Skip to content

fix: alway include the controller namespace in the watched namespaces#9100

Merged
zhaohuabing merged 14 commits into
envoyproxy:mainfrom
zhaohuabing:fix-9094
Jun 3, 2026
Merged

fix: alway include the controller namespace in the watched namespaces#9100
zhaohuabing merged 14 commits into
envoyproxy:mainfrom
zhaohuabing:fix-9094

Conversation

@zhaohuabing

@zhaohuabing zhaohuabing commented May 28, 2026

Copy link
Copy Markdown
Member

This PR always includes the controller namespace in the watched namespaces and watch infra resources in the controller namespace. This is required to

The current behavior of kubernetes provider in the watched namespace mode is verified in #9104. It fails when the controller namespace is not explicitly configured.

fixes: #9094

@zhaohuabing zhaohuabing requested a review from a team as a code owner May 28, 2026 03:10
@zhaohuabing zhaohuabing marked this pull request as draft May 28, 2026 03:10
@netlify

netlify Bot commented May 28, 2026

Copy link
Copy Markdown

Deploy Preview for cerulean-figolla-1f9435 ready!

Name Link
🔨 Latest commit 3a4d8e6
🔍 Latest deploy log https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a1fe8d9abb9970008cfd1d9
😎 Deploy Preview https://deploy-preview-9100--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 065e3c15af

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread test/config/envoy-gateaway-config/watch-namespaces.yaml
@codecov

codecov Bot commented May 28, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 83.58209% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.81%. Comparing base (3ab110e) to head (3a4d8e6).
⚠️ Report is 4 commits behind head on main.

Files with missing lines Patch % Lines
internal/provider/kubernetes/kubernetes.go 73.80% 9 Missing and 2 partials ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #9100      +/-   ##
==========================================
+ Coverage   74.76%   74.81%   +0.04%     
==========================================
  Files         252      252              
  Lines       40687    40756      +69     
==========================================
+ Hits        30421    30490      +69     
  Misses       8186     8186              
  Partials     2080     2080              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@zhaohuabing zhaohuabing force-pushed the fix-9094 branch 2 times, most recently from bb64f89 to ea80207 Compare May 28, 2026 05:47
@zhaohuabing zhaohuabing changed the title fix: caching regression when using label selectors for watched namespaces. fix: alway include the controller namespace in the watched namespaces May 28, 2026
@zhaohuabing zhaohuabing force-pushed the fix-9094 branch 2 times, most recently from ef94fcc to 2931bfc Compare May 28, 2026 06:10
@zhaohuabing

Copy link
Copy Markdown
Member Author

@codex review

@zhaohuabing zhaohuabing marked this pull request as ready for review May 28, 2026 06:11
- key: kubernetes.io/metadata.name
operator: In
values:
- btp-cross-ns-denied

@zhaohuabing zhaohuabing May 28, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove the explicitly configured envoy-gateway-system - it should always be included by default to watch Infra resources.

Signed-off-by: Huabing Zhao <[email protected]>
(cherry picked from commit 84be503d855e968b7b6999d476a6897e98d4e330)
@zhaohuabing

Copy link
Copy Markdown
Member Author

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3fa526706a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread internal/provider/kubernetes/kubernetes.go Outdated

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a regression in Kubernetes namespace-scoped watch modes by ensuring the Envoy Gateway controller namespace is always included, so the controller can consistently reconcile its own infrastructure resources (e.g., Envoy Services/Deployments/Secrets) even when users restrict watched namespaces via an explicit list or a namespace label selector.

Changes:

  • Always add the controller namespace to the controller-runtime cache’s DefaultNamespaces when using explicit namespace list watch mode.
  • Extend namespace-selector-based list filtering and watch predicates to bypass user selectors for the controller namespace.
  • Update docs, API reference text, test configuration, and release notes to reflect the new behavior.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated no comments.

Show a summary per file
File Description
test/config/envoy-gateaway-config/watch-namespaces.yaml Switches test config to NamespaceSelector-based watching without explicitly listing the controller namespace.
site/content/en/v1.8/tasks/operations/gateway-namespace-mode.md Documents that the controller namespace is always included in watched namespaces.
site/content/en/v1.8/tasks/operations/deployment-mode.md Clarifies controller namespace inclusion for reconciling managed infra resources.
site/content/en/v1.8/api/extension_types.md Updates API reference text to state controller namespace is always included.
site/content/en/latest/tasks/operations/gateway-namespace-mode.md Same documentation update for “latest”.
site/content/en/latest/tasks/operations/deployment-mode.md Same documentation update for “latest”.
site/content/en/latest/api/extension_types.md Same API reference update for “latest”.
release-notes/current.yaml Adds a bug-fix release note describing the controller-namespace inclusion behavior.
internal/provider/kubernetes/predicates.go Ensures controller-namespace events bypass namespace-selector filtering.
internal/provider/kubernetes/predicates_test.go Adds test coverage validating controller-namespace inclusion for List-based infra lookups.
internal/provider/kubernetes/namespace_selector_client.go Adds an “included namespaces” bypass set (used for controller namespace) for namespace-selector filtered List operations.
internal/provider/kubernetes/namespace_selector_client_test.go Extends tests to cover included-namespace bypass behavior.
internal/provider/kubernetes/kubernetes.go Ensures cache includes controller namespace in explicit namespace list mode.
internal/provider/kubernetes/controller.go Wraps the reconciler client so the controller namespace is always included under NamespaceSelector watch mode.
api/v1alpha1/envoygateway_types.go Updates API comments to document controller namespace inclusion in both watch modes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Huabing Zhao <[email protected]>
// When configured with an explicit namespace watch list, scope the default
// cache to those namespaces and add type-specific controller namespace
// exceptions below.
if svrCfg.EnvoyGateway.WatchesNamespaces() {

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This and the above if svrCfg.EnvoyGateway.GatewayNamespaceMode() { code block are starting to get a bit messy. For easier review, I keep that block untouched in this PR, and we can clean it up in a follow-up PR.

Signed-off-by: Huabing (Robin) Zhao <[email protected]>
@zhaohuabing

Copy link
Copy Markdown
Member Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

Comment thread internal/provider/kubernetes/kubernetes.go Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3a396323f2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

// NamespaceMode returns if uses namespace mode.
func (e *EnvoyGateway) NamespaceMode() bool {
// WatchesNamespaces returns true when Envoy Gateway is configured to watch specific Kubernetes namespaces.
func (e *EnvoyGateway) WatchesNamespaces() bool {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve the exported NamespaceMode helper

This renames the exported EnvoyGateway.NamespaceMode() method in the public api/v1alpha1 package even though the behavior is unchanged. Any downstream Go code that imports Envoy Gateway API types and calls NamespaceMode() will fail to compile on upgrade; keep NamespaceMode() as a wrapper around WatchesNamespaces() if the clearer name is needed internally.

Useful? React with 👍 / 👎.

@zhaohuabing zhaohuabing Jun 2, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a helper method, and it should not be in the API directory.
The original NamespaceMode method name could be easily get confused with GatewayNamespaceMode.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 3 comments.

Comment thread internal/provider/kubernetes/predicates.go Outdated
Comment thread internal/provider/kubernetes/namespace_selector_client.go Outdated
Comment thread internal/provider/kubernetes/controller.go Outdated
zhaohuabing and others added 2 commits June 2, 2026 12:26
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Signed-off-by: Huabing Zhao <[email protected]>
Signed-off-by: Huabing Zhao <[email protected]>

// If there is only one item, we don't need to delete it,
// because it normally means custom resource name is not enabled.
if items.Len() <= 1 {

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not safe since now we use the cached kube client.

Signed-off-by: Huabing Zhao <[email protected]>
Signed-off-by: Huabing Zhao <[email protected]>
gatewayObjMeta := metav1.ObjectMeta{
Name: "e2e-test-infra",
Namespace: "envoy-gateway-system",
Namespace: "gateway-conformance-infra",

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use gateway-conformance-infra for the Gateway, as the envoy-gateway-system namespace is not configured in the watch-namespaces profile anymore.

guydc
guydc previously approved these changes Jun 2, 2026

@guydc guydc left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@zhaohuabing

zhaohuabing commented Jun 2, 2026

Copy link
Copy Markdown
Member Author
    --- FAIL: TestE2E/ZoneAwareRouting/topology_aware_routing_-_only_local_zone_should_get_requests (20.62s)
   --- FAIL: TestE2E/ZoneAwareRouting/BackendTrafficPolicy_-_ForceLocalZone_-_only_local_zone_should_get_requests (0.10s)

For some reason, these two tests fail with the watch-namespaces profile.

cc @jukie, do you have any ideas?

arkodg
arkodg previously approved these changes Jun 3, 2026
Signed-off-by: Huabing Zhao <[email protected]>
@zhaohuabing zhaohuabing dismissed stale reviews from arkodg and guydc via c3a4e19 June 3, 2026 06:43
arkodg
arkodg previously approved these changes Jun 3, 2026
zirain
zirain previously approved these changes Jun 3, 2026
Signed-off-by: Huabing Zhao <[email protected]>
@zhaohuabing zhaohuabing dismissed stale reviews from zirain and arkodg via 3a4d8e6 June 3, 2026 08:41
@zhaohuabing zhaohuabing requested review from arkodg, guydc and zirain June 3, 2026 08:59
@zhaohuabing zhaohuabing merged commit 5266322 into envoyproxy:main Jun 3, 2026
63 of 68 checks passed
@zhaohuabing zhaohuabing deleted the fix-9094 branch June 3, 2026 13:32
jukie added a commit that referenced this pull request Jun 5, 2026
* fix: restore last transition time in merge status conditions (#8962)

* fix: restore last transition time in merge status conditions

Signed-off-by: Rudrakh Panigrahi <[email protected]>

* add release note

Signed-off-by: Rudrakh Panigrahi <[email protected]>

---------

Signed-off-by: Rudrakh Panigrahi <[email protected]>
(cherry picked from commit 9430ab9)
Signed-off-by: jukie <[email protected]>

* fix: applyBackendTLSSetting panic (#8998)

* fix: applyBackendTLSSetting panic

Signed-off-by: zirain <[email protected]>
(cherry picked from commit b754b68)
Signed-off-by: jukie <[email protected]>

* fix(xds): hot-reload xDS server cert in GatewayNamespaceMode (#8959)

* fix(xds): hot-reload xDS server cert in GatewayNamespaceMode

Signed-off-by: nguyenptk <[email protected]>

* extract loadServerTLSConfig helper and add tests

Signed-off-by: nguyenptk <[email protected]>

---------

Signed-off-by: nguyenptk <[email protected]>
Signed-off-by: Nguyên (Harry) <[email protected]>
(cherry picked from commit 35c5a12)
Signed-off-by: jukie <[email protected]>

* fix(helm): correct typo in HPA maxReplicas required message (#9032)

Signed-off-by: benjaminch <[email protected]>
(cherry picked from commit 8da6dc7)
Signed-off-by: jukie <[email protected]>

* fix: allow IANA cipher names (#9073)

allow IANA cipher names

Signed-off-by: Huabing Zhao <[email protected]>
(cherry picked from commit ea41d6f)
Signed-off-by: jukie <[email protected]>

* fix(gatewayapi): prefer sectioned BackendTLSPolicy over wildcard for same target (#9068)

* add passing testcase showing wildcard overriding sectioned backendTLSPolicy

Signed-off-by: AlecDiraimondo <[email protected]>

* fix(gatewayapi): prefer sectioned BackendTLSPolicy over wildcard for same target

When two BackendTLSPolicies target the same backend — one with sectionName
set, one without — the wildcard wins whenever it sorts earlier, since
policies are iterated in creationTimestamp order with no specificity
preference. The sectioned policy is silently dropped: never selected by
the translator, no status written.

Make getBackendTLSPolicy prefer policies with an explicit sectionName
match before falling back to wildcard matches. Matches the specificity
ordering SecurityPolicy already implements.

Refs #9035

Signed-off-by: AlecDiraimondo <[email protected]>

* update release notes

Signed-off-by: AlecDiraimondo <[email protected]>

* fixes from review: dedup helper, return early if backendTarget has no section specified

Signed-off-by: AlecDiraimondo <[email protected]>
Co-authored-by: Rudrakh Panigrahi <[email protected]>

---------

Signed-off-by: AlecDiraimondo <[email protected]>
Signed-off-by: Alec Diraimondo <[email protected]>
Co-authored-by: Rudrakh Panigrahi <[email protected]>
(cherry picked from commit 07ec95c)
Signed-off-by: jukie <[email protected]>

* fix: encode TLS secrets with canonical PEM formatting (#8744)

* exclude non-ready https

Signed-off-by: Karol Szwaj <[email protected]>

* prevent BoringSSL errors

Signed-off-by: Karol Szwaj <[email protected]>

* Add trailing newline to testdata PEMs

Signed-off-by: Karol Szwaj <[email protected]>

* add release notes

Signed-off-by: Karol Szwaj <[email protected]>

* use shallow copy instead of DeepCopy

Signed-off-by: Karol Szwaj <[email protected]>

* use maps.Clone for the data and split the PRs

Signed-off-by: Karol Szwaj <[email protected]>

---------

Signed-off-by: Karol Szwaj <[email protected]>
(cherry picked from commit 560a262)
Signed-off-by: jukie <[email protected]>

* fix: MaxStreamDuration should worked for non-route cluster (#9028)

* fix: MaxStreamDuration should worked on commonHttpProtocolOptions

Signed-off-by: zirain <[email protected]>

* should only worked for non-route cluster

Signed-off-by: zirain <[email protected]>

* fix

Signed-off-by: zirain <[email protected]>

---------

Signed-off-by: zirain <[email protected]>
(cherry picked from commit 0edf51a)
Signed-off-by: jukie <[email protected]>

* fix(egctl): skip missing CRDs in `x status` bulk modes (#9099)

`egctl x status all` (and `xroute`/`xpolicy`) aborted with an error when a
Gateway API CRD was not installed in the cluster (e.g. TCPRoute). Missing
CRDs are now skipped, and reported on stderr when `-v` is set. Explicit
single-resource invocations still error loudly so users get a clear signal
when a kind they asked for is unavailable.

Signed-off-by: Jeremiah Snapp <[email protected]>
(cherry picked from commit 3ab110e)
Signed-off-by: jukie <[email protected]>

* fix(gatewayapi): reject unsupported BackendRef URLRewrite path rewrites (#9131)

gatewayapi: reject BackendRef URLRewrite path modifiers

Signed-off-by: Aditya7880900936 <[email protected]>
(cherry picked from commit acaf4cd)
Signed-off-by: jukie <[email protected]>

* fix: force HTTP1 for Service/ServiceImport with websocket appProtocol (#9138)

force HTTP1 for Service/ServiceImport with websocket appProtocol

Signed-off-by: Huabing Zhao <[email protected]>
(cherry picked from commit b1aa5d9)
Signed-off-by: jukie <[email protected]>

* fix: move validation admission policy outside of crds directory (#9024)

* move validation admission policy outside of crds directory

Signed-off-by: Huabing Zhao <[email protected]>

* fix upgrade

Signed-off-by: Huabing Zhao <[email protected]>

* add release note

Signed-off-by: Huabing Zhao <[email protected]>

* fix

Signed-off-by: Huabing Zhao <[email protected]>

* update docs

Signed-off-by: Huabing Zhao <[email protected]>

* address comment

Signed-off-by: Huabing Zhao <[email protected]>

* address comment

Signed-off-by: Huabing Zhao <[email protected]>

* address comments

Signed-off-by: Huabing Zhao <[email protected]>

* update relese note

Signed-off-by: Huabing Zhao <[email protected]>

* address comments

Signed-off-by: Huabing Zhao <[email protected]>

* fix gen

Signed-off-by: Huabing Zhao <[email protected]>

* use a more general name for this option

Signed-off-by: Huabing Zhao <[email protected]>

* update docs

Signed-off-by: Huabing Zhao <[email protected]>

* rename

Signed-off-by: Huabing Zhao <[email protected]>

* update test

Signed-off-by: Huabing Zhao <[email protected]>

* update release note

Signed-off-by: Huabing Zhao <[email protected]>

* fix gen

Signed-off-by: Huabing Zhao <[email protected]>

* rename supportingResources to safeUpgradePolicy

Signed-off-by: Huabing Zhao <[email protected]>

* update

Signed-off-by: Huabing Zhao <[email protected]>

---------

Signed-off-by: Huabing Zhao <[email protected]>
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Co-authored-by: zirain <[email protected]>
(cherry picked from commit 35ad8f2)
Signed-off-by: jukie <[email protected]>

* fix: alway include the controller namespace in the watched namespaces (#9100)

* always include the controller namespace in the k8s provider

Signed-off-by: Huabing Zhao <[email protected]>

* update docs

Signed-off-by: Huabing Zhao <[email protected]>
(cherry picked from commit 84be503d855e968b7b6999d476a6897e98d4e330)

* address comment

Signed-off-by: Huabing Zhao <[email protected]>

* address comments

Signed-off-by: Huabing Zhao <[email protected]>

* address comments

Signed-off-by: Huabing Zhao <[email protected]>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* minor changes

Signed-off-by: Huabing Zhao <[email protected]>

* fix test

Signed-off-by: Huabing Zhao <[email protected]>

* fix lint

Signed-off-by: Huabing Zhao <[email protected]>

* fix test

Signed-off-by: Huabing Zhao <[email protected]>

* fix test

Signed-off-by: Huabing Zhao <[email protected]>

* fix test

Signed-off-by: Huabing Zhao <[email protected]>

---------

Signed-off-by: Huabing Zhao <[email protected]>
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
(cherry picked from commit 5266322)
Signed-off-by: jukie <[email protected]>

* test(helm): regenerate safe-upgrade-policy-disabled golden for release/v1.8

The safe-upgrade-policy-disabled test case added in #9024 shipped a golden
rendered against main's chart templates, which include features not present
on release/v1.8 (automountServiceAccountToken, expanded HPA RBAC verbs,
serviceaccount securityContext, ArgoCD/Flux hook comment). Regenerate the
golden against the release branch templates and restore the release-pinned
ratelimit image tag (ff287602).

Signed-off-by: jukie <[email protected]>

* regen

Signed-off-by: jukie <[email protected]>

* chore: bump golang to 1.26.4 (#9147)

Signed-off-by: zirain <[email protected]>
Signed-off-by: jukie <[email protected]>

---------

Signed-off-by: Rudrakh Panigrahi <[email protected]>
Signed-off-by: jukie <[email protected]>
Signed-off-by: zirain <[email protected]>
Signed-off-by: nguyenptk <[email protected]>
Signed-off-by: Nguyên (Harry) <[email protected]>
Signed-off-by: benjaminch <[email protected]>
Signed-off-by: Huabing Zhao <[email protected]>
Signed-off-by: AlecDiraimondo <[email protected]>
Signed-off-by: Alec Diraimondo <[email protected]>
Signed-off-by: Karol Szwaj <[email protected]>
Signed-off-by: Jeremiah Snapp <[email protected]>
Signed-off-by: Aditya7880900936 <[email protected]>
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Co-authored-by: Rudrakh Panigrahi <[email protected]>
Co-authored-by: zirain <[email protected]>
Co-authored-by: Nguyên (Harry) <[email protected]>
Co-authored-by: BenjaminCh <[email protected]>
Co-authored-by: Huabing (Robin) Zhao <[email protected]>
Co-authored-by: Alec Diraimondo <[email protected]>
Co-authored-by: Karol Szwaj <[email protected]>
Co-authored-by: Jeremiah Snapp <[email protected]>
Co-authored-by: Aditya Sanskar Srivastav <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
cleman95 pushed a commit to cleman95/gateway that referenced this pull request Jun 25, 2026
…envoyproxy#9100)

* always include the controller namespace in the k8s provider

Signed-off-by: Huabing Zhao <[email protected]>

* update docs

Signed-off-by: Huabing Zhao <[email protected]>
(cherry picked from commit 84be503d855e968b7b6999d476a6897e98d4e330)

* address comment

Signed-off-by: Huabing Zhao <[email protected]>

* address comments

Signed-off-by: Huabing Zhao <[email protected]>

* address comments

Signed-off-by: Huabing Zhao <[email protected]>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* minor changes

Signed-off-by: Huabing Zhao <[email protected]>

* fix test

Signed-off-by: Huabing Zhao <[email protected]>

* fix lint

Signed-off-by: Huabing Zhao <[email protected]>

* fix test

Signed-off-by: Huabing Zhao <[email protected]>

* fix test

Signed-off-by: Huabing Zhao <[email protected]>

* fix test

Signed-off-by: Huabing Zhao <[email protected]>

---------

Signed-off-by: Huabing Zhao <[email protected]>
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug: caching regression in 1.8.0 breaks Gateways when using label selectors instead of explicit namespace list

6 participants