envoyproxy
diff --git a/‎.github/workflows/build_and_test.yaml‎
Lines changed: 1 addition & 1 deletion b/‎.github/workflows/build_and_test.yaml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎.github/workflows/release.yaml‎
Lines changed: 5 additions & 3 deletions b/‎.github/workflows/release.yaml‎
Lines changed: 5 additions & 3 deletions
diff --git a/‎VERSION‎
Lines changed: 1 addition & 1 deletion b/‎VERSION‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎api/v1alpha1/envoygateway_types.go‎
Lines changed: 8 additions & 0 deletions b/‎api/v1alpha1/envoygateway_types.go‎
Lines changed: 8 additions & 0 deletions
diff --git a/‎go.mod‎
Lines changed: 2 additions & 2 deletions b/‎go.mod‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎go.sum‎
Lines changed: 4 additions & 5 deletions b/‎go.sum‎
Lines changed: 4 additions & 5 deletions
diff --git a/‎internal/cmd/server.go‎
Lines changed: 3 additions & 1 deletion b/‎internal/cmd/server.go‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎internal/gatewayapi/backend.go‎
Lines changed: 23 additions & 15 deletions b/‎internal/gatewayapi/backend.go‎
Lines changed: 23 additions & 15 deletions
diff --git a/‎internal/gatewayapi/backend_test.go‎
Lines changed: 100 additions & 0 deletions b/‎internal/gatewayapi/backend_test.go‎
Lines changed: 100 additions & 0 deletions
diff --git a/‎internal/gatewayapi/backendtrafficpolicy.go‎
Lines changed: 32 additions & 1 deletion b/‎internal/gatewayapi/backendtrafficpolicy.go‎
Lines changed: 32 additions & 1 deletion
@@ -274,7 +274,7 @@ jobs:
 
   resilience-test:
     runs-on: ubuntu-latest
-    if: ${{ ! (startsWith(github.event_name, 'push') && needs.changes.outputs.skip_test_workflow != 'true') }}
+    if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.run_test_workflow == 'true' }}
     needs:
     - build
     - changes
 
@@ -60,9 +60,11 @@ jobs:
         id: vars
         shell: bash
         run: |
-          echo "release_tag=$(echo ${GITHUB_REF##*/})" >> $GITHUB_ENV
-          echo "without_v_release_tag=$(echo ${GITHUB_REF##*/v})" >> $GITHUB_ENV
-          echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+          {
+            echo "release_tag=${GITHUB_REF##*/}"
+            echo "without_v_release_tag=${GITHUB_REF##*/v}"
+            echo "sha_short=$(git rev-parse --short HEAD)"
+          } >> "$GITHUB_ENV"
 
       - name: Login to DockerHub
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef  # v3.6.0
 
@@ -1 +1 @@
-v1.7.0-rc.1
+v1.7.0-rc.2
@@ -91,6 +91,10 @@ type EnvoyGatewaySpec struct {
 
 	// ExtensionManager defines an extension manager to register for the Envoy Gateway Control Plane.
 	//
+	// Warning: Enabling an Extension Server may lead to complete security compromise of your system.
+	// Users that control the Extension Server can inject arbitrary configuration to proxies,
+	// leading to high Confidentiality, Integrity and Availability risks.
+	//
 	// +optional
 	ExtensionManager *ExtensionManager `json:"extensionManager,omitempty"`
 
@@ -300,6 +304,10 @@ type Gateway struct {
 type ExtensionAPISettings struct {
 	// EnableEnvoyPatchPolicy enables Envoy Gateway to
 	// reconcile and implement the EnvoyPatchPolicy resources.
+	//
+	// Warning: Enabling `EnvoyPatchPolicy` may lead to complete security compromise of your system.
+	// Users with `EnvoyPatchPolicy` permissions can inject arbitrary configuration to proxies,
+	// leading to high Confidentiality, Integrity and Availability risks.
 	EnableEnvoyPatchPolicy bool `json:"enableEnvoyPatchPolicy"`
 	// EnableBackend enables Envoy Gateway to
 	// reconcile and implement the Backend resources.
 
@@ -48,7 +48,7 @@ require (
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
 	github.com/telepresenceio/watchable v0.0.0-20220726211108-9bb86f92afa7
-	github.com/tetratelabs/func-e v1.3.0
+	github.com/tetratelabs/func-e v1.4.0
 	github.com/tsaarni/certyaml v0.10.0
 	github.com/yuin/gopher-lua v1.1.1
 	go.opentelemetry.io/otel v1.39.0
@@ -207,7 +207,7 @@ require (
 	github.com/lib/pq v1.10.9 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
 	github.com/longhorn/go-iscsi-helper v0.0.0-20210330030558-49a327fb024e // indirect
-	github.com/lufia/plan9stats v0.0.0-20220913051719-115f729f3c8c // indirect
+	github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect
 	github.com/lyft/gostats v0.4.1 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 
@@ -302,7 +302,6 @@ github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7O
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-containerregistry v0.20.6 h1:cvWX87UxxLgaH76b4hIvya6Dzz9qHB31qAwjAohdSTU=
@@ -403,8 +402,8 @@ github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9
 github.com/longhorn/go-iscsi-helper v0.0.0-20210330030558-49a327fb024e h1:hz4quJkaJWDo+xW+G6wTF6d6/95QvJ+o2D0+bB/tJ1U=
 github.com/longhorn/go-iscsi-helper v0.0.0-20210330030558-49a327fb024e/go.mod h1:9z/y9glKmWEdV50tjlUPxFwi1goQfIrrsoZbnMyIZbY=
 github.com/longhorn/nsfilelock v0.0.0-20200723175406-fa7c83ad0003/go.mod h1:0CLeXlf59Lg6C0kjLSDf47ft73Dh37CwymYRKWwAn04=
-github.com/lufia/plan9stats v0.0.0-20220913051719-115f729f3c8c h1:VtwQ41oftZwlMnOEbMWQtSEUgU64U4s+GHk7hZK+jtY=
-github.com/lufia/plan9stats v0.0.0-20220913051719-115f729f3c8c/go.mod h1:JKx41uQRwqlTZabZc+kILPrO/3jlKnQ2Z8b7YiVw5cE=
+github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 h1:PwQumkgq4/acIiZhtifTV5OUqqiP82UAl0h87xj/l9k=
+github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
 github.com/lyft/gostats v0.4.1 h1:oR6p4HRCGxt0nUntmZIWmYMgyothBi3eZH2A71vRjsc=
 github.com/lyft/gostats v0.4.1/go.mod h1:Tpx2xRzz4t+T2Tx0xdVgIoBdR2UMVz+dKnE3X01XSd8=
 github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
@@ -614,8 +613,8 @@ github.com/telepresenceio/telepresence/rpc/v2 v2.6.8 h1:q5V85LBT9bA/c4YPa/kMvJGy
 github.com/telepresenceio/telepresence/rpc/v2 v2.6.8/go.mod h1:VlgfRoXaW6Tl8IZbHmMWhITne8HY09/wOFtABHGj3ic=
 github.com/telepresenceio/watchable v0.0.0-20220726211108-9bb86f92afa7 h1:GMw3nEaOVyi+tNiGko5kAeRtoiEIpXNHmISyZ7fpw14=
 github.com/telepresenceio/watchable v0.0.0-20220726211108-9bb86f92afa7/go.mod h1:ihJ97e2gsd8GuzFF/I3B1qcik3XZLpXjumQifXi8Slg=
-github.com/tetratelabs/func-e v1.3.0 h1:u6FS+ec2hs9vn+vX5X2GEB9JeqCajz/A4rvlsdktnQ4=
-github.com/tetratelabs/func-e v1.3.0/go.mod h1:zq1g5hXTBV3rNOXruLeMquQvZse0kscUSQg9NvkUz6U=
+github.com/tetratelabs/func-e v1.4.0 h1:eBu8RoGQIogjCNuX1lmbO8crRopvfcu7tQO82NVL+gA=
+github.com/tetratelabs/func-e v1.4.0/go.mod h1:q8/N//P0lY3hTuMKwWrfq4IXIUN5pCc2J+AsE74odxo=
 github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
 github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
 github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
 
@@ -54,7 +54,9 @@ func GetServerCommand(asyncErrHandler func(string, error)) *cobra.Command {
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			runnerErrors := &message.RunnerErrors{}
 			defer runnerErrors.Close()
-			go message.HandleSubscription(message.Metadata{Runner: "runner-errors", Message: message.RunnerErrorsMessageName},
+			go message.HandleSubscription(
+				logging.NewLogger(cmd.OutOrStdout(), egv1a1.DefaultEnvoyGatewayLogging()),
+				message.Metadata{Runner: "runner-errors", Message: message.RunnerErrorsMessageName},
 				runnerErrors.Subscribe(cmd.Context()),
 				func(update message.Update[string, message.WatchableError], _ chan error) {
 					if asyncErrHandler != nil {
 
@@ -17,7 +17,6 @@ import (
 
 	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
 	"github.com/envoyproxy/gateway/internal/gatewayapi/status"
-	"github.com/envoyproxy/gateway/internal/utils/net"
 )
 
 func (t *Translator) ProcessBackends(backends []*egv1a1.Backend, backendTLSPolicies []*gwapiv1.BackendTLSPolicy) []*egv1a1.Backend {
@@ -69,17 +68,9 @@ func validateBackend(backend *egv1a1.Backend, backendTLSPolicies []*gwapiv1.Back
 				return routeErr
 			}
 		} else if ep.IP != nil {
-			ip, err := netip.ParseAddr(ep.IP.Address)
-			if err != nil {
-				return status.NewRouteStatusError(
-					fmt.Errorf("IP address %s is invalid", ep.IP.Address),
-					status.RouteReasonInvalidAddress,
-				)
-			} else if ip.IsLoopback() && !runningOnHost {
-				return status.NewRouteStatusError(
-					fmt.Errorf("IP address %s in the loopback range is only supported when using the Host infrastructure", ep.IP.Address),
-					status.RouteReasonInvalidAddress,
-				)
+			routeErr := validateIP(ep.IP, runningOnHost)
+			if routeErr != nil {
+				return routeErr
 			}
 		}
 	}
@@ -170,16 +161,17 @@ func validateBackendTLSSettings(backend *egv1a1.Backend, backendTLSPolicies []*g
 	return nil
 }
 
-func validateHostname(hostname, typeName string, allowLocalhost bool) *status.RouteStatusError {
+func validateHostname(hostname, typeName string, runningOnHost bool) *status.RouteStatusError {
 	// must be a valid hostname
 	if errs := validation.IsDNS1123Subdomain(hostname); errs != nil {
 		return status.NewRouteStatusError(
 			fmt.Errorf("hostname %s is not a valid %s", hostname, typeName),
 			status.RouteReasonInvalidAddress,
 		)
 	}
-	isLocalHostname := allowLocalhost && hostname == net.DefaultLocalAddress
-	if !isLocalHostname && len(strings.Split(hostname, ".")) < 2 {
+	// Host mode is a dev configuration, so we do not enforce domain rules.
+	// Doing so would interfere with docker hostnames (e.g. "jaeger") or literal IPs.
+	if !runningOnHost && len(strings.Split(hostname, ".")) < 2 {
 		return status.NewRouteStatusError(
 			fmt.Errorf("hostname %s should be a domain with at least two segments separated by dots", hostname),
 			status.RouteReasonInvalidAddress,
@@ -195,3 +187,19 @@ func validateHostname(hostname, typeName string, allowLocalhost bool) *status.Ro
 
 	return nil
 }
+
+func validateIP(epIP *egv1a1.IPEndpoint, runningOnHost bool) status.Error {
+	ip, err := netip.ParseAddr(epIP.Address)
+	if err != nil {
+		return status.NewRouteStatusError(
+			fmt.Errorf("IP address %s is invalid", epIP.Address),
+			status.RouteReasonInvalidAddress,
+		)
+	} else if ip.IsLoopback() && !runningOnHost {
+		return status.NewRouteStatusError(
+			fmt.Errorf("IP address %s in the loopback range is only supported when using the Host infrastructure", epIP.Address),
+			status.RouteReasonInvalidAddress,
+		)
+	}
+	return nil
+}
@@ -0,0 +1,100 @@
+// Copyright Envoy Gateway Authors
+// SPDX-License-Identifier: Apache-2.0
+// The full text of the Apache license is available in the LICENSE file at
+// the root of the repo.
+
+package gatewayapi
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
+)
+
+func TestValidateHostnameRunningOnHost(t *testing.T) {
+	cases := []struct {
+		name          string
+		hostname      string
+		runningOnHost bool
+		expectedErr   string
+	}{
+		{
+			name:          "domain ok in any case",
+			hostname:      "httpbin.org",
+			runningOnHost: false,
+		},
+		{
+			name:          "single label not ok when in k8s",
+			hostname:      "otel-tui",
+			runningOnHost: false,
+			expectedErr:   "hostname otel-tui should be a domain with at least two segments separated by dots",
+		},
+		{
+			name:          "single label ok when running on host",
+			hostname:      "otel-tui",
+			runningOnHost: true,
+		},
+		{
+			name:          "IP not ok in any case",
+			hostname:      "127.0.0.1",
+			runningOnHost: true,
+			expectedErr:   "hostname 127.0.0.1 is an IP address",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validateHostname(tc.hostname, "hostname", tc.runningOnHost)
+			if tc.expectedErr == "" {
+				require.Nil(t, err)
+				return
+			}
+			require.EqualError(t, err, tc.expectedErr)
+		})
+	}
+}
+
+func TestValidateIPRunningOnHost(t *testing.T) {
+	cases := []struct {
+		name          string
+		address       string
+		runningOnHost bool
+		expectedErr   string
+	}{
+		{
+			name:          "address ok in any case",
+			address:       "10.0.0.1",
+			runningOnHost: false,
+		},
+		{
+			name:          "loopback not ok when in k8s",
+			address:       "127.0.0.1",
+			runningOnHost: false,
+			expectedErr:   "IP address 127.0.0.1 in the loopback range is only supported when using the Host infrastructure",
+		},
+		{
+			name:          "loopback ok when running on host",
+			address:       "127.0.0.1",
+			runningOnHost: true,
+		},
+		{
+			name:          "invalid IP not ok in any case",
+			address:       "300.0.0.1",
+			runningOnHost: true,
+			expectedErr:   "IP address 300.0.0.1 is invalid",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validateIP(&egv1a1.IPEndpoint{Address: tc.address}, tc.runningOnHost)
+			if tc.expectedErr == "" {
+				require.Nil(t, err)
+				return
+			}
+			require.EqualError(t, err, tc.expectedErr)
+		})
+	}
+}
@@ -952,10 +952,41 @@ func (t *Translator) buildTrafficFeatures(policy *egv1a1.BackendTrafficPolicy) (
 		RequestBuffer:     rb,
 		Compression:       cp,
 		HTTPUpgrade:       httpUpgrade,
-		Telemetry:         policy.Spec.Telemetry,
+		Telemetry:         buildBackendTelemetry(policy.Spec.Telemetry),
 	}, errs
 }
 
+func buildBackendTelemetry(telemetry *egv1a1.BackendTelemetry) *ir.BackendTelemetry {
+	if telemetry == nil {
+		return nil
+	}
+	return &ir.BackendTelemetry{
+		Tracing: buildBackendTracing(telemetry.Tracing),
+		Metrics: buildBackendMetrics(telemetry.Metrics),
+	}
+}
+
+func buildBackendTracing(tracing *egv1a1.Tracing) *ir.BackendTracing {
+	if tracing == nil {
+		return nil
+	}
+	return &ir.BackendTracing{
+		SamplingFraction: tracing.SamplingFraction,
+		CustomTags:       ir.CustomTagMapToSlice(tracing.CustomTags),
+		Tags:             ir.MapToSlice(tracing.Tags),
+		SpanName:         tracing.SpanName,
+	}
+}
+
+func buildBackendMetrics(metrics *egv1a1.BackendMetrics) *ir.BackendMetrics {
+	if metrics == nil {
+		return nil
+	}
+	return &ir.BackendMetrics{
+		RouteStatName: metrics.RouteStatName,
+	}
+}
+
 func (t *Translator) translateBackendTrafficPolicyForGateway(
 	policy *egv1a1.BackendTrafficPolicy, target gwapiv1.LocalPolicyTargetReferenceWithSectionName,
 	gateway *GatewayContext, xdsIR resource.XdsIRMap,