Skip to content

[v3.24] feat(gatewayapi): bump bundled Envoy Gateway helm chart to v1.8.0#4934

Open
electricjesus wants to merge 1 commit into
tigera:release-v1.43from
electricjesus:seth/eg-1.8.0-on-v1.43
Open

[v3.24] feat(gatewayapi): bump bundled Envoy Gateway helm chart to v1.8.0#4934
electricjesus wants to merge 1 commit into
tigera:release-v1.43from
electricjesus:seth/eg-1.8.0-on-v1.43

Conversation

@electricjesus

Copy link
Copy Markdown
Member

Cherry-pick of #4832 onto release-v1.43 (Calico Enterprise v3.24).

Description

Brings the Envoy Gateway v1.8.0 bundled-chart bump to the v3.24 operator branch. Cherry-picks cleanlyrelease-v1.43 already carries the #4690 (Namespaced Mode) renderer, same as master, so the EG-1.8.0 delta applies with no conflict.

Type: enhancement.

  • Makefile: ENVOY_GATEWAY_VERSION v1.7.2 → v1.8.0. release-v1.43 already pins GO_BUILD_VER=1.26.3-llvm21.1.8-k8s1.36.1, so no GOTOOLCHAIN workaround is needed.
  • go.mod: github.com/envoyproxy/gateway v1.7.2 → v1.8.0, cascading sigs.k8s.io/gateway-api v1.4.1 → v1.5.1 (controller-runtime stays at v0.24.1).
  • pkg/render/gatewayapi/gateway_api.go: parseManifest handles the two new admission-policy kinds the v1.8 chart ships — ValidatingAdmissionPolicy + ValidatingAdmissionPolicyBinding (gateway-api safe-upgrades). gateway_api_test.go: controllerExpected gains them.

See #4832 for full rationale + the upstream v1.8.0 behavior-change list.

Verification

  • go mod tidy clean on the release-v1.43 base — controller-runtime v0.24.1 + gateway-api v1.5.1 + gateway v1.8.0 resolve.
  • go test ./pkg/render/gatewayapi/... — pass (embedded chart regenerated at v1.8.0 via helm v3.20.2).
  • CI.

Release Note

Bumped bundled Envoy Gateway from v1.7.2 to v1.8.0. Adds first-class `ListenerSet` support (enables cert-manager and external-dns integration with Gateway-API), the `safe-upgrades` ValidatingAdmissionPolicy for CRD version migrations, and pulls in the v1.8.0 security and bug-fix rollup. Note: v1.8.0 contains several upstream behavior changes (DirectResponse template interpolation, SecurityPolicy `0s` timeout semantics, samplingFraction 100x correction, OIDC filter consolidation) — see https://gateway.envoyproxy.io/news/releases/notes/v1.8.0/.

For PR author

  • Tests for change — gateway_api_test.go updated for the new admission-policy resources.
  • If changing pkg/apis/, run make gen-files — N/A (no pkg/apis changes).
  • If changing versions, run make gen-versions — N/A (EG chart version, not a CE component version).

For PR reviewers

  • Milestone set according to targeted release.
  • Appropriate labels: kind/enhancement, enterprise, release-note-required, docs-pr-required.

Re-derived onto current master after tigera#4690 (Namespaced Mode) rewrote the
gatewayapi renderer to render the embedded helm chart at runtime (the
prior static gateway_api_resources.yaml is gone).

- Makefile: ENVOY_GATEWAY_VERSION v1.7.2 -> v1.8.0
- go.mod: github.com/envoyproxy/gateway v1.7.2 -> v1.8.0, cascading
  sigs.k8s.io/gateway-api v1.4.1 -> v1.5.1. controller-runtime stays at
  master's v0.24.1; go mod tidy confirms the v0.24.1 + gateway-api
  v1.5.1 + gateway v1.8.0 set resolves.
- pkg/render/gatewayapi/gateway-helm.tgz: regenerated from upstream
  gateway-helm v1.8.0.
- gateway_api.go: parseManifest now handles the two new admission-policy
  kinds the v1.8 chart ships (ValidatingAdmissionPolicy +
  ValidatingAdmissionPolicyBinding for the gateway-api "safe-upgrades"
  policy). Without this, the renderer's fail-loud default trips on them.
- gateway_api_test.go: controllerExpected gains the safe-upgrades VAP +
  binding.

v1.8.0 adds ListenerSet support, requested by community users for
cert-manager / external-dns integration on Gateway-API installs (tigera#4534).

(cherry picked from commit a7ecd98)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants