Skip to content

Commit f4209a3

Browse files
jukierudrakhpzirainnguyenptkbenjaminch
authored
[release/v1.8] cherry-pick for v1.8.1 (#9169)
* fix: restore last transition time in merge status conditions (#8962) * fix: restore last transition time in merge status conditions Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> * add release note Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> --------- Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> (cherry picked from commit 9430ab9) Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix: applyBackendTLSSetting panic (#8998) * fix: applyBackendTLSSetting panic Signed-off-by: zirain <zirain2009@gmail.com> (cherry picked from commit b754b68) Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix(xds): hot-reload xDS server cert in GatewayNamespaceMode (#8959) * fix(xds): hot-reload xDS server cert in GatewayNamespaceMode Signed-off-by: nguyenptk <nguyenptk@gmail.com> * extract loadServerTLSConfig helper and add tests Signed-off-by: nguyenptk <nguyenptk@gmail.com> --------- Signed-off-by: nguyenptk <nguyenptk@gmail.com> Signed-off-by: Nguyên (Harry) <nguyenptk@gmail.com> (cherry picked from commit 35c5a12) Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix(helm): correct typo in HPA maxReplicas required message (#9032) Signed-off-by: benjaminch <benjamin.chastanier@gmail.com> (cherry picked from commit 8da6dc7) Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix: allow IANA cipher names (#9073) allow IANA cipher names Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> (cherry picked from commit ea41d6f) Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix(gatewayapi): prefer sectioned BackendTLSPolicy over wildcard for same target (#9068) * add passing testcase showing wildcard overriding sectioned backendTLSPolicy Signed-off-by: AlecDiraimondo <50001153+AlecDiraimondo@users.noreply.github.com> * fix(gatewayapi): prefer sectioned BackendTLSPolicy over wildcard for same target When two BackendTLSPolicies target the same backend — one with sectionName set, one without — the wildcard wins whenever it sorts earlier, since policies are iterated in creationTimestamp order with no specificity preference. The sectioned policy is silently dropped: never selected by the translator, no status written. Make getBackendTLSPolicy prefer policies with an explicit sectionName match before falling back to wildcard matches. Matches the specificity ordering SecurityPolicy already implements. Refs #9035 Signed-off-by: AlecDiraimondo <50001153+AlecDiraimondo@users.noreply.github.com> * update release notes Signed-off-by: AlecDiraimondo <50001153+AlecDiraimondo@users.noreply.github.com> * fixes from review: dedup helper, return early if backendTarget has no section specified Signed-off-by: AlecDiraimondo <50001153+AlecDiraimondo@users.noreply.github.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com> --------- Signed-off-by: AlecDiraimondo <50001153+AlecDiraimondo@users.noreply.github.com> Signed-off-by: Alec Diraimondo <drayalec@gmail.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com> (cherry picked from commit 07ec95c) Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix: encode TLS secrets with canonical PEM formatting (#8744) * exclude non-ready https Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * prevent BoringSSL errors Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * Add trailing newline to testdata PEMs Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * add release notes Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * use shallow copy instead of DeepCopy Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * use maps.Clone for the data and split the PRs Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> --------- Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> (cherry picked from commit 560a262) Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix: MaxStreamDuration should worked for non-route cluster (#9028) * fix: MaxStreamDuration should worked on commonHttpProtocolOptions Signed-off-by: zirain <zirain2009@gmail.com> * should only worked for non-route cluster Signed-off-by: zirain <zirain2009@gmail.com> * fix Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> (cherry picked from commit 0edf51a) Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix(egctl): skip missing CRDs in `x status` bulk modes (#9099) `egctl x status all` (and `xroute`/`xpolicy`) aborted with an error when a Gateway API CRD was not installed in the cluster (e.g. TCPRoute). Missing CRDs are now skipped, and reported on stderr when `-v` is set. Explicit single-resource invocations still error loudly so users get a clear signal when a kind they asked for is unavailable. Signed-off-by: Jeremiah Snapp <jeremiahs@tomonetworks.com> (cherry picked from commit 3ab110e) Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix(gatewayapi): reject unsupported BackendRef URLRewrite path rewrites (#9131) gatewayapi: reject BackendRef URLRewrite path modifiers Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> (cherry picked from commit acaf4cd) Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix: force HTTP1 for Service/ServiceImport with websocket appProtocol (#9138) force HTTP1 for Service/ServiceImport with websocket appProtocol Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> (cherry picked from commit b1aa5d9) Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix: move validation admission policy outside of crds directory (#9024) * move validation admission policy outside of crds directory Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * fix upgrade Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * add release note Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * fix Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * update docs Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * address comment Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * address comment Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * update relese note Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * fix gen Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * use a more general name for this option Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * update docs Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * rename Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * update test Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * update release note Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * fix gen Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * rename supportingResources to safeUpgradePolicy Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * update Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: zirain <zirain2009@gmail.com> (cherry picked from commit 35ad8f2) Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix: alway include the controller namespace in the watched namespaces (#9100) * always include the controller namespace in the k8s provider Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * update docs Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> (cherry picked from commit 84be503d855e968b7b6999d476a6897e98d4e330) * address comment Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * minor changes Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * fix lint Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> (cherry picked from commit 5266322) Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * test(helm): regenerate safe-upgrade-policy-disabled golden for release/v1.8 The safe-upgrade-policy-disabled test case added in #9024 shipped a golden rendered against main's chart templates, which include features not present on release/v1.8 (automountServiceAccountToken, expanded HPA RBAC verbs, serviceaccount securityContext, ArgoCD/Flux hook comment). Regenerate the golden against the release branch templates and restore the release-pinned ratelimit image tag (ff287602). Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * regen Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * chore: bump golang to 1.26.4 (#9147) Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> --------- Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: nguyenptk <nguyenptk@gmail.com> Signed-off-by: Nguyên (Harry) <nguyenptk@gmail.com> Signed-off-by: benjaminch <benjamin.chastanier@gmail.com> Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com> Signed-off-by: AlecDiraimondo <50001153+AlecDiraimondo@users.noreply.github.com> Signed-off-by: Alec Diraimondo <drayalec@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> Signed-off-by: Jeremiah Snapp <jeremiahs@tomonetworks.com> Signed-off-by: Aditya7880900936 <adityasanskarsrivastav788@gmail.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Co-authored-by: zirain <zirain2009@gmail.com> Co-authored-by: Nguyên (Harry) <nguyenptk@gmail.com> Co-authored-by: BenjaminCh <benjamin.chastanier@gmail.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: Alec Diraimondo <drayalec@gmail.com> Co-authored-by: Karol Szwaj <karol.szwaj@gmail.com> Co-authored-by: Jeremiah Snapp <jeremiah.snapp@gmail.com> Co-authored-by: Aditya Sanskar Srivastav <161202916+Aditya7880900936@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
1 parent fdd1341 commit f4209a3

116 files changed

Lines changed: 5322 additions & 215 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎api/v1alpha1/envoygateway_helpers.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,8 +96,8 @@ func (e *EnvoyGateway) GetEnvoyGatewayAdminAddress() string {
9696
return ""
9797
}
9898

99-
// NamespaceMode returns if uses namespace mode.
100-
func (e *EnvoyGateway) NamespaceMode() bool {
99+
// WatchesNamespaces returns true when Envoy Gateway is configured to watch specific Kubernetes namespaces.
100+
func (e *EnvoyGateway) WatchesNamespaces() bool {
101101
return e.Provider != nil &&
102102
e.Provider.Kubernetes != nil &&
103103
e.Provider.Kubernetes.Watch != nil &&

‎api/v1alpha1/envoygateway_types.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -427,12 +427,16 @@ type KubernetesWatchMode struct {
427427

428428
// Namespaces holds the list of namespaces that Envoy Gateway will watch for namespaced scoped
429429
// resources such as Gateway, HTTPRoute and Service.
430+
// The namespace where Envoy Gateway runs is always included so Envoy Gateway can reconcile its
431+
// own managed infrastructure resources.
430432
// Note that Envoy Gateway will continue to reconcile relevant cluster scoped resources such as
431433
// GatewayClass that it is linked to. Precisely one of Namespaces and NamespaceSelector must be set.
432434
Namespaces []string `json:"namespaces,omitempty"`
433435

434436
// NamespaceSelector holds the label selector used to dynamically select namespaces.
435437
// Envoy Gateway will watch for namespaces matching the specified label selector.
438+
// The namespace where Envoy Gateway runs is always included so Envoy Gateway can reconcile its
439+
// own managed infrastructure resources.
436440
// Precisely one of Namespaces and NamespaceSelector must be set.
437441
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`
438442
}

‎api/v1alpha1/tls_types.go‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,39 @@ type TLSSettings struct {
4141

4242
// Ciphers specifies the set of cipher suites supported when
4343
// negotiating TLS 1.0 - 1.2. This setting has no effect for TLS 1.3.
44-
// For the list of supported ciphers, please refer to the Envoy documentation:
44+
// For Envoy TLS cipher suite configuration semantics and default cipher
45+
// lists, see the Envoy documentation:
4546
// https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#extensions-transport-sockets-tls-v3-tlsparameters
47+
// Supported cipher suite names:
48+
// - ECDHE-ECDSA-AES128-GCM-SHA256
49+
// - ECDHE-RSA-AES128-GCM-SHA256
50+
// - ECDHE-ECDSA-AES256-GCM-SHA384
51+
// - ECDHE-RSA-AES256-GCM-SHA384
52+
// - ECDHE-ECDSA-CHACHA20-POLY1305
53+
// - ECDHE-RSA-CHACHA20-POLY1305
54+
// - ECDHE-ECDSA-AES128-SHA
55+
// - ECDHE-RSA-AES128-SHA
56+
// - AES128-GCM-SHA256
57+
// - AES128-SHA
58+
// - ECDHE-ECDSA-AES256-SHA
59+
// - ECDHE-RSA-AES256-SHA
60+
// - AES256-GCM-SHA384
61+
// - AES256-SHA
62+
// Supported IANA/RFC aliases:
63+
// - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
64+
// - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
65+
// - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
66+
// - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
67+
// - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
68+
// - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
69+
// - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
70+
// - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
71+
// - TLS_RSA_WITH_AES_128_GCM_SHA256
72+
// - TLS_RSA_WITH_AES_128_CBC_SHA
73+
// - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
74+
// - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
75+
// - TLS_RSA_WITH_AES_256_GCM_SHA384
76+
// - TLS_RSA_WITH_AES_256_CBC_SHA
4677
// In non-FIPS Envoy Proxy builds the default cipher list is:
4778
// - [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
4879
// - [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backends.yaml‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -242,8 +242,39 @@ spec:
242242
description: |-
243243
Ciphers specifies the set of cipher suites supported when
244244
negotiating TLS 1.0 - 1.2. This setting has no effect for TLS 1.3.
245-
For the list of supported ciphers, please refer to the Envoy documentation:
245+
For Envoy TLS cipher suite configuration semantics and default cipher
246+
lists, see the Envoy documentation:
246247
https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#extensions-transport-sockets-tls-v3-tlsparameters
248+
Supported cipher suite names:
249+
- ECDHE-ECDSA-AES128-GCM-SHA256
250+
- ECDHE-RSA-AES128-GCM-SHA256
251+
- ECDHE-ECDSA-AES256-GCM-SHA384
252+
- ECDHE-RSA-AES256-GCM-SHA384
253+
- ECDHE-ECDSA-CHACHA20-POLY1305
254+
- ECDHE-RSA-CHACHA20-POLY1305
255+
- ECDHE-ECDSA-AES128-SHA
256+
- ECDHE-RSA-AES128-SHA
257+
- AES128-GCM-SHA256
258+
- AES128-SHA
259+
- ECDHE-ECDSA-AES256-SHA
260+
- ECDHE-RSA-AES256-SHA
261+
- AES256-GCM-SHA384
262+
- AES256-SHA
263+
Supported IANA/RFC aliases:
264+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
265+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
266+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
267+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
268+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
269+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
270+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
271+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
272+
- TLS_RSA_WITH_AES_128_GCM_SHA256
273+
- TLS_RSA_WITH_AES_128_CBC_SHA
274+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
275+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
276+
- TLS_RSA_WITH_AES_256_GCM_SHA384
277+
- TLS_RSA_WITH_AES_256_CBC_SHA
247278
In non-FIPS Envoy Proxy builds the default cipher list is:
248279
- [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
249280
- [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1353,8 +1353,39 @@ spec:
13531353
description: |-
13541354
Ciphers specifies the set of cipher suites supported when
13551355
negotiating TLS 1.0 - 1.2. This setting has no effect for TLS 1.3.
1356-
For the list of supported ciphers, please refer to the Envoy documentation:
1356+
For Envoy TLS cipher suite configuration semantics and default cipher
1357+
lists, see the Envoy documentation:
13571358
https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#extensions-transport-sockets-tls-v3-tlsparameters
1359+
Supported cipher suite names:
1360+
- ECDHE-ECDSA-AES128-GCM-SHA256
1361+
- ECDHE-RSA-AES128-GCM-SHA256
1362+
- ECDHE-ECDSA-AES256-GCM-SHA384
1363+
- ECDHE-RSA-AES256-GCM-SHA384
1364+
- ECDHE-ECDSA-CHACHA20-POLY1305
1365+
- ECDHE-RSA-CHACHA20-POLY1305
1366+
- ECDHE-ECDSA-AES128-SHA
1367+
- ECDHE-RSA-AES128-SHA
1368+
- AES128-GCM-SHA256
1369+
- AES128-SHA
1370+
- ECDHE-ECDSA-AES256-SHA
1371+
- ECDHE-RSA-AES256-SHA
1372+
- AES256-GCM-SHA384
1373+
- AES256-SHA
1374+
Supported IANA/RFC aliases:
1375+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
1376+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
1377+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
1378+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
1379+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
1380+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
1381+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
1382+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
1383+
- TLS_RSA_WITH_AES_128_GCM_SHA256
1384+
- TLS_RSA_WITH_AES_128_CBC_SHA
1385+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
1386+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
1387+
- TLS_RSA_WITH_AES_256_GCM_SHA384
1388+
- TLS_RSA_WITH_AES_256_CBC_SHA
13581389
In non-FIPS Envoy Proxy builds the default cipher list is:
13591390
- [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
13601391
- [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,39 @@ spec:
7474
description: |-
7575
Ciphers specifies the set of cipher suites supported when
7676
negotiating TLS 1.0 - 1.2. This setting has no effect for TLS 1.3.
77-
For the list of supported ciphers, please refer to the Envoy documentation:
77+
For Envoy TLS cipher suite configuration semantics and default cipher
78+
lists, see the Envoy documentation:
7879
https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#extensions-transport-sockets-tls-v3-tlsparameters
80+
Supported cipher suite names:
81+
- ECDHE-ECDSA-AES128-GCM-SHA256
82+
- ECDHE-RSA-AES128-GCM-SHA256
83+
- ECDHE-ECDSA-AES256-GCM-SHA384
84+
- ECDHE-RSA-AES256-GCM-SHA384
85+
- ECDHE-ECDSA-CHACHA20-POLY1305
86+
- ECDHE-RSA-CHACHA20-POLY1305
87+
- ECDHE-ECDSA-AES128-SHA
88+
- ECDHE-RSA-AES128-SHA
89+
- AES128-GCM-SHA256
90+
- AES128-SHA
91+
- ECDHE-ECDSA-AES256-SHA
92+
- ECDHE-RSA-AES256-SHA
93+
- AES256-GCM-SHA384
94+
- AES256-SHA
95+
Supported IANA/RFC aliases:
96+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
97+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
98+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
99+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
100+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
101+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
102+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
103+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
104+
- TLS_RSA_WITH_AES_128_GCM_SHA256
105+
- TLS_RSA_WITH_AES_128_CBC_SHA
106+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
107+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
108+
- TLS_RSA_WITH_AES_256_GCM_SHA384
109+
- TLS_RSA_WITH_AES_256_CBC_SHA
79110
In non-FIPS Envoy Proxy builds the default cipher list is:
80111
- [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
81112
- [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]

‎charts/gateway-helm/README.md‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,11 @@ Once Helm has been set up correctly, install the chart from dockerhub:
3535
``` shell
3636
helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace
3737
```
38+
This command installs both Gateway API CRDs and Envoy Gateway CRDs. If your Kubernetes provider already manages
39+
Gateway API CRDs for the cluster, confirm that the provider-installed Gateway API version and channel are compatible
40+
with the Envoy Gateway release and the Gateway API resources you plan to use. If they are compatible, install only the
41+
Envoy Gateway CRDs separately and use `--skip-crds` when installing this chart.
42+
3843
You can find all helm chart release in [Dockerhub](https://hub.docker.com/r/envoyproxy/gateway-helm/tags)
3944

4045
### Install from Source Code
@@ -49,10 +54,26 @@ make kube-deploy TAG=latest
4954

5055
### Skip install CRDs
5156

52-
You can install the eg chart along without Gateway API CRDs and Envoy Gateway CRDs, make sure CRDs exist in Cluster first if you want to skip to install them, otherwise EG may fail to start:
57+
You can install the eg chart without Gateway API CRDs and Envoy Gateway CRDs. Make sure the CRDs exist in the cluster
58+
before installing the chart with `--skip-crds`, otherwise Envoy Gateway may fail to start.
59+
60+
If your Kubernetes provider manages compatible Gateway API CRDs, install only the Envoy Gateway CRDs from the
61+
`gateway-crds-helm` chart first:
62+
63+
``` shell
64+
helm template eg-crds oci://docker.io/envoyproxy/gateway-crds-helm --set 'crds.gatewayAPI.enabled=false' --set 'crds.envoyGateway.enabled=true' \
65+
--version v0.0.0-latest | kubectl apply --server-side -f -
66+
```
67+
68+
If the provider-managed Gateway API CRDs are not compatible, use a compatible Gateway API CRD installation method for
69+
the cluster first, then install this chart with `--skip-crds`.
70+
71+
After the required CRDs are installed, install the eg chart with `--skip-crds`. Gateway API safe upgrade policy
72+
resources (the safe-upgrades ValidatingAdmissionPolicy and binding shipped with the Gateway API bundle) are rendered
73+
from the chart templates on install by default, so disable them when these resources are managed outside this chart:
5374

5475
``` shell
55-
helm install eg --create-namespace oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --skip-crds
76+
helm install eg --create-namespace oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --skip-crds --set crds.gatewayAPI.safeUpgradePolicy.enabled=false
5677
```
5778

5879
To uninstall the chart:

‎charts/gateway-helm/charts/crds/crds/gatewayapi-crds.yaml‎

Lines changed: 0 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -21168,58 +21168,6 @@ status:
2116821168
storedVersions: null
2116921169
---
2117021170
#
21171-
# config/crd/experimental/gateway.networking.k8s.io_vap_safeupgrades.yaml
21172-
#
21173-
apiVersion: admissionregistration.k8s.io/v1
21174-
kind: ValidatingAdmissionPolicy
21175-
metadata:
21176-
annotations:
21177-
gateway.networking.k8s.io/bundle-version: v1.5.0-dev
21178-
gateway.networking.k8s.io/channel: standard
21179-
name: "safe-upgrades.gateway.networking.k8s.io"
21180-
spec:
21181-
failurePolicy: Fail
21182-
matchConstraints:
21183-
resourceRules:
21184-
- apiGroups: ["apiextensions.k8s.io"]
21185-
apiVersions: ["v1"]
21186-
operations: ["CREATE", "UPDATE"]
21187-
resources: ["*"]
21188-
validations:
21189-
- expression: "object.spec.group != 'gateway.networking.k8s.io' || oldObject == null || (
21190-
has(object.metadata.annotations) && object.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/channel') &&
21191-
object.metadata.annotations['gateway.networking.k8s.io/channel'] == 'standard' ) || (
21192-
oldObject != null && has(oldObject.metadata.annotations) && oldObject.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/channel') &&
21193-
oldObject.metadata.annotations['gateway.networking.k8s.io/channel'] == 'experimental' )"
21194-
message: "Installing experimental CRDs on top of standard channel CRDs is prohibited by default. Uninstall ValidatingAdmissionPolicy safe-upgrades.gateway.networking.k8s.io to install experimental CRDs on top of standard channel CRDs."
21195-
reason: Invalid
21196-
- expression: "object.spec.group != 'gateway.networking.k8s.io' ||
21197-
(has(object.metadata.annotations) && object.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/bundle-version') &&
21198-
!matches(object.metadata.annotations['gateway.networking.k8s.io/bundle-version'], 'v1.[0-4].\\\\d+') &&
21199-
!matches(object.metadata.annotations['gateway.networking.k8s.io/bundle-version'], 'v0'))" #TODO Kubernetes 1.37: Migrate to kubernetes semver library
21200-
message: "Installing CRDs with version before v1.5.0 is prohibited by default. Uninstall ValidatingAdmissionPolicy safe-upgrades.gateway.networking.k8s.io to install older versions."
21201-
reason: Invalid
21202-
21203-
---
21204-
21205-
apiVersion: admissionregistration.k8s.io/v1
21206-
kind: ValidatingAdmissionPolicyBinding
21207-
metadata:
21208-
annotations:
21209-
gateway.networking.k8s.io/bundle-version: v1.5.0-dev
21210-
gateway.networking.k8s.io/channel: standard
21211-
name: safe-upgrades.gateway.networking.k8s.io
21212-
spec:
21213-
policyName: safe-upgrades.gateway.networking.k8s.io
21214-
validationActions: [Deny]
21215-
matchResources:
21216-
resourceRules:
21217-
- apiGroups: ["apiextensions.k8s.io"]
21218-
apiVersions: ["v1"]
21219-
resources: ["customresourcedefinitions"]
21220-
operations: ["CREATE", "UPDATE"]
21221-
---
21222-
#
2122321171
# config/crd/experimental/gateway.networking.x-k8s.io_xbackendtrafficpolicies.yaml
2122421172
#
2122521173
apiVersion: apiextensions.k8s.io/v1

‎charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_backends.yaml‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -241,8 +241,39 @@ spec:
241241
description: |-
242242
Ciphers specifies the set of cipher suites supported when
243243
negotiating TLS 1.0 - 1.2. This setting has no effect for TLS 1.3.
244-
For the list of supported ciphers, please refer to the Envoy documentation:
244+
For Envoy TLS cipher suite configuration semantics and default cipher
245+
lists, see the Envoy documentation:
245246
https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#extensions-transport-sockets-tls-v3-tlsparameters
247+
Supported cipher suite names:
248+
- ECDHE-ECDSA-AES128-GCM-SHA256
249+
- ECDHE-RSA-AES128-GCM-SHA256
250+
- ECDHE-ECDSA-AES256-GCM-SHA384
251+
- ECDHE-RSA-AES256-GCM-SHA384
252+
- ECDHE-ECDSA-CHACHA20-POLY1305
253+
- ECDHE-RSA-CHACHA20-POLY1305
254+
- ECDHE-ECDSA-AES128-SHA
255+
- ECDHE-RSA-AES128-SHA
256+
- AES128-GCM-SHA256
257+
- AES128-SHA
258+
- ECDHE-ECDSA-AES256-SHA
259+
- ECDHE-RSA-AES256-SHA
260+
- AES256-GCM-SHA384
261+
- AES256-SHA
262+
Supported IANA/RFC aliases:
263+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
264+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
265+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
266+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
267+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
268+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
269+
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
270+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
271+
- TLS_RSA_WITH_AES_128_GCM_SHA256
272+
- TLS_RSA_WITH_AES_128_CBC_SHA
273+
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
274+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
275+
- TLS_RSA_WITH_AES_256_GCM_SHA384
276+
- TLS_RSA_WITH_AES_256_CBC_SHA
246277
In non-FIPS Envoy Proxy builds the default cipher list is:
247278
- [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
248279
- [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]

0 commit comments

Comments
 (0)