Release v2.7.0

[kpacha]

Release v2.7.0

JWT

• in the JWT, SignatureConfig, a new leeway field has been added to allow an "extra" valid time for the JWT: https://github.com/krakend/krakend-jose/pull/131/files

audit rules

• add OpenTelemetry recommendations:
  • mark as deprecated opencensus, ganalytics, and instana
  • check if more than one system is reporting metrics
• add check for deprectade plugins.
• check gRPC server number of exposed services
• fix false positive rule for no rate limit control

rate limit

• improved memory usage
• add num_shards param to configure the sharding for each rate limit (impacts the supported parallel access to rate limit counters)
• Added the params to tweak the expiration with cleanup_period (how often we run the cleanup process, defaults to 1 minute) and cleanup_threads (the number of parallel clean threads, that defaults to 1, and should not be changed except if an extreme case is detected).
• Added param token extractor: a param from the gin.Request can be used as a "token" (until now we had ip and header)

set DNS Cache TTL

• add service level dns_cache_ttl config option (added in Lura: https://github.com/luraproject/lura/blob/master/config/parser.go#L168 )

support multiple certs

At the service level, under the tls section, we add a keys property, that is a list of { "public_key": "publick_key_file_path", "private_key": "private_key_file_path" } , and the exisitng public_key / private_key under the tls sections are deprecated. From the Lura PR: luraproject/lura#725

set max header bytes

• added field at the service level to configure the max_header_bytes : added in lura PR: https://github.com/luraproject/lura/pull/721/files

Checked with 🟢 that works on the playground

CORS changes:

• 🟢 options_success_status: allows to define the options success status code.
• 🟢 options_passthrough: Instructs preflight to let other potential next handlers to process the OPTIONS method. Turn this on if you have enabled auto_options in the extra_options/router
• allow_private_network: Indicates whether to accept cross-origin requests over a private network.

HTTP Secure changes:

• ⚠️ removed / ignored the public_key value, as public key pinning is a deprecated feature
• 🟢 ssl_proxy_headers : map of header → values
• 🟢 allowed_hosts_are_regex : boolean indicating that allowed_hosts are regex instead of simple strings
• 🟢 force_sts_header : boolean indicating we want the STSHeader even for HTTP requests

Audit changes:

• add deprecated rule for private_key / public_key : now that several certificate pairs are supported, we have them in an array field.

Cobra changes:

• fix: check command with extra verbose -ddd displays new fields in root config.

Tagged versions of the following libs:

• https://github.com/krakend/krakend-audit
• https://github.com/krakend/krakend-cors
• https://github.com/krakend/krakend-httpsecure
• https://github.com/krakend/krakend-cobra
• https://github.com/krakend/go-auth0

---

Fixes

• OTEL:
  • skipped paths generate metric values: Paths skipped still generate metric values in form of http_route="404 Not Found" krakend-otel#9
• always stack cache factory (???): https://github.com/krakend/krakend-ce/pull/891/files

Other

• added trivy actions to the repo