Skip to content

Commit ff7e3ff

Browse files
arkodgarkodg
authored
Merge branch 'main' into dependabot/github_actions/codecov/codecov-action-5.4.2
2 parents 1641799 + 5273853 commit ff7e3ff

File tree

166 files changed

+5322
-1192
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

166 files changed

+5322
-1192
lines changed

‎.github/workflows/build_and_test.yaml

+12-2
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,16 @@ jobs:
8585
strategy:
8686
fail-fast: false
8787
matrix:
88-
version: [ v1.29.10, v1.30.6, v1.31.4, v1.32.0 ]
88+
target:
89+
- version: v1.29.10
90+
ipFamily: ipv4
91+
- version: v1.30.6
92+
ipFamily: ipv4
93+
- version: v1.31.4
94+
ipFamily: ipv6 # only run ipv6 test on this version to save time
95+
# TODO: this's IPv4 first, need a way to test IPv6 first.
96+
- version: v1.32.0
97+
ipFamily: dual # only run dual test on latest version to save time
8998
steps:
9099
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
91100
- uses: ./tools/github-actions/setup-deps
@@ -104,8 +113,9 @@ jobs:
104113
# conformance
105114
- name: Run Standard Conformance Tests
106115
env:
107-
KIND_NODE_TAG: ${{ matrix.version }}
116+
KIND_NODE_TAG: ${{ matrix.target.version }}
108117
IMAGE_PULL_POLICY: IfNotPresent
118+
IP_FAMILY: ${{ matrix.target.ipFamily }}
109119
run: make conformance
110120

111121
e2e-test:

‎api/v1alpha1/backend_types.go

+38
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ package v1alpha1
77

88
import (
99
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
10+
gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
11+
gwapiv1a3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
1012
)
1113

1214
const (
@@ -141,6 +143,42 @@ type BackendSpec struct {
141143
//
142144
// +optional
143145
Fallback *bool `json:"fallback,omitempty"`
146+
147+
// TLS defines the TLS settings for the backend.
148+
// Only supported for DynamicResolver backends.
149+
//
150+
// +optional
151+
// +notImplementedHide
152+
TLS *BackendTLSSettings `json:"tls,omitempty"`
153+
}
154+
155+
// BackendTLSSettings holds the TLS settings for the backend.
156+
// Only used for DynamicResolver backends.
157+
type BackendTLSSettings struct {
158+
// CACertificateRefs contains one or more references to Kubernetes objects that
159+
// contain TLS certificates of the Certificate Authorities that can be used
160+
// as a trust anchor to validate the certificates presented by the backend.
161+
//
162+
// A single reference to a Kubernetes ConfigMap or a Kubernetes Secret,
163+
// with the CA certificate in a key named `ca.crt` is currently supported.
164+
//
165+
// If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
166+
// specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
167+
// not both.
168+
//
169+
// +kubebuilder:validation:MaxItems=8
170+
// +optional
171+
CACertificateRefs []gwapiv1.LocalObjectReference `json:"caCertificateRefs,omitempty"`
172+
173+
// WellKnownCACertificates specifies whether system CA certificates may be used in
174+
// the TLS handshake between the gateway and backend pod.
175+
//
176+
// If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
177+
// must be specified with at least one entry for a valid configuration. Only one of
178+
// CACertificateRefs or WellKnownCACertificates may be specified, not both.
179+
//
180+
// +optional
181+
WellKnownCACertificates *gwapiv1a3.WellKnownCACertificatesType `json:"wellKnownCACertificates,omitempty"`
144182
}
145183

146184
// BackendType defines the type of the Backend.

‎api/v1alpha1/backendtrafficpolicy_types.go

+2-3
Original file line numberDiff line numberDiff line change
@@ -100,16 +100,15 @@ type BackendTrafficPolicySpec struct {
100100
// +notImplementedHide
101101
// +optional
102102
RequestBuffer *RequestBuffer `json:"requestBuffer,omitempty"`
103-
// Telemetry configures the telemetry settings for the backend or backend.
103+
// Telemetry configures the telemetry settings for the policy target (Gateway or xRoute).
104104
// This will override the telemetry settings in the EnvoyProxy resource.
105105
//
106-
// +notImplementedHide
107106
// +optional
108107
Telemetry *BackendTelemetry `json:"telemetry,omitempty"`
109108
}
110109

111110
type BackendTelemetry struct {
112-
// Tracing configures the tracing settings for the backend.
111+
// Tracing configures the tracing settings for the backend or HTTPRoute.
113112
//
114113
// +optional
115114
Tracing *Tracing `json:"tracing,omitempty"`

‎api/v1alpha1/envoygateway_types.go

+7-5
Original file line numberDiff line numberDiff line change
@@ -501,13 +501,15 @@ type ExtensionManager struct {
501501
Service *ExtensionService `json:"service,omitempty"`
502502

503503
// FailOpen defines if Envoy Gateway should ignore errors returned from the Extension Service hooks.
504-
// The default is false, which means Envoy Gateway will fail closed if the Extension Service returns an error.
505504
//
506-
// Fail-close means that if the Extension Service hooks return an error, the relevant route/listener/resource
507-
// will be replaced with a default configuration returning Internal Server Error (HTTP 500).
505+
// When set to false, Envoy Gateway does not ignore extension Service hook errors. As a result,
506+
// xDS updates are skipped for the relevant envoy proxy fleet and the previous state is preserved.
508507
//
509-
// Fail-open means that if the Extension Service hooks return an error, no changes will be applied to the
510-
// source of the configuration which was sent to the extension server.
508+
// When set to true, if the Extension Service hooks return an error, no changes will be applied to the
509+
// source of the configuration which was sent to the extension server. The errors are ignored and the resulting
510+
// xDS configuration is updated in the xDS snapshot.
511+
//
512+
// Default: false
511513
//
512514
// +optional
513515
FailOpen bool `json:"failOpen,omitempty"`

‎api/v1alpha1/zz_generated.deepcopy.go

+31
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/gateway-crds-helm/templates/gatewayapi-crds.yaml

+15-15
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ kind: CustomResourceDefinition
2525
metadata:
2626
annotations:
2727
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
28-
gateway.networking.k8s.io/bundle-version: v1.3.0-rc.2
28+
gateway.networking.k8s.io/bundle-version: v1.3.0
2929
gateway.networking.k8s.io/channel: experimental
3030
creationTimestamp: null
3131
labels:
@@ -676,7 +676,7 @@ kind: CustomResourceDefinition
676676
metadata:
677677
annotations:
678678
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
679-
gateway.networking.k8s.io/bundle-version: v1.3.0-rc.2
679+
gateway.networking.k8s.io/bundle-version: v1.3.0
680680
gateway.networking.k8s.io/channel: experimental
681681
creationTimestamp: null
682682
name: gatewayclasses.gateway.networking.k8s.io
@@ -1196,7 +1196,7 @@ kind: CustomResourceDefinition
11961196
metadata:
11971197
annotations:
11981198
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
1199-
gateway.networking.k8s.io/bundle-version: v1.3.0-rc.2
1199+
gateway.networking.k8s.io/bundle-version: v1.3.0
12001200
gateway.networking.k8s.io/channel: experimental
12011201
creationTimestamp: null
12021202
name: gateways.gateway.networking.k8s.io
@@ -3904,7 +3904,7 @@ kind: CustomResourceDefinition
39043904
metadata:
39053905
annotations:
39063906
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
3907-
gateway.networking.k8s.io/bundle-version: v1.3.0-rc.2
3907+
gateway.networking.k8s.io/bundle-version: v1.3.0
39083908
gateway.networking.k8s.io/channel: experimental
39093909
creationTimestamp: null
39103910
name: grpcroutes.gateway.networking.k8s.io
@@ -6125,7 +6125,7 @@ kind: CustomResourceDefinition
61256125
metadata:
61266126
annotations:
61276127
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
6128-
gateway.networking.k8s.io/bundle-version: v1.3.0-rc.2
6128+
gateway.networking.k8s.io/bundle-version: v1.3.0
61296129
gateway.networking.k8s.io/channel: experimental
61306130
creationTimestamp: null
61316131
name: httproutes.gateway.networking.k8s.io
@@ -13407,7 +13407,7 @@ kind: CustomResourceDefinition
1340713407
metadata:
1340813408
annotations:
1340913409
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
13410-
gateway.networking.k8s.io/bundle-version: v1.3.0-rc.2
13410+
gateway.networking.k8s.io/bundle-version: v1.3.0
1341113411
gateway.networking.k8s.io/channel: experimental
1341213412
creationTimestamp: null
1341313413
name: referencegrants.gateway.networking.k8s.io
@@ -13600,7 +13600,7 @@ kind: CustomResourceDefinition
1360013600
metadata:
1360113601
annotations:
1360213602
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
13603-
gateway.networking.k8s.io/bundle-version: v1.3.0-rc.2
13603+
gateway.networking.k8s.io/bundle-version: v1.3.0
1360413604
gateway.networking.k8s.io/channel: experimental
1360513605
creationTimestamp: null
1360613606
name: tcproutes.gateway.networking.k8s.io
@@ -14336,7 +14336,7 @@ kind: CustomResourceDefinition
1433614336
metadata:
1433714337
annotations:
1433814338
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
14339-
gateway.networking.k8s.io/bundle-version: v1.3.0-rc.2
14339+
gateway.networking.k8s.io/bundle-version: v1.3.0
1434014340
gateway.networking.k8s.io/channel: experimental
1434114341
creationTimestamp: null
1434214342
name: tlsroutes.gateway.networking.k8s.io
@@ -15135,7 +15135,7 @@ kind: CustomResourceDefinition
1513515135
metadata:
1513615136
annotations:
1513715137
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
15138-
gateway.networking.k8s.io/bundle-version: v1.3.0-rc.2
15138+
gateway.networking.k8s.io/bundle-version: v1.3.0
1513915139
gateway.networking.k8s.io/channel: experimental
1514015140
creationTimestamp: null
1514115141
name: udproutes.gateway.networking.k8s.io
@@ -15871,7 +15871,7 @@ kind: CustomResourceDefinition
1587115871
metadata:
1587215872
annotations:
1587315873
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
15874-
gateway.networking.k8s.io/bundle-version: v1.3.0-rc.2
15874+
gateway.networking.k8s.io/bundle-version: v1.3.0
1587515875
gateway.networking.k8s.io/channel: experimental
1587615876
creationTimestamp: null
1587715877
labels:
@@ -15962,21 +15962,21 @@ spec:
1596215962
interval:
1596315963
default: 10s
1596415964
description: |-
15965-
BudgetInterval defines the duration in which requests will be considered
15965+
Interval defines the duration in which requests will be considered
1596615966
for calculating the budget for retries.
1596715967

1596815968
Support: Extended
1596915969
pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
1597015970
type: string
1597115971
x-kubernetes-validations:
15972-
- message: budgetInterval can not be greater than one hour
15973-
or less than one second
15972+
- message: interval can not be greater than one hour or less
15973+
than one second
1597415974
rule: '!(duration(self) < duration(''1s'') || duration(self)
1597515975
> duration(''1h''))'
1597615976
percent:
1597715977
default: 20
1597815978
description: |-
15979-
BudgetPercent defines the maximum percentage of active requests that may
15979+
Percent defines the maximum percentage of active requests that may
1598015980
be made up of retries.
1598115981

1598215982
Support: Extended
@@ -16480,7 +16480,7 @@ kind: CustomResourceDefinition
1648016480
metadata:
1648116481
annotations:
1648216482
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
16483-
gateway.networking.k8s.io/bundle-version: v1.3.0-rc.2
16483+
gateway.networking.k8s.io/bundle-version: v1.3.0
1648416484
gateway.networking.k8s.io/channel: experimental
1648516485
creationTimestamp: null
1648616486
name: xlistenersets.gateway.networking.x-k8s.io

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backends.yaml

+66
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,72 @@ spec:
147147
The overprovisioning factor is set to 1.4, meaning the fallback backends will only start receiving traffic when
148148
the health of the active backends falls below 72%.
149149
type: boolean
150+
tls:
151+
description: |-
152+
TLS defines the TLS settings for the backend.
153+
Only supported for DynamicResolver backends.
154+
properties:
155+
caCertificateRefs:
156+
description: |-
157+
CACertificateRefs contains one or more references to Kubernetes objects that
158+
contain TLS certificates of the Certificate Authorities that can be used
159+
as a trust anchor to validate the certificates presented by the backend.
160+
161+
A single reference to a Kubernetes ConfigMap or a Kubernetes Secret,
162+
with the CA certificate in a key named `ca.crt` is currently supported.
163+
164+
If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
165+
specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
166+
not both.
167+
items:
168+
description: |-
169+
LocalObjectReference identifies an API object within the namespace of the
170+
referrer.
171+
The API object must be valid in the cluster; the Group and Kind must
172+
be registered in the cluster for this reference to be valid.
173+
174+
References to objects with invalid Group and Kind are not valid, and must
175+
be rejected by the implementation, with appropriate Conditions set
176+
on the containing object.
177+
properties:
178+
group:
179+
description: |-
180+
Group is the group of the referent. For example, "gateway.networking.k8s.io".
181+
When unspecified or empty string, core API group is inferred.
182+
maxLength: 253
183+
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
184+
type: string
185+
kind:
186+
description: Kind is kind of the referent. For example "HTTPRoute"
187+
or "Service".
188+
maxLength: 63
189+
minLength: 1
190+
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
191+
type: string
192+
name:
193+
description: Name is the name of the referent.
194+
maxLength: 253
195+
minLength: 1
196+
type: string
197+
required:
198+
- group
199+
- kind
200+
- name
201+
type: object
202+
maxItems: 8
203+
type: array
204+
wellKnownCACertificates:
205+
description: |-
206+
WellKnownCACertificates specifies whether system CA certificates may be used in
207+
the TLS handshake between the gateway and backend pod.
208+
209+
If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
210+
must be specified with at least one entry for a valid configuration. Only one of
211+
CACertificateRefs or WellKnownCACertificates may be specified, not both.
212+
enum:
213+
- System
214+
type: string
215+
type: object
150216
type:
151217
default: Endpoints
152218
description: Type defines the type of the backend. Defaults to "Endpoints"

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1669,11 +1669,12 @@ spec:
16691669
type: object
16701670
telemetry:
16711671
description: |-
1672-
Telemetry configures the telemetry settings for the backend or backend.
1672+
Telemetry configures the telemetry settings for the policy target (Gateway or xRoute).
16731673
This will override the telemetry settings in the EnvoyProxy resource.
16741674
properties:
16751675
tracing:
1676-
description: Tracing configures the tracing settings for the backend.
1676+
description: Tracing configures the tracing settings for the backend
1677+
or HTTPRoute.
16771678
properties:
16781679
customTags:
16791680
additionalProperties:

0 commit comments

Comments
 (0)