Skip to content

Commit 791c42c

Browse files
Merge remote-tracking branch 'upstream/main' into fix/node-port-gateway-dualstack
2 parents da6ea53 + e97b0e6 commit 791c42c

File tree

567 files changed

+47631
-1150
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

567 files changed

+47631
-1150
lines changed

.github/workflows/build_and_test.yaml

Lines changed: 16 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -86,20 +86,20 @@ jobs:
8686
fail-fast: false
8787
matrix:
8888
target:
89-
- version: v1.30.10
89+
- version: v1.30.13
9090
ipFamily: ipv4
9191
profile: default
92-
- version: v1.31.6
92+
- version: v1.31.9
9393
ipFamily: ipv4
9494
profile: default
95-
- version: v1.32.3
95+
- version: v1.32.5
9696
ipFamily: ipv6 # only run ipv6 test on this version to save time
9797
profile: default
9898
# TODO: this's IPv4 first, need a way to test IPv6 first.
99-
- version: v1.33.0
99+
- version: v1.33.1
100100
ipFamily: dual # only run dual test on latest version to save time
101101
profile: default
102-
- version: v1.33.0
102+
- version: v1.33.1
103103
ipFamily: dual # only run dual test on latest version to save time
104104
profile: gateway-namespace-mode
105105
steps:
@@ -133,27 +133,22 @@ jobs:
133133
fail-fast: false
134134
matrix:
135135
target:
136-
- version: v1.30.10
136+
- version: v1.30.13
137137
ipFamily: ipv4
138138
profile: default
139-
loadQPS: 1000
140-
- version: v1.31.6
139+
- version: v1.31.9
141140
ipFamily: ipv4
142141
profile: default
143-
loadQPS: 2000
144-
- version: v1.32.3
142+
- version: v1.32.5
145143
ipFamily: ipv6 # only run ipv6 test on this version to save time
146144
profile: default
147-
loadQPS: 3000
148145
# TODO: this's IPv4 first, need a way to test IPv6 first.
149-
- version: v1.33.0
146+
- version: v1.33.1
150147
ipFamily: dual # only run dual test on latest version to save time
151148
profile: default
152-
loadQPS: 4000
153-
- version: v1.33.0
149+
- version: v1.33.1
154150
ipFamily: dual # only run dual test on latest version to save time
155151
profile: gateway-namespace-mode
156-
loadQPS: 5000
157152
steps:
158153
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
159154
- uses: ./tools/github-actions/setup-deps
@@ -177,10 +172,13 @@ jobs:
177172
IP_FAMILY: ${{ matrix.target.ipFamily }}
178173
KUBE_DEPLOY_PROFILE: ${{ matrix.target.profile }}
179174
E2E_TIMEOUT: 1h
180-
# use the loadQPS from the matrix to set the QPS for the E2E tests
181-
# this is used to determine whether the flaky tests are due to load or not
182-
E2E_BACKEND_UPGRADE_QPS: ${{ matrix.target.loadQPS }}
183175
NUM_WORKERS: 2
176+
# QPS more than 3000 may cause e2e flaky test.
177+
# This is not the limit of Envoy Gateway,
178+
# but the limit of running e2e tests in github CI.
179+
E2E_BACKEND_UPGRADE_QPS: "3000"
180+
# Cluster trust bundle reach beta in v1.33, so we can enable it for v1.33 and later.
181+
ENABLE_CLUSTER_TRUST_BUNDLE: ${{ startsWith(matrix.target.version, 'v1.33') }}
184182
run: make e2e
185183

186184
benchmark-test:

.github/workflows/codeql.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,14 +36,14 @@ jobs:
3636
- uses: ./tools/github-actions/setup-deps
3737

3838
- name: Initialize CodeQL
39-
uses: github/codeql-action/init@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
39+
uses: github/codeql-action/init@39edc492dbe16b1465b0cafca41432d857bdb31a # v3.29.1
4040
with:
4141
languages: ${{ matrix.language }}
4242

4343
- name: Autobuild
44-
uses: github/codeql-action/autobuild@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
44+
uses: github/codeql-action/autobuild@39edc492dbe16b1465b0cafca41432d857bdb31a # v3.29.1
4545

4646
- name: Perform CodeQL Analysis
47-
uses: github/codeql-action/analyze@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
47+
uses: github/codeql-action/analyze@39edc492dbe16b1465b0cafca41432d857bdb31a # v3.29.1
4848
with:
4949
category: "/language:${{matrix.language}}"

.github/workflows/experimental_conformance.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,22 +23,22 @@ jobs:
2323
strategy:
2424
matrix:
2525
target:
26-
- version: v1.30.10
26+
- version: v1.30.13
2727
ipFamily: ipv4
2828
profile: default
29-
- version: v1.31.6
29+
- version: v1.31.9
3030
ipFamily: ipv4
3131
profile: default
32-
- version: v1.32.3
32+
- version: v1.32.5
3333
# only run ipv6 test on this version to save time
3434
ipFamily: ipv6
3535
profile: default
3636
# TODO: this's IPv4 first, need a way to test IPv6 first.
37-
- version: v1.33.0
37+
- version: v1.33.1
3838
# only run dual test on latest version to save time
3939
ipFamily: dual
4040
profile: default
41-
- version: v1.33.0
41+
- version: v1.33.1
4242
# only run dual test on latest version to save time
4343
ipFamily: dual
4444
profile: gateway-namespace-mode

.github/workflows/scorecard.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,6 @@ jobs:
4040
retention-days: 5
4141

4242
- name: "Upload to code-scanning"
43-
uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
43+
uses: github/codeql-action/upload-sarif@39edc492dbe16b1465b0cafca41432d857bdb31a # v3.29.1
4444
with:
4545
sarif_file: results.sarif

VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
v1.4.1
1+
v1.4.2

api/v1alpha1/connection_types.go

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,12 +39,11 @@ type ClientConnection struct {
3939

4040
// MaxAcceptPerSocketEvent provides configuration for the maximum number of connections to accept from the kernel
4141
// per socket event. If there are more than MaxAcceptPerSocketEvent connections pending accept, connections over
42-
// this threshold will be accepted in later event loop iterations. If no value is provided Envoy will accept
43-
// all connections pending accept from the kernel.
44-
// It is recommended to lower this value for better overload management and reduced per-event cost.
45-
// Setting it to 1 is a viable option with no noticeable impact on performance.
42+
// this threshold will be accepted in later event loop iterations.
43+
// Defaults to 1 and can be disabled by setting to 0 for allowing unlimited accepted connections.
4644
//
4745
// +optional
46+
// +kubebuilder:default=1
4847
MaxAcceptPerSocketEvent *uint32 `json:"maxAcceptPerSocketEvent,omitempty"`
4948
}
5049

api/v1alpha1/envoygateway_types.go

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -505,6 +505,7 @@ type RedisTLSSettings struct {
505505
// RateLimitRedisSettings defines the configuration for connecting to redis database.
506506
type RateLimitRedisSettings struct {
507507
// URL of the Redis Database.
508+
// This can reference a single Redis host or a comma delimited list for Sentinel and Cluster deployments of Redis.
508509
URL string `json:"url"`
509510

510511
// TLS defines TLS configuration for connecting to redis database.
@@ -528,6 +529,14 @@ type ExtensionManager struct {
528529
// +optional
529530
PolicyResources []GroupVersionKind `json:"policyResources,omitempty"`
530531

532+
// BackendResources defines the set of K8s resources the extension will handle as
533+
// custom backendRef resources. These resources can be referenced in HTTPRoute
534+
// backendRefs to enable support for custom backend types (e.g., S3, Lambda, etc.)
535+
// that are not natively supported by Envoy Gateway.
536+
//
537+
// +optional
538+
BackendResources []GroupVersionKind `json:"backendResources,omitempty"`
539+
531540
// Hooks defines the set of hooks the extension supports
532541
//
533542
// +kubebuilder:validation:Required

api/v1alpha1/loadbalancer_types.go

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1212
//
1313
// +kubebuilder:validation:XValidation:rule="self.type == 'ConsistentHash' ? has(self.consistentHash) : !has(self.consistentHash)",message="If LoadBalancer type is consistentHash, consistentHash field needs to be set."
1414
// +kubebuilder:validation:XValidation:rule="self.type in ['Random', 'ConsistentHash'] ? !has(self.slowStart) : true ",message="Currently SlowStart is only supported for RoundRobin and LeastRequest load balancers."
15+
// +kubebuilder:validation:XValidation:rule="self.type == 'ConsistentHash' ? !has(self.zoneAware) : true ",message="Currently ZoneAware is only supported for LeastRequest, Random, and RoundRobin load balancers."
1516
type LoadBalancer struct {
1617
// Type decides the type of Load Balancer policy.
1718
// Valid LoadBalancerType values are
@@ -34,6 +35,12 @@ type LoadBalancer struct {
3435
//
3536
// +optional
3637
SlowStart *SlowStart `json:"slowStart,omitempty"`
38+
39+
// ZoneAware defines the configuration related to the distribution of requests between locality zones.
40+
//
41+
// +optional
42+
// +notImplementedHide
43+
ZoneAware *ZoneAware `json:"zoneAware,omitempty"`
3744
}
3845

3946
// LoadBalancerType specifies the types of LoadBalancer.
@@ -135,3 +142,39 @@ type SlowStart struct {
135142
Window *metav1.Duration `json:"window"`
136143
// TODO: Add support for non-linear traffic increases based on user usage.
137144
}
145+
146+
// ZoneAware defines the configuration related to the distribution of requests between locality zones.
147+
type ZoneAware struct {
148+
// PreferLocalZone configures zone-aware routing to prefer sending traffic to the local locality zone.
149+
//
150+
// +optional
151+
// +notImplementedHide
152+
PreferLocal *PreferLocalZone `json:"preferLocal,omitempty"`
153+
}
154+
155+
// PreferLocalZone configures zone-aware routing to prefer sending traffic to the local locality zone.
156+
type PreferLocalZone struct {
157+
// ForceLocalZone defines override configuration for forcing all traffic to stay within the local zone instead of the default behavior
158+
// which maintains equal distribution among upstream endpoints while sending as much traffic as possible locally.
159+
//
160+
// +optional
161+
// +notImplementedHide
162+
Force *ForceLocalZone `json:"force,omitempty"`
163+
164+
// MinEndpointsThreshold is the minimum number of total upstream endpoints across all zones required to enable zone-aware routing.
165+
//
166+
// +optional
167+
// +notImplementedHide
168+
MinEndpointsThreshold *uint64 `json:"minEndpointsThreshold,omitempty"`
169+
}
170+
171+
// ForceLocalZone defines override configuration for forcing all traffic to stay within the local zone instead of the default behavior
172+
// which maintains equal distribution among upstream endpoints while sending as much traffic as possible locally.
173+
type ForceLocalZone struct {
174+
// MinEndpointsInZoneThreshold is the minimum number of upstream endpoints in the local zone required to honor the forceLocalZone
175+
// override. This is useful for protecting zones with fewer endpoints.
176+
//
177+
// +optional
178+
// +notImplementedHide
179+
MinEndpointsInZoneThreshold *uint32 `json:"minEndpointsInZoneThreshold,omitempty"`
180+
}

api/v1alpha1/oidc_types.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,13 @@ type OIDCProvider struct {
162162
//
163163
// +optional
164164
TokenEndpoint *string `json:"tokenEndpoint,omitempty"`
165+
166+
// The OIDC Provider's [end session endpoint](https://openid.net/specs/openid-connect-core-1_0.html#RPLogout).
167+
//
168+
// If the end session endpoint is provided, EG will use it to log out the user from the OIDC Provider when the user accesses the logout path.
169+
// EG will also try to discover the end session endpoint from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse) when authorizationEndpoint or tokenEndpoint is not provided.
170+
// +optional
171+
EndSessionEndpoint *string `json:"endSessionEndpoint,omitempty"`
165172
}
166173

167174
// OIDCDenyRedirect defines headers to match against the request to deny redirect to the OIDC Provider.

api/v1alpha1/shared_types.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -231,13 +231,15 @@ type KubernetesContainerSpec struct {
231231
// Image specifies the EnvoyProxy container image to be used including a tag, instead of the default image.
232232
// This field is mutually exclusive with ImageRepository.
233233
//
234+
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._/-]+:[a-zA-Z0-9._-]+$')",message="Image must include a tag and allowed characters only (e.g., 'repo:tag')."
234235
// +optional
235236
Image *string `json:"image,omitempty"`
236237

237238
// ImageRepository specifies the container image repository to be used without specifying a tag.
238239
// The default tag will be used.
239240
// This field is mutually exclusive with Image.
240241
//
242+
// +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._/-]+$')",message="ImageRepository must contain only allowed characters and must not include a tag or any colons."
241243
// +optional
242244
ImageRepository *string `json:"imageRepository,omitempty"`
243245

@@ -385,14 +387,15 @@ const (
385387
// XDSTranslatorHook defines the types of hooks that an Envoy Gateway extension may support
386388
// for the xds-translator
387389
//
388-
// +kubebuilder:validation:Enum=VirtualHost;Route;HTTPListener;Translation
390+
// +kubebuilder:validation:Enum=VirtualHost;Route;HTTPListener;Translation;Cluster
389391
type XDSTranslatorHook string
390392

391393
const (
392394
XDSVirtualHost XDSTranslatorHook = "VirtualHost"
393395
XDSRoute XDSTranslatorHook = "Route"
394396
XDSHTTPListener XDSTranslatorHook = "HTTPListener"
395397
XDSTranslation XDSTranslatorHook = "Translation"
398+
XDSCluster XDSTranslatorHook = "Cluster"
396399
)
397400

398401
// StringMatch defines how to match any strings.

0 commit comments

Comments
 (0)