Merge branch 'main' into feat/startup-probe-gtw

Author: cleman95

.github/dependabot.yml

@@ -118,6 +118,8 @@ updates:
       - dependency-name: "github.com/envoyproxy/go-control-plane*"
       # Ignore all k8s.io packages on release branches to avoid unintended k8s version bumps
       - dependency-name: "k8s.io/*"
+      # Ignore sigs.k8s.io/gateway-api on release branches to avoid unintended Gateway API version bumps
+      - dependency-name: "sigs.k8s.io/gateway-api"
     groups:
       gomod:
         patterns:
@@ -169,6 +171,8 @@ updates:
       - dependency-name: "github.com/envoyproxy/go-control-plane*"
       # Ignore all k8s.io packages on release branches to avoid unintended k8s version bumps
       - dependency-name: "k8s.io/*"
+      # Ignore sigs.k8s.io/gateway-api on release branches to avoid unintended Gateway API version bumps
+      - dependency-name: "sigs.k8s.io/gateway-api"
     groups:
       gomod:
         patterns:

api/v1alpha1/authorization_types.go

@@ -30,6 +30,8 @@ type Authorization struct {
 }
 
 // AuthorizationRule defines a single authorization rule.
+//
+// +kubebuilder:validation:XValidation:rule="has(self.principal) || has(self.cel)",message="at least one of principal or cel must be specified"
 type AuthorizationRule struct {
 	// Name is a user-friendly name for the rule.
 	// If not specified, Envoy Gateway will generate a unique name for the rule.
@@ -52,9 +54,45 @@ type AuthorizationRule struct {
 	// If there are multiple principal types, all principals must match for the rule to match.
 	// For example, if there are two principals: one for client IP and one for JWT claim,
 	// the rule will match only if both the client IP and the JWT claim match.
-	Principal Principal `json:"principal"`
+	//
+	// +optional
+	Principal *Principal `json:"principal,omitempty"`
+
+	// CEL specifies a Common Expression Language expression to evaluate for the
+	// request. If specified, the expression must evaluate to true for the rule to match.
+	//
+	// The expression can use Envoy attributes exposed to the CEL runtime.
+	// Request attributes, such as request.path, request.url_path, request.host,
+	// request.scheme, request.method, request.headers, and request.query, are
+	// generally available during authorization. Connection attributes, such as
+	// source.address, source.port, destination.address, destination.port,
+	// connection.mtls, and connection.requested_server_name, may also be used.
+	// Dynamic metadata and filter state produced by earlier filters may also be
+	// available through attributes such as metadata and filter_state.
+	// Response attributes are only available after the request completes and
+	// should not be used for authorization decisions.
+	//
+	// For more details, see:
+	// https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/advanced/attributes
+	//
+	// The rule matches only when the expression evaluates to a boolean true.
+	// Non-boolean results, false, null, and CEL evaluation errors are treated as
+	// no match.
+	//
+	// Examples:
+	// `request.headers['x-tenant'] == 'team-a'`
+	// `request.method == 'POST' && request.path.startsWith('/admin')`
+	//
+	// +optional
+	CEL *CELExpression `json:"cel,omitempty"`
 }
 
+// CELExpression specifies a CEL expression.
+//
+// +kubebuilder:validation:MinLength=1
+// +kubebuilder:validation:MaxLength=4096
+type CELExpression string
+
 // Operation specifies the operation of a request.
 //
 // +kubebuilder:validation:XValidation:rule="has(self.methods) || has(self.path)",message="at least one of methods or path must be specified"

api/v1alpha1/envoygateway_helpers.go

@@ -110,6 +110,7 @@ func (e *EnvoyGateway) GatewayNamespaceMode() bool {
 	return e.Provider != nil &&
 		e.Provider.Kubernetes != nil &&
 		e.Provider.Kubernetes.Deploy != nil &&
+		e.Provider.Kubernetes.Deploy.Type != nil &&
 		*e.Provider.Kubernetes.Deploy.Type == KubernetesDeployModeTypeGatewayNamespace
 }
 

api/v1alpha1/ratelimit_types.go

@@ -433,12 +433,16 @@ type PathMatch struct {
 
 // RateLimitValue defines the limits for rate limiting.
 type RateLimitValue struct {
+	// Requests intentionally sets Format=int64. Controller-gen renders uint32 as
+	// format int32, whose range is below Maximum=4294967295 and would be rejected
+	// in Kubernetes 1.36+
+
 	// Requests is the number of requests (or cost units, when used with
 	// cost-based rate limiting) allowed per Unit.
 	//
 	// +kubebuilder:validation:Minimum=1
 	// +kubebuilder:validation:Maximum=4294967295
-	// +kubebuilder:validation:Format=uint32
+	// +kubebuilder:validation:Format=int64
 	Requests uint32        `json:"requests"`
 	Unit     RateLimitUnit `json:"unit"`
 	// FromMetadata sources the limit value from per-request dynamic metadata.

api/v1alpha1/securitypolicy_types.go

@@ -49,7 +49,7 @@ type SecurityPolicy struct {
 // +kubebuilder:validation:XValidation:rule="has(self.targetRef) ? self.targetRef.kind in ['Gateway', 'HTTPRoute', 'GRPCRoute', 'TCPRoute'] : true", message="this policy can only have a targetRef.kind of Gateway/HTTPRoute/GRPCRoute/TCPRoute"
 // +kubebuilder:validation:XValidation:rule="has(self.targetRefs) ? self.targetRefs.all(ref, ref.group == 'gateway.networking.k8s.io') : true ", message="this policy can only have a targetRefs[*].group of gateway.networking.k8s.io"
 // +kubebuilder:validation:XValidation:rule="has(self.targetRefs) ? self.targetRefs.all(ref, ref.kind in ['Gateway', 'HTTPRoute', 'GRPCRoute', 'TCPRoute']) : true ", message="this policy can only have a targetRefs[*].kind of Gateway/HTTPRoute/GRPCRoute/TCPRoute"
-// +kubebuilder:validation:XValidation:rule="(has(self.authorization) && has(self.authorization.rules) && self.authorization.rules.exists(r, has(r.principal.jwt))) ? has(self.jwt) : true", message="if authorization.rules.principal.jwt is used, jwt must be defined"
+// +kubebuilder:validation:XValidation:rule="(has(self.authorization) && has(self.authorization.rules) && self.authorization.rules.exists(r, has(r.principal) ? has(r.principal.jwt) : false)) ? has(self.jwt) : true", message="if authorization.rules.principal.jwt is used, jwt must be defined"
 type SecurityPolicySpec struct {
 	PolicyTargetReferences `json:",inline"`
 

api/v1alpha1/zz_generated.deepcopy.go

@@ -19,6 +19,6 @@ dependencies:
   version: 1.3.1
 - name: opentelemetry-collector
   repository: https://open-telemetry.github.io/opentelemetry-helm-charts
-  version: 0.159.0
-digest: sha256:be0a00f1e10a1dc28ac0d24bc2663574c846f665566a4d36f7a6489f59ea8281
-generated: "2026-06-23T03:32:18.054105612Z"
+  version: 0.159.2
+digest: sha256:2b45964580ba403a616a6546a3f544878c757dddb72854509294fd970d2d2794
+generated: "2026-07-01T04:22:11.232246258Z"

charts/gateway-addons-helm/Chart.lock

@@ -51,5 +51,5 @@ dependencies:
     condition: tempo.enabled
   - name: opentelemetry-collector
     repository: https://open-telemetry.github.io/opentelemetry-helm-charts
-    version: 0.159.0
+    version: 0.159.2
     condition: opentelemetry-collector.enabled

charts/gateway-addons-helm/Chart.yaml

@@ -26,7 +26,7 @@ An Add-ons Helm chart for Envoy Gateway
 | https://grafana.github.io/helm-charts | grafana | 10.5.15 |
 | https://grafana.github.io/helm-charts | loki | 7.0.0 |
 | https://grafana.github.io/helm-charts | tempo | 1.3.1 |
-| https://open-telemetry.github.io/opentelemetry-helm-charts | opentelemetry-collector | 0.159.0 |
+| https://open-telemetry.github.io/opentelemetry-helm-charts | opentelemetry-collector | 0.159.2 |
 | https://prometheus-community.github.io/helm-charts | prometheus | 29.10.1 |
 
 ## Usage

charts/gateway-addons-helm/README.md

@@ -23,7 +23,7 @@ A Helm chart for Envoy Gateway CRDs
 Please refer to Helm's [documentation](https://helm.sh/docs) to get started.
 
 If you want to manage the CRDs outside of the Envoy Gateway Helm chart, you can use this chart to install the CRDs separately.
-If you do, make sure that you don't install the CRDs again when installing the Envoy Gateway Helm chart, by using `--skip-crds` flag.
+If you do, make sure that you don't install the CRDs again when installing the Envoy Gateway Helm chart, by using `--set crds.enabled=false`.
 If your Kubernetes provider already manages Gateway API CRDs for the cluster, compare the provider-installed Gateway API
 version and channel with the [Envoy Gateway compatibility matrix](https://gateway.envoyproxy.io/news/releases/matrix/)
 and the Gateway API resources you plan to use. If they are compatible, leave those CRDs disabled in this chart and