fix(deps): update module go.datum.net/network-services-operator to v0.10.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
go.datum.net/network-services-operator	v0.1.0 -> v0.10.1

---

Release Notes

datum-cloud/network-services-operator (go.datum.net/network-services-operator)

v0.10.1

Compare Source

What's Changed

• feat: extract dk whois fields by @​zachsmith1 in #​79
• Fix bug with transitioning proxy target domain. by @​joshlreese in #​80

Full Changelog: datum-cloud/network-services-operator@v0.10.0...v0.10.1

v0.10.0

Compare Source

What's Changed

• feat: respect rdap 429 by @​zachsmith1 in #​74
• feat: retry after for rdap ip lookup by @​zachsmith1 in #​75
• feat: domain desired reg refresh attempt by @​zachsmith1 in #​76
• chore: merge main by @​zachsmith1 in #​77
• Remove dashes from DNS addresses and hostnames created for gateways by @​joshlreese in #​78
• Add new controller that looks for certificates pending a challenge and attaches a direct response route to the owning gateway. by @​joshlreese in #​73

Full Changelog: datum-cloud/network-services-operator@v0.9.0...v0.10.0

v0.9.0: - TrafficProtectionPolicies and Coraza WAF

Compare Source

What's Changed

• feat: add traffic protection policies for coraza waf by @​joshlreese in #​66
• Inject TrafficProtectionPolicy info into Envoy route metadata. by @​joshlreese in #​71
• feat: remove location role from network admin by @​scotwells in #​72

Full Changelog: datum-cloud/network-services-operator@v0.8.2...v0.9.0

TrafficProtectionPolicies

A TrafficProtectionPolicy can be used to apply policies to Gateways, Gateway Listeners, HTTPRoutes, and upcoming HTTPRoute Rules. The most specific attachment point takes precedence when multiple policies exist.

Minimal manifest

apiVersion: networking.datumapis.com/v1alpha
kind: TrafficProtectionPolicy
metadata:
  name: trafficprotectionpolicy-sample
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: backend
  mode: Observe

Manifest with defaults populated, rule exclusions added

apiVersion: networking.datumapis.com/v1alpha
kind: TrafficProtectionPolicy
metadata:
  name: trafficprotectionpolicy-sample
spec:
  mode: Enforce
  ruleSets:
  - owaspCoreRuleSet:
      paranoiaLevels:
        blocking: 1
        detection: 1
      ruleExclusions:
        idRanges:
        - 952101-990000
        ids:
        - 942100
        tags:
        - attack-sqli
      samplingPercentage: 100
      scoreThresholds:
        inbound: 5
        outbound: 4
    type: OWASPCoreRuleSet
  targetRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: backend

v0.8.2

Compare Source

What's Changed

• fix: floor positive sub-seconds to 1s by @​zachsmith1 in #​70

Full Changelog: datum-cloud/network-services-operator@v0.8.1...v0.8.2

v0.8.1

Compare Source

What's Changed

• fix: requeue on now or in the past by @​zachsmith1 in #​69

Full Changelog: datum-cloud/network-services-operator@v0.8.0...v0.8.1

v0.8.0

Compare Source

What's Changed

• refactor: adjust verification flow to support upcoming registration loop by @​zachsmith1 in #​64
• feat: wire domain controller with rdap registration by @​zachsmith1 in #​65
• feat: whois reconcile loop for tlds not in rdap by @​zachsmith1 in #​67
• feat: registration api/controller for rdap/whois by @​zachsmith1 in #​63

Full Changelog: datum-cloud/network-services-operator@v0.7.0...v0.8.0

v0.7.0

Compare Source

What's Changed

• Update Gateway API to v1.3.0, target Envoy Gateway v1.5.0. by @​joshlreese in #​48
• Default Gateway hostname changes to avoid issues outlined in GEP-3567. by @​joshlreese in #​49
• Add support for Envoy Gateway APIs: Backends, BackendTrafficPolicies, HTTPRouteFilters, SecurityPolicies. by @​joshlreese in #​50
• Validation for Backends, BackendTrafficPolicies, HTTPRouteFilters, and SecurityPolicies. by @​joshlreese in #​51
• Sync downstream resource status to upstream resources in gateway resource replicator. by @​joshlreese in #​52
• Add new ProtectedResource entries for Envoy Gateway API Extensions by @​joshlreese in #​53
• Move the webhook kustomization to be a Component so it can be included via Flux Kustomizations. by @​joshlreese in #​54
• Install Gateway API and Envoy Gateway API CRDs via direct manifests by @​joshlreese in #​55
• Allow management of secrets in the downstream control plane. by @​joshlreese in #​56
• Prefix cluster names obtained from UserInfo.Extra with a slash. by @​joshlreese in #​57
• Gateway API conformance suite implementation. by @​joshlreese in #​58
• Support v1 BackendTLSPolicies from the v1.4.0-rc2 release of the Gateway API. by @​joshlreese in #​59
• Add ProtectedResource for BackendTLSPolicies, update gateway admin and viewer roles with necessary permissions. by @​joshlreese in #​60
• Forgot to add the BackendTLSPolicy ProtectedResource to the kustomization. by @​joshlreese in #​61
• Update Gateway API to v1.3.0, target Envoy Gateway v1.5.0, expose new APIs by @​joshlreese in #​62

Full Changelog: datum-cloud/network-services-operator@v0.6.1...v0.7.0

v0.6.1

Compare Source

What's Changed

• Defining Gateways SLOs w/ Alerting by @​OscarLlamas6 in #​40

Full Changelog: datum-cloud/network-services-operator@v0.6.0...v0.6.1

v0.6.0

Compare Source

What's Changed

• feat: use extra for project/cluster by @​zachsmith1 in #​47

New Contributors

• @​zachsmith1 made their first contribution in #​47

Full Changelog: datum-cloud/network-services-operator@v0.5.0...v0.6.0

v0.5.0

Compare Source

What's Changed

• Add metric series to track custom hostnames defined on HTTPProxies and Gateways. by @​joshlreese in #​46

Full Changelog: datum-cloud/network-services-operator@v0.4.1...v0.5.0

v0.4.1

Compare Source

What's Changed

• fix: Remove e2e test for domains, fix gateway e2e test by @​joshlreese in #​45

Full Changelog: datum-cloud/network-services-operator@v0.4.0...v0.4.1

v0.4.0

Compare Source

What's Changed

• chore: use tagged milo release by @​scotwells in #​42
• feat: implement domain ownership verification with DNS and HTTP methods by @​joshlreese in #​43
• feat: Implement custom hostname support for HTTPProxies and Gateways by @​joshlreese in #​44

Full Changelog: datum-cloud/network-services-operator@v0.3.0...v0.4.0

New Features

Domain Ownership Verification and Custom Hostname Support

Added domain ownership verification and custom hostname support for HTTPProxy and Gateway resources:

• DNS TXT Record Verification: Verify domain ownership through DNS TXT records
• HTTP Token Verification: Alternative verification method using HTTP token validation
• Flexible Verification Logic: Domain is considered verified when either method succeeds
• Custom Hostname Programming: Support for custom hostnames on HTTPProxies and Gateways
• Hostname Retention: Programmed hostnames are retained even if Domain records are deleted
• Status Tracking: New verification conditions (Verified, VerifiedDNS, VerifiedHTTP, HostnamesVerified) provide status visibility
• ConfigMap-Based Tracking: Uses ConfigMaps to track hostnames programmed on downstream control planes
• Automated Retry Logic: status.verification.nextVerificationAttempt indicates when the next verification attempt will occur

v0.3.0

Compare Source

What's Changed

• Add network and network context controllers to manage status conditions and teardown logic. by @​joshlreese in #​18
• Adding Domain CRD by @​mustela in #​23
• Adding printer columns by @​mustela in #​26
• Adding city column by @​mustela in #​28
• Publish container image to GtHub by @​scotwells in #​24
• Migrate to Milo multi-cluster provider by @​scotwells in #​25
• Milo IAM resources by @​scotwells in #​27
• feat: New HTTPProxy CRD to use as a convenient method to set up reverse proxies. by @​joshlreese in #​32
• bugfix: allow exact matches on gateway hostname by @​scotwells in #​35
• feat: Add HTTPProxy controller and webhook implementation by @​joshlreese in #​34
• feat: Add HTTPRoute parentRef sectionName support and improved downstream resource GC by @​joshlreese in #​36
• fix: Correctly count the number of attached routes per listener, do not process attached routes more than once. by @​joshlreese in #​37
• fix: Map valid protocols to ports and only create downstream listeners for upstream protocols by @​joshlreese in #​38
• fix: Align backend endpoint host validation with EndpointSlice address validation. by @​joshlreese in #​41
• Merge HTTPProxy integration branch into main by @​joshlreese in #​39

New Contributors

• @​mustela made their first contribution in #​23

Full Changelog: datum-cloud/network-services-operator@v0.2.1...v0.3.0

v0.2.1

Compare Source

What's Changed

• Remove constraint that required backendRefs for all rules by @​joshlreese in #​16
• Program downstream gateways to use a separate secret for each listener certificate by @​joshlreese in #​17

Full Changelog: datum-cloud/network-services-operator@v0.2.0...v0.2.1

v0.2.0

Compare Source

What's Changed

• Add support for permitting specific clusters to use custom domains via a suffix match, by @​joshlreese in #​15

Full Changelog: datum-cloud/network-services-operator@v0.1.0...v0.2.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 13 additional dependencies were updated

Details:

Package	Change
cel.dev/expr	v0.19.1 -> v0.24.0
github.com/antlr4-go/antlr/v4	v4.13.0 -> v4.13.1
github.com/google/cel-go	v0.23.2 -> v0.25.0
github.com/grpc-ecosystem/grpc-gateway/v2	v2.24.0 -> v2.26.3
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.58.0 -> v0.60.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace	v1.33.0 -> v1.35.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	v1.33.0 -> v1.35.0
go.opentelemetry.io/otel/sdk	v1.34.0 -> v1.35.0
go.opentelemetry.io/proto/otlp	v1.4.0 -> v1.6.0
golang.org/x/exp	v0.0.0-20240719175910-8a7402abbf56 -> v0.0.0-20250506013437-ce4c2cf36ca6
google.golang.org/genproto/googleapis/api	v0.0.0-20250106144421-5f5ef82da422 -> v0.0.0-20250512202823-5a2f75b736a9
google.golang.org/genproto/googleapis/rpc	v0.0.0-20250218202821-56aae31c358a -> v0.0.0-20250519155744-55703ea1f237
google.golang.org/grpc	v1.71.0 -> v1.72.1

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: module go.datum.net/[email protected] requires go >= 1.24.7; switching to go1.24.10
go: downloading go1.24.10 (linux/amd64)
go: download go1.24.10: golang.org/[email protected]: verifying module: checksum database disabled by GOSUMDB=off