LoginSign Up
← Back to all sparks
C

Contour

INFRA · APIS
Velocity0.0

Kubernetes ingress controller built on the Envoy proxy

projectcontour.io ↗

Three supported branches, patched in lockstep within the same minute.

kubernetes-ingressenvoymulti-branch-releasescve-responsehttpproxy-crdgateway-api
◆Current state
Contour maintains 1.31, 1.32 and 1.33 concurrently and releases them together — the February batch went out across three branches inside two minutes, and the March batch did the same. The content is almost entirely inherited: Envoy bumps to pick up security fixes, Go updates, and a gRPC update for a CVE that Contour explicitly notes it is not affected by.
◆Where it's heading
This is a proxy whose release cadence is governed by its data plane rather than its own feature work. Envoy security releases set the schedule, and Contour's job is to bump, verify compatibility and ship across every supported branch simultaneously. The changes that do originate in Contour are operational sharp edges found in production: an HTTPProxy CRD schema wrongly marking a status error field as required, which broke load balancer status updates, and shutdown-manager being CPU-throttled at a 50m limit.
◆Prediction
The next release will almost certainly be another simultaneous three-branch batch triggered by an Envoy security bump, since both batches in this window followed exactly that pattern.

◆Recent moves

  1. 4mo ago

    Contour 1.33.3 bumps Envoy to 1.35.9 for security fixes

    Bumps Envoy to v1.35.9 for security fixes on the newest supported branch, updates gRPC for CVE-2026-33186 while noting Contour is not affected, and drops the Envoy metrics hostPort from example manifests. Released within two minutes of the equivalent 1.32 and 1.31 patches.

    View source ↗
  2. 4mo ago

    Contour 1.32.4 bumps Envoy to 1.34.13 for security fixes

    The 1.32 instance of the same March batch, carrying Envoy v1.34.13 rather than 1.35.9 because of the branch's compatibility window. Same gRPC update and same manifest change as its siblings.

    View source ↗
  3. 4mo ago

    Contour 1.31.5 bumps Envoy to 1.34.13 for security fixes

    The oldest branch in the March batch, identical in content to 1.32.4 down to the Envoy version. Released first, one minute ahead of the other two.

    View source ↗
  4. 5mo ago

    Contour 1.33.2 fixes HTTPProxy status updates and shutdown throttling

    Fixes load balancer status update failures caused by the HTTPProxy CRD schema marking status.loadBalancer.ingress[].ports[].error as required. Uniquely among the February batch it also raises the shutdown-manager CPU limit from 50m to 200m under the Gateway Provisioner to stop throttling.

    View source ↗
  5. 5mo ago

    Contour 1.32.3 fixes the HTTPProxy status schema

    Carries the HTTPProxy CRD schema fix and a Go update to the 1.32 branch, without the shutdown-manager change that only 1.33.2 received.

    View source ↗
  6. 5mo ago

    Contour 1.31.4 fixes the HTTPProxy status schema

    The 1.31 instance of the February batch, identical to 1.32.3. Three branches, one fix, three tags one minute apart.

    View source ↗