v1.4.3

Release Announcement

Check out the v1.4.3 release notes to learn more about the release.

v1.5.0

Release Announcement

Check out the v1.5 release announcement to learn more about the release.

What's Changed

• skip building egctl for windows_arm64 by @arkodg in #5878
• docs(grpc): add note on using BackendTrafficPolicy for GPRC timeouts by @Antvirf in #5822
• ci: remove windows_arm64 uploads by @arkodg in #5884
• increase liveness probe failureThreshold for shutdown manager by @arkodg in #5877
• fix: remove sanposhiho from reviewers by @sanposhiho in #5870
• fix: make topology injector best effort by @arkodg in #5891
• docs: Change Subtitle of Concept Template by @melsal13 in #5893
• Revert "increase liveness probe failureThreshold for shutdown manager… by @arkodg in #5889
• release notes for v1.4.0-rc.2 by @arkodg in #5899
• chore: ignore api types in codecov by @shawnh2 in #5886
• chore/ci: add go.lint.fmt target by @cnvergence in #5846
• fix: staticcheck issues by @mmorel-35 in #5779
• docs: local jwks by @zhaohuabing in #5806
• disable settings by default in gateway-crds-helm by @arkodg in #5894
• Add seed corpus to guide the fuzzer to generate combinations of gatew… by @sudiptob2 in #5904
• fix(chart): passing root context to template by @hansselvig in #5902
• chore: improve merge test by @zirain in #5861
• fix: httproute precedence by considering header/query match type by @kkk777-7 in #5740
• ci: make helm-generate should failed as expected by @zirain in #5908
• docs(rate-limit): minor fix in 'Distinct Users Except Admin' section by @tomas-rojo in #5912
• adpot internals/utils/merge.Merge by @zirain in #5917
• Add Bitnami as an Envoy Gateway adopter by @carrodher in #5926
• build(deps): bump google/osv-scanner-action from 2.0.1 to 2.0.2 by @dependabot[bot] in #5920
• build(deps): bump github/codeql-action from 3.28.16 to 3.28.17 by @dependabot[bot] in #5919
• build(deps): bump github.com/valyala/fasthttp from 1.60.0 to 1.61.0 in /examples/preserve-case-backend in the github-com group across 1 directory by @dependabot[bot] in #5921
• docs: fix example for http redirects page by @mczaplinski in #5830
• docs: Add docs for request buffering by @markwinter in #5910
• feat: support configuring tls for dynamic resolver backend by @zhaohuabing in #5867
• fix: fix topology injector bug by @jukie in #5911
• feat: allow merge rate limit rule in BTP by @zirain in #5915
• docs: install EG via Argo CD by @zhaohuabing in #5824
• chore: clean up BTP status by @zhaohuabing in #5934
• e2e: test for dynamic resolver backend using system ca for TLS by @zhaohuabing in #5932
• feat: implement offline kubernetes controller by @shawnh2 in #5767
• fix: SecurityPolicy reference grant by @kkk777-7 in #5792
• fix: add validation for header values by @gavinkflam in #5933
• fix: Fixed typo in error message. by @mathias-ws in #5945
• e2e: disable DynamicResolverBackendTest on IPv6 by @zhaohuabing in #5964
• fix: proxy creation/deletion error handling in GatewayNamespace mode by @zirain in #5954
• ci: kube-deploy support KUBE_DEPLOY_PROFILE by @zirain in #5957
• fix: process remaining gatewayClasses after encountering an err by @arkodg in #5953
• fix: do not add tls inspector filter to quic listener by @Xunzhuo in #5671
• Add seed corpus related to traffic task. by @sudiptob2 in #5947
• [release/v1.3] release v1.3.3 notes by @guydc in #5969
• e2e: fix PreserveCase flaky by @zirain in #5966
• feat: validate JWT token and use projected token by @cnvergence in #5871
• feat: add controller namespace field to infrastructure render by @cnvergence in #5937
• e2e: GatewayNamespace mode by @zirain in #5961
• helm: support standard channel by @zhaohuabing in #5958
• e2e: bump upgrade test version to v1.3.2 by @zirain in #5976
• fix: add validation for duplicated API keys by @gavinkflam in #5955
• [release/v1.3] update site to use v1.3.3 by @guydc in #5980
• docs: dynamic resolver backend by @zhaohuabing in #5935
• Fuzzing: Fail on xds translation error by @sudiptob2 in #5986
• fix btp merge not working when there's multi parent refs on router by @zirain in #5967
• e2e: fix GRPCExtAuth flaky by @zirain in #5987
• chore: add coverpkg for coverage test by @shawnh2 in #5991
• ci: enable conformance test for GatewayNamespaceMode by @zirain in #5992
• e2e: add CollectAndDump for EGUpgrade test by @zirain in #5998
• e2e: add test for BTP timeout by @zirain in #5994
• Remoe check for accesslog formatter by @zirain in #5985
• e2e: fix GRPCExtAuth/http_route_with_ext_auth_authentication by @zirain in #6001
• chore: update dependabot by @zirain in #6007
• e2e: update CORS test by @zirain in #6011
• chore: add multiple gateways testdata for GatewayNamespace mode by @cnvergence in #5972
• feat: adds support for extension server in standalone mode by @mathetake in #5984
• docs: Add new conceptual pages for intro concepts by @melsal13 in #5981
• docs: update open graph image by @missBerg in #6022
• temporarily disable the backend tls test by @zhaohuabing in #6030
• Fix lint by @zhaohuabing in #6031
• fix: allows offline k8s controller to use non default CRDs by @mathetake in #6020
• e2e: refactor ratelmit test by @zirain in #5997
• moved shared under rules by @ryanhristovski in #5944
• docs: fix path to og:image by @missBerg in #6046
• version and release notes for v1.4.0 by @arkodg in #6048
• docs: add cherry-pick range example in release steps by @arkodg in #6045
• docs: clean up quickstart by @arkodg in #6051
• Release news for v1.4.0 by @arkodg in #6050
• chore: publish shouldnt wait for resilience-test by @arkodg in #6053
• docs: fix v1.4 release news by @arkodg in #6058
• build(deps): bump the gomod group across 6 directories with 8 updates by @dependabot[bot] in #6016
• build(deps): bump the gomod group across 2 directories with 3 updates by @dependabot[bot] in #6060
• v1.4 docs by @zhaohuabing in #6052
• update release process by @zhaohuabing in #6063
• e2e: fix EnvoyProxyCustomName by @zirain in #6014
• fix: custom controller namespace refs in gateway namespace mode by @cnvergence in #6065
• e2e: fix BackendUpgrade flaky by @zirain in #6038
• build(deps): bump actions/setup-go from 5.4.0 to 5.5.0 in /tools/github-actions/setup-deps in the github-actions group across 1 directory by @dependabot[bot] in https:/...

v1.5.0-rc.2

Envoy Gateway v1.5.0-rc.2 Release Candidate

v1.5.0-rc.1

What's Changed

• skip building egctl for windows_arm64 by @arkodg in #5878
• docs(grpc): add note on using BackendTrafficPolicy for GPRC timeouts by @Antvirf in #5822
• ci: remove windows_arm64 uploads by @arkodg in #5884
• increase liveness probe failureThreshold for shutdown manager by @arkodg in #5877
• fix: remove sanposhiho from reviewers by @sanposhiho in #5870
• fix: make topology injector best effort by @arkodg in #5891
• docs: Change Subtitle of Concept Template by @melsal13 in #5893
• Revert "increase liveness probe failureThreshold for shutdown manager… by @arkodg in #5889
• release notes for v1.4.0-rc.2 by @arkodg in #5899
• chore: ignore api types in codecov by @shawnh2 in #5886
• chore/ci: add go.lint.fmt target by @cnvergence in #5846
• fix: staticcheck issues by @mmorel-35 in #5779
• docs: local jwks by @zhaohuabing in #5806
• disable settings by default in gateway-crds-helm by @arkodg in #5894
• Add seed corpus to guide the fuzzer to generate combinations of gatew… by @sudiptob2 in #5904
• fix(chart): passing root context to template by @hansselvig in #5902
• chore: improve merge test by @zirain in #5861
• fix: httproute precedence by considering header/query match type by @kkk777-7 in #5740
• ci: make helm-generate should failed as expected by @zirain in #5908
• docs(rate-limit): minor fix in 'Distinct Users Except Admin' section by @tomas-rojo in #5912
• adpot internals/utils/merge.Merge by @zirain in #5917
• Add Bitnami as an Envoy Gateway adopter by @carrodher in #5926
• build(deps): bump google/osv-scanner-action from 2.0.1 to 2.0.2 by @dependabot[bot] in #5920
• build(deps): bump github/codeql-action from 3.28.16 to 3.28.17 by @dependabot[bot] in #5919
• build(deps): bump github.com/valyala/fasthttp from 1.60.0 to 1.61.0 in /examples/preserve-case-backend in the github-com group across 1 directory by @dependabot[bot] in #5921
• docs: fix example for http redirects page by @mczaplinski in #5830
• docs: Add docs for request buffering by @markwinter in #5910
• feat: support configuring tls for dynamic resolver backend by @zhaohuabing in #5867
• fix: fix topology injector bug by @jukie in #5911
• feat: allow merge rate limit rule in BTP by @zirain in #5915
• docs: install EG via Argo CD by @zhaohuabing in #5824
• chore: clean up BTP status by @zhaohuabing in #5934
• e2e: test for dynamic resolver backend using system ca for TLS by @zhaohuabing in #5932
• feat: implement offline kubernetes controller by @shawnh2 in #5767
• fix: SecurityPolicy reference grant by @kkk777-7 in #5792
• fix: add validation for header values by @gavinkflam in #5933
• fix: Fixed typo in error message. by @mathias-ws in #5945
• e2e: disable DynamicResolverBackendTest on IPv6 by @zhaohuabing in #5964
• fix: proxy creation/deletion error handling in GatewayNamespace mode by @zirain in #5954
• ci: kube-deploy support KUBE_DEPLOY_PROFILE by @zirain in #5957
• fix: process remaining gatewayClasses after encountering an err by @arkodg in #5953
• fix: do not add tls inspector filter to quic listener by @Xunzhuo in #5671
• Add seed corpus related to traffic task. by @sudiptob2 in #5947
• [release/v1.3] release v1.3.3 notes by @guydc in #5969
• e2e: fix PreserveCase flaky by @zirain in #5966
• feat: validate JWT token and use projected token by @cnvergence in #5871
• feat: add controller namespace field to infrastructure render by @cnvergence in #5937
• e2e: GatewayNamespace mode by @zirain in #5961
• helm: support standard channel by @zhaohuabing in #5958
• e2e: bump upgrade test version to v1.3.2 by @zirain in #5976
• fix: add validation for duplicated API keys by @gavinkflam in #5955
• [release/v1.3] update site to use v1.3.3 by @guydc in #5980
• docs: dynamic resolver backend by @zhaohuabing in #5935
• Fuzzing: Fail on xds translation error by @sudiptob2 in #5986
• fix btp merge not working when there's multi parent refs on router by @zirain in #5967
• e2e: fix GRPCExtAuth flaky by @zirain in #5987
• chore: add coverpkg for coverage test by @shawnh2 in #5991
• ci: enable conformance test for GatewayNamespaceMode by @zirain in #5992
• e2e: add CollectAndDump for EGUpgrade test by @zirain in #5998
• e2e: add test for BTP timeout by @zirain in #5994
• Remoe check for accesslog formatter by @zirain in #5985
• e2e: fix GRPCExtAuth/http_route_with_ext_auth_authentication by @zirain in #6001
• chore: update dependabot by @zirain in #6007
• e2e: update CORS test by @zirain in #6011
• chore: add multiple gateways testdata for GatewayNamespace mode by @cnvergence in #5972
• feat: adds support for extension server in standalone mode by @mathetake in #5984
• docs: Add new conceptual pages for intro concepts by @melsal13 in #5981
• docs: update open graph image by @missBerg in #6022
• temporarily disable the backend tls test by @zhaohuabing in #6030
• Fix lint by @zhaohuabing in #6031
• fix: allows offline k8s controller to use non default CRDs by @mathetake in #6020
• e2e: refactor ratelmit test by @zirain in #5997
• moved shared under rules by @ryanhristovski in #5944
• docs: fix path to og:image by @missBerg in #6046
• version and release notes for v1.4.0 by @arkodg in #6048
• docs: add cherry-pick range example in release steps by @arkodg in #6045
• docs: clean up quickstart by @arkodg in #6051
• Release news for v1.4.0 by @arkodg in #6050
• chore: publish shouldnt wait for resilience-test by @arkodg in #6053
• docs: fix v1.4 release news by @arkodg in #6058
• build(deps): bump the gomod group across 6 directories with 8 updates by @dependabot[bot] in #6016
• build(deps): bump the gomod group across 2 directories with 3 updates by @dependabot[bot] in #6060
• v1.4 docs by @zhaohuabing in #6052
• update release process by @zhaohuabing in #6063
• e2e: fix EnvoyProxyCustomName by @zirain in #6014
• fix: custom controller namespace refs in gateway namespace mode by @cnvergence in #6065
• e2e: fix BackendUpgrade flaky by @zirain in #6038
• build(deps): bump actions/setup-go from 5.4.0 to 5.5.0 in /tools/github-actions/setup-deps in the github-actions group across 1 directory by @dependabot[bot] in #6004
• e2e: fix backend tls test by @zhaohuabing in #6029
• pin envoy imag...

latest

This is the "latest" release of Envoy Gateway, which contains the most recent commits from the main branch.

This release might not be stable.

It is only intended for developers wishing to try out the latest features in Envoy Gateway, some of which may not be fully implemented.

We use v0.0.0-latest as the latest chart version to install latest envoy-gateway:

helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace

Try latest version of egctl with:

curl -Ls https://gateway.envoyproxy.io/get-egctl.sh | VERSION=latest bash

v1.4.2

Release Announcement

Check out the v1.4.2 release announcement to learn more about the release.

Security Updates

• Disabled automountServiceAccountToken for proxy and ratelimit deployments and serviceAccounts.

Bug Fixes

• Fixed issue where EnvoyExtensionPolicy ExtProc body processing mode was set to FullDuplexStreamed, but trailers were not sent.
• Fixed validation issue where EnvoyExtensionPolicy ExtProc with failOpen set to true did not reject the FullDuplexStreamed body processing mode.
• Fixed issue where EnvoyPatchPolicy could not replace the telemetry cluster.
• Added validation for section names in Gateway listeners.
• Added ConfigMap indexers for EnvoyExtensionPolicies to reconcile Lua changes.
• Fixed issue where the default access log format was not working.
• Fixed bug where backendRequestTimeout was incorrectly set when retries were enabled.
• Fixed certificate SANs overlap detection in listeners.
• Fixed issue where telemetry did not work when using host port.
• Fixed bug where BackendTLSPolicy incorrectly referenced ConfigMaps or Secrets across namespaces.

What's Changed

• [release/v1.4] cherry pick v1.4.2 by @shawnh2 in #6452
• [release/1.4] release note for 1.4.2 by @zhaohuabing in #6465

Full Changelog: v1.4.1...v1.4.2

v1.4.1

Release Announcement

Check out the v1.4.1 release announcement to learn more about the release.

New Features

• Added support for configuring Subject Alternative Names (SANs) for upstream TLS validation via BackendTLSPolicy.validation.subjectAltNames.
• Added support for setting ownerreference to infra resources when Gateway Namespace mode is enabled.

Bug Fixes

• Fixed OverlappingTLSConfig condition for merged Gateways.
• Fixed an issue with shared rules in the rate limit translator when clientSelector is not specified.
• Fixed an issue with handling integer values in zone annotations.
• Fixed an issue where routes without WASM in their EnvoyExtensionPolicies returned HTTP 500 responses when WASM cache initialization failed.
• Fixed an issue where UDP listeners were not created in the Envoy proxy’s xDS configuration.
• Fixed broken rate limit merging for BackendTrafficPolicy when the Gateway target defines rate limiting but the Route target does not.
• Fixed an issue that preserves ALPN configuration for listeners with overlapping certificates when ALPN is explicitly set in ClientTrafficPolicy.
• Replaced static UID with a dynamic UID for the global rate limit Grafana dashboard.

Other changes

• Fixed backend TLS e2e test.
• Bumped go version to 1.24.3.

What's Changed

• [release/v1.4] fix: custom controller namespace refs in gateway namespace mode by @cnvergence in #6067
• [release/v1.4] fix: missing v1.4 deployment yaml to Gateway Namespace Mode docs by @cnvergence in #6141
• [release/v1.4] Cherry Pick fixes into v1.4.1 by @arkodg in #6258
• [release/v1.4] pin ratelimit tag by @shawnh2 in #6255
• [release/v1.4] add release notes by @shawnh2 in #6260
• [release/v1.4] update version by @shawnh2 in #6261
• [release/v1.4] skip RateLimitGlobalMergeTest for gateway namespace mode by @arkodg in #6262

Full Changelog: v1.4.0...v1.4.1

v1.4.0

Release Announcement

Check out the v1.4.0 release announcement to learn more about the release.

What's Changed

• docs: tracing sampling fraction by @zirain in #5131
• doc: response compression by @zhaohuabing in #5071
• docs: how to specify a self-signed ca for the remote jwks host in the SP JWT settings. by @zhaohuabing in #5085
• chore: fix gen by @zhaohuabing in #5166
• docs: add api key auth instructions by @nothinux in #5097
• add SECURITY.md by @arkodg in #5167
• chore: link SECURITY.md by @arkodg in #5168
• build(deps): bump actions/stale from 9.0.0 to 9.1.0 by @dependabot in #5162
• docs: rm sectionName from some of the examples by @arkodg in #5173
• ci(fix): osv-scanner PR mode by @shahar-h in #5174
• wip: docs: add standalone in container instruction by @dshatokhin in #5172
• docs: update prerequisites files with installation and connectivity t… by @DeeBi9 in #5094
• [release/v1.3] fix 1.3.0-rc.1 release note by @guydc in #5175
• fail validation if baseInterval is 0s by @arkodg in #5176
• [release/1.3] release notes by @guydc in #5177
• add link for adopters by @arkodg in #5183
• copy some docs into current docs by @arkodg in #5185
• fix shortcodes and version location by @guydc in #5184
• Make panic threshold configurable for cluster by @nezdolik in #5118
• docs: add a adopter readme by @arkodg in #5187
• build(deps): bump actions/setup-node from 4.1.0 to 4.2.0 by @dependabot in #5163
• build(deps): bump the k8s-io group across 2 directories with 1 update by @dependabot in #5157
• build(deps): bump the golang-org group across 2 directories with 2 updates by @dependabot in #5158
• build(deps): bump helm.sh/helm/v3 from 3.16.4 to 3.17.0 by @dependabot in #5160
• build(deps): bump codecov/codecov-action from 5.1.2 to 5.3.1 by @dependabot in #5164
• build(deps): bump github.com/ohler55/ojg from 1.26.0 to 1.26.1 by @dependabot in #5044
• build(deps): bump actions/setup-go from 5.2.0 to 5.3.0 in /tools/github-actions/setup-deps by @dependabot in #5165
• add title for adopters by @arkodg in #5196
• build(deps): bump github/codeql-action from 3.27.9 to 3.28.8 by @dependabot in #5189
• build(deps): bump github.com/docker/cli from 27.5.0+incompatible to 27.5.1+incompatible by @dependabot in #5159
• chore: bump go 1.23.5 by @zirain in #5190
• fix build extension-server by @zirain in #5199
• chore: bump go 1.23.6 by @zirain in #5204
• Update Code Reviewers by @arkodg in #5218
• Gateway API - support percentage-based-request-mirroring by @LiorLieberman in #5212
• chore: fix wrong example by @zirain in #5224
• chore: add test for patch ratelimit env by @zirain in #5221
• chore: run gofumpt by @zirain in #5222
• Add conformance e2e test for panic mode by @nezdolik in #5213
• docs: add docs link for envoyGateway configuration in helm chart by @arkodg in #5231
• chore: add coactiveai adopter logo svg and data by @ross-at-coactive in #5233
• build(deps): bump github.com/miekg/dns from 1.1.62 to 1.1.63 by @dependabot in #5243
• build(deps): bump the golang-org group across 2 directories with 2 updates by @dependabot in #5239
• fix: implement num-route-per-host for benchmark scale_httproutes case by @shawnh2 in #5235
• docs: fix config for api key by @arkodg in #5250
• feat: Add support for MaxUnavailable in KubernetesPodDisruptionBudgetSpec by @jukie in #5209
• docs: fixed the documentation for multiple request mirrorfilter docs by @Anu-Ra-g in #5234
• xds: use a dedicated listener port for envoy proxy readiness by @zirain in #5197
• build(deps): bump github.com/docker/docker from 27.5.0+incompatible to 27.5.1+incompatible by @dependabot in #5242
• chore: read go version from gomod by @zirain in #5262
• build(deps): bump github/codeql-action from 3.28.8 to 3.28.9 by @dependabot in #5244
• feat: add defaulter for gateway-api resources loading from file by @shawnh2 in #5232
• chore: bump deps by @zirain in #5263
• Add support for MatchExpressions by @dprotaso in #5201
• feat: implement Lua EnvoyExtensionPolicy by @rudrakhp in #5171
• docs: Lua EnvoyExtensionPolicy by @rudrakhp in #5270
• docs: added BootstrapConfig for Merge Option by @Anu-Ra-g in #5259
• chore: refactor ext auth e2e by @zirain in #5271
• chore: add canva to ignore lint list by @Xunzhuo in #5279
• docs: add Canva logo to the adopters list by @harrisonturton in #5274
• docs: add secret enum in envoyPatchPolicy by @arkodg in #5268
• fix: Fixed egctl build for windows by @Anu-Ra-g in #5284
• fix: sort the missing resources to fix the gen-check by @shawnh2 in #5286
• docs: fix broken steps in prerequisites by @Nishikoh in #5296
• docs: site design update by @missBerg in #5285
• chore: bump go to 1.24 by @zirain in #5287
• build(deps): bump sigs.k8s.io/kind from 0.26.0 to 0.27.0 in /tools/src/kind by @dependabot in #5295
• build(deps): bump helm.sh/helm/v3 from 3.17.0 to 3.17.1 by @dependabot in #5291
• build(deps): bump the golang-org group across 2 directories with 1 update by @dependabot in #5290
• build(deps): bump github.com/golangci/golangci-lint from 1.63.4 to 1.64.5 in /tools/src/golangci-lint by @dependabot in #5294
• build(deps): bump github.com/evanphx/json-patch/v5 from 5.9.0 to 5.9.11 by @dependabot in #5293
• api: BackendTrafficPolicy DNSLookupFamily by @guydc in #5249
• chore: ignore sched.co by @zirain in #5305
• build(deps): bump the k8s-io group by @zirain in #5309
• fix: latest release failed for cache overlimit by @Xunzhuo in #5316
• validate all xds resources before returning the translation result by @zhaohuabing in #5148
• chore: move ratelimit per-route config to typedPerFilterConfig by @zhaohuabing in #5072
• chore: use go tool by @zirain in #5304
• feat: support HPA in helm chart by @Dean-Coakley in #5127
• fix: Allow weights to be zero on endpoints by @tobrien-nydig in #5278
• feat: Add RequestID to ClientTrafficPolicy for controlling X-Request-ID header behavior by @jukie in #5283
• api: HTTP header and method based authz by @zhaohuabing in #5310
• site: fix styling issues wrt fonts and headings by @missBerg in #5333
• docs: adding SAP as an adopter by @guydc in #5343
• feat: support adding additional labels to dashboard configmap by @fengxsong in #5317
• build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @dependabot in https://github.com/envoyproxy/gatew...

v1.3.3

Release Announcement

Check out the v1.3.3 release announcement to learn more about the release.

Bug fixes

• Fix issue where ReferenceGrant from SecurityPolicy to the referenced RemoteJWKS backend was not respected.
• Fix HTTPRoute precedence by correctly considering header and query match types.
• Fix to return an error if direct response size exceeds the limit.
• Fix to avoid adding the TLS inspector filter to QUIC listeners.
• Fix to continue processing remaining GatewayClasses after encountering an error.
• Add validation for header values.

Other changes

• Bumped envoy to v1.33.3.
• Bumped ratelimit to 3e085e5b.

What's Changed

• [release/v1.3] release v1.3.3 cherry-pick by @guydc in #5951
• [release/v1.3] pin envoy and ratelimit by @guydc in #5968
• [release/v1.3] Release version v1.3.3 by @guydc in #5970
• [release/v1.3] bump cc action by @guydc in #5975

Full Changelog: v1.3.2...v1.3.3

v1.4.0-rc.2

Envoy Gateway v1.4.0-rc.2 Release Candidate