🎉 Welcome to the v2.4.0-beta.2 release of the kgateway project!
Release Notes
Changes since v2.4.0-beta.1
New Features
- Add headersToClient and headersToClientOnSuccess fields to AuthorizationResponse in ExtHttpService, mapping to Envoy's allowed_client_headers and allowed_client_headers_on_success. This enables redirect-based OAuth2 flows by forwarding auth service response headers (e.g. Location) to the downstream client. (#13592)
- Now storing release artifacts for each commit to make it easier to try out cutting-edge releases. Previously we only stored vX.Y.Z-main, a moving tag. Also fixes a minor race that could cause that tag to point to an older commit than desired. (#13876)
- Add transportSocketConnectTimeout field to ListenerPolicy (#14058)
- Add an
rbac.createvalue to disable the creation of the ClusterRole and ClusterRoleBinding (#14105) - TrafficPolicy response compression now supports selecting and negotiating multiple codecs via
compression.responseCompression.libraries(Gzip, Brotli, Zstd, in preference order). Envoy negotiates the codec from the request's Accept-Encoding header. Defaults to Gzip, preserving existing behavior. (#14275) - Allow configuring supported TLS signature algorithms in
GatewayandBackendConfigPolicy(#14282) - EC2 backends now expose Prometheus metrics for endpoint discovery:
kgateway_ec2_discovery_poll_total,kgateway_ec2_discovery_endpoints_active,kgateway_ec2_discovery_error_state, andkgateway_ec2_discovery_poll_duration_seconds. (#14318) - Added
allowConnectto listenerhttp2ProtocolOptions(ListenerPolicy and HTTPListenerPolicy), mapping to Envoy's HCMhttp2_protocol_options.allow_connect, to support WebSocket-over-HTTP/2 (RFC 8441 Extended CONNECT). (#14323) - Added
connectionKeepalivetoBackendConfigPolicy.spec.http2ProtocolOptions, enabling Envoy HTTP/2 keepalive PINGs for active half-dead upstream connection detection. (#14367) - Added default-off support for ordered ADS delivery via KGW_ENABLE_ORDERED_ADS=true, preserving CDS, EDS, LDS, and RDS response order for same-snapshot busy-stream additions. (#14372)
- Added an opt-in
statPrefixfield toTrafficPolicythat sets the Envoy routestat_prefix, enabling per-route statistics. The value supports{{route_name}},{{route_namespace}}, and{{rule_name}}template variables and is only honored for HTTPRoute and GRPCRoute targets. (#14409)
Bug Fixes
- Fix XListenerSet status patch failures caused by missing required port field since v2.3.0. (#14231)
- Fix route status reporting and ensure stale status is cleared for GRPCRoute, TCPRoute, and TLSRoute resources. (#14294)
- TrafficPolicy retry may now target a whole Gateway (without a sectionName), consistent with timeouts. TrafficPolicy urlRewrite is now validated to only target HTTPRoute resources, matching its documented behavior. (#14378)
- Fix 503s for ingress-use-waypoint routes to auto-allocated ServiceEntries. (#14391)
Cleanup
- Refactor: replace sort package with slices package for cleaner sorting code. (#14356)
Dependency Updates
- Kgateway now supports Gateway API v1.6.1 (#14426)
Contributors
Thanks to all the contributors who made this release possible:
Installation
The kgateway project is available as a Helm chart and docker images.
Helm Charts
The Helm charts are available at:
- cr.kgateway.dev/kgateway-dev/charts/kgateway.
Docker Images
The docker images are available at:
- cr.kgateway.dev/kgateway-dev/kgateway:v2.4.0-beta.2
- cr.kgateway.dev/kgateway-dev/sds:v2.4.0-beta.2
- cr.kgateway.dev/kgateway-dev/envoy-wrapper:v2.4.0-beta.2
Quickstart
Try installing this release:
helm install kgateway-crds oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds --version v2.4.0-beta.2 --namespace kgateway-system --create-namespace
helm install kgateway oci://cr.kgateway.dev/kgateway-dev/charts/kgateway --version v2.4.0-beta.2 --namespace kgateway-system --create-namespace
For detailed installation instructions and next steps, please visit our quickstart guide.