kgateway-dev/kgateway v2.4.5

on GitHub

🎉 Welcome to the v2.4.5 release of the kgateway project!

Release Notes

Changes since v2.4.4

New Features

• Added normalizePath and mergeSlashes fields to ListenerPolicy's httpSettings to control whether the HTTP Connection Manager normalizes request paths and merges adjacent slashes. Both default to true, matching prior (hardcoded) behavior. (#14666)

Bug Fixes

• Fixed an issue where a TrafficPolicy using OAuth2 would stay permanently broken if the OpenID provider was unreachable the first time kgateway discovered its configuration, for example when both were restarting together. The discovery failure was latched until the control plane was restarted. kgateway now retries discovery in the background and re-translates affected policies once the provider becomes reachable. Retries start 30 seconds after a failure and back off exponentially, so recovery from a prolonged provider outage can take up to a few minutes. (#14576)
• Fixed an apiKeyAuth TrafficPolicy selecting two Secrets that hold the same api-key value emitting a duplicate credential, which Envoy rejects, freezing xDS delivery for the entire listener while the policy still reported Accepted. Identical credentials are now collapsed, and two clients sharing one key value fail translation with the policy reporting Accepted=False. (#14611)
• Fixed AWS Lambda Backends with spec.aws.auth.type: AssumeRole silently ignoring the configured role. The proxy now calls sts:AssumeRole using its ambient credentials (IRSA / EKS Pod Identity / environment) and signs Lambda requests with the returned temporary credentials, instead of signing with the ambient credentials directly. (#14649)
• Add buffer.filterStage to TrafficPolicy, which moves the buffer filter earlier in the filter chain so that maxRequestSize enforces ahead of filters that read the request body, such as ext_proc. The default placement is unchanged. (#14672)
• Fixed a bug where backends with more than one label produced a different endpoint hash on every recomputation, causing kgateway to publish a new EDS version and push endpoint updates to every connected proxy even when the endpoints had not changed. (#14676)
• Fix an ADS snapshot-cache bug that discarded pending endpoint watches when a snapshot could not answer them, potentially leaving proxies on stale endpoints even after the snapshot was corrected. Also fix superseded responses being sent after subscription changes when ordered ADS is explicitly enabled (disabled by default on v2.4.x). (#14688)

Contributors

Thanks to all the contributors who made this release possible:

Installation

The kgateway project is available as a Helm chart and docker images.

Helm Charts

The Helm charts are available at:

• oci://cr.kgateway.dev/kgateway-dev/charts/kgateway
• oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds

Docker Images

The docker images are available at:

• cr.kgateway.dev/kgateway-dev/kgateway:v2.4.5
• cr.kgateway.dev/kgateway-dev/sds:v2.4.5
• cr.kgateway.dev/kgateway-dev/envoy-wrapper:v2.4.5

Quickstart

Try installing this release:

helm install kgateway-crds oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds --version v2.4.5 --namespace kgateway-system --create-namespace
helm install kgateway oci://cr.kgateway.dev/kgateway-dev/charts/kgateway --version v2.4.5 --namespace kgateway-system --create-namespace

For detailed installation instructions and next steps, please visit our quickstart guide.