Skip to content

fix: helm secrets rbac for gateway namespace with watch list of namespaces#8706

Merged
rudrakhp merged 4 commits intoenvoyproxy:mainfrom
cnvergence:fix-gateway-ns-watch-rbac
Apr 15, 2026
Merged

fix: helm secrets rbac for gateway namespace with watch list of namespaces#8706
rudrakhp merged 4 commits intoenvoyproxy:mainfrom
cnvergence:fix-gateway-ns-watch-rbac

Conversation

@cnvergence
Copy link
Copy Markdown
Member

@cnvergence cnvergence commented Apr 9, 2026

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #8701

Release Notes: Yes/No

@cnvergence cnvergence requested a review from a team as a code owner April 9, 2026 18:50
@netlify
Copy link
Copy Markdown

netlify bot commented Apr 9, 2026 •
edited
Loading

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name Link
🔨 Latest commit d372650
🔍 Latest deploy log https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69d7f4f1aa03e400089599b3

@netlify
Copy link
Copy Markdown

netlify bot commented Apr 9, 2026 •
edited
Loading

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name Link
🔨 Latest commit 62031ec
🔍 Latest deploy log https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69df1a5d81ea2d00089ee209

@codecov
Copy link
Copy Markdown

codecov bot commented Apr 9, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.32%. Comparing base (beb9fec) to head (62031ec).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #8706      +/-   ##
==========================================
- Coverage   74.33%   74.32%   -0.01%     
==========================================
  Files         245      245              
  Lines       38801    38801              
==========================================
- Hits        28842    28840       -2     
- Misses       7957     7960       +3     
+ Partials     2002     2001       -1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

jukie
jukie reviewed Apr 9, 2026
View reviewed changes
Comment thread test/helm/gateway-helm/certgen-annotations.out.yaml
Copy link
Copy Markdown
Contributor

@jukie jukie Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this expected?

Copy link
Copy Markdown
Member

@zirain zirain Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it shouldn't happen, gen-check faild

Copy link
Copy Markdown
Member Author

@cnvergence cnvergence Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

old artifacts

@cnvergence cnvergence force-pushed the fix-gateway-ns-watch-rbac branch from b7c3b91 to 6175c77 Compare April 10, 2026 11:18
@zirain
Copy link
Copy Markdown
Member

zirain commented Apr 10, 2026

/retest

zirain
zirain previously approved these changes Apr 10, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@zirain zirain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, need to release notes to backport.

rudrakhp
rudrakhp previously approved these changes Apr 12, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@rudrakhp rudrakhp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@cnvergence can we add release notes?

arkodg
arkodg reviewed Apr 12, 2026
View reviewed changes
Comment thread charts/gateway-helm/templates/infra-manager-rbac.yaml Outdated
rules:
{{ include "eg.rbac.infra.basic" . }}
{{ if and (.Values.config.envoyGateway.provider.kubernetes) (.Values.config.envoyGateway.provider.kubernetes.watch) (.Values.config.envoyGateway.provider.kubernetes.deploy) (eq .Values.config.envoyGateway.provider.kubernetes.deploy.type "GatewayNamespace") (.Values.config.envoyGateway.provider.kubernetes.watch.namespaces) (gt (len .Values.config.envoyGateway.provider.kubernetes.watch.namespaces) 0) }}
{{ include "eg.rbac.namespaced.infra.secrets.read" . }}
Copy link
Copy Markdown
Contributor

@arkodg arkodg Apr 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: should it be called eg.rbac.controllerNamespace.secrets.read ?

Copy link
Copy Markdown
Member Author

@cnvergence cnvergence Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I was sort of out of names, we can change it to yours

@cnvergence cnvergence dismissed stale reviews from rudrakhp and zirain via 0d0455f April 14, 2026 08:27
@cnvergence cnvergence force-pushed the fix-gateway-ns-watch-rbac branch from a5f865b to 0d0455f Compare April 14, 2026 08:27
@cnvergence
fix: helm secrets rbac for gateway namespace with watch list of names…
80343fb 
…paces

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
@cnvergence
add release notes
80dece9 
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
@cnvergence cnvergence force-pushed the fix-gateway-ns-watch-rbac branch from 0d0455f to 80dece9 Compare April 14, 2026 08:28
@jukie
Copy link
Copy Markdown
Contributor

jukie commented Apr 14, 2026

/retest

@jukie
Copy link
Copy Markdown
Contributor

jukie commented Apr 14, 2026

I don't know why CI is stuck here

@jukie jukie closed this Apr 14, 2026
@jukie jukie reopened this Apr 14, 2026
@rudrakhp rudrakhp closed this Apr 14, 2026
@rudrakhp rudrakhp mentioned this pull request Apr 14, 2026
Closed
@rudrakhp rudrakhp reopened this Apr 14, 2026
@cnvergence
review update
15ff876 
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
@cnvergence cnvergence force-pushed the fix-gateway-ns-watch-rbac branch from fd61f7a to 15ff876 Compare April 14, 2026 17:34
@rudrakhp rudrakhp merged commit c48a346 into envoyproxy:main Apr 15, 2026
47 of 49 checks passed
rudrakhp added a commit to rudrakhp/gateway that referenced this pull request Apr 15, 2026
@cnvergence @rudrakhp
fix: helm secrets rbac for gateway namespace with watch list of names…
1dc59b4 
…paces (envoyproxy#8706)

* fix: helm secrets rbac for gateway namespace with watch list of namespaces

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* add release notes

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* review update

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

---------

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
rudrakhp added a commit that referenced this pull request Apr 16, 2026
@rudrakhp @felipesabadini
@jukie @cnvergence @zhaohuabing @aburanrbx @arkodg @stekole @kkk777-7
[release/v1.6] cherry-pick for v1.6.6 (#8761)
174c1d7 
* fix: avoid metric increments on no-op delete reconcile paths (#8480)

* fix: avoid metric increments on no-op delete reconcile paths

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>

* Update internal/infrastructure/kubernetes/infra_resource_test.go

Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>

* Update internal/infrastructure/kubernetes/infra_resource_test.go

Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>

---------

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>
Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: restore failure-path metric recording for delete and HPA reconcile (#8656)

Fixes #8651

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: helm secrets rbac for gateway namespace with watch list of namespaces (#8706)

* fix: helm secrets rbac for gateway namespace with watch list of namespaces

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* add release notes

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* review update

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

---------

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: handle network errors in rate limit e2e tests (#8446)

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: propagate the HTTPFilter translation errors to the outer layer (#7556)

* progate the HTTPFilter validation errors to the outer layer

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: return 500 error for invalid filters (#7605)

return 500 error for invalid filters

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: prevent configuring requestMirror filter and directResponse/RequestRedirect filter together (#7474)

* fix: prevent configuring RequestMirror and DirectResponse filters together

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

check redirect respose filter

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* address comments

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

* fix lint

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

---------

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix bug with grpcroute mirror filter (#8541)

* fix bug with grpcroute mirror filter

Signed-off-by: Adam Buran <aburan@roblox.com>

* add indexers test

Signed-off-by: Adam Buran <aburan@roblox.com>

* add release note

Signed-off-by: Adam Buran <aburan@roblox.com>

---------

Signed-off-by: Adam Buran <aburan@roblox.com>
Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: normalize CRLF line endings in htpasswd basic auth secrets (#8557)

Fixes #8554

Signed-off-by: stekole <stefan@sandnetworks.com>
Signed-off-by: stekole <30674956+stekole@users.noreply.github.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: status for mirror backend (#8675)

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: set HTTPRoute Accepted condition as true with mixed invalid and valid rules (#7625)

* set HTTPRoute Accepted condition as true with mixed invalid and valid rules

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* fix: basic auth validation (#8053)

* fix basic auth validation

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

* [release/v1.6] fix gen check

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

---------

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>
Signed-off-by: Adam Buran <aburan@roblox.com>
Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Signed-off-by: stekole <stefan@sandnetworks.com>
Signed-off-by: stekole <30674956+stekole@users.noreply.github.com>
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: Felipe Sabadini <fsabadini@hotmail.com>
Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
Co-authored-by: Karol Szwaj <karol.szwaj@gmail.com>
Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Co-authored-by: aburanrbx <aburan@roblox.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Co-authored-by: stekole <30674956+stekole@users.noreply.github.com>
Co-authored-by: Kota Kimura <86363983+kkk777-7@users.noreply.github.com>
@cnvergence cnvergence deleted the fix-gateway-ns-watch-rbac branch April 16, 2026 07:46
cnvergence added a commit to cnvergence/gateway that referenced this pull request Apr 16, 2026
@cnvergence @rudrakhp
fix: helm secrets rbac for gateway namespace with watch list of names…
60c3cf4 
…paces (envoyproxy#8706)

* fix: helm secrets rbac for gateway namespace with watch list of namespaces

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* add release notes

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* review update

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

---------

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
(cherry picked from commit c48a346)
cnvergence added a commit to cnvergence/gateway that referenced this pull request Apr 16, 2026
@cnvergence @rudrakhp
fix: helm secrets rbac for gateway namespace with watch list of names…
792e0e3 
…paces (envoyproxy#8706)

* fix: helm secrets rbac for gateway namespace with watch list of namespaces

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* add release notes

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* review update

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

---------

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
(cherry picked from commit c48a346)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
cnvergence added a commit that referenced this pull request Apr 16, 2026
@cnvergence @rudrakhp
@zirain @aburanrbx @arkodg @stekole @felipesabadini @jukie @codefromthecrypt @kkk777-7
[release/v1.7] cherry-pick for v1.7.2 (#8768)
005d80e 
* fix: handle network errors in rate limit e2e tests (#8446)

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
(cherry picked from commit b0638d5)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* refactor/perf: use LuaPerRoute instead of FilterConfig (#8355)

perf: use LuaPerRoute instead of FilterConfig

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
(cherry picked from commit f31ac4e)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: per-endpoint hostname override blocked by auto-generated wildcad host (#8565)

* fix: per-endpoint hostname override blocked by auto-generated wildcard host

Signed-off-by: zirain <zirain2009@gmail.com>

* add UT

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
(cherry picked from commit 595010a)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix bug with grpcroute mirror filter (#8541)

* fix bug with grpcroute mirror filter

Signed-off-by: Adam Buran <aburan@roblox.com>

* add indexers test

Signed-off-by: Adam Buran <aburan@roblox.com>

* add release note

Signed-off-by: Adam Buran <aburan@roblox.com>

---------

Signed-off-by: Adam Buran <aburan@roblox.com>
Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
(cherry picked from commit e633c08)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: normalize CRLF line endings in htpasswd basic auth secrets (#8557)

Fixes #8554

Signed-off-by: stekole <stefan@sandnetworks.com>
Signed-off-by: stekole <30674956+stekole@users.noreply.github.com>
(cherry picked from commit 9cac348)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: avoid metric increments on no-op delete reconcile paths (#8480)

* fix: avoid metric increments on no-op delete reconcile paths

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>

* Update internal/infrastructure/kubernetes/infra_resource_test.go

Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>

* Update internal/infrastructure/kubernetes/infra_resource_test.go

Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>

---------

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>
Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
(cherry picked from commit 7a2a4ec)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix(telemetry): support BackendTLSPolicy for telemetry backends (#8545)

* fix(telemetry): support BackendTLSPolicy for telemetry backends

processBackendRefs does not look up BackendTLSPolicy for telemetry
backends (access logs, tracing, metrics), so TLS can only be configured
via Backend.spec.tls. Replace inline processServerValidationTLSSettings
with applyBackendTLSSetting so telemetry backends get the full Backend +
BackendTLSPolicy + EnvoyProxy TLS merge.

Workaround: envoyproxy/ai-gateway#1964

Signed-off-by: Adrian Cole <adrian@tetrate.io>
(cherry picked from commit ac18feb)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: restore failure-path metric recording for delete and HPA reconcile (#8656)

Fixes #8651

Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
(cherry picked from commit 2a5bfd0)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: status for mirror backend (#8675)

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
(cherry picked from commit fa81778)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy extAuth Backend (#8654)

* fix: client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy extAuth Backend

Signed-off-by: zirain <zirain2009@gmail.com>

* fix lint

Signed-off-by: zirain <zirain2009@gmail.com>

---------

Signed-off-by: zirain <zirain2009@gmail.com>
(cherry picked from commit c7e21fa)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy jwt/oidc Backend (#8711)

Signed-off-by: zirain <zirain2009@gmail.com>
(cherry picked from commit 95c3a79)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: helm secrets rbac for gateway namespace with watch list of namespaces (#8706)

* fix: helm secrets rbac for gateway namespace with watch list of namespaces

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* add release notes

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* review update

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

---------

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
(cherry picked from commit c48a346)
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* add release notes

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix lint

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix lint

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

---------

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>
Signed-off-by: zirain <zirain2009@gmail.com>
Signed-off-by: Adam Buran <aburan@roblox.com>
Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Signed-off-by: stekole <stefan@sandnetworks.com>
Signed-off-by: stekole <30674956+stekole@users.noreply.github.com>
Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com>
Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>
Signed-off-by: Adrian Cole <adrian@tetrate.io>
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
Co-authored-by: zirain <zirain2009@gmail.com>
Co-authored-by: aburanrbx <aburan@roblox.com>
Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
Co-authored-by: stekole <30674956+stekole@users.noreply.github.com>
Co-authored-by: Felipe Sabadini <fsabadini@hotmail.com>
Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com>
Co-authored-by: Adrian Cole <64215+codefromthecrypt@users.noreply.github.com>
Co-authored-by: Kota Kimura <86363983+kkk777-7@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@arkodg arkodg arkodg left review comments

@jukie jukie jukie approved these changes

@rudrakhp rudrakhp rudrakhp approved these changes

@zirain zirain zirain left review comments

Assignees

No one assigned

Labels

cherrypick/release-v1.6.6 cherrypick/release-v1.7.2

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[helm] not enough permissions in gateway namespaced mode

5 participants

@cnvergence @zirain @jukie @arkodg @rudrakhp