Skip to content

Commit f7306b3

Browse files
jukiewucm667claudekkk777-7zirain
authored
[release/v1.8] cherry-pick v1.8.0 (#8970)
* fix(api): increase RateLimitSelectCondition.headers MaxItems from 16 to 64 (#8906) * fix(api): increase RateLimitSelectCondition.headers MaxItems from 16 to 64 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: wucm667 <stevenwucongmin@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * feat: policy field owner (#8538) * feat: policy field owner Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * skip invalid listener first in IR (#8577) * skip invalid listener Signed-off-by: zirain <zirain2009@gmail.com> * fix specValid Signed-off-by: zirain <zirain2009@gmail.com> * nit Signed-off-by: zirain <zirain2009@gmail.com> * fix Signed-off-by: zirain <zirain2009@gmail.com> * MUST NOT pick one conflicting Listener as the winner Signed-off-by: zirain <zirain2009@gmail.com> * update Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix: remove cross ns policy attachment status (#8901) * Revert "add warning for partially accepted targets" This reverts commit 5d88fbb. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * remove warning condition for cross-ns policy attachments without referenceGrants Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * feat: add runner event metrics (#8802) * add metrics for runner Signed-off-by: zirain <zirain2009@gmail.com> * rename Signed-off-by: zirain <zirain2009@gmail.com> * rename Signed-off-by: zirain <zirain2009@gmail.com> * reuse Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com> Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix: respect backend endpoint hostname for health checks (#8929) * fix: respect backend endpoint hostname for health checks ### Summary - Keep BackendTrafficPolicy HTTP health check hostnames as explicit cluster-level hosts, and leave route-derived host fallback to xDS cluster translation. - Preserve Backend endpoint hostnames as per-endpoint overrides via Endpoint.HealthCheckConfig.hostname, ahead of the route fallback. - Update gatewayapi/xDS fixtures, release notes, and generated API docs/CRDs for the host selection order. ### Test plan - go test ./internal/ir - go test ./internal/xds/translator - go test ./internal/gatewayapi -run TestTranslate/backendtrafficpolicy - go test ./internal/gatewayapi -run TestTranslate/(clienttrafficpolicy-http-health-check|envoyextensionpolicy-with-extproc-with-retries|envoyextensionpolicy-with-extproc-with-traffic-features|envoyproxy-accesslog-with-traffic|envoyproxy-tracing-backend-uds|envoyproxy-tracing-backend|securitypolicy-with-jwt-backendcluster|securitypolicy-with-jwt-backendsettings) - make generate - make manifests - git diff --check Signed-off-by: Arko Dasgupta <arkodg@gmail.com> Co-authored-by: Codex <noreply@openai.com> * fix gen Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: Arko Dasgupta <arkodg@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> Co-authored-by: Codex <noreply@openai.com> Co-authored-by: zirain <zirain2009@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix(helm): propagate commonLabels to RBAC resources (#8818) * feat(helm): propagate commonLabels to RBAC resources Issue #8817 reported that 'helm template ... --set commonLabels.custom-label=custom-value' left ClusterRole, ClusterRoleBinding, Role, and RoleBinding resources unlabelled. The other resources in the chart already include 'eg.labels' in their metadata - which picks up 'commonLabels' via the helper at _helpers.tpl:43 - but envoy-gateway-rbac.yaml didn't set any labels block. Add 'labels: {{- include "eg.labels" . | nindent 4 }}' on every Role / RoleBinding / ClusterRole / ClusterRoleBinding declared in envoy-gateway-rbac.yaml. Matches the existing labels pattern used in certgen-rbac.yaml and envoy-gateway-deployment.yaml. Scopes are '$' inside the watched-namespaces 'range' and '.' at the template root, same rule the helper block inside the file already used. Verified locally with: helm dependency update charts/gateway-helm envsubst < charts/gateway-helm/values.tmpl.yaml > \ charts/gateway-helm/values.yaml helm template eg charts/gateway-helm \ --set commonLabels.custom-label=custom-value | yq ... All four RBAC resources now emit 'custom-label: custom-value' in their metadata.labels, matching the issue's repro steps. Cert-gen RBAC resources already carried it; this PR brings the core envoy-gateway RBAC set into parity. Fixes #8817 Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * chore: regenerate helm-template snapshots for RBAC labels Run 'make helm-template.gateway-helm' to regenerate the snapshot fixtures after the envoy-gateway-rbac.yaml labels change. Adds the 'labels:' block to the RBAC resources in all 27 test cases. Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix gen Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add release note Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix(translator): set ListenerSet and listener Accepted:True for InvalidCertificateRef (#8871) * fix(translator): set ListenerSet and listener Accepted:True for InvalidCertificateRef When a ListenerSet listener has an unresolvable TLS certificate reference (InvalidCertificateRef or RefNotPermitted), Accepted: False was incorrectly set on both the listener and ListenerSet object. The Gateway API spec places InvalidCertificateRef exclusively under ResolvedRefs, not Accepted — a missing certificate is a reference resolution concern, not a structural one. Fixes #8870 Signed-off-by: apkatsikas <apkatsikas@gmail.com> * chore: fix gofumpt formatting in validateListenerConditions Signed-off-by: apkatsikas <apkatsikas@gmail.com> * fix(translator): separate RefNotPermitted from InvalidCertificateRef handling Unlike InvalidCertificateRef, RefNotPermitted should not set Accepted:True. Update unit test fixtures to match. Signed-off-by: apkatsikas <apkatsikas@gmail.com> * fix gen Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: apkatsikas <apkatsikas@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix: do not downgrade ALPN for only hostnames-overlapping listeners (#8934) fix: do not downgrade ALPN for overlapping hostnames withoug SANs overlapping Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * feat: enableDeferredCreationStats by default (#8937) * feat: enableDeferredCreationStats by default Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix: restore last transition time in merge status conditions (#8962) * fix: restore last transition time in merge status conditions Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> * add release note Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> --------- Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * [release/v1.8] v1.8.0 release notes Cherry-picked release-notes/v1.8.0.yaml and VERSION bump from #8942. Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> --------- Signed-off-by: wucm667 <stevenwucongmin@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com> Signed-off-by: Arko Dasgupta <arkodg@gmail.com> Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Signed-off-by: apkatsikas <apkatsikas@gmail.com> Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Co-authored-by: wucm667 <109257021+wucm667@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Kota Kimura <86363983+kkk777-7@users.noreply.github.com> Co-authored-by: zirain <zirain2009@gmail.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> Co-authored-by: Codex <noreply@openai.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Andrew Katsikas <apkatsikas@gmail.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
1 parent 875c80f commit f7306b3

231 files changed

Lines changed: 4853 additions & 1764 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
v1.8.0-rc.1
1+
v1.8.0

‎api/v1alpha1/healthcheck_types.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -177,8 +177,9 @@ const (
177177

178178
// HTTPActiveHealthChecker defines the settings of http health check.
179179
type HTTPActiveHealthChecker struct {
180-
// Hostname defines the HTTP host that will be requested during health checking.
181-
// Default: HTTPRoute or GRPCRoute hostname.
180+
// Hostname defines the HTTP Host header used for active HTTP health checks.
181+
// Host selection uses this order: this field, the associated Backend endpoint
182+
// hostname if available, then the effective Route hostname.
182183
//
183184
// +kubebuilder:validation:MinLength=1
184185
// +kubebuilder:validation:MaxLength=253

‎api/v1alpha1/policy_helpers.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,10 @@ type TargetSelector struct {
5858
// When specified, the effective set of namespaces is always constrained to the
5959
// namespaces watched by Envoy Gateway.
6060
//
61+
// Selecting targets across namespaces requires a ReferenceGrant in the target
62+
// namespace that allows this policy kind to reference the selected target kind.
63+
// Cross-namespace targets without a matching ReferenceGrant are ignored.
64+
//
6165
// +optional
6266
Namespaces *TargetSelectorNamespaces `json:"namespaces,omitempty"`
6367

‎api/v1alpha1/ratelimit_types.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,7 @@ type RateLimitSelectCondition struct {
228228
// meaning, a request MUST match all the specified headers.
229229
//
230230
// +optional
231-
// +kubebuilder:validation:MaxItems=16
231+
// +kubebuilder:validation:MaxItems=64
232232
Headers []HeaderMatch `json:"headers,omitempty"`
233233

234234
// Methods is a list of request methods to match. Multiple method values are ORed together,

‎api/v1alpha1/shared_types.go‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,10 +70,6 @@ const (
7070
// PolicyReasonDeprecatedField is used with the "Warning" condition when the policy
7171
// uses deprecated fields that should be migrated to newer alternatives.
7272
PolicyReasonDeprecatedField gwapiv1.PolicyConditionReason = "DeprecatedField"
73-
74-
// PolicyReasonRefNotPermitted is used when the policy targets a cross-namespace
75-
// object without a matching ReferenceGrant.
76-
PolicyReasonRefNotPermitted gwapiv1.PolicyConditionReason = "RefNotPermitted"
7773
)
7874

7975
// GroupVersionKind unambiguously identifies a Kind.

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -671,8 +671,9 @@ spec:
671671
type: array
672672
hostname:
673673
description: |-
674-
Hostname defines the HTTP host that will be requested during health checking.
675-
Default: HTTPRoute or GRPCRoute hostname.
674+
Hostname defines the HTTP Host header used for active HTTP health checks.
675+
Host selection uses this order: this field, the associated Backend endpoint
676+
hostname if available, then the effective Route hostname.
676677
maxLength: 253
677678
minLength: 1
678679
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
@@ -1506,7 +1507,7 @@ spec:
15061507
required:
15071508
- name
15081509
type: object
1509-
maxItems: 16
1510+
maxItems: 64
15101511
type: array
15111512
methods:
15121513
description: |-
@@ -1890,7 +1891,7 @@ spec:
18901891
required:
18911892
- name
18921893
type: object
1893-
maxItems: 16
1894+
maxItems: 64
18941895
type: array
18951896
methods:
18961897
description: |-
@@ -2924,6 +2925,10 @@ spec:
29242925
29252926
When specified, the effective set of namespaces is always constrained to the
29262927
namespaces watched by Envoy Gateway.
2928+
2929+
Selecting targets across namespaces requires a ReferenceGrant in the target
2930+
namespace that allows this policy kind to reference the selected target kind.
2931+
Cross-namespace targets without a matching ReferenceGrant are ignored.
29272932
properties:
29282933
from:
29292934
default: Same

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1181,6 +1181,10 @@ spec:
11811181
11821182
When specified, the effective set of namespaces is always constrained to the
11831183
namespaces watched by Envoy Gateway.
1184+
1185+
Selecting targets across namespaces requires a ReferenceGrant in the target
1186+
namespace that allows this policy kind to reference the selected target kind.
1187+
Cross-namespace targets without a matching ReferenceGrant are ignored.
11841188
properties:
11851189
from:
11861190
default: Same

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -567,8 +567,9 @@ spec:
567567
type: array
568568
hostname:
569569
description: |-
570-
Hostname defines the HTTP host that will be requested during health checking.
571-
Default: HTTPRoute or GRPCRoute hostname.
570+
Hostname defines the HTTP Host header used for active HTTP health checks.
571+
Host selection uses this order: this field, the associated Backend endpoint
572+
hostname if available, then the effective Route hostname.
572573
maxLength: 253
573574
minLength: 1
574575
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
@@ -1824,6 +1825,10 @@ spec:
18241825
18251826
When specified, the effective set of namespaces is always constrained to the
18261827
namespaces watched by Envoy Gateway.
1828+
1829+
Selecting targets across namespaces requires a ReferenceGrant in the target
1830+
namespace that allows this policy kind to reference the selected target kind.
1831+
Cross-namespace targets without a matching ReferenceGrant are ignored.
18271832
properties:
18281833
from:
18291834
default: Same

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11837,8 +11837,9 @@ spec:
1183711837
type: array
1183811838
hostname:
1183911839
description: |-
11840-
Hostname defines the HTTP host that will be requested during health checking.
11841-
Default: HTTPRoute or GRPCRoute hostname.
11840+
Hostname defines the HTTP Host header used for active HTTP health checks.
11841+
Host selection uses this order: this field, the associated Backend endpoint
11842+
hostname if available, then the effective Route hostname.
1184211843
maxLength: 253
1184311844
minLength: 1
1184411845
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
@@ -13368,8 +13369,9 @@ spec:
1336813369
type: array
1336913370
hostname:
1337013371
description: |-
13371-
Hostname defines the HTTP host that will be requested during health checking.
13372-
Default: HTTPRoute or GRPCRoute hostname.
13372+
Hostname defines the HTTP Host header used for active HTTP health checks.
13373+
Host selection uses this order: this field, the associated Backend endpoint
13374+
hostname if available, then the effective Route hostname.
1337313375
maxLength: 253
1337413376
minLength: 1
1337513377
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
@@ -15086,8 +15088,9 @@ spec:
1508615088
type: array
1508715089
hostname:
1508815090
description: |-
15089-
Hostname defines the HTTP host that will be requested during health checking.
15090-
Default: HTTPRoute or GRPCRoute hostname.
15091+
Hostname defines the HTTP Host header used for active HTTP health checks.
15092+
Host selection uses this order: this field, the associated Backend endpoint
15093+
hostname if available, then the effective Route hostname.
1509115094
maxLength: 253
1509215095
minLength: 1
1509315096
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
@@ -16694,8 +16697,9 @@ spec:
1669416697
type: array
1669516698
hostname:
1669616699
description: |-
16697-
Hostname defines the HTTP host that will be requested during health checking.
16698-
Default: HTTPRoute or GRPCRoute hostname.
16700+
Hostname defines the HTTP Host header used for active HTTP health checks.
16701+
Host selection uses this order: this field, the associated Backend endpoint
16702+
hostname if available, then the effective Route hostname.
1669916703
maxLength: 253
1670016704
minLength: 1
1670116705
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1194,8 +1194,9 @@ spec:
11941194
type: array
11951195
hostname:
11961196
description: |-
1197-
Hostname defines the HTTP host that will be requested during health checking.
1198-
Default: HTTPRoute or GRPCRoute hostname.
1197+
Hostname defines the HTTP Host header used for active HTTP health checks.
1198+
Host selection uses this order: this field, the associated Backend endpoint
1199+
hostname if available, then the effective Route hostname.
11991200
maxLength: 253
12001201
minLength: 1
12011202
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
@@ -2597,8 +2598,9 @@ spec:
25972598
type: array
25982599
hostname:
25992600
description: |-
2600-
Hostname defines the HTTP host that will be requested during health checking.
2601-
Default: HTTPRoute or GRPCRoute hostname.
2601+
Hostname defines the HTTP Host header used for active HTTP health checks.
2602+
Host selection uses this order: this field, the associated Backend endpoint
2603+
hostname if available, then the effective Route hostname.
26022604
maxLength: 253
26032605
minLength: 1
26042606
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
@@ -4279,8 +4281,9 @@ spec:
42794281
type: array
42804282
hostname:
42814283
description: |-
4282-
Hostname defines the HTTP host that will be requested during health checking.
4283-
Default: HTTPRoute or GRPCRoute hostname.
4284+
Hostname defines the HTTP Host header used for active HTTP health checks.
4285+
Host selection uses this order: this field, the associated Backend endpoint
4286+
hostname if available, then the effective Route hostname.
42844287
maxLength: 253
42854288
minLength: 1
42864289
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
@@ -5993,8 +5996,9 @@ spec:
59935996
type: array
59945997
hostname:
59955998
description: |-
5996-
Hostname defines the HTTP host that will be requested during health checking.
5997-
Default: HTTPRoute or GRPCRoute hostname.
5999+
Hostname defines the HTTP Host header used for active HTTP health checks.
6000+
Host selection uses this order: this field, the associated Backend endpoint
6001+
hostname if available, then the effective Route hostname.
59986002
maxLength: 253
59996003
minLength: 1
60006004
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
@@ -7142,6 +7146,10 @@ spec:
71427146
71437147
When specified, the effective set of namespaces is always constrained to the
71447148
namespaces watched by Envoy Gateway.
7149+
7150+
Selecting targets across namespaces requires a ReferenceGrant in the target
7151+
namespace that allows this policy kind to reference the selected target kind.
7152+
Cross-namespace targets without a matching ReferenceGrant are ignored.
71457153
properties:
71467154
from:
71477155
default: Same

0 commit comments

Comments
 (0)