Envoy AI Gateway v1.1.x

✨ New Features​

🔗 API Updates​

• AIGatewayRouteRule.name: Optional unique name copied onto the generated HTTPRoute rule. route-not-found is reserved.
• AIGatewayRouteRule.streamIdleTimeout: Optional Gateway API duration; unset means no per-try idle timeout.
• BackendSecurityPolicy.spec.credentialOverride: Optional per-request credential source. Exactly one of fromRequestHeaders or fromDynamicMetadata. fallbackToConfigured defaults to true.
• GatewayConfig.spec.forwardProxy: Optional HTTP CONNECT proxy. address is required (host:port).
• MCPRoute.spec.hostnames: Optional list of hostnames (max 16).
• MCPRoute.spec.backendSelector: Optional CEL selector evaluated at session initialize. defaultAction defaults to Deny.

⚠️ Breaking Changes​

• Helm controller security context defaults: The Helm chart now sets a restricted podSecurityContext and container securityContext on the controller (non-root UID/GID 65532, all capabilities dropped, no privilege escalation, RuntimeDefault seccomp). Previously both were empty. If you run a custom controller image that cannot use UID 65532, override controller.podSecurityContext and controller.securityContext in your values.

🐛 Bug Fixes​

• Stale Content-Encoding on translated error responses: Translated error bodies no longer keep the upstream Content-Encoding header. Clients no longer fail to decode an uncompressed error payload that still claimed to be gzip or brotli.
• Anthropic ping events keep streams alive: Anthropic ping SSE events now emit an empty chunk on translated paths, so intermediaries and clients that time out on silence no longer drop a healthy Claude stream.
• Gateway local replies are not reprocessed as upstream responses: Ext-proc no longer treats Envoy local replies (rate-limit, timeout, auth) as provider payloads. Local error bodies pass through instead of being force-translated into a malformed LLM response.
• Anthropic cache_control on the Bedrock path: Prompt-caching cache_control markers now translate onto AWS Bedrock, including tool-result cache control and Bedrock tool cache points as their own tools[] element. Cached prefixes that previously silently dropped now actually hit Bedrock's cache.
• Bedrock reasoning_content serialized as a plain string: Non-streaming and streaming Bedrock reasoning content is emitted as a plain string, with signatures carried via thinking_blocks. Clients that expected a string and previously received an object no longer fail to parse Claude-on-Bedrock reasoning.
• Unsupported Anthropic tool types error instead of dropping: Unknown Anthropic tool types now fail the request rather than being silently stripped. You get a clear error instead of a tool-less prompt that looks like it succeeded.
• Cross-namespace InferencePool backendRef honours namespace: An InferencePool referenced from another namespace is now resolved in that namespace instead of the route's. Cross-namespace inference pools that previously 404'd at reconcile now work when the ReferenceGrant allows them.
• Anthropic streaming cache tokens no longer double-counted: Input and cache token counts on Anthropic message_delta events are merged once, including on the OpenAI→Anthropic streaming path. Usage metrics and access logs no longer inflate cached-token cost on streaming Claude calls.
• Credential leak in Envoy ext-proc debug logs: Envoy HTTP and ext-proc debug logging is capped, and credential header mutations are always redacted in debug output. Passthrough endpoints also redact user content. Debug-level logging is no longer a credential-exfiltration path.
• Gemini streaming tool-call finish reasons and reasoning tokens: Newer Gemini models such as gemini-3.5-flash now map streaming tool-call finish reasons correctly, and reasoning tokens are counted in streaming metrics. Streaming Gemini tool use no longer reports a wrong finish reason or drops thinking-token usage.

📖 Upgrade Guidance​

Upgrading from v1.0 requires no CRD migrations. New fields are optional and backward compatible. Review the Helm security-context change if you override the controller image.

If the official controller image works for you, no action is needed. To restore empty security contexts:

controller:
  podSecurityContext: {}
  securityContext: {}

JSON logs: set controller.logFormat and extProc.logFormat to json. Enable a PDB with controller.podDisruptionBudget.enabled: true when you run more than one replica.

📦 Dependencies Versions​

⏩ Patch Releases​

🙏 Acknowledgements​

Thank you to everyone who made v1.1 possible

🔮 What's Next​

The roadmap is community-driven — join us and help shape it.