Release Notes

Version 1.7.7

TSB 1.7.7 is a patch release that includes stability and reliability updates.

• Improved the performance of LDAP queries by requesting only the attributes that are needed.
• Fixed edge cases related to CRD deletion by the TSB operator finalizers.
• Added the pip/sql/queries and pip/sql/results loggers to show the SQL queries that are being executed by TSB. This can be extremely verbose, but useful for debugging purposes. To enable the query logging, the mentioned loggers can be configured with: tctl x debug log-level management/apiserver --level pip/sql/queries:debug,pip/sql/results:debug
• Fixed an issue associated with cross cluster port 15443 when configured as NodePort service when there are multiple gateway install objects
• Fixed an issue related to delay in synchronizing cross cluster endpoints when the number of replicas of gateway pods of LoadBalancer service type goes to zero

Outstanding CVEs

At the time of shipping, there are no Critical/High CVEs flagged by our scanner. The following medium/low CVEs have been identified as being present in some images by our security tools. They have been evaluated by Tetrate Product Security and are not exploitable in TSB installations. Where applicable, this was ascertained by using static code analysis tools.

• GHSA-3m87-5598-2v4f - Not vulnerable - Advisory withdrawn
• CVE-2024-26462 - No fix available.
• CVE-2021-31879 - No fix available.
• CVE-2024-26461 - No fix available.
• CVE-2023-34969 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-46218 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-47038 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-5156 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-5678 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6004 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6129 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6918 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-0553 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-0567 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-22365 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.

Version 1.7.6

TSB 1.7.6 is a patch release that includes bug fixes related to cleanup of TSB resources.

Bug Fixes and Improvements

• The logic for tracking TSB-created objects has been shifted from the Kubernetes webhook to xcp-edge.This change ensures thorough clean-up of objects preventing any possibility of a conflicting duplicate TSB objects.
• Enhancements to metrics captured by xcp-edge. For example, added metrics for Kubernetes events that xcp-edge receives
• Performance optimization to services processing in xcp-edge while generating cluster state

Outstanding CVEs

At the time of shipping, there are no Critical/High CVEs flagged by our scanner. The following medium/low CVEs have been identified as being present in some images by our security tools. They have been evaluated by Tetrate Product Security and are not exploitable in TSB installations. Where applicable, this was ascertained by using static code analysis tools.

• GHSA-3m87-5598-2v4f - Not vulnerable - Advisory withdrawn
• PRISMA-2021-0153 - No fix available.
• CVE-2024-28834 - No fix available.
• CVE-2024-26462 - No fix available.
• CVE-2021-31879 - No fix available.
• CVE-2024-26461 - No fix available.
• PRISMA-2023-0046 - No fix available.
• CVE-2023-34969 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-35116 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-39804 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-42363 - No fix available.
• CVE-2023-42364 - No fix available.
• CVE-2023-42365 - No fix available.
• CVE-2023-42366 - No fix available.
• CVE-2023-46218 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-47038 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-5156 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-52426 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-5678 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6004 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6129 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6237 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6918 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-0553 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-0567 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-0727 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-22365 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-25620 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-26147 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.

Version 1.7.5

TSB 1.7.5 is a patch release that includes stability and reliability updates, along with fixes to CVEs in TSB's dependencies.

Outstanding CVEs

At the time of shipping, there are no Critical/High CVEs flagged by our scanner. The following medium/low CVEs have been identified as being present in some images by our security tools. They have been evaluated by Tetrate Product Security and are not exploitable in TSB installations.
Where applicable, this was ascertained by using static code analysis tools.

• GHSA-3m87-5598-2v4f - Not vulnerable - Advisory withdrawn
• PRISMA-2021-0153 - No fix available.
• CVE-2024-28834 - No fix available.
• CVE-2024-26462 - No fix available.
• CVE-2021-31879 - No fix available.
• CVE-2024-26461 - No fix available.
• PRISMA-2023-0046 - No fix available.
• CVE-2023-34969 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-35116 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-39804 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-42363 - No fix available.
• CVE-2023-42364 - No fix available.
• CVE-2023-42365 - No fix available.
• CVE-2023-42366 - No fix available.
• CVE-2023-46218 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-47038 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-5156 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-52426 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-5678 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6004 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6129 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6237 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6918 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-0553 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-0567 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-0727 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-22365 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-25620 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-26147 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.

Version 1.7.4

TSB 1.7.4 is a patch release that includes stability and reliability updates, along with fixes to CVEs in TSB's dependencies.

Bug Fixes and Improvements

• Fixed an issue were image pull secrets are incorrectly rendered for gateway deployments when using isolation boundaries.

Outstanding CVEs

At the time of shipping, the following CVEs had been identified as being present in some images by our security tools. They have been evaluated by Tetrate Product Security and are not exploitable in TSB installations.
Where applicable, this was ascertained by using static code analysis tools.

• CVE-2016-2781 - No fix available.
• CVE-2018-1000007 - No fix available.
• CVE-2019-10743 - No fix available.
• CVE-2021-31879 - No fix available.
• CVE-2022-27943 - No fix available.
• CVE-2022-3219 - No fix available.
• CVE-2022-3715 - No fix available.
• CVE-2022-3857 - No fix available.
• CVE-2022-48522 - No fix available.
• CVE-2022-4899 - No fix available.
• CVE-2023-29383 - No fix available.
• CVE-2023-2953 - No fix available.
• CVE-2023-34969 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-35116 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-39804 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-42363 - No fix available.
• CVE-2023-42364 - No fix available.
• CVE-2023-42365 - No fix available.
• CVE-2023-42366 - No fix available.
• CVE-2023-46218 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-4641 - No fix available.
• CVE-2023-47038 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-4806 - No fix available.
• CVE-2023-4813 - No fix available.
• CVE-2023-48795 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-50495 - No fix available.
• CVE-2023-5156 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-52426 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-5678 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6004 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6129 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6237 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6918 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-6992 - No fix available.
• CVE-2023-7008 - No fix available.
• CVE-2024-0553 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-0567 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-0727 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-22365 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-24786 - awaiting classification
• CVE-2024-25620 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2024-26461 - No fix available.
• CVE-2024-26462 - No fix available.
• CVE-2024-28122 - No fix available.
• CVE-2024-28180 - No fix available.
• CVE-2024-26147 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.

Known Issues

• OpenAPI spec translation will cease to work if you run your management plane in TSB version 1.7.x while keeping your control planes at version 1.6.x. The issue only appears when the control planes are in a version lower than 1.7, so having both management and control planes in version 1.7 will work as expected.
• TSB API pod might get restarted in some situations when losing connection to MPC pod. The API will continue to work as usual after the restart.

Version 1.7.3

TSB 1.7.3 is a patch release that includes stability and reliability updates, along with fixes to CVEs in TSB's dependencies.

Outstanding CVEs

At the time of shipping, the following CVEs had been identified as being present in some images by our security tools. They have been evaluated by Tetrate Product Security and are not exploitable in TSB installations.
Where applicable, this was ascertained by using static code analysis tools.

• CVE-2010-0834 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2018-6557 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2016-2781 - No fix available.
• CVE-2018-1000007 - No fix available.
• CVE-2019-0190 - No fix available.
• CVE-2019-10743 - No fix available.
• CVE-2021-31879 - No fix available.
• CVE-2022-27943 - No fix available.
• CVE-2022-3219 - No fix available.
• CVE-2022-3715 - No fix available.
• CVE-2022-3857 - No fix available.
• CVE-2022-48522 - No fix available.
• CVE-2022-4899 - No fix available.
• CVE-2023-29383 - No fix available.
• CVE-2023-2953 - No fix available.
• CVE-2023-34969 - No fix available.
• CVE-2023-35116 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-39326 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-39804 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-4039 - No fix available.
• CVE-2023-42363 - No fix available.
• CVE-2023-42364 - No fix available.
• CVE-2023-42365 - No fix available.
• CVE-2023-42366 - No fix available.
• CVE-2023-44487 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-45142 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-45283 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-45284 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-45285 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-46218 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-47038 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-47108 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-4806 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-4813 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-48795 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-49290 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-5156 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-5678 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-5981 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.

Version 1.7.2

TSB 1.7.2 is a patch release that fixes CVEs in TSB's dependencies. Of particular note, CVE-2023-44487 has been fixed in Envoy, Istio and core TSB components. Some vulnerability scanners may still list the vulnerability as being present in some of TSBs packages, but in those instances the vulnerability is not exploitable.

Deprecation Notices

• Removed flag --local-charts from tctl x app-ingress kubernetes generate command.

Outstanding CVEs

At the time of shipping, the following CVEs had been identified as being present in some images by our security tools. They have been evaluated by Tetrate Product Security and are not exploitable in TSB installations.
Where applicable, this was ascertained by using static code analysis tools.

• CVE-2016-2781 - No fix available.
• CVE-2019-10743 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2021-31879 - No fix available.
• CVE-2022-27943 - No fix available.
• CVE-2022-3219 - No fix available.
• CVE-2022-3715 - No fix available.
• CVE-2022-3857 - No fix available.
• CVE-2022-48522 - No fix available.
• CVE-2022-4899 - No fix available.
• CVE-2023-29383 - No fix available.
• CVE-2023-2953 - No fix available.
• CVE-2023-2975 - No fix available.
• CVE-2023-3446 - No fix available.
• CVE-2023-34969 - No fix available.
• CVE-2023-36054 - No fix available.
• CVE-2023-3817 - No fix available.
• CVE-2023-38545 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-38546 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-39318 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-39319 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-39323 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-39325 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-3978 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-4016 - No fix available.
• CVE-2023-4039 - No fix available.
• CVE-2023-44487 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-45142 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-4586 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-4911 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-38545 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-39323 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-39325 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-44487 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-45142 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-47108 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• CVE-2023-4911 - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• GHSA-m425-mq94-257g - TSB does not execute the code path identified by the vulnerability and is not vulnerable.
• GHSA-xpw8-rcwv-8f8p - TSB does not execute the code path identified by the vulnerability and is not vulnerable.

Version 1.7.0

What’s New

• Enabled TCP keepalive.

  • At front envoy, by default. To disable, use tctl install manifest management-plane-operator --registry gcr.io/mycompany/registry --set "operator.deployment.env[0].name=DISABLE_DOWSTREAM_KEEPALIVE,operator.deployment.env[0].value=true"
  • At ingress gateways, by default. To disable, use tctl install manifest control-plane-operator --registry gcr.io/mycompany/registry --set "operator.deployment.env[0].name=DISABLE_GATEWAY_DOWSTREAM_KEEPALIVE,operator.deployment.env[0].value=true" when using TSB-managed Istio.

• Added deletion protection for Organizations, Tenants, Workspaces and Groups:

  • The deletionProtectionEnabled property has been added to prevent these resources from being deleted when set.
  • If a resource or any of its children resources is protected, deletion is not allowed.
  • To delete a protected resource, the deletionProtectionEnabled property must be cleared, or the new --force flag in tctl must be used.

• Metrics for API endpoints

  • Metrics for API endpoints are enabled by default. To disable the option, set spec.meshObservability.settings.apiEndpointMetricsEnabled to false.
  • As new metrics are added, an increase in ElasticSearch storage usage is expected.

• Improved experience when pulling WASM extensions from private registries.

  • Extensions that are hosted in private OCI registries can now be downloaded using an internal WASM download proxy that is part of the TSB ControlPlane. This download proxy centrally caches the images to optimize downloads and centralizes the credentials used to pull them. When using the download proxy, the imagePullSecrets references in the WASM extensions only have to be created in the istio-system namespace. In addition, when using the download proxy, the image pull secrets are not needed anymore when pulling from the cloud provider registries. The download proxy is disabled by default in this release. To enable , just edit the ManagementPlane resource spec as follows:

    spec:
      enableWasmDownloadProxy: true
  • Internal WASM extensions can be directly mounted in the Sidecar, Ingress and Egress gateway pods instead of being downloaded from the image registries. This can improve pod availability and startup times. The feature is disabled by default. To enable it, set the following configuration in the istio component of the ControlPlane resource:

    spec:
      components:
        istio:
          mountInternalWasmExtensions: true
    This feature is also available on onboarded VM workloads, and the internal WASM extensions are installed by the onboarding-agent package. If your workloads were onboarded using the Manual Onboarding using tctl, you can install the onboarding agent package in your workloads and keep the WASM extensions located in /wasm-plugins.

• Moved from istio stats envoy filters to Telemetry API allowing greater control over metrics and telemetry.

• Cluster Service Account auto-generated on cluster creation. Now, when a new Cluster is created a Service account with the name following the pattern auto-cluster-<cluster-name> is created, and returned along a new key pair ready to be used in the cluster onboard process. With this, cluster onboarding has been simplified to:

  1. Create cluster in TSB: tctl apply -f <new-cluster.yaml>
  2. Get the install template: tctl x cluster-install-template <cluster-name> > cluster-values.yaml
  3. Apply Helm install: helm install <repo>/controlplane <release-name> -n istio-system --version v1.7.0 -f cluster-values.yaml

  The previous cluster onboarding flows are still valid and supported.

• OAP supports basic PromQL, users can obtain metrics through PromQL Service to do integration such as building a Grafana dashboard.

Upgrade notes

• With the introduction of the new Gateway resource, there have been API modifications to maintain consistency within the TSB API. These changes were driven by our use of Protocol Buffers (protobuf), which has specific conventions for naming and managing collections. Here's what you need to know:
  • The service previously known as Gateway has been renamed to Gateways
    • If you interact with TSB using the gRPC API, it's essential to update your application with the latest gRPC client library.
    • If you utilize tctl, please ensure you have the most recent version to seamlessly communicate with TSB.

Known Issues and Limitations

• ExternalServices health is reported as unacceptable in the topology UI.
• The enableWasmDownloadProxy is not fully supported yet on VMs.
• There is a regression in the conversion of VirtualServices and DestinationRules in DIRECT mode that may cause the resources to be deleted when they're modified in TSB. A workaround exists and can be mitigated by setting the --concurrent-k8s-configs-push=0 (defaults to 50) in the MPC deployment startup flags. This will mitigate the issue but VirtualServices and DestinationRules will be deleted/recreated (instead of just updated) when they're updated in TSB, and that may have an impact o traffic when this happens. This issue is fixed in the next patch release.