From f4e5ad0710aa93af68cd5f12b58fbfea2ae37d0e Mon Sep 17 00:00:00 2001
From: Andrew M <andrew.p.martinez@gmail.com>
Date: Fri, 31 Jul 2020 16:23:47 -0400
Subject: [PATCH] update release notes

---
 doc/release-notes.md | 52 ++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 50 insertions(+), 2 deletions(-)

diff --git a/doc/release-notes.md b/doc/release-notes.md
index 5bfc96968..d5b0e758b 100644
--- a/doc/release-notes.md
+++ b/doc/release-notes.md
@@ -1,11 +1,59 @@
 # Release 0.15.3
 
-* What's New:
+# What's New:
+
+* End-To-End Encryption Enhancements
+   * [e2e Service Configuration & Router Termination](https://github.com/openziti/edge/issues/173)
 
 * Bug Fixes:
   * [#152](https://github.com/openziti/ziti/issues/152) - Fix ziti-router enroll exit code on failure
   * [#156](https://github.com/openziti/ziti/issues/156) - fix display of policies with empty roles lists
- 
+
+## End-To-End Encryption Enhancements
+### E2E Encryption Router Termination
+A new xgress module has been added specifically for handling Ziti Edge e2e to handle SDK to Router Termination scenarios.
+Previously, only SDK-to-SDK end-to-end encryption was supported. When e2e encryption is desired
+for a router terminated service, use the bind value `xgress_edge_transport` when defining
+the terminator for the service. This value is now the default when using the CLI to create
+a terminator. If the `binding` value is omitted when using the REST API directly, it will default
+to `transport` - which does not support e2e encryption.
+
+##### CLI Example (explicit binding):
+
+```
+ziti edge create terminator mytcpservice 002 tcp:my-tcp-service.com:12345 --binding  xgress_edge_transport
+```
+
+##### Edge Rest API Example:
+
+```
+POST /terminators
+{
+    "service": "ZbX9",
+    "router": "002",
+    "binding": "xgress_edge_transport",
+    "address": "tcp:my-tcp-service.com:12345"
+}
+```
+
+### E2E Encryption Service Configuration
+
+Edge Services can now be set to require e2e encryption. All Edge
+Services defined before this version will default to requiring e2e
+encryption. Existing services will need to have their terminators
+updated to use `xgress_edge_transport` or update the service to not
+require e2e encryption.
+
+##### Create Service Example (e2e on)
+```
+POST /services
+{
+    "name": "my-service",
+    "encryptionRequired": true
+}
+```
+
+
 # Release 0.15.2
 
 * What's New: