GitHub repository: emissary-ingress/emissary
Description: open source Kubernetes-native API gateway for microservices built on the Envoy Proxy
Topics: ambassador, api-gateway, api-management, cloud-native, docker, envoy, envoy-proxy, gateway-api, kubernetes, kubernetes-annotations, kubernetes-ingress, microservice

Emissary Ingress 3.9.1: tag_name: v3.9.1
body: 
## :tada: Emissary Ingress 3.9.1 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.9.1/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: Previously, after reconfiguration, routes could briefly be misconfigured due to a shift in
  the routes list. This has now been patched. Thanks to <a href="https://github.com/dynajoe">Joe
  Andaverde</a> for contributing this bugfix!

Emissary Ingress Chart 8.9.1: tag_name: chart/v8.9.1
body: ## :tada: Emissary Ingress Chart 8.9.1 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
- Upgrade Emissary to v3.9.1 [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
- Fix: Route Shifting Bug
Emissary Ingress 3.9.0: tag_name: v3.9.0
body: 
## :tada: Emissary Ingress 3.9.0 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.9.0/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Feature: This upgrades Emissary-ingress to be built on Envoy v1.27.2 which provides security,
  performance  and feature enhancements. You can read more about them here:  <a
  href="https://www.envoyproxy.io/docs/envoy/v1.27.2/version_history/version_history">Envoy Proxy
  1.27.2 Release Notes</a>

- Feature: By default, Emissary-ingress will return an `UNAVAILABLE` code when a request using gRPC 
  is rate limited. The `RateLimitService` resource now exposes a new
  `grpc.use_resource_exhausted_code`  field that when set to `true`, Emissary-ingress will return a
  `RESOURCE_EXHAUSTED` gRPC code instead.  Thanks to <a href="https://github.com/jeromefroe">Jerome
  Froelich</a> for contributing this feature!

- Feature: Envoy runtime fields that were provided to mitigate the recent HTTP/2 rapid reset
  vulnerability  can now be configured via the Module resource so the configuration will persist
  between restarts.  This configuration is added to the Envoy bootstrap config, so restarting
  Emissary is necessary after  changing these fields for the configuration to take effect.

- Change: APIExt would previously allow for TLS 1.0 connections. We have updated it to now only use
  a minimum  TLS version of 1.3 to resolve security concerns.

- Change: - Update default image to Emissary-ingress v3.9.0. <br/>

- Bugfix: The APIExt server provides CRD conversion between the stored version v2 and the version
  watched for  by Emissary-ingress v3alpha1. Since this component is required to operate
  Emissary-ingress, we have  introduced an init container that will ensure it is available before
  starting. This will help address  some of the intermittent issues seen during install and
  upgrades.

Emissary Ingress Chart 8.9.0: tag_name: chart/v8.9.0
body: ## :tada: Emissary Ingress Chart 8.9.0 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---

- Upgrade Emissary to v3.9.0 [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
- Feature: configure autoscaling behaviors for HorizontalPodAutoscaler in `.Values.autoscaling.behavior`
- Fix: wrong autoscaling apiVersion on EKS due to EKS not following semver (see https://github.com/aws/containers-roadmap/issues/1404, https://github.com/helm/helm/issues/10375, https://github.com/helm/helm/issues/12053)
Emissary Ingress 3.8.2: tag_name: v3.8.2
body: 
## :tada: Emissary Ingress 3.8.2 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.8.2/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Security: This release includes security patches to the current Envoy proxy version to address CVE
  2023-44487 and includes a fix to determine if a client is making too many requests with premature
  resets. The connection is disconnected if more than 50% of resets are considered premature.
  Another fix is also included which exposes a runtime setting to control the limit on the number of
  HTTP requests processed from a single connection in a single I/O cycle to mitigate CPU starvation.

- Security: Upgrading to the latest release of Golang as part of our general dependency upgrade
  process. This update resolves CVE-2023-39323 and CVE-2023-39325.

Emissary Ingress Chart 8.8.2: tag_name: chart/v8.8.2
body: ## :tada: Emissary Ingress Chart 8.8.2 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Emissary Ingress 3.8.1: tag_name: v3.8.1
body: 
## :tada: Emissary Ingress 3.8.1 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.8.1/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Security: Upgrading to the latest release of Golang as part of our general dependency upgrade
  process. This includes security fixes for CVE-2023-39318, CVE-2023-39319.

Emissary Ingress Chart 8.8.1: tag_name: chart/v8.8.1
body: ## :tada: Emissary Ingress Chart 8.8.1 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Emissary Ingress 3.8.0: tag_name: v3.8.0
body: 
## :tada: Emissary Ingress 3.8.0 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.8.0/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: As of v2.2.2, if two mappings were associated with different Hosts through host
  mappingSelector labels but share the same prefix, the labels were not taken into account which
  would cause one Mapping to be correctly routed but the other not.
  This change fixes this issue so
  that Mappings sharing the same prefix but associated with different Hosts will be correctly
  routed. ([Canary grouping must take labels into account])

- Bugfix: In previous versions, if multiple Headers/QueryParameters where used in a v3alpha1
  mapping, these values would duplicate and cause all the Headers/QueryParameters to have the same
  value. This is no longer the case and the expected values for unique Headers/QueryParameters will
  apply.
  This issue was only present in v3alpha1 Mappings. For users who may have this issue, please
  be sure to re-apply any v3alpha1 Mappings in order to update the stored v2 Mapping and resolve the
  issue.

- Change: When the Ambassador agent is being used, it will no longer attempt to collect and report
  Envoy metrics. In previous versions, Emissary-ingress would always create an Envoy stats sink for
  the agent as long as the AMBASSADOR_GRPC_METRICS_SINK environmet variable was provided. This
  environment variable was hardcoded on the release manifests and has now been removed and an Envoy
  stats sink for the agent is no longer created.

[Canary grouping must take labels into account]: https://github.com/emissary-ingress/emissary/issues/4170

Emissary Ingress Chart 8.8.0: tag_name: chart/v8.8.0
body: ## :tada: Emissary Ingress Chart 8.8.0 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Emissary Ingress 3.7.2: tag_name: v3.7.2
body: 
## :tada: Emissary Ingress 3.7.2 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.7.2/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Security: This upgrades Emissary-ingress to be built on Envoy v1.26.4 which includes a security
  fixes for  CVE-2023-35942, CVE-2023-35943,  VE-2023-35944.

Emissary Ingress Chart 8.7.2: tag_name: chart/v8.7.2
body: ## :tada: Emissary Ingress Chart 8.7.2 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Emissary Ingress 3.7.1: tag_name: v3.7.1
body: 
## :tada: Emissary Ingress 3.7.1 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.7.1/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Security: This upgrades Emissary-ingress to be built on Envoy v1.26.3 which includes a security
  fix for CVE-2023-35945.

Emissary Ingress Chart 8.7.1: tag_name: chart/v8.7.1
body: ## :tada: Emissary Ingress Chart 8.7.1 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Emissary Ingress 3.7.0: tag_name: v3.7.0
body: 
## :tada: Emissary Ingress 3.7.0 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.7.0/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Security: Upgrading to the latest release of Golang as part of our general dependency upgrade
  process. This includes security fixes for CVE-2023-24539, CVE-2023-24540, CVE-2023-29400.

- Feature: This upgrades Emissary-ingress to be built on Envoy v1.26.1. This provides
  Emissary-ingress with the latest security patches, performances enhancments, and features offered
  by the envoy proxy.

Emissary Ingress Chart 8.7.0: tag_name: chart/v8.7.0
body: ## :tada: Emissary Ingress Chart 8.7.0 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Emissary Ingress 3.6.0: tag_name: v3.6.0
body: 
## :tada: Emissary Ingress 3.6.0 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.6.0/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Feature: This upgrades Emissary-ingress to be built on Envoy v1.25.4. This provides
  Emissary-ingress with the latest security patches, performances enhancments, and features offered
  by the envoy proxy.

Emissary Ingress Chart 8.6.0: tag_name: chart/v8.6.0
body: ## :tada: Emissary Ingress Chart 8.6.0 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Emissary Ingress 3.5.2: tag_name: v3.5.2
body: 
## :tada: Emissary Ingress 3.5.2 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.5.2/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Security: Upgrading to the latest release of Golang as part of our general dependency upgrade
  process. This includes security fixes for CVE-2023-24537, CVE-2023-24538, CVE-2023-24534,
  CVE-2023-24536.

- Security: This upgrades Emissary-ingress to be built on Envoy v1.24.5 which contains security
  patches for CVE-2023-27487, CVE-2023-27491, CVE-2023-27492, CVE-2023-27493, CVE-2023-27488, and
  CVE-2023-27496.

Emissary Ingress Chart 8.5.2: tag_name: chart/v8.5.2
body: ## :tada: Emissary Ingress Chart 8.5.2 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
- Upgrade Emissary to v3.5.2 [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Emissary Ingress 3.5.1: tag_name: v3.5.1
body: 
## :tada: Emissary Ingress 3.5.1 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.5.1/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: No changes made to Emissary-ingress but this patch release addresses a regression where
  the  Module resource fails validation when setting the ambassador_id after upgrading to
  `getambassador.io/v3alpha1`.  <br/><br/> Thanks to [pie-r](https://github.com/pie-r)

Emissary Ingress Chart 8.5.1: tag_name: chart/v8.5.1
body: ## :tada: Emissary Ingress Chart 8.5.1 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Emissary Ingress 3.5.0: tag_name: v3.5.0
body: 
## :tada: Emissary Ingress 3.5.0 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.5.0/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Security: Upgrading to the latest release of Golang as part of our general dependency upgrade
  process. This includes security fixes for CVE-2022-41725, CVE-2022-41723.

- Feature: In Envoy 1.24, experimental support for a native OpenTelemetry tracing driver  was
  introduced that allows exporting spans in the otlp format. Many  Observability platforms accept
  that format and is the recommend replacement for the LightStep driver. Emissary-ingress now
  supports setting the  `TracingService.spec.driver=opentelemetry` to export spans in  otlp
  format.<br/><br/>
  Thanks to <a href="https://github.com/psalaberria002">Paul</a> for helping us
  get this tested and implemented!

- Bugfix: When wanting to expose traffic to clients on ports other than 80/443, users will set a
  port in the Host.hostname (eg.`Host.hostname=example.com:8500`. The config generated allowed
  matching on the :authority header. This worked in v1.Y series due to the way emissary was
  generating Envoy configuration under a single wild-card virtual_host and matching on
  :authority.

  In v2.Y/v3.Y+, the way emissary generates Envoy configuration changed to address
  memory pressure and improve route lookup speed in Envoy. However, when including a port in the
  hostname, an incorrect configuration  was generated with an sni match including the port. This has
  been fixed and the correct envoy configuration is being generated. ([fix: hostname port issue])

- Change: Previously, specifying backend ports by name in Ingress was not supported and would result
  in defaulting to port 80. This allows emissary-ingress to now resolve port names for backend
  services. If the port number cannot be resolved by the name (e.g named port in the Service doesn't
  exist) then it defaults back  to the original behavior. (Thanks to <a
  href="https://github.com/antonu17">Anton Ustyuzhanin</a>!). ([#4809])

- Change: The `emissary-apiext` server is a Kubernetes Conversion Webhook that converts between the 
  Emissary-ingress CRD versions. On startup, it ensures that a self-signed cert is available so that
  K8s API Server can talk to the conversion webhook (*TLS is required by K8s*). We  have introduced
  a startupProbe to ensure that emissary-apiext server has enough time to configure the webhooks
  before running liveness and readiness probes. This is to ensure  slow startup doesn't cause K8s to
  needlessly restart the pod.

[fix: hostname port issue]: https://github.com/emissary-ingress/emissary/pull/4816
[#4809]: https://github.com/emissary-ingress/emissary/pull/4809

Emissary Ingress Chart 8.5.0: tag_name: chart/v8.5.0
body: ## :tada: Emissary Ingress Chart 8.5.0 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Emissary Ingress 3.4.1: tag_name: v3.4.1
body: 
## :tada: Emissary Ingress 3.4.1 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.4.1/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Security: This upgrades emissary-ingress to be built on Envoy v1.24.2. This captures a  patch to
  boringssl to address CVE-2023-0286. It also includes an update to c-ares dependency to address
  issue with cname wildcard dns resolution for upstream clusters.

Emissary Ingress Chart 8.4.1: tag_name: chart/v8.4.1
body: ## :tada: Emissary Ingress Chart 8.4.1 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Emissary Ingress 3.4.0: tag_name: v3.4.0
body: 
## :tada: Emissary Ingress 3.4.0 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.4.0/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Feature: Support for the `getambassador.io/v1` apiVersion has been re-introduced, in order to
  facilitate smoother migrations from Emissary-ingress 1.y.  Previously, in order to make migrations
  possible, an "unserved" `v1` version was declared to Kubernetes, but was unsupported by
  Emissary-ingress.  That unserved `v1` could cause an excess of errors to be logged by the
  Kubernetes Nodes (regardless of whether the installation was migrated from 1.y or was a fresh 2.y
  install); fully supporting `v1` again should resolve these errors.

- Feature: It is now possible to configure active healhchecking for upstreams within a `Mapping`. If
  the upstream fails its configured health check then Envoy will mark the upstream as unhealthy and
  no longer send traffic to that upstream. Single pods within a group may can be marked as
  unhealthy. The healthy pods will continue to receive traffic normally while the unhealthy pods
  will not receive any traffic until they recover by passing the health check.

- Feature: The healthcheck server's bind address, bind port and IP family can now be configured
  using environment variables:
  - `AMBASSADOR_HEALTHCHECK_BIND_ADDRESS`: The address to bind the
  healthcheck server to.
  - `AMBASSADOR_HEALTHCHECK_BIND_PORT`: The port to bind the healthcheck
  server to.
  - `AMBASSADOR_HEALTHCHECK_IP_FAMILY`: The IP family to use for the healthcheck
  server.
  This allows the healthcheck server to be configured to use IPv6-only k8s environments. 
  (Thanks to <a href="https://github.com/TimonOmsk">Dmitry Golushko</a>!).

- Feature: This upgrades Emissary-ingress to be built on Envoy v1.24.1. One notable change is that 
  the team at LightStep and Envoy Maintainers have decided to no longer support the native
  *LightStep* tracing driver in favor of using the Open Telemetry driver. The code  for LightStep
  driver has been completely removed from Envoy code base so Emissary-ingress  will no longer
  support it either.
  The recommended upgrade path is to leverage a supported Tracing driver such as
  `Zipkin` and use the [Open Telemetry Collector](https://opentelemetry.io/docs/collector/) to
  collect and forward Observabity data to LightStep.

Emissary Ingress Chart 8.4.0: tag_name: chart/v8.4.0
body: ## :tada: Emissary Ingress Chart 8.4.0 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Emissary Ingress 3.3.1: tag_name: v3.3.1
body: 
## :tada: Emissary Ingress 3.3.1 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.3.1/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Security: Update Golang to release 1.19.4. Two CVE's were annouced in this z patch release.
  CVE-2022-41720 only affects Windows environments and Emissary-ingress runs in linux. The second
  one  CVE-2022-41717 only affects HTTP/2 server connections exposed to external clients.
  Emissary-ingress does  not expose any Golang http servers to outside clients. The data-plane of
  Envoy is not affected by either of these.

Emissary Ingress 2.5.1: tag_name: v2.5.1
body: 
## :tada: Emissary Ingress 2.5.1 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v2.5.1/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Feature: Support for the `getambassador.io/v1` apiVersion has been re-introduced, in order to
  facilitate smoother migrations from Emissary-ingress 1.y.  Previously, in order to make migrations
  possible, an "unserved" `v1` version was declared to Kubernetes, but was unsupported by
  Emissary-ingress.  That unserved `v1` could cause an excess of errors to be logged by the
  Kubernetes Nodes (regardless of whether the installation was migrated from 1.y or was a fresh 2.y
  install); fully supporting `v1` again should resolve these errors.

- Security: Update Golang to release 1.19.4. Two CVE's were annouced in this z patch release.
  CVE-2022-41720 only affects Windows environments and Emissary-ingress runs in linux. The second
  one  CVE-2022-41717 only affects HTTP/2 server connections exposed to external clients.
  Emissary-ingress does  not expose any Golang http servers to outside clients. The data-plane of
  Envoy is not affected by either of these. 

- Security: Updated Golang to the latest z patch. We are not vulnerable to the CVE-2022-3602 that
  was  released in 1.19.3 and you can read more about it here:
  <https://medium.com/ambassador-api-gateway/ambassador-labs-security-impact-assessment-of-nov-1-openssl-golang-vulnerabilities-f11b5ec37a7e>.
  Updating to the latest z patch as part of our normal dependency update process and this will help
  reduce the noise of security scanners.

Emissary Ingress Chart 8.3.1: tag_name: chart/v8.3.1
body: ## :tada: Emissary Ingress Chart 8.3.1 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---

- Upgrade Emissary to v3.3.1 [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Emissary Ingress Chart 7.6.1: tag_name: chart/v7.6.1
body: ## :tada: Emissary Ingress Chart 7.6.1 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---

- Upgrade Emissary to v2.5.1 [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Emissary Ingress 2.5.0: tag_name: v2.5.0
body: 
## :tada: Emissary Ingress 2.5.0 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v2.5.0/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: If a `Host` or `TLSContext` contained a hostname with a `:` then when using the 
  diagnostics endpoints `ambassador/v0/diagd` then an error would be thrown due to the parsing logic
  not  being able to handle the extra colon. This has been fixed and Emissary-ingress will not throw
  an error when parsing envoy metrics for the diagnostics user interface.

- Security: Bump Go from 1.17.12 to 1.19.2. This is to keep the Go version current.

Emissary Ingress Chart 7.6.0: tag_name: chart/v7.6.0
body: ## :tada: Emissary Ingress Chart 7.6.0 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---

- Upgrade Emissary to v2.5.0 [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Emissary Ingress 3.3.0: tag_name: v3.3.0
body: 
## :tada: Emissary Ingress 3.3.0 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.3.0/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Security: Updated Golang to 1.19.2 to address the CVEs: CVE-2022-2879, CVE-2022-2880,
  CVE-2022-41715.

- Bugfix: By default Emissary-ingress adds routes for http to https redirection. When an AuthService
  is applied in v2.Y of Emissary-ingress, Envoy would skip the ext_authz call for non-tls http
  request and would perform the https redirect. In Envoy 1.20+ the behavior has changed where Envoy
  will always call the ext_authz filter and must be disabled on a per route basis.
  This new behavior
  change introduced a regression in v3.0 of Emissary-ingress when it was upgraded to Envoy 1.22. The
  http to https redirection no longer works when an AuthService was applied. This fix restores the
  previous behavior by disabling the ext_authz call on the https redirect routes. ([#4620])

- Bugfix: When an AuthService is applied in v2.Y of Emissary-ingress, Envoy would skip the ext_authz
  call for all redirect routes and would perform the redirect. In Envoy 1.20+ the behavior has
  changed where Envoy will always call the ext_authz filter so it must be disabled on a per route
  basis.
  This new behavior change introduced a regression in v3.0 of Emissary-ingress when it was
  upgraded to Envoy 1.22. The host_redirect would call an AuthService prior to redirect if applied.
  This fix restores the previous behavior by disabling the ext_authz call on the host_redirect
  routes. ([#4640])

- Bugfix: Previous versions of Emissary-ingress required a workaround using `TLSContexts` to find
  tls secrets referenced from `Ingress` resources. Now tls secrets referenced are properly detected
  without requiring an additional `TLSContext` to reference them. (Thanks to <a
  href="https://github.com/olemarkus">Ole Markus</a>!).

[#4620]: https://github.com/emissary-ingress/emissary/issues/4620
[#4640]: https://github.com/emissary-ingress/emissary/issues/4640

Emissary Ingress Chart 8.3.0: tag_name: chart/v8.3.0
body: ## :tada: Emissary Ingress Chart 8.3.0 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---

- Upgrade Emissary to v3.3.0 [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)

- Change: By default, the Ambassador agent will report diagnostics to the Ambassador Cloud

- Change: updated auto-scaling resource cpu and memory variable ordering to help with git-ops syncing. Also, adjusted memory and cpu settings to be more friendly so that they do not cause the HPA auto-scaling to trigger during start-up. Thanks to [Ian Martin](https://github.com/aztechian) for the contribution!
Emissary Ingress 2.4.1: tag_name: v2.4.1
body: 
## :tada: Emissary Ingress 2.4.1 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v2.4.1/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: If a `Host` or `TLSContext` contained a hostname with a `:` then when using the 
  diagnostics endpoints `ambassador/v0/diagd` then an error would be thrown due to the parsing logic
  not  being able to handle the extra colon. This has been fixed and Emissary-ingress will not throw
  an error when parsing envoy metrics for the diagnostics user interface.

- Bugfix: The synthetic AuthService didn't correctly handle AmbassadorID, which was fixed in version
  3.1 of Emissary-ingress. The fix has been backported to make sure the AuthService is handled
  correctly during upgrades.

Emissary Ingress Chart 7.5.1: tag_name: chart/v7.5.1
body: ## :tada: Emissary Ingress Chart 7.5.1 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---

- Upgrade Emissary to v2.4.1 [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Emissary Ingress 3.2.0: tag_name: v3.2.0
body: 
## :tada: Emissary Ingress 3.2.0 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.2.0/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Change: The envoy version included in Emissary-ingress has been upgraded from 1.22 to the latest
  patch release of 1.23. This provides Emissary-ingress with the latest security patches,
  performances enhancments, and features offered by the envoy proxy.

- Change: Changes to label matching will change how `Hosts` are associated with `Mappings`. There
  was a bug with label selectors that was causing `Hosts` to be incorrectly being associated with
  more `Mappings` than intended. If any single label from the selector was matched then the `Host`
  would be associated with the `Mapping`. Now it has been updated to correctly only associate a
  `Host` with a `Mapping` if **all** labels required by the selector are present. This brings the
  `mappingSelector` field in-line with how label selectors are used in Kubernetes. To avoid
  unexpected behaviour after the upgrade, add all labels that Hosts have in their `mappingSelector`
  to `Mappings` you want to associate with the `Host`. You can opt-out of the new behaviour by
  setting the environment variable `DISABLE_STRICT_LABEL_SELECTORS` to `"true"` (default:
  `"false"`). (Thanks to <a href="https://github.com/f-herceg">Filip Herceg</a> and <a
  href="https://github.com/dynajoe">Joe Andaverde</a>!).      

- Feature: Previously the `Host` resource could only use secrets that are in the namespace as the
  Host. The `tlsSecret` field in the Host has a new subfield `namespace` that will allow the use of
  secrets from different namespaces.

- Change: Set `AMBASSADOR_EDS_BYPASS` to `true` to bypass EDS handling of endpoints and have
  endpoints be inserted to clusters manually. This can help resolve with `503 UH` caused by
  certification rotation relating to a delay between EDS + CDS. The default is `false`.     

- Bugfix: Distinct services with names that are the same in the first forty characters will no
  longer be incorrectly mapped to the same cluster. ([#4354])

- Feature: By default, when Envoy is unable to communicate with the configured RateLimitService then
  it will allow traffic through. The `RateLimitService` resource now exposes the <a
  href="https://www.envoyproxy.io/docs/envoy/v1.23.0/configuration/http/http_filters/rate_limit_filter">failure_mode_deny</a>
  option. Set `failure_mode_deny: true`, then Envoy will deny traffic when it is unable to
  communicate to the RateLimitService returning a 500.

- Bugfix: Previously, setting the `stats_name` for the `TracingService`, `RateLimitService` or the
  `AuthService` would have no affect because it was not being properly passed to the Envoy cluster
  config. This has been fixed and the `alt_stats_name` field in the cluster config is now set
  correctly. (Thanks to <a href="https://github.com/psalaberria002">Paul</a>!)

- Feature: The `AMBASSADOR_RECONFIG_MAX_DELAY` env var can be optionally set to batch changes for
  the specified non-negative window period in seconds before doing an Envoy reconfiguration. Default
  is "1" if not set.

- Bugfix: If a `Host` or `TLSContext` contained a hostname with a `:` when using the diagnostics
  endpoints `ambassador/v0/diagd` then an error would be thrown due to the parsing logic not being
  able to handle the extra colon. This has been fixed and Emissary-ingress will not throw an error
  when parsing envoy metrics for the diagnostics user interface.

- Feature: It is now possible to set `custom_tags` in the `TracingService`. Trace tags can be set
  based on literal values, environment variables, or request headers. (Thanks to <a
  href="https://github.com/psalaberria002">Paul</a>!) ([#4181])

- Bugfix: Emissary-ingress 2.0.0 introduced a bug where a `TCPMapping` that uses SNI, instead of
  using the hostname glob in the `TCPMapping`, uses the hostname glob in the `Host` that the TLS
  termination configuration comes from.

- Bugfix: Emissary-ingress 2.0.0 introduced a bug where a `TCPMapping` that terminates TLS must have
  a corresponding `Host` that it can take the TLS configuration from. This was semi-intentional, but
  didn't make much sense.  You can now use a `TLSContext` without a `Host`as in Emissary-ingress 1.y
  releases, or a `Host` with or without a `TLSContext` as in prior 2.y releases.

- Bugfix: Prior releases of Emissary-ingress had the arbitrary limitation that a `TCPMapping` cannot
  be used on the same port that HTTP is served on, even if TLS+SNI would make this possible. 
  Emissary-ingress now allows `TCPMappings` to be used on the same `Listener` port as HTTP `Hosts`,
  as long as that `Listener` terminates TLS.

- Security: Updated Golang to 1.19.1 to address the CVEs: CVE-2022-27664, CVE-2022-32190.

[#4354]: https://github.com/emissary-ingress/emissary/issues/4354
[#4181]: https://github.com/emissary-ingress/emissary/pull/4181

Emissary Ingress Chart 8.2.0: tag_name: chart/v8.2.0
body: ## :tada: Emissary Ingress Chart 8.2.0 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---

- Upgrade Emissary to v3.2.0 [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)

- Bugfix: The default Role configuration of the Ambassador Agent Deployment will allow it to correctly watch Secret resources for Ambassador Cloud tokens.
Emissary Ingress 2.4.0: tag_name: v2.4.0
body: 
## :tada: Emissary Ingress 2.4.0 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v2.4.0/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Feature: Previously the `Host` resource could only use secrets that are in the namespace as the
  Host. The `tlsSecret` field in the Host has a new subfield `namespace` that will allow the use of
  secrets from different namespaces.

- Change: Set `AMBASSADOR_EDS_BYPASS` to `true` to bypass EDS handling of endpoints and have
  endpoints be inserted to clusters manually. This can help resolve with `503 UH` caused by
  certification rotation relating to a delay between EDS + CDS. The default is `false`.

- Bugfix: Previously, setting the `stats_name` for the `TracingService`, `RateLimitService` or the
  `AuthService` would have no affect because it was not being properly passed to the Envoy cluster
  config. This has been fixed and the `alt_stats_name` field in the cluster config is now set
  correctly. (Thanks to <a href="https://github.com/psalaberria002">Paul</a>!)

- Feature: The `AMBASSADOR_RECONFIG_MAX_DELAY` env var can be optionally set to batch changes for
  the specified non-negative window period in seconds before doing an Envoy reconfiguration. Default
  is "1" if not set.

- Bugfix: Emissary-ingress 2.0.0 introduced a bug where a `TCPMapping` that uses SNI, instead of
  using the hostname glob in the `TCPMapping`, uses the hostname glob in the `Host` that the TLS
  termination configuration comes from.

- Bugfix: Emissary-ingress 2.0.0 introduced a bug where a `TCPMapping` that terminates TLS must have
  a corresponding `Host` that it can take the TLS configuration from. This was semi-intentional, but
  didn't make much sense.  You can now use a `TLSContext` without a `Host`as in Emissary-ingress 1.y
  releases, or a `Host` with or without a `TLSContext` as in prior 2.y releases.

- Bugfix: Prior releases of Emissary-ingress had the arbitrary limitation that a `TCPMapping` cannot
  be used on the same port that HTTP is served on, even if TLS+SNI would make this possible. 
  Emissary-ingress now allows `TCPMappings` to be used on the same `Listener` port as HTTP `Hosts`,
  as long as that `Listener` terminates TLS.

Emissary Ingress Chart 7.5.0: tag_name: chart/v7.5.0
body: ## :tada: Emissary Ingress Chart 7.5.0 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---

- Upgrade Emissary to v2.4.0 [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Emissary Ingress 3.1.0: tag_name: v3.1.0
body: 
## :tada: Emissary Ingress 3.1.0 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.1.0/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Feature: The agent is now able to parse api contracts using swagger 2, and to convert them to
  OpenAPI 3, making them available for use in the dev portal.

- Feature: Adds a new command to the agent directive service to manage secrets. This allows a third
  party product to manage CRDs that depend upon a secret.

- Feature: Add additional pprof endpoints to allow for profiling Emissary-ingress:
    - CPU profiles
  (/debug/pprof/profile)
    - tracing (/debug/pprof/trace)
    - command line running
  (/debug/pprof/cmdline)
    - program counters (/debug/pprof/symbol)

- Change: In the standard published `.yaml` files, the `Module` resource enables serving remote
  client requests to the `:8877/ambassador/v0/diag/` endpoint. The associated Helm chart release
  also now enables it by default.

- Bugfix: A regression was introduced in 2.3.0 causing the agent to miss some of the metrics coming
  from emissary ingress before sending them to Ambassador cloud. This issue has been resolved to
  ensure that all the nodes composing the emissary ingress cluster are reporting properly.

- Security: Updated Golang to 1.17.12 to address the CVEs: CVE-2022-23806, CVE-2022-28327,
  CVE-2022-24675, CVE-2022-24921, CVE-2022-23772.

- Security: Updated Curl to 7.80.0-r2 to address the CVEs: CVE-2022-32207, CVE-2022-27782,
  CVE-2022-27781, CVE-2022-27780.

- Security: Updated openSSL-dev to 1.1.1q-r0 to address CVE-2022-2097.

- Security: Updated ncurses to 1.1.1q-r0 to address CVE-2022-29458

Emissary Ingress 2.3.2: tag_name: v2.3.2
body: 
## :tada: Emissary Ingress 2.3.2 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v2.3.2/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: A regression was introduced in 2.3.0 causing the agent to miss some of the metrics coming
  from emissary ingress before sending them to Ambassador cloud. This issue has been resolved to
  ensure that all the nodes composing the emissary ingress cluster are reporting properly.

- Security: Updated Golang to 1.17.12 to address the CVEs: CVE-2022-23806, CVE-2022-28327,
  CVE-2022-24675, CVE-2022-24921, CVE-2022-23772.

- Security: Updated Curl to 7.80.0-r2 to address the CVEs: CVE-2022-32207, CVE-2022-27782,
  CVE-2022-27781, CVE-2022-27780.

- Security: Updated openSSL-dev to 1.1.1q-r0 to address CVE-2022-2097.

- Security: Updated ncurses to 1.1.1q-r0 to address CVE-2022-29458

Emissary Ingress Chart 8.1.0: tag_name: chart/v8.1.0
body: ## :tada: Emissary Ingress Chart 8.1.0 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Emissary Ingress Chart 7.4.2: tag_name: chart/v7.4.2
body: ## :tada: Emissary Ingress Chart 7.4.2 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---

- Update Emissary chart image to version v2.3.2 [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Emissary Ingress 3.0.0: tag_name: v3.0.0
body: 
## :tada: Emissary Ingress 3.0.0 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.0.0/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Change: The envoy version included in Emissary-ingress has been upgraded from 1.17 to the latest
  patch release of 1.22. This provides Emissary-ingress with the latest security patches,
  performances enhancments, and features offered by the envoy proxy. One notable change that will
  effect users is the removal of support for V2 tranport protocol. See below for more information.

- Change: Emissary-ingress can no longer be made to configure Envoy using the v2 xDS configuration
  API; it now always uses the v3 xDS API to configure Envoy.  This change should be mostly invisible
  to users, with one notable exception: It removes support for `regex_type: unsafe`.
  The
  `regex_type` field will is removed from the `ambassador` `Module`, meaning that it is not be
  possible to instruct Envoy to use the <a
  href="https://en.cppreference.com/w/cpp/regex/ecmascript">ECMAScript Regex</a> engine rather than
  the default <a href="https://github.com/google/re2">RE2</a> engine.
  Users who rely on the specific
  ECMAScript Regex syntax will need to rewrite their regular expressions with RE2 syntax before
  upgrading to Emissary-ingress 3.0.0.
  As the xDS version is no longer configurable and the range of
  supported Zipkin protocols is reduced (see below), the AMBASSADOR_ENVOY_API_VERSION environment
  variable has been removed.

- Change: With the ugprade to Envoy 1.22, Emissary-ingress no longer supports the V2 transport
  protocol. The `AuthService`, `LogService` and the `RateLimitService` will only support the v3
  protocol_version. If protocol_version is not specified, the default value of `v2` will cause an
  error to be posted. Therefore, you will need to set it to `protocol_version: "v3"`. If upgrading
  from a previous version you will want to set it to "v3" and ensure it is working before upgrading
  to Emissary-ingress 3.Y.

- Change: With the upgrade to Envoy 1.22, the `zipkin` driver for the `TraceService` no longer
  supports setting the `collector_endpoint_version: HTTP_JSON_V1`. This was removed in Envoy 1.20 -
  <a href="https://github.com/envoyproxy/envoy/commit/db74e313b3651588e59c671af45077714ac32cef" />.
  The new default will be `collector_endpoint_version: HTTP_JSON`, regardless of the
  `AMBASSADOR_ENVOY_API_VERSION` environment variable.

- Change: In the standard published `.yaml` files, now included is a `Module` resource that disables
  the `/ambassador/v0/` → `127.0.0.1:8878` synthetic mapping.  We have long recommended to turn
  this off for production use; it is now off in the standard YAML.  The associated Helm chart
  release also now disables it by default.  A later apiVersion (`getambassador.io/v3alpha2` or
  later) will likely change the `Module` CRD so that it is disabled if unspecified; but in the
  mean-time, the default install procedure will now specify it to be disabled.

- Change: This release does not include the publishing of `emissary-emissaryns-agent.yaml`,
  `emissary-defaultns-agent.yaml`, `emissary-emissaryns-migration.yaml`, or
  `emissary-defaultns-migration.yaml` files.  All four of these files existed solely as part of the
  migration process from 1;y, but since 2.2.0 the `*-migration.yaml` files have not been part of the
  migration instructions, and while the `*-agent.yaml` files remained part of the instructions they
  were actually unnescessary.

- Change: The previous version of Emissary-ingress was based on Envoy 1.17 and when using grpc_stats
  with `all_methods` or `services` set, it would output metrics in the following format
  `envoy_cluster_grpc_{ServiceName}_{statname}`. When neither of these fields are set it would be
  aggregated to `envoy_cluster_grpc_{statname}`.
  The new behavior since Envoy 1.18 will produce
  metrics in the following format `envoy_cluster_grpc_{MethodName}_statsname` and
  `envoy_cluster_grpc_statsname`.
  After further investigation we found that Envoy doesn't properly
  parse service names such as `cncf.telepresence.Manager/Status`. In the future, we will work
  upstream Envoy to get this parsing logic fixed to ensure consistent metric naming.

- Bugfix: Previously setting `grpc_stats` in the `ambassador` `Module` without setting either
  `grpc_stats.services` or `grpc_stats.all_methods` would result in crashing. Now it behaves as if
  `grpc_stats.all_methods=false`.

- Feature: With the ugprade to Envoy 1.22, Emissary-ingress can now be configured to listen for
  HTTP/3 connections using QUIC and the UDP network protocol. It currently only supports for
  connections between downstream clients and Emissary-ingress.

Emissary Ingress Chart 8.0.0: tag_name: chart/v8.0.0
body: ## :tada: Emissary Ingress Chart 8.0.0 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---

- Change: The default for the `module` value has changed to disable
  the `/ambassador/v0/` → `127.0.0.1:8877` synthetic Mapping by
  default.  We have long recommended to turn this off for production
  use; it is now off by default.

- Bugfix: The default values no trigger the creation of an
  "emissary-test-ready" Pod.  This Pod was meant to only be created
  when running the chart's test suite; it was not meant to be created
  in users' clusters.
Ambassador 1.14.4: tag_name: v1.14.4
body: 
## :tada: Ambassador 1.14.4 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started


- Security: We have backported patches from the Envoy 1.19.5 security update to Emissary-ingress's
  1.17-based Envoy, addressing CVE-2022-29224 and CVE-2022-29225.  Emissary-ingress is not affected
  by CVE-2022-29226, CVE-2022-29227, or CVE-2022-29228; as it <a
  href="https://github.com/emissary-ingress/emissary/issues/2846">does not support internal
  redirects</a>, and does not use Envoy's built-in OAuth2 filter.



Ambassador Chart 6.9.5: tag_name: chart/v6.9.5
body: ## :tada: Ambassador Chart 6.9.5 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/charts/ambassador/CHANGELOG.md

---



- Update Ambassador API Gateway chart image to version v1.14.4: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
- Update Ambassador Edge Stack chart image to version v1.14.4: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Emissary Ingress 2.3.1: tag_name: v2.3.1
body: 
## :tada: Emissary Ingress 2.3.1 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v2.3.1/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: A regression was introduced in 2.3.0 that leaked zipkin default config fields into the
  configuration for the other drivers (lightstep, etc...). This caused Emissary-ingress to crash on
  startup. This issue has been resolved to ensure that the defaults are only applied when driver is
  `zipkin` ([#4267])

- Security: We have backported patches from the Envoy 1.19.5 security update to Emissary-ingress's
  1.17-based Envoy, addressing CVE-2022-29224 and CVE-2022-29225.  Emissary-ingress is not affected
  by CVE-2022-29226, CVE-2022-29227, or CVE-2022-29228; as it <a
  href="https://github.com/emissary-ingress/emissary/issues/2846">does not support internal
  redirects</a>, and does not use Envoy's built-in OAuth2 filter.

[#4267]: https://github.com/emissary-ingress/emissary/issues/4267

Emissary Ingress Chart 7.4.1: tag_name: chart/v7.4.1
body: ## :tada: Emissary Ingress Chart 7.4.1 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Emissary Ingress 2.3.0: tag_name: v2.3.0
body: 
## :tada: Emissary Ingress 2.3.0 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v2.3.0/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Security: Completely remove gdbm, pip, smtplib, and sqlite packages, as they are unused.

- Feature: It is now possible to set `propagation_modes` in the `TracingService` config when using
  lightstep as the driver. (Thanks to <a href="https://github.com/psalaberria002">Paul</a>!) ([#4179])

- Feature: It is now possible to set `crl_secret` in `Host` and `TLSContext` resources to check peer
  certificates against a certificate revocation list. ([#1743])

- Feature: Previously, a `LogService` would always have Emissary-ingress communicate with the
  external log service using the `envoy.service.accesslog.v2.AccessLogService` API. It is now
  possible for the `LogService` to specify `protocol_version: v3` to use the newer
  `envoy.service.accesslog.v3.AccessLogService` API instead.  This functionality is not available if
  you set the `AMBASSADOR_ENVOY_API_VERSION=V2` environment variable.

- Bugfix: When CORS is specified (either in a `Mapping` or in the `Ambassador` `Module`), CORS
  processing will happen before authentication. This corrects a problem where XHR to authenticated
  endpoints would fail.

- Bugfix: In 2.x releases of Emissary-ingress when there are multiple `Mapping`s that have the same
  `metadata.name` across multiple namespaces, their old config would not properly be removed from
  the cache when their config was updated. This resulted in an inability to update configuration for
  groups of `Mapping`s that share the same name until the Emissary-ingress pods restarted.

- Bugfix: It is now possible for a `TracingService` to specify `collector_endpoint_version:
  HTTP_JSON_V1` when using xDS v3 to configure Envoy (which has been the default since
  Emissary-ingress 1.14.0).  The `HTTP_JSON_V1` value configures Envoy to speak to Zipkin using
  Zipkin's old API-v1, while the `HTTP_JSON` value configures Envoy to speak to Zipkin using
  Zipkin's new API-v2. In previous versions of Emissary-ingress it was only possible to use
  `HTTP_JSON_V1` when explicitly setting the `AMBASSADOR_ENVOY_API_VERSION=V2` environment variable
  to force use of xDS v2 to configure Envoy.

[#4179]: https://github.com/emissary-ingress/emissary/pull/4179
[#1743]: https://github.com/emissary-ingress/emissary/issues/1743

Emissary Ingress Chart 7.4.0: tag_name: chart/v7.4.0
body: ## :tada: Emissary Ingress Chart 7.4.0 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---

- Update change Emissary chart image to version v2.3.0 [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
- Add "lifecycle" option to main container. This can be used, for example, to add a lifecycle.preStop hook. Thanks to [Eric Totten](https://github.com/etotten) for the contribution!
- Add `ambassador_id` to listener manifests rendered when using `createDefaultListeners: true` with `AMBASSADOR_ID` set in environment variables. Thanks to [Jennifer Reed](https://github.com/ServerNinja) for the contribution!
- Feature: Added configurable IngressClass resource to be compliant with Kubernetes 1.22+ ingress specification.
Emissary Ingress 2.2.2: tag_name: v2.2.2
body: 
## :tada: Emissary Ingress 2.2.2 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v2.2.2/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Change: You may now choose to enable TLS Secret validation by setting the
  `AMBASSADOR_FORCE_SECRET_VALIDATION=true` environment variable. The default configuration does not
  enforce secret validation.

- Bugfix: Kubernetes Secrets that should contain an EC (Elliptic Curve) TLS Private Key are now
  properly validated. ([4134])

[4134]: https://github.com/emissary-ingress/emissary/issues/4134

Ambassador 1.14.3: tag_name: v1.14.3
body: 
## :tada: Ambassador 1.14.3 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started


- Security: Upgraded Envoy to address security vulnerabilities CVE-2021-43824, CVE-2021-43825,
  CVE-2021-43826, CVE-2022-21654, and CVE-2022-21655.



Emissary Ingress Chart 7.3.2: tag_name: chart/v7.3.2
body: ## :tada: Emissary Ingress Chart 7.3.2 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Ambassador Chart 6.9.4: tag_name: chart/v6.9.4
body: ## :tada: Ambassador Chart 6.9.4 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/charts/ambassador/CHANGELOG.md

---



- Update Ambassador API Gateway chart image to version v1.14.3: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
- Update Ambassador Edge Stack chart image to version v1.14.3: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Emissary Ingress 2.2.1: tag_name: v2.2.1
body: 
## :tada: Emissary Ingress 2.2.1 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v2.2.1/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Change: Support for the Envoy V2 API is deprecated as of Emissary-ingress v2.1, and will be
  removed in Emissary-ingress v3.0. The `AMBASSADOR_ENVOY_API_VERSION` environment variable will be
  removed at the same time. Only the Envoy V3 API will be supported (this has been the default since
  Emissary-ingress v1.14.0).

- Bugfix: The Ambassador Agent now correctly supports requests to cancel a rollout.

Emissary Ingress Chart 7.3.1: tag_name: chart/v7.3.1
body: ## :tada: Emissary Ingress Chart 7.3.1 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Emissary Ingress 2.2.0: tag_name: v2.2.0
body: 
## :tada: Emissary Ingress 2.2.0 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v2.2.0/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Change: Support for the Envoy V2 API is deprecated as of Emissary-ingress v2.1, and will be
  removed in Emissary-ingress v3.0. The `AMBASSADOR_ENVOY_API_VERSION` environment variable will be
  removed at the same time. Only the Envoy V3 API will be supported (this has been the default since
  Emissary-ingress v1.14.0).

- Change: Emissary-ingress will now watch for ConfigMap or Secret resources specified by the
  `AGENT_CONFIG_RESOURCE_NAME` environment variable in order to allow all components (and not only
  the Ambassador Agent) to authenticate requests to Ambassador Cloud.

- Security: Emissary-ingress has updated Alpine to 3.15, and Python and Go dependencies to their
  latest compatible versions, to incorporate numerous security patches.

- Feature: Emissary-ingress now supports the metric `ambassador_log_level{label="debug"}` which will
  be set to 1 if debug logging is enabled for the running Emissary instance, or to 0 if not. This
  can help to be sure that a running production instance was not actually left doing debugging
  logging, for example. (Thanks to <a href="https://github.com/jfrabaute">Fabrice</a>!) ([#3906])

- Feature: Emissary-ingress is now leveraging a new Envoy Proxy patch that allows Envoy to accept
  escaped '%' characters in its configuration. This means that error_response_overrides and other
  custom user content can now contain '%' symbols escaped as '%%'. ([DW Envoy: 74]) ([Upstream Envoy: 19383])

- Feature: Support for streaming Envoy metrics about the clusters to Ambassador Cloud. ([#4053])

- Feature: The Ambassador agent now receives commands to manipulate Rollouts (pause, continue, and
  abort are currently supported) via directives and executes them in the cluster. A report is sent
  to Ambassador Cloud including the command ID, whether it ran successfully, and an error message in
  case there was any. ([#4040])

- Bugfix: Kubernetes Secrets that should contain TLS certificates are now validated before being
  accepted for configuration. A Secret that contains an invalid TLS certificate will be logged as an
  invalid resource. ([#3821])

[#3906]: https://github.com/emissary-ingress/emissary/issues/3906
[DW Envoy: 74]: https://github.com/datawire/envoy/pull/74
[Upstream Envoy: 19383]: https://github.com/envoyproxy/envoy/pull/19383
[#4053]: https://github.com/emissary-ingress/emissary/pull/4053
[#4040]: https://github.com/emissary-ingress/emissary/pull/4040
[#3821]: https://github.com/emissary-ingress/emissary/issues/3821

Emissary Ingress Chart 7.3.0: tag_name: chart/v7.3.0
body: ## :tada: Emissary Ingress Chart 7.3.0 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---
Emissary Ingress 2.1.2: tag_name: v2.1.2
body: 
## :tada: Emissary Ingress 2.1.2 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v2.1.2/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: Emissary-ingress 2.1.0 generated invalid Envoy configuration for `getambassador.io/v2`
  `Mappings` that set `spec.cors.origins` to a string rather than a list of strings; this has been
  fixed, and these `Mappings` should once again function correctly.

- Bugfix: Changes to the `weight` of `Mapping` in a canary group will now always be correctly
  managed during reconfiguration; such changes could have been missed in earlier releases.

- Bugfix: A `Mapping` that is not part of a canary group, but that has a `weight` less than 100,
  will be correctly configured to receive all traffic as if the `weight` were 100.

- Bugfix: Using `rewrite: ""` in a `Mapping` is correctly handled to mean "do not rewrite the path
  at all".

- Bugfix: `Mapping`s with DNS wildcard `hostname` will now be correctly matched with `Host`s.
  Previously, the case where both the `Host` and the `Mapping` use DNS wildcards for their hostnames
  could sometimes  not correctly match when they should have.

- Bugfix: Any `Mapping` that uses the `host_redirect` field is now properly discovered and used.
  Thanks to <a href="https://github.com/gferon">Gabriel Féron</a> for contributing this bugfix! ([3709])

- Bugfix: If the `ambassador` `Module` sets a global default for `add_request_headers`,
  `add_response_headers`, `remove_request_headers`, or `remove_response_headers`, it is often
  desirable to be able to turn off that setting locally for a specific `Mapping`. For several
  releases this has not been possible for `Mappings` that are native Kubernetes resources (as
  opposed to annotations), as an empty value ("mask the global default") was erroneously considered
  to be equivalent to unset ("inherit the global default").  This is now fixed.

- Bugfix: It is now possible to set a `Mapping` `spec.error_response_overrides` `body.text_format`
  to an empty string or `body.json_format` to an empty dict.  Previously, this was possible for
  annotations but not for native Kubernetes resources.

- Bugfix: Resources that exist as `getambassador.io/config` annotations rather than as native
  Kubernetes resources are now validated and internally converted to v3alpha1 and, the same as
  native Kubernetes resources.

- Bugfix: Resource validation errors are now reported more consistently; it was the case that in
  some situations a validation error would not be reported.

- Change: Docker BuildKit is enabled for all Emissary builds. Additionally, the Go build cache is
  fully enabled when building images, speeding up repeated builds.

[3709]: https://github.com/emissary-ingress/emissary/issues/3709

Emissary Ingress Chart 7.2.2: tag_name: chart/v7.2.2
body: ## :tada: Emissary Ingress Chart 7.2.2 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---

- Update Emissary chart image to version v2.1.2: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)


Emissary Ingress 2.1.0: tag_name: v2.1.0
body: ## :tada: Emissary Ingress 2.1.0 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Feature: It is now possible to use both the `getambassador.io/v2` and `getambassador.io/v3alpha1`
  apiVersions.  This is accomplished with the addition of an `emissary-ingress-apiext` Service and
  Deployment that handles converting between the two versions for the apiserver.  This allows the
  user to semlessly request and author resources in whichever API version is desired, and
  facilitates easier migration from Emissary 1.x to 2.x.  Resources authored in v3alpha1 will not be
  visible to Emissary 1.x; resources authored in v2 will be visible to both Emissary 1.x and 2.x.

- Bugfix: The incremental reconfiguration cache could miss some updates when multiple `Mapping`s had
  the same `prefix` ("canary"ing multiple `Mapping`s together). This has been corrected, so that all
  such updates correctly take effect. ([3945])

- Bugfix: When using Kubernetes Secrets to store ACME private keys (as the Edge Stack ACME client
  does), an error would always be logged about the Secret not being present, even though it was
  present, and everything was working correctly. This error is no longer logged.

- Bugfix: When using gzip compression, upstream services will no longer receive compressed data.
  This bug was introduced in 1.14.0. The fix restores the default behavior of not sending compressed
  data to upstream services. ([3818])

- Security: Update to busybox 1.34.1 to resolve CVE-2021-28831, CVE-2021-42378, CVE-2021-42379,
  CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385,
  and CVE-2021-42386.

- Security: Update Python dependencies to resolve CVE-2020-28493 (jinja2), CVE-2021-28363 (urllib3),
  and CVE-2021-33503 (urllib3).

- Security: Previous built images included some Python packages used only for test. These have now
  been removed, resolving CVE-2020-29651.

[3945]: https://github.com/emissary-ingress/emissary/issues/3945
[3818]: https://github.com/emissary-ingress/emissary/issues/3818

Emissary Ingress 2.0.5: tag_name: v2.0.5
body: ## :tada: Emissary Ingress 2.0.5 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Feature: It is now possible to set the `circuit_breakers` for `AuthServices`, exactly the same as
  for `Mappings` and `TCPMappings`. This makes it possible to configure your `AuthService` to be
  able to handle more than 1024 concurrent requests.

- Bugfix: Any token delimited by '%' is now validated agains a whitelist of valid Envoy command
  operators. Any mapping containing an `error_response_overrides` section with invalid command
  operators will be discarded.

- Bugfix: The `Host` CRD now correctly supports the `mappingSelector` element, as documented. As a
  transition aid, `selector` is a synonym for `mappingSelector`; a future version of
  Emissary-ingress will remove the `selector` element. ([3902])

[3902]: https://github.com/emissary-ingress/emissary/issues/3902

Emissary Ingress Chart 7.1.10: tag_name: chart-v7.1.10
body: ## :tada: Emissary Ingress Chart 7.1.10 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---

- Update Emissary chart image to version v2.0.5: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)


Emissary Ingress 2.0.4: tag_name: v2.0.4
body: ## :tada: Emissary Ingress 2.0.4 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

We're pleased to introduce Emissary-ingress 2.0.4 for general availability! The 2.X family introduces a number of changes to allow Emissary-ingress to more gracefully handle larger installations, reduce global configuration to better handle multitenant or multiorganizational installations, reduce memory footprint, and improve performance. We welcome feedback!! Join us on [Slack] and let us know what you think.

- Change: The `x.getambassador.io/v3alpha1` API version has become the `getambassador.io/v3alpha1`
  API version. The `Ambassador-` prefixes from `x.getambassador.io/v3alpha1` resources have been
  removed for ease of migration. _Note that `getambassador.io/v3alpha1` is the only supported API
  version for 2.0.4_ &mdash; full support for `getambassador.io/v2` will arrive soon in a later 2.X
  version.

- Feature: The `getambassador.io/v3alpha1` API version and the published chart and manifests have
  been updated to support Kubernetes 1.22.

- Feature: You can now set `dns_type` between `strict_dns` and `logical_dns` in a `Mapping` to
  configure the Service Discovery Type.

- Feature: You can now set `respect_dns_ttl` to `true` to force the DNS refresh rate for a `Mapping`
  to be set to the record's TTL obtained from DNS resolution.

- Feature: You can now set `buffer_limit_bytes` in the `ambassador` `Module` to to change the size
  of the upstream read and write buffers. The default is 1MiB.

- Bugfix: The release now shows its actual released version number, rather than the internal
  development version number. ([#3854])

- Bugfix: Large configurations no longer cause Emissary-ingress to be unable to communicate with
  Ambassador Cloud. ([#3593])

- Bugfix: The `l7Depth` element of the `Listener` CRD is  properly supported.

[Slack]: https://a8r.io/slack
[#3854]: https://github.com/emissary-ingress/emissary/issues/3854
[#3593]: https://github.com/emissary-ingress/emissary/issues/3593

Emissary Ingress Chart 7.1.9: tag_name: chart-v7.1.9
body: ## :tada: Emissary Ingress Chart 7.1.9 :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---

- Update Ambassador chart image to version v2.0.4: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)


Ambassador Chart 6.9.3: tag_name: chart-v6.9.3
body: ## :tada: Ambassador Chart 6.9.3 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/charts/emissary-ingress/CHANGELOG.md

---



- Update Ambassador API Gateway chart image to version v1.14.2: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
- Update Ambassador Edge Stack chart image to version v1.14.2: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
(v6.9.2 was withdrawn)
Emissary Ingress 1.14.2: tag_name: v1.14.2
body: ## :tada: Emissary Ingress 1.14.2 :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Feature: You can now set `respect_dns_ttl` to `true` to force the DNS refresh rate for a `Mapping` to be
  set to the record's TTL obtained from DNS resolution.

- Feature: You can now set `dns_type` between `strict_dns` and `logical_dns` in a `Mapping` to configure the
  Service Discovery Type.

- Feature: You can now set `buffer_limit_bytes` in the `ambassador` `Module` to to change the size of the
  upstream read and write buffers. The default is 1MiB. 

Ambassador Chart 6.9.2: tag_name: chart-v6.9.2
body: ## :tada: Ambassador Chart 6.9.2 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/charts/emissary-ingress/CHANGELOG.md

---



- Update Ambassador API Gateway chart image to version v1.14.2: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
- Update Ambassador Edge Stack chart image to version v1.14.2: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Emissary Ingress Chart 7.1.8-ea: tag_name: chart-v7.1.8-ea
body: ## :tada: Emissary Ingress Chart 7.1.8-ea :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---



- Update Ambassador chart image to version v2.0.3-ea: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Emissary Ingress 2.0.3-ea: tag_name: v2.0.3-ea
body: 
## :tada: Emissary Ingress 2.0.3-ea :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Feature: The environment variable `AES_LOG_LEVEL` now also sets the log level for the `diagd` logger. [#3686] [#3666]

- Feature: You can now set `dns_type` in the `AmbassadorMapping` to configure how Envoy will use the DNS for
  the service.

- Bugfix: It is no longer necessary to set `DOCKER_BUILDKIT=0` when building Emissary. A future change will
  fully support BuildKit. [#3707]

[#3686]: https://github.com/emissary-ingress/emissary/issues/3686
[#3666]: https://github.com/emissary-ingress/emissary/issues/3666
[#3707]: https://github.com/emissary-ingress/emissary/issues/3707



Emissary Ingress 2.0.2-ea: tag_name: v2.0.2-ea
body: 
## :tada: Emissary Ingress 2.0.2-ea :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started


- - Change: Update Envoy from 1.15 to 1.17.4 with security patches to fix the following CVEs
  - CVE-2021-32777
  - CVE-2021-32779
  - CVE-2021-32781
  - CVE-2021-32778
- Feature: You can now set `allow_chunked_length` in the Ambassador Module to configure the same value in Envoy.
- Change: Envoy-configuration snapshots get saved (as `ambex-#.json`) in `/ambassador/snapshots`.
  The number of snapshots is controlled by the `AMBASSADOR_AMBEX_SNAPSHOT_COUNT` environment
  variable; set it to 0 to disable. The default is 30.



Ambassador 1.14.1: tag_name: v1.14.1
body: 
## :tada: Ambassador 1.14.1 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started


- Change: Update Envoy with security patches to fix the following CVEs
  - CVE-2021-32777
  - CVE-2021-32779
  - CVE-2021-32781
  - CVE-2021-32778



Emissary Ingress Chart 7.1.2-ea: tag_name: chart-v7.1.2-ea
body: ## :tada: Emissary Ingress Chart 7.1.2-ea :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---



- Update Ambassador chart image to version v2.0.2-ea: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Ambassador Chart 6.9.1: tag_name: chart-v6.9.1
body: ## :tada: Ambassador Chart 6.9.1 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/charts/emissary-ingress/CHANGELOG.md

---



- Update Ambassador API Gateway chart image to version v1.14.1: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
- Update Ambassador Edge Stack chart image to version v1.14.1: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Ambassador Chart 6.9.0: tag_name: chart-v6.9.0
body: ## :tada: Ambassador Chart 6.9.0 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/charts/ambassador/CHANGELOG.md

---



- Update Ambassador Edge Stack chart image to version v1.14.0: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Ambassador 1.14.0: tag_name: v1.14.0
body: 
## :tada: Ambassador 1.14.0 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started


- Change: Logs now include subsecond time resolutions, rather than just seconds.
- Change: Update from Envoy 1.15 to 1.17.3
- Change: `AMBASSADOR_ENVOY_API_VERSION` now defaults to `V3`
- Feature: You can now set `allow_chunked_length` in the Ambassador Module to configure the same value in Envoy.



Emissary Ingress 2.0.1-ea: tag_name: v2.0.1-ea
body: 
## :tada: Emissary Ingress 2.0.1-ea :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started


- Feature: The optional `stats_prefix` element of the `AmbassadorListener` CRD now determines the prefix of HTTP statistics emitted for a specific `AmbassadorListener`.
- Feature: The optional `stats_name` element of `AmbassadorMapping`, `AmbassadorTCPMapping`, `AuthService`, `LogService`, `RateLimitService`, and `TracingService` now sets the name under which cluster statistics will be logged. The default is the `service`, with non-alphanumeric characters replaced by underscores.
- Feature: Ambassador Agent reports sidecar process information and Mapping OpenAPI documentation to Ambassador Cloud to provide more visibility into services and clusters.
- Change: Logs now include subsecond time resolutions, rather than just seconds.
- Change: Envoy-configuration snapshots get saved (as `ambex-#.json`) in `/ambassador/snapshots`.
  The number of snapshots is controlled by the `AMBASSADOR_AMBEX_SNAPSHOT_COUNT` environment
  variable; set it to 0 to disable. The default is 30.
- Change: Set `AMBASSADOR_AMBEX_NO_RATELIMIT` to `true` to completely disable ratelimiting Envoy
  reconfiguration under memory pressure. This can help performance with the endpoint or Consul
  resolvers, but could make OOMkills more likely with large configurations. The default is `false`,
  meaning that the rate limiter is active.



Emissary Ingress Chart 7.1.1-ea: tag_name: chart-v7.1.1-ea
body: ## :tada: Emissary Ingress Chart 7.1.1-ea :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---



- Update Ambassador chart image to version v2.0.1-ea: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Ambassador 1.13.10: tag_name: v1.13.10
body: 
## :tada: Ambassador 1.13.10 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started


- Change: Envoy-configuration snapshots get saved (as ambex-#.json) in /ambassador/snapshots. The number of snapshots is
  controlled by the `AMBASSADOR_AMBEX_SNAPSHOT_COUNT` environment variable; set it to 0 to disable. The default is 30.
- Change: A new field is added to the `Docs` field in the `Mapping` resource: `timeout_ms` is an optional integer that, 
  when present, configures the number of milliseconds the Devportal HTTP client will wait to access the docs endpoint 
  of the service mapping. 
- Change: Set `AMBASSADOR_AMBEX_NO_RATELIMIT` to `true` to completely disable ratelimiting Envoy
  reconfiguration under memory pressure. This can help performance with the endpoint or Consul resolvers,
  but could make OOMkills more likely with large configurations. The default is `false`, meaning that
  the rate limiter is active.
- Bugfix: Fixed a regression when specifying a comma separated string for `cors.origins` on the `Mapping` resource

### Ambassador Edge Stack

- Change: Consul certificate-rotation logging now includes the fingerprints and validity timestamps of certificates
  being rotated.
- Change: Devportal leverages the `timeout_ms` field in the `docs` field of the `Mapping` resource to configure the 
  HTTP client it uses to fetch API specifications.



Ambassador Chart 6.7.13: tag_name: chart-v6.7.13
body: ## :tada: Ambassador Chart 6.7.13 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/charts/ambassador/CHANGELOG.md

---



- Update Ambassador API Gateway chart image to version v1.13.10: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
- Update Ambassador Edge Stack chart image to version v1.13.10: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Emissary Ingress Chart 7.1.0-ea: tag_name: chart-v7.1.0-ea
body: ## :tada: Emissary Ingress Chart 7.1.0-ea :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---



- Feature: New canarying features for Ambassador in the chart that allow creation of a secondary deployment/service to test new versions and environment variables.
- Feature: Exposed `progressDeadlineSeconds` for the Ambassador and Ambassador Agent Deployments with new values
Ambassador 1.13.9: tag_name: v1.13.9
body: 
## :tada: Ambassador 1.13.9 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/release/v1.13/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started


- Bugfix: Configuring multiple TCPMappings with the same ports (but different hosts) no longer generates invalid Envoy configuration.



Ambassador Chart 6.7.12: tag_name: chart-v6.7.12
body: ## :tada: Ambassador Chart 6.7.12 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/release/v1.13/charts/ambassador/CHANGELOG.md

---



- Update Ambassador API Gateway chart image to version v1.13.9: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/release/v1.13/CHANGELOG.md)
- Update Ambassador Edge Stack chart image to version v1.13.9: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/release/v1.13/CHANGELOG.md)
Emissary Ingress 2.0.0-ea: tag_name: v2.0.0-ea
body: 
## :tada: Emissary Ingress 2.0.0-ea :tada:

#### Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started


We're pleased to introduce Emissary 2.0.0 as a developer preview. The 2.X family introduces a number of changes to allow Emissary to more gracefully handle larger installations, reduce global configuration to better handle multitenant or multiorganizational installations, reduce memory footprint, and improve performance. We welcome feedback!! Join us on <a href="https://a8r.io/slack">Slack</a> and let us know what you think.

- Feature: The `Listener` CRD allows explicit definition of ports to listen on, the protocols and security model for each port, and which `Host`s should be associated with which `Listener`.
- Bugfix: `requestPolicy.insecure.action` works independently across `Host`s ([#2888])
- Bugfix: Fixed a regression in detecting the Ambassador Kubernetes service that could cause the wrong IP or hostname to be used in Ingress statuses.
- Change: `Host`s and `Mapping`s will not be associated unless a `Host` selector or a `Mapping`'s `host` element explicitly agree.
- Change: `Mapping`'s `host` field is either an exact match or (with `host_regex` set) a regex. `Mapping` now has a new `hostname` element that is functionally the same as `host`, but is always a DNS glob.
- Change: The `tls` field on the Ambassador module is now deprecated. Please use TLSContexts instead https://www.getambassador.io/docs/edge-stack/latest/topics/running/tls/#tlscontext.
- Change: Envoy V3 is now the default.
- Change: The `Host` CRD is now required when terminating TLS.
- Change: The AGENT_SERVICE environment variable has been deprecated.
- Change: `redirect_cleartext_from` in a `TLSContext` is no longer supported -- use an extra 'Listener' instead!
- Change: `prune_unreachable_routes` now defaults to true, which should reduce Envoy memory requirements for installations with many `Host`s
- Change: The edgectl CLI tool has been deprecated, please use the `emissary-ingress` helm chart instead.

[#2888]: https://github.com/datawire/ambassador/issues/2888



Emissary Ingress Chart 7.0.0-ea: tag_name: chart-v7.0.0-ea
body: ## :tada: Emissary Ingress Chart 7.0.0-ea :tada:

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

---



We're pleased to introduce Emissary 2.0.0 as a developer preview.
Emissary Ingress chart v7.0.0-ea provides early access to Emissary 2.0 features. [Learn more in our docs](https://www.getambassador.io/docs/emissary/latest/about/changes-2.0.0/)
- Update Ambassador chart image to version v2.0.0-ea: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
- Change: removed helm 2 support
- Feature: Add an option to create default HTTP and HTTPS listeners
Ambassador 1.13.8: tag_name: v1.13.8
body: 
## :tada: Ambassador 1.13.8 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started


- Bugfix: Ambassador Agent now accurately reports up-to-date Endpoint information to Ambassador Cloud
- Feature: Ambassador Agent reports ConfigMaps and Deployments to Ambassador Cloud to provide a better Argo Rollouts experience. See [Argo+Ambassador documentation](https://www.getambassador.io/docs/argo) for more info.



Ambassador Chart 6.7.11: tag_name: chart-v6.7.11
body: ## :tada: Ambassador Chart 6.7.11 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/charts/ambassador/CHANGELOG.md

---



- Update Ambassador API Gateway chart image to version v1.13.8: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
- Update Ambassador Edge Stack chart image to version v1.13.8: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
- Bugfix: remove duplicate label key in ambassador-agent deployment
Ambassador 1.13.7: tag_name: v1.13.7
body: 
## :tada: Ambassador 1.13.7 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started


- Feature: Add AMBASSADOR_JSON_LOGGING to enable JSON for most of the Ambassador control plane. Some (but few) logs from gunicorn and the Kubernetes client-go package still log text.
- Bugfix: Fixed a bug where the Consul resolver would not actually use Consul endpoints with TCPMappings.
- Change: Ambassador now calculates its own memory usage in a way that is more similar to how the kernel OOMKiller tracks memory.



Ambassador Chart 6.7.10: tag_name: chart-v6.7.10
body: ## :tada: Ambassador Chart 6.7.10 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/charts/ambassador/CHANGELOG.md

---



- Update Ambassador API Gateway chart image to version v1.13.7: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
- Update Ambassador Edge Stack chart image to version v1.13.7: [CHANGELOG](https://github.com/emissary-ingress/emissary/blob/master/CHANGELOG.md)
Ambassador 1.13.6: tag_name: v1.13.6
body: ## :tada: Ambassador 1.13.6 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: Fixed a regression where Ambassador snapshot data was logged at the INFO label when using AMBASSADOR_LEGACY_MODE=true
Ambassador Chart 6.7.9: tag_name: chart-v6.7.9
body: ## :tada: Ambassador Chart 6.7.9 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/charts/ambassador/CHANGELOG.md

---

- Update Ambassador chart image to version 1.13.6: [CHANGELOG](https://github.com/datawire/ambassador/blob/master/CHANGELOG.md)
Ambassador 1.13.5: tag_name: v1.13.5
body: ## :tada: Ambassador 1.13.5 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Emissary Ingress and Ambassador Edge Stack

- Bugfix: Fix a regression from 1.8.0 that prevented Ambassador module config keys `proper_case` and `preserve_external_request_id` from working correctly.
- Bugfix: Fixed a regression in detecting the Ambassador Kubernetes service that could cause the wrong IP or hostname to be used in Ingress statuses (thanks, [Noah Fontes](https://github.com/impl)!

Ambassador Chart 6.7.8: tag_name: chart-v6.7.8
body: ## :tada: Ambassador Chart 6.7.8 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md

- Update Ambassador chart image to version 1.13.5: [CHANGELOG](https://github.com/datawire/ambassador/blob/master/CHANGELOG.md)

Ambassador Chart 6.7.7: tag_name: chart-v6.7.7
body: ## :tada: Ambassador Chart 6.7.7 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/charts/ambassador/CHANGELOG.md

---

- Bugfix: ambassador-injector and telepresence-proxy now use the correct default image repository

Ambassador 1.13.4: tag_name: v1.13.4
body: ## :tada: Ambassador 1.13.4 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: Incorporate the Envoy 1.15.5 security update by adding the `reject_requests_with_escaped_slashes` option to the Ambassador module.
Ambassador Chart 6.7.6: tag_name: chart-v6.7.6
body: ## :tada: Ambassador Chart 6.7.6 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md

- Update Ambassador chart image to version 1.13.4: [CHANGELOG](https://github.com/datawire/ambassador/blob/master/CHANGELOG.md)
- Change: unless image.repository or image.fullImageOverride is explicitly set, the ambassador image used will be templated on .Values.enableAES. If AES is enabled, the chart will use docker.io/datawire/aes, otherwise will use docker.io/datawire/ambassador.
Ambassador 1.13.3: tag_name: v1.13.3
body: ## :tada: Ambassador 1.13.3 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: Fixed a regression that caused Ambassador to crash when loading the Edge Policy Console when any RateLimit resources exist ([#3348])
Ambassador Chart 6.7.5: tag_name: chart-v6.7.5
body: ## :tada: Ambassador Chart 6.7.5 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md

- Update Ambassador chart image to version v1.13.3: [CHANGELOG](https://github.com/datawire/ambassador/blob/master/CHANGELOG.md)
Ambassador Chart 6.7.4: tag_name: chart-v6.7.4
body: ## :tada: Ambassador Chart 6.7.4 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/charts/ambassador/CHANGELOG.md

---

- Feature: The [Ambassador Module](https://www.getambassador.io/docs/edge-stack/latest/topics/running/ambassador/) can now be configured and managed by Helm

Ambassador 1.13.2: tag_name: v1.13.2
body: ## :tada: Ambassador 1.13.2 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: Fixed a regression that caused endpoint routing to not work when defining mappings in service annotations ([#3369])
Ambassador Chart 6.7.3: tag_name: chart-v6.7.3
body: ## :tada: Ambassador Chart 6.7.3 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md

- Update Ambassador chart image to version v1.13.2: [CHANGELOG](https://github.com/datawire/ambassador/blob/master/CHANGELOG.md)
Ambassador Chart 6.7.2: tag_name: chart-v6.7.2
body: ## :tada: Ambassador Chart 6.7.2 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/charts/ambassador/CHANGELOG.md

---

- Bugfix: Don't change the Role name when running in singleNamespace mode.

Ambassador 1.13.1: tag_name: v1.13.1
body: ## :tada: Ambassador 1.13.1 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

 - Bugfix: Potentially increased CPU Usage for deployments with large numbers of Hosts ([#3358])

Ambassador Chart 6.7.1: tag_name: chart-v6.7.1
body: ## :tada: Ambassador Chart 6.7.1 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md

- Update Ambassador chart image to version v1.13.1: [CHANGELOG](https://github.com/datawire/ambassador/blob/master/CHANGELOG.md)

Ambassador 1.13.0: tag_name: v1.13.0
body: ## :tada: Ambassador 1.13.0 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Emissary Ingress and Ambassador Edge Stack

*Note*: Support for the deprecated `v2alpha` `protocol_version` has been removed from the `AuthService` and `RateLimitService`.

- Feature: Added support for the [Mapping AuthService setting] `auth_context_extensions`, allowing supplying custom per-mapping information to external auth services (thanks, [Giridhar Pathak](https://github.com/gpathak)!).
- Feature: Added support in ambassador-agent for reporting [Argo Rollouts] and [Argo Applications] to Ambassador Cloud
- Feature: The [Ambassador Module configuration] now supports the `diagnostics.allow_non_local` flag to expose admin UI internally only ([#3074] -- thanks, [Fabrice](https://github.com/jfrabaute)!)
- Feature: Ambassador will now use the Envoy v3 API internally when the AMBASSADOR_ENVOY_API_VERSION environment variable is set to "V3". By default, Ambassador will continue to use the v2 API.
- Feature: The [Ambassador Agent] is now available (and deployed by default) for the API Gateway (https://app.getambassador.io).
- Feature: The [Ambassador Module configuration] now supports `merge_slashes` which tells Ambassador to merge adjacent slashes when performing route matching. For example, when true, a request with URL '//foo/' would match a Mapping with prefix '/foo/'.
- Feature: Basic support for a subset of the [Kubernetes Gateway API] has been added.
- Feature: Ambassador now supports the `DD_ENTITY_ID` environment variable to set the `dd.internal.entity_id` statistics tag on metrics generated when using DogStatsD.
- Bugfix: Make Knative paths match on prefix instead of the entire path to better align to the Knative specification ([#3224]).
- Bugfix: The endpoint routing resolver will now properly watch services that include a scheme.
- Bugfix: Environment variable interpolation works again for `ConsulResolver.Spec.Address` without setting `AMBASSADOR_LEGACY_MODE` ([#3182], [#3317])
- Bugfix: Endpoint routing will now detect endpoint changes when your service field includes `.svc.cluster.local`. ([#3324])
- Bugfix: Upgrade PyYAML to 5.4.1 ([#3349])
- Change: The Helm chart has been moved into this repo, in the `charts/ambassador` directory.
- Change: The `Mapping` CRD has been modified so that `kubectl get mappings` now has a column for not just the source path-prefix (`.spec.prefix`), but the source host (`.spec.host`) too.
- Change: The yaml in yaml/docs is now generated from the contents of the helm chart in the `charts/ambassador` directory.
- Change: Support for the deprecated `v2alpha` `protocol_version` has been removed from the `AuthService` and `RateLimitService`.

[Ambassador Agent]: https://www.getambassador.io/docs/cloud/latest/service-catalog/quick-start/
[Ambassador Module configuration]: https://getambassador.io/docs/edge-stack/latest/topics/running/ambassador/
[Argo Applications]: https://www.getambassador.io/docs/argo/latest/quick-start/
[Argo Rollouts]: https://www.getambassador.io/docs/argo/latest/quick-start/
[Kubernetes Gateway API]: https://getambassador.io/docs/edge-stack/latest/topics/using/gateway-api/
[Mapping AuthService setting]: https://getambassador.io/docs/edge-stack/latest/topics/using/authservice

[#3074]: https://github.com/datawire/ambassador/issues/3074
[#3182]: https://github.com/datawire/ambassador/issues/3182
[#3224]: https://github.com/datawire/ambassador/issues/3224
[#3317]: https://github.com/datawire/ambassador/issues/3317
[#3324]: https://github.com/datawire/ambassador/issues/3324
[#3349]: https://github.com/datawire/ambassador/issues/3349

### Ambassador Edge Stack only

- Feature: DevPortal: Added doc.display_name attribute to the Mapping CRD. This value allows for a custom name and documentation URL path of the service in the DevPortal.
- Feature: DevPortal: Added `naming_scheme` enum to the DevPortal CRD. This enum controls the way services are displayed in the DevPortal. Supported values are `namespace.name` (current behavior) and `name.prefix`, which will use the Mapping name and Mapping prefix to display the services.
- Feature: DevPortal: `DEVPORTAL_DOCS_BASE_PATH` environment variable makes the base path of service API documentation configurable.
- Feature: DevPortal: DevPortal will now reload content on changes to Mapping and DevPortal resources.
- Feature: DevPortal: DevPortal now supports a search endpoint at `/docs/api/search`
- Feature: DevPortal search can be configured to only search over titles (with search.type=`title-only`in the DevPortal CRD) or to search over all content (search.type=`all-content`)
- Feature: DevPortal search supports deep linking to openapi spec entries (must set `search.type=all-content` and `search.enabled=true` on the DevPortal CRD)
- Feature: DevPortal: Trigger content refresh by hitting `/docs/api/refreshContent`
- Feature: The AES ratelimit preview service now supports [burst ratelimiting] (aka token bucket ratelimiting).
- Bugfix: The AES ratelimit preview no longer ignores LOCAL_CACHE_SIZE_IN_BYTES.
- Bugfix: The AES ratelimit preview no longer ignores NEAR_LIMIT_RATIO.
- Bugfix: The AES ratelimit preview no longer ignores EXPIRATION_JITTER_MAX_SECONDS.
- Change: Silence DevPortal warnings when DevPortal cannot parse a hostname from a Mapping. (#3341)

[burst ratelimiting]: https://getambassador.io/docs/edge-stack/latest/topics/using/rate-limits/rate-limits/

[#3341]: https://github.com/datawire/ambassador/issues/3341

Ambassador 1.12.4: tag_name: v1.12.4
body: ## :tada: Ambassador 1.12.4 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: Fix the Envoy base image build step and, as a result, correctly ship the Envoy 1.15.4 security updates.
Ambassador Chart 6.7.0: tag_name: chart-v6.7.0
body: ## :tada: Ambassador Chart 6.7.0 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md

- Update Ambassador to version 1.13.0: [CHANGELOG](https://github.com/datawire/ambassador/blob/master/CHANGELOG.md)
- Feature: Ambassador Agent now available for API Gateway (https://app.getambassador.io)
- Feature: Add support for [pod toplology spread constraints](https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/) via the `topologySpreadConstraints` helm value to the Ambassador deployment. (thanks, [@lawliet89](https://github.com/lawliet89)!)
- BugFix: Add missing `ambassador_id` for resolvers.
- Change: Ambassador ClusterRoles are now aggregated under the label `rbac.getambassador.io/role-group`. The aggregated role has the same name as the previous role name (so no need to update ClusterRoleBindings).

Ambassador Chart 6.6.4: tag_name: chart-v6.6.4
body: ## :tada: Ambassador Chart 6.6.4 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md

---

- Update Ambassador to version 1.12.4: [CHANGELOG](https://github.com/datawire/ambassador/blob/master/CHANGELOG.md)
Ambassador 1.12.3: tag_name: v1.12.3
body: ## :tada: Ambassador 1.12.3 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: Incorporate the Envoy 1.15.4 security update.
Ambassador Chart 6.6.3: tag_name: chart-v6.6.3
body: ## :tada: Ambassador Chart 6.6.3 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md

---

- Update Ambassador to version 1.12.3: [CHANGELOG](https://github.com/datawire/ambassador/blob/master/CHANGELOG.md)
Ambassador 1.12.2: tag_name: v1.12.2
body: ## :tada: Ambassador 1.12.2 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: Update OpenSSL to 1.1.1k to address CVE-2021-23840), CVE-2021-3450), CVE-2021-23841), CVE-2021-3449), CVE-2021-23839), CVE-2021-23840), CVE-2021-3450), CVE-2021-23841), CVE-2021-3449), and CVE-2021-23839)

Ambasssador Chart 6.6.2: tag_name: chart-v6.6.2
body: ## :tada: Ambassador Chart 6.6.2 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md

---

- Update Ambassador to version 1.12.2: [CHANGELOG](https://github.com/datawire/ambassador/blob/master/CHANGELOG.md)

Ambassador Chart  6.6.1: tag_name: chart-v6.6.1
body: ## :tada: Ambassador Chart 6.6.1 :tada:

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/datawire/ambassador/blob/master/charts/ambassador/CHANGELOG.md

---

- Bugfix: Fix metadata field in ConsulRevoler
- Feature: Make resolvers available to OSS
Ambassador 1.12.1: tag_name: v1.12.1
body: ## :tada: Ambassador 1.12.1 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: The endpoint routing resolver will now properly watch services with mappings that define the service field with an explicit port.
- Bugfix: Correctly manage cluster load assignments with very long cluster names and `AMBASSADOR_FAST_RECONFIGURE`
Ambassador 1.12.0: tag_name: v1.12.0
body: ## :tada: Ambassador 1.12.0 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambasssador API Gateway + Ambassador Edge Stack

- Feature: Endpoint routing is now much more performant, especially in situations where reconfigurations are frequent.
- Feature: A scrubbed ambassador snapshot is now accessible outside the pod at `:8005/snapshot-external`. This port is exposed on the ambassador-admin Kubernetes service.
- Feature: Ambassador now supports configuring the maximum lifetime of an upstream connection using `cluster_max_connection_lifetime_ms`. After the configured time, upstream connections are drained and closed, allowing an operator to set an upper bound on how long any upstream connection will remain open. This is useful when using Kubernetes Service resolvers (the default) and modifying label selectors for traffic shifting.
- Feature: The Ambassador Module configuration now supports `cluster_request_timeout_ms` to set a default request `timeout_ms` for Mappings. This allows an operator to update the default request timeout (currently 3000ms) without needing to update every Mapping.
- Feature: The Ambassador Module configuration now supports `suppress_envoy_headers` to prevent Ambassador from setting additional headers on requests and responses. These headers are typically used for diagnostic purposes and are safe to omit when they are not desired.
- Feature: All Kubernetes services managed by Ambassador are automatically instrumented with service catalog discovery annotations.
- Feature: [`headers_with_underscores_action`](https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/core/protocol.proto#enum-core-httpprotocoloptions-headerswithunderscoresaction) is now configurable in the Ambassador `Module`.
- Feature: The Ambassador Module configuration now supports `strip_matching_host_port` to control whether the port should be removed from the host/Authority header before any processing by request filters / routing. This behavior only applies if the port matches the associated Envoy listener port.
- Bugfix: Ambassador now does a better job of cleaning up gRPC connections when shutting down.
- Bugfix: Prevent potential reconcile loop when updating the status of an Ingress.
- Bugfix: Update Python requirements, including addressing CVE-2020-36242 ([#3233])
- Bugfix: Remove unnecessary logs about Kubernetes Secrets ([#3229])

[#3229]: https://github.com/datawire/ambassador/issues/3229
[#3233]: https://github.com/datawire/ambassador/issues/3233

### Ambassador Edge Stack only

- Feature: Added support for ambassador-agent deployment, reporting to Ambassador Cloud Service Catalog (https://app.getambassador.io)
- Feature: `edgectl login` will automatically open your browser, allowing you to login into Service Catalog (https://app.getambassador.io)
- Feature: `edgectl install` command allows you to install a new Ambassador Edge Stack automatically connected to Ambassador Cloud by passing a `--cloud-connect-token` argument.
- Feature: `AES_AUTH_TIMEOUT` now allows you to configure the timeout of the AES authentication service. Defaults to 4s.
- Bugfix: Prevent Dev Portal from sporadically responding with upstream connect timeout when loading content
Ambassador 1.11.2: tag_name: v1.11.2
body: ## :tada: Ambassador 1.11.2 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: Changes to endpoints when endpoint routing is not active will no longer cause reconfiguration
- Bugfix: Correctly differentiate int values of 0 and Boolean values of `false` from non-existent attributes in CRDs ([#3212])
- Bugfix: Correctly support Consul datacenters other than "dc1" without legacy mode.

[#3212]: https://github.com/datawire/ambassador/issues/3212
Ambassador 1.11.1: tag_name: 1.11.1
body: ## :tada: Ambassador 1.11.1 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: Fix an issue that caused Dev Portal to sporadically respond with upstream connect timeout when loading content
Ambassador 1.11.0: tag_name: v1.11.0
body: ## :tada: Ambassador 1.11.0 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambasssador API Gateway + Ambassador Edge Stack

- Feature: Ambassador now reads the ENVOY_CONCURRENCY environment variable to optionally set the [--concurrency](https://www.envoyproxy.io/docs/envoy/latest/operations/cli#cmdoption-concurrency) command line option when launching Envoy. This controls the number of worker threads used to serve requests and can be used to fine-tune system resource usage.
- Feature: The %DOWNSTREAM_PEER_CERT_V_START% and %DOWNSTREAM_PEER_CERT_V_END% command operators now support custom date formatting, similar to %START_TIME%. This can be used for both header formatting and access log formatting.
- Feature: Eliminate the need to drain and recreate listeners when routing configuration is changed. This reduces both memory usage and disruption of in-flight requests.
- Bugfix: Make sure that `labels` specifying headers with extra attributes are correctly supported again ([#3137]).
- Bugfix: Support Consul services when the `ConsulResolver` and the `Mapping` aren't in the same namespace, and legacy mode is not enabled.
- Bugfix: Fix failure to start when one or more IngressClasses are present in a cluster ([#3142]).
- Bugfix: Properly handle Kubernetes 1.18 and greater when RBAC prohibits access to IngressClass resources.
- Bugfix: Support `TLSContext` CA secrets with fast validation ([#3005]).
- Bugfix: Dev Portal correctly handles transient failures when fetching content
- Bugfix: Dev Portal sidebar pages have a stable order
- Bugfix: Dev Portal pages are now marked cacheable

### Ambassador Edge Stack only

- Feature: RateLimit CRDs now suport specifying an `action` for each limit. Possible values include "Enforce" and "LogOnly", case insensitive. LogOnly may be used to implement dry run rules that do not actually enforce.
- Feature: RateLimit CRDs now support specifying a symbolic `name` for each limit. This name can later be used in the access log to know which RateLimit, if any, applied to a request.
- Feature: RateLimit metadata is now available using the `DYNAMIC_METADATA(envoy.http.filters.ratelimit: ... )` command operator in the Envoy access logs. See [Envoy Documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage) for more on using dynamic metadata in the access log.
- Feature: OAuth2 Filter: The SameSite cookie attribute is now configurable.

[#3005]: https://github.com/datawire/ambassador/issues/3005
[#3137]: https://github.com/datawire/ambassador/issues/3137
[#3142]: https://github.com/datawire/ambassador/issues/3142
Ambassador 1.10.0: tag_name: v1.10.0
body: ## :tada: Ambassador 1.10.0 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambasssador API Gateway + Ambassador Edge Stack

- Feature: The redirect response code returned by Ambassador is now configurable using `redirect_reponse_code` on `Mappings` that use `host_redirect`.
- Feature: The redirect location header returned by Ambassador now supports prefix rewrites using `prefix_redirect` on `Mappings` that use `host_redirect`.
- Feature: The redirect location header returned by Ambassador now supports regex rewrites using `regex_redirect` on `Mappings` that use `host_redirect`.
- Feature: Expose `max_request_headers_kb` in the Ambassador `Module`. This directly exposes the same value in Envoy; see [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/filter/network/http_connection_manager/v2/http_connection_manager.proto) for more information.
- Feature: Support Istio mTLS certification rotation for Istio 1.5 and higher. See the [howto](https://www.getambassador.io/docs/latest/howtos/istio/) for details.
- Feature: The Ambassador Module's `error_response_overrides` now support configuring an empty response body using `text_format`. Previously, empty response bodies could only be configured by specifying an empty file using `text_format_source`.
- Feature: OAuth2 Filter: Support injecting HTTP header fields in to the request before passing on to the upstream service. Enables passing along `id_token` information to the upstream if it was returned by the IDP.
- Bugfix: Fix a bug in the Mapping CRD where the `text_format_source` field was incorrectly defined as type `string` instead of an object, as documented.
- Bugfix: The RBAC requirements when `AMBASSADOR_FAST_RECONFIGURE` is enabled now more-closely match the requirements when it's disabled.
- Bugfix: Fix error reporting and required-field checks when fast validation is enabled. Note that fast validation is now the default; see below.
- Change: **Fast validation is now the default**, so the `AMBASSADOR_FAST_VALIDATION` variable has been removed. The Golang boot sequence is also now the default. Set `AMBASSADOR_LEGACY_MODE=true` to disable these two behaviors.
- Change: ambassador-consul-connect resources now get deployed into the `ambassador` namespace instead of the active namespace specified in the user's kubernetes context (usually `default`). Old resource cleanup is documented in the Ambassador Consul integration documentation.

### Ambassador Edge Stack only

- Default-off early access: Ratelimiting now supports redis clustering, local caching, and an upgraded redis client with improved scalability. Must set AES_RATELIMIT_PREVIEW=true to access these improvements.
- Bugfix: OAuth2 Filter: Fix `insufficient_scope` error when validating Azure access tokens.
- Bugfix: Filters: Fix a capitalization-related bug where sometimes existing headers are appended to when they should be overwritten.
Ambassador 1.9.1: tag_name: v1.9.1
body: ## :tada: Ambassador 1.9.1 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambasssador API Gateway + Ambassador Edge Stack

- Bugfix: DevPortal: fix a crash when the `host` cannot be parsed as a valid hostname.
Ambassador 1.9.0: tag_name: v1.9.0
body: ## :tada: Ambassador 1.9.0 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambasssador API Gateway + Ambassador Edge Stack

- Change: The DevPortal no longer looks for documentation at `/.ambassador-internal/openapi-docs`.  A new field in `Mappings`, `docs`, must be used for specifying the source for documentation.  This can result in an empty Dev Portal after upgrading if `Mappings` do not include a `docs` attribute.
- Feature: Support configuring the gRPC Statistics Envoy filter to enable telemetry of gRPC calls (see the `grpc_stats` configuration flag -- thanks, [Felipe Roveran](https://github.com/feliperoveran)!)
- Feature: The `RateLimitService` and `AuthService` configs now support switching between gRPC protocol versions `v2` and `v2alpha` (see the `protocol_version` setting)
- Feature: The `TracingService` Zipkin config now supports setting `collector_hostname` to tell Envoy which host header to set when sending spans to the collector
- Feature: Ambassador now supports custom error response mapping
- Feature: DevPortal: default configuration using the `ambassador` `DevPortal` resource.
- Bugfix: Ambassador will no longer mistakenly post notices regarding `regex_rewrite` and `rewrite` directive conflicts in `Mapping`s due to the latter's implicit default value of `/` (thanks, [obataku](https://github.com/obataku)!)
- Bugfix: The `/metrics` endpoint will no longer break if invoked before configuration is complete (thanks, [Markus Jevring](https://github.com/markusjevringsesame)!)
- Bugfix: Update Python requirements to address CVE-2020-25659
- Bugfix: Prevent mixing `Mapping`s with `host_redirect` set with `Mapping`s that don't in the same group
- Bugfix: `ConsulResolver` will now fallback to the `Address` of a Consul service if `Service.Address` is not set.
- Docs: Added instructions for building ambassador from source, within a docker container (thanks, [Rahul Kumar Saini](https://github.com/rahul-kumar-saini)!)
- Update: Upgrade Alpine 3.10→3.12, GNU libc 2.30→2.32, and Python 3.7→3.8
- Update: Knative serving tests were bumped from version 0.11.0 to version 0.18.0 (thanks, [Noah Fontes](https://github.com/impl)!)

### Ambassador Edge Stack Only

- Feature: How the `OAuth2` Filter authenticates itself to the identity provider is now configurable with the `clientAuthentication` setting.
- Feature: The `OAuth2` Filter can now use RFC 7523 JWT assertions to authenticate itself to the identity provider; this is usable with all grant types.
- Feature: When validating a JWT's scope, the `JWT` and `OAuth2` Filters now support not just RFC 8693 behavior, but also the behavior of various drafts leading to it, making JWT scope validation usable with more identity providers.
- Feature: The `OAuth2` Filter now has `inheritScopeArgument` and `stripInheritedScope` settings that can further customize the behavior of `accessTokenJWTFilter`.
- Change: The `OAuth2` Filter argument `scopes` has been renamed to `scope`, for consistency.  The name `scopes` is deprecated, but will continue to work for backward compatibility.
- Bugfix: `OAuth2` Filter: Don't have `accessTokenValidation: auto` fall back to "userinfo" validation for a client_credentials grant; it doesn't make sense there and only serves to obscure a more useful error message.
Ambassador 1.8.1: tag_name: v1.8.1
body: ## :tada: Ambassador 1.8.1 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambasssador API Gateway + Ambassador Edge Stack

- Bugfix: Ambassador no longer fails to configure Envoy listeners when a TracingService or LogService has a service name whose underlying cluster name has over 40 charcters.
- Bugfix: The Ambassador diagnostics page no longer returns HTTP 500 when a TracingService or LogService has a service name whose underlying cluster name has over 40 characters.

Ambassador 1.8.0: tag_name: v1.8.0
body: ## :tada: Ambassador 1.8.0 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambasssador API Gateway + Ambassador Edge Stack

- Feature: HTTP IP Allow/Deny ranges are supported.
- Bugfix: Ambassador's health checks don't claim that Envoy has failed when reconfiguration taking a long time (thanks, [Fabrice](https://github.com/jfrabaute), for contributions here!).
- Bugfix: The `edgectl connect` command now works properly when using zsh on a Linux platform.
- Bugfix: The container no longer exits "successfully" when the Deployment specifies an invalid `command`.

### Ambassador Edge Stack Only

- Feature: `RateLimit` CRDs now support setting a response body, configurable with the `errorResponse` setting.
- Bugfix: `External` `Filter` can now properly proxy the body to the configured `auth_service`
- BugFix: The RBAC for AES now grants permission to "patch" `Events.v1.core` (previously it granted "create" but not "patch")

Ambassador 1.7.4: tag_name: v1.7.4
body: ## :tada: Ambassador 1.7.4 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambasssador API Gateway + Ambassador Edge Stack

- Bugfix: Several regressions in the 1.7.x series are resolved by removing the ability to set `insecure.action` on a per-`Host`-resource basis, which was an ability added in 1.7.0.  This reverts to the pre-1.7.0 behavior of having one `Host`'s insecure action "win" and be used for all `Host`s.
- Bugfix: Ambassador will no longer generate invalid Envoy configuration with duplicate clusters in certain scenarios when `AMBASSADOR_FAST_RECONFIGURE=true`.
- Enhancement: When `AMBASSADOR_FAST_RECONFIGURE=true` is set, Ambassador now logs information about memory usage.

Ambassador 1.7.3: tag_name: v1.7.3
body: ## :tada: Ambassador 1.7.3 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambasssador API Gateway + Ambassador Edge Stack

- Incorporate the Envoy 1.15.1 security update.
- Bugfix: A regression introduced in 1.7.2 when `AMBASSADOR_FAST_RECONFIGURE=true` has been fixed where Host resources `tls.ca_secret` didn't work correctly.
- Bugfix: `TLSContext` resources and `spec.tls` in `Host` resources now correctly handle namespaces with `.` in them.
- Bugfix: Fix `spec.requestPolicy.insecure.action` for `Host` resources with a `*` wildcard in the hostname.
- Bugfix: Reduce lock contention while generating diagnostics.

Ambassador 1.7.2: tag_name: v1.7.2
body: ## :tada: Ambassador 1.7.2 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambasssador API Gateway + Ambassador Edge Stack

- Bugfix: A regression introduced in 1.7.0 with the various Host.spec.insecure.action behaviors, including handling of X-Forwarded-Proto, has been fixed.
- Bugfix: Host resources no longer perform secret namespacing when the AMBASSADOR_FAST_RECONFIGURE flag is enabled.

Ambassador 1.7.1: tag_name: v1.7.1
body: ## :tada: Ambassador 1.7.1 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambasssador API Gateway + Ambassador Edge Stack

- Bugfix: Support `envoy_validation_timeout` in the Ambassador Module to set the timeout for validating new Envoy configurations

### Ambassador Edge Stack only

- Bugfix: `consul_connect_integration` is now built correctly.
- Bugfix: The developer portal again supports requests for API documentation

Ambassador 1.7.0: tag_name: v1.7.0
body: ## :tada: Ambassador 1.7.0 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador API Gateway + Ambassador Edge Stack

- Feature: Upgrade from Envoy 1.14.4 to 1.15.0.
- Bugfix: Correctly handle a `Host` object with incompatible manually-specified `TLSContext`
- Feature: The Ambassador control-plane now publishes Prometheus metrics alongside the existing Envoy data-plane metrics under the `/metrics` endpoint on port 8877.
- Default-off early access: Experimental changes to allow Ambassador to more quickly process configuration changes (especially with larger configurations) have been added. The `AMBASSADOR_FAST_RECONFIGURE` env var must be set to enable this. `AMBASSADOR_FAST_VALIDATION` should also be set for maximum benefit.

### Ambassador API Gateway only

- Bugfix: Fixes regression in 1.5.1 that caused it to not correctly know its own version number, leading to notifications about an available upgrade despite being on the most recent version.

### Ambassador Edge Stack only

- Feature: DevPortal can now discover openapi documentation from `Mapping`s that set `host` and `headers`
- Feature: `edgectl install` will automatically enable Service Preview with a Preview URL on the Host resource it creates.
- Feature: Service Preview will inject an `x-service-preview-path` header in filtered requests with the original request prefix to allow for context propagation.
- Feature: Service Preview can intercept gRPC requests using the `--grpc` flag on the `edgectl intercept add` command and the `getambassador.io/inject-traffic-agent-grpc: "true"` annotation when using automatic Traffic-Agent injection.
- Feature: The `TracingService` Zipkin config now supports setting `collector_endpoint_version` to tell Envoy to use Zipkin v2.
- Feature: You can now inject request and/or response headers from a `RateLimit`.
- Bugfix: Don't crash during startup if Redis is down.
- Bugfix: Service Preview correctly uses the Host default `Path` value for the `spec.previewUrl.type` field.
- Bugfix: The `JWT`, `OAuth2`, and other Filters are now better about reusing connections for outgoing HTTP requests.
- Bugfix: Fixed a potential deadlock in the HTTP cache used for fetching JWKS and such for `Filters`.
- Bugfix: Fixed insecure route action behavior. Host security policies no longer affect other Hosts.
- Bugfix: Internal Ambassador data is no longer exposed to the `/.ambassador-internal/` endpoints used by the DevPortal.
- Bugfix: Problems with license key limits will no longer trigger spurious HTTP 429 errors.  Using the `RateLimit` resource beyond 5rps without any form of license key will still trigger 429 responses, but now with a `X-Ambassador-Message` header indicating that's what happned.
- Bugfix: When multiple `RateLimit`s overlap, it is supposed to enforce the strictest limit; but the strictness comparison didn't correctly handle comparing limits with different units.

Ambassador 1.6.2: tag_name: v1.6.2
body: ## :tada: Ambassador 1.6.2 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador API Gateway + Ambassador Edge Stack

- Bugfix: The (new in 1.6.0) `Host.spec.tls` and `Host.spec.tlsContext` fields now work when `AMBASSADOR_FAST_VALIDATION=fast` is not set.
- Bugfix: Setting `use_websocket: true` on a `Mapping` now only affects routes generated from that `Mapping`, instead of affecting all routes on that port.
- Feature: It is now possible to "upgrade" to non-HTTP protocols other than WebSocket; the new `allow_upgrade` is a generalization of `use_websocket`.

### Ambassador Edge Stack only

- Bugfix: The `Host.spec.requestPolicy.insecure.additionalPort` field works again.
- Bugfix: The `Host.spec.ambassadorId` is once again handled in addition to `.ambassador_id`; allowing hosts written by older versions AES prior to 1.6.0 to continue working.
- Bugfix: Fix a redirect loop that could occur when using using multiple `protectedOrigins` in a `Host`.

Ambassador 1.6.1: tag_name: v1.6.1
body: ## :tada: Ambassador 1.6.1 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: Mapping with `https` scheme for service are correctly parsed.
- Bugfix: Mapping with both a scheme and a hostname of `localhost` is now handled correctly.
- Bugfix: ConsulResolver now works again for Mappings outside of Ambassador's namespace.

Ambassador 1.6.0: tag_name: v1.6.0
body: ## :tada: Ambassador 1.6.0 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading/
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador API Gateway + Ambassador Edge Stack

- Incorporate the Envoy 1.14.4 security update.
- API CHANGE: Turning off the Diagnostics UI via the Ambassador Module now disables access to the UI from both inside and outside the Ambassador Pod.
- API CHANGE: Default changes updating `Mapping` status from default-on to default-off; see below.
- Feature: Add support for circuit breakers in TCP mapping (thanks, [Pierre Fersing](https://github.com/PierreF)!)
- Feature: Ambassador CRDs now include schema. This enables validation by `kubectl apply`.
- Feature: Advanced TLS configuration can be specified in `Host` resource via `tlsContext` and `tls` fields.
- Feature: Implement sampling percentage in tracing service.
- Performance improvement: Diagnostics are generated on demand rather than on every reconfig.
- Performance improvement: Experimental fast validation of the contents of Ambassador resources has been added. The `AMBASSADOR_FAST_VALIDATION` env var must be set to enable this.
- Internal: Configuration endpoints used internally by Ambassador are no longer accessible from outside the Ambassador Pod.
- Bugfix: `envoy_log_format` can now be set with `envoy_log_type: json`.
- Docs: Fixed OAuth2 documentation spelling errors (thanks, [Travis Byrum](https://github.com/travisbyrum)!)

As previously announced, the default value of `AMBASSADOR_UPDATE_MAPPING_STATUS`
has now changed from `true` to `false`; Ambassador will no longer attempt to
update the `Status` of a `Mapping` unless you explicitly set
`AMBASSADOR_UPDATE_MAPPING_STATUS=true` in the environment.  If you do not have
tooling that relies on `Mapping` status updates, we do not recommend setting
`AMBASSADOR_UPDATE_MAPPING_STATUS`.

*In Ambassador 1.7*, TLS secrets in `Ingress` resources will not be able to use
`.namespace` suffixes to cross namespaces.

### Ambassador Edge Stack only

- Feature: The Edge Policy Console's Debugging page now has a "Log Out" button to terminate all EPC sessions.
- Feature: `X-Content-Type-Options: nosniff` to response headers are now set for the Edge Policy Console, to prevent MIME confusion attacks.
- Feature: The `OAuth2` Filter now has a `allowMalformedAccessToken` setting to enable use with IDPs that generate access tokens that are not compliant with RFC 6750.
- Bugfix: All JWT Filter errors are now formatted per the specified `errorResponse`.
- Feature: Options for making Redis connection pooling configurable.
- Bugfix: User is now directed to the correct URL after clicking in Microsoft Office.
- Feature: The Console's Dashboard page has speedometer gauges to visualize Rate Limited and Authenticated traffic.
Ambassador 1.5.5: tag_name: v1.5.5
body: ## :tada: Ambassador 1.5.5 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador API Gateway + Ambassador Edge Stack

- Incorporate the Envoy 1.14.3 security update.
Ambassador 1.5.4: tag_name: v1.5.4
body: ## :tada: Ambassador 1.5.4 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador API Gateway + Ambassador Edge Stack

- Bugfix: Allow disabling `Mapping`-status updates (RECOMMENDED: see below)
- Bugfix: Logging has been made _much_ quieter; the default Envoy log level has been turned down from "warning" to "error"
- Ambassador now logs timing information about reconfigures

We recommend that users set `AMBASSADOR_UPDATE_MAPPING_STATUS=false` in the environment to tell Ambassador not to update `Mapping` statuses unless you have some script that relies on `Mapping` status updates.  The default value of `AMBASSADOR_UPDATE_MAPPING_STATUS` will change to `false` in Ambassador 1.6.
Ambassador 1.5.3: tag_name: v1.5.3
body: ## :tada: Ambassador 1.5.3 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador API Gateway + Ambassador Edge Stack

- Bugfix: Restore Envoy listener drain time to its pre-Ambassador 1.3.0 default of 10 minutes.

### Ambassador Edge Stack only

- Bugfix: Allow deletion of ProjectControllers.
- Bugfix: Fix regression introduced in 1.4.2 where the `OAuth2` AuthorizationCode filter no longer works when behind another gateway that rewrites the request hostname.  The behavior here is now controllable via the `internalOrigin` sub-field.

Ambassador 1.5.2: tag_name: v1.5.2
body: ## :tada: Ambassador 1.5.2 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador API Gateway + Ambassador Edge Stack

- Incorporate the [Envoy 1.14.2](https://www.envoyproxy.io/docs/envoy/v1.14.2/intro/version_history#june-8-2020) security update.
- Upgrade the base Docker images used by several tests (thanks, [Daniel Sutton](https://github.com/ducksecops)!).

### Ambassador Edge Stack only

- Feature: (BETA) Added an in-cluster micro CI/CD system to enable building, staging, and publishing of GitHub projects from source.  This has been included in previous versions as an alpha, but disabled by default. It is now in BETA.
- Bugfix: The `DEVPORTAL_CONTENT_URL` environment variable now properly handles `file:///` URLs to refer to volume-mounted content.
- Bugfix: `acmeProvider.authority: none` is no longer case sensitive
- Bugfix: `edgectl connect` works again on Ubuntu and other Linux setups with old versions of nss-mdns (older than version 0.11)
- Bugfix: `edgectl` works again on Windows
- Bugfix: The Edge Policy Console now correctly creates FilterPolicy resources

Ambassador 1.5.1: tag_name: v1.5.1
body: ## :tada: Ambassador 1.5.1 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador API Gateway + Ambassador Edge Stack

- Bugfix: Logging has been made _much_ quieter
- Bugfix: A service that somehow has no hostname should no longer cause an exception

Ambassador 1.5.0: tag_name: v1.5.0
body: ## :tada: Ambassador 1.5.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrading - https://www.getambassador.io/docs/latest/topics/install/upgrading/
View changelog - https://github.com/datawire/ambassador/blob/release/v1.5/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador API Gateway + Ambassador Edge Stack

- Switched from quay.io back to DockerHub as our primary publication point. **If you are using your own Kubernetes manifests, you will have to update them!** Datawire's Helm charts and published YAML have already been updated.
- Feature: switch to Envoy 1.14.1
- Feature: Allow defaults for `add_request_header`, `remove_request_header`, `add_response_header`, and `remove_response_header`
- Feature: Inform Knative of the route to the Ambassador service if available (thanks, [Noah Fontes](https://github.com/impl)!)
- Feature: Support the path and timeout options of the Knative ingress path rules (thanks, [Noah Fontes](https://github.com/impl)!)
- Feature: Allow preserving `X-Request-ID` on requests from external clients (thanks, [Prakhar Joshi](https://github.com/prakharjoshi)!)
- Feature: Mappings now support query parameters (thanks, [Phil Peble](https://github.com/ppeble)!)
- Feature: Allow setting the Envoy shared-memory base ID (thanks, [Phil Peble](https://github.com/ppeble)!)
- Feature: Additional security configurations not set on default YAMLs
- Feature: Let Ambassador configure `regex_rewrite` for advanced forwarding
- Bugfix: Only update Knative ingress CRDs when the generation changes (thanks, [Noah Fontes](https://github.com/impl)!)
- Bugfix: Now behaves properly when `AMBASSADOR_SINGLE_NAMESPACE` is set to an empty string; rather than getting in to a weird in-between state
- Bugfix: The websocket library used by the test suite has been upgraded to incorporate security fixes (thanks, [Andrew Allbright](https://github.com/aallbrig)!)
- Bugfix: Fixed evaluation of label selectors causing the wrong IP to be put in to Ingress resource statuses
- Bugfix: The `watt` (port 8002) and `ambex` (port 8003) components now bind to localhost instead of 0.0.0.0, so they are no longer erroneously available from outside the Pod

### Ambassador Edge Stack only

- Feature: `edgectl upgrade` allows upgrading API Gateway installations to AES
- Feature: `edgectl intercept` can generate preview-urls for Host resources that enabled the feature
- Feature: `edgectl install` will now automatically install the Service Preview components (ambassador-injector, telepresence-proxy) and scoped RBAC
- Feature: Rate-limited 429 responses now include the `Retry-After` header
- Feature: The `JWT` Filter now makes `hasKey` and `doNotSet` functions available to header field templates; in order to facilitate only conditionally setting a header field.
- Feature: The `OAuth2` Filter now has an `expirationSafetyMargin` setting that will cause an access token to be treated as expired sooner, in order to have a safety margin of time to send it to the upstream Resource Server that grants insufficient leeway.
- Feature: The `JWT` Filter now has `leewayFor{ExpiresAt,IssuedAt,NotBefore}` settings for configuring leeway when validating the timestamps of a token.
- Feature: The environment variables `REDIS{,_PERSECOND}_{USERNAME,PASSWORD,TLS_ENABLED,TLS_INSECURE}` may now be used to further configure how the Ambassador Edge Stack communicates with Redis.
- Bugfix: Don't start the dev portal running if `POLL_EVERY_SECS` is 0
- Bugfix: Now no longer needs cluster-wide RBAC when running with `AMBASSADOR_SINGLE_NAMESPACE`.
- Bugfix: The `OAuth2` Filter now validates the reported-to-Client scope of an Access Token even if a separate `accessTokenJWTFilter` is configured.
- Bugfix: The `OAuth2` Filter now sends the user back to the identity provider to upgrade the scope if they request an endpoint that requires broader scope than initially requested; instead of erroring.
- Bugfix: The `OAuth2` Filter will no longer send RFC 7235 challenges back to the user agent if it would not accept RFC 7235 credentials (previously it only avoided sending HTTP 401 challenges, but still sent 400 or 403 challenges).
- Bugfix: The `amb-sidecar` (port 8500) component now binds to localhost instead of 0.0.0.0, so it is no longer erroneously available from outside the Pod

Ambassador 1.4.3: tag_name: v1.4.3
body: ## :tada: Ambassador 1.4.3 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador Edge Stack Only

- Bugfix: Don't generate spurious 403s in logs when using Edge Policy Console.
Ambassador 1.4.2: tag_name: v1.4.2
body: ## :tada: Ambassador 1.4.2 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador Edge Stack Only

- Bugfix: The Traffic Agent binds to port 9900 by default. That port can be configured in the Agent's Pod spec.
   - For more about using the Traffic Agent, see the [Service Preview documentation](https://www.getambassador.io/docs/latest/topics/using/edgectl/#configuring-service-preview).
- Bugfix: The `OAuth2` Filter redirection-endpoint now handles various XSRF errors more consistently (the way we meant it to in 1.2.1)
- Bugfix: The `OAuth2` Filter now supports multiple authentication domains that share the same credentials.   
   - For more about using multiple domains, see the [OAuth2 `Filter` documentation](https://www.getambassador.io/docs/1.4/topics/using/filters/oauth2/).
- Bugfix: The ACME client now obeys `AMBASSADOR_ID`

Ambassador 1.4.1: tag_name: v1.4.1
body: ## :tada: Ambassador 1.4.1 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador Edge Stack Only

- Internal: `edgectl install` uses Helm under the hood 

Ambassador 1.4.0: tag_name: v1.4.0
body: ## :tada: Ambassador 1.4.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador API Gateway + Ambassador Edge Stack

- Feature: Support Ingress Path types improvements from networking.k8s.io/v1beta1 on Kubernetes 1.18+
- Feature: Support Ingress hostname wildcards
- Feature: Support for the IngressClass Resource, added to networking.k8s.io/v1beta1 on Kubernetes 1.18+
   - For more about new Ingress support, see the [Ingress Controller documentation](https://getambassador.io/docs/1.4/topics/running/ingress-controller).
- Feature: `Mapping`s support the `cluster_tag` attribute to control the name of the generated Envoy cluster (thanks, [Stefan Sedich](https://github.com/stefansedich)!)
   - See the [Advanced Mapping Configuration documentation](https://getambassador.io/docs/1.4/topics/using/mappings) for more.
- Feature: Support Envoy's ability to force response headers to canonical HTTP case (thanks, [Puneet Loya](https://github.com/puneetloya)!)
   - See the [Ambassador Module documentation](https://getambassador.io/docs/1.4/topics/running/ambassador) for more.
- Bugfix: Correctly ignore Kubernetes services with no metadata (thanks, [Fabrice](https://github.com/jfrabaute)!)

### Ambassador Edge Stack Only

- Feature: `edgectl install` output has clearer formatting
- Feature: `edgectl install` offers help when installation does not succeed
- Feature: `edgectl install` uploads installer and AES logs to a private area upon failure so Datawire support can help
- Bugfix: The "Filters" tab in the webui no longer renders the value of OAuth client secrets that are stored in Kubernetes secrets.
- Bugfix: The ACME client of of one Ambassador install will no longer interfere with the ACME client of another Ambassador install in the same namespace with a different AMBASSADOR_ID.
- Bugfix: `edgectl intercept` supports matching headers values against regular expressions once more
- Bugfix: `edgectl install` correctly handles more local and cluster environments
   - For more about `edgectl` improvements, see the [Service Preview and Edge Control documentation](https://getambassador.io/docs/1.4/topics/using/edgectl).

Ambassador 1.3.2: tag_name: v1.3.2
body: ## :tada: Ambassador 1.3.2 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador Edge Stack

- Bugfix: `edgectl install` correctly installs on Amazon EKS and other clusters that provide load balancers with fixed DNS names
- Bugfix: `edgectl install` when using Helm once again works as documented
- Bugfix: `edgectl install` console logs are improved and neatened
- Bugfix: `edgectl install --verbose` output is improved
- Bugfix: `edgectl install` automatically opens documentation pages for some errors
- Bugfix: `edgectl install` help text is improved

Ambassador 1.3.1: tag_name: v1.3.1
body: ## :tada: Ambassador 1.3.1 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador Edge Stack

- Bugfix: `edgectl install` will not install on top of a running Ambassador
- Bugfix: `edgectl install` can detect and report if `kubectl` is missing
- Bugfix: `edgectl install` can detect and report if it cannot talk to a Kubernetes cluster
- Bugfix: When using the `Authorization Code` grant type for `OAuth2`, expired tokens are correctly handled so that the user will be prompted to renew
- Bugfix: When using the `Password` grant type for `OAuth2`, authentication sessions are properly associated with each user
- Bugfix: When using the `Password` grant type for `OAuth2`, you can set up multiple `Filter`s to allow requesting different scopes for different endpoints

Ambassador 1.3.0: tag_name: v1.3.0
body: ## :tada: Ambassador 1.3.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador Edge Stack

- Feature: Support username and password as headers for OAuth2 authentication (`grantType: Password`)
- Feature: `edgectl install` provides better feedback for clusters that are unreachable from the public Internet
- Feature: `edgectl install` supports KIND clusters (thanks, [@factorypreset](https://github.com/factorypreset)!)
- Feature: `edgectl intercept` supports HTTPS
- Feature: Ambassador Edge Stack Docker image is ~150MB smaller
- Feature: The Edge Policy Console can be fully disabled with the `diagnostics.enable` element in the `ambassador` Module
- Feature: `aes-plugin-runner` now allows passing in `docker run` flags after the main argument list.
- Bugfix: Ambassador Edge Stack doesn't crash if the Developer Portal content URL is not accessible
- Bugfix: `edgectl connect` does a better job handling clusters with many services
- Bugfix: The `Plugin` Filter now correctly sets `request.TLS` to nil/non-nil based on if the original request was encrypted or not.
- Change: There is no longer a separate traffic-proxy image; that functionality is now part of the main AES image. Set `command: ["traffic-manager"]` to use it.

Ambassador 1.2.2: tag_name: v1.2.2
body: ## :tada: Ambassador 1.2.2 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador API Gateway + Ambassador Edge Stack

- Bugfix: re-support PROXY protocol when terminating TLS ([#2348])
- Bugfix: Incorporate the Envoy 1.12.3 security update
- Internal: Fix an error in Edge Stack update checks

### Ambassador Edge Stack only

- Bugfix: The `aes-plugin-runner` binary for GNU/Linux is now statically linked (instead of being linked against musl libc), so it should now work on either musl libc or GNU libc systems
- Bugfix: The `OAuth2` Filter redirection-endpoint now handles various XSRF errors more consistently
- Change: The `OAuth2` Filter redirection-endpoint now handles XSRF errors by redirecting back to the identity provider

(1.2.1 is superseded by 1.2.2.)

[#2348]: https://github.com/datawire/ambassador/issues/2348

Ambassador 1.2.0: tag_name: v1.2.0
body: ## :tada: Ambassador 1.2.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador API Gateway + Ambassador Edge Stack

- Feature: add `idle_timeout_ms` support for common HTTP listener (thanks, [Jordan Neufeld](https://github.com/neufeldtech)!) ([#2155])
- Feature: allow override of bind addresses, including for IPv6! (thanks to [Josue Diaz](https://github.com/josuesdiaz)!) ([#2293])
- Bugfix: Support Istio mTLS secrets natively (thanks, [Phil Peble](https://github.com/ppeble)!) ([#1475])
- Bugfix: TLS custom secret with period in name doesn't work (thanks, [Phil Peble](https://github.com/ppeble)!) ([#1255])
- Bugfix: Honor `ingress.class` when running with Knative
- Internal: Fix CRD-versioning issue in CI tests (thanks, [Ricky Taylor](https://github.com/ricky26)!)
- Bugfix: Stop using deprecated Envoy configuration elements

### Ambassador Edge Stack only

- Feature: `edgectl install` provides a much cleaner, quicker experience when installing Ambassador Edge Stack
- Feature: Ambassador Edge Stack supports the Ambassador operator for automated management and upgrade
- Feature: `ifRequestHeader` can now have `valueRegex` instead of `value`
- Feature: The `OAuth2` Filter now has `useSessionCookies` option to have cookies expire when the browser closes, rather than at a fixed duration
- Feature: `ifRequestHeader` now has `negate: bool` to invert the match
- Bugfix: The RBAC for `Ingress` now supports the `networking.k8s.io` `apiGroup`
- Bugfix: Quiet Dev Portal debug logs
- Change: The intercept agent is now incorporated into the `aes` image
- Change: The `OAuth2` Filter no longer sets cookies when `insteadOfRedirect` triggers
- Change: The `OAuth2` Filter more frequently adjusts the cookies

[#1475]: https://github.com/datawire/ambassador/issues/1475
[#1255]: https://github.com/datawire/ambassador/issues/1255
[#2155]: https://github.com/datawire/ambassador/issues/2155
[#2293]: https://github.com/datawire/ambassador/issues/2293
Ambassador 1.1.1: tag_name: v1.1.1
body: ## :tada: Ambassador 1.1.1 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador API Gateway + Ambassador Edge Stack

- Bugfix: Load explicitly referenced secrets in another namespace, even when `AMBASSADOR_SINGLE_NAMESPACE` (thanks, [Thibault Cohen](https://github.com/titilambert)!) ([#2202])
- Bugfix: Fix Host support for choosing cleartext or TLS ([#2279])
- Bugfix: Fix intermittent error when rendering `/ambassador/v0/diag/`
- Internal: Various CLI tooling improvements

[#2202]: https://github.com/datawire/ambassador/issues/2202
[#2279]: https://github.com/datawire/ambassador/pull/2279

### Ambassador Edge Stack only

- Feature: The Policy Console can now set the log level to "trace" (in addition to "info" or "debug")
- Bugfix: Don't have the Policy Console poll for snapshots when logged out
- Bugfix: Do a better job of noticing when the license key changes
- Bugfix: `aes-plugin-runner --version` now works properly
- Bugfix: Only serve the custom CONGRATULATIONS! 404 page on `/`
- Change: The `OAuth2` Filter `stateTTL` setting is now ignored; the lifetime of state-tokens is now managed automatically

Ambassador 1.1.0: tag_name: v1.1.0
body: ## :tada: Ambassador 1.1.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

(Note that Ambassador 1.1.0 is identical to Ambassador 1.1.0-rc.0, from January 24, 2020.
 Also, we're now using "-rc.N" rather than just "-rcN", for better compliance with
 [SemVer](https://www.semver.org/).

### Ambassador API Gateway + Ambassador Edge Stack

- Feature: support resources with the same name but in different namespaces ([#2226], [#2198])
- Feature: support DNS overrides in `edgectl`
- Bugfix: Reduce log noise about "kubestatus" updates
- Bugfix: manage the diagnostics snapshot cache more aggressively to reduce memory footprint
- Bugfix: re-enable Docker demo mode (and improve the test to make sure we don't break it again!) ([#2227])
- Bugfix: correct potential issue with building edgectl on Windows
- Internal: fix an error with an undefined Python type in the TLS test (thanks, [Christian Clauss](https://github.com/cclauss)!)

### Ambassador Edge Stack only

- Feature: make the `External` filter type fully compatible with the `AuthService` type
- Docs: add instructions for what to do after downloading `edgectl`
- Bugfix: make it much faster to apply the Edge Stack License
- Bugfix: make sure the ACME terms-of-service link is always shown
- Bugfix: make the Edge Policy Console more performant

[#2198]: https://github.com/datawire/ambassador/issues/2198
[#2226]: https://github.com/datawire/ambassador/issues/2226
[#2227]: https://github.com/datawire/ambassador/issues/2227

Ambassador 1.1.0-rc.0: tag_name: v1.1.0-rc.0
body: ## :tada: Ambassador 1.1.0-rc.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

Note that we're now using "-rc.N" rather than just "-rcN", for better compliance with
[SemVer](https://www.semver.org/).

### Ambassador API Gateway + Ambassador Edge Stack

- Feature: support resources with the same name but in different namespaces ([#2226], [#2198])
- Feature: support DNS overrides in `edgectl`
- Bugfix: Reduce log noise about "kubestatus" updates
- Bugfix: manage the diagnostics snapshot cache more aggressively to reduce memory footprint
- Bugfix: re-enable Docker demo mode (and improve the test to make sure we don't break it again!) ([#2227])
- Bugfix: correct potential issue with building edgectl on Windows
- Internal: fix an error with an undefined Python type in the TLS test (thanks, [Christian Clauss](https://github.com/cclauss)!)

### Ambassador Edge Stack only

- Feature: make the `External` filter type fully compatible with the `AuthService` type
- Docs: add instructions for what to do after downloading `edgectl`
- Bugfix: make it much faster to apply the Edge Stack License
- Bugfix: make sure the ACME terms-of-service link is always shown
- Bugfix: make the Edge Policy Console more performant

[#2198]: https://github.com/datawire/ambassador/issues/2198
[#2226]: https://github.com/datawire/ambassador/issues/2226
[#2227]: https://github.com/datawire/ambassador/issues/2227

Ambassador 1.0.0: tag_name: v1.0.0
body: ## :tada: Ambassador 1.0.0 :tada:

#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

- Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
- View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
- Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Caution!

All of Ambassador's CRDs have been switched to `apiVersion: getambassador.io/v2`, and **your resources may be upgraded when you apply the new CRDs**. We recommend that you follow the [migration instructions](https://getambassador.io/early-access/user-guide/upgrade-to-edge-stack/) and check your installation's behavior before upgrading your CRDs.

### Breaking changes

- When a resource specifies a service or secret name without a corresponding namespace, Ambassador will now look for the service or secret in the namespace of the resource that mentioned it. In the past, Ambassador would look in the namespace in which Ambassador was running.

### Features

- The Host CR provides an easy way to tell Ambassador about domains it should expect to handle, and how it should handle secure and insecure requests for those domains
- Redirection from HTTP to HTTPS defaults to ON when termination contexts are present
- Mapping and Host CRs, as well as Ingress resources, get Status updates to provide better feedback
- Improve performance of processing events from Kubernetes
- Automatic HTTPS should work with any ACME clients doing the http-01 challenge

### Bugfixes

- CORS now happens before rate limiting
- The reconfiguration engine is better protected from exceptions
- Don’t try to check for upgrades on every UI snapshot update
- Reduced reconfiguration churn
- Don't force SNI routes to be lower-priority than non-SNI routes
- Knative mappings fallback to the Ambassador namespace if no namespace is specified
- Fix `ambassador_id` handling for Knative resources
- Treat `ambassadorId` as a synonym for `ambassador_id` (`ambassadorId` is the Protobuf 3 canonical form of `ambassador_id`)

### Ambassador Edge Stack

- Authentication and ratelimiting are now available under a free community license
- Given a Host CR, Ambassador can manage TLS certificates using ACME (or you can manage them by hand)
- There is now an `edgectl` program that you can use for interacting with Ambassador from the command line
- There is a web user-interface for Ambassador
- BREAKING CHANGE: `APP_LOG_LEVEL` is now `AES_LOG_LEVEL`
Ambassador 1.0.0-rc6: tag_name: v1.0.0-rc6
body: ## :tada: Ambassador 1.0.0-rc6 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.
﻿
Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started
﻿
 - AES: Bugfix: Fix ACME client with multiple replicas
 - AES: Bugfix: Fix ACME client race conditions with the API server and WATT
 - AES: Bugfix: Don't crash in the ACME client if Redis is unavailable
Ambassador 1.0.0-rc4: tag_name: v1.0.0-rc4
body: ## :tada: Ambassador 1.0.0-rc4 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Change: Less verbose yet more useful Ambassador pod logs
- Bugfix: Various bugfixes for listeners and route rejection
- Bugfix: Don't append the service namespace for `localhost`
- AES: Bugfix: Fix rendering mapping labels YAML in the webui
- AES: Bugfix: Organize help output from `edgectl` so it is easier to read
- AES: Bugfix: Various bugfixes around ACME support with manually-configured TLSContexts
- AES: Change: Don't disable scout or enable extra-verbose logging when migrating from OSS
- AES: BREAKING CHANGE: `APP_LOG_LEVEL` is now `AES_LOG_LEVEL`

Ambassador 1.0.0-rc1: tag_name: v1.0.0-rc1
body: ## :tada: Ambassador 1.0.0-rc1 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- BREAKING CHANGE: Rename Host CR status field `reason` to `errorReason`
- Feature: Host CRs now default `.spec.hostname` to `.metadata.name`
- Feature: Host CRs now have a `requestPolicy` field to control redirecting from cleartext to TLS
- Feature: Redirecting from cleartext to TLS no longer interferes with ACME http-01 challenges
- Feature: Improved `edgectl` help and informational messages
- Bugfix: Host CR status is now a sub-resource
- Bugfix: Have diagd snapshot JSON not include "serialization" keys (which could potentially leak secrets)
- Bugfix: Fix `ambassador_id` handling for Knative resources
- Bugfix: Use the correct namespace for resources found via annotations
- Bugfix: Treat `ambassadorId` as a synonym for `ambassador_id` (`ambassadorId` is the Protobuf 3 canonical form of `ambassador_id`)
- Internal: Allow passing a `DOCKER_NETWORK` variable to the build-system
- Internal: Improvements to release machinery
- Internal: Fix the dev shell
- Internal: Adjust KAT tests to work with the Edge Stack


Ambassador 1.0.0-ea13: tag_name: v1.0.0-ea13
body: ## :tada: Ambassador 1.0.0-ea13 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: Knative mappings populate and fallback to the ambassador namespace if unspecified
- Internal: Knative tests for versions 0.7.1 and 0.8.0 were removed
- Internal: Knative tests for version 0.11.0 were added
- Internal: Improved performance with Edge Stack using /ambassador/v0/diag/ with an optional `patch_client` query param to send a partial representation in JSON Patch format, reducing the memory and network traffic for large deployments
- Internal: Silencing warnings from `which` in docs preflight-check

Ambassador 1.0.0-ea12: tag_name: v1.0.0-ea12
body: ## :tada: Ambassador 1.0.0-ea12 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Breaking Change

When a resource specifies a service or secret name without a corresponding namespace, Ambassador uses the namespace of the resource. In the past, Ambassador would use its own namespace.

### Bugfixes

- Add the appropriate label so Ingress works with Edge Stack
- Remove superfluous imagePullSecret
- Fix various admin UI quirks, especially in Firefox
  - Bogus warnings about duplicate resources
  - Drag-and-drop reordering of rate limit configuration
  - Missing icons

### Internal

- Drop duplicated resources earlier in the processing chain
- Streamline code generation from protobufs
- Automated broken-link checks in the documentation
Ambassador 1.0.0-ea9: tag_name: v1.0.0-ea9
body: ## :tada: Ambassador 1.0.0-ea9 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started


### Minor changes:
- Bugfix: Use proper executable name for Windows edgectl
- Bugfix: Don't force SNI routes to be lower-priority than non-SNI routes
- Bugfix: Prevent the self-signed fallback context from conflicting with a manual context

Ambassador 1.0.0-ea7: tag_name: v1.0.0-ea7
body: ## :tada: Ambassador 1.0.0-ea7 :tada:                                                                                   
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.
                                                                                                                        
Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html                                              
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md                                        
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started                     
                                                            
- Bugfix: UI buttons can hide themselves                    
- Bugfix: Developer Portal API acquisition                  
- Bugfix: Developer Portal internal routing                 
- Internal: Better JS console usage                         
- Internal: Rationalize usage reporting for Edge Stack      

Ambassador 1.0.0-ea6: tag_name: v1.0.0-ea6
body: ## :tada: Ambassador 1.0.0-ea6 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Feature: Improve performance of processing events from Kubernetes
- Feature: Automatic HTTPS should work with any ACME clients doing the HTTP-01 challenge
- Internal: General improvements to test infrasture
- Internal: Improved the release process

`ambassador-internal-access-control` `Filter` and `FilterPolicy` are now
created internally. Remove them from your cluster if upgrading from a
previous version.

Ambassador 1.0.0-ea5: tag_name: v1.0.0-ea5
body: ## :tada: Ambassador 1.0.0-ea5 :tada:                                                                                   
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.                
                                                                                                                        
Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html                                              
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md                                        
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started                     
                                                                                                                        
- Internal: Improved the reliability of CI                                                                              
- Internal: Improved the release process                                                                                

Ambassador Edge Stack 1.0.0-ea3: tag_name: v1.0.0-ea3
body: ## :tada: Ambassador 1.0.0-ea3 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Feature: initial edgectl support for Windows!
- UX: be explicit that seeing the license applied can take a few minutes
- Bugfix: don’t try to check for upgrades on every UI snapshot update
- Bugfix: don’t activate the fallback TLSContext if its secret is not available
- Bugfix: first cut at reducing reconfiguration churn

Ambassador Edge Stack 1.0.0-ea1: tag_name: v1.0.0-ea1
body: ## :tada: Ambassador 1.0.0-ea1 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Ambassador Edge Stack 1.0.0-ea1

**Ambassador Edge Stack is in EARLY ACCESS.** We strongly encourage following the [migration guide](https://getambassador.io/early-access/user-guide/upgrade-to-edge-stack/) to test your installation.

### Features

- Authentication and ratelimiting are now available under a free community license
- The Host CRD provides an easy way to tell Ambassador about domains it should expect to handle
- Given a Host CRD, Ambassador can manage TLS certificates using ACME (or you can manage them by hand)
- Redirection from HTTP to HTTPS defaults to ON when termination contexts are present
- Mapping and Host CRDs, as well as Ingress resources, get Status updates to provide better feedback

### Bugfixes

- CVE-2019–18801, CVE-2019–18802, and CVE-2019–18836 are fixed by including Envoy 1.12.2
- CORS now happens before rate limiting
- The reconfiguration engine is better protected from exceptions


Ambassador 0.86.0: tag_name: v0.86.0
body: ## :tada: Ambassador 0.86.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Envoy updated to 1.12.2 for security fixes
- Envoy TCP keepalives are now supported (thanks, [Bartek Kowalczyk](https://github.com/KowalczykBartek)!)
- Envoy remote access logs are now supported
Ambassador 0.84.1: tag_name: v0.84.1
body: ## :tada: Ambassador 0.84.1 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Major changes:
- Bugfix: Fix /ambassador permissions to allow running as non-root - Thanks @dmayle for reporting the bug.

v0.84.1-rc1: tag_name: v0.84.1-rc1
Ambassador 0.84.0: tag_name: v0.84.0
body: ## :tada: Ambassador 0.84.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Features:

- Support setting window_bits for the GZip filter (thanks to [Florent Delannoy](https://github.com/Pluies)!)
- Correctly support tuning the regex_max_size, and bump its default to 200 (thanks to [Paul Salaberria](https://github.com/psalaberria002)!)
- Support setting redirect_cleartext_from in a TLSContext

### Bugfixes:

- Correctly update loadbalancer status of Ingress resources
- Don't enable diagd debugging in the test suite unless explicitly requested (thanks to [Jonathan Suever](https://github.com/suever)!)
- Switch to an Envoy release build

### Developer Notes:

- Many many things about the build system have changed under the hood!
   - Start with `make help`, and
   - Join our [Slack channel](https://d6e.co/slack) for more help!
Ambassador 0.83.0: tag_name: v0.83.0
body: ## :tada: Ambassador 0.83.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Major changes:
- Update Ambassador to address CVE-2019-15225 and CVE-2019-15226.
Ambassador 0.82.0: tag_name: v0.82.0
body: ## :tada: Ambassador 0.82.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Major changes:
- Feature: Arrange for the Prometheus metrics endpoint to also return associated headers (thanks, [Jennifer Wu](https://github.com/jhsiaomei)!)
- Feature: Support setting a TLS origination context when doing TLS to a RateLimitService (thanks, [Phil Peble](https://github.com/ppeble)!)
- Feature: Allow configuring Envoy's access log path (thanks, [Jonathan Suever](https://github.com/suever)!)
- Update: Switch to Python 3.7 and Alpine 3.10

### Developer notes:
- Switch back to the latest mypy (currently 0.730)
- Environment variable KAT_IMAGE_PULL_POLICY can override the imagePullPolicy when running KAT tests
- Updated Generated Envoy Golang APIs
Ambassador 0.81.0: tag_name: v0.81.0
body: ## :tada: Ambassador 0.81.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Major changes:
- Feature: ${} environment variable interpolation is supported in all Ambassador configuration resources (thanks, [Stefan Sedich](https://github.com/stefansedich)!)
- Feature: DataDog APM tracing is now supported (thanks again, [Stefan Sedich](https://github.com/stefansedich)!)
- Bugfix: Fix an error in the TLSContext schema (thanks, [@georgekaz](https://github.com/georgekaz)!)

### Developer notes:
- Test services can now be built, deployed, and tested more easily (see BUILDING.md)
- `mypy` is temporarily pinned to version 0.720.
Ambassador 0.80.0: tag_name: v0.80.0
body: ## :tada: Ambassador 0.80.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Major changes:
- Feature: Basic support for the Kubernetes Ingress resource
- Feature: Basic reporting for some common configuration errors (lack of Mappings, lack of TLS contexts)
- Bugfix: Update Envoy to prevent crashing when updating AuthService under load

### Developer notes
- Golang components now use Go 1.13
- Ambassador build now _requires_ clean type hinting
- KAT client and server have been pulled back into the Ambassador repo
Ambassador v0.78.0: tag_name: v0.78.0
body: ## :tada: Ambassador v0.78.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Major changes:
- Feature: Support setting cipher_suites and ecdh_curves in TLSContext - #1782 (Thanks @teejaded)
- Feature: Make 128-bits traceids the default - #1794 (Thanks @Pluies)
- Feature: Set cap_net_bind_service to allow binding to low ports - #1720 (Thanks @swalberg)

### Minor changes:
- Testing: Add test that ambassador cli does not crash when called with --help - #1806 (Thanks @rokostik)
v0.78.0-rc2: tag_name: v0.78.0-rc2
v0.78.0-rc1: tag_name: v0.78.0-rc1
Ambassador 0.77.0: tag_name: v0.77.0
body: ## :tada: Ambassador 0.77.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- (Feature) Support the `least_request` load balancer policy (thanks, [Steve Flanders](https://github.com/flands)!)
- (Misc) Many test and release-engineering improvements under the hood
Ambassador 0.76.0: tag_name: 0.76.0
body: ## :tada: Ambassador 0.76.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- circuit breakers now properly handle overriding a global circuit breaker within a Mapping ([#1767])
- support for Knative 0.8.0 ([#1732])

[#1767]: https://github.com/datawire/ambassador/issues/1767
[#1732]: https://github.com/datawire/ambassador/issues/1732
Ambassador 0.74.1: tag_name: 0.74.1
body: ## :tada: Ambassador 0.74.1 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- (bugfix) Make sure that updates properly trigger reconfigures ([#1727])
- (misc) Arrange for startup logging to have timestamps
Ambassador 0.74.0: tag_name: 0.74.0
body: ## :tada: Ambassador 0.74.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Bugfix: Make sure that the pod dies if Envoy dies
- Bugfix: Correctly allow setting `timeout_ms` for `AuthService` (thanks, [John Esmet!](https://www.github.com/esmet)!)
- Feature: Permit configuring `cluster_idle_timeout_ms` for upstream services (thanks, [John Esmet!](https://www.github.com/esmet)!) ([#1542])

[#1542]: https://github.com/datawire/ambassador/issues/1542

Ambassador 0.73.0: tag_name: 0.73.0
body: ## :tada: Ambassador 0.73.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Feature: Experimental native support for Knative! ([#1579])
- Feature: Better Linkerd interoperability! ([#1578], [#1594])

- Feature: Add a legend for the colors of service names on the diagnostic overview (thanks, [Wyatt Pearsall](https://github.com/wpears)!)
- Feature: Allow switching Envoy to output JSON logs (thanks, [Pedro Tavares](https://github.com/ServerlessP)!)
- Feature: Allow setting `AMBASSADOR_LABEL_SELECTOR` and `AMBASSADOR_FIELD_SELECTOR` to let Ambassador use Kubernetes selectors to determine which things to read (thanks, [John Esmet](https://github.com/esmet)!) ([#1292])
- Feature: Allow configuring retries for `AuthService` (thanks, [Kevin Dagostino](https://github.com/TonkWorks)!) ([#1622], [#1461])

- Bugfix: Allow Ambassador to ride through Envoy-validation timeouts (thanks, [John Morrisey](https://github.com/jwm)!)
- Bugfix: Allow Ambassador to ride through parse errors on input resources (thanks, [Andrei Predoiu](https://github.com/Andrei-Predoiu)!) ([#1625])
- Bugfix: Allow '.' in a `secret` name to just be a '.' ([#1255])

- Bugfix: Allow manually defining an Ambassador `Service` resource, same as any other resource
- Bugfix: Prevent spurious duplicate-resource errors when loading config from the filesystem

[#1255]: https://github.com/datawire/ambassador/issues/1255
[#1292]: https://github.com/datawire/ambassador/issuse/1292
[#1461]: https://github.com/datawire/ambassador/issues/1461
[#1578]: https://github.com/datawire/ambassador/issuse/1578
[#1579]: https://github.com/datawire/ambassador/issuse/1579
[#1594]: https://github.com/datawire/ambassador/issuse/1594
[#1622]: https://github.com/datawire/ambassador/issues/1622
[#1625]: https://github.com/datawire/ambassador/issues/1625
Ambassador 0.72.0: tag_name: 0.72.0
body: ## :tada: Ambassador 0.72.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

Envoy: Update Envoy to commit 8f57f7d765
Bugfix: Auth spans are now properly connected to requests ([#1414])
Bugfix: `include_body` now works correctly ([#1531], [#1595])
Bugfix: `x_forwarded_proto_redirect` works again (thanks to [Kyle Martin](https://github.com/KyleMartin901)!) ([#1571])
Bugfix: Ambassador works correctly with read-only filesystems (thanks, [Niko Kurtti](https://github.com/n1koo)!) ([#1614], [#1619])
Bugfix: Correctly render groups associated with a given resolver in diagnostics JSON output
Feature: Give the Ambassador CLI a way to specify the directory into which to write secrets.

[#1414]: https://github.com/datawire/ambassador/issues/1414
[#1531]: https://github.com/datawire/ambassador/issues/1531
[#1571]: https://github.com/datawire/ambassador/issues/1571
[#1595]: https://github.com/datawire/ambassador/issues/1595
[#1614]: https://github.com/datawire/ambassador/issues/1614
[#1619]: https://github.com/datawire/ambassador/issues/1619
Ambassador 0.71.0: tag_name: 0.71.0
body: ## :tada: Ambassador 0.71.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Feature: GZIP support [#744]
- Feature: diag UI shows active Resolvers [#1453]
- Feature: CRDs exist for Resolvers [#1563]
- Feature: Resolvers with custom names work, even as CRDs [#1497]
- Bugfix: redirect_cleartext_from no longer strips the URL path [#1463]
- Bugfix: canary weights of 0 and 100 work correctly [#1379]
- Bugfix: `docker run` works again for the Ambassador demo, and is part of our tests now [#1569]
- Bugfix: Scout `DEBUG` messages don’t get leaked into the diag UI [#1573]
- Maintenance: warn of upcoming protocol version changes
- Maintenance: check in with Scout every 24 hours, but no more than twice per day

[#744]: https://github.com/datawire/ambassador/issues/744
[#1379]: https://github.com/datawire/ambassador/issues/1379
[#1453]: https://github.com/datawire/ambassador/issues/1453
[#1463]: https://github.com/datawire/ambassador/issues/1463
[#1497]: https://github.com/datawire/ambassador/issues/1497
[#1563]: https://github.com/datawire/ambassador/issues/1563
[#1569]: https://github.com/datawire/ambassador/issues/1569
[#1573]: https://github.com/datawire/ambassador/issues/1573
Ambassador 0.70.1 release: tag_name: 0.70.1
body: ## :tada: Ambassador 0.70.1 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Changes since 0.70.0
- Bugfix: Disable CRD support if Ambassador cannot access them
- Upgrade: Upgrade to watt 0.5.1
Ambassador 0.61.0: tag_name: 0.61.0
body: ## :tada: Ambassador 0.61.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Changes since 0.60.3

- Feature: Support for minimum and maximum TLS versions (#689)
- Feature: Allow choosing whether to append or overwrite when adding request or response headers (#1481) - thanks to @ysaakpr
- Feature: Support for circuit breakers (#360)
- Feature: Support for automatic retries (#1127) - thanks to @l1v3
- Feature: Support for shadow traffic weighting - thanks to @nemo83
- Feature: Support for HTTP/1.0 (#988) - thanks to @cyrus-mc
- Bugfix: Problem with local Consul agent resolver and non-standard HTTP port (#1508)
- Bugfix: Round each mapping's weight to an integer to prevent invalid Envoy configurations when using weights (#1289) - thanks to @esmet
- Bugfix: Fix deadlock on invalid Envoy configuration (#1491) - thanks to @esmet
- Bugfix: Fixed LightStep gRPC TracingService (#1189) - thanks to @sbaum1994
0.61.0-rc3: tag_name: 0.61.0-rc3
0.61.0-rc2: tag_name: 0.61.0-rc2
0.61.0-rc1: tag_name: 0.61.0-rc1
Ambassador 0.60.3: tag_name: 0.60.3
body: ## :tada: Ambassador 0.60.3 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Changes since 0.60.2

- When scanning its configuration for secrets and endpoints that must be watched, 0.60.2 could fail with certain configurations if TLS termination but not origination was active. Those failures are fixed now.
Ambassador 0.60.2: tag_name: 0.60.2
body: ## :tada: Ambassador 0.60.2 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Ambassador is now much more careful about which endpoints and secrets it pays attention to. ([#1465] again -- thanks to [@flands](https://github.com/flands) and @seandon for the help here!)

[#1465]: https://github.com/datawire/ambassador/issues/1465
Ambassador 0.60.1: tag_name: 0.60.1
body: ## :tada: Ambassador 0.60.1 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

- Speed up initial parsing of WATT snapshots considerably ([#1465])
- Don't look at secrets in the kube-system namespace, or for service-account tokens.
- Make sure that secrets we do look at are correctly associated with their namespaces ([#1467] -- thanks to @flands and @derrickburns for their contributions here!)
- Allow tuning the number of input snapshots retained for debugging
- Include the grab-snapshots.py script to help with debuggability

[#1465]: https://github.com/datawire/ambassador/issues/1465
[#1467]: https://github.com/datawire/ambassador/issues/1467
Ambassador 0.40.0: tag_name: 0.40.0
body: ## :tada: Ambassador 0.40.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

Ambassador 0.39.0: tag_name: 0.39.0
body: ## :tada: Ambassador 0.39.0 :tada:
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Major Changes:

- BugFix: The StatsD container has been removed and functionality has been baked into Ambassador container image which can enabled by setting the `STATSD_ENABLED` environment variable to `true` in Ambassador's Kubernetes deployment configuration.
- Feature: Diagnostic view now displays AuthService, RateLimitService, and TracingService. - @alexgervais
- Docs: Added detailed Ambassador + Istio integration documentation. - @feitnomore

### Minor Changes:

- Docs: Added instructions for running Ambassador with Docker Compose. - @bcatcho
- BugFix: Ambassador now reconnects to Kubernetes when the watch loop throws an exception. - @nmatsui 
- Feature: Enable Ambassador to tag tracing spans with request headers. - @alexgervais

0.39.0-rc4: tag_name: 0.39.0-rc4
0.39.0-rc0: tag_name: 0.39.0-rc0
Ambassador 0.38.0: tag_name: 0.38.0
body: ## :tada: Ambassador 0.38.0 :tada:                          
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.                             
                                                                                                                                     
Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html                                                                    
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md                                                       
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started                                                 
                                                                                                                                     
### Major changes:                                                                                                                   
- Feature: Default CORS configuration can now be set - @KowalczykBartek                                                                       
- BugFix: Ambassador does not crash with empty YAML config anymore - @rohan47                                                          
                                                                   
### Minor changes:                         
- DevEx: `master` is now latest, `stable` tracks the latest released version
- DevEx: release-prep target added to Makefile to facilitate releasing process      
- DevEx: all tests now run in parallel, consuming lesser time
- BugFix: Ambassador SIGCHLD messages are less scary looking now
0.38.0-rc0: tag_name: 0.38.0-rc0
Ambassador 0.37.0: tag_name: 0.37.0
body: ## :tada: Ambassador 0.37.0 :tada: 
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Major changes:
- Feature: Added support for request tracing (by @alexgervais)
0.37.0-rc4: tag_name: 0.37.0-rc4
Ambassador 0.36.0: tag_name: 0.36.0
body: ## :tada: Ambassador 0.36.0 :tada: 
#### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Major changes:
- Fix: HEAD requests no longer cause segfaults
- Feature: TLS can now be configured with arbitrary secret names, instead of predefined secrets
- Change: The Envoy dynamic header value `%CLIENT_IP%` is no longer supported. Use`%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%` instead. (This is due to a change in Envoy 1.7.0.)
0.36.0-rc1: tag_name: 0.36.0-rc1
0.36.0-rc0: tag_name: 0.36.0-rc0
Ambassador 0.35.3: tag_name: 0.35.3
body: ### Ambassador is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Ambassador - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/datawire/ambassador/blob/master/CHANGELOG.md
Get started with Ambassador on Kubernetes - https://www.getambassador.io/user-guide/getting-started

### Major changes:
- Ambassador is now based on Envoy v1.7.0
- Support for X-FORWARDED-PROTO based redirection, used with Layer 7 load balancers
- Support for port based redirection using `redirect_cleartext_from`
- Support in Helm chart for HTTP and HTTPS target ports

### Other changes:
- End-to-end tests can now be run with `make e2e` command
- Helm release automation has been fixed
- Mutliple end-to-end tests are now executed in parallel, taking lesser time
- Huge revamp to documentation around unit tests
- Documentation changes
Third release candidate for 0.35.3: tag_name: 0.35.3-rc2
Second release candidate for 0.35.3: tag_name: 0.35.3-rc1