Skip to content

Latest commit

 

History

History
119 lines (109 loc) · 17.8 KB

current.rst

File metadata and controls

119 lines (109 loc) · 17.8 KB

1.21.0 (Pending)

Incompatible Behavior Changes

Changes that are expected to cause an incompatibility if applicable; deployment changes are likely required

  • auto_config: :ref:`auto_config: <envoy_v3_api_field_extensions.upstreams.http.v3.HttpProtocolOptions.auto_config>` now verifies that any transport sockets configured via :ref:`transport_socket_matches <envoy_v3_api_field_config.cluster.v3.Cluster.transport_socket_matches>` support ALPN. This behavioral change can be temporarily reverted by setting runtime guard envoy.reloadable_features.correctly_validate_alpn to false..
  • xds: * became a reserved name for a wildcard resource that can be subscribed to and unsubscribed from at any time. This is a requirement for implementing the on-demand xDSes (like on-demand CDS) that can subscribe to specific resources next to their wildcard subscription. If such xDS is subscribed to both wildcard resource and to other specific resource, then in stream reconnection scenario, the xDS will not send an empty initial request, but a request containing * for wildcard subscription and the rest of the resources the xDS is subscribed to. If the xDS is only subscribed to wildcard resource, it will try to send a legacy wildcard request. This behavior implements the recent changes in :ref:`xDS protocol <xds_protocol>` and can be temporarily reverted by setting the envoy.restart_features.explicit_wildcard_resource runtime guard to false.

Minor Behavior Changes

Changes that may cause incompatibilities for some users, but should not for most

  • bandwidth_limit: added :ref:`response trailers <envoy_v3_api_field_extensions.filters.http.bandwidth_limit.v3.BandwidthLimit.enable_response_trailers>` when request or response delay are enforced.
  • bandwidth_limit: added :ref:`bandwidth limit stats <config_http_filters_bandwidth_limit>` request_enforced and response_enforced.
  • dns: now respecting the returned DNS TTL for resolved hosts, rather than always relying on the hard-coded :ref:`dns_refresh_rate. <envoy_v3_api_field_config.cluster.v3.Cluster.dns_refresh_rate>` This behavior can be temporarily reverted by setting the runtime guard envoy.reloadable_features.use_dns_ttl to false.
  • http: directly response with http status code 1xx isn't valid usecase, so the status code 1xx was refused by the :ref:`direct_response <envoy_v3_api_field_config.route.v3.Route.direct_response>` field.
  • http: envoy will now proxy 102 and 103 headers from upstream, though as with 100s only the first 1xx response headers will be sent. This behavioral change by can temporarily reverted by setting runtime guard envoy.reloadable_features.proxy_102_103 to false.
  • http: usage of the experimental matching API is no longer guarded behind a feature flag, as the corresponding protobuf fields have been marked as WIP.
  • http: when envoy run out of max_requests_per_connection, it will send an HTTP/2 "shutdown nofitication" (GOAWAY frame with max stream ID) and go to a default grace period of 5000 milliseconds (5 seconds) if drain_timeout is not specified. During this grace period, envoy will continue to accept new streams. After the grace period, a final GOAWAY is sent and envoy will start refusing new streams. However before bugfix, during the grace period, every time a new stream is received, old envoy will always send a "shutdown notification" and restart drain again which actually causes the grace period to be extended and is no longer equal to drain_timeout.
  • json: switching from rapidjson to nlohmann/json. This behavioral change can be temporarily reverted by setting runtime guard envoy.reloadable_features.remove_legacy_json to false.
  • listener: destroy per network filter chain stats when a network filter chain is removed during the listener in place update.
  • quic: add back the support for IETF draft 29 which is guarded via envoy.reloadable_features.FLAGS_quic_reloadable_flag_quic_disable_version_draft_29. It is off by default so Envoy only supports RFCv1 without flipping this runtime guard explicitly. Draft 29 is not recommended for use.
  • router: take elapsed time into account when setting the x-envoy-expected-rq-timeout-ms header for retries, and never send a value that's longer than the request timeout. This behavioral change can be temporarily reverted by setting runtime guard envoy.reloadable_features.update_expected_rq_timeout_on_retry to false.
  • stream_info: response code details with empty space characters (' ', 't', 'f', 'v', 'n', 'r') is not accepted by the setResponseCodeDetails() API.
  • upstream: fixed a bug where auto_config didn't work for wrapped TLS sockets (e.g. if proxy proto were configured for TLS).

Bug Fixes

Changes expected to improve the state of the world and are unlikely to have negative effects

  • ext_authz: fix the ext_authz http filter to correctly set response flags to UAEX when a connection is denied.
  • ext_authz: fix the ext_authz network filter to correctly set response flag and code details to UAEX when a connection is denied.
  • hcm: stop processing the response if encoding it has caused downstream reset. The fix is guarded by envoy.reloadable_features.handle_stream_reset_during_hcm_encoding.
  • listener: fixed issue where more than one listener could listen on the same port if using reuse port, thus randomly accepting connections on different listeners. This configuration is now rejected.
  • thrift_proxy: do not close downstream connections when an upstream connection overflow happens.
  • thrift_proxy: fix the thrift_proxy connection manager to correctly report success/error response metrics when performing :ref:`payload passthrough <envoy_v3_api_field_extensions.filters.network.thrift_proxy.v3.ThriftProxy.payload_passthrough>`.

Removed Config or Runtime

Normally occurs at the end of the :ref:`deprecation period <deprecated>`

  • compression: removed envoy.reloadable_features.enable_compression_without_content_length_header runtime guard and legacy code paths.
  • grpc-web: removed envoy.reloadable_features.grpc_web_fix_non_proto_encoded_response_handling and legacy code paths.
  • header map: removed envoy.reloadable_features.header_map_correctly_coalesce_cookies and legacy code paths.
  • health check: removed envoy.reloadable_features.health_check.immediate_failure_exclude_from_cluster runtime guard and legacy code paths.
  • http: removed envoy.reloadable_features.add_and_validate_scheme_header and legacy code paths.
  • http: removed envoy.reloadable_features.check_unsupported_typed_per_filter_config, Envoy will always check unsupported typed per filter config if the filter isn't optional.
  • http: removed envoy.reloadable_features.dont_add_content_length_for_bodiless_requests deprecation and legacy code paths.
  • http: removed envoy.reloadable_features.grpc_json_transcoder_adhere_to_buffer_limits and legacy code paths.
  • http: removed envoy.reloadable_features.http2_skip_encoding_empty_trailers and legacy code paths. Envoy will always encode empty trailers by sending empty data with end_stream true (instead of sending empty trailers) for HTTP/2.
  • http: removed envoy.reloadable_features.improved_stream_limit_handling and legacy code paths.
  • http: removed envoy.reloadable_features.remove_forked_chromium_url and legacy code paths.
  • http: removed envoy.reloadable_features.return_502_for_upstream_protocol_errors. Envoy will always return 502 code upon encountering upstream protocol error.
  • http: removed envoy.reloadable_features.treat_host_like_authority and legacy code paths.
  • http: removed envoy.reloadable_features.treat_upstream_connect_timeout_as_connect_failure and legacy code paths.
  • http: removed envoy.reloadable_features.upstream_http2_flood_checks and legacy code paths.
  • upstream: removed envoy.reloadable_features.upstream_host_weight_change_causes_rebuild and legacy code paths.

New Features

Deprecated