Project: 3Scale (Orchestration & Management / API Gateway)
File: CHANGELOG.md

All notable changes to this project will be documented in this file. The format is based on and this project adheres to . Fixed 3scale Batcher policy unable to handle `appid`/`accesstoken` contains special characters Bump openresty to 1.21.4.3 Fix GRPC on HTTP2 POST method Fixed CVE-2023-44487 (HTTP/2 Rapid Reset) Fixed issue where the proxy policy could not handle requests with "Transfer-Encoding: chunked" header Fixed custom-config.t conversion to APIcast::Blackbox Fixed resty-ctx.t conversion to APIcast::Blackbox Fixed backend-cache-handler.t conversion to APIcast::Blackbox Fixed apicast-mapping-rules.t conversion to APIcast::Blackbox gateway/src/apicast/http_proxy.lua: remove unused code Fixed token instrospection field removed Fixed issue with URL was not correctly escaped when using the JWT claim check policy Fix upstream default port when HTTP_PROXY Docker compose up instead of docker compose run Fix integration of upstream connection policy with camel policy Upgrade lua-resty-http to 0.17.1 to fix 100 response header are not handled when using `HTTPS_PROXY` Replace luafilesystem-ffi with Fix "Upstream cannot be null" error in APIcast logs Fixed 3scale Batcher policy unable to handle base64 encoded `user_key` Update luacheck settings and fix issues reported Disable \_G write guard warning Detect number of CPU shares when running on Cgroups V2 Add support to use Basic Authentication with the forward proxy. Added request unbuffered policy Dev environment: keycloak Dev environment: Camel proxy Bump penlight to 1.31.1 Added `APICASTCLIENTREQUESTHEADERBUFFERS` variable to allow configure of the NGINX `clientrequestheader_buffers` directive: , Added the `APICASTPOLICYBATCHERSHAREDMEMORY_SIZE` variable to allow configuration of the batcher policy's share memory size. , In boot mode on `init_worker` check configuration expiration Removes the warning message at the bootstrap Set NGiNX variable variableshashmax_size to 2048 to avoid startup warning Dev environment on aarch64 host Doc: Policy Development Tutorial Opentelemetry support. Opentracing is now deprecated `/admin/api/account/proxy_configs` endpoint for configuration loading Pagination of services and proxy config endpoints Upstream TLS v1.3 Updated policy list for v3.13.2 Updated policy list for v3.14.0 `APICASTLOADSERVICESWHENNEEDED` is dropped and the configuration is fetched "when needed" by default Fixed: OIDC jwt key verification Fixed NGINX filters policy error Fix to avoid uninitialized variables when request URI is too large Fixed issue where request path is stripped for proxied https requests Bumped liquid-lua to version 0.2.0-2 - includes: and Fixed: APIcast could not retrieve the latest version of the proxy config Fixed: JWKs without alg field cause the JWT validation process to fail Updated policy list Fixed: OIDC jwt key verification Fixed warning messages Fixed dirty context Fixed jwk alg confusion Fixed issue with resolving target server hostnames to IP when using CONNECT method Fixed issue with resolving target server hostnames to IPs when forwarding requests through http/s proxy Fixed dirty context Fixed dirty context (part 2 of

#1328) when tls termination policy is in the policy chain Fixed hostname_rewrite incompatibility with Routing Policy Fixed issues with URI when using Routing Policy Fixed typo on TLS jsonschema Fixed host header format on http_ng resty Fixed issues on OIDC jwk discovery Fixed Payload limit content-length response header Fixed IPcheck policy issues with invalid IP Disabled content-caching globally if no policy at all Fixed warning messages Fixed lua socket error on ssl_certificate Fixed Acess log header Fixed Payload limit jsonschema Fixed Status code overwrite policy jsonschema Fixed TLS host validation Fixed Status code overwrite policy jsonschema Fixed URL encoding on set-path Fixed trailing slash on routing policy Fixed race condition on caching mode Fixed Nginx filter issues on jsonschema Fixed issues with OIDC filters Fixed issues with OIDC filters Fixed issues with Upstream MTLS certs Fixed warning messages Fixed dirty context Fixed jwk alg confusion Fixed issue with resolving target server hostnames to IP when using CONNECT method Fixed issue with resolving target server hostnames to IPs when forwarding requests through http/s proxy Fixed dirty context Fixed dirty context (part 2 of PR #1328) when tls termination policy is in the policy chain Fixed NGINX filters policy error Fix to avoid uninitialized variables when request URI is too large Fixed issue where request path is stripped for proxied https requests Bumped liquid-lua to version 0.2.0-2 - includes: and New /admin/api/account/proxy_configs endpoint for configuration loading Added conditions in maintenance mode policy including upstream in the liquid context + the upstream updated by Upstream policy is now shared in context.route_upstream Add methods to transformations in rewrite url captures policy Add Access-Control-Max-Age Add HTTP codes policy Buffer access log on chunks Added sendfilemaxchunk to the worker Increased api-keys shared memory size Add support to multiple Origin based on regexp Bump Openresty version to 1.19.3 Change how ngx.encode_args is made on usage Upstream pool key when is using HTTPs connection Fix a warning message on invalid upstream Upstream MTLS server verify Add Nginx filter policy Added on_failed policy Master branch containers builds are now latest tag on quay.io Beta1 is stable and moved to final release. Fixed issues with OIDC validation Fixed issues with Liquid body size Non-alphanumeric metric name in 3scale-batcher policy Fixed issues when using fully qualified DNS query Support Proxy Protocol Enable support to log credentials on logging policy Add a way to support more than 1000 services in a single instance Added new originalrequesturi tag on Opentracing Caching policy disable default field Add response/request content size limits Add HTTP codes policy Fixed issues with allow caching mode and 3scale batcher Fixed issues when Auth Caching is disabled Fixed issues with service filter and OIDC Increased size of dictionaries used by the Batching policy to 20 MB. Users with many services might have experienced issues with this policy because the size of those dictionaries was not enough to store everything the policy needs to function correctly. Fixed issue with Camel service over HTTPs when Routing Policy Fixed doc issue on SERVICES_FILTER parameter Non-alphanumeric metric name in 3scale-batcher policy Fixed issues when using fully qualified DNS query Fixed issues with OIDC validation Fixed issues with Liquid body size Fixed filter services with APICASTSERVICESFILTERBYURL when using remote v2 config Added a new metric when the `worker_process` starts Fixed issues when using fully qualified DNS query No issues found on beta1,so becames final release. Fixed issues with URL encode on routing policy Fixed issue with mapping rules and 3scale batcher policy Fixed issues with invalid number of conditions Fixed issues with liquid replaces Fixed issues with HTTPS_PROXY and large bodies Fixed issues with path routing and query args Fixed issue with IPCheck policy when forwarder-for value contains port Added upstream Mutual TLS policy Added Rate-limit headers policy Added Content-caching policy Added Nginx request_id variable to context Added HTTP verb on url_rewriten Added custom_metrics policy New apicast_status Prometheus metric New content_caching Prometheus metric Added Camel policy

was considered final and became `3.8.0`. Fixed naming issues in policies Fixed issues on invalid config in logging policy Fixed issues with routing policy and GRPC one Check status is bigger than zero on caching policy Now the configuration of the issuer is cached to avoid flip-flop issues when OIDC connectivity fails. Openresty dependencies comes now from RedHat build system. Added HTTP2 support Websocket support. Added Request_id on ngx.log function. Logging policy add the option to log JWT claims When PATH routing was enabled the URL was not correctly escaped Add the correct host header when using an http proxy Normalize policy names capitalization Fix issues with non-alphanumeric variables in liquid Fix issues with double mapping rules `3.7.0-rc2` was considered final and became `3.7.0`. Fix exception if api_backend is null Fix issues when TLS is enabled in Lazy mode , Return 404 back if the upstream is not defined Added usage metrics to the Logging policy , Added `owner_id` to mapping rule and Routing policy Fix issues with escaped characters in URI Introduce possibility of specifying policy order restrictions in their schemas. APIcast now shows a warning when those restrictions are not respected , Added new parameters to logging policy to allow custom access log , , [PR #1116] (https://github.com/3scale/APIcast/pull/1116) Added httpproxy policy to use an HTTP proxy in apibacked calls. , Option to load service configurations one by one lazily , New maintenance mode policy, useful for maintenance periods. , Remove dnsmasq process for APIcast , Enable liquid operations and original request variable on routing policy Allow to use capture function in liquid templates. , OAuth 2.0 MTLS policy Add an option to enable keepalive_timeout on gateway Added a new replace path option in routing policy Fix issues when OPENTRACINGFORWARDHEADER was set , New TLS termination policy , Fix exception on rate limit policy when window was set as 0. , Fix issues with escaped characters in uri `3.6.0-rc2` was considered final and became `3.6.0`. Fix typos on JWT claim policy jsonschema , Extended variables in Liquid template operations , You can filter services by endpoint name using Regexp "Upstream Connection" policy. It allows to configure several options for the connections to the upstream , Enable APICASTEXTENDEDMETRICS environment variable to provide additional details Add the option to obtain client_id from any JWT claim Added `APICASTPATHROUTING_ONLY` variable that allows to perform path-based routing without falling back to the default host-based routing , Added the option to manage access based on method on Keycloak Policy. The Rate Limit policy now supports conditions defined with the "matches" operation. , Upgrade OpenResty to 1.15.8.1 release., Now it is possible to report status codes when using reporting threads , New Retry policy. Allows to configure retries for calls to the upstream APIs , JWT claim policy. Allows to allow/deny traffic based on JWT claim constraint , Fixed incorrect description of the `client` attribute in the Keycloak role check policy , `export()` now works correctly in policies of the local chain. It was only working in the `rewrite` phase , The caching policy now works correctly when combined with the 3scale batcher one , Fixed the name of the 3scale batching policy in the

Some logs showed "Caching policy" where it should have said "3scale Batcher" Changed the schema of the IP check policy so it renders correctly in the UI , Allow uppercase backend API in the service., Fixed lock issues on configuration loader when Lazy mode is enabled., Fixed multiple x-forwarded-for headers issue on IP Check policy., APIcast now returns "Auth failed" instead of "Limits Exceeded" for disabled metrics , Checking `aud` JWT claim for app_id when using OIDC integration , Apart from the changes mentioned in this section, this version also includes the changes introduced in `3.5.0-rc1` that were not included in `3.5.0`. Ability to configure client certificate chain depth , Segfault when normalizing some client certificates Fixed incorrect connection reuse for requests on different domains , `3.5.0-beta1` was considered final and became `3.5.0`. Notice that this version does not include the changes introduced in `3.5.0-rc1`. Do not send OpenResty version in the `Server` response header , When using OIDC, the "no-body" option is now set when contacting the 3scale backend. This option helps reducing the workload in the 3scale backend and the network traffic , Improve startup time by improving templating performance and caching filesystem access Liquid `default` filter now does not override `false` values Fix 3scale Batcher policy failing to cache and report requests containing app ID only , Auths against the 3scale backend are now retried when using the 3scale batching policy Fix timeouts when proxying POST requests to an HTTPS upstream using `HTTPS_PROXY` , The APIcast policy now ensures that its post-action phase only runs when its access phase ran. Not ensuring this was causing a bug that was triggered when combining the APIcast policy with some policies that can deny the request, such as the IP check one. In certain cases, APIcast reported to the 3scale backend in its post-action phase even when other policies denied the request with a 4xx error. "Matches" operation that can be used when defining conditionals New routing policy that selects an upstream based on the request path, a header, a query argument, or a jwt claim , , , Added "last" attribute in the mapping rules. When set to true indicates that, if the rule matches, APIcast should not try to match the rules placed after this one , Added TLS Validation policy to verify TLS Client Certificate against a whitelist. , New CLI command "push_policy" that pushes a policy schema to the 3scale admin portal , , Added support for experimental standalone YAML configuration Environment files now can use global `context` variable to share data Added service id and service name headers in debug context The modules used to build conditions have been extracted from the conditional policy so they can be used from other policies . `3.4.0-rc2` was considered final and became `3.4.0`. Fix bug in the Default credentials

It was using the default credentials in some cases where it should not , Fix "nil" being added to the end of URL Path in some cases when using http_proxy Fix `APICASTPROXYHTTPSPASSWORDFILE` and `APICASTPROXYHTTPSSESSIONREUSE` parameters for Mutual SSL The "allow" mode of the caching policy now accepts the request when it's authorization is not cached , When using SSL certs with path-based routing enabled, now APIcast falls backs to host-based routing instead of crashing , Fixed error that happened when loading certain configurations that use OIDC , The port is now included in the Host header when the request is proxied Prometheus metrics for: the 3scale batching policy, the upstream API and request response times , , , Support for path in the upstream URL OIDC Authentication policy (only usable directly by the configuration file) IP check policy. This policy allows to accept or deny requests based on the IP , , Delete operation in the headers policy , "Retry-After" header in the response when rate-limited by the 3scale backend , The `threescalebackendcalls` Prometheus metric now includes the response (used to be in `backend_response`) and also the kind of call (auth, authrep, report) , Performance improvement: replaced some varargs in hot paths `3.3.0-cr2` was considered final and became `3.3.0`. The configuration schema of the rate-limit policy has changed from `3.2.0` so if you were using it, please adapt your configuration file accordingly. The Native OAuth 2.0 flow is deprecated. Please consider using the OIDC integration instead. The new conditional policy is considered experimental. The way conditions are expressed might change in future releases. Handles properly policies that raise an error when initialized , Set default errlog level when `APICASTLOGLEVEL` is empty Correct JWT validation according to . Like not required `nbf` claim. Mismatch in OIDC issuer when loading configuration through a configuration file When the 3scale referrer filters was enabled, cached requests were not handled correctly Invalid SNI when connecting to 3scale backend over HTTPS Fix handling --pid and --signal on the CLI Some policies did not have access to the vars exposed when using Liquid (`uri`, `path`, etc.) Fix error when loading certain configurations that use OIDC Fix error that appeared when combining the liquid context debug policy with policies that contain liquid templates Thread safety issues when rendering Liquid templates Expose `http_method` in Liquid Print error message when OIDC configuration is missing for a request Print whole stderr in 4k chunks when executing external commands Capture permission errors when searching for files on filesystem OpenTracing support , Generate new policy scaffold from the CLI 3scale batcher policy , , , , , Liquid templating support in the headers policy configuration , , , Ability to modify query parameters in the URL rewriting policy , , 3scale referrer policy , , Liquid templating support in the rate-limit policy , , , Default credentials policy , Configurable caching for the token introspection policy `APICASTACCESSLOG_FILE` env to make the access log location configurable , ENV variables to make APIcast listen on HTTPS port New `ssl_certificate` phase allows policies to provide certificate to terminate HTTPS connection Configurable `auth_type` for the token introspection policy `TimerTask` module to execute recurrent tasks that can be cancelled , , `GC` module that implements a workaround to be able to define `gc` on tables Policies can define `gc` metamethod that gets called when they are garbage collected to do cleanup Keycloak Role Check policy , Conditional policy. This policy includes a condition and a policy chain, and only executes the chain when the condition is true , , Request headers are now exposed in the context available when evaluating Liquid Rewrite URL captures

This policy captures arguments in a URL and rewrites the URL using them , Support for HTTP Proxy , Conditions for the limits of the rate-limit policy `bin/apicast console` to start Lua REPL with APIcast code loaded Liquid Context Debugging policy. It's a policy only meant for debugging purposes, returns the context available when evaluating liquid Logging policy. It allows to enable/disable access logs per service , Support JWK through OIDC Discovery Initial Prometheus metrics policy (backend responses and nginx metrics) , `THREESCALEPORTALENDPOINT` and `THREESCALECONFIGFILE` are not required anymore The `scope` of the Rate Limit policy is `service` by default Decoded JWTs are now exposed in the policies context by the APIcast policy Upgraded OpenResty to 1.13.6.2, uses OpenSSL 1.1 Use forked `resty.limit.count` that uses increments instead of decrements , Rate Limit policy to take into account changes in the config The regular expression for mapping rules has been changed, so that special characters are accepted in the wildcard values for path Call `init` and `init_worker` on all available policies regardless they are used or not Cache loaded policies. Loading one policy several times will use the same instance Load all policies into cache when starting APIcast master process. `init` and `init_worker` phases are executed on the policy module, not the instance of a policy with a configuration `timer_resolution` set only in development environment The rate-limit policy, when `redis_url` is empty, now applies per-gateway limits instead of trying to use a localhost Redis Changed the display name of some policies. This only affects how the name shows in the UI Do not crash when initializing unreachable/invalid DNS resolver Reporting only 50% calls to 3scale backend when using OIDC , Building container image on OpenShift 3.9 , Rate Limit policy to define multiple limiters of the same type Fix `exclusiveMinimum` field for `conn` property in the rate-limit JSON schema Skip invalid policies in the policy chain `APICASTBACKENDCACHEHANDLER` environment variable is now deprecated. Use caching policy instead. `APICASTCUSTOMCONFIG`, `APICASTMODULE` environment variables are now deprecated. Use policies instead. , Path routing feature enabled by the `APICASTPATHROUTING` environment variable is not considered experimental anymore. Reporting only 50% calls to 3scale backend when using OIDC 3.2.0-rc2 was considered final and became 3.2.0. Default value for the `caching_type` attribute of the caching policy config schema , Fixed set of valid values for the exit param of the Echo policy The schema of the rate-limit policy has been adapted so it can be rendered by `react-jsonschema-form`, a library used in the 3scale UI. This is a breaking change. , The upstream policy now performs the rule matching in the rewrite phase. This allows combining it with the URL rewriting policy upstream policy regex will be matched against the original path if upstream policy is placed before URL rewriting in the policy chain, and against the rewritten path otherwise , Rate Limit policy Documented restrictions in the position in the chain for some policies , `export()` now works correctly in policies of the local chain caching policy now works correctly when placed after the apicast policy in the chain OpenTracing support descriptions in `oneOf`s in policy manifests have been replaced with titles `resty.balancer` doesn't fall back to the port `80` by default. If the port is missing, `apicast.balancer` sets the default port for the scheme of the `proxy_pass` URL `ljsonschema` is only used in testing but was required in production also New property `summary` in the policy manifests

Token Introspection policy New `metrics` phase that runs when prometheus is collecting metrics Validation of policy configs both in integration and unit tests Option to avoid refreshing the config when using the lazy loader with `APICASTCONFIGURATIONCACHE` < 0 Error loading policy chain configuration JSON with null value Splitted `resolv.conf` in lines,to avoid commented lines Avoid `nameserver` repetion from `RESOLVER` variable and `resolv.conf` file Bug in URL rewriting policy that ignored the `commands` attribute in the policy manifest Skip comentaries after `search` values in resolv.conf Bug that prevented using `CONFIGURATIONCACHELOADER=boot` without specifying `APICASTCONFIGURATIONCACHE` in staging , . `typ` is verified when it's present in keycloak tokens `summary` is now required in policy manifests Definition of JSON schemas for policy configurations , URL rewriting policy , Liquid template can find files in current folder too `bin/apicast` respects `APICASTOPENRESTYBINARY` and `TESTNGINXBINARY` environment Caching policy , , , New phase: `content` for generating content or getting the upstream response Upstream policy , Policy JSON manifest SOAP policy , Ability to set custom directories to load policies from CLI is running with proper log level set by `APICASTLOGLEVEL` 3scale configuration (staging/production) can be passed as `-3` or `--channel` on the CLI APIcast CLI loads environments defined by `APICAST_ENVIRONMENT` variable Endpoint in management API to retrieve all the JSON manifests of the policies Development environment (`--dev`) starts with Echo policy unless some configuration is passed Added support for passing whole configuration as Data URL More complete global environment when loading environment policies Support for Client Certificate authentication with upstream servers , Detecting local rover installation from the CLI Use more `command` instead of `which` to work in plain shell Fixed rockspec so APIcast can be installed by luarocks , Fix loading renamed APIcast code Fix `apicast` command when installed from luarocks Fix lua docs formatting in the CORS policy `postaction` phase not being called in the policychain Failing to execute `libexec/boot` on some systems Detect number of CPU cores in containers by using `nproc` Running with development config in Docker Fix setting twice the headers in a pre-flight request in the CORS policy Fix case where debug headers are returned without enabling the option Fix errors loading openresty libraries when rover is active Passthrough "invalid" headers , Fix using relative path for access and error log Consolidate apicast-0.1-0.rockspec into apicast-scm-1.rockspec Deprecated `Configuration.extractusage` in favor of `Service.getusage` Extract Test::APIcast to own package on CPAN Load policies by the APIcast loader instead of changing load path , Add `src` directory to the Lua load path when using CLI Move rejection reason parsing from CacheHandler to Proxy Propagate full package.path and cpath from the CLI to Nginx `post_action` phase now shares `ngx.ctx` with the main request Decrease nginx timer resolution to improve performance and enable PCRE JIT Moved `proxy_pass` into new internal location `@upstream` Split 3scale authorization to rewrite and access phase Extract `mapping_rule` module from the `configuration` module Renamed `apicast/policy/policy.lua` to `apicast/policy.lua` Sandbox loading policies Extracted `usage` and `mappingrulesmatcher` modules so they can be used from policies Renamed all `apicast/policy//policy.lua` to `apicast/policy//init.lua` to match Lua naming Environment configuration can now define the configuration loader or cache . APIcast starts with "boot" configuration loader by default (because production is the default environment)

Deprecated `APICASTSERVICES` in favor of `APICASTSERVICES_LIST` but provides backwards compatibility Deprecated `APICASTPATHROUTINGENABLED` in favor of `APICASTPATH_ROUTING` but provides backwards compatibility New policy chains system. This allows users to write custom policies to configure what Apicast can do on each of the Nginx phases , Resolver can resolve nginx upstreams Add `resolver` directive in the nginx configuration Calls 3scale backend with the 'no_body' option enabled. This reduces network traffic in cases where APIcast does not need to parse the response body Methods to modify policy chains Ability to load several environment configurations Ability to configure policy chain from the environment configuration Load environment variables defined in the configuration Allow configuration of the echo/management/fake backend ports Headers policy , CORS policy , Detect number of CPU shares when running on Kubernetes Namespace all APIcast code in `apicast` folder. Possible BREAKING CHANGE for some customizations. CLI ignores environment variables that are empty strings Loading installed luarocks from outside rover Support IPv6 addresses in `/etc/resolv.conf` Fix possible 100% CPU usage when starting APIcast and manipulating filesystem Experimental option for true out of band reporting (`APICASTREPORTINGWORKERS`) , `/status/info` endpoint to the Management API `/_threescale/healthz` endpoint returns a success status code, this is used for health checking in kubernetes environments Usage limit errors are now configurable to distinguish them from other authorization errors , . Templating nginx configuration with liquid. Upgraded to OpenResty 1.11.2.5-1 `/oauth/token` endpoint returns an error status code, when the access token couldn't be stored in 3scale backend ] URI params in POST requests are now taken into account when matching mapping rules Increased number of background timers and connections in the cosocket pool Make OAuth tokens TTL configurable Detect when being executed in Test::Nginx and use default backend accordingly Update the s2i-openresty image to have the same path (`/opt/app-root/src`) in all images Launcher scripts are now Perl + Lua instead of Shell Unify how to connect to 3scale backend Upgraded OpenResty to 1.13.6.1 , Request headers are not passed to the backend, preventing sending invalid Content-Type to the access token store endpoint , Live and ready endpoints now set correct Content-Type header in the response, 3.1.0-rc2 was considered final and became

Request headers are not passed to the backend, preventing sending invalid Content-Type to the access token store endpoint Support for extending APIcast location block with snippets of nginx configuration Crash on empty OIDC Issuer endpoint Handle partial credentials Crash when configuration endpoint was missing Fix double queries to not fully qualified domains Fix caching DNS queries with scope (like on OpenShift) `THREESCALEDEPLOYMENTENV` defaults to `production` OIDC is now used based on settings on the API Manager No limit on body size from the client sent to the server Print module loading errors only when it failed to load `bin/busted` rewritten to support different working directories dnsmasq started in docker will not forward queries without domain Ability to configure how to cache backend authorizations Not loading services when APICAST\_SERVICES is empty , Fixed CVE-2017-7512 APIcast module `balancer` method now accepts optional balancer Extracted lua-resty-url Extracted lua-resty-env Do not load all services when APICAST\_SERVICES is set APIcast published to Support for passing remote configuratio URL through the CLI CLI flag -b to load configuration on boot OIDC support Keycloak / RH SSO integration replaced with OIDC Bump OpenResty version to Upgraded lua-resty-http and lua-resty-jwt Experimental caching proxy to the http client Print better errors when module loading fails Support for loading configration from custom URL Turn on SSL/TLS validation by `OPENSSL_VERIFY` environment variable Load trusted CA chain certificates Support HTTP Basic authentication for client credentials when authorizing with RH-SSO Show more information about the error when the module load fails Use `RESOLVER` before falling back to `resolv.conf` Improve error logging when failing to download configuration Service hostnames are normalized to lower case Don't attempt to perform post\_action when request was handled without authentication Store authorization responses with a ttl, if sent Do not return stale service configuration when new one is available Memory leak in every request Remove unnecessary code and comments JWT expiry not taken into account in authorization response cache / / Fixed by Memory leak in round robin balancer Error when trying to determine status of failed request when downloading configuration Use per request configuration when cache is disabled Automatically expose all environment variables starting with `APICAST` or `THREESCALE` to nginx Error log to show why downloading configuration failed Backend HTTP client that uses cosockets Ability to customize main section of nginx configuration (and expose more env variables) Ability to lock service to specific configuration version Ability to use Redis DB and password via `REDIS_URL` Ability to Authenticate against API using RHSSO and OpenID Connect `http_ng` client supports auth passsed in the url, and default client options if the request options are missing for methods with body (POST, PUT, etc.) Fixed lazy configuration loader to recover from failures Fixed undefined variable `p` in post\_action Fixed caching of negative ttl by dnsmasq Removed support for sending Request logs Support for parallel DNS query JWT expiry not taken into account in authorization response cache / Reloading of configuration with every request when cache is disabled Auth caching is not used when OAuth method is used Lazy load DNS resolver to improve performance Execute queries to all defined nameservers in parallel `RESOLVER` ENV variable overrides all other nameservers detected from `/etc/resolv.conf` Use stale DNS cache when there is a query in progress for that record Bump s2i-openresty to 1.11.2.2-2 Echo API on port 8081 listens accepts any Host Always use DNS search scopes Reduce use of global objects Configuration is using LRU cache Management API not opened by default Management API returns ready status with no services Danger bot to check for consistency in Pull Requests Start local caching DNS server in