🎉 Welcome to the v2.3.7 release of the kgateway project!

Release Notes

Changes since v2.3.6

Bug Fixes

• Fix XListenerSet status patch failures caused by missing required port field since v2.3.0. (#14406)
• Fixed a bug where a TrafficPolicy using autoHostRewrite or tracing without targetRefs/targetSelectors (e.g. attached via an HTTPRoute ExtensionRef filter) was rejected by CRD validation. (#14436)

Cleanup

• Route matchers using regular expressions no longer set the deprecated google_re2 engine type on the generated Envoy RegexMatcher. RE2 remains the engine Envoy uses, so matching behavior is unchanged. (#14539)
• Route matchers using regular expressions no longer set the deprecated google_re2 engine type on the generated Envoy RegexMatcher. RE2 remains the engine Envoy uses, so matching behavior is unchanged. (#14552)

Dependency Updates

• Toolchain and dependencies bumped. (#14589)

Contributors

Thanks to all the contributors who made this release possible:

Installation

The kgateway project is available as a Helm chart and docker images.

Helm Charts

The Helm charts are available at:

• cr.kgateway.dev/kgateway-dev/charts/kgateway.

Docker Images

The docker images are available at:

• cr.kgateway.dev/kgateway-dev/kgateway:v2.3.7
• cr.kgateway.dev/kgateway-dev/sds:v2.3.7
• cr.kgateway.dev/kgateway-dev/envoy-wrapper:v2.3.7

Quickstart

Try installing this release:

helm install kgateway-crds oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds --version v2.3.7 --namespace kgateway-system --create-namespace
helm install kgateway oci://cr.kgateway.dev/kgateway-dev/charts/kgateway --version v2.3.7 --namespace kgateway-system --create-namespace

For detailed installation instructions and next steps, please visit our quickstart guide.

🎉 Welcome to the v2.4.3 release of the kgateway project!

Release Notes

Changes since v2.4.2

Cleanup

• Route matchers using regular expressions no longer set the deprecated google_re2 engine type on the generated Envoy RegexMatcher. RE2 remains the engine Envoy uses, so matching behavior is unchanged. (#14578)

Dependency Updates

• Toolchain and dependencies bumped. (#14590)

Contributors

Thanks to all the contributors who made this release possible:

Installation

The kgateway project is available as a Helm chart and docker images.

Helm Charts

The Helm charts are available at:

• cr.kgateway.dev/kgateway-dev/charts/kgateway.

Docker Images

The docker images are available at:

• cr.kgateway.dev/kgateway-dev/kgateway:v2.4.3
• cr.kgateway.dev/kgateway-dev/sds:v2.4.3
• cr.kgateway.dev/kgateway-dev/envoy-wrapper:v2.4.3

Quickstart

Try installing this release:

helm install kgateway-crds oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds --version v2.4.3 --namespace kgateway-system --create-namespace
helm install kgateway oci://cr.kgateway.dev/kgateway-dev/charts/kgateway --version v2.4.3 --namespace kgateway-system --create-namespace

For detailed installation instructions and next steps, please visit our quickstart guide.

🎉 Welcome to the v2.4.2 release of the kgateway project!

Release Notes

Changes since v2.4.1

Bug Fixes

• Fixed an issue where a backend whose translation failed (for example, a BackendConfigPolicy
  rejected by strict validation) caused endpoint updates for all other clusters on the same
  gateway to stop flowing until the proxy reconnected. The invalid backend still fails closed;
  unrelated clusters now continue to receive endpoint updates, and the backend's endpoints are
  delivered again once the policy is fixed.
  (#14505)

Contributors

Thanks to all the contributors who made this release possible:

Installation

The kgateway project is available as a Helm chart and docker images.

Helm Charts

The Helm charts are available at:

• cr.kgateway.dev/kgateway-dev/charts/kgateway.

Docker Images

The docker images are available at:

• cr.kgateway.dev/kgateway-dev/kgateway:v2.4.2
• cr.kgateway.dev/kgateway-dev/sds:v2.4.2
• cr.kgateway.dev/kgateway-dev/envoy-wrapper:v2.4.2

Quickstart

Try installing this release:

helm install kgateway-crds oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds --version v2.4.2 --namespace kgateway-system --create-namespace
helm install kgateway oci://cr.kgateway.dev/kgateway-dev/charts/kgateway --version v2.4.2 --namespace kgateway-system --create-namespace

For detailed installation instructions and next steps, please visit our quickstart guide.

🎉 Welcome to the v2.4.1 release of the kgateway project!

Release Notes

Changes since v2.4.0

Bug Fixes

• Fixed a control-plane/data-plane incompatibility during rolling upgrades where proxies still on an older version could have their entire endpoint (EDS) updates withheld, freezing them on stale/deleted backend IPs. (#14482)

Contributors

Thanks to all the contributors who made this release possible:

Installation

The kgateway project is available as a Helm chart and docker images.

Helm Charts

The Helm charts are available at:

• cr.kgateway.dev/kgateway-dev/charts/kgateway.

Docker Images

The docker images are available at:

• cr.kgateway.dev/kgateway-dev/kgateway:v2.4.1
• cr.kgateway.dev/kgateway-dev/sds:v2.4.1
• cr.kgateway.dev/kgateway-dev/envoy-wrapper:v2.4.1

Quickstart

Try installing this release:

helm install kgateway-crds oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds --version v2.4.1 --namespace kgateway-system --create-namespace
helm install kgateway oci://cr.kgateway.dev/kgateway-dev/charts/kgateway --version v2.4.1 --namespace kgateway-system --create-namespace

For detailed installation instructions and next steps, please visit our quickstart guide.

🎉 Welcome to the v2.4.0 release of the kgateway project!

Release Notes

Changes since v2.3.0

Breaking Changes

• Breaking: Using APIs to override image tags clears any digest. Non-breaking: Using APIs to change image digests now clears the image tag by default. Kubernetes did not use the tag when a digest was provided, and you can still provide both if you choose.

  This break applies only to users who have GatewayParameters that use a non-empty sha256 image digest. (Default parameters only use image tags, never image digests.)
  (#13953)

• remove deprecated perConnectionBufferLimitBytes gateway annotation support. Use ListenerPolicy instead. (#14156)

• Breaking: Control Plane / Data Plane Compatibility During Upgrades
  When upgrading the kgateway control plane from v2.3.x to v2.4.0, the control plane now injects a new "local cluster" Endpoint Discovery Service (EDS) resource (intended for zone-aware routing) into client snapshots. Most users will experience a smooth upgrade without any noticeable impact, especially if proxy pods roll over quickly. However, in environments with long rolling upgrade windows and high endpoint churn, older Envoy proxies will temporarily stop receiving endpoint updates until they are upgraded. We are addressing this issue in an upcoming patch release. (#14471)

New Features

• Add headersToClient and headersToClientOnSuccess fields to AuthorizationResponse in ExtHttpService, mapping to Envoy's allowed_client_headers and allowed_client_headers_on_success. This enables redirect-based OAuth2 flows by forwarding auth service response headers (e.g. Location) to the downstream client. (#13592)
• Add support for gateway-level TrafficPolicy application to routes. TrafficPolicies attached to Gateways now apply to child HTTPRoutes, with route-level policies taking precedence over gateway-level ones. (#13596)
• Envoy routes generated by kgateway now carry a io.kgateway.route_source
  filter metadata entry with the originating xRoute's kind, group, name,
  namespace, and rule name — enabling tracing correlation and access-log
  filtering against route origin.
  (#13620)
• Add filterStage configuration to ExtProc GatewayExtension, allowing control over filter chain positioning via stage, predicate, and weight fields. (#13845)
• Now storing release artifacts for each commit to make it easier to try out cutting-edge releases. Previously we only stored vX.Y.Z-main, a moving tag. Also fixes a minor race that could cause that tag to point to an older commit than desired. (#13876)
• Add GatewayParameters.spec.kube.envoyContainer.bootstrap.staticListenerProxyProtocol to enable the Envoy PROXY protocol listener filter on the readiness listener port. (#13879)
• TrafficPolicy headerModifiers now supports secret-backed header values via secretRef on set/add entries. name and key are both optional: each defaults to the other when only one is specified, and omitting both injects all entries from the secret as headers. The secret namespace defaults to the policy namespace. Cross-namespace references require a ReferenceGrant. (#13880)
• Add maxRequestsPerConnection to ListenerPolicy.httpSettings to cap downstream keepalive connections per client. Useful for rebalancing long-lived HTTP/2 and gRPC connections across gateway pods when using L4 load balancers such as AWS NLB. (#13922)
• Added forwardClientCertDetails to httpSettings on ListenerPolicy for forwarding selected fields of the downstream client certificate to upstream backends via the x-forwarded-client-cert (XFCC) header. (#13925)
• Added AWS EC2 backend support behind the controller.enableAwsEc2Discovery setting, allowing Backend resources to dynamically discover tagged EC2 instances and route to them through Envoy EDS. Lambda backends now prefer spec.aws.lambda.accountId, while the existing top-level spec.aws.accountId remains supported for backward compatibility. (#13961)
• Added BackendConfigPolicy zone-aware routing with native Envoy prefer-local and force-local support, including bootstrap locality wiring for Envoy proxies. (#13978)
• Added http2ProtocolOptions support to ListenerPolicy and HTTPListenerPolicy for configuring downstream HTTP/2 settings on Envoy listeners. (#13991)
• Add downstream TCP keepalive configuration to ListenerPolicy. (#13994)
• Add kgateway_routing_replacements_total counter metric. (#14019)
• Users can now customize the readiness and startup probes (#14020)
• Added stripHostPortMode to ListenerPolicy HTTPSettings, providing the option to strip ports
  from Host/authority headers before forwarding to upstream backends.
  (#14031)
• Add merge semantics for BackendConfigPolicy and define precedence between BackendConfigPolicy and BackendTLSPolicy when both target the same backend. (#14043)
• Add transportSocketConnectTimeout field to ListenerPolicy (#14058)
• Add an rbac.create value to disable the creation of the ClusterRole and ClusterRoleBinding (#14105)
• Add requestAttributes field to GatewayExtension ext_proc config, allowing
  Envoy attributes (e.g. source.address) to be forwarded to ext_proc servers.
  (#14109)
• Add an opt-in admin bind address setting for the kgateway control-plane admin server. (#14135)
• Added Envoy local reply configuration to ListenerPolicy (#14146)
• Add optional jwksBackendRef field to OAuth2JWTConfig in GatewayExtension, allowing JWKS endpoint to be fetched through a different backend than the OAuth2 token endpoint. (#14147)
• Added an AssumeRole AWS auth type to the Backend API (spec.aws.auth.assumeRole) for per-Backend STS role chaining, used for both Lambda request signing and EC2 instance discovery. The previous spec.aws.ec2.roleArn field is replaced by spec.aws.auth.assumeRole.roleArn. (#14148)
• EC2 backends now report an EndpointsDiscovered status condition reflecting whether runtime endpoint discovery succeeded, including credential, authorization, and zero-match failures. (#14173)
• added max_headers_count setting to ListenerPolicy (#14188)
• added reference grant mode (#14209)
• Added asyncFetch and retryPolicy options to the JWT provider remote JWKS configuration, enabling asynchronous JWKS fetching/caching and retries with exponential backoff. (#14211)
• Added support for GatewayHTTPListenerIsolation conformance behavior for HTTP listeners. (#14234)
• Add support for Gateway API 1.6.0 (#14245)
• Add internal redirect feature in TrafficPolicy (#14261)
• TrafficPolicy response compression now supports selecting and negotiating multiple codecs via compression.responseCompression.libraries (Gzip, Brotli, Zstd, in preference order). Envoy negotiates the codec from the request's Accept-Encoding header. Defaults to Gzip, preserving existing behavior. (#14275)
• Allow configuring supported TLS signature algorithms in Gateway and BackendConfigPolicy (#14282)
• EC2 backends now expose Prometheus metrics for endpoint discovery: kgateway_ec2_discovery_poll_total, kgateway_ec2_discovery_endpoints_active, kgateway_ec2_discovery_error_state, and kgateway_ec2_discovery_poll_duration_seconds. (#14318)
• Added allowConnect to listener `http2ProtocolOption...

🎉 Welcome to the v2.4.0-rc.1 release of the kgateway project!

Release Notes

Changes since v2.3.0

Breaking Changes

• Breaking: Using APIs to override image tags clears any digest. Non-breaking: Using APIs to change image digests now clears the image tag by default. Kubernetes did not use the tag when a digest was provided, and you can still provide both if you choose.

  This break applies only to users who have GatewayParameters that use a non-empty sha256 image digest. (Default parameters only use image tags, never image digests.)
  (#13953)

• remove deprecated perConnectionBufferLimitBytes gateway annotation support. Use ListenerPolicy instead. (#14156)

New Features

• Add headersToClient and headersToClientOnSuccess fields to AuthorizationResponse in ExtHttpService, mapping to Envoy's allowed_client_headers and allowed_client_headers_on_success. This enables redirect-based OAuth2 flows by forwarding auth service response headers (e.g. Location) to the downstream client. (#13592)
• Add support for gateway-level TrafficPolicy application to routes. TrafficPolicies attached to Gateways now apply to child HTTPRoutes, with route-level policies taking precedence over gateway-level ones. (#13596)
• Envoy routes generated by kgateway now carry a io.kgateway.route_source
  filter metadata entry with the originating xRoute's kind, group, name,
  namespace, and rule name — enabling tracing correlation and access-log
  filtering against route origin.
  (#13620)
• Add filterStage configuration to ExtProc GatewayExtension, allowing control over filter chain positioning via stage, predicate, and weight fields. (#13845)
• Now storing release artifacts for each commit to make it easier to try out cutting-edge releases. Previously we only stored vX.Y.Z-main, a moving tag. Also fixes a minor race that could cause that tag to point to an older commit than desired. (#13876)
• Add GatewayParameters.spec.kube.envoyContainer.bootstrap.staticListenerProxyProtocol to enable the Envoy PROXY protocol listener filter on the readiness listener port. (#13879)
• TrafficPolicy headerModifiers now supports secret-backed header values via secretRef on set/add entries. name and key are both optional: each defaults to the other when only one is specified, and omitting both injects all entries from the secret as headers. The secret namespace defaults to the policy namespace. Cross-namespace references require a ReferenceGrant. (#13880)
• Add maxRequestsPerConnection to ListenerPolicy.httpSettings to cap downstream keepalive connections per client. Useful for rebalancing long-lived HTTP/2 and gRPC connections across gateway pods when using L4 load balancers such as AWS NLB. (#13922)
• Added forwardClientCertDetails to httpSettings on ListenerPolicy for forwarding selected fields of the downstream client certificate to upstream backends via the x-forwarded-client-cert (XFCC) header. (#13925)
• Added AWS EC2 backend support behind the controller.enableAwsEc2Discovery setting, allowing Backend resources to dynamically discover tagged EC2 instances and route to them through Envoy EDS. Lambda backends now prefer spec.aws.lambda.accountId, while the existing top-level spec.aws.accountId remains supported for backward compatibility. (#13961)
• Added BackendConfigPolicy zone-aware routing with native Envoy prefer-local and force-local support, including bootstrap locality wiring for Envoy proxies. (#13978)
• Added http2ProtocolOptions support to ListenerPolicy and HTTPListenerPolicy for configuring downstream HTTP/2 settings on Envoy listeners. (#13991)
• Add downstream TCP keepalive configuration to ListenerPolicy. (#13994)
• Add kgateway_routing_replacements_total counter metric. (#14019)
• Users can now customize the readiness and startup probes (#14020)
• Added stripHostPortMode to ListenerPolicy HTTPSettings, providing the option to strip ports
  from Host/authority headers before forwarding to upstream backends.
  (#14031)
• Add merge semantics for BackendConfigPolicy and define precedence between BackendConfigPolicy and BackendTLSPolicy when both target the same backend. (#14043)
• Add transportSocketConnectTimeout field to ListenerPolicy (#14058)
• Add an rbac.create value to disable the creation of the ClusterRole and ClusterRoleBinding (#14105)
• Add requestAttributes field to GatewayExtension ext_proc config, allowing
  Envoy attributes (e.g. source.address) to be forwarded to ext_proc servers.
  (#14109)
• Add an opt-in admin bind address setting for the kgateway control-plane admin server. (#14135)
• Added Envoy local reply configuration to ListenerPolicy (#14146)
• Add optional jwksBackendRef field to OAuth2JWTConfig in GatewayExtension, allowing JWKS endpoint to be fetched through a different backend than the OAuth2 token endpoint. (#14147)
• Added an AssumeRole AWS auth type to the Backend API (spec.aws.auth.assumeRole) for per-Backend STS role chaining, used for both Lambda request signing and EC2 instance discovery. The previous spec.aws.ec2.roleArn field is replaced by spec.aws.auth.assumeRole.roleArn. (#14148)
• EC2 backends now report an EndpointsDiscovered status condition reflecting whether runtime endpoint discovery succeeded, including credential, authorization, and zero-match failures. (#14173)
• added max_headers_count setting to ListenerPolicy (#14188)
• added reference grant mode (#14209)
• Added asyncFetch and retryPolicy options to the JWT provider remote JWKS configuration, enabling asynchronous JWKS fetching/caching and retries with exponential backoff. (#14211)
• Added support for GatewayHTTPListenerIsolation conformance behavior for HTTP listeners. (#14234)
• Add support for Gateway API 1.6.0 (#14245)
• Add internal redirect feature in TrafficPolicy (#14261)
• TrafficPolicy response compression now supports selecting and negotiating multiple codecs via compression.responseCompression.libraries (Gzip, Brotli, Zstd, in preference order). Envoy negotiates the codec from the request's Accept-Encoding header. Defaults to Gzip, preserving existing behavior. (#14275)
• Allow configuring supported TLS signature algorithms in Gateway and BackendConfigPolicy (#14282)
• EC2 backends now expose Prometheus metrics for endpoint discovery: kgateway_ec2_discovery_poll_total, kgateway_ec2_discovery_endpoints_active, kgateway_ec2_discovery_error_state, and kgateway_ec2_discovery_poll_duration_seconds. (#14318)
• Added allowConnect to listener http2ProtocolOptions (ListenerPolicy and HTTPListenerPolicy), mapping to Envoy's HCM http2_protocol_options.allow_connect, to support WebSocket-over-HTTP/2 (RFC 8441 Extended CONNECT). (#14323)
• Added support for excluding Istio ServiceEntries from kgateway ServiceEntry backend and endpoint discovery using Kubernetes label selectors. (#14328)
• TrafficPolicy retry configuration is now applied at the route level instead of the virtual host level, making retry policy precedence between TrafficPolicy and the builtin HTTPRouteRetry policy explicit and consistent. ([#14360](https://github.com/kgateway-dev/kgate...

🎉 Welcome to the v2.4.0-beta.2 release of the kgateway project!

Release Notes

Changes since v2.4.0-beta.1

New Features

• Add headersToClient and headersToClientOnSuccess fields to AuthorizationResponse in ExtHttpService, mapping to Envoy's allowed_client_headers and allowed_client_headers_on_success. This enables redirect-based OAuth2 flows by forwarding auth service response headers (e.g. Location) to the downstream client. (#13592)
• Now storing release artifacts for each commit to make it easier to try out cutting-edge releases. Previously we only stored vX.Y.Z-main, a moving tag. Also fixes a minor race that could cause that tag to point to an older commit than desired. (#13876)
• Add transportSocketConnectTimeout field to ListenerPolicy (#14058)
• Add an rbac.create value to disable the creation of the ClusterRole and ClusterRoleBinding (#14105)
• TrafficPolicy response compression now supports selecting and negotiating multiple codecs via compression.responseCompression.libraries (Gzip, Brotli, Zstd, in preference order). Envoy negotiates the codec from the request's Accept-Encoding header. Defaults to Gzip, preserving existing behavior. (#14275)
• Allow configuring supported TLS signature algorithms in Gateway and BackendConfigPolicy (#14282)
• EC2 backends now expose Prometheus metrics for endpoint discovery: kgateway_ec2_discovery_poll_total, kgateway_ec2_discovery_endpoints_active, kgateway_ec2_discovery_error_state, and kgateway_ec2_discovery_poll_duration_seconds. (#14318)
• Added allowConnect to listener http2ProtocolOptions (ListenerPolicy and HTTPListenerPolicy), mapping to Envoy's HCM http2_protocol_options.allow_connect, to support WebSocket-over-HTTP/2 (RFC 8441 Extended CONNECT). (#14323)
• Added connectionKeepalive to BackendConfigPolicy.spec.http2ProtocolOptions, enabling Envoy HTTP/2 keepalive PINGs for active half-dead upstream connection detection. (#14367)
• Added default-off support for ordered ADS delivery via KGW_ENABLE_ORDERED_ADS=true, preserving CDS, EDS, LDS, and RDS response order for same-snapshot busy-stream additions. (#14372)
• Added an opt-in statPrefix field to TrafficPolicy that sets the Envoy route stat_prefix, enabling per-route statistics. The value supports {{route_name}}, {{route_namespace}}, and {{rule_name}} template variables and is only honored for HTTPRoute and GRPCRoute targets. (#14409)

Bug Fixes

• Fix XListenerSet status patch failures caused by missing required port field since v2.3.0. (#14231)
• Fix route status reporting and ensure stale status is cleared for GRPCRoute, TCPRoute, and TLSRoute resources. (#14294)
• TrafficPolicy retry may now target a whole Gateway (without a sectionName), consistent with timeouts. TrafficPolicy urlRewrite is now validated to only target HTTPRoute resources, matching its documented behavior. (#14378)
• Fix 503s for ingress-use-waypoint routes to auto-allocated ServiceEntries. (#14391)

Cleanup

• Refactor: replace sort package with slices package for cleaner sorting code. (#14356)

Dependency Updates

• Kgateway now supports Gateway API v1.6.1 (#14426)

Contributors

Thanks to all the contributors who made this release possible:

Installation

The kgateway project is available as a Helm chart and docker images.

Helm Charts

The Helm charts are available at:

• cr.kgateway.dev/kgateway-dev/charts/kgateway.

Docker Images

The docker images are available at:

• cr.kgateway.dev/kgateway-dev/kgateway:v2.4.0-beta.2
• cr.kgateway.dev/kgateway-dev/sds:v2.4.0-beta.2
• cr.kgateway.dev/kgateway-dev/envoy-wrapper:v2.4.0-beta.2

Quickstart

Try installing this release:

helm install kgateway-crds oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds --version v2.4.0-beta.2 --namespace kgateway-system --create-namespace
helm install kgateway oci://cr.kgateway.dev/kgateway-dev/charts/kgateway --version v2.4.0-beta.2 --namespace kgateway-system --create-namespace

For detailed installation instructions and next steps, please visit our quickstart guide.

🎉 Welcome to the v2.2.9 release of the kgateway project!

Release Notes

Changes since v2.2.8

Bug Fixes

• Fix a reconnect-time xDS race where Envoy could briefly receive routes and listeners before all referenced backend clusters were present, causing transient NC/500 responses during controller restart. Uses a brief first-connect grace period (configurable via KGW_XDS_FIRST_CONNECT_DELAY). (#13868, #14386)
• Fixed TrafficPolicy retry translation for HTTPS listeners by applying retry policy at route level. (#14304)
• Fixed north-south traffic to a global service continuing to route to a local pod for the duration of its termination grace period. kgateway now drains a terminating pod (deletionTimestamp set) from ServiceEntry-derived endpoints and fails over to a healthy peer-cluster endpoint, consistent with the east-west (ztunnel) path and the Kubernetes Service backend path. (#14334)
• Fixed TrafficPolicy validation to include retry and timeout configuration. (#14337)
• kgateway no longer overwrites an existing Kubernetes Service for a Gateway unless the Service has a matching Gateway ownerReference or kgateway ownership metadata. (#14350)
• Fixed TrafficPolicy retry translation for HTTPS listeners by applying retry policy at route level. (#14392)

Installation

The kgateway project is available as a Helm chart and docker images.

Helm Charts

The Helm charts are available at:

• cr.kgateway.dev/kgateway-dev/charts/kgateway.

Docker Images

The docker images are available at:

• cr.kgateway.dev/kgateway-dev/kgateway:v2.2.9
• cr.kgateway.dev/kgateway-dev/sds:v2.2.9
• cr.kgateway.dev/kgateway-dev/envoy-wrapper:v2.2.9

Quickstart

Try installing this release:

helm install kgateway-crds oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds --version v2.2.9 --namespace kgateway-system --create-namespace
helm install kgateway oci://cr.kgateway.dev/kgateway-dev/charts/kgateway --version v2.2.9 --namespace kgateway-system --create-namespace

For detailed installation instructions and next steps, please visit our quickstart guide.

🎉 Welcome to the v2.4.0-beta.1 release of the kgateway project!

Release Notes

Changes since v2.4.0-alpha.2

New Features

• Envoy routes generated by kgateway now carry a io.kgateway.route_source
  filter metadata entry with the originating xRoute's kind, group, name,
  namespace, and rule name — enabling tracing correlation and access-log
  filtering against route origin.
  (#13620)
• Added asyncFetch and retryPolicy options to the JWT provider remote JWKS configuration, enabling asynchronous JWKS fetching/caching and retries with exponential backoff. (#14211)
• Add support for Gateway API 1.6.0 (#14245)
• Add internal redirect feature in TrafficPolicy (#14261)
• Added support for excluding Istio ServiceEntries from kgateway ServiceEntry backend and endpoint discovery using Kubernetes label selectors. (#14328)
• TrafficPolicy retry configuration is now applied at the route level instead of the virtual host level, making retry policy precedence between TrafficPolicy and the builtin HTTPRouteRetry policy explicit and consistent. (#14360)
• Added a new priorityGroups backend type to the Backend API, enabling active/passive failover between static backends. Each group in the ordered list becomes an Envoy priority level; traffic fails over to the next group when the preceding groups' endpoints are unhealthy, and recovers automatically. Combine with an active health check via BackendConfigPolicy to drive failover. (#14379)
• added get cookie functions to transformation template funcion (#14385)

Bug Fixes

• Fix a reconnect-time xDS race where Envoy could briefly receive routes and listeners before all referenced backend clusters were present, causing transient NC/500 responses during controller restart. (#13868)
• Fixed two HTTPListenerPolicy/DirectResponse cases where an IR field could be compared by pointer identity instead of value, causing spurious re-translations. (#14331)
• Fixed north-south traffic to a global service continuing to route to a local pod for the duration of its termination grace period. kgateway now drains a terminating pod (deletionTimestamp set) from ServiceEntry-derived endpoints and fails over to a healthy peer-cluster endpoint, consistent with the east-west (ztunnel) path and the Kubernetes Service backend path. (#14332)
• Fixed a bug where a TrafficPolicy timeout (and other route-level settings) targeting a Gateway HTTP listener section was silently ignored. (#14374)
• Fix a bug where per-client xDS snapshots could be withheld indefinitely (reverts #13868/#13958), stranding running gateway pods on stale endpoints and starving newly created pods of any configuration until they crashloop. The control plane now publishes snapshots unconditionally and instead delays each newly connected client's first xDS response by a short grace period (default 1s, configurable via KGW_XDS_FIRST_CONNECT_DELAY; 0 disables) so per-client translation can converge before the first snapshot is served. Trade-off: in environments where per-client translation exceeds the grace period, a controller restart can once again cause a brief, self-healing burst of upstream-connect (NC) errors on reconnecting proxies; raise KGW_XDS_FIRST_CONNECT_DELAY if you observe this. (#14380)

Contributors

Thanks to all the contributors who made this release possible:

Installation

The kgateway project is available as a Helm chart and docker images.

Helm Charts

The Helm charts are available at:

• cr.kgateway.dev/kgateway-dev/charts/kgateway.

Docker Images

The docker images are available at:

• cr.kgateway.dev/kgateway-dev/kgateway:v2.4.0-beta.1
• cr.kgateway.dev/kgateway-dev/sds:v2.4.0-beta.1
• cr.kgateway.dev/kgateway-dev/envoy-wrapper:v2.4.0-beta.1

Quickstart

Try installing this release:

helm install kgateway-crds oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds --version v2.4.0-beta.1 --namespace kgateway-system --create-namespace
helm install kgateway oci://cr.kgateway.dev/kgateway-dev/charts/kgateway --version v2.4.0-beta.1 --namespace kgateway-system --create-namespace

For detailed installation instructions and next steps, please visit our quickstart guide.

🎉 Welcome to the v2.3.6 release of the kgateway project!

Release Notes

Changes since v2.3.5

New Features

• Added support for excluding Istio ServiceEntries from kgateway ServiceEntry backend and endpoint discovery using Kubernetes label selectors. (#14328, #14359)

Bug Fixes

• Fixed a bug where a Gateway, Route, Backend, or ListenerSet status observedGeneration could intermittently freeze at a stale value after a spec change, due to a skew between the translation cache and the status syncer's cache. (#14302)
• Fixed TrafficPolicy retry translation for HTTPS listeners by applying retry policy at route level. (#14304)
• Fixed two HTTPListenerPolicy/DirectResponse cases where an IR field could be compared by pointer identity instead of value, causing spurious re-translations. (#14331)
• Fixed north-south traffic to a global service continuing to route to a local pod for the duration of its termination grace period. kgateway now drains a terminating pod (deletionTimestamp set) from ServiceEntry-derived endpoints and fails over to a healthy peer-cluster endpoint, consistent with the east-west (ztunnel) path and the Kubernetes Service backend path. (#14335)
• Fixed TrafficPolicy validation to include retry and timeout configuration. (#14336)
• Fixed HttpListenerPolicy and DirectResponse being re-translated unnecessarily because their IR Equals methods compared pointer-bearing fields by identity instead of by value. (#14342)
• kgateway no longer overwrites an existing Kubernetes Service for a Gateway unless the Service has a matching Gateway ownerReference or kgateway ownership metadata. (#14351)
• Reverted the per-client xDS whole-snapshot readiness gates, which could withhold a gateway's configuration indefinitely when it referenced a backend that can never become ready (for example an ExternalName Service) — stranding already-connected proxies on stale endpoints and crash-looping newly started proxy pods. Readiness is now handled by a bounded per-stream first-connect grace period (configurable via KGW_XDS_FIRST_CONNECT_DELAY, defaulting to 1s). (#14387)

Cleanup

• Fixed GatewayExtension equality to include the object source, and Listener equality to ignore parent object metadata churn (e.g. resourceVersion bumps from status writes), preventing missed updates and spurious recomputation. (#14248)

Contributors

Thanks to all the contributors who made this release possible:

Installation

The kgateway project is available as a Helm chart and docker images.

Helm Charts

The Helm charts are available at:

• cr.kgateway.dev/kgateway-dev/charts/kgateway.

Docker Images

The docker images are available at:

• cr.kgateway.dev/kgateway-dev/kgateway:v2.3.6
• cr.kgateway.dev/kgateway-dev/sds:v2.3.6
• cr.kgateway.dev/kgateway-dev/envoy-wrapper:v2.3.6

Quickstart

Try installing this release:

helm install kgateway-crds oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds --version v2.3.6 --namespace kgateway-system --create-namespace
helm install kgateway oci://cr.kgateway.dev/kgateway-dev/charts/kgateway --version v2.3.6 --namespace kgateway-system --create-namespace

For detailed installation instructions and next steps, please visit our quickstart guide.