* feat: policy field owner

Signed-off-by: kkk777-7 <[email protected]>
Signed-off-by: jukie <[email protected]>

* skip invalid listener

Signed-off-by: zirain <[email protected]>

* fix specValid

Signed-off-by: zirain <[email protected]>

* nit

Signed-off-by: zirain <[email protected]>

* fix

Signed-off-by: zirain <[email protected]>

* MUST NOT pick one conflicting Listener as the winner

Signed-off-by: zirain <[email protected]>

* update

Signed-off-by: zirain <[email protected]>

---------

Signed-off-by: zirain <[email protected]>
Co-authored-by: Isaac Wilson <[email protected]>
Signed-off-by: jukie <[email protected]>

* Revert "add warning for partially accepted targets"

This reverts commit 5d88fbb.

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* remove warning condition for cross-ns policy attachments without referenceGrants

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

---------

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Signed-off-by: jukie <[email protected]>

* add metrics for runner

Signed-off-by: zirain <[email protected]>

* rename

Signed-off-by: zirain <[email protected]>

* rename

Signed-off-by: zirain <[email protected]>

* reuse

Signed-off-by: zirain <[email protected]>

---------

Signed-off-by: zirain <[email protected]>
Signed-off-by: Arko Dasgupta <[email protected]>
Co-authored-by: Arko Dasgupta <[email protected]>
Signed-off-by: jukie <[email protected]>

…8929)

* fix: respect backend endpoint hostname for health checks

### Summary
- Keep BackendTrafficPolicy HTTP health check hostnames as explicit cluster-level hosts, and leave route-derived host fallback to xDS cluster translation.
- Preserve Backend endpoint hostnames as per-endpoint overrides via Endpoint.HealthCheckConfig.hostname, ahead of the route fallback.
- Update gatewayapi/xDS fixtures, release notes, and generated API docs/CRDs for the host selection order.

### Test plan
- go test ./internal/ir
- go test ./internal/xds/translator
- go test ./internal/gatewayapi -run TestTranslate/backendtrafficpolicy
- go test ./internal/gatewayapi -run TestTranslate/(clienttrafficpolicy-http-health-check|envoyextensionpolicy-with-extproc-with-retries|envoyextensionpolicy-with-extproc-with-traffic-features|envoyproxy-accesslog-with-traffic|envoyproxy-tracing-backend-uds|envoyproxy-tracing-backend|securitypolicy-with-jwt-backendcluster|securitypolicy-with-jwt-backendsettings)
- make generate
- make manifests
- git diff --check

Signed-off-by: Arko Dasgupta <[email protected]>
Co-authored-by: Codex <[email protected]>

* fix gen

Signed-off-by: zirain <[email protected]>

---------

Signed-off-by: Arko Dasgupta <[email protected]>
Signed-off-by: zirain <[email protected]>
Co-authored-by: Codex <[email protected]>
Co-authored-by: zirain <[email protected]>
Signed-off-by: jukie <[email protected]>

* feat(helm): propagate commonLabels to RBAC resources

Issue envoyproxy#8817 reported that 'helm template ... --set
commonLabels.custom-label=custom-value' left ClusterRole,
ClusterRoleBinding, Role, and RoleBinding resources unlabelled.
The other resources in the chart already include 'eg.labels' in
their metadata - which picks up 'commonLabels' via the helper
at _helpers.tpl:43 - but envoy-gateway-rbac.yaml didn't set any
labels block.

Add 'labels: {{- include "eg.labels" . | nindent 4 }}' on every
Role / RoleBinding / ClusterRole / ClusterRoleBinding declared in
envoy-gateway-rbac.yaml. Matches the existing labels pattern used
in certgen-rbac.yaml and envoy-gateway-deployment.yaml. Scopes are
'$' inside the watched-namespaces 'range' and '.' at the template
root, same rule the helper block inside the file already used.

Verified locally with:
  helm dependency update charts/gateway-helm
  envsubst < charts/gateway-helm/values.tmpl.yaml > \
    charts/gateway-helm/values.yaml
  helm template eg charts/gateway-helm \
    --set commonLabels.custom-label=custom-value | yq ...

All four RBAC resources now emit 'custom-label: custom-value' in
their metadata.labels, matching the issue's repro steps. Cert-gen
RBAC resources already carried it; this PR brings the core
envoy-gateway RBAC set into parity.

Fixes envoyproxy#8817

Signed-off-by: Matt Van Horn <[email protected]>

* chore: regenerate helm-template snapshots for RBAC labels

Run 'make helm-template.gateway-helm' to regenerate the snapshot fixtures
after the envoy-gateway-rbac.yaml labels change. Adds the 'labels:' block
to the RBAC resources in all 27 test cases.

Signed-off-by: Matt Van Horn <[email protected]>

* fix gen

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* add release note

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

---------

Signed-off-by: Matt Van Horn <[email protected]>
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Co-authored-by: Matt Van Horn <[email protected]>
Co-authored-by: Huabing (Robin) Zhao <[email protected]>
Signed-off-by: jukie <[email protected]>

…idCertificateRef (envoyproxy#8871)

* fix(translator): set ListenerSet and listener Accepted:True for InvalidCertificateRef

When a ListenerSet listener has an unresolvable TLS certificate reference
(InvalidCertificateRef or RefNotPermitted), Accepted: False was incorrectly
set on both the listener and ListenerSet object. The Gateway API spec places
InvalidCertificateRef exclusively under ResolvedRefs, not Accepted — a missing
certificate is a reference resolution concern, not a structural one.

Fixes envoyproxy#8870

Signed-off-by: apkatsikas <[email protected]>

* chore: fix gofumpt formatting in validateListenerConditions

Signed-off-by: apkatsikas <[email protected]>

* fix(translator): separate RefNotPermitted from InvalidCertificateRef handling

Unlike InvalidCertificateRef, RefNotPermitted should not set Accepted:True.
Update unit test fixtures to match.

Signed-off-by: apkatsikas <[email protected]>

* fix gen

Signed-off-by: zirain <[email protected]>

---------

Signed-off-by: apkatsikas <[email protected]>
Signed-off-by: zirain <[email protected]>
Signed-off-by: jukie <[email protected]>

…nvoyproxy#8934)

fix: do not downgrade ALPN for overlapping hostnames withoug SANs overlapping

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Signed-off-by: jukie <[email protected]>

* feat: enableDeferredCreationStats by default

Signed-off-by: zirain <[email protected]>
Signed-off-by: jukie <[email protected]>

…oxy#8962)

* fix: restore last transition time in merge status conditions

Signed-off-by: Rudrakh Panigrahi <[email protected]>

* add release note

Signed-off-by: Rudrakh Panigrahi <[email protected]>

---------

Signed-off-by: Rudrakh Panigrahi <[email protected]>
Signed-off-by: jukie <[email protected]>

Cherry-picked release-notes/v1.8.0.yaml and VERSION bump from envoyproxy#8942.

Signed-off-by: jukie <[email protected]>