chore: bump golang to 1.26.6 - #9749
Merged
Merged
Conversation
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
✅ Deploy Preview for cerulean-figolla-1f9435 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #9749 +/- ##
==========================================
- Coverage 76.28% 76.28% -0.01%
==========================================
Files 261 261
Lines 44351 44351
==========================================
- Hits 33835 33833 -2
- Misses 8277 8280 +3
+ Partials 2239 2238 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
zirain
approved these changes
Aug 14, 2026
cnvergence
approved these changes
Aug 14, 2026
kkk777-7
added a commit
that referenced
this pull request
Aug 15, 2026
* chore: replace sets.NewString with sets.New[string] (#9704) refactor: replace sets.NewString with sets.New[string] Signed-off-by: Kise Ryota <kiseryota.contact@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * feat(chart): Add TLS certificate expiration to the Envoy Global dashboard (#9615) * Add tls certificate expiration to the Envoy Global dashboard Signed-off-by: Floris Feddema <floris.feddema@infosupport.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * docs: add note about Tempo appProtocol in proxy-trace.md (#5963) * docs: add note about Tempo appProtocol in proxy-trace.md Signed-off-by: Renzo Tomà @ DPG <151731240+rtomadpg@users.noreply.github.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * docs: improve custom certificate installation guide (#9650) Signed-off-by: Dennis Lanov <dennis.lanov@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * feat(charts): add unhealthyPodEvictionPolicy field in envoy-gateway PodDisruptionBudget (#9449) * chore(charts): add unhealthyPodEvictionPolicy field in envoy-gateway PodDisruptionBudget Signed-off-by: QuantumEnigmaa <thibaud@giantswarm.io> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * fix: generate manifests (#9715) Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * docs: add kdvz to list of adopters (#9556) Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * chore: ignore nvd.nist.gov (#9724) Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * fix(provider): make BackendTLSPolicy watch optional (#9517) fix(provider): skip absent optional Gateway API CRD watches Envoy Gateway unconditionally establishes watches (and reconcile-time List calls) for ListenerSet, TLSRoute and BackendTLSPolicy. Those types are in the gateway.networking.k8s.io v1 standard channel now, but a cluster can still lack them when it ships an older standard bundle. OpenShift is one example: it installs a fixed standard-channel set and blocks anyone else from adding the rest. When one of these CRDs is missing the manager fails its cache sync and the controller crash-loops with `no matches for kind "..."`. Guard the three watches with a CRD existence check and a skip log, and guard the matching processing and predicate paths, mirroring what is already done for EnvoyProxy, TCPRoute and UDPRoute. The offline provider continues to assume all CRDs exist. When a CRD is present behaviour is unchanged; when it is absent the controller starts and serves the CRDs that do exist. Signed-off-by: Seth Malaki <seth@tigera.io> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * feat: add healthCheckFailureDelay to shutdown config (#9363) * feat: add healthCheckFailureDelay to shutdown config Allow Envoy listener drain to start immediately while delaying `/healthcheck/fail` during pod termination. This helps deployments that need the terminating pod to remain a ready local endpoint while upstream load balancers stop sending traffic to the node. The default remains 0s, preserving the existing behavior where `/healthcheck/fail` starts listener drain immediately. Signed-off-by: Erik Sundell <erik@sundellopensource.se> * fix: preserve subsecond healthCheckFailureDelay values Signed-off-by: Erik Sundell <erik@sundellopensource.se> --------- Signed-off-by: Erik Sundell <erik@sundellopensource.se> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> Co-authored-by: kkk777-7 <kota.kimura0725@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * chore: fix wasm stats test (#9657) * chore: fix wasm stats test Signed-off-by: zirain <zirain2009@gmail.com> * update Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * build(deps): bump the helm group across 1 directory with 4 updates (#9728) * build(deps): bump the helm group across 1 directory with 4 updates Bumps the helm group with 4 updates in the /charts/gateway-addons-helm directory: alloy, loki, opentelemetry-collector and otel/opentelemetry-collector-contrib. Updates `alloy` from 1.11.0 to 1.11.1 Updates `loki` from 7.2.0 to 7.3.0 Updates `opentelemetry-collector` from 0.166.0 to 0.169.0 Updates `otel/opentelemetry-collector-contrib` from 0.157.0 to 0.158.0 --- updated-dependencies: - dependency-name: alloy dependency-version: 1.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: helm - dependency-name: loki dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: helm - dependency-name: opentelemetry-collector dependency-version: 0.169.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: helm - dependency-name: otel/opentelemetry-collector-contrib dependency-version: 0.158.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: helm ... Signed-off-by: dependabot[bot] <support@github.com> * fix-gen Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix-gen Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * build(deps): bump npm-check-updates from 23.0.0 to 23.0.2 in /site (#9727) Bumps [npm-check-updates](https://github.com/raineorshine/npm-check-updates) from 23.0.0 to 23.0.2. - [Release notes](https://github.com/raineorshine/npm-check-updates/releases) - [Changelog](https://github.com/raineorshine/npm-check-updates/blob/main/CHANGELOG.md) - [Commits](raineorshine/npm-check-updates@v23.0.0...v23.0.2) --- updated-dependencies: - dependency-name: npm-check-updates dependency-version: 23.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * build(deps): bump the gomod group across 2 directories with 16 updates (#9729) * build(deps): bump the gomod group across 2 directories with 16 updates Bumps the gomod group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/docker/cli](https://github.com/docker/cli) | `29.7.1+incompatible` | `29.7.2+incompatible` | | [github.com/go-openapi/validate](https://github.com/go-openapi/validate) | `0.26.1` | `0.26.2` | | [github.com/ohler55/ojg](https://github.com/ohler55/ojg) | `1.28.3` | `1.28.4` | | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` | | [go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go) | `0.66.0` | `0.67.0` | | [go.opentelemetry.io/otel/exporters/stdout/stdoutmetric](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` | Bumps the gomod group with 1 update in the /examples/sds-test-server directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go). Updates `github.com/docker/cli` from 29.7.1+incompatible to 29.7.2+incompatible - [Commits](docker/cli@v29.7.1...v29.7.2) Updates `github.com/go-openapi/validate` from 0.26.1 to 0.26.2 - [Release notes](https://github.com/go-openapi/validate/releases) - [Commits](go-openapi/validate@v0.26.1...v0.26.2) Updates `github.com/ohler55/ojg` from 1.28.3 to 1.28.4 - [Release notes](https://github.com/ohler55/ojg/releases) - [Changelog](https://github.com/ohler55/ojg/blob/develop/CHANGELOG.md) - [Commits](ohler55/ojg@v1.28.3...v1.28.4) Updates `go.opentelemetry.io/otel` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.66.0 to 0.67.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@metric/x/v0.66.0...metric/x/v0.67.0) Updates `go.opentelemetry.io/otel/exporters/stdout/stdoutmetric` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `go.opentelemetry.io/otel/metric` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `go.opentelemetry.io/otel/sdk` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `go.opentelemetry.io/otel/sdk/metric` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `go.opentelemetry.io/otel/trace` from 1.44.0 to 1.45.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0) Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260720211330-0afa2a65878a to 0.0.0-20260803160001-6ac0973c030d - [Commits](https://github.com/googleapis/go-genproto/commits) Updates `google.golang.org/grpc` from 1.82.1 to 1.83.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.82.1...v1.83.0) --- updated-dependencies: - dependency-name: github.com/docker/cli dependency-version: 29.7.2+incompatible dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/go-openapi/validate dependency-version: 0.26.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/ohler55/ojg dependency-version: 1.28.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: go.opentelemetry.io/otel dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: go.opentelemetry.io/otel/exporters/prometheus dependency-version: 0.67.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdoutmetric dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: go.opentelemetry.io/otel/metric dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: go.opentelemetry.io/otel/sdk/metric dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: go.opentelemetry.io/otel/trace dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/genproto/googleapis/rpc dependency-version: 0.0.0-20260803160001-6ac0973c030d dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: google.golang.org/grpc dependency-version: 1.83.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> * fix go mod Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix go mod Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * test(configloader): fix flaky reload tests (#9418) fix flaky loader config test Signed-off-by: Kise Ryota <kiseryota.contact@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * gatewayapi: decide ClusterSettings merge eligibility per listener, not per rule (#9695) * gatewayapi: change CTPClusterSettingsIndex.HasClusterSettingsBelowGateway to take one listener Every real caller (routeDestinationForListener, added by a later task in this series) only ever has one listener in hand when it needs this answer, so drop the slice-and-OR shape in favor of checking one listener directly. Its own test is updated to match; the sole production call site (route.go:591) still passes a slice and is fixed by the next task in this series, so this package does not compile standalone yet. Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * gatewayapi: resolve ClusterSettings divergence per listener, not per rule CTPClusterSettingsIndex.HasClusterSettingsBelowGateway now checks one listener directly instead of looping parentRef.listeners and ORing the results. hasClusterSettingsBelowGatewayForListener replaces the deleted rule-level hasClusterSettingsBelowGateway, taking the listener actually being considered instead of guessing it from parentRef.SectionName. Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * gatewayapi: add routeDestinationForListener, the shared per-listener merge-choice helper Deciding whether a backend uses a shared cluster or its own inline settings now happens per listener instead of once per rule, so listener-scoped ClusterSettings divergence on one listener no longer leaks onto (or gets wrongly blamed onto) every other listener the same route attaches to. Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * gatewayapi: return an unregistered BackendClusterKey from processBackendRef Mechanical refactor, no behavior change: processBackendRef now returns the merge-cluster key instead of an already-registered BackendClusterRef. Every call site registers it immediately, exactly where processBackendRef used to - this only relocates the call one level up, in preparation for making it lazy per listener. Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * gatewayapi: decide HTTP/GRPC merge eligibility per listener, not per rule A route with no sectionName that attaches to a whole Gateway/ListenerSet no longer has one listener's ClusterSettings divergence silently missed (BTP) or wrongly applied to every other listener too (CTP) - the choice between a shared cluster and inline settings is now made per listener, inside the existing per-listener fan-out. Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * gatewayapi: decide TCP merge eligibility per listener, not per rule Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * gatewayapi: decide UDP merge eligibility per listener, not per rule Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * docs: add release note for per-listener ClusterSettings merge-eligibility fix Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * gatewayapi: fix stale comment reference to renamed hasClusterSettingsBelowGatewayForListener Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * gatewayapi: decide TLS merge eligibility per listener, not per rule TLS pools every rule's backends into one destination reused across every listener, but the per-listener merge choice this fix already applies to HTTP/GRPC/TCP/UDP works unmodified here too - the only difference is routeRuleName is always nil, since TLS's rule-scoped BTP/CTP targeting is already inert on the policy-application side (buildResourceMetadata hardcodes the pooled destination's Metadata.SectionName to empty), so there is no real rule-scope divergence left to protect against losing by merging. Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * gatewayapi: trim now-unused parameters from merge-incompatibility checks mergeIncompatibleForWeightedRule/mergeIncompatibleForSingleClusterRule lost their ClusterSettings-divergence check when that moved to the new per-listener routeDestinationForListener helper; parentRef and routeRuleName (and, for the single-cluster variant, gatewayCtx and routeCtx too) had been dead ever since. Also stop populating httpRouteDestinationChoice's destName/routeRuleMetadata/routeRuleName for rule-matches that already resolved to a DirectResponse/Redirect and never consume them. Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * docs: extend per-listener ClusterSettings merge-eligibility release note to cover TLS Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * gatewayapi: drop stale route-level-cluster-settings clause from mergeIncompatibleForWeightedRule's doc comment Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * gatewayapi: simplify routeDestinationForListener naming and logic - clusterKey -> backendClusterKey throughout; the pre-existing constructor function of that name became newBackendClusterKey to avoid a shadowing collision. - Drop the hasMergeCandidate pre-scan: just call hasClusterSettingsBelowGateway unconditionally and let its (cheap) result be ignored when nothing is merge-eligible, instead of pre-scanning to decide whether to bother calling it. - hasClusterSettingsBelowGatewayForListener -> hasClusterSettingsBelowGateway: the ForListener suffix was disambiguating against a same-named rule-level method that no longer exists. - listenerDiverges -> hasClusterSettings, matching the naming already used for the same concept in backendtrafficpolicy.go/clienttrafficpolicy.go. Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * gatewayapi: final cleanup pass on per-listener ClusterSettings merge fix Drop a stale comment reference to the (now-deleted) design doc, split routeDestinationForListener's call sites onto multiple lines now that it takes 9 arguments, and rename the routeRoutes slice to routesWithBackends to match its httpRouteWithBackendDestinations element type. Replace TestRouteDestinationForListener with golden fixture coverage: add a BTP per-listener-divergence fixture mirroring the existing CTP one, plus fixtures for cross-listener cluster dedup and the never-registered-when- every-listener-diverges case. Rename the existing no-sectionname listener- divergence fixtures to say which policy (ctp/btp) drives the divergence, now that both exist side by side. Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * gatewayapi: simplify TLS routeRuleName comment Drop the self-reference to "this fix" and the three unrelated helper function names cited purely as supporting evidence - none of them are called nearby, so the citation would go stale silently on any rename. State the invariant directly instead. Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * docs: fix release note filename to reference PR number, simplify wording Renamed to reference PR #9695 instead of the issue number, and trimmed the note to a single plain sentence per the release-notes convention. Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> --------- Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * fix: reconcile ListenerSet when referenced TLS Secret changes (#9634) * fix: reconcile ListenerSet when referenced TLS Secret changes Signed-off-by: zanarelli <zanarelli.dev@gmail.com> * fix: validate parent Gateway for ListenerSet secret watches Mirror isGatewayReferencingSecret by checking that every ListenerSet indexed by a TLS Secret belongs to a Gateway managed by this controller. Signed-off-by: zanarelli <zanarelli.dev@gmail.com> * fix: do not abort secret reconcile on one bad parentRef isGatewayReferencingSecret and isListenerSetReferencingSecret returned false as soon as any unmanaged or missing parent appeared, so a valid Gateway/ListenerSet sharing the same TLS Secret never reconciled. Return true on the first managed parent; continue past Get errors and unmanaged gateways. Cover mixed valid/invalid parents in unit tests. Signed-off-by: zanarelli <zanarelli.dev@gmail.com> --------- Signed-off-by: zanarelli <zanarelli.dev@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * gatewayapi: fix ListenerSet scope in MergeBackends cluster-settings index (#9692) * gatewayapi: thread listenerSetNN through HasClusterSettingsBelowGateway Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * gatewayapi: track ListenerSet-level BTP cluster settings, fixing #9619 Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * testdata: add golden fixtures for ListenerSet-targeted BTP MergeBackends demerge Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> * gatewayapi: address review feedback on ListenerSet MergeBackends fix - Drop redundant explanatory comments on the ListenerSet cases in BuildBTPIndexes and on loadBalancerIdx's switch; fold the latter's reasoning into the existing default-case comment instead. - Rename two new test cases to describe what's actually exercised (direct index-level lookup with an explicit listenerSetNN), not an HTTPRoute-to-ListenerSet attachment this test level never constructs. - Derive listenerSetNN in the hasClusterSettingsBelowGateway wrapper from parentRef.Kind/Namespace/Name directly, matching the existing pattern in resolveBTPRoutingType, instead of reaching into a resolved listener's back-reference. Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> --------- Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * fix: pin consistent-hash clients across weighted backendRefs (#9629) When a route splits traffic across multiple weighted backendRefs and uses a ConsistentHash load balancer, Envoy Gateway rendered the split as a weighted_clusters route action whose cluster selection is random per request. The route hash policy only pinned endpoint selection within a cluster, so a client was not pinned to a single backend across the split. Set WeightedCluster.use_hash_policy on the generated weighted clusters when a hash policy is present, so Envoy selects the weighted cluster deterministically from the request's hash policy instead of at random. Gated on a hash policy being configured, so non-ConsistentHash weighted routes are unaffected. Fixes #9626 Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * docs: add GRPC Timeouts task (BackendTrafficPolicy) (#9631) * docs: add GRPC Timeouts task (BackendTrafficPolicy) GRPCRoute has no native timeouts field yet (tracked upstream at kubernetes-sigs/gateway-api#3139), and users repeatedly rediscover the BackendTrafficPolicy workaround by word of mouth. Document how to configure gRPC timeouts via BackendTrafficPolicy: requestTimeout for unary RPCs, and requestTimeout: 0s + maxStreamDuration/streamIdleTimeout for streaming RPCs. Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com> * docs: address review — use a single BackendTrafficPolicy for the grpc-timeouts examples A GRPCRoute accepts only one BackendTrafficPolicy; a second policy targeting the same route is rejected as Conflicted (backendtrafficpolicy.go resolveBackendTrafficPolicyRouteTargetRef). The unary and streaming examples now reuse a single policy name (grpc-timeouts) and a note explains they are alternatives, so following the task top-to-bottom no longer produces a Conflicted second policy. Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com> * docs: fix gateway-api reference links and add timeout verification - Correct the HTTPRoute/GRPCRoute links to the /reference/api-types/ path used by the other traffic docs (the /api-types/ form 404s, failing docs-lint link check). - Address review: add a Verification step that proves the timeout is programmed into the Envoy route config via egctl (route timeout / maxStreamDuration), plus an end-to-end grpcurl DEADLINE_EXCEEDED example and a note that the sample yages backend does not delay. Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com> * docs: use the GRPC Routing gateway name in the egctl selector The GRPC Routing prerequisite task creates a Gateway named example-gateway (examples/kubernetes/grpc-routing.yaml), not eg, so the hard-coded owning-gateway-name=eg selector matched no proxy pod and egctl config errored instead of showing the programmed timeout. Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com> --------- Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * chore: add e2e for SDS Ref (#8983) * add more sds e2e Signed-off-by: zirain <zirain2009@gmail.com> * merge test suite Signed-off-by: zirain <zirain2009@gmail.com> * fix merge Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * chore: fix gen Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * fix: Add overlap status for duplicate HTTPRoutes (#8373) * route overlap Signed-off-by: jukie <isaac.wilson514@gmail.com> * Check all route types vs only HTTPRoute Signed-off-by: jukie <isaac.wilson514@gmail.com> * lint Signed-off-by: jukie <isaac.wilson514@gmail.com> * feedback Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> Signed-off-by: jukie <10012479+Jukie@users.noreply.github.com> * use listener name map to avoid repeated linear scans in checkRouteOverlaps Signed-off-by: jukie <10012479+Jukie@users.noreply.github.com> * Feedback Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * feedback and tweaks Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * Fix goldens Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * feedback Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * regen Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> --------- Signed-off-by: jukie <isaac.wilson514@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> Signed-off-by: jukie <10012479+Jukie@users.noreply.github.com> Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * e2e: fix flaky ExtProc test (#9739) * e2e: fix flaky ExtProc test Signed-off-by: zirain <zirain2009@gmail.com> * fix lint Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Co-authored-by: Guy Daich <guy.daich@sap.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * fix: allow single character labels in cookieDomain (#9736) fix: allow single character root domains in cookieDomain Single character domains are valid, but the regex only allows them as the first label. So lab.x.com is rejected, but x.com is allowed. #4803 fixed exactly this for Backend FQDN endpoints in v1.3.0. Same root cause, different field, so this is the one that got missed. Signed-off-by: Jacob Winther <jacob@9.nz> Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * chore: bump golang to 1.26.6 (#9749) Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * [release/v1.9] v1.9.0 release docs and announcement (#9751) * add: release note for v1.9 Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * bump version Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * add: release announce and docs of v1.9 Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * update site layouts Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * update site hugo.toml Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * update lint Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * remove uncorrect files Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * update gwapi doc sync shell Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * fix lint Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * fix lint Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> --------- Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> --------- Signed-off-by: Kise Ryota <kiseryota.contact@gmail.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> Signed-off-by: Floris Feddema <floris.feddema@infosupport.com> Signed-off-by: Renzo Tomà @ DPG <151731240+rtomadpg@users.noreply.github.com> Signed-off-by: Dennis Lanov <dennis.lanov@gmail.com> Signed-off-by: QuantumEnigmaa <thibaud@giantswarm.io> Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Seth Malaki <seth@tigera.io> Signed-off-by: Erik Sundell <erik@sundellopensource.se> Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Muhammad Waqar <mwaqar@confluent.io> Signed-off-by: zanarelli <zanarelli.dev@gmail.com> Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com> Signed-off-by: jukie <isaac.wilson514@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> Signed-off-by: jukie <10012479+Jukie@users.noreply.github.com> Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com> Signed-off-by: Jacob Winther <jacob@9.nz> Co-authored-by: ryota kise <kiseryota.contact@gmail.com> Co-authored-by: Floris Feddema <Floris1996@hotmail.com> Co-authored-by: Renzo Tomà @ DPG <151731240+rtomadpg@users.noreply.github.com> Co-authored-by: Dennis Lanov <155569926+dlanov@users.noreply.github.com> Co-authored-by: Zirko <64951262+QuantumEnigmaa@users.noreply.github.com> Co-authored-by: Alexander <32269455+VonNao@users.noreply.github.com> Co-authored-by: zirain <zirain2009@gmail.com> Co-authored-by: Seth Malaki <seth.malaki@gmail.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: Erik Sundell <erik.i.sundell@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Muhammad Waqar <mwaqar@confluent.io> Co-authored-by: zanarelli <zanarelli.dev@gmail.com> Co-authored-by: Andrey Maltsev <maltsev.andrey@gmail.com> Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com> Co-authored-by: Guy Daich <guy.daich@sap.com> Co-authored-by: Jacob Winther <jacob@9.nz> Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
Bump Go to 1.26.6, which includes security fixes to
stdlib.Fixed https://github.com/envoyproxy/gateway/actions/runs/31767895470/job/94667451495