Project: Contour (Orchestration & Management / Service Proxy)
File: CHANGELOG-v1.13.0.md

We are delighted to present version 1.13.0 of Contour, our layer 7 HTTP reverse proxy for Kubernetes clusters. A big thank you to everyone who contributed to the release. Contour now provides initial support for , an open source project to evolve service networking APIs within the Kubernetes ecosystem. Gateway API consists of multiple resources that provide user interfaces to expose Kubernetes applications- Services, Ingress, and more. See the for additional details and to start using Gateway API with Contour. Related issues and PRs: #3278 #3397 #2809 #3283 Thanks to @stevesloka and @youngnick for designing and implementing this feature. There are times when distributed circuit breaking is not very effective and global rate limiting is desired. With global rate limiting, Envoy communicates with an external Rate Limit Service (RLS) over gRPC to make rate limit decisions for requests. For additional details, see the . Related issues and PRs: #3178 #3298 #3324 Thanks to @skriss for designing and implementing this feature! Known Issues: #3409 (global rate limit policies at the virtual host level for TLS vhosts do not take effect). TLS cipher suites used by Envoy listeners can now be configured. The configured cipher suites are validated against Envoy's allowed cipher list. Contour will exit on startup if any invalid cipher suites are present in the config file. If no cipher suites are provided, Contour will use the defaults that exist now. Related issues and PRs: #2880 #3292 #3304 There are situations where Envoy's "delayedclosetimeout" can close connections to a client when data remains to be written. This can happen when a client sets the "Connection: close" header and is slow to read the response. The 'delayedclosetimeout' can now be configured by users who encounter this situation. Related issues and PRs: #3285 #3316 Thanks to @xtreme-jesse-malone for implementing this feature! If a user has an external load balancer that terminates TLS, the X-Forwarded-Proto header gets overwritten unless the downstream connection is

XffNumTrustedHops can now be configured to set the number of trusted hops which will allow the headers to be intact already set from downstream. Related issues and PRs: #3294 #3293 Thanks to @stevesloka for implementing this feature! ExactBalance is a connection balancer implementation that does exact balancing. This means that a lock is held during balancing so that connection counts are nearly exactly balanced between worker threads. With long keep-alive connections, the Envoy listener will use the ExactBalance connection balancer. For additional details, see the . Related issues and PRs: #3314 Thanks to @iyacontrol for implementing this feature! SNI will be set on any TCPProxy.Service which references an externalName type service as well as having the upstream protocol of "tls". Related issues and PRs: #3291 Thanks to @stevesloka for implementing this feature! Adds support for %CONTOURNAMESPACE%, %CONTOURSERVICENAME% and %CONTOURSERVICEPORT% dynamic variables. These variables will be expanded like the Envoy dynamic variables in #3234. Note: The CONTOUR prefix is used to prevent the clashing with a future Envoy dynamic variable. Variables that can't be expanded are passed through literally. Related issues and PRs: #3269 Thanks to @erwbgy for implementing this feature! The deprecated `FileAccessLog.jsonformat` access logging format field is replaced by `envoy.extensions.accessloggers.file.v3.FileAccessLog.log_format`. See #3210 for additional details. The deprecated cluster `Http2ProtocolOptions` field is replaced with `TypedExtensionProtocolOptions`. See #3308 for additional details. Insecure AES128/256 ciphers are disabled by default. See #3304 for additional details. The following Prometheus Gauges have been renamed to make the metric names follow promlint conventions. We encourage operators to have dashboard and alert queries refer to the new names. The old metrics will be removed completely in the next release: ``` contourhttpproxytotal -> contour_httpproxy contourhttpproxyinvalidtotal -> contourhttpproxy_invalid contourhttpproxyorphanedtotal -> contourhttpproxy_orphaned contourhttpproxyvalidtotal -> contourhttpproxy_valid contourhttpproxyroottotal -> contourhttpproxy_root ``` Please consult the . Were immensely grateful for all the community contributions that help make Contour even better! For version 1.13, special thanks go out to the following contributors: @xtreme-jesse-malone @abhide @seemiller If you're using Contour and want to add your organization to our adopters list, please visit this . If you prefer to keep your organization name anonymous but still give us feedback into your usage and scenarios for Contour, please post on this .