- Root certificate rotation is now supported through the new CRD, MeshRootCertificate.
- Along with root certificate rotation we support custom trust domains, as well as rotating to new trust domains with no downtime.
- The following metrics no longer use the label
common_name
, due to the fact that the common name's trust domain can rotate. Instead 2 new labels,proxy_uuid
andidentity
have been added.osm_proxy_response_send_success_count
osm_proxy_response_send_error_count
osm_proxy_xds_request_count
- Circuit breaking support for traffic directed to in-mesh and external destinations
The following changes are not backward compatible with the previous release.
- The
osm_proxy_response_send_success_count
andosm_proxy_response_send_error_count
metrics are now labeled with the proxy certificate's common name and XDS type, so queries to match the previous equivalent need to sum for all values of each of those labels.
The following capabilities have been deprecated and cannot be used.
- The
osm_injector_injector_sidecar_count
andosm_injector_injector_rq_time
metrics have been removed. Theosm_admission_webhook_response_total
andosm_http_response_duration
metrics should be used instead. - OSM will no longer support installation on Kubernetes version v1.19.
- New internal control plane event management framework to handle changes to the Kubernetes cluster and policies
- Validations to reject/ignore invalid SMI TrafficTarget resources
- Control plane memory utilization improvements
- Support for TCP server-first protocols for in-mesh traffic
- Updates to Grafana dashboards to reflect accurate metrics
- OSM control plane images are now multi-architecture, built for linux/amd64 and linux/arm64
The following changes are not backward compatible with the previous release.
- Top level Helm chart keys are renamed from
OpenServiceMesh
toosm
osm mesh upgrade
no longer carries over values from previous releases. Use the--set
flag onosm mesh upgrade
to pass values as needed. The--container-registry
and--osm-image-tag
flags have also been removed in favor of--set
.
The following capabilities have been deprecated and cannot be used.
- Kubernetes Ingress API to configure a service mesh backend to authorize ingress traffic. OSM's IngressBackend API must be used to authorize ingress traffic between an ingress gateway and service mesh backend.