Skip to content

Commit d897c15

Browse files
jukiejukie
authored
Merge branch 'main' into feat-bandwidth
Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>
2 parents edfe2d2 + 6b8ac52 commit d897c15

12 files changed

Lines changed: 1410 additions & 41 deletions

File tree

‎charts/gateway-helm/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,9 @@ helm uninstall eg -n envoy-gateway-system
113113
| global.images.envoyGateway.image | string | `nil` | |
114114
| global.images.envoyGateway.pullPolicy | string | `nil` | |
115115
| global.images.envoyGateway.pullSecrets | list | `[]` | |
116+
| global.images.envoyProxy.image | string | `""` | |
117+
| global.images.envoyProxy.pullPolicy | string | `""` | |
118+
| global.images.envoyProxy.pullSecrets | list | `[]` | |
116119
| global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:master"` | |
117120
| global.images.ratelimit.pullPolicy | string | `"IfNotPresent"` | |
118121
| global.images.ratelimit.pullSecrets | list | `[]` | |

‎charts/gateway-helm/templates/_helpers.tpl‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,11 +158,61 @@ imagePullSecrets: {{ toYaml list }}
158158
{{- end }}
159159
{{- end }}
160160

161+
{{/*
162+
Resolve the Envoy Proxy image.
163+
*/}}
164+
{{- define "eg.envoyProxy.image" -}}
165+
{{- $imageParts := splitn "/" 2 .Values.global.images.envoyProxy.image -}}
166+
{{/* if global.imageRegistry is defined, it takes precedence always */}}
167+
{{- $registryName := default $imageParts._0 .Values.global.imageRegistry -}}
168+
{{- $repositoryTag := $imageParts._1 -}}
169+
{{- $repositoryParts := splitn ":" 2 $repositoryTag -}}
170+
{{- $repositoryName := $repositoryParts._0 -}}
171+
{{- $imageTag := default "distroless-dev" $repositoryParts._1 -}}
172+
{{- printf "%s/%s:%s" $registryName $repositoryName $imageTag -}}
173+
{{- end -}}
174+
175+
{{/*
176+
Resolve the Envoy Proxy image pull secrets.
177+
*/}}
178+
{{- define "eg.envoyProxy.image.pullSecrets" -}}
179+
{{- if .Values.global.imagePullSecrets }}
180+
imagePullSecrets:
181+
{{ toYaml .Values.global.imagePullSecrets }}
182+
{{- else if .Values.global.images.envoyProxy.pullSecrets -}}
183+
imagePullSecrets:
184+
{{ toYaml .Values.global.images.envoyProxy.pullSecrets }}
185+
{{- else }}
186+
imagePullSecrets: {{ toYaml list }}
187+
{{- end }}
188+
{{- end }}
161189

162190
{{/*
163191
The default Envoy Gateway configuration.
164192
*/}}
165193
{{- define "eg.default-envoy-gateway-config" -}}
194+
{{- if or .Values.global.images.envoyProxy.image .Values.config.envoyGateway.envoyProxy }}
195+
{{- $envoyProxyBase := .Values.config.envoyGateway.envoyProxy | default dict }}
196+
{{- $imageOverride := dict }}
197+
{{- if .Values.global.images.envoyProxy.image }}
198+
{{- $container := dict "image" (include "eg.envoyProxy.image" .) }}
199+
{{- if .Values.global.images.envoyProxy.pullPolicy }}
200+
{{- $_ := set $container "imagePullPolicy" .Values.global.images.envoyProxy.pullPolicy }}
201+
{{- end }}
202+
{{- $deployment := dict "container" $container }}
203+
{{- if or .Values.global.imagePullSecrets .Values.global.images.envoyProxy.pullSecrets }}
204+
{{- $pullSecretsYaml := include "eg.envoyProxy.image.pullSecrets" . }}
205+
{{- $pullSecrets := dict "imagePullSecrets" ($pullSecretsYaml | fromYaml).imagePullSecrets }}
206+
{{- $_ := set $deployment "pod" $pullSecrets }}
207+
{{- end }}
208+
{{- $kubernetes := dict "envoyDeployment" $deployment }}
209+
{{- $provider := dict "type" "Kubernetes" "kubernetes" $kubernetes }}
210+
{{- $imageOverride = dict "provider" $provider }}
211+
{{- end }}
212+
{{- $merged := mustMergeOverwrite (dict) $envoyProxyBase $imageOverride }}
213+
envoyProxy:
214+
{{ toYaml $merged | indent 2 }}
215+
{{- end }}
166216
provider:
167217
type: Kubernetes
168218
kubernetes:

‎charts/gateway-helm/values.tmpl.yaml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Global settings
22
global:
3-
# If set, these take highest precedence and change both envoyGateway and ratelimit's container registry and pull secrets.
3+
# If set, these take highest precedence and change envoyGateway, envoyProxy, and ratelimit's container registry and pull secrets.
44
# -- Global override for image registry
55
imageRegistry: ""
66
# -- Global override for image pull secrets
@@ -25,6 +25,15 @@ global:
2525
pullPolicy: IfNotPresent
2626
# List of secrets in the same namespace of the component that can be used to pull images from private repositories.
2727
pullSecrets: []
28+
envoyProxy:
29+
# This is the full image name including the hub, repo, and tag for the Envoy Proxy data plane.
30+
# If not specified, uses the default image built into envoy-gateway.
31+
image: ""
32+
# Specify image pull policy if default behavior isn't desired.
33+
# Default behavior: IfNotPresent.
34+
pullPolicy: ""
35+
# List of secrets in the same namespace of the component that can be used to pull images from private repositories.
36+
pullSecrets: []
2837

2938
# -- Labels to apply to all resources
3039
commonLabels: {}

‎release-notes/current.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ new features: |
4848
Added support for sending Envoy Gateway route metadata to external authorization backends via `SecurityPolicy.spec.extAuth.includeRouteMetadata`.
4949
Added support for path override in ExtAuth HTTP service.
5050
Added support for bandwidth limit.
51+
Added support for defining Envoy Proxy image, pullPolicy, and pullSecrets via the helm chart. Note that to merge these helm-configured values with EnvoyProxy resources, the EnvoyProxy must include `mergeType: StrategicMerge` or `mergeType: JSONMerge`.
5152
5253
bug fixes: |
5354
Fixed local rate limit rules with identical sourceCIDR client selectors producing conflicting descriptors.

‎release-notes/v1.6.7.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
date: April 27, 2026
2+
3+
# Changes that are expected to cause an incompatibility with previous versions, such as deletions or modifications to existing APIs.
4+
breaking changes: |
5+
6+
# Updates addressing vulnerabilities, security flaws, or compliance requirements.
7+
security updates: |
8+
Bumped `google.golang.org/grpc` to v1.79.3 to address CVE-2026-33186 (Critical, gRPC-Go authorization bypass via non-canonical HTTP/2 `:path` header).
9+
Bumped `go.opentelemetry.io/otel/sdk` to v1.40.0 to address CVE-2026-24051 (High, OpenTelemetry Go SDK path hijacking on macOS/Darwin).
10+
11+
# New features or capabilities added in this release.
12+
new features: |
13+
14+
bug fixes: |
15+
Fixed a control plane panic caused by concurrent Status mutation racing with the watchable Map coalesce goroutine.
16+
Fixed status conditions not being updated when a route is rejected due to multiple errors.
17+
Fixed unresolved or unsupported HTTPRoute filters using `BackendNotFound` as the `ResolvedRefs` reason; they now correctly use `UnsupportedValue`.
18+
Fixed benchmark JSON report emitting `0` for p99 and p999 percentiles by using the nearest Nighthawk histogram percentiles.
19+
20+
# Enhancements that improve performance.
21+
performance improvements: |
22+
Introduced a translator context with preprocessed resource maps in the Gateway API translator, reducing translation time by up to ~45% on large workloads.
23+
24+
# Deprecated features or APIs.
25+
deprecations: |
26+
27+
# Other notable changes not covered by the above sections.
28+
Other changes: |

‎site/content/en/latest/install/gateway-helm-api.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,9 @@ The Helm chart for Envoy Gateway
7777
| global.images.envoyGateway.image | string | `nil` | |
7878
| global.images.envoyGateway.pullPolicy | string | `nil` | |
7979
| global.images.envoyGateway.pullSecrets | list | `[]` | |
80+
| global.images.envoyProxy.image | string | `""` | |
81+
| global.images.envoyProxy.pullPolicy | string | `""` | |
82+
| global.images.envoyProxy.pullSecrets | list | `[]` | |
8083
| global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:master"` | |
8184
| global.images.ratelimit.pullPolicy | string | `"IfNotPresent"` | |
8285
| global.images.ratelimit.pullSecrets | list | `[]` | |

‎site/content/en/news/releases/notes/v1.6.7.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
title: "v1.6.7"
3+
publishdate: 2026-04-27
4+
---
5+
6+
Date: April 27, 2026
7+
8+
## Breaking changes
9+
-
10+
11+
## Security updates
12+
- Bumped `google.golang.org/grpc` to v1.79.3 to address [CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) (Critical, gRPC-Go authorization bypass via non-canonical HTTP/2 `:path` header).
13+
- Bumped `go.opentelemetry.io/otel/sdk` to v1.40.0 to address [CVE-2026-24051](https://nvd.nist.gov/vuln/detail/CVE-2026-24051) (High, OpenTelemetry Go SDK path hijacking on macOS/Darwin).
14+
15+
## New features
16+
-
17+
18+
## Bug fixes
19+
- Fixed a control plane panic caused by concurrent Status mutation racing with the watchable Map coalesce goroutine.
20+
- Fixed status conditions not being updated when a route is rejected due to multiple errors.
21+
- Fixed unresolved or unsupported HTTPRoute filters using `BackendNotFound` as the `ResolvedRefs` reason; they now correctly use `UnsupportedValue`.
22+
- Fixed benchmark JSON report emitting `0` for p99 and p999 percentiles by using the nearest Nighthawk histogram percentiles.
23+
24+
## Performance improvements
25+
- Introduced a translator context with preprocessed resource maps in the Gateway API translator, reducing translation time by up to ~45% on large workloads.
26+
27+
## Deprecations
28+
-
29+
30+
## Other changes
31+
-

‎site/static/js/benchmark-dashboard.js‎

Lines changed: 40 additions & 40 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎site/tools/benchmark-dashboard/src/data/index.ts‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,11 @@ import { benchmarkData as v166TestSuite } from './versions/v1.6.6';
4646

4747
import { benchmarkData as v172TestSuite } from './versions/v1.7.2';
4848

49+
import { benchmarkData as v167TestSuite } from './versions/v1.6.7';
50+
4951
// Import all version data
5052
export const allTestSuites: TestSuite[] = [
53+
v167TestSuite,
5154
v172TestSuite,
5255
v166TestSuite,
5356
v171TestSuite,

0 commit comments

Comments
 (0)