Merge remote-tracking branch 'origin/main' into rustformation-config-rework

Signed-off-by: Andy Fong <[email protected]>

Author: andy-fong

.custom-gcl.yml

@@ -0,0 +1,8 @@
+version: v2.6.1
+name: golangci-lint-custom
+destination: _output
+plugins:
+- module: github.com/kgateway-dev/kgateway/v2/hack/krtequals
+  path: ./hack/krtequals
+- module: 'sigs.k8s.io/kube-api-linter'
+  version: 'v0.0.0-20250715075424-4fab82d26a8e' # Pin to a commit while there's no tag

.github/actions/kube-agent-gateway-conformance-tests/action.yaml

@@ -45,13 +45,14 @@ runs:
         ADDITIONAL_VALUES="-f ${HELM_ADDITIONAL_VALUES}"
         echo "Using additional Helm values from: ${HELM_ADDITIONAL_VALUES}"
       fi
-      
+
       if [[ -z "${{ matrix.version }}" ]]; then
         # If matrix.version is empty, use the local chart path specified in the Makefile.
           helm upgrade -i -n kgateway-system kgateway-crds ./install/helm/kgateway-crds/ \
           --create-namespace
         helm upgrade -i -n kgateway-system kgateway ./install/helm/kgateway/ \
           --create-namespace \
+          --set controller.extraEnv.KGW_ENABLE_EXPERIMENTAL_GATEWAY_API_FEATURES="true" \
           --set image.tag=${VERSION} --set image.registry=ghcr.io/kgateway-dev \
           ${ADDITIONAL_VALUES}
       else
@@ -64,6 +65,7 @@ runs:
         helm upgrade -i -n kgateway-system kgateway oci://${{ env.IMAGE_REGISTRY }}/charts/kgateway \
           --version ${VERSION} \
           --create-namespace \
+          --set controller.extraEnv.KGW_ENABLE_EXPERIMENTAL_GATEWAY_API_FEATURES="true" \
           --set image.tag=${VERSION} \
           ${ADDITIONAL_VALUES}
       fi

.github/actions/kube-gateway-api-conformance-tests/action.yaml

@@ -45,6 +45,7 @@ runs:
           --create-namespace
         helm upgrade -i -n kgateway-system kgateway ./install/helm/kgateway/ \
           --create-namespace \
+          --set controller.extraEnv.KGW_ENABLE_EXPERIMENTAL_GATEWAY_API_FEATURES="true" \
           --set image.tag=${VERSION} --set image.registry=ghcr.io/kgateway-dev
       else
         # TODO(tim): this will require changes once the new helm chart is integrated
@@ -56,6 +57,7 @@ runs:
         helm upgrade -i -n kgateway-system kgateway oci://${{ env.IMAGE_REGISTRY }}/charts/kgateway \
           --version ${VERSION} \
           --create-namespace \
+          --set controller.extraEnv.KGW_ENABLE_EXPERIMENTAL_GATEWAY_API_FEATURES="true" \
           --set image.tag=${VERSION}
       fi
   - name: Run the kubernetes gateway API conformance tests

.github/actions/kube-inference-extension-conformance-tests/action.yaml

@@ -47,6 +47,7 @@ runs:
           --create-namespace \
           --set image.tag=${VERSION} \
           --set image.registry=ghcr.io/kgateway-dev \
+          --set controller.extraEnv.KGW_ENABLE_EXPERIMENTAL_GATEWAY_API_FEATURES="true" \
           --set inferenceExtension.enabled=true
       else
         # TODO(tim): this will require changes once the new helm chart is integrated
@@ -60,6 +61,7 @@ runs:
           --version ${VERSION} \
           --create-namespace \
           --set image.tag=${VERSION} \
+          --set controller.extraEnv.KGW_ENABLE_EXPERIMENTAL_GATEWAY_API_FEATURES="true" \
           --set inferenceExtension.enabled=true
       fi
   - name: Run the kubernetes gateway API inference extension conformance tests

.github/actions/setup-kind-cluster/action.yaml

@@ -19,6 +19,10 @@ inputs:
     required: false
     default: "" # If this is undefined the setup-kind script has its own default value
     description: The version of the gateway-api to use
+  gateway-api-channel:
+    required: false
+    default: "" # If this is undefined the setup-kind script has its own default value
+    description: The channel of the gateway-api to use
   localstack:
     required: false
     default: "false"
@@ -38,6 +42,7 @@ runs:
         CLUSTER_NODE_VERSION: ${{ inputs.kind-node-version }}
         ISTIO_VERSION: ${{ inputs.istio-version }}
         CONFORMANCE_VERSION: ${{ inputs.gateway-api-version }}
+        CONFORMANCE_CHANNEL: ${{ inputs.gateway-api-channel }}
         LOCALSTACK: ${{ inputs.localstack }}
         CONFORMANCE: true
       run: |

.github/workflows/e2e.yaml

@@ -75,7 +75,6 @@ jobs:
         - cluster-name: 'agent-gateway-cluster'
           go-test-args: '-v -timeout=25m'
           go-test-run-regex: '^TestAgentgatewayIntegration'
-          agentgateway: 'true'
         # August 29, 2025: ~3 minutes
         - cluster-name: 'api-validation'
           go-test-args: '-v -timeout=10m'

.github/workflows/lint.yaml

@@ -21,13 +21,8 @@ jobs:
       uses: actions/checkout@v4
     - name: Prep Go Runner
       uses: ./.github/actions/prep-go-runner
-    - uses: golangci/golangci-lint-action@v7
-      with:
-        version: v2.5.0
-        args: --verbose --modules-download-mode=readonly --allow-parallel-runners
-        skip-cache: true
-        skip-save-cache: true
-        only-new-issues: false
+    - name: Lint Go code
+      run: make analyze
 
   # Lint Helm charts
   helm-lint:

.github/workflows/nightly-tests.yaml

@@ -22,6 +22,10 @@ on:
         description: "Run load testing suite"
         type: boolean
         default: false
+      run-e2e-tests:
+        description: "Run e2e tests"
+        type: boolean
+        default: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
@@ -59,3 +63,50 @@ jobs:
       with:
         ref: main
     - uses: ./.github/actions/kube-gateway-api-load-tests
+
+  kgateway_e2e_tests_for_gateway_api_versions:
+    name: GwApi E2E
+    if: ${{ (github.event_name == 'workflow_dispatch' && inputs.run-e2e-tests) || github.event.schedule == '0 5 * * *' }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        gateway-api-version: [ { version: 'v1.4.0', channel: 'experimental' },
+                              { version: 'v1.4.0', channel: 'standard' },
+                              { version: 'v1.3.0', channel: 'experimental' },
+                              { version: 'v1.3.0', channel: 'standard' },
+                              { version: 'v1.2.1', channel: 'experimental' },
+                              { version: 'v1.2.1', channel: 'standard' }]
+    steps:
+    - uses: actions/checkout@v4
+    - name: Prep Go Runner
+      uses: ./.github/actions/prep-go-runner
+    - name: Dotenv Action
+      uses: falti/[email protected]
+      id: dotenv
+      with:
+        path: "./.github/workflows/.env/nightly-tests/max_versions.env"
+        log-variables: true
+    - name: Setup KinD Cluster
+      uses: ./.github/actions/setup-kind-cluster
+      with:
+        gateway-api-version: ${{ matrix.gateway-api-version.version }}
+        gateway-api-channel: ${{ matrix.gateway-api-version.channel }}
+        cluster-name: "kgw-api-e2e-${{ matrix.gateway-api-version.version }}-${{ matrix.gateway-api-version.channel }}"
+        kubectl-version: ${{ steps.dotenv.outputs.kubectl_version }}
+        istio-version: ${{ steps.dotenv.outputs.istio_version }}
+        kind-node-version: ${{ steps.dotenv.outputs.node_version }}
+    - id: run-tests
+      uses: ./.github/actions/kubernetes-e2e-tests
+      env:
+        VERSION: '1.0.0-ci1'
+        GITHUB_TOKEN: ${{ github.token }}
+        GO_TEST_RETRIES: '3' # Use a higher number of retries because there are so many tests and we don't want to rerun
+        GOTESTSUM_ARGS: '--format=standard-verbose --rerun-fails-max-failures 60' # High value for "rerun-fails-max-failures" because 3 failed tests can result in gotestsum thinking there's 40+ failures
+      with:
+        cluster-name: "kgw-api-e2e-${{ matrix.gateway-api-version.version }}-${{ matrix.gateway-api-version.channel }}"
+        test-args: '-v -timeout=120m'
+        run-regex: "^Test"
+        istio-version: ${{ steps.dotenv.outputs.istio_version }}
+        matrix-label: "nightly-kgw-api-${{ matrix.gateway-api-version.version }}-${{ matrix.gateway-api-version.channel }}"

.golangci.yaml

@@ -19,17 +19,48 @@ linters:
     - gosec
     - importas
     - ineffassign
+    - krtequals
+    - kubeapilinter
     - misspell
+    - modernize
     - nakedret
     - predeclared
     - promlinter
     - sloglint
     - spancheck
     - staticcheck
+    - unparam
     - unused
     - usestdlibvars
     - whitespace
   settings:
+    custom:
+      krtequals:
+        type: "module"
+        description: Checks Equals() implementations for KRT-style semantic equality issues
+        settings:
+          deepEqual: false
+      kubeapilinter:
+        type: module
+        description: Kube API Linter lints Kube like APIs based on API conventions and best practices
+        settings:
+          linters:
+            enable:
+            - "*"
+            disable:
+            - commentstart
+            - integers
+            - maxlength
+            - nobools
+            - nomaps
+            - optionalfields
+            - optionalorrequired
+            - ssatags
+          lintersConfig:
+            conditions:
+              isFirstField: Ignore
+              useProtobuf: Forbid
+              usePatchStrategy: Ignore
     forbidigo:
       forbid:
         - pattern: anypb.New
@@ -76,6 +107,10 @@ linters:
     misspell:
       ignore-rules:
         - kgateway
+    modernize:
+      disable:
+        # disabled because modernize gets confused with conflicting edits. we can probably rely on the kube api linter instead for this one.
+        - omitzero
     nakedret:
       # The team consensus is that naked returns hinder the readability of the code.
       # However, named return values can still be useful as documentation for certain scenarios.
@@ -124,16 +159,36 @@ linters:
       - examples$
     rules:
       # Forbid t.Cleanup only in e2e tests (exclude the rule from non-e2e paths)
-      - linters:
+      - path-except: test/e2e/
+        linters:
           - forbidigo
         text: 'require testutils.Cleanup'
-        path-except: test/e2e/
+      # Restrict krtequals analyzer to the pkg and internal directories
+      - path-except: pkg/|internal/
+        linters:
+          - krtequals
+      # Only run kubeapilinter inside the 'api/' directory. This prevents running API-specific checks
+      # on unrelated packages like controllers or tests and producing false positives.
+      - path-except: "^api/v1alpha1"
+        linters:
+          - kubeapilinter
 issues:
   max-same-issues: 0
   uniq-by-line: true
 formatters:
   enable:
-    - goimports
+    - gofmt
+    - gci
+  settings:
+    gci:
+      sections:
+      - standard
+      - default
+      - prefix(github.com/kgateway-dev)
+      - blank
+      - dot
+      - localmodule
+      custom-order: true
   exclusions:
     generated: lax
     paths: