🎉 Welcome to the v2.3.6 release of the kgateway project!
Release Notes
Changes since v2.3.5
New Features
- Added support for excluding Istio ServiceEntries from kgateway ServiceEntry backend and endpoint discovery using Kubernetes label selectors. (#14328)
- Added support for excluding Istio ServiceEntries from kgateway ServiceEntry backend and endpoint discovery using Kubernetes label selectors. (#14359)
Bug Fixes
- Fixed a bug where a Gateway, Route, Backend, or ListenerSet status observedGeneration could intermittently freeze at a stale value after a spec change, due to a skew between the translation cache and the status syncer's cache. (#14302)
- Fixed TrafficPolicy retry translation for HTTPS listeners by applying retry policy at route level. (#14304)
- Fixed two HTTPListenerPolicy/DirectResponse cases where an IR field could be compared by pointer identity instead of value, causing spurious re-translations. (#14331)
- Fixed north-south traffic to a global service continuing to route to a local pod for the duration of its termination grace period. kgateway now drains a terminating pod (deletionTimestamp set) from ServiceEntry-derived endpoints and fails over to a healthy peer-cluster endpoint, consistent with the east-west (ztunnel) path and the Kubernetes Service backend path. (#14335)
- Fixed TrafficPolicy validation to include retry and timeout configuration. (#14336)
- Fixed HttpListenerPolicy and DirectResponse being re-translated unnecessarily because their IR Equals methods compared pointer-bearing fields by identity instead of by value. (#14342)
- kgateway no longer overwrites an existing Kubernetes Service for a Gateway unless the Service has a matching Gateway ownerReference or kgateway ownership metadata. (#14351)
- Reverted the per-client xDS whole-snapshot readiness gates, which could withhold a gateway's configuration indefinitely when it referenced a backend that can never become ready (for example an ExternalName Service) — stranding already-connected proxies on stale endpoints and crash-looping newly started proxy pods. Readiness is now handled by a bounded per-stream first-connect grace period (configurable via KGW_XDS_FIRST_CONNECT_DELAY, defaulting to 1s). (#14387)
Cleanup
- Fixed GatewayExtension equality to include the object source, and Listener equality to ignore parent object metadata churn (e.g. resourceVersion bumps from status writes), preventing missed updates and spurious recomputation. (#14248)
Contributors
Thanks to all the contributors who made this release possible:
Installation
The kgateway project is available as a Helm chart and docker images.
Helm Charts
The Helm charts are available at:
- cr.kgateway.dev/kgateway-dev/charts/kgateway.
Docker Images
The docker images are available at:
- cr.kgateway.dev/kgateway-dev/kgateway:v2.3.6
- cr.kgateway.dev/kgateway-dev/sds:v2.3.6
- cr.kgateway.dev/kgateway-dev/envoy-wrapper:v2.3.6
Quickstart
Try installing this release:
helm install kgateway-crds oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds --version v2.3.6 --namespace kgateway-system --create-namespace
helm install kgateway oci://cr.kgateway.dev/kgateway-dev/charts/kgateway --version v2.3.6 --namespace kgateway-system --create-namespace
For detailed installation instructions and next steps, please visit our quickstart guide.