v1.23.0

Upgrade Notes

Behavioral change: the router public listener no longer serves /fission-function/<ns>/<name>. External tooling that today calls those paths through the public router URL (typically via Ingress) will receive 404 after upgrading. This closes GHSA-3g33-6vg6-27m8.

KEDA users: internalAuth.enabled now defaults to true. Upstream fission/kafka-http-connector images do not yet sign their requests, so KEDA-driven message-queue triggers will receive 401. Set --set internalAuth.enabled=false at upgrade time if you depend on stock KEDA connector images.

See the Upgrade Guide and Internal Service Authentication for the full procedure.

Deprecations/Removals

  • We continue to support Kubernetes 1.28 and above (kubeVersion: ">=1.28.0-0" in the Helm chart). No change in supported Kubernetes versions from v1.22.0.
  • /fission-function/<ns>/<name> is removed from the public router listener (port 8888) and now lives only on a new internal listener (port 8889). See Upgrade Notes above.
  • The legacy bash-based integration test suite has been retired. All integration tests now run as Go test suites.

Highlights

  • Application-layer HMAC authentication has been added across internal Fission services — StorageSvc /v1/archive, fetcher, builder, executor, and router-internal — so cross-service calls are authenticated even within the cluster. Enabled by default via internalAuth.enabled=true; see Internal Service Authentication for configuration, the toggle matrix, and master-secret rotation.
  • Per-service NetworkPolicies now cover every Fission listener, restricting in-cluster traffic to the components that actually need it.
  • The fission-fetcher ServiceAccount token is no longer mounted into user function containers, removing an unnecessary credential from the function runtime.

Fixes

  • Multiple security sweeps refreshed Go dependencies and closed Dependabot CVEs, including docker/cli (3 CVEs), golang.org/x/image, go-git, and the keda/v2 module.
  • Bumped the Go toolchain to 1.26, and refreshed workflow CLI tool versions (helm, kind, skaffold, cosign, golangci-lint).
  • Helm chart published as 1.23.0, now versioned independently from the app version.
  • Allow = characters in ingress trigger parsing — previously rejected as malformed (thanks @immanuwell).
  • Internal refactors: switched to the logr interface across the codebase, replaced hashicorp/go-multierror with the stdlib errors package, optimized the throttler, reduced webhook code duplication, and improved abstractions in the mqtrigger package.

Changelog

What’s Changed

New Contributors

Full Changelog: https://github.com/fission/fission/compare/v1.22.0...v1.23.0

References

Last modified May 15, 2026: Doc changes v1.23.0 (#282) (9599b04)