Project: Emissary-Ingress (Orchestration & Management / API Gateway)
File: CHANGELOG.old-pro.md

DO NOT EDIT THIS FILE FOR ANY NEW DEVELOPMENT. This is the CHANGELOG for the old "Ambassador Pro" product that was an add-on to the Ambassador API Gateway. In 1.0.0, Ambassador Pro and the Ambassador API Gateway were merged in to a combined "Ambassador Edge Stack" product. Behavior: Developer portal no longer requires the /openapi Mapping Renamed environment variable APRODEVPORTALCONTENTURL to DEVPORTALCONTENT_URL Feature: Developer portal can check out a non-default branch. Control with DEVPORTALCONTENTBRANCH env var Feature: Developer portal can use a subdir of a checkout. Control with DEVPORTALCONTENTDIR env var `apictl traffic initialize` no longer waits for the traffic-proxy to become ready before exiting. Feature: Developer portal will show swagger documentation for up to five services (or more with appropriate license) Feature: local-devportal is now a standalone go binary with no external dependencies `v1` license keys were not being used so augment them to include emails The OAuth2 redirection endpoint has moved from `/callback` to `/.ambassador/oauth2/redirection-endpoint`. Migrating Pro users will need to notify thier IDP of the change. Other: `amb-core` and `amb-sidecar` have been merged in to a combined `aes` which is based on Ambassador OSS [version TBD]. `login-gate-js`content has been updated for a clearer first time experience. Configuration: `JWT` Filter now has a `realm` setting to configure the realm mentioned in `WWW-Authenticate` of error responses. Feature: `JWT` Filter now has a FilterPolicy argument `scope` to preform `draft-ietf-oauth-token-exchange`-compatible Scope validation. Feature: `OAuth2` Filter now has a `.insteadOfRedirect.filters` FilterPolicy argument that lets you provide a list of filters to run; as if you were listing them directly in a FilterPolicy. Feature: `OAuth2` Filter now has a `extraAuthorizationParameters` setting to manually pass extra parameters to the IDP's authorization endpoint. Feature: `OAuth2` Filter now has a `accessTokenJWTFilter` setting to use a `JWT` filter for access token validation when `accessTokenValidation: jwt` or `accessTokenValidation: auto`. Behavior: Feature: `JWT` Filter now generates RFC 6750-compliant responses with the `WWW-Authenticate` header set. Other: Update Ambassador Core from Ambassador 0.85.0 (Envoy 1.11+half-way-to-1.12) to 0.86.0 (Envoy 1.12.2) Configuration: Feature: `FilterPolicy` may now set `ifRequestHeader` to only apply a `Filter` to requests with appropriate headers. Feature: `FilterPolicy` may now set `onDeny` and `onAllow` to modify how `Filter`s chain together. Feature: `JWT` Filter `injectRequestHeaderse` templates can now read the incoming HTTP request headers. Feature: `JWT` Filter `errorResponse` can now set HTTP headers of the error response. Beta feature: `OAuth2` Filter can now be configured to receive OAuth client credentials in the HTTP request header, and use them to obtain a client credentials grant. This is only currently tested with Okta. Behavior: The `OAuth2` filter's XSRF protection now works differently. You should use the `ambassadorxsrf.{name}.{namespace}` cookie instead of the `ambassadorsession.{name}.{namespace}` cookie for XSRF-protection purposes. Configuration: The `JWT` and `OAuth2` Filter types support `renegotiateTLS` The `JWT` Filter now has an `errorResponse` argument that allows templating the filter's error response. Other: Update Ambassador Core from Ambassador 0.83.0 to 0.85.0 Configuration The `OAuth2` filter now has a FilterPolicy argument `insteadOfRedirect` that can specify a different action to perform than redirecting to the IDP. Behavior: Feature: Developer portal URL can be changed by the user. Adjust the `ambassador-pro-devportal` `Mapping` CRD (or annotation) by changing the `prefix` to desired prefix and changing the `rewrite` to `/docs/`. The `ambassador-pro-devportal-api` can not be adjusted

Feature: The `OAuth2` filter can now perform OIDC-session RP-initiated logout when used with an identity provider that supports it. Bugfix: Properly return a 404 for unknown paths in the amb-sidecar; instead of serving the index page; this could happen if the devportal Mapping is misconfigured. Bugfix: Fix the "loaded filter" log info message. Bugfix: Don't publish the "dev-portal-server" Docker image; it was obviated by "amb-sidecar" in 0.8.0. Bugfix: The `JWT` Filter is no longer case-sensitive with the auth-scheme (`Bearer` vs `bearer`) Bugfix: The `JWT` Filter no longer accepts authorizations that are missing an auth-scheme Other: Update Ambassador Core from Ambassador 0.75.0 to 0.83.0 Incorporate the Envoy 1.11.2 security patches in Ambassador Core Fast iteration on Developer Portal styling and content using a docker image inside a local checkout of Developer Portal content repo (see reference doc for usage guide) Configuration: `amb-sidecar` now takes additional configuration related to the developer portal. Behavior: Feature: The developer portal is now in "beta", and incorporated into amb-sidecar. Bugfix: The `External` Filter no longer erroneously follows redirects. Bugfix: Fixed a case-folding bug causing the `JWT` Filter to be inoperable. Enhancement: Errors in `Filter` resource definitions are now recorded and included in error messages. Configuration: `amb-sidecar`: The default value of `USE_STATSD` has changed from `true` to `false`. Bump license key schema v0 v1. The developer portal requires a v1 license with the "devportal" feature enabled. Some future version of the other functionality will drop support for v0 license keys. The `JWT` Filter can now inject HTTP request headers; configured with the `injectRequestHeaders` field. Behavior: Fixed a resource leak in dev-portal-server Other: There is now a build of Ambassador with Certified Envoy named "amb-core". Configuration: The CRD field `ambassador_id` may now be a single string instead of a list of strings (this should have always been the case, but there was a bug in the parser). Everything is now on one port: `APROHTTPPORT`, which defaults to `8500`. `LOGLEVEL` no longer exists; everything obeys `APPLOG_LEVEL`. The meaning of `REDISPOOLSIZE` has changed slightly; there are no longer separate connection pools for ratelimit and filtering; the maximum number of connections is now `REDISPOOLSIZE` instead of 2`REDISPOOLSIZE`. The `amb-sidecar` RateLimitService can now report to statsd, and attempts to do so by default (`USESTATSD`, `STATSDHOST`, `STATSDPORT`, `GOSTATSFLUSHINTERVALSECONDS`). Behavior: Now also handles gRPC requests for `envoy.service.auth.v2`, in addition to `envoy.service.auth.v2alpha`. Log a stacktrace at log-level "debug" whenever the HTTP client encounters an error. Fix bug where the wrong key was selected from a JWKS. Everything in amb-sidecar now runs as a single process. Configuration: Redis is now always required to be configured. The `amb-sidecar` environment variables `$APROPRIVATEKEYPATH` and `$APROPUBLICKEYPATH` are replaced by a Kubernetes secret and the `$APROKEYPAIRSECRETNAME` and `$APROKEYPAIRSECRETNAMESPACE` environment variables. If the `$APROKEYPAIRSECRET_NAME` Kubernetes secret (above) does not exist, `amb-sidecar` now needs the "create" permission for secrets in its ClusterRole. The `OAuth2` Filter now ignores the `audience` field setting. I expect it to make a come-back in 0.5.1 though. The `OAuth2` Filter now acts as if the `openid` scope value is always included in the FilterPolicy's `scopes` argument. The `OAuth2` Filter can verify Access Tokens with several different methods; configured with the `accessTokenValidation` field. Behavior: The `OAuth2` Filter is now strictly compliant with OAuth

It is verified to work properly with: Auth0 Azure AD Google Keycloak Okta UAA The `OAuth2` Filter browser cookie has changed: It is now named `ambassadorsession.{{filtername}}.{{filternamespace}}` instead of `accesstoken`. It is now an opaque string instead of a JWT Access Token. The Access Token is still available in the injected `Authorization` header. The `OAuth2` Filter will no longer consider a user-agent-provided `Authorization` header, it will only consider the cookie. The `OAuth2` Filter now supports Refresh Tokens; they must be requested by listing `offline_access` in the `scopes` argument in the FilterPolicy. The `OAuth2` Filter's `/callback` endpoint is no longer vulnerable to XSRF attacks The Developer Portal file descriptor leak is fixed. Other: Open Source dependency license compliance is now automated as part of the release machinery. Source releases for the Docker images are now present in the images themselves at `/.opensource.tar.gz`. Add the Developer Portal (experimental; no documentation available yet) `apictl traffic initialize`: Correctly handle non-`default` namespaces `app-sidecar`: Respect the `APPLOGLEVEL` environment variable, same as `amb-sidecar` Turn down liveness and readiness probe logging from "info" to "debug" Add liveness and readiness probes Moved all of the default sidecar ports around; YAML will need to be adjusted (hence 0.4.0 instead of 0.3.2). Additionally, all of the ports are now configurable via environment variables | Purpose | Variable | Old | New | | - | -- | | | | Auth gRPC | APROAUTHPORT | 8082 | 8500 | | RLS gRPC | GRPC_PORT | 8081 | 8501 | | RLS debug (HTTP) | DEBUG_PORT | 6070 | 8502 | | RLS HTTP ??? | PORT | 7000 | 8503 | `apictl` no longer sets an imagePullSecret when deploying Pro things to the cluster (since the repo is now public) Support running the Ambassador sidecar as a non-root user New Filter type `External` Request IDs in the Pro logs are the same as the Request IDs in the Ambassador logs `OAuth2` Filter type supports `secretName` and `secretNamespace` Switch to using Ambassador OSS gRPC API No longer necessary to set `allowedrequestheaders` or `allowedauthorizationheaders` for `Plugin` Filters RLS logs requests as `info` instead of `warn` Officially support Okta as an IDP (0.3.0 was initially tagged as 0.2.5) `JWT` and `OAuth2` Filter types support `insecureTLS` `OAuth2` now handles JWTs with a `scope` claim that is a JSON list of scope values, instead of a JSON string containing a whitespace-separated list of scope values (such as those generated by UAA) Consul Connect integration no longer requires a license key Fix Consul certificate rotation Move the AuthService from port 8080 to 8082, and make it configurable with `APROAUTHPORT` Have everything require license keys Differentiate between components when phoning-home to Scout Phone-home to kubernaut.io/scout, not metriton.datawire.io/scout Fix bug where `apictl traffic inject` wiped existing `imagePullSecrets` Support `AMBASSADORID`, `AMBASSADORSINGLENAMESPACE`, and `AMBASSADORNAMESPACE` Log format changed OIDC support Replace `Tenant` and `Policy` CRDs with `Filter` and `FilterPolicy` CRDs Add JWT validation filter Add `apro-plugin-runner` (previously was in a separate OSS git repo) More readable logs in the event of a crash `apictl traffic` sets `imagePullSecret` Have `apictl` also look for the license key in `~/.config/` as a fallback on macOS. The paths it now looks in, from highest to lowest precedence, are: `$HOME/Library/Application Support/ambassador/license-key` (macOS only) `${XDGCONFIGHOME:-$HOME/.config}/ambassador/license-key` `$HOME/.ambassador.key` First release with combined rate-limiting and authentication.