Skip to content

feat: set OverlappingTLSConfig condition for merged Gateways#5862

Merged
arkodg merged 4 commits intoenvoyproxy:mainfrom
zhaohuabing:overlapping-tls-config-merged-gw
May 23, 2025
Merged

feat: set OverlappingTLSConfig condition for merged Gateways#5862
arkodg merged 4 commits intoenvoyproxy:mainfrom
zhaohuabing:overlapping-tls-config-merged-gw

Conversation

@zhaohuabing
Copy link
Copy Markdown
Member

@zhaohuabing zhaohuabing commented Apr 30, 2025 •
edited
Loading

closes: #5860 #2675

@zhaohuabing zhaohuabing requested a review from a team as a code owner April 30, 2025 05:00
@zhaohuabing zhaohuabing requested review from a team and guydc and removed request for a team April 30, 2025 05:00
@codecov
Copy link
Copy Markdown

codecov bot commented Apr 30, 2025 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 65.84%. Comparing base (9b78828) to head (937a5bf).
Report is 109 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #5862      +/-   ##
==========================================
+ Coverage   65.80%   65.84%   +0.04%     
==========================================
  Files         217      217              
  Lines       36020    36067      +47     
==========================================
+ Hits        23703    23750      +47     
- Misses      10836    10837       +1     
+ Partials     1481     1480       -1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@arkodg arkodg added this to the v1.4.0 milestone Apr 30, 2025
@zhaohuabing zhaohuabing force-pushed the overlapping-tls-config-merged-gw branch from ccad1f3 to 059f0f7 Compare May 7, 2025 03:42
@arkodg arkodg modified the milestones: v1.4.0, Backlog May 7, 2025
@zhaohuabing zhaohuabing modified the milestones: Backlog, v1.4.0 May 9, 2025
zhaohuabing added 3 commits May 9, 2025 02:37
@zhaohuabing
fix lint
0c13e89 
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
@zhaohuabing
Merge remote-tracking branch 'origin/main' into overlapping-tls-confi…
a3ac922 
…g-merged-gw
@zhaohuabing
minor change
937a5bf 
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
guydc
guydc approved these changes May 23, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@guydc guydc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@arkodg arkodg merged commit be51e5b into envoyproxy:main May 23, 2025
25 checks passed
@zhaohuabing zhaohuabing deleted the overlapping-tls-config-merged-gw branch May 24, 2025 00:07
@kkk777-7 kkk777-7 mentioned this pull request May 26, 2025
Merged
arkodg pushed a commit to arkodg/gateway that referenced this pull request Jun 3, 2025
@zhaohuabing
feat: set OverlappingTLSConfig condition for merged Gateways (envoypr…
6fbd588 
…oxy#5862)

* set OverlappingTLSConfig condition for merged Gateways

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* fix lint

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* minor change

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

---------

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
(cherry picked from commit be51e5b)
Signed-off-by: Arko Dasgupta <[email protected]>
arkodg added a commit that referenced this pull request Jun 4, 2025
@arkodg @zhaohuabing
@cnvergence @zirain @ryanhristovski @ankushagarwal @kkk777-7 @guydc @jukie @eminaktas
[release/v1.4] Cherry Pick fixes into v1.4.1 (#6258)
12345ea 
* feat: set OverlappingTLSConfig condition for merged Gateways (#5862)

* set OverlappingTLSConfig condition for merged Gateways

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* fix lint

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* minor change

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

---------

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
(cherry picked from commit be51e5b)
Signed-off-by: Arko Dasgupta <[email protected]>

* e2e: fix backend tls test (#6029)

* fix backend tls test

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* enable backend tls test

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* remove gateway TLS to simplify the test

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* rename secret to avoid conflicts

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

---------

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
(cherry picked from commit a685667)
Signed-off-by: Arko Dasgupta <[email protected]>

* validate gateway namespace mode and merged gateways (#6041)

* validate gateway namespace mode and merged gateways in translator

Signed-off-by: Karol Szwaj <[email protected]>

* fix lint

Signed-off-by: Karol Szwaj <[email protected]>

* skip merge gateways test

Signed-off-by: Karol Szwaj <[email protected]>

* validate on gatewayclass and set the status

Signed-off-by: Karol Szwaj <[email protected]>

* skip e2e test

Signed-off-by: Karol Szwaj <[email protected]>

* add valid testcases

Signed-off-by: Karol Szwaj <[email protected]>

* Update internal/provider/kubernetes/controller.go

Co-authored-by: Arko Dasgupta <[email protected]>
Signed-off-by: Karol Szwaj <[email protected]>

* fix lint

Signed-off-by: Karol Szwaj <[email protected]>

* skip merge gateways test

Signed-off-by: Karol Szwaj <[email protected]>

* rebase

Signed-off-by: Karol Szwaj <[email protected]>

---------

Signed-off-by: Karol Szwaj <[email protected]>
Co-authored-by: zirain <[email protected]>
Co-authored-by: Arko Dasgupta <[email protected]>
(cherry picked from commit c5f6831)
Signed-off-by: Arko Dasgupta <[email protected]>

* Fix shared=true when no clientSelector, (#6072)

* Fix shared=true when no clientSelector, cleanup filter logic, fix rl descriptor logic

Signed-off-by: Ryan Hristovski <[email protected]>

* testdata update

Signed-off-by: Ryan Hristovski <[email protected]>

* Linting, remove unused funcs

Signed-off-by: Ryan Hristovski <[email protected]>

* fix e2e

Signed-off-by: Ryan Hristovski <[email protected]>
(cherry picked from commit bb3c8da)
Signed-off-by: Arko Dasgupta <[email protected]>

* fix(tranlator): SubjectAltNames were being dropped from BackendTLSPolicy.validation (#6092)

* Add support for SubjectAltNames from BackendTLSPolicy.validation

Signed-off-by: Ankush Agarwal <[email protected]>
(cherry picked from commit 35420d5)
Signed-off-by: Arko Dasgupta <[email protected]>

* feat: add ownerreference to infra resources when gateway namespace mode (#6100)

* feat: add ownerreference to infra resources when gateway namespace mode

Signed-off-by: kkk777-7 <[email protected]>
(cherry picked from commit fc462a8)
Signed-off-by: Arko Dasgupta <[email protected]>

* fix: add FullDuplexStreamed to enum (#6103)

* fix: add FullDuplexStreamed to enum

Signed-off-by: Guy Daich <[email protected]>
(cherry picked from commit 020d60a)
Signed-off-by: Arko Dasgupta <[email protected]>

* fix: Use quoted values zone annotation in topology injector (#6133)

* Quoted string for zone values

Signed-off-by: jukie <[email protected]>

* release note

Signed-off-by: jukie <[email protected]>

* regen

Signed-off-by: jukie <[email protected]>
(cherry picked from commit ea9cb05)
Signed-off-by: Arko Dasgupta <[email protected]>

* fix: return early from buildwasms (#6169)

return early from buildwasms

Signed-off-by: Guy Daich <[email protected]>
(cherry picked from commit 64624fe)
Signed-off-by: Arko Dasgupta <[email protected]>

* chore: bump go and purego (#6174)

* chore: bump go and purego

Signed-off-by: zirain <[email protected]>

* fix  gen

Signed-off-by: zirain <[email protected]>

---------

Signed-off-by: zirain <[email protected]>
(cherry picked from commit 40ae9e3)
Signed-off-by: Arko Dasgupta <[email protected]>

* fix: translate xds udp listener (#6183)

* fix: translate udp listener

Signed-off-by: kkk777-7 <[email protected]>

* add: tcp/udp no routes testdata in xds translator

Signed-off-by: kkk777-7 <[email protected]>

* add: release note

Signed-off-by: kkk777-7 <[email protected]>
(cherry picked from commit 8f538e7)
Signed-off-by: Arko Dasgupta <[email protected]>

* Change static uid to  for global ratelimit dashboard (#6193)

Signed-off-by: Emin Aktas <[email protected]>
(cherry picked from commit f721925)
Signed-off-by: Arko Dasgupta <[email protected]>

* Fix broken btp ratelimit merge (#6214)

* Fix broken btp ratelimit merge

Signed-off-by: Ryan Hristovski <[email protected]>

* lint

Signed-off-by: Ryan Hristovski <[email protected]>

---------

Signed-off-by: Ryan Hristovski <[email protected]>
(cherry picked from commit 0f6f363)
Signed-off-by: Arko Dasgupta <[email protected]>

* Keep ALPN configuration for listeners with overlapping certificates when ALPN is explicitly set via ClientTrafficPolicy (#6217)

Keep ALPN configuration for listeners with overlapping certificates when ALPN is explicitly set in ClientTrafficPolicy

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
(cherry picked from commit de816a6)
Signed-off-by: Arko Dasgupta <[email protected]>

* fix testdata

Signed-off-by: Arko Dasgupta <[email protected]>

* Allow for headless envoy services (#6250)

* Allow for headless envoy services

Signed-off-by: Ryan Hristovski <[email protected]>

* Allow headless service, cleanup

Signed-off-by: Ryan Hristovski <[email protected]>

* clean

Signed-off-by: Ryan Hristovski <[email protected]>

* Add test and comment

Signed-off-by: Ryan Hristovski <[email protected]>

* Fix tests

Signed-off-by: Ryan Hristovski <[email protected]>
(cherry picked from commit 2e168a8)
Signed-off-by: Arko Dasgupta <[email protected]>

* remove infra ENVOY_GATEWAY_NAMESPACE and introduce ENVOY_POD_NAMESPACE envVar for accesslog (#6221)

* remove infra ENVOY_GATEWAY_NAMESPACE and introduce ENVOY_POD_NAMESPACE envVar for accesslog

Signed-off-by: Karol Szwaj <[email protected]>

* fix e2e test

Signed-off-by: Karol Szwaj <[email protected]>

---------

Signed-off-by: Karol Szwaj <[email protected]>
(cherry picked from commit b7ed197)
Signed-off-by: Arko Dasgupta <[email protected]>

* fix lint

Signed-off-by: Arko Dasgupta <[email protected]>

---------

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Signed-off-by: Arko Dasgupta <[email protected]>
Signed-off-by: Karol Szwaj <[email protected]>
Signed-off-by: Ryan Hristovski <[email protected]>
Signed-off-by: Ankush Agarwal <[email protected]>
Signed-off-by: kkk777-7 <[email protected]>
Signed-off-by: Guy Daich <[email protected]>
Signed-off-by: jukie <[email protected]>
Signed-off-by: zirain <[email protected]>
Signed-off-by: Emin Aktas <[email protected]>
Co-authored-by: Huabing (Robin) Zhao <[email protected]>
Co-authored-by: Karol Szwaj <[email protected]>
Co-authored-by: zirain <[email protected]>
Co-authored-by: Ryan Hristovski <[email protected]>
Co-authored-by: Ankush Agarwal <[email protected]>
Co-authored-by: Kota Kimura <[email protected]>
Co-authored-by: Guy Daich <[email protected]>
Co-authored-by: Isaac <[email protected]>
Co-authored-by: Emin AKTAS <[email protected]>
@BrewTestBot BrewTestBot mentioned this pull request Aug 8, 2025
Merged
shawnh2 pushed a commit to shawnh2/gateway that referenced this pull request Sep 15, 2025
@arkodg @zhaohuabing
@cnvergence @zirain @ryanhristovski @ankushagarwal @kkk777-7 @guydc @jukie @eminaktas @shawnh2
[release/v1.4] Cherry Pick fixes into v1.4.1 (envoyproxy#6258)
d98883b 
* feat: set OverlappingTLSConfig condition for merged Gateways (envoyproxy#5862)

* set OverlappingTLSConfig condition for merged Gateways

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* fix lint

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* minor change

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

---------

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
(cherry picked from commit be51e5b)
Signed-off-by: Arko Dasgupta <[email protected]>

* e2e: fix backend tls test (envoyproxy#6029)

* fix backend tls test

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* enable backend tls test

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* remove gateway TLS to simplify the test

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* rename secret to avoid conflicts

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

---------

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
(cherry picked from commit a685667)
Signed-off-by: Arko Dasgupta <[email protected]>

* validate gateway namespace mode and merged gateways (envoyproxy#6041)

* validate gateway namespace mode and merged gateways in translator

Signed-off-by: Karol Szwaj <[email protected]>

* fix lint

Signed-off-by: Karol Szwaj <[email protected]>

* skip merge gateways test

Signed-off-by: Karol Szwaj <[email protected]>

* validate on gatewayclass and set the status

Signed-off-by: Karol Szwaj <[email protected]>

* skip e2e test

Signed-off-by: Karol Szwaj <[email protected]>

* add valid testcases

Signed-off-by: Karol Szwaj <[email protected]>

* Update internal/provider/kubernetes/controller.go

Co-authored-by: Arko Dasgupta <[email protected]>
Signed-off-by: Karol Szwaj <[email protected]>

* fix lint

Signed-off-by: Karol Szwaj <[email protected]>

* skip merge gateways test

Signed-off-by: Karol Szwaj <[email protected]>

* rebase

Signed-off-by: Karol Szwaj <[email protected]>

---------

Signed-off-by: Karol Szwaj <[email protected]>
Co-authored-by: zirain <[email protected]>
Co-authored-by: Arko Dasgupta <[email protected]>
(cherry picked from commit c5f6831)
Signed-off-by: Arko Dasgupta <[email protected]>

* Fix shared=true when no clientSelector, (envoyproxy#6072)

* Fix shared=true when no clientSelector, cleanup filter logic, fix rl descriptor logic

Signed-off-by: Ryan Hristovski <[email protected]>

* testdata update

Signed-off-by: Ryan Hristovski <[email protected]>

* Linting, remove unused funcs

Signed-off-by: Ryan Hristovski <[email protected]>

* fix e2e

Signed-off-by: Ryan Hristovski <[email protected]>
(cherry picked from commit bb3c8da)
Signed-off-by: Arko Dasgupta <[email protected]>

* fix(tranlator): SubjectAltNames were being dropped from BackendTLSPolicy.validation (envoyproxy#6092)

* Add support for SubjectAltNames from BackendTLSPolicy.validation

Signed-off-by: Ankush Agarwal <[email protected]>
(cherry picked from commit 35420d5)
Signed-off-by: Arko Dasgupta <[email protected]>

* feat: add ownerreference to infra resources when gateway namespace mode (envoyproxy#6100)

* feat: add ownerreference to infra resources when gateway namespace mode

Signed-off-by: kkk777-7 <[email protected]>
(cherry picked from commit fc462a8)
Signed-off-by: Arko Dasgupta <[email protected]>

* fix: add FullDuplexStreamed to enum (envoyproxy#6103)

* fix: add FullDuplexStreamed to enum

Signed-off-by: Guy Daich <[email protected]>
(cherry picked from commit 020d60a)
Signed-off-by: Arko Dasgupta <[email protected]>

* fix: Use quoted values zone annotation in topology injector (envoyproxy#6133)

* Quoted string for zone values

Signed-off-by: jukie <[email protected]>

* release note

Signed-off-by: jukie <[email protected]>

* regen

Signed-off-by: jukie <[email protected]>
(cherry picked from commit ea9cb05)
Signed-off-by: Arko Dasgupta <[email protected]>

* fix: return early from buildwasms (envoyproxy#6169)

return early from buildwasms

Signed-off-by: Guy Daich <[email protected]>
(cherry picked from commit 64624fe)
Signed-off-by: Arko Dasgupta <[email protected]>

* chore: bump go and purego (envoyproxy#6174)

* chore: bump go and purego

Signed-off-by: zirain <[email protected]>

* fix  gen

Signed-off-by: zirain <[email protected]>

---------

Signed-off-by: zirain <[email protected]>
(cherry picked from commit 40ae9e3)
Signed-off-by: Arko Dasgupta <[email protected]>

* fix: translate xds udp listener (envoyproxy#6183)

* fix: translate udp listener

Signed-off-by: kkk777-7 <[email protected]>

* add: tcp/udp no routes testdata in xds translator

Signed-off-by: kkk777-7 <[email protected]>

* add: release note

Signed-off-by: kkk777-7 <[email protected]>
(cherry picked from commit 8f538e7)
Signed-off-by: Arko Dasgupta <[email protected]>

* Change static uid to  for global ratelimit dashboard (envoyproxy#6193)

Signed-off-by: Emin Aktas <[email protected]>
(cherry picked from commit f721925)
Signed-off-by: Arko Dasgupta <[email protected]>

* Fix broken btp ratelimit merge (envoyproxy#6214)

* Fix broken btp ratelimit merge

Signed-off-by: Ryan Hristovski <[email protected]>

* lint

Signed-off-by: Ryan Hristovski <[email protected]>

---------

Signed-off-by: Ryan Hristovski <[email protected]>
(cherry picked from commit 0f6f363)
Signed-off-by: Arko Dasgupta <[email protected]>

* Keep ALPN configuration for listeners with overlapping certificates when ALPN is explicitly set via ClientTrafficPolicy (envoyproxy#6217)

Keep ALPN configuration for listeners with overlapping certificates when ALPN is explicitly set in ClientTrafficPolicy

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
(cherry picked from commit de816a6)
Signed-off-by: Arko Dasgupta <[email protected]>

* fix testdata

Signed-off-by: Arko Dasgupta <[email protected]>

* Allow for headless envoy services (envoyproxy#6250)

* Allow for headless envoy services

Signed-off-by: Ryan Hristovski <[email protected]>

* Allow headless service, cleanup

Signed-off-by: Ryan Hristovski <[email protected]>

* clean

Signed-off-by: Ryan Hristovski <[email protected]>

* Add test and comment

Signed-off-by: Ryan Hristovski <[email protected]>

* Fix tests

Signed-off-by: Ryan Hristovski <[email protected]>
(cherry picked from commit 2e168a8)
Signed-off-by: Arko Dasgupta <[email protected]>

* remove infra ENVOY_GATEWAY_NAMESPACE and introduce ENVOY_POD_NAMESPACE envVar for accesslog (envoyproxy#6221)

* remove infra ENVOY_GATEWAY_NAMESPACE and introduce ENVOY_POD_NAMESPACE envVar for accesslog

Signed-off-by: Karol Szwaj <[email protected]>

* fix e2e test

Signed-off-by: Karol Szwaj <[email protected]>

---------

Signed-off-by: Karol Szwaj <[email protected]>
(cherry picked from commit b7ed197)
Signed-off-by: Arko Dasgupta <[email protected]>

* fix lint

Signed-off-by: Arko Dasgupta <[email protected]>

---------

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Signed-off-by: Arko Dasgupta <[email protected]>
Signed-off-by: Karol Szwaj <[email protected]>
Signed-off-by: Ryan Hristovski <[email protected]>
Signed-off-by: Ankush Agarwal <[email protected]>
Signed-off-by: kkk777-7 <[email protected]>
Signed-off-by: Guy Daich <[email protected]>
Signed-off-by: jukie <[email protected]>
Signed-off-by: zirain <[email protected]>
Signed-off-by: Emin Aktas <[email protected]>
Co-authored-by: Huabing (Robin) Zhao <[email protected]>
Co-authored-by: Karol Szwaj <[email protected]>
Co-authored-by: zirain <[email protected]>
Co-authored-by: Ryan Hristovski <[email protected]>
Co-authored-by: Ankush Agarwal <[email protected]>
Co-authored-by: Kota Kimura <[email protected]>
Co-authored-by: Guy Daich <[email protected]>
Co-authored-by: Isaac <[email protected]>
Co-authored-by: Emin AKTAS <[email protected]>
Signed-off-by: shawnh2 <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@arkodg arkodg arkodg approved these changes

@guydc guydc guydc approved these changes

Assignees

No one assigned

Labels

cherrypick/release-v1.4.1

Projects

None yet

Milestone

Backlog

Development

Successfully merging this pull request may close these issues.

Handle overlapping TLS config for merged Gateways

3 participants

@zhaohuabing @arkodg @guydc