v1.4.0
On Wednesday, December 16, 2020, we released the version 1.4.0 of Apigee Adapter for Envoy.
Supported platforms
We publish binaries for MacOS, Linux, and Windows.
We publish docker images from Google's distroless, Ubuntu, and Ubuntu with Boring Crypto.
In this version we support the following platforms:
- Apigee hybrid version 1.3.x, 1.4.x (release date pending), Apigee Edge for Public Cloud, Apigee Edge for Private Cloud, and Apigee on Google Cloud
- Istio versions 1.5, 1.6, 1.7, 1.8
- Envoy versions 1.14, 1.15, 1.16
Features and improvements
Feature | Description |
---|---|
The remote-service proxy no longer requires association with
an API product that uses Remote Service Targets. |
Because this association is no longer required, note the following changes:
|
The Apigee Organization Admin role is no longer required for provisioning. |
Rather than require the org admin permission for provisioning, you can now use
the IAM roles API Creator and Deployer instead. You must grant both of these roles
to successfully provision.
|
Other issues and fixes
- An issue was fixed where re-provisioning Apigee without the
--rotate
option exited with an error. - The provisioning CLI now reads and reuses the analytics service account credentials
from a given
config.yaml
file (Issue #133).
v1.3.0
On Monday, November 23, we released the version 1.3.0 of Apigee Adapter for Envoy.
Supported platforms
We publish binaries for MacOS, Linux, and Windows.
We publish docker images from Google's distroless, Ubuntu, and Ubuntu with Boring Crypto.
In this version we support the following platforms:
- Apigee hybrid version 1.3.x, 1.4.x (release date pending), Apigee Edge for Public Cloud, Apigee Edge for Private Cloud, and Apigee on Google Cloud
- Istio versions 1.5, 1.6, 1.7, 1.8
- Envoy versions 1.14, 1.15, 1.16
Features and improvements
Feature | Description |
---|---|
Support for API product OperationGroups. | OperationGroups bind the resources and associated quota enforcement in a proxy or
remote service with HTTP methods.
(Applies to Apigee on Google Cloud and Apigee hybrid only) |
Remove support for dynamic forward proxy from samples generation. | Because of this change, clients must include the HOST header if the hostname is
different from the remote service target host that is set in the API product. For
example:
curl -i http://localhost:8080/httpbin/headers -H "HOST:httpbin.org" |
Support service accounts and Workload Identity. | To allow analytics data to be uploaded to Apigee when
running the adapter outside an Apigee hybrid cluster, you must use the
analytics-sa parameter with the apigee-remote-service-cli provision
command. In addition, the adapter now supports Workload Identity on Google Kubernetes
Engine (GKE). See Provision command.
(Applies to Apigee on Google Cloud and Apigee hybrid only) |
New jwt_provider_key configuration attribute. |
This key is added to the config file.
It represents the JWT provider's payload_in_metadata key in
Envoy config
or the RequestAuthentication JWT issuer in Istio config. |
KeepAliveMaxConnectionAge configuration attribute now
defaults to 1 minute. |
The previous default was 10 minutes. This change allows smoother scaling. This value is also used for the access log stream lifetime. See config file. |
Removed CLI commands. | The following CLI commands have been deprecated. We recommend that you use the
Edge APIs
instead to update remote service targets for API products:
|
Added new CLI command. | The command:
apigee-remote-service-cli samples templates lists the available options
that you can use with the |
Changed existing CLI command. | A change was made to the apigee-remote-service-cli samples create
command. Flags specific to Envoy or Istio templates are strictly checked, and
errors are returned on wrongly used flags. The native template option is
deprecated. To get a list of available templates, use the apigee-remote-service-cli samples templates command.
See also CLI reference.
|
The /token endpoint response now follows the
OAuth2 spec. |
The access_token parameter was added to the response, and the token parameter
is deprecated. |
v1.2.0
On Wednesday, September 30, we released the version 1.2.0 of Apigee Adapter for Envoy.
Supported platforms
We publish binaries for MacOS, Linux, and Windows.
We publish docker images from Google's distroless, Ubuntu, and Ubuntu with Boring Crypto.
In this version we support the following platforms:
- Apigee hybrid version 1.3.x
- Istio versions 1.5, 1.6, 1.7
- Envoy versions 1.14, 1.15
Features and improvements
Feature | Description |
---|---|
Support for Apigee on Google Cloud | You can now use Apigee Adapter for Envoy with Apigee on Google Cloud. You can run the adapter in its own cluster or by running the Remote Service for Envoy as a native binary or in a container. Provision the adapter on Apigee using the provision command. |
Direct upload for analytics data | You can now configure the Apigee Adapter to upload analytics data to Apigee directly. If you are
using Apigee hybrid, this
new feature makes it possible to deploy the adapter to its own Kubernetes cluster, outside
of the cluster where Apigee hybrid is installed. To enable direct upload, use the new
--analytics-sa flag with the provision command.
See provision command.
|
Health check returns "Ready" after API product data is loaded from Apigee | The Kubernetes health check will not return "Ready" until the API product data is loaded from Apigee. This change helps with scaling and upgrading, because no traffic will be sent to the newly instantiated adapter until it is ready. |
Other issues and fixes
- An issue was fixed to address a potential quota sync deadlock (Issue #17).
- Prometheus annotations were moved to pod spec (Issue #69).
- An issue was fixed to address improperly emitted verify errors (Issue #62).
v1.1.0
On Wednesday, August 26, we released the version 1.1.0 of Apigee Adapter for Envoy.
Supported platforms
We publish binaries for MacOS, Linux, and Windows.
We publish docker images from Google's distroless, Ubuntu, and Ubuntu with Boring Crypto.
In version 1.1.0 we support the following platforms:
- Apigee hybrid version 1.3
- Istio versions 1.5, 1.6, 1.7
- Envoy versions 1.14, 1.15
Features and improvements
Feature | Description |
---|---|
Verify bindings | A new command apigee-remote-service-cli bindings verify was
added to the CLI. This command verifies that the specified bound API product and its
associated developer apps also have a remote service product associated with them. See
Verify a binding. |
Generate samples | A new command apigee-remote-service-cli samples create was added
to the CLI. This command creates
sample configuration files for native Envoy or Istio deployments. The config
files you generate with this command replace the sample files that were installed
with the Adapter for Envoy in previous versions. See
Samples command. |
OAuth2 authentication | The adapter now uses OAuth2 authentication when multi-factor auth (MFA) is
enabled for Apigee Edge. Use the --mfa flag whenever you use the
--legacy flag. |
Distroless container | The adapter now uses Google's distroless (gcr.io/distroless/base ) image instead
of scratch for the default Docker image base. |
Other issues and fixes
- A CLI issue was fixed for bindings commands in OPDK. (#29)
- Quota could become stuck when connection lost (apigee/apigee-remote-service-envoy. (#31)
- Docker images are now built with non-root user (999).
- Kubernetes samples enforce the user must not be root.
- The
--http1.1
is no longer needed for curl commands against proxy endpoints. The flag has been removed from examples.
v1.0.0
On Friday, July 31, we released the GA version of Apigee Adapter for Envoy.
Supported platforms
We publish binaries for MacOS, Linux, and Windows.
We publish docker images from scratch, Ubuntu, and Ubuntu with Boring Crypto.
In version 1.0.0 we support the following platforms:
- Apigee hybrid version 1.3
- Istio versions 1.5, 1.6
- Envoy versions 1.14, 1.15
Additions and changes
Between the v1.0-beta4 release and GA, the following additions changes were made to the adapter:
Go Boring builds
A new build is now available that uses FIPS compliant Go BoringSSL libraries.
- Log level flag changes
The logging level flags for the apigee-remote-service-envoy service have been changed for consistency:
Old flag New flag log_level
log-level
json_log
json-log
- New CLI flags
New flags were added to the CLI
token
commands:Flag Description --legacy
Set this flag if you are using Apigee Edge Cloud. --opdk
Set this flag if you are using Apigee Edge for Private Cloud.