API gateway release notes

Install the latest API gateway release with every OpenLM Platform release. For the upgrade steps, see API gateway.

1.0.0-rc.2

Release candidate. Install it with --version 1.0.0-rc.2. This release changes the following:

• The gateway now has 80 routes (was 75). New: /api/assistantservice, /api/automation, /api/flowengine, /api/resourcetracking, /api/usersdirectory.
• Every route reaches its service by its short name, so the gateway works in any namespace. Before, four routes (/api/agents-hub/announce, /api/integration-orchestrator, /api/marketplacemanager, /api/servicenow-alerts) only worked in the namespace openlm. If you corrected these routes by hand after earlier upgrades, you no longer need to.
• /api/atlassianintegration uses the service's port 3080.
• The error message for a missing storage class is now spelled correctly.

Upgrade from 1.0.0-rc.1: Run the upgrade with your values file. The job that loads the routes runs again and replaces all routes. The gateway pod isn't restarted.

Upgrade from 0.2.x: Read Before you upgrade under 1.0.0-rc.1 first.

1.0.0-rc.1

Release candidate. Install it with --version 1.0.0-rc.1, because Helm skips pre-release versions otherwise.

Action needed for some installations. Read Before you upgrade.

This release changes the following:

• The chart is now called openlm-apigateway and is available in the OpenLM Helm repository (https://openlm-helm.github.io/helmcharts). Versions up to 0.2.x were called openlm-gateway. Version numbers restart at 1.0.0.
• The chart no longer has a default APISecret. Set your own, preferably as a Secret with useSecretName. Without one, helm install and helm upgrade stop with a message.
• The API routes and the gateway version are unchanged from 0.2.12 (Tyk Gateway 5.9.1).

Before you upgrade

Before you upgrade from 0.2.x, follow these steps:

1. Keep the release name openlm-gateway and upgrade it with the new chart. Don't install openlm-apigateway under a new release name, because OpenLM Platform sends /api to the existing gateway.
2. Check whether your installation has its own secret:

   helm -n "$NS" get values openlm-gateway | grep -E "useSecretName|APISecret"

   • If it shows useSecretName with a name, or APISecret with a value you chose, you don't need to do anything. The upgrade changes no objects and doesn't restart the gateway.
   • If it shows nothing, or an APISecret you didn't choose, create a Secret first, then upgrade with useSecretName (see Upgrade from openlm-gateway 0.2.x). The gateway restarts once, so /api is unavailable for a few seconds. Update any script of your own that calls the gateway's control API with the old secret.

If the upgrade stops with "The gateway needs its own APISecret", nothing has changed in the cluster. Create the Secret and run the upgrade again.

0.2.12

This release changes the following:

• On OpenShift, the /api Route is now created in the namespace you install into (helm -n). Before, it always went to openlm.
• New setting openShiftRoute.name (default openlm-gateway) to choose the Route's name, for example to take over a Route you created by hand.
• No change for installations in the namespace openlm.

0.2.11

This release changes the following:

• On OpenShift, the /api Route sets the same security headers as the OpenLM Platform Routes: HSTS (one year, including subdomains), X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and Content-Security-Policy: frame-ancestors 'self'. (80929)
• New settings under openShiftRoute.routeSecurity: enabled (default true), hstsMaxAge, and hstsIncludeSubDomains. The headers need OpenShift 4.14 or higher. Set enabled: false on older versions.
• If you added these headers to the /api Route by hand, the upgrade sets the same values. If Helm reports a field conflict on the Route, remove your manual changes and upgrade again.