kgateway-dev/kgateway v2.5.0-beta.5

on GitHub

🎉 Welcome to the v2.5.0-beta.5 release of the kgateway project!

Release Notes

Changes since v2.5.0-beta.4

Breaking Changes

• Removed the deprecated support for running kgateway as an Istio ambient waypoint:

  • the kgateway-waypoint GatewayClass
  • Istio AuthorizationPolicy translation
  • the KGW_WAYPOINT_LOCAL_BINDING setting

  To move existing kgateway waypoints to Istio waypoints, see the migration guide.

  Sending ingress traffic through an Istio waypoint with the istio.io/ingress-use-waypoint label is still supported:

  • With Helm, it is still enabled by the value waypoint.enabled.
  • Without Helm, set KGW_INGRESS_USE_WAYPOINTS=true. Its default changed from true to false.
  • KGW_ENABLE_WAYPOINT is deprecated. It still enables this feature when KGW_INGRESS_USE_WAYPOINTS is unset, and will be removed in a future release.

  RBAC: the controller ClusterRole still grants get/list/watch on authorizationpolicies.security.istio.io in this release so that upgrades are safe, but kgateway no longer uses it. It will be removed in the next minor release. If you maintain a custom ClusterRole, or rely on this rule for anything else, plan for its removal.
  (#14831)

• Bump Gateway API to v1.7.0-rc.3.

  • Route sessionPersistence now uses cookie.name, cookie and header.name; sessionName and cookieConfig are removed. Migrate them before upgrading the CRDs.
  • With cookie.lifetimeType unset, the cookie is now a Session cookie and absoluteTimeout has no effect. Set lifetimeType: Permanent to keep the Max-Age.
  • HTTPRoute retry applies even with experimental Gateway API features disabled.
  • Backends with a BackendTLSPolicy and no appProtocol now negotiate HTTP/2 or HTTP/1.1 via ALPN. Set appProtocol: http to keep HTTP/1.1.
  • Terminate and Passthrough TLS listeners can share a port with experimental Gateway API features disabled.
  • Waypoint AuthorizationPolicy HTTP method matches are now case-insensitive.
  • The minimum supported Kubernetes version is now 1.33.
    (#14882)

New Features

• Add experimental IPv6 and dual-stack support. GatewayParameters.spec.kube.service accepts ipFamilies and ipFamilyPolicy, and BackendConfigPolicy.spec.dns.lookupFamily overrides the cluster-wide DNS lookup family for a single backend. These fields are experimental and may change in future releases. The proxy's readiness and stats listeners now follow the configured bind family rather than being pinned to IPv4.

  This listener change is not experimental and applies to every install: because KGW_LISTENER_BIND_IPV6 defaults to true, the readiness and stats listeners now bind [::] with IPv4 compatibility, so IPv4 clients are unaffected. On a node whose kernel has IPv6 disabled entirely (ipv6.disable=1), the proxy now fails to start instead of reporting Ready with no working listeners; set KGW_LISTENER_BIND_IPV6=false to keep an IPv4-only bootstrap, which the data-plane listeners already required on such nodes.
  (#14651)

• Add pathWithEscapedSlashesAction to ListenerPolicy httpSettings to configure how Envoy handles escaped slashes in request paths (KeepUnchanged, RejectRequest, UnescapeAndRedirect, UnescapeAndForward). (#14803)

• Add KGW_LEADER_ELECTION_LEASE_DURATION, KGW_LEADER_ELECTION_RENEW_DEADLINE, and KGW_LEADER_ELECTION_RETRY_PERIOD settings and controller.leaderElection.* Helm values to configure the controller leader election timings. (#14828)

• ListenerPolicy now supports tcpSettings.accessLog for per-connection access logging on TCP and TLS (Terminate and Passthrough) listeners. gRPC sinks use Envoy's TCP gRPC access logger. (#14859)

• Support the Gateway API GatewayRouteHostnameIntersectionPrecedence feature: routes whose hostnames intersect with a listener hostname to the same hostname are ordered by the specificity of their own hostnames. (#14887)

Bug Fixes

• OIDC provider configuration discovery now validates the issuer using the CA certificates of the BackendTLSPolicy attached to the OAuth2 backendRef, so an issuer served under a private or self-signed CA no longer fails discovery and no longer causes the referencing TrafficPolicy and HTTPRoute to be rejected. (#14650)
• Fixed BackendConfigPolicy tls.files client certificates, which were always rejected, and strict validation rejecting TLS files that exist only on the proxy. (#14905)

Contributors

Thanks to all the contributors who made this release possible:

Installation

The kgateway project is available as a Helm chart and docker images.

Helm Charts

The Helm charts are available at:

• oci://cr.kgateway.dev/kgateway-dev/charts/kgateway
• oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds

Docker Images

The docker images are available at:

• cr.kgateway.dev/kgateway-dev/kgateway:v2.5.0-beta.5
• cr.kgateway.dev/kgateway-dev/sds:v2.5.0-beta.5
• cr.kgateway.dev/kgateway-dev/envoy-wrapper:v2.5.0-beta.5

Quickstart

Try installing this release:

helm install kgateway-crds oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds --version v2.5.0-beta.5 --namespace kgateway-system --create-namespace
helm install kgateway oci://cr.kgateway.dev/kgateway-dev/charts/kgateway --version v2.5.0-beta.5 --namespace kgateway-system --create-namespace

For detailed installation instructions and next steps, please visit our quickstart guide.