Merge branch 'main' into tls-key-ec-parameters

Author: jvlxz

.github/dependabot.yml

@@ -118,6 +118,8 @@ updates:
       - dependency-name: "github.com/envoyproxy/go-control-plane*"
       # Ignore all k8s.io packages on release branches to avoid unintended k8s version bumps
       - dependency-name: "k8s.io/*"
+      # Ignore sigs.k8s.io/gateway-api on release branches to avoid unintended Gateway API version bumps
+      - dependency-name: "sigs.k8s.io/gateway-api"
     groups:
       gomod:
         patterns:
@@ -169,6 +171,8 @@ updates:
       - dependency-name: "github.com/envoyproxy/go-control-plane*"
       # Ignore all k8s.io packages on release branches to avoid unintended k8s version bumps
       - dependency-name: "k8s.io/*"
+      # Ignore sigs.k8s.io/gateway-api on release branches to avoid unintended Gateway API version bumps
+      - dependency-name: "sigs.k8s.io/gateway-api"
     groups:
       gomod:
         patterns:

.github/workflows/build_and_test.yaml

@@ -27,7 +27,7 @@ jobs:
     outputs:
       run_test_workflow: ${{ steps.check-changes.outputs.run_test_workflow }}
     steps:
-    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d  # v4.0.1
+    - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706  # v4.0.2
       id: check-changes
       # A dependent job will be automatically skipped if its parent job is skipped.
       # So we skip this step in pull_request event if the changes are not relevant.
@@ -368,7 +368,7 @@ jobs:
 
     # build and push image
     - name: Login to DockerHub
-      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
       with:
         username: ${{ vars.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_PASSWORD }}

.github/workflows/codeql.yml

@@ -36,14 +36,14 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
+      uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v3.29.5
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
+      uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v3.29.5
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
+      uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v3.29.5
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/docs.yaml

@@ -48,7 +48,7 @@ jobs:
     - uses: ./tools/github-actions/setup-deps
 
     - name: Setup Node
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
       with:
         node-version-file: site/.nvmrc
 

.github/workflows/osv-scanner.yml

@@ -19,7 +19,7 @@ permissions:
 jobs:
   scan-scheduled:
     if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@fa4ff678dd5d0a4fa3d628e57af8162873e93cd6"  # main, pending release > v2.3.8 (incl. osv-scanner-action#130)
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a82132c0bd6c7261ffcb78e754c46c70ab57ad9a"  # main, pending release > v2.3.8 (incl. osv-scanner-action#130)
     with:
       scan-args: |-
         --config tools/osv-scanner/vulnerability-scan-config.toml
@@ -33,7 +33,7 @@ jobs:
 
   scan-pr:
     if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@fa4ff678dd5d0a4fa3d628e57af8162873e93cd6"  # main, pending release > v2.3.8 (incl. osv-scanner-action#130)
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@a82132c0bd6c7261ffcb78e754c46c70ab57ad9a"  # main, pending release > v2.3.8 (incl. osv-scanner-action#130)
     with:
       scan-args: |-
         --config tools/osv-scanner/vulnerability-scan-config.toml

.github/workflows/release.yaml

@@ -107,7 +107,7 @@ jobs:
           } >> "$GITHUB_ENV"
 
       - name: Login to DockerHub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
@@ -159,7 +159,7 @@ jobs:
 
       - name: Upload Release Manifests
         if: ${{ !contains(github.ref, '-rc.0') }}
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
         with:
           files: |
             release-artifacts/install.yaml

.github/workflows/scorecard.yml

@@ -40,6 +40,6 @@ jobs:
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
+      uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v3.29.5
       with:
         sarif_file: results.sarif

.github/workflows/stale.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
     - name: Prune Stale
-      uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899  # v10.3.0
+      uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629  # v10.4.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         days-before-pr-stale: 30

SECURITY.md

@@ -1,39 +1,55 @@
 # Security Policy
 
-## Reporting a Vulnerability or a Crash
+## Reporting a Vulnerability or Crash
 
-We take security seriously and appreciate your help in identifying and responsibly disclosing vulnerabilities to protect our users.
+Please report suspected vulnerabilities privately.
 
 To report a security issue:
 
 1. **Do not open a public issue** on the GitHub repository to disclose a vulnerability.
 2. Send an email to our security team at [envoy-gateway-security@googlegroups.com](mailto:envoy-gateway-security@googlegroups.com).
 3. Include the following details in your email:
-    - A detailed description of the vulnerability.
-    - Steps to reproduce the issue.
-    - Potential impact of the vulnerability.
-    - Any suggested remediation or patches (if applicable).
+    - Description of the vulnerability.
+    - Steps to reproduce it.
+    - Potential impact.
+    - Suggested fixes or patches, if any.
 
-We aim to respond to vulnerability reports within **48 hours** and will work with you to validate and address the issue. 
-Once a resolution is identified, we will coordinate a release timeline with you and provide credit if applicable (with your consent).
+We aim to respond within **3 business days**. If the issue is confirmed, we will coordinate the release timeline with you and credit you if applicable and with your consent.
 
-## Security Updates
+## Vulnerability Review and Fix Process
 
-Security patches are announced through:
+The Envoy Gateway security team at [envoy-gateway-security@googlegroups.com](mailto:envoy-gateway-security@googlegroups.com) reviews reports privately. The team checks scope, validates the issue, asks for details when needed, and identifies affected versions and impact.
 
+After initial validation, accepted vulnerabilities are tracked in a draft GitHub Security Advisory. The advisory tracks affected versions, severity, CVSS assessment, credits, fix status, and disclosure plan. The team evaluates vulnerabilities against the [Envoy Gateway threat model](https://gateway.envoyproxy.io/latest/tasks/security/threat-model/). Severity guides urgency, disclosure planning, and whether the fix needs a coordinated patch release. When appropriate, the team requests or attaches a CVE before public disclosure.
+
+The team assigns fixes to security team members or Envoy Gateway maintainers with the right expertise. Fixes for accepted, undisclosed vulnerabilities are developed privately until coordinated disclosure, using a GitHub Security Advisory temporary private fork when appropriate, and coordinated with release managers for affected active branches. Accepted privately disclosed vulnerabilities are fixed in supported, non-EOL release branches or publicly disclosed within **90 days**. In exceptional circumstances, the team may coordinate an extension with the reporter.
+
+Once fixes are ready for supported versions, we publish the advisory and announce the patched releases through the channels below.
+
+## Public Vulnerability Disclosure
+
+The Envoy Gateway security team and release managers coordinate public disclosure for affected release branches.
+
+Publicly disclosed vulnerabilities are handled urgently. If the issue affects a supported release, the team publishes patched releases unless the issue does not affect production usage or can be safely handled through the normal release process.
+
+We announce advisories and patched releases through:
+
+- [GitHub Security Advisories](https://github.com/envoyproxy/gateway/security/advisories)
 - The [GitHub Releases page](https://github.com/envoyproxy/gateway/releases)
+- The `#gateway-users` channel in the [Envoy Slack workspace](https://communityinviter.com/apps/envoyproxy/envoy)
+- The [envoy-gateway-announce mailing list](https://groups.google.com/g/envoy-gateway-announce)
 
-To stay up-to-date with the latest security updates, we recommend subscribing to these channels.
+Security fixes are merged into active, non-EOL release branches as patch releases when the affected versions are still supported. See the [release matrix](https://gateway.envoyproxy.io/news/releases/matrix/) for support windows and the [patch release process](https://gateway.envoyproxy.io/community/releasing/#patch-release) for release mechanics.
+
+Subscribe to these channels for security updates.
 
 ## Best Practices for Secure Usage
 
-To minimize security risks when using Envoy Gateway:
+To reduce risk:
 
 - Use the latest supported version of Envoy Gateway.
 - Regularly monitor for updates and apply patches promptly.
 
 ## Contact
 
-If you have any questions about this security policy, please contact us at [envoy-gateway-security@googlegroups.com](mailto:envoy-gateway-security@googlegroups.com).
-
-Thank you for helping us ensure the security of Envoy Gateway!
+Questions? Email [envoy-gateway-security@googlegroups.com](mailto:envoy-gateway-security@googlegroups.com).

api/v1alpha1/authorization_types.go

@@ -30,6 +30,8 @@ type Authorization struct {
 }
 
 // AuthorizationRule defines a single authorization rule.
+//
+// +kubebuilder:validation:XValidation:rule="has(self.principal) || has(self.cel)",message="at least one of principal or cel must be specified"
 type AuthorizationRule struct {
 	// Name is a user-friendly name for the rule.
 	// If not specified, Envoy Gateway will generate a unique name for the rule.
@@ -52,9 +54,45 @@ type AuthorizationRule struct {
 	// If there are multiple principal types, all principals must match for the rule to match.
 	// For example, if there are two principals: one for client IP and one for JWT claim,
 	// the rule will match only if both the client IP and the JWT claim match.
-	Principal Principal `json:"principal"`
+	//
+	// +optional
+	Principal *Principal `json:"principal,omitempty"`
+
+	// CEL specifies a Common Expression Language expression to evaluate for the
+	// request. If specified, the expression must evaluate to true for the rule to match.
+	//
+	// The expression can use Envoy attributes exposed to the CEL runtime.
+	// Request attributes, such as request.path, request.url_path, request.host,
+	// request.scheme, request.method, request.headers, and request.query, are
+	// generally available during authorization. Connection attributes, such as
+	// source.address, source.port, destination.address, destination.port,
+	// connection.mtls, and connection.requested_server_name, may also be used.
+	// Dynamic metadata and filter state produced by earlier filters may also be
+	// available through attributes such as metadata and filter_state.
+	// Response attributes are only available after the request completes and
+	// should not be used for authorization decisions.
+	//
+	// For more details, see:
+	// https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/advanced/attributes
+	//
+	// The rule matches only when the expression evaluates to a boolean true.
+	// Non-boolean results, false, null, and CEL evaluation errors are treated as
+	// no match.
+	//
+	// Examples:
+	// `request.headers['x-tenant'] == 'team-a'`
+	// `request.method == 'POST' && request.path.startsWith('/admin')`
+	//
+	// +optional
+	CEL *CELExpression `json:"cel,omitempty"`
 }
 
+// CELExpression specifies a CEL expression.
+//
+// +kubebuilder:validation:MinLength=1
+// +kubebuilder:validation:MaxLength=4096
+type CELExpression string
+
 // Operation specifies the operation of a request.
 //
 // +kubebuilder:validation:XValidation:rule="has(self.methods) || has(self.path)",message="at least one of methods or path must be specified"
@@ -126,7 +164,8 @@ type Principal struct {
 	//
 	// If multiple entries are specified,  one of the ClientIPGeoLocation entries must match for the rule to match.
 	//
-	// The client IP is inferred from the X-Forwarded-For header or a custom header.
+	// The client IP is inferred from the X-Forwarded-For header, a custom header, or the
+	// direct downstream connection source address (the TCP peer of the connection terminated by Envoy).
 	// You can use the `ClientIPDetection` field in the `ClientTrafficPolicy` to configure the client IP detection.
 	//
 	// +optional