Contour v0.13.0

VMware is proud to present version 0.13 of Contour, our Envoy powered Kubernetes Ingress Controller. As always, without the help of the many community contributors, this release would not have been possible. Thank you!

New and improved

Contour 0.13 includes several new features as well as the usual smattering of fixes and minor improvements.

Session Affinity

Session affinity, also known as sticky sessions, is a load balancing strategy whereby a sequence of requests from a single client are consistently routed to the same application backend. Contour 0.13.0 supports session affinity with the strategy: Cookie key on a per-service basis.

apiVersion: contour.heptio.com/v1beta1
kind: IngressRoute
metadata:
  name: httpbin
  namespace: default
spec:
  virtualhost:
    fqdn: httpbin.davecheney.com
  routes:
  - match: /
    services:
    - name: httpbin
      port: 8080
      strategy: Cookie

See the design document and IngressRoute documentation for more information.

Service ExternalNames are now supported

Contour now supports proxying traffic to Services which use service.spec.externalName.
When service.spec.externalName is defined DNS is used to discover the services' external endpoints.

Both HTTP and TCP ExternalNames are supported.

See the design document and Kubernetes' Service documentation for more information.

Fixes #334. Thanks @stevesloka.

Sample deployment/ YAML examples moved to examples/

Since our 0.1 release Contour has always included in the repository sample YAML for various configurations.
These were always intended to be examples, and this is how the Contour team always perceived them.
However, we did a bad job of communicating this to our user base, which we are now trying to correct.

In operation, nothing has changed with the sample YAML other than it has moved from deployment/ to examples/ to make clear that these are in fact simply examples.

Fixes #1118. Many thanks to @rochacon.

--envoy-external-http-port and --envoy-external-https-port flags have been deprecated

Due to a long-standing limitation in Envoy, if Contour was deployed on ports other than the tradition 80 (HTTP), and 443 (HTTPS), operators were required to pass to Envoy, via --envoy-external-http-port and --envoy-external-https-port, the non-standard ports that were in use. This was annoying in practice and restricted the use of local development tools like Minikube and Kind.

Contour 0.13.0 introduces a workaround for envoyproxy/envoy#1269, that removes the need to inform Envoy of external ports that will be forwarded to it. In turn, this should make it easier to deploy Contour inside Kind or Minikube clusters.

As they are no longer needed, the --envoy-external-http-port and --envoy-external-https-port flags now generate a warning if used and will be removed completely in 0.14.0.

Fixes #210. Thanks @youngnick.

force-ssl-redirect now takes precidence over the ingress.allow-http annotation

The behavior when the kubernetes.io/ingress.allow-http and ingress.kubernetes.io/force-ssl-redirect were both specified was somewhat surprising. ingress.allow-http: false meant that no routes were not registered for port 80, even if force-ssl-redirect: true was set leading to a 404 where a 3xx upgrade to https was expected.

Contour 0.13.0 now prioritizes force-ssl-redirect. If this annotation is specified and set to true, Contour will always register a port 80 route for the ingress, even if ingress.allow-http: false, so that the forced upgrade can take effect.

Fixes #1023 with many thanks to @ceralena.

Maglev and RingHash load balancer strategies no longer supported.

RingHash and Maglev are two balancing/affinity strategies offered by IngressRoute. However, due to a lack of understanding of how they worked when they were added in Contour 0.6, neither strategy was properly configured and would only result in random behavior.
Without the ability to configure the hash key, which is usually some form of a session cookie, these strategies are not useful and cannot be used correctly.
As such they have been removed from the list of valid strategies.

For their replacement, see the earlier section on Session Affinity.

Fixes #1030 and #1150

HTTP and TCP idle timeouts

Contour 0.13.0 configures an explicit timeout for all idle HTTP and TCP proxy connections. As the definition of idle differs between HTTP and TCP modes the values are different.

• For HTTP an idle timeout of 60 seconds is configured for all connections. After 60 seconds a connection without activity will be closed.
• For TCP proxy idle connections are expected to stay open longer thus the idle timeout is set to 9001 seconds. This value is larger than the default TCP keepalive timeout on most operating systems so the most likely scenario is the operating system will time out the connection before Envoy does. The Envoy idle timeout acts as a second line of defense to avoid leaking file descriptors.

Fixes #1045 and #1074. Thanks @mattalberts and @youngnick.

Envoy memory usage

As part of a continuing effort to characterize and reduce the amount of memory used by Envoy, Contour 0.13 contains several improvements and bug fixes intended to reduce Envoy's footprint.
This work will continue in 0.14 and onwards.

Fixes or updates #499, #876, #1096

Huge thanks to @lrouquette, @mattalberts, @phylake, and many more for their assistance.

IPv6 improvements

Contour now understands the IPv6-any address, "::", and when used Contour will instruct Envoy to open ports on both IPv4 and IPv6 stacks. For example:

command: ["contour"]
args:
- serve
- --incluster
- --envoy-service-http-port=8080
- --envoy-service-https-port=8443
- "--stats-address=::"
- "--envoy-service-https-address=::"
- "--envoy-service-http-address=::"

This makes it possible to use the same config for ipv4-only and ipv6-only k8s, and enables dual-stack.
Big thanks to @uablrek for improving the story for IPv6 only or dual stack Kubernetes clusters.

Other improvements

• Envoy upgraded to 1.10.0. Thanks @stevesloka. Fixes #998.
• IngressRoute now validates that a secret is valid before using it and sets the appropriate status on the IngressRoute object if not. Thanks @stevesloka
• The Envoy's stats listener is now generated programmatically from Contour rather than hardcoded in the bootstrap configuration. Thanks @stevesloka
• Envoy 1.10.0 natively generates statistics in Prometheus format, removing the need for statsd. Fixes #1035, #1086. Thanks @rata and @stevesloka.
• A document outlining the development workflow of the Contour team has been added. It may be informative to interested contributors. We've also updated our CONTRIBUTING document with some guidelines for commit and PR messages. Fixes #1136. Thanks @youngnick.
• Contour now verifies that a TLS secret is of type kubernetes.io/tls and contains the required tls.crt and tls.key elements.

Bugs fixed

Contour 0.13 fixes a problem whereby Envoy could stall during startup if the cluster contains Services with no active pods. This situation is commonly encountered when a Service's Deployment has been scaled to zero replicas.

This fix was also backported to 0.12.1.

For more information see #1091 and #1110.

Additional bug fixes

• The CRD validation for the spec.virtualhost.fqdn field has been adjusted once more. Fixes #755, #1117. Thanks @youngnick.
• A broken link in our Zenhub documentation has been corrected. Fixes #1160. Thanks @paivagustavo.

Upgrading

• The --envoy-external-http-port and --envoy-external-https-port flags are deprecated will be removed in 0.14.0. There is no replacement, the flags are no longer required and should be removed from your deployment YAML.
• Contour 0.13 requires Envoy 1.10.0.

  docker.io/envoyproxy/envoy:v1.10.0
  

  Versions of Envoy later than 1.10.0 are not tested and not guaranteed to work with Contour 0.13.0.
• The strategy: Maglev and strategy: RingHash load balancer strategies have been removed. They never worked correctly and were functionally equivalent of strategy: Random. If cookie based routing is required, see the earlier section on Session Affinity.