Merge branch 'main' into fix/register-go-test-coverage-tool

Author: Valyrian-Code

.github/actions/kubernetes-e2e-tests/action.yaml

@@ -24,6 +24,10 @@ inputs:
   matrix-label:
     required: true
     description: The version of the matrix being used - used to name artifacts to prevent filename collisions
+  envtest-k8s-version:
+    required: false
+    default: '1.33'
+    description: Kubernetes minor version for envtest API-server assets
 
 runs:
   using: "composite"
@@ -37,6 +41,7 @@ runs:
         TEST_PKG: ./test/e2e/tests
         # Doesn't really matter, but using the same as `go build` means we can re-use the same Go cache.
         CGO_ENABLED: 0
+        ENVTEST_K8S_VERSION: ${{ inputs.envtest-k8s-version }}
       shell: bash
       run: make e2e-test
     - name: Archive bug report directory on failure

.github/workflows/.env/nightly-tests/max_versions.env

@@ -3,3 +3,4 @@ kubectl_version='v1.36.1'
 kind_version='v0.32.0'
 istio_version='1.30.1'
 cluster_type='kind'
+envtest_k8s_version='1.36'

.github/workflows/.env/nightly-tests/min_versions.env

@@ -3,3 +3,4 @@ kubectl_version='v1.32.5'
 kind_version='v0.29.0'
 istio_version='1.23.6'
 cluster_type='kind'
+envtest_k8s_version='1.32'

.github/workflows/nightly-tests.yaml

@@ -269,3 +269,4 @@ jobs:
           run-regex: ${{ matrix.controllers.regex }}
           istio-version: ${{ steps.dotenv.outputs.istio_version }}
           matrix-label: "nightly-kgw-api-${{ matrix.env-versions.label }}-${{ matrix.gateway-api-version.version }}-${{ matrix.gateway-api-version.channel }}"
+          envtest-k8s-version: ${{ steps.dotenv.outputs.envtest_k8s_version }}

.github/workflows/release.yaml

@@ -44,6 +44,7 @@ jobs:
     runs-on: ubuntu-22.04
     outputs:
       version: ${{ steps.set_vars.outputs.version }}
+      floating_version: ${{ steps.set_vars.outputs.floating_version }}
       goreleaser_args: ${{ steps.set_vars.outputs.goreleaser_args }}
       needs_release: ${{ steps.set_vars.outputs.needs_release }}
       previous_tag: ${{ steps.set_vars.outputs.previous_tag }}
@@ -56,7 +57,8 @@ jobs:
         shell: bash
         run: |
           set -x
-          GIT_SHA=$(git rev-parse --short HEAD)
+          GIT_SHA=$(git rev-parse --short=12 HEAD)
+          FLOATING_VERSION=""
 
           find_previous_release_notes_tag() {
             local version="$1"
@@ -108,7 +110,10 @@ jobs:
             NEEDS_RELEASE=true
             GORELEASER_ARGS="--clean --skip=validate --release-notes _output/RELEASE_NOTES.md"
           elif [[ $GITHUB_REF == refs/heads/main ]]; then
-            VERSION="$(make --no-print-directory print-ROLLING_MAIN_VERSION)"
+            # Per-sha version gives parallel main runs non-colliding image tags;
+            # the floating tag is promoted separately, only by the run that is still HEAD.
+            FLOATING_VERSION="$(make --no-print-directory print-ROLLING_MAIN_VERSION)"
+            VERSION="${FLOATING_VERSION}-${GIT_SHA}"
             NEEDS_RELEASE=false
             GORELEASER_ARGS="--clean --skip=validate"
           elif [[ $GITHUB_REF == refs/pull/* ]]; then
@@ -125,6 +130,7 @@ jobs:
           # Group redirects to satisfy shellcheck SC2129
           {
             echo "version=${VERSION}"
+            echo "floating_version=${FLOATING_VERSION}"
             echo "previous_tag=${PREVIOUS_TAG:-}"
             echo "needs_release=${NEEDS_RELEASE}"
             echo "goreleaser_args=${GORELEASER_ARGS}"
@@ -141,6 +147,20 @@ jobs:
         if: ${{ github.event_name != 'pull_request' }}
         run: echo "${{ secrets.GITHUB_TOKEN }}" | go tool helm registry login ${{ env.IMAGE_REGISTRY }} -u ${{ github.repository_owner }} --password-stdin
 
+      # docker login + buildx are only needed to promote the floating image tags below
+      # (`docker buildx imagetools create`); gate them on the same condition as that step.
+      - name: Log into ${{ env.IMAGE_REGISTRY }}
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.setup.outputs.floating_version != '' }}
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          registry: ${{ env.IMAGE_REGISTRY }}
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup Buildx
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.setup.outputs.floating_version != '' }}
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+
       - name: Package kgateway charts
         run: make package-kgateway-charts
         env:
@@ -153,6 +173,40 @@ jobs:
           VERSION: ${{ needs.setup.outputs.version }}
           IMAGE_REGISTRY: ${{ env.IMAGE_REGISTRY }}
 
+      # Promote the floating chart and image tags together, gated on a single origin/main
+      # HEAD check, so the two artifact tags can never diverge. Doing this in one step (rather
+      # than promoting images in the goreleaser job and charts here) avoids a race where
+      # origin/main advances between the two jobs and leaves the floating chart tag behind the
+      # floating image tag. This job needs [setup, goreleaser], so both the per-sha charts
+      # (pushed above) and the per-sha images (from goreleaser) already exist by now.
+      - name: Promote floating chart and image tags if this commit is still main HEAD
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.setup.outputs.floating_version != '' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          git fetch origin main --depth=1
+          HEAD_SHA=$(git rev-parse origin/main)
+          if [ "${HEAD_SHA}" != "${GITHUB_SHA}" ]; then
+            echo "origin/main (${HEAD_SHA}) has moved past this commit (${GITHUB_SHA}); skipping floating tag promotion"
+            exit 0
+          fi
+          make release-charts VERSION="${FLOAT}"
+          for image in kgateway sds envoy-wrapper; do
+            docker buildx imagetools create \
+              -t "${REG}/${image}:${FLOAT}" \
+              "${REG}/${image}:${VERSION}"
+            for arch in amd64 arm64; do
+              docker buildx imagetools create \
+                -t "${REG}/${image}:${FLOAT}-${arch}" \
+                "${REG}/${image}:${VERSION}-${arch}"
+            done
+          done
+        env:
+          REG: ${{ env.IMAGE_REGISTRY }}
+          IMAGE_REGISTRY: ${{ env.IMAGE_REGISTRY }}
+          VERSION: ${{ needs.setup.outputs.version }}
+          FLOAT: ${{ needs.setup.outputs.floating_version }}
+
   release-notes:
     name: Generate release notes
     needs: setup

.golangci.yaml

@@ -13,6 +13,7 @@ linters:
   enable:
     - bodyclose
     - copyloopvar
+    - depguard
     - forbidigo
     - ginkgolinter
     - gomodguard
@@ -63,6 +64,14 @@ linters:
               isFirstField: Ignore
               useProtobuf: Forbid
               usePatchStrategy: Ignore
+    depguard:
+      rules:
+        default:
+          files:
+            - "$all"
+          deny:
+            - pkg: "sort"
+              desc: "Should be replaced with slices package"
     forbidigo:
       forbid:
         - pattern: anypb.New

Makefile

@@ -482,7 +482,9 @@ golden-translator-%:
 
 # Gateway API v1.6 experimental CRDs (xbackends) use the CEL format library,
 # which requires a kube-apiserver newer than 1.31.
-ENVTEST_K8S_VERSION = 1.33
+# Defaults to a version compatible with the Gateway API experimental CRDs. CI
+# matrix lanes may override this to match their Kubernetes version.
+ENVTEST_K8S_VERSION ?= 1.33
 ENVTEST ?= go -C tools tool setup-envtest
 
 .PHONY: envtest-path

api/annotations/gateway.go

@@ -32,6 +32,11 @@ const (
 	// Use in the TLS options field of a TLS listener.
 	EcdhCurves gwv1.AnnotationKey = "kgateway.dev/ecdh-curves"
 
+	// SignatureAlgorithms is the annotation key used to set the supported algorithms for a TLS listener.
+	// The value is a comma separated list of algorithms, e.g "ecdsa_secp256r1_sha256,rsa_pss_rsae_sha256".
+	// Use in the TLS options field of a TLS listener.
+	SignatureAlgorithms gwv1.AnnotationKey = "kgateway.dev/signature-algorithms"
+
 	// MinTLSVersion is the annotation key used to set the minimum TLS version for a TLS listener.
 	// The value is a string representing the version, e.g "1.2".
 	// Use in the TLS options field of a TLS listener.

api/settings/settings.go

@@ -323,6 +323,8 @@ type Settings struct {
 	// to every Envoy route. This metadata includes the Kubernetes source object (kind, group,
 	// name, namespace, rule) for each route, which can be useful for debugging and observability.
 	// Disabled by default.
+	//
+	// Note: This feature is experimental and subject to breaking changes in future releases.
 	EnableRouteSourceMetadata bool `split_words:"true" default:"false"`
 
 	// GatewayClassParametersRefs configures the GatewayParameters references to set on the default GatewayClasses.

api/v1alpha1/kgateway/backend_config_policy_types.go

@@ -398,6 +398,9 @@ type TLSParameters struct {
 
 	// +optional
 	EcdhCurves []string `json:"ecdhCurves,omitempty"`
+
+	// +optional
+	SignatureAlgorithms []string `json:"signatureAlgorithms,omitempty"`
 }
 
 // +kubebuilder:validation:XValidation:rule="has(self.tlsCertificate) || has(self.tlsKey) || has(self.rootCA)",message="At least one of tlsCertificate, tlsKey, or rootCA must be set in TLSFiles"
@@ -464,6 +467,8 @@ type LoadBalancer struct {
 	// When enabled, traffic is preferentially routed to endpoints in the same
 	// availability zone as the Envoy proxy.
 	// This is mutually exclusive with localityType.
+	//
+	// Note: This feature is experimental and subject to breaking changes in future releases.
 	// +optional
 	ZoneAware *ZoneAwareLoadBalancer `json:"zoneAware,omitempty"`
 
@@ -585,6 +590,8 @@ const (
 // ZoneAwareLoadBalancer configures zone-aware routing behavior.
 // Currently, preferLocal must be specified.
 //
+// Note: This struct is part of an experimental API and subject to breaking changes in future releases.
+//
 // +kubebuilder:validation:AtLeastOneOf=preferLocal
 type ZoneAwareLoadBalancer struct {
 	// PreferLocal enables Envoy's zone-aware routing which prefers sending traffic
@@ -599,6 +606,8 @@ type ZoneAwareLoadBalancer struct {
 // ZoneAwarePreferLocal configures Envoy's native zone-aware routing.
 // Envoy will prefer sending traffic to endpoints in the same zone as the proxy,
 // while still maintaining rough request balance across all upstream hosts.
+//
+// Note: This struct is part of an experimental API and subject to breaking changes in future releases.
 type ZoneAwarePreferLocal struct {
 	// Force enables Envoy forced zone-local routing. Envoy routes to same-zone
 	// endpoints while the local endpoint threshold is met. If there are not enough
@@ -627,6 +636,8 @@ type ZoneAwarePreferLocal struct {
 }
 
 // ZoneAwareForce configures Envoy forceLocalZone behavior.
+//
+// Note: This struct is part of an experimental API and subject to breaking changes in future releases.
 type ZoneAwareForce struct {
 	// MinEndpointsInZoneThreshold is the minimum number of endpoints that must
 	// exist in the local zone for forced zone-local routing to be active.