Skip to content

Cherry pick/v1.6.0#7482

Merged
arkodg merged 39 commits intoenvoyproxy:release/v1.6from
rudrakhp:cherry-pick/v1.6.0
Nov 10, 2025
Merged

Cherry pick/v1.6.0#7482
arkodg merged 39 commits intoenvoyproxy:release/v1.6from
rudrakhp:cherry-pick/v1.6.0

Conversation

@rudrakhp
Copy link
Copy Markdown
Member

@rudrakhp rudrakhp commented Nov 10, 2025

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

Release Notes: Yes/No

maxbrunet and others added 30 commits November 10, 2025 23:33
@maxbrunet @rudrakhp
chore(examples): fix extensionserver build (#7398)
dfb2a0a 
Signed-off-by: Maxime Brunet <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@zhaohuabing @rudrakhp
chore: add missing endpoints in the crl test (#7402)
eb2b573 
fix test for #7199

Signed-off-by: Huabing Zhao <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@maxbrunet @zirain @rudrakhp
chore(make): exit on failure (#7387)
a5b547d 
Signed-off-by: Maxime Brunet <[email protected]>
Co-authored-by: zirain <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@woodgear @rudrakhp
fix: port typo (#7397)
7a61be4 
Signed-off-by: cong <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@dependabot @rudrakhp
build(deps): bump busybox from 2f590fc to e3652a0 in /tools/docke…
883d7e2 
…r/envoy-gateway (#7409)

build(deps): bump busybox in /tools/docker/envoy-gateway

Bumps busybox from `2f590fc` to `e3652a0`.

---
updated-dependencies:
- dependency-name: busybox
  dependency-version: e3652a00a2fabd16ce889f0aa32c38eec347b997e73bd09e69c962ec7f8732ee
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@zirain @rudrakhp
fix: validate EnvoyGateway configuration before reload (#7412)
0554e6d 
Signed-off-by: zirain <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@dependabot @rudrakhp
build(deps): bump the actions group across 1 directory with 2 updates (…
b6a4569 
…#7410)

Bumps the actions group with 2 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action) and [google/osv-scanner-action](https://github.com/google/osv-scanner-action).

Updates `github/codeql-action` from 4.31.0 to 4.31.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@4e94bd1...0499de3)

Updates `google/osv-scanner-action` from 2.2.3 to 2.2.4
- [Release notes](https://github.com/google/osv-scanner-action/releases)
- [Commits](google/osv-scanner-action@e92b5d0...9bb6957)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.31.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: google/osv-scanner-action
  dependency-version: 2.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@Inode1 @rudrakhp
fix: missing onInvalidMessage for ClientTrafficPolicy (#7417)
d1b4eb1 
Signed-off-by: i.makarychev <[email protected]>
Signed-off-by: i.makarychev <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@zhaohuabing @rudrakhp
chore: add missing filters in the filter order configuration (#7404)
9cc394e 
* add missing filters in the filter order configuration

Signed-off-by: Huabing Zhao <[email protected]>

* fix wrong filter name

Signed-off-by: Huabing Zhao <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@davem-git @rudrakhp
test: tcp security policy e2e (#7226)
b70a4e6 
* feat(securitypolicy): Added e2e tests for tcp security policies

Signed-off-by: davem-git <[email protected]>

* removed commented out line

Signed-off-by: davem-git <[email protected]>

---------

Signed-off-by: davem-git <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@davem-git @rudrakhp
Docs: tcp security policy (#7247)
2943181 
* updated release notes

Signed-off-by: davem-git <[email protected]>

* updated docs

Signed-off-by: davem-git <[email protected]>

* fixed merge conflict

Signed-off-by: davem-git <[email protected]>

---------

Signed-off-by: davem-git <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@kkk777-7 @rudrakhp
feat: support both local and global ratelimit simultaneously (#7334)
f3dec7e 
* update rate limit type

Signed-off-by: kkk777-7 <[email protected]>

* feat: support both type rate limit

Signed-off-by: kkk777-7 <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@kkk777-7 @rudrakhp
feat: support separated path match in ratelimit path (#7413)
0548ad2 
* update: path match ratelimit e2e

Signed-off-by: kkk777-7 <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@rudrakhp
fix: handle optional next update for CRL (#7422)
925eb53 
fix: handle optional next update for crl

Signed-off-by: Rudrakh Panigrahi <[email protected]>
@zhaohuabing @rudrakhp
fix: missing jwt provider when jwt is configured on multiple listener…
39d7ca8 
…s sharing the same port (#7337)

* fix jwt provider missing when jwt is configured at multiple ir listeners

Signed-off-by: Huabing Zhao <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@jukie @rudrakhp
fix: only insert proxy service once it exists (#7424)
b8f87d7 
* maybe this is the fix?

Signed-off-by: jukie <[email protected]>

* fixes

Signed-off-by: jukie <[email protected]>

* cleanup

Signed-off-by: jukie <[email protected]>

* consolidate

Signed-off-by: jukie <[email protected]>

* fix

Signed-off-by: jukie <[email protected]>

---------

Signed-off-by: jukie <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@zirain @rudrakhp
fix error when updating invalid gateway status (#7415)
ea465a6 
* fix error when updating invalid gateway status

Signed-off-by: zirain <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@zhaohuabing @rudrakhp
fix: avoid calling the issuer's well-known endpoint for every routes (#…
d503774 
…7394)

* fix: avoid calling the issuer's well-known endpoint for every routes with

Signed-off-by: Huabing Zhao <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@gonzaloserrano @rudrakhp
fix: memory leak (#7429)
96decfe 
Fix memory leak.

Two watchable.Maps were never closed when shutting down the provider:
- GatewayClassStatuses.Close() - missing in GatewayAPIStatuses.Close()
- BackendTrafficPolicyStatuses.Close() - missing in PolicyStatuses.Close()

Each unclosed map leaked 3 goroutines:
1. Internal watchable.Map.coalesce goroutine
2. HandleSubscription goroutine blocked on channel read
3. Error handler goroutine blocked on channel read

Signed-off-by: Gonzalo Serrano <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@arkodg @rudrakhp
perf: move snapshot update above status update in xds layer (#7423)
07278ca 
Signed-off-by: Arko Dasgupta <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@jukie @rudrakhp
chore: cleanup logging when inserting proxy service cluster (#7431)
3decb8a 
cleanup

Signed-off-by: jukie <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@fabian4 @rudrakhp
upgrade gofumpt (#7420)
1259746 
Signed-off-by: fabian4 <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@nacx @rudrakhp
feat(translator): relax backend restrictions for localhost when runni…
7cf7832 
…ng standalone with Host infrastructure (#7427)

Signed-off-by: Rudrakh Panigrahi <[email protected]>
@zhaohuabing @rudrakhp
chore: improve api docs for http10.useDefaultHost (#7435)
3d22aad 
* imporove api docs for useDefaultHost

Signed-off-by: Huabing Zhao <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@zirain @rudrakhp
ci: disable lint.dependabot (#7445)
f1f5a7d 
Signed-off-by: zirain <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@zirain @rudrakhp
chore: bump github.com/containerd/containerd (#7448)
dba801e 
Signed-off-by: zirain <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@rudrakhp
perf: do not set last transition time for status in watcher layer (#7268
9ebb51b 
)

Signed-off-by: Rudrakh Panigrahi <[email protected]>
@zirain @rudrakhp
docs: fix gwapi docs (#7408)
305ec67 
* docs: fix gwapi docs

Signed-off-by: zirain <[email protected]>

* fix

Signed-off-by: zirain <[email protected]>

* update

Signed-off-by: zirain <[email protected]>

---------

Signed-off-by: zirain <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@zirain @rudrakhp
chore: renable lint.dependabot (#7454)
a3888d4 
Signed-off-by: zirain <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@rudrakhp @zirain
chore: remove last transition time comparison as no longer set (#7451)
af1d36a 
chore: remove last transition time comparision as no longer set

Signed-off-by: Rudrakh Panigrahi <[email protected]>
Co-authored-by: zirain <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
kkk777-7 and others added 9 commits November 10, 2025 23:33
@kkk777-7 @rudrakhp
fix: merged policy status (#7376)
3266d7c 
Signed-off-by: kkk777-7 <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@kkk777-7 @rudrakhp
fix: header modifier doesn't permit multiple values with commas (#7436)
75ac37e 
* revert: separate headers with commas

Signed-off-by: kkk777-7 <[email protected]>

* add e2e

Signed-off-by: kkk777-7 <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@zirain @rudrakhp
fix auto http config with proxy protocol (#7439)
a81e77c 
* don't set TypedExtensionProtocolOptions when ProxyProtocol enabled

Signed-off-by: zirain <[email protected]>

* update test

Signed-off-by: zirain <[email protected]>

* enable auto ALPN for proxy protocol

Signed-off-by: zirain <[email protected]>

* add e2e

Signed-off-by: zirain <[email protected]>

* update

Signed-off-by: zirain <[email protected]>

---------

Signed-off-by: zirain <[email protected]>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@dependabot @rudrakhp
build(deps): bump sigs.k8s.io/controller-runtime from 0.22.3 to 0.22.…
f02129c 
…4 in /examples/extension-server (#7470)

build(deps): bump sigs.k8s.io/controller-runtime

Bumps [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) from 0.22.3 to 0.22.4.
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases)
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/controller-runtime@v0.22.3...v0.22.4)

---
updated-dependencies:
- dependency-name: sigs.k8s.io/controller-runtime
  dependency-version: 0.22.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@dependabot @rudrakhp
build(deps): bump softprops/action-gh-release from 2.4.1 to 2.4.2 in …
82a2187 
…the actions group across 1 directory (#7461)

build(deps): bump softprops/action-gh-release

Bumps the actions group with 1 update in the / directory: [softprops/action-gh-release](https://github.com/softprops/action-gh-release).

Updates `softprops/action-gh-release` from 2.4.1 to 2.4.2
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@6da8fa9...5be0e66)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 2.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@dependabot @rudrakhp
build(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1…
b46ebfa 
….35.0 to 1.36.0 in /examples/grpc-ext-proc (#7471)

build(deps): bump github.com/envoyproxy/go-control-plane/envoy

Bumps [github.com/envoyproxy/go-control-plane/envoy](https://github.com/envoyproxy/go-control-plane) from 1.35.0 to 1.36.0.
- [Release notes](https://github.com/envoyproxy/go-control-plane/releases)
- [Changelog](https://github.com/envoyproxy/go-control-plane/blob/main/CHANGELOG.md)
- [Commits](envoyproxy/go-control-plane@envoy/v1.35.0...envoy/v1.36.0)

---
updated-dependencies:
- dependency-name: github.com/envoyproxy/go-control-plane/envoy
  dependency-version: 1.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@dependabot @rudrakhp
build(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1…
a6a2789 
….35.0 to 1.36.0 in /examples/envoy-ext-auth (#7467)

build(deps): bump github.com/envoyproxy/go-control-plane/envoy

Bumps [github.com/envoyproxy/go-control-plane/envoy](https://github.com/envoyproxy/go-control-plane) from 1.35.0 to 1.36.0.
- [Release notes](https://github.com/envoyproxy/go-control-plane/releases)
- [Changelog](https://github.com/envoyproxy/go-control-plane/blob/main/CHANGELOG.md)
- [Commits](envoyproxy/go-control-plane@envoy/v1.35.0...envoy/v1.36.0)

---
updated-dependencies:
- dependency-name: github.com/envoyproxy/go-control-plane/envoy
  dependency-version: 1.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@dependabot @rudrakhp
build(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1…
61ea17a 
….35.1-0.20251029084203-42a4a9261f66 to 1.36.0 in /examples/extension-server (#7468)

build(deps): bump github.com/envoyproxy/go-control-plane/envoy

Bumps [github.com/envoyproxy/go-control-plane/envoy](https://github.com/envoyproxy/go-control-plane) from 1.35.1-0.20251029084203-42a4a9261f66 to 1.36.0.
- [Release notes](https://github.com/envoyproxy/go-control-plane/releases)
- [Changelog](https://github.com/envoyproxy/go-control-plane/blob/main/CHANGELOG.md)
- [Commits](https://github.com/envoyproxy/go-control-plane/commits/envoy/v1.36.0)

---
updated-dependencies:
- dependency-name: github.com/envoyproxy/go-control-plane/envoy
  dependency-version: 1.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@rudrakhp
[release/v1.6] v1.6.0 release docs (#7475)
22497a6 
Signed-off-by: Rudrakh Panigrahi <[email protected]>
@rudrakhp rudrakhp requested a review from a team as a code owner November 10, 2025 18:22
@arkodg arkodg requested review from a team November 10, 2025 19:21
@arkodg arkodg merged commit 26ebf49 into envoyproxy:release/v1.6 Nov 10, 2025
77 of 83 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@arkodg arkodg arkodg approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.