Feature Request: Release Envoy v1.26.4

[suniltheta]

The Envoy team released v1.26.4: https://github.com/envoyproxy/envoy/releases/tag/v1.26.4.

We should update the App Mesh Envoy Container Image to v1.26.4.

[suniltheta]

The images have been released:

• For me-south-1:

  772975370895.dkr.ecr.me-south-1.amazonaws.com/aws-appmesh-envoy:v1.26.4.0-prod
  

• For cn-north-1:

  919366029133.dkr.ecr.cn-north-1.amazonaws.com.cn/aws-appmesh-envoy:v1.26.4.0-prod
  

• For ap-southeast-3:

  909464085924.dkr.ecr.ap-southeast-3.amazonaws.com/aws-appmesh-envoy:v1.26.4.0-prod
  

• For af-south-1:

  924023996002.dkr.ecr.af-south-1.amazonaws.com/aws-appmesh-envoy:v1.26.4.0-prod
  

• For ap-east-1:

  856666278305.dkr.ecr.ap-east-1.amazonaws.com/aws-appmesh-envoy:v1.26.4.0-prod
  

• For eu-south-1:

  422531588944.dkr.ecr.eu-south-1.amazonaws.com/aws-appmesh-envoy:v1.26.4.0-prod
  

• For cn-northwest-1:

  919830735681.dkr.ecr.cn-northwest-1.amazonaws.com.cn/aws-appmesh-envoy:v1.26.4.0-prod
  

• For all other regions where App Mesh is available:

  840364872350.dkr.ecr.<region>.amazonaws.com/aws-appmesh-envoy:v1.26.4.0-prod
  

  e.g.

  840364872350.dkr.ecr.us-west-2.amazonaws.com/aws-appmesh-envoy:v1.26.4.0-prod
  

• Public ECR Image:

  public.ecr.aws/appmesh/aws-appmesh-envoy:v1.26.4.0-prod
  

We'll keep this issue open as we update the recommended image our other projects (e.g. aws/aws-app-mesh-controller-for-k8s), examples, and documentation.

[suniltheta]

Thanks to Envoy maintainers & community this image provides fixes for the following CVEs:

CVE-2023-35945
CVE-2023-35943
CVE-2023-35944
CVE-2023-35941
CVE-2023-35942

Refer: https://github.com/envoyproxy/envoy/security/advisories

[suniltheta]

⚠️⚠️ Caution while upgrading to this image ⚠️⚠️

A minor behavior change in Envoy introduced since v1.26.0 release:

healthcheck: If active HC is enabled and a host is ejected by outlier detection, a successful active health check unejects the host and consider it healthy. This also clears all the outlier detection counters. This behavior change can be reverted by setting envoy.reloadable_features_successful_active_health_check_uneject_host to false.

Currently, this behavior change is by default disabled in this AppMesh Envoy v1.26.4.0 release, which is contrary to Envoy default which by default will be enabled. The reason we chose to disable it by default it that this changes will cause unexpected behavior if we do shallow active health check instead of deep active health check that reflects the actual application behavior. If you choose to enable this feature then set the env variable ENVOY_ACTIVE_HEALTH_CHECK_UNEJECT_HOST to true in the Envoy sidecar container. (Context: aws/amazon-ecs-service-connect-agent#38).

[thomashoffman]

Release is complete.