Update Gateway API to v1.3.0, target Envoy Gateway v1.5.0.

Makefile

@@ -79,6 +79,8 @@ test-e2e: chainsaw
 		echo "No Kind cluster is running. Please start a Kind cluster before running the e2e tests."; \
 		exit 1; \
 	}
+	$(KIND) get kubeconfig --name nso-standard > $(TMPDIR)/.kind-nso-standard.yaml
+	$(KIND) get kubeconfig --name nso-infra > $(TMPDIR)/.kind-nso-infra.yaml
 	$(CHAINSAW) test ./test/e2e \
 		--cluster nso-standard=$(TMPDIR)/.kind-nso-standard.yaml \
 		--cluster nso-infra=$(TMPDIR)/.kind-nso-infra.yaml
@@ -142,7 +144,10 @@ set-image-controller: manifests kustomize
 prepare-infra-cluster: cert-manager envoy-gateway external-dns
 
 .PHONY: prepare-e2e
-prepare-e2e: chainsaw set-image-controller cert-manager envoy-gateway external-dns load-image-all deploy-e2e
+prepare-e2e: chainsaw set-image-controller cert-manager load-image-all deploy-e2e
+
+.PHONY: prepare-dev
+prepare-dev: chainsaw set-image-controller cert-manager install
 
 .PHONY: load-image-all
 load-image-all: load-image-operator
@@ -167,12 +172,10 @@ external-dns:
 .PHONY: kind-standard-cluster
 kind-standard-cluster: kind
 	$(KIND) create cluster --config=config/tools/kind/standard-cluster.yaml
-	$(KIND) get kubeconfig --name nso-standard > $(TMPDIR)/.kind-nso-standard.yaml
 
 .PHONY: kind-infra-cluster
 kind-infra-cluster: kind
 	$(KIND) create cluster --config=config/tools/kind/infra-cluster.yaml
-	$(KIND) get kubeconfig --name nso-infra > $(TMPDIR)/.kind-nso-infra.yaml
 
 ##@ Deployment
 
@@ -182,23 +185,23 @@ endif
 
 .PHONY: install
 install: manifests kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config.
-	$(KUSTOMIZE) build config/dev | $(KUBECTL) apply -f -
+	$(KUSTOMIZE) build --enable-helm config/dev | $(KUBECTL) apply -f -
 
 .PHONY: uninstall
 uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
-	$(KUSTOMIZE) build config/crd | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -
+	$(KUSTOMIZE) build --enable-helm config/crd | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -
 
 .PHONY: deploy
 deploy: set-image-controller ## Deploy controller to the K8s cluster specified in ~/.kube/config.
-	$(KUSTOMIZE) build config/default | $(KUBECTL) apply -f -
+	$(KUSTOMIZE) build --enable-helm config/default | $(KUBECTL) apply -f -
 
 .PHONY: deploy-e2e
 deploy-e2e: set-image-controller
-	$(KUSTOMIZE) build config/e2e | $(KUBECTL) apply -f -
+	$(KUSTOMIZE) build --enable-helm config/e2e | $(KUBECTL) apply -f -
 
 .PHONY: undeploy
 undeploy: kustomize ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
-	$(KUSTOMIZE) build config/default | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -
+	$(KUSTOMIZE) build --enable-helm config/default | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -
 
 
 
@@ -238,7 +241,7 @@ CRDOC_VERSION ?= v0.6.4
 KIND_VERSION ?= v0.27.0
 
 # renovate: datasource=go depName=github.com/kyverno/chainsaw
-CHAINSAW_VERSION ?= v0.2.12
+CHAINSAW_VERSION ?= v0.2.13
 
 # renovate: datasource=go depName=github.com/cert-manager/cmctl/v2
 CMCTL_VERSION ?= v2.1.1

config/crd/gateway/kustomization.yaml

@@ -1,20 +1,59 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-resources:
-  - github.com/kubernetes-sigs/gateway-api/config/crd/?ref=v1.2.1
+
+helmCharts:
+- name: gateway-crds-helm
+  repo: oci://docker.io/envoyproxy
+  # IMPORTANT - When upgrading the helm chart, ensure there's no undesired CRDs
+  # added in the new version. If there are, remove them in the patches below.
+  version: v1.5.0
+  releaseName: gateway
+  namespace: kube-system
+  valuesInline:
+    crds:
+      gatewayAPI:
+        enabled: true
+        channel: standard
+      envoyGateway:
+        enabled: true
 
 patches:
-  # Drop GRPCRoutes for now
+  # Drop resources that shouldn't be added to upstream control planes yet
+  # Gateway API resources
   - patch: |
       $patch: delete
       apiVersion: apiextensions.k8s.io/v1
       kind: CustomResourceDefinition
       metadata:
         name: grpcroutes.gateway.networking.k8s.io
-  # Drop ReferenceGrants for now
   - patch: |
       $patch: delete
       apiVersion: apiextensions.k8s.io/v1
       kind: CustomResourceDefinition
       metadata:
         name: referencegrants.gateway.networking.k8s.io
+  # Envoy gateway resources
+  - patch: |
+      $patch: delete
+      apiVersion: apiextensions.k8s.io/v1
+      kind: CustomResourceDefinition
+      metadata:
+        name: envoyextensionpolicies.gateway.envoyproxy.io
+  - patch: |
+      $patch: delete
+      apiVersion: apiextensions.k8s.io/v1
+      kind: CustomResourceDefinition
+      metadata:
+        name: envoypatchpolicies.gateway.envoyproxy.io
+  - patch: |
+      $patch: delete
+      apiVersion: apiextensions.k8s.io/v1
+      kind: CustomResourceDefinition
+      metadata:
+        name: envoyproxies.gateway.envoyproxy.io
+  - patch: |
+      $patch: delete
+      apiVersion: apiextensions.k8s.io/v1
+      kind: CustomResourceDefinition
+      metadata:
+        name: clienttrafficpolicies.gateway.envoyproxy.io

config/dev/kustomization.yaml

@@ -3,6 +3,7 @@ namePrefix: network-services-operator-
 
 resources:
   - ../crd
+  - ../crd/gateway
   - ../webhook
   - ../certmanager
 

config/tools/envoy-gateway/kustomization.yaml

@@ -5,5 +5,5 @@ helmCharts:
     includeCRDs: true
     namespace: envoy-gateway-system
     releaseName: envoy-gateway
-    version: v1.3.2
+    version: v1.5.0
     repo: oci://docker.io/envoyproxy

go.mod

@@ -5,7 +5,9 @@ go 1.24.0
 toolchain go1.24.2
 
 require (
+	github.com/go-logr/logr v1.4.3
 	github.com/google/go-cmp v0.7.0
+	github.com/google/uuid v1.6.0
 	github.com/onsi/ginkgo/v2 v2.23.4
 	github.com/stretchr/testify v1.10.0
 	go.miloapis.com/milo v0.1.0
@@ -16,7 +18,7 @@ require (
 	k8s.io/client-go v0.33.1
 	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
 	sigs.k8s.io/controller-runtime v0.21.0
-	sigs.k8s.io/gateway-api v1.2.1
+	sigs.k8s.io/gateway-api v1.3.0
 	sigs.k8s.io/multicluster-runtime v0.21.0-alpha.8
 )
 
@@ -34,7 +36,6 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-openapi/jsonpointer v0.21.1 // indirect
@@ -46,7 +47,6 @@ require (
 	github.com/google/cel-go v0.25.0 // indirect
 	github.com/google/gnostic-models v0.6.9 // indirect
 	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
-	github.com/google/uuid v1.6.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect

go.sum

@@ -252,8 +252,8 @@ sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUo
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
 sigs.k8s.io/controller-runtime v0.21.0 h1:CYfjpEuicjUecRk+KAeyYh+ouUBn4llGyDYytIGcJS8=
 sigs.k8s.io/controller-runtime v0.21.0/go.mod h1:OSg14+F65eWqIu4DceX7k/+QRAbTTvxeQSNSOQpukWM=
-sigs.k8s.io/gateway-api v1.2.1 h1:fZZ/+RyRb+Y5tGkwxFKuYuSRQHu9dZtbjenblleOLHM=
-sigs.k8s.io/gateway-api v1.2.1/go.mod h1:EpNfEXNjiYfUJypf0eZ0P5iXA9ekSGWaS1WgPaM42X0=
+sigs.k8s.io/gateway-api v1.3.0 h1:q6okN+/UKDATola4JY7zXzx40WO4VISk7i9DIfOvr9M=
+sigs.k8s.io/gateway-api v1.3.0/go.mod h1:d8NV8nJbaRbEKem+5IuxkL8gJGOZ+FJ+NvOIltV8gDk=
 sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
 sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/multicluster-runtime v0.21.0-alpha.8 h1:Pq69tTKfN8ADw8m8A3wUtP8wJ9SPQbbOsgapm3BZEPw=

internal/validation/gateway_validation_test.go

@@ -197,7 +197,7 @@ func TestValidateGateway(t *testing.T) {
 							Port:     80,
 						},
 					},
-					Addresses: []gatewayv1.GatewayAddress{
+					Addresses: []gatewayv1.GatewaySpecAddress{
 						{
 							Type:  ptr.To(gatewayv1.IPAddressType),
 							Value: "192.168.1.1",

test/e2e/gateway/chainsaw-test.yaml

@@ -430,101 +430,45 @@ spec:
                   status: "True"
                   type: Programmed
                 listeners:
-                - attachedRoutes: 0
-                  conditions:
-                  - reason: Programmed
-                    status: "True"
-                    type: Programmed
-                  - reason: Accepted
-                    status: "True"
-                    type: Accepted
-                  - reason: ResolvedRefs
-                    status: "True"
-                    type: ResolvedRefs
+                - (conditions[?contains(['Programmed', 'Accepted', 'ResolvedRefs'], type)]):
+                  - status: "True"
+                  - status: "True"
+                  - status: "True"
                   name: http-test-e2e
-                - attachedRoutes: 0
-                  conditions:
-                  - reason: Programmed
-                    status: "True"
-                    type: Programmed
-                  - reason: Accepted
-                    status: "True"
-                    type: Accepted
-                  - reason: ResolvedRefs
-                    status: "True"
-                    type: ResolvedRefs
+                - (conditions[?contains(['Programmed', 'Accepted', 'ResolvedRefs'], type)]):
+                  - status: "True"
+                  - status: "True"
+                  - status: "True"
                   name: https-test-e2e
-                - attachedRoutes: 0
-                  conditions:
-                  - reason: Programmed
-                    status: "True"
-                    type: Programmed
-                  - reason: Accepted
-                    status: "True"
-                    type: Accepted
-                  - reason: ResolvedRefs
-                    status: "True"
-                    type: ResolvedRefs
+                - (conditions[?contains(['Programmed', 'Accepted', 'ResolvedRefs'], type)]):
+                  - status: "True"
+                  - status: "True"
+                  - status: "True"
                   name: http-0
-                - attachedRoutes: 0
-                  conditions:
-                  - reason: Programmed
-                    status: "True"
-                    type: Programmed
-                  - reason: Accepted
-                    status: "True"
-                    type: Accepted
-                  - reason: ResolvedRefs
-                    status: "True"
-                    type: ResolvedRefs
+                - (conditions[?contains(['Programmed', 'Accepted', 'ResolvedRefs'], type)]):
+                  - status: "True"
+                  - status: "True"
+                  - status: "True"
                   name: https-0
-                - attachedRoutes: 0
-                  conditions:
-                  - reason: Programmed
-                    status: "True"
-                    type: Programmed
-                  - reason: Accepted
-                    status: "True"
-                    type: Accepted
-                  - reason: ResolvedRefs
-                    status: "True"
-                    type: ResolvedRefs
+                - (conditions[?contains(['Programmed', 'Accepted', 'ResolvedRefs'], type)]):
+                  - status: "True"
+                  - status: "True"
+                  - status: "True"
                   name: http-1
-                - attachedRoutes: 0
-                  conditions:
-                  - reason: Programmed
-                    status: "True"
-                    type: Programmed
-                  - reason: Accepted
-                    status: "True"
-                    type: Accepted
-                  - reason: ResolvedRefs
-                    status: "True"
-                    type: ResolvedRefs
+                - (conditions[?contains(['Programmed', 'Accepted', 'ResolvedRefs'], type)]):
+                  - status: "True"
+                  - status: "True"
+                  - status: "True"
                   name: https-1
-                - attachedRoutes: 0
-                  conditions:
-                  - reason: Programmed
-                    status: "True"
-                    type: Programmed
-                  - reason: Accepted
-                    status: "True"
-                    type: Accepted
-                  - reason: ResolvedRefs
-                    status: "True"
-                    type: ResolvedRefs
+                - (conditions[?contains(['Programmed', 'Accepted', 'ResolvedRefs'], type)]):
+                  - status: "True"
+                  - status: "True"
+                  - status: "True"
                   name: http-2
-                - attachedRoutes: 0
-                  conditions:
-                  - reason: Programmed
-                    status: "True"
-                    type: Programmed
-                  - reason: Accepted
-                    status: "True"
-                    type: Accepted
-                  - reason: ResolvedRefs
-                    status: "True"
-                    type: ResolvedRefs
+                - (conditions[?contains(['Programmed', 'Accepted', 'ResolvedRefs'], type)]):
+                  - status: "True"
+                  - status: "True"
+                  - status: "True"
                   name: https-2
 
         # Load the downstream gateway so we can get the IP address info from its