chore: update Envoy Gateway to v1.5.0 by electricjesus · Pull Request #4130 · tigera/operator

electricjesus · 2025-09-06T19:05:54Z

Summary

Update Envoy Gateway from the previous version to v1.5.0 following the provided upgrade instructions.

Changes Made

Dependencies: Updated go.mod to use Envoy Gateway v1.5.0
Configuration: Updated Makefile to use envoy-gateway/gateway-helm chart reference
Resources: Regenerated pkg/render/gateway_api_resources.yaml with updated resources
Tests: Fixed CRD count expectation in pkg/render/gateway_api.go from 11 to 10 k8s CRDs, fixed resource render expectation from 17 to 21 (20 core resources + 1 resource per envoygatewayclass)

The following CRDs are packaged in this change

Gateway API-Specific CRDs

Resource Kind	Version	Notes
BackendTLSPolicy	v1alpha3	Gateway API specific (standard resource for TLS backend configuration).
GatewayClass	v1, v1beta1	Gateway API specific (standard resource for gateway classes).
Gateway	v1, v1beta1	Gateway API specific (standard resource for gateways).
GRPCRoute	v1	Gateway API specific (standard resource for gRPC routing).
HTTPRoute	v1, v1beta1	Gateway API specific (standard resource for HTTP routing).
ReferenceGrant	v1beta1	Gateway API specific (standard resource for cross-namespace references).
TCPRoute	v1alpha2	Gateway API specific (standard resource for TCP routing).
TLSRoute	v1alpha2	Gateway API specific (standard resource for TLS routing).
UDPRoute	v1alpha2	Gateway API specific (standard resource for UDP routing).
XBackendTrafficPolicy	v1alpha1	Gateway API experimental (extended resource for backend traffic policies, from `gateway.networking.x-k8s.io`).
XListenerSet	v1alpha1	Gateway API experimental (extended resource for listener sets, from `gateway.networking.x-k8s.io`).

Envoy-Specific CRDs

Resource Kind	Version	Notes
Backend	v1alpha1	Envoy Gateway specific (custom resource for backend endpoints, from `gateway.envoyproxy.io`).
BackendTrafficPolicy	v1alpha1	Envoy Gateway specific (custom resource for backend traffic policies, from `gateway.envoyproxy.io`).
ClientTrafficPolicy	v1alpha1	Envoy Gateway specific (custom resource for client-side traffic policies, from `gateway.envoyproxy.io`).
EnvoyExtensionPolicy	v1alpha1	Envoy Gateway specific (custom resource for Envoy extensions like Lua/WASM, from `gateway.envoyproxy.io`).
EnvoyPatchPolicy	v1alpha1	Envoy Gateway specific (custom resource for patching Envoy xDS resources, from `gateway.envoyproxy.io`).
EnvoyProxy	v1alpha1	Envoy Gateway specific (custom resource for Envoy proxy configuration, from `gateway.envoyproxy.io`).
HTTPRouteFilter	v1alpha1	Envoy Gateway specific (custom resource for HTTP route filters, from `gateway.envoyproxy.io`).
SecurityPolicy	v1alpha1	Envoy Gateway specific (custom resource for security policies like JWT/OIDC, from `gateway.envoyproxy.io`).

New Features

This update includes new Envoy Gateway v1.5.0 features such as the SecurityPolicy CRD and other enhancements.

Testing

Ran focused Gateway API tests with go test ./pkg/render -v -ginkgo.focus ".*Gateway.*"
Executed full unit test suite with make ut
All tests pass successfully

Description

Release Note

Envoy Gateway updated to v1.5.0. This now includes envoy `SecurityPolicy` CRD

For PR author

Tests for change.
If changing pkg/apis/, run make gen-files
If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

Milestone set according to targeted release.
Appropriate labels:
- kind/bug if this is a bugfix.
- kind/enhancement if this is a a new feature.
- enterprise if this PR applies to Calico Enterprise only.

nelljerram

I'd like to understand the MutatingWebhook better.

What does it do?
It is correct to configure it before the gateway controller is deployed?

We'll need doc updates for the CRD changes. BackendLBPolicy removed, XBackendTraffic and XListenerSet added, and version changes for other CRDs.

A few other specific points.

nelljerram · 2025-09-11T14:41:29Z

pkg/controller/gatewayapi/gatewayapi_controller.go

 	"github.com/tigera/operator/pkg/controller/utils/imageset"
 	"github.com/tigera/operator/pkg/ctrlruntime"
 	"github.com/tigera/operator/pkg/render"
+	"github.com/tigera/operator/pkg/render/gatewayapi"


Moving the gateway API rendering into its own package seems like a nice move to me, but I'd appreciate an operator-dev OK'ing this as well, in case there's some gotcha with not having all of our rendering in a single package.

we do already have existing component-specific subdirectories under pkg/render.. so I think that's okay? (cc @tigera/tigera-operator-maintainers maybe i'm not seeing something here)

nelljerram · 2025-09-11T14:43:08Z

pkg/controller/compliance/compliance_controller_test.go

 		result, err := r.Reconcile(ctx, reconcile.Request{})
 		Expect(err).NotTo(HaveOccurred())
-		Expect(result.RequeueAfter).To(Equal(0 * time.Second))
+		Expect(result.RequeueAfterAfter).To(Equal(0 * time.Second))


Really? That's such an obviously terrible name. But I presume this isn't your choice at all. Out of interest do you have a pointer to the deprecation notice?

Oh I see, it was a typo.

sorry that was a search-and-replace fail!

here's the specific release we've upgrade to, take a look at Breaking Changes https://github.com/kubernetes-sigs/controller-runtime/releases/tag/v0.21.0

nelljerram · 2025-09-11T14:51:09Z

pkg/render/gatewayapi/gateway_api.go

+	for _, mwc := range resources.mutatingWebhookConfigurations {
+		objs = append(objs, mwc.DeepCopyObject().(client.Object))
+	}
+	for _, resource := range []client.Object{


Please note that this function is quite careful about the order of objsToCreate - so that when object A depends on other objects {B}, {B} are emitted first, then A. Considering the insertions here:

I think the extra cluster role (binding) for certgen job is fine, because the job itself is created later.

Not sure about the mutating web hook. Does this depend on the envoy-gateway controller already running, since that what it points to? Perhaps it's fine because of its policy to ignore failures. I'm curious what happens later when the envoy-gateway controller is actually deployed... then the webhook fires and tries to call the controller while it's still being created?

@nelljerram apparently the webhook's only job is to label gateway proxy pods with node topology labels. these seem to be mostly informational doesn't seem to affect operation. perhaps it's used for something else? taxonomy purposes?

nelljerram · 2025-09-11T14:57:29Z

PR description mentions a new SecurityPolicy CRD, but I didn't spot that in the YAML changes. Is the PR description correct?

nelljerram · 2025-09-11T15:00:47Z

UT failures look related to the Requeue -> RequeueAfter change

nelljerram · 2025-09-11T15:14:23Z

https://gateway.envoyproxy.io/news/releases/v1.5/ says:

xDS Listener Naming: Listeners are now named based on listening port and protocol instead of Gateway and section names.
This affects existing EnvoyPatchPolicies and ExtensionManagers.

Is that going to need changes to our WAF implementation?

electricjesus · 2025-09-11T17:16:19Z

gateway.envoyproxy.io/news/releases/v1.5 says:

xDS Listener Naming: Listeners are now named based on listening port and protocol instead of Gateway and section names.
This affects existing EnvoyPatchPolicies and ExtensionManagers.

Is that going to need changes to our WAF implementation?

yes you're right.. looks like it's deprecated in 1.5, removed in 1.6. it doesn't change the WAF implementation but it will affect the documentation: https://docs.tigera.io/calico-enterprise/3.22/threat/deploying-waf-ingress-gateway#customizing-your-waf-configuration-for-an-ingress-gateway

that's fine, seems like a quick change after this PR is merged.

electricjesus · 2025-09-11T17:23:06Z

PR description mentions a new SecurityPolicy CRD, but I didn't spot that in the YAML changes. Is the PR description correct?

updated the description

UT failures look related to the Requeue -> RequeueAfter change

now fixed, i think!

nelljerram · 2025-09-15T13:31:22Z

updated the description

It still says "SecurityPolicy" in the PR description, unless my eyes are fooling me!

nelljerram · 2025-09-11T14:55:48Z

pkg/controller/compliance/compliance_controller_test.go

 		result, err := r.Reconcile(ctx, reconcile.Request{})
 		Expect(err).NotTo(HaveOccurred())
-		Expect(result.RequeueAfter).To(Equal(0 * time.Second))
+		Expect(result.RequeueAfterAfter).To(Equal(0 * time.Second))


Oh I see, it was a typo.

Update Envoy Gateway from the previous version to v1.5.0 following the provided upgrade instructions. - **Dependencies**: Updated `go.mod` to use Envoy Gateway v1.5.0 - **Configuration**: Updated `Makefile` to use `envoy-gateway/gateway-helm` chart reference - **Resources**: Regenerated `pkg/render/gateway_api_resources.yaml` with updated resources (40,569 lines) - **Tests**: Fixed CRD count expectation in `pkg/render/gateway_api.go` from 11 to 10 k8s CRDs (SecurityPolicy is now an envoy CRD) - ✅ All Gateway tests passing (11/11) - ✅ All unit tests passing (66 suites) - ✅ No regressions introduced This update includes new Envoy Gateway v1.5.0 features such as the SecurityPolicy CRD and other enhancements. - Ran focused Gateway API tests with `go test ./pkg/render -v -ginkgo.focus ".*Gateway.*"` - Executed full unit test suite with `make ut` - All tests pass successfully

…eway API

…on correctly

nelljerram · 2025-09-17T08:20:05Z

@electricjesus Is your last commit a necessary part of bumping to 1.5.0 ?

…deletion" This reverts commit c2020d8.

electricjesus · 2025-09-17T11:10:55Z

@nelljerram no that's not necessary, just trying to figure out why that FV is timing out. seems that it does tend to help so i separated the tweaks out to its own PR: #4150

also reverted the commit

…deletion" This reverts commit e4f5fdd.

…-v1.40 chore: update Envoy Gateway to v1.5.0 (#4130)

electricjesus requested a review from a team as a code owner September 6, 2025 19:05

marvin-tigera added this to the v1.40.0 milestone Sep 6, 2025

marvin-tigera added docs-pr-required release-note-required labels Sep 6, 2025

electricjesus removed the release-note-required label Sep 6, 2025

marvin-tigera added the release-note-required label Sep 6, 2025

electricjesus removed the release-note-required label Sep 6, 2025

marvin-tigera added the release-note-required label Sep 6, 2025

nelljerram reviewed Sep 11, 2025

View reviewed changes

electricjesus requested a review from nelljerram September 11, 2025 18:27

electricjesus force-pushed the update-envoy-gateway-version branch from 5d66178 to db949c3 Compare September 11, 2025 18:59

nelljerram approved these changes Sep 15, 2025

View reviewed changes

danudey modified the milestones: v1.40.0, v1.41.0 Sep 16, 2025

electricjesus force-pushed the update-envoy-gateway-version branch from db949c3 to bf31c81 Compare September 16, 2025 20:14

rene-dekker approved these changes Sep 16, 2025

View reviewed changes

electricjesus added 8 commits September 16, 2025 22:13

chore: make build

4df8ac0

fix: update source paths in gateway API resource definitions

a6a9126

fix: update expected number of k8s CRDs in Gateway API validation

b1231bd

refactor: gateway api in its own package

140cb87

fix: add missing MutatingWebhookConfiguration and ClusterRole for Gat…

dea2229

…eway API

chore: controller-runtime update - .Requeue is deprecated

4b86116

chore: fix search-and-replace fail

32dc11b

electricjesus added 2 commits September 16, 2025 22:14

fix: update compliance controller tests to check RequeueAfter conditi…

0fe4fea

…on correctly

chore: make gen-versions

970ec04

electricjesus force-pushed the update-envoy-gateway-version branch from c5b32a1 to 970ec04 Compare September 16, 2025 21:14

feat: implement finalizer for GatewayAPI to manage namespace deletion

c2020d8

Revert "feat: implement finalizer for GatewayAPI to manage namespace …

ad920eb

…deletion" This reverts commit c2020d8.

electricjesus added 6 commits October 1, 2025 22:11

Merge branch 'master' into update-envoy-gateway-version

ebd6d0a

chore: go mod tidy

91d6482

Merge branch 'master' into update-envoy-gateway-version

5e545c1

feat: implement finalizer for GatewayAPI to manage namespace deletion

e4f5fdd

Merge branch 'master' into update-envoy-gateway-version

d72db2e

Revert "feat: implement finalizer for GatewayAPI to manage namespace …

2be589c

…deletion" This reverts commit e4f5fdd.

electricjesus merged commit 857b9db into tigera:master Oct 10, 2025
6 checks passed

electricjesus deleted the update-envoy-gateway-version branch October 10, 2025 10:57

electricjesus added a commit to electricjesus/operator that referenced this pull request Oct 13, 2025

chore: update Envoy Gateway to v1.5.0 (tigera#4130)

34f993a

electricjesus mentioned this pull request Oct 13, 2025

chore: update Envoy Gateway to v1.5.0 (#4130) #4206

Merged

5 tasks

tmjd added a commit that referenced this pull request Oct 13, 2025

Merge pull request #4206 from electricjesus/pick-update-envoy-version…

c60d630

…-v1.40 chore: update Envoy Gateway to v1.5.0 (#4130)

Conversation

electricjesus commented Sep 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes Made

Gateway API-Specific CRDs

Envoy-Specific CRDs

New Features

Testing

Description

Release Note

For PR author

For PR reviewers

Uh oh!

nelljerram left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nelljerram commented Sep 11, 2025

Uh oh!

nelljerram commented Sep 11, 2025

Uh oh!

nelljerram commented Sep 11, 2025

Uh oh!

electricjesus commented Sep 11, 2025

Uh oh!

electricjesus commented Sep 11, 2025

Uh oh!

nelljerram commented Sep 15, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nelljerram commented Sep 17, 2025

Uh oh!

electricjesus commented Sep 17, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

electricjesus commented Sep 6, 2025 •

edited

Loading