fix: move validation admission policy outside of crds directory by zhaohuabing · Pull Request #9024 · envoyproxy/gateway

zhaohuabing · 2026-05-18T11:28:48Z

This PR moves validationAdmissionPolicy out of the crds directory and into the templates directory.

This fixes Flux installation as it treats all resources in the crds directory as CRDs.

Release Notes: Yes

netlify · 2026-05-18T11:28:54Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`ff48f15`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a1a56f522439a0008c2e55e
😎 Deploy Preview	https://deploy-preview-9024--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a0caaf38c2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codecov · 2026-05-18T11:43:55Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.83%. Comparing base (8d3cfb4) to head (ff48f15).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9024      +/-   ##
==========================================
+ Coverage   74.77%   74.83%   +0.06%     
==========================================
  Files         252      252              
  Lines       40675    40675              
==========================================
+ Hits        30415    30440      +25     
+ Misses       8179     8158      -21     
+ Partials     2081     2077       -4

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

zhaohuabing · 2026-05-22T03:15:10Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c499193462

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

zhaohuabing · 2026-05-22T03:33:54Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d3ade13519

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

zhaohuabing · 2026-05-22T04:02:30Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a12ec94e88

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

zhaohuabing · 2026-05-22T05:24:41Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 31c07399ba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

zhaohuabing · 2026-05-22T06:08:45Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4376333a5d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

zhaohuabing · 2026-05-22T08:15:09Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f43969e13

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-22T08:23:44Z

+{{- $vap := lookup "admissionregistration.k8s.io/v1" "ValidatingAdmissionPolicy" "" $safeUpgradePolicyName -}}
+{{- $vapBinding := lookup "admissionregistration.k8s.io/v1" "ValidatingAdmissionPolicyBinding" "" $safeUpgradePolicyName -}}


Guard lookup against unavailable API or RBAC denial

These unconditional lookup calls can make chart rendering fail before any manifests are emitted: Helm documents that lookup errors from the API server (including missing resource types or permission errors) fail template processing. That means installs/upgrades now fail on clusters where ValidatingAdmissionPolicy is unavailable/disabled or where the installer cannot get these cluster-scoped resources, even in --skip-crds workflows that previously avoided this path. Consider gating with capability checks (and/or avoiding lookup in skip-CRD flows) so unsupported environments can still install.

Useful? React with 👍 / 👎.

I see the concern, but I think this is an expected install prerequisite rather than a regression. Gateway API installation now includes ValidatingAdmissionPolicy resources, so clusters using this chart path need to expose admissionregistration.k8s.io/v1/ValidatingAdmissionPolicy. Similarly, Helm uses the Kubernetes identity running the install; that identity needs the cluster-scoped permissions required to install/read these resources.

jukie

LGTM, but let's discuss including this in the v1.8.1 cherry-pick.

This could be disruptive for users who exclude crds/ from gateway-helm and install through another path like the gateway-crds-helm chart. Before this change, those users had no VAP in their gateway-helm set, and if they already have the VAP installed through another path they'll need to work through an ownership transition. It's minor but it is an undesired behavior change for a patch release.

zhaohuabing · 2026-05-28T06:26:35Z

LGTM, but let's discuss including this in the v1.8.1 cherry-pick.

This could be disruptive for users who exclude crds/ from gateway-helm and install through another path like the gateway-crds-helm chart. Before this change, those users had no VAP in their gateway-helm set, and if they already have the VAP installed through another path they'll need to work through an ownership transition. It's minor but it is an undesired behavior change for a patch release.

Let's discuss this at this week's community meeting.

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

zhaohuabing · 2026-05-28T15:46:56Z

@jukie @arkodg the release note has been updated to explain the required upgrade steps according to the discussion at today's meeting.

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

arkodg · 2026-05-30T22:48:39Z

@@ -0,0 +1,3 @@
+gatewayAPI:


should this live at the top level instead https://github.com/zhaohuabing/gateway/blob/ff48f15437818b57ce9815a37182139fe7290eea/charts/gateway-helm/values.tmpl.yaml ?

Yes, it’s technically possible, but I think crds.gatewayAPI.supportingResources.enabled reads more clearly: the full path makes it explicit that these supporting resources are associated with the Gateway API CRDs. It also fits Helm’s existing value-scoping model better and stays consistent with crds.gatewayAPI.enabled / crds.gatewayAPI.channel.

If we prefer a top-level gatewayAPI.supportingResources.enabled value, I can move the VAP template into the main gateway-helm chart so it can read that value directly. My slight preference is to keep it in the crds subchart and expose it as crds.gatewayAPI.supportingResources.enabled, since these supporting resources are used for the Gateway API CRDs

zhaohuabing requested a review from a team as a code owner May 18, 2026 11:28

zhaohuabing force-pushed the fix-9015 branch from a0caaf3 to 5a0e399 Compare May 18, 2026 11:33

chatgpt-codex-connector Bot reviewed May 18, 2026

View reviewed changes

Comment thread charts/gateway-helm/charts/crds/templates/gatewayapi-validating-admission-policy.yaml Outdated

zhaohuabing marked this pull request as draft May 18, 2026 11:37

zhaohuabing added the cherrypick/release-v1.8.1 label May 18, 2026

zhaohuabing force-pushed the fix-9015 branch from 05c074b to 68f77e1 Compare May 22, 2026 02:40

zhaohuabing marked this pull request as ready for review May 22, 2026 03:15

chatgpt-codex-connector Bot reviewed May 22, 2026

View reviewed changes

Comment thread charts/gateway-helm/charts/crds/templates/gatewayapi-validating-admission-policy.yaml Outdated

zhaohuabing force-pushed the fix-9015 branch 2 times, most recently from 2e05bcc to d3ade13 Compare May 22, 2026 03:33

chatgpt-codex-connector Bot reviewed May 22, 2026

View reviewed changes

Comment thread charts/gateway-helm/charts/crds/templates/gatewayapi-supporting-resources.yaml

chatgpt-codex-connector Bot reviewed May 22, 2026

View reviewed changes

Comment thread charts/gateway-helm/charts/crds/templates/gatewayapi-supporting-resources.yaml

zhaohuabing force-pushed the fix-9015 branch from a12ec94 to 31c0739 Compare May 22, 2026 05:21

chatgpt-codex-connector Bot reviewed May 22, 2026

View reviewed changes

Comment thread charts/gateway-helm/charts/crds/templates/gatewayapi-supporting-resources.yaml

chatgpt-codex-connector Bot reviewed May 22, 2026

View reviewed changes

Comment thread charts/gateway-helm/charts/crds/templates/gatewayapi-validating-admission-policy.yaml Outdated

zhaohuabing added 8 commits May 22, 2026 15:09

move validation admission policy outside of crds directory

883c75c

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

fix upgrade

79e445e

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

add release note

e76288b

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

fix

223b70a

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

update docs

eaba496

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

address comment

fe29ffc

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

address comment

1b2dc63

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

address comments

c33afc0

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

zhaohuabing added 3 commits May 22, 2026 15:41

update docs

e054589

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

rename

6a3492f

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

update test

5f43969

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

chatgpt-codex-connector Bot reviewed May 22, 2026

View reviewed changes

rudrakhp previously approved these changes May 27, 2026

View reviewed changes

cnvergence previously approved these changes May 27, 2026

View reviewed changes

zhaohuabing requested review from a team, arkodg, guydc and jukie May 28, 2026 02:03

jukie previously approved these changes May 28, 2026

View reviewed changes

zhaohuabing dismissed stale reviews from jukie, cnvergence, and rudrakhp via ec789fc May 28, 2026 15:39

update release note

a06a8a4

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

zhaohuabing force-pushed the fix-9015 branch from ec789fc to a06a8a4 Compare May 28, 2026 15:43

zhaohuabing requested review from cnvergence, jukie and rudrakhp May 28, 2026 15:44

Merge branch 'main' into fix-9015

2e3fcdd

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

zhaohuabing added 2 commits May 29, 2026 12:44

Merge branch 'main' into fix-9015

431f6ba

fix gen

f4cb426

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

zirain approved these changes May 29, 2026

View reviewed changes

jukie approved these changes May 30, 2026

View reviewed changes

Merge branch 'main' into fix-9015

ff48f15

arkodg reviewed May 30, 2026

View reviewed changes

zhaohuabing requested a review from arkodg June 1, 2026 03:33

		{{- $vap := lookup "admissionregistration.k8s.io/v1" "ValidatingAdmissionPolicy" "" $safeUpgradePolicyName -}}
		{{- $vapBinding := lookup "admissionregistration.k8s.io/v1" "ValidatingAdmissionPolicyBinding" "" $safeUpgradePolicyName -}}

Conversation

zhaohuabing commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

codecov Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

zhaohuabing commented May 22, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

zhaohuabing commented May 22, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

zhaohuabing commented May 22, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

zhaohuabing commented May 22, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

zhaohuabing commented May 22, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

zhaohuabing commented May 22, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 22, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing May 22, 2026

Choose a reason for hiding this comment

Uh oh!

jukie left a comment

Choose a reason for hiding this comment

Uh oh!

zhaohuabing commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zhaohuabing commented May 28, 2026

Uh oh!

arkodg May 30, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

zhaohuabing commented May 18, 2026 •

edited

Loading

netlify Bot commented May 18, 2026 •

edited

Loading

codecov Bot commented May 18, 2026 •

edited

Loading

zhaohuabing commented May 28, 2026 •

edited

Loading

zhaohuabing Jun 1, 2026 •

edited

Loading