changelogs/CHANGELOG-v1.15.0.md
We are delighted to present version 1.15.0 of Contour, our layer 7 HTTP reverse proxy for Kubernetes clusters.
A big thank you to everyone who contributed to the release.
Contour v1.15.0 supports GatewayAPI v0.3.0 which was released on 04/29/21. Not all of the features in GatewayAPI are fully supported yet in Contour, however, v1.15.0 adds some new features outlined below:
If you're interested in following the GatewayAPI implementation progress in Contour, issue #2287 is the Epic issue which outlines all the features that have been implemented as well as those that are still not yet complete.
Contour 1.15 improves its IPv6 support. Bootstrap clusters with IP addresses are now configured as STATIC in Envoy, to fix an issue where IPv6 addresses were not properly parsed (#3572). Also, IPv6 addresses are now consistently accepted as flag values (#3579). Thanks @sunjayBhatia for fixing these issues!
Contour 1.15 adds support for the HeaderValueMatch rate limiting descriptor type, which allows for generation of descriptor entries based on complex matching against header values. As part of this, "notpresent" is now a supported header match operator (#3599 #3602). For more information, see the global rate limiting documentation. Thanks to @skriss for implementing this feature.
As part of fully supporting the Ingress v1 API, Contour now supports Ingresses with wildcard hosts. The first DNS label in a host name can be a wildcard, e.g. *.projectcontour.io, which will match foo.projectcontour.io but not foo.bar.projectcontour.io. You can read more about the API spec in the Kubernetes Ingress documentation. This was implemented by @sunjayBhatia in #3381.
HTTPProxy now supports skipping verification when client certificates are requested for downstream TLS, via the spec.virtualhost.tls.clientValidation.skipClientCertValidation field. This is not enabled by default. This can be used in conjunction with an external authorization server as Envoy will still require client certificates to be supplied, and will pass them along to the external authorization server for verification (#3611). Thanks to @sunjayBhatia for implementing this feature!
Contour's shutdown-manager now supports a customizable admin port, via the --admin-port flag (#3501). Thanks to @alessandroargentieri for implementing this!
Contour 1.15 is compatible with Envoy 1.18.2 (#3589). For more information, see the Contour compatibility matrix.
Contour 1.15 is supported on Kubernetes 1.21 (#3581 #3609). For more information, see the Contour compatibility matrix.
HTTPProxy also had headers being set (#3550). Thanks @mattatcha for finding and fixing!Please consult the upgrade documentation.
We’re immensely grateful for all the community contributions that help make Contour even better! For this release, special thanks go out to the following contributors:
If you're using Contour and want to add your organization to our adopters list, please visit this page. If you prefer to keep your organization name anonymous but still give us feedback into your usage and scenarios for Contour, please post on this GitHub thread.