LoginSign Up
← Back to all sparks
S

Skipper

INFRA · APIS
Velocity5.0

HTTP router and reverse proxy for service composition

opensource.zalando.com/skipper ↗

Skipper adds an opt-in shared OpenID discovery cache so routing survives issuer outages.

http-routerkubernetes-ingressauthenticationcachingobservability
◆Current state
Skipper, Zalando's HTTP router and Kubernetes ingress, tagged eight releases from November 3 to 6. v0.28.68 closed an httpoxy-class flaw in FastCGI and v0.28.64 fixed closed bodies in shared cache fetches. v0.28.70 adds an opt-in process-wide OpenID discovery cache for JWT validation and token introspection filters, so warm route rebuilds no longer need the issuer to be reachable, and v0.28.71 adds application-based proxy logs via the annotate filter.
◆Where it's heading
The week's work hardens Skipper's role as an auth-aware edge: caching, auth filter resilience and security fixes land in quick tags. Changes are operator-facing and mostly opt-in.
◆Prediction
Expect more filter-level resilience and observability tags on the same near-daily cadence.

◆Recent moves

  1. 3d ago

    v0.28.71: per-application proxy logs via annotate

    Proxy logs can be tagged per application through the annotate filter. A small observability option for multi-tenant ingress.

    View source ↗
  2. 3d ago

    v0.28.70: shared OpenID discovery cache for auth filters

    An opt-in process-wide cache for OpenID discovery documents means route rebuilds send no HTTP request on a hit and can survive an identity issuer outage. A resilience gain for clusters with many auth-filtered routes.

    View source ↗
  3. 4d ago

    v0.28.69: code commenting guidelines in AGENTS.md

    Updates the code commenting guidelines in AGENTS.md. No change for users.

    View source ↗
  4. 5d ago

    v0.28.66: reload OAuth client secret on token exchange

    The auth filter now reloads a secretRef client secret on token exchange, so rotated secrets take effect without a restart. A small fix for the OAuth filters.

    View source ↗
  5. 5d ago

    v0.28.68: stop passing client Proxy header to FastCGI (httpoxy)

    A client-supplied Proxy header no longer reaches FastCGI apps as HTTP_PROXY, which let any client route an app's outgoing requests through its own host. The second security fix in a week, after the routes-annotation SSRF fix.

    View source ↗
  6. 5d ago

    v0.28.67: RouteGroup errors name namespace and resource

    RouteGroup validation errors now include the resource's namespace and name, so admission logs point at the failing object. Operator convenience.

    View source ↗