https://github.com/solo-io/solo-projects/issues/6661)
- Added support for reporting ListenerOption status. Issues/conflicts with ListenerOptions are now reported in the resource's status. (https://github.com/solo-io/solo-projects/issues/6344)

v1.19.0-rc1 (v1.19.0)

Fri, 18 Apr 2025 14:40:22 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.19.0-beta18.
- solo-io/solo-apis has been upgraded to gloo-v1.19.0-beta18.
- solo-io/envoy-gloo-ee has been upgraded to 1.33.0-patch3.
- istio.io/istio has been upgraded to v1.25.2.
- istio.io/client-go has been upgraded to v1.25.2.
- istio.io/api has been upgraded to v1.25.2.
- golang.org/x/crypto has been upgraded to v0.36.0.
- golang.org/x/sync has been upgraded to v0.12.0.
- solo-io/gloo has been upgraded to v1.19.0-rc1.
- solo-io/solo-apis has been upgraded to gloo-v1.19.0-rc1.
- solo-io/envoy-gloo has been upgraded to v1.33.2-patch2.
- istio.io/istio has been upgraded to v1.25.2.
- istio.io/client-go has been upgraded to v1.25.2.
- istio.io/api has been upgraded to v1.25.2.
- golang.org/x/crypto has been upgraded to v0.36.0.
- golang.org/x/sync has been upgraded to v0.12.0.
Fixes
- Fixes a regression in disabling the JWT filter at the route level. Previously, if the JWT filter was enabled at the virtual host level and disabled on the route, Gloo would incorrectly reject unauthenticated requests on the route. This change rectifies this regression so that route-level configuration of the JWT filter correctly overrides the virtual host-level configuration. (https://github.com/solo-io/solo-projects/issues/7810)
- Upgrade envoy-gloo-ee to update Modsecurity from 3.0.10 to [3.0.14](https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.14). This upgrade includes a fix for [CVE-2025-27110](https://www.cve.org/CVERecord?id=CVE-2025-27110). (https://github.com/solo-io/envoy-gloo-ee/issues/900)
- gateway2/delegation: check cyclic reference only for valid children
- Moves the cyclic reference check after ignoring unattached candidate
- Removes the self-reference check so that invalid references to self
- gateway2/delegation: ignore child routes with mismatched parentRef early
- After the refactor to decouple querying of routes from translation
- This change prunes the routes in the chain early on to avoid
- Testing done:
- "Fix tests to apply different resources based on whether the XListenerSet CRD is present" (https://github.com/solo-io/solo-projects/issues/7886)
- Fixed a bug in route delegation where the `parentRefs` field on child HTTPRoutes were not being respected when parent matcher inheritance was enabled. (https://github.com/solo-io/solo-projects/issues/8163)
New Features
- This adds a cli command 'glooctl gateway-api convert' to convert Edge APIs to Gateway API. (https://github.com/solo-io/gloo/issues/10738)

v1.19.0-beta5 (v1.19.0)

Fri, 11 Apr 2025 00:33:04 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.19.0-beta17.
- solo-io/solo-apis has been upgraded to gloo-v1.19.0-beta17.
- solo-io/gloo has been upgraded to v1.19.0-beta16.
- solo-io/solo-apis has been upgraded to gloo-v1.19.0-beta16.
- google.golang.org/protobuf has been upgraded to v1.36.6.
Fixes
- The ambient.istio.io/dns-capture annotation was incorrectly being set as a label and therefore didn't take effect. (https://github.com/solo-io/solo-projects/issues/8106)
- ServiceEntry with DNS resolution now correctly uses the `hosts` field to drive endpoints when the `endpoints` field is unspecified. (https://github.com/solo-io/solo-projects/issues/8128)
- The gloo-waypoint class will now deploy pods that always have ambient capture enabled, never have sidecars and don't use zTunnel for DNS. Disabling the Istio zTunnel provided DNS allows the gloo-waypoint to be used for egress. Without this setting, the egress traffic will loop back into the waypoint and eventually timeout. (https://github.com/solo-io/solo-projects/issues/7977)
- Both gloo-gateway and gloo-waypoint support the same global multicluster services based on ServiceEntry like `autogen.service.namespace` living in `istio-system`. This fixes an issue where we always wanted targetRef and parentRef to reference the original Service being peered. While the UX of this is arguable, to make things identical to Istio behavior, we now require a reference to the _name_ of the generated ServiceEntry, but the peered object namespace. E.g. a Service foo in bar-ns, will generate autogen.bar-ns.foo in istio-system. The references should be `name: autogen...`, `namespace: bar`. (https://github.com/solo-io/solo-projects/issues/7978)
- Fixed a bug with VirtualHostOptions and RouteOptions status reports were not being merged correctly when they referenced multiple proxies. (https://github.com/solo-io/solo-projects/issues/7980)
- gateway2/delegation: use a wildcard namespace
- Namespace type in Gateway API must be a valid RFC 1123 DNS label,
- gateway2/status: use SetStatusCondition to prevent duplicate conditions
- Currently, we append() Conditions while building the status reports.
- Updated HTTP tunneling plugin to support HTTP CONNECT tunneling on all Upstreams, not just
- To address clusters having their own lifecycle that differs from listeners in
New Features
- Allows a kubernetes gateway to have more than 64 listeners by implementing ListenerSets defined in https://gateway-api.sigs.k8s.io/geps/gep-1713. Listener Sets can define their own listeners and be mapped to a parent gateway via their parentRef. The kubernetes gateway will have the merged list of all listeners from itself and attached ListenerSets. This is an experimental feature and requires the `xlistenersets.gateway.networking.x-k8s.io` CRD to be present. (https://github.com/solo-io/solo-projects/issues/7886)
- Allows a kubernetes gateway to have more than 64 listeners by implementing ListenerSets defined in https://gateway-api.sigs.k8s.io/geps/gep-1713. Listener Sets can define their own listeners and be mapped to a parent gateway via their parentRef. The kubernetes gateway will have the merged list of all listeners from itself and attached ListenerSets. This is an experimental feature and requires the `xlistenersets.gateway.networking.x-k8s.io` CRD to be present. (https://github.com/solo-io/solo-projects/issues/7886)
- Support multiple target refs in ListenerOptions, HttpListenerOptions, VirtualHostOptions, and RouteOptions. (https://github.com/solo-io/solo-projects/issues/7980)

v1.19.0-beta4 (v1.19.0)

Wed, 26 Mar 2025 18:16:33 GMT

Breaking Changes
- Access log handlers added by filters will now be evaluated before access log handlers that are configured in the access_log configuration. This change can be disabled by setting the runtime guard flag `envoy.reloadable_features.filter_access_loggers_first` to `false`.
- The default configuration of Envoy will continue to trust internal addresses while in the future it will not trust them by default. If you have tooling such as probes on your private network which need to be treated as trusted (e.g. changing arbitrary x-envoy headers) please explicitly include those addresses or CIDR ranges into [internal_address_config](https://docs.solo.io/gloo-edge/latest/reference/api/github.com/solo-io/gloo/projects/gloo/api/v1/options/hcm/hcm.proto.sk/#internaladdressconfig). You can turn up or test the upcoming internal address defaults by setting runtime guard envoy.reloadable_features.explicit_internal_address_config to true.
Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.67.2.
- golang.org/x/net has been upgraded to v0.36.0.
- golang.org/x/sync has been upgraded to v0.11.0.
- solo-io/gloo has been upgraded to v1.19.0-beta13.
- golang/go has been upgraded to v1.24.1.
- solo-io/skv2 has been upgraded to v0.43.1.
- solo-io/ext-auth-service has been upgraded to v0.67.1.
- solo-io/gloo has been upgraded to v1.19.0-beta15.
- solo-io/envoy-gloo has been upgraded to v1.33.0-patch2.
- golang/go has been upgraded to v1.24.1.
Fixes
- Fixed large request body causing AI upstream transformation to fail (https://github.com/solo-io/solo-projects/issues/7934)
- Fixed usage might be missing issue if the chunk we are collapsing to does not have usage data already (https://github.com/solo-io/solo-projects/issues/7918)
- Bump the alpine base container image to 3.21.3 (https://github.com/solo-io/solo-projects/issues/7956)
- Removes unnecessary packages from distroless image variants. (https://github.com/solo-io/solo-projects/issues/7915)
- Fix issue where Gloo Fed does not receive certain reconcile events. (https://github.com/solo-io/solo-projects/issues/8014)
- Fix a bug where the image registry for the jobs was not correctly overwritten. Address the issue that this causes in CI by adding a composite action that copies the oss images to the correct registry when EE is using a different registry than OSS, which happens during PR CI and dev releases.
- Update the nginx base image for the gloo-federation-console image to resolve CVE-2025-24928. (https://github.com/solo-io/solo-projects/issues/7990)
- Ensure that the Gloo Federation controller respects the settings.discoveryNamespace in the list of namespaces to watch (https://github.com/solo-io/solo-projects/issues/8014)
- gateway2/delegation: enable wildcard namespace for label selection
- Allows specifying a wildcard value when using the label selector
- Previously, Gloo did not provide any means to determine whether a request to an AWS Lambda upstream was rate-limited. With this fix, if the AWS Lambda upstream responds to Gloo with a HTTP 429, Gloo will return an HTTP 500 response to the client and set the `x-envoygloo-lambda-statuscode` and `x-envoygloo-lambda-statusreason` headers. The `statuscode` header will be set to `429` to indicate the value received from the Lambda upstream, and the `statusreason` header will be set as described in the [Lambda documentation](https://docs.aws.amazon.com/lambda/latest/api/API_Invoke.html)). (https://github.com/kgateway-dev/kgateway/issues/10192)
- Improved HTTP tunneling documentation and added note about remote JWKS configuration using an upstream with `httpProxyHostname` requiring additional configuration. (https://github.com/solo-io/solo-projects/issues/7497)
- Bump the alpine base container image to 3.21.3 (https://github.com/solo-io/solo-projects/issues/7956)
- Discover the Gloo service using labels. In some environments, services must be renamed. This change allows the service to still be discovered when it's been renamed. In the event that multiple services in the namespace have the gloo=gloo label, an error will occur. (https://github.com/solo-io/solo-projects/issues/7646)
- Fixes a bug where the route ordering affects the deprecated aws requiretransform functionality. (https://github.com/solo-io/solo-projects/issues/7882)
Helm Changes
- Adds the new helm value `global.image.disableDigest` to disable adding the container image's hash digest. Defaults to false (https://github.com/solo-io/gloo/issues/10690)
New Features
- Added prompt guard support for multi-choice streaming response (currently only OpenAI supports this) (https://github.com/solo-io/solo-projects/issues/7439)
- Added a new field `attachFailedStatusToMetadata` to attach JWT failure status to dynamic metadata so that the status code and message can be logged. (https://github.com/solo-io/solo-projects/issues/7837)
- This adds the ability to configure Gateway Pod Topology Spread Constraints via GatewayParams `spec.kube.podTemplate.topologySpreadConstraints`. This can also be managed via Helm specifying `kubeGateway.gatewayParameters.glooGateway.podTemplate.topologySpreadConstraints`. (https://github.com/solo-io/solo-projects/issues/6928)
- Add support for setting filter state from the grpc access log with the gatewayProxies.gatewayProxy.gatewaySettings.accessLoggingService.accessLog.grpcService.filterStateObjectsToLog helm value (https://github.com/solo-io/solo-projects/issues/7923)
- Adds support for http2 via the service port appProtocol spec (https://github.com/solo-io/solo-projects/issues/7824)

v1.19.0-beta3 (v1.19.0)

Thu, 27 Feb 2025 20:07:26 GMT

Breaking Changes
- Bump dependencies to support Kubernetes 1.32 (https://github.com/solo-io/gloo/issues/8978)
- Remove `regex` field from ai options proto enum to avoid generated code conflicts with `REGEX` field. skipCI-kube-tests:true skipCI-docs-build:true (https://github.com/solo-io/solo-projects/issues/7875)
- Bump dependencies to support Kubernetes 1.32 (https://github.com/solo-io/solo-projects/issues/7788)
- The default configuration of Envoy will continue to trust internal addresses while in the future it will not trust them by default. If you have tooling such as probes on your private network which need to be treated as trusted (e.g. changing arbitrary x-envoy headers) please explicitly include those addresses or CIDR ranges into [internal_address_config](https://docs.solo.io/gloo-edge/latest/reference/api/github.com/solo-io/gloo/projects/gloo/api/v1/options/hcm/hcm.proto.sk/#internaladdressconfig). You can turn up or test the upcoming internal address defaults by setting runtime guard envoy.reloadable_features.explicit_internal_address_config to true.
Dependency Bumps
- solo-io/gloo has been upgraded to v1.19.0-beta8.
- solo-io/caching-service has been upgraded to v0.9.0.
- solo-io/ext-auth-service has been upgraded to v0.66.0.
- solo-io/external-apis has been upgraded to v0.4.0.
- solo-io/gloo has been upgraded to v1.19.0-beta10.
- solo-io/go-utils has been upgraded to v0.27.4.
- solo-io/k8s-utils has been upgraded to v0.9.0.
- solo-io/rate-limiter has been upgraded to v0.14.0.
- solo-io/skv2 has been upgraded to v0.42.0.
- solo-io/solo-apis has been upgraded to gloo-v1.19.0-beta10.
- solo-io/solo-kit has been upgraded to v0.37.0.
- k8s.io/api has been upgraded to v0.32.2.
- k8s.io/apiextensions-apiserver has been upgraded to v0.32.2.
- k8s.io/apimachinery has been upgraded to v0.32.2.
- k8s.io/apiserver has been upgraded to v0.32.2.
- k8s.io/cli-runtime has been upgraded to v0.32.2.
- k8s.io/client-go has been upgraded to v0.32.2.
- sigs.k8s.io/code-generator has been upgraded to v0.32.2.
- sigs.k8s.io/component-base has been upgraded to v0.32.2.
- sigs.k8s.io/component-helpers has been upgraded to v0.32.2.
- sigs.k8s.io/kube-openapi has been upgraded to v0.0.0-20241104100929-3ea5e8cea738.
- sigs.k8s.io/kubectl has been upgraded to v0.32.2.
- sigs.k8s.io/metrics has been upgraded to v0.32.2.
- solo-io/cloud-builders has been upgraded to v0.11.1.
- onsi/ginkgo/v2 has been upgraded to v2.21.0.
- onsi/gomega has been upgraded to v1.35.1.
- go.uber.org/zap has been upgraded to v1.27.0.
- google/protobuf has been upgraded to v1.35.1.
- solo-io/envoy-gloo-ee has been upgraded to v1.32.3-patch2.
- solo-io/gloo has been upgraded to v1.19.0-beta7.
- golang/go has been upgraded to v1.24.0.
- solo-io/gloo has been upgraded to v1.19.0-beta12.
- solo-io/solo-apis has been upgraded to gloo-v1.19.0-beta12.
- solo-io/anyvendor has been upgraded to v0.1.0.
- solo-io/caching-service has been upgraded to v0.10.0.
- solo-io/ext-auth-plugins has been upgraded to v0.3.0.
- solo-io/ext-auth-service has been upgraded to v0.67.0.
- solo-io/go-utils has been upgraded to v0.28.4.
- solo-io/k8s-utils has been upgraded to v0.10.0.
- solo-io/protoc-gen-ext has been upgraded to v0.1.0.
- solo-io/protoc-gen-openapi has been upgraded to v0.3.0.
- solo-io/skv2 has been upgraded to v0.43.0.
- solo-io/solo-kit has been upgraded to v0.38.0.
- solo-io/gloo has been upgraded to v1.19.0-beta6.
- solo-io/solo-kit has been upgraded to v0.36.4.
- solo-io/rate-limiter has been upgraded to v0.15.0.
- cncf/xds has been upgraded to v0.0.0-20250121191232-2f005788dc42.
- envoyproxy/go-control-plane has been upgraded to v0.13.5-0.20250123154839-2a6715911fec.
- envoyproxy/protoc-gen-validate has been upgraded to v1.2.1.
- onsi/ginkgo/v2 has been upgraded to v2.22.1.
- onsi/gomega has been upgraded to v1.36.2.
- solo-io/gloo has been upgraded to v1.19.0-beta9.
- golang/exp has been upgraded to v0.0.0-20241215155358-4a5509556b9e.
- golang/net has been upgraded to v0.34.0.
- golang/tools has been upgraded to v0.29.0.
- google.golang.org/grpc has been upgraded to v1.70.0.
- google.golang.org/protobuf has been upgraded to v1.36.5.
- helm.sh/helm/v3 has been upgraded to v3.17.0.
- istio.io/api has been upgraded to v1.25.0-alpha.0.0.20250210220544-0b64afd2de85.
- istio.io/client-go has been upgraded to v1.25.0-alpha.0.0.20250210220843-5a4065fded65.
- k8s.io/api has been upgraded to v0.32.1.
- k8s.io/apiextensions-apiserver has been upgraded to v0.32.1.
- k8s.io/apimachinery has been upgraded to v0.32.1.
- k8s.io/client-go has been upgraded to v0.32.1.
- k8s.io/code-generator has been upgraded to v0.32.1.
- k8s.io/utils has been upgraded to v0.0.0-20241210054802-24370beab758.
- sigs.k8s.io/controller-runtime has been upgraded to v0.20.1.
- containerd/containerd has been upgraded to v1.7.24.
- envoyproxy/go-control-plane/envoy has been upgraded to v1.32.5-0.20250211152746-ef139ef8ea6b.
- golang/mod has been upgraded to v0.22.0.
- istio.io/istio has been upgraded to v0.0.0-20250212203644-c2ac935c5888.
- golang/go has been upgraded to v1.24.0.
- k8s.io/api has been upgraded to v0.32.2.
- k8s.io/apiextensions-apiserver has been upgraded to v0.32.2.
- k8s.io/apimachinery has been upgraded to v0.32.2.
- k8s.io/client-go has been upgraded to v0.32.2.
- k8s.io/code-generator has been upgraded to v0.32.2.
- k8s.io/component-base has been upgraded to v0.32.2.
- k8s.io/kubectl has been upgraded to v0.32.2.
- sigs.k8s.io/controller-runtime has been upgraded to v0.20.1.
- onsi/gomega has been upgraded to v1.35.1.
- onsi/ginkgo has been upgraded to v2.21.0.
- go.uber.org/zap has been upgraded to v1.27.0.
- solo-io/go-utils has been upgraded to v0.27.4.
- solo-io/cloud-builders has been upgraded to v0.11.1.
- solo-io/skv2 has been upgraded to v0.42.0.
- solo-io/solo-kit has been upgraded to v0.37.0.
- github.com/envoyproxy/go-control-plane/contrib has been upgraded to v1.32.5-0.20250207140015-90270e3c85fd.
- github.com/envoyproxy/go-control-plane/envoy has been upgraded to v1.32.5-0.20250211152746-ef139ef8ea6b.
- golang.org/x/crypto has been upgraded to v0.32.0.
- golang.org/x/tools has been upgraded to v0.29.0.
- google.golang.org/grpc has been upgraded to v1.70.0.
- google.golang.org/protobuf has been upgraded to v1.36.5.
- github.com/fsnotify/fsnotify has been upgraded to v1.8.0.
- k8s.io/api has been upgraded to v0.32.1.
- k8s.io/apiextensions-apiserver has been upgraded to v0.32.1.
- k8s.io/apimachinery has been upgraded to v0.32.1.
- k8s.io/apiserver has been upgraded to v0.32.1.
- k8s.io/cli-runtime has been upgraded to v0.32.1.
- k8s.io/client-go has been upgraded to v0.32.1.
- sigs.k8s.io/code-generator has been upgraded to v0.32.1.
- sigs.k8s.io/component-base has been upgraded to v0.32.1.
- sigs.k8s.io/component-helpers has been upgraded to v0.32.1.
- sigs.k8s.io/kubectl has been upgraded to v0.32.1.
- sigs.k8s.io/metrics has been upgraded to v0.32.1.
- sigs.k8s.io/controller-runtime has been upgraded to v0.20.1.
- onsi/ginkgo/v2 has been upgraded to v2.22.1.
- onsi/gomega has been upgraded to v1.36.2.
- solo-io/envoy-gloo has been upgraded to v1.32.3-patch2.
- solo-io/solo-kit has been upgraded to v0.36.4.
Fixes
- In gloo-fed, ensure that failed unplacements/deletes of resources from a control plane cluster are retried. (https://github.com/solo-io/solo-projects/issues/7709)
- Fix a bug where the helm charts don't contain image digests
- Fixes the wrong sds image generated in the gateway params.
- Fixes ServiceEntry HTTPRoute attachment for Waypoints. (https://github.com/solo-io/solo-projects/issues/7801)
- IPv6 addresses in ServiceEntry Addresses no longer generate invalid prefix length of 32. We will now determine the prefix length based on IP type, and support specifyng CIDRs by hand (e.g. 1.2.3.4/16). (https://github.com/solo-io/solo-projects/issues/7800)
- Fixes incorrect Helm field name - changes global.extensions.extAuth.signingKey.signing-key to global.extensions.extAuth.signingKey.key, which is what the Helm template expects. Note that this changes only the field name as it appears in the doc and doesn't change the backend field name. (https://github.com/solo-io/solo-projects/issues/7733)
- Remove `regex` field from ai options proto enum to avoid generated code conflicts with `REGEX` field (https://github.com/solo-io/solo-projects/issues/7875)
- Added the ability to control if resource status metrics are no longer reported after deletion.
- Setting `.Values.gloo.clearStatusMetrics` to `true` will result in metrics
- Fixes the gateway params image to respect the fips and distroless variants specified by global.image.variant. This only applies to the kubernetes gateway proxy. (https://github.com/solo-io/gloo/issues/10602)
- Fixes a bug where we translate Gateways that do not belong to us. (https://github.com/solo-io/solo-projects/issues/7768)
- Pull in solo-kit fix to reduce log level of snapshot cache watches. (https://github.com/kgateway-dev/kgateway/issues/8626)
New Features
- Added optional `hostname` to the AI Upstream CustomHost setting to override SNI and host header value (https://github.com/solo-io/solo-projects/issues/7831)
- Support sending to east-west gateways for ambient multi-network/multi-cluster. (https://github.com/solo-io/solo-projects/issues/7312)
- Added optional `hostname` to the AI Upstream CustomHost setting to override SNI and host header value (https://github.com/solo-io/solo-projects/issues/7831)
- "Add support for sig gateway's TLS Routes." (https://github.com/kgateway-dev/kgateway/issues/10074)

v1.19.0-beta2 (v1.19.0)

Fri, 31 Jan 2025 20:15:31 GMT

Extra Notes
- This release contained no user-facing changes.

v1.19.0-beta1 (v1.19.0)

Fri, 31 Jan 2025 03:09:47 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.19.0-beta3.
- solo-io/solo-apis has been upgraded to gloo-v1.19.0-beta3.
- solo-io/gloo has been upgraded to v1.19.0-beta1.
- solo-io/solo-apis has been upgraded to gloo-v1.19.0-beta1.
- oras.land/oras-go has been upgraded to v1.2.6.
- containerd/containerd has been upgraded to v1.7.20.
- moby/moby has been upgraded to v27.2.0.
- solo-io/envoy-gloo-ee has been upgraded to v1.31.2-patch4.
- solo-io/gloo has been upgraded to v1.19.0-beta4.
- solo-io/gloo has been upgraded to v1.19.0-beta2.
- solo-io/gloo has been upgraded to v1.19.0-beta5.
- solo-io/solo-apis has been upgraded to gloo-v1.19.0-beta5.
- solo-io/gloo has been upgraded to v1.19.0-beta5.
- solo-io/solo-apis has been upgraded to gloo-v1.19.0-beta5.
- solo-io/ext-auth-service has been upgraded to v0.65.1.
Fixes
- Fixes AI Gateway Rate Limiting parsing model raising an exception when model is missing. (https://github.com/solo-io/solo-projects/issues/7374)
- Passthrough redis score_threshold for semantic_caching. (https://github.com/solo-io/solo-projects/issues/7440)
- Document what tests exist in the solo-projects repository and when they are run
- Fixed chunk alignment when utf-8 multi-byte characters are present in the streaming response (https://github.com/solo-io/solo-projects/issues/7762)
- When a `WorkloadEntry` with no address is selected by a Service,
- [Gloo Gateway Portal] Fix namespace reference check when a Portal references an API Product.
- [Gloo Gateway Portal] Fix an issue where portal transformations were not being applied for delegated routes. (https://github.com/solo-io/solo-projects/issues/7484)
- Sort Gloo Gateway Portal's dynamic metadata transforms to avoid non-deterministic ordering in the generated Proxy. (https://github.com/solo-io/solo-projects/issues/7375)
- Fixes an issue where PortalGroup claims fail to propagate to the database for existing API products. (https://github.com/solo-io/solo-projects/issues/7383)
- Allows the group claim name used to identify which group a user belongs to in the portal web server to be configurable via the env var `CUSTOM_GROUP_CLAIM_KEY` which can be set on the portal web server deployment. This is useful when using portal with an IdP where the `group` or `groups` claim is reserved which rendered portal admin functionality unusable as the portal admins needed the `group` claim to be set with the `admin` value. (https://github.com/solo-io/solo-projects/issues/7470)
- When an apiKeyAuth AuthConfig is applied which selects a secret whose api-key data does not decode into valid UTF-8, it is now handled gracefully and valid API Keys still work. skipCI-docs-build:true (https://github.com/kgateway-dev/kgateway/issues/10143)
- Update nightly test logic to echo branch name to GITHUB_OUTPUT, not GITHUB_ENV skipCI-kube-tests:true skipCI-storybook-tests:true skipCI-in-memory-e2e-tests:true (https://github.com/solo-io/solo-projects/issues/6395)
- Update branch nightly test logic to determine LTS branch when run from a scheduled job. skipCI-kube-tests:true skipCI-storybook-tests:true skipCI-in-memory-e2e-tests:true (https://github.com/solo-io/solo-projects/issues/6395)
- Fixes an issue where `portalAuth` would return a 403 unauthorized when no rateLimitMetadata is attached to the api product. (https://github.com/solo-io/solo-projects/issues/7364)
- Fixes an issue where only the first listener protocol was being used for the stitched openAPI specification servers. (https://github.com/solo-io/solo-projects/issues/7437)
- When the v1 ServiceEntry and WorkloadEntry CRDs do not exist, don't attempt to read them. (https://github.com/solo-io/solo-projects/issues/7400)
New Features
- Add `overrideProtocol` option to API Product CR to allow overriding the default gateway protocol for the openAPI schema corresponding to the API Product. (https://github.com/solo-io/solo-projects/issues/7409)
- Propagate trace context to AI webhook service (https://github.com/solo-io/solo-projects/issues/7675)
- Implement AI tracing for Gloo Gateway. (https://github.com/solo-io/solo-projects/issues/7295)
- Add Guardrails Webhook Unified API (https://github.com/solo-io/solo-projects/issues/7438)
- Add streaming response support for AI guardrail (https://github.com/solo-io/solo-projects/issues/7076)
- Add user invoked function calling support. (https://github.com/solo-io/solo-projects/issues/7482)

v1.18.31 (v1.18.0)

Sat, 13 Jun 2026 12:03:27 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.31.10-patch8.
- go dependences update for CVE's

v1.18.30 (v1.18.0)

Wed, 10 Jun 2026 03:23:57 GMT

v1.18.29 (v1.18.0)

Tue, 09 Jun 2026 19:55:09 GMT

Extra Notes
- Skipped due to CI pipeline failure.

v1.18.28 (v1.18.0)

Thu, 04 Jun 2026 21:38:28 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.31.10-patch7.
Fixes
- "upgraded envoy to enforce cookie limit" (https://github.com/solo-io/solo-projects/issues/8986)

v1.18.27 (v1.18.0)

Sat, 23 May 2026 02:29:09 GMT

Dependency Bumps
- nginx/nginx has been upgraded to 1.30.0-alpine.
- solo-io/gloo has been upgraded to v1.18.37.
- alpine/alpine has been upgraded to 3.23.4.
- alpine/alpine has been upgraded to 3.23.4.
Fixes
- Update AI extension Python dependencies and runtime base images to address reported CVEs, and pin the Kubernetes client/config loading behavior so the extension pod starts correctly in cluster. (https://github.com/solo-io/solo-projects/issues/8960)
- Update certgen dependency versions for security fixes. (https://github.com/solo-io/gloo/issues/9034)

v1.18.26 (v1.18.0)

Thu, 30 Apr 2026 23:43:23 GMT

v1.18.25 (v1.18.0)

Thu, 26 Mar 2026 19:38:26 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.31.10-patch6.
Fixes
- "cve updates" (https://github.com/solo-io/solo-projects/issues/8850)

v1.18.24 (v1.18.0)

Thu, 12 Mar 2026 20:43:52 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.31.10-patch5.
- golang/go has been upgraded to v1.25.7.
- solo-io/cloud-builders has been upgraded to v0.14.2.
- solo-io/gloo has been upgraded to v1.18.33.
- solo-io/solo-apis has been upgraded to gloo-v1.18.33.
- golang/go has been upgraded to v1.25.8.
- golang/net has been upgraded to v0.51.0.
- containerd/containerd has been upgraded to v1.7.30.
- open-telemetry/opentelemetry-go has been upgraded to v1.41.0.
Fixes
- Add the ability to add two new ExtProc configs, `ExtProcEarly` and `ExtProcLate`. The former can be run at a specified stage, but the latter runs as the final filter before a request leaves envoy and the first filter when the response enters envoy. It adds them to the global settings, vhost and route options, which mimics the existing extProc fields. (https://github.com/solo-io/gloo-gateway/issues/1495)
- Add only one wait UpstreamHTTPFilter if multiple have been specified. (https://github.com/solo-io/gloo/issues/11142)
- fixed snapshot out of sync with envoy when upstream points to invalid service (https://github.com/solo-io/solo-projects/issues/8668)
- Add two new configs, ExtProcEarly && ExtProcLate. The former can be run at a specified stage, but the latter runs as the final filter before a request leaves envoy and the first filter when the response enters envoy. (https://github.com/solo-io/gloo-gateway/issues/1495)

v1.18.23 (v1.18.0)

Mon, 19 Jan 2026 23:49:39 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.18.32.
- solo-io/solo-apis has been upgraded to gloo-v1.18.32.
- golang/go has been upgraded to v1.24.11.
- solo-io/gloo has been upgraded to v1.18.31.
- solo-io/solo-apis has been upgraded to gloo-v1.18.31.
- rancher/kubectl has been upgraded to v1.34.3.
- golang/go has been upgraded to v1.24.11.

v1.18.22 (v1.18.0)

Fri, 05 Dec 2025 19:47:47 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.31.10-patch4.

v1.18.21 (v1.18.0)

Wed, 22 Oct 2025 21:55:39 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.31.10-patch3.
- solo-io/gloo has been upgraded to v1.18.30.
- solo-io/solo-apis has been upgraded to gloo-v1.18.30.
- golang/go has been upgraded to v1.24.9.
- solo-io/cloud-builders has been upgraded to v0.13.2.
Fixes
- Bump the alpine base container image to 3.21.5 (https://github.com/solo-io/solo-projects/issues/8620)

v1.18.20 (v1.18.0)

Tue, 30 Sep 2025 21:50:09 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.31.10-patch2.
- solo-io/gloo has been upgraded to v1.18.28.
- solo-io/solo-apis has been upgraded to gloo-v1.18.28.
- solo-io/envoy-gloo has been upgraded to v1.31.10-patch2.

v1.18.19 (v1.18.0)

Thu, 04 Sep 2025 13:57:17 GMT

Fixes
- Change order of locking mutexes in failover plugin to avoid deadlocks. (https://github.com/solo-io/solo-projects/issues/8548)

v1.18.18 (v1.18.0)

Wed, 13 Aug 2025 22:32:26 GMT

Dependency Bumps
- golang/go has been upgraded to v1.24.6.
- solo-io/gloo has been upgraded to v1.18.27.
- solo-io/cloudbuilders has been upgraded to v0.13.1.
- solo-io/solo-apis has been upgraded to gloo-1.18.27.
- bitnami/kubectl has been upgraded to v1.33.3.
- golang/go has been upgraded to v1.24.6.
- solo-io/cloud-builders has been upgraded to v0.13.1.
- bitnami/kubectl has been upgraded to v1.33.3.
Fixes
- Ensure that when one-way TLS is enabled, the upstream TLS context is configured correctly to validate the server certificate. (https://github.com/solo-io/solo-projects/issues/8499)

v1.18.17 (v1.18.0)

Tue, 29 Jul 2025 19:08:14 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.18.26.
- solo-io/solo-apis has been upgraded to gloo-v1.18.26.
Fixes
- Bumped the nginx version in Dockerfile to resolve CVE. (https://github.com/solo-io/solo-projects/issues/8487)
- Fixed pr workflow to run TestK8sGateway/ServerTls test and disable the pq-tls for now (see comment in test) (https://github.com/solo-io/solo-projects/issues/8456)

v1.18.16 (v1.18.0)

Thu, 10 Jul 2025 19:08:32 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.18.25.
- solo-io/gloo has been upgraded to v1.18.24.
- cncf/xds has been upgraded to v0.0.0-20250121191232-2f005788dc42.
- envoyproxy/go-control-plane has been upgraded to v0.13.5-0.20250123154839-2a6715911fec.
- envoyproxy/protoc-gen-validate has been upgraded to v1.2.1.
- onsi/ginkgo/v2 has been upgraded to v2.22.1.
- onsi/gomega has been upgraded to v1.36.2.
- solo-io/gloo has been upgraded to v1.18.23.
- golang/exp has been upgraded to v0.0.0-20241215155358-4a5509556b9e.
- golang/net has been upgraded to v0.34.0.
- golang/tools has been upgraded to v0.29.0.
- google.golang.org/grpc has been upgraded to v1.70.0.
- google.golang.org/protobuf has been upgraded to v1.36.5.
- helm.sh/helm/v3 has been upgraded to v3.17.0.
- istio.io/api has been upgraded to v1.25.0-alpha.0.0.20250210220544-0b64afd2de85.
- istio.io/client-go has been upgraded to v1.25.0-alpha.0.0.20250210220843-5a4065fded65.
- k8s.io/api has been upgraded to v0.32.1.
- k8s.io/apiextensions-apiserver has been upgraded to v0.32.1.
- k8s.io/apimachinery has been upgraded to v0.32.1.
- k8s.io/client-go has been upgraded to v0.32.1.
- k8s.io/code-generator has been upgraded to v0.32.1.
- k8s.io/utils has been upgraded to v0.0.0-20241210054802-24370beab758.
- sigs.k8s.io/controller-runtime has been upgraded to v0.20.1.
- containerd/containerd has been upgraded to v1.7.24.
- envoyproxy/go-control-plane/envoy has been upgraded to v1.32.5-0.20250211152746-ef139ef8ea6b.
- golang/mod has been upgraded to v0.22.0.
- istio.io/istio has been upgraded to v0.0.0-20250212203644-c2ac935c5888.
- helm.sh/helm has been upgraded to v3.18.4.
- github.com/envoyproxy/go-control-plane/contrib has been upgraded to v1.32.5-0.20250207140015-90270e3c85fd.
- github.com/envoyproxy/go-control-plane/envoy has been upgraded to v1.32.5-0.20250211152746-ef139ef8ea6b.
- golang.org/x/crypto has been upgraded to v0.32.0.
- golang.org/x/tools has been upgraded to v0.29.0.
- google.golang.org/grpc has been upgraded to v1.70.0.
- google.golang.org/protobuf has been upgraded to v1.36.5.
- github.com/fsnotify/fsnotify has been upgraded to v1.8.0.
- k8s.io/api has been upgraded to v0.32.1.
- k8s.io/apiextensions-apiserver has been upgraded to v0.32.1.
- k8s.io/apimachinery has been upgraded to v0.32.1.
- k8s.io/apiserver has been upgraded to v0.32.1.
- k8s.io/cli-runtime has been upgraded to v0.32.1.
- k8s.io/client-go has been upgraded to v0.32.1.
- sigs.k8s.io/code-generator has been upgraded to v0.32.1.
- sigs.k8s.io/component-base has been upgraded to v0.32.1.
- sigs.k8s.io/component-helpers has been upgraded to v0.32.1.
- sigs.k8s.io/kubectl has been upgraded to v0.32.1.
- sigs.k8s.io/metrics has been upgraded to v0.32.1.
- sigs.k8s.io/controller-runtime has been upgraded to v0.20.1.
- onsi/ginkgo/v2 has been upgraded to v2.22.1.
- onsi/gomega has been upgraded to v1.36.2.
Fixes
- Fixes a potential cause of increased memory pressure when the using Portal's API Discovery feature where frequent changes in services, replicaSets or pods could lead to excessive reconciliation and memory usage in the control plane. Also improve reconciliation detection for services by only triggering reconciliation when the service annotations change. (https://github.com/solo-io/solo-projects/issues/8442)
- Expose ecdh-curves TLS settings for listeners (https://github.com/solo-io/solo-projects/issues/8456)

v1.18.15 (v1.18.0)

Mon, 30 Jun 2025 15:57:43 GMT

Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.65.2-patch1.
- getkin/kin-openapi has been upgraded to v0.131.0.
- solo-io/protoc-gen-openapi has been upgraded to v0.3.1.
- oapi-codegen/oapi-codegen has been upgraded to v2.4.1.
- solo-io/gloo has been upgraded to v1.18.22.
- solo-io/cloudbuilders has been upgraded to v0.13.0.
- golang/go has been upgraded to v1.24.4.

v1.18.14 (v1.18.0)

Fri, 13 Jun 2025 16:10:37 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.31.8-patch2.

v1.18.13 (v1.18.0)

Tue, 10 Jun 2025 13:31:44 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.18.21.
- solo-io/solo-apis has been upgraded to gloo-v1.18.21.
- golang/go has been upgraded to v1.24.1.
Fixes
- Update gloo to 1.18.21 (https://github.com/solo-io/solo-projects/issues/8362)
- Setting the `uuidRequestIdConfig` in the `HttpConnectionManagerSettings` now correctly sets the `RequestIdExtension` in the `HttpConnectionManager` filter.

v1.18.12 (v1.18.0)

Thu, 05 Jun 2025 13:43:47 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.18.20.
- solo-io/solo-apis has been upgraded to gloo-v1.18.20.
- solo-io/gloo has been upgraded to v1.18.19.
- solo-io/solo-apis has been upgraded to gloo-v1.18.19.
Fixes
- Fix a bug in the gloo_solo_io_namespaces_watched metric that errors when the list of namespaces watched is large. (https://github.com/solo-io/solo-projects/issues/8319)
- Pull in OSS changes to allow for circuit breaking on dyanmic forward proxy clusters. (https://github.com/solo-io/solo-projects/issues/8094)
- Fix a bug causing the observability Grafana dashboard syncer to incorrectly delete snapshots in Grafana which it did not create. This change uses the dashboard default tags to determine whether a dashboard was created by the syncer and can correctly be deleted when the associated upstream has been removed. It performs the same check when deleting snapshots to ensure only snapshots associated with dashboards created by the syncer are deleted. (https://github.com/solo-io/solo-projects/issues/8118)
- Fix a bug in the gloo_solo_io_namespaces_watched metric that errors when the list of namespaces watched is large. (https://github.com/solo-io/solo-projects/issues/8319)
- For clusters generated for the dynamic forward proxy, the circuit breakers are now generated from the dfp config, if provided, otherwise from the settings. If the circuitBreakers are not provided in either location, envoy will use the default circuit breakers. (https://github.com/solo-io/solo-projects/issues/8094)

v1.18.11 (v1.18.0)

Wed, 14 May 2025 18:06:57 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.18.14.
- solo-io/solo-apis has been upgraded to gloo-v1.18.14.
- solo-io/gloo has been upgraded to v1.18.18.
- solo-io/solo-apis has been upgraded to gloo-v1.18.18.
- solo-io/gloo has been upgraded to v1.18.16.
- solo-io/solo-apis has been upgraded to gloo-v1.18.16.
- solo-io/gloo has been upgraded to v1.18.17.
- solo-io/solo-apis has been upgraded to gloo-v1.18.17.
- golang.org/crypto has been upgraded to v0.35.0.
- solo-io/envoy-gloo has been upgraded to v1.31.6-patch1.
Fixes
- Switched to aiohttp for webhook performance and persistent connections (https://github.com/solo-io/solo-projects/issues/8214)
- Fix a bug where the gloo pod crashes if the install and write namespace are different. (https://github.com/solo-io/solo-projects/issues/8183)
- Add support for setting the authority field on gRPC requests made to OTEL Collectors during tracing.
- gateway2/delegation: check cyclic reference only for valid children
- Moves the cyclic reference check after ignoring unattached candidate
- Removes the self-reference check so that invalid references to self
- gateway2/delegation: ignore child routes with mismatched parentRef early
- After the refactor to decouple querying of routes from translation
- This change prunes the routes in the chain early on to avoid
- Testing done:
- gateway2/delegation: enable wildcard namespace for label selection
- Allows specifying a wildcard value when using the label selector
- gateway2/delegation: use a wildcard namespace
- Namespace type in Gateway API must be a valid RFC 1123 DNS label,
- Fixed a bug in route delegation where the `parentRefs` field on child HTTPRoutes were not being respected when parent matcher inheritance was enabled. (https://github.com/solo-io/solo-projects/issues/8163)
- gateway2/status: use SetStatusCondition to prevent duplicate conditions
- Currently, we append() Conditions while building the status reports.

v1.18.10 (v1.18.0)

Wed, 09 Apr 2025 13:00:30 GMT

Extra Notes
- This release contained no user-facing changes.

v1.18.9 (v1.18.0)

Wed, 26 Mar 2025 13:43:08 GMT

Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.65.2-patch0.
- golang.org/x/net has been upgraded to v0.36.0.
- golang.org/x/sync has been upgraded to v0.11.0.

v1.18.8 (v1.18.0)

Fri, 21 Mar 2025 18:53:03 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.18.13.
- solo-io/envoy-gloo-ee has been upgraded to v1.31.6-patch1.
- solo-io/skv2 has been upgraded to v0.41.1.
Fixes
- Bump the alpine base container image to 3.21.3 (https://github.com/solo-io/solo-projects/issues/7956)
- Update the nginx base image for the gloo-federation-console image to resolve CVE-2025-24928. (https://github.com/solo-io/solo-projects/issues/7990)
- Fix issue where Gloo Fed does not receive certain reconcile events. (https://github.com/solo-io/solo-projects/issues/8014)
- Fix a bug where the image registry for the jobs was not correctly overwritten. Address the issue that this causes in CI by adding a composite action that copies the oss images to the correct registry when EE is using a different registry than OSS, which happens during PR CI and dev releases.
- Ensure that the Gloo Federation controller respects the settings.discoveryNamespace in the list of namespaces to watch (https://github.com/solo-io/solo-projects/issues/8014)
- Bump the alpine base container image to 3.21.3 (https://github.com/solo-io/solo-projects/issues/7956)
- Add support for setting filter state from the grpc access log with the gatewayProxies.gatewayProxy.gatewaySettings.accessLoggingService.accessLog.grpcService.filterStateObjectsToLog helm value (https://github.com/solo-io/solo-projects/issues/7923)

v1.18.7 (v1.18.0)

Thu, 06 Mar 2025 23:51:44 GMT

Dependency Bumps
- golang/go has been upgraded to v1.23.7.
- solo-io/gloo has been upgraded to v1.18.12.
- solo-io/solo-apis has been upgraded to gloo-v1.18.12.
- golang/go has been upgraded to v1.23.7.
Fixes
- Fixed large request body causing AI upstream transformation to fail (https://github.com/solo-io/solo-projects/issues/7934)
- Fixed usage might be missing issue if the chunk we are collapsing to does not have usage data already (https://github.com/solo-io/solo-projects/issues/7918)
- Removes unnecessary packages from distroless image variants. (https://github.com/solo-io/solo-projects/issues/7915)
- Discover the Gloo service using labels. In some environments, services must be renamed. This change allows the service to still be discovered when it's been renamed. In the event that multiple services in the namespace have the gloo=gloo label, an error will occur. (https://github.com/solo-io/solo-projects/issues/7646)

v1.18.6 (v1.18.0)

Wed, 26 Feb 2025 18:39:40 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.19.0-beta4.
- solo-io/gloo has been upgraded to v1.18.10.
- solo-io/solo-apis has been upgraded to gloo-v1.18.10.
Fixes
- Propagate trace context to AI webhook service (https://github.com/solo-io/solo-projects/issues/7675)
- Implement AI tracing for Gloo Gateway. (https://github.com/solo-io/solo-projects/issues/7295)
- Passthrough redis score_threshold for semantic_caching. (https://github.com/solo-io/solo-projects/issues/7440)
- Added optional `hostname` to the AI Upstream CustomHost setting to override SNI and host header value (https://github.com/solo-io/solo-projects/issues/7831)
- Fixed chunk alignment when utf-8 multi-byte characters are present in the streaming response (https://github.com/solo-io/solo-projects/issues/7762)
- Fix a bug where the helm charts don't contain image digests
- Add Guardrails Webhook Unified API (https://github.com/solo-io/solo-projects/issues/7438)
- Add streaming response support for AI guardrail (https://github.com/solo-io/solo-projects/issues/7076)
- Add user invoked function calling support. (https://github.com/solo-io/solo-projects/issues/7482)
- Fixes an issue where the ai semantic caching distance is not being set correctly in the cache. Also move the distance threshold to the cache configuration, rather than per datastore. (https://github.com/solo-io/solo-projects/issues/7440)
- Added optional `hostname` to the AI Upstream CustomHost setting to override SNI and host header value (https://github.com/solo-io/solo-projects/issues/7831)
- Fixes a bug where the route ordering affects the deprecated aws requiretransform functionality. (https://github.com/solo-io/solo-projects/issues/7882)

v1.18.5 (v1.18.0)

Mon, 24 Feb 2025 17:38:02 GMT

Dependency Bumps
- solo-io/solo-apis has been upgraded to gloo-v1.18.7.
- solo-io/gloo has been upgraded to v1.18.7.
- solo-io/solo-kit has been upgraded to v0.36.4.
- solo-io/gloo has been upgraded to v1.18.8.
- solo-io/solo-apis has been upgraded to gloo-v1.18.9.
- solo-io/gloo has been upgraded to v1.18.9.
- solo-io/solo-kit has been upgraded to v0.36.4.
Fixes
- Fixes the gateway params image to respect the fips and distroless variants specified by global.image.variant. This only applies to the kubernetes gateway proxy. (https://github.com/solo-io/solo-projects/issues/7803)
- In gloo-fed, ensure that failed unplacements/deletes of resources from a control plane cluster are retried. (https://github.com/solo-io/solo-projects/issues/7709)
- Fixes the wrong sds image generated in the gateway params.
- Backport from 1.19 - Fixes incorrect Helm field name. Changes global.extensions.extAuth.signingKey.signing-key to global.extensions.extAuth.signingKey.key, which is what the Helm template expects. Note that this changes only the field name as it appears in the doc and doesn't change the backend field name. (https://github.com/solo-io/solo-projects/issues/7733)
- Pull in OSS changes to `options/ai/ai.proto` which was resulting in the generation of bad ts code (https://github.com/solo-io/solo-projects/issues/7875)
- Remove `regex` field from ai options proto enum to avoid generated code conflicts with `REGEX` field (https://github.com/solo-io/solo-projects/issues/7875)
- Fixes a bug where we translate Gateways that do not belong to us. (https://github.com/solo-io/solo-projects/issues/7768)
- Fixes the gateway params image to respect the fips and distroless variants specified by global.image.variant. This only applies to the kubernetes gateway proxy. (https://github.com/solo-io/gloo/issues/10602)
- Add support for xDS over mTLS for communication between the Gloo pod and the Kubernetes Gateway proxies. This can be enabled by setting the 'global.glooMtls.enabled' helm value to true. (https://github.com/solo-io/solo-projects/issues/6210)
- Pull in solo-kit fix to reduce log level of snapshot cache watches. (https://github.com/kgateway-dev/kgateway/issues/8626)

v1.18.4 (v1.18.0)

Mon, 03 Feb 2025 17:02:31 GMT

Fixes
- Adds support for match conditions (defined via Common Expression Language (CEL)) to the validating webhook to allow fine grained request filtering. They can be set via two new helm values : - `gloo.gateway.validation.matchConditions` on the Gloo webhook - `gloo.gateway.validation.kubeCoreMatchConditions` on the Kube webhook Note that match labels are supported from Kubernetes v1.30+ but need to be enabled in Kubernetes v1.27 to v1.30 via the AdmissionWebhookMatchConditions feature gate. (https://github.com/k8sgateway/k8sgateway/issues/9828)
- When a `WorkloadEntry` with no address is selected by a Service,
- [Gloo Gateway Portal] Fix an issue where portal transformations were not being applied for delegated routes. (https://github.com/solo-io/solo-projects/issues/7484)
- When an apiKeyAuth AuthConfig is applied which selects a secret whose api-key data does not decode into valid UTF-8, it is now handled gracefully and valid API Keys still work. skipCI-docs-build:true (https://github.com/kgateway-dev/kgateway/issues/10143)
Helm Changes
- Adds support for match conditions (defined via Common Expression Language (CEL)) to the validating webhook to allow fine grained request filtering. They can be set via two new helm values : - `gateway.validation.matchConditions` on the Gloo webhook - `gateway.validation.kubeCoreMatchConditions` on the Kube webhook Note that match labels are supported from Kubernetes v1.30+ but need to be enabled in Kubernetes v1.27 to v1.30 via the AdmissionWebhookMatchConditions feature gate. (https://github.com/k8sgateway/k8sgateway/issues/9828)

v1.18.3 (v1.18.0)

Tue, 14 Jan 2025 20:31:55 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.18.5.
- solo-io/envoy-gloo-33 has been upgraded to v1.31.5-patch2.
- solo-io/envoy-gloo has been upgraded to v1.31.5-patch2.
Fixes
- Pull tiktoken encoding during docker build step rather than on first LLM traffic. This allows for air-gapped environments to use the AI extension. (https://github.com/solo-io/solo-projects/issues/7600)
- [Gloo Gateway Portal] Fix namespace reference check when a Portal references an API Product.
- Allows the group claim name used to identify which group a user belongs to in the portal web server to be configurable via the env var `CUSTOM_GROUP_CLAIM_KEY` which can be set on the portal web server deployment. This is useful when using portal with an IdP where the `group` or `groups` claim is reserved which rendered portal admin functionality unusable as the portal admins needed the `group` claim to be set with the `admin` value. (https://github.com/solo-io/solo-projects/issues/7470)
- Update branch nightly test logic to handle branch input when called from a scheduled job. skipCI-kube-tests:true skipCI-storybook-tests:true skipCI-in-memory-e2e-tests:true (https://github.com/solo-io/solo-projects/issues/6395)
- Fixes an issue where only the first listener protocol was being used for the stitched openAPI specification servers. (https://github.com/solo-io/solo-projects/issues/7437)
- Expose spawn_upstream_span on the tracing API. This setting tells envoy to spawn a new span for each upstream request. (https://github.com/solo-io/solo-projects/issues/6748)
- Add a new Ports field to the `GatewayParameters` `Kube.Service` Spec in order to allow admin users to configure additional information about the ports that the Gateway should listen on. This is useful if the user wants to specify a static `NodePort` (https://github.com/solo-io/solo-projects/issues/7504)
- Add new SSL options to GatewayTLSConfig to enable configuring additional SSL options which were previously available using the edge API. This includes cipher suites, minimum TLS version, maximum TLS version, client certificate validation, and one way TLS. (https://github.com/solo-io/solo-projects/issues/7505)
- gateway2: allow route delegation using wellknown label
- There is a product requirement to enable users to use
- To strike a balance between flexibility and performance,
- Add ability to configure proxy service External Traffic Policy via Gateway Params (https://github.com/k8sgateway/k8sgateway/issues/9879)
- Bumps Gateway API dependencies from v1.2.0 to v1.2.1. (https://github.com/solo-io/gloo/issues/10546)
- When merging parent-child policies, the merging should allow child

v1.18.2 (v1.18.0)

Fri, 03 Jan 2025 22:02:36 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.18.3.
Fixes
- Fix a memory leaking a log name. (https://github.com/solo-io/solo-projects/issues/7573)
- Fix a memory leaking a log name. (https://github.com/solo-io/solo-projects/issues/7573)

v1.18.1 (v1.18.0)

Sat, 21 Dec 2024 00:01:30 GMT

Dependency Bumps
- solo-io/solo-apis has been upgraded to gloo-v1.18.2.
- solo-io/gloo has been upgraded to v1.18.2.
- solo-io/envoy-gloo-ee has been upgraded to v1.31.5-patch1.
- solo-io/solo-apis has been upgraded to gloo-v1.18.1.
- solo-io/gloo has been upgraded to v1.18.1.
- solo-io/envoy-gloo-ee has been upgraded to v1.31.2-patch4.
- solo-io/envoy-gloo has been upgraded to v1.31.5-patch1.
- golang.org/crypto has been upgraded to v0.31.0.
- golang.org/x/net has been upgraded to v0.33.0.
Fixes
- Add `overrideProtocol` option to API Product CR to allow overriding the default gateway protocol for the openAPI schema corresponding to the API Product (https://github.com/solo-io/solo-projects/issues/7409)
- Update Envoy to latest 1.31.5 release for http1 cves. CVE-2024-53269: Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting. CVE-2024-53270: HTTP/1: sending overload crashes when the request is reset beforehand CVE-2024-53271: HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset (https://github.com/solo-io/envoy-gloo-ee/issues/843)
- Route delegation makes use of delegation.gateway.solo.io/*
- Fixes an issue where an error is thrown instead of an InvalidDestinationWarning when a tracing collector references a missing upstream. (https://github.com/k8sgateway/k8sgateway/issues/10293)
- gateway2/delegation: enable inherited policy overrides
- Adds the ability to override inherited policy fields when
- Functionally, a child RouteOption may only override the RouteOptions
- Testing done:
- Translator tests for the new scenarios. (https://github.com/solo-io/solo-projects/issues/7315)

v1.18.0 (v1.18.0)

Thu, 12 Dec 2024 18:42:54 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.18.0.

v1.18.0-rc6 (v1.18.0)

Thu, 12 Dec 2024 00:04:08 GMT

Fixes
- When the v1 ServiceEntry and WorkloadEntry CRDs do not exist, don't attempt to read them. (https://github.com/solo-io/solo-projects/issues/7400)
- When the v1 DestinationRule CRD does not exist, don't attemp to read DestinationRule. (https://github.com/solo-io/solo-projects/issues/7400)

v1.18.0-rc4 (v1.18.0)

Sat, 07 Dec 2024 00:51:28 GMT

Dependency Bumps
- oras.land/oras-go has been upgraded to v1.2.6.
- containerd/containerd has been upgraded to v1.7.20.
- moby/moby has been upgraded to v27.2.0.
- solo-io/gloo has been upgraded to v1.18.0-rc4.
- solo-io/ext-auth-service has been upgraded to v0.65.1.
- moby/moby has been upgraded to v26.0.0.
Fixes
- Sort Gloo Gateway Portal's dynamic metadata transforms to avoid non-deterministic ordering in the generated Proxy. (https://github.com/solo-io/solo-projects/issues/7375)
- Fixes an issue where PortalGroup claims fail to propagate to the database for existing API products. (https://github.com/solo-io/solo-projects/issues/7383)
- Fixes an issue where `portalAuth` would return a 403 unauthorized when no rateLimitMetadata is attached to the api product. (https://github.com/solo-io/solo-projects/issues/7364)
- When using the Kubernetes Gateway API and routing to Kubernetes Services or Kubernetes Upstreams, the envoy cluster stats names are now in a new more parseable format that allows us to extract info about the Service: `upstreamName_upstreamNs_svcNs_svcName_svcPort` (underscore-separated). Note that as long as Kubernetes Gateway integration is enabled (i.e. Gloo Gateway is installed with `kubeGateway.enabled=true`), both Edge and Kubernetes Gateway proxies will use the new stats name format for these clusters. (https://github.com/solo-io/solo-projects/issues/7105)
- Adds tests for TCPRoute ReferenceGrant support to ensure cross namespace references. (https://github.com/solo-io/solo-projects/issues/7309)
- Increases the assertion timeout for TCPRoute e2e test cases. (https://github.com/solo-io/gloo/issues/10434)

v1.18.0-rc3 (v1.18.0)

Tue, 03 Dec 2024 02:17:36 GMT

Dependency Bumps
- solo-io/licensing has been upgraded to v0.5.5.
- solo-io/gloo has been upgraded to v1.18.0-rc3.
- solo-io/go-utils has been upgraded to v0.27.3.
Fixes
- Fixes an issue causing Portal translation output and status to flicker when multiple gateways are deployed. (https://github.com/solo-io/solo-projects/issues/7275)
- Fixes an issue causing AI semantic caching in write mode to use the wrong model name on the request/response. (https://github.com/solo-io/solo-projects/issues/7340)
- There's a bug in how cycles are detected when evaluating a
- Refactors TCPRoute e2e tests to run in parallel, reduce flakes, and parameterize tests for reusability. (https://github.com/solo-io/gloo/issues/10414)
- Changes endpointslice logging level to debug for transformK8sEndpoints() function. (https://github.com/solo-io/solo-projects/issues/7286)
- Fix the validation of large configurations when using envoy validation. This was rarely seen in practice but occurred more often with the new fullEnvoyConfig validation. Previously if the configuration grew too large translation would be blocked. (https://github.com/solo-io/solo-projects/issues/7089)
New Features
- Check for AIGateway add-on in License Key to enable enterprise AIGateway feature (https://github.com/solo-io/solo-projects/issues/7232)

v1.18.0-rc2 (v1.18.0)

Tue, 26 Nov 2024 07:44:16 GMT

Breaking Changes
- Upstreams and UpstreamGroups no longer get Accepted status by default. If they have not gone through translation they will have an empty status field. (https://github.com/solo-io/gloo/issues/10401)
Dependency Bumps
- solo-io/gloo has been upgraded to v1.18.0-rc2.
- solo-io/go-utils has been upgraded to v0.27.2.
- solo-io/solo-kit has been upgraded to v0.36.3.
- solo-io/ext-auth-service has been upgraded to v0.65.0.
- solo-io/solo-kit has been upgraded to v0.36.3.
Fixes
- Omit the gateway portal `database` value in Helm (`gateway-portal-web-server.glooPortalServer.database`) if not defined to avoid Helm installation failures. (https://github.com/solo-io/solo-projects/issues/7252)
- Swap out the WeaviateVectorStore impl to use asyncio. This should fix the lock contention exception the gRPC library has been throwing. (https://github.com/solo-io/solo-projects/issues/7258)
- Fix server to return user defined response message and status code. (https://github.com/solo-io/solo-projects/issues/7178)
- Uses the latest k3s API server
- Sets DISABLE_POD_LOCALITY_XDS to skip pod lookup
- Bump the timeout for the nightly e2e tests (https://github.com/solo-io/gloo/issues/10380)
- Adds support for setting TCPRoute status and managing status conditions. (https://github.com/k8sgateway/k8sgateway/issues/10365)
Helm Changes
- Introduce `global.extensions.extAuth.deployment.extraContainers` to configure extra containers in the ExtAuth deployment.
New Features
- Implement API to allow configuring `CHAT_STREAMING` to support Gemini streaming API. (hhttps://github.com/solo-io/solo-projects/issues/7030)
- Implements support for the PortalAuth API in Gloo Gateway. (https://github.com/solo-io/solo-projects/issues/7170)
- The portal webserver now passes the JWT header to the SPI, allowing the SPI to access additional information about the user. The JWT header is passed as a header named `token`, and the value would be the identity token if it exists, falling back to the access token if the identity token does not exist. (https://github.com/solo-io/solo-projects/issues/7072)
- Allow referencing ServiceEntry from backendRef in Kubernetes Gateway. The reference can use the ServiceEntry Group/Kind directly or it can use Istio's `networking.istio.io` Group with a `Hostname` kind to do a softer reference. (https://github.com/solo-io/solo-projects/issues/5825)
- Allow gloo-waypoint to capture traffic for ServiceEntry. Routing to a ServiceEntry as a backend works the same as for any Kubernetes Gateway. (https://github.com/solo-io/solo-projects/issues/6734)

v1.18.0-rc1 (v1.18.0)

Tue, 19 Nov 2024 21:25:36 GMT

Dependency Bumps
- solo-io/ext-auth-plugins has been upgraded to v0.2.3.
- solo-io/ext-auth-service has been upgraded to v0.64.0.
- golang/go has been upgraded to v1.23.3.
- solo-io/gloo has been upgraded to v1.18.0-rc1.
- solo-io/solo-kit has been upgraded to v0.36.2.
- golang/go has been upgraded to v1.23.3.
- solo-io/envoy-gloo has been upgraded to 1.31.2-patch3.
- solo-io/k8s-utils has been upgraded to v0.8.1.
Fixes
- Mark ExtAuthPlugin deprecated in favor of [Passthrough Auth](https://docs.solo.io/gloo-edge/latest/guides/security/auth/extauth/passthrough_auth/). (https://github.com/solo-io/solo-projects/issues/6961)
- The GraphQL feature of Gloo Gateway is deprecated and will be removed in a future release. Log deprecation warning for the graphql plugin on Init() to communicate the change. (https://github.com/solo-io/solo-projects/issues/7159)
- Bump the kubectl image from 1.29.6 to to 1.31.1 to address CVE-2023-45288. (https://github.com/solo-io/gloo-mesh-enterprise/issues/19119)
- The GraphQL feature of Gloo Gateway is deprecated and will be removed in a future release (https://github.com/solo-io/solo-projects/issues/7159)
- Remove docs for external APIs (https://github.com/solo-io/solo-projects/issues/6768)
- Fix issue where Gloo Gateway did not respect the cluster domain for the xds host address. (https://github.com/solo-io/gloo/issues/10268)
- Adds basic support for Gateway API TCPRoute. (https://github.com/solo-io/gloo/issues/10073)
- Makes the Gateway API TCPRoute controller optional. (https://github.com/solo-io/gloo/issues/10304)
- Removes the endpoints resource from Helm RBAC manifest when kubeGateway is enabled. (https://github.com/solo-io/gloo/issues/10323)
- Updates the gateway2 project to use EndpointSlice instead of Endpoints for creating upstream endpoints. (https://github.com/solo-io/solo-projects/issues/6910)
Helm Changes
- Adds the following new fields that configure the Kubernetes Gloo Gateway pod :
New Features
- Adds a new Portal enablement helm value to simplify enabling the Developer Portal in Gloo Gateway. (`gloo.kubeGateway.portal.enabled`)
- Implemented the Portal Group API, which allows restricting API product access to users based on whether
- Allow adding extra labels a defining security contexts for gateway portal.
- Adds a common category to all Gloo Gateway CRDs. `kubectl get gloo-gateway -A` can now be used to list all GG CRs on your cluster. Also adds the "solo-io" category to GG enterprise CRDs. (https://github.com/solo-io/solo-projects/issues/6605)
- Adds the ability for users to enable as well as add custom readiness and liveness probes to the Kubernetes Gloo Gateway. (https://github.com/solo-io/solo-projects/issues/7084)
- Add API for configuring authentication for APIs managed by Gloo Portal. (https://github.com/solo-io/solo-projects/issues/7170)
- Add `glooctl proxy snapshot` command, which can be pointed at a Gloo Gateway instance and will produce a zip archive containing all Envoy state, for the purposes of simplified issue reporting and triage. (https://github.com/solo-io/solo-projects/issues/7131)
- Add `listenerTcpStats: true|false` to the ListenerOptions API. If `true` will enable [Envoy TCP](https://www.envoyproxy.io/docs/envoy/latest/configuration/listeners/stats#tcp-statistics) stats collection for all listeners. This can be useful for L4 debugging. (https://github.com/solo-io/solo-projects/issues/7176)
- Added support for early header manipulation on Gateways. This feature allows headers to be manipulated before significant processing and routing decisions. It affords the ability to add or remove headers that affect request processing and can be used to implement override headers. This can be configured by setting the `gateway.spec.httpGateway.options.httpConnectionManagerSettings.earlyHeaderMutation` field. The headersToAdd field will add key-value pair headers to the request if not already present or overwrite them unless append is set to true. The headersToRemove field removes the specified headers and is processed after the headers have been added. (https://github.com/solo-io/gloo/issues/9604)
- Support exportTo for Istio's DestinationRule. (https://github.com/solo-io/solo-projects/issues/7101)
- Enable modifying the span name for tracing purposes using InjaTemplates in the transformation filter. More information on OpenTelemetry span names can be found here: https://opentelemetry.io/docs/specs/semconv/http/http-spans/ (https://github.com/solo-io/gloo/issues/9848)
- Split the validating webhook to allow different failure policies for gloo/non-gloo resources. The split out webhook for kubernetes resources shares all configuration with the existing webhook except for the failure policy, which can be set with `gateway.validation.kubeCoreFailurePolicy` (https://github.com/solo-io/gloo/issues/10247)

v1.18.0-beta2 (v1.18.0)

Fri, 08 Nov 2024 05:15:01 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.30.6-patch2.
- solo-io/envoy-gloo-ee has been upgraded to 1.31.2-patch1.
- solo-io/gloo has been upgraded to v1.18.0-beta27.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta27.
- solo-io/ext-auth-service has been upgraded to v0.63.0.
- solo-io/gloo-portal-idp-connect has been upgraded to 0.3.0.
- solo-io/gloo has been upgraded to v1.18.0-beta30.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta30.
- solo-io/gloo has been upgraded to v1.18.0-beta31.
- sigs.k8s.io/gateway-api has been upgraded to v1.1.0.
- k8s.io/api has been upgraded to v0.31.1.
- sigs.k8s.io/controller-runtime has been upgraded to v0.19.0.
- solo-io/envoy-gloo-ee has been upgraded to v1.31.2-patch2.
- solo-io/gloo has been upgraded to v1.18.0-beta33.
- solo-io/ext-auth-service has been upgraded to v0.62.0.
- solo-io/solo-kit has been upgraded to v0.36.1.
- solo-io/gloo has been upgraded to v1.18.0-beta24.
- solo-io/envoy-gloo has been upgraded to 1.31.2-patch1.
- sigs.k8s.io/gateway-api has been upgraded to v1.1.0.
- solo-io/solo-kit has been upgraded to v0.36.1.
- solo-io/cloud-builders has been upgraded to 0.10.1.
- golang/go has been upgraded to go1.23.1.
- solo-io/go-utils has been upgraded to 0.27.0.
Fixes
- Fix for dynamic rate limiting not working when using the `limit` API on the `RateLimitConfig` CR. (https://github.com/solo-io/solo-projects/issues/6865)
- GG Portal now prevents users from creating teams with the same name as a team they are already a member of - returns a 409.
- Enrich portal user endpoints with field indicating whether user is an admin or not based on token claims. Also added
- Upgrade envoy-gloo-ee to pull in cve changes and OTEL decortator backport. CVE-2024-45808: Malicious log injection via access logs CVE-2024-45806: Potential manipulate x-envoy headers from external sources CVE-2024-45809: Jwt filter crash in the clear route cache with remote JWKs CVE-2024-45810: Envoy crashes for LocalReply in http async client (https://github.com/solo-io/solo-projects/issues/6290)
- Disable RDB (redis database persistence) if persistence is disabled with the flag `redis.deployment.persistence.enabled` (https://github.com/solo-io/solo-projects/issues/7111)
- Fixes an issue where the portal server panics when the `/v1/metadata` endpoint is invoked with subscription metadata set but no application metadata is set. (https://github.com/solo-io/solo-projects/issues/6990)
- Fixes an issue where the portal server `/v1/apps` and `/v1/subscriptions` GET endpoints did not return the associated metadata (https://github.com/solo-io/solo-projects/issues/7002)
- Fixes an issue where the portal server `/v1/metadata` creation endpoint would create a new metadata object instead of updating the existing metadata object if the metadata object already exists. (https://github.com/solo-io/solo-projects/issues/7003)
- Fixes an issue where the portal server `/v1/teams`, and `/v1/apps` GET endpoints would return an error for an admin user instead of displaying the appropriate data. (https://github.com/solo-io/solo-projects/issues/7004)
- Fixes WAF validation failure when the rule defines a file present only on the data plane. This assumes that the file is present and valid on the data plane and skips validation of the file. (https://github.com/solo-io/solo-projects/issues/6921)
- Requests that are transformed to mimick aws apigateway have the following changes: - Multivalue headers and query parameters are now a true super set and no longer miss single values - Several values that were previously elided when missing now show as null - The `x-api-key` header is now added to the requestcontext's identity as apikey if present - If requestcontext is set as a header on a request it will now be merged with the requestcontext that is auto generated in the wrapping function
- Requestcontext identity now appropriately sets sourceIP and user-agent by default Note that we do not remove x-api-key nor requestcontext from the default headers but that can be resolved via an extra instance of transformations if required. (https://github.com/solo-io/gloo/issues/9541)
- Fix `glooctl check` so that it only checks Proxies in the write namespace (where all proxies are written), instead of checking in each of the watch namespaces. (https://github.com/solo-io/gloo/issues/9935)
- Fixes a bug where gloo segfaults if resources are applied to a unwatched namespace. (https://github.com/solo-io/solo-projects/issues/7082)
- Previously, the controller would only watch Gateway objects for generation field changes which is not updated when annotations change. Since Gateway reconciliation should be triggered when the gateway.gloo.solo.io/gateway-parameters-name annotation is added, removed, or modified, the predicate was updated to check for changes in either the generation field or the annotations. (https://github.com/solo-io/gloo/issues/10099)
- Updates the Gateway API CRDs to from v1.0.0-rc1 to v1.0.0. (https://github.com/solo-io/gloo/issues/10115)
- Changes to downgrade the level of strictness added in 1.17.8 for TLS secret validation. We still validate several pieces of the cert but also scrub down to usable bits. This means we avoid envoy nacks while allowing more non-useful or functional info in our TLS secrets. This means we are RFC compliant but it may mean that there could exist some cert data in an edge case which we will elide from envoy but previously would be nacked. (https://github.com/solo-io/solo-projects/issues/6772)
- Fix a bug that caused discovered Upstreams to not reflect the updated state of parent Services discovered using watchLabels (https://github.com/solo-io/gloo/issues/8635)
Helm Changes
- Add value to enable full Envoy validation after translation. This functionality is disabled by default but can be enabled with gloo.gateway.validation.fullEnvoyValidation=true. (https://github.com/solo-io/gloo/issues/5720)
- Automatically set the GOMAXPROCS environment variable in the gloo, discovery, extauth, rate-limit, caching, and observability pods when CPU resource limits are set (via the `.resources.limits.cpu` helm value). Automatically set the GOMEMLIMIT environment variable in the gloo, discovery, extauth, rate-limit, caching, and observability pods when memory resource limits are set (via the `.resources.limits.memory` helm value). These may help limit CPU/memory usage when resource limits are set on the pods. (https://github.com/solo-io/gloo/issues/10062)
- Adds a new helm value `settings.watchNamespaceSelectors`. This allows users to specify namespaces to watch based on label selectors that can be specified via `settings.watchNamespaceSelectors.matchLabels` for an exact label match and `settings.watchNamespaceSelectors.matchExpressions` for more generic requirements. The `settings.watchNamespaces` field will override this if specified. (https://github.com/solo-io/gloo/issues/9274)
- Expose new Helm values `kubeGateway.gatewayParameters.glooGateway.service.extraLabels` and `kubeGateway.gatewayParameters.glooGateway.service.extraAnnotations` to set extra labels and extra annotations on the default GatewayParameters. (https://github.com/solo-io/solo-projects/issues/7090)
- Add value to enable full Envoy validation after translation. This functionality is disabled by default but can be enabled with gateway.validation.fullEnvoyValidation=true. (https://github.com/solo-io/gloo/issues/5720)
- Adds a new helm value `settings.watchNamespaceSelectors`. This allows users to specify namespaces to watch based on label selectors that can be specified via `settings.watchNamespaceSelectors.matchLabels` for an exact label match and `settings.watchNamespaceSelectors.matchExpressions` for more generic requirements. The `settings.watchNamespaces` field will override this if specified. (https://github.com/solo-io/gloo/issues/9274)
- Automatically set the GOMAXPROCS environment variable in the gloo and discovery pods when CPU resource limits are set (via the `resources.limits.cpu` deployment helm value). Automatically set the GOMEMLIMIT environment variable in the gloo and discovery pods when memory resource limits are set (via the `resources.limits.memory` deployment helm value). These may help limit CPU/memory usage when resource limits are set on the pods. (https://github.com/solo-io/gloo/issues/10062)
New Features
- Implements the `opaServerAuth` API to configure integration with an OPA server for authorization decisions. (https://github.com/solo-io/solo-projects/issues/7092)
- Add Gemini support for AI Upstreams. (https://github.com/solo-io/solo-projects/issues/7030)
- Add API to enable passthrough auth strategy for AI services. This allows users to pass through the token to the AI service, rather than requiring them to supply a seprate token for the AI service. This can be useful if Identity federation has already been done for the backend in question (https://github.com/solo-io/solo-projects/issues/7115)
- Add API to add moderation as a possible Prompt Guard step. This allows users to add run the user prompt through a moderation service before sending it to the backend LLM. (https://github.com/solo-io/solo-projects/issues/7070)
- Implement API to allow configuring prioritized pools of LLM backends. (https://github.com/solo-io/solo-projects/issues/6957)
- Implement API to allow configuring Weaviate as a backend for semantic caching. (https://github.com/solo-io/solo-projects/issues/6919)
- Implement custom labels for stats in AI Extension server based on helm API. (https://github.com/solo-io/solo-projects/issues/6895)
- Support Azure OpenAI Token based auth with the AI Gateway. (https://github.com/solo-io/solo-projects/issues/6856)
- Implement API to allow users to bring their own Webhook for PromptGuard with AI traffic. (https://github.com/solo-io/solo-projects/issues/6983)
- from envoy 1.31, access_log formatter specifier changes: The upstream connection address, rather than the upstream host address, will be used for the %UPSTREAM_REMOTE_ADDRESS%, %UPSTREAM_REMOTE_PORT% and %UPSTREAM_REMOTE_ADDRESS_WITHOUT_PORT% access log format specifiers. This behavior can be reverted by setting the runtime guard `envoy.reloadable_features.upstream_remote_address_use_connection` to false. (https://github.com/solo-io/solo-projects/issues/6997)
- from envoy 1.31, added %UPSTREAM_CLUSTER_RAW% access log formatter to log the original upstream cluster name, regadless of whether alt_stat_name is set. (https://github.com/solo-io/solo-projects/issues/6997)
- from envoy 1.31, yaml parsing behavior change to no longer support the malformed boolean and fraction object as string. Set `envoy.reloadable_features.reject_invalid_yaml` to false to get back this behavior. (https://github.com/solo-io/solo-projects/issues/6997)
- from envoy 1.31, `envoy.reloadable_features.token_passed_entirely` is removed and can no longer be turned off. (https://github.com/solo-io/solo-projects/issues/6997)
- from envoy 1.31, jwt_authn will remove token from qs param now if forward is set to false. Previously, it would only remove from headers. Set `envoy.reloadable_features.jwt_authn_remove_jwt_from_query_params` to false to go back to old behavior (https://github.com/solo-io/solo-projects/issues/6997)
- from envoy 1.31, jwt_authn now validates provider URIs. If the validation is too strict it can temporarily be disabled by setting the runtime guard `envoy.reloadable_features.jwt_authn_validate_uri` to false. (https://github.com/solo-io/solo-projects/issues/6997)
- from envoy 1.31, access_log will sanitize SNI for potential log injection. The invalid character will be replaced by _ with an invalid: marker. If runtime flag `envoy.reloadable_features.sanitize_sni_in_access_log` is set to false, the sanitize behavior will be disabled. (https://github.com/solo-io/solo-projects/issues/6997)
- from envoy 1.31, changing HTTP/2 colon prefixed headers to being sanitized by Envoy code rather than nghttp2. Should be a functional no-op but guarded by `envoy.reloadable_features.sanitize_http2_headers_without_nghttp2`. Previously, pseudo header with upper case letters will fail validation, now it will pass. (https://github.com/solo-io/solo-projects/issues/6997)
- local ratelimit now default to use the new AtomicToken implementation and will no longer send out the x-ratelimit-reset header as it is no longer timer based. This behavior can be temporarily reverted by setting the runtime guard `envoy.reloadable_features.no_timer_based_rate_limit_token_bucket` to `false`. (https://github.com/solo-io/solo-projects/issues/6997)
- Adds feature to utilize Envoy's validate mode to validate all config during translation. This will be helpful in catching issues which Gloo translation cannot or otherwise does not view as errors before the config gets served to Envoy. (https://github.com/solo-io/gloo/issues/5720)
- Add support for dynamicMetadataFromClaims to OidcAuthorizationCode auth (https://github.com/solo-io/gloo/issues/9282)
- Add support for OIDC distributed claims to OidcAuthorizationCode auth (https://github.com/solo-io/solo-projects/issues/5544)
- Add support Redis/server default storage of API Keys (https://github.com/solo-io/solo-projects/issues/5451)
- Add support for distributed claims to AccessTokenValidation auth (https://github.com/solo-io/solo-projects/issues/7155)
- Allow users to configure the secret key to use for HMAC-SHA256 hashing of stored API Keys.
- Implement OAuth credentials endpoints to contact Portal's IDP Connect API, and generate credentials for Portal applications. Updated the portal reconciliation process to be generalized and include IdP reconciliation of api products. (https://github.com/solo-io/solo-projects/issues/6591)
- Updates the Portal init script to support the portal-frontend deployment. (https://github.com/solo-io/solo-projects/issues/6848)
- Add translation for the `skipMetadataValdiaiton` field for `apiKeyAuth` AuthConfigs and pull in updated `ext-auth-service` dependency.
- Adds a new field `watchNamespaceSelectors` to the settings CR. This allows users to specify namespaces to watch based on label selectors. The `watchNamespaces` field will override this if specified. (https://github.com/solo-io/gloo/issues/9274)
- Support port level settings for lb and outlier detection in Istio's DestinationRule. (https://github.com/solo-io/solo-projects/issues/7101)
- Adds new Portal enablement helm value to simplify enabling the Developer Portal in Gloo Gateway. (`gloo.kubeGateway.portal.enabled`) (https://github.com/solo-io/solo-projects/issues/6470)
- Initial support for Istio's DestinationRule resource for purposes of failover. (https://github.com/solo-io/gloo/pull/10251)
- Add an API to allow configuring `CHAT_STREAMING` to support Gemini streaming API. (hhttps://github.com/solo-io/solo-projects/issues/7030)
- Add API to enable passthrough auth strategy for AI services. This allows users to pass through the token to the AI service, rather than requiring them to supply a seprate token for the AI service. This can be useful if Identity federation has already been done for the backend in question (https://github.com/solo-io/solo-projects/issues/7115)
- Add API to add moderation as a possible Prompt Guard step. This allows users to add run the user prompt through a moderation service before sending it to the backend LLM. (https://github.com/solo-io/solo-projects/issues/7070)
- The existing Helm values `settings.aws.enableServiceAccountCredentials` and `settings.aws.stsCredentialsRegion` are now respected when using Kubernetes Gateway API, as part of supporting [AWS Lambda with EKS ServiceAccounts](https://docs.solo.io/gloo-edge/latest/guides/traffic_management/destination_types/aws_lambda/eks-service-accounts/). When `settings.aws.enableServiceAccountCredentials` is true, a `aws_sts_cluster` cluster, configured with the STS endpoint specified by `settings.aws.stsCredentialsRegion`, will automatically be added to dynamically provisioned proxies, so that Envoy can reach AWS to assume the role needed to access Lambdas. (https://github.com/solo-io/solo-projects/issues/6847)
- Expose `close_connections_on_host_set_change` on `LoadBalancerConfig`. Setting this value configures the Envoy LB policy to drain connections when the upstream host set changes. This is useful when using Ring Hash or Maglev load balancing policies and helps ensure rebalancing when recovering from disruptions. Connections are not immediately closed and are allowed to drain. This feature is disabled by default. (https://github.com/solo-io/gloo/issues/9505) (https://github.com/solo-io/gloo/issues/9505)
- Add an API to allow configuring Gemini as AI upstream. (hhttps://github.com/solo-io/solo-projects/issues/7030)
- Add the initial API for the AI Prompt Guard Webhook. (https://github.com/solo-io/solo-projects/issues/6983)
- Updated the datadog tracer config proto to match envoy v1.31. New fields include `collector_hostname` and `remote_config`. Remote config can now be configured or disabled completely. (https://github.com/solo-io/gloo/issues/10145)
- Adds feature to utilize Envoy's validate mode to validate all config during translation. This will be helpful in catching issues which Gloo translation cannot or otherwise does not view as errors before the config gets served to Envoy. (https://github.com/solo-io/gloo/issues/5720)
- When using the Kubernetes Gateway API, the provisioned ServiceAccount's labels and annotations are now configurable via the GatewayParameters fields `spec.kube.serviceAccount.extraLabels` and `spec.kube.serviceAccount.extraAnnotations`. These values can also be set on the default GatewayParameters during install/upgrade using the Helm values `kubeGateway.gatewayParameters.glooGateway.serviceAccount.extraLabels` and `kubeGateway.gatewayParameters.glooGateway.serviceAccount.extraAnnotations`. (https://github.com/solo-io/solo-projects/issues/6846)
- Adds a new field `watchNamespaceSelectors` to the settings CR. This allows users to specify namespaces to watch based on label selectors. The `watchNamespaces` field will override this if specified. (https://github.com/solo-io/gloo/issues/9274)
- Add an API to allow configuring prioritized pools of LLM backends. (https://github.com/solo-io/solo-projects/issues/6957)
- Add an API to allow configuring Weaviate as a backend for semantic caching. (https://github.com/solo-io/solo-projects/issues/6919)

v1.18.0-beta1 (v1.18.0)

Wed, 18 Sep 2024 00:19:44 GMT

Breaking Changes
- Fix for issue where a missing TLS secret was treated by validation as an error, potentially bringing down the entire HTTPS gateway if the gloo pod restarts while in this bad state. This is a breaking change in the default behavior of validation. To disable this behavior, use the helm setting `gloo.gateway.validation.warnMissingTlsSecret=false` or the same field on the Settings CR. This field has no effect if allowWarnings is false or acceptAllResources is true. (https://github.com/solo-io/gloo/issues/6957)
- Fixes an issue where the denied auth chain would return 403 instead of 401 when merging two 401 responses from AuthServices. This behavior can temporarily be reverted by setting the environment variable `DONT_MERGE_DENIED_AUTH_RESPONSES` to `true` on the Extauth Service. To do this via helm use the following field: global.extensions.extAuth.deployment.customEnv (https://github.com/solo-io/ext-auth-service/issues/669)
Dependency Bumps
- solo-io/gloo has been upgraded to v1.18.0-beta9.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta9.
- solo-io/gloo has been upgraded to v1.18.0-beta5.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta5.
- solo-io/gloo has been upgraded to v1.18.0-beta15.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta15.
- solo-io/gloo has been upgraded to v1.18.0-beta16.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta16.
- solo-io/skv2 has been upgraded to v0.39.2.
- solo-io/gloo has been upgraded to v1.18.0-beta3.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta3.
- golang/go has been upgraded to go1.22.4.
- solo-io/cloud-builders has been upgraded to v0.9.2.
- solo-io/gloo has been upgraded to v1.18.0-beta11.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta11.
- solo.io/ext-auth-service has been upgraded to 0.59.1.
- solo-io/gloo has been upgraded to v1.18.0-beta10.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta10.
- solo-io/gloo has been upgraded to v1.18.0-beta14.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta14.
- solo-io/gloo has been upgraded to v1.18.0-beta7.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta7.
- solo-io/gloo has been upgraded to v1.18.0-beta2.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta2.
- solo-io/gloo has been upgraded to v1.18.0-beta6.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta6.
- solo-io/gloo has been upgraded to v1.18.0-beta8.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta8.
- solo-io/gloo has been upgraded to v1.18.0-beta13.
- solo-io/gloo has been upgraded to v1.18.0-beta21.
- golang/go has been upgraded to go1.22.7.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta21.
- solo-io/gloo has been upgraded to v1.18.0-beta4.
- solo-io/gloo has been upgraded to v1.18.0-beta19.
- solo-io/solo-apis has been upgraded to v1.18.0-beta19.
- solo-io/gloo has been upgraded to v1.18.0-beta21.
- solo-io/solo-apis has been upgraded to gloo-v1.18.0-beta21.
- solo-io/cloudbuilders has been upgraded to v0.9.3.
- golang/go has been upgraded to go1.22.7.
- solo-io/gloo has been upgraded to v1.18.0-beta18.
- solo-io/solo-apis has been upgraded to v1.18.0-beta18.
- solo-io/cloud-builders has been upgraded to 0.10.1.
- golang/go has been upgraded to go1.23.1.
- solo-io/gloo has been upgraded to v1.18.0-beta22.
Fixes
- Fixes an issue with schema stitching short circuting when an auth config not of type `oidc`, `oauth`, or `api_key` is attached to a route via a RouteOption. Also fixed a panic caused when custom metadata is not set on an APIProduct. (https://github.com/solo-io/solo-projects/issues/6349)
- Fixes an issue where translation short circuits when OPA is used in an auth config attached to a route selected by Portal. (https://github.com/solo-io/solo-projects/issues/6350)
- Fixes an issue with schema stitching where security schemes were not added to the stitched schema when the route options were set on the parent route but the `ApiProduct` selects a child route. (https://github.com/solo-io/solo-projects/issues/6361)
- Fixed a bug in the `/api-products` endpoint where version metadata was returned instead of api product metadata. Also updated custom metadata merging logic for portal transformations to have version metadata take precedence and lastly, removed `api_id` from portal transformation replacing it with `api_version` instead. (https://github.com/solo-io/solo-projects/issues/6392)
- Fixes issue on concurrent map write where values are not set properly if multiple goroutines try and write to an
- skipCI-kube-tests:true
- ai-extension: add FIPS build
- Adds a FIPS build for the AI extension.
- It does the following:
- Builds a custom Python base image that is FIPS
- Custom patches to Python and Langchain to be FIPS
- Build logic to build the FIPS variants of the base image
- Set the 'message' field on various HTTPRoute conditions to enable easier troubleshooting (https://github.com/solo-io/gloo/issues/9859)
- Support defining the PriorityClassName on a GatewayProxy deployment. This allows users to attach pods to PriorityClasses (https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/) (https://github.com/solo-io/gloo/issues/9010)
- Fix issue when installing GGv2 alongside GM due to the conflicting `internal.gloo.solo.io` CRDs. We rename the group in GGv2 to `portal.internal.gloo.solo.io` to avoid the conflict when installing both into the same cluster. (https://github.com/solo-io/solo-projects/issues/6448)
- Fix issue regarding Portal short-circuiting when generating an ApiDoc when a single path matched can't be stitched. (https://github.com/solo-io/solo-projects/issues/6300)
- Use PostRouting stage for Portal metadata to avoid overwriting metadata in Early and Regular stages. (https://github.com/solo-io/solo-projects/issues/6312)
- Fix the GCP Authn filter to run before the router filter, rather than at the beginning of the chain. This is the last thing we want to happen before the request goes upstream because nothing else in the filter chain relies on this JWT. (https://github.com/solo-io/solo-projects/issues/6564)
- Fix bug that caused Helm to error when installing without any classic GatewayProxies enabled, which may be the case when using kubeGateway. Also ensure that all necessary dataplane components are applies when kubeGateway is enabled, regardless of any classic Gateways and their settings. (https://github.com/solo-io/solo-projects/issues/6109)
- Fix bug that caused Helm not to render the sidecar config required by rate-limit when redis was disabled (ie when using custom redis). (https://github.com/solo-io/gloo/issues/9524)
Helm Changes
- Ensure that gateway-proxy deployments respect the `gloo.gatewayProxy.NAME.kind.deployment.priorityClassName` field. This API allows you to set the PriorityClassName for gateway-proxy Pods. This is already supported on all other Gloo deployments. (https://github.com/solo-io/gloo/issues/8677)
- New field gloo.gateway.validation.warnMissingTlsSecret controls whether missing TLS secrets referenced in SslConfig and UpstreamSslConfig will be treated as a warning instead of an error during validation. Defaults to true. This field has no effect if allowWarnings is false or acceptAllResources is true. (https://github.com/solo-io/gloo/issues/6957)
- Extend application of `global.securitySettings.floatingUserId` from OSS to Enterprise and Fed charts. In addition to unsetting `runAsUser`, this field has additional effects of acting as if `redis.deployment.enablePodSecurityContext=false`. The global `floatingUserId`. The functionality also maintains the extra effect of `global.extensions.extAuth.deployment.floatingUserId=true` which unsets `fsGroup` in the pod security context. (https://github.com/solo-io/gloo/issues/5034)
- Pass redis the "--appendonly" option on start up. The value passed depends upon the valu of the helm field `redis.deployment.persistence.enabled`. If the field is `false` (the default), a value of `no` is passed. If the field is `true`, a value of `yes` is passed. (https://github.com/solo-io/solo-projects/issues/6492)
- Ensure that image digests are set correctly for all image variants (standard, fips, distroless, fips-distroless). (https://github.com/solo-io/gloo/issues/9860)
New Features
- Add support for self service API keys for portal, including 3 new endpoints:
- Enable GG Portal's `subscriptions` and `apps` routes + handlers. (https://github.com/solo-io/solo-projects/issues/6585)
- Enable GG Portal's `team` routes + handlers for managing teams. (https://github.com/solo-io/solo-projects/issues/6584)
- "Integrates gloo-ai-extension python project into solo-projects." (https://github.com/solo-io/solo-projects/issues/6496)
- Add new AI Gateway functionality to the API Gateway. This feature can be accessed by: - Enabling the ai-gateway extension in the `GatewayParameters` CRD. - Creating an `ai` upstream. - Optionally Enabling `ai` options in a `RouteOptions` CRD. (https://github.com/solo-io/solo-projects/issues/6570)
- Expose `CorsPolicyMergeSettings` on `VirtualHostOptions` which allows users to specify how to reconcile CORS settings when configured on both Route and VirtualHost. Specifically it is now possible to define a `UNION` merge strategy for the `ExposeHeaders` field, resulting in the union of the headers set at Route and VirtualHost level being applied to traffic for the Route. (https://github.com/solo-io/gloo/issues/7689)
- Provide a mechanism to globally apply `floatingUserId` via the `global.securitySettings.floatingUserId` field in order to easily work with OpenShift. Setting this field to `true` will allow deployment from OpenShift without the need to set deployment-specific `floatingUserId` values (with the exception of `gateway-portal-web-server.glooPortalServer.floatingUserId`) or `redis.deployment.enablePodSecurityContext=false`. Though (https://github.com/solo-io/gloo/issues/5034)
- Support front channel logout: https://openid.net/specs/openid-connect-frontchannel-1_0-final.html. Enabled by setting `oidcAuthorizationCode.frontChannelLogout.path` in the AuthConfig. (https://github.com/solo-io/gloo/issues/9510)
- Implement new APIServer to manually control the semantic cache data for gloo AI Gateway.
- Expose max_buffered_{rx/tx}_bytes, record_headers_received_time and record_downstream_connection settings for the Tap filter config. (https://github.com/solo-io/solo-projects/issues/5455)
- Add `redis.cert.tlsSecretName` and `redis.cert.caCertSecretName` Helm values, allowing users to use custom names for the Redis TLS secret and Redis CA cert secrets. By default these secrets are named as `-redis-tls-secret` and `-redis-ca-cert-secret` respectively. (https://github.com/solo-io/gloo/issues/9699)
- Added support for route level JWT configuration by introducing new `jwtProvidersStaged` field on the RouteOptions. (https://github.com/solo-io/solo-projects/issues/6541)
- Adds new `validationPolicy` option for JWT configuration to allow configuring `ALLOW_MISSING` if token is missing, request is still accepted. The existing API flag `allow_missing_or_failed` is not sufficient for this use case. (https://github.com/solo-io/gloo/issues/8728)
- Add support for the [envoy.http.stateful_session.header filter](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/stateful_session_filter) This support has been added via a new HTTPListener option, `stateful_session` which can be used to configure the filter. Envoy notes about this filter: - Stateful sessions can result in imbalanced load across upstreams and allow external actors to direct requests to specific upstream hosts. Operators should carefully consider the security and reliability implications of stateful sessions before enabling this feature. - This extension is functional but has not had substantial production burn time, use only with this caveat. - This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted. (https://github.com/solo-io/gloo/issues/9104)

v1.17.20 (v1.17.0)

Thu, 12 Mar 2026 00:27:03 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.30.11-patch9.
- golang/go has been upgraded to v1.25.7.
- solo-io/cloud-builders has been upgraded to v0.14.2.
Fixes
- re-enable envoy-wrapper fips-debug build (https://github.com/solo-io/solo-projects/issues/8818)

v1.17.19 (v1.17.0)

Tue, 20 Jan 2026 00:02:08 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.17.37.
- solo-io/solo-apis has been upgraded to gloo-v1.17.37.
- golang/go has been upgraded to v1.24.11.
- solo-io/gloo has been upgraded to v1.17.36.
- solo-io/solo-apis has been upgraded to gloo-v1.17.36.
- rancher/kubectl has been upgraded to v1.34.3.
- golang/go has been upgraded to v1.24.11.

v1.17.18 (v1.17.0)

Fri, 05 Dec 2025 15:35:42 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.30.11-patch8.

v1.17.17 (v1.17.0)

Wed, 22 Oct 2025 20:32:42 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.30.11-patch7.
- solo-io/gloo has been upgraded to v1.17.35.
- solo-io/solo-apis has been upgraded to gloo-v1.17.35.
- golang/go has been upgraded to v1.24.9.
- solo-io/cloud-builders has been upgraded to v0.13.2.
- golang/go has been upgraded to v1.24.9.
- solo-io/cloud-builders has been upgraded to v0.13.2.
Fixes
- Bump the alpine base container image to 3.21.5 (https://github.com/solo-io/solo-projects/issues/8620)
- Fixes a bug where the the default gatewayProxy when disabled would create invalid helm templates for custom proxies. (https://github.com/solo-io/solo-projects/issues/8613)

v1.17.16 (v1.17.0)

Fri, 26 Sep 2025 14:19:55 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.30.11-patch6.
- solo-io/gloo has been upgraded to v1.17.34.
- solo-io/solo-apis has been upgraded to gloo-v1.17.34.
- solo-io/envoy-gloo has been upgraded to v1.30.11-patch2.

v1.17.15 (v1.17.0)

Thu, 04 Sep 2025 15:37:15 GMT

Fixes
- Change order of locking mutexes in failover plugin to avoid deadlocks. (https://github.com/solo-io/solo-projects/issues/8548)

v1.17.14 (v1.17.0)

Fri, 15 Aug 2025 20:43:16 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.17.32.
- helm/helm has been upgraded to v3.17.4.
- solo-io/ext-auth-service has been upgraded to v0.58.0-patch6.
- go/oauth2 has been upgraded to v0.27.0.
- golang/go has been upgraded to v1.24.6.
- solo-io/gloo has been upgraded to v1.17.33.
- golang/go has been upgraded to v1.24.6.
- solo-io/cloud-builders has been upgraded to v0.13.1.
- bitnami/kubectl has been upgraded to v1.33.3.
- solo-io/go-utils has been upgraded to v0.25.4.
- helm/helm has been upgraded to v3.17.4.
Fixes
- Bumped the nginx version in Dockerfile to resolve CVE. (https://github.com/solo-io/solo-projects/issues/8487)
- Fixes a potential cause of increased memory pressure when the using Portal's API Discovery feature where frequent changes in services, replicaSets or pods could lead to excessive reconciliation and memory usage in the control plane. Also improve reconciliation detection for services by only triggering reconciliation when the service annotations change. (https://github.com/solo-io/solo-projects/issues/8442)

v1.17.13 (v1.17.0)

Mon, 30 Jun 2025 19:15:03 GMT

Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.58.0-patch5.
- solo-io/envoy-gloo-ee has been upgraded to v1.30.11-patch4.
- solo-apis/gloo has been upgraded to gloo-v1.17.31.
- solo-io/gloo has been upgraded to v1.17.31.
- solo-io/cloudbuilders has been upgraded to v0.13.0.
- golang/go has been upgraded to v1.24.4.

v1.17.12 (v1.17.0)

Thu, 12 Jun 2025 13:16:25 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.30.11-patch3.

v1.17.11 (v1.17.0)

Tue, 10 Jun 2025 13:05:48 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.17.29.
- solo-io/solo-apis has been upgraded to gloo-v1.17.29.
- golang/go has been upgraded to v1.24.1.
- solo-io/gloo has been upgraded to v1.17.30.
- solo-io/cloud-builders has been upgraded to v0.12.1.
- golang.org/crypto has been upgraded to v0.35.0.
- golang/go has been upgraded to v1.24.1.
Fixes
- Fix a bug causing the observability Grafana dashboard syncer to incorrectly delete snapshots in Grafana which it did not create. This change uses the dashboard default tags to determine whether a dashboard was created by the syncer and can correctly be deleted when the associated upstream has been removed. It performs the same check when deleting snapshots to ensure only snapshots associated with dashboards created by the syncer are deleted. (https://github.com/solo-io/solo-projects/issues/8118)
- Fix a bug in the gloo_solo_io_namespaces_watched metric that errors when the list of namespaces watched is large. (https://github.com/solo-io/solo-projects/issues/8319)
- Setting the `uuidRequestIdConfig` in the `HttpConnectionManagerSettings` now correctly sets the `RequestIdExtension` in the `HttpConnectionManager` filter.
- Fixed a bug in route delegation where the `parentRefs` field on child HTTPRoutes were not being respected when parent matcher inheritance was enabled. (https://github.com/solo-io/solo-projects/issues/8163)

v1.17.10 (v1.17.0)

Wed, 09 Apr 2025 13:00:01 GMT

Extra Notes
- This release contained no user-facing changes.

v1.17.9 (v1.17.0)

Wed, 26 Mar 2025 17:42:20 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.30.10-patch1.
- solo-io/ext-auth-service has been upgraded to v0.58.0-patch4.
- solo-io/gloo has been upgraded to v1.17.28.
- solo-io/solo-apis has been upgraded to gloo-v1.17.28.
- golang.org/x/net has been upgraded to v0.36.0.
- golang.org/x/sync has been upgraded to v0.11.0.
- solo-io/envoy-gloo has been upgraded to v1.30.10-patch1.

v1.17.8 (v1.17.0)

Wed, 12 Mar 2025 20:09:15 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.17.27.
- golang/go has been upgraded to v1.23.7.
- golang/go has been upgraded to v1.23.3.
- golang/go has been upgraded to v1.23.3.
- golang/go has been upgraded to v1.23.7.
Fixes
- Bump the alpine base container image to 3.21.3 (https://github.com/solo-io/solo-projects/issues/7956)
- Update the nginx base image for the gloo-federation-console image to resolve CVEs (https://github.com/solo-io/solo-projects/issues/7991)
- Bump the alpine base container image to 3.21.3 (https://github.com/solo-io/solo-projects/issues/7956)
- Add support for setting filter state from the grpc access log with the gatewayProxies.gatewayProxy.gatewaySettings.accessLoggingService.accessLog.grpcService.filterStateObjectsToLog helm value (https://github.com/solo-io/solo-projects/issues/7923)

v1.17.7 (v1.17.0)

Thu, 27 Feb 2025 22:30:57 GMT

Dependency Bumps
- solo-io/solo-apis has been upgraded to gloo-v1.17.25.
- solo-io/gloo has been upgraded to v1.17.26.
- solo-io/solo-kit has been upgraded to v0.35.6.
Fixes
- Fixes the gateway params image to respect the fips and distroless variants specified by global.image.variant. This only applies to the kubernetes gateway proxy. (https://github.com/solo-io/solo-projects/issues/7803)
- Fixes a memory leak caused by an indefinitely growing map (https://github.com/solo-io/solo-projects/issues/7805)
- In gloo-fed, ensure that failed unplacements/deletes of resources from a control plane cluster are retried. (https://github.com/solo-io/solo-projects/issues/7709)
- [Gloo Gateway Portal] Fix namespace reference check when a Portal references an API Product.
- When an apiKeyAuth AuthConfig is applied which selects a secret whose api-key data does not decode into valid UTF-8, it is now handled gracefully and valid API Keys still work. skipCI-docs-build:true (https://github.com/kgateway-dev/kgateway/issues/10143)
- Update branch nightly test logic to handle branch input when called from a scheduled job. skipCI-kube-tests:true skipCI-storybook-tests:true skipCI-in-memory-e2e-tests:true (https://github.com/solo-io/solo-projects/issues/6395)
- Fixes an issue where only the first listener protocol was being used for the stitched openAPI specification servers. (https://github.com/solo-io/solo-projects/issues/7437)
- Fixes the wrong sds image generated in the gateway params.
- Backport from 1.19 - Fixes incorrect Helm field name. Changes global.extensions.extAuth.signingKey.signing-key to global.extensions.extAuth.signingKey.key, which is what the Helm template expects. Note that this changes only the field name as it appears in the doc and doesn't change the backend field name. (https://github.com/solo-io/solo-projects/issues/7733)
- Discover the Gloo service using labels. In some environments, services must be renamed. This change allows the service to still be discovered when it's been renamed. In the event that multiple services in the namespace have the gloo=gloo and app=gloo labels, an error will occur. (https://github.com/solo-io/solo-projects/issues/7646)
- Fixes a memory leak caused by an indefinitely growing map (https://github.com/solo-io/solo-projects/issues/7805)
- Fixes the gateway params image to respect the fips and distroless variants specified by global.image.variant. This only applies to the kubernetes gateway proxy. (https://github.com/solo-io/gloo/issues/10602)

v1.17.6 (v1.17.0)

Thu, 09 Jan 2025 22:36:18 GMT

Dependency Bumps
- solo-io/solo-apis has been upgraded to gloo-v1.17.21.
- solo-io/gloo has been upgraded to v1.17.21.
- solo-io/solo-apis has been upgraded to gloo-v1.17.20.
- solo-io/gloo has been upgraded to v1.17.20.
Fixes
- When merging parent-child policies, the merging should allow child

v1.17.5 (v1.17.0)

Sat, 21 Dec 2024 03:52:56 GMT

Dependency Bumps
- oras.land/oras-go has been upgraded to v1.2.6.
- containerd/containerd has been upgraded to v1.7.20.
- moby/moby has been upgraded to v27.2.0.
- solo-io/solo-apis has been upgraded to gloo-v1.17.19.
- solo-io/gloo has been upgraded to v1.17.19.
- solo-io/envoy-gloo-ee has been upgraded to v1.30.9-patch1.
- solo-io/solo-kit has been upgraded to v0.35.5.
- solo-io/solo-apis has been upgraded to gloo-v1.17.18.
- solo-io/gloo has been upgraded to v1.17.18.
- solo-io/envoy-gloo has been upgraded to v1.30.9-patch1.
- golang.org/x/net has been upgraded to v0.33.0.
- moby/moby has been upgraded to v26.0.0.
- golang.org/crypto has been upgraded to v0.31.0.
- solo-io/solo-kit has been upgraded to v0.35.5.
Fixes
- Add `overrideProtocol` option to API Product CR to allow overriding the default gateway protocol for the openAPI schema corresponding to the API Product. (https://github.com/solo-io/solo-projects/issues/7409)
- Update Envoy to latest 1.30.9 release for http cves. CVE-2024-53269: Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting. CVE-2024-53270: HTTP/1: sending overload crashes when the request is reset beforehand (https://github.com/solo-io/envoy-gloo-ee/issues/843)
- Route delegation makes use of delegation.gateway.solo.io/*
- Fixes an issue where an error is thrown instead of an InvalidDestinationWarning when a tracing collector references a missing upstream. (https://github.com/k8sgateway/k8sgateway/issues/10293)
- gateway2/delegation: enable inherited policy overrides
- Adds the ability to override inherited policy fields when
- Functionally, a child RouteOption may only override the RouteOptions
- Testing done:
- Translator tests for the new scenarios. (https://github.com/solo-io/solo-projects/issues/7315)
- Remove docs for external APIs (https://github.com/solo-io/solo-projects/issues/6768)

v1.17.4 (v1.17.0)

Thu, 14 Nov 2024 03:05:24 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.17.15.
- solo-io/envoy-gloo-ee has been upgraded to v1.30.6-patch3.
- solo-io/gloo has been upgraded to v1.17.16.
- solo-apis/gloo has been upgraded to v1.17.16.
- solo-io/ext-auth-service has been upgraded to v0.58.0-patch3.
- solo-io/gloo has been upgraded to v1.17.14.
- solo-io/solo-apis has been upgraded to gloo-v1.17.14.
- solo-io/envoy-gloo has been upgraded to 1.30.6-patch5.
- solo-io/envoy-gloo has been upgraded to v1.30.6-patch3.
- solo-io/envoy-gloo-ee has been upgraded to v1.30.6-patch2.
Fixes
- Fixes a bug where gloo segfaults if resources are applied to a unwatched namespace. (https://github.com/solo-io/solo-projects/issues/7082)
- Add translation for the `skipMetadataValdiaiton` field for `apiKeyAuth` AuthConfigs and pull in updated `ext-auth-service` dependency.
- Added support for early header manipulation on Gateways. This feature allows headers to be manipulated before significant processing and routing decisions. It affords the ability to add or remove headers that affect request processing and can be used to implement override headers. This can be configured by setting the `gateway.spec.httpGateway.options.httpConnectionManagerSettings.earlyHeaderMutation` field. The headersToAdd field will add key-value pair headers to the request if not already present or overwrite them unless append is set to true. The headersToRemove field removes the specified headers and is processed after the headers have been added. (https://github.com/solo-io/gloo/issues/9604)
- Fix `glooctl check` so that it only checks Proxies in the write namespace (where all proxies are written), instead of checking in each of the watch namespaces. (https://github.com/solo-io/gloo/issues/9935)
- When using the Kubernetes Gateway API, the provisioned ServiceAccount's labels and annotations are now configurable via the GatewayParameters fields `spec.kube.serviceAccount.extraLabels` and `spec.kube.serviceAccount.extraAnnotations`. These values can also be set on the default GatewayParameters during install/upgrade using the Helm values `kubeGateway.gatewayParameters.glooGateway.serviceAccount.extraLabels` and `kubeGateway.gatewayParameters.glooGateway.serviceAccount.extraAnnotations`. (https://github.com/solo-io/solo-projects/issues/6846)
- Enable modifying the span name for tracing purposes using InjaTemplates in the transformation filter. More information on OpenTelemetry span names can be found here: https://opentelemetry.io/docs/specs/semconv/http/http-spans/ (https://github.com/solo-io/gloo/issues/9848)
- Add metrics for translatation timing and time for taken to sync served xDS entries.
- Fixes a bug where gloo segfaults if resources are applied to a unwatched namespace. (https://github.com/solo-io/solo-projects/issues/7082)
Helm Changes
- Expose new Helm values `kubeGateway.gatewayParameters.glooGateway.service.extraLabels` and `kubeGateway.gatewayParameters.glooGateway.service.extraAnnotations` to set extra labels and extra annotations on the default GatewayParameters. (https://github.com/solo-io/solo-projects/issues/7090)

v1.17.3 (v1.17.0)

Wed, 02 Oct 2024 23:23:19 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.30.6-patch2.
- solo-io/gloo has been upgraded to v1.17.13.
- solo-io/solo-apis has been upgraded to gloo-v1.17.13.
- solo-io/solo-kit has been upgraded to v0.35.4.
- solo-io/gloo has been upgraded to v1.17.10.
- solo-io/solo-kit has been upgraded to v0.35.4.
Fixes
- Upgrade envoy-gloo-ee to pull in cve changes and OTEL decortator backport. CVE-2024-45808: Malicious log injection via access logs CVE-2024-45806: Potential manipulate x-envoy headers from external sources CVE-2024-45809: Jwt filter crash in the clear route cache with remote JWKs CVE-2024-45810: Envoy crashes for LocalReply in http async client (https://github.com/solo-io/solo-projects/issues/6290)
- Add missing Kubernetes OSS file `glooctl-test-helm.yaml` to fix test fail due to missing file. (https://github.com/solo-io/solo-projects/issues/6914)
- Rename test file `disable-transformation-validation-test-helm.yaml` to fix test fail due to missing file. (https://github.com/solo-io/solo-projects/issues/6915)
- Fixes WAF validation failure when the rule defines a file present only on the data plane. This assumes that the file is present and valid on the data plane and skips validation of the file. (https://github.com/solo-io/solo-projects/issues/6921)
- Fix the GCP Authn filter to run before the router filter, rather than at the beginning of the chain. This is the last thing we want to happen before the request goes upstream because nothing else in the filter chain relies on this JWT. (https://github.com/solo-io/solo-projects/issues/6564)
- Adds a new field `watchNamespaceSelectors` to the settings CR. This allows users to specify namespaces to watch based on label selectors. The `watchNamespaces` field will override this if specified. (https://github.com/solo-io/gloo/issues/9274)
- Adds a new helm value `settings.watchNamespaceSelectors`. This allows users to specify namespaces to watch based on label selectors that can be specified via `settings.watchNamespaceSelectors.matchLabels` for an exact label match and `settings.watchNamespaceSelectors.matchExpressions` for more generic requirements. The `settings.watchNamespaces` field will override this if specified. (https://github.com/solo-io/gloo/issues/9274)
- Changes to downgrade the level of strictness added in 1.17.8 for TLS secret validation. We still validate several pieces of the cert but also scrub down to usable bits. This means we avoid envoy nacks while allowing more non-useful or functional info in our TLS secrets. This means we are RFC compliant but it may mean that there could exist some cert data in an edge case which we will elide from envoy but previously would be nacked. (https://github.com/solo-io/solo-projects/issues/6772)
- Fix a bug that caused discovered Upstreams to not reflect the updated state of parent Services discovered using watchLabels (https://github.com/solo-io/gloo/issues/8635)
- Adds a new field `watchNamespaceSelectors` to the settings CR. This allows users to specify namespaces to watch based on label selectors. The `watchNamespaces` field will override this if specified. (https://github.com/solo-io/gloo/issues/9274)
- Adds a new helm value `settings.watchNamespaceSelectors`. This allows users to specify namespaces to watch based on label selectors that can be specified via `settings.watchNamespaceSelectors.matchLabels` for an exact label match and `settings.watchNamespaceSelectors.matchExpressions` for more generic requirements. The `settings.watchNamespaces` field will override this if specified. (https://github.com/solo-io/gloo/issues/9274)

v1.17.2 (v1.17.0)

Tue, 17 Sep 2024 20:47:03 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.17.7.
- solo-io/solo-apis has been upgraded to gloo-v1.17.7.
- solo-io/gloo has been upgraded to v1.17.5.
- solo-io/solo-apis has been upgraded to gloo-v1.17.5.
- solo-io/gloo has been upgraded to v1.17.8.
- solo-io/ext-auth-service has been upgraded to v0.58.0-patch2.
- solo-io/cloud-builders has been upgraded to 0.9.3.
- golang/go has been upgraded to go1.22.7.
- solo-io/cloud-builders has been upgraded to 0.9.3.
- golang/go has been upgraded to go1.22.7.
Fixes
- Fix for issue where a missing TLS secret was treated by validation as an error, potentially bringing down the entire HTTPS gateway if the gloo pod restarts while in this bad state. This is a breaking change in the default behavior of validation. To enable this behavior, use the helm setting `gloo.gateway.validation.warnMissingTlsSecret=true` or the same field on the Settings CR. This field has no effect if allowWarnings is false or acceptAllResources is true. (https://github.com/solo-io/gloo/issues/6957)
- Expose max_buffered_{rx/tx}_bytes, record_headers_received_time and record_downstream_connection settings for the Tap filter config. (https://github.com/solo-io/solo-projects/issues/5455)
- Increase timeout/retries for glooctl check when connecting to the gateway using port forwarding. (https://github.com/solo-io/gloo/issues/10020)
- Fixes an issue on upgrades to 1.17+ where persistproxyspec was set to true. Persist proxy spec is configured in helm via gateway.persistProxySpec or in ee gloo.gateway.persistProxySpec (https://github.com/solo-io/gloo/issues/9968)
- Plugs a gap where go would check a secret for validity per spec but envoy is more aggressive. For example a tls secret with a certchain that contains an invalid pem block will be rejected by envoy but not go. Prior to this pr these types of secrets would be accepted by gloo and nacked by envoy. (https://github.com/solo-io/solo-projects/issues/6772)
- Fix for issue where a missing TLS secret was treated by validation as an error, potentially bringing down the entire HTTPS gateway if the gloo pod restarts while in this bad state. This is a breaking change in the default behavior of validation.
Helm Changes
- New field gloo.gateway.validation.warnMissingTlsSecret controls whether missing TLS secrets referenced in SslConfig and UpstreamSslConfig will be treated as a warning instead of an error during validation. Defaults to false. This field has no effect if allowWarnings is false or acceptAllResources is true. (https://github.com/solo-io/gloo/issues/6957)
- New field gateway.validation.warnMissingTlsSecret controls whether missing TLS secrets referenced in SslConfig and UpstreamSslConfig will be treated as a warning instead of an error during validation. Defaults to false. This field has no effect if allowWarnings is false or acceptAllResources is true. (https://github.com/solo-io/gloo/issues/6957)

v1.17.1 (v1.17.0)

Fri, 16 Aug 2024 21:01:02 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.17.1.
- solo-io/solo-apis has been upgraded to gloo-v1.17.1.
- solo-io/skv2 has been upgraded to v0.39.2.
- solo-io/gloo has been upgraded to v1.17.3.
- solo-io/solo-apis has been upgraded to gloo-v1.17.3.
- solo-io/envoy-gloo-ee has been upgraded to v1.30.4-patch3.
- solo.io/ext-auth-service has been upgraded to 0.58.0-patch1.
- solo-io/gloo has been upgraded to v1.17.2.
- solo-io/solo-apis has been upgraded to gloo-v1.17.2.
- solo-io/gloo has been upgraded to v1.17.4.
- solo-io/envoy-gloo-ee has been upgraded to v1.30.4-patch4.
- solo-io/envoy-gloo has been upgraded to 1.30.4-patch4.
Fixes
- Provide a mechanism to globally apply `floatingUserId` via the `global.securitySettings.floatingUserId` field in order to easily work with OpenShift. Setting this field to `true` will allow deployment from OpenShift without the need to set deployment-specific `floatingUserId` values (with the exception of `gateway-portal-web-server.glooPortalServer.floatingUserId`) or `redis.deployment.enablePodSecurityContext=false`. Though (https://github.com/solo-io/gloo/issues/5034)
- Update Envoy to enable thread-local slots to be deallocated on worker threads. This provides greater stability in Envoy when the main thread is under heavy load. This behaviour can be disabled by toggling the runtime flag envoy_restart_features_allow_slot_destroy_on_worker_threads. (https://github.com/solo-io/solo-projects/issues/6713)
- Allows user to opt into the ability to merge Auth Responses differently. When not enabled denied auth chains would return 403 instead of 401 when merging two 401 responses from AuthServices. This behavior can be enabled by setting the environment variable `DONT_MERGE_DENIED_AUTH_RESPONSES` to `false` on the Extauth Service. To do this via helm use the following field: global.extensions.extAuth.deployment.customEnv. (https://github.com/solo-io/ext-auth-service/issues/669)
- Backport of local rate limiting changes for envoy 1.31. New non-main thread locked implementation can be set to true via. envoy_reloadable_features_no_timer_based_rate_limit_token_bucket (https://github.com/solo-io/gloo/issues/9564)
- gateway2/route-options: merge extensionRef based attachments
- Enables merging of multiple ExtensionRef based RouteOption
- Only update the K8s Gateway resource statuses on change to improve HTTPRoute translation time. (https://github.com/solo-io/solo-projects/issues/6638)
- Support defining the PriorityClassName on a GatewayProxy deployment. This allows users to attach pods to PriorityClasses (https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/) (https://github.com/solo-io/gloo/issues/9010)
- gateway2: merge multiple targetRef based Route & VirtualHost options
- Implements merging of targetRef based RouteOptions and
- The merging uses shallow merging such that for an option
- Update Envoy to enable thread-local slots to be deallocated on worker threads. This provides greater stability in Envoy when the main thread is under heavy load. This behaviour can be disabled by toggling the runtime flag envoy_restart_features_allow_slot_destroy_on_worker_threads. (https://github.com/solo-io/solo-projects/issues/6713)
- Provide a Helm field `global.securitySettings.floatingUserId` to apply floatingUserId logic, which unsets `runAsUser` for security contexts, for all deployments in the Gloo Helm chart. The global field will also cause templates to be rendered as if deployments with "enablePodSecurityContext` fields have their value set to `false` to allow for easy OpenShift deployment. This functionality has also been added to Gloo Gateway via the GatewayParameters resource. If `floatingUserId` is set in GatewayParameters, it will be applied to all deployments in the Gloo Gateway Helm chart, unless a deployment-specific value is set. (https://github.com/solo-io/gloo/issues/5034)
- Set the 'message' field on various HTTPRoute conditions to enable easier troubleshooting (https://github.com/solo-io/gloo/issues/9859)
- gateway2/delegation: fix extraneous route arising from invalid child rule
- There's a bug where if a child route contains an invalid rule (rule
- The essence of this fix is to prune both the `rules` and `matches`
- invalid matchers on the child route are discarded
- invalid rules (no valid child matchers) are also discarded
- Previously, 2. was missing so a child route with a rule without
- Fix a bug that causes edge to try to list endpoints across all namespaces when no upstreams exist. (https://github.com/solo-io/gloo/issues/5885)
- Fix a bug where the service and function names of a discovered gRPC service are not printed in JSON and YAML
Helm Changes
- Extend application of `global.securitySettings.floatingUserId` from OSS to Enterprise and Fed charts. In addition to unsetting `runAsUser`, this field has additional effects of acting as if `redis.deployment.enablePodSecurityContext=false`. The global `floatingUserId`. The functionality also maintains the extra effect of `global.extensions.extAuth.deployment.floatingUserId=true` which unsets `fsGroup` in the pod security context. (https://github.com/solo-io/gloo/issues/5034)
- Pass redis the "--appendonly" option on start up. The value passed depends upon the valu of the helm field `redis.deployment.persistence.enabled`. If the field is `false` (the default), a value of `no` is passed. If the field is `true`, a value of `yes` is passed. (https://github.com/solo-io/solo-projects/issues/6492)
- Ensure that image digests are set correctly for all image variants (standard, fips, distroless, fips-distroless). (https://github.com/solo-io/gloo/issues/9860)
- Ensure that gateway-proxy deployments respect the `gatewayProxy.NAME.kind.deployment.priorityClassName` field. This API allows you to set the PriorityClassName for gateway-proxy Pods. This is already supported on all other Gloo deployments. (https://github.com/solo-io/gloo/issues/8677)
- Introduce `gatewayProxies.gatewayProxy.istioSpiffeCertProviderAddress` which overrides the Istio SPIFFE certificate provider (`CA_ADDR` env variable). It defaults to `gatewayProxies.gatewayProxy.discoveryAddress`. (https://github.com/solo-io/gloo/issues/9855)
- Add a new field `global.securitySettings.floatingUserId` to the Gloo Helm chart that when set to `true` has the same effect as setting `floatingUserId=true` for all deployment-specific `floatingUserId`s, as well as setting `discovery.deployment.enablePodSecurityContext=false` and gatewayProxies.gatewayProxy.podTemplate.enablePodSecurityContext=false`to allow for easy OpenShift deployment. The global value will override any local settings. (https://github.com/solo-io/gloo/issues/5034)
- Ensure that image digests are set correctly for all image variants (standard, fips, distroless, fips-distroless). (https://github.com/solo-io/gloo/issues/9860)

v1.17.0 (v1.17.0)

Tue, 16 Jul 2024 00:54:17 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.30.4-patch1.
- solo-io/gloo has been upgraded to v1.17.0.
- solo-apis/gloo has been upgraded to gloo-v1.17.0.
- solo-io/envoy-gloo has been upgraded to v1.30.4-patch1.
Fixes
- Fixes an issue with schema stitching where security schemes were not added to the stitched schema when the route options were set on the parent route but the `ApiProduct` selects a child route. (https://github.com/solo-io/solo-projects/issues/6361)
- Fix regex safety check for CORS allowed origins. Other instances in gloo already checked the regex either through compile or envoy validate. (https://github.com/solo-io/gloo/issues/7524)

v1.17.0-rc6 (v1.17.0)

Sat, 13 Jul 2024 12:08:02 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.17.0-rc12.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-rc12.
Fixes
- Resolves issue of HTTPS listeners not aggregating appropriately when defined using the same port on a kube gateway. (https://github.com/solo-io/solo-projects/issues/6559)
- Fix issue regarding Portal short-circuiting when generating an ApiDoc when a single path matched can't be stitched. (https://github.com/solo-io/solo-projects/issues/6300)
- Fix bug that caused Helm not to render the sidecar config required by rate-limit when redis was disabled (ie when using custom redis). (https://github.com/solo-io/gloo/issues/9524)
- Resolves issue of HTTPS listeners not aggregating appropriately when defined using the same port on a kube gateway. (https://github.com/solo-io/solo-projects/issues/6559)

v1.17.0-rc5 (v1.17.0)

Wed, 10 Jul 2024 13:58:04 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.17.0-rc9.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-rc9.
- golang/go has been upgraded to go1.22.4.
- solo-io/cloud-builders has been upgraded to v0.9.2.
- solo-io/gloo has been upgraded to v1.17.0-rc11.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-rc11.
- solo-io/gloo has been upgraded to v1.17.0-rc10.
- bitnami/kubectl has been upgraded to 1.29.6.
- golang/go has been upgraded to v1.22.4.
- solo-io/cloud-builders has been upgraded to v0.9.2.
Fixes
- Fixes an issue with schema stitching short circuting when an auth config not of type `oidc`, `oauth`, or `api_key` is attached to a route via a RouteOption. Also fixed a panic caused when custom metadata is not set on an APIProduct. (https://github.com/solo-io/solo-projects/issues/6349)
- Fixes an issue where translation short circuits when OPA is used in an auth config attached to a route selected by Portal. (https://github.com/solo-io/solo-projects/issues/6350)
- Use PostRouting stage for Portal metadata to avoid overwriting metadata in Early and Regular stages. (https://github.com/solo-io/solo-projects/issues/6312)
- Use kube builder instead of skv2 for faster and easier codegen for GGv2 CRDs. (https://github.com/solo-io/solo-projects/issues/6490)
- Optimizes the `glooctl check` command by reducing the time taken to check resources by almost half in large environments consisting of over 500 namespaces (https://github.com/solo-io/gloo/issues/9673)
- Infer the gloo deployment name in cases where the deployment name is not the default `gloo`. The gloo deployment is identified by the `gloo=gloo` label. (https://github.com/solo-io/gloo/issues/9163)
- Fix a bug where the service and function names of a discovered gRPC service are not printed when running glooctl get upstreams (https://github.com/solo-io/gloo/issues/9644)

v1.17.0-rc4 (v1.17.0)

Wed, 03 Jul 2024 00:52:58 GMT

Fixes
- Fixed a bug in the `/api-products` endpoint where version metadata was returned instead of api product metadata. Also updated custom metadata merging logic for portal transformations to have version metadata take precedence and lastly, removed `api_id` from portal transformation replacing it with `api_version` instead. (https://github.com/solo-io/solo-projects/issues/6392)

v1.17.0-rc3 (v1.17.0)

Thu, 27 Jun 2024 13:47:52 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.17.0-rc6.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-rc6.
- solo-io/gloo has been upgraded to v1.17.0-rc8.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-rc8.
Fixes
- Fix a bug where a hybrid gateway with non existing delegatedHttpGateways is accepted if no virtual services exist. This would only occur when the flag for isolating virtualservices by ssl configs is enabled. (https://github.com/solo-io/gloo/issues/8834)
- Previously, header names consisting of invalid characters such as '()[]:;,<=>' were accepted when passed via the healthCheck or headerManipulation `requestHeadersToAdd` parameter. This resulted in envoy throwing an `invalid header name` error. Now, header names are validated according to RFC 9110, which is the same validation used by envoy. If a header name consisting of invalid characters is passed via the aforementioned parameters, it is caught and rejected in edge and does not propagate to envoy. (https://github.com/solo-io/gloo/issues/9622)
- Fix bug that caused Helm to error when installing without any classic GatewayProxies enabled, which may be the case when using kubeGateway. Also ensure that all necessary dataplane components are applies when kubeGateway is enabled, regardless of any classic Gateways and their settings. (https://github.com/solo-io/solo-projects/issues/6109)
- Move remaining non-user-facing default values for dynamically provisioned gateway proxies from internal helm chart to main Gloo Gateway helm chart. This allows features like Security Context to be configured/disabled. (https://github.com/solo-io/solo-projects/issues/6381)
- Update `glooctl check` to check for Kubernetes Gateway resources. (https://github.com/solo-io/solo-projects/issues/5741)
- Only act on GatewayClass resources that use the Gloo Gateway controller name (https://github.com/solo-io/gloo/issues/9660)
- Fix a bug where a hybrid gateway with non existing delegatedHttpGateways is accepted if no virtual services exist. This would only occur when the flag for isolating virtualservices by ssl configs is enabled. (https://github.com/solo-io/gloo/issues/8834)
- Fix statuses being synced properly for k8s gateway resources (https://github.com/solo-io/solo-projects/issues/6304)
- Follow up to fix discoveryAddress, istioMetaMeshId and istioMetaClusterId in k8s gateway deployment for Istio integration. (https://github.com/solo-io/solo-projects/issues/6107)
- Adds the `host_rewrite_header` to the route options to allow envoy to swapped the host header with the content of given downstream or custom header. Pay attention to the potential security implications of using this option. Provided header must come from trusted source. (https://github.com/solo-io/gloo/issues/9579)
- Previously, header names consisting of invalid characters such as '()[]:;,<=>' were accepted when passed via the healthCheck or headerManipulation `requestHeadersToAdd` parameter. This resulted in envoy throwing an `invalid header name` error. Now, header names are validated according to RFC 9110, which is the same validation used by envoy. If a header name consisting of invalid characters is passed via the aforementioned parameters, it is caught and rejected in edge and does not propagate to envoy. (https://github.com/solo-io/gloo/issues/9622)
- Fix issue where Kube Gateway proxies would have errors regarding status logged constantly (https://github.com/solo-io/solo-projects/issues/6252)
Helm Changes
- Introduce `gateway.validation.webhook.enablePolicyApi` which controls whether or not RouteOptions and VirtualHostOptions CRs are subject to validation. By default, this value is true. The validation of these Policy APIs only runs if the Kubernetes Gateway integration is enabled (`kubeGateway.enabled`). (https://github.com/solo-io/solo-projects/issues/6352)
New Features
- Adds the ability to recover if the Kubernetes API server is unreachable once the gloo pod comes up. The `MAX_RECOVERY_DURATION_WITHOUT_KUBE_API_SERVER` environment variable defines the maximum duration the gloo pod can run and attempt to reconnect to the kube apiserver if it is unreachable. Exceeding this duration will lead to the pod quitting. To enable this feature, set the `MAX_RECOVERY_DURATION_WITHOUT_KUBE_API_SERVER` environment variable to the desired duration in the gloo container. This can be done either by modifying the gloo deployment or by specifying the `gloo.deployment.customEnv[0].Name=MAX_RECOVERY_DURATION_WITHOUT_KUBE_API_SERVER` and `gloo.deployment.customEnv[0].Value=60s` helm values. (https://github.com/solo-io/gloo/issues/8107)
- Adds the `host_rewrite_header` to the route options to allow envoy to swapped the host header with the content of given downstream or custom header. Pay attention to the potential security implications of using this option. Provided header must come from trusted source. (https://github.com/solo-io/gloo/issues/9579)
- Add support for the [envoy.http.stateful_session.header filter](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/stateful_session_filter) This support has been added via a new HTTPListener option, `stateful_session` which can be used to configure the filter. Envoy notes about this filter: - Stateful sessions can result in imbalanced load across upstreams and allow external actors to direct requests to specific upstream hosts. Operators should carefully consider the security and reliability implications of stateful sessions before enabling this feature. - This extension is functional but has not had substantial production burn time, use only with this caveat. - This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted. (https://github.com/solo-io/gloo/issues/9104)
- Enable Envoy to accept requests with extended HTTP methods (such as `LABEL` or `UPDATE`). Previously, requests with these methods would return an HTTP 400 response. Currently, this functionality is supported for HTTP/1 only. (https://github.com/solo-io/gloo/issues/5579)
- Export Prometheus Metrics on Port 9091 for Gloo Gateway. (https://github.com/solo-io/solo-projects/issues/6393)
- Adds the ability to recover if the Kubernetes API server is unreachable once the gloo pod comes up. The `MAX_RECOVERY_DURATION_WITHOUT_KUBE_API_SERVER` environment variable defines the maximum duration the gloo pod can run and attempt to reconnect to the kube apiserver if it is unreachable. Exceeding this duration will lead to the pod quitting. To enable this feature, set the `MAX_RECOVERY_DURATION_WITHOUT_KUBE_API_SERVER` environment variable to the desired duration in the gloo container. This can be done either by modifying the gloo deployment or by specifying the `gloo.deployment.customEnv[0].Name=MAX_RECOVERY_DURATION_WITHOUT_KUBE_API_SERVER` and `gloo.deployment.customEnv[0].Value=60s` helm values. (https://github.com/solo-io/gloo/issues/8107)

v1.17.0-rc2 (v1.17.0)

Sat, 15 Jun 2024 03:44:43 GMT

Breaking Changes
- Bump the default Prometheus Helm subchart to 25.21.0 from 15.18.0. There are a number of breaking changes enumerated in [Prometheus Helm documentation](https://artifacthub.io/packages/helm/prometheus-community/prometheus#upgrading-chart) for each minor version. Notably the labels on the Prometheus deployments have changed, requiring that the old deployments are deleted on upgrade before the new deployments can be applied. We have added a Job that will automatically delete the Prometheus server deployment on Gloo upgrade if needed (ie default Prometheus is used and the labels on the existing deployment are out-of-date). *This will lead to downtime for Prometheus during the upgrade.* The Job is enabled by default and can be disabled by specifying `prometheus.prometheusServerMigrationJob.enabled=false`, in which case the user is responsible for managing the Prometheus chart upgrade. Other notable breaking changes in the Prometheus subchart include changing the `pushgateway` values block to `prometheus-pushgateway` and `nodeExporter` to `prometheus-node-exporter`. Users who have specified values under these blocks should be sure to use the new names when upgrading. *Users who use custom Prometheus deployments will not be affected by this change.* (https://github.com/solo-io/solo-projects/issues/5891)
- The default Grafana Helm subchart has been bumped from 6.16.14 to 7.3.11. There are breaking changes identified in [Grafana Helm documentation](https://artifacthub.io/packages/helm/grafana/grafana#to-7-0-0), namely the change of the `global.image.registry` parameter in the subchart to `global.imageRegistry`. *Users who use custom Grafana deployments will not be affected by this change.* (https://github.com/solo-io/solo-projects/issues/5891)
Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to 1.30.2-patch2.
- solo-io/gloo has been upgraded to 1.17.0-rc3.
- solo-io/solo-apis has been upgraded to gloo-1.17.0-rc3.
- solo-io/gloo has been upgraded to v1.17.0-rc2.
- solo-io/gloo has been upgraded to v1.17.0-rc4.
- redis/redis has been upgraded to 7.2.5-alpine.
- solo-io/envoy-gloo has been upgraded to v1.30.2-patch2.
Fixes
- Fix a memory corruption issue in the XSLT transformer. Memory was not being deallocated properly when XML transforms were being performed on message bodies using the XSLT filter.
- Rename the `/v1/apis` endpoints to `/v1/api-products` to align with the REST endpoint naming convention we want to move forward with. This is a breaking change when migrating from GM v2.5 Portal. (https://github.com/solo-io/solo-projects/issues/6366)
- Fix false warning statuses regarding missing apidocs when using route delegation. (https://github.com/solo-io/solo-projects/issues/6335)
- Fixing MaxDepth not processed and propagated to envoy. (https://github.com/solo-io/solo-projects/issues/6372)
- Adds error types for plugins errors to differentiate between validation errors and validation warnings in order to support preventing the validation webhook rejecting config due to eventual consistency issues with the RateLimitConfig resource. (https://github.com/solo-io/solo-projects/issues/6251)
- Resync the Gloo Gateway Controller when a Service is updated. (https://github.com/solo-io/solo-projects/issues/6332)
- Fix `glooctl check` to not rely on existence of proxy deployments when checking proxies. (https://github.com/solo-io/solo-projects/issues/5741)
- Properly pass through the `json_to_proto` value from the gloo API to the envoy API for dynamic metadata transformations. (https://github.com/solo-io/solo-projects/issues/5890)
Helm Changes
- Fix istioIntegration.enabled helm value to configure bootstrap configmap. Remove deprecated istioSDS.enabled as a requirement for Istio automtls integration. (https://github.com/solo-io/solo-projects/issues/5743)
- Rename the kube gateway envoy container image helm value from `kubeGateway.gatewayParameters.glooGateway.image` to `kubeGateway.gatewayParameters.glooGateway.envoyContainer.image`. (https://github.com/solo-io/solo-projects/issues/6107)
New Features
- Adds support for routes that use regex based matching in Portal. Also adds support for routes that use regex rewrites via route option attachment for prefix, exact and regex based routes. (https://github.com/solo-io/solo-projects/issues/6053)
- gateway2: enable running ggv2 control-plane and proxy outside k8s
- Enables running the gateway and control-plane outside k8s, such
- It provides the following packages:
- gloo-control
- gloo-gateway
- gloo-extensions
- Refer to projects/vm/docs/README.md for a detailed demo guide. (https://github.com/solo-io/solo-projects/issues/6297)
- Enables routing to AWS Lambda and Azure Function upstreams via the GGv2 API. (https://github.com/solo-io/solo-projects/issues/6160)
- Add HttpListenerOption policy for use with Kube Gateway API resources (https://github.com/solo-io/solo-projects/issues/6319)
- Add support for the [envoy.http.stateful_session.header filter](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/stateful_session_filter) This support has been added via a new HTTPListener option, `stateful_session` which can be used to configure the filter. Envoy notes about this filter: - Stateful sessions can result in imbalanced load across upstreams and allow external actors to direct requests to specific upstream hosts. Operators should carefully consider the security and reliability implications of stateful sessions before enabling this feature. - This extension is functional but has not had substantial production burn time, use only with this caveat. - This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted. (https://github.com/solo-io/gloo/issues/9104)
- Add API for adding metadata to endpoints in static/failover upstreams. This metadata can
- Add new plugin type to allow adding filter in the upstream filter chain. (https://github.com/solo-io/solo-projects/issues/5890)

v1.17.0-rc1 (v1.17.0)

Thu, 06 Jun 2024 18:52:25 GMT

Breaking Changes
- Bump dependencies to support Kubernetes 1.29 (https://github.com/solo-io/gloo/issues/8978)
- The ApiProduct definition has changed to allow a list of HTTPRoute references. (https://github.com/solo-io/solo-projects/issues/6225)
- Deprecate Gloo Edge as an Ingress Controller (https://github.com/solo-io/gloo/issues/8978)
- The `ErrNoSupportedSidecar` has been removed from the `projects/gloo/cli/pkg/cmd/istio/sidecars` package as we no longer support any versions that would trigger this error. (https://github.com/solo-io/gloo/issues/8990)
Dependency Bumps
- solo-io/gloo has been upgraded to v1.17.0-beta34.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-beta34.
- solo-io/caching-service has been upgraded to v0.7.0.
- solo-io/ext-auth-service has been upgraded to v0.58.0.
- solo-io/external-apis has been upgraded to v0.2.8.
- solo-io/gloo has been upgraded to v1.17.0-beta33.
- solo-io/rate-limiter has been upgraded to v0.12.0.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-beta33.
- solo-io/solo-kit has been upgraded to v0.35.0.
- k8s.io/api has been upgraded to v0.29.2.
- k8s.io/apiextensions-apiserver has been upgraded to v0.29.2.
- k8s.io/apimachinery has been upgraded to v0.29.2.
- k8s.io/apiserver has been upgraded to v0.29.2.
- k8s.io/cli-runtime has been upgraded to v0.29.2.
- k8s.io/client-go has been upgraded to v0.29.2.
- sigs.k8s.io/code-generator has been upgraded to v0.29.2.
- sigs.k8s.io/component-base has been upgraded to v0.29.2.
- sigs.k8s.io/component-helpers has been upgraded to v0.29.2.
- sigs.k8s.io/kube-openapi has been upgraded to v0.0.0-20231010175941-2dd684a91f00.
- sigs.k8s.io/kubectl has been upgraded to v0.29.2.
- sigs.k8s.io/metrics has been upgraded to v0.29.2.
- k8s.io/api has been upgraded to v0.29.2.
- k8s.io/apiextensions-apiserver has been upgraded to v0.29.2.
- k8s.io/apimachinery has been upgraded to v0.29.2.
- k8s.io/apiserver has been upgraded to v0.29.2.
- k8s.io/cli-runtime has been upgraded to v0.29.2.
- k8s.io/client-go has been upgraded to v0.29.2.
- sigs.k8s.io/code-generator has been upgraded to v0.29.2.
- sigs.k8s.io/component-base has been upgraded to v0.29.2.
- sigs.k8s.io/component-helpers has been upgraded to v0.29.2.
- sigs.k8s.io/kubectl has been upgraded to v0.29.2.
- sigs.k8s.io/metrics has been upgraded to v0.29.2.
- sigs.k8s.io/controller-runtime has been upgraded to v0.17.4.
- onsi/ginkgo/v2 has been upgraded to v2.14.0.
- onsi/gomega has been upgraded to v1.30.0.
- go.uber.org/zap has been upgraded to v1.26.0.
- solo-io/k8s-utils has been upgraded to v0.7.2.
- solo-io/skv2 has been upgraded to v0.39.1.
- solo-io/solo-apis has been upgraded to sa-k8s-1.29-bump.
- solo-io/solo-kit has been upgraded to v0.35.0.
Fixes
- Fixes the `/v1/me` returning no user found when processing a valid id token. Also updated the `v1/api-products` endpoints to `/v1/apis` instead for backwards compatibility. (https://github.com/solo-io/solo-projects/issues/6260)
- Fix helm chart bug where redis secret was not created for caching/extAuth when rateLimit was disabled. (https://github.com/solo-io/solo-projects/issues/6318)
- Fix an issue where the wrong query param was discovered for a rest resolver. (https://github.com/solo-io/solo-projects/issues/6275)
- Adds error types for plugins errors to differentiate between validation errors and validation warnings in order to support preventing the validation webhook rejecting config due to eventual consistency issues with the RateLimitConfig resource. (https://github.com/solo-io/solo-projects/issues/6251)
- Changing error type to warning will deflake the validation webhook rejecting config due to eventual consistency issues with the RateLimitConfig resource. (https://github.com/solo-io/solo-projects/issues/5307)
- Ensure that RateLimitConfig that are not found result in a warning, instead of an error (https://github.com/solo-io/gloo/issues/7357)
- Set the `parseBodyBehavior` to `Don't Parse` for Portal transformations. (https://github.com/solo-io/solo-projects/issues/6111)
- Adds error types for plugins errors to differentiate between validation errors and validation warnings in order to support preventing the validation webhook rejecting config due to eventual consistency issues with the RateLimitConfig resource. (https://github.com/solo-io/solo-projects/issues/6251)
- Changing error type to warning will deflake the validation webhook rejecting config due to eventual consistency issues with the RateLimitConfig resource. (https://github.com/solo-io/solo-projects/issues/5307)
- Adds initial error types for plugins errors to differentiate between validation errors and validation warnings. (https://github.com/solo-io/gloo/issues/7357)
- Resolves issue where default GatewayParameters could be passed invalid fields and fail to render (https://github.com/solo-io/solo-projects/issues/6257)
- Fix bug in `glooctl get proxy` that returned duplicate proxies. (https://github.com/solo-io/solo-projects/issues/6088)
- Fix issue where upstream creation/deletion were not being reconciled by the K8s Gateway controller. (https://github.com/solo-io/solo-projects/issues/6222)
Helm Changes
- Add k8s Gateway Istio integration values to the Gloo Gateway Helm chart under kubeGateway.gatewayParameters.glooGateway. (https://github.com/solo-io/solo-projects/issues/5743)
- Mark Istio integration helm values that rely on double proxy setup as deprecated. This includes: - global.istioIntegration.labelInstallNamespace - global.istioIntegration.whitelistDiscovery - global.istioIntegration.enableIstioSidecarOnGateway - global.istioIntegration.istioSidecarRevTag - global.istioIntegration.appendXForwardedHost (https://github.com/solo-io/solo-projects/issues/5743)
- Startup probe has been enabled by default in Istio helm charts. See [Istio 1.20.0 release notes](https://istio.io/latest/news/releases/1.20.x/announcing-1.20/upgrade-notes/#startupprobe-added-to-sidecar-by-default) for more information and halm values to revert the startup probe enablement. (https://github.com/solo-io/gloo/issues/8990)
New Features
- Adds support for ApiProducts selecting HttpRoutes that target upstreams. (https://github.com/solo-io/solo-projects/issues/6097)
- Adds support for delegated routes in Portal. `ApiProducts` can now select any parent route in a delegation chain and expect all child routes to be part of the `ApiProduct`. (https://github.com/solo-io/solo-projects/issues/6236)
- Enable selection of multiple API products for a single (https://github.com/solo-io/solo-projects/issues/6254)
- Support multiple HTTPRoute references in the ApiProduct definition, allowing the stitching of multiple routes. (https://github.com/solo-io/solo-projects/issues/6225)
- New CRDs added for ListenerOption and HttpListenerOption resources (https://github.com/solo-io/solo-projects/issues/5941)
- Add ListenerOption as a policy resource for use with Kube Gateway API objects.
- gateway2: enable self-managed Gateways
- Adds capability to integrate self-managed gateways
- It adds a selfManaged field to the GatewayParameters

v1.17.0-beta3 (v1.17.0)

Fri, 24 May 2024 19:42:16 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.17.0-beta26.
- solo-io/envoy-gloo-ee has been upgraded to v1.29.3-patch2.
- solo-io/gloo has been upgraded to v1.17.0-beta31.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-beta31.
- solo-io/gloo has been upgraded to v1.17.0-beta27.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-beta27.
- solo-io/envoy-gloo-ee has been upgraded to v1.30.1-patch1.
- solo-io/gloo has been upgraded to v1.17.0-beta32.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-beta32.
- solo-io/skv2 has been upgraded to v0.39.1.
- solo-io/k8s-utils has been upgraded to v0.7.2.
- solo-io/gloo has been upgraded to v1.17.0-beta30.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-beta30.
- solo-io/envoy-gloo has been upgraded to v1.30.1-patch1.
- solo-io/k8s-utils has been upgraded to v0.6.3.
- bitnami/kubectl has been upgraded to 1.28.9.
- solo-io/envoy-gloo has been upgraded to v1.29.3-patch2.
Fixes
- Replace use of portal crds from gloo-mesh-enterprise to portal cards generated by solo-projects. (https://github.com/solo-io/solo-projects/issues/6181)
- Replace use of the GME PortalConfig CRD with the PortalConfig CRD generated by solo-projects. (https://github.com/solo-io/solo-projects/issues/6181)
- Migrate portal web server from GME to solo-projects using the new REST API specification that will support self-service credentials. Creation of multiple Portal CRs is now not supported. (https://github.com/solo-io/solo-projects/issues/6182)
- Fix missing HTTPS listener data causing issues with the portal server URLs. (https://github.com/solo-io/solo-projects/issues/6201)
- Update to allow WAF policy validation. Invalid or malformed WAF policies will now be validated and rejected by gloo. The new behavior is enabled by default and can be turned off by setting the `DISABLE_WAF_VALIDATION` environment variable to `true` in the `gloo` deployment. A dedicated helm value has not been added, and the environment variable can be set using `gloo.gloo.deployment.customEnv` (https://github.com/solo-io/solo-projects/issues/6141)
- Using default GatewayParameters passes through the correct sds image tag (https://github.com/solo-io/solo-projects/issues/6103)
- Added default service type of LoadBalancer to default GatewayParameters. This value will be inherited by each deployed gateway proxy unless it is overridden in a GatewayParameters attached to the Gateway resource which generated it. (https://github.com/solo-io/solo-projects/issues/6113)
- Fixes bug that prevented deleted HTTPRoutes from being fully reconciled to proxies (https://github.com/solo-io/gloo/issues/9508)
- Make GatewayParameters fields nullable so they are more easily overridable. (https://github.com/solo-io/solo-projects/issues/6107)
- Set the previously-missing HTTPS listener data when the listeners are translated. (https://github.com/solo-io/solo-projects/issues/6201)
- gateway2: simplify how plugins handle delegated routes
- This change simplifies how plugins may perform merging
- Further, it accurately tracks the source RouteOptions
- Removed the `--proxy-ns` flag from `glooctl get proxy`, as proxies are now all written to the discoveryNamespace specified in settings. (https://github.com/solo-io/solo-projects/issues/6088)
- This change updates the route sorting such that regex based matchers
- Further, it avoids prioritizing regex based matchers based on their
- Refactor our TestInstallation to make it more re-usable with Portal E2E tests. (https://github.com/solo-io/solo-projects/issues/6029)
- Fix a bug where Lambdas returning multiValueHeaders with non-string type with `unwrapAsApiGateway` enabled would result in a 500 response to the caller (https://github.com/solo-io/gloo/issues/8867)
Helm Changes
- Adds a new helm value `global.additionalLabels` that specifies additional labels to add to gloo resources. (https://github.com/solo-io/gloo/issues/9035)
- Introduced new fields to kubeGateway top-level field which configure the deployed Gateway proxies generated from a Gateway. Also introduced a new default GatewayParameters to be rendered when kubeGateway.enabled=true. This contains defaults for Istio/SDS, as well as things like envoy image, deployment replicas, and extra labels in the pod template. (https://github.com/solo-io/solo-projects/issues/6107)
- Adds a new helm value `global.additionalLabels` that specifies additional labels to add to gloo resources. (https://github.com/solo-io/gloo/issues/9035)
New Features
- Implement GCP Upstream support in Gloo Edge Enterprise. This feature allows users to configure Gloo Edge to route traffic to Google Cloud Platform services using the GCP Upstream type. This upstream type will handle auth for you assuming the google metadata service is present, and the workload is allowed to access the service. (https://github.com/solo-io/gloo/issues/6828)
- Add helm values for all containers to allow for conforming to [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) (https://github.com/solo-io/gloo/issues/8864)
- Introduced a new default GatewayParameters which is associated with a GatewayClass and represents the default values applied to Gateways created from that GatewayClass that don't otherwise have a specific GatewayParameters attached. (https://github.com/solo-io/solo-projects/issues/6107)
- gateway2/delegation: enable optional parent matcher inheritance
- In the current design, a child route must have route matchers
- There's a request to enable matcher inheritance from the parent
- Add helm values for all containers to allow for conforming to [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) (https://github.com/solo-io/gloo/issues/8864)
- Adds webhook validation for Gloo Gateway Policies (e.g. RouteOption and VirtualHostOption) when used with Kubernetes Gateway API (https://github.com/solo-io/solo-projects/issues/6063)
- This change implements policy inheritance, specifically
- Additionally, it does the following:
- Refactors the RouteOption query API to perform merging
- Translator tests for the many scenarios of policy inheritance.
- Converts delegation translator test to a table-driven test.
- E2e tests to verify the inheritance and merge functionality. (https://github.com/solo-io/solo-projects/issues/6161)

v1.17.0-beta2 (v1.17.0)

Sat, 04 May 2024 10:46:54 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.17.0-beta25.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-beta25.
- solo.io/ext-auth-service has been upgraded to 0.56.9.
- stretchr/testify has been upgraded to v1.8.4.
- solo-io/gloo has been upgraded to v1.17.0-beta24.
- solo-io/protoc-gen-openapi has been upgraded to v0.2.2.
- solo.io/ext-auth-service has been upgraded to 0.57.0.
- stretchr/testify has been upgraded to v1.8.4.
- solo-io/protoc-gen-openapi has been upgraded to v0.2.2.
Fixes
- Fix portal stitched schema path when prefix rewrite or full rewrite is used. (https://github.com/solo-io/solo-projects/issues/6132)
- Fix a bug where multiple statuses on a product were not being merged correctly due to pointer map references. (https://github.com/solo-io/solo-projects/issues/6046)
- Fix an issue where a malformed Authorization header causes a panic in HMAC authorization. (https://github.com/solo-io/ext-auth-service/issues/740)
- Make sure the sds image tag for dynamically provisioned proxies gets populated correctly. (https://github.com/solo-io/solo-projects/issues/6103)
- Fix RouteOption resource statuses used for policy attachment (via targetRef) with separate status syncer. (https://github.com/solo-io/solo-projects/issues/6084)
- Fixs the issue of all routes and route tables warning of an invalid route when an unsupported route action is defined on a listener with the grpcjson plugin enabled. (https://github.com/solo-io/gloo/issues/9160)
- Fix a bug that caused the validation server to incorrectly reject deletion operations for Kube type Upstreams (https://github.com/solo-io/gloo/issues/6543)
Helm Changes
- Disable kubernetes gateway api integration by default. (https://github.com/solo-io/solo-projects/issues/6080)
New Features
- Add warning (or failure) statuses to Portal resources during translation when ReferenceGrants are needed, but not found. (https://github.com/solo-io/solo-projects/issues/6046)
- Populate SecurityRequirements in OpenAPI Docs generated by Developer Portal. (https://github.com/solo-io/solo-projects/issues/6050)
- Allow the Remote JWKS AuthService to start up without a valid JWKs endpoint. This is useful for cases where the JWKs endpoint is not available at startup time, but will be available later. If the AuthService is being started for the first time (either at resource creation or pod startup), it will immediately become active and deny all requests, as it has no JWKs to validate tokens. If an existing AuthService is modified with an invalid JWKs endpoint, it will enter a "pending" state and the existing JWKs will be used until the new JWKs are available. (https://github.com/solo-io/gloo/issues/7803)
- Adds the API for a new enterprise only feature designed to allow authenticating requests using tokens from the google metadata service before sending the requests upstreams. This feature will be exposed as a new Upstream type. (https://github.com/solo-io/gloo/issues/6828)
- Upstream Support: enable the use of Gloo Edge v1 Upstreams as destinations for using routes and mirror policy from the K8s Gateway API. (https://github.com/solo-io/solo-projects/issues/6129)
- Add VirtualHostOptions status tracking for Kubernetes Gateways (https://github.com/solo-io/solo-projects/issues/6044)
- Route delegation: explicitly pass route's hostnames to plugins so that delegatee (child) routes without hostnames can be associated with their corresponding hostnames. (https://github.com/solo-io/solo-projects/issues/6121)
- Route delegation: enable HTTP route delegation with Gateway API, such that a parent route may delegate routing decisions to other routes that match the parent route rules consisting of path prefix, headers, and query parameters. (https://github.com/solo-io/solo-projects/issues/6121)
- Adds a new Listener level access log option. Previously Edge was able to configure Proxy level logging for TCP proxies and HTTPConnectionManager(hcm) level logging for HTTP. With this change there is a new listeneroption that will configure http listener level logs. While http hcm has generally more useful logs there are certain logging command operators that are not usable at certain levels. The old version of logging and the new version are also both configurable concurrently but will have a higher performance overhead. This change also introduces a new warning log for command operators that are not useful for a given levels. For now this warning is purely a log line to reduce thrash before hardening these checks. (https://github.com/solo-io/gloo/issues/8438)

v1.17.0-beta1 (v1.17.0)

Mon, 22 Apr 2024 22:00:51 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.27.3-patch2.
- solo-io/ext-auth-service has been upgraded to v0.56.1.
- solo-io/gloo has been upgraded to v1.17.0-beta21.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-beta21.
- solo-io/envoy-gloo has been upgraded to v1.29.3-patch1.
- solo-io/envoy-gloo has been upgraded to v1.27.3-patch1.
- solo-io/gloo has been upgraded to v1.17.0-beta4.
- solo-io/gloo has been upgraded to v1.17.0-beta16.
- solo-io/envoy-gloo-ee has been upgraded to v1.29.2-patch1.
- solo-io/gloo has been upgraded to v1.17.0-beta15.
- solo-io/ext-auth-service has been upgraded to v0.56.6.
- solo.io/ext-auth-service has been upgraded to 0.55.4.
- solo-io/gloo has been upgraded to v1.17.0-beta18.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-beta18.
- solo-io/gloo has been upgraded to v1.17.0-beta20.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-beta20.
- solo-io/gloo has been upgraded to v1.17.0-beta17.
- solo-io/gloo has been upgraded to v1.17.0-beta19.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-beta19.
- solo-io/gloo has been upgraded to v1.17.0-beta7.
- solo-io/ext-auth-service has been upgraded to v0.56.0.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-beta7.
- solo-io/gloo-mesh-enterprise/v2 has been upgraded to v2.6.0-beta2.0.20240326202215-ef7a35aa7566.
- golang/go has been upgraded to go1.22.1.
- solo-io/cloud-builders has been upgraded to v0.9.0.
- solo-io/ext-auth-service has been upgraded to v0.56.5.
- solo-io/external-apis has been upgraded to v0.2.7.
- solo-io/skv2 has been upgraded to v0.36.5.
- golang/go has been upgraded to go1.22.2.
- solo-io/external-apis has been upgraded to v0.2.6.
- solo-io/gloo-mesh-enterprise has been upgraded to v2.6.0-beta0.0.20240221150203-6eccefd5da46.
- solo-io/licensing has been upgraded to v0.5.2.
- solo-io/rate-limiter has been upgraded to v0.11.8.
- solo-io/skv2 has been upgraded to v0.36.4.
- solo-io/gloo has been upgraded to v1.17.0-beta5.
- solo-io/solo-apis has been upgraded to gloo-1.17.0-beta5.
- solo-io/gloo has been upgraded to v1.17.0-beta12.
- solo-io/ext-auth-service has been upgraded to v0.56.3.
- solo-io/gloo has been upgraded to v1.17.0-beta11.
- helm.sh/helm/v3 has been upgraded to v3.14.2.
- solo-io/gloo has been upgraded to v1.17.0-beta22.
- onsi/ginkgo/v2 has been upgraded to v2.17.0.
- golang.org/x/tools has been upgraded to v0.17.0.
- solo-io/gloo has been upgraded to v1.17.0-beta8.
- solo-io/solo-apis has been upgraded to gloo-v1.17.0-beta8.
- sigs.k8s.io/controller-runtime has been upgraded to v0.16.4.
- envoy-gloo-ee/solo-io has been upgraded to 1.27.2-patch2.
- aws/aws-sdk-go has been upgraded to v1.47.10.
- gin-gonic/gin has been upgraded to v1.9.1.
- solo-io/go-utils has been upgraded to v1.25.1.
- solo-io/licensing has been upgraded to v0.4.2.
- solo-io/rate-limiter has been upgraded to v0.11.7.
- solo-io/skv2 has been upgraded to v0.36.3.
- google.golang.org/protobuf has been upgraded to v1.32.0.
- onsi/ginkgo/v2 has been upgraded to v2.15.0.
- onsi/gomega has been upgraded to v1.31.0.
- solo-io/gloo has been upgraded to v1.17.0-beta2.
- solo-apis/gloo has been upgraded to gloo-v1.17.0-beta2.
- solo-io/gloo has been upgraded to v1.17.0-beta10.
- solo-apis/gloo has been upgraded to gloo-v1.17.0-beta10.
Fixes
- Fixes the issue where the GrpcPassthrough Authconfig doesn't recongnize seconds in base and max intervals (https://github.com/solo-io/solo-projects/issues/5841)
- Revert "Hardcode Envoy's reloadable feature for TE header sanitization to false" (#9307) (https://github.com/solo-io/gloo/issues/9232)
- Fixes a bug where specifying the setting `gloo.settings.observabilityOptions.grafanaIntegration.defaultDashboardFolderId` does not move the default grafana dashboards into the specified folder. (https://github.com/solo-io/gloo/issues/6536)
- Fix bug in extauth that caused gRPC passthrough auth to return an error when sequenced after OIDC auth (https://github.com/solo-io/gloo/issues/9070)
- Fixes the invalid query in the 'Gloo Overview' dashboard in grafana when the extraMetricQueryParameters is set. It also adds test to validate that the grafana queries are PromQL compliant. (https://github.com/solo-io/solo-projects/issues/5783)
- Fix null pointer error in GraphQL Openapi schema discovery. Also fixes issue where
- Update Upstream templates for Enterprise services to have the same health check config (interval: 10s, healthyThreshold: 3, unhealthyThreshold: 3). This fixes a bug whereby on pod restart, traffic would continue to be sent to deleted rate-limit pods, causing those requests to not be processed by rate-limit. (https://github.com/solo-io/gloo/issues/8942)
- Fixes an issue where if the gateway is applied to a namespace that is different from the namespace of the portal backend, the Portal resource would not be processed. (https://github.com/solo-io/solo-projects/issues/6057)
- Fix Helm chart bugs which cause rate limiting to break when both redis client-side sharding and dataplane per proxy
Helm Changes
- Update the default value of the `redis.deployment.image.tag` to `7.2.4-alpine` (https://github.com/solo-io/solo-projects/issues/5670)
- Introduce `global.extensions.extAuth.serverUpstreamName` and `global.extensions.rateLimit.serverUpstreamName` as APIs to configure the name of the Upstream that the ExtAuth and RateLimit filters will reference. (https://github.com/solo-io/solo-projects/issues/5874)
- Changes to support and test use of `sds-ee` and `sds-ee-fips` images (https://github.com/solo-io/gloo/issues/8909)
New Features
- Adds statuses for the `ApiProduct`, `Portal`, `PortalConfig` and stitched `ApiDoc` custom resources. Status for `ApiDoc` resources generated by API Discovery (ie: Service Annotations) will be added to GME and integrated into GGv2 at a later point. Also fixed the following bugs: 1. Fixed a bug where we were incorrectly using pointers for the portal object in a map. 2. Fixed a bug where using the prefix and exact matcher on the HttpRoute would not result in the openAPI path containing said prefix or exact path 3. Fixed a bug where we were translating PortalConfig per HttpRoute instead of staging all HttpRoutes for a Portal before translating the PortalConfig (https://github.com/solo-io/solo-projects/issues/5980)
- Introduces a new setting `gloo.settings.observabilityOptions.grafanaIntegration.dashboardPrefix` that specifies the prefix for the title and UID of Grafana Dashboards created. It is restricted to 20 characters in length. This is useful when the data is aggregated to a central grafana instance so they do not conflict across multiple Gloo environments. Note that any dashboard created without a prefix or with a different prefix will need to be manually removed on changing this value. (https://github.com/solo-io/gloo/issues/9022)
- Introduces a new setting `gloo.settings.observabilityOptions.grafanaIntegration.extraMetricQueryParameters` that specifies additional query parameters to add to all metric query definitions in the Grafana dashboards generated by gloo. It is a string and can consist of multiple query parameters separated by a comma. For example `cluster="some-cluster",gateway_proxy_id="proxy-2"`. (https://github.com/solo-io/gloo/issues/9016)
- Add support for distroless images in gloo fed. The `global.image.variant` helm value specifies the variant of the image to be deployed. It can take the values 'standard' and 'distroless'. It defaults to 'standard'. Setting the value to 'fips' has the same result as 'default' and 'fips-distroless' as 'distroless' as fed does not have a fips variant as of now. (https://github.com/solo-io/gloo/issues/8849)
- Supports distroless images. The `global.image.variant` helm value specifies the variant of the image to be deployed. Can take the values 'standard', 'fips', 'distroless', 'fips-distroless'. Defaults to 'standard'. This consequently deprecates the `global.image.fips` value. Use `global.image.variant=fips` instead. (https://github.com/solo-io/gloo/issues/8849)
- Enable ext_proc filter features MutationRules, DisableClearRouteCache, ForwardRules, FilterMetadata, AllowModeOverride. Note that regardless of AllowModeOverride value, ModeOverride is only respected in request headers messages. (https://github.com/solo-io/solo-projects/issues/5692)
- Support configuration of dynamically provisioned proxies via a GatewayParameters CR in Gloo Gateway Enterprise. (https://github.com/solo-io/solo-projects/issues/5909)
- Add the option to allow retries for gRPC Passthrough Auth in case the service is unavailable. This can be configured via the new `retryPolicy` in the PassThroughGrpc AuthConfig. Note that the global settings `extauth.requestTimeout` must be greater than the `retryPolicy.numRetries` * `retryPolicy.retryBackOff.baseInterval` to ensure that the failed gRPC call has sufficient time to retry. (https://github.com/solo-io/gloo/issues/6804)
- Implement the Portal controller to allow XDS resync on changes to Portal resources. (https://github.com/solo-io/gloo/issues/9330)
- Update Oauth2 state parameter to use a signed JWT to store the redirect URL (https://github.com/solo-io/gloo/issues/8673)
- Allow configuring the authority header for ratelimit gRPC calls. (https://github.com/solo-io/gloo/issues/8995)
- Users can deploy Portal v2 using with `gateway-portal-web-server.glooPortalServer.enabled`, and its CRDs with `gateway-portal-web-server.installEnterpriseCrds`. (https://github.com/solo-io/solo-projects/issues/5717)
- Tap filter alpha release. Implements support for HTTP and GRPC output sinks. Both sinks fully buffer messages before sending them out to the tap server. Only supports defining the tap filter on the Gateway at this time. A number of fields (such as the output format type) are also not supported at this time. (https://github.com/solo-io/solo-projects/issues/5315)

v1.16.21 (v1.16.0)

Tue, 01 Jul 2025 13:17:28 GMT

Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.55.4-patch10.
- solo-io/gloo has been upgraded to v1.16.26.
- solo-io/cloudbuilders has been upgraded to v0.13.0.
- golang/go has been upgraded to v1.24.4.
- golang.org/crypto has been upgraded to v0.35.0.
- golang/go has been upgraded to v1.24.1.
- solo-io/cloud-builders has been upgraded to v0.12.1.

v1.16.20 (v1.16.0)

Thu, 12 Jun 2025 13:16:06 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to 1.27.7-patch8.

v1.16.19 (v1.16.0)

Wed, 09 Apr 2025 15:54:10 GMT

Extra Notes
- This release contained no user-facing changes.

v1.16.18 (v1.16.0)

Tue, 01 Apr 2025 12:15:28 GMT

Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.55.4-patch9.
- golang.org/x/net has been upgraded to v0.36.0.
- golang.org/x/sync has been upgraded to v0.11.0.
- solo-io/envoy-gloo-ee has been upgraded to v1.27.7-patch6.

v1.16.17 (v1.16.0)

Wed, 12 Mar 2025 18:57:49 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.16.24.
- golang/go has been upgraded to v1.23.7.
- golang/go has been upgraded to v1.23.3.
- golang/go has been upgraded to v1.23.3.
- golang/go has been upgraded to v1.23.7.
Fixes
- Bump the alpine base container image to 3.21.3 (https://github.com/solo-io/solo-projects/issues/7956)
- Update the nginx base image for the gloo-federation-console image to resolve CVEs. (https://github.com/solo-io/solo-projects/issues/7992)
- When an apiKeyAuth AuthConfig is applied which selects a secret whose api-key data does not decode into valid UTF-8, it is now handled gracefully and valid API Keys still work. skipCI-docs-build:true (https://github.com/kgateway-dev/kgateway/issues/10143)
- Update branch nightly test logic to handle branch input when called from a scheduled job. skipCI-kube-tests:true skipCI-storybook-tests:true skipCI-in-memory-e2e-tests:true (https://github.com/solo-io/solo-projects/issues/6395)
- Bump the alpine base container image to 3.21.3 (https://github.com/solo-io/solo-projects/issues/7956)

v1.16.16 (v1.16.0)

Tue, 24 Dec 2024 16:58:21 GMT

Dependency Bumps
- solo-io/solo-kit has been upgraded to v0.34.4.
- solo-io/solo-apis has been upgraded to gloo-v1.16.23.
- solo-io/gloo has been upgraded to v1.16.23.
- solo-io/ext-auth-service has been upgraded to v0.55.4-patch8.
- solo-io/gloo has been upgraded to v1.16.22.
- solo-io/solo-apis has been upgraded to gloo-v1.16.22.
- golang.org/x/net has been upgraded to v0.33.0.
- golang.org/crypto has been upgraded to v0.31.0.
- solo-io/solo-kit has been upgraded to v0.34.4.
Fixes
- Add translation for the `skipMetadataValdiaiton` field for `apiKeyAuth` AuthConfigs and pull in updated `ext-auth-service` dependency.
- Remove docs for external APIs (https://github.com/solo-io/solo-projects/issues/6768)

v1.16.15 (v1.16.0)

Thu, 03 Oct 2024 19:03:08 GMT

Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.55.4-patch7.
- solo-io/envoy-gloo-ee has been upgraded to v1.27.7-patch4.
- solo-io/gloo has been upgraded to v1.16.20.
- solo-io/solo-apis has been upgraded to gloo-v1.16.20.
- solo-io/gloo has been upgraded to v1.16.21.
- solo-io/solo-apis has been upgraded to gloo-v1.16.21.
- solo-io/go-utils has been upgraded to v0.25.3.
Fixes
- Upgrade envoy-gloo-ee to pull in cve changes. CVE-2024-45808: Malicious log injection via access logs CVE-2024-45806: Potential manipulate x-envoy headers from external sources CVE-2024-45809: Jwt filter crash in the clear route cache with remote JWKs CVE-2024-45810: Envoy crashes for LocalReply in http async client (https://github.com/solo-io/solo-projects/issues/6290)
- Fix for issue where a missing TLS secret was treated by validation as an error, potentially bringing down the entire HTTPS gateway if the gloo pod restarts while in this bad state. This is a breaking change in the default behavior of validation. To enable this behavior, use the helm setting `gateway.validation.warnMissingTlsSecret=true` or the same field on the Settings CR. This field has no effect if allowWarnings is false or acceptAllResources is true. (https://github.com/solo-io/gloo/issues/6957)
- Fix a bug that caused discovered Upstreams to not reflect the updated state of parent Services discovered using watchLabels (https://github.com/solo-io/gloo/issues/8635)
- Fix for issue where a missing TLS secret was treated by validation as an error, potentially bringing down the entire HTTPS gateway if the gloo pod restarts while in this bad state. This is a breaking change in the default behavior of validation. To enable this behavior, use the helm setting `gateway.validation.warnMissingTlsSecret=true` or the same field on the Settings CR. This field has no effect if allowWarnings is false or acceptAllResources is true. (https://github.com/solo-io/gloo/issues/6957)
Helm Changes
- New field gateway.validation.warnMissingTlsSecret controls whether missing TLS secrets referenced in SslConfig and UpstreamSslConfig will be treated as a warning instead of an error during validation. Defaults to false. This field has no effect if allowWarnings is false or acceptAllResources is true. (https://github.com/solo-io/gloo/issues/6957)
- New field gateway.validation.warnMissingTlsSecret controls whether missing TLS secrets referenced in SslConfig and UpstreamSslConfig will be treated as a warning instead of an error during validation. Defaults to false. This field has no effect if allowWarnings is false or acceptAllResources is true. (https://github.com/solo-io/gloo/issues/6957)

v1.16.14 (v1.16.0)

Thu, 15 Aug 2024 18:23:11 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.16.19.
- solo-io/envoy-gloo-ee has been upgraded to v1.27.7-patch2.
- solo-io/envoy-gloo has been upgraded to v1.27.7-patch2.
Fixes
- Update Envoy to enable thread-local slots to be deallocated on worker threads. This provides greater stability in Envoy when the main thread is under heavy load. This behaviour can be disabled by toggling the runtime flag envoy_restart_features_allow_slot_destroy_on_worker_threads. (https://github.com/solo-io/solo-projects/issues/6713)
- Update Envoy to enable thread-local slots to be deallocated on worker threads. This provides greater stability in Envoy when the main thread is under heavy load. This behaviour can be disabled by toggling the runtime flag envoy_restart_features_allow_slot_destroy_on_worker_threads. (https://github.com/solo-io/solo-projects/issues/6713)
- Fix a bug where the service and function names of a discovered gRPC service are not printed in JSON and YAML
- Fix regex safety check for CORS allowed origins. Other instances in gloo already checked the regex either through compile or envoy validate. (https://github.com/solo-io/gloo/issues/7524)
- Infer the gloo deployment name in cases where the deployment name is not the default `gloo`. The gloo deployment is identified by the `gloo=gloo` label. (https://github.com/solo-io/gloo/issues/9163)
- Optimizes the `glooctl check` command by reducing the time taken to check resources by almost half in large environments consisting of over 500 namespaces (https://github.com/solo-io/gloo/issues/9673)
- Fix a bug where the service and function names of a discovered gRPC service are not printed when running glooctl get upstreams (https://github.com/solo-io/gloo/issues/9644)
Helm Changes
- Introduce `gatewayProxies.gatewayProxy.istioSpiffeCertProviderAddress` which overrides the Istio SPIFFE certificate provider (`CA_ADDR` env variable). It defaults to `gatewayProxies.gatewayProxy.discoveryAddress`. (https://github.com/solo-io/gloo/issues/9855)

v1.16.13 (v1.16.0)

Thu, 25 Jul 2024 18:35:12 GMT

Dependency Bumps
- solo.io/ext-auth-service has been upgraded to 0.55.4-patch6.
Fixes
- Allows user to opt into the ability to merge Auth Responses differently. When not enabled denied auth chains would return 403 instead of 401 when merging two 401 responses from AuthServices. This behavior can be enabled by setting the environment variable `DONT_MERGE_DENIED_AUTH_RESPONSES` to `false` on the Extauth Service. To do this via helm use the following field: global.extensions.extAuth.deployment.customEnv. (https://github.com/solo-io/ext-auth-service/issues/669)

v1.16.12 (v1.16.0)

Fri, 19 Jul 2024 20:31:15 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to 1.27.7-patch1.
- solo-io/cloud-builders has been upgraded to v0.8.8.
- solo-io/gloo has been upgraded to v1.16.17-beta3.
- solo-io/solo-apis has been upgraded to gloo-v1.16.17.
- golang/go has been upgraded to go1.21.11.
- solo-io/cloud-builders has been upgraded to v0.8.8.
- bitnami/kubectl has been upgraded to 1.28.11.
- golang/go has been upgraded to v1.21.11.
- solo-io/cloud-builders has been upgraded to v0.8.8.
Fixes
- Fix bug that caused Helm not to render the sidecar config required by rate-limit when redis was disabled (ie when using custom redis). (https://github.com/solo-io/gloo/issues/9524)

v1.16.11 (v1.16.0)

Wed, 19 Jun 2024 13:53:08 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.16.16.
Fixes
- Fix an issue where the wrong query param was discovered for a rest resolver. (https://github.com/solo-io/solo-projects/issues/6275)
- Fixing MaxDepth not processed and propagated to envoy. (https://github.com/solo-io/solo-projects/issues/6372)

v1.16.11-alpine1 (v1.16.0)

Thu, 20 Jun 2024 13:35:34 GMT

Fixes
- Adds the `host_rewrite_header` to the route options to allow envoy to swapped the host header with the content of given downstream or custom header. Pay attention to the potential security implications of using this option. Provided header must come from trusted source. (https://github.com/solo-io/gloo/issues/9579)
- Previously, header names consisting of invalid characters such as '()[]:;,<=>' were accepted when passed via the healthCheck or headerManipulation `requestHeadersToAdd` parameter. This resulted in envoy throwing an `invalid header name` error. Now, header names are validated according to RFC 9110, which is the same validation used by envoy. If a header name consisting of invalid characters is passed via the aforementioned parameters, it is caught and rejected in edge and does not propagate to envoy. (https://github.com/solo-io/gloo/issues/9622)

v1.16.10 (v1.16.0)

Wed, 12 Jun 2024 18:55:42 GMT

Dependency Bumps
- solo-io/envoy-gloo has been upgraded to v1.27.6-patch1.
- solo-io/gloo has been upgraded to v1.16.15.
- solo-io/k8s-utils has been upgraded to v0.6.3.
- solo-io/gloo has been upgraded to v1.16.14.
- solo-io/solo-apis has been upgraded to gloo-v1.16.14.
- solo-io/envoy-gloo has been upgraded to v1.27.6-patch1.
- solo-io/k8s-utils has been upgraded to v0.6.3.
- solo-io/envoy-gloo has been upgraded to v1.27.5-patch2.
Fixes
- Bump envoy to 1.27.6 to address non-exploitable CVEs. - [CVE-2024-34362: Crash (use-after-free) in EnvoyQuicServerStream](GHSA-hww5-43gv-35jv) - [CVE-2024-34363: Crash due to uncaught nlohmann JSON exception](GHSA-g979-ph9j-5gg4) - [CVE-2024-34364: Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response, and other components](GHSA-xcj3-h7vf-fw26) - [CVE-2024-32974: Crash in EnvoyQuicServerStream::OnInitialHeadersComplete()](GHSA-mgxp-7hhp-8299) - [CVE-2024-32975: Crash in QuicheDataReader::PeekVarInt62Length()](GHSA-g9mq-6v96-cpqc) - [CVE-2024-32976: Endless loop while decompressing Brotli data with extra input](GHSA-7wp5-c2vq-4f8m) - [CVE-2024-23326: Envoy incorrectly accepts HTTP 200 response for entering upgrade mode](GHSA-vcf8-7238-v74c) (https://github.com/solo-io/solo-projects/issues/6290)
- Add helm values for all containers to allow for conforming to [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) (https://github.com/solo-io/gloo/issues/8864)
- Add helm values for all containers to allow for conforming to [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) (https://github.com/solo-io/gloo/issues/8864)
- Fix a bug where Lambdas returning multiValueHeaders with non-string type with `unwrapAsApiGateway` enabled would result in a 500 response to the caller (https://github.com/solo-io/gloo/issues/8867)

v1.16.9 (v1.16.0)

Tue, 07 May 2024 20:53:22 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.16.12.

v1.16.9-alpine2 (v1.16.0)

Sat, 11 May 2024 23:42:22 GMT

Dependency Bumps
- bitnami/kubectl has been upgraded to 1.28.9.
Fixes
- Fixs the issue of all routes and route tables warning of an invalid route when an unsupported route action is defined on a listener with the grpcjson plugin enabled. (https://github.com/solo-io/gloo/issues/9160)

v1.16.8 (v1.16.0)

Mon, 29 Apr 2024 20:05:53 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.27.5-patch1.
- solo.io/ext-auth-service has been upgraded to v0.55.4-patch5.
Fixes
- Auto SNI CVE https://github.com/envoyproxy/envoy/security/advisories/GHSA-3mh5-6q8v-25wj. Previously static upstreams with auto_sni enabled could be vunerable to CVE-2024-32475 (https://github.com/solo-io/solo-projects/issues/6077)
- Fix an issue where a malformed Authorization header causes a panic in HMAC authorization. (https://github.com/solo-io/ext-auth-service/issues/740)

v1.16.7 (v1.16.0)

Mon, 15 Apr 2024 14:26:33 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.27.4-patch1.
- golang/go has been upgraded to v1.21.9.
- solo-io/cloud-builders has been upgraded to v0.8.4.
- solo-io/gloo has been upgraded to v1.16.10.
Fixes
- HTTP2 continuation CVE fixed. See https://github.com/envoyproxy/envoy/security/advisories/GHSA-j654-3ccm-vfmm (https://github.com/solo-io/solo-projects/issues/6008)

v1.16.7-alpine1 (v1.16.0)

Wed, 17 Apr 2024 21:45:22 GMT

Dependency Bumps
- solo-io/envoy-gloo has been upgraded to v1.27.4-patch1.
- golang/go has been upgraded to v1.21.9.
- solo-io/cloud-builders has been upgraded to v0.8.4.

v1.16.6 (v1.16.0)

Fri, 05 Apr 2024 20:37:48 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.16.9.
- solo-io/ext-auth-service has been upgraded to v0.55.4-patch4.
Fixes
- Fix a breaking change present in 1.16.4 and 1.16.5 whereby rate-limit, extauth, and caching-service deployments

v1.16.5 (v1.16.0)

Tue, 26 Mar 2024 19:17:43 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to 1.27.3-patch2.
- solo-io/gloo has been upgraded to v1.16.8.
- solo-io/gloo has been upgraded to v1.16.9.
- envoy-gloo/solo-io has been upgraded to 1.27.3-patch2.
Fixes
- Fix error messages for unimplemented ext_proc features to indicate availability in 1.17 (https://github.com/solo-io/solo-projects/issues/5692)
- Move resource cleanup job to pre-delete Helm hook. This fixes an issue where Helm uninstall would not complete when the validation webhook's failure policy was set to "Fail". (https://github.com/solo-io/solo-projects/issues/5903)

v1.16.4 (v1.16.0)

Tue, 12 Mar 2024 15:44:32 GMT

Dependency Bumps
- helm.sh/helm has been upgraded to v3.14.2.
- solo-io/gloo has been upgraded to v1.16.6.
- solo-io/solo-apis has been upgraded to gloo-v1.16.6.
- solo-io/gloo has been upgraded to v1.16.7.
- solo-io/ext-auth-service has been upgraded to v0.55.4-patch3.
- solo-io/gloo has been upgraded to v1.16.5.
- solo-io/solo-apis has been upgraded to gloo-v1.16.5.
Fixes
- Fix null pointer error in GraphQL Openapi schema discovery. Also fixes issue where
- Updates to oauth2 ext-auth tests to support storing the redirect/final destination URL in the state instead of gloo_urlToRedirect (https://github.com/solo-io/gloo/issues/8673)
- Pull in `gloo` changes to enable updated secret deletion validation (https://github.com/solo-io/gloo/issues/8931)

v1.16.4-alpine1 (v1.16.0)

Tue, 12 Mar 2024 21:08:24 GMT

Dependency Bumps
- helm.sh/helm has been upgraded to v3.14.2.
- rotisserie/eris has been upgraded to v0.5.4.
- solo-io/solo-kit has been upgraded to v0.34.2.
Fixes
- Expose use_hostname_for_hashing, the hostname will be used for hashing when using maglev for example, useful when using multiple host in the upstreams that resolve to the same IP. (https://github.com/solo-io/gloo/issues/9138)
- Update to allow deletion of secrets when warnings or errors are present.
Helm Changes
- Add helm flags for setting log level on sds container `.Values.global.glooMtls.sds.logLevel` and setting log level on istio-proxy container `global.glooMtls.istioProxy.logLevel`. (https://github.com/solo-io/gloo/issues/9006)

v1.16.3 (v1.16.0)

Thu, 29 Feb 2024 13:36:46 GMT

Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.55.4-patch2.
Fixes
- Fixes the issue where the GrpcPassthrough Authconfig doesn't recongnize seconds in base and max intervals (https://github.com/solo-io/solo-projects/issues/5841)
- Fixes the invalid query in the 'Gloo Overview' dashboard in grafana when the extraMetricQueryParameters is set. It also adds test to validate that the grafana queries are PromQL compliant. (https://github.com/solo-io/solo-projects/issues/5783)
- Fix Helm chart bugs which cause rate limiting to break when both redis client-side sharding and dataplane per proxy

v1.16.2 (v1.16.0)

Thu, 15 Feb 2024 00:04:21 GMT

Dependency Bumps
- solo-io/envoy-gloo has been upgraded to v1.27.3-patch1.
- solo-io/gloo has been upgraded to v1.16.4.
- solo-io/ext-auth-service has been upgraded to v0.55.4-patch1.
- solo-io/solo-apis has been upgraded to gloo-v1.16.4.
Fixes
- Add the option to allow retries for gRPC Passthrough Auth in case the service is unavailable. This can be configured via the new `retryPolicy` in the PassThroughGrpc AuthConfig. Note that the global settings `extauth.requestTimeout` must be greater than the `retryPolicy.numRetries` * `retryPolicy.retryBackOff.baseInterval` to ensure that the failed gRPC call has sufficient time to retry. (https://github.com/solo-io/gloo/issues/6804)
- Allow configuring the authority header for ratelimit gRPC calls. (https://github.com/solo-io/gloo/issues/8995)

v1.16.2-alpine1 (v1.16.0)

Sun, 18 Feb 2024 16:19:48 GMT

Dependency Bumps
- solo-io/envoy-gloo has been upgraded to v1.27.3-patch1.
Fixes
- Add the option to allow retries for gRPC Passthrough Auth in case the service is unavailable. This can be configured via the new `retryPolicy` in the PassThroughGrpc AuthConfig. (https://github.com/solo-io/gloo/issues/6804)
- Expose the `global.istioIntegration.AppendXForwardedHost` Helm value to allow users to toggle off the appending of
- Expose a new ratelimit option `grpcService.authority` to configure the authority header for the ratelimit gRPC call. (https://github.com/solo-io/gloo/issues/8995)
- Re-enable wget in our gloo and gateway-proxy pods. Wget is currently used in our non-custom probes which are currently not well covered in tests. Caused by https://github.com/solo-io/solo-projects/issues/5344 shift to ubuntu. (https://github.com/solo-io/gloo/issues/9092)

v1.16.1 (v1.16.0)

Fri, 02 Feb 2024 19:38:08 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.16.1.
- solo.io/ext-auth-service has been upgraded to 0.55.4.
- solo-io/gloo has been upgraded to v1.16.3.
- solo-io/solo-apis has been upgraded to gloo-v1.16.3.
- solo-io/gloo has been upgraded to v1.16.2.
- solo-apis/gloo has been upgraded to gloo-v1.16.2.
Fixes
- Introduces a new setting `gloo.settings.observabilityOptions.grafanaIntegration.dashboardPrefix` that specifies the prefix for the title and UID of Grafana Dashboards created. It is restricted to 20 characters in length. This is useful when the data is aggregated to a central grafana instance so they do not conflict across multiple Gloo environments. Note that any dashboard created without a prefix or with a different prefix will need to be manually removed on changing this value. (https://github.com/solo-io/gloo/issues/9022)
- Introduces a new setting `gloo.settings.observabilityOptions.grafanaIntegration.extraMetricQueryParameters` that specifies additional query parameters to add to all metric query definitions in the Grafana dashboards generated by gloo. It is a string and can consist of multiple query parameters separated by a comma. For example `cluster="some-cluster",gateway_proxy_id="proxy-2"`. (https://github.com/solo-io/gloo/issues/9016)
- Fixes a bug where specifying the setting `gloo.settings.observabilityOptions.grafanaIntegration.defaultDashboardFolderId` does not move the default grafana dashboards into the specified folder. (https://github.com/solo-io/gloo/issues/6536)
- Fix bug in extauth that caused gRPC passthrough auth to return an error when sequenced after OIDC auth (https://github.com/solo-io/gloo/issues/9070)
- Update Upstream templates for Enterprise services to have the same health check config (interval: 10s, healthyThreshold: 3, unhealthyThreshold: 3). This fixes a bug whereby on pod restart, traffic would continue to be sent to deleted rate-limit pods, causing those requests to not be processed by rate-limit. (https://github.com/solo-io/gloo/issues/8942)
- When deploying edge with tilt + helm, the resource-rollout-job is deleted before the install completes which causes the deployment to fail. The cleanup for the resource-rollout job is now moved to a pre-upgrade hook to ensure that the job exists so deployments now succeed. (https://github.com/solo-io/gloo/issues/9033)
- When deploying edge with tilt + helm, the resource-rollout-job is deleted before the install completes which causes the deployment to fail. The cleanup for the resource-rollout job is now moved to a pre-upgrade hook to ensure that the job exists so deployments now succeed. (https://github.com/solo-io/gloo/issues/9033)
- Introduces a new Enterprise setting `settings.observabilityOptions.grafanaIntegration.dashboardPrefix` that specifies the prefix for the title and UID of Grafana Dashboards created. It is restricted to 20 characters in length. This is useful when the data is aggregated to a central grafana instance so they do not conflict across multiple Gloo environments. Note that any dashboard created without a prefix or with a different prefix will need to be manually removed on changing this value. (https://github.com/solo-io/gloo/issues/9022)
- Introduces a new Enterprise setting `gloo.settings.observabilityOptions.grafanaIntegration.extraMetricQueryParameters` that specifies additional query parameters to add to all metric query definitions in the Grafana dashboards generated by gloo. It is a string and can consist of multiple query parameters separated by a comma. For example `cluster="some-cluster",gateway_proxy_id="proxy-2"`. (https://github.com/solo-io/gloo/issues/9016)
- Add missing required runtime key for aggression in slow start config. (https://github.com/solo-io/gloo/pull/9031)
Helm Changes
- Changes to support and test use of `sds-ee` and `sds-ee-fips` images (https://github.com/solo-io/gloo/issues/8909)
- Updates to helper functions to recognize `sds-ee` images as fips-suppported (https://github.com/solo-io/gloo/issues/8909)

v1.16.0 (v1.16.0)

Fri, 12 Jan 2024 21:02:25 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.16.0.
- solo-apis/gloo has been upgraded to gloo-v1.16.0.
- solo-io/gloo has been upgraded to v1.16.0-rc3.
- solo-apis/gloo has been upgraded to gloo-v1.16.0-rc3.
- envoy-gloo-ee/solo-io has been upgraded to 1.27.2-patch2.
- golang.org/crypto has been upgraded to v0.17.0.
Fixes
- Add renewal logic for Hashicorp vault tokens. The settings.secretOptions.sources[].vault.aws.leaseIncrement field can be used to specify the lease increment for Hashicorp token renewal. This value is passed as the 'Increment' parameter to the Hashicorp vault API.
Helm Changes
- Added settings.secretOptions.sources[].vault.aws.leaseIncrement to allow users to specify the lease increment for Hashicorp token renewal. This value is passed as the 'Increment' parameter to the Hashicorp vault API. (https://github.com/solo-io/solo-projects/issues/5438)
New Features
- Tap filter alpha release. Implements support for HTTP and GRPC output sinks. Both sinks fully buffer messages before sending them out to the tap server. Only supports defining the tap filter on the Gateway at this time. A number of fields (such as the output format type) are also not supported at this time. (https://github.com/solo-io/solo-projects/issues/5315)

v1.16.0-rc1 (v1.16.0)

Fri, 15 Dec 2023 21:24:41 GMT

Breaking Changes
- Bump dependencies to support Kubernetes 1.28 (https://github.com/solo-io/gloo/issues/8515)
- Bump dependencies to support Kubernetes 1.28 (https://github.com/solo-io/gloo/issues/8515)
Dependency Bumps
- golang/go has been upgraded to v1.21.5.
- solo-io/caching-service has been upgraded to v0.6.0.
- solo-io/ext-auth-service has been upgraded to v0.55.0.
- solo-io/external-apis has been upgraded to gloo-v0.2.1.
- solo-io/gloo has been upgraded to v1.16.0-beta28.
- solo-io/go-utils has been upgraded to v0.24.8.
- solo-io/k8s-utils has been upgraded to v0.6.0.
- solo-io/rate-limiter has been upgraded to v0.11.4.
- solo-io/skv2 has been upgraded to v0.36.0.
- solo-io/solo-kit has been upgraded to v0.34.0.
- solo-io/cloud-builders has been upgraded to v0.8.1.
- k8s.io/api has been upgraded to v0.28.3.
- k8s.io/apiextensions-apiserver has been upgraded to v0.28.3.
- k8s.io/apimachinery has been upgraded to v0.28.3.
- k8s.io/apiserver has been upgraded to v0.28.3.
- k8s.io/cli-runtime has been upgraded to v0.28.3.
- k8s.io/client-go has been upgraded to v0.28.3.
- sigs.k8s.io/code-generator has been upgraded to v0.28.3.
- sigs.k8s.io/component-base has been upgraded to v0.28.3.
- sigs.k8s.io/component-helpers has been upgraded to v0.28.3.
- sigs.k8s.io/kube-openapi has been upgraded to v0.0.0-20230717233707-2695361300d9.
- sigs.k8s.io/kubectl has been upgraded to v0.28.3.
- sigs.k8s.io/metrics has been upgraded to v0.28.3.
- sigs.k8s.io/controller-runtime has been upgraded to v0.16.3.
- helm.sh/helm has been upgraded to v3.13.2.
- go.uber.org/zap has been upgraded to v1.26.0.
- envoy-gloo-ee/solo-io has been upgraded to v1.27.2-patch1.
- solo-io/gloo has been upgraded to v1.16.0-beta25.
- linux/alpine has been upgraded to 3.17.6.
- nginx/nginx has been upgraded to 1.25.3-alpine3.18.
- golang/go has been upgraded to v1.21.4.
- solo-io/cloud-builders has been upgraded to v0.7.0.
- solo-io/gloo has been upgraded to v1.16.0-beta26.
- solo-io/skv2 has been upgraded to v0.34.10.
- solo-io/solo-apis has been upgraded to gloo-v1.16.0-rc1.
- solo-io/gloo has been upgraded to v1.16.0-rc1.
- solo-io/gloo has been upgraded to v1.16.0-beta24.
- linux/alpine has been upgraded to 3.17.6.
- golang/go has been upgraded to v1.21.5.
- k8s.io/api has been upgraded to v0.28.3.
- k8s.io/apiextensions-apiserver has been upgraded to v0.28.3.
- k8s.io/apimachinery has been upgraded to v0.28.3.
- k8s.io/client-go has been upgraded to v0.28.3.
- sigs.k8s.io/code-generator has been upgraded to v0.28.3.
- sigs.k8s.io/component-base has been upgraded to v0.28.3.
- sigs.k8s.io/kubectl has been upgraded to v0.28.3.
- sigs.k8s.io/controller-runtime has been upgraded to v0.16.3.
- helm.sh/helm has been upgraded to v3.13.2.
- onsi/ginkgo/v2 has been upgraded to v2.11.0.
- onsi/gomega has been upgraded to v1.27.10.
- go.uber.org/zap has been upgraded to v1.25.0.
- solo-io/go-utils has been upgraded to v0.24.8.
- solo-io/k8s-utils has been upgraded to v0.6.0.
- solo-io/skv2 has been upgraded to v0.36.0.
- solo-io/solo-apis has been upgraded to sa-k8s-1.28-bump.
- solo-io/solo-kit has been upgraded to v0.34.0.
- solo-io/cloud-builders has been upgraded to v0.8.1.
- envoy-gloo/solo-io has been upgraded to v1.27.2-patch1.
- golang/go has been upgraded to v1.21.4.
- solo-io/cloud-builders has been upgraded to v0.7.0.
Fixes
- Ensure that the `failOnRedirect` option is respected on an AuthConfig resource. (https://github.com/solo-io/gloo/issues/7167)
- Ensure that Gloo Fed can create resources with owner label over 63 characters long. (https://github.com/solo-io/gloo/issues/7716)
- Support `k8sSecretApikeyStorage` translation. (https://github.com/solo-io/gloo/issues/8709)
- Update glooctl inject for sds to not include v in the version (https://github.com/solo-io/gloo/pull/8983)
- Fix upgrade issues from v1.15.16, v1.14.27 and v1.13.32 to v1.16.0-beta20+. This was caused due to the resource-rollout RBAC being a pre-upgrade/install helm hook in v1.16.0-beta20+ while not being a hook in the latest LTS releases. This fix moves the resource-rollout RBAC out of the pre-upgrade/install hook in this release. Upgrades from v1.16.0-beta20+ will require running the following commands prior to the upgrade to cleanup the pre-upgrade/install resource-rollout RBAC helm hooks. ``` export RELEASE_NAMESPACE="gloo-system" # replace this with the installation namespace export RBAC_SUFFIX=`kubectl get ClusterRole | grep gloo-resource-rollout | sed 's/gloo-resource-rollout//g' | cut -d ' ' -f 1` kubectl delete ClusterRole gloo-resource-rollout$RBAC_SUFFIX kubectl delete ClusterRoleBinding gloo-resource-rollout$RBAC_SUFFIX kubectl delete Role gloo-resource-rollout -n $RELEASE_NAMESPACE kubectl delete RoleBinding gloo-resource-rollout -n $RELEASE_NAMESPACE kubectl delete ServiceAccount gloo-resource-rollout -n $RELEASE_NAMESPACE ``` (https://github.com/solo-io/gloo/issues/8902)
- Avoid allowing glooctl to install v2 variants without an explicit call for it. This may be reverted later once we have a better understanding of upgrade path.
Helm Changes
- Adds the new helm value `gloo.gatewayProxies.NAME.disableExtauthSidecar` to disable the extauth sidecar on a given gateway proxy when `global.extensions.extAuth.envoySidecar` is set. The default behavior of setting `global.extensions.extAuth.envoySidecar` to true is that all the gateway proxies come up with an extauth sidecar. In scenarios where a specific gateway proxy might not need an extauth sidecar as it does not require extauth, the new helm value `gloo.gatewayProxies.NAME.disableExtauthSidecar` can be set. Defaults to false. It has no effect if `global.extensions.extAuth.envoySidecar` is not set. (https://github.com/solo-io/gloo/issues/8430)
- Delegate creating CRs to the OSS resource rollout job. (https://github.com/solo-io/solo-projects/issues/5490)
- Adds the new helm value `gatewayproxy.proxyName.disableExtauthSidecar` to disable the extauth sidecar on a given gateway proxy when `global.extensions.extAuth.envoySidecar` is set. Defaults to false. This is used with enterprise extauth deployments. (https://github.com/solo-io/gloo/issues/8430)
- Adds a new helm value `global.extraCustomResources` to allow users to add additional custom resources to create, as defined by a helm partial (https://github.com/solo-io/solo-projects/issues/5490)
New Features
- Add additional options to the OidcAuthorizationCodeConfig API to configure Azure-specific details for resolving distributed claims. (https://github.com/solo-io/gloo-mesh-enterprise/issues/12848)

v1.16.0-beta2 (v1.16.0)

Thu, 02 Nov 2023 22:29:37 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.16.0-beta15.
- solo-io/gloo has been upgraded to v1.16.0-beta17.
- solo-io/ext-auth-service has been upgraded to v0.51.1.
- solo-io/envoy-gloo-ee has been upgraded to 1.26.4-patch6.
- solo-io/gloo has been upgraded to v1.16.0-beta20.
- solo-io/gloo has been upgraded to v1.16.0-beta14.
- google.golang.org/grpc has been upgraded to v1.59.0.
- solo-io/gloo has been upgraded to v1.16.0-beta19.
- solo-io/gloo has been upgraded to v1.16.0-beta16.
- solo.io/ext-auth-service has been upgraded to 0.52.0.
- solo-io/gloo has been upgraded to v1.16.0-beta18.
- solo-io/go-control-plane-fork-v2 has been upgraded to v0.0.0-20231026174848-be784d54c527.
- golang.org/grpc has been upgraded to 1.59.0.
- jhump/protoreflect has been upgraded to v1.15.3.
- solo-io/cloud-builders has been upgraded to v0.6.5.
- solo-io/envoy-gloo has been upgraded to v1.26.5-patch1.
- solo-io/go-control-plane-fork-v2 has been upgraded to v0.11.1/forked-extproc.
Fixes
- Ensure that ApiKeys which are persisted in Aerospike respect the labelSelector configuration on the AuthConfig API. (https://github.com/solo-io/dev-portal/issues/2753)
- Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the `--wait` flag and via ArgoCD. (https://github.com/solo-io/gloo/issues/8288)
- Ensure that LDAP kube2e tests succeed. Previously, the tests were not running due to incorrect gating, and when enabled they would fail. (https://github.com/solo-io/solo-projects/issues/5456)
- Unfortunately, the custom readiness probe fix causes issues in deployments via Argo, since the resouce-rollout job is deleted and causes the argo app to go out of sync, as well as missing permissions to watch jobs. Reverted this fix (https://github.com/solo-io/gloo/issues/8809)
- Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the `--wait` flag and via ArgoCD. (https://github.com/solo-io/gloo/issues/8288)
- Glooctl should now correctly respect kube context if passed. (https://github.com/solo-io/gloo/pull/7623)
- Make cert rotation more resilient against downtime when mTLS is enabled, by updating the certs in stages and waiting for changes to propagate. A new helm value `gateway.certGenJob.rotationDuration` (default 65s) can be used the configure the duration to wait for each stage of cert rotation to complete. This value must be tuned according to the performance of the specific environment in which the jobs are run. (https://github.com/solo-io/solo-projects/issues/5252)
- Unfortunately, the custom readiness probe fix causes issues in deployments via Argo, since the resouce-rollout job is deleted and causes the argo app to go out of sync, as well as missing permissions to watch jobs. Reverted this fix (https://github.com/solo-io/gloo/issues/8809)
- Remove the Envoy cluster from the error log when validating clusters, avoiding the exposure of sensitive data (secrets). (https://github.com/solo-io/gloo/issues/8592)
- **IMPORTANT**: `Secret` deletions are now being validated. This _could_ cause a slight performance degradation when deleting Secrets. To opt-out, add `'secrets'` to `gateway.validation.webhook.skipDeleteValidationResources`. (https://github.com/solo-io/gloo/issues/8001)
- This ensures that a new deployment is rolled if the configmap it references changes. This is done by adding a `checksum/` annotation on any deployment that uses a configmap as a container volume. (https://github.com/solo-io/gloo/issues/8392)
- Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the `--wait` flag. (https://github.com/solo-io/gloo/issues/8288)
Helm Changes
- Adds the helm value `gateway.rolloutJob.timeout` to specifiy the timeout to wait for the resource rollout job to complete. (https://github.com/solo-io/gloo/issues/8782)
New Features
- Add support to use sha1 for basic auth. Sha1 is considered insecure and is not recommended for production use. (https://github.com/solo-io/solo-projects/issues/5234)
- Implements `claimToHeaders` for OIDC which converts token claims to headers on the request. (https://github.com/solo-io/gloo/issues/8737)
- Exposes cluster option for preconnect policy. Explicitly scoped to just upstreams as this is RARELY a good feature to use. (https://github.com/solo-io/solo-projects/issues/5411)

v1.16.0-beta1 (v1.16.0)

Mon, 09 Oct 2023 17:42:21 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.16.0-beta3.
- solo-io/gloo has been upgraded to v1.16.0-beta9.
- solo-io/envoy-gloo-ee has been upgraded to 1.26.4-patch3.
- sigs.k8s.io/controller-runtime has been upgraded to v0.15.2.
- solo-io/go-control-plane-fork-v2 has been upgraded to v0.11.1/forked-extproc.
- solo-io/ext-auth-service has been upgraded to v0.43.1.
- sigs.k8s.io/controller-runtime has been upgraded to v0.15.2-0.20230808150016-0269522a418c.
- solo-io/ext-auth-service has been upgraded to v0.50.0.
- solo-io/gloo has been upgraded to v1.16.0-beta13.
- solo-io/solo-apis has been upgraded to gloo-v1.16.0-beta13.
- solo-io/ext-auth-service has been upgraded to v0.49.0.
- solo-io/envoy-gloo-ee has been upgraded to 1.26.4-patch2.
- solo-io/gloo has been upgraded to v1.16.0-beta2.
Fixes
- Fix incorrect CRD generation and overflow caused of proto fileds of type `google.protobuf.UInt64Value`. Previously fields of this type had an incorrect schema as well as led to overflows which led to them failing being unmarshalled, which is now resolved by changing the type to `google.protobuf.UInt32Value`, which is backward-forward compatible. Ref. https://protobuf.dev/programming-guides/proto2/#updating point 5. Affected protos include gateway specs `httpGateway.options.caching.maxPayloadSize` and `httpGateway.options.connectionLimit.maxActiveConnections` (https://github.com/solo-io/gloo/issues/8568)
- Migrate from alpine to ubuntu for released version. Backlogged an issue to move fully to distroless on beta branch. Can be found here https://github.com/solo-io/solo-projects/issues/5388 Not migrating prior as this may impact some debugging steps. Forced to migrate per glibc being unable to update. https://nvd.nist.gov/vuln/detail/CVE-2022-23218 https://nvd.nist.gov/vuln/detail/CVE-2022-23219 https://nvd.nist.gov/vuln/detail/CVE-2021-38604 https://nvd.nist.gov/vuln/detail/CVE-2021-3998 See here for glibc on alpine maintainers https://gitlab.alpinelinux.org/alpine/tsc/-/issues/43#note_306270 https://github.com/sgerrand/alpine-pkg-glibc/issues/207#issuecomment-1707209887 https://github.com/sgerrand/alpine-pkg-glibc/issues/176 (https://github.com/solo-io/solo-projects/issues/5344)
- Ensure that `failover.policy` configuration on an Upstream is respected for Static Upstreams. (https://github.com/solo-io/gloo/issues/8720)
- Plugin and test updates to correctly check for empty required fields in RateLimit actions. (https://github.com/solo-io/gloo/issues/8573)
Helm Changes
- Ensure that setting `discovery.deployment.image.fips` will result in the FIPS variant of the discovery image being used. (https://github.com/solo-io/solo-projects/issues/5367)
- Update enterprise chart with fix for TTL not being respected on Helm hook jobs due to deletion policy. (https://github.com/solo-io/gloo/issues/8500)
New Features
- Gloo now supports local limiting. This restricts the rate of connections per gateway, virtual host or route using envoy's own local rate limit filter, thus no longer requiring the need for an external rate limit server. This includes both the network and http local rate limit filter. (https://github.com/solo-io/gloo/issues/7428)
- Add support to overwrite headers sent to upstreams with headers from the passthrough/external auth response via the use of the OverwriteUpstreamHeaders option. (https://github.com/solo-io/gloo/issues/8477)
- Support configuration of new extproc fields such as metadata. (https://github.com/solo-io/solo-projects/issues/5212)
- Adding PK JWT client authentication support for OIDC (https://github.com/solo-io/gloo/issues/7744)

v1.15.26 (v1.15.0)

Wed, 09 Apr 2025 15:54:00 GMT

Extra Notes
- This release contained no user-facing changes.

v1.15.25 (v1.15.0)

Fri, 28 Mar 2025 17:17:12 GMT

Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.44.0-patch8.

v1.15.24 (v1.15.0)

Wed, 12 Mar 2025 19:17:44 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.15.36.
- golang/go has been upgraded to v1.23.7.
- golang/go has been upgraded to v1.23.3.
- solo-io/skv2 has been upgraded to v0.32.2.
- golang/go has been upgraded to v1.23.3.
- golang/go has been upgraded to v1.23.7.
Fixes
- Bump the alpine base container image to 3.21.3 (https://github.com/solo-io/solo-projects/issues/7956)
- Update the nginx base image for the gloo-federation-console image to resolve CVEs. (https://github.com/solo-io/solo-projects/issues/7993)
- Update branch nightly test logic to handle branch input when called from a scheduled job. skipCI-kube-tests:true skipCI-storybook-tests:true skipCI-in-memory-e2e-tests:true (https://github.com/solo-io/solo-projects/issues/6395)
- Bump the alpine base container image to 3.21.3 (https://github.com/solo-io/solo-projects/issues/7956)

v1.15.23 (v1.15.0)

Mon, 06 Jan 2025 14:37:51 GMT

Dependency Bumps
- solo-io/solo-kit has been upgraded to v0.33.2.
- solo-io/solo-apis has been upgraded to gloo-v1.15.35.
- solo-io/gloo has been upgraded to v1.15.35.
- golang.org/crypto has been upgraded to v0.31.0.
- golang.org/x/net has been upgraded to v0.33.0.
- solo-io/solo-kit has been upgraded to v0.36.2.
Fixes
- Remove docs for external APIs (https://github.com/solo-io/solo-projects/issues/6768)

v1.15.22 (v1.15.0)

Wed, 02 Oct 2024 21:47:25 GMT

Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.44.0-patch6.
- solo-io/envoy-gloo-ee has been upgraded to v1.26.8-patch5.
- solo-io/gloo has been upgraded to v1.15.31.
- solo-io/solo-apis has been upgraded to gloo-v1.15.31.
- solo-io/gloo has been upgraded to v1.15.32.
- solo-io/solo-apis has been upgraded to gloo-v1.15.32.
Fixes
- Upgrade envoy-gloo-ee to pull in cve changes. CVE-2024-45808: Malicious log injection via access logs CVE-2024-45806: Potential manipulate x-envoy headers from external sources CVE-2024-45809: Jwt filter crash in the clear route cache with remote JWKs CVE-2024-45810: Envoy crashes for LocalReply in http async client (https://github.com/solo-io/solo-projects/issues/6290)
- Fix for issue where a missing TLS secret was treated by validation as an error, potentially bringing down the entire HTTPS gateway if the gloo pod restarts while in this bad state. This is a breaking change in the default behavior of validation. To enable this behavior, use the helm setting `gateway.validation.warnMissingTlsSecret=true` or the same field on the Settings CR. This field has no effect if allowWarnings is false or acceptAllResources is true. (https://github.com/solo-io/gloo/issues/6957)
- Fix a bug that caused discovered Upstreams to not reflect the updated state of parent Services discovered using watchLabels (https://github.com/solo-io/gloo/issues/8635)
- Fix for issue where a missing TLS secret was treated by validation as an error, potentially bringing down the entire HTTPS gateway if the gloo pod restarts while in this bad state. This is a breaking change in the default behavior of validation. To enable this behavior, use the helm setting `gateway.validation.warnMissingTlsSecret=true` or the same field on the Settings CR. This field has no effect if allowWarnings is false or acceptAllResources is true. (https://github.com/solo-io/gloo/issues/6957)
- Fix a bug where the service and function names of a discovered gRPC service are not printed in JSON and YAML
- Infer the gloo deployment name in cases where the deployment name is not the default `gloo`. The gloo deployment is identified by the `gloo=gloo` label. (https://github.com/solo-io/gloo/issues/9163)
- Optimizes the `glooctl check` command by reducing the time taken to check resources by almost half in large environments consisting of over 500 namespaces (https://github.com/solo-io/gloo/issues/9673)
- Fix a bug where the service and function names of a discovered gRPC service are not printed when running glooctl get upstreams (https://github.com/solo-io/gloo/issues/9644)
Helm Changes
- New field gateway.validation.warnMissingTlsSecret controls whether missing TLS secrets referenced in SslConfig and UpstreamSslConfig will be treated as a warning instead of an error during validation. Defaults to false. This field has no effect if allowWarnings is false or acceptAllResources is true. (https://github.com/solo-io/gloo/issues/6957)
- New field gateway.validation.warnMissingTlsSecret controls whether missing TLS secrets referenced in SslConfig and UpstreamSslConfig will be treated as a warning instead of an error during validation. Defaults to false. This field has no effect if allowWarnings is false or acceptAllResources is true. (https://github.com/solo-io/gloo/issues/6957)

v1.15.21 (v1.15.0)

Tue, 30 Jul 2024 13:10:46 GMT

Dependency Bumps
- solo.io/ext-auth-service has been upgraded to 0.44.0-patch5.
Fixes
- Allows user to opt into the ability to merge Auth Responses differently. When not enabled denied auth chains would return 403 instead of 401 when merging two 401 responses from AuthServices. This behavior can be enabled by setting the environment variable `DONT_MERGE_DENIED_AUTH_RESPONSES` to `false` on the Extauth Service. To do this via helm use the following field: global.extensions.extAuth.deployment.customEnv. (https://github.com/solo-io/ext-auth-service/issues/669)
- Fix CVE-2024-24790 && CVE-2024-2398 (https://github.com/solo-io/solo-projects/issues/6668)

v1.15.20 (v1.15.0)

Mon, 15 Jul 2024 15:34:57 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.15.29.
- solo-io/solo-apis has been upgraded to gloo-v1.15.29.
- solo-io/cloud-builders has been upgraded to v0.7.7.
- bitnami/kubectl has been upgraded to 1.27.15.
- solo-io/cloud-builders has been upgraded to v0.7.7.
- solo-io/envoy-gloo has been upgraded to v1.26.8-patch2.
Fixes
- Fix a bug where Lambdas returning multiValueHeaders with non-string type with `unwrapAsApiGateway` enabled would result in a 500 response to the caller (https://github.com/solo-io/gloo/issues/8867)

v1.15.19 (v1.15.0)

Tue, 02 Jul 2024 23:22:49 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.26.8-patch4.

v1.15.18 (v1.15.0)

Tue, 07 May 2024 20:34:44 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.15.27.
- bitnami/kubectl has been upgraded to 1.27.13.
Fixes
- Fixs the issue of all routes and route tables warning of an invalid route when an unsupported route action is defined on a listener with the grpcjson plugin enabled. (https://github.com/solo-io/gloo/issues/9160)

v1.15.17 (v1.15.0)

Mon, 29 Apr 2024 18:53:25 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.26.8-patch2.
- solo.io/ext-auth-service has been upgraded to v0.44.0-patch4.
Fixes
- Auto SNI CVE https://github.com/envoyproxy/envoy/security/advisories/GHSA-3mh5-6q8v-25wj. Previously static upstreams with auto_sni enabled could be vunerable to CVE-2024-32475 (https://github.com/solo-io/solo-projects/issues/6077)
- Fix an issue where a malformed Authorization header causes a panic in HMAC authorization. (https://github.com/solo-io/ext-auth-service/issues/740)

v1.15.16 (v1.15.0)

Mon, 15 Apr 2024 15:33:41 GMT

Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.44.0-patch3.
- solo-io/envoy-gloo-ee has been upgraded to v1.26.8-patch1.
- golang/go has been upgraded to v1.20.latest.
- solo-io/cloud-builders has been upgraded to v0.7.6.
- solo-io/gloo has been upgraded to v1.15.15.
- solo-io/envoy-gloo has been upgraded to v1.26.8-patch1.
- solo-io/cloud-builders has been upgraded to v0.7.6.
Fixes
- HTTP2 continuation CVE fixed. See https://github.com/envoyproxy/envoy/security/advisories/GHSA-j654-3ccm-vfmm (https://github.com/solo-io/solo-projects/issues/6008)

v1.15.15 (v1.15.0)

Mon, 18 Mar 2024 19:28:49 GMT

Dependency Bumps
- solo-io/envoy-gloo has been upgraded to 1.26.7-patch2.
- solo-io/gloo has been upgraded to v1.15.24.
- envoy-gloo/solo-io has been upgraded to 1.26.7-patch2.

v1.15.14 (v1.15.0)

Fri, 23 Feb 2024 19:28:07 GMT

Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.44.0-patch2.
- golang.org/x/tools has been upgraded to v0.11.1.
Fixes
- Fixes the issue where the GrpcPassthrough Authconfig doesn't recongnize seconds in base and max intervals (https://github.com/solo-io/solo-projects/issues/5841)
- Fixes the invalid query in the 'Gloo Overview' dashboard in grafana when the extraMetricQueryParameters is set. It also adds test to validate that the grafana queries are PromQL compliant. (https://github.com/solo-io/solo-projects/issues/5783)

v1.15.13 (v1.15.0)

Wed, 14 Feb 2024 22:54:30 GMT

Dependency Bumps
- solo-io/envoy-gloo has been upgraded to v1.26.7-patch1.
- solo-io/gloo has been upgraded to v1.15.23.
- solo-io/ext-auth-service has been upgraded to v0.44.0-patch1.
- solo-io/solo-apis has been upgraded to gloo-v1.15.23.
- solo-io/envoy-gloo has been upgraded to v1.26.7-patch1.
Fixes
- Add the option to allow retries for gRPC Passthrough Auth in case the service is unavailable. This can be configured via the new `retryPolicy` in the PassThroughGrpc AuthConfig. Note that the global settings `extauth.requestTimeout` must be greater than the `retryPolicy.numRetries` * `retryPolicy.retryBackOff.baseInterval` to ensure that the failed gRPC call has sufficient time to retry. (https://github.com/solo-io/gloo/issues/6804)
- Allow configuring the authority header for ratelimit gRPC calls. (https://github.com/solo-io/gloo/issues/8995)
- Add the option to allow retries for gRPC Passthrough Auth in case the service is unavailable. This can be configured via the new `retryPolicy` in the PassThroughGrpc AuthConfig. (https://github.com/solo-io/gloo/issues/6804)
- Expose the `global.istioIntegration.AppendXForwardedHost` Helm value to allow users to toggle off the appending of
- Expose a new ratelimit option `grpcService.authority` to configure the authority header for the ratelimit gRPC call. (https://github.com/solo-io/gloo/issues/8995)

v1.15.12 (v1.15.0)

Thu, 01 Feb 2024 21:20:23 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.15.20.
- solo-io/gloo has been upgraded to v1.15.22.
- solo-io/solo-apis has been upgraded to gloo-v1.15.22.
- solo-io/envoy-gloo has been upgraded to v1.26.5-patch2.
Fixes
- Introduces a new setting `gloo.settings.observabilityOptions.grafanaIntegration.dashboardPrefix` that specifies the prefix for the title and UID of Grafana Dashboards created. It is restricted to 20 characters in length. This is useful when the data is aggregated to a central grafana instance so they do not conflict across multiple Gloo environments. Note that any dashboard created without a prefix or with a different prefix will need to be manually removed on changing this value. (https://github.com/solo-io/gloo/issues/9022)
- Introduces a new setting `gloo.settings.observabilityOptions.grafanaIntegration.extraMetricQueryParameters` that specifies additional query parameters to add to all metric query definitions in the Grafana dashboards generated by gloo. It is a string and can consist of multiple query parameters separated by a comma. For example `cluster="some-cluster",gateway_proxy_id="proxy-2"`. (https://github.com/solo-io/gloo/issues/9016)
- Fixes a bug where specifying the setting `gloo.settings.observabilityOptions.grafanaIntegration.defaultDashboardFolderId` does not move the default grafana dashboards into the specified folder. (https://github.com/solo-io/gloo/issues/6536)
- Update Upstream templates for Enterprise services to have the same health check config (interval: 10s, healthyThreshold: 3, unhealthyThreshold: 3). This fixes a bug whereby on pod restart, traffic would continue to be sent to deleted rate-limit pods, causing those requests to not be processed by rate-limit. (https://github.com/solo-io/gloo/issues/8942)
- When deploying edge with tilt + helm, the resource-rollout-job is deleted before the install completes which causes the deployment to fail. The cleanup for the resource-rollout job is now moved to a pre-upgrade hook to ensure that the job exists so deployments now succeed. (https://github.com/solo-io/gloo/issues/9033)
- When deploying edge with tilt + helm, the resource-rollout-job is deleted before the install completes which causes the deployment to fail. The cleanup for the resource-rollout job is now moved to a pre-upgrade hook to ensure that the job exists so deployments now succeed. (https://github.com/solo-io/gloo/issues/9033)
- Introduces a new Enterprise setting `settings.observabilityOptions.grafanaIntegration.dashboardPrefix` that specifies the prefix for the title and UID of Grafana Dashboards created. It is restricted to 20 characters in length. This is useful when the data is aggregated to a central grafana instance so they do not conflict across multiple Gloo environments. Note that any dashboard created without a prefix or with a different prefix will need to be manually removed on changing this value. (https://github.com/solo-io/gloo/issues/9022)
- Introduces a new Enterprise setting `gloo.settings.observabilityOptions.grafanaIntegration.extraMetricQueryParameters` that specifies additional query parameters to add to all metric query definitions in the Grafana dashboards generated by gloo. It is a string and can consist of multiple query parameters separated by a comma. For example `cluster="some-cluster",gateway_proxy_id="proxy-2"`. (https://github.com/solo-io/gloo/issues/9016)
- Add missing required runtime key for aggression in slow start config. (https://github.com/solo-io/gloo/pull/9031)
Helm Changes
- Changes to support and test use of `sds-ee` and `sds-ee-fips` images (https://github.com/solo-io/gloo/issues/8909)
- Ensure that setting `discovery.deployment.image.fips` will result in the FIPS variant of the discovery image being used. (https://github.com/solo-io/solo-projects/issues/5367)
- Updates to helper functions to recognize `sds-ee` images as fips-suppported (https://github.com/solo-io/gloo/issues/8909)

v1.15.11 (v1.15.0)

Fri, 12 Jan 2024 14:46:32 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.15.19.
- solo-apis/gloo has been upgraded to gloo-v1.15.19.
- solo-io/envoy-gloo-ee has been upgraded to v1.26.5-patch3.
Fixes
- Add renewal logic for Hashicorp vault tokens. The settings.secretOptions.sources[].vault.aws.leaseIncrement field can be used to specify the lease increment for Hashicorp token renewal. This value is passed as the 'Increment' parameter to the Hashicorp vault API.
Helm Changes
- Added settings.secretOptions.sources[].vault.aws.leaseIncrement to allow users to specify the lease increment for Hashicorp token renewal. This value is passed as the 'Increment' parameter to the Hashicorp vault API. (https://github.com/solo-io/solo-projects/issues/5438)

v1.15.10 (v1.15.0)

Fri, 22 Dec 2023 21:15:06 GMT

Dependency Bumps
- linux/alpine has been upgraded to 3.17.6.
- nginx/nginx has been upgraded to 1.25.3-alpine3.18.
- solo-io/cloud-builders has been upgraded to 0.7.1.
- solo-io/gloo has been upgraded to v1.14.28.

v1.15.10-alpine1 (v1.15.0)

Tue, 26 Dec 2023 19:46:00 GMT

Dependency Bumps
- linux/alpine has been upgraded to 3.17.6.
- solo-io/cloud-builders has been upgraded to 0.7.1.
- golang.org/crypto has been upgraded to v0.17.0.

v1.15.9 (v1.15.0)

Thu, 07 Dec 2023 16:45:38 GMT

Dependency Bumps
- solo.io/ext-auth-service has been upgraded to 0.43.1-patch4.
Fixes
- Ensure that the `failOnRedirect` option is respected on an AuthConfig resource. When `failOnRedirect` is set, if the ext-auth-service returns a redirect, Gloo will return a 401 to the client instead of following the redirect. (https://github.com/solo-io/gloo/issues/7167)

v1.15.8 (v1.15.0)

Fri, 01 Dec 2023 15:23:15 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.15.16.
- x/net has been upgraded to v0.18.0.
- solo.io/ext-auth-service has been upgraded to 0.43.1-patch3.
- solo.io/solo-apis has been upgraded to gloo-v1.15.17.
- solo.io/gloo has been upgraded to v1.15.17.
- solo-io/cloud-builders has been upgraded to v0.6.8.
- x/net has been upgraded to v0.18.0.
- google/go has been upgraded to 1.20.11.
Fixes
- Ensure that the `failOnRedirect` option is respected on an AuthConfig resource. (https://github.com/solo-io/gloo/issues/7167)
- Ensure that Gloo Fed can create resources with owner label over 63 characters long. (https://github.com/solo-io/gloo/issues/7716)
- Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the `--wait` flag and via ArgoCD. (https://github.com/solo-io/gloo/issues/8288)
- Add support to use sha1 for basic auth. Sha1 is considered insecure and is not recommended for production use. (https://github.com/solo-io/solo-projects/issues/5234)
- Support `k8sSecretApikeyStorage` translation. (https://github.com/solo-io/gloo/issues/8709)
- Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the `--wait` flag and via ArgoCD. (https://github.com/solo-io/gloo/issues/8288)
Helm Changes
- Delegate creating CRs to the OSS resource rollout job. (https://github.com/solo-io/solo-projects/issues/5490)
- Adds a new helm value `global.extraCustomResources` to allow users to add additional custom resources to create, as defined by a helm partial (https://github.com/solo-io/solo-projects/issues/5490)

v1.15.7 (v1.15.0)

Wed, 01 Nov 2023 20:50:56 GMT

Dependency Bumps
- google.golang.org/grpc has been upgraded to v1.59.0.
- solo-io/gloo has been upgraded to v1.15.15.

v1.15.7-alpine1 (v1.15.0)

Wed, 01 Nov 2023 22:57:49 GMT

Dependency Bumps
- golang.org/grpc has been upgraded to 1.59.0.
- jhump/protoreflect has been upgraded to v1.15.3.

v1.15.6 (v1.15.0)

Sat, 21 Oct 2023 01:05:54 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.15.12.
- solo-io/gloo has been upgraded to v1.15.14.
- solo-io/ext-auth-service has been upgraded to v0.43.1-patch2.
- solo-io/gloo has been upgraded to v1.15.13.
Fixes
- Gloo now supports local limiting. This restricts the rate of connections per gateway, virtual host or route using envoy's own local rate limit filter, thus no longer requiring the need for an external rate limit server. This includes both the network and http local rate limit filter. (https://github.com/solo-io/gloo/issues/7428)
- Ensure that ApiKeys which are persisted in Aerospike respect the labelSelector configuration on the AuthConfig API. (https://github.com/solo-io/dev-portal/issues/2753)
- Unfortunately, the custom readiness probe fix causes issues in deployments via Argo, since the resouce-rollout job is deleted and causes the argo app to go out of sync, as well as missing permissions to watch jobs. Reverted this fix (https://github.com/solo-io/gloo/issues/8809)
- Make cert rotation more resilient against downtime when mTLS is enabled, by updating the certs in stages and waiting for changes to propagate. A new helm value `gateway.certGenJob.rotationDuration` (default 65s) can be used the configure the duration to wait for each stage of cert rotation to complete. This value must be tuned according to the performance of the specific environment in which the jobs are run. (https://github.com/solo-io/solo-projects/issues/5252)
- Certgen job will now renew existing certificate if it is expiring soon (90d by default). (https://github.com/solo-io/gloo/issues/5944)
- Unfortunately, the custom readiness probe fix causes issues in deployments via Argo, since the resouce-rollout job is deleted and causes the argo app to go out of sync, as well as missing permissions to watch jobs. Reverted this fix (https://github.com/solo-io/gloo/issues/8809)
- Gloo now supports local limiting. This restricts the rate of connections per gateway, virtual host or route using envoy's own local rate limit filter, thus no longer requiring the need for an external rate limit server. This includes both the network and http local rate limit filter. (https://github.com/solo-io/gloo/issues/7428)
Helm Changes
- Add new certgen CronJob if validation webhook is enabled (https://github.com/solo-io/gloo/issues/5944)
- Add an option to enable `force-rotation` flag for certgen job (https://github.com/solo-io/gloo/issues/5944)

v1.15.5 (v1.15.0)

Thu, 12 Oct 2023 23:17:48 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to 1.26.5-patch1.
- solo-io/cloud-builders has been upgraded to 0.6.5.
- solo-io/gloo has been upgraded to 1.15.11.
- solo-io/envoy-gloo-ee has been upgraded to 1.26.4-patch6.
- solo-io/gloo has been upgraded to v1.15.11.
- solo-io/cloud-builders has been upgraded to v0.6.5.
- solo-io/envoy-gloo has been upgraded to v1.26.5-patch1.
- solo-io/go-control-plane-fork-v2 has been upgraded to v0.11.1/forked-extproc.
Fixes
- Note that this version of envoy adds` `http.max_requests_per_io_cycle`` as a runtime value. This runtime value can be set to 1 in the presence of abusive HTTP/2 or HTTP/3 connections. (https://github.com/solo-io/solo-projects/issues/5391)
- Ensure that `failover.policy` configuration on an Upstream is respected for Static Upstreams. (https://github.com/solo-io/gloo/issues/8720)
- Remove the Envoy cluster from the error log when validating clusters, avoiding the exposure of sensitive data (secrets). (https://github.com/solo-io/gloo/issues/8592)
- **IMPORTANT**: `Secret` deletions are now being validated. This _could_ cause a slight performance degradation when deleting Secrets. To opt-out, add `'secrets'` to `gateway.validation.webhook.skipDeleteValidationResources`. (https://github.com/solo-io/gloo/issues/8001)
- Exposes cluster option for preconnect policy. Explicitly scoped to just upstreams as this is RARELY a good feature to use. (https://github.com/solo-io/solo-projects/issues/5411)
- Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the `--wait` flag. (https://github.com/solo-io/gloo/issues/8288)
Helm Changes
- Adds the helm value `gateway.rolloutJob.timeout` to specifiy the timeout to wait for the resource rollout job to complete. (https://github.com/solo-io/gloo/issues/8782)
- Changes the default value of `gateway.rolloutJob.ttlSecondsAfterFinished` from 60 to 300 to accomodate the fix for the aforementioned custom readiness probe issue. (https://github.com/solo-io/gloo/issues/8288)

v1.15.4 (v1.15.0)

Fri, 06 Oct 2023 19:39:44 GMT

Fixes
- Re-enable wget in our gloo and gateway-proxy pods. Wget is currently used in our non-custom probes which are currently not well covered in tests. Caused by https://github.com/solo-io/solo-projects/issues/5344 shift to ubuntu. (https://github.com/solo-io/gloo/issues/8749)
- This ensures that a new deployment is rolled if the configmap it references changes. This is done by adding a `checksum/` annotation on any deployment that uses a configmap as a container volume. (https://github.com/solo-io/gloo/issues/8392)
- Re-enable wget in our gloo and gateway-proxy pods. Wget is currently used in our non-custom probes which are currently not well covered in tests. Caused by https://github.com/solo-io/solo-projects/issues/5344 shift to ubuntu. (https://github.com/solo-io/gloo/issues/8749)

v1.15.3 (v1.15.0)

Wed, 04 Oct 2023 14:44:17 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.26.4-patch4.
- solo-io/gloo has been upgraded to v1.15.7.
- solo-io/envoy-gloo has been upgraded to v1.26.4-patch3.
Fixes
- Migrate from alpine to ubuntu for released version. Backlogged an issue to move fully to distroless on beta branch. Can be found here https://github.com/solo-io/solo-projects/issues/5388 Not migrating prior as this may impact some debugging steps. Forced to migrate per glibc being unable to update. https://nvd.nist.gov/vuln/detail/CVE-2022-23218 https://nvd.nist.gov/vuln/detail/CVE-2022-23219 https://nvd.nist.gov/vuln/detail/CVE-2021-38604 https://nvd.nist.gov/vuln/detail/CVE-2021-3998 See here for glibc on alpine maintainers https://gitlab.alpinelinux.org/alpine/tsc/-/issues/43#note_306270 https://github.com/sgerrand/alpine-pkg-glibc/issues/207#issuecomment-1707209887 https://github.com/sgerrand/alpine-pkg-glibc/issues/176 (https://github.com/solo-io/solo-projects/issues/5344)
- Migrate from alpine to ubuntu for released version. Backlogged an issue to move fully to distroless on beta branch. Can be found here https://github.com/solo-io/solo-projects/issues/5388 Not migrating prior as this may impact some debugging steps. Forced to migrate per glibc being unable to update. https://nvd.nist.gov/vuln/detail/CVE-2022-23218 https://nvd.nist.gov/vuln/detail/CVE-2022-23219 https://nvd.nist.gov/vuln/detail/CVE-2021-38604 https://nvd.nist.gov/vuln/detail/CVE-2021-3998 See here for glibc on alpine maintainers https://gitlab.alpinelinux.org/alpine/tsc/-/issues/43#note_306270 https://github.com/sgerrand/alpine-pkg-glibc/issues/207#issuecomment-1707209887 https://github.com/sgerrand/alpine-pkg-glibc/issues/176 (https://github.com/solo-io/solo-projects/issues/5344)
- Add support for `most_specific_header_mutations_wins` to allow the more specific header mutation to win. Toggling it on would reverse the evaluation order of the header mutations, allowing more specific header mutations to overwrite less specific.
- Support role chaining using EKS ServiceAccounts outside of us-east-1 (https://github.com/solo-io/gloo/issues/8578)
Helm Changes
- Update enterprise chart with fix for TTL not being respected on Helm hook jobs due to deletion policy. (https://github.com/solo-io/gloo/issues/8500)
- Ensure that setting `discovery.deployment.image.fips` will result in the FIPS variant of the discovery image being used. (https://github.com/solo-io/solo-projects/issues/5367)
- Fix TTL not being respected on Helm hook jobs due to deletion policy. (https://github.com/solo-io/gloo/issues/8500)

v1.15.2 (v1.15.0)

Mon, 11 Sep 2023 22:31:30 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.15.3.
- solo-io/gloo has been upgraded to v1.15.5.
- solo-io/envoy-gloo-ee has been upgraded to 1.26.4-patch3.
- solo-io/go-control-plane-fork-v2 has been upgraded to v0.11.1/forked-extproc.
- solo-io/k8s-utils has been upgraded to v0.5.1.
- solo-io/envoy-gloo-ee has been upgraded to 1.26.4-patch2.
- solo-io/envoy-gloo has been upgraded to v1.26.4-patch2.
- solo-io/go-control-plane-fork-v2 has been upgraded to v0.11.1.
- solo-io/k8s-utils has been upgraded to v0.5.1.
Fixes
- Add field to ExtAuth API's OIDC AuthorizationCode plugin to eventually support mapping claims to headers. (https://github.com/solo-io/gloo-mesh-enterprise/issues/10589)
- Make Vault's AWS credentials optional. This allows users to integrate AWS Security Token Service (STS) or IAM Roles for Service Accounts (IRSA) for temporary credentials. https://developer.hashicorp.com/vault/docs/auth/aws#iam-authentication-inferences (https://github.com/solo-io/gloo/issues/8533)
Helm Changes
- Fix syntax error in Gateway yaml when using kube overrides. (https://github.com/solo-io/gloo/issues/8648)
- Expose `secretOptions` in `Settings` Helm chart. (https://github.com/solo-io/gloo/issues/8533)
New Features
- Support configuration of new extproc fields such as metadata. (https://github.com/solo-io/solo-projects/issues/5212)

v1.15.1 (v1.15.0)

Thu, 31 Aug 2023 18:38:22 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.15.2.
- solo-io/solo-apis has been upgraded to gloo-v1.15.2.
- sigs.k8s.io/controller-runtime has been upgraded to v0.15.2.
- sigs.k8s.io/controller-runtime has been upgraded to v0.15.2.
Fixes
- Add support to overwrite headers sent to upstreams with headers from the passthrough/external auth response via the use of the OverwriteUpstreamHeaders option. (https://github.com/solo-io/gloo/issues/8477)
- Prevent error when modifying settings by making sure loggers get initialized. (https://github.com/solo-io/gloo/issues/8627)
- Expose the ability to overwrite headers in HTTP Passthrough Auth with the added allowedUpstreamHeaderToOverwrite field. (https://github.com/solo-io/gloo/issues/8477)
Helm Changes
- Added PodDisruptionBudget helm values for the gloo deployment (https://github.com/solo-io/gloo/issues/8445)

v1.15.0 (v1.15.0)

Mon, 21 Aug 2023 21:40:32 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.15.0-rc5.
- solo-io/ext-auth-service has been upgraded to v0.43.1.
- sigs.k8s.io/controller-runtime has been upgraded to v0.15.2-0.20230808150016-0269522a418c.
- solo-io/gloo has been upgraded to v1.15.0.
- solo-io/gloo has been upgraded to v1.15.0-rc4.
- solo-io/cloud-builders has been upgraded to v0.6.4.
Fixes
- Fix incorrect CRD generation and overflow caused of proto fileds of type `google.protobuf.UInt64Value`. Previously fields of this type had an incorrect schema as well as led to overflows which led to them failing being unmarshalled, which is now resolved by changing the type to `google.protobuf.UInt32Value`, which is backward-forward compatible. Ref. https://protobuf.dev/programming-guides/proto2/#updating point 5. Affected protos include gateway specs `httpGateway.options.caching.maxPayloadSize` and `httpGateway.options.connectionLimit.maxActiveConnections` (https://github.com/solo-io/gloo/issues/8568)
- Plugin and test updates to correctly check for empty required fields in RateLimit actions. (https://github.com/solo-io/gloo/issues/8573)
- Fix incorrect CRD generation and overflow caused of proto fileds of type `google.protobuf.UInt64Value`. Previously fields of this type had an incorrect schema as well as led to overflows which led to them failing being unmarshalled, which is now resolved by changing the type to `google.protobuf.UInt32Value`, which is backward-forward compatible. Ref. https://protobuf.dev/programming-guides/proto2/#updating point 5. Affected protos include gateway specs `httpGateway.options.caching.maxPayloadSize` and `httpGateway.options.connectionLimit.maxActiveConnections` (https://github.com/solo-io/gloo/issues/8568)
- Check for empty values in fields that are required by Envoy for RateLimitActions. Previously invalid config would be passed to Envoy. API reference: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-ratelimit-action. (https://github.com/solo-io/gloo/issues/8573)

v1.15.0-rc2 (v1.15.0)

Mon, 07 Aug 2023 20:33:00 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.15.0-rc3.
- solo-io/solo-apis has been upgraded to gloo-v1.15.0-rc3.
Fixes
- -| Updates ui envoy sidecar version (https://github.com/solo-io/solo-projects/issues/5260)
New Features
- Add support for External Processing filters. External processor settings can be configured on `HttpListenerOptions`, and overrides can be specified on `VirtualHostOptions` and `RouteOptions`. Default global settings can be configured via the `global.extensions.extProc` helm value. (https://github.com/solo-io/gloo/issues/8320)

v1.15.0-rc1 (v1.15.0)

Fri, 04 Aug 2023 02:20:03 GMT

Breaking Changes
- Update Kubernetes API to 1.27 (https://github.com/solo-io/gloo/issues/8214)
Dependency Bumps
- solo-io/cloudbuilders has been upgraded to v0.6.3.
- solo-io/envoy-gloo-ee has been upgraded to v1.26.2-patch2.
- envoyproxy/go-control-plane has been upgraded to v0.11.1.
- envoyproxy/protoc-gen-validate has been upgraded to v1.0.1.
- solo-io/gloo has been upgraded to v1.15.0-beta21.
- solo-io/solo-apis has been upgraded to gloo-v1.15.0-beta21.
- solo-io/envoy-gloo-ee has been upgraded to v1.26.4-patch1.
- solo-io/gloo has been upgraded to v1.15.0-beta23.
- solo-io/solo-apis has been upgraded to gloo-v1.15.0-beta23.
- solo-io/caching-service has been upgraded to v0.5.0.
- solo-io/ext-auth-service has been upgraded to v0.43.0.
- solo-io/gloo has been upgraded to v1.15.0-beta15.
- solo-io/solo-apis has been upgraded to gloo-v1.15.0-beta24.
- solo-io/k8s-utils has been upgraded to v0.5.0.
- solo-io/solo-kit has been upgraded to v0.33.0.
- solo-io/skv2 has been upgraded to v0.32.0.
- solo-io/go-utils has been upgraded to v0.24.6.
- k8s.io/api has been upgraded to v0.27.3.
- k8s.io/apiextensions-apiserver has been upgraded to v0.27.3.
- k8s.io/apimachinery has been upgraded to v0.27.3.
- k8s.io/client-go has been upgraded to v0.27.3.
- k8s.io/code-generator has been upgraded to v0.27.3.
- k8s.io/utils has been upgraded to v0.0.0-20230406110748-d93618cff8a2.
- sigs.k8s.io/controller-runtime has been upgraded to v0.15.0.
- helm.sh/helm has been upgraded to v3.12.2.
- solo-io/go-utils has been upgraded to v0.24.6.
- solo-io/k8s-utils has been upgraded to v0.5.0.
- solo-io/skv2 has been upgraded to v0.32.0.
- solo-io/solo-apis has been upgraded to sa-k8s-1.27-bump.
- solo-io/solo-kit has been upgraded to v0.33.0.
- k8s.io/api has been upgraded to v0.27.3.
- k8s.io/apiextensions-apiserver has been upgraded to v0.27.3.
- k8s.io/apimachinery has been upgraded to v0.27.3.
- k8s.io/client-go has been upgraded to v0.27.3.
- k8s.io/code-generator has been upgraded to v0.27.3.
- k8s.io/component-base has been upgraded to v0.27.3.
- k8s.io/kubectl has been upgraded to v0.27.3.
- k8s.io/kube-openapi has been upgraded to v0.0.0-20230501164219-8b0f38b5fd1f.
- k8s.io/metrics has been upgraded to v0.27.3.
- k8s.io/utils has been upgraded to v0.0.0-20230220204549-a5ecb0141aa5.
- sigs.k8s.io/controller-runtime has been upgraded to v0.15.0.
- solo-io/envoy-gloo has been upgraded to v1.26.3-patch2.
- solo-io/envoy-gloo has been upgraded to v1.26.4-patch1.
- solo-io/k8s-utils has been upgraded to v0.4.1.
- solo-io/envoy-gloo has been upgraded to v1.26.2-patch3.
- envoyproxy/go-control-plane has been upgraded to v0.11.1.
- envoyproxy/protoc-gen-validate has been upgraded to v1.0.1.
- google.golang.org/grpc has been upgraded to v1.55.0.
- google.golang.org/protobuf has been upgraded to v1.30.0.
Fixes
- Pulls in upstream Envoy v1.26.4, which includes fixes for CVE-2023-35941, CVE-2023-35942, CVE-2023-35944, and CVE-2023-35945 (https://github.com/solo-io/solo-projects/issues/5138)
- Fix typo in helm template when rendering multiple Gateways. (https://github.com/solo-io/gloo/issues/8404)
- When modifying gateways that depend on TCP upstreams that do not exist, report these validation issues not as errors, but as warnings instead (https://github.com/solo-io/solo-projects/issues/5163)
New Features
- Use later version of Inja for transformations (Version 3.4) which provides access to numerous new templating features. (https://github.com/solo-io/gloo/issues/8177)
- Add option to preserve escaped characters within an entire TransformationTemplate and a new Inja function for fine-grained control within a template. (https://github.com/solo-io/solo-projects/issues/5155)
- Gloo now supports connection limiting. This restricts the number of active connections per gateway. Useful to protect resources, ensure fair share of resources across gateways, and prevent DoS attacks. Both HTTP and TCP Gateways can now be configured via the `options.ConnectionLimit` parameter to restrict the number of active connections and wait for an optional delay before closing them. This is based off the envoy Connection Limit Filter (https://www.envoyproxy.io/docs/envoy/latest/configuration/listeners/network_filters/connection_limit_filter) (https://github.com/solo-io/gloo/issues/7428)
- Add an environment variable "HEADER_SECRET_REF_NS_MATCHES_US" that when set in the gloo pod requires that secrets sent in headers to an upstream are in the same namespace as that upstream. This defaults to false and when it is not set, resources can be in any namespaces watched by Gloo. (https://github.com/solo-io/solo-projects/issues/5007)
- Adds the ability to pass `initial_metadata` while configuring a GrpcHealthCheck. It specifies a list of key-value pairs that should be added to the metadata of each GRPC call that is sent to the health checked cluster. (https://github.com/solo-io/gloo/issues/8490)
- Add option to preserve escaped characters within an entire TransformationTemplate and a new Inja function for fine-grained control within a template. (https://github.com/solo-io/solo-projects/issues/5155)
- Gloo now supports connection limiting. This restricts the number of active connections per gateway. Useful to protect resources, ensure fair share of resources across gateways, and prevent DoS attacks. Both HTTP and TCP Gateways can now be configured via the `options.ConnectionLimit` parameter to restrict the number of active connections and wait for an optional delay before closing them. This is based off the envoy Connection Limit Filter (https://www.envoyproxy.io/docs/envoy/latest/configuration/listeners/network_filters/connection_limit_filter) (https://github.com/solo-io/gloo/issues/7428)
- Add an environment variable "HEADER_SECRET_REF_NS_MATCHES_US" that when set in the gloo pod requires that secrets sent in headers to an upstream are in the same namespace as that upstream. This defaults to false and when it is not set, resources can be in any namespaces watched by Gloo. (https://github.com/solo-io/solo-projects/issues/5007)
- Use later version of Inja for transformations (Version 3.4) which provides access to numerous new templating features. (https://github.com/solo-io/gloo/issues/8177)
Extra Notes
- *This release build failed.*

v1.15.0-beta4 (v1.15.0)

Fri, 14 Jul 2023 18:32:16 GMT

Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.39.1.
- jhump/protoreflect has been upgraded to v1.15.1.
- solo-io/ext-auth-service has been upgraded to v0.40.0.
- solo-io/go-utils has been upgraded to v0.24.5.
- solo-io/gloo has been upgraded to v1.15.0-beta17.
- solo-io/solo-apis has been upgraded to gloo-v1.15.0-beta17.
- solo-io/envoy-gloo-ee has been upgraded to v1.25.8-patch1.
- solo-io/gloo has been upgraded to v1.15.0-beta19.
- solo-io/solo-apis has been upgraded to gloo-v1.15.0-beta19.
- solo-io/gloo has been upgraded to v1.15.0-beta18.
- solo-io/gloo has been upgraded to v1.15.0-beta15.
- solo-io/gloo has been upgraded to v1.15.0-beta16.
Fixes
- OIDC's EndSessionParameters were not being translated and used in ext-auth-service, and has now been fixed. (https://github.com/solo-io/solo-projects/issues/3927)
- Pulls in upstream Envoy v1.25.8-patch1, which includes a fix for CVE-2023-35945 (https://github.com/solo-io/solo-projects/issues/5138)
Helm Changes
- Allow extauth to log to a file by setting the global.extensions.extAuth.deployment.logToFileLocation Helm value to the desired file location. This is done to support AWS Fargate, which cannot collect logs from stdout. The end user is responsible for ensuring the necessary volume is mounted and for log rotation and maintenance. (https://github.com/solo-io/gloo/issues/7729)

v1.15.0-beta3 (v1.15.0)

Fri, 23 Jun 2023 22:04:49 GMT

Extra Notes
- This release contained no user-facing changes.

v1.15.0-beta2 (v1.15.0)

Fri, 16 Jun 2023 18:59:22 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.15.0-beta12.
- solo-io/gloo has been upgraded to v1.15.0-beta6.
- solo-io/go-utils has been upgraded to v0.24.2.
- solo-io/solo-apis has been upgraded to gloo-v1.15.0-beta6.
- solo-io/skv2 has been upgraded to v0.29.7-0.20230421193338-ff4b71e3a12f.
- solo-io/rate-limiter has been upgraded to v0.9.0.
- solo-io/ext-auth-service has been upgraded to v0.36.0.
- solo-io/external-apis has been upgraded to gloo-v0.2.0.
- k8s.io/api has been upgraded to v0.26.4.
- k8s.io/apiextensions-apiserver has been upgraded to v0.26.4.
- k8s.io/apimachinery has been upgraded to v0.26.4.
- k8s.io/code-generator has been upgraded to v0.26.4.
- k8s.io/utils has been upgraded to v0.0.0-20221128185143-99ec85e7a448.
- sigs.k8s.io/controller-runtime has been upgraded to v0.14.4.
- k8s.io/client-go has been upgraded to v0.26.4.
- k8s.io/kube-openapi has been upgraded to v0.0.0-20221012153701-172d655c2280.
- solo-io/caching-service has been upgraded to v0.4.0.
- solo-io/ext-auth-service has been upgraded to v0.38.0.
- solo-io/gloo has been upgraded to v1.15.0-beta8.
- solo-io/solo-apis has been upgraded to gloo-v1.15.0-beta8.
- solo-io/k8s-utils has been upgraded to v0.4.0.
- solo-io/solo-kit has been upgraded to v0.32.0.
- solo-io/gloo has been upgraded to v1.15.0-beta7.
- solo-io/gloo has been upgraded to v1.15.0-beta11.
- solo-io/skv2 has been upgraded to v0.30.1.
- solo-io/gloo has been upgraded to v1.15.0-beta10.
- solo-io/solo-apis has been upgraded to gloo-v1.15.0-beta10.
- solo-io/go-utils has been upgraded to v0.24.3.
- solo-io/rate-limiter has been upgraded to v0.9.1.
- solo-io/caching-service has been upgraded to v0.3.0.
- solo-io/solo-apis has been upgraded to gloo-v1.15.0-beta14.
- solo-io/gloo has been upgraded to v1.15.0-beta14.
- envoy-gloo-ee/solo-io has been upgraded to v1.25.7-patch1.
Fixes
- Add support for an optional parameter `terminatingCiphers` for deprecated cipher passthrough. Ciphers for this feature can be added in the `sslConfig` of an httpgateway or virtualservice (if using the isolate by vsfunctionality). If set only these ciphers will be considered as native for passthrough decisions. This resolves an issue where clients that offer native but disallowed ciphers would not be eligible for passthrough. (https://github.com/solo-io/solo-projects/issues/5044)
- Ignore missing CRDs on remote clusters during Gloo Fed discovery. This allows us to continue reconciling in the case where a remote cluster is on an older Gloo Edge version that does not have all the CRDs that are on the management cluster. (https://github.com/solo-io/solo-projects/issues/4990)
- Fix issue with ext-auth config having failed status, when only `session.cookieOptions` are set. (https://github.com/solo-io/solo-projects/issues/5072)
- Fix UI bug falsely stating no Envoy proxies exist when Gloo Federation is not enabled. (https://github.com/solo-io/gloo/issues/8285)
- Translate oauth2 config when disableClientSecret is set. (https://github.com/solo-io/gloo/issues/6095)
- ECDSA and EdDSA (as ED25519) public keys are now supported for JWT auth. (https://github.com/solo-io/gloo/issues/7993)
- Move from unmaintained form3tech-oss/jwt-go to golang-jwt/jwt. (https://github.com/solo-io/gloo/issues/7993)
- Added customInputResource unmarshalling logic to ValidatingAdmissionWebhook for RateLimitConfigs (https://github.com/solo-io/gloo/issues/8042)
Helm Changes
- Enable TLS directly through new helm value `redis.tls`. This fixes issue with rate-limit having issues connecting to TLS. (https://github.com/solo-io/gloo/issues/8033)
- Allow `gloo.settings.ratelimitServer` helm value to override defaults. (https://github.com/solo-io/gloo/issues/4379)
- Adding PodSecurityContext to gloo-fed deployment pod. Values are set at with gloo-fed.glooFed.podSecurityContext. (https://github.com/solo-io/gloo/issues/7912)
- Allow custom securityContext definitions to be merged with the default definition instead of overwriting with the use of the `mergePolicy` field. This is useful, for example, for setting the `runAsNonRoot` field to `true` without overwriting the default securityContext. The default, which is also indicated by the attribute `mergePolicy` value of `no-merge` results in the defined securityContext being used in the chart. If the value is set to `helm-merge` the defined securityContext will be merged with the default securityContext with the helm merge command, with defined values overriding the defaults. If the value is unrecognized, an error is thrown.
- Allow namedExtAuth references to be defined in Settings by setting the global.extensions.extAuth.namedExtAuth value. (https://github.com/solo-io/solo-projects/issues/5030)
- Setting the helm value, `redis.disabled` to `true`, will no longer create the `redis` secret when `global.extensions.glooRedis.enableAcl` is set to `true`, it's default value.
New Features
- Enable TCP passthrough when client provides TLS ciphers that are not
- Add an option to specify the Redis DB used (when not using clustered redis or client-side-sharding), can be set via .Values.redis.service.db. (https://github.com/solo-io/gloo/issues/7959)

v1.15.0-beta1 (v1.15.0)

Thu, 04 May 2023 17:15:29 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.25.6-patch1.
- solo-io/gloo has been upgraded to v1.15.0-beta5.
- solo-io/solo-apis has been upgraded to gloo-v1.15.0-beta5.
- solo-io/envoy-gloo has been upgraded to v1.25.4-patch2.
- alpine/alpine has been upgraded to 3.17.3.
- graphql-go/graphql has been upgraded to v0.8.1.
- coreruleset/coreruleset has been upgraded to v3.2.1.
- redis/go-redis has been upgraded to v9.0.3+(notquitepatch4).
- solo-io/caching-service has been upgraded to v0.2.1.
- solo-io/rate-limiter has been upgraded to v0.8.2.
- solo-io/ext-auth-service has been upgraded to v0.35.4.
Fixes
- Check go version before building docker images, other small fixes (https://github.com/solo-io/gloo/issues/7926)
- Deduplicate EnvVars in our rate limit deployment to fix potential crashes when deploying helm charts with ArgoCI (https://github.com/solo-io/gloo/issues/7992)
- gRPC will now generate the `grpcDescriptorRegistry.protoDescriptorBin` when a gRPC graphQLAPI resource is discovered. (https://github.com/solo-io/gloo/issues/8031)
- Configure the gRPC connections from the enterprise ext-auth and rate-limit services to support large xDS responses from the Gloo Control Plane. Previously, when the default value was exceeded, the connection would fail causing updates to not be sent to the services. (https://github.com/solo-io/gloo/issues/8135)
New Features
- Introduce ability to configure timeouts for individual resolutions within a GraphQL query. Additionally, default the resolver timeout to that configured on the upstream, if any. The per-resolution timeout will overwrite the upstream timeout, and if neither are set then the default timeout of 1 second will be applied. (https://github.com/solo-io/gloo/issues/7950)
- Can now add symmetric key encryption to Ext-Auth-Service cookie sessions. By adding a encryptionkey, `glooctl create secret encryptionkey --name --key ` and the corresponding configuration `session.cipherConfig.keyRef` to the AuthConfig. (https://github.com/solo-io/ext-auth-service/issues/433)

v1.14.23 (v1.14.0)

Thu, 03 Oct 2024 19:03:04 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.14.32.
- solo-io/solo-apis has been upgraded to gloo-v1.14.32.
Fixes
- Fix a bug that caused discovered Upstreams to not reflect the updated state of parent Services discovered using watchLabels (https://github.com/solo-io/gloo/issues/8635)
- Fix a bug where the service and function names of a discovered gRPC service are not printed in JSON and YAML
- Infer the gloo deployment name in cases where the deployment name is not the default `gloo`. The gloo deployment is identified by the `gloo=gloo` label. (https://github.com/solo-io/gloo/issues/9163)
- Fix a bug where the service and function names of a discovered gRPC service are not printed when running glooctl get upstreams (https://github.com/solo-io/gloo/issues/9644)

v1.14.22 (v1.14.0)

Mon, 05 Aug 2024 18:36:46 GMT

Fixes
- Fix CVE-2024-24790 && CVE-2024-2398 (https://github.com/solo-io/solo-projects/issues/6669)

v1.14.21 (v1.14.0)

Mon, 15 Jul 2024 15:27:38 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.14.31.
- solo-io/solo-apis has been upgraded to gloo-v1.14.31.
- solo-io/cloud-builders has been upgraded to v0.7.7.
- bitnami/kubectl has been upgraded to 1.27.15.
- solo-io/cloud-builders has been upgraded to v0.7.7.

v1.14.20 (v1.14.0)

Tue, 02 Jul 2024 21:00:43 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.25.11-patch3.

v1.14.19 (v1.14.0)

Thu, 09 May 2024 20:11:48 GMT

Dependency Bumps
- linux/alpine has been upgraded to 3.17.6.
- google/docker golang has been upgraded to golang:1.21.10-alpine3.18.
- solo-io/cloud-builders has been upgraded to 0.7.6.
- solo-io/gloo has been upgraded to v1.14.30.
- bitnami/kubectl has been upgraded to 1.27.13.
- solo-io/cloud-builders has been upgraded to 0.7.6.

v1.14.18 (v1.14.0)

Mon, 29 Apr 2024 18:08:45 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.25.11-patch2.
Fixes
- Auto SNI CVE https://github.com/envoyproxy/envoy/security/advisories/GHSA-3mh5-6q8v-25wj. Previously static upstreams with auto_sni enabled could be vunerable to CVE-2024-32475 (https://github.com/solo-io/solo-projects/issues/6077)

v1.14.17 (v1.14.0)

Mon, 15 Apr 2024 14:19:25 GMT

Dependency Bumps
- solo-io/envoy-gloo has been upgraded to 1.25.11-patch1.
Fixes
- HTTP2 continuation CVE fixed. See https://github.com/envoyproxy/envoy/security/advisories/GHSA-j654-3ccm-vfmm (https://github.com/solo-io/solo-projects/issues/6008)

v1.14.16 (v1.14.0)

Wed, 20 Mar 2024 19:19:56 GMT

Extra Notes
- This release contained no user-facing changes.

v1.14.15 (v1.14.0)

Thu, 15 Feb 2024 18:10:35 GMT

Dependency Bumps
- solo-io/envoy-gloo has been upgraded to v1.25.10-patch2.
- solo-io/gloo has been upgraded to v1.14.29.
- solo-io/solo-apis has been upgraded to gloo-v1.14.29.
- solo-io/envoy-gloo has been upgraded to v1.25.10-patch2.
Fixes
- Allow configuring the authority header for ratelimit gRPC calls. (https://github.com/solo-io/gloo/issues/8995)
- Add missing required runtime key for aggression in slow start config. (https://github.com/solo-io/gloo/pull/9031)
- Expose a new ratelimit option `grpcService.authority` to configure the authority header for the ratelimit gRPC call. (https://github.com/solo-io/gloo/issues/8995)

v1.14.14 (v1.14.0)

Fri, 22 Dec 2023 21:14:46 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.14.28.
- golang.org/x/net has been upgraded to v0.17.0.
- nginx/nginx has been upgraded to 1.25.3-alpine3.18.
- alpine/alpine has been upgraded to 3.17.6.
- solo-io/cloud-builders has been upgraded to 0.7.1.
- solo-io/gloo has been upgraded to v1.14.27.
- solo-io/cloud-builders has been upgraded to v0.6.8.
- x/net has been upgraded to v0.18.0.
- google/go has been upgraded to 1.20.11.
- linux/alpine has been upgraded to 3.17.6.
- solo-io/cloud-builders has been upgraded to 0.7.1.
- golang.org/crypto has been upgraded to v0.17.0.
Fixes
- Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the `--wait` flag and via ArgoCD. (https://github.com/solo-io/gloo/issues/8288)
- Support `k8sSecretApikeyStorage` translation. (https://github.com/solo-io/gloo/issues/8709)
- Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the `--wait` flag and via ArgoCD. (https://github.com/solo-io/gloo/issues/8288)
Helm Changes
- Delegate creating CRs to the OSS resource rollout job. (https://github.com/solo-io/solo-projects/issues/5490)
- Adds a new helm value `global.extraCustomResources` to allow users to add additional custom resources to create, as defined by a helm partial (https://github.com/solo-io/solo-projects/issues/5490)

v1.14.13 (v1.14.0)

Wed, 01 Nov 2023 20:06:57 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.14.25.
- solo-io/ext-auth-service has been upgraded to v0.35.6-patch6.
- google.golang.org/grpc has been upgraded to v1.59.0.
- solo-io/gloo has been upgraded to v1.14.26.
- golang.org/grpc has been upgraded to 1.59.0.
- jhump/protoreflect has been upgraded to v1.15.3.
Fixes
- Ensure that ApiKeys which are persisted in Aerospike respect the labelSelector configuration on the AuthConfig API. (https://github.com/solo-io/dev-portal/issues/2753)
- Certgen job will now renew existing certificate if it is expiring soon (90d by default). (https://github.com/solo-io/gloo/issues/5944)
Helm Changes
- Add new certgen CronJob if validation webhook is enabled (https://github.com/solo-io/gloo/issues/5944)
- Add an option to enable `force-rotation` flag for certgen job (https://github.com/solo-io/gloo/issues/5944)

v1.14.12 (v1.14.0)

Fri, 20 Oct 2023 22:06:28 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.14.24.
Fixes
- Unfortunately, the custom readiness probe fix causes issues in deployments via Argo, since the resouce-rollout job is deleted and causes the argo app to go out of sync, as well as missing permissions to watch jobs. Reverted this fix (https://github.com/solo-io/gloo/issues/8809)
- Unfortunately, the custom readiness probe fix causes issues in deployments via Argo, since the resouce-rollout job is deleted and causes the argo app to go out of sync, as well as missing permissions to watch jobs. Reverted this fix (https://github.com/solo-io/gloo/issues/8809)

v1.14.11 (v1.14.0)

Fri, 13 Oct 2023 00:15:57 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.25.10-patch1.
- solo-io/cloud-builders has been upgraded to 0.6.5.
- solo-io/envoy-gloo-ee has been upgraded to v1.25.9-patch4.
- solo-io/gloo has been upgraded to v1.14.23.
- solo-io/cloud-builders has been upgraded to v0.6.5.
- solo-io/envoy-gloo has been upgraded to v1.25.10-patch1.
Fixes
- Note that this version of envoy adds` `http.max_requests_per_io_cycle`` as a runtime value. This runtime value can be set to 1 in the presence of abusive HTTP/2 or HTTP/3 connections. (https://github.com/solo-io/solo-projects/issues/5391)
- Ensure that `failover.policy` configuration on an Upstream is respected for Static Upstreams. (https://github.com/solo-io/gloo/issues/8720)
- Remove the Envoy cluster from the error log when validating clusters, avoiding the exposure of sensitive data (secrets). (https://github.com/solo-io/gloo/issues/8592)
- This ensures that a new deployment is rolled if the configmap it references changes. This is done by adding a `checksum/` annotation on any deployment that uses a configmap as a container volume. (https://github.com/solo-io/gloo/issues/8392)
- Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the `--wait` flag. (https://github.com/solo-io/gloo/issues/8288)
- Fix istio-proxy container definition in gateway-proxy template Add new e2e tests that handles Istio SDS case, ensuring mTLS occurs as expected (https://github.com/solo-io/gloo/issues/8092)
Helm Changes
- Adds the helm value `gateway.rolloutJob.timeout` to specifiy the timeout to wait for the resource rollout job to complete. (https://github.com/solo-io/gloo/issues/8782)
- Changes the default value of `gateway.rolloutJob.ttlSecondsAfterFinished` from 60 to 300 to accomodate the fix for the aforementioned custom readiness probe issue. (https://github.com/solo-io/gloo/issues/8288)

v1.14.10 (v1.14.0)

Tue, 26 Sep 2023 20:30:56 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.25.9-patch3.
- solo-io/gloo has been upgraded to v1.14.21.
- solo-io/envoy-gloo has been upgraded to v1.25.9-patch2.
Fixes
- Add support for `most_specific_header_mutations_wins` to allow the more specific header mutation to win. Toggling it on would reverse the evaluation order of the header mutations, allowing more specific header mutations to overwrite less specific.
- Support role chaining using EKS ServiceAccounts outside of us-east-1 (https://github.com/solo-io/gloo/issues/8578)
Helm Changes
- Update enterprise chart with fix for TTL not being respected on Helm hook jobs due to deletion policy. (https://github.com/solo-io/gloo/issues/8500)
- Ensure that setting `discovery.deployment.image.fips` will result in the FIPS variant of the discovery image being used. (https://github.com/solo-io/solo-projects/issues/5367)
- Fix TTL not being respected on Helm hook jobs due to deletion policy. (https://github.com/solo-io/gloo/issues/8500)

v1.14.9 (v1.14.0)

Sun, 10 Sep 2023 00:09:08 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.14.18.
- solo-io/gloo has been upgraded to v1.14.19.
- solo-io/solo-apis has been upgraded to gloo-v1.14.19.
- solo-io/gloo has been upgraded to v1.14.17.
- solo-io/ext-auth-service has been upgraded to v0.35.6-patch5.
- solo-io/envoy-gloo-ee has been upgraded to 1.25.9-patch2.
- solo-io/gloo has been upgraded to v1.14.16.
- solo-io/k8s-utils has been upgraded to v0.3.3.
- solo-io/cloud-builders has been upgraded to v0.6.4.
Fixes
- Fix incorrect CRD generation and overflow caused of proto fileds of type `google.protobuf.UInt64Value`. Previously fields of this type had an incorrect schema as well as led to overflows which led to them failing being unmarshalled, which is now resolved by changing the type to `google.protobuf.UInt32Value`, which is backward-forward compatible. Ref. https://protobuf.dev/programming-guides/proto2/#updating point 5. Affected protos include gateway specs `httpGateway.options.caching.maxPayloadSize` and `httpGateway.options.connectionLimit.maxActiveConnections` (https://github.com/solo-io/gloo/issues/8568)
- Prevent nil headers from being sent from auth to upstream (https://github.com/solo-io/gloo/issues/8391)
- Plugin and test updates to correctly check for empty required fields in RateLimit actions. (https://github.com/solo-io/gloo/issues/8573)
- Add fields to the API to allow Envoy to set x-fowarded-host and x-forwarded-post headers. (https://github.com/solo-io/gloo/issues/7683)
- Fix incorrect CRD generation and overflow caused of proto fileds of type `google.protobuf.UInt64Value`. Previously fields of this type had an incorrect schema as well as led to overflows which led to them failing being unmarshalled, which is now resolved by changing the type to `google.protobuf.UInt32Value`, which is backward-forward compatible. Ref. https://protobuf.dev/programming-guides/proto2/#updating point 5. Affected protos include gateway specs `httpGateway.options.caching.maxPayloadSize` and `httpGateway.options.connectionLimit.maxActiveConnections` (https://github.com/solo-io/gloo/issues/8568)
- Check for empty values in fields that are required by Envoy for RateLimitActions. Previously invalid config would be passed to Envoy. API reference: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-ratelimit-action. (https://github.com/solo-io/gloo/issues/8573)
- Added customInputResource unmarshalling logic to ValidatingAdmissionWebhook for RateLimitConfigs (https://github.com/solo-io/gloo/issues/8042)
Helm Changes
- Fix syntax error in Gateway yaml when using kube overrides. (https://github.com/solo-io/gloo/issues/8648)
- Added PodDisruptionBudget helm values for the gloo deployment (https://github.com/solo-io/gloo/issues/8445)

v1.14.8 (v1.14.0)

Thu, 03 Aug 2023 19:29:50 GMT

Dependency Bumps
- solo-io/cloudbuilders has been upgraded to v0.6.3.
- solo-io/envoy-gloo-ee has been upgraded to v1.25.9-patch1.
- solo-io/gloo has been upgraded to v1.14.14.
- solo-io/cloudbuilders has been upgraded to v0.6.4.
- solo-io/gloo has been upgraded to v1.14.13.
- solo-io/k8s-utils has been upgraded to v0.3.2.
- solo-io/envoy-gloo has been upgraded to v1.25.9-patch1.
- solo-io/k8s-utils has been upgraded to v0.3.2.
- bitnami/kubectl has been upgraded to 1.25.9.
- solo-io/envoy-gloo has been upgraded to v1.25.6-patch1.
Fixes
- Pulls in upstream Envoy v1.25.9, which includes fixes for CVE-2023-35941, CVE-2023-35942, CVE-2023-35944, and CVE-2023-35945 (https://github.com/solo-io/solo-projects/issues/5138)
- Adds the ability to pass `initial_metadata` while configuring a GrpcHealthCheck. It specifies a list of key-value pairs that should be added to the metadata of each GRPC call that is sent to the health checked cluster. (https://github.com/solo-io/gloo/issues/8490)
- Add an environment variable "HEADER_SECRET_REF_NS_MATCHES_US" that when set in the gloo pod requires that secrets sent in headers to an upstream are in the same namespace as that upstream. This defaults to false and when it is not set, resources can be in any namespaces watched by Gloo. (https://github.com/solo-io/solo-projects/issues/5007)
- Adds the ability to pass `initial_metadata` while configuring a GrpcHealthCheck. It specifies a list of key-value pairs that should be added to the metadata of each GRPC call that is sent to the health checked cluster. (https://github.com/solo-io/gloo/issues/8490)
- Pulls in upstream Envoy v1.25.9-patch1, which resolves CVE-2023-35941, CVE-2023-35942, CVE-2023-35944, and CVE-2023-35945 (https://github.com/solo-io/solo-projects/issues/5138)
- Fix typo in helm template when rendering multiple Gateways. (https://github.com/solo-io/gloo/issues/8404)
- Add an environment variable "HEADER_SECRET_REF_NS_MATCHES_US" that when set in the gloo pod requires that secrets sent in headers to an upstream are in the same namespace as that upstream. This defaults to false and when it is not set, resources can be in any namespaces watched by Gloo. (https://github.com/solo-io/solo-projects/issues/5007)
- Adds regex validation to gloo.solo.io.RouteOptions.prefixRewrite and gloo.solo.io.RouteOptions.hostRewritePathRegex to prevent leaking invalid regex to envoy (https://github.com/solo-io/gloo/issues/8091)
- Added the ability to create EncryptionSecrets via `glooctl create secret`. (https://github.com/solo-io/gloo/issues/8094)
- To give users time to migrate, discovery does not overwrite the old gRPC upstream API with the new one. (https://github.com/solo-io/gloo/issues/7983)
New Features
- Expose Envoy's OCSP Stapling support through two new fields: `ocsp_staple` and `ocsp_staple_policy`. OCSP responses can be stored in TLS secrets through `glooctl create secret tls`, or by manually storing the OCSP response in a k8s tls secret under the `data` field: `tls.ocsp-staple`. The `tls.ocsp-staple` secret field name is subject to change, and is currently based off of the naming used by cert-manager in this [WIP PR](https://github.com/cert-manager/cert-manager/pull/5830). (https://github.com/solo-io/gloo/issues/5605)

v1.14.7 (v1.14.0)

Fri, 14 Jul 2023 19:08:02 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.25.8-patch1.
- solo-io/gloo has been upgraded to v1.14.11.
- solo-io/solo-apis has been upgraded to gloo-v1.14.11.
- solo-io/ext-auth-service has been upgraded to v0.35.6-patch3.
- solo-io/gloo has been upgraded to v1.14.12.
Fixes
- Pulls in upstream Envoy v1.25.8-patch1, which includes a fix for CVE-2023-35945 (https://github.com/solo-io/solo-projects/issues/5138)
Helm Changes
- Allow extauth to log to a file by setting the global.extensions.extAuth.deployment.logToFileLocation Helm value to the desired file location. This is done to support AWS Fargate, which cannot collect logs from stdout. The end user is responsible for ensuring the necessary volume is mounted and for log rotation and maintenance. (https://github.com/solo-io/gloo/issues/7729)

v1.14.6 (v1.14.0)

Fri, 16 Jun 2023 18:47:23 GMT

Dependency Bumps
- solo-io/solo-apis has been upgraded to gloo-v1.14.9.
- solo-io/gloo has been upgraded to v1.14.9.
Fixes
- Translate oauth2 config when disableClientSecret is set. (https://github.com/solo-io/gloo/issues/6095)

v1.14.5 (v1.14.0)

Mon, 12 Jun 2023 20:41:31 GMT

Dependency Bumps
- docker/distribution has been upgraded to v2.8.2+incompatible.
- solo-io/gloo has been upgraded to v1.14.8.
- solo-io/envoy-gloo-ee has been upgraded to v1.25.7-patch1.
Fixes
- Fix UI bug falsely stating no Envoy proxies exist when Gloo Federation is not enabled. (https://github.com/solo-io/gloo/issues/8285)
Helm Changes
- Allow namedExtAuth references to be defined in Settings by setting the global.extensions.extAuth.namedExtAuth value. (https://github.com/solo-io/solo-projects/issues/5030)
- Allow `gloo.settings.ratelimitServer` helm value to override defaults. (https://github.com/solo-io/gloo/issues/4379)

v1.14.4 (v1.14.0)

Tue, 06 Jun 2023 18:14:28 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.14.7.
Fixes
- Add support for an optional parameter `terminatingCiphers` for deprecated cipher passthrough. Ciphers for this feature can be added in the `sslConfig` of an httpgateway or virtualservice (if using the isolate by vsfunctionality). If set only these ciphers will be considered as native for passthrough decisions. This resolves an issue where clients that offer native but disallowed ciphers would not be eligible for passthrough. (https://github.com/solo-io/solo-projects/issues/5044)
- Fix issue with ext-auth config having failed status, when only `session.cookieOptions` are set. (https://github.com/solo-io/solo-projects/issues/5072)
Helm Changes
- Adding PodSecurityContext to gloo-fed deployment pod. Values are set at with gloo-fed.glooFed.podSecurityContext. (https://github.com/solo-io/gloo/issues/7912)

v1.14.3 (v1.14.0)

Sun, 28 May 2023 07:38:43 GMT

Dependency Bumps
- solo-io/skv2 has been upgraded to v0.29.9.
- solo-io/gloo has been upgraded to v1.14.6.
- solo-io/rate-limiter has been upgraded to v0.8.4.
- solo-io/caching-service has been upgraded to v0.3.0.
Fixes
- Ignore missing CRDs on remote clusters during Gloo Fed discovery. This allows us to continue reconciling in the case where a remote cluster is on an older Gloo Edge version that does not have all the CRDs that are on the management cluster. (https://github.com/solo-io/solo-projects/issues/4990)
- Add an option to specify the Redis DB used (when not using clustered redis or client-side-sharding), can be set via .Values.redis.service.db. (https://github.com/solo-io/gloo/issues/7959)
Helm Changes
- Enable TLS directly through new helm value `redis.tls`. This fixes issue with rate-limit having issues connecting to TLS. (https://github.com/solo-io/gloo/issues/8033)
- Setting the helm value, `redis.disabled` to `true`, will no longer create the `redis` secret when `global.extensions.glooRedis.enableAcl` is set to `true`, it's default value.

v1.14.2 (v1.14.0)

Fri, 19 May 2023 02:07:15 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.14.2.
- solo-io/solo-apis has been upgraded to gloo-v1.14.2.
- solo-io/gloo has been upgraded to v1.14.4.
- solo-io/envoy-gloo-ee has been upgraded to 1.25.6-patch4.
- solo-io/gloo has been upgraded to v1.14.3.
- solo-io/solo-apis has been upgraded to gloo-v1.14.3.
- solo-io/gloo has been upgraded to v1.14.5.
- solo-io/solo-api has been upgraded to gloo-v1.14.5.
- redis/go-redis has been upgraded to v9.0.3+(notquitepatch4).
- solo-io/caching-service has been upgraded to v0.2.1.
- solo-io/rate-limiter has been upgraded to v0.8.2.
- solo-io/ext-auth-service has been upgraded to v0.35.6-patch0.
Fixes
- Enable TCP passthrough when client provides TLS ciphers that are not
- Introduce ability to configure timeouts for individual resolutions within a GraphQL query. Additionally, default the resolver timeout to that configured on the upstream, if any. The per-resolution timeout will overwrite the upstream timeout, and if neither are set then the default timeout of 1 second will be applied. (https://github.com/solo-io/gloo/issues/7950)
- ECDSA and EdDSA (as ED25519) public keys are now supported for JWT auth. (https://github.com/solo-io/gloo/issues/7993)
- Move from unmaintained form3tech-oss/jwt-go to golang-jwt/jwt. (https://github.com/solo-io/gloo/issues/7993)
- Can now add symmetric key encryption to Ext-Auth-Service cookie sessions. By adding a encryptionkey, `glooctl create secret encryptionkey --name --key ` and the corresponding configuration `session.cipherConfig.keyRef` to the AuthConfig. (https://github.com/solo-io/ext-auth-service/issues/433)
Helm Changes
- Original PR: https://github.com/solo-io/solo-projects/pull/4932

v1.14.1 (v1.14.0)

Tue, 02 May 2023 03:29:09 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.25.6-patch1.
- solo-io/gloo has been upgraded to v1.14.1.
- solo-io/solo-apis has been upgraded to gloo-v1.14.1.
- solo-io/envoy-gloo-ee has been upgraded to v1.25.6-patch2.
- bitnami/kubectl has been upgraded to 1.25.9.
- solo-io/envoy-gloo has been upgraded to v1.25.6-patch1.
Fixes
- gRPC will now generate the `grpcDescriptorRegistry.protoDescriptorBin` when a gRPC graphQLAPI resource is discovered. (https://github.com/solo-io/gloo/issues/8031)
- Configure the gRPC connections from the enterprise ext-auth and rate-limit services to support large xDS responses from the Gloo Control Plane. Previously, when the default value was exceeded, the connection would fail causing updates to not be sent to the services. (https://github.com/solo-io/gloo/issues/8135)

v1.14.0 (v1.14.0)

Thu, 27 Apr 2023 11:39:09 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.14.0.
- graphql-go/graphql has been upgraded to v0.8.1.

v1.14.0-rc2 (v1.14.0)

Thu, 13 Apr 2023 21:03:08 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.14.0-rc2.
- solo-io/envoy-gloo has been upgraded to v1.25.4-patch2.
- alpine/alpine has been upgraded to 3.17.3.
- coreruleset/coreruleset has been upgraded to v3.2.1.
Fixes
- To give users time to migrate, discovery does not overwrite the old gRPC upstream API with the new one. (https://github.com/solo-io/gloo/issues/7983)

v1.14.0-rc1 (v1.14.0)

Thu, 06 Apr 2023 16:18:58 GMT

Breaking Changes
- Adds support for running Gloo Edge Enterprise on Kubernetes 1.25 and removes support for 1.22 and below. Note that if you are using the Prometheus charts included with Gloo Edge, the default kube-state-metrics deployment name has been changed from `glooe-prometheus-kube-state-metrics` to `glooe-prometheus-kube-state-metrics-v2` to get around the [chart's breaking change](https://github.com/prometheus-community/helm-charts/issues/1542). If you are overriding the deployment name with a custom name (via the `prometheus.kube-state-metrics.fullnameOverride` helm value), you may need to either rename it before upgrading, or use the [documented workaround](https://github.com/prometheus-community/helm-charts/blob/main/charts/prometheus/README.md#to-150) of deleting the existing kube-state-metrics deployment first. (https://github.com/solo-io/gloo/issues/6833)
- responseTransformation will no longer overwrite the content-type header to text/html. (https://github.com/solo-io/solo-projects/issues/4438)
Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.25.1-patch1.
- solo-io/ext-auth-service has been upgraded to v0.34.3.
- k8s.io/api has been upgraded to v0.25.8.
- k8s.io/apiextensions-apiserver has been upgraded to v0.25.8.
- k8s.io/apimachinery has been upgraded to v0.25.8.
- k8s.io/cli-runtime has been upgraded to v0.25.8.
- k8s.io/client-go has been upgraded to v0.25.8.
- k8s.io/code-generator has been upgraded to v0.25.8.
- k8s.io/component-base has been upgraded to v0.25.8.
- k8s.io/kubectl has been upgraded to v0.25.8.
- k8s.io/metrics has been upgraded to v0.25.8.
- k8s.io/kube-openapi has been upgraded to v0.0.0-20220803162953-67bda5d908f1.
- helm/helm has been upgraded to v3.11.2.
- solo-io/anyvendor has been upgraded to v0.1.0.
- solo-io/gloo has been upgraded to v1.14.0-rc1.
- solo-io/solo-apis has been upgraded to gloo-v1.14.0-rc1.
- solo-io/skv2 has been upgraded to v0.29.5.
- solo-io/caching-service has been upgraded to v0.2.0.
- solo-io/ext-auth-service has been upgraded to v0.35.1.
- solo-io/rate-limiter has been upgraded to v0.8.0.
Helm Changes
- Fixes in the Enterprise Helm charts to standardise the exposure of `logLevel` flag. The log level for exauth, rate-limit, caching, and observability deployments can be set using the helm values `global.extensions.extAuth.deployment.logLevel`, `global.extensions.rateLimit.deployment.logLevel`, `global.extensions.caching.deployment.logLevel`, and `observability.deployment.logLevel`, respectively. (https://github.com/solo-io/solo-projects/issues/4699)
New Features
- responseTransformation will now extract headers and status code from response body in addition to the body. (https://github.com/solo-io/solo-projects/issues/4438)

v1.14.0-beta11 (v1.14.0)

Fri, 24 Mar 2023 21:47:04 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.14.0-beta16.
- wundergraph/graphql-go-tools has been upgraded to v1.61.0.
- solo-io/gloo-graphql-example has been upgraded to v0.1.0.
- solo-io/ext-auth-service has been upgraded to v0.33.0.
- solo-io/gloo has been upgraded to v1.14.0-beta17.
New Features
- You can now Discover Remote Executors for GraphQL and generate GraphQLAPI custom resources in Gloo.
- Add translation required to use HMAC Auth with ext-auth. (https://github.com/solo-io/gloo/issues/7472)

v1.14.0-beta10 (v1.14.0)

Fri, 17 Mar 2023 20:35:20 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.24.1-patch3.
- solo-io/envoy-gloo-ee has been upgraded to v1.24.1-patch4.
- solo-io/ext-auth-service has been upgraded to v0.31.0.
- golang/go has been upgraded to v1.20.1.
- solo-io/skv2 has been upgraded to v0.26.2.
- avast/retry-go has been upgraded to v4.3.3.
- solo-io/gloo has been upgraded to v1.14.0-beta14.
- solo-io/go-utils has been upgraded to v0.24.0.
- solo-io/k8s-utils has been upgraded to v0.3.0.
- solo-io/protoc-gen-ext has been upgraded to v0.0.18.
- solo-io/solo-kit has been upgraded to v0.31.0.
- onsi/ginkgo/v2 has been upgraded to v2.5.0.
- onsi/gomega has been upgraded to v1.24.1.
- solo-io/licensing has been upgraded to v0.3.13.
- golang.org/x/net has been upgraded to v0.7.0.
Fixes
- Make the following retry options configurable when Gloo Fed encounters errors while handling cluster events: retry type (backoff or fixed), delay between retries, max delay, max number of attempts, and max jitter. (https://github.com/solo-io/gloo/issues/7814)
- GraphQL plugin now logs during translation if graphql features are not enabled. Changed from guarding the enabling of the plugin behind the license key check to guarding the translation logic to allow this check. (https://github.com/solo-io/solo-projects/issues/4330)
- Fixed bug where CRs are not rendered in helm chart if lexicographically smallest gwProxy disabled (https://github.com/solo-io/gloo/issues/5298)
- Old repo is creating UX issues where users are being given license keys that are too new for edge. Repo has been bumped and license now checked with a `NewLicensingClient` ( via `GetLicense` and `foundLicenseForState`) instead of `ValidateLicenseKey`. (https://github.com/solo-io/solo-projects/issues/4543)
- Race condition occurs with `NewIsolate()` function in v8go. Adding mutex to prevent this from occuring. (https://github.com/solo-io/solo-projects/issues/4569)
Helm Changes
- Added the ability to specify the container SecurityContexts PodSecurityContext for the Redis and rateLimit deployment charts by setting values for:
New Features
- Add support for sharing API key metadata between the API key and OPA auth modules. (https://github.com/solo-io/gloo-mesh-enterprise/issues/7628)

v1.14.0-beta9 (v1.14.0)

Fri, 17 Feb 2023 19:19:34 GMT

Dependency Bumps
- solo-io/solo-apis has been upgraded to gloo-v1.14.0-beta12.
- solo-io/gloo has been upgraded to v1.14.0-beta12.

v1.14.0-beta8 (v1.14.0)

Wed, 15 Feb 2023 20:44:08 GMT

Extra Notes
- This release contained no user-facing changes.

v1.14.0-beta7 (v1.14.0)

Wed, 15 Feb 2023 19:45:00 GMT

Extra Notes
- *This release build failed.*
- This release contained no user-facing changes.

v1.14.0-beta6 (v1.14.0)

Tue, 07 Feb 2023 21:49:54 GMT

Extra Notes
- *This release build failed.*
- This release contained no user-facing changes.

v1.14.0-beta5 (v1.14.0)

Tue, 07 Feb 2023 17:28:45 GMT

Extra Notes
- *This release build failed.*
- This release contained no user-facing changes.

v1.14.0-beta3 (v1.14.0)

Fri, 20 Jan 2023 22:45:45 GMT

Dependency Bumps
- solo-io/solo-apis has been upgraded to gloo-v1.14.0-beta6.
- solo-io/gloo has been upgraded to v1.14.0-beta6.
- solo-io/ext-auth-service has been upgraded to v0.30.0.
- solo-io/envoy-gloo-ee has been upgraded to v1.23.3-patch2.
- solo-io/gloo has been upgraded to v1.14.0-beta45.
- solo-io/k8s-utils has been upgraded to v0.1.9.
Fixes
- Prevent Ext-Auth side car container from crashing when connecting using unix domain socket. (https://github.com/solo-io/gloo/issues/5728)
- ExtAuth only pushes updates via xDS when the set of AuthConfigs has changed. Previously, an AuthConfig with multiple definitions would cause the hash of the snapshot to change on each translation run. (https://github.com/solo-io/gloo/issues/7546)
- Ensure that unmatched AuthConfigs at both VS and RT level do not cause extauth to loop loading config (https://github.com/solo-io/gloo/issues/6598)
New Features
- Updating extauth gRPC pass through feature to allow basic TLS connections (https://github.com/solo-io/solo-projects/issues/4469)

v1.14.0-beta2 (v1.14.0)

Fri, 06 Jan 2023 15:41:41 GMT

Dependency Bumps
- solo-io/caching-service has been upgraded to v0.1.17.
- solo-io/k8s-utils has been upgraded to v0.1.1.
- solo-io/skv2 has been upgraded to v0.26.1.
- solo-io/skv2 has been upgraded to v0.25.0.
- solo-io/gloo has been upgraded to v1.14.0-beta2.
- solo-io/skv2 has been upgraded to v0.26.0.
- solo-io/go-utils has been upgraded to v0.23.0.
- solo-io/k8s-utils has been upgraded to v0.1.7.
- solo-io/k8s-utils has been upgraded to v0.1.8.
- solo-io/gloo has been upgraded to v1.14.0-beta1.
- solo-io/gloo has been upgraded to v1.14.0-beta4.
- solo-io/solo-apis has been upgraded to gloo-v1.14.0-beta4.
Fixes
- Update helm charts to use "caching-service" instead of "caching-server" as the default cache service upstream name (https://github.com/solo-io/solo-projects/issues/4162)
- Fix Gloo Fed panic caused by unhashable types in reconciler queue. (https://github.com/solo-io/gloo/issues/7620)
- Fixes issue where Gloo Fed erroneously writes to a remote cluster registered by another Gloo Fed instance. The cluster watcher now only watches clusters registered in the Gloo Fed instance's own install namespace. (https://github.com/solo-io/gloo/issues/7529)
- Enterprise changes to disable linkerd injection in jobs. (https://github.com/solo-io/gloo/issues/7488)
- Gloo Federation for k8s 1.24+ now supports the 1.24 breaking changes in cluster naming and service accounts. (https://github.com/solo-io/gloo/issues/6611)
- Fix Gloo Fed cluster registration on k8s 1.24+. (https://github.com/solo-io/gloo/issues/7071)
- Fix a panic that occurs in Gloo Fed when applying a FailoverScheme. (https://github.com/solo-io/gloo/issues/7572)
- Added make targets to build glooctl for arm, added arch detection to setup kind scripts (https://github.com/solo-io/k8s-utils/issues/25)
- Fixes the issue where not supplying query variables breaks graphiql explorer queries. (https://github.com/solo-io/gloo/issues/7467)
New Features
- Expose clock skew seconds on JWT Provider (https://github.com/solo-io/gloo/issues/7398)

v1.14.0-beta1 (v1.14.0)

Sat, 03 Dec 2022 01:08:17 GMT

Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.29.2.
- solo-io/k8s-utils has been upgraded to v0.1.2.
Fixes
- Adds support for stitched APIs in the GraphQL Explorer UI. (https://github.com/solo-io/solo-projects/issues/4278)

v1.13.35 (v1.13.0)

Mon, 08 Jul 2024 16:44:36 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.39.
- solo-io/solo-apis has been upgraded to gloo-v1.13.39.
- solo-io/envoy-gloo-ee has been upgraded to v1.23.12-patch8.
- solo-io/cloud-builders has been upgraded to v0.7.7.
Fixes
- Infer the gloo deployment name in cases where the deployment name is not the default `gloo`. The gloo deployment is identified by the `gloo=gloo` label. (https://github.com/solo-io/gloo/issues/9163)
- Infer the gloo deployment name in cases where the deployment name is not the default `gloo`. The gloo deployment is identified by the `gloo=gloo` label. (https://github.com/solo-io/gloo/issues/9163)

v1.13.34 (v1.13.0)

Thu, 09 May 2024 20:10:21 GMT

Dependency Bumps
- linux/alpine has been upgraded to 3.17.6.
- google/docker golang has been upgraded to golang:1.21.10-alpine3.18.
- solo-io/gloo has been upgraded to v1.13.37.
- solo-apis/gloo has been upgraded to gloo-v1.13.37.
- solo-io/cloud-builders has been upgraded to 0.7.6.

v1.13.33 (v1.13.0)

Tue, 30 Apr 2024 14:32:00 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.23.12-patch7.
Fixes
- Auto SNI CVE https://github.com/envoyproxy/envoy/security/advisories/GHSA-3mh5-6q8v-25wj. Previously static upstreams with auto_sni enabled could be vunerable to CVE-2024-32475 (https://github.com/solo-io/solo-projects/issues/6077)

v1.13.32 (v1.13.0)

Mon, 15 Apr 2024 17:30:16 GMT

Dependency Bumps
- solo-io/envoy-gloo has been upgraded to 1.23.12-patch6.
Fixes
- HTTP2 continuation CVE fixed. See https://github.com/envoyproxy/envoy/security/advisories/GHSA-j654-3ccm-vfmm (https://github.com/solo-io/solo-projects/issues/6008)

v1.13.31 (v1.13.0)

Thu, 15 Feb 2024 18:25:47 GMT

Dependency Bumps
- solo-io/envoy-gloo has been upgraded to v1.23.12-patch5.
- solo-io/gloo has been upgraded to v1.13.36.
- solo-io/solo-apis has been upgraded to gloo-v1.13.36.
- solo-io/envoy-gloo has been upgraded to v1.23.12-patch4.
Fixes
- Allow configuring the authority header for ratelimit gRPC calls. (https://github.com/solo-io/gloo/issues/8995)
- Add missing required runtime key for aggression in slow start config. (https://github.com/solo-io/gloo/pull/9031)
- Expose a new ratelimit option `grpcService.authority` to configure the authority header for the ratelimit gRPC call. (https://github.com/solo-io/gloo/issues/8995)

v1.13.30 (v1.13.0)

Mon, 08 Jan 2024 14:06:08 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.35.
- solo-io/skv2 has been upgraded to v0.26.3.
- golang.org/crypto has been upgraded to v0.17.0.
- alpine/alpine has been upgraded to 3.17.6.
- solo-io/cloud-builders has been upgraded to 0.7.1.
- golang.org/grpc has been upgraded to 1.58.3.
- jhump/protoreflect has been upgraded to v1.15.1.
- solo-io/cloud-builders has been upgraded to v0.6.8.
- x/net has been upgraded to v0.18.0.
- google/go has been upgraded to 1.20.11.

v1.13.29 (v1.13.0)

Mon, 11 Dec 2023 00:02:18 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.31.
- solo-io/ext-auth-service has been upgraded to v0.29.14.
- solo-io/gloo has been upgraded to v1.13.32.
- salesforce/tough-cookie has been upgraded to 4.1.3.
- solo-io/cloud-builders has been upgraded to 0.7.1.
- openjs/node has been upgraded to 16.20.2.
- golang/go has been upgraded to v1.20.6.
Fixes
- Ensure that ApiKeys which are persisted in Aerospike respect the labelSelector configuration on the AuthConfig API. (https://github.com/solo-io/dev-portal/issues/2753)
- Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the `--wait` flag and via ArgoCD. (https://github.com/solo-io/gloo/issues/8288)
- Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the `--wait` flag and via ArgoCD. (https://github.com/solo-io/gloo/issues/8288)
Helm Changes
- Delegate creating CRs to the OSS resource rollout job. (https://github.com/solo-io/solo-projects/issues/5490)
- Adds a new helm value `global.extraCustomResources` to allow users to add additional custom resources to create, as defined by a helm partial (https://github.com/solo-io/solo-projects/issues/5490)

v1.13.28 (v1.13.0)

Fri, 20 Oct 2023 21:05:20 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.30.
Fixes
- Unfortunately, the custom readiness probe fix causes issues in deployments via Argo, since the resouce-rollout job is deleted and causes the argo app to go out of sync, as well as missing permissions to watch jobs. Reverted this fix (https://github.com/solo-io/gloo/issues/8809)
- Unfortunately, the custom readiness probe fix causes issues in deployments via Argo, since the resouce-rollout job is deleted and causes the argo app to go out of sync, as well as missing permissions to watch jobs. Reverted this fix (https://github.com/solo-io/gloo/issues/8809)

v1.13.27 (v1.13.0)

Thu, 12 Oct 2023 22:08:35 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.23.12-patch4.
- solo-io/cloud-builders has been upgraded to 0.6.5.
- solo-io/gloo has been upgraded to v1.13.29.
- envoy-gloo/solo-io has been upgraded to v1.23.12-patch3.
- solo-io/cloud-builders has been upgraded to v0.6.5.
Fixes
- Note that this version of envoy adds` `http.max_requests_per_io_cycle`` as a runtime value. This runtime value can be set to 1 in the presence of abusive HTTP/2 or HTTP/3 connections. (https://github.com/solo-io/solo-projects/issues/5391)
- Remove the Envoy cluster from the error log when validating clusters, avoiding the exposure of sensitive data (secrets). (https://github.com/solo-io/gloo/issues/8592)
- This ensures that a new deployment is rolled if the configmap it references changes. This is done by adding a `checksum/` annotation on any deployment that uses a configmap as a container volume. (https://github.com/solo-io/gloo/issues/8392)
- Fixes the issue of defining a custom readiness probe for the gateway proxy for zero downtime upgrades via helm with the `--wait` flag. (https://github.com/solo-io/gloo/issues/8288)
- Fix istio-proxy container definition in gateway-proxy template Add new e2e tests that handles Istio SDS case, ensuring mTLS occurs as expected (https://github.com/solo-io/gloo/issues/8092)
Helm Changes
- Adds the helm value `gateway.rolloutJob.timeout` to specifiy the timeout to wait for the resource rollout job to complete. (https://github.com/solo-io/gloo/issues/8782)
- Changes the default value of `gateway.rolloutJob.ttlSecondsAfterFinished` from 60 to 300 to accomodate the fix for the aforementioned custom readiness probe issue. (https://github.com/solo-io/gloo/issues/8288)

v1.13.26 (v1.13.0)

Thu, 05 Oct 2023 13:43:07 GMT

Fixes
- Ensure that `failover.policy` configuration on an Upstream is respected for Static Upstreams. (https://github.com/solo-io/gloo/issues/8720)

v1.13.25 (v1.13.0)

Fri, 22 Sep 2023 22:10:27 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to 1.23.12-patch3.
- solo-io/gloo has been upgraded to v1.13.27.
- solo-io/envoy-gloo has been upgraded to v1.23.12-patch2.
Fixes
- Support role chaining using EKS ServiceAccounts outside of us-east-1 (https://github.com/solo-io/gloo/issues/8578)
Helm Changes
- Update enterprise chart with fix for TTL not being respected on Helm hook jobs due to deletion policy. (https://github.com/solo-io/gloo/issues/8500)
- Ensure that setting `discovery.deployment.image.fips` will result in the FIPS variant of the discovery image being used. (https://github.com/solo-io/solo-projects/issues/5367)
- Fix TTL not being respected on Helm hook jobs due to deletion policy. (https://github.com/solo-io/gloo/issues/8500)

v1.13.24 (v1.13.0)

Mon, 11 Sep 2023 16:33:37 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.26.
- solo-io/envoy-gloo-ee has been upgraded to 1.23.12-patch2.
- solo-io/gloo has been upgraded to v1.13.25.
- solo-io/k8s-utils has been upgraded to v0.1.11.
Fixes
- Plugin and test updates to correctly check for empty required fields in RateLimit actions. (https://github.com/solo-io/gloo/issues/8573)
- Check for empty values in fields that are required by Envoy for RateLimitActions. Previously invalid config would be passed to Envoy. API reference: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-ratelimit-action. (https://github.com/solo-io/gloo/issues/8573)
- Added customInputResource unmarshalling logic to ValidatingAdmissionWebhook for RateLimitConfigs (https://github.com/solo-io/gloo/issues/8042)
Helm Changes
- Fix syntax error in Gateway yaml when using kube overrides. (https://github.com/solo-io/gloo/issues/8648)

v1.13.23 (v1.13.0)

Thu, 03 Aug 2023 21:10:56 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.23.
- solo-io/cloudbuilders has been upgraded to v0.6.4.
- solo-io/gloo has been upgraded to v1.13.24.

v1.13.22 (v1.13.0)

Wed, 26 Jul 2023 13:43:36 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.23.12-patch1.
Fixes
- Pulls in upstream Envoy v1.23.12, which includes fixes for CVE-2023-35941, CVE-2023-35942, CVE-2023-35944, and CVE-2023-35945 (https://github.com/solo-io/solo-projects/issues/5138)

v1.13.21 (v1.13.0)

Fri, 14 Jul 2023 13:09:12 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.23.11-patch1.
- solo-io/gloo has been upgraded to v1.13.22.
- solo-io/solo-apis has been upgraded to gloo-v1.13.22.
- solo-io/go-utils has been upgraded to v0.23.1.
- solo-io/ext-auth-service has been upgraded to v0.29.13.
- solo-io/gloo has been upgraded to v1.13.21.
Fixes
- Pulls in upstream Envoy v1.23.11, which includes a fix for CVE-2023-35945 (https://github.com/solo-io/solo-projects/issues/5138)
Helm Changes
- Allow extauth to log to a file by setting the global.extensions.extAuth.deployment.logToFileLocation Helm value to the desired file location. This is done to support AWS Fargate, which cannot collect logs from stdout. The end user is responsible for ensuring the necessary volume is mounted and for log rotation and maintenance. (https://github.com/solo-io/gloo/issues/7729)

v1.13.20 (v1.13.0)

Fri, 30 Jun 2023 21:12:52 GMT

Dependency Bumps
- solo-io/ext-auth-service has been upgraded to v0.29.12.

v1.13.19 (v1.13.0)

Mon, 12 Jun 2023 18:00:28 GMT

Dependency Bumps
- docker/distribution has been upgraded to v2.8.2+incompatible.
- solo-io/gloo has been upgraded to v1.13.20.
Fixes
- Fix UI bug falsely stating no Envoy proxies exist when Gloo Federation is not enabled. (https://github.com/solo-io/gloo/issues/8285)
Helm Changes
- Allow namedExtAuth references to be defined in Settings by setting the global.extensions.extAuth.namedExtAuth value. (https://github.com/solo-io/solo-projects/issues/5030)
- Allow `gloo.settings.ratelimitServer` helm value to override defaults. (https://github.com/solo-io/gloo/issues/4379)
- Enable TLS directly through new helm value `redis.tls`. This fixes issue with rate-limit having issues connecting to TLS. (https://github.com/solo-io/gloo/issues/8033)
- Setting the helm value, `redis.disabled` to `true`, will no longer create the `redis` secret when `global.extensions.glooRedis.enableAcl` is set to `true`, it's default value.

v1.13.18 (v1.13.0)

Fri, 19 May 2023 14:36:58 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.19.
- solo-io/gloo has been upgraded to v1.13.18.
- solo-io/solo-apis has been upgraded to gloo-v1.13.18.
Fixes
- Introduce ability to configure timeouts for individual resolutions within a GraphQL query. Additionally, default the resolver timeout to that configured on the upstream, if any. The per-resolution timeout will overwrite the upstream timeout, and if neither are set then the default timeout of 1 second will be applied. (https://github.com/solo-io/gloo/issues/7950)

v1.13.17 (v1.13.0)

Fri, 28 Apr 2023 20:42:21 GMT

Dependency Bumps
- solo-io/solo-apis has been upgraded to gloo-v1.13.16.
- solo-io/gloo has been upgraded to v1.13.16.
- solo-io/ext-auth-service has been upgraded to v0.29.9.
- solo-io/envoy-gloo-ee has been upgraded to v1.23.9-patch1.
- solo-io/envoy-gloo has been upgraded to v1.23.9-patch1.
Fixes
- Updating extauth gRPC pass through feature to allow basic TLS connections (https://github.com/solo-io/solo-projects/issues/4469)
- Configure the gRPC connections from the enterprise ext-auth and rate-limit services to support large xDS responses from the Gloo Control Plane. Previously, when the default value was exceeded, the connection would fail causing updates to not be sent to the services. (https://github.com/solo-io/gloo/issues/8135)
- Adding TLS support for extauth Grpc passthrough. (https://github.com/solo-io/gloo/issues/7663)

v1.13.16 (v1.13.0)

Mon, 24 Apr 2023 22:55:58 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.13.
- redis/go-redis has been upgraded to v9.0.3+(notquitepatch4).
- solo-io/caching-service has been upgraded to v0.1.18.
- solo-io/rate-limiter has been upgraded to v0.7.11.
- solo-io/ext-auth-service has been upgraded to v0.29.8.
- graphql-go/graphql has been upgraded to v0.8.1.
- coreruleset/coreruleset has been upgraded to v3.2.1.
- solo-io/envoy-gloo has been upgraded to 1.23.7-patch1.
- alpine/alpine has been upgraded to 3.17.3.

v1.13.15 (v1.13.0)

Fri, 07 Apr 2023 16:56:37 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.23.7-patch4.
- alpine/alpine has been upgraded to 3.17.3.
- solo-io/ext-auth-service has been upgraded to v0.29.6.

v1.13.14 (v1.13.0)

Thu, 30 Mar 2023 19:44:02 GMT

Fixes
- Update extauth for aerospike connectivity issues on authservice start. (https://github.com/solo-io/ext-auth-service/issues/489)

v1.13.13 (v1.13.0)

Tue, 21 Mar 2023 16:27:47 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.11.
- node/node has been upgraded to 16.19.1-alpine3.17.
- golang.org/x/net has been upgraded to v0.7.0.
- solo-io/envoy-gloo has been upgraded to v1.23.3-patch3.
- solo-io/envoy-gloo has been upgraded to v1.23.3-patch2.
- golang.org/x/mod has been upgraded to v0.9.0.
- golang.org/x/tools has been upgraded to v0.7.0.
Fixes
- Adds support for stitched APIs in the GraphQL Explorer UI. (https://github.com/solo-io/solo-projects/issues/4278)
- Fixes the issue where not supplying query variables breaks graphiql explorer queries. (https://github.com/solo-io/gloo/issues/7467)
- Speed up the istio integration plugin translation time by reading from the input snapshot instead of using an upstream client. (https://github.com/solo-io/gloo/issues/7960)

v1.13.12 (v1.13.0)

Fri, 10 Mar 2023 22:10:05 GMT

Dependency Bumps
- alpine/alpine has been upgraded to 3.17.2.
- golang/go has been upgraded to v1.18.6.
- solo-io/gloo has been upgraded to v1.13.10.
- solo-io/skv2 has been upgraded to v0.26.2.
- avast/retry-go has been upgraded to v4.3.3.
- alpine/alpine has been upgraded to 3.17.2.
Fixes
- Make the following retry options configurable when Gloo Fed encounters errors while handling cluster events: retry type (backoff or fixed), delay between retries, max delay, max number of attempts, and max jitter. (https://github.com/solo-io/gloo/issues/7814)

v1.13.11 (v1.13.0)

Sun, 05 Mar 2023 00:27:33 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.9.
- golang/go has been upgraded to v1.18.6.
Fixes
- Expose `config.core.v3.Cluster.SlowStartConfig` for `RoundRobin` and `LeastRequest` load balancers. Requires CRD update to be able to use. (https://github.com/solo-io/gloo/issues/7807)

v1.13.10 (v1.13.0)

Fri, 03 Mar 2023 18:17:14 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.23.3-patch5.
Fixes
- GraphQL plugin now logs during translation if graphql features are not enabled. Changed from guarding the enabling of the plugin behind the license key check to guarding the translation logic to allow this check. (https://github.com/solo-io/solo-projects/issues/4330)

v1.13.9 (v1.13.0)

Wed, 22 Feb 2023 18:16:48 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.8.
- alpine/alpine has been upgraded to 3.17.2.
Fixes
- Fixed bug where CRs are not rendered in helm chart if lexicographically smallest gwProxy disabled (https://github.com/solo-io/gloo/issues/5298)
New Features
- Extract the generated files from `ssl.proto` into their own go package. This is a breaking change. This *will not* affect the regular operation of `gloo`. Rather, it will impact consumers of the solo-apis repository, as paths will have changed. (https://github.com/solo-io/gloo/issues/7693)
- Allow configured DynamicForwardProxies to use TLS Origination (https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-field-config-cluster-v3-cluster-transport-socket) via a newly exposed field: gateway.spec.httpGateway.options.dynamicForwardProxy.sslConfig (https://github.com/solo-io/gloo/issues/7693)

v1.13.8 (v1.13.0)

Fri, 17 Feb 2023 22:15:08 GMT

Dependency Bumps
- solo-io/envoy-gloo-ee has been upgraded to v1.23.3-patch4.

v1.13.7 (v1.13.0)

Mon, 13 Feb 2023 19:58:33 GMT

Dependency Bumps
- nodejs/node has been upgraded to 16.18.1-alpine.
- solo-io/gloo has been upgraded to v1.13.7.
- solo-io/solo-apis has been upgraded to gloo-v1.13.7.
Fixes
- Use Pod IPs for headless services when the gloo deployment's `ENABLE_ISTIO_INTEGRATION` is `true`. (https://github.com/solo-io/gloo/issues/7491)
- Fix a bug where the validation webhook server on the gloo pod would still start even if the `VALIDATION_MUST_START` environment variable was `false`.
- Fix issue with wrong port being used with Istio integration and setting a different `TargetPort` than the `Port`. (https://github.com/solo-io/gloo/issues/7298)

v1.13.6 (v1.13.0)

Tue, 07 Feb 2023 23:26:58 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.6.
Fixes
- No longer fail validation when specifying query parameters on re-writes. (https://github.com/solo-io/gloo/issues/7715#issuecomment-1410014270)
Helm Changes
- Provide a helm template value `gatewayProxies.gatewayProxy.disableCoreDumps` which disables core dumps from being written in the event of an Envoy crash (https://github.com/solo-io/gloo/issues/7659)

v1.13.5 (v1.13.0)

Mon, 30 Jan 2023 23:17:15 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.4.
- solo-io/envoy-gloo-ee has been upgraded to v1.23.3-patch3.
- solo-io/solo-kit has been upgraded to v0.30.9.
Fixes
- Exempt [dynamic forward proxies](https://www.solo.io/blog/dynamic-forward-proxy-with-gloo-edge/) from being auto-censure by enabling the [replaceInvalidRoutes](https://docs.solo.io/gloo-edge/latest/guides/traffic_management/configuration_validation/invalid_route_replacement/) feature (https://github.com/solo-io/gloo/issues/7668)
- Exempt http tunnels from being auto-censured by enabling the [replaceInvalidRoutes](https://docs.solo.io/gloo-edge/latest/guides/traffic_management/configuration_validation/invalid_route_replacement/) feature (https://github.com/solo-io/gloo/issues/7668)
- Fix for `argument list too long` errors from resource rollout job. The Gateway custom resource yaml is now stored in a ConfigMap. The resource rollout job mounts the ConfigMap as a file and applies the file, instead of applying the entire yaml inline. (https://github.com/solo-io/gloo/issues/7060)
- Upgrade to solo-kit version which fixes status reporting for multiple namespaces. (https://github.com/solo-io/solo-kit/issues/529)
Helm Changes
- Add backoffLimit, completions, manualSelector, and parallelism fields to Enterprise Resource Rollout job (https://github.com/solo-io/gloo/issues/7112)
- Add backoffLimit, completions, manualSelector, and parallelism fields to k8s jobs. https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#job-v1-batch (https://github.com/solo-io/gloo/issues/7112)

v1.13.4 (v1.13.0)

Fri, 13 Jan 2023 22:18:32 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.3.
- solo-io/envoy-gloo-ee has been upgraded to v1.23.3-patch2.
Fixes
- Pick up Gloo release with proto descriptor ConfigMap support. (https://github.com/solo-io/gloo/issues/7495)
- Pick up Gloo release with proto descriptor ConfigMap support. (https://github.com/solo-io/gloo/issues/7060)
- Prevent Ext-Auth side car container from crashing when connecting using unix domain socket. (https://github.com/solo-io/gloo/issues/5728)
- ExtAuth only pushes updates via xDS when the set of AuthConfigs has changed. Previously, an AuthConfig with multiple definitions would cause the hash of the snapshot to change on each translation run. (https://github.com/solo-io/gloo/issues/7546)
- Allow storing proto descriptors used for gRPC to JSON transcoding in a ConfigMap and referencing the ConfigMap from the Gateway options. (https://github.com/solo-io/gloo/issues/7495)
- Avoid `argument list too long` errors from resource rollout job by enabling getting proto descriptors from a ConfigMap instead of including the proto descriptor inline. (https://github.com/solo-io/gloo/issues/7060)
Helm Changes
- Adding `topologySpreadConstraints` to gateway-proxy. (https://github.com/solo-io/gloo/issues/7582)

v1.13.3 (v1.13.0)

Thu, 05 Jan 2023 17:26:19 GMT

Dependency Bumps
- solo-io/skv2 has been upgraded to v0.26.1.
Fixes
- Fix Gloo Fed panic caused by unhashable types in reconciler queue. (https://github.com/solo-io/gloo/issues/7620)

v1.13.2 (v1.13.0)

Tue, 03 Jan 2023 20:40:58 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.2.
- solo-io/solo-apis has been upgraded to v1.13.2.
Fixes
- Add route validation to reject and sanitize invalid paths.

v1.13.1 (v1.13.0)

Fri, 23 Dec 2022 15:55:17 GMT

Dependency Bumps
- solo-io/gloo has been upgraded to v1.13.1.
- solo-io/solo-apis has been upgraded to gloo-v1.13.1.
Helm Changes
- Adding `gatewayProxies.gatewayProxy.podTemplate.extraInitContainers` and

v1.13.0 (v1.13.0)

Wed, 21 Dec 2022 01:13:29 GMT

Dependency Bumps
- solo-io/skv2 has been upgraded to v0.25.0.
- solo-io/gloo has been upgraded to v1.13.0.
- solo-io/skv2 has been upgraded to v0.26.0.
- solo-io/go-utils has been upgraded to v0.23.0.
- solo-io/k8s-utils has been upgraded to v0.1.7.
- solo-io/skv2 has been upgraded to v0.26.0.
- solo-io/k8s-utils has been upgraded to v0.1.7.
Fixes
- Update helm charts to use "caching-service" instead of "caching-server" as the default cache service upstream name (https://github.com/solo-io/solo-projects/issues/4162)
- Fixes issue where Gloo Fed erroneously writes to a remote cluster registered by another Gloo Fed instance. The cluster watcher now only watches clusters registered in the Gloo Fed instance's own install namespace. (https://github.com/solo-io/gloo/issues/7529)
- Gloo Federation for k8s 1.24+ now supports the 1.24 breaking changes in cluster naming and service accounts. (https://github.com/solo-io/gloo/issues/6611)
- Fix Gloo Fed cluster registration on k8s 1.24+. (https://github.com/solo-io/gloo/issues/7071)
- Fix a panic that occurs in Gloo Fed when applying a FailoverScheme. (https://github.com/solo-io/gloo/issues/7572)
- Expose Envoy's opencensus plugin via Gloo. This extension is provided to enable W3C-compliant tracing metadata to be sent to a collector. Note that the Envoy extension has severe limitations which are documented in this feature, so users should take great care before enabling it. (https://github.com/solo-io/gloo/issues/7406)