fix: validate API Key auth ExtractFrom by zhaohuabing · Pull Request #9250 · envoyproxy/gateway

zhaohuabing · 2026-06-19T01:01:31Z

What type of PR is this?

What this PR does / why we need it:

This PR fixes:

error xds cache Envoy rejected the last update with code 13 and message One of 'header'/'query'/'cookie' must be set.

Which issue(s) this PR fixes:

Fixes #

Release Notes: Yes

netlify · 2026-06-19T01:01:36Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`159e6af`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a38a11dac8ea70008f9f8c5
😎 Deploy Preview	https://deploy-preview-9250--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bdfd5f015f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

zhaohuabing · 2026-06-22T02:15:19Z

@codex review

Copilot

Pull request overview

This PR tightens SecurityPolicy API key auth validation to ensure spec.apiKeyAuth.extractFrom is always usable, preventing Envoy from receiving an invalid config that results in errors like: One of 'header'/'query'/'cookie' must be set.

Changes:

Add CRD/CEL validations for APIKeyAuth.extractFrom (non-empty list; each entry must specify exactly one of headers/params/cookies; non-empty source names).
Add CEL validation test coverage for the new constraints.
Update generated CRDs, Helm expected outputs, API docs, and release notes to reflect the stricter validation.

Findings

Required fixes: None.

Optional follow-ups (nit):

test/cel-validation/securitypolicy_test.go:1737 test case desc is duplicated; rename for clearer test output.

Reviewed changes

Copilot reviewed 7 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
api/v1alpha1/api_key_auth_types.go	Adds kubebuilder MinItems/MinLength and XValidation to enforce valid `extractFrom` configuration.
charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml	Regenerates CRD schema with the new validations.
charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml	Regenerates CRD schema for the CRDs Helm chart with the new validations.
test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml	Updates Helm-rendered CRD expected output to include the new schema validations.
test/helm/gateway-crds-helm/e2e.out.yaml	Updates Helm-rendered CRD expected output to include the new schema validations.
test/helm/gateway-crds-helm/all.out.yaml	Updates Helm-rendered CRD expected output to include the new schema validations.
test/cel-validation/securitypolicy_test.go	Adds CEL/admission validation tests covering valid/invalid `extractFrom` cases.
site/content/en/latest/api/extension_types.md	Updates published API docs text to match new validation semantics.
release-notes/current.yaml	Notes the stricter admission validation as a breaking change for upgrade awareness.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9b72bd7498

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

codecov · 2026-06-22T02:53:17Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.15%. Comparing base (139de99) to head (159e6af).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9250      +/-   ##
==========================================
- Coverage   75.16%   75.15%   -0.01%     
==========================================
  Files         252      252              
  Lines       41047    41047              
==========================================
- Hits        30854    30850       -4     
- Misses       8094     8097       +3     
- Partials     2099     2100       +1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

zhaohuabing · 2026-06-22T03:57:08Z

/retest

* fix: validate API Key auth ExtractFrom Signed-off-by: Huabing (Robin) Zhao <[email protected]> * add test Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]>

* fix rate limit validation on K8s 1.36 (#9166) fixi: rate limit validation on K8s 1.36 Starting with K8s 1.36 the int range and maximum are validated against each other, which breaks the BTP tests. This can be fixed validating the field as uint32. Signed-off-by: Clemens Beck <[email protected]> Co-authored-by: Clemens Beck <[email protected]> (cherry picked from commit a21fd29) Signed-off-by: jukie <[email protected]> * fix(validation): allow IPv6 to be specific in loadBalancerSourceRanges (#9050) * fix(validation): allow IPv6 to be specific in loadBalancerSourceRanges and loadBalancerIP Signed-off-by: Marc 'risson' Schmitt <[email protected]> (cherry picked from commit 3c1d7b9) Signed-off-by: jukie <[email protected]> * fix: allow Backend TLS to disable ALPN with an empty list (#9162) * Fixed Backend TLS to disable upstream ALPN instead of inheriting EnvoyProxy BackendTLS defaults. Signed-off-by: Huabing Zhao <[email protected]> * add test case for envoyproxy without tls Signed-off-by: Huabing Zhao <[email protected]> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> * address comments Signed-off-by: Huabing Zhao <[email protected]> --------- Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> (cherry picked from commit 21eb101) Signed-off-by: jukie <[email protected]> * fix(gatewayapi): sort api key auth credentials (#9042) * fix(gatewayapi): sort api key auth credentials Signed-off-by: Alexej Disterhoft <[email protected]> * docs(release-notes): add api key auth fix note Signed-off-by: Alexej Disterhoft <[email protected]> --------- Signed-off-by: Alexej Disterhoft <[email protected]> Signed-off-by: Alexej Disterhoft <[email protected]> Signed-off-by: zirain <[email protected]> Co-authored-by: Arko Dasgupta <[email protected]> Co-authored-by: zirain <[email protected]> (cherry picked from commit b96a2d3) Signed-off-by: jukie <[email protected]> * fix(status): separate listener programmed state from HTTPRoute Accepted condition (#9129) * fix(status): separate listener programmed state from HTTPRoute Accepted condition Remove the NoReadyListeners block that set Accepted: False on routes when no listeners were programmed. Route acceptance reflects binding validity; listener programmed state is already tracked by the listener's own conditions. Signed-off-by: apkatsikas <[email protected]> * fix(status): separate listener programmed state from TCPRoute/UDPRoute Accepted condition Routes with a valid binding to an unprogrammed listener now correctly reach Accepted=True regardless of listener readiness. Moves accepted=true and IncrementAttachedRoutes before the IsReady check so the Accepted condition reflects binding validity only, consistent with the HTTPRoute fix and the Gateway API spec. Signed-off-by: apkatsikas <[email protected]> (cherry picked from commit e9c3ac5) Signed-off-by: jukie <[email protected]> * fix: reject ExternalName Service as a route backend (#9190) fix: reject Service as a route backend Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> (cherry picked from commit ee16b3f) Signed-off-by: jukie <[email protected]> * fix(status): fall back to service externalIPs for Gateway addresses (#9209) When the Envoy service is of type LoadBalancer but no load balancer controller assigns an ingress address (e.g. bare-metal clusters), the Gateway status had no addresses and stayed Programmed=False with reason AddressNotAssigned, even when reachable addresses were configured via spec.externalIPs (e.g. through an EnvoyProxy service patch). Use spec.externalIPs as a fallback when the load balancer ingress list is empty. Ingress addresses keep priority when present, so behavior is unchanged for clusters with a working load balancer controller. Fixes #8987 Signed-off-by: Jules Dutel <[email protected]> (cherry picked from commit f2c0921) Signed-off-by: jukie <[email protected]> * fix: don't duplicate ValidatingAdmissionPolicy in install.yaml (#9182) * Fix duplicate VAP in install.yaml Signed-off-by: jukie <[email protected]> * Add regression check and release notes Signed-off-by: jukie <[email protected]> --------- Signed-off-by: jukie <[email protected]> (cherry picked from commit 332081c) Signed-off-by: jukie <[email protected]> * fix(listenerset): implement hostname conflict listener precedence (#9192) * fix(listenerset): implement hostname conflict listener precedence - In Gateway, multiple listeners with the same hostname all get marked Conflicted (no winner). In ListenerSet, a Gateway-owned listener wins over ListenerSet listeners; among ListenerSet listeners the first in processing order wins. - Conflicted ListenerSet listeners now get Accepted=False and Programmed=False with the conflict reason (HostnameConflict or ProtocolConflict), matching the Gateway API conformance expectation. - AttachedListenerSets on the Gateway status is now incremented only for ListenerSets that have at least one accepted listener, aligning with the spec definition of "successfully attached". Signed-off-by: zirain <[email protected]> * ListenerSet conflict Signed-off-by: zirain <[email protected]> * fix and improve message Signed-off-by: zirain <[email protected]> * better display gateway listener Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> (cherry picked from commit 9271654) Signed-off-by: jukie <[email protected]> * fix: correct the config hot reload validation order (#9214) Co-authored-by: Nimisha Mehta <[email protected]> (cherry picked from commit 7e4492d) Signed-off-by: jukie <[email protected]> * feat(helm): add CRDs dependency toggle (#8850) * feat(helm): add CRDs dependency toggle Allow skipping installation of the `crds` dependency on the gateway-helm chart by providing a conditional `crds.enabled` variable. This boolean defaults to `true` and toggles the inclusion of the dependency on the parent chart. ref: #8560 Signed-off-by: Gaston Festari <[email protected]> * docs: update Helm installation steps Use the `crds.enabled` variable in the examples instead of the `--skip-crds` flag. Update crds.enabled variable description. Co-authored-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Gaston Festari <[email protected]> --------- Signed-off-by: Gaston Festari <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> (cherry picked from commit 62e01ce) Signed-off-by: jukie <[email protected]> * fix: validate API Key auth ExtractFrom (#9250) * fix: validate API Key auth ExtractFrom Signed-off-by: Huabing (Robin) Zhao <[email protected]> * add test Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]> (cherry picked from commit 50b1339) Signed-off-by: jukie <[email protected]> * fix: XRateLimitHeadersOptionDisabled constant value must match CRD enum (#9224) * fix: XRateLimitHeadersOptionDisabled constant value must match CRD enum The constant held "Disabled" but the CRD enum specifies "Off", causing xRateLimitHeaders: "Off" to silently fall through the translator switch and always emit X-RateLimit headers. Fixes #9223 Signed-off-by: gianniskt <[email protected]> * fix: XRateLimitHeadersOptionDisabled constant value must match CRD enum The constant held "Disabled" but the CRD enum specifies "Off", causing xRateLimitHeaders: "Off" to silently fall through the translator switch and always emit X-RateLimit headers. Fixes #9223 Signed-off-by: gianniskt <[email protected]> * fix: add release note for XRateLimitHeadersOptionDisabled fix Signed-off-by: gianniskt <[email protected]> --------- Signed-off-by: gianniskt <[email protected]> Signed-off-by: Ioannis Koutroumpis <[email protected]> (cherry picked from commit 43c9d8e) Signed-off-by: jukie <[email protected]> * fix(ratelimit): shared global ratelimit with cost not working (#9245) * fix(ratelimit): shared global ratelimit with cost not working Signed-off-by: zirain <[email protected]> * fix Signed-off-by: zirain <[email protected]> * fix mixed shared rule Signed-off-by: zirain <[email protected]> * add e2e Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> (cherry picked from commit 7997791) Signed-off-by: jukie <[email protected]> * fix(gatewayapi): http retry without backoff (#9238) * fix http retry without backoff Signed-off-by: zirain <[email protected]> * release notes Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> (cherry picked from commit 4872e53) Signed-off-by: jukie <[email protected]> * fix: panic with empty deploy (#9365) Signed-off-by: zirain <[email protected]> (cherry picked from commit 42a0c2c) Signed-off-by: jukie <[email protected]> * chore: restore current.yaml after cherry-picks The cherry-picked bug-fix commits appended their release-note entries to release-notes/current.yaml. Those notes are already finalized in release-notes/v1.8.2.yaml, so restore current.yaml to its prior state to avoid duplicating them in the next release cycle. Signed-off-by: jukie <[email protected]> * [release-1.8] bump ratelimit image to 1e50889b Bump the Envoy Ratelimit image from ff287602 to 1e50889b in source and the gateway-helm chart, and note the bump under security updates in the v1.8.2 release notes. Signed-off-by: jukie <[email protected]> * testdata Signed-off-by: jukie <[email protected]> * fix: use int64 format for ratelimit Requests field (#9377) Signed-off-by: jukie <[email protected]> --------- Signed-off-by: Clemens Beck <[email protected]> Signed-off-by: jukie <[email protected]> Signed-off-by: Marc 'risson' Schmitt <[email protected]> Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Alexej Disterhoft <[email protected]> Signed-off-by: Alexej Disterhoft <[email protected]> Signed-off-by: zirain <[email protected]> Signed-off-by: apkatsikas <[email protected]> Signed-off-by: Jules Dutel <[email protected]> Signed-off-by: Gaston Festari <[email protected]> Signed-off-by: gianniskt <[email protected]> Signed-off-by: Ioannis Koutroumpis <[email protected]> Co-authored-by: Clemens Beck <[email protected]> Co-authored-by: Clemens Beck <[email protected]> Co-authored-by: Marc 'risson' Schmitt <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> Co-authored-by: Alexej Disterhoft <[email protected]> Co-authored-by: Arko Dasgupta <[email protected]> Co-authored-by: zirain <[email protected]> Co-authored-by: Andrew Katsikas <[email protected]> Co-authored-by: jvlxz <[email protected]> Co-authored-by: Mengjia Liang <[email protected]> Co-authored-by: Nimisha Mehta <[email protected]> Co-authored-by: Gaston Festari <[email protected]> Co-authored-by: Ioannis Koutroumpis <[email protected]>

zhaohuabing requested a review from a team as a code owner June 19, 2026 01:01

zhaohuabing added the cherrypick/release-v1.8.2 label Jun 19, 2026

zhaohuabing force-pushed the fix-nack-api-key branch from bdfd5f0 to 268fade Compare June 19, 2026 01:05

chatgpt-codex-connector Bot reviewed Jun 19, 2026

View reviewed changes

Comment thread api/v1alpha1/api_key_auth_types.go Outdated

zhaohuabing marked this pull request as draft June 19, 2026 01:09

zhaohuabing added 3 commits June 22, 2026 10:07

fix: validate API Key auth ExtractFrom

2c813e6

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

add test

1520865

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

update

4d6b084

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

zhaohuabing force-pushed the fix-nack-api-key branch from 510840c to 4d6b084 Compare June 22, 2026 02:07

update

9b72bd7

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

zhaohuabing marked this pull request as ready for review June 22, 2026 02:15

zhaohuabing requested a review from Copilot June 22, 2026 02:15

zhaohuabing added the cherrypick/release-v1.7.5 label Jun 22, 2026

Copilot started reviewing on behalf of zhaohuabing June 22, 2026 02:15 View session

Copilot AI reviewed Jun 22, 2026

View reviewed changes

Comment thread test/cel-validation/securitypolicy_test.go Outdated

chatgpt-codex-connector Bot reviewed Jun 22, 2026

View reviewed changes

Comment thread test/cel-validation/securitypolicy_test.go Outdated

update

159e6af

Signed-off-by: Huabing (Robin) Zhao <[email protected]>

zhaohuabing force-pushed the fix-nack-api-key branch from 19d6363 to 159e6af Compare June 22, 2026 02:42

zhaohuabing removed the cherrypick/release-v1.7.5 label Jun 22, 2026

zirain approved these changes Jun 22, 2026

View reviewed changes

zhaohuabing requested a review from a team June 22, 2026 03:56

jukie approved these changes Jun 22, 2026

View reviewed changes

zhaohuabing merged commit 50b1339 into envoyproxy:main Jun 22, 2026
111 of 120 checks passed

zhaohuabing deleted the fix-nack-api-key branch June 22, 2026 08:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: validate API Key auth ExtractFrom#9250

fix: validate API Key auth ExtractFrom#9250
zhaohuabing merged 5 commits into
envoyproxy:mainfrom
zhaohuabing:fix-nack-api-key

zhaohuabing commented Jun 19, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Jun 19, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

zhaohuabing commented Jun 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

codecov Bot commented Jun 22, 2026

Uh oh!

zhaohuabing commented Jun 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

zhaohuabing commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

zhaohuabing commented Jun 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Findings

Reviewed changes

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

codecov Bot commented Jun 22, 2026

Codecov Report

Uh oh!

zhaohuabing commented Jun 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

zhaohuabing commented Jun 19, 2026 •

edited

Loading

netlify Bot commented Jun 19, 2026 •

edited

Loading