.. _version_history_1.9.0: 1.9.0 (December 20, 2018) ========================== Changes ------- * **access log**: added ``DOWNSTREAM_CONNECTION_TERMINATION``. * **access log**: added a :ref:`JSON logging mode ` to output access logs in JSON format. * **access log**: added dynamic metadata to access log messages streamed over gRPC. * **admin**: :http:get:`/server_info` now exposes what stage of initialization the server is currently in. * **admin**: :http:get:`/server_info` now responds with a JSON object instead of a single string. * **admin**: :http:post:`/logging` now responds with 200 while there are no params. * **admin**: added host weight to the :http:get:`/clusters?format=json` end point response. * **admin**: added support for displaying command line options in :http:get:`/server_info` end point. * **admin**: added support for displaying subject alternate names in :ref:`certs ` end point. * **circuit-breaker**: added cx_open, rq_pending_open, rq_open and rq_retry_open gauges to expose live state via :ref:`circuit breakers statistics `. * **cluster**: set a default of 1s for :ref:`option `. * **config**: added support for :ref:`rate limiting ` discovery request calls. * **config**: removed support for the v1 API. * **cors**: added :ref:`invalid/valid stats ` to filter. * **ext-authz**: added support for providing per route config - optionally disable the filter and provide context extensions. * **fault**: removed integer percentage support. * **grpc-json**: added support for :ref:`ignoring query parameters `. * **health check**: added :ref:`logging health check failure events `. * **health check**: added ability to set :ref:`authority header value ` for gRPC health check. * **http**: added HTTP/2 WebSocket proxying via :ref:`extended CONNECT `. * **http**: added limits to the number and length of header modifications in all fields request_headers_to_add and response_headers_to_add. These limits are very high and should only be used as a last-resort safeguard. * **http**: added support for a :ref:`request timeout `. The timeout is disabled by default. * **http**: added support for more gRPC content-type headers in :ref:`gRPC bridge filter `, like application/grpc+proto. * **http**: augmented the ``sendLocalReply`` filter API to accept an optional ``GrpcStatus`` value to override the default HTTP to gRPC status mapping. * **http**: no longer adding whitespace when appending ``X-Forwarded-For headers``. **Warning**: this is not compatible with 1.7.0 builds prior to `9d3a4eb4ac44be9f0651fcc7f87ad98c538b01ee `_. See `#3611 `_ for details. * **http**: no longer close the TCP connection when a HTTP/1 request is retried due to a response with empty body. * **listeners**: added the ability to match :ref:`FilterChain ` using :ref:`source_type `. * **listeners**: all listener filters are now governed by the :ref:`listener_filters_timeout ` setting. The hard coded 15s timeout in the :ref:`TLS inspector listener filter ` is superseded by this setting. * **load balancer**: added a :ref:`configuration ` option to specify the number of choices made in P2C. * **logging**: added missing ``[`` in log prefix. * **mongo_proxy**: added :ref:`dynamic metadata `. * **network**: removed the reference to ``FilterState`` in ``Connection`` in favor of ``StreamInfo``. * **rate-limit**: added :ref:`configuration ` to specify whether the ``GrpcStatus`` status returned should be ``RESOURCE_EXHAUSTED`` or ``UNAVAILABLE`` when a gRPC call is rate limited. * **rate-limit**: added :ref:`rate_limit_service ` configuration to filters. * **rate-limit**: removed support for the legacy ratelimit service and made the data-plane-api :ref:`rls.proto ` based implementation default. * **rate-limit**: removed the deprecated cluster_name attribute in :ref:`rate limit service configuration `. * **rbac**: added dynamic metadata to the network level filter. * **rbac**: added support for permission matching by :ref:`requested server name `. * **redis**: static cluster configuration is no longer required. Redis proxy will work with clusters delivered via CDS. * **router**: added :ref:`scheme_redirect ` and :ref:`port_redirect ` to define the respective scheme and port rewriting RedirectAction. * **router**: added ability to configure arbitrary :ref:`retriable status codes `. * **router**: added ability to set attempt count in upstream requests, see :ref:`virtual host's include request attempt count flag `. * **router**: added internal :ref:`grpc-retry-on ` policy. * **router**: added support for enabling upgrades on a :ref:`per-route ` basis. * **router**: added support for not retrying :ref:`rate limited requests `. Rate limit filter now sets the :ref:`x-envoy-ratelimited ` header so the rate limited requests that may have been retried earlier will not be retried with this change. * **router**: per try timeouts now starts when an upstream stream is ready instead of when the request has been fully decoded by Envoy. * **router**: support configuring a default fraction of mirror traffic via :ref:`runtime_fraction `. * **router**: when :ref:`max_grpc_timeout ` is set, Envoy will now add or update the grpc-timeout header to reflect Envoy's expected timeout. * **sandbox**: added :ref:`cors sandbox `. * **server**: added ``SIGINT`` (Ctrl-C) handler to gracefully shutdown Envoy like ``SIGTERM``. * **stats**: added :ref:`stats_matcher ` to the bootstrap config for granular control of stat instantiation. * **stream**: added ``downstreamDirectRemoteAddress`` to ``StreamInfo``. * **stream**: renamed ``perRequestState`` to ``filterState`` in ``StreamInfo``. * **stream**: renamed the ``RequestInfo`` namespace to ``StreamInfo`` to better match its behaviour within TCP and HTTP implementations. * **thrift_proxy**: introduced thrift rate limiter filter. * **tls**: added ssl.curves., ssl.sigalgs. and ssl.versions. to :ref:`listener metrics ` to track TLS algorithms and versions in use. * **tls**: added support for :ref:`client-side session resumption `. * **tls**: added support for :ref:`multiple server TLS certificates `. * **tls**: added support for :ref:`password encrypted private keys `. * **tls**: added support for CRLs in :ref:`trusted_ca `. * **tls**: added the ability to build :ref:`BoringSSL FIPS ` using ``--define boringssl=fips`` Bazel option. * **tls**: removed support for ECDSA certificates with curves other than P-256. * **tls**: removed support for RSA certificates with keys smaller than 2048-bits. * **tracing**: added support for :ref:`Datadog ` tracer. * **tracing**: added support to the Zipkin tracer for the :ref:`b3 ` single header format. * **upstream**: added :ref:`scale_locality_weight ` to enable scaling locality weights by number of hosts removed by subset lb predicates. * **upstream**: changed how load calculation for :ref:`priority levels ` and :ref:`panic thresholds ` interact. As long as normalized total health is 100% panic thresholds are disregarded. * **upstream**: changed the default hash for :ref:`ring hash ` from std::hash to `xxHash `_. * **upstream**: when using active health checking and STRICT_DNS with several addresses that resolve to the same hosts, Envoy will now health check each host independently. Deprecated ---------- * **api**: Use of the v1 ``REST_LEGACY`` ``ApiConfigSource`` is deprecated. * **filters**: Order of execution of the HTTP encoder filter chain has been reversed. Prior to this release cycle it was incorrect, see `#4599 `_. In the 1.9.0 release cycle we introduced ``bugfix_reverse_encode_order`` in `http_connection_manager.proto `_ to temporarily support both old and new behaviors. Note this boolean field is deprecated. * **filters**: Order of execution of the network write filter chain has been reversed. Prior to this release cycle it was incorrect, see `#4599 `_. In the 1.9.0 release cycle we introduced ``bugfix_reverse_write_filter_order`` in `lds.proto `_ to temporarily support both old and new behaviors. Note this boolean field is deprecated. * **hcm**: Use of buffer filter ``max_request_time`` is deprecated in favor of the request timeout found in `HttpConnectionManager `_. * **load_balancing**: Use of std::hash in the ring hash load balancer is deprecated. * **rate_limiting**: Use of ``rate_limit_service`` configuration in the `bootstrap configuration `_ is deprecated. * **routing**: Use of ``runtime_key`` in ``RequestMirrorPolicy``, found in `route.proto `_ is deprecated. Set the ``runtime_fraction`` field instead.