Skip to content

Commit da2aac9

Browse files
cnvergenceguydczhaohuabingdependabot[bot]jukie
authored
[release/v1.7] v1.7.0 cherrypick (#8190)
* chore(docs): Update Azure Entra link in OIDC guide (#8167) Update Azure Entra link in OIDC guide Signed-off-by: Guy Daich <guy.daich@sap.com> * fix: continue processing the remaining xDS with invalid EnvoyPatchPolicies (#8153) continue processing the remaining xDS with invalid EnvoyPatchPolicies Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * build(deps): bump the actions group across 1 directory with 2 updates (#8178) Bumps the actions group with 2 updates in the / directory: [docker/login-action](https://github.com/docker/login-action) and [github/codeql-action](https://github.com/github/codeql-action). Updates `docker/login-action` from 3.6.0 to 3.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@5e57cd1...c94ce9f) Updates `github/codeql-action` from 4.32.0 to 4.32.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b20883b...6bc82e0) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action dependency-version: 4.32.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Isaac Wilson <10012479+jukie@users.noreply.github.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: skip provision when IR Infra is invalid (#7754) * fix: do not trigger IR deletion when EnvoyProxy is invalid Signed-off-by: zirain <zirain2009@gmail.com> * add Invalid to ir.Infra Signed-off-by: zirain <zirain2009@gmail.com> * fix gen Signed-off-by: zirain <zirain2009@gmail.com> * add e2e Signed-off-by: zirain <zirain2009@gmail.com> * remove invalid Signed-off-by: zirain <zirain2009@gmail.com> * add comments Signed-off-by: zirain <zirain2009@gmail.com> * update Signed-off-by: zirain <zirain2009@gmail.com> * merge loop Signed-off-by: zirain <zirain2009@gmail.com> * move back Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * docs: add HTTP header and method based authentication task (#7990) * docs: add HTTP header and method based authentication task Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> * docs: replace api-key examples with user header Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> * docs: format header and method authentication examples Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> * docs: add header and method based authorization examples Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> --------- Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: Validation of XListenerSet certificateRefs (#8168) Previously, validateTerminateModeAndGetTLSSecrets would always use the namespace of the listener's gateway when verifying a cross-namespace ref. This meant that if the listener were from an XListenerSet, whether or not the Secret associated with the certificateRef was in the same namespace as the XListenerSet, it would not be permitted. Additionally, and relatedly, this fixes an issue where an XListenerSet could reference a Secret in the gateway's namespace without a ReferenceGrant being present. With this change we add a new GetNamespace() method to gatewayapi.ListenerContext which returns the listener's gateway's namespace for a listener added directly to the gateway, or the XListenerSet's namespace otherwise. This is similar to some of the other methods that were added to ListenerContext in support of XListenerSets. The new method is used when creating the `crossNamespaceFrom` to determine if the certificateRef is permitted. If the Secret and XListenerSet are in the same namespace, it is permitted. If that is not the case a ReferenceGrant from the XListenerSet to the Secret will be properly searched for. Signed-off-by: krishicks <kris@krishicks.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: Remove whitespace for nodeSelector in deployment YAML - helm chart change (#8185) Remove whitespace for nodeSelector in deployment YAML Signed-off-by: Jess Belliveau <jess.belliveau@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * [release/v1.7.0] release notes (#8188) Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> --------- Signed-off-by: Guy Daich <guy.daich@sap.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> Signed-off-by: krishicks <kris@krishicks.com> Signed-off-by: Jess Belliveau <jess.belliveau@gmail.com> Co-authored-by: Guy Daich <guy.daich@sap.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Isaac Wilson <10012479+jukie@users.noreply.github.com> Co-authored-by: zirain <zirain2009@gmail.com> Co-authored-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> Co-authored-by: krishicks <kris@krishicks.com> Co-authored-by: Jess Belliveau <jess.belliveau@gmail.com>
1 parent e55e154 commit da2aac9

59 files changed

Lines changed: 2550 additions & 204 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/build_and_test.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -308,7 +308,7 @@ jobs:
308308
# build and push image
309309
- name: Login to DockerHub
310310
if: github.event_name == 'push'
311-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
311+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
312312
with:
313313
username: ${{ vars.DOCKERHUB_USERNAME }}
314314
password: ${{ secrets.DOCKERHUB_PASSWORD }}

‎.github/workflows/codeql.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,14 +36,14 @@ jobs:
3636
- uses: ./tools/github-actions/setup-deps
3737

3838
- name: Initialize CodeQL
39-
uses: github/codeql-action/init@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v3.29.5
39+
uses: github/codeql-action/init@6bc82e05fd0ea64601dd4b465378bbcf57de0314 # v3.29.5
4040
with:
4141
languages: ${{ matrix.language }}
4242

4343
- name: Autobuild
44-
uses: github/codeql-action/autobuild@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v3.29.5
44+
uses: github/codeql-action/autobuild@6bc82e05fd0ea64601dd4b465378bbcf57de0314 # v3.29.5
4545

4646
- name: Perform CodeQL Analysis
47-
uses: github/codeql-action/analyze@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v3.29.5
47+
uses: github/codeql-action/analyze@6bc82e05fd0ea64601dd4b465378bbcf57de0314 # v3.29.5
4848
with:
4949
category: "/language:${{matrix.language}}"

‎.github/workflows/release.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ jobs:
6767
} >> "$GITHUB_ENV"
6868
6969
- name: Login to DockerHub
70-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
70+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
7171
with:
7272
username: ${{ vars.DOCKERHUB_USERNAME }}
7373
password: ${{ secrets.DOCKERHUB_PASSWORD }}

‎.github/workflows/scorecard.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,6 @@ jobs:
4040
retention-days: 5
4141

4242
- name: "Upload to code-scanning"
43-
uses: github/codeql-action/upload-sarif@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v3.29.5
43+
uses: github/codeql-action/upload-sarif@6bc82e05fd0ea64601dd4b465378bbcf57de0314 # v3.29.5
4444
with:
4545
sarif_file: results.sarif

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
v1.7.0-rc.2
1+
v1.7.0

‎charts/gateway-helm/templates/envoy-gateway-deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ spec:
3737
{{- end }}
3838
{{- with .Values.deployment.pod.nodeSelector }}
3939
nodeSelector:
40-
{{ toYaml . | nindent 8 }}
40+
{{- toYaml . | nindent 8 }}
4141
{{- end }}
4242
{{- with .Values.deployment.pod.topologySpreadConstraints }}
4343
topologySpreadConstraints:

‎internal/cmd/egctl/testdata/translate/out/invalid-envoyproxy.all.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,3 +41,58 @@ gatewayClass:
4141
reason: InvalidParameters
4242
status: "False"
4343
type: Accepted
44+
gateways:
45+
- apiVersion: gateway.networking.k8s.io/v1
46+
kind: Gateway
47+
metadata:
48+
name: eg
49+
namespace: default
50+
spec:
51+
gatewayClassName: eg
52+
listeners:
53+
- allowedRoutes:
54+
namespaces:
55+
from: Same
56+
name: tcp
57+
port: 1234
58+
protocol: TCP
59+
- allowedRoutes:
60+
namespaces:
61+
from: Same
62+
name: udp
63+
port: 1234
64+
protocol: UDP
65+
- allowedRoutes:
66+
namespaces:
67+
from: Same
68+
hostname: foo.com
69+
name: tls-passthrough
70+
port: 8443
71+
protocol: TLS
72+
tls:
73+
mode: Passthrough
74+
- allowedRoutes:
75+
kinds:
76+
- group: gateway.networking.k8s.io
77+
kind: HTTPRoute
78+
namespaces:
79+
from: Same
80+
name: http
81+
port: 80
82+
protocol: HTTP
83+
- allowedRoutes:
84+
kinds:
85+
- group: gateway.networking.k8s.io
86+
kind: GRPCRoute
87+
namespaces:
88+
from: Same
89+
name: grpc
90+
port: 8080
91+
protocol: HTTP
92+
status:
93+
conditions:
94+
- lastTransitionTime: null
95+
message: 'Invalid parametersRef:: dynamic_resources cannot be modified'
96+
reason: InvalidParameters
97+
status: "False"
98+
type: Accepted

‎internal/gatewayapi/contexts.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,13 @@ func (l *ListenerContext) IsReady() bool {
204204
return false
205205
}
206206

207+
func (l *ListenerContext) GetNamespace() string {
208+
if l.isFromXListenerSet() {
209+
return l.xListenerSet.Namespace
210+
}
211+
return l.gateway.Namespace
212+
}
213+
207214
func (l *ListenerContext) GetConditions() []metav1.Condition {
208215
if l.isFromXListenerSet() {
209216
return l.xListenerSet.Status.Listeners[l.xListenerSetStatusIdx].Conditions

‎internal/gatewayapi/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml‎

Lines changed: 38 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,41 @@ gatewayClass:
1919
reason: InvalidParameters
2020
status: "False"
2121
type: Accepted
22-
infraIR: {}
23-
xdsIR: {}
22+
gateways:
23+
- apiVersion: gateway.networking.k8s.io/v1
24+
kind: Gateway
25+
metadata:
26+
name: gateway-1
27+
namespace: envoy-gateway
28+
spec:
29+
gatewayClassName: envoy-gateway-class
30+
listeners:
31+
- allowedRoutes:
32+
namespaces:
33+
from: Same
34+
name: http
35+
port: 80
36+
protocol: HTTP
37+
status:
38+
conditions:
39+
- lastTransitionTime: null
40+
message: 'Invalid parametersRef:: [unable to configure access log when using
41+
File sink type but "file" field being empty, unable to configure access log
42+
when using OpenTelemetry sink type but "openTelemetry" field being empty]'
43+
reason: InvalidParameters
44+
status: "False"
45+
type: Accepted
46+
infraIR:
47+
envoy-gateway/gateway-1:
48+
proxy:
49+
metadata:
50+
labels:
51+
gateway.envoyproxy.io/owning-gateway-name: gateway-1
52+
gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
53+
ownerReference:
54+
kind: GatewayClass
55+
name: envoy-gateway-class
56+
name: envoy-gateway/gateway-1
57+
namespace: envoy-gateway-system
58+
xdsIR:
59+
envoy-gateway/gateway-1: {}

‎internal/gatewayapi/testdata/envoyproxy-for-gatewayclass.in.yaml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
gatewayClass:
2+
apiVersion: gateway.networking.k8s.io/v1
3+
kind: GatewayClass
4+
metadata:
5+
name: envoy-gateway-class
6+
spec:
7+
controllerName: gateway.envoyproxy.io/gatewayclass-controller
8+
parametersRef:
9+
group: gateway.envoyproxy.io
10+
kind: EnvoyProxy
11+
name: invalid
12+
namespace: envoy-gateway-system
13+
envoyProxyForGatewayClass:
14+
apiVersion: gateway.envoyproxy.io/v1alpha1
15+
kind: EnvoyProxy
16+
metadata:
17+
namespace: envoy-gateway
18+
name: invalid
19+
spec:
20+
telemetry:
21+
accessLog:
22+
settings:
23+
- format:
24+
type: Text
25+
text: |
26+
[%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
27+
sinks:
28+
- type: File
29+
- type: ALS
30+
- type: OpenTelemetry
31+
envoyProxiesForGateways:
32+
- apiVersion: gateway.envoyproxy.io/v1alpha1
33+
kind: EnvoyProxy
34+
metadata:
35+
namespace: envoy-gateway
36+
name: valid
37+
spec:
38+
telemetry:
39+
accessLog:
40+
settings:
41+
- format:
42+
type: Text
43+
text: |
44+
[%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
45+
sinks:
46+
- type: File
47+
file:
48+
path: /dev/stdout
49+
gateways:
50+
- apiVersion: gateway.networking.k8s.io/v1
51+
kind: Gateway
52+
metadata:
53+
namespace: envoy-gateway
54+
name: ep-from-gtw
55+
spec:
56+
gatewayClassName: envoy-gateway-class
57+
listeners:
58+
- name: http
59+
protocol: HTTP
60+
port: 80
61+
allowedRoutes:
62+
namespaces:
63+
from: Same
64+
infrastructure:
65+
parametersRef:
66+
group: gateway.envoyproxy.io
67+
kind: EnvoyProxy
68+
name: valid
69+
- apiVersion: gateway.networking.k8s.io/v1
70+
kind: Gateway
71+
metadata:
72+
namespace: envoy-gateway
73+
name: ep-from-gc
74+
spec:
75+
gatewayClassName: envoy-gateway-class
76+
listeners:
77+
- name: http
78+
protocol: HTTP
79+
port: 80
80+
allowedRoutes:
81+
namespaces:
82+
from: Same

0 commit comments

Comments
 (0)