LoginSign Up
← Back to all sparks
S

Skipper

INFRA · APIS
Velocity5.0

HTTP router and reverse proxy for service composition

opensource.zalando.com/skipper ↗

Zalando's ingress proxy finally speaks HTTP/2 cleartext end to end

reverse-proxykuberneteshttp2load-balancingdependency-hygiene
◆Current state
Skipper ships patch tags almost daily, and most carry a single dependency bump or a one-line auth fix. The substance in this window is v0.27.57, which enables h2c on the server handler, the proxy client, and the net client, with a new h2c:// route scheme and Kubernetes appProtocol wiring. Everything else in the window is Dependabot traffic and two narrow fixes to token introspection and grant auth.
◆Where it's heading
The release cadence is a stream of small, individually unremarkable tags where the occasional protocol or load-balancing change is the only thing worth reading. Recent substance has clustered on the data path: leastRequests balancing in v0.27.53, h2c now. The auth filters are being maintained rather than extended, with fixes rather than new capability.
◆Prediction
Expect the h2c work to generate follow-up fixes as it meets real gRPC backends, since the release notes already show HTTP Upgrade negotiation failing while direct prior knowledge works.

◆Recent moves

  1. 15h ago

    Fix token introspection handling

    A single fix to the token introspection filter, shipped as its own tag twenty-five minutes after the previous one. Typical of the auth filters being maintained rather than extended.

    View source ↗
  2. 16h ago

    Fix grant auth flow

    A one-line fix to the grant auth filter with no detail in the notes. Part of the same-day pair of auth patches that closes out this window.

    View source ↗
  3. 21h ago

    Update outdated golang.org/x dependencies

    Routine refresh of the golang.org/x module set. No user-visible change.

    View source ↗
  4. 1d ago

    h2c enabled for server handler, proxy client and net client

    The one release in this window that changes what Skipper can carry: HTTP/2 cleartext on both the inbound handler (behind -enable-h2c-server) and the outbound path, selected by an h2c:// route scheme or by setting appProtocol on a Kubernetes service. It brings Skipper to parity with the other cluster ingress proxies for in-cluster gRPC rather than opening new ground.

    View source ↗
  5. 1d ago

    Bump protobuf off a pre-release pin

    Dependabot moves google.golang.org/protobuf from a dated pseudo-version to the released 1.36.12. Housekeeping.

    View source ↗
  6. 2d ago

    Bump the CodeQL upload-sarif action

    A CI action version bump with no runtime effect, one of several such tags in this window.

    View source ↗