Skip to content

Commit 0dd658b

Browse files
authored
Merge branch 'main' into dym-lb-policy
Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>
2 parents 2954cb3 + 0a81122 commit 0dd658b

83 files changed

Lines changed: 2581 additions & 900 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/workflows/monthly-release-issue.yaml

Lines changed: 38 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -16,94 +16,66 @@ jobs:
1616
- name: Checkout repository
1717
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1818

19-
- name: Calculate current release month and versions
20-
id: release_info
19+
- name: Collect supported versions from hugo.toml
20+
id: versions
2121
run: |
22-
# Get current date
23-
CURRENT_MONTH=$(date +%m)
24-
CURRENT_YEAR=$(date +%Y)
25-
26-
# Get current month name
27-
MONTH_NAME=$(date +%B)
28-
29-
# Read current version from VERSION file
30-
CURRENT_VERSION=$(cat VERSION | tr -d 'v' | tr -d '\n')
31-
32-
# Parse version (assuming format X.Y.Z)
33-
MAJOR=$(echo $CURRENT_VERSION | cut -d. -f1)
34-
MINOR=$(echo $CURRENT_VERSION | cut -d. -f2)
35-
PATCH=$(echo $CURRENT_VERSION | cut -d. -f3)
36-
37-
# Calculate N version (current minor version)
38-
N_VERSION="v${MAJOR}.${MINOR}"
39-
40-
# Calculate N-1 version (previous minor version)
41-
if [ $MINOR -gt 0 ]; then
42-
N_MINUS_1_MINOR=$((MINOR - 1))
43-
N_MINUS_1_VERSION="v${MAJOR}.${N_MINUS_1_MINOR}"
44-
else
45-
# If minor is 0, go to previous major version
46-
if [ $MAJOR -gt 0 ]; then
47-
N_MINUS_1_MAJOR=$((MAJOR - 1))
48-
N_MINUS_1_VERSION="v${N_MINUS_1_MAJOR}.0"
49-
else
50-
N_MINUS_1_VERSION="v0.0"
22+
TODAY=$(date +%Y-%m-%d)
23+
24+
# Extract version/eol pairs from hugo.toml, skipping "latest"
25+
ACTIVE_VERSIONS=()
26+
VERSION=""
27+
VERSION_RE='version[[:space:]]*=[[:space:]]*"([^"]+)"'
28+
EOL_RE='eol[[:space:]]*=[[:space:]]*"([^"]+)"'
29+
while IFS= read -r line; do
30+
if [[ "$line" =~ $VERSION_RE ]]; then
31+
VERSION="${BASH_REMATCH[1]}"
5132
fi
52-
fi
33+
if [[ "$line" =~ $EOL_RE ]]; then
34+
EOL="${BASH_REMATCH[1]}"
35+
if [[ "$VERSION" != "latest" && ! "$EOL" < "$TODAY" ]]; then
36+
ACTIVE_VERSIONS+=("$VERSION")
37+
fi
38+
VERSION=""
39+
fi
40+
done < site/hugo.toml
41+
42+
printf '%s\n' "Supported versions (EOL on or after ${TODAY}):" "${ACTIVE_VERSIONS[@]}"
5343
54-
echo "month=${CURRENT_MONTH}" >> $GITHUB_OUTPUT
55-
echo "year=${CURRENT_YEAR}" >> $GITHUB_OUTPUT
56-
echo "month_name=${MONTH_NAME}" >> $GITHUB_OUTPUT
57-
echo "n_version=${N_VERSION}" >> $GITHUB_OUTPUT
58-
echo "n_minus_1_version=${N_MINUS_1_VERSION}" >> $GITHUB_OUTPUT
44+
# Export as JSON array for the matrix
45+
JSON=$(printf '%s\n' "${ACTIVE_VERSIONS[@]}" | jq -R . | jq -sc .)
46+
echo "matrix=${JSON}" >> $GITHUB_OUTPUT
47+
echo "month_name=$(date +%B)" >> $GITHUB_OUTPUT
48+
echo "year=$(date +%Y)" >> $GITHUB_OUTPUT
5949
6050
- name: Read issue template
6151
id: template
6252
run: |
63-
# Read the template file and skip the YAML front matter
6453
TEMPLATE_CONTENT=$(awk '/^---$/,/^---$/{if (!/^---$/) next} /^---$/{p++; next} p==2' .github/ISSUE_TEMPLATE/release.md)
6554
66-
# Save to output using multiline format
6755
{
6856
echo 'content<<EOF'
6957
echo "$TEMPLATE_CONTENT"
7058
echo 'EOF'
7159
} >> $GITHUB_OUTPUT
7260
73-
- name: Create release issue for N version
74-
env:
75-
GH_TOKEN: ${{ github.token }}
76-
run: |
77-
MONTH_NAME="${{ steps.release_info.outputs.month_name }}"
78-
YEAR="${{ steps.release_info.outputs.year }}"
79-
N_VERSION="${{ steps.release_info.outputs.n_version }}"
80-
TEMPLATE_CONTENT="${{ steps.template.outputs.content }}"
81-
82-
gh issue create \
83-
--title "Patch Release ${N_VERSION}.x for ${MONTH_NAME} ${YEAR}" \
84-
--label "release-process" \
85-
--body "## Patch Release Checklist for ${N_VERSION}.x (${MONTH_NAME} ${YEAR})
86-
87-
${TEMPLATE_CONTENT}
88-
89-
---
90-
*This issue was automatically created by the monthly release workflow.*"
91-
92-
- name: Create release issue for N-1 version
61+
- name: Create release issues for supported versions
9362
env:
9463
GH_TOKEN: ${{ github.token }}
9564
run: |
96-
MONTH_NAME="${{ steps.release_info.outputs.month_name }}"
97-
YEAR="${{ steps.release_info.outputs.year }}"
98-
N_MINUS_1_VERSION="${{ steps.release_info.outputs.n_minus_1_version }}"
65+
MONTH_NAME="${{ steps.versions.outputs.month_name }}"
66+
YEAR="${{ steps.versions.outputs.year }}"
9967
TEMPLATE_CONTENT="${{ steps.template.outputs.content }}"
68+
VERSIONS='${{ steps.versions.outputs.matrix }}'
10069
101-
gh issue create \
102-
--title "Patch Release ${N_MINUS_1_VERSION}.x for ${MONTH_NAME} ${YEAR}" \
103-
--label "release-process" \
104-
--body "## Patch Release Checklist for ${N_MINUS_1_VERSION}.x (${MONTH_NAME} ${YEAR})
70+
for VERSION in $(echo "$VERSIONS" | jq -r '.[]'); do
71+
echo "Creating release issue for ${VERSION}.x ..."
72+
gh issue create \
73+
--title "Patch Release ${VERSION}.x for ${MONTH_NAME} ${YEAR}" \
74+
--label "release-process" \
75+
--body "## Patch Release Checklist for ${VERSION}.x (${MONTH_NAME} ${YEAR})
10576
10677
${TEMPLATE_CONTENT}
10778
10879
---
10980
*This issue was automatically created by the monthly release workflow.*"
81+
done

api/v1alpha1/oidc_types.go

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ const (
1616

1717
// OIDC defines the configuration for the OpenID Connect (OIDC) authentication.
1818
// +kubebuilder:validation:XValidation:rule="(has(self.clientID) && !has(self.clientIDRef)) || (!has(self.clientID) && has(self.clientIDRef))", message="only one of clientID or clientIDRef must be set"
19+
// +kubebuilder:validation:XValidation:rule="!(has(self.forwardAccessToken) && self.forwardAccessToken && has(self.forwardIDToken) && self.forwardIDToken.header.lowerAscii() == 'authorization')", message="forwardAccessToken cannot be true when forwardIDToken.header is Authorization"
1920
type OIDC struct {
2021
// The OIDC Provider configuration.
2122
Provider OIDCProvider `json:"provider"`
@@ -99,6 +100,14 @@ type OIDC struct {
99100
// +optional
100101
ForwardAccessToken *bool `json:"forwardAccessToken,omitempty"`
101102

103+
// ForwardIDToken configures forwarding of the OIDC ID token to the upstream.
104+
//
105+
// If the configured header is "Authorization", EG forwards the ID token using
106+
// the "Bearer " prefix. For any other header, EG forwards the raw token value.
107+
// If not specified, the ID token will not be forwarded.
108+
// +optional
109+
ForwardIDToken *OIDCTokenForwarding `json:"forwardIDToken,omitempty"`
110+
102111
// DefaultTokenTTL is the default lifetime of the id token and access token.
103112
// Please note that Envoy will always use the expiry time from the response
104113
// of the authorization server if it is provided. This field is only used when
@@ -234,6 +243,13 @@ type OIDCCookieNames struct {
234243
IDToken *string `json:"idToken,omitempty"`
235244
}
236245

246+
// OIDCTokenForwarding defines how an OIDC token is forwarded upstream.
247+
type OIDCTokenForwarding struct {
248+
// Header is the upstream request header that will carry the ID token.
249+
// +kubebuilder:validation:MinLength=1
250+
Header string `json:"header"`
251+
}
252+
237253
type SameSite string
238254

239255
const (

api/v1alpha1/zz_generated.deepcopy.go

Lines changed: 20 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5429,6 +5429,22 @@ spec:
54295429
via the Authorization header Bearer scheme to the upstream.
54305430
If not specified, defaults to false.
54315431
type: boolean
5432+
forwardIDToken:
5433+
description: |-
5434+
ForwardIDToken configures forwarding of the OIDC ID token to the upstream.
5435+
5436+
If the configured header is "Authorization", EG forwards the ID token using
5437+
the "Bearer " prefix. For any other header, EG forwards the raw token value.
5438+
If not specified, the ID token will not be forwarded.
5439+
properties:
5440+
header:
5441+
description: Header is the upstream request header that will
5442+
carry the ID token.
5443+
minLength: 1
5444+
type: string
5445+
required:
5446+
- header
5447+
type: object
54325448
logoutPath:
54335449
description: |-
54345450
The path to log a user out, clearing their credential cookies.
@@ -6885,6 +6901,11 @@ spec:
68856901
- message: only one of clientID or clientIDRef must be set
68866902
rule: (has(self.clientID) && !has(self.clientIDRef)) || (!has(self.clientID)
68876903
&& has(self.clientIDRef))
6904+
- message: forwardAccessToken cannot be true when forwardIDToken.header
6905+
is Authorization
6906+
rule: '!(has(self.forwardAccessToken) && self.forwardAccessToken
6907+
&& has(self.forwardIDToken) && self.forwardIDToken.header.lowerAscii()
6908+
== ''authorization'')'
68886909
targetRef:
68896910
description: |-
68906911
TargetRef is the name of the resource this policy is being attached to.

charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5428,6 +5428,22 @@ spec:
54285428
via the Authorization header Bearer scheme to the upstream.
54295429
If not specified, defaults to false.
54305430
type: boolean
5431+
forwardIDToken:
5432+
description: |-
5433+
ForwardIDToken configures forwarding of the OIDC ID token to the upstream.
5434+
5435+
If the configured header is "Authorization", EG forwards the ID token using
5436+
the "Bearer " prefix. For any other header, EG forwards the raw token value.
5437+
If not specified, the ID token will not be forwarded.
5438+
properties:
5439+
header:
5440+
description: Header is the upstream request header that will
5441+
carry the ID token.
5442+
minLength: 1
5443+
type: string
5444+
required:
5445+
- header
5446+
type: object
54315447
logoutPath:
54325448
description: |-
54335449
The path to log a user out, clearing their credential cookies.
@@ -6884,6 +6900,11 @@ spec:
68846900
- message: only one of clientID or clientIDRef must be set
68856901
rule: (has(self.clientID) && !has(self.clientIDRef)) || (!has(self.clientID)
68866902
&& has(self.clientIDRef))
6903+
- message: forwardAccessToken cannot be true when forwardIDToken.header
6904+
is Authorization
6905+
rule: '!(has(self.forwardAccessToken) && self.forwardAccessToken
6906+
&& has(self.forwardIDToken) && self.forwardIDToken.header.lowerAscii()
6907+
== ''authorization'')'
68876908
targetRef:
68886909
description: |-
68896910
TargetRef is the name of the resource this policy is being attached to.

examples/backend-utilization/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.26.1 AS builder
1+
FROM golang:1.26.2 AS builder
22

33
ARG GO_LDFLAGS=""
44

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
module github.com/envoyproxy/gateway-backend-utilization
22

3-
go 1.26.1
3+
go 1.26.2

examples/dynamic-module-test/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Update both together when changing the target Envoy version.
33
ARG ENVOY_VERSION=dev
44

5-
FROM golang:1.26.1 AS builder
5+
FROM golang:1.26.2 AS builder
66

77
WORKDIR /build
88
COPY go.mod go.sum ./
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
module github.com/envoyproxy/gateway/examples/dynamic-module-test
22

3-
go 1.26.1
3+
go 1.26.2
44

55
require github.com/envoyproxy/envoy/source/extensions/dynamic_modules v0.0.0-20260305043144-94d5888d4c19

examples/envoy-ext-auth/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.26.1 AS builder
1+
FROM golang:1.26.2 AS builder
22

33
ARG GO_LDFLAGS=""
44

0 commit comments

Comments
 (0)