Skip to main content
logoTetrate Enterprise Gateway for EnvoyVersion: v1.8.x

v1.8.2

Updated Envoy Gateway to v1.8.2.

Breaking Changes​

  • The XRateLimitHeadersOptionDisabled constant in BackendTrafficPolicy now uses "Off" instead of "Disabled" to match the CRD enum. Because "Disabled" was never a valid CRD value (it would have been rejected by the API server), no existing manifests are affected.
  • SecurityPolicy validation for spec.apiKeyAuth.extractFrom is now stricter, requiring non-empty lists with unambiguous source specifications. Policies with empty or ambiguous configurations will now be rejected and must be corrected before upgrading.

New Features​

  • The default data-plane Envoy image now bundles the WAF dynamic module, so the Web Application Firewall (configured via ExtendedSecurityPolicy) works out of the box — you no longer need to override the Envoy proxy image in your Helm values to enable WAF. This default image is published to the public docker.io/tetrate/teg-envoy repository and can be pulled without registry credentials. FIPS deployments must still override the Envoy proxy image with the FIPS variant (published to a credentialed Tetrate registry), which likewise bundles the FIPS-compliant WAF module. Because the dynamic module is now baked in, the Envoy images are slightly larger and are tagged with the TEG release version (e.g. distroless-v1.8.2) rather than the upstream Envoy version.
  • Added the ability to disable the crds dependency on the gateway-helm chart via the crds.enabled configuration variable.

Security Updates​

Bug Fixes​

  • Fixed API key auth credential ordering to avoid unnecessary xDS updates.
  • Fixed the EnvoyProxy resource not allowing IPv6 ranges in loadBalancerSourceRanges when configuring the Envoy service.
  • Fixed HTTPRoute, GRPCRoute, TLSRoute, TCPRoute, and UDPRoute Accepted conditions being set to False when an attached listener is not programmed due to a missing TLS certificate ref; listener programmed state is now correctly separated from route acceptance.
  • Fixed Backend TLS alpnProtocols: [] to disable upstream ALPN instead of inheriting EnvoyProxy BackendTLS defaults.
  • Fixed BackendTrafficPolicy rate limit validation failing on Kubernetes 1.36 by validating the affected field as int64.
  • Fixed the generated install.yaml creating a duplicate ValidatingAdmissionPolicy and its binding, which caused kustomize build to fail with a duplicate resource error.
  • Fixed an ExternalName Service referenced as a route backend producing an invalid xDS cluster that stalled config delivery for the whole snapshot. ExternalName Services are now explicitly rejected as backends with a ResolvedRefs: False route condition; use a Backend resource with an FQDN endpoint instead.
  • Fixed ListenerSet hostname conflict resolution to apply listener precedence: Gateway-owned listeners win over ListenerSet listeners, and conflicted ListenerSet listeners now correctly report Accepted: False with the conflict reason.
  • Fixed Gateway status reporting Programmed: False when the Envoy LoadBalancer Service has no load balancer ingress (e.g. on bare-metal clusters without a load balancer controller) but has addresses configured in spec.externalIPs; the external IPs are now used as a fallback for the Gateway status addresses.
  • Fixed EnvoyGateway config hot-reload to apply defaults before validation on both the startup and reload paths.
  • Fixed HTTPRoute per-retry timeout not being applied when no retry backoff was configured.
  • Fixed shared global rate limit rules with a cost field not working as expected.
  • Prevented a panic when the EnvoyGateway Kubernetes provider sets a deploy block without specifying a type.

Other Changes​

  • Bumped the BOE composer dynamic module to v0.9.0.
  • Bumped the ratelimit service to aba2384d.