vmware · avijenkins · Dec 19, 2025 · Dec 24, 2025
diff --git a/ako-crd-operator/api/v1alpha1/applicationprofile_types.go b/ako-crd-operator/api/v1alpha1/applicationprofile_types.go
@@ -73,7 +73,7 @@ type TrueClientIPConfig struct {
 	Direction TrueClientIPIndexDirection `json:"direction,omitempty"`
 }
 
-// +kubebuilder:validation:XValidation:rule="!has(self.true_client_ip) || self.use_true_client_ip",message="true_client_ip can only be configured if use_true_client_ip is true"
+// +kubebuilder:validation:XValidation:rule="!(has(self.true_client_ip) && (size(self.true_client_ip.headers) > 0 || self.true_client_ip.index_in_header > 0 || has(self.true_client_ip.direction))) || self.use_true_client_ip",message="true_client_ip can only be configured if use_true_client_ip is true"
 // +kubebuilder:validation:XValidation:rule="self.xff_enabled || (!has(self.xff_alternate_name) && !has(self.xff_update))",message="xff_alternate_name and xff_update can only be configured if xff_enabled is true"
 // +kubebuilder:validation:XValidation:rule="!(has(self.xff_update) && self.xff_update == 'APPEND_TO_THE_XFF_HEADER' && has(self.xff_alternate_name))",message="if xff_update is APPEND_TO_THE_XFF_HEADER, xff_alternate_name must be an empty string."
 type HTTPApplicationProfile struct {

diff --git a/ako-crd-operator/config/crd/bases/ako.vmware.com_applicationprofiles.yaml b/ako-crd-operator/config/crd/bases/ako.vmware.com_applicationprofiles.yaml
@@ -188,7 +188,9 @@ spec:
                 x-kubernetes-validations:
                 - message: true_client_ip can only be configured if use_true_client_ip
                     is true
-                  rule: '!has(self.true_client_ip) || self.use_true_client_ip'
+                  rule: '!(has(self.true_client_ip) && (size(self.true_client_ip.headers)
+                    > 0 || self.true_client_ip.index_in_header > 0 || has(self.true_client_ip.direction)))
+                    || self.use_true_client_ip'
                 - message: xff_alternate_name and xff_update can only be configured
                     if xff_enabled is true
                   rule: self.xff_enabled || (!has(self.xff_alternate_name) && !has(self.xff_update))

diff --git a/ako-crd-operator/config/rbac/role.yaml b/ako-crd-operator/config/rbac/role.yaml
@@ -7,20 +7,19 @@ rules:
 - apiGroups:
   - ""
   resources:
-  - configmaps
+  - events
+  verbs:
+  - create
+  - patch
+- apiGroups:
+  - ""
+  resources:
   - namespaces
   - secrets
   verbs:
   - get
   - list
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - events
-  verbs:
-  - create
-  - patch
 - apiGroups:
   - ako.vmware.com
   resources:
@@ -58,3 +57,18 @@ rules:
   - get
   - patch
   - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: manager-role
+  namespace: avi-system
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
diff --git a/ako-crd-operator/config/rbac/role_binding.yaml b/ako-crd-operator/config/rbac/role_binding.yaml
@@ -13,3 +13,20 @@ subjects:
 - kind: ServiceAccount
   name: controller-manager
   namespace: system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: ako-crd-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: manager-rolebinding
+  namespace: avi-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: manager-role
+subjects:
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system
diff --git a/ako-crd-operator/go.mod b/ako-crd-operator/go.mod
@@ -1,6 +1,6 @@
 module github.com/vmware/load-balancer-and-ingress-services-for-kubernetes/ako-crd-operator
 
-go 1.24.6
+go 1.24.11
 
 godebug default=go1.23
 
@@ -11,7 +11,7 @@ require (
 	github.com/onsi/ginkgo/v2 v2.23.3
 	github.com/onsi/gomega v1.37.0
 	github.com/stretchr/testify v1.10.0
-	github.com/vmware/alb-sdk v0.0.0-20250407104238-8f88209a8f1a
+	github.com/vmware/alb-sdk v0.0.0-20251031103126-465797fb76a0
 	github.com/vmware/load-balancer-and-ingress-services-for-kubernetes v0.1.0
 	k8s.io/api v0.33.1
 	k8s.io/apimachinery v0.33.1

diff --git a/ako-crd-operator/go.sum b/ako-crd-operator/go.sum
@@ -447,8 +447,8 @@ github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijb
 github.com/vektah/gqlparser v1.1.2/go.mod h1:1ycwN7Ij5njmMkPPAOaRFY4rET2Enx7IkVv3vaXspKw=
 github.com/vmware-tanzu/service-apis v0.0.0-20200901171416-461d35e58618 h1:ZLkxMxSr/YrYENjUJ8g6uB4rUQpZKBR3Olqf2DvuMFk=
 github.com/vmware-tanzu/service-apis v0.0.0-20200901171416-461d35e58618/go.mod h1:afqpDk9He9v+/qWix0RRotm3RNyni4Lmc1y9geDCPuo=
-github.com/vmware/alb-sdk v0.0.0-20250407104238-8f88209a8f1a h1:LwflvQ8MSQ5X1Zh8sD5NF8XE1OU7xjr00USw+GQjykk=
-github.com/vmware/alb-sdk v0.0.0-20250407104238-8f88209a8f1a/go.mod h1:fuRb4saDY/xy/UMeMvyKYmcplNknEL9ysaqYSw7reNE=
+github.com/vmware/alb-sdk v0.0.0-20251031103126-465797fb76a0 h1:Ooc6UVcgHnHeOX4F1pvy5tZg+N5d7KEJT75NWlHHbbk=
+github.com/vmware/alb-sdk v0.0.0-20251031103126-465797fb76a0/go.mod h1:fuRb4saDY/xy/UMeMvyKYmcplNknEL9ysaqYSw7reNE=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xiang90/probing v0.0.0-20160813154853-07dd2e8dfe18/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=

diff --git a/...perator/helm/ako-crd-operator/chart/templates/crd/ako.vmware.com_applicationprofiles.yaml b/...perator/helm/ako-crd-operator/chart/templates/crd/ako.vmware.com_applicationprofiles.yaml
@@ -188,7 +188,9 @@ spec:
                 x-kubernetes-validations:
                 - message: true_client_ip can only be configured if use_true_client_ip
                     is true
-                  rule: '!has(self.true_client_ip) || self.use_true_client_ip'
+                  rule: '!(has(self.true_client_ip) && (size(self.true_client_ip.headers)
+                    > 0 || self.true_client_ip.index_in_header > 0 || has(self.true_client_ip.direction)))
+                    || self.use_true_client_ip'
                 - message: xff_alternate_name and xff_update can only be configured
                     if xff_enabled is true
                   rule: self.xff_enabled || (!has(self.xff_alternate_name) && !has(self.xff_update))

diff --git a/ako-crd-operator/internal/controller/secret_controller.go b/ako-crd-operator/internal/controller/secret_controller.go
@@ -150,7 +150,7 @@ func (r *SecretReconciler) GetRegisteredReconcilers() []string {
 }
 
 // +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
-// +kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch
+// +kubebuilder:rbac:groups="",resources=configmaps,verbs=get;list;watch,namespace=avi-system
 // +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
 
 // Reconcile handles secret update events

diff --git a/ako-crd-operator/vendor/github.com/json-iterator/go/Gopkg.lock b/ako-crd-operator/vendor/github.com/json-iterator/go/Gopkg.lock
diff --git a/ako-crd-operator/vendor/github.com/modern-go/reflect2/Gopkg.lock b/ako-crd-operator/vendor/github.com/modern-go/reflect2/Gopkg.lock
diff --git a/ako-crd-operator/vendor/github.com/vmware/alb-sdk/go/session/avisession.go b/ako-crd-operator/vendor/github.com/vmware/alb-sdk/go/session/avisession.go
diff --git a/...hub.com/vmware/load-balancer-and-ingress-services-for-kubernetes/internal/lib/avi_rbac.go b/...hub.com/vmware/load-balancer-and-ingress-services-for-kubernetes/internal/lib/avi_rbac.go
diff --git a/...m/vmware/load-balancer-and-ingress-services-for-kubernetes/internal/lib/dynamic_client.go b/...m/vmware/load-balancer-and-ingress-services-for-kubernetes/internal/lib/dynamic_client.go
diff --git a/...r/github.com/vmware/load-balancer-and-ingress-services-for-kubernetes/internal/lib/lib.go b/...r/github.com/vmware/load-balancer-and-ingress-services-for-kubernetes/internal/lib/lib.go
diff --git a/...com/vmware/load-balancer-and-ingress-services-for-kubernetes/internal/objects/crdrules.go b/...com/vmware/load-balancer-and-ingress-services-for-kubernetes/internal/objects/crdrules.go