1.4.1

Istio Compatibility

This release is compatible with Istio 1.1.0 and above. It has been tested against Istio 1.3.4.

Release Notes

Overview

• Analytics reporting tested and behaves well under high load with lower CPU use.
• sample adapter.yaml now has logging set to info instead of debug

Changelog

f4a0efa analytics rewrite: better channel use, worker pool

1.4.0

Istio Compatibility

This release is compatible with Istio 1.1.0 and above. It has been tested against Istio 1.3.3.

Release Notes

Overview

• API Keys can now be cached while disconnected
• Quotas now count locally while disconnected
• Logging has been cleaned up

Breaking changes

• api_key_claim option has been moved into an auth subsection of the handler configuration. See config.proto for more details.

• The way that API Keys are checked and cached has changed. Previously, API Keys would be cached for the length of time in the JWT generated by the /verifyAPIKey endpoint and fetched again as needed. Going forward, API Keys will still be revalidated and refreshed on that interval, however a new config item: api_key_cache_duration has been added to the auth section to control how long an API Keys will remain valid when a refresh is impossible (ie. the adapter is unable to reach Apigee). This allows the adapter to operate in a disconnected state for a longer duration - while still updating the API Key information when it is available to.

• Invalid auth attempts are no longer sent to the log as errors, it is now debugging information. The logging at info level is now fairly minimal.

• The apigee-adapter-debug docker image now has a ENTRYPOINT to enable easier switching between the images in Kubernetes deployment.

Changelog

62a7bfa prep 1.4.0
f2b3de6 standardize auth errors
e98d204 don't create and log an error for each bad auth
a574dc2 add an entrypoint to debug docker image
8985437 cache errors in known bad cache
47a06b3 test coverage
a8fafc1 api keys now cached while disconnected api keys renewed in background move auth config and add api key cache duration improved auth status codes and messages improved logging
3f42dfb quota should use local counter, not fail completely closed when disconnected
ac01973 HTTPAPISpec is deprecated, remove

1.3.0

Istio Compatibility

This release is compatible with Istio 1.1.0 and above. It has been tested against Istio 1.3.1.

Release Notes

Fixes Quota counting and bucket window behavior.

If upgrading from a previous version, be sure to run apigee-istio provision and use the --forceProxyInstall option to upgrade your istio-auth proxy!

BREAKING CHANGE: Because the quota type has changed to "calendar" from "flexi", any in-flight quota counts may be wrong until the quota bucket windows reset.

Changelog

ac981b3 change quota policy type from flexi to calendar, avoids flexi quota bug in edge
d52606b make quota work as client expects
ed47486 more logging

1.2.0

Istio Compatibility

This release is compatible with Istio 1.1.0 and above. It has been tested against Istio 1.3.0.

Release Notes

• move quota processing to customer organization istio-auth proxy
• quotas are now handled synchronously on the server (still asynchronously on the client)

BREAKING CHANGE: This is a potential breaking change for customers upgrading from prior releases. Because the location of where quotas are stored has changed from an Apigee organization to the customer organization, any in-flight quota counts will be reset.

Changelog

97183d7 prep 1.2.0
57c9b53 Merge pull request #294 from apigee/issue-292
72d5b01 use customer proxy for quota verification
b8bd879 update goreleaser v0.117.1
5edaecb Gopkg should use override instead of constraint
683f755 add proper auth to quota calls
fb6860d nail down gogo/googleapis version to fix builds
a5909f6 switch client to istio-auth quota endpoint
083f8cf add /quota endpoint to auth-proxy (synchronous: true)
8f03ad8 update goreleaser config to remove deprecation notice

1.1.5

Istio Compatibility

This release is compatible with Istio 1.1.0 and above. It has been tested with Istio 1.2.2.

Release Notes

• address new requirement to include unique gateway_flow_id for analytics records

Changelog

2a652ad prep 1.1.5
f3609a1 gocyclo refactoring
c26cc8a fmt and lint
0765336 add gateway_flow_id to ax records

1.1.4

Istio Compatibility

This release is compatible with Istio 1.1.0 and above. It has been tested up to Istio 1.2.0.

Release Notes

• apigee-istio provision no longer has a --grpc option, it always provisions using grpc.
• fixes an issue where the adapter might improperly restart during quota processing.

Changelog

6d23219 guard syncingBuckets with mutex
0493f81 enable kubernetes probes
461a770 remove Istio 1.0 references
e025623 update adapter proto docs
761a08d remove --grpc option from CLI provision
8ca86d1 remove refs to Istio 1.0 in docs, move grpc samples to samples/apigee

1.1.3

Istio Compatibility

This release is compatible with Istio 1.1.0 and above. It has been tested against Istio 1.1.5.

Release Notes

There was an error in the initial 1.1.3 image. If you downloaded 1.1.3 prior to 5/14, please re-download.

There is a new config option to ignore self-signed Apigee Server certs. To enable, add allowUnverifiedSSLCert: true to the params in samples/apigee/grpc/handler.yaml.

Istio 1.1 installation reminders

• This release is utilizes Istio's external gRPC adapter protocol, there is no Mixer image.
• Policy control must be explicitly enabled in Istio, see Enabling Policy Enforcement for more details.

Changelog

7539cfc update istio constraint to 1.1.5
164ead3 add script to update grpc definitions
919f0df don't attempt to close null body
a9cc351 add allowUnverifiedSSLCert config
7a67a9a test cleanup

1.1.2

Istio Compatibility

This release is compatible with Istio 1.1.0 and above. It has been tested against Istio 1.1.4.

Release Notes

The primary purpose of this release is to improve behavior when adapter is unable to reach Apigee. Specifically, there was an issue that allowed quota requests to build in memory until Apigee was reachable at which point the accumulated quota weight was assigned to the current Apigee quota bucket. Instead, individual quota requests are no longer maintained between syncs and if the local bucket expires, the server is no longer assigned the quota when reconnected, thus avoiding dumping into the new quota bucket.

Installation reminders

For Istio 1.1.x, policy control is no longer enabled by default. For Apigee's policy features to take effect, policy control must now be explicitly enabled in Istio config. See Enabling Policy Enforcement for more details.

The 1.1 release line is based on Istio's external gRPC Mixer adapter protocol and relies on deploying the adapter as a separate service. A custom Istio Mixer image is not available.

Changelog

36e4477 better sync and disconnected behavior for quota
acc5936 properly expose address and log_output_level w/ example
4e61d00 mtls config should be object. closes #268
14a99a9 single-thread staging to avoid potential double commit

1.0.7

Istio Compatibility

This mixer release is compiled against Istio 1.0.7.

Note: Istio 1.0.7 includes an important security update and 1.0.x users are advised to upgrade to this version ASAP. See this blog post for more information.

Mixer Information

image: gcr.io/apigee-api-management-istio/istio-mixer:1.0.7
debug image: gcr.io/apigee-api-management-istio/istio-mixer-debug:1.0.7

1.1.1

Istio Compatibility

This release is for Istio 1.1.0 and above. It has been tested against Istio 1.1.0, 1.1.1, and 1.1.2.

Release Notes

For Istio 1.1.x, policy control is no longer enabled by default. For Apigee's policy features to take effect, policy control must now be explicitly enabled in Istio config. See Enabling Policy Enforcement for more details.

This release exclusively supports Istio 1.1's external gRPC Mixer adapter protocol - it does not require or include a custom mixer image.

note on prior (1.0.0) release

The apigee-istio provision --grpc command in 1.0.0 was creating an incorrect handler file. If you have a 1.0.0 handler file, you must either regenerate the file using the provision command or you must edit the file to have kind: handler and adapter: apigee. Without the correct field values, the handler will not be recognized by Mixer.

Changelog

aefdeaf grpc kind should be 'handler'