Project: Kong (Orchestration & Management / API Gateway)
File: CHANGELOG.md

:warning: Alpine packages and Docker images based on Alpine are no longer supported :warning: Cassandra as a datastore for Kong is no longer supported Ubuntu 18.04 artifacts are no longer supported as it's EOL AmazonLinux 2022 artifacts are renamed to AmazonLinux 2023 according to AWS's decision CentOS packages are now removed from the release and are no longer supported in future versions. Enable `expressions` and `traditional_compatible` router flavor in stream subsystem. Make upstream `hostheader` and router `preservehost` config work in stream tls proxy. Add beta support for WebAssembly/proxy-wasm '/schemas' endpoint returns additional information about cross-field validation as part of the schema. This should help tools that use the Admin API to perform better client-side validation. First release of the Kong Manager Open Source Edition. OpenTelemetry: Support AWS X-Ray propagation header The field `header_type`now accepts the `aws` value to handle this specific propagation header. Opentelemetry: Support the `endpoint` parameter as referenceable. Ip-Restriction: Add TCP support to the plugin. Thanks for contributing this change. In dbless mode, the declarative schema is now fully initialized at startup instead of on-demand in the request path. This is most evident in decreased response latency when updating configuration via the `/config` API endpoint. The Prometheus plugin has been optimized to reduce proxy latency impacts during scraping. Declarative config now performs proper uniqueness checks against its inputs: previously, it would silently drop entries with conflicting primary/endpoint keys, or accept conflicting unique fields silently. Fixed a bug that causes `POST /config?flatten_errors=1` to throw an exception and return a 500 error under certain circumstances. Fix a bug when worker consuming dynamic log level setting event and using a wrong reference for notice logging Added a `User=` specification to the systemd unit definition so that Kong can be controlled by systemd again. Fix a bug that caused sampling rate to be applied to individual spans producing split traces. Fix a bug that caused spans to not be instrumented with http.status_code when the request was not proxied to an upstream. Thanks for contributing this change. , Fix a bug that caused the router to fail in `traditional_compatible` mode when a route with multiple paths and no service was created. Fix an issue where the router of flavor `expressions` can not work correctly when `route.protocols` is set to `grpc` or `grpcs`. Fix an issue where the router of flavor `expressions` can not configure https redirection. Added new span attribute `net.peer.name` if balancer_data.hostname is available. Thanks for contributing this change. Make `kong vault get` CLI command work in dbless mode by injecting the necessary directives into the kong cli nginx.conf. Fix an issue where a crashing Go plugin server process would cause subsequent requests proxied through Kong to execute Go plugins with inconsistent configurations. The issue only affects scenarios where the same Go plugin is applied to different Route or Service entities. Fix an issue where clustercert or clustercacert is inserted into luassltrustedcertificate before being base64 decoded. Update the DNS client to follow configured timeouts in a more predictable manner. Also fix a corner case in its behavior that could cause it to resolve incorrectly during transient network and DNS server failures. Fix an issue where `/schemas/plugins/validate` endpoint fails to validate valid plugin configuration when the key of `customfieldsby_lua` contains dot

Fix an issue with the `/tags/:tag` Admin API returning a JSON object (`{}`) instead of an array (`[]`) for empty data sets. Response Transformer: fix an issue that plugin does not transform the response body while upstream returns a Content-Type with +json suffix at subtype. grpc-gateway: Fixed an issue that empty (all default value) messages can not be unframed correctly. ACME: Fixed sanity test can't work with "kong" storage in Hybrid mode rate-limiting: Fixed an issue that impact the accuracy with the `redis` policy. Thanks for contributing this change. Zipkin: Fixed an issue that traces not being generated correctly when instrumentations are enabled. Acme: Fixed string concatenation on cert renewal errors Validation for queue related parameters has been improved. `maxbatchsize`, `maxentries` and `maxbytes` are now `integer`s instead of `number`s. `initialretrydelay` and `maxretrydelay` must now be `number`s greater than 0.001 (seconds). Tracing: new attribute `http.route` added to http request spans. The default value of `lmdbmapsize` config has been bumped to `2048m` from `128m` to accommodate most commonly deployed config sizes in DB-less and Hybrid mode. The default value of `clustermaxpayload` config has been bumped to `16m` from `4m` to accommodate most commonly deployed config sizes in Hybrid mode. Remove kong branding from kong HTML error template. Drop luasocket in cli Remove the database information from the status API when operating in dbless mode or data plane. Bumped lua-resty-openssl from 0.8.20 to 0.8.23 Bumped kong-lapis from 1.8.3.1 to 1.14.0.2 Bumped lua-resty-events from 0.1.4 to 0.2.0 Bumped lua-resty-session from 4.0.3 to 4.0.4 Bumped OpenSSL from 1.1.1t to 3.1.1 Bumped pgmoon from 1.16.0 to 1.16.2 (Kong's fork) Bumped atc-router from 1.0.5 to 1.2.0 Bumped lua-resty-lmdb from 1.1.0 to 1.3.0 Bumped lua-ffi-zlib from 0.5 to 0.6 Some referenceable configuration fields, such as the `http_endpoint` field of the `http-log` plugin and the `endpoint` field of the `opentelemetry` plugin, do not accept reference values due to incorrect field validation. The `traditional_compatible` router mode has been made more compatible with the behavior of `traditional` mode by splitting routes with multiple paths into multiple atc routes with separate priorities. Since the introduction of the new router in Kong Gateway 3.0, `traditional_compatible` mode assigned only one priority to each route, even if different prefix path lengths and regular expressions were mixed in a route. This was not how multiple paths were handled in the `traditional` router and the behavior has now been changed so that a separate priority value is assigned to each path in a route. http-log, statsd, opentelemetry, datadog: The queueing system has been reworked, causing some plugin parameters to not function as expected anymore. If you use queues on these plugin, new parameters must be configured. The module `kong.tools.batch_queue` has been renamed to `kong.tools.queue` in the process and the API was changed. If your custom plugin uses queues, it must be updated to use the new API. See for a tour of the new queues and how they are parametrized. http-log: If the log server responds with a 3xx HTTP status code, the plugin will consider it to be an error and retry according to the retry configuration. Previously, 3xx status codes would be interpreted as success, causing the log entries to be dropped. Serverless Functions: `kong.cache` now points to a cache instance that is dedicated to the Serverless Functions plugins: it does not provide access to the global kong cache. Access to certain fields in kong.configuration has also been

Zipkin: The zipkin plugin now uses queues for internal buffering. The standard queue parameter set is available to control queuing behavior. Tracing: tracingsamplingrate defaults to 0.01 (trace one of every 100 requests) instead of the previous 1 (trace all requests). Tracing all requests is inappropriate for most production systems Proxy Cache: Add option to remove the proxy cache headers from the response Make runloop and init error response content types compliant with Accept header value Add a new field `updatedat` for core entities cacertificates, certificates, consumers, targets, upstreams, plugins, workspaces, clusteringdataplanes and snis. Allow configuring custom error templates The maximum number of request headers, response headers, uri args, and post args that are parsed by default can now be configured with a new configuration parameters: `luamaxreqheaders`, `luamaxrespheaders`, `luamaxuriargs` and `luamaxpostargs` Allow configuring Labels for data planes to provide metadata information. Labels are only compatible with hybrid mode deployments with Kong Konnect (SaaS) Add Postgres triggers on the core entites and entities in bundled plugins to delete the expired rows in an efficient and timely manner. Support for configurable Node IDs Request and response buffering options are now enabled for incoming HTTP 2.0 requests too. Thanks for contributing this change. Add `KONGUPSTREAMDNS_TIME` to `kong.ctx` so that we can record the time it takes for DNS resolution when Kong proxies to upstream. Tracing: rename spans to simplify filtering on tracing backends. Support timeout for dynamic log level Added new span attribute `http.client_ip` to capture the client IP when behind a proxy. Thanks for this contribution! The `/upstreams/<upstream>/health?balancer_health=1` endpoint always shows the balancer health, through a new attribute balancer_health, which always returns HEALTHY or UNHEALTHY (reporting the true state of the balancer), even if the overall upstream health status is HEALTHCHECKS_OFF. This is useful for debugging. The `status_listen` server has been enhanced with the addition of the `/status/ready` API for monitoring Kong's health. This endpoint provides a `200` response upon receiving a `GET` request, but only if a valid, non-empty configuration is loaded and Kong is prepared to process user requests. Load balancers frequently utilize this functionality to ascertain Kong's availability to distribute incoming requests. ACME: acme plugin now supports configuring an `accountkey` in `keys` and `keysets` Proxy-Cache: add `ignoreuricase` to configuring cache-key uri to be handled as lowercase HTTP-Log: add `application/json; charset=utf-8` option for the `Content-Type` header in the http-log plugin, for log collectors that require that character set declaration. DataDog: supports value of `host` to be referenceable. Zipkin&Opentelemetry: convert traceid in http response headers to hex format ACME: acme plugin now supports configuring `namespace` for redis storage which is default to empty string for backward compatibility. AWS Lambda: add a new field `disable_https` to support scheme config on lambda service api endpoint OpenTelemetry: spans are now correctly correlated in downstream Datadog traces. OpenTelemetry: add `header_type` field in OpenTelemetry plugin. Previously, the `header_type` was hardcoded to `preserve`, now it can be set to one of the following values: `preserve`, `ignore`, `b3`, `b3-single`, `w3c`, `jaeger`, `ot`. PDK now supports getting plugins' ID with `kong.plugin.get_id`. Fixed an issue where upstream keepalive pool has CRC32 collision. Fix an issue where control plane does not downgrade config for `aws_lambda` and `zipkin` for older version of data planes. Fix an issue where control plane does not rename fields correctly for `session` for older version of data

Fix an issue where validation to regex routes may be skipped when the old-fashioned config is used for DB-less Kong. Fix and issue where tracing may cause unexpected behavior. Fix an issue where balancer passive healthcheck would use wrong status code when kong changes status code from upstream in `header_filter` phase. Fix an issue where schema validations failing in a nested record did not propagate the error correctly. Fixed an issue where dangling Unix sockets would prevent Kong from restarting in Docker containers if it was not cleanly stopped. Fix an issue where sorting function for traditional router sources/destinations lead to "invalid order function for sorting" error. Fix the UDP socket leak caused by frequent DNS queries. Fix a typo of mlcache option `shmsettries`. Fix an issue where slow start up of Go plugin server causes dead lock. Tracing: fix an issue that caused the `sampled` flag of incoming propagation headers to be handled incorrectly and only affect some spans. Tracing: fix an issue that was preventing `http_client` spans to be created for OpenResty HTTP client requests. Tracing: fix an approximation issue that resulted in reduced precision of the balancer span start and end times. Tracing: tracingsamplingrate defaults to 0.01 (trace one of every 100 requests) instead of the previous 1 (trace all requests). Tracing all requests is inappropriate for most production systems Fix issue when stopping a Kong could error out if using Vault references Fix issue where Vault configuration stayed sticky and cached even when configurations were changed. Backported the openresty `ngx.print` chunk encoding buffer double free bug fix that leads to the corruption of chunk-encoded response data. Fix an issue where empty value of URI argument `custom_id` crashes `/consumer`. Request-Transformer: fix an issue where requests would intermittently be proxied with incorrect query parameters. Request Transformer: honor value of untrusted_lua configuration parameter OAuth2: fix an issue that OAuth2 token was being cached to nil while access to the wrong service first. OpenTelemetry: fix an issue that reconfigure of OpenTelemetry does not take effect. OpenTelemetry: fix an issue that caused spans to be propagated incorrectly resulting in a wrong hierarchy being rendered on tracing backends. gRPC gateway: `null` in the JSON payload caused an uncaught exception to be thrown during pb.encode. Oauth2: prevent an authorization code created by one plugin instance to be exchanged for an access token by a different plugin instance. gRPC gateway: fixed an issue that empty arrays in JSON are incorrectly encoded as `"{}"`; they are now encoded as `"[]"` to comply with standard. Fixed an issue for tracing PDK where sample rate does not work. Postgres TTL cleanup timer will now only run on traditional and control plane nodes that have enabled the Admin API. Postgres TTL cleanup timer now runs a batch delete loop on each ttl enabled table with a number of 50.000 rows per batch. Postgres TTL cleanup timer now runs every 5 minutes instead of every 60 seconds. Postgres TTL cleanup timer now deletes expired rows based on database server-side timestamp to avoid potential problems caused by the difference of clock time between Kong and database server. `request.geturicaptures` now returns the unnamed part tagged as an array (for jsonification). Request-Termination: If the echo option was used, it would not return the uri-captures. OpenTelemetry: add `httpresponseheaderfortraceid` field in OpenTelemetry plugin. The plugin will set the corresponding header in the response if the field is specified with a string

Bumped lua-resty-session from 4.0.2 to 4.0.3 Bumped lua-protobuf from 0.3.3 to 0.5.0 Bumped lua-resty-timer-ng from 0.2.3 to 0.2.5 Bumped lua-resty-openssl from 0.8.17 to 0.8.20 Bumped lua-resty-http from 0.17.0.beta.1 to 0.17.1 Bumped LuaSec from 1.2.0 to 1.3.1 Bumped lua-resty-acme from 0.10.1 to 0.11.0 Bumped lua-resty-events from 0.1.3 to 0.1.4 Bumped lua-kong-nginx-module from 0.5.1 to 0.6.0 Bumped lua-resty-lmdb from 1.0.0 to 1.1.0 JWT: JWT plugin now denies a request that has different tokens in the jwt token search locations. Session: for sessions to work as expected it is required that all nodes run Kong >= 3.2.x. For that reason it is advisable that during upgrades mixed versions of proxy nodes run for as little as possible. During that time, the invalid sessions could cause failures and partial downtime. All existing sessions are invalidated when upgrading to this version. The parameter `idling_timeout` now has a default value of `900`: unless configured differently, sessions expire after 900 seconds (15 minutes) of idling. The parameter `absolute_timeout` has a default value of `86400`: unless configured differently, sessions expire after 86400 seconds (24 hours). Proxy Cache: Add wildcard and parameter match support for content_type Expose postgres connection pool configuration. When `routerflavor` is `traditionalcompatible`, verify routes created using the Expression router instead of the traditional router to ensure created routes are actually compatible. Nginx charset directive can now be configured with Nginx directive injections Services upstream TLS config is extended to stream subsystem. New configuration option `sslsessioncachesize` to set the Nginx directive `sslsession_cache`. This config defaults to `10m`. Thanks for contributing this change. Add a new load-balancing `algorithm` option `latency` to the `Upstream` entity. This algorithm will choose a target based on the response latency of each target from prior requests. Plugin: add an optional field `instance_name` that identifies a particular plugin entity. Zipkin: Add support to set the durations of Kong phases as span tags through configuration property `config.phasedurationflavor`. HTTP logging: Suppport value of `headers` to be referenceable. AWS Lambda: Add `awsimdsprotocol_version` configuration parameter that allows the selection of the IMDS protocol version. Defaults to `v1`, can be set to `v2` to enable IMDSv2. OpenTelemetry: Support scoping with services, routes and consumers. Statsd: Add `tag_style` configuration parameter that allows to send metrics with . Defaults to `nil` which means do not add any tags to the metrics. Session: now uses lua-resty-session v4.0.0 In dbless mode, `/config` API endpoint can now flatten entity-related schema validation errors to a single array via the optional `flatten_errors` query parameter. Non-entity errors remain unchanged in this mode. Support for `upstream_status` field in log serializer. Add back Postgres `FLOOR` function when calculating `ttl`, so the returned `ttl` is always a whole integer. Fix an issue where after a valid declarative configuration is loaded, the configuration hash is incorrectly set to the value: `00000000000000000000000000000000`. Update the batch queues module so that queues no longer grow without bounds if their consumers fail to process the entries. Instead, old batches are now dropped and an error is logged. Fix an issue where 'X-Kong-Upstream-Status' cannot be emitted when response is buffered. Zipkin: Fix an issue where the global plugin's sample ratio overrides route-specific. JWT: Deny requests that have different tokens in the jwt token search locations. Thanks Jackson 'Che-Chun' Kuo from Latacora for reporting this

Statsd: Fix a bug in the StatsD plugin batch queue processing where metrics are published multiple times. Datadog: Fix a bug in the Datadog plugin batch queue processing where metrics are published multiple times. OpenTelemetry: Fix non-compliances to specification: For `http.uri` in spans. The field should be full HTTP URI. For `http.status_code`. It should be present on spans for requests that have a status code. For `http.flavor`. It should be a string value, not a double. OpenTelemetry: Fix a bug that when getting the trace of other formats, the trace ID reported and propagated could be of incorrect length. OAuth2: `refreshtokenttl` is now limited between `0` and `100000000` by schema validator. Previously numbers that are too large causes requests to fail. Improve error message for invalid JWK entities. Renamed two configuration properties: `opentelemetrytracing` => `tracinginstrumentations` `opentelemetrytracingsamplingrate` => `tracingsampling_rate` The old `opentelemetry_*` properties are considered deprecated and will be fully removed in a future version of Kong. Revert the removal of WebSocket protocol support for configuration sync, and disable the wRPC protocol. Bumped luarocks from 3.9.1 to 3.9.2 Bumped atc-router from 1.0.1 to 1.0.5 Bumped lua-resty-openssl from 0.8.15 to 0.8.17 Bumped lua-kong-nginx-module from 0.5.0 to 0.5.1 Bumped lua-resty-session from 3.10 to 4.0.2 Bumped OpenSSL from 1.1.1s to 1.1.1t Bumped lua-resty-timer-ng from 0.2.0 to 0.2.3 Change the reponse body for a TRACE method from `The upstream server responded with 405` to `Method not allowed`, make the reponse to show more clearly that Kong do not support TRACE method. Add `allowdebugheader` Kong conf to allow use of the `Kong-Debug` header for debugging. This option defaults to `off`. Allow `kong.conf` ssl properties to be stored in vaults or environment variables. Allow such properties to be configured directly as content or base64 encoded content. Add support for full entity transformations in schemas Allow schema `map` type field being marked as referenceable. Add support for dynamically changing the log level Add `keys` entity to store and manage asymmetric keys. Add `key-sets` entity to group and manage `keys` Rate-limiting: The HTTP status code and response body for rate-limited requests can now be customized. Thanks, ! Zipkin: add `responseheaderfor_traceid` field in Zipkin plugin. The plugin will set the corresponding header in the response if the field is specified with a string value. AWS Lambda: add `requestContext` field into `awsgateway_compatible` input data ACME: add support for Redis SSL, through configuration properties `config.storageconfig.redis.ssl`, `config.storageconfig.redis.ssl_verify`, and `config.storageconfig.redis.sslserver_name`. Session: Add new config `cookie_persistent` that allows browser to persist cookies even if browser is closed. This defaults to `false` which means cookies are not persistend across browser restarts. Thanks for this contribution! Response-rate-limiting: add support for Redis SSL, through configuration properties `redisssl` (can be set to `true` or `false`), `sslverify`, and `sslservername`. Thanks ! OpenTelemetry: add referenceable attribute to the `headers` field that could be stored in vaults. HTTP-Log: Support `http_endpoint` field to be referenceable rate-limiting: Add a new configuration `sync_rate` to the `redis` policy, which synchronizes metrics to redis periodically instead of on every request. Data plane node IDs will now persist across restarts. Add HTTP CONNECT forward proxy support for Hybrid Mode connections. New configuration options `clusteruseproxy`, `proxyserver` and `proxyserversslverify` are added. Increase the default value of `luaregexcachemaxentries`, a warning will be thrown when there are too many regex routes and `router_flavor` is `traditional`. Add batch queue into the Datadog and StatsD plugin to reduce timer usage. Extend

to support setting the Distinguished Name (DN) list hints of the accepted CA certificates. Fix issue where external plugins crashing with unhandled exceptions would cause high CPU utilization after the automatic restart. Fix issue where Zipkin plugin cannot parse OT baggage headers due to invalid OT baggage pattern. Add `usesrvname` options to upstream for balancer. Fix issue in `header_filter` instrumentation where the span was not correctly created. Fix issue in router building where when field contains an empty table, the generated expression is invalid. Fix issue in router rebuilding where when paths field is invalid, the router's mutex is not released properly. Fixed an issue where `kong docker-start` would fail if `KONG_PREFIX` was set to a relative path. Fixed an issue with error-handling and process cleanup in `kong start`. Fixed a race condition that can cause configuration push events to be dropped when the first data-plane connection is established with a control-plane worker. Fix slow CLI performance due to pending timer jobs Increase the maximum request argument number from `100` to `1000`, and return `400` error if request parameters reach the limitation to avoid being truncated. Paging size parameter is now propogated to next page if specified in current request. Non-normalized prefix route path is now rejected. It will also suggest how to write the path in normalized form. Added support for `kong.request.geturicaptures` (`kong.request.getUriCaptures`) Fixed parameter type of `kong.service.request.setrawbody` (`kong.service.request.setRawBody`), return type of `kong.service.response.getrawbody`(`kong.service.request.getRawBody`), and body parameter type of `kong.response.exit` to bytes. Note that old version of go PDK is incompatible after this change. Vault will not call `semaphore:wait` in `init` or `init_worker` phase. Add missing `protocols` field to various plugin schemas. AWS Lambda: Fix an issue that is causing inability to read environment variables in ECS environment. Request-Transformer: fix a bug when header renaming will override existing header and cause unpredictable result. OpenTelemetry: Fix an issue that the default propagation header is not configured to `w3c` correctly. Replace the worker-level table cache with `BatchQueue` to avoid data race. Fix an issue that the `parent_id` is not set on the span when propagating w3c traceparent. Response-Transformer: Fix the bug that Response-Transformer plugin breaks when receiving an unexcepted body. HTTP-Log: Fix an issue where queue id serialization does not include `queuesize` and `flushtimeout`. The legacy hybrid configuration protocol has been removed in favor of the wRPC protocol introduced in 3.0. Bumped openssl from 1.1.1q to 1.1.1s Bumped atc-router from 1.0.0 to 1.0.1 Bumped lua-resty-openssl from 0.8.10 to 0.8.15 Bumped lyaml from 6.2.7 to 6.2.8 Bumped lua-resty-acme from 0.8.1 to 0.9.0 Bumped resty.healthcheck from 1.6.1 to 1.6.2 Bumped pgmoon from 1.15.0 to 1.16.0 Fix issue where Zipkin plugin cannot parse OT baggage headers due to invalid OT baggage pattern. Fix issue in `header_filter` instrumentation where the span was not correctly created. Fix issue in router building where when field contains an empty table, the generated expression is invalid. Fix issue in router rebuilding where when paths field is invalid, the router's mutex is not released properly. Fixed an issue where `kong docker-start` would fail if `KONG_PREFIX` was set to a relative path. Fixed an issue with error-handling and process cleanup in `kong start`. Released 2022/09/12 This major release adds a new router written in Rust and a tracing API that is compatible with the OpenTelemetry API spec. Furthermore, various internal changes have been made to improve Kong's performance and memory

As it is a major release, users are advised to review the list of braking changes to determine whether configuration changes are needed when upgrading. Blue-green deployment from Kong earlier than `2.1.0` is not supported, upgrade to `2.1.0` or later before upgrading to `3.0.0` to have blue-green deployment. Thank you ) for reporting issue and proposing a pull-request. Deprecate/stop producing Amazon Linux (1) containers and packages (EOLed December 31, 2020) Deprecate/stop producing Debian 8 "Jessie" containers and packages (EOLed June 2020) Kong schema library's `processautofields` function will not any more make a deep copy of data that is passed to it when the given context is `"select"`. This was done to avoid excessive deep copying of tables where we believe the data most of the time comes from a driver like `pgmoon` or `lmdb`. If a custom plugin relied on `processautofields` not overriding the given table, it must make its own copy before passing it to the function now. The deprecated `shorthands` field in Kong Plugin or DAO schemas was removed in favor or the typed `shorthand_fields`. If your custom schemas still use `shorthands`, you need to update them to use `shorthand_fields`. The support for `legacy = true/false` attribute was removed from Kong schemas and Kong field schemas. The deprecated alias of `Kong.serveadminapi` was removed. If your custom Nginx templates still use it, please change it to `Kong.admin_content`. The Kong singletons module `"kong.singletons"` was removed in favor of the PDK `kong.*`. The dataplane config cache was removed. The config persistence is now done automatically with LMDB. `ngx.ctx.balanceraddress` does not exist anymore, please use `ngx.ctx.balancerdata` instead. We have changed the normalization rules for `route.path`: Kong stores the unnormalized path, but regex path always pattern matches with the normalized URI. We used to replace percent-encoding in regex path pattern to ensure different forms of URI matches. That is no longer supported. Except for reserved characters defined in , we should write all other characters without percent-encoding. Kong will no longer use an heuristic to guess whether a `route.path` is a regex pattern. From now 3.0 onwards, all regex paths must start with the `"~"` prefix, and all paths that don't start with `"~"` will be considered plain text. The migration process should automatically convert the regex paths when upgrading from 2.x to 3.0 Bumping version number (`formatversion`) of declarative configuration to "3.0" for changes on `route.path`. Declaritive configuration with older version are upgraded to "3.0" on the fly. Removed deprecated `config.functions` from serverless-functions plugin's schema, please use `config.access` phase instead. Tags may now contain space characters. The feature, which has been in beta since release 2.8.0, is now included as a regular feature. `POST` requests on Targets endpoint are no longer able to update existing entities, they are only able to create new ones. , . If you have scripts that use `POST` requests to modify Targets, you should change them to `PUT` requests to the appropriate endpoints before updating to Kong 3.0. Insert and update operations on duplicated Targets returns 409. , The list of reported plugins available on the server now returns a table of metadata per plugin instead of a boolean `true`. The `kong.request.get_path()` PDK function now performs path normalization on the string that is returned to the caller. The raw, non-normalized version of the request path can be fetched via `kong.request.getrawpath()`. `pdk.response.setheader()`, `pdk.response.setheaders()`,

now ignore and emit warnings for manually set `Transfer-Encoding` headers. The PDK is no longer versioned The JavaScript PDK now returns `Uint8Array` for `kong.request.getRawBody`, `kong.response.getRawBody` and `kong.service.response.getRawBody`. The Python PDK returns `bytes` for `kong.request.getrawbody`, `kong.response.getrawbody`, `kong.service.response.getrawbody`. All these funtions used to return strings in the past. DAOs in plugins must be listed in an array, so that their loading order is explicit. Loading them in a hash-like table is no longer supported. Plugins MUST now have a valid `PRIORITY` (integer) and `VERSION` ("x.y.z" format) field in their `handler.lua` file, otherwise the plugin will fail to load. The old `kong.plugins.log-serializers.basic` library was removed in favor of the PDK function `kong.log.serialize`, please upgrade your plugins to use PDK. The support for deprecated legacy plugin schemas was removed. If your custom plugins still use the old (`0.x era`) schemas, you are now forced to upgrade them. Some plugins received new priority values. This is important for those who run custom plugins as it may affect the sequence your plugins are executed. Note that this does not change the order of execution for plugins in a standard kong installation. List of plugins and their old and new priority value: `acme` changed from 1007 to 1705 `basic-auth` changed from 1001 to 1100 `hmac-auth` changed from 1000 to 1030 `jwt` changed from 1005 to 1450 `key-auth` changed from 1003 to 1250 `ldap-auth` changed from 1002 to 1200 `oauth2` changed from 1004 to 1400 `rate-limiting` changed from 901 to 910 HTTP-log: `headers` field now only takes a single string per header name, where it previously took an array of values AWS Lambda: `aws_region` field must be set through either plugin config or environment variables, allow both `host` and `aws_region` fields, and always apply SigV4 signature. Serverless Functions Removed deprecated `config.functions`, please use `config.access` instead. Serverless Functions: The pre-functions plugin changed priority from `+inf` to `1000000`. JWT: The authenticated JWT is no longer put into the nginx context (ngx.ctx.authenticatedjwttoken). Custom plugins which depend on that value being set under that name must be updated to use Kong's shared context instead (kong.ctx.shared.authenticatedjwttoken) before upgrading to 3.0 Prometheus: The prometheus metrics have been reworked extensively for 3.0. Latency has been split into 4 different metrics: konglatencyms, upstreamlatencyms and requestlatencyms (http) /tcpsessionduration_ms (stream). Buckets details below. Separate out Kong Latency Bucket values and Upstream Latency Bucket values. `consumer_status` removed. `requestcount` and `consumerstatus` have been merged into just `httprequeststotal`. If the `per_consumer` config is set false, the consumer label will be empty. If the `per_consumer` config is true, it will be filled. `httprequeststotal` has a new label `source`, set to either `exit`, `error` or `service`. New Metric: `node_info`. Single gauge set to 1 that outputs the node's id and kong version. All Memory metrics have a new label `node_id` `nginxhttpcurrentconnections` merged with `nginxstreamcurrentconnection` into `nginxcurrentconnections` Prometheus: The plugin doesn't export status codes, latencies, bandwidth and upstream healthcheck metrics by default. They can still be turned on manually by setting `statuscodemetrics`, `latencymetrics`, `bandwidthmetrics` and `upstreamhealthmetrics` respectively. Enabling those metrics will impact the performance if you have a large volume of Kong entities, we recommend using the plugin with the push model if that is the case. And now `prometheus` plugin new grafana updated ACME: `allowanydomain` field added. It is default to false and if set to true, the gateway will ignore the `domains`

Statsd: The metric name that is related to the service has been renamed by adding a `service.` prefix. e.g. `kong.service.<service_identifier>.request.count` The metric `kong.<serviceidentifier>.request.status.<status>` and `kong.<serviceidentifier>.user.<consumeridentifier>.request.status.<status>` has been renamed to `kong.service.<serviceidentifier>.status.<status>` and `kong.service.<serviceidentifier>.user.<consumeridentifier>.status.<status>` The metric `*.status.<status>.total` from metrics `statuscount` and `statuscountperuser` has been removed Proxy-cache: The plugin does not store the response data in `ngx.ctx.proxycachehit` anymore. Logging plugins that need the response data must read it from `kong.ctx.shared.proxycachehit` from Kong 3.0 on. Rate-limiting: The default policy is now `local` for all deployment modes. Response-rate-limiting: The default policy is now `local` for all deployment modes. The `gopluginserverexe` and `gopluginsdir` directives are no longer supported. . If you are using , please migrate your plugins to use the before upgrading. The migration helper library (mostly used for Cassandra migrations) is no longer supplied with Kong The pathhandling algorithm `v1` is deprecated and only supported when `routerflavor` config option is set to `traditional`. The Kong constant `CREDENTIAL_USERNAME` with value of `X-Credential-Username` was removed. Kong plugins in general have moved (since ) to use constant `CREDENTIAL_IDENTIFIER` with value of `X-Credential-Identifier` when setting the upstream headers for a credential. Change the default of `luassltrusted_certificate` to `system` to automatically load trusted CA list from system CA store. Remove a warning of `AAAA` being experimental with `dns_order`. It is no longer possible to use a .lua format to import a declarative config from the `kong` command-line tool, only json and yaml are supported. If your update procedure with kong involves executing `kong config db_import config.lua`, please create a `config.json` or `config.yml` and use that before upgrading. We bumped the version number (`formatversion`) of declarative configuration to "3.0" because of changes on `route.path`. Declarative configuration with older version should be upgraded to "3.0" on the fly. Postgres migrations can now have an `up_f` part like Cassandra migrations, designating a function to call. The `up_f` part is invoked after the `up` part has been executed against the database for both Postgres and Cassandra. A new CLI command, `kong migrations status`, generates the status on a JSON file. Bumped OpenResty from 1.19.9.1 to Bumped pgmoon from 1.13.0 to 1.15.0 Bumped OpenSSL from 1.1.1n to 1.1.1q Bumped resty.openssl from 0.8.8 to 0.8.10 Bumped inspect from 3.1.2 to 3.1.3 Bumped resty.acme from 0.7.2 to 0.8.1 Bumped luarocks from 3.8.0 to 3.9.1 Bumped luasec from 1.0.2 to 1.2.0 Bumped resty.healthcheck from 1.5.0 to 1.6.1 Bumped resty.cassandra from 1.5.1 to 1.5.2 Bumped penlight from 1.12.0 to 1.13.1 Bumped lua-resty-mlcache from 2.5.0 to 2.6.0 Do not register unnecessary event handlers on Hybrid mode Control Plane nodes . Use the new timer library to improve performance, except for the plugin server. Increased use of caching for DNS queries by activating `additional_section` by default `pdk.request.get_header` changed to a faster implementation, not to fetch all headers every time it's called Conditional rebuilding of router, plugins iterator and balancer on DP , Made config loading code more cooperative by yielding Use LuaJIT encoder instead of JSON to serialize values faster in LMDB Move inflating and JSON decoding non-concurrent, which avoids blocking and makes DP reloads faster Stop duplication of some events Improve performance of config hash calculation by using string buffer and tablepool Reduce cache usage in dbless by not using the kong cache for Routes and Services in LMDB Implemented delayed response in stream mode Added `cache_key` on target entity for uniqueness

Introduced the tracing API which compatible with OpenTelemetry API spec and add build-in instrumentations. The tracing API is intend to be used with a external exporter plugin. Build-in instrumentation types and sampling rate are configuable through `opentelemetrytracing` and `opentelemetrytracingsamplingrate` options. Added `path`, `uricapture`, and `queryarg` options to upstream `hash_on` for load balancing. Introduced unix domain socket based `lua-resty-events` to replace shared memory based `lua-resty-worker-events`. Introduced a new router implementation `atc-router`, which is written in Rust. Introduce a new field for entities `table_name` that allows to specify a table name. Before the name was deduced by the entity `name` attribute. Added `headers` on active healthcheck for upstreams. Target entities using hostnames were resolved when they were not needed. Now when a target is removed or updated, the DNS record associated with it is removed from the list of hostnames to be resolved. Improved error handling and debugging info in the DNS code Kong will now attempt to recover from an unclean shutdown by detecting and removing dangling unix sockets in the prefix directory Added a new API `/timers` to get the timer statistics. and worker info `/` endpoint now includes plugin priority Add wRPC protocol support. Now configuration synchronization is over wRPC. wRPC is an RPC protocol that encodes with ProtoBuf and transports with WebSocket. To keep compatibility with earlier versions, add support for CP to fall back to the previous protocol to support old DP. Add support to negotiate services supported with wRPC protocol. We will support more services than config sync over wRPC in the future. Declarative config exports happen inside a transaction in Postgres Sync all plugin versions to the Kong version Introduced the new OpenTelemetry plugin that export tracing instrumentations to any OTLP/HTTP compatible backend. `opentelemetry_tracing` configuration should be enabled to collect the core tracing spans of Kong. Zipkin: add support for including HTTP path in span name through configuration property `httpspanname`. Zipkin: add support for socket connect and send/read timeouts through configuration properties `connecttimeout`, `sendtimeout`, and `read_timeout`. This can help mitigate `ngx.timer` saturation when upstream collectors are unavailable or slow. AWS-Lambda: add support for cross account invocation through configuration properties `awsassumerole_arn` and `awsrolesession_name`. AWS-Lambda: accept string type `statusCode` as valid return when working in proxy integration mode. AWS-Lambda: separate aws credential cache by IAM role ARN Statsd: :fireworks: Newly open-sourced plugin capabilities: All capabilities of are now bundled in . A new configuration item (`openresty_path`) has been added to allow developers/operators to specify the OpenResty installation to use when running Kong (instead of using the system-installed OpenResty) Add `ipv6only` to listen options (e.g. `KONGPROXYLISTEN`) Add `sokeepalive` to listen options (e.g. `KONGPROXY_LISTEN`) Add LMDB dbless config persistence and removed the JSON based config cache for faster startup time `nginxeventsworker_connections=auto` has a lower bound of 1024 `nginxmainworkerrlimitnofile=auto` has a lower bound of 1024 Added new PDK function: `kong.request.getstarttime()` `kong.db.*.cachekey()` falls back to `.id` if nothing from `cachekey` is found The schema validator now correctly converts `null` from declarative configurations to `nil`. Only reschedule router and plugin iterator timers after finishing previous execution, avoiding unnecessary concurrent executions. External plugins now handle returned JSON with null member correctly. Fixed an issue where the address of the environ variable could change but the code didn't assumed it was fixed after init Fix issue where the Go plugin server instance would not be updated after a restart (e.g., upon a plugin server

Fixed an issue on trying to reschedule the DNS resolving timer when Kong was being reloaded. The private stream API has been rewritten to allow for larger message payloads Fixed an issue that the client certificate sent to upstream was not updated when calling PATCH Admin API Fixed an issue where the CP and wRPC modules would cause Kong to crash when calling `exportdeflatedreconfigure_payload` without a pcall Moved all `.proto` files to `/usr/local/kong/include` and ordered by priority. Fixed an issue that cause unexpected 404 error on creating/updating configs with invalid options Fixed an issue that causes crashes when calling some PDK APIs Fixed an issue that cause crashes when go PDK calls return arrays Plugin servers now shutdowns gracefully when Kong exits CLI now prompts with `[y/n]` instead of `[Y/n]`, as it does not take `y` as default Improved the error message when Kong cannot connect to Cassandra on init Fixed an issue where Vault Subschema wasn't loaded in `off` strategy The Schema now runs select transformations before processautofields Fixed an issue where Kong would use too many timers to keep track of upstreams when `worker_consistency`=`eventual` , Fixed an issue where it wasn't possible to set target status using only a hostname for targets set only by their hostname Fixed pagination issue when getting to the second page while iterationg over a foreign key field using the DAO Fixed an issue where cache entries of some entities were not being properly invalidated after a cascade delete Running `kong start` when Kong is already running will no longer clobber the existing `.kong_env` file Support HTTP/2 when requesting `/status` Plugins with colliding priorities have now deterministic sorting based on their name External Plugins: better handling of the logging when a plugin instance loses the instances_id in an event handler ACME: `auth_method` default value is set to `token` ACME: Added cache for `domains_matcher` syslog: `conf.facility` default value is now set to `user` AWS-Lambda: Removed `proxy_scheme` field from schema AWS-Lambda: Change path from requesturi to upstreamuri, fix uri can not follow the rule defined in the request-transformer configuration hmac-auth: Removed deprecated signature format using `ngx.var.uri` Remove deprecated `blacklist`/`whitelist` config fields from bot-detection, ip-restriction and ACL plugins. Zipkin: Correct the balancer spans' duration to include the connection time from Nginx to the upstream. Zipkin: Correct the calculation of the header filter start time Zipkin: Compatibility with the latest Jaeger header spec, which makes `parent_id` optional LDAP-Auth: Refactored ASN.1 parser using OpenSSL API through FFI. Rate-Limiting and Response-ratelimiting: Fix a disordered behaviour caused by `pairs` function which may cause Postgres DEADLOCK problem Response-rate-Limiting: Fix a disordered behaviour caused by `pairs` function which may cause Postgres DEADLOCK problem gRPC gateway: Fix the handling of boolean fields from URI arguments Serverless Functions: Fix problem that could result in a crash Azure-functions: Support working without dummy service The cluster listener now uses the value of `adminerrorlog` for its log file instead of `proxyerrorlog` Fixed a typo in some business logic that checks the Kong role before setting a value in cache at startup Fixed DP get zero size config while service with plugin-enabled route is disabled Localize `config_version` to avoid a race condition from the new yielding config loading code `kong.response.get_source()` now return an error instead of an exit when plugin throws runtime exception on access phase `kong.tools.uri.normalize()` now does escaping of reserved and unreserved characters more correctly Please see file for < 3.0 releases.