Release Notes

v0.7.2

Highlights

• Added route conflict validation for HTTPRoute, GRPCRoute, TCPRoute, UDPRoute, and TLSRoute
• Added ListenerSet validation against conflicting attached routes

New Features

• Added route conflict validation to prevent overlapping HTTPRoute paths, GRPCRoute service/methods, TCPRoute and UDPRoute attachments, and TLSRoute hostnames on the same Gateway or ListenerSet section
• Added ListenerSet create/update validation to reject listener changes that would make attached routes conflict

Documentation

• Updated documentation

v0.7.1

Highlights

• Added missing loadBalancerClass parameter

New Features

• Added missing loadBalancerClass parameter

v0.7.0

Highlights

• Added support for UDPRoutes
• Added changelogs
• Updated Gateway API CRDs

New Features

• Added support for UDPRoutes
• Added changelogs

Dependencies

• Updated Gateway API CRDs to 1.6

v0.6.0

Highlights

• Added graceful shutdown for proxies
• Updated Envoy and Istio versions
• Fixed admission webhook annotation priority

New Features

• Added graceful shutdown for proxies — after receiving SIGTERM/SIGKILL, proxies continue to operate normally for an extra 60 seconds. During this graceful shutdown, the /healthz endpoint returns 503, signaling to the load balancer that traffic has to move away from the instance. After 60 seconds, proxies are terminated as usual, draining connections and shutting down.

Bug Fixes

• Fixed admission webhook annotation priority to comply with latest DKP requirements
• Fixed tests and documentation

Dependencies

• Updated Envoy and Istio versions to 1.38.3 and 1.30.2 respectively

v0.5.0

Highlights

• Backend TLS settings annotation now supports Kubernetes Secrets
• Header modification annotations support regex capture groups
• Added proxy-buffer-size annotation
• Added TCP and TLS logs and metrics

New Features

• Backend TLS settings annotation now supports Kubernetes Secrets so that backends can be accessed using TLS with the data from a Kubernetes secret
• Header modification annotations now support regex capture groups so that an HTTP header’s value can be constructed based on the Path parameter
• Added proxy-buffer-size annotation to limit the size of the upstream HTTP headers
• Added TCP and TLS logs and metrics to improve observability

v0.4.4

Highlights

• Fixed RBAC permissions

Bug Fixes

• Fixed RBAC permissions

v0.4.3

Highlights

• Relaxed ALB CRDs validation for ports

Improvements

• Relaxed ALB CRDs validation regarding ports to allow defining pure TCP load balancing scheme (without http/https ports at all)

v0.4.2

Highlights

• Disabled TLS autodetection
• Fixed default gateway election process

Bug Fixes

• Fixed default gateway election process

Breaking Changes

• Disabled TLS autodetection inherited from Istio.

v0.4.1

Highlights

• Fixed Gateway lifecycle

Bug Fixes

• Fixed deletion of the default gateway from ConfigMap so that if a default Deckhouse gateway is deleted, DKP deletes relevant resources.

v0.4.0

Highlights

• Moved auxiliary proxy sockets to localhost

Improvements

• Moved auxiliary proxy sockets to localhost to not expose extra information

Documentation

• Updated documentation

v0.3.0

Highlights

• Added idle-timeout annotation
• Security CVE patches in dependencies

New Features

• Added idle-timeout annotation to control the amount of time an open session can stay up without exchanging packets

Security Updates

• Applied security CVE patches

v0.2.5

Highlights

• Added gateway cleanup procedure

New Features

• Added gateway cleanup procedure to improve Gateways lifecycle.

v0.2.4

Highlights

• Fixed backend-tls-settings annotation handling on backend restart

Bug Fixes

• Fixed backend-tls-settings annotation on backend restart. Previously it would break occasionally on config reload.

Documentation

• Docs updated

v0.2.3

Highlights

• Fixed proxy mount points in containers

Bug Fixes

• Fixed mount points in the proxy containers

v0.2.2

Highlights

• Added CSE edition packaging

New Features

• Added CSE edition packaging

v0.2.0

Highlights

• Web Application Firewall (ModSecurity) support was added
• OpenTelemetry (OTLP) Tracing export was added
• Envoy updated to 1.37.3
• GeoIP database support extended to include the license parameter

New Features

• Added Web Application Firewall (ModSecurity) support using Coraza WAF project
• Added OpenTelemetry (OTLP) Tracing export parameters
• GeoIP database settings now include license parameter so the module can download GeoIP databases on its own

Improvements

• Trimmed overly long generated resource names and labels
• Improved Grafana dashboard for Envoy

Bug Fixes

• Fixed CRD version preflight checks

Documentation

• Documented HTTP/3 support

Dependencies

• Updated Envoy to 1.37.3

v0.1.0

Highlights

• Combined whitelist, basic auth, and satisfy logic into a single auth plugin
• Added CRD version preflight check in the gateway controller
• Resource management settings for the controller

New Features

• Added auth plugin combining whitelist, basic auth, and satisfy logic via an annotation
• CRD version preflight check in the gateway controller was added to check if the cluster’s CRDs comply with what ALB expects
• Added resource management settings to the controller

Improvements

• Optimized container image builds to reduce cache usage and size
• Refactored internal components

Documentation

• Updated documentation

v0.0.0

Highlights

• Initial ALB module release on Gateway API 1.5
• GeoIP database support is added to the ALB controller
• Istio sidecar integration and PROXY protocol support added
• Global basic authentication and IP whitelist settings added
• Vertical Pod Autoscaler mode for controllers added

New Features

• GeoIP database support is added to the ALB controller
• Added ListenerSet validations
• Implemented extension reference filters
• Added server-upstream annotation to access backends via Kubernetes service
• Enabled Istio sidecar integration if Istio module is enabled
• Added tls-disable-protocol annotation to be able to configure accessing backends using TLS
• Added extended request histogram metrics
• Added fallback TLS certificate to present the default certificate if the application certificate isn’t available
• Added hash-key annotation to be able to configure session affinity when accessing backends
• Added proxy-body-size annotation
• Added auth response headers support to support Dex authorization scheme
• Implemented default Deckhouse gateway feature for discovering the default gateway
• Added a cookie-based session affinity annotation
• Added global basic authentication settings
• Added PROXY protocol support per ClusterALBInstance/ALBInstance
• Added default access logging configuration
• Added IP whitelist annotation
• Added proxy log level configuration
• Added limit-rps annotation
• Added request-body-buffer-limit annotation
• Added URL rewrite annotation
• Support of multiple TLS certificates per listener is added
• Implemented Vertical Pod Autoscaler resource management mode
• Added Grafana dashboard for the proxy

Improvements

• Updated Grafana dashboard metrics
• Added warning when multiple default ALB Istio instances exist
• Improved default gateway name validation
• Switched proxy base image to distroless

Bug Fixes

• Fixed minor bugs
• Fixed Dex re-login by forcing HTTP/1.1 in Istiod
• Fixed gateway overlap validation
• Fixed Pilot crash on startup
• Fixed monitoring dashboard resources
• Fixed Envoy proxy crash
• Fixed CRD definitions

Dependencies

• Upgraded to Gateway API 1.5