fix(base): make Gateway API CRD ref configurable and align with Istio 1.27 - #183
Merged
Merged
Conversation
…rade installGatewayV2Crd's Job only applied CRDs when the CRD was missing (kubectl get ... ||), so it never reconciled an already-installed bundle on later upgrades, and the ref was hardcoded to a fixed commit. Expose global.gatewayApiCrdRef so the target ref is configurable, drop the existence check so pre-upgrade actually re-applies it, and use --server-side to avoid the last-applied-configuration annotation size limit on this CRD bundle. Skipped the yamllint pre-commit hook: it fails on this file (and 16 other chart templates) because yamllint can't parse Helm's Go template syntax, a preexisting condition unrelated to this change (verified against the file at HEAD before editing). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Istio 1.27's own version-pinned docs (istio.io/v1.27) document installing Gateway API CRDs at v1.3.0, not the latest release (v1.6.0, which targets Istio's current ~1.30 line). A CRD version Istio's controller doesn't understand yet unlocks nothing, so the ref should track the Gateway API version the pinned Istio release actually validates against. Skipped the yamllint pre-commit hook for the same preexisting, unrelated reason as the prior commit on this branch. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
4 tasks
Dropping the existence check made the Job re-apply on every pre-install/pre-upgrade, but plain --server-side apply fails with an ownership conflict on any cluster where these CRDs were already installed by another field manager (e.g. terraform-provider-helm, via istio-base) — reproduced against a live EKS cluster: the Job CrashLoopBackOff'd on all 4 pre-existing CRDs (only the new grpcroutes CRD, with no prior manager, applied cleanly). Re-running with --force-conflicts applied all 5 CRDs, bumped bundle-version to v1.3.0, and left the existing Gateway resources unaffected (gateway-public/gateway-private stayed PROGRAMMED=True throughout). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Author
|
Tested this against a live EKS cluster (Istio 1.27, istio-base already installing Gateway API CRDs at bundle-version
🤖 Generated with Claude Code |
timossileandro
self-requested a review
September 1, 2026 13:50
timossileandro
approved these changes
Sep 1, 2026
sebastiancorrea81
deleted the
fix/gateway-api-crd-configurable-version
branch
September 1, 2026 14:03
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
installGatewayV2Crd's Job only applied CRDs when missing (kubectl get ... ||), so it never reconciled an already-installed bundle on later upgrades, and the target ref was hardcoded to a fixed commit SHA.global.gatewayApiCrdRef(new value) so the ref is configurable, drops the existence check sopre-upgradeactually re-applies it, and uses--server-side(needed given this CRD bundle's size, which exceeds the client-sidelast-applied-configurationannotation limit).v1.3.0, matching what Istio 1.27's own version-pinned docs (istio.io/v1.27) document installing — not the newest Gateway API tag, since a newer CRD schema than Istio's controller understands doesn't unlock anything.Test plan
helm lint charts/basehelm templaterendered correctly with default and overriddenglobal.gatewayApiCrdRefhelm-docsregeneratedcharts/base/README.md🤖 Generated with Claude Code