Microgateway 5.0

Attackers are already collecting encrypted data today with the intention of decrypting it later using quantum computers. Microgateway 5.0 addresses this "harvest now, decrypt later" threat with several important enhancements, that make your systems resistant to future quantum attacks: 

• Secure by default: PQC-capable KEM groups (Key Encapsulation Mechanisms) are enabled by default. 
• Hybrid Key Exchanges: Classical and post-quantum algorithms are combined. This ensures that connections remain secure even if one of the methods is broken in the future.
• Reporting: The logging clearly shows which clients already use PQC-capable groups. TLS key exchange groups appear in TLS-SESS-START and are also available as ENV cookies and rewrite variables.
• Performance: PQC introduces no relevant performance degradation on the same hardware.
• Broad compatibility: Chromium-based browsers such as Chrome and Edge already support PQC. Apple will enable PQC automatically with iOS/macOS 26. Firefox offers PQC support via configuration switch.

These capabilities have been evaluated in PoCs with customers and partners since early 2024, and the findings have been directly incorporated into Microgateway 5.0.

Further information can be found in our blog article.

Microgateway lets you require a higher authentication level for sensitive paths and actions, such as admin screens, member areas, or high-risk transactions.

• Enforce strong authentication only where it matters.
• Configure it directly alongside existing access control policies.
• Prevent redirect loops if the user cannot satisfy the required authentication level.
• Use a standards-based setup with acr_values or by ensuring the requested scope is issued.

Step-up authentication can be configured with any OIDC provider supporting this standard.

Microgateway can hand off HTTP requests to an external ICAP server for inspection using the Internet Content Adaptation Protocol (RFC 3507).

• Block malware by integrating an external antivirus scanner via ICAP.
• Keep deployments lean and scalable by offloading scanning to a dedicated ICAP service.
• Enforce security policy inline at Microgateway by connecting ICAP-based security services.
• Integrate with existing malware scanning ecosystems through a standards-based interface.

Connecing your ICAP scanning service to Microgateway blocks malware before it reaches your workloads.

Microgateway can send traces so you can follow a single request end-to-end across Pods and Services using OpenTelemetry compatible backends.

Troubleshoot faster by pinpointing which hop failed and where latency was introduced.
Gain performance insight through spans that capture timing and dependencies, making bottlenecks and slow components obvious.
Fit into your existing observability stack with OpenTelemetry ecosystem compatibility.
Avoid vendor lock-in by using a widely adopted industry standard.

With tracing support, you turn “guessing from logs” into actionable trace visualizations for complex Kubernetes request flows.

Microgateway 5.0 now validates its Kubernetes Custom Resources using CEL validation rules directly in the CRD schema instead of relying on a validating admission webhook.

By replacing the validating admission webhook with CEL rules in the CRD, Microgateway 5.0 reduces operational overhead. No webhook component to run and maintain. Since the webhook is gone, the cert-manager is no longer a prerequisite for deploying Microgateway.

Switching to CEL-based validation simplifies deployment and alleviates your operational headache.