envoyproxy
diff --git a/‎api/v1alpha1/api_key_auth_types.go‎
Lines changed: 13 additions & 4 deletions b/‎api/v1alpha1/api_key_auth_types.go‎
Lines changed: 13 additions & 4 deletions
diff --git a/‎api/v1alpha1/envoygateway_helpers.go‎
Lines changed: 1 addition & 0 deletions b/‎api/v1alpha1/envoygateway_helpers.go‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎api/v1alpha1/ratelimit_types.go‎
Lines changed: 2 additions & 1 deletion b/‎api/v1alpha1/ratelimit_types.go‎
Lines changed: 2 additions & 1 deletion
diff --git a/‎api/v1alpha1/shared_types.go‎
Lines changed: 1 addition & 1 deletion b/‎api/v1alpha1/shared_types.go‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎api/v1alpha1/validation/envoyproxy_validate.go‎
Lines changed: 1 addition & 1 deletion b/‎api/v1alpha1/validation/envoyproxy_validate.go‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎api/v1alpha1/validation/envoyproxy_validate_test.go‎
Lines changed: 21 additions & 0 deletions b/‎api/v1alpha1/validation/envoyproxy_validate_test.go‎
Lines changed: 21 additions & 0 deletions
diff --git a/‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml‎
Lines changed: 2 additions & 2 deletions b/‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml‎
Lines changed: 16 additions & 4 deletions b/‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml‎
Lines changed: 16 additions & 4 deletions
diff --git a/‎charts/gateway-helm/Chart.lock‎
Lines changed: 2 additions & 2 deletions b/‎charts/gateway-helm/Chart.lock‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎charts/gateway-helm/Chart.yaml‎
Lines changed: 1 addition & 0 deletions b/‎charts/gateway-helm/Chart.yaml‎
Lines changed: 1 addition & 0 deletions
@@ -21,6 +21,8 @@ type APIKeyAuth struct {
 
 	// ExtractFrom is where to fetch the key from the coming request.
 	// The value from the first source that has a key will be used.
+	//
+	// +kubebuilder:validation:MinItems=1
 	ExtractFrom []*ExtractFrom `json:"extractFrom"`
 
 	// ForwardClientIDHeader is the name of the header to forward the client identity to the backend
@@ -36,24 +38,31 @@ type APIKeyAuth struct {
 }
 
 // ExtractFrom is where to fetch the key from the coming request.
-// Only one of header, param or cookie is supposed to be specified.
+// Only one of headers, params or cookies must be specified.
+// +kubebuilder:validation:XValidation:rule="(has(self.headers) ? 1 : 0) + (has(self.params) ? 1 : 0) + (has(self.cookies) ? 1 : 0) == 1",message="exactly one of headers, params, or cookies must be specified"
 type ExtractFrom struct {
 	// Headers is the names of the header to fetch the key from.
 	// If multiple headers are specified, envoy will look for the api key in the order of the list.
-	// This field is optional, but only one of headers, params or cookies is supposed to be specified.
+	// This field is optional, but only one of headers, params or cookies must be specified.
 	//
 	// +optional
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:items:MinLength=1
 	Headers []string `json:"headers,omitempty"`
 	// Params is the names of the query parameter to fetch the key from.
 	// If multiple params are specified, envoy will look for the api key in the order of the list.
-	// This field is optional, but only one of headers, params or cookies is supposed to be specified.
+	// This field is optional, but only one of headers, params or cookies must be specified.
 	//
 	// +optional
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:items:MinLength=1
 	Params []string `json:"params,omitempty"`
 	// Cookies is the names of the cookie to fetch the key from.
 	// If multiple cookies are specified, envoy will look for the api key in the order of the list.
-	// This field is optional, but only one of headers, params or cookies is supposed to be specified.
+	// This field is optional, but only one of headers, params or cookies must be specified.
 	//
 	// +optional
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:items:MinLength=1
 	Cookies []string `json:"cookies,omitempty"`
 }
@@ -110,6 +110,7 @@ func (e *EnvoyGateway) GatewayNamespaceMode() bool {
 	return e.Provider != nil &&
 		e.Provider.Kubernetes != nil &&
 		e.Provider.Kubernetes.Deploy != nil &&
+		e.Provider.Kubernetes.Deploy.Type != nil &&
 		*e.Provider.Kubernetes.Deploy.Type == KubernetesDeployModeTypeGatewayNamespace
 }
 
 
@@ -81,7 +81,7 @@ type XRateLimitHeadersOption string
 const (
 	// XRateLimitHeadersOptionDisabled disables X-RateLimit headers for this rate limit rule,
 	// regardless of the global ClientTrafficPolicy setting.
-	XRateLimitHeadersOptionDisabled XRateLimitHeadersOption = "Disabled"
+	XRateLimitHeadersOptionDisabled XRateLimitHeadersOption = "Off"
 
 	// XRateLimitHeadersOptionDraftVersion03 enables X-RateLimit headers using RFC draft version 03
 	// for this rate limit rule, regardless of the global ClientTrafficPolicy setting.
@@ -437,6 +437,7 @@ type RateLimitValue struct {
 	//
 	// +kubebuilder:validation:Minimum=1
 	// +kubebuilder:validation:Maximum=4294967295
+	// +kubebuilder:validation:Format=int64
 	Requests uint32        `json:"requests"`
 	Unit     RateLimitUnit `json:"unit"`
 }
 
@@ -34,7 +34,7 @@ const (
 	// DefaultShutdownManagerImage is the default image used for the shutdown manager.
 	DefaultShutdownManagerImage = "docker.io/envoyproxy/gateway-dev:latest"
 	// DefaultRateLimitImage is the default image used by ratelimit.
-	DefaultRateLimitImage = "docker.io/envoyproxy/ratelimit:ff287602"
+	DefaultRateLimitImage = "docker.io/envoyproxy/ratelimit:1e50889b"
 	// HTTPProtocol is the common-used http protocol.
 	HTTPProtocol = "http"
 	// GRPCProtocol is the common-used grpc protocol.
 
@@ -166,7 +166,7 @@ func validateService(spec *egv1a1.EnvoyProxySpec) []error {
 			}
 
 			for _, serviceLoadBalancerSourceRange := range serviceLoadBalancerSourceRanges {
-				if ip, _, err := net.ParseCIDR(serviceLoadBalancerSourceRange); err != nil || ip.To4() == nil {
+				if _, _, err := net.ParseCIDR(serviceLoadBalancerSourceRange); err != nil {
 					errs = append(errs, fmt.Errorf("loadBalancerSourceRange:%s is an invalid IP subnet", serviceLoadBalancerSourceRange))
 				}
 			}
 
@@ -251,6 +251,27 @@ func TestValidateEnvoyProxy(t *testing.T) {
 			},
 			expected: true,
 		},
+		{
+			name: "envoy service type 'LoadBalancer' with ipv6 loadBalancerSourceRanges",
+			proxy: &egv1a1.EnvoyProxy{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: "test",
+					Name:      "test",
+				},
+				Spec: egv1a1.EnvoyProxySpec{
+					Provider: &egv1a1.EnvoyProxyProvider{
+						Type: egv1a1.EnvoyProxyProviderTypeKubernetes,
+						Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{
+							EnvoyService: &egv1a1.KubernetesServiceSpec{
+								Type:                     egv1a1.GetKubernetesServiceType(egv1a1.ServiceTypeLoadBalancer),
+								LoadBalancerSourceRanges: []string{"2001:db8::/32"},
+							},
+						},
+					},
+				},
+			},
+			expected: true,
+		},
 		{
 			name: "non envoy service type 'LoadBalancer' with loadBalancerSourceRanges",
 			proxy: &egv1a1.EnvoyProxy{
 
@@ -1762,7 +1762,7 @@ spec:
                                   description: |-
                                     Requests is the number of requests (or cost units, when used with
                                     cost-based rate limiting) allowed per Unit.
-                                  format: int32
+                                  format: int64
                                   maximum: 4294967295
                                   minimum: 1
                                   type: integer
@@ -2146,7 +2146,7 @@ spec:
                                   description: |-
                                     Requests is the number of requests (or cost units, when used with
                                     cost-based rate limiting) allowed per Unit.
-                                  format: int32
+                                  format: int64
                                   maximum: 4294967295
                                   minimum: 1
                                   type: integer
 
@@ -118,33 +118,45 @@ spec:
                     items:
                       description: |-
                         ExtractFrom is where to fetch the key from the coming request.
-                        Only one of header, param or cookie is supposed to be specified.
+                        Only one of headers, params or cookies must be specified.
                       properties:
                         cookies:
                           description: |-
                             Cookies is the names of the cookie to fetch the key from.
                             If multiple cookies are specified, envoy will look for the api key in the order of the list.
-                            This field is optional, but only one of headers, params or cookies is supposed to be specified.
+                            This field is optional, but only one of headers, params or cookies must be specified.
                           items:
+                            minLength: 1
                             type: string
+                          minItems: 1
                           type: array
                         headers:
                           description: |-
                             Headers is the names of the header to fetch the key from.
                             If multiple headers are specified, envoy will look for the api key in the order of the list.
-                            This field is optional, but only one of headers, params or cookies is supposed to be specified.
+                            This field is optional, but only one of headers, params or cookies must be specified.
                           items:
+                            minLength: 1
                             type: string
+                          minItems: 1
                           type: array
                         params:
                           description: |-
                             Params is the names of the query parameter to fetch the key from.
                             If multiple params are specified, envoy will look for the api key in the order of the list.
-                            This field is optional, but only one of headers, params or cookies is supposed to be specified.
+                            This field is optional, but only one of headers, params or cookies must be specified.
                           items:
+                            minLength: 1
                             type: string
+                          minItems: 1
                           type: array
                       type: object
+                      x-kubernetes-validations:
+                      - message: exactly one of headers, params, or cookies must be
+                          specified
+                        rule: '(has(self.headers) ? 1 : 0) + (has(self.params) ? 1
+                          : 0) + (has(self.cookies) ? 1 : 0) == 1'
+                    minItems: 1
                     type: array
                   forwardClientIDHeader:
                     description: |-
 
@@ -2,5 +2,5 @@ dependencies:
 - name: crds
   repository: ""
   version: 0.0.0
-digest: sha256:aeada3fbffa2565a325406ad014001fd2685f7c0c9cfc1167da4f10c75a1bd65
-generated: "2026-02-17T14:34:30.962808-07:00"
+digest: sha256:16cbbceffe2a6946ae7cbb20b5a8313267bc77f4669caba20fffb3ff64a773a6
+generated: "2026-05-22T21:27:32.703929139-03:00"
@@ -27,3 +27,4 @@ sources:
 dependencies:
   - name: crds
     version: "0.0.0"
+    condition: crds.enabled
Original file line number	Diff line number	Diff line change
`@@ -110,6 +110,7 @@ func (e *EnvoyGateway) GatewayNamespaceMode() bool {`
`110`	`110`	`return e.Provider != nil &&`
`111`	`111`	`e.Provider.Kubernetes != nil &&`
`112`	`112`	`e.Provider.Kubernetes.Deploy != nil &&`
	`113`	`+ e.Provider.Kubernetes.Deploy.Type != nil &&`
`113`	`114`	`*e.Provider.Kubernetes.Deploy.Type == KubernetesDeployModeTypeGatewayNamespace`
`114`	`115`	`}`
`115`	`116`
Original file line number	Diff line number	Diff line change
`@@ -166,7 +166,7 @@ func validateService(spec *egv1a1.EnvoyProxySpec) []error {`
`166`	`166`	`}`
`167`	`167`
`168`	`168`	`for _, serviceLoadBalancerSourceRange := range serviceLoadBalancerSourceRanges {`
`169`		`- if ip, _, err := net.ParseCIDR(serviceLoadBalancerSourceRange); err != nil \|\| ip.To4() == nil {`
	`169`	`+ if _, _, err := net.ParseCIDR(serviceLoadBalancerSourceRange); err != nil {`
`170`	`170`	`errs = append(errs, fmt.Errorf("loadBalancerSourceRange:%s is an invalid IP subnet", serviceLoadBalancerSourceRange))`
`171`	`171`	`}`
`172`	`172`	`}`