Skip to content

Commit b0249f7

Browse files
jukiejukie
authored
Merge branch 'main' into route-overlap
Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>
2 parents 495fb34 + f984377 commit b0249f7

737 files changed

Lines changed: 61448 additions & 1663 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/build_and_test.yaml‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ jobs:
119119
run: make build-multiarch PLATFORMS="linux_amd64 linux_arm64"
120120

121121
- name: Upload EG Binaries
122-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
122+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
123123
with:
124124
name: envoy-gateway
125125
path: bin/
@@ -137,28 +137,34 @@ jobs:
137137
- version: v1.32.11
138138
ipFamily: ipv4
139139
profile: default
140+
gwapiChannel: standard
140141
- version: v1.33.7
141142
ipFamily: ipv4
142143
profile: default
144+
gwapiChannel: experimental
143145
- version: v1.34.3
144146
ipFamily: ipv6 # only run ipv6 test on this version to save time
145147
profile: default
148+
gwapiChannel: experimental
146149
# TODO: this's IPv4 first, need a way to test IPv6 first.
147150
- version: v1.35.0
148151
ipFamily: dual # only run dual test on latest version to save time
149152
profile: default
153+
gwapiChannel: experimental
150154
- version: v1.35.0
151155
ipFamily: dual # only run dual test on latest version to save time
156+
gwapiChannel: experimental
152157
profile: gateway-namespace-mode
153158
- version: v1.35.0
154159
ipFamily: ipv4
155160
profile: xds-name-scheme-v2
161+
gwapiChannel: experimental
156162
steps:
157163
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
158164
- uses: ./tools/github-actions/setup-deps
159165

160166
- name: Download EG Binaries
161-
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
167+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
162168
with:
163169
name: envoy-gateway
164170
path: bin/
@@ -175,6 +181,7 @@ jobs:
175181
IMAGE_PULL_POLICY: IfNotPresent
176182
IP_FAMILY: ${{ matrix.target.ipFamily }}
177183
KUBE_DEPLOY_PROFILE: ${{ matrix.target.profile }}
184+
E2E_GATEWAY_API_CHANNEL: ${{ matrix.target.gwapiChannel }}
178185
run: make conformance
179186

180187
e2e-test:
@@ -213,7 +220,7 @@ jobs:
213220
- uses: ./tools/github-actions/reclaim-storage
214221

215222
- name: Download EG Binaries
216-
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
223+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
217224
with:
218225
name: envoy-gateway
219226
path: bin/
@@ -232,10 +239,10 @@ jobs:
232239
KUBE_DEPLOY_PROFILE: ${{ matrix.target.profile }}
233240
E2E_TIMEOUT: 1h
234241
NUM_WORKERS: 2
235-
# QPS more than 3000 may cause e2e flaky test.
242+
# QPS more than 2000 may cause e2e flaky test.
236243
# This is not the limit of Envoy Gateway,
237244
# but the limit of running e2e tests in github CI.
238-
E2E_BACKEND_UPGRADE_QPS: "3000"
245+
E2E_BACKEND_UPGRADE_QPS: "2000"
239246
# Cluster trust bundle reach beta in v1.33, so we can enable it for v1.33 and later.
240247
ENABLE_CLUSTER_TRUST_BUNDLE: ${{ startsWith(matrix.target.version, 'v1.33') }}
241248
run: make e2e
@@ -268,7 +275,7 @@ jobs:
268275
run: make benchmark
269276

270277
- name: Upload Benchmark report
271-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
278+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
272279
with:
273280
name: benchmark_report
274281
path: ./test/benchmark/benchmark_report/
@@ -296,7 +303,7 @@ jobs:
296303
- uses: ./tools/github-actions/setup-deps
297304

298305
- name: Download EG Binaries
299-
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
306+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
300307
with:
301308
name: envoy-gateway
302309
path: bin/
@@ -309,7 +316,7 @@ jobs:
309316
# build and push image
310317
- name: Login to DockerHub
311318
if: github.event_name == 'push'
312-
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
319+
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
313320
with:
314321
username: ${{ vars.DOCKERHUB_USERNAME }}
315322
password: ${{ secrets.DOCKERHUB_PASSWORD }}

‎.github/workflows/codeql.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,14 +36,14 @@ jobs:
3636
- uses: ./tools/github-actions/setup-deps
3737

3838
- name: Initialize CodeQL
39-
uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3.29.5
39+
uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.29.5
4040
with:
4141
languages: ${{ matrix.language }}
4242

4343
- name: Autobuild
44-
uses: github/codeql-action/autobuild@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3.29.5
44+
uses: github/codeql-action/autobuild@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.29.5
4545

4646
- name: Perform CodeQL Analysis
47-
uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3.29.5
47+
uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.29.5
4848
with:
4949
category: "/language:${{matrix.language}}"

‎.github/workflows/docs.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ jobs:
6060
extended: true
6161

6262
- name: Setup Node
63-
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
63+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
6464
with:
6565
node-version: '18'
6666

‎.github/workflows/experimental_conformance.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ jobs:
6060
run: make experimental-conformance
6161

6262
- name: Upload Conformance Report
63-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
63+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
6464
with:
6565
name: conformance-report-k8s-${{ matrix.target.version }}-${{ matrix.target.profile }}
6666
path: ./test/conformance/conformance-report-k8s-${{ matrix.target.version }}-${{ matrix.target.profile }}.yaml

‎.github/workflows/release.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242
run: cd test/benchmark && zip -r benchmark_report.zip benchmark_report
4343

4444
- name: Upload Benchmark Report
45-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
45+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
4646
with:
4747
name: benchmark_report
4848
path: test/benchmark/benchmark_report.zip
@@ -67,7 +67,7 @@ jobs:
6767
} >> "$GITHUB_ENV"
6868
6969
- name: Login to DockerHub
70-
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
70+
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
7171
with:
7272
username: ${{ vars.DOCKERHUB_USERNAME }}
7373
password: ${{ secrets.DOCKERHUB_PASSWORD }}
@@ -84,7 +84,7 @@ jobs:
8484
IMAGE_PULL_POLICY=IfNotPresent OCI_REGISTRY=oci://docker.io/envoyproxy CHART_VERSION=${{ env.without_v_release_tag }} IMAGE=docker.io/envoyproxy/gateway TAG=${{ env.release_tag }} make helm-package helm-push
8585
8686
- name: Download Benchmark Report
87-
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
87+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
8888
with:
8989
name: benchmark_report
9090
path: release-artifacts

‎.github/workflows/scorecard.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,13 @@ jobs:
3333
publish_results: true
3434

3535
- name: "Upload artifact"
36-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
36+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
3737
with:
3838
name: SARIF file
3939
path: results.sarif
4040
retention-days: 5
4141

4242
- name: "Upload to code-scanning"
43-
uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3.29.5
43+
uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.29.5
4444
with:
4545
sarif_file: results.sarif

‎.github/workflows/trivy.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
IMAGE=envoy-proxy/gateway-dev TAG=${{ github.sha }} make image
3636
3737
- name: Run Trivy vulnerability scanner
38-
uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # v0.34.1
38+
uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # v0.34.2
3939
with:
4040
image-ref: envoy-proxy/gateway-dev:${{ github.sha }}
4141
exit-code: '1'

‎api/v1alpha1/authorization_types.go‎

Lines changed: 55 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ type Operation struct {
7272
// or any other identity that can be extracted from a custom header.
7373
// If there are multiple principal types, all principals must match for the rule to match.
7474
//
75-
// +kubebuilder:validation:XValidation:rule="(has(self.clientCIDRs) || has(self.jwt) || has(self.headers))",message="at least one of clientCIDRs, jwt, or headers must be specified"
75+
// +kubebuilder:validation:XValidation:rule="(has(self.clientCIDRs) || has(self.jwt) || has(self.headers) || has(self.clientIPGeoLocations))",message="at least one of clientCIDRs, jwt, headers, or clientIPGeoLocations must be specified"
7676
type Principal struct {
7777
// ClientCIDRs are the IP CIDR ranges of the client.
7878
// Valid examples are "192.168.1.0/24" or "2001:db8::/64"
@@ -128,6 +128,60 @@ type Principal struct {
128128
// +kubebuilder:validation:MinItems=1
129129
// +notImplementedHide
130130
SourceCIDRs []CIDR `json:"sourceCIDRs,omitempty"`
131+
132+
// ClientIPGeoLocations authorizes the request based on geolocation metadata derived from the client IP.
133+
// If multiple entries are specified, one of the ClientIPGeoLocation entries must match for the rule to match.
134+
//
135+
// +optional
136+
// +kubebuilder:validation:MinItems=1
137+
// +notImplementedHide
138+
ClientIPGeoLocations []ClientIPGeoLocation `json:"clientIPGeoLocations,omitempty"`
139+
}
140+
141+
// ClientIPGeoLocation specifies geolocation-based match criteria for authorization.
142+
//
143+
// +kubebuilder:validation:XValidation:rule="has(self.country) || has(self.region) || has(self.city) || has(self.asn) || has(self.isp) || has(self.anonymous)",message="at least one of country, region, city, asn, isp, or anonymous must be specified"
144+
type ClientIPGeoLocation struct {
145+
// Country is the country ISO code associated with the client IP.
146+
//
147+
// +optional
148+
// +kubebuilder:validation:MinLength=2
149+
// +kubebuilder:validation:MaxLength=2
150+
// +kubebuilder:validation:Pattern=`^[A-Za-z]{2}$`
151+
Country *string `json:"country,omitempty"`
152+
153+
// Region is the region ISO code associated with the client IP.
154+
//
155+
// +optional
156+
// +kubebuilder:validation:MinLength=1
157+
// +kubebuilder:validation:MaxLength=16
158+
// +kubebuilder:validation:Pattern=`^[A-Za-z0-9-]+$`
159+
Region *string `json:"region,omitempty"`
160+
161+
// City is the city associated with the client IP.
162+
//
163+
// +optional
164+
// +kubebuilder:validation:MinLength=1
165+
// +kubebuilder:validation:MaxLength=128
166+
City *string `json:"city,omitempty"`
167+
168+
// ASN is the autonomous system number associated with the client IP.
169+
//
170+
// +optional
171+
// +kubebuilder:validation:Minimum=1
172+
ASN *uint32 `json:"asn,omitempty"`
173+
174+
// ISP is the internet service provider associated with the client IP.
175+
//
176+
// +optional
177+
// +kubebuilder:validation:MinLength=1
178+
// +kubebuilder:validation:MaxLength=256
179+
ISP *string `json:"isp,omitempty"`
180+
181+
// Anonymous matches anonymous network detection signals.
182+
//
183+
// +optional
184+
Anonymous *GeoIPAnonymousMatch `json:"anonymous,omitempty"`
131185
}
132186

133187
// AuthorizationHeaderMatch specifies how to match against the value of an HTTP header within a authorization rule.

‎api/v1alpha1/basic_auth_types.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,6 @@ type BasicAuth struct {
2323
// Right now, only SHA hash algorithm is supported.
2424
// Reference to https://httpd.apache.org/docs/2.4/programs/htpasswd.html
2525
// for more details.
26-
//
27-
// Note: The secret must be in the same namespace as the SecurityPolicy.
2826
Users gwapiv1.SecretObjectReference `json:"users"`
2927

3028
// This field specifies the header name to forward a successfully authenticated user to

‎api/v1alpha1/clienttrafficpolicy_types.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,10 @@ type ClientTrafficPolicySpec struct {
103103
//
104104
// +optional
105105
HTTP3 *HTTP3Settings `json:"http3,omitempty"`
106+
// GRPC provides gRPC configuration on the listener.
107+
//
108+
// +optional
109+
GRPC *GRPCSettings `json:"grpc,omitempty"`
106110
// HealthCheck provides configuration for determining whether the HTTP/HTTPS listener is healthy.
107111
//
108112
// +optional

0 commit comments

Comments
 (0)