CHANGELOG.old-pro.md
DO NOT EDIT THIS FILE FOR ANY NEW DEVELOPMENT.
This is the CHANGELOG for the old "Ambassador Pro" product that was an add-on to the Ambassador API Gateway. In 1.0.0, Ambassador Pro and the Ambassador API Gateway were merged in to a combined "Ambassador Edge Stack" product.
Behavior:
apictl traffic initialize no longer waits for the traffic-proxy to become ready before exiting.v1 license keys were not being used so augment them to include emails/callback to /.ambassador/oauth2/redirection-endpoint. Migrating Pro users will need to notify thier IDP of the change.Other:
amb-core and amb-sidecar have been merged in to a combined aes which is based on Ambassador OSS [version TBD].login-gate-jscontent has been updated for a clearer first time experience.Configuration:
JWT Filter now has a realm setting to configure the realm mentioned in WWW-Authenticate of error responses.JWT Filter now has a FilterPolicy argument scope to preform draft-ietf-oauth-token-exchange-compatible Scope validation.OAuth2 Filter now has a .insteadOfRedirect.filters FilterPolicy argument that lets you provide a list of filters to run; as if you were listing them directly in a FilterPolicy.OAuth2 Filter now has a extraAuthorizationParameters setting to manually pass extra parameters to the IDP's authorization endpoint.OAuth2 Filter now has a accessTokenJWTFilter setting to use a JWT filter for access token validation when accessTokenValidation: jwt or accessTokenValidation: auto.Behavior:
JWT Filter now generates RFC 6750-compliant responses with the WWW-Authenticate header set.Other:
Configuration:
FilterPolicy may now set ifRequestHeader to only apply a Filter to requests with appropriate headers.FilterPolicy may now set onDeny and onAllow to modify how Filters chain together.JWT Filter injectRequestHeaderse templates can now read the incoming HTTP request headers.JWT Filter errorResponse can now set HTTP headers of the error response.OAuth2 Filter can now be configured to receive OAuth client credentials in the HTTP request header, and use them to obtain a client credentials grant. This is only currently tested with Okta.Behavior:
OAuth2 filter's XSRF protection now works differently. You should use the ambassador_xsrf.{name}.{namespace} cookie instead of the ambassador_session.{name}.{namespace} cookie for XSRF-protection purposes.Configuration:
JWT and OAuth2 Filter types support renegotiateTLSJWT Filter now has an errorResponse argument that allows templating the filter's error response.Other:
Configuration
OAuth2 filter now has a FilterPolicy argument insteadOfRedirect that can specify a different action to perform than redirecting to the IDP.Behavior:
ambassador-pro-devportal Mapping CRD (or annotation) by changing the prefix to desired prefix and changing the rewrite to /docs/. The ambassador-pro-devportal-api can not be adjusted yet.OAuth2 filter can now perform OIDC-session RP-initiated logout when used with an identity provider that supports it.JWT Filter is no longer case-sensitive with the auth-scheme (Bearer vs bearer)JWT Filter no longer accepts authorizations that are missing an auth-schemeOther:
Configuration:
amb-sidecar now takes additional configuration related to the developer portal.Behavior:
External Filter no longer erroneously follows redirects.JWT Filter to be inoperable.Filter resource definitions are now recorded and included in error messages.Configuration:
amb-sidecar: The default value of USE_STATSD has changed from true to false.JWT Filter can now inject HTTP request headers; configured with the injectRequestHeaders field.Behavior:
Other:
Configuration:
ambassador_id may now be a single string instead of a list of strings (this should have always been the case, but there was a bug in the parser).APRO_HTTP_PORT, which defaults to 8500.LOG_LEVEL no longer exists; everything obeys APP_LOG_LEVEL.REDIS_POOL_SIZE has changed slightly; there are no longer separate connection pools for ratelimit and filtering; the maximum number of connections is now REDIS_POOL_SIZE instead of 2×REDIS_POOL_SIZE.amb-sidecar RateLimitService can now report to statsd, and attempts to do so by default (USE_STATSD, STATSD_HOST, STATSD_PORT, GOSTATS_FLUSH_INTERVAL_SECONDS).Behavior:
envoy.service.auth.v2, in addition to envoy.service.auth.v2alpha.Configuration:
amb-sidecar environment variables $APRO_PRIVATE_KEY_PATH and $APRO_PUBLIC_KEY_PATH are replaced by a Kubernetes secret and the $APRO_KEYPAIR_SECRET_NAME and $APRO_KEYPAIR_SECRET_NAMESPACE environment variables.$APRO_KEYPAIR_SECRET_NAME Kubernetes secret (above) does not exist, amb-sidecar now needs the "create" permission for secrets in its ClusterRole.OAuth2 Filter now ignores the audience field setting. I expect it to make a come-back in 0.5.1 though.OAuth2 Filter now acts as if the openid scope value is always included in the FilterPolicy's scopes argument.OAuth2 Filter can verify Access Tokens with several different methods; configured with the accessTokenValidation field.Behavior:
OAuth2 Filter is now strictly compliant with OAuth 2.0. It is verified to work properly with:
OAuth2 Filter browser cookie has changed:
ambassador_session.{{filter_name}}.{{filter_namespace}} instead of access_token.Authorization header.OAuth2 Filter will no longer consider a user-agent-provided Authorization header, it will only consider the cookie.OAuth2 Filter now supports Refresh Tokens; they must be requested by listing offline_access in the scopes argument in the FilterPolicy.OAuth2 Filter's /callback endpoint is no longer vulnerable to XSRF attacksOther:
/*.opensource.tar.gz.apictl traffic initialize: Correctly handle non-default namespacesapp-sidecar: Respect the APP_LOG_LEVEL environment variable, same as amb-sidecarMoved all of the default sidecar ports around; YAML will need to be adjusted (hence 0.4.0 instead of 0.3.2). Additionally, all of the ports are now configurable via environment variables
| Purpose | Variable | Old | New |
|---|---|---|---|
| Auth gRPC | APRO_AUTH_PORT | 8082 | 8500 |
| RLS gRPC | GRPC_PORT | 8081 | 8501 |
| RLS debug (HTTP) | DEBUG_PORT | 6070 | 8502 |
| RLS HTTP ??? | PORT | 7000 | 8503 |
apictl no longer sets an imagePullSecret when deploying Pro things to the cluster (since the repo is now public)
ExternalOAuth2 Filter type supports secretName and secretNamespaceallowed_request_headers or allowed_authorization_headers for Plugin Filtersinfo instead of warn(0.3.0 was initially tagged as 0.2.5)
JWT and OAuth2 Filter types support insecureTLSOAuth2 now handles JWTs with a scope claim that is a JSON list of scope values, instead of a JSON string containing a whitespace-separated list of scope values (such as those generated by UAA)APRO_AUTH_PORTapictl traffic inject wiped existing imagePullSecretsAMBASSADOR_ID, AMBASSADOR_SINGLE_NAMESPACE, and AMBASSADOR_NAMESPACETenant and Policy CRDs with Filter and FilterPolicy CRDsapro-plugin-runner (previously was in a separate OSS git repo)apictl traffic sets imagePullSecretapictl also look for the license key in ~/.config/ as a fallback on macOS. The paths it now looks in, from highest to lowest precedence, are:
$HOME/Library/Application Support/ambassador/license-key (macOS only)${XDG_CONFIG_HOME:-$HOME/.config}/ambassador/license-key$HOME/.ambassador.key