fix: fall back to last successful OIDC discovery when refetch fails by KR-Ravindra · Pull Request #10020 · envoyproxy/gateway

KR-Ravindra · 2026-09-13T08:22:12Z

What this PR does / why we need it:

OIDC discovery runs on every translation with a cache that is re-created each time. If /.well-known/openid-configuration is unreachable or non-2xx during a reconciliation, the SecurityPolicy fails and every route it protects answers 500 until a later reconciliation succeeds.

This keeps the last successfully discovered OpenIDConfig per issuer in a process-wide, mutex-guarded LRU cache (128 entries) and falls back to it, logging the error, when discovery fails. Discovery is still retried every translation; an issuer that never succeeded still fails, and local issuer/TLS configuration errors are never masked. Follows the guidance on #9239 (size cap + LRU, no TTL).

Tests: fallback, none without prior success or on a local TLS config error, LRU eviction, concurrency under -race.

Which issue(s) this PR fixes:
Fixes #9235

PR Checklist

Experimented and verified with an AI agent.

netlify · 2026-09-13T08:22:18Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`88e846f`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6aeb08b8fa9df580771a3471
😎 Deploy Preview	https://deploy-preview-10020--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

sadovnikov · 2026-10-21T11:24:49Z

@KR-Ravindra, can you submit this PR for review?

KR-Ravindra · 2026-10-21T13:30:30Z

@sadovnikov rebased on current main in 5fdc4c6 and marked ready for review. (Experimented and verified with an AI agent.)

chatgpt-codex-connector · 2026-10-21T13:30:45Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T10:33:30.736443Z	`88e846f`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5fdc4c6c8f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

KR-Ravindra · 2026-10-21T15:43:28Z

Addressed the finding in 8a5ecb0: issuer-URL and TLS client construction errors are now typed as local configuration errors and never fall back to the retained discovery result, with a test for the invalid client-certificate case. @codex review (Experimented and verified with an AI agent.)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8a5ecb0856

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

sadovnikov · 2026-10-21T16:31:58Z

Thank you, @KR-Ravindra 👍

KR-Ravindra · 2026-10-21T17:57:37Z

@sadovnikov thanks. Codex raised one more point after that push, addressed in 0f3cbbc: each retained discovery result now carries a fingerprint of the TLS settings it was fetched with and is only reused while those match, with a test for the changed-settings case. @codex review (Experimented and verified with an AI agent.)

chatgpt-codex-connector · 2026-10-21T18:02:09Z

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 0f3cbbcf5d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

KR-Ravindra · 2026-11-02T14:42:25Z

Rebased on main and switched the two ptr.To calls in the test to new() for the forbidigo rule in 3b19a88. The coverage-test failure on the rerun was TestProvider/gateway_scheduled_status in internal/provider/kubernetes, which this PR does not touch, and osv-scan reports the same go-jose finding on main.

(Experimented and verified with an AI agent.)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3b19a88fa2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-11-02T14:47:53Z

+			if fallback, ok := oidcDiscoveryFallback.Get(issuerURL, tlsFingerprint); ok {
+				t.Logger.Error(err, "OIDC discovery failed, using the last successfully discovered configuration",
+					"issuer", issuerURL)
+				t.oidcDiscoveryCache.Set(issuerURL, fallback, nil)


Include TLS settings in the per-translation cache key

When two SecurityPolicies in one translation share an issuer but use different TLS settings, the first fallback stored here is returned to the second by the issuer-only Get before tlsFingerprint is computed. During an issuer outage, TLS B can therefore reuse a document retained under TLS A even when B's CA or SNI cannot connect. Fresh evidence after the fingerprint fix is that the newly added fallback is inserted into the old issuer-only per-translation cache; key that cache by both issuer and fingerprint (or recheck the fingerprint on lookup).

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-11-02T14:47:53Z

 		t.oidcDiscoveryCache.Set(issuerURL, nil, err)
 		return nil, err
 	}

+	oidcDiscoveryFallback.Set(issuerURL, config, tlsFingerprint)


Validate discovered endpoints before replacing the fallback

When a previously valid issuer next returns HTTP 200 metadata with a nonempty token URL that validateTokenEndpoint rejects (for example, an IP-literal URL), discoverEndpointsFromIssuer reports success because OpenIDConfig.validate only checks for empty fields, so this call replaces the usable fallback before buildOIDCProvider rejects the endpoint. A subsequent 503 then retrieves the invalid entry and the protected routes continue returning 500 instead of falling back to the last usable configuration; validate the discovered endpoint before calling Set, or preserve the old entry when downstream validation fails.

Useful? React with 👍 / 👎.

KR-Ravindra · 2026-11-02T16:58:22Z

Pushed 6c70f5a: a discovery result whose token endpoint fails validateTokenEndpoint is no longer stored as the fallback (second Codex thread), with a test. The first thread is about the per-translation cache being keyed by issuer only, which is main's existing behaviour and unchanged here; the TLS fingerprint guards the cross-translation fallback.

(Experimented and verified with an AI agent.)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6c70f5a666

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-11-02T17:02:00Z

 		t.oidcDiscoveryCache.Set(issuerURL, nil, err)
 		return nil, err
 	}

+	// Only retain a result whose token endpoint passes the validation applied when the provider
+	// is built, so that an unusable discovery result never replaces a usable fallback.
+	if validateTokenEndpoint(config.TokenEndpoint) == nil {


Retain discoveries usable with explicit token endpoints

When a SecurityPolicy explicitly sets provider.tokenEndpoint but leaves authorizationEndpoint to discovery, buildOIDCProvider replaces the discovered token URL and validates only the explicit URL. If the discovery document has a nonempty token URL that this helper rejects (for example, an IP literal), the current translation succeeds using the explicit endpoint, but this gate does not retain the discovered authorization endpoint. A later issuer outage therefore has no fallback (or uses an older authorization endpoint) and returns the protected route to HTTP 500 even though the last resolved provider was usable; retention needs to account for the final selected endpoints or which fields the policy overrides.

Useful? React with 👍 / 👎.

codecov · 2026-11-02T18:33:37Z

Codecov Report

❌ Patch coverage is 92.30769% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.67%. Comparing base (c267eaa) to head (88e846f).
⚠️ Report is 10 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/gatewayapi/securitypolicy.go	92.30%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #10020      +/-   ##
==========================================
+ Coverage   82.53%   82.67%   +0.13%     
==========================================
  Files         277      277              
  Lines       44270    44328      +58     
==========================================
+ Hits        36540    36649     +109     
+ Misses       7729     7678      -51     
  Partials        1        1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

zhaohuabing · 2026-11-03T01:22:37Z

@@ -103,6 +106,8 @@ func (t *Translator) ProcessSecurityPolicies(
 ) []*egv1a1.SecurityPolicy {
 	// Cache is only reused during one translation across multiple routes and gateways.
 	// The failed fetches will be retried in the next translation when the provider resources are reconciled again.
+	// The last successful discovery result per issuer is retained across translations in
+	// oidcDiscoveryFallback and used when a later discovery attempt fails.
 	t.oidcDiscoveryCache = newOIDCDiscoveryCache()


Non-blocking, fine as a follow-up: the per-translation cache is still keyed by issuer only, so when two policies share an issuer, the second one gets the first one's fallback without its own TLS fingerprint check. Adding the fingerprint to that cache key would fix it.

zhaohuabing · 2026-11-03T01:29:49Z

 		t.oidcDiscoveryCache.Set(issuerURL, nil, err)
 		return nil, err
 	}

+	// Only retain a result whose token endpoint passes the validation applied when the provider
+	// is built, so that an unusable discovery result never replaces a usable fallback.
+	if validateTokenEndpoint(config.TokenEndpoint) == nil {


Should we only check the discovered token endpoint when the policy doesn't set its own tokenEndpoint?

Fine as a follow-up since this is an edge case.

zhaohuabing · 2026-11-03T01:35:09Z

+		var configErr *oidcDiscoveryConfigError
+		if !errors.As(err, &configErr) {
+			if fallback, ok := oidcDiscoveryFallback.Get(issuerURL, tlsFingerprint); ok {
+				t.Logger.Error(err, "OIDC discovery failed, using the last successfully discovered configuration",


Non-blocking: Could we add a warning condition to make that visible? It's fine as a follow-up.

KR-Ravindra · 2026-11-03T01:37:55Z

@zhaohuabing done in bc353f7: the per-translation cache is now keyed by issuer plus the TLS fingerprint, and the discovered token endpoint is only checked before retaining the result when the policy does not set its own tokenEndpoint (buildOIDCProvider passes the override through). Tests for both are included. Could you take another look?

(Experimented and verified with an AI agent.)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bc353f7012

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-11-03T01:43:02Z

+	if tokenEndpointOverridden || validateTokenEndpoint(config.TokenEndpoint) == nil {
+		oidcDiscoveryFallback.Set(issuerURL, config, tlsFingerprint)


Separate override-only discovery fallbacks

Fresh evidence after adding override-sensitive retention is that this branch still writes an override-only document into the issuer/TLS-wide fallback. If two policies share those settings, a previously valid fallback can be replaced when the issuer advertises an IP-literal token URL and the policy being translated supplies its own valid token endpoint; on the next issuer outage, a policy without an override receives that retained IP URL, fails validateTokenEndpoint in buildOIDCProvider, and returns its protected routes to 500. Keep override-only discoveries separate from fallback entries usable by non-overriding policies.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-11-03T01:43:02Z

+	if config, cachedErr, ok := t.oidcDiscoveryCache.Get(issuerURL, tlsFingerprint); ok {
 		if cachedErr != nil {
 			return nil, cachedErr
 		}


Apply override retention on translation-cache hits

Fresh evidence after making retention depend on tokenEndpointOverridden is that a per-translation hit returns before that decision. If a non-overriding policy first fetches a document with an IP-literal token URL, it caches the document here but correctly does not retain it globally; a later policy sharing issuer/TLS but supplying a valid token override succeeds from this cache hit without retaining the discovered authorization endpoint, so its next reconciliation during an issuer outage has no fallback and its protected routes return 500. Reapply retention on cached successes or include override mode in this cache key.

Useful? React with 👍 / 👎.

zhaohuabing · 2026-11-03T01:44:25Z

+type oidcDiscoveryFallbackCache struct {
+	mu         sync.Mutex
+	maxEntries int
+	entries    map[string]*list.Element


The fallback cache is keyed by issuer only, so with the per-translation cache now split by TLS settings, policies that share an issuer overwrite each other's fallback and only the last one is covered during an outage. Keying the fallback by issuer plus fingerprint as well would fix it.

KR-Ravindra · 2026-11-03T06:06:32Z

@zhaohuabing done in f81e6ca: the fallback cache is now keyed by issuer plus the TLS fingerprint as well, so policies sharing an issuer each keep their own entry (the TLS-change test now checks both are retained), and the unparam lint failure is fixed. I've left the warning condition for a follow-up as you suggested. Could you take another look?

(Experimented and verified with an AI agent.)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cc657cfde3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-11-03T12:50:27Z

+	// Only retain a result whose token endpoint passes the validation applied when the provider
+	// is built, so that an unusable discovery result never replaces a usable fallback. The check
+	// is skipped when the policy overrides the token endpoint, since the discovered one is unused.
+	if tokenEndpointOverridden || validateTokenEndpoint(config.TokenEndpoint) == nil {


Reject token ports that downstream translation cannot encode

Fresh evidence after adding this validation gate is that, on 64-bit builds and for a policy with neither a token override nor provider BackendRefs, a discovered URL such as https://idp.example.com:4294967296/token passes validateTokenEndpoint because strconv.Atoi accepts the port, so this branch replaces the last usable fallback. url2Cluster then rejects that same port via ParseUint(..., 32) (internal/xds/translator/utils.go:60-63), and a later discovery outage reuses the invalid entry instead of restoring the working document; validate against the downstream port range before Set.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-11-03T12:50:27Z

+		return
+	}
+
+	c.entries[key] = c.order.PushFront(&oidcDiscoveryFallbackEntry{key: key, config: cfg})


Bound the fallback cache by retained byte size

When an issuer returns very large strings in the decoded token, authorization, or end-session fields, this line retains those bytes process-wide, while the 128-entry limit bounds only count and the decoder at securitypolicy.go:2934 has no body-size limit. Cycling through 128 such issuers can therefore retain gigabytes even after their policies are removed, whereas the prior translation cache was collectible after each run; reject oversized discovery responses or make eviction account for retained bytes.

Useful? React with 👍 / 👎.

zhaohuabing

LGTM thanks!

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5ebd886202

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-11-04T06:15:01Z

+// fetchEndpointsFromIssuer discovers the OpenID configuration of the issuer. tokenEndpointOverridden
+// reports that the policy sets its own token endpoint, so the discovered one is not used.
+func (t *Translator) fetchEndpointsFromIssuer(issuerURL string, providerTLS *ir.TLSUpstreamConfig, tokenEndpointOverridden bool) (*OpenIDConfig, error) {
+	tlsFingerprint := oidcDiscoveryTLSFingerprint(providerTLS)


Memoize TLS fingerprints across route targets

When an OIDC SecurityPolicy with an inline CA or client certificate is applied through a selector to many routes, buildOIDCProvider invokes this path for every target; although all but the first lookup are served from oidcDiscoveryCache, this line first JSON-marshals and SHA-256-hashes the entire TLS config on every call. A 1 MiB bundle and 1,000 matched routes therefore add roughly a gigabyte of serialization and allocation to each reconciliation, so cache the fingerprint per translated TLS source/config rather than recomputing it before every per-route cache lookup.

Useful? React with 👍 / 👎.

Thinking about this more, I'd drop the TLS fingerprint from both caches. The discovery document depends only on the issuer, not on the TLS settings used to fetch it, so one entry per issuer is enough. cc @KR-Ravindra

@zhaohuabing done in 88e846f: dropped the TLS fingerprint from both caches, so they are keyed by issuer only again, and removed the two tests that covered the per-TLS entries. Could you take another look?

(Experimented and verified with an AI agent.)

The OIDC discovery cache is re-created on every translation, so a transient failure fetching <issuer>/.well-known/openid-configuration during any reconciliation made every route protected by that issuer return HTTP 500 until a later translation succeeded. Retain the last successfully discovered OpenID configuration per issuer in a process-wide, mutex-guarded, size-capped LRU cache and fall back to it (logging the error) when discovery fails. Issuers that were never discovered successfully still surface the error, and errors in the local issuer or TLS configuration are never masked. A discovered token endpoint the policy overrides is not validated before the result is retained. Signed-off-by: KR Ravindra <42912207+KR-Ravindra@users.noreply.github.com>

sadovnikov · 2026-11-05T07:41:14Z

Thank you, @KR-Ravindra and @zhaohuabing

* docs: fix Gateway API links (#10456) * docs: fix Gateway API links Signed-off-by: zirain <zirain2009@gmail.com> * fix Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> (cherry picked from commit 38bba5acd799bed36c6c4f2933fe3cad4f3db5e9) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * chore: fixing typo on examples/kubernetes/ext-auth-http-service.yaml (#10098) Fixing typo Fixing typo on console.log Signed-off-by: allevimi <michele.allevi@gmail.com> Co-authored-by: kkk777-7 <kota.kimura0725@gmail.com> (cherry picked from commit b02cef4109dfccc27503b74a0178909e356cbbdb) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * docs: add doc for SDS ref (#10367) * docs: add doc for SDS ref Signed-off-by: zirain <zirain2009@gmail.com> * fix Signed-off-by: zirain <zirain2009@gmail.com> * comments Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> (cherry picked from commit 314be2117341d55b3988febc4048daf6ebccd940) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * test(e2e): apply gRPC health check routes once the backend serves (#10405) BackendHealthCheckActiveGRPC applied grpc-health-backend together with its routes and BackendTrafficPolicies. EG publishes the endpoint of a pod that is not Ready yet as draining, so Envoy received the health checked clusters, and ran each first health check, while the gRPC server was still starting. That check failed with a network error, and Envoy checks a cluster that has seen no traffic again only after no_traffic_interval (60s), past the 30s the test waits for a success. Give the backend a gRPC readiness probe, wait for it, and only then apply the policies and routes, policies first: a route processed before its policy yields a cluster without the health check, and the update that adds it waits for EDS until initial_fetch_timeout (15s). Signed-off-by: Alexej Disterhoft <alexej@disterhoft.de> Co-authored-by: zirain <zirain2009@gmail.com> (cherry picked from commit 79c64789ecc53cbf4d3558ef71e3d03b87dc5f23) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix(translator): ignore invalid EnvoyProxy fields instead of rejecting it (#10446) * fix(translator): ignore invalid EnvoyProxy fields instead of rejecting it Signed-off-by: zirain <zirain2009@gmail.com> * release notes Signed-off-by: zirain <zirain2009@gmail.com> * fix Signed-off-by: zirain <zirain2009@gmail.com> * fix review Signed-off-by: zirain <zirain2009@gmail.com> * fix review Signed-off-by: zirain <zirain2009@gmail.com> * Clear stale warnings on fatal validation Signed-off-by: zirain <zirain2009@gmail.com> * Drop ALS sinks whose configuration is absent Signed-off-by: zirain <zirain2009@gmail.com> * fix test Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> (cherry picked from commit 4f2c7c331b9ba8786b487ff8ce6096d9eae1dadb) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix(metrics): remove watchable_depth, which always reported 0 (#9860) * fix(metrics): record watchable_depth as the coalesced update count Signed-off-by: somaz <genius5711@gmail.com> * fix(metrics): reset watchable_depth once the batch has been handled Signed-off-by: somaz <genius5711@gmail.com> * fix(metrics): remove watchable_depth and repoint the dashboards that used it Signed-off-by: somaz <genius5711@gmail.com> --------- Signed-off-by: somaz <genius5711@gmail.com> Co-authored-by: zirain <zirain2009@gmail.com> (cherry picked from commit 6d68b367e85fac1b9a8fd67e2442db0d7d05f0ef) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * perf(translator): index repeated backend policy route lookups (#10146) * [envoy-gateway] Index repeated backend policy route lookups [ci changed_files] Signed-off-by: Cooper Gamble <cooper@openai.com> * [envoy-gateway] Note backend policy route indexing [ci changed_files] Signed-off-by: Cooper Gamble <cooper@openai.com> --------- Signed-off-by: Cooper Gamble <cooper@openai.com> Co-authored-by: zirain <zirain2009@gmail.com> (cherry picked from commit cb88d3d5e63770622a6c2c3c522d36c1a1a9ae1d) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix(e2e): poll until endpoint override takes effect (#10264) * fix(e2e): poll until endpoint override takes effect The valid-pod-IP subtest of EndpointOverrideLoadBalancing asserted on the very first request. The BackendTrafficPolicy being Accepted doesn't mean Envoy has received the override config yet, so early requests could still be load-balanced to another pod and fail the test. Use pollTrafficTest so the check retries until all requests reach the expected pod. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: zirain <zirain2009@gmail.com> * fix nit Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit fc335c2eda6ce5a897c9e9cbf6dfcb78b066dd87) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * docs: local rate limit supports Distinct matching (#9975) * docs: local rate limit supports Distinct matching The local rate limit task page still says Distinct matching is not supported and points users to global rate limiting. Distinct matching for local rate limits shipped in v1.4.0 (#5319). Replace the note with a short "Rate Limit Distinct Clients" example and describe what per-proxy buckets mean, on the latest page and on the v1.8 and v1.9 pages. Signed-off-by: Andreea Popescu <andreea.popescu@pidginhost.com> * docs: qualify Distinct local rate limits Review feedback on the new section: a sourceCIDR selector keys on the client address Envoy detects, so deployments behind a proxy need clientIPDetection first or every client shares one bucket; and the per-value buckets live in a bounded least recently used cache, so an evicted value returns with a full bucket. Say both, without a number for the cache size, so the text stays true across releases. Signed-off-by: Andreea Popescu <andreea.popescu@pidginhost.com> * docs: state Distinct cache size per release #9974 shipped in v1.9.2 and v1.8.5, so the route-level cache size is known: 10,000 entries from those releases, 20 before. Say so on the latest, v1.9 and v1.8 pages instead of leaving the size unstated. Signed-off-by: Andreea Popescu <andreea.popescu@pidginhost.com> --------- Signed-off-by: Andreea Popescu <andreea.popescu@pidginhost.com> (cherry picked from commit 323e368f7d8f5a6fb16f24b008a27a4874f7ed6d) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix: report clear ownership conflict for unmanaged same-name Deployment/DaemonSet in GatewayNamespace mode (#9470) * fix: report clear ownership conflict for unmanaged same-name Deployment/DaemonSet in GatewayNamespace mode In GatewayNamespace mode, when a pre-existing, unmanaged Deployment or DaemonSet shares the Gateway's name (e.g. an unrelated nginx Deployment), the reconcile surfaced a misleading "illegal change in a custom label of EnvoyProxy" error instead of a clear ownership-conflict error. This happened because createOrUpdateDeployment/createOrUpdateDaemonSet ran the selector-migration workaround before the ownership check: an unmanaged same-name resource with a different selector hit the selector-migration error and never reached the ownership guard added by #9215. Move checkOwnership to run right after the existing Get succeeds and before the selector-migration block, so unmanaged collisions return "already exists and is not owned by this Gateway" and the pre-existing resource is left untouched. Non-GatewayNamespace mode is unaffected (checkOwnership returns nil immediately), so the legitimate custom-label migration error path is preserved. Fixes #9132 Signed-off-by: liuhy <liuhongyu@apache.org> Co-Authored-By: Claude <noreply@anthropic.com> * fix: detect unmanaged same-name infra via uncached API read in GatewayNamespace mode Address review feedback on #9470 (Codex P2 + Copilot). The production controller cache filters DaemonSets (and HPA/PDB) by the envoy managed-label selector, so an unmanaged same-name DaemonSet is absent from the cache: checkOwnership's cached Get returned NotFound and the ownership guard never ran, so applyIfOwned proceeded to server-side apply and users still got an API/immutability error or adoption instead of the ownership-conflict error. The earlier unit tests used an unfiltered fake client and so missed this. Wire the uncached API reader (mgr.GetAPIReader()) through KubernetesClientHolder -> Provider.GetAPIReader -> Infra.apiReader, and use it for the existence read in checkOwnership (falling back to the cached client when no API reader is configured, e.g. in unit tests). This makes the ownership-conflict detection reliable for all resource kinds, including the label-filtered ones, matching the intent claimed by #9215. Also set replicas=0 on the e2e pre-existing unmanaged Deployment to keep it inert (no scheduling/image-pull), per Copilot review — the collision behavior under test needs no Pods to run. Tests: - TestCheckOwnership_UsesAPIReaderWhenCacheMisses: cached Get returns NotFound (simulating the filtered cache) while the API reader sees the unmanaged resource; asserts the ownership error is surfaced. Verified to FAIL on the pre-API-reader code. - TestCheckOwnership_FallsBackToCachedClientWhenNoAPIReader: preserves the cached-client path used by the existing tests. - Existing unit + e2e tests still pass. Signed-off-by: liuhy <liuhongyu@apache.org> Co-Authored-By: Claude <noreply@anthropic.com> * test(e2e): replace ptr.To with new() to satisfy forbidigo lint CI lint failed on gateway_namespace_ownership.go:183 because forbidigo (tools/linter/golangci-lint/.golangci.yml) forbids ptr.To from k8s.io/utils/ptr in favor of the new() builtin. ptr.To[int32](0) and new(int32) are equivalent (both yield a *int32 to zero), so switch to new(int32) and drop the now-unused import. The APIReader cache-miss fix is unchanged. Signed-off-by: liuhy <liuhongyu@apache.org> Co-Authored-By: Claude <noreply@anthropic.com> * fix: limit uncached ownership reads Signed-off-by: liuhy <liuhongyu@apache.org> --------- Signed-off-by: liuhy <liuhongyu@apache.org> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: zirain <zirain2009@gmail.com> (cherry picked from commit a33257784342f53c6ff2b48201fbb239481bdd82) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * docs: add EnvoyPatchPolicy cluster patching example (#9949) * docs: add EnvoyPatchPolicy cluster patching example Document how to patch Cluster resources with EnvoyPatchPolicy, including cluster name format and a working load balancing policy example using replace instead of add. Fixes #7306 Signed-off-by: amarkdotdev <amark@g.jct.ac.il> Signed-off-by: Aaron <amark@g.jct.ac.il> * docs: address Codex review nits on cluster patch example Reuse Quickstart default/backend resources, drop unsupported targetRef namespace, fix egctl translate invocation, and include httproute prefix in cluster name examples. Signed-off-by: Aaron <amark@g.jct.ac.il> --------- Signed-off-by: amarkdotdev <amark@g.jct.ac.il> Signed-off-by: Aaron <amark@g.jct.ac.il> (cherry picked from commit 4255dc38b528aa2620416bde850441673e897164) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix(lua): validate numeric path arguments in the lua sandbox (#10411) Signed-off-by: RAJATH MOHARE <rajath@digiscrypt.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com> (cherry picked from commit dad807297baa7027566c3de579be5f0d70348b25) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * docs: document overload manager defaults (#10161) * docs: document overload manager defaults Signed-off-by: Matheus Sousa <matessousa@outlook.com> * docs: scope overload defaults and fix HPA memory example Signed-off-by: Matheus Sousa <matessousa@outlook.com> --------- Signed-off-by: Matheus Sousa <matessousa@outlook.com> Co-authored-by: zirain <zirain2009@gmail.com> (cherry picked from commit ad04d02b5ac73fd14cce0d790f526cab50dec5f0) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * docs: clarify direct response body size (#10073) * docs: clarify direct response body size Signed-off-by: simonfelding <simonfelding@gmail.com> * docs: simplify direct response size note Signed-off-by: simonfelding <simonfelding@gmail.com> --------- Signed-off-by: simonfelding <simonfelding@gmail.com> (cherry picked from commit 7fa069b795b6da15f9366b33dc852ab52fead0c4) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * perf: index cluster names during xDS construction (#10483) Avoid repeatedly scanning existing clusters when building xDS resources. Maintain a name index during construction, preserving resource order and first-match lookup behavior. Update it on additions, replacements and bulk updates, and drop it before JSON patches and extension post-translation hooks can rename resources in place. The 10,000-cluster, eight-reference construction benchmark improves from about 621ms without the index to 8.9ms with it (median of five local runs). The index adds about 0.42 MiB of live heap at 10,000 clusters. Validation: focused xDS type and translator tests, including race and coverage; local cluster-construction benchmarks; resource replacement, deletion and rejected-resource regression coverage. Signed-off-by: Arko Dasgupta <arkodg@gmail.com> (cherry picked from commit d11fe0951d1f546f955858e59fffacc4c41cc5d3) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * perf: translate GatewayClasses concurrently (#10481) Translate up to two GatewayClasses per provider update so a smaller class can publish its IR while another class is still translating. Lock only shared key tracking and metric counters, merge statuses in input order, and join workers before processing the next update. Preserve existing IR when translation or publication panics. Validated with go test -race ./internal/gatewayapi/runner and golangci-lint on the GatewayClass runner diff. Signed-off-by: Arko Dasgupta <arkodg@gmail.com> (cherry picked from commit b3465b385b32cd4979da093e35e64c88fc19b5fc) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * docs: add Verfahrensdokumentation.pro as an adopter (#10486) Signed-off-by: Nico Bleiler <n.bleiler@verfahrensdokumentation.pro> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 529f6a82cf85498a2d2a8744acecb7a019decda7) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * chore: mute OSV scanner (#10487) Signed-off-by: zirain <zirain2009@gmail.com> (cherry picked from commit 3103d038c787e3aeef4bde8cd845c0c05df79d17) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix: name the jwt requirement after its owning SecurityPolicy (#10442) * fix: name the jwt requirement after its owning SecurityPolicy Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * renumber release notes Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * fix: name the jwt requirement after the policies applied to the route Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * fix: pick the local JWKS ConfigMap fallback key deterministically Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> --------- Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> (cherry picked from commit fca6beea9950a107feb77d8d613d65ef16be8e7e) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix: drop stale route parent status when a parentRef is removed from spec (#9587) * fix: drop stale route parent status when a parentRef is removed from spec Motivation: When a Route's spec.parentRefs is edited to remove a reference to a Gateway, the RouteParentStatus entry for that old parentRef used to linger in status.parents forever (envoyproxy/gateway#774). The status subresource kept reporting a parent condition (e.g. Accepted=True) for a Gateway the route no longer references at all. This is a status-reporting bug only: it does not affect dataplane behavior, since Envoy's xDS config is derived from the current spec / attached-routes computation, not from the status subresource. The route's live parentRefs were always handled correctly for traffic; only the stale status.parents entry was left behind. Root cause: mergeRouteParentStatus() reconciles the route's on-cluster status.Parents ("old") with what the translator computed for this particular reconciliation batch ("new"). PR #6812 taught it to drop old entries not in "new" when they belonged to our own controller, fixing #774, but that broke multi-parent routes because a single batch may only touch some of a route's parents (PR #7068, issue entry absent from "new", which silently reintroduced the #774 staleness bug. Approach: Thread the route's live spec.ParentRefs (already available in the status-updater Mutator, fetched immediately before the merge) into mergeRouteParentStatus as a new parameter. An old status entry absent from "new" is now kept only if its parentRef is still present in spec.ParentRefs (multi-parent case, not touched this batch); otherwise it's dropped as stale. This keeps both prior fixes intact at once. Validation: go build ./... go test ./internal/provider/kubernetes/... Both pass, including the existing Test_mergeRouteParentStatus suite (updated for the new parameter) plus a new case that reproduces #774: a parentRef removed from spec.ParentRefs no longer survives the merge. Fixes #774 Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> * test: exercise updateStatusFromSubscriptions HTTPRoute path for #774 fix Adds a regression test that drives the real subscription/mutator wiring (watchable.Map + fake Updater) instead of calling mergeRouteParentStatus directly, so the HTTPRoute call site that threads spec.ParentRefs through is covered. Addresses the codecov/patch check, which flagged the new call sites added across status.go as uncovered. Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> * docs: add release-note fragment for stale route parent status fix Per Codex review feedback on PR #9587, add the missing bug-fix fragment under release-notes/current/bug_fixes/. Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> * fix: filter new RouteParentStatus entries against spec.ParentRefs too mergeRouteParentStatus already dropped stale old-status entries no longer in spec.ParentRefs, but the second loop appended unmatched new entries unconditionally. Since new is computed asynchronously and can lag behind the live spec read at patch-apply time, a status entry for a parentRef removed from spec in between could leak back into the merged result. Apply the same spec-membership filter to new. Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> * fix: only drop stale route parent status owned by our controller Entries in status.parents written by other controllers are always kept, even if their parentRef is no longer in spec.parentRefs; only Envoy Gateway's own stale entries are dropped. Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> * test: match fakeUpdater.Send to the context-aware Updater interface Updater.Send now takes a context.Context on main, so the test fake used by Test_updateStatusFromSubscriptions_HTTPRoute no longer satisfied the interface once the branch was rebased. Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> * fix: drop matched route parent status when parentRef is removed from spec Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> --------- Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> (cherry picked from commit d8023843ed272abec231e30b95768bcf63c92d56) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * Update report link for crashes and security issues (#10488) Signed-off-by: zirain <zirain2009@gmail.com> (cherry picked from commit 3ddec9d2817585aa897d51e1efb71dba91ab4fa7) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix: bound compressor minContentLength before narrowing to uint32 (#9852) * fix: bound compressor minContentLength before narrowing to uint32 Signed-off-by: Javid Khan <dxbjavid@gmail.com> (cherry picked from commit c1d70ccd83521aafac046e33582dd8f50b988d15) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * build(deps-dev): bump autoprefixer from 10.6.1 to 10.6.2 in /site (#10500) Bumps [autoprefixer](https://github.com/postcss/autoprefixer) from 10.6.1 to 10.6.2. - [Release notes](https://github.com/postcss/autoprefixer/releases) - [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/autoprefixer/compare/10.6.1...10.6.2) --- updated-dependencies: - dependency-name: autoprefixer dependency-version: 10.6.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 00940a62dece43e87c95353a8bf744c76bd0ecb3) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * build(deps): bump distroless/base-nossl from `6a2a334` to `e6b0f82` in /tools/docker/envoy-gateway (#10498) build(deps): bump distroless/base-nossl in /tools/docker/envoy-gateway Bumps distroless/base-nossl from `6a2a334` to `e6b0f82`. --- updated-dependencies: - dependency-name: distroless/base-nossl dependency-version: nonroot dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit c267eaae4c2bf40244a5c4e1d02d9ed31b774260) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * build(deps): bump busybox from `fd7dc98` to `a46257e` in /tools/docker/envoy-gateway (#10499) build(deps): bump busybox in /tools/docker/envoy-gateway Bumps busybox from `fd7dc98` to `a46257e`. --- updated-dependencies: - dependency-name: busybox dependency-version: a46257e06c82ad85242d0d38077d0a52d9896389ca60a1a59d3463db586e5fa4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 9c677e0f5bd09e432f37fd35287d468d13cd8ddf) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * build(deps): bump sigs.k8s.io/gateway-api from 1.6.3 to 1.7.0 in /examples/extension-server (#10511) build(deps): bump sigs.k8s.io/gateway-api in /examples/extension-server Bumps [sigs.k8s.io/gateway-api](https://github.com/kubernetes-sigs/gateway-api) from 1.6.3 to 1.7.0. - [Release notes](https://github.com/kubernetes-sigs/gateway-api/releases) - [Changelog](https://github.com/kubernetes-sigs/gateway-api/blob/main/RELEASE.md) - [Commits](https://github.com/kubernetes-sigs/gateway-api/compare/v1.6.3...v1.7.0) --- updated-dependencies: - dependency-name: sigs.k8s.io/gateway-api dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit a9488202c0add875081be2b0d526e4179992f08f) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * perf(translator): reuse consecutive backend policy merges (#10147) * [envoy-gateway] Reuse consecutive backend policy merges [ci changed_files] Signed-off-by: Cooper Gamble <cooper@openai.com> * [envoy-gateway] Note repeated policy merge reuse [ci changed_files] Signed-off-by: Cooper Gamble <cooper@openai.com> --------- Signed-off-by: Cooper Gamble <cooper@openai.com> Co-authored-by: zirain <zirain2009@gmail.com> (cherry picked from commit f45fed8f3b97c225e005981f485e94e4760994ae) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * perf: skip deep copy when listing policies in the k8s provider (#10164) List the policy CRDs with client.UnsafeDisableDeepCopy and set the GVK on each listed item, since controller-runtime only populates TypeMeta when it deep-copies. Fixes #9781 Signed-off-by: stillya <st.ilya.101@gmail.com> (cherry picked from commit b154c381a3e5ba2746b014d61486cb6a5937654c) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * test: add proxy reconnect config resilience coverage (#10184) * test: add proxy reconnect config resilience coverage Signed-off-by: Ashok Gopalakrishnan <286242776+ashok-gk@users.noreply.github.com> * test: wait for config processing before proxy reconnect Signed-off-by: Ashok Gopalakrishnan <286242776+ashok-gk@users.noreply.github.com> * test: strengthen proxy reconnect resilience checks Signed-off-by: Ashok Gopalakrishnan <286242776+ashok-gk@users.noreply.github.com> * test: wait for xds snapshot before proxy reconnect Signed-off-by: Ashok Gopalakrishnan <286242776+ashok-gk@users.noreply.github.com> --------- Signed-off-by: Ashok Gopalakrishnan <286242776+ashok-gk@users.noreply.github.com> (cherry picked from commit bf4533c7bd6120699e386ca83d4f4a98401658c5) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix: check group when dispatching HTTPRouteFilter extensionRefs (#10395) * fix: check group when dispatching HTTPRouteFilter extensionRefs Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * renumber release note Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> --------- Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> (cherry picked from commit 4b12875056f0bf93ee11eef0dc5cfd3181e06ac0) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * ci: treat abandoned as false (#10287) Signed-off-by: zirain <zirain2009@gmail.com> (cherry picked from commit c2aaf5fc231a7fc9fe29fc8a14e74ecdef510560) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * build(deps): bump jpmcb/prow-github-actions from 3.0.1 to 3.5.0 in the actions group across 1 directory (#10514) build(deps): bump jpmcb/prow-github-actions Bumps the actions group with 1 update in the / directory: [jpmcb/prow-github-actions](https://github.com/jpmcb/prow-github-actions). Updates `jpmcb/prow-github-actions` from 3.0.1 to 3.5.0 - [Release notes](https://github.com/jpmcb/prow-github-actions/releases) - [Commits](https://github.com/jpmcb/prow-github-actions/compare/187c5e3cd95a329c43448e1bdb3b1f5249232e44...a192ee15687d4ede4d553ff0929b2b296666afd7) --- updated-dependencies: - dependency-name: jpmcb/prow-github-actions dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 86dd45db1537a5a8020d059851393abebfe9de1e) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * build(deps): bump the gomod group across 10 directories with 4 updates (#10508) * build(deps): bump the gomod group across 10 directories with 4 updates Bumps the gomod group with 3 updates in the / directory: [github.com/ohler55/ojg](https://github.com/ohler55/ojg), [github.com/replicatedhq/troubleshoot](https://github.com/replicatedhq/troubleshoot) and [google.golang.org/grpc](https://github.com/grpc/grpc-go). Bumps the gomod group with 1 update in the /examples/backend-utilization directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go). Bumps the gomod group with 1 update in the /examples/envoy-ext-auth directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go). Bumps the gomod group with 1 update in the /examples/extension-server directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go). Bumps the gomod group with 1 update in the /examples/grpc-ext-proc directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go). Bumps the gomod group with 1 update in the /examples/grpc-health-backend directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go). Bumps the gomod group with 1 update in the /examples/preserve-case-backend directory: [github.com/valyala/fasthttp](https://github.com/valyala/fasthttp). Bumps the gomod group with 1 update in the /examples/remote-infra directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go). Bumps the gomod group with 1 update in the /examples/sds-test-server directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go). Bumps the gomod group with 1 update in the /examples/simple-extension-server directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go). Updates `github.com/ohler55/ojg` from 1.28.8 to 1.28.9 - [Release notes](https://github.com/ohler55/ojg/releases) - [Changelog](https://github.com/ohler55/ojg/blob/develop/CHANGELOG.md) - [Commits](https://github.com/ohler55/ojg/compare/v1.28.8...v1.28.9) Updates `github.com/replicatedhq/troubleshoot` from 0.134.2 to 0.134.3 - [Release notes](https://github.com/replicatedhq/troubleshoot/releases) - [Commits](https://github.com/replicatedhq/troubleshoot/compare/v0.134.2...v0.134.3) Updates `google.golang.org/grpc` from 1.84.0 to 1.85.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.84.0...v1.85.0) Updates `google.golang.org/grpc` from 1.84.0 to 1.85.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.84.0...v1.85.0) Updates `google.golang.org/grpc` from 1.84.0 to 1.85.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.84.0...v1.85.0) Updates `google.golang.org/grpc` from 1.84.0 to 1.85.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.84.0...v1.85.0) Updates `google.golang.org/grpc` from 1.84.0 to 1.85.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.84.0...v1.85.0) Updates `google.golang.org/grpc` from 1.84.0 to 1.85.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.84.0...v1.85.0) Updates `github.com/valyala/fasthttp` from 1.76.0 to 1.77.0 - [Release notes](https://github.com/valyala/fasthttp/releases) - [Commits](https://github.com/valyala/fasthttp/compare/v1.76.0...v1.77.0) Updates `google.golang.org/grpc` from 1.84.0 to 1.85.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.84.0...v1.85.0) Updates `google.golang.org/grpc` from 1.84.0 to 1.85.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.84.0...v1.85.0) Updates `google.golang.org/grpc` from 1.84.0 to 1.85.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.84.0...v1.85.0) --- updated-dependencies: - dependency-name: github.com/ohler55/ojg dependency-version: 1.28.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: github.com/replicatedhq/troubleshoot dependency-version: 0.134.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: google.golang.org/grpc dependency-version: 1.85.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/grpc dependency-version: 1.85.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/grpc dependency-version: 1.85.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/grpc dependency-version: 1.85.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/grpc dependency-version: 1.85.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/grpc dependency-version: 1.85.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: github.com/valyala/fasthttp dependency-version: 1.77.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/grpc dependency-version: 1.85.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/grpc dependency-version: 1.85.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/grpc dependency-version: 1.85.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> * fix go mod Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> (cherry picked from commit 271851b5942b9576d35c211316bf75bd272528ce) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix(extension): select the Secret hook owner first and support extensionManagers offline (#10490) * fix(extension): select the Secret hook owner first and support extensionManagers offline When several extension managers register the Secret hook, every manager's client was built before the owner was known, so a manager that failed to connect blocked certificate resolution for all extensions. The owning extension is now selected by group and kind first, and only its client is built. The offline controller only read the singular extensionManager, so extension kinds configured through extensionManagers were not registered in standalone mode. It now uses GetExtensionManagers(), like the Kubernetes controller and the file loader. Signed-off-by: Weiwei Li <weiweiww@amazon.com> * fix(gatewayapi): keep configured order of extension and Secret certificates Signed-off-by: Weiwei Li <weiweiww@amazon.com> --------- Signed-off-by: Weiwei Li <weiweiww@amazon.com> (cherry picked from commit 497a83ea14675b8244983d70ae6c0305eb276720) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * feat(translator): report ineffective backend priority in route status (#10462) * feat(translator): report ineffective backend priority in route status Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * renumber release notes Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * remove dead code Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> * fix: treat custom backends as usable when detecting priority failover Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> --------- Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> (cherry picked from commit 5dae240edc5c4e4bb7c66c21dd1fb15eb62cb9c6) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * ci: bump trivy to v0.76.1 (#10522) trivy-action is already on its latest release but still installs Trivy v0.70.0 by default. Pin the scanner to v0.76.1 so the image scan uses a current vulnerability matcher. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> (cherry picked from commit 186776ecad8a3892e7c403d50c6c069e58a4bb9d) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix: fall back to last successful OIDC discovery when refetch fails (#10020) The OIDC discovery cache is re-created on every translation, so a transient failure fetching <issuer>/.well-known/openid-configuration during any reconciliation made every route protected by that issuer return HTTP 500 until a later translation succeeded. Retain the last successfully discovered OpenID configuration per issuer in a process-wide, mutex-guarded, size-capped LRU cache and fall back to it (logging the error) when discovery fails. Issuers that were never discovered successfully still surface the error, and errors in the local issuer or TLS configuration are never masked. A discovered token endpoint the policy overrides is not validated before the result is retained. Signed-off-by: KR Ravindra <42912207+KR-Ravindra@users.noreply.github.com> (cherry picked from commit 4026ff41fd9fbd7fb5add135e440fb44ed693881) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * build(deps): bump the helm group across 1 directory with 3 updates (#10507) * build(deps): bump the helm group across 1 directory with 3 updates Bumps the helm group with 3 updates in the /charts/gateway-addons-helm directory: alloy, opentelemetry-collector and otel/opentelemetry-collector-contrib. Updates `alloy` from 1.14.3 to 1.15.0 Updates `opentelemetry-collector` from 0.178.0 to 0.178.2 Updates `otel/opentelemetry-collector-contrib` from 0.163.2 to 0.164.0 --- updated-dependencies: - dependency-name: alloy dependency-version: 1.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: helm - dependency-name: opentelemetry-collector dependency-version: 0.178.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: helm - dependency-name: otel/opentelemetry-collector-contrib dependency-version: 0.164.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: helm ... Signed-off-by: dependabot[bot] <support@github.com> * fix-gen Signed-off-by: zhaohuabing <huabing@tetrate.io> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: zhaohuabing <huabing@tetrate.io> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: zhaohuabing <huabing@tetrate.io> (cherry picked from commit a5e9d8becf8c4bfdd4abc7887b602c78ade674ef) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix: retry status updates on transient errors (#10449) * fix: retry status updates on transient errors The status writer only retried conflicts, so a timeout, throttling or a brief API server outage dropped the update. Since the same status isn't re-sent, the object kept a stale status until something else changed. Transient errors are now retried with backoff, and each attempt gets its own timeout and stops on shutdown. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * docs: name release note after PR number Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix: drop the per-attempt timeout from status retries The timeout made client-side rate limiting fail early with an error that isn't treated as transient, and cancelled in-flight writes on shutdown. The API calls go back to a background context, and the handler's context now only stops the backoff wait. Tests skip the real backoff waits. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix: use one backoff for status conflicts and transient errors Conflicts and transient errors now share a single retry loop instead of a nested one, so the worst case stays at about 1.5s. The loop uses wait.ExponentialBackoffWithContext, which already stops waiting on shutdown. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix: go back to retry.OnError for status retries Use retry.OnError with the shared backoff, the same pattern crdExists uses, so the code reads like it did before. Each attempt checks for shutdown first, so nothing is written once the handler stops. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix: keep the status retry change minimal Go back to the original retry call and only add transient errors to what it retries, with a longer backoff so they have time to clear. The shutdown handling and the refactor are dropped to keep the change small. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * test: drop the status updater retry test Remove the new test file to keep this change small. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix: count transient status retries under their own reason Transient retries were counted as errors, so one lost update showed up as several and a retry that later succeeded still looked like a failure. They now use a separate transient reason, and error only counts updates that fail. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix: treat connection-level API errors as transient A refused or reset connection comes back from client-go as a transport error, not a Kubernetes status error, so status writes gave up on the first attempt while the API server was briefly unreachable. Widening isTransientError covers both the status updater and the controller, which now requeues instead of reporting a resource as invalid on a network blip. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> (cherry picked from commit c89fb11108e34686666307eba4b8230ab65db8b1) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * build(deps): bump the k8s-io group across 2 directories with 6 updates (#10509) * build(deps): bump the k8s-io group across 2 directories with 6 updates Bumps the k8s-io group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [k8s.io/api](https://github.com/kubernetes/api) | `0.37.1` | `0.37.2` | | [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | `0.37.1` | `0.37.2` | | [k8s.io/apiserver](https://github.com/kubernetes/apiserver) | `0.37.1` | `0.37.2` | | [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime) | `0.37.1` | `0.37.2` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.37.1` | `0.37.2` | | [k8s.io/kubectl](https://github.com/kubernetes/kubectl) | `0.37.1` | `0.37.2` | Bumps the k8s-io group with 1 update in the /examples/remote-infra directory: [k8s.io/api](https://github.com/kubernetes/api). Updates `k8s.io/api` from 0.37.1 to 0.37.2 - [Commits](https://github.com/kubernetes/api/compare/v0.37.1...v0.37.2) Updates `k8s.io/apiextensions-apiserver` from 0.37.1 to 0.37.2 - [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases) - [Commits](https://github.com/kubernetes/apiextensions-apiserver/compare/v0.37.1...v0.37.2) Updates `k8s.io/apiserver` from 0.37.1 to 0.37.2 - [Commits](https://github.com/kubernetes/apiserver/compare/v0.37.1...v0.37.2) Updates `k8s.io/cli-runtime` from 0.37.1 to 0.37.2 - [Commits](https://github.com/kubernetes/cli-runtime/compare/v0.37.1...v0.37.2) Updates `k8s.io/client-go` from 0.37.1 to 0.37.2 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](https://github.com/kubernetes/client-go/compare/v0.37.1...v0.37.2) Updates `k8s.io/kubectl` from 0.37.1 to 0.37.2 - [Commits](https://github.com/kubernetes/kubectl/compare/v0.37.1...v0.37.2) Updates `k8s.io/api` from 0.37.1 to 0.37.2 - [Commits](https://github.com/kubernetes/api/compare/v0.37.1...v0.37.2) --- updated-dependencies: - dependency-name: k8s.io/api dependency-version: 0.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apiextensions-apiserver dependency-version: 0.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/apiserver dependency-version: 0.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/cli-runtime dependency-version: 0.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/client-go dependency-version: 0.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/kubectl dependency-version: 0.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io - dependency-name: k8s.io/api dependency-version: 0.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: k8s-io ... Signed-off-by: dependabot[bot] <support@github.com> * fix go mod Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> (cherry picked from commit 639aa2b0475029b182dfb146a1be78b66c7c34a1) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * e2e: fix WeightedZones flaky (#10496) Signed-off-by: zirain <zirain2009@gmail.com> (cherry picked from commit 8dd6b0ec6d6a3c96c9fd863ce3e306eefa3c6c89) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix: extension backend dispatch (#10256) * fix: extension backend dispatch Signed-off-by: zirain <zirain2009@gmail.com> * update docs Signed-off-by: zirain <zirain2009@gmail.com> * fix review comments Signed-off-by: zirain <zirain2009@gmail.com> * test: build ExtensionRefIndex in custom backend unit tests #10321 moved custom backend lookup to an index built in Translate(), so tests that call processDestination directly must populate it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 1564810c93c8f4616efdb606a284a3d0c7cc5a62) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * ci: pin alloy chart to 1.14.3 (#10526) ci: pin alloy chart to 1.14.3 (#10525) Alloy v1.21.3 seems to stall log shipping to Loki, which breaks the e2e health check event log tests in about half the cells. Pin the chart back and keep dependabot from bumping it until the root cause is sorted out. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> (cherry picked from commit 73db23a3f1a0685cb392c04e2a16374d1da35b66) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * chore: ignore linkedin.com (#10527) Signed-off-by: zirain <zirain2009@gmail.com> (cherry picked from commit 2ffc5d9ca2339ca283c4f035da6437ee4239efaf) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * ci: extend dependabot alloy ignore to chart 1.14.4 (#10530) Alloy chart 1.14.4 is a patch release that already ships Alloy v1.21.3, the version that breaks the health check event log e2e tests. The existing ignore only started at 1.15.0, so dependabot opened #10529 anyway. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> (cherry picked from commit fc0abcb58b20a1c60861cf77ec19b27d48cee491) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * fix: bump golang.org/x/crypto to fix GO-2026-5932 (#10523) Trivy flags x/crypto v0.58.0 in the envoy-gateway binary for GO-2026-5932. There is no tagged release with the fix yet, so this moves to the upstream commit that splits openpgp out of x/crypto. Switch back to a tag once one ships. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> Co-authored-by: zirain <zirain2009@gmail.com> (cherry picked from commit d82a6b6920e3267697e35c5e45893e92e10870be) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * build(deps): bump github.com/avast/retry-go/v5 from 5.0.0 to 5.0.1 in the gomod group across 1 directory (#10534) * build(deps): bump github.com/avast/retry-go/v5 Bumps the gomod group with 1 update in the / directory: [github.com/avast/retry-go/v5](https://github.com/avast/retry-go). Updates `github.com/avast/retry-go/v5` from 5.0.0 to 5.0.1 - [Release notes](https://github.com/avast/retry-go/releases) - [Commits](https://github.com/avast/retry-go/compare/5.0.0...5.0.1) --- updated-dependencies: - dependency-name: github.com/avast/retry-go/v5 dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> * fix lint Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: zirain <zirain2009@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: zirain <zirain2009@gmail.com> (cherry picked from commit cfb4c251e82a8c6e7f2d8271633c2d488744f609) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * docs: v1.10.0 release notes and announcement (#10536) docs: v1.10.0 release notes, announcement and versioned docs Add the v1.10.0 release notes (rc.1 plus everything merged since), the announcement, the v1.10 docs snapshot, and the version bumps in the site config. Also fix a few spots that compared version strings as plain text, so v1.10 no longer sorts before v1.9 or matches the EOL v1.1 entry. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> (cherry picked from commit dcd65a47ce91cd3dea3fa467661191bbe6c199a3) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * test: give resilience xDS disconnect check more time (#10538) The proxy reconnect test blocks xDS with a NetworkPolicy, but that only drops packets on the open connection, so Envoy notices through its 30s keepalive. With jitter, the ping timeout and the Prometheus scrape that often runs past the one-minute wait, so the disconnect check now waits up to two minutes. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> (cherry picked from commit 1d179989f9205dfe06aa9bac9871ac16ab2bbf8a) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> * test: use isolated schemes in route processing tests (#10539) The HTTPRoute and GRPCRoute processing tests shared the global scheme with their fake clients, which register unknown extension types on the fly. That write raced with informers left running by other tests in the package and flaked coverage-test under the race detector. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> (cherry picked from commit 3e91fbc9781c39c6b0066ddf0a9b6bb473e358f8) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> --------- Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io> Signed-off-by: allevimi <michele.allevi@gmail.com> Signed-off-by: Alexej Disterhoft <alexej@disterhoft.de> Signed-off-by: somaz <genius5711@gmail.com> Signed-off-by: Cooper Gamble <cooper@openai.com> Signed-off-by: Andreea Popescu <andreea.popescu@pidginhost.com> Signed-off-by: liuhy <liuhongyu@apache.org> Signed-off-by: amarkdotdev <amark@g.jct.ac.il> Signed-off-by: Aaron <amark@g.jct.ac.il> Signed-off-by: RAJATH MOHARE <rajath@digiscrypt.com> Signed-off-by: Matheus Sousa <matessousa@outlook.com> Signed-off-by: simonfelding <simonfelding@gmail.com> Signed-off-by: Arko Dasgupta <arkodg@gmail.com> Signed-off-by: Nico Bleiler <n.bleiler@verfahrensdokumentation.pro> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Signed-off-by: Javid Khan <dxbjavid@gmail.com> Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: stillya <st.ilya.101@gmail.com> Signed-off-by: Ashok Gopalakrishnan <286242776+ashok-gk@users.noreply.github.com> Signed-off-by: Weiwei Li <weiweiww@amazon.com> Signed-off-by: KR Ravindra <42912207+KR-Ravindra@users.noreply.github.com> Signed-off-by: zhaohuabing <huabing@tetrate.io> Co-authored-by: zirain <zirain2009@gmail.com> Co-authored-by: allevimi <michele.allevi@gmail.com> Co-authored-by: kkk777-7 <kota.kimura0725@gmail.com> Co-authored-by: Alexej Disterhoft <alexej@disterhoft.de> Co-authored-by: somaz <112675579+somaz94@users.noreply.github.com> Co-authored-by: cooper-oai <cooper@openai.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: andreeapid <andreea.popescu@pidginhost.com> Co-authored-by: aias00 <liuhongyu@apache.org> Co-authored-by: Aaron Mark <64331623+amarkdotdev@users.noreply.github.com> Co-authored-by: rajath201 <rajath@digiscrypt.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Co-authored-by: Matheus Sousa <matessousa@outlook.com> Co-authored-by: simonfelding <45149055+simonfelding@users.noreply.github.com> Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> Co-authored-by: Nico Bleiler <nico.bleiler@gmail.com> Co-authored-by: Kota Kimura <86363983+kkk777-7@users.noreply.github.com> Co-authored-by: Pujitha Paladugu <pujitha.rathna@gmail.com> Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Co-authored-by: Javid Khan <dxbjavid@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Starchenko Ilya <st.ilya.101@gmail.com> Co-authored-by: Ashok Gopalakrishnan <286242776+ashok-gk@users.noreply.github.com> Co-authored-by: wweiwei-li <79778352+wweiwei-li@users.noreply.github.com> Co-authored-by: KR Ravindra <rajaravindra919@gmail.com>

KR-Ravindra marked this pull request as ready for review September 27, 2026 09:08

KR-Ravindra requested a review from a team as a code owner September 27, 2026 09:08

KR-Ravindra marked this pull request as draft September 27, 2026 17:52

KR-Ravindra force-pushed the fix/oidc-discovery-fallback-last-good branch from 0f8eb56 to 5fdc4c6 Compare October 21, 2026 13:29

KR-Ravindra marked this pull request as ready for review October 21, 2026 13:30

chatgpt-codex-connector Bot reviewed Oct 21, 2026

View reviewed changes

Comment thread internal/gatewayapi/securitypolicy.go Resolved

KR-Ravindra force-pushed the fix/oidc-discovery-fallback-last-good branch from 5fdc4c6 to 8a5ecb0 Compare October 21, 2026 15:43

chatgpt-codex-connector Bot reviewed Oct 21, 2026

View reviewed changes

Comment thread internal/gatewayapi/securitypolicy.go Resolved

KR-Ravindra force-pushed the fix/oidc-discovery-fallback-last-good branch from 8a5ecb0 to 0f3cbbc Compare October 21, 2026 17:57

KR-Ravindra force-pushed the fix/oidc-discovery-fallback-last-good branch from 0f3cbbc to 3b19a88 Compare November 2, 2026 14:42

chatgpt-codex-connector Bot reviewed Nov 2, 2026

View reviewed changes

KR-Ravindra force-pushed the fix/oidc-discovery-fallback-last-good branch from 3b19a88 to 6c70f5a Compare November 2, 2026 16:57

chatgpt-codex-connector Bot reviewed Nov 2, 2026

View reviewed changes

arkodg added this to the v1.10.0 Release milestone Nov 2, 2026

arkodg requested a review from zhaohuabing November 2, 2026 18:19

KR-Ravindra force-pushed the fix/oidc-discovery-fallback-last-good branch from 6c70f5a to db45ccb Compare November 2, 2026 19:10

zhaohuabing reviewed Nov 3, 2026

View reviewed changes

KR-Ravindra force-pushed the fix/oidc-discovery-fallback-last-good branch from db45ccb to bc353f7 Compare November 3, 2026 01:37

zhaohuabing requested a review from a team November 3, 2026 01:37

chatgpt-codex-connector Bot reviewed Nov 3, 2026

View reviewed changes

zhaohuabing reviewed Nov 3, 2026

View reviewed changes

zhaohuabing requested a review from a team November 3, 2026 01:50

KR-Ravindra force-pushed the fix/oidc-discovery-fallback-last-good branch from bc353f7 to f81e6ca Compare November 3, 2026 06:06

KR-Ravindra force-pushed the fix/oidc-discovery-fallback-last-good branch 2 times, most recently from 534e8d9 to cc657cf Compare November 3, 2026 12:42

chatgpt-codex-connector Bot reviewed Nov 3, 2026

View reviewed changes

zhaohuabing previously approved these changes Nov 4, 2026

View reviewed changes

KR-Ravindra force-pushed the fix/oidc-discovery-fallback-last-good branch from cc657cf to 5ebd886 Compare November 4, 2026 06:09

chatgpt-codex-connector Bot reviewed Nov 4, 2026

View reviewed changes

zhaohuabing requested review from a team and zhaohuabing November 4, 2026 09:00

KR-Ravindra dismissed zhaohuabing’s stale review via 88e846f November 4, 2026 10:28

KR-Ravindra force-pushed the fix/oidc-discovery-fallback-last-good branch from bd924a6 to 88e846f Compare November 4, 2026 10:28

jakeyheath mentioned this pull request Nov 4, 2026

fix(stack): set the Okta OIDC endpoints explicitly instead of fetching them at runtime chanzuckerberg/argo-helm-charts#618

Closed

zirain approved these changes Nov 5, 2026

View reviewed changes

zhaohuabing approved these changes Nov 5, 2026

View reviewed changes

zhaohuabing merged commit 4026ff4 into envoyproxy:main Nov 5, 2026
45 checks passed

		if tokenEndpointOverridden \|\| validateTokenEndpoint(config.TokenEndpoint) == nil {
		oidcDiscoveryFallback.Set(issuerURL, config, tlsFingerprint)

Conversation

KR-Ravindra commented Sep 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Sep 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

sadovnikov commented Oct 21, 2026

Uh oh!

KR-Ravindra commented Oct 21, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

KR-Ravindra commented Oct 21, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

sadovnikov commented Oct 21, 2026

Uh oh!

KR-Ravindra commented Oct 21, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 21, 2026

Uh oh!

KR-Ravindra commented Nov 2, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Nov 2, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Nov 2, 2026

Choose a reason for hiding this comment

Uh oh!

KR-Ravindra commented Nov 2, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Nov 2, 2026

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

zhaohuabing Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

KR-Ravindra commented Nov 3, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Nov 3, 2026

Choose a reason for hiding this comment

KR-Ravindra commented Sep 13, 2026 •

edited

Loading

netlify Bot commented Sep 13, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 21, 2026 •

edited

Loading

codecov Bot commented Nov 2, 2026 •

edited

Loading

zhaohuabing Nov 3, 2026 •

edited

Loading