Merge branch 'main' into fix/listenerset-accepted-invalid-cert

Signed-off-by: zirain <zirain2009@gmail.com>

Author: zirain

.github/workflows/codeql.yml

@@ -36,14 +36,14 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225  # v3.29.5
+      uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7  # v3.29.5
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225  # v3.29.5
+      uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7  # v3.29.5
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225  # v3.29.5
+      uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7  # v3.29.5
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/scorecard.yml

@@ -40,6 +40,6 @@ jobs:
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225  # v3.29.5
+      uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7  # v3.29.5
       with:
         sarif_file: results.sarif

api/v1alpha1/policy_helpers.go

@@ -58,6 +58,10 @@ type TargetSelector struct {
 	// When specified, the effective set of namespaces is always constrained to the
 	// namespaces watched by Envoy Gateway.
 	//
+	// Selecting targets across namespaces requires a ReferenceGrant in the target
+	// namespace that allows this policy kind to reference the selected target kind.
+	// Cross-namespace targets without a matching ReferenceGrant are ignored.
+	//
 	// +optional
 	Namespaces *TargetSelectorNamespaces `json:"namespaces,omitempty"`
 

api/v1alpha1/ratelimit_types.go

@@ -228,7 +228,7 @@ type RateLimitSelectCondition struct {
 	// meaning, a request MUST match all the specified headers.
 	//
 	// +optional
-	// +kubebuilder:validation:MaxItems=16
+	// +kubebuilder:validation:MaxItems=64
 	Headers []HeaderMatch `json:"headers,omitempty"`
 
 	// Methods is a list of request methods to match. Multiple method values are ORed together,

api/v1alpha1/shared_types.go

@@ -70,10 +70,6 @@ const (
 	// PolicyReasonDeprecatedField is used with the "Warning" condition when the policy
 	// uses deprecated fields that should be migrated to newer alternatives.
 	PolicyReasonDeprecatedField gwapiv1.PolicyConditionReason = "DeprecatedField"
-
-	// PolicyReasonRefNotPermitted is used when the policy targets a cross-namespace
-	// object without a matching ReferenceGrant.
-	PolicyReasonRefNotPermitted gwapiv1.PolicyConditionReason = "RefNotPermitted"
 )
 
 // GroupVersionKind unambiguously identifies a Kind.

charts/gateway-addons-helm/Chart.lock

@@ -1,7 +1,7 @@
 dependencies:
 - name: prometheus
   repository: https://prometheus-community.github.io/helm-charts
-  version: 29.3.0
+  version: 29.6.0
 - name: grafana
   repository: https://grafana.github.io/helm-charts
   version: 10.5.15
@@ -19,6 +19,6 @@ dependencies:
   version: 1.3.1
 - name: opentelemetry-collector
   repository: https://open-telemetry.github.io/opentelemetry-helm-charts
-  version: 0.152.0
-digest: sha256:31e439ab78cec2551ca15813d21b27637c060fd0b22a6f147d7b11fbf75ed05e
-generated: "2026-04-29T04:35:56.58559758Z"
+  version: 0.153.0
+digest: sha256:2c021601dd359d16c3a167eeb6bbbb854c5ffe6d71536190c9ea62d0c087ed28
+generated: "2026-05-06T04:36:04.893013011Z"

charts/gateway-addons-helm/Chart.yaml

@@ -26,7 +26,7 @@ sources:
 
 dependencies:
   - name: prometheus
-    version: 29.3.0
+    version: 29.6.0
     repository: https://prometheus-community.github.io/helm-charts
     condition: prometheus.enabled
   - name: grafana
@@ -51,5 +51,5 @@ dependencies:
     condition: tempo.enabled
   - name: opentelemetry-collector
     repository: https://open-telemetry.github.io/opentelemetry-helm-charts
-    version: 0.152.0
+    version: 0.153.0
     condition: opentelemetry-collector.enabled

charts/gateway-addons-helm/README.md

@@ -26,8 +26,8 @@ An Add-ons Helm chart for Envoy Gateway
 | https://grafana.github.io/helm-charts | grafana | 10.5.15 |
 | https://grafana.github.io/helm-charts | loki | 7.0.0 |
 | https://grafana.github.io/helm-charts | tempo | 1.3.1 |
-| https://open-telemetry.github.io/opentelemetry-helm-charts | opentelemetry-collector | 0.152.0 |
-| https://prometheus-community.github.io/helm-charts | prometheus | 29.3.0 |
+| https://open-telemetry.github.io/opentelemetry-helm-charts | opentelemetry-collector | 0.153.0 |
+| https://prometheus-community.github.io/helm-charts | prometheus | 29.6.0 |
 
 ## Usage
 

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml

@@ -1506,7 +1506,7 @@ spec:
                                       required:
                                       - name
                                       type: object
-                                    maxItems: 16
+                                    maxItems: 64
                                     type: array
                                   methods:
                                     description: |-
@@ -1890,7 +1890,7 @@ spec:
                                       required:
                                       - name
                                       type: object
-                                    maxItems: 16
+                                    maxItems: 64
                                     type: array
                                   methods:
                                     description: |-
@@ -2924,6 +2924,10 @@ spec:
 
                         When specified, the effective set of namespaces is always constrained to the
                         namespaces watched by Envoy Gateway.
+
+                        Selecting targets across namespaces requires a ReferenceGrant in the target
+                        namespace that allows this policy kind to reference the selected target kind.
+                        Cross-namespace targets without a matching ReferenceGrant are ignored.
                       properties:
                         from:
                           default: Same

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -1181,6 +1181,10 @@ spec:
 
                         When specified, the effective set of namespaces is always constrained to the
                         namespaces watched by Envoy Gateway.
+
+                        Selecting targets across namespaces requires a ReferenceGrant in the target
+                        namespace that allows this policy kind to reference the selected target kind.
+                        Cross-namespace targets without a matching ReferenceGrant are ignored.
                       properties:
                         from:
                           default: Same