🎉 Emissary v4.1.0 🎉

Emissary-ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Get started with Emissary-ingress - https://emissary-ingress.dev/docs/v4.1.0/quick-start/
View changelog - https://github.com/emissary-ingress/emissary/blob/v4.1.0/CHANGELOG.md

Changes

• Update: Upgrade from Envoy 1.36.2 to Envoy 1.37.2 (1.37.0 release notes,
  1.37.1 release notes, 1.37.2 release notes).

• Fix: IR.check_deltas now forces a complete reconfigure whenever the
  cache is present but the incoming snapshot has no deltas. Previously,
  an empty-delta snapshot with a cached entry kept the stale entry around
  until another delta happened to arrive, which caused the Istio mTLS
  cert-rotation failure described in #4744 (thanks, Jonathan Bailey!).

🎉 Emissary v4.1.0-rc.0 🎉

Emissary-ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Get started with Emissary-ingress - https://emissary-ingress.dev/docs/v4.1.0-rc.0/quick-start/
View changelog - https://github.com/emissary-ingress/emissary/blob/v4.1.0-rc.0/CHANGELOG.md

Changes

• Update: Upgrade from Envoy 1.36.2 to Envoy 1.37.2 (1.37.0 release notes,
  1.37.1 release notes, 1.37.2 release notes).

• Fix: IR.check_deltas now forces a complete reconfigure whenever the
  cache is present but the incoming snapshot has no deltas. Previously,
  an empty-delta snapshot with a cached entry kept the stale entry around
  until another delta happened to arrive, which caused the Istio mTLS
  cert-rotation failure described in #4744 (thanks, Jonathan Bailey!).

🎉 Emissary v4.0.1 🎉

Emissary-ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Get started with Emissary-ingress - https://emissary-ingress.dev/docs/v4.0.1/quick-start/
View changelog - https://github.com/emissary-ingress/emissary/blob/v4.0.1/CHANGELOG.md

(Note that Emissary v4.0.0 was never published due to a CI glitch. v4.0.1 is the correct first release of Emissary 4.)

Quickstart

Emissary v4 supports both AMD64 and ARM64 architectures. To install Emissary v4 using Helm, follow the instructions in the Emissary Quickstart.

Emissary provides two Helm charts:

• ghcr.io/emissary-ingress/emissary-crds-chart is the chart for Emissary's CRDs.

• ghcr.io/emissary-ingress/emissary-ingress is the chart for Emissary itself.

The Emissary project recommends using Helm to install Emissary. If you need YAML instead, use helm template to generate the YAML manifests from the Helm charts.

Breaking Changes

• BREAKING CHANGE: Emissary is now built using distroless and Envoy 1.36.2 with no custom Envoy changes, and almost all code specific to Ambassador Edge Stack has been removed to lessen maintenance burdens (with thanks to Luke Shumaker for jumping back in to help with tooling work!).

  As a result, Ambassador Edge Stack's custom error responses and header-case mangling features are completely unavailable in Emissary (which should not affect any Emissary users).

• BREAKING CHANGE: The Helm chart and Emissary itself now have aligned version numbers (e.g., use chart 4.0.1 to install Emissary 4.0.1).

• BREAKING CHANGE: Emissary's Helm charts are now available only from the GitHub Container Registry (GHCR):

• BREAKING CHANGE: By default, the Emissary CRD Helm chart will not enable the conversion webhook that supports Emissary's v1 and v2 CRDs. To enable the webhook:

  • Set enableLegacyVersions: true to enable the conversion webhook with support for v2 CRDs.

  • Also set enableV1: true to additionally support v1 CRDs. There is no way to support only v1 CRDs.

• BREAKING CHANGE: Support for the extra metrics endpoint (set by supplying --metrics-endpoint on the command line for diagd) has been removed. This was a holdover from Ambassador Edge Stack (thanks to
  Jeremy Dinsel for the report!)

• BREAKING CHANGE: The default --banner-endpoint argument has been removed, since it was a holdover from Ambassador Edge Stack. If you want to use the diagnostics-banner functionality, you can now set AMBASSADOR_DIAGD_BANNER_ENDPOINT in the environment to the URL from which to fetch the banner.

Changes

• Fix: Correctly distinguish Mappings that differ only by weight, even when some weights are missing (thanks, sekar-saravanan!).

• Fix: Generate correct cache keys for Mappings using header_regex match conditions (thanks, sekar-saravanan!).

• Fix: Document the loadBalancerSourceRanges value in the Helm chart (thanks, Abhay Bothra!).

• Fix: The Helm chart no longer sets a CPU limit on Emissary's deployments (thanks, Frederic Mereu!).

• Fix: The Helm chart's initContainers are now correctly indented (thanks, Catalin Codreanu!).

• Fix: The Helm chart now correctly restores the HOST_IP value for tracing providers (thanks, Tenshin Higashi!).

• Fix: Update many dependencies and the Python interpreter to resolve CVEs (thanks, Bhargav Joshi!)

• Fix: When the conversion webhook is active and Emissary is instructed to wait for the webhooks at boot time, this is now completely internal rather than requiring an extra init container.

• Fix: When trying to use environment variables to tell the conversion webhook not to manage aspects of its certificate, don't invert the meaning of the environment variables.

• Fix: The diagnostics UI refers to Emissary (instead of Ambassador) and links to emissary-ingress.dev's docs.

• Fix: Emissary now uses the current string_match Envoy HeaderMatcher stanza rather than the deprecated exact_match stanza.

• Feature: Emissary now supports both arm64 and amd64 architectures using multiarch Docker images.

• Feature: When the emissary-apiext deployment is in use, the Helm chart correctly sets its securityContext (thanks, Frederic Mereu!).

• Feature: The Helm chart can now supply a loadBalancerClass on Emissary's Services (thanks, Sunny Kumar!).

• Feature: The Helm chart supports setting the IP address family for Emissary's Services, and disabling the creation of a Module entirely (thanks, Pier!).

🎉 Emissary v4.0.1-rc.0 🎉

Emissary-ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Get started with Emissary-ingress - https://emissary-ingress.dev/docs/v4.0.1-rc.0/quick-start/
View changelog - https://github.com/emissary-ingress/emissary/blob/v4.0.1-rc.0/CHANGELOG.md

🎉 Emissary v4.0.0-rc.2 🎉

Emissary-ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Get started with Emissary-ingress - https://emissary-ingress.dev/docs/v4.0.0-rc.2/quick-start/
View changelog - https://github.com/emissary-ingress/emissary/blob/v4.0.0-rc.2/CHANGELOG.md

Quickstart

Emissary v4 supports both AMD64 and ARM64 architectures. To install Emissary v4 using Helm, follow the instructions in the Emissary Quickstart.

Emissary provides two Helm charts:

• ghcr.io/emissary-ingress/emissary-crds-chart is the chart for Emissary's CRDs.

• ghcr.io/emissary-ingress/emissary-ingress is the chart for Emissary itself.

The Emissary project recommends using Helm to install Emissary. If you need YAML instead, use helm template to generate the YAML manifests from the Helm charts.

Breaking Changes since v4.0.0-rc.1

• BREAKING CHANGE: Support for the extra metrics endpoint (set by supplying --metrics-endpoint on the command line for diagd) has been removed. This was a holdover from Ambassador Edge Stack (thanks to Jeremy Dinsel for the report!)

• BREAKING CHANGE: The default --banner-endpoint argument has been removed, since it was a holdover from Ambassador Edge Stack. If you want to use the diagnostics-banner functionality, you can now set AMBASSADOR_DIAGD_BANNER_ENDPOINT in the environment to the URL from which to fetch the banner.

Changes since v4.0.0-rc.1

• Fix: The diagnostics UI refers to Emissary (instead of Ambassador) and links to emissary-ingress.dev's docs.

• Fix: Emissary now uses the current string_match Envoy HeaderMatcher stanza rather than the deprecated exact_match stanza.

• Fix: Update many dependencies and the Python interpreter to resolve CVEs (thanks, Bhargav Joshi!).

🎉 Emissary v4.0.0-rc.1 🎉

Emissary-ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Get started with Emissary-ingress - https://emissary-ingress.dev/docs/4.0/quick-start/
View changelog - https://github.com/emissary-ingress/emissary/blob/v4.0.0-rc.1/CHANGELOG.md

Quickstart

Emissary v4 supports both AMD64 and ARM64 architectures. To install Emissary v4 using Helm, follow the instructions in the Emissary Quickstart.

Emissary provides two Helm charts:

• ghcr.io/emissary-ingress/emissary-crds-chart is the chart for Emissary's CRDs.

• ghcr.io/emissary-ingress/emissary-ingress is the chart for Emissary itself.

The Emissary project recommends using Helm to install Emissary. If you need YAML instead, use helm template to generate the YAML manifests from the Helm charts.

Breaking Changes

• BREAKING CHANGE: Emissary is now built using distroless and Envoy 1.36.2 with no custom Envoy changes, and almost all code specific to Ambassador Edge Stack has been removed to lessen maintenance burdens (with thanks to Luke Shumaker for jumping back in to help with tooling work!).

  As a result, Ambassador Edge Stack's custom error responses and header-case mangling features are completely unavailable in Emissary (which should not affect any Emissary users).

• BREAKING CHANGE: The Helm chart and Emissary itself now have aligned version numbers (e.g., use chart 4.0.0 to install Emissary 4.0.0).

• BREAKING CHANGE: Emissary's Helm charts are now available only from the GitHub Container Registry (GHCR):

• BREAKING CHANGE: By default, the Emissary CRD Helm chart will not enable the conversion webhook that supports Emissary's v1 and v2 CRDs. To enable the webhook:

  • Set enableLegacyVersions: true to enable the conversion webhook with support for v2 CRDs.

  • Also set enableV1: true to additionally support v1 CRDs. There is no way to support only v1 CRDs.

Changes

• Fix: Correctly distinguish Mappings that differ only by weight, even when some weights are missing (thanks, sekar-saravanan!).

• Fix: Generate correct cache keys for Mappings using header_regex match conditions (thanks, sekar-saravanan!).

• Fix: Document the loadBalancerSourceRanges value in the Helm chart (thanks, Abhay Bothra!).

• Fix: The Helm chart no longer sets a CPU limit on Emissary's deployments (thanks, Frederic Mereu!).

• Fix: The Helm chart's initContainers are now correctly indented (thanks, Catalin Codreanu!).

• Fix: The Helm chart now correctly restores the HOST_IP value for tracing providers (thanks, Tenshin Higashi!)

• Fix: When the conversion webhook is active and Emissary is instructed to wait for the webhooks at boot time, this is now completely internal rather than requiring an extra init container.

• Fix: When trying to use environment variables to tell the conversion webhook not to manage aspects of its certificate, don't invert the meaning of the environment variables.

• Feature: Emissary now supports both arm64 and amd64 architectures using multiarch Docker images.

• Feature: When the emissary-apiext deployment is in use, the Helm chart correctly sets its securityContext (thanks, Frederic Mereu!).

• Feature: The Helm chart can now supply a loadBalancerClass on Emissary's Services (thanks, Sunny Kumar!).

• Feature: The Helm chart supports setting the IP address family for Emissary's Services, and disabling the creation of a Module entirely (thanks, Pier!).

🎉 Emissary Ingress 3.10.0 🎉

Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Get started with Emissary - https://emissary-ingress.dev/docs/3.10/quick-start/
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.10.0/CHANGELOG.md

• Change: The Emissary images are now hosted at GHCR rather than at DockerHub.

  • The main Emissary image is at ghcr.io/emissary-ingress/emissary:3.10.0
  • The (new) Helm chart for the Emissary CRDs is at ghcr.io/emissary-ingress/emissary-crds-charts
  • The Helm chart for the Emissary control plane is at ghcr.io/emissary-ingress/emissary-chart

  See the Quickstart for more details.

• Feature: This upgrades Emissary-ingress to be built on Envoy v1.28.0 which provides security,
  performance and feature enhancements. You can read more about them here: Envoy Proxy
  1.28.0 Release Notes

• Change: Emissary-ingress will no longer publish YAML manifests with the Ambassador Agent being
  installed by default.

• Change: Upgraded Emissary-ingress to the latest release of Golang as part of our general
  dependency upgrade process.

• Bugfix: Emissary-ingress was incorrectly caching Mappings with regex headers using the header name
  instead of the Mapping name, which could reduce the cache's effectiveness. This has been fixed so
  that the correct key is used. (Incorrect Cache Key for Mapping)

🎉 Emissary Ingress 3.9.1 🎉

Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.9.1/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

• Bugfix: Previously, after reconfiguration, routes could briefly be misconfigured due to a shift in
  the routes list. This has now been patched. Thanks to Joe
  Andaverde for contributing this bugfix!

🎉 Emissary Ingress Chart 8.9.1 🎉

Upgrade Emissary - https://www.getambassador.io/reference/upgrading#helm.html
View changelog - https://github.com/emissary-ingress/emissary/blob/master/charts/emissary-ingress/CHANGELOG.md

• Upgrade Emissary to v3.9.1 CHANGELOG
• Fix: Route Shifting Bug

🎉 Emissary Ingress 3.9.0 🎉

Emissary Ingress is an open source, Kubernetes-native microservices API gateway built on the Envoy Proxy.

Upgrade Emissary - https://www.getambassador.io/reference/upgrading.html
View changelog - https://github.com/emissary-ingress/emissary/blob/v3.9.0/CHANGELOG.md
Get started with Emissary on Kubernetes - https://www.getambassador.io/user-guide/getting-started

• Feature: This upgrades Emissary-ingress to be built on Envoy v1.27.2 which provides security,
  performance and feature enhancements. You can read more about them here: Envoy Proxy
  1.27.2 Release Notes

• Feature: By default, Emissary-ingress will return an UNAVAILABLE code when a request using gRPC
  is rate limited. The RateLimitService resource now exposes a new
  grpc.use_resource_exhausted_code field that when set to true, Emissary-ingress will return a
  RESOURCE_EXHAUSTED gRPC code instead. Thanks to Jerome
  Froelich for contributing this feature!

• Feature: Envoy runtime fields that were provided to mitigate the recent HTTP/2 rapid reset
  vulnerability can now be configured via the Module resource so the configuration will persist
  between restarts. This configuration is added to the Envoy bootstrap config, so restarting
  Emissary is necessary after changing these fields for the configuration to take effect.

• Change: APIExt would previously allow for TLS 1.0 connections. We have updated it to now only use
  a minimum TLS version of 1.3 to resolve security concerns.

• Change: - Update default image to Emissary-ingress v3.9.0.
  

• Bugfix: The APIExt server provides CRD conversion between the stored version v2 and the version
  watched for by Emissary-ingress v3alpha1. Since this component is required to operate
  Emissary-ingress, we have introduced an init container that will ensure it is available before
  starting. This will help address some of the intermittent issues seen during install and
  upgrades.