Skip to content

Commit 76e714e

Browse files
guydczhaohuabingnothinuxarkodgdependabot[bot]
authored
[release/v1.3] release v1.3.0 cherry-pick from main (#5179)
* doc: response compression (#5071) compression docs Signed-off-by: Huabing Zhao <[email protected]> (cherry picked from commit 549fdde) Signed-off-by: Guy Daich <[email protected]> * docs: how to specify a self-signed ca for the remote jwks host in the SP JWT settings. (#5085) * docs for jwt self-signed ca Signed-off-by: Huabing Zhao <[email protected]> * fix gen Signed-off-by: Huabing Zhao <[email protected]> * update docs Signed-off-by: Huabing Zhao <[email protected]> --------- Signed-off-by: Huabing Zhao <[email protected]> (cherry picked from commit fdc7849) Signed-off-by: Guy Daich <[email protected]> * chore: fix gen (#5166) fix gen Signed-off-by: Huabing (Robin) Zhao <[email protected]> (cherry picked from commit 34db8af) Signed-off-by: Guy Daich <[email protected]> * docs: add api key auth instructions (#5097) * docs: add api key auth instruction Signed-off-by: Taufik Mulyana <[email protected]> * fix: remove unrelated links Signed-off-by: Taufik Mulyana <[email protected]> --------- Signed-off-by: Taufik Mulyana <[email protected]> (cherry picked from commit b5cf087) Signed-off-by: Guy Daich <[email protected]> * add SECURITY.md (#5167) Signed-off-by: Arko Dasgupta <[email protected]> (cherry picked from commit f7a10eb) Signed-off-by: Guy Daich <[email protected]> * chore: link SECURITY.md (#5168) Signed-off-by: Arko Dasgupta <[email protected]> (cherry picked from commit ac9026f) Signed-off-by: Guy Daich <[email protected]> * build(deps): bump actions/stale from 9.0.0 to 9.1.0 (#5162) Bumps [actions/stale](https://github.com/actions/stale) from 9.0.0 to 9.1.0. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@28ca103...5bef64f) --- updated-dependencies: - dependency-name: actions/stale dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Arko Dasgupta <[email protected]> (cherry picked from commit 57d4aa8) Signed-off-by: Guy Daich <[email protected]> * docs: rm sectionName from some of the examples (#5173) adds whats left off from #4868 deleted the sectionName in these examples because the Service spec does not define a port `Name` Signed-off-by: Arko Dasgupta <[email protected]> (cherry picked from commit 45804e2) Signed-off-by: Guy Daich <[email protected]> * ci(fix): osv-scanner PR mode (#5174) fix: osv-scanner PR mode Signed-off-by: shahar-h <[email protected]> Co-authored-by: Guy Daich <[email protected]> (cherry picked from commit e904d3f) Signed-off-by: Guy Daich <[email protected]> * wip: docs: add standalone in container instruction (#5172) * docs: add standalone in container instruction Signed-off-by: Denis Shatokhin <[email protected]> * docs: update headings and image tag Signed-off-by: Denis Shatokhin <[email protected]> --------- Signed-off-by: Denis Shatokhin <[email protected]> (cherry picked from commit a3448c1) Signed-off-by: Guy Daich <[email protected]> * docs: update prerequisites files with installation and connectivity t… (#5094) * docs: update prerequisites files with installation and connectivity testing steps Signed-off-by: DeeBi9 <[email protected]> * lint Signed-off-by: DeeBi9 <[email protected]> * docs: remove the Note Signed-off-by: DeeBi9 <[email protected]> * remove redundant code Signed-off-by: DeeBi9 <[email protected]> --------- Signed-off-by: DeeBi9 <[email protected]> (cherry picked from commit 3253339) Signed-off-by: Guy Daich <[email protected]> * [release/v1.3] fix 1.3.0-rc.1 release note (#5175) * fix 1.3.0-rc.1 release note Signed-off-by: Guy Daich <[email protected]> * more fixes Signed-off-by: Guy Daich <[email protected]> --------- Signed-off-by: Guy Daich <[email protected]> (cherry picked from commit 4fba2bf) Signed-off-by: Guy Daich <[email protected]> * fail validation if baseInterval is 0s (#5176) * fail validation if baseInterval is 0s Fixes: #5147 Signed-off-by: Arko Dasgupta <[email protected]> * more validations Signed-off-by: Arko Dasgupta <[email protected]> --------- Signed-off-by: Arko Dasgupta <[email protected]> (cherry picked from commit 4844d9a) Signed-off-by: Guy Daich <[email protected]> * [release/1.3] release notes (#5177) Signed-off-by: Guy Daich <[email protected]> (cherry picked from commit c2215b2) Signed-off-by: Guy Daich <[email protected]> --------- Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Guy Daich <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Taufik Mulyana <[email protected]> Signed-off-by: Arko Dasgupta <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: shahar-h <[email protected]> Signed-off-by: Denis Shatokhin <[email protected]> Signed-off-by: DeeBi9 <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Taufik Mulyana <[email protected]> Co-authored-by: Arko Dasgupta <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: shahar-h <[email protected]> Co-authored-by: Denis Shatokhin <[email protected]> Co-authored-by: Deepanshu Bisht <[email protected]>
1 parent bfe2bc1 commit 76e714e

File tree

142 files changed

+31034
-1218
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

142 files changed

+31034
-1218
lines changed

‎.github/ISSUE_TEMPLATE/config.yml

-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1 @@
11
blank_issues_enabled: false
2-
contact_links:
3-
- name: "Crash bug"
4-
url: https://github.com/envoyproxy/envoy/security/policy
5-
about: "Please file any crash bug with [email protected]."

‎.github/ISSUE_TEMPLATE/non--crash-security--bug.md

+1-2
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,7 @@ assignees: ''
99

1010
*Description*:
1111
>What issue is being seen? Describe what should be happening instead of
12-
the bug, for example: Envoy should not crash, the expected value isn't
13-
returned, etc.
12+
the bug, for example: The expected value isn't returned, etc.
1413

1514
*Repro steps*:
1615
> Include sample requests, environment, etc. All data and inputs

‎.github/workflows/osv-scanner.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333

3434
scan-pr:
3535
if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
36-
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@764c91816374ff2d8fc2095dab36eecd42d61638" # v1.9.2
36+
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@764c91816374ff2d8fc2095dab36eecd42d61638" # v1.9.2
3737
with:
3838
scan-args: |-
3939
--skip-git

‎.github/workflows/stale.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818

1919
steps:
2020
- name: Prune Stale
21-
uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
21+
uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
2222
with:
2323
repo-token: ${{ secrets.GITHUB_TOKEN }}
2424
# Different amounts of days for issues/PRs are not currently supported but there is a PR

‎README.md

+4
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,10 @@ Kubernetes-based application gateway.
3131
* [Contributing guide](https://gateway.envoyproxy.io/contributions/contributing/)
3232
* [Developer guide](https://gateway.envoyproxy.io/contributions/develop/)
3333

34+
## Security Reporting
35+
36+
If youve found a security vulnerability or a process crash, please follow the instructions in [SECURITY.md](./SECURITY.md) to submit a report.
37+
3438
## Community Meeting
3539

3640
The Envoy Gateway team meets every Tuesday and Thursday. We also have a separate meeting to be held in the

‎SECURITY.md

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Security Policy
2+
3+
## Reporting a Vulnerability or a Crash
4+
5+
We take security seriously and appreciate your help in identifying and responsibly disclosing vulnerabilities to protect our users.
6+
7+
To report a security issue:
8+
9+
1. **Do not open a public issue** on the GitHub repository to disclose a vulnerability.
10+
2. Send an email to our security team at [[email protected]](mailto:[email protected]).
11+
3. Include the following details in your email:
12+
- A detailed description of the vulnerability.
13+
- Steps to reproduce the issue.
14+
- Potential impact of the vulnerability.
15+
- Any suggested remediation or patches (if applicable).
16+
17+
We aim to respond to vulnerability reports within **48 hours** and will work with you to validate and address the issue.
18+
Once a resolution is identified, we will coordinate a release timeline with you and provide credit if applicable (with your consent).
19+
20+
## Security Updates
21+
22+
Security patches are announced through:
23+
24+
- The [GitHub Releases page](https://github.com/envoyproxy/gateway/releases)
25+
26+
To stay up-to-date with the latest security updates, we recommend subscribing to these channels.
27+
28+
## Best Practices for Secure Usage
29+
30+
To minimize security risks when using Envoy Gateway:
31+
32+
- Use the latest supported version of Envoy Gateway.
33+
- Regularly monitor for updates and apply patches promptly.
34+
35+
## Contact
36+
37+
If you have any questions about this security policy, please contact us at [[email protected]](mailto:[email protected]).
38+
39+
Thank you for helping us ensure the security of Envoy Gateway!

‎VERSION

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
v1.3.0-rc.1
1+
v1.3.0

‎examples/standalone/quickstart-containers.yaml

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
apiVersion: gateway.networking.k8s.io/v1
2+
kind: GatewayClass
3+
metadata:
4+
name: eg
5+
spec:
6+
controllerName: gateway.envoyproxy.io/gatewayclass-controller
7+
---
8+
apiVersion: gateway.networking.k8s.io/v1
9+
kind: Gateway
10+
metadata:
11+
name: eg
12+
spec:
13+
gatewayClassName: eg
14+
listeners:
15+
- name: http
16+
protocol: HTTP
17+
port: 8888
18+
---
19+
apiVersion: gateway.networking.k8s.io/v1
20+
kind: HTTPRoute
21+
metadata:
22+
name: backend
23+
spec:
24+
parentRefs:
25+
- name: eg
26+
hostnames:
27+
- "www.example.com"
28+
rules:
29+
- backendRefs:
30+
- group: "gateway.envoyproxy.io"
31+
kind: Backend
32+
name: backend
33+
matches:
34+
- path:
35+
type: PathPrefix
36+
value: /
37+
---
38+
apiVersion: gateway.envoyproxy.io/v1alpha1
39+
kind: Backend
40+
metadata:
41+
name: backend
42+
spec:
43+
endpoints:
44+
- fqdn:
45+
hostname: local-server.local
46+
port: 3000

‎internal/gatewayapi/backendtrafficpolicy.go

+10-4
Original file line numberDiff line numberDiff line change
@@ -333,9 +333,12 @@ func (t *Translator) translateBackendTrafficPolicyForRoute(
333333
err = perr.WithMessage(err, "TCPKeepalive")
334334
errs = errors.Join(errs, err)
335335
}
336-
if policy.Spec.Retry != nil {
337-
rt = buildRetry(policy.Spec.Retry)
336+
337+
if rt, err = buildRetry(policy.Spec.Retry); err != nil {
338+
err = perr.WithMessage(err, "Retry")
339+
errs = errors.Join(errs, err)
338340
}
341+
339342
if to, err = buildClusterSettingsTimeout(policy.Spec.ClusterSettings); err != nil {
340343
err = perr.WithMessage(err, "Timeout")
341344
errs = errors.Join(errs, err)
@@ -484,9 +487,12 @@ func (t *Translator) translateBackendTrafficPolicyForGateway(
484487
err = perr.WithMessage(err, "TCPKeepalive")
485488
errs = errors.Join(errs, err)
486489
}
487-
if policy.Spec.Retry != nil {
488-
rt = buildRetry(policy.Spec.Retry)
490+
491+
if rt, err = buildRetry(policy.Spec.Retry); err != nil {
492+
err = perr.WithMessage(err, "Retry")
493+
errs = errors.Join(errs, err)
489494
}
495+
490496
if ct, err = buildClusterSettingsTimeout(policy.Spec.ClusterSettings); err != nil {
491497
err = perr.WithMessage(err, "Timeout")
492498
errs = errors.Join(errs, err)

‎internal/gatewayapi/clustersettings.go

+19-7
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,10 @@ func translateTrafficFeatures(policy *egv1a1.ClusterSettings) (*ir.TrafficFeatur
7272
ret.HTTP2 = h2
7373
}
7474

75-
ret.Retry = buildRetry(policy.Retry)
75+
var err error
76+
if ret.Retry, err = buildRetry(policy.Retry); err != nil {
77+
return nil, err
78+
}
7679

7780
// If nothing was set in any of the above calls, return nil instead of an empty
7881
// container
@@ -477,9 +480,9 @@ func translateDNS(policy egv1a1.ClusterSettings) *ir.DNS {
477480
}
478481
}
479482

480-
func buildRetry(r *egv1a1.Retry) *ir.Retry {
483+
func buildRetry(r *egv1a1.Retry) (*ir.Retry, error) {
481484
if r == nil {
482-
return nil
485+
return nil, nil
483486
}
484487

485488
rt := &ir.Retry{}
@@ -518,13 +521,22 @@ func buildRetry(r *egv1a1.Retry) *ir.Retry {
518521
if r.PerRetry.BackOff != nil {
519522
if r.PerRetry.BackOff.MaxInterval != nil || r.PerRetry.BackOff.BaseInterval != nil {
520523
bop := &ir.BackOffPolicy{}
524+
if r.PerRetry.BackOff.BaseInterval != nil {
525+
bop.BaseInterval = r.PerRetry.BackOff.BaseInterval
526+
if bop.BaseInterval.Duration == 0 {
527+
return nil, fmt.Errorf("baseInterval cannot be set to 0s")
528+
}
529+
}
521530
if r.PerRetry.BackOff.MaxInterval != nil {
522531
bop.MaxInterval = r.PerRetry.BackOff.MaxInterval
532+
if bop.MaxInterval.Duration == 0 {
533+
return nil, fmt.Errorf("maxInterval cannot be set to 0s")
534+
}
535+
if bop.BaseInterval != nil && bop.BaseInterval.Duration > bop.MaxInterval.Duration {
536+
return nil, fmt.Errorf("maxInterval cannot be less than baseInterval")
537+
}
523538
}
524539

525-
if r.PerRetry.BackOff.BaseInterval != nil {
526-
bop.BaseInterval = r.PerRetry.BackOff.BaseInterval
527-
}
528540
pr.BackOff = bop
529541
bpr = true
530542
}
@@ -535,5 +547,5 @@ func buildRetry(r *egv1a1.Retry) *ir.Retry {
535547
}
536548
}
537549

538-
return rt
550+
return rt, nil
539551
}

‎internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.in.yaml

+68-1
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,44 @@ httpRoutes:
6262
backendRefs:
6363
- name: service-1
6464
port: 8080
65+
- apiVersion: gateway.networking.k8s.io/v1
66+
kind: HTTPRoute
67+
metadata:
68+
namespace: default
69+
name: httproute-2
70+
spec:
71+
hostnames:
72+
- gateway.envoyproxy.io
73+
parentRefs:
74+
- namespace: envoy-gateway
75+
name: gateway-2
76+
sectionName: http
77+
rules:
78+
- matches:
79+
- path:
80+
value: "/route2"
81+
backendRefs:
82+
- name: service-1
83+
port: 8080
84+
- apiVersion: gateway.networking.k8s.io/v1
85+
kind: HTTPRoute
86+
metadata:
87+
namespace: default
88+
name: httproute-3
89+
spec:
90+
hostnames:
91+
- gateway.envoyproxy.io
92+
parentRefs:
93+
- namespace: envoy-gateway
94+
name: gateway-2
95+
sectionName: http
96+
rules:
97+
- matches:
98+
- path:
99+
value: "/route3"
100+
backendRefs:
101+
- name: service-1
102+
port: 8080
65103
backendTrafficPolicies:
66104
- apiVersion: gateway.envoyproxy.io/v1alpha1
67105
kind: BackendTrafficPolicy
@@ -86,7 +124,7 @@ backendTrafficPolicies:
86124
kind: BackendTrafficPolicy
87125
metadata:
88126
namespace: default
89-
name: policy-for-route
127+
name: policy-for-route-1
90128
spec:
91129
targetRef:
92130
group: gateway.networking.k8s.io
@@ -106,3 +144,32 @@ backendTrafficPolicies:
106144
backoff:
107145
baseInterval: 100ms
108146
maxInterval: 10s
147+
- apiVersion: gateway.envoyproxy.io/v1alpha1
148+
kind: BackendTrafficPolicy
149+
metadata:
150+
namespace: default
151+
name: policy-for-route-2
152+
spec:
153+
targetRef:
154+
group: gateway.networking.k8s.io
155+
kind: HTTPRoute
156+
name: httproute-2
157+
retry:
158+
perRetry:
159+
backoff:
160+
baseInterval: 0s
161+
- apiVersion: gateway.envoyproxy.io/v1alpha1
162+
kind: BackendTrafficPolicy
163+
metadata:
164+
namespace: default
165+
name: policy-for-route-3
166+
spec:
167+
targetRef:
168+
group: gateway.networking.k8s.io
169+
kind: HTTPRoute
170+
name: httproute-3
171+
retry:
172+
perRetry:
173+
backoff:
174+
baseInterval: 2s
175+
maxInterval: 1s

0 commit comments

Comments
 (0)