Connectivity
Added
- Add support for Azure Workload Identity in AKS clusters.
Added
- Add
basicauth performance test suite. - Add
keyauth performance test suite. - Add
mobilelatency performance test suite.
Changed
- Set
giantswarm-critical priorityClass on the Envoy Gateway control plane pods. - Add
circuitBreaker config field in bundle values for envoy performance test suites to better sustain high request load. - Configure Envoy Gateway to be HA by default.
- Move apps’ versions in dependencies_test files from each performance test suite into a single file used in each of those.
- Update Envoy Gateway to v1.8.2 (data plane Envoy bumped to v1.38.3).
Fixed
- Fix kong performance tests in
basic and basicauth suites.
Changed
- Standardize
values.yaml comments to the # @schema / # -- (helm-docs) convention and remove section-header dividers, so values.schema.json and the chart README.md are generated from the values file. Rendered manifests are unchanged.
Added
- Wire up the full set of CoreDNS
forward, cache, and kubernetes block parameters in the structured zone config:forward: maxIdleConns, maxConnectAttempts, dohMethod, tls, tlsServername, next, nextOnNodata, failfastAllUnhealthyUpstreams, failover, resolver.cache: zones, serveStale.verifyTimeout, disable.successZones, disable.denialZones.kubernetes: endpoint, tls, kubeconfig, apiserverQPS, apiserverBurst, apiserverMaxInflight, namespaceLabels, fallthroughZones, multicluster, startupTimeout.
Fixed
- Render the
health directive in only the . server block. The health plugin is process-wide and can be enabled in just one Server Block, so emitting it in every zone block was invalid. ready is kept in every block (its readiness is aggregated across blocks). - Correct the
coredns.*.cache.serveStale.refreshMode schema enum to immediate/verify (was immediate/background), matching the CoreDNS cache plugin.
Refactored
- Restructure Helm chart values interface with a zone-aware
coredns.* layout; all old paths remain backward compatible. - Add
coredns.public.* for the forward zone: autopath and a structured forward map mirroring the CoreDNS forward block, including maxConcurrent (max_concurrent). - Migrate the CI test value files to the new
coredns.* interface. - Add
coredns.cluster.* for the in-cluster zone: domains, serviceCIDR, podCIDR, and a structured kubernetes map mirroring the CoreDNS kubernetes block. - Add
coredns.custom. - Add
controlPlane.*, securityContext.*, service.clusterIP, and ports.metrics.port. - Configure cache, log, and loadbalance per zone (
coredns.public.*, coredns.cluster.*, and each coredns.additionalZones[].*), replacing the former global coredns.cache, coredns.log, and coredns.loadbalance (removed). A zone that omits them falls back to the deprecated paths, then to built-in defaults. - Replace
coredns.additionalLocalZones (a list of zone-name strings) with coredns.additionalZones, a list of fully-templated zone objects. The deprecated top-level additionalLocalZones string list still renders as kubernetes zones, now inheriting the coredns.cluster.* cache, log, and loadbalance config.
Changed
- Update
coredns image to 1.14.4.
Added
- Import load testing framework from microservices-demo app.
Fixed
- Correct the ports path and format in the Envoy Gateway ingress
CiliumNetworkPolicy. The previous empty toPorts entry put the endpoint into default-deny mode, silently dropping all xDS connections from new proxy pods.
Changed
- Update Envoy Gateway to v1.8.1 (data plane Envoy bumped to v1.38.1).
Changed
- update CoreDNS icon to light version
Changed
- Envoy Gateway CRDs are no longer installed as Helm-managed resources. Instead, a dedicated Docker image (
gsoci.azurecr.io/giantswarm/envoy-gateway-crds) is built and a pre-install/pre-upgrade hook Job applies the CRDs via kubectl apply --server-side. This avoids CRD ownership conflicts and allows safe upgrades.
