Skip to content

Sync release/v1.8 with main - #8896

Closed
jukie wants to merge 168 commits into
release/v1.8from
main
Closed

Sync release/v1.8 with main#8896
jukie wants to merge 168 commits into
release/v1.8from
main

Conversation

@jukie

@jukie jukie commented Apr 30, 2026

Copy link
Copy Markdown
Contributor

This was created during rc.0 but wasn't actually used yet

zirain and others added 30 commits March 22, 2026 12:15
… host (#8565)

* fix: per-endpoint hostname override blocked by auto-generated wildcard host

Signed-off-by: zirain <zirain2009@gmail.com>

* add UT

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
Implement issue #4280 ClientValidationModeType to effectively be able to use trust_chain_verification ACCEPT_UNTRUSTED

Signed-off-by: Julien Spadoni <julien@beezeelinx.com>
…ty routes (#8521)

* fix(tcp): add SNI-based filter chain matching for TLS passthrough empty routes

This fix addresses the issue where multiple TLS passthrough listeners on the
same port without routes would generate duplicate empty filter chains without
unique matching rules, causing Envoy to reject the configuration with:
"filter chain 'EmptyCluster' has the same matching rules defined as 'EmptyCluster'"

Changes:
- Add Hostnames field to TCPListener IR to capture SNI values from Gateway API
- Populate hostnames from Gateway API listener.Hostname for TLS protocol
- Detect TLS passthrough by presence of hostnames (SNI matching required)
- Create unique EmptyCluster per TLS passthrough listener with SNI-based matching
- Add TLSInspectorConfig with SNIs to enable filterChainMatch generation
- Add test coverage for multiple TLS passthrough listeners without routes

This ensures each TLS passthrough listener gets a unique filter chain with
serverNames matching, allowing Envoy to properly route based on SNI.

Builds on work from #7912 by @Aditya7880900936 which addressed the unique
cluster naming issue. This PR extends it to properly implement SNI-based
filter chain matching as noted in the review comments by @sudiptob2.

Fixes #7912

Signed-off-by: Oliver Bailey <github@obailey.co.uk>
Signed-off-by: zirain <zirain2009@gmail.com>
* update API

Signed-off-by: zirain <zirain2009@gmail.com>

* impl

Signed-off-by: zirain <zirain2009@gmail.com>

* translator test

Signed-off-by: zirain <zirain2009@gmail.com>

* add e2e

Signed-off-by: zirain <zirain2009@gmail.com>

* release notes

Signed-off-by: zirain <zirain2009@gmail.com>

* fix gen

Signed-off-by: zirain <zirain2009@gmail.com>

* address review comments

Signed-off-by: zirain <zirain2009@gmail.com>

* fix

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
* chore: refactor JSONPatch

Signed-off-by: zirain <zirain2009@gmail.com>

* fix

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
* docs: avoid "authentication"

Signed-off-by: Kazuhiro Sakurayama <haruyama480@gmail.com>

* apply to v1.6 and v1.7

% git diff HEAD~ HEAD site/content/en/latest/tasks/security/ext-auth.md > diff.patch
% patch site/content/en/v1.6/tasks/security/ext-auth.md < diff.patch
patching file 'site/content/en/v1.6/tasks/security/ext-auth.md'
% patch site/content/en/v1.7/tasks/security/ext-auth.md < diff.patch
patching file 'site/content/en/v1.7/tasks/security/ext-auth.md'

Signed-off-by: Kazuhiro Sakurayama <haruyama480@gmail.com>

---------

Signed-off-by: Kazuhiro Sakurayama <haruyama480@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>
…obin (#7407)

* Add support for ClientSideWeightedRoundRobin load balancer policy in Gateway CRDs, ensuring configurable parameters and validation rules are integrated. Includes e2e test for validation.

Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>

* Adds / Updates test cases for client wrr

Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>

* Fix: gen-check ci, coverage-check

Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>

* Remove `enableOOBLoadReport` and `oobReportingPeriod` fields from gateway CRDs and related configurations. Update associated test data and documentation.

Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>

* Remove `enableOOBLoadReport` and `oobReportingPeriod` fields from ClientSideWeightedRoundRobin configuration, update affected tests and CRDs.

Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>

* Update: Change `ErrorUtilizationPenalty` type from float to integer across Gateway CRDs, configuration files, and related tests. Adjust documentation to reflect percentage-based representation.

Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>

* Update: Refactor `ErrorUtilizationPenalty` to use integer type with percentage-based representation in Gateway CRDs, configurations, and tests. Adjust related documentation and ensure backward compatibility.

Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>

* Refactor: Replace `ptr.To(metav1.Duration)` with `ir.MetaV1DurationPtr` across gateway configurations and tests for cleaner and consistent duration handling. Remove unused `metav1` imports where applicable.

Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>

* Update: Add support for SlowStart configuration for ClientSideWeightedRoundRobin load balancer in Gateway CRDs, configurations, and tests. Adjust validation rules and documentation accordingly.

Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>

* Update: Replace `ClientSideWeightedRoundRobin` load balancer type with `BackendUtilization` in Gateway CRDs, configurations, and tests. Revise validation rules, documentation, and enums accordingly.

Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>

* Update: Replace `ClientSideWeightedRoundRobin` references with `BackendUtilization` in load balancing tests and documentation.

Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>

* Update: Replace `lb-backend-bu` references with `lb-backend-utilization` across tests, configurations, and load balancing policies for consistency.

Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>

* Remove: Delete obsolete BackendUtilization OOB and penalty load balancing tests.

Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>

* Update: Add detailed documentation and configuration examples for Backend Utilization (ORCA) load balancing in Gateway CRDs and related docs. Refine header handling and metric formats.

Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>

* Update: Rename `ErrorUtilizationPenalty` to `ErrorUtilizationPenaltyPercent` across API, tests, and internal logic for clarity and precision. Adjust related documentation and validations.

Signed-off-by: anurag.ag <6075379+altaiezior@users.noreply.github.com>

* Update: Add support for `removeResponseHeaders` in `BackendUtilization`. Adjust logic, tests, and documentation to highlight default value and ORCA header removal.

Signed-off-by: anurag.ag <6075379+altaiezior@users.noreply.github.com>

* Update: Replace `removeResponseHeaders` with `keepResponseHeaders` across API, internal logic, and templates. Adjust defaults, documentation, and validations to reflect behavior change.

Signed-off-by: anurag.ag <6075379+altaiezior@users.noreply.github.com>

* Refactor: Reorganize import order in `cluster_test.go` for consistency.

Signed-off-by: anurag.ag <6075379+altaiezior@users.noreply.github.com>

* Update: Fix formatting and alignment in `load_balancing.go` and `loadbalancer_types.go` for consistency.

Signed-off-by: altaiezior <6075379+altaiezior@users.noreply.github.com>

* Update: Add validation to disallow ZoneAware routing for BackendUtilization load balancers. Adjust tests to reflect the new validation rule.

Signed-off-by: altaiezior <6075379+altaiezior@users.noreply.github.com>

* Update: Add error handling for invalid duration values in `BackendUtilization` fields (`BlackoutPeriod`, `WeightExpirationPeriod`, `WeightUpdatePeriod`).

Signed-off-by: altaiezior <6075379+altaiezior@users.noreply.github.com>

* Refactor: Simplify nil check and assignment logic in `BackendUtilization` handling within cluster translator.

Signed-off-by: altaiezior <6075379+altaiezior@users.noreply.github.com>

* Update: Add support for BackendUtilization load balancing policy in BackendTrafficPolicy.

Signed-off-by: altaiezior <6075379+altaiezior@users.noreply.github.com>

---------

Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>
Signed-off-by: anurag.ag <6075379+altaiezior@users.noreply.github.com>
Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Signed-off-by: altaiezior <6075379+altaiezior@users.noreply.github.com>
Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>
Co-authored-by: anurag.ag <anuragagarwal561994@users.noreply.github.com>
Co-authored-by: Isaac <10012479+jukie@users.noreply.github.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
…s-helm in the helm group across 1 directory (#8550)

* build(deps): bump loki

Bumps the helm group with 1 update in the /charts/gateway-addons-helm directory: loki.


Updates `loki` from 6.54.0 to 6.55.0

---
updated-dependencies:
- dependency-name: loki
  dependency-version: 6.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: helm
...

Signed-off-by: dependabot[bot] <support@github.com>

* gen-check

Signed-off-by: jukie <10012479+Jukie@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: jukie <10012479+Jukie@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: jukie <10012479+Jukie@users.noreply.github.com>
* fix bug with grpcroute mirror filter

Signed-off-by: Adam Buran <aburan@roblox.com>

* add indexers test

Signed-off-by: Adam Buran <aburan@roblox.com>

* add release note

Signed-off-by: Adam Buran <aburan@roblox.com>

---------

Signed-off-by: Adam Buran <aburan@roblox.com>
Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Fixes #8554

Signed-off-by: stekole <stefan@sandnetworks.com>
Signed-off-by: stekole <30674956+stekole@users.noreply.github.com>
…#8548)

* build(deps): bump the gomod group across 5 directories with 6 updates

Bumps the gomod group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/go-openapi/strfmt](https://github.com/go-openapi/strfmt) | `0.26.0` | `0.26.1` |
| [github.com/ohler55/ojg](https://github.com/ohler55/ojg) | `1.28.0` | `1.28.1` |
| [github.com/replicatedhq/troubleshoot](https://github.com/replicatedhq/troubleshoot) | `0.123.18` | `0.125.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.79.2` | `1.79.3` |
| [helm.sh/helm/v3](https://github.com/helm/helm) | `3.20.0` | `3.20.1` |

Bumps the gomod group with 1 update in the /examples/envoy-ext-auth directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go).
Bumps the gomod group with 1 update in the /examples/extension-server directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go).
Bumps the gomod group with 1 update in the /examples/grpc-ext-proc directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go).
Bumps the gomod group with 2 updates in the /examples/simple-extension-server directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go) and [github.com/envoyproxy/gateway](https://github.com/envoyproxy/gateway).


Updates `github.com/go-openapi/strfmt` from 0.26.0 to 0.26.1
- [Release notes](https://github.com/go-openapi/strfmt/releases)
- [Commits](go-openapi/strfmt@v0.26.0...v0.26.1)

Updates `github.com/ohler55/ojg` from 1.28.0 to 1.28.1
- [Release notes](https://github.com/ohler55/ojg/releases)
- [Changelog](https://github.com/ohler55/ojg/blob/develop/CHANGELOG.md)
- [Commits](ohler55/ojg@v1.28.0...v1.28.1)

Updates `github.com/replicatedhq/troubleshoot` from 0.123.18 to 0.125.0
- [Release notes](https://github.com/replicatedhq/troubleshoot/releases)
- [Commits](replicatedhq/troubleshoot@v0.123.18...v0.125.0)

Updates `google.golang.org/grpc` from 1.79.2 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.79.2...v1.79.3)

Updates `helm.sh/helm/v3` from 3.20.0 to 3.20.1
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](helm/helm@v3.20.0...v3.20.1)

Updates `google.golang.org/grpc` from 1.79.2 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.79.2...v1.79.3)

Updates `google.golang.org/grpc` from 1.79.2 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.79.2...v1.79.3)

Updates `google.golang.org/grpc` from 1.79.2 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.79.2...v1.79.3)

Updates `google.golang.org/grpc` from 1.79.2 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.79.2...v1.79.3)

Updates `github.com/envoyproxy/gateway` from 1.7.0 to 1.7.1
- [Release notes](https://github.com/envoyproxy/gateway/releases)
- [Commits](v1.7.0...v1.7.1)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/strfmt
  dependency-version: 0.26.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/ohler55/ojg
  dependency-version: 1.28.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/replicatedhq/troubleshoot
  dependency-version: 0.125.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: helm.sh/helm/v3
  dependency-version: 3.20.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/envoyproxy/gateway
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>

* Run make gen-check: commit generated changes

* tidy

Signed-off-by: jukie <10012479+Jukie@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: jukie <10012479+Jukie@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
Co-authored-by: jukie <10012479+Jukie@users.noreply.github.com>
update release schedule

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
* provider implementation

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

GeoIP implementation

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* debug ipv6 failure

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* disable geoIP test in IPv6

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix lint

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* simplify code

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* reuse direct response

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* simplify code

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: jukie <10012479+Jukie@users.noreply.github.com>
update grpc

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
…r/envoy-gateway (#8590)

build(deps): bump busybox in /tools/docker/envoy-gateway

Bumps busybox from `b3255e7` to `1487d0a`.

---
updated-dependencies:
- dependency-name: busybox
  dependency-version: 1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…8591)

* build(deps): bump the gomod group across 1 directory with 2 updates

Bumps the gomod group with 2 updates in the / directory: [github.com/fatih/color](https://github.com/fatih/color) and [github.com/replicatedhq/troubleshoot](https://github.com/replicatedhq/troubleshoot).


Updates `github.com/fatih/color` from 1.18.0 to 1.19.0
- [Release notes](https://github.com/fatih/color/releases)
- [Commits](fatih/color@v1.18.0...v1.19.0)

Updates `github.com/replicatedhq/troubleshoot` from 0.125.0 to 0.125.1
- [Release notes](https://github.com/replicatedhq/troubleshoot/releases)
- [Commits](replicatedhq/troubleshoot@v0.125.0...v0.125.1)

---
updated-dependencies:
- dependency-name: github.com/fatih/color
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/replicatedhq/troubleshoot
  dependency-version: 0.125.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix gen

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix gen

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
…8594)

* build(deps): bump the helm group across 1 directory with 3 updates

Bumps the helm group with 3 updates in the /charts/gateway-addons-helm directory: prometheus, opentelemetry-collector and otel/opentelemetry-collector-contrib.


Updates `prometheus` from 28.13.0 to 28.14.0

Updates `opentelemetry-collector` from 0.147.0 to 0.147.1

Updates `otel/opentelemetry-collector-contrib` from 0.147.0 to 0.148.0

---
updated-dependencies:
- dependency-name: prometheus
  dependency-version: 28.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: helm
- dependency-name: opentelemetry-collector
  dependency-version: 0.147.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: helm
- dependency-name: otel/opentelemetry-collector-contrib
  dependency-version: 0.148.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: helm
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix gen

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
…8592)

* build(deps): bump the k8s-io group across 1 directory with 6 updates

Bumps the k8s-io group with 4 updates in the / directory: [k8s.io/api](https://github.com/kubernetes/api), [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver), [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime) and [k8s.io/kubectl](https://github.com/kubernetes/kubectl).


Updates `k8s.io/api` from 0.35.2 to 0.35.3
- [Commits](kubernetes/api@v0.35.2...v0.35.3)

Updates `k8s.io/apiextensions-apiserver` from 0.35.2 to 0.35.3
- [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases)
- [Commits](kubernetes/apiextensions-apiserver@v0.35.2...v0.35.3)

Updates `k8s.io/apiserver` from 0.35.2 to 0.35.3
- [Commits](kubernetes/apiserver@v0.35.2...v0.35.3)

Updates `k8s.io/cli-runtime` from 0.35.2 to 0.35.3
- [Commits](kubernetes/cli-runtime@v0.35.2...v0.35.3)

Updates `k8s.io/client-go` from 0.35.2 to 0.35.3
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.35.2...v0.35.3)

Updates `k8s.io/kubectl` from 0.35.2 to 0.35.3
- [Commits](kubernetes/kubectl@v0.35.2...v0.35.3)

---
updated-dependencies:
- dependency-name: k8s.io/api
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s-io
- dependency-name: k8s.io/apiextensions-apiserver
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s-io
- dependency-name: k8s.io/apiserver
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s-io
- dependency-name: k8s.io/cli-runtime
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s-io
- dependency-name: k8s.io/client-go
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s-io
- dependency-name: k8s.io/kubectl
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: k8s-io
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
#8598)

* [xds] stabilize listener-level Lua XDS filters to avoid listener drain

Use one disabled HCM Lua filter per Lua slot index instead of per EnvoyExtensionPolicy.
The slot/index logic is needed because https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/lua/v3/lua.proto#envoy-v3-api-msg-extensions-filters-http-lua-v3-luaperroute only supports one sourceCode at a time

Route-specific scripts still use LuaPerRoute, so multi-Lua ordering is preserved while adding new single-Lua policies
no longer churns the listener filter chain once slot 0 already exists.

Co-authored-by: Codex <noreply@openai.com>
Signed-off-by: Arko Dasgupta <arkodg@gmail.com>

* Update internal/xds/translator/lua.go

Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com>

---------

Signed-off-by: Arko Dasgupta <arkodg@gmail.com>
Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
update basic auth error status

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
update-buffer-docs

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
* Add note on case-insensitivity of header names

Clarified that header names are case-insensitive and provided an example.

Signed-off-by: Alexander Bolshakov <lextiz@gmail.com>

* Refer to RFC

Signed-off-by: Alexander Bolshakov <lextiz@gmail.com>

---------

Signed-off-by: Alexander Bolshakov <lextiz@gmail.com>
Signed-off-by: Shavgath Perumal <shavgath.perumal@pollinate.co.uk>
fix: reject imcompatible requestBuffer + httpUpgrade CTP

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
* geoip docs

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

geoip docs

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* Apply suggestion from @rudrakhp

Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
mkhpalm and others added 23 commits April 23, 2026 10:44
…8801)

* Add support for extraVolumes and extraVolumeMounts to EG deployment

Signed-off-by: Mike Palmer <mkhpalm@gmail.com>

* Update docs for extraVolumes and extraVolumeMounts

Signed-off-by: Mike Palmer <mkhpalm@gmail.com>

---------

Signed-off-by: Mike Palmer <mkhpalm@gmail.com>
Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
* add cel validation of grpcStatus

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

* fix: gen-check

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

* add: cel test

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

---------

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>
* add e2e test for watched namespace

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* explicitly includes the controller namespace

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
* use cached client from the controller manager

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix rbac

Signed-off-by: zhaohuabing <zhaohuabing@gmail.com>

* address comments

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* inject provider kube client to infra runner

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* add retries for rate limit server

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* watch only EG owned resources

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* add release note

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* use context to pass the kube client

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* update release note

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* use config.server to pass the kube client

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix lint

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* update release note

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* minor wording

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* wait for the cached client and start ratlimit server first

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix gen

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* remove unnecessary change

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix rbac

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix gen

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: zhaohuabing <zhaohuabing@gmail.com>
* api: bandwidth limit

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

* api: fix response trailers and add cel

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

* api: redesign BandwidthLimitSpec with separate request/response configs

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

* define bandwidth limit value and update crd comments

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

* update crd comments

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

* update cel validation test

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

* remove ptr

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

* update: define bandwidth limit unit

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

* fix: cel test

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

---------

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
* fix: reason with multiple errors rejected validation

Signed-off-by: zirain <zirain2009@gmail.com>

* release notes

Signed-off-by: zirain <zirain2009@gmail.com>

* fix lint

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
* feat: Allow configuring envoy proxy defaults via helm chart

This commit is a continuation of the previous work to support supplying default proxy settings added in #7698 and adds three new chart values under `global.images.envoyProxy`:

| Value | Type | Default | Description |
|----------------------------------------|--------|------|---------------------------------------------------------------------|
| `global.images.envoyProxy.image`       | string | `""` | Full image name (`registry/repo:tag`) for the Envoy Proxy container |
| `global.images.envoyProxy.pullPolicy`  | string | `""` | Image pull policy                                                   |
| `global.images.envoyProxy.pullSecrets` | list   | `[]` | Image pull secrets                                                  |

When any of these are set, the chart generates an `envoyProxy:` block inside the `EnvoyGateway` ConfigMap, wiring into the existing `EnvoyGatewaySpec.envoyProxy` field (added in #7698). The global `imageRegistry` override takes highest precedence, consistent with other chart components.

Full EnvoyProxy defaults (replicas, resources, etc.) can be provided via `config.envoyGateway.envoyProxy`; the image values are merged on top.

Closes #4764.

Signed-off-by: Michael Sommerville <msommerville@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
…th sequential chaining (#8458)

* feat: add support for multiple ExtensionManagers with sequential chaining

Add a new `extensionManagers` plural field to `EnvoyGatewaySpec` that allows
registering multiple extension managers with sequential chaining semantics.
Each extension's output becomes the next extension's input.

Key changes:
- Add `Name` field to `ExtensionManager` and `ExtensionManagers` list to `EnvoyGatewaySpec`
- Add `GetExtensionManagers()` helper to normalize singular/plural fields
- Add mutual exclusivity validation between singular and plural fields
- Implement `CompositeManager` wrapping multiple managers behind the `Manager` interface
- Implement `compositeXDSHookClient` with per-extension policy filtering and
  per-extension resource-type gating in `PostTranslateModifyHook`
- Merge `TranslationConfig` using OR semantics across all managers
- Add `CleanupHookConns()` to the `Manager` interface
- Unify `NewManager` factory to handle 0, 1, and N extensions

Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io>

# Conflicts:
#	release-notes/current.yaml

# Conflicts:
#	release-notes/current.yaml

# Conflicts:
#	release-notes/current.yaml

# Conflicts:
#	release-notes/current.yaml

# Conflicts:
#	release-notes/current.yaml

* Fix lint issues

Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io>

* Add more test cases

Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io>

* Per-extension manager filter Resources, BackendResources, and PolicyResources accordingly

Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io>

# Conflicts:
#	internal/extension/registry/extension_manager_test.go

* Implement new hook method PostEndpointsModifyHook

Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io>

* Respect failOpen when GetPre/PostXDSHookClient errors in CompositeManager

Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io>

* Simplified and unified client getter and tests

Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io>

* Add resilience tests for multiple ExtensionManagers chaining and resource isolation

Enhance the simple-extension-server with a configurable --suffix flag and
resource-aware PostRouteModify to support testing multiple extension managers.
Add resilience tests that verify sequential chaining of VirtualHost mutations
and per-extension resource isolation via extensionRef filters.

Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io>

# Conflicts:
#	examples/simple-extension-server/go.mod
#	examples/simple-extension-server/go.sum

* Add CompositeManager coverage to xDS translator tests and document plural ExtensionManagers

Mirror the existing extension-manager translator error-handling tests through
CompositeManager via a new NewInMemoryCompositeManager helper: a 1-entry
composite verifies child errors are swallowed when failOpen is true, and a
2-entry composite verifies errors are propagated with the 'extension "<name>":'
prefix when failOpen is false. Extract a shared buildManagerGVKSets helper to
avoid duplication between NewManager and the new in-memory constructor.

Also extend the extension-server docs with a "Multiple extension servers"
subsection covering sequential chaining, per-server resource isolation,
per-server failOpen, the unique name requirement, and mutual exclusivity with
the singular extensionManager field.

Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io>

* Fix lint errors

Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io>

* Match extension resources by group/kind, and wire cleanup for in-memory composite

Two fixes in the composite-extension path:

1. CompositeManager filter now matches by group/kind only, aligning with
   runner.ExtensionGroupKinds, Manager.HasExtension, and Gateway API
   extensionRef. Exact-GVK matching could silently drop resources whose
   served version differed from the one declared in ExtensionManager.Resources,
   diverging from single-manager behavior when CRDs serve multiple versions.

2. NewInMemoryCompositeManager wires a sync.Once-guarded cleanup into every
   entry's cleanupHookConn, so CompositeManager.CleanupHookConns() (from the
   Manager interface) tears down the shared bufconn/server. The separate
   cleanup func return is removed; callers use CleanupHookConns() on the
   returned Manager.

Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io>

* Add MinItems=1 and mutual-exclusion validation on extensionManagers

* +kubebuilder:validation:MinItems=1 on EnvoyGatewaySpec.ExtensionManagers,
  mirrored by a runtime check that rejects an explicitly-set-but-empty list
  (a nil slice still means "omitted").
* +kubebuilder:validation:XValidation on EnvoyGatewaySpec declaring that
  extensionManager and extensionManagers are mutually exclusive. The same
  constraint is already enforced at runtime in
  validateEnvoyGatewayExtensionManagers; the marker documents the schema
  and is wired up for consumers that validate against the generated OpenAPI.

Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io>

* Fix MultiextensionManagers tests

Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io>

---------

Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
update api docs for the default EnvoyProxy

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
* feat: bandwidth limit

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

* add: crd validation

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

---------

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
* Add source to responseOverride

Fixes #6796

Signed-off-by: Lee Boynton <lee.boynton@truelayer.com>
…8882)

Bumps [npm-check-updates](https://github.com/raineorshine/npm-check-updates) from 21.0.3 to 22.0.1.
- [Release notes](https://github.com/raineorshine/npm-check-updates/releases)
- [Changelog](https://github.com/raineorshine/npm-check-updates/blob/main/CHANGELOG.md)
- [Commits](raineorshine/npm-check-updates@v21.0.3...v22.0.1)

---
updated-dependencies:
- dependency-name: npm-check-updates
  dependency-version: 22.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump go.uber.org/zap from 1.27.1 to 1.28.0

Bumps [go.uber.org/zap](https://github.com/uber-go/zap) from 1.27.1 to 1.28.0.
- [Release notes](https://github.com/uber-go/zap/releases)
- [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md)
- [Commits](uber-go/zap@v1.27.1...v1.28.0)

---
updated-dependencies:
- dependency-name: go.uber.org/zap
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix go mod

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
…8885)

* build(deps): bump the helm group across 1 directory with 4 updates

Bumps the helm group with 4 updates in the /charts/gateway-addons-helm directory: prometheus, alloy, loki and otel/opentelemetry-collector-contrib.


Updates `prometheus` from 29.2.1 to 29.3.0

Updates `alloy` from 1.7.0 to 1.8.0

Updates `loki` from 6.55.0 to 7.0.0

Updates `otel/opentelemetry-collector-contrib` from 0.150.1 to 0.151.0

---
updated-dependencies:
- dependency-name: prometheus
  dependency-version: 29.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: helm
- dependency-name: alloy
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: helm
- dependency-name: loki
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: helm
- dependency-name: otel/opentelemetry-collector-contrib
  dependency-version: 0.151.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: helm
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix gen

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>
* api: cross-namespace policy target selectors

Signed-off-by: Guy Daich <guy.daich@sap.com>

* use gw-api style for namespace selector

Signed-off-by: Guy Daich <guy.daich@sap.com>

* fix json tag

Signed-off-by: Guy Daich <guy.daich@sap.com>

* update API

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* update API

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* implmentation

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* add e2e tests for cross ns policy attachment

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* update test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix lint

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* update test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* add referencegrants to the provider

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* simplify code

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* simplify code

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* simplify code

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* rename

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix race

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* remove unnecessary change

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* simplify code

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* rename

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* refactor

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* add referencegrants for extension server policies

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* Revert "add referencegrants for extension server policies"

This reverts commit a0fbe68.

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* remove cross-ns policy attachment for extension server

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix gen

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix lint

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix test

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* remove unnecessary change

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* fix cel validation

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* add warning for partially accepted targets

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Guy Daich <guy.daich@sap.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: Guy Daich <guy.daich@sap.com>
@jukie
jukie requested a review from a team as a code owner April 30, 2026 15:48
@github-advanced-security

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

@@ -0,0 +1,21 @@
FROM golang:1.26.2 AS builder
Comment thread examples/backend-utilization/Dockerfile Dismissed
ARG ENVOY_VERSION=dev

FROM golang:1.26.1 AS builder
FROM golang:1.26.2 AS builder
@@ -1,4 +1,4 @@
FROM golang:1.26.1 AS builder
FROM golang:1.26.2 AS builder
@@ -1,4 +1,4 @@
FROM golang:1.26.1 AS builder
FROM golang:1.26.2 AS builder
@@ -1,4 +1,4 @@
FROM golang:1.26.1 AS builder
FROM golang:1.26.2 AS builder
@@ -1,4 +1,4 @@
FROM golang:1.26.1 AS builder
FROM golang:1.26.2 AS builder
@@ -1,4 +1,4 @@
FROM golang:1.26.1 AS builder
FROM golang:1.26.2 AS builder
@netlify

netlify Bot commented Apr 30, 2026

Copy link
Copy Markdown

Deploy Preview for cerulean-figolla-1f9435 ready!

Name Link
🔨 Latest commit 8fa767a
🔍 Latest deploy log https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69f379bcc723be00088ea841
😎 Deploy Preview https://deploy-preview-8896--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8fa767a980

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

name: codecov-envoy-gateway
verbose: true
use_oidc: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) }}
use_oidc: true

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep tokenless fallback for forked PR coverage uploads

Setting use_oidc: true unconditionally makes the Codecov step depend on an OIDC token for every pull_request run. Forked PR workflows typically cannot rely on that token path, so with fail_ci_if_error: true this can fail the entire coverage-test job for external contributors even when tests pass. The previous conditional guarded this exact case; restoring a fork-aware condition avoids blocking community PRs.

Useful? React with 👍 / 👎.

@codecov

codecov Bot commented Apr 30, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 87.02852% with 141 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (release/v1.8@c5f54a2). Learn more about missing BASE report.

Files with missing lines Patch % Lines
internal/gatewayapi/envoyextensionpolicy.go 67.27% 27 Missing and 9 partials ⚠️
internal/gatewayapi/backendtrafficpolicy.go 90.69% 12 Missing and 8 partials ⚠️
api/v1alpha1/validation/envoygateway_validate.go 56.09% 13 Missing and 5 partials ⚠️
internal/gatewayapi/clienttrafficpolicy.go 85.59% 12 Missing and 5 partials ⚠️
internal/gatewayapi/backendtlspolicy.go 88.46% 8 Missing and 4 partials ⚠️
internal/extension/registry/inmemory_composite.go 80.48% 5 Missing and 3 partials ⚠️
internal/gatewayapi/clustersettings.go 80.00% 4 Missing and 4 partials ⚠️
internal/envoygateway/config/config.go 36.36% 7 Missing ⚠️
internal/gatewayapi/envoyproxy_merge.go 77.77% 3 Missing and 3 partials ⚠️
internal/extension/registry/extension_manager.go 93.87% 2 Missing and 1 partial ⚠️
... and 4 more
Additional details and impacted files
@@               Coverage Diff               @@
##             release/v1.8    #8896   +/-   ##
===============================================
  Coverage                ?   74.69%           
===============================================
  Files                   ?      251           
  Lines                   ?    40257           
  Branches                ?        0           
===============================================
  Hits                    ?    30068           
  Misses                  ?     8123           
  Partials                ?     2066           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@jukie jukie closed this Apr 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.