Sync release/v1.8 with main - #8896
Conversation
… host (#8565) * fix: per-endpoint hostname override blocked by auto-generated wildcard host Signed-off-by: zirain <zirain2009@gmail.com> * add UT Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com>
Implement issue #4280 ClientValidationModeType to effectively be able to use trust_chain_verification ACCEPT_UNTRUSTED Signed-off-by: Julien Spadoni <julien@beezeelinx.com>
…ty routes (#8521) * fix(tcp): add SNI-based filter chain matching for TLS passthrough empty routes This fix addresses the issue where multiple TLS passthrough listeners on the same port without routes would generate duplicate empty filter chains without unique matching rules, causing Envoy to reject the configuration with: "filter chain 'EmptyCluster' has the same matching rules defined as 'EmptyCluster'" Changes: - Add Hostnames field to TCPListener IR to capture SNI values from Gateway API - Populate hostnames from Gateway API listener.Hostname for TLS protocol - Detect TLS passthrough by presence of hostnames (SNI matching required) - Create unique EmptyCluster per TLS passthrough listener with SNI-based matching - Add TLSInspectorConfig with SNIs to enable filterChainMatch generation - Add test coverage for multiple TLS passthrough listeners without routes This ensures each TLS passthrough listener gets a unique filter chain with serverNames matching, allowing Envoy to properly route based on SNI. Builds on work from #7912 by @Aditya7880900936 which addressed the unique cluster naming issue. This PR extends it to properly implement SNI-based filter chain matching as noted in the review comments by @sudiptob2. Fixes #7912 Signed-off-by: Oliver Bailey <github@obailey.co.uk>
Signed-off-by: zirain <zirain2009@gmail.com>
* update API Signed-off-by: zirain <zirain2009@gmail.com> * impl Signed-off-by: zirain <zirain2009@gmail.com> * translator test Signed-off-by: zirain <zirain2009@gmail.com> * add e2e Signed-off-by: zirain <zirain2009@gmail.com> * release notes Signed-off-by: zirain <zirain2009@gmail.com> * fix gen Signed-off-by: zirain <zirain2009@gmail.com> * address review comments Signed-off-by: zirain <zirain2009@gmail.com> * fix Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com>
* chore: refactor JSONPatch Signed-off-by: zirain <zirain2009@gmail.com> * fix Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com>
* docs: avoid "authentication" Signed-off-by: Kazuhiro Sakurayama <haruyama480@gmail.com> * apply to v1.6 and v1.7 % git diff HEAD~ HEAD site/content/en/latest/tasks/security/ext-auth.md > diff.patch % patch site/content/en/v1.6/tasks/security/ext-auth.md < diff.patch patching file 'site/content/en/v1.6/tasks/security/ext-auth.md' % patch site/content/en/v1.7/tasks/security/ext-auth.md < diff.patch patching file 'site/content/en/v1.7/tasks/security/ext-auth.md' Signed-off-by: Kazuhiro Sakurayama <haruyama480@gmail.com> --------- Signed-off-by: Kazuhiro Sakurayama <haruyama480@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>
…obin (#7407) * Add support for ClientSideWeightedRoundRobin load balancer policy in Gateway CRDs, ensuring configurable parameters and validation rules are integrated. Includes e2e test for validation. Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> * Adds / Updates test cases for client wrr Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> * Fix: gen-check ci, coverage-check Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> * Remove `enableOOBLoadReport` and `oobReportingPeriod` fields from gateway CRDs and related configurations. Update associated test data and documentation. Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> * Remove `enableOOBLoadReport` and `oobReportingPeriod` fields from ClientSideWeightedRoundRobin configuration, update affected tests and CRDs. Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> * Update: Change `ErrorUtilizationPenalty` type from float to integer across Gateway CRDs, configuration files, and related tests. Adjust documentation to reflect percentage-based representation. Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> * Update: Refactor `ErrorUtilizationPenalty` to use integer type with percentage-based representation in Gateway CRDs, configurations, and tests. Adjust related documentation and ensure backward compatibility. Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> * Refactor: Replace `ptr.To(metav1.Duration)` with `ir.MetaV1DurationPtr` across gateway configurations and tests for cleaner and consistent duration handling. Remove unused `metav1` imports where applicable. Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> * Update: Add support for SlowStart configuration for ClientSideWeightedRoundRobin load balancer in Gateway CRDs, configurations, and tests. Adjust validation rules and documentation accordingly. Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> * Update: Replace `ClientSideWeightedRoundRobin` load balancer type with `BackendUtilization` in Gateway CRDs, configurations, and tests. Revise validation rules, documentation, and enums accordingly. Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> * Update: Replace `ClientSideWeightedRoundRobin` references with `BackendUtilization` in load balancing tests and documentation. Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> * Update: Replace `lb-backend-bu` references with `lb-backend-utilization` across tests, configurations, and load balancing policies for consistency. Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> * Remove: Delete obsolete BackendUtilization OOB and penalty load balancing tests. Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> * Update: Add detailed documentation and configuration examples for Backend Utilization (ORCA) load balancing in Gateway CRDs and related docs. Refine header handling and metric formats. Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> * Update: Rename `ErrorUtilizationPenalty` to `ErrorUtilizationPenaltyPercent` across API, tests, and internal logic for clarity and precision. Adjust related documentation and validations. Signed-off-by: anurag.ag <6075379+altaiezior@users.noreply.github.com> * Update: Add support for `removeResponseHeaders` in `BackendUtilization`. Adjust logic, tests, and documentation to highlight default value and ORCA header removal. Signed-off-by: anurag.ag <6075379+altaiezior@users.noreply.github.com> * Update: Replace `removeResponseHeaders` with `keepResponseHeaders` across API, internal logic, and templates. Adjust defaults, documentation, and validations to reflect behavior change. Signed-off-by: anurag.ag <6075379+altaiezior@users.noreply.github.com> * Refactor: Reorganize import order in `cluster_test.go` for consistency. Signed-off-by: anurag.ag <6075379+altaiezior@users.noreply.github.com> * Update: Fix formatting and alignment in `load_balancing.go` and `loadbalancer_types.go` for consistency. Signed-off-by: altaiezior <6075379+altaiezior@users.noreply.github.com> * Update: Add validation to disallow ZoneAware routing for BackendUtilization load balancers. Adjust tests to reflect the new validation rule. Signed-off-by: altaiezior <6075379+altaiezior@users.noreply.github.com> * Update: Add error handling for invalid duration values in `BackendUtilization` fields (`BlackoutPeriod`, `WeightExpirationPeriod`, `WeightUpdatePeriod`). Signed-off-by: altaiezior <6075379+altaiezior@users.noreply.github.com> * Refactor: Simplify nil check and assignment logic in `BackendUtilization` handling within cluster translator. Signed-off-by: altaiezior <6075379+altaiezior@users.noreply.github.com> * Update: Add support for BackendUtilization load balancing policy in BackendTrafficPolicy. Signed-off-by: altaiezior <6075379+altaiezior@users.noreply.github.com> --------- Signed-off-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> Signed-off-by: anurag.ag <6075379+altaiezior@users.noreply.github.com> Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com> Signed-off-by: altaiezior <6075379+altaiezior@users.noreply.github.com> Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com> Co-authored-by: anurag.ag <anuragagarwal561994@users.noreply.github.com> Co-authored-by: Isaac <10012479+jukie@users.noreply.github.com> Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
…s-helm in the helm group across 1 directory (#8550) * build(deps): bump loki Bumps the helm group with 1 update in the /charts/gateway-addons-helm directory: loki. Updates `loki` from 6.54.0 to 6.55.0 --- updated-dependencies: - dependency-name: loki dependency-version: 6.55.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: helm ... Signed-off-by: dependabot[bot] <support@github.com> * gen-check Signed-off-by: jukie <10012479+Jukie@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: jukie <10012479+Jukie@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jukie <10012479+Jukie@users.noreply.github.com>
* fix bug with grpcroute mirror filter Signed-off-by: Adam Buran <aburan@roblox.com> * add indexers test Signed-off-by: Adam Buran <aburan@roblox.com> * add release note Signed-off-by: Adam Buran <aburan@roblox.com> --------- Signed-off-by: Adam Buran <aburan@roblox.com> Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com> Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Fixes #8554 Signed-off-by: stekole <stefan@sandnetworks.com> Signed-off-by: stekole <30674956+stekole@users.noreply.github.com>
…#8548) * build(deps): bump the gomod group across 5 directories with 6 updates Bumps the gomod group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/go-openapi/strfmt](https://github.com/go-openapi/strfmt) | `0.26.0` | `0.26.1` | | [github.com/ohler55/ojg](https://github.com/ohler55/ojg) | `1.28.0` | `1.28.1` | | [github.com/replicatedhq/troubleshoot](https://github.com/replicatedhq/troubleshoot) | `0.123.18` | `0.125.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.79.2` | `1.79.3` | | [helm.sh/helm/v3](https://github.com/helm/helm) | `3.20.0` | `3.20.1` | Bumps the gomod group with 1 update in the /examples/envoy-ext-auth directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go). Bumps the gomod group with 1 update in the /examples/extension-server directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go). Bumps the gomod group with 1 update in the /examples/grpc-ext-proc directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go). Bumps the gomod group with 2 updates in the /examples/simple-extension-server directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go) and [github.com/envoyproxy/gateway](https://github.com/envoyproxy/gateway). Updates `github.com/go-openapi/strfmt` from 0.26.0 to 0.26.1 - [Release notes](https://github.com/go-openapi/strfmt/releases) - [Commits](go-openapi/strfmt@v0.26.0...v0.26.1) Updates `github.com/ohler55/ojg` from 1.28.0 to 1.28.1 - [Release notes](https://github.com/ohler55/ojg/releases) - [Changelog](https://github.com/ohler55/ojg/blob/develop/CHANGELOG.md) - [Commits](ohler55/ojg@v1.28.0...v1.28.1) Updates `github.com/replicatedhq/troubleshoot` from 0.123.18 to 0.125.0 - [Release notes](https://github.com/replicatedhq/troubleshoot/releases) - [Commits](replicatedhq/troubleshoot@v0.123.18...v0.125.0) Updates `google.golang.org/grpc` from 1.79.2 to 1.79.3 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.79.2...v1.79.3) Updates `helm.sh/helm/v3` from 3.20.0 to 3.20.1 - [Release notes](https://github.com/helm/helm/releases) - [Commits](helm/helm@v3.20.0...v3.20.1) Updates `google.golang.org/grpc` from 1.79.2 to 1.79.3 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.79.2...v1.79.3) Updates `google.golang.org/grpc` from 1.79.2 to 1.79.3 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.79.2...v1.79.3) Updates `google.golang.org/grpc` from 1.79.2 to 1.79.3 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.79.2...v1.79.3) Updates `google.golang.org/grpc` from 1.79.2 to 1.79.3 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.79.2...v1.79.3) Updates `github.com/envoyproxy/gateway` from 1.7.0 to 1.7.1 - [Release notes](https://github.com/envoyproxy/gateway/releases) - [Commits](v1.7.0...v1.7.1) --- updated-dependencies: - dependency-name: github.com/go-openapi/strfmt dependency-version: 0.26.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/ohler55/ojg dependency-version: 1.28.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/replicatedhq/troubleshoot dependency-version: 0.125.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: helm.sh/helm/v3 dependency-version: 3.20.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/envoyproxy/gateway dependency-version: 1.7.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> * Run make gen-check: commit generated changes * tidy Signed-off-by: jukie <10012479+Jukie@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: jukie <10012479+Jukie@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com> Co-authored-by: jukie <10012479+Jukie@users.noreply.github.com>
update release schedule Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
* provider implementation Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> GeoIP implementation Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * debug ipv6 failure Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * disable geoIP test in IPv6 Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix lint Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * simplify code Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * reuse direct response Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * simplify code Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: jukie <10012479+Jukie@users.noreply.github.com>
update grpc Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
…r/envoy-gateway (#8590) build(deps): bump busybox in /tools/docker/envoy-gateway Bumps busybox from `b3255e7` to `1487d0a`. --- updated-dependencies: - dependency-name: busybox dependency-version: 1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…8591) * build(deps): bump the gomod group across 1 directory with 2 updates Bumps the gomod group with 2 updates in the / directory: [github.com/fatih/color](https://github.com/fatih/color) and [github.com/replicatedhq/troubleshoot](https://github.com/replicatedhq/troubleshoot). Updates `github.com/fatih/color` from 1.18.0 to 1.19.0 - [Release notes](https://github.com/fatih/color/releases) - [Commits](fatih/color@v1.18.0...v1.19.0) Updates `github.com/replicatedhq/troubleshoot` from 0.125.0 to 0.125.1 - [Release notes](https://github.com/replicatedhq/troubleshoot/releases) - [Commits](replicatedhq/troubleshoot@v0.125.0...v0.125.1) --- updated-dependencies: - dependency-name: github.com/fatih/color dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: github.com/replicatedhq/troubleshoot dependency-version: 0.125.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> * fix gen Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix gen Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
…8594) * build(deps): bump the helm group across 1 directory with 3 updates Bumps the helm group with 3 updates in the /charts/gateway-addons-helm directory: prometheus, opentelemetry-collector and otel/opentelemetry-collector-contrib. Updates `prometheus` from 28.13.0 to 28.14.0 Updates `opentelemetry-collector` from 0.147.0 to 0.147.1 Updates `otel/opentelemetry-collector-contrib` from 0.147.0 to 0.148.0 --- updated-dependencies: - dependency-name: prometheus dependency-version: 28.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: helm - dependency-name: opentelemetry-collector dependency-version: 0.147.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: helm - dependency-name: otel/opentelemetry-collector-contrib dependency-version: 0.148.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: helm ... Signed-off-by: dependabot[bot] <support@github.com> * fix gen Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
…8592) * build(deps): bump the k8s-io group across 1 directory with 6 updates Bumps the k8s-io group with 4 updates in the / directory: [k8s.io/api](https://github.com/kubernetes/api), [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver), [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime) and [k8s.io/kubectl](https://github.com/kubernetes/kubectl). Updates `k8s.io/api` from 0.35.2 to 0.35.3 - [Commits](kubernetes/api@v0.35.2...v0.35.3) Updates `k8s.io/apiextensions-apiserver` from 0.35.2 to 0.35.3 - [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases) - [Commits](kubernetes/apiextensions-apiserver@v0.35.2...v0.35.3) Updates `k8s.io/apiserver` from 0.35.2 to 0.35.3 - [Commits](kubernetes/apiserver@v0.35.2...v0.35.3) Updates `k8s.io/cli-runtime` from 0.35.2 to 0.35.3 - [Commits](kubernetes/cli-runtime@v0.35.2...v0.35.3) Updates `k8s.io/client-go` from 0.35.2 to 0.35.3 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.35.2...v0.35.3) Updates `k8s.io/kubectl` from 0.35.2 to 0.35.3 - [Commits](kubernetes/kubectl@v0.35.2...v0.35.3) --- updated-dependencies: - dependency-name: k8s.io/api dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apiextensions-apiserver dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apiserver dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/cli-runtime dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/client-go dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/kubectl dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io ... Signed-off-by: dependabot[bot] <support@github.com> * fix test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
#8598) * [xds] stabilize listener-level Lua XDS filters to avoid listener drain Use one disabled HCM Lua filter per Lua slot index instead of per EnvoyExtensionPolicy. The slot/index logic is needed because https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/lua/v3/lua.proto#envoy-v3-api-msg-extensions-filters-http-lua-v3-luaperroute only supports one sourceCode at a time Route-specific scripts still use LuaPerRoute, so multi-Lua ordering is preserved while adding new single-Lua policies no longer churns the listener filter chain once slot 0 already exists. Co-authored-by: Codex <noreply@openai.com> Signed-off-by: Arko Dasgupta <arkodg@gmail.com> * Update internal/xds/translator/lua.go Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com> --------- Signed-off-by: Arko Dasgupta <arkodg@gmail.com> Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com> Co-authored-by: Codex <noreply@openai.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
update basic auth error status Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
update-buffer-docs Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
* Add note on case-insensitivity of header names Clarified that header names are case-insensitive and provided an example. Signed-off-by: Alexander Bolshakov <lextiz@gmail.com> * Refer to RFC Signed-off-by: Alexander Bolshakov <lextiz@gmail.com> --------- Signed-off-by: Alexander Bolshakov <lextiz@gmail.com>
Signed-off-by: Shavgath Perumal <shavgath.perumal@pollinate.co.uk>
fix: reject imcompatible requestBuffer + httpUpgrade CTP Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
* geoip docs Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> geoip docs Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * Apply suggestion from @rudrakhp Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
…8801) * Add support for extraVolumes and extraVolumeMounts to EG deployment Signed-off-by: Mike Palmer <mkhpalm@gmail.com> * Update docs for extraVolumes and extraVolumeMounts Signed-off-by: Mike Palmer <mkhpalm@gmail.com> --------- Signed-off-by: Mike Palmer <mkhpalm@gmail.com> Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
* add cel validation of grpcStatus Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * fix: gen-check Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * add: cel test Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> --------- Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>
* add e2e test for watched namespace Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * explicitly includes the controller namespace Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
* use cached client from the controller manager Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix rbac Signed-off-by: zhaohuabing <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * inject provider kube client to infra runner Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add retries for rate limit server Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * watch only EG owned resources Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add release note Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * use context to pass the kube client Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update release note Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * use config.server to pass the kube client Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix lint Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update release note Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * minor wording Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * wait for the cached client and start ratlimit server first Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix gen Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * remove unnecessary change Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix rbac Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix gen Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: zhaohuabing <zhaohuabing@gmail.com>
* api: bandwidth limit Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * api: fix response trailers and add cel Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * api: redesign BandwidthLimitSpec with separate request/response configs Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * define bandwidth limit value and update crd comments Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * update crd comments Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * update cel validation test Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * remove ptr Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * update: define bandwidth limit unit Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * fix: cel test Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> --------- Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
* fix: reason with multiple errors rejected validation Signed-off-by: zirain <zirain2009@gmail.com> * release notes Signed-off-by: zirain <zirain2009@gmail.com> * fix lint Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
* feat: Allow configuring envoy proxy defaults via helm chart This commit is a continuation of the previous work to support supplying default proxy settings added in #7698 and adds three new chart values under `global.images.envoyProxy`: | Value | Type | Default | Description | |----------------------------------------|--------|------|---------------------------------------------------------------------| | `global.images.envoyProxy.image` | string | `""` | Full image name (`registry/repo:tag`) for the Envoy Proxy container | | `global.images.envoyProxy.pullPolicy` | string | `""` | Image pull policy | | `global.images.envoyProxy.pullSecrets` | list | `[]` | Image pull secrets | When any of these are set, the chart generates an `envoyProxy:` block inside the `EnvoyGateway` ConfigMap, wiring into the existing `EnvoyGatewaySpec.envoyProxy` field (added in #7698). The global `imageRegistry` override takes highest precedence, consistent with other chart components. Full EnvoyProxy defaults (replicas, resources, etc.) can be provided via `config.envoyGateway.envoyProxy`; the image values are merged on top. Closes #4764. Signed-off-by: Michael Sommerville <msommerville@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
…th sequential chaining (#8458) * feat: add support for multiple ExtensionManagers with sequential chaining Add a new `extensionManagers` plural field to `EnvoyGatewaySpec` that allows registering multiple extension managers with sequential chaining semantics. Each extension's output becomes the next extension's input. Key changes: - Add `Name` field to `ExtensionManager` and `ExtensionManagers` list to `EnvoyGatewaySpec` - Add `GetExtensionManagers()` helper to normalize singular/plural fields - Add mutual exclusivity validation between singular and plural fields - Implement `CompositeManager` wrapping multiple managers behind the `Manager` interface - Implement `compositeXDSHookClient` with per-extension policy filtering and per-extension resource-type gating in `PostTranslateModifyHook` - Merge `TranslationConfig` using OR semantics across all managers - Add `CleanupHookConns()` to the `Manager` interface - Unify `NewManager` factory to handle 0, 1, and N extensions Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io> # Conflicts: # release-notes/current.yaml # Conflicts: # release-notes/current.yaml # Conflicts: # release-notes/current.yaml # Conflicts: # release-notes/current.yaml # Conflicts: # release-notes/current.yaml * Fix lint issues Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io> * Add more test cases Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io> * Per-extension manager filter Resources, BackendResources, and PolicyResources accordingly Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io> # Conflicts: # internal/extension/registry/extension_manager_test.go * Implement new hook method PostEndpointsModifyHook Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io> * Respect failOpen when GetPre/PostXDSHookClient errors in CompositeManager Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io> * Simplified and unified client getter and tests Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io> * Add resilience tests for multiple ExtensionManagers chaining and resource isolation Enhance the simple-extension-server with a configurable --suffix flag and resource-aware PostRouteModify to support testing multiple extension managers. Add resilience tests that verify sequential chaining of VirtualHost mutations and per-extension resource isolation via extensionRef filters. Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io> # Conflicts: # examples/simple-extension-server/go.mod # examples/simple-extension-server/go.sum * Add CompositeManager coverage to xDS translator tests and document plural ExtensionManagers Mirror the existing extension-manager translator error-handling tests through CompositeManager via a new NewInMemoryCompositeManager helper: a 1-entry composite verifies child errors are swallowed when failOpen is true, and a 2-entry composite verifies errors are propagated with the 'extension "<name>":' prefix when failOpen is false. Extract a shared buildManagerGVKSets helper to avoid duplication between NewManager and the new in-memory constructor. Also extend the extension-server docs with a "Multiple extension servers" subsection covering sequential chaining, per-server resource isolation, per-server failOpen, the unique name requirement, and mutual exclusivity with the singular extensionManager field. Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io> * Fix lint errors Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io> * Match extension resources by group/kind, and wire cleanup for in-memory composite Two fixes in the composite-extension path: 1. CompositeManager filter now matches by group/kind only, aligning with runner.ExtensionGroupKinds, Manager.HasExtension, and Gateway API extensionRef. Exact-GVK matching could silently drop resources whose served version differed from the one declared in ExtensionManager.Resources, diverging from single-manager behavior when CRDs serve multiple versions. 2. NewInMemoryCompositeManager wires a sync.Once-guarded cleanup into every entry's cleanupHookConn, so CompositeManager.CleanupHookConns() (from the Manager interface) tears down the shared bufconn/server. The separate cleanup func return is removed; callers use CleanupHookConns() on the returned Manager. Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io> * Add MinItems=1 and mutual-exclusion validation on extensionManagers * +kubebuilder:validation:MinItems=1 on EnvoyGatewaySpec.ExtensionManagers, mirrored by a runtime check that rejects an explicitly-set-but-empty list (a nil slice still means "omitted"). * +kubebuilder:validation:XValidation on EnvoyGatewaySpec declaring that extensionManager and extensionManagers are mutually exclusive. The same constraint is already enforced at runtime in validateEnvoyGatewayExtensionManagers; the marker documents the schema and is wired up for consumers that validate against the generated OpenAPI. Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io> * Fix MultiextensionManagers tests Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io> --------- Signed-off-by: Marc Navarro Sonnenfeld <marcnavarro@tetrate.io>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
update api docs for the default EnvoyProxy Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
* feat: bandwidth limit Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * add: crd validation Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> --------- Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
* Add source to responseOverride Fixes #6796 Signed-off-by: Lee Boynton <lee.boynton@truelayer.com>
…8882) Bumps [npm-check-updates](https://github.com/raineorshine/npm-check-updates) from 21.0.3 to 22.0.1. - [Release notes](https://github.com/raineorshine/npm-check-updates/releases) - [Changelog](https://github.com/raineorshine/npm-check-updates/blob/main/CHANGELOG.md) - [Commits](raineorshine/npm-check-updates@v21.0.3...v22.0.1) --- updated-dependencies: - dependency-name: npm-check-updates dependency-version: 22.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump go.uber.org/zap from 1.27.1 to 1.28.0 Bumps [go.uber.org/zap](https://github.com/uber-go/zap) from 1.27.1 to 1.28.0. - [Release notes](https://github.com/uber-go/zap/releases) - [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md) - [Commits](uber-go/zap@v1.27.1...v1.28.0) --- updated-dependencies: - dependency-name: go.uber.org/zap dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * fix go mod Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
…8885) * build(deps): bump the helm group across 1 directory with 4 updates Bumps the helm group with 4 updates in the /charts/gateway-addons-helm directory: prometheus, alloy, loki and otel/opentelemetry-collector-contrib. Updates `prometheus` from 29.2.1 to 29.3.0 Updates `alloy` from 1.7.0 to 1.8.0 Updates `loki` from 6.55.0 to 7.0.0 Updates `otel/opentelemetry-collector-contrib` from 0.150.1 to 0.151.0 --- updated-dependencies: - dependency-name: prometheus dependency-version: 29.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: helm - dependency-name: alloy dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: helm - dependency-name: loki dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: helm - dependency-name: otel/opentelemetry-collector-contrib dependency-version: 0.151.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: helm ... Signed-off-by: dependabot[bot] <support@github.com> * fix gen Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>
* api: cross-namespace policy target selectors Signed-off-by: Guy Daich <guy.daich@sap.com> * use gw-api style for namespace selector Signed-off-by: Guy Daich <guy.daich@sap.com> * fix json tag Signed-off-by: Guy Daich <guy.daich@sap.com> * update API Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update API Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * implmentation Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add e2e tests for cross ns policy attachment Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix lint Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add referencegrants to the provider Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * simplify code Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * simplify code Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * simplify code Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * rename Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix race Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * remove unnecessary change Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * simplify code Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * rename Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * refactor Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add referencegrants for extension server policies Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * Revert "add referencegrants for extension server policies" This reverts commit a0fbe68. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * remove cross-ns policy attachment for extension server Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix gen Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix lint Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * remove unnecessary change Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix cel validation Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add warning for partially accepted targets Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Guy Daich <guy.daich@sap.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: Guy Daich <guy.daich@sap.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
| @@ -0,0 +1,21 @@ | |||
| FROM golang:1.26.2 AS builder | |||
| ARG ENVOY_VERSION=dev | ||
|
|
||
| FROM golang:1.26.1 AS builder | ||
| FROM golang:1.26.2 AS builder |
| @@ -1,4 +1,4 @@ | |||
| FROM golang:1.26.1 AS builder | |||
| FROM golang:1.26.2 AS builder | |||
| @@ -1,4 +1,4 @@ | |||
| FROM golang:1.26.1 AS builder | |||
| FROM golang:1.26.2 AS builder | |||
| @@ -1,4 +1,4 @@ | |||
| FROM golang:1.26.1 AS builder | |||
| FROM golang:1.26.2 AS builder | |||
| @@ -1,4 +1,4 @@ | |||
| FROM golang:1.26.1 AS builder | |||
| FROM golang:1.26.2 AS builder | |||
| @@ -1,4 +1,4 @@ | |||
| FROM golang:1.26.1 AS builder | |||
| FROM golang:1.26.2 AS builder | |||
✅ Deploy Preview for cerulean-figolla-1f9435 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8fa767a980
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| name: codecov-envoy-gateway | ||
| verbose: true | ||
| use_oidc: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) }} | ||
| use_oidc: true |
There was a problem hiding this comment.
Keep tokenless fallback for forked PR coverage uploads
Setting use_oidc: true unconditionally makes the Codecov step depend on an OIDC token for every pull_request run. Forked PR workflows typically cannot rely on that token path, so with fail_ci_if_error: true this can fail the entire coverage-test job for external contributors even when tests pass. The previous conditional guarded this exact case; restoring a fork-aware condition avoids blocking community PRs.
Useful? React with 👍 / 👎.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## release/v1.8 #8896 +/- ##
===============================================
Coverage ? 74.69%
===============================================
Files ? 251
Lines ? 40257
Branches ? 0
===============================================
Hits ? 30068
Misses ? 8123
Partials ? 2066 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This was created during rc.0 but wasn't actually used yet