1.17.0 (pending)

Incompatible Behavior Changes

Changes that are expected to cause an incompatibility if applicable; deployment changes are likely required

Minor Behavior Changes

Changes that may cause incompatibilities for some users, but should not for most

  • build: the Alpine based debug images are no longer built in CI, use Ubuntu based images instead.

  • cluster manager: the cluster which can’t extract secret entity by SDS to be warming and never activate. This feature is disabled by default and is controlled by runtime guard envoy.reloadable_features.cluster_keep_warming_no_secret_entity.

  • expr filter: added connection.termination_details property support.

  • ext_authz filter: disable envoy.reloadable_features.ext_authz_measure_timeout_on_check_created by default.

  • ext_authz filter: the deprecated field use_alpha is no longer supported and cannot be set anymore.

  • grpc_web filter: if a grpc-accept-encoding header is present it’s passed as-is to the upstream and if it isn’t grpc-accept-encoding:identity is sent instead. The header was always overwriten with grpc-accept-encoding:identity,deflate,gzip before.

  • tls: removed RSA key transport and SHA-1 cipher suites from the client-side defaults.

  • watchdog: the watchdog action abort_action is now the default action to terminate the process if watchdog kill / multikill is enabled.

  • xds: to support TTLs, heartbeating has been added to xDS. As a result, responses that contain empty resources without updating the version will no longer be propagated to the subscribers. To undo this for VHDS (which is the only subscriber that wants empty resources), the envoy.reloadable_features.vhds_heartbeats can be set to “false”.

Bug Fixes

Changes expected to improve the state of the world and are unlikely to have negative effects

  • dns: fix a bug where custom resolvers provided in configuration were not preserved after network issues.

  • http: fixed URL parsing for HTTP/1.1 fully qualified URLs and connect requests containing IPv6 addresses.

  • http: sending CONNECT_ERROR for HTTP/2 where appropriate during CONNECT requests.

  • proxy_proto: fixed a bug where the wrong downstream address got sent to upstream connections.

  • tls: fix read resumption after triggering buffer high-watermark and all remaining request/response bytes are stored in the SSL connection’s internal buffers.

  • watchdog: touch the watchdog before most event loop operations to avoid misses when handling bursts of callbacks.

Removed Config or Runtime

Normally occurs at the end of the deprecation period

  • ext_authz: removed auto ignore case in HTTP-based ext_authz header matching and the runtime guard envoy.reloadable_features.ext_authz_http_service_enable_case_sensitive_string_matcher. To ignore case, set the ignore_case field to true.

  • http: flip default HTTP/1 and HTTP/2 server codec implementations to new codecs that remove the use of exceptions for control flow. To revert to old codec behavior, set the runtime feature envoy.reloadable_features.new_codec_behavior to false.

  • http: removed envoy.reloadable_features.http1_flood_protection and legacy code path for turning flood protection off.

New Features

  • config: added new runtime feature envoy.features.enable_all_deprecated_features that allows the use of all deprecated features.

  • grpc: implemented header value syntax support when defining initial metadata for gRPC-based ext_authz HTTP and network filters, and ratelimit filters.

  • hds: added support for delta updates in the HealthCheckSpecifier, making only the Endpoints and Health Checkers that changed be reconstructed on receiving a new message, rather than the entire HDS.

  • health_check: added option to use no_traffic_healthy_interval which allows a different no traffic interval when the host is healthy.

  • http: added frame flood and abuse checks to the upstream HTTP/2 codec. This check is off by default and can be enabled by setting the envoy.reloadable_features.upstream_http2_flood_checks runtime key to true.

  • jwt_authn: added support for per-route config.

  • listener: added an optional default filter chain. If this field is supplied, and none of the filter_chains matches, this default filter chain is used to serve the connection.

  • lua: added downstreamDirectRemoteAddress() and downstreamLocalAddress() APIs to streamInfo().

  • mongo_proxy: the list of commands to produce metrics for is now configurable.

  • network: added a timeout for incoming connections completing transport-level negotiation, including TLS and ALTS hanshakes.

  • overload: add envoy.overload_actions.reduce_timeouts overload action to enable scaling timeouts down with load.

  • ratelimit: added support for use of various metadata as a ratelimit action.

  • ratelimit: added disable_x_envoy_ratelimited_header option to disable X-Envoy-RateLimited header.

  • tcp: added a new envoy.overload_actions.reject_incoming_connections action to reject incoming TCP connections.

  • tls: added support for RSA certificates with 4096-bit keys in FIPS mode.

  • tracing: added SkyWalking tracer.

  • xds: added support for resource TTLs. A TTL is specified on the Resource. For SotW, a Resource can be embedded in the list of resources to specify the TTL.

Deprecated