Merge branch 'main' into client-overall-tracing-sampling

Author: Ri7ay

.github/workflows/build_and_test.yaml

@@ -27,7 +27,7 @@ jobs:
     outputs:
       run_test_workflow: ${{ steps.check-changes.outputs.run_test_workflow }}
     steps:
-    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d  # v4.0.1
+    - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706  # v4.0.2
       id: check-changes
       # A dependent job will be automatically skipped if its parent job is skipped.
       # So we skip this step in pull_request event if the changes are not relevant.
@@ -368,7 +368,7 @@ jobs:
 
     # build and push image
     - name: Login to DockerHub
-      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
       with:
         username: ${{ vars.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_PASSWORD }}

.github/workflows/codeql.yml

@@ -36,14 +36,14 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
+      uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v3.29.5
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
+      uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v3.29.5
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
+      uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v3.29.5
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/release.yaml

@@ -107,7 +107,7 @@ jobs:
           } >> "$GITHUB_ENV"
 
       - name: Login to DockerHub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}

.github/workflows/scorecard.yml

@@ -40,6 +40,6 @@ jobs:
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
+      uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v3.29.5
       with:
         sarif_file: results.sarif

api/v1alpha1/authorization_types.go

@@ -164,7 +164,8 @@ type Principal struct {
 	//
 	// If multiple entries are specified,  one of the ClientIPGeoLocation entries must match for the rule to match.
 	//
-	// The client IP is inferred from the X-Forwarded-For header or a custom header.
+	// The client IP is inferred from the X-Forwarded-For header, a custom header, or the
+	// direct downstream connection source address (the TCP peer of the connection terminated by Envoy).
 	// You can use the `ClientIPDetection` field in the `ClientTrafficPolicy` to configure the client IP detection.
 	//
 	// +optional

api/v1alpha1/clienttrafficpolicy_types.go

@@ -281,7 +281,8 @@ const (
 
 // ClientIPDetectionSettings provides configuration for determining the original client IP address for requests.
 //
-// +kubebuilder:validation:XValidation:rule="!(has(self.xForwardedFor) && has(self.customHeader))",message="customHeader cannot be used in conjunction with xForwardedFor"
+// Exactly one of XForwardedFor, CustomHeader, or DirectSourceIP must be set.
+// +kubebuilder:validation:XValidation:rule="[has(self.xForwardedFor), has(self.customHeader), has(self.directSourceIP)].filter(x, x).size() == 1",message="exactly one of xForwardedFor, customHeader, or directSourceIP must be set"
 type ClientIPDetectionSettings struct {
 	// XForwardedForSettings provides configuration for using X-Forwarded-For headers for determining the client IP address.
 	//
@@ -294,8 +295,25 @@ type ClientIPDetectionSettings struct {
 	//
 	// +optional
 	CustomHeader *CustomHeaderExtensionSettings `json:"customHeader,omitempty"`
+	// DirectSourceIP configures the geoip filter to use the downstream connection
+	// source address (the TCP peer of the connection terminated by Envoy) as the client IP.
+	//
+	// Use this in L4-transparent topologies where a load balancer preserves the original
+	// client source IP at TCP level and does not populate XFF or a custom header — for
+	// example, AWS NLB with target-type=instance + externalTrafficPolicy=Local, or
+	// Azure Standard Load Balancer.
+	//
+	// Mutually exclusive with XForwardedFor and CustomHeader.
+	//
+	// +optional
+	DirectSourceIP *DirectSourceIPSettings `json:"directSourceIP,omitempty"`
 }
 
+// DirectSourceIPSettings configures client IP detection from the downstream
+// connection source address. It currently has no fields; its presence opts the listener
+// into using the TCP peer address as the client IP.
+type DirectSourceIPSettings struct{}
+
 // XForwardedForSettings provides configuration for using X-Forwarded-For headers for determining the client IP address.
 // Refer to https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers#x-forwarded-for
 // for more details.

api/v1alpha1/zz_generated.deepcopy.go

@@ -19,6 +19,6 @@ dependencies:
   version: 1.3.1
 - name: opentelemetry-collector
   repository: https://open-telemetry.github.io/opentelemetry-helm-charts
-  version: 0.159.2
-digest: sha256:2b45964580ba403a616a6546a3f544878c757dddb72854509294fd970d2d2794
-generated: "2026-07-01T04:22:11.232246258Z"
+  version: 0.164.0
+digest: sha256:a382a12fb2d3fdf05ab3fbac1139ff026afbd19af55d897af5950bf89254f56e
+generated: "2026-07-08T04:13:12.003862967Z"

charts/gateway-addons-helm/Chart.lock

@@ -51,5 +51,5 @@ dependencies:
     condition: tempo.enabled
   - name: opentelemetry-collector
     repository: https://open-telemetry.github.io/opentelemetry-helm-charts
-    version: 0.159.2
+    version: 0.164.0
     condition: opentelemetry-collector.enabled

charts/gateway-addons-helm/Chart.yaml

@@ -26,7 +26,7 @@ An Add-ons Helm chart for Envoy Gateway
 | https://grafana.github.io/helm-charts | grafana | 10.5.15 |
 | https://grafana.github.io/helm-charts | loki | 7.0.0 |
 | https://grafana.github.io/helm-charts | tempo | 1.3.1 |
-| https://open-telemetry.github.io/opentelemetry-helm-charts | opentelemetry-collector | 0.159.2 |
+| https://open-telemetry.github.io/opentelemetry-helm-charts | opentelemetry-collector | 0.164.0 |
 | https://prometheus-community.github.io/helm-charts | prometheus | 29.10.1 |
 
 ## Usage
@@ -172,7 +172,7 @@ helm uninstall eg-addons -n monitoring
 | opentelemetry-collector.enabled | bool | `false` |  |
 | opentelemetry-collector.fullnameOverride | string | `"otel-collector"` |  |
 | opentelemetry-collector.image.repository | string | `"otel/opentelemetry-collector-contrib"` |  |
-| opentelemetry-collector.image.tag | string | `"0.155.0"` |  |
+| opentelemetry-collector.image.tag | string | `"0.156.0"` |  |
 | opentelemetry-collector.mode | string | `"deployment"` |  |
 | opentelemetry-collector.ports.datadog.containerPort | int | `8126` |  |
 | opentelemetry-collector.ports.datadog.enabled | bool | `true` |  |