fix(helm): propagate commonLabels to RBAC resources#8818
Merged
Conversation
✅ Deploy Preview for cerulean-figolla-1f9435 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Member
|
Hi @mvanhorn Can you sign this commit? |
Member
|
@codex review |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8818 +/- ##
==========================================
+ Coverage 74.74% 74.77% +0.03%
==========================================
Files 251 251
Lines 40372 40372
==========================================
+ Hits 30176 30189 +13
+ Misses 8130 8119 -11
+ Partials 2066 2064 -2 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Issue envoyproxy#8817 reported that 'helm template ... --set commonLabels.custom-label=custom-value' left ClusterRole, ClusterRoleBinding, Role, and RoleBinding resources unlabelled. The other resources in the chart already include 'eg.labels' in their metadata - which picks up 'commonLabels' via the helper at _helpers.tpl:43 - but envoy-gateway-rbac.yaml didn't set any labels block. Add 'labels: {{- include "eg.labels" . | nindent 4 }}' on every Role / RoleBinding / ClusterRole / ClusterRoleBinding declared in envoy-gateway-rbac.yaml. Matches the existing labels pattern used in certgen-rbac.yaml and envoy-gateway-deployment.yaml. Scopes are '$' inside the watched-namespaces 'range' and '.' at the template root, same rule the helper block inside the file already used. Verified locally with: helm dependency update charts/gateway-helm envsubst < charts/gateway-helm/values.tmpl.yaml > \ charts/gateway-helm/values.yaml helm template eg charts/gateway-helm \ --set commonLabels.custom-label=custom-value | yq ... All four RBAC resources now emit 'custom-label: custom-value' in their metadata.labels, matching the issue's repro steps. Cert-gen RBAC resources already carried it; this PR brings the core envoy-gateway RBAC set into parity. Fixes envoyproxy#8817 Signed-off-by: Matt Van Horn <[email protected]>
Run 'make helm-template.gateway-helm' to regenerate the snapshot fixtures after the envoy-gateway-rbac.yaml labels change. Adds the 'labels:' block to the RBAC resources in all 27 test cases. Signed-off-by: Matt Van Horn <[email protected]>
mvanhorn
force-pushed
the
osc/8817-commonlabels-rbac
branch
from
29270b3 to
0af14ed
Compare
Contributor
Author
|
@zhaohuabing signed the commit in fee67e5 and regenerated the helm-template snapshots in 0af14ed - the 27 .out.yaml files under test/helm/gateway-helm/ now include the RBAC labels block. Force-pushed to the PR. Let me know if gen-check still flags anything. |
Member
|
Hi @mvanhorn, could you check and run |
zhaohuabing
changed the title
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Member
|
Hi @mvanhorn sorry for pushing directly to this PR. We would like to get it in v1.8.0. |
zhaohuabing
approved these changes
May 8, 2026
zirain
approved these changes
May 8, 2026
arkodg
approved these changes
May 8, 2026
Contributor
Author
|
Thanks @zhaohuabing for taking it across the line, and @zirain @arkodg for the reviews. Glad it landed in v1.8.0. @kkk777-7 sorry I dropped the |
jukie
added a commit
that referenced
this pull request
May 13, 2026
* fix(api): increase RateLimitSelectCondition.headers MaxItems from 16 to 64 (#8906) * fix(api): increase RateLimitSelectCondition.headers MaxItems from 16 to 64 Co-Authored-By: Claude Sonnet 4.6 <[email protected]> Signed-off-by: wucm667 <[email protected]> Signed-off-by: jukie <[email protected]> * feat: policy field owner (#8538) * feat: policy field owner Signed-off-by: kkk777-7 <[email protected]> Signed-off-by: jukie <[email protected]> * skip invalid listener first in IR (#8577) * skip invalid listener Signed-off-by: zirain <[email protected]> * fix specValid Signed-off-by: zirain <[email protected]> * nit Signed-off-by: zirain <[email protected]> * fix Signed-off-by: zirain <[email protected]> * MUST NOT pick one conflicting Listener as the winner Signed-off-by: zirain <[email protected]> * update Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> Co-authored-by: Isaac Wilson <[email protected]> Signed-off-by: jukie <[email protected]> * fix: remove cross ns policy attachment status (#8901) * Revert "add warning for partially accepted targets" This reverts commit 5d88fbb. Signed-off-by: Huabing (Robin) Zhao <[email protected]> * remove warning condition for cross-ns policy attachments without referenceGrants Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: jukie <[email protected]> * feat: add runner event metrics (#8802) * add metrics for runner Signed-off-by: zirain <[email protected]> * rename Signed-off-by: zirain <[email protected]> * rename Signed-off-by: zirain <[email protected]> * reuse Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> Signed-off-by: Arko Dasgupta <[email protected]> Co-authored-by: Arko Dasgupta <[email protected]> Signed-off-by: jukie <[email protected]> * fix: respect backend endpoint hostname for health checks (#8929) * fix: respect backend endpoint hostname for health checks ### Summary - Keep BackendTrafficPolicy HTTP health check hostnames as explicit cluster-level hosts, and leave route-derived host fallback to xDS cluster translation. - Preserve Backend endpoint hostnames as per-endpoint overrides via Endpoint.HealthCheckConfig.hostname, ahead of the route fallback. - Update gatewayapi/xDS fixtures, release notes, and generated API docs/CRDs for the host selection order. ### Test plan - go test ./internal/ir - go test ./internal/xds/translator - go test ./internal/gatewayapi -run TestTranslate/backendtrafficpolicy - go test ./internal/gatewayapi -run TestTranslate/(clienttrafficpolicy-http-health-check|envoyextensionpolicy-with-extproc-with-retries|envoyextensionpolicy-with-extproc-with-traffic-features|envoyproxy-accesslog-with-traffic|envoyproxy-tracing-backend-uds|envoyproxy-tracing-backend|securitypolicy-with-jwt-backendcluster|securitypolicy-with-jwt-backendsettings) - make generate - make manifests - git diff --check Signed-off-by: Arko Dasgupta <[email protected]> Co-authored-by: Codex <[email protected]> * fix gen Signed-off-by: zirain <[email protected]> --------- Signed-off-by: Arko Dasgupta <[email protected]> Signed-off-by: zirain <[email protected]> Co-authored-by: Codex <[email protected]> Co-authored-by: zirain <[email protected]> Signed-off-by: jukie <[email protected]> * fix(helm): propagate commonLabels to RBAC resources (#8818) * feat(helm): propagate commonLabels to RBAC resources Issue #8817 reported that 'helm template ... --set commonLabels.custom-label=custom-value' left ClusterRole, ClusterRoleBinding, Role, and RoleBinding resources unlabelled. The other resources in the chart already include 'eg.labels' in their metadata - which picks up 'commonLabels' via the helper at _helpers.tpl:43 - but envoy-gateway-rbac.yaml didn't set any labels block. Add 'labels: {{- include "eg.labels" . | nindent 4 }}' on every Role / RoleBinding / ClusterRole / ClusterRoleBinding declared in envoy-gateway-rbac.yaml. Matches the existing labels pattern used in certgen-rbac.yaml and envoy-gateway-deployment.yaml. Scopes are '$' inside the watched-namespaces 'range' and '.' at the template root, same rule the helper block inside the file already used. Verified locally with: helm dependency update charts/gateway-helm envsubst < charts/gateway-helm/values.tmpl.yaml > \ charts/gateway-helm/values.yaml helm template eg charts/gateway-helm \ --set commonLabels.custom-label=custom-value | yq ... All four RBAC resources now emit 'custom-label: custom-value' in their metadata.labels, matching the issue's repro steps. Cert-gen RBAC resources already carried it; this PR brings the core envoy-gateway RBAC set into parity. Fixes #8817 Signed-off-by: Matt Van Horn <[email protected]> * chore: regenerate helm-template snapshots for RBAC labels Run 'make helm-template.gateway-helm' to regenerate the snapshot fixtures after the envoy-gateway-rbac.yaml labels change. Adds the 'labels:' block to the RBAC resources in all 27 test cases. Signed-off-by: Matt Van Horn <[email protected]> * fix gen Signed-off-by: Huabing (Robin) Zhao <[email protected]> * add release note Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Matt Van Horn <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Matt Van Horn <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: jukie <[email protected]> * fix(translator): set ListenerSet and listener Accepted:True for InvalidCertificateRef (#8871) * fix(translator): set ListenerSet and listener Accepted:True for InvalidCertificateRef When a ListenerSet listener has an unresolvable TLS certificate reference (InvalidCertificateRef or RefNotPermitted), Accepted: False was incorrectly set on both the listener and ListenerSet object. The Gateway API spec places InvalidCertificateRef exclusively under ResolvedRefs, not Accepted — a missing certificate is a reference resolution concern, not a structural one. Fixes #8870 Signed-off-by: apkatsikas <[email protected]> * chore: fix gofumpt formatting in validateListenerConditions Signed-off-by: apkatsikas <[email protected]> * fix(translator): separate RefNotPermitted from InvalidCertificateRef handling Unlike InvalidCertificateRef, RefNotPermitted should not set Accepted:True. Update unit test fixtures to match. Signed-off-by: apkatsikas <[email protected]> * fix gen Signed-off-by: zirain <[email protected]> --------- Signed-off-by: apkatsikas <[email protected]> Signed-off-by: zirain <[email protected]> Signed-off-by: jukie <[email protected]> * fix: do not downgrade ALPN for only hostnames-overlapping listeners (#8934) fix: do not downgrade ALPN for overlapping hostnames withoug SANs overlapping Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: jukie <[email protected]> * feat: enableDeferredCreationStats by default (#8937) * feat: enableDeferredCreationStats by default Signed-off-by: zirain <[email protected]> Signed-off-by: jukie <[email protected]> * fix: restore last transition time in merge status conditions (#8962) * fix: restore last transition time in merge status conditions Signed-off-by: Rudrakh Panigrahi <[email protected]> * add release note Signed-off-by: Rudrakh Panigrahi <[email protected]> --------- Signed-off-by: Rudrakh Panigrahi <[email protected]> Signed-off-by: jukie <[email protected]> * [release/v1.8] v1.8.0 release notes Cherry-picked release-notes/v1.8.0.yaml and VERSION bump from #8942. Signed-off-by: jukie <[email protected]> --------- Signed-off-by: wucm667 <[email protected]> Signed-off-by: jukie <[email protected]> Signed-off-by: kkk777-7 <[email protected]> Signed-off-by: zirain <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Arko Dasgupta <[email protected]> Signed-off-by: Arko Dasgupta <[email protected]> Signed-off-by: Matt Van Horn <[email protected]> Signed-off-by: apkatsikas <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> Co-authored-by: wucm667 <[email protected]> Co-authored-by: Claude Sonnet 4.6 <[email protected]> Co-authored-by: Kota Kimura <[email protected]> Co-authored-by: zirain <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Arko Dasgupta <[email protected]> Co-authored-by: Codex <[email protected]> Co-authored-by: Matt Van Horn <[email protected]> Co-authored-by: Matt Van Horn <[email protected]> Co-authored-by: Andrew Katsikas <[email protected]> Co-authored-by: Rudrakh Panigrahi <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Thread
commonLabelsthrough the four RBAC resources declared incharts/gateway-helm/templates/envoy-gateway-rbac.yamlby adding the existingeg.labelshelper to each of them - the same pattern already used incertgen-rbac.yamlandenvoy-gateway-deployment.yaml.Why this matters
Issue #8817 pointed at the concrete gap:
helm template eg ... --set commonLabels.custom-label=custom-valuerendersClusterRole eg-gateway-helm-envoy-gateway-roleandClusterRoleBinding eg-gateway-helm-envoy-gateway-rolebindingwithcustom-label: null. The cause is mechanical - those resources just didn't declare alabels:block, so thecommonLabelsmerged in byeg.labels(at_helpers.tpl:43) never reached them. The cert-gen RBAC and the rest of the chart already have the labels block, so this PR just closes the last gap.Changes
charts/gateway-helm/templates/envoy-gateway-rbac.yaml: addrange, ClusterRole + ClusterRoleBinding at the template root, and the two outer ClusterRole/ClusterRoleBinding in the{{ else }}branch).$vs.matches the existing template-root scoping rules in the same file.Testing
Local render:
After this change, all four envoy-gateway RBAC resources (plus the cert-gen set that was already wired) render
custom-label: custom-value:Matches the expected output in the issue's repro block.
Fixes #8817
This contribution was developed with AI assistance (Claude Code).