DO NOT MERGE: initial v1.4.0 feedback #4042

shaneutt · 2025-08-28T12:16:50Z

This is a PR to gather some early initial feedback on the upcoming changes for #3756. It should not be merged.

…s#3729) * add mesh confomance tests structure and first test * move mesh tests to mesh folder

kubernetes-sigs#3777) * add redirect-port and redirect scheme mesh tests * mesh tests for path host and status redirect

Signed-off-by: Norwin Schnyder <norwin.schnyder+github@gmail.com>

* Add conformance report for Contour 1.31.0 Supports gateway API 1.2.1 Signed-off-by: Sunjay Bhatia <sunjay.bhatia@broadcom.com> * update implementations.md Signed-off-by: Sunjay Bhatia <sunjay.bhatia@broadcom.com> --------- Signed-off-by: Sunjay Bhatia <sunjay.bhatia@broadcom.com>

…3781) * add csm mesh to implementations.md * fix * fix1 * Update implementations.md Co-authored-by: Rob Scott <rob.scott87@gmail.com> --------- Co-authored-by: Rob Scott <rob.scott87@gmail.com>

…igs#3564) Add feature name processing to remove redundant prefixes and improve readability in conformance comparison tables. Changes include: - Remove "HTTPRoute" and "Gateway" prefixes from feature names - Split camelCase words into space-separated words - Add process_feature_name() function for consistent text processing - Update generate_profiles_report() to use processed feature names This makes the conformance reports easier to read

Signed-off-by: bitliu <bitliu@tencent.com>

The report is generated by Cilium GHA CI https://github.com/cilium/cilium/actions/runs/15111523465 Signed-off-by: Tam Mach <sayboras@yahoo.com>

…igs#3809) * conformance: Add Airlock Microgateway report for v1.3.0 Signed-off-by: Norwin Schnyder <norwin.schnyder+github@gmail.com> * add trailing new lines Signed-off-by: Norwin Schnyder <norwin.schnyder+github@gmail.com> --------- Signed-off-by: Norwin Schnyder <norwin.schnyder+github@gmail.com>

…#3811) Signed-off-by: Norwin Schnyder <norwin.schnyder+github@gmail.com>

* conformance: add Hook in ConformanceTestSuite * update comment Signed-off-by: zirain <zirain2009@gmail.com> * add Hook in ConformanceOptions Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com>

) This PR removes the Dependabot configuration for the `github-actions` package ecosystem since Github Actions are not used in this repository. There is no PR ever created with a `dependencies` tag which is not for `go`, `docker`, or `python`.

…bernetes-sigs#3775)

* add mesh conformance for request header modifier * address feedback

* docs: Add v1.3 conformance report table Signed-off-by: Norwin Schnyder <norwin.schnyder+github@gmail.com> * Automatically update conformance table files Signed-off-by: Norwin Schnyder <norwin.schnyder+github@gmail.com> --------- Signed-off-by: Norwin Schnyder <norwin.schnyder+github@gmail.com>

Signed-off-by: Shane Utt <shaneutt@linux.com>

…-sigs#3827) * add httproute weights mesh conformance tests * gofmt

…#2712) * draft dns configuration for gateway API GEP-2627 minor tweaks Update geps/gep-2627/index.md Co-authored-by: Candace Holman <candita@users.noreply.github.com> Update geps/gep-2627/index.md Co-authored-by: Candace Holman <candita@users.noreply.github.com> Update geps/gep-2627/index.md Co-authored-by: Candace Holman <candita@users.noreply.github.com> * changes post review * rewording * Update geps/gep-2627/index.md Co-authored-by: Nick Young <inocuo@gmail.com> * Update geps/gep-2627/index.md Co-authored-by: Nick Young <inocuo@gmail.com> * Update geps/gep-2627/index.md Co-authored-by: Nick Young <inocuo@gmail.com> * Update geps/gep-2627/index.md Co-authored-by: Nick Young <inocuo@gmail.com> * Update geps/gep-2627/index.md Co-authored-by: Shane Utt <shane@shaneutt.com> * Update geps/gep-2627/index.md Co-authored-by: Shane Utt <shane@shaneutt.com> * Update geps/gep-2627/index.md Co-authored-by: Shane Utt <shane@shaneutt.com> * Update geps/gep-2627/index.md Co-authored-by: Shane Utt <shane@shaneutt.com> * Update geps/gep-2627/index.md Co-authored-by: Shane Utt <shane@shaneutt.com> * Update geps/gep-2627/index.md Co-authored-by: Shane Utt <shane@shaneutt.com> * Update geps/gep-2627/index.md Co-authored-by: Shane Utt <shane@shaneutt.com> * Update geps/gep-2627/index.md Co-authored-by: Shane Utt <shane@shaneutt.com> * minor tweaks to the text and link to kuadrant as an example of a DNSPolicy type API * fix new line * move kuadrant to a reference --------- Co-authored-by: Candace Holman <candita@users.noreply.github.com> Co-authored-by: Nick Young <inocuo@gmail.com> Co-authored-by: Shane Utt <shane@shaneutt.com>

Signed-off-by: Keith Mattix II <keithmattix@microsoft.com>

* Kubevernor conformance report * Adding Kubvernor section to implementations section

Adding conformance report for the v2.0 NGINX Gateway Fabric release. Now supporting Gateway API v1.3.

* Update naming * fix failures

k8s-ci-robot · 2025-08-28T12:16:52Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

k8s-ci-robot · 2025-08-28T12:16:53Z

Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2025-08-28T12:16:55Z

Keywords which can automatically close issues and at(@) or hashtag(#) mentions are not allowed in commit messages.

The list of commits with invalid commit messages:

270d637 build(deps): bump google.golang.org/grpc from 1.71.1 to 1.73.0 (build(deps): bump google.golang.org/grpc from 1.71.1 to 1.73.0 #3842)
b58707c build(deps): bump the k8s-io group with 6 updates (build(deps): bump the k8s-io group with 6 updates #3819)
9f27e4b build(deps): bump golang.org/x/sync from 0.13.0 to 0.15.0 (build(deps): bump golang.org/x/sync from 0.13.0 to 0.15.0 #3889)
4dcfc56 build(deps): bump github.com/miekg/dns from 1.1.65 to 1.1.66 (build(deps): bump github.com/miekg/dns from 1.1.65 to 1.1.66 #3790)
33e9aa9 build(deps): bump sigs.k8s.io/controller-tools from 0.17.3 to 0.18.0 (build(deps): bump sigs.k8s.io/controller-tools from 0.17.3 to 0.18.0 #3791)
3c2c3d9 build(deps): bump mkdocs-material in /hack/mkdocs/image (build(deps): bump mkdocs-material from 9.6.11 to 9.6.14 in /hack/mkdocs/image #3797)
6745685 build(deps): bump tornado from 6.4.2 to 6.5.1 in /hack/mkdocs/image (build(deps): bump tornado from 6.4.2 to 6.5.1 in /hack/mkdocs/image #3815)
3987a08 build(deps): bump pymdown-extensions in /hack/mkdocs/image (build(deps): bump pymdown-extensions from 10.14.3 to 10.16 in /hack/mkdocs/image #3878)
e6eff87 build(deps): bump pygments from 2.19.1 to 2.19.2 in /hack/mkdocs/image (build(deps): bump pygments from 2.19.1 to 2.19.2 in /hack/mkdocs/image #3879)
1b2b35f build(deps): bump golang.org/x/net from 0.39.0 to 0.41.0 (build(deps): bump golang.org/x/net from 0.39.0 to 0.41.0 #3843)
a241e4a build(deps): bump sigs.k8s.io/controller-runtime from 0.20.4 to 0.21.0 (build(deps): bump sigs.k8s.io/controller-runtime from 0.20.4 to 0.21.0 #3858)
b7ebf2a build(deps): bump golang.org/x/sync from 0.15.0 to 0.16.0 (build(deps): bump golang.org/x/sync from 0.15.0 to 0.16.0 #3915)
58fc576 build(deps): bump sigs.k8s.io/yaml from 1.4.0 to 1.5.0 (build(deps): bump sigs.k8s.io/yaml from 1.4.0 to 1.5.0 #3904)
f005226 build(deps): bump the k8s-io group with 5 updates (build(deps): bump the k8s-io group with 5 updates #3931)
d3b3a08 build(deps): bump google.golang.org/grpc from 1.73.0 to 1.74.2 (build(deps): bump google.golang.org/grpc from 1.73.0 to 1.74.2 #3957)
08b0c9b build(deps): bump mkdocs-material in /hack/mkdocs/image (build(deps): bump mkdocs-material from 9.6.15 to 9.6.16 in /hack/mkdocs/image #3959)
db957ba build(deps): bump github.com/elastic/crd-ref-docs from 0.1.0 to 0.2.0 (build(deps): bump github.com/elastic/crd-ref-docs from 0.1.0 to 0.2.0 #3958)
5ecdaac build(deps): bump github.com/miekg/dns from 1.1.66 to 1.1.68 (build(deps): bump github.com/miekg/dns from 1.1.66 to 1.1.68 #3973)
8af898c build(deps): bump pymdown-extensions in /hack/mkdocs/image (build(deps): bump pymdown-extensions from 10.16 to 10.16.1 in /hack/mkdocs/image #3974)
07f7675 build(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.7 (build(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.7 #3980)
5244a39 build(deps): bump tornado from 6.5.1 to 6.5.2 in /hack/mkdocs/image (build(deps): bump tornado from 6.5.1 to 6.5.2 in /hack/mkdocs/image #3982)
02e4952 build(deps): bump golang.org/x/net from 0.41.0 to 0.43.0 (build(deps): bump golang.org/x/net from 0.41.0 to 0.43.0 #3981)
a516fa4 build(deps): bump the k8s-io group with 5 updates (build(deps): bump the k8s-io group with 5 updates #4002)
ef4c5b0 build(deps): bump google.golang.org/grpc from 1.74.2 to 1.75.0 (build(deps): bump google.golang.org/grpc from 1.74.2 to 1.75.0 #4019)
a82c06b build(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0 (build(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0 #4020)
a108a10 build(deps): bump mkdocs-material in /hack/mkdocs/image (build(deps): bump mkdocs-material from 9.6.16 to 9.6.18 in /hack/mkdocs/image #4022)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

k8s-ci-robot · 2025-08-28T12:16:59Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: shaneutt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [shaneutt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

aojea · 2025-08-29T10:26:44Z

apis/v1/gateway_types.go

+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:Maximum=65535
+	// <gateway:experimental>
+	Port PortNumber `json:"port"`


we had this questions in the review of GIE, right now everything is HTTP1 and HTTP2 that are TCP , but eventually we'll get to http3 that is UDP :/ and this will require to discriminate by port ... and then the key need to be Port+proto ... just commenting

Handling HTTP3 correctly will require a lot of changes , I guess we should add this to the pile. Thanks!

aojea · 2025-08-29T10:29:14Z

apis/v1/gateway_types.go

+// FrontendTLSConfig specifies frontend tls configuration for gateway.
+type FrontendTLSConfig struct {
+	// Default specifies the default client certificate validation configuration
+	// for all Listeners handling HTTPS traffic, unless a per-port configuration


just for my understanding, this field is required, so the unless a per-port configuration means if a Port configuration exists it overrides the default, but is not that this is a kind of oneOf API, you always need to define a default?

cc @kl52752

Good question, I don't think we defined what happens if you don't set a default and do set a per-port config. We either need to say you can't do that, or define what happens when you do.

@aojea yes :)
After all review rounds we agreeded that per port override rules might be confusing. Therefore, a default option is required and will apply to all Listeners with HTTPS protocol. If someone needs to divers frontend TLS config then it can be overridden for a specific port if needed.

aojea · 2025-08-29T10:35:27Z

apis/v1/gateway_types.go

 	//
 	// References to a resource in a different namespace are invalid UNLESS there
 	// is a ReferenceGrant in the target namespace that allows the certificate
 	// to be attached. If a ReferenceGrant does not allow this reference, the
 	// "ResolvedRefs" condition MUST be set to False for this listener with the
 	// "RefNotPermitted" reason.
 	//
+	// +required
+	// +listType=atomic


TIL default is atomic kubernetes/kubernetes#121759 , I'm educating myself here, is that right @thockin ?

Yep - kube-api-linter is requiring us to specify in all cases, even though this is the default. It's easy to forget to set this and accidentally end up with atomic, so I think this is a net positive.

yeah, explicit > implicit :)

aojea · 2025-08-29T10:44:42Z

apis/v1/gateway_types.go

+	//   if relevant.)
+	//
+	// </gateway:util:excludeFromCRD>
+	//
 	// +listType=map
 	// +listMapKey=type
 	// +kubebuilder:validation:MaxItems=8


question, I see in some places you require one item

gateway-api/apis/v1/shared_types.go

Lines 510 to 515 in 8ec8a83

// +listType=map

// +listMapKey=type

// +kubebuilder:validation:MinItems=1

// +kubebuilder:validation:MaxItems=8

// +required

Conditions []metav1.Condition `json:"conditions,omitempty"`

is this allowed to have empty or you always want to have at least 1?

// +kubebuilder:validation:MinItems=1

aojea · 2025-08-29T10:58:59Z

apis/v1/httproute_types.go

+	// If this list is empty, then the following headers must be sent:
+	//
+	// - `Authorization`
+	// - `Location`
+	// - `Proxy-Authenticate`
+	// - `Set-Cookie`
+	// - `WWW-Authenticate`
+	//
+	// If the list has entries, only those entries must be sent.


why not default the list to these if empty?

This brings up, to me, an ambiguity in the spec.

If the list is empty, does the proxy need to send exactly these 5 headers and nothing else? Or at least these 5, and the rest is implementation specific?

If the former, how can I say "send all headers", which is (IIUC) the most common usage with grpc?

If the latter, why not just default to all headers?

cc @htuch @youngnick

I based this on the protos at https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto#envoy-v3-api-msg-extensions-filters-http-ext-authz-v3-extauthz, but on rereading, them, I've made a mistake.

The gRPC header config should be as @howardjohn says - if unspecified or empty, then all headers should be sent. Those five headers are relevant for the HTTP external servers, not the gRPC one.

I'll make a PR to fix this.

Hmm, actually, looking back, @kflynn asked for this list to be included (in #3884 (comment)), so I think that he should have the chance to respond here.

Looking back over my comments and rereading, I'm pretty sure that I was unclear in my original comment. It's critical that HTTP not send all headers, ever. For gRPC, the implementations I know of just send all the headers because it's safe to do so.

Sorry for the confusion and thanks for doublechecking, @youngnick!

Just to fully close the loop on this and be explicit -- I agree with Flynn that HTTP=subset, gRPC=all is the correct default here.

Okay, great, I will make a PR to change this today.

Opened #4061 with changes.

LiorLieberman and others added 30 commits April 24, 2025 14:42

add mesh conformance tests structure and a first test (kubernetes-sig…

1e14dd6

…s#3729) * add mesh confomance tests structure and first test * move mesh tests to mesh folder

Fix v1.3.0 release URL in README.md (kubernetes-sigs#3782)

983ce8a

docs: Update HTTPRoute status example (kubernetes-sigs#3784)

2cb99f3

rm duplicate explanation (kubernetes-sigs#3780)

344f8de

Add mesh conformance tests for httproute path host and status redirect (

c698f24

kubernetes-sigs#3777) * add redirect-port and redirect scheme mesh tests * mesh tests for path host and status redirect

fix: remove misleading description (kubernetes-sigs#3778)

0912739

Signed-off-by: Norwin Schnyder <norwin.schnyder+github@gmail.com>

Add Google Cloud Service Mesh to implementations.md (kubernetes-sigs#…

dce6bc4

…3781) * add csm mesh to implementations.md * fix * fix1 * Update implementations.md Co-authored-by: Rob Scott <rob.scott87@gmail.com> --------- Co-authored-by: Rob Scott <rob.scott87@gmail.com>

Update RELEASE_MANAGEMENT.md

b7d2c57

Fix typo for the file name case type. (kubernetes-sigs#3807)

b9062b7

feat: add eg v1.3 gwapi conformance report (kubernetes-sigs#3795)

7bfd028

Signed-off-by: bitliu <bitliu@tencent.com>

conformance: Add Cilium report for v1.3.0 (kubernetes-sigs#3799)

5e93489

The report is generated by Cilium GHA CI https://github.com/cilium/cilium/actions/runs/15111523465 Signed-off-by: Tam Mach <sayboras@yahoo.com>

conformance: fix typo in Airlock Microgateway report (kubernetes-sigs…

fe41f50

…#3811) Signed-off-by: Norwin Schnyder <norwin.schnyder+github@gmail.com>

fix(gep-1911): remove duplicated header in table (kubernetes-sigs#3818)

f311bd7

Updating ngrok Gateway API Implementation on Implementations page (ku…

e7c711b

…bernetes-sigs#3775)

add mesh conformance for request header modifier (kubernetes-sigs#3812)

dbd2ff9

* add mesh conformance for request header modifier * address feedback

chore: remove inactive reviewers (kubernetes-sigs#3829)

cdcca5f

Signed-off-by: Shane Utt <shaneutt@linux.com>

add httproute weight based routing mesh conformance tests (kubernetes…

69a4a5f

…-sigs#3827) * add httproute weights mesh conformance tests * gofmt

same-namespace-attachment-mesh-conformance (kubernetes-sigs#3833)

a879542

add httproute matching conformance (kubernetes-sigs#3831)

77baa43

Add Istio report for 1.3.0 (kubernetes-sigs#3808)

b3e0aa9

Signed-off-by: Keith Mattix II <keithmattix@microsoft.com>

Add Kubvernor conformance report (kubernetes-sigs#3813)

1b895fe

* Kubevernor conformance report * Adding Kubvernor section to implementations section

Add NGINX Gateway Fabric v2.0 conformance report (kubernetes-sigs#3836)

c3dd6c3

Adding conformance report for the v2.0 NGINX Gateway Fabric release. Now supporting Gateway API v1.3.

Fix godoc comment for GatewaySpecAddress (kubernetes-sigs#3845)

3fa0912

* Update naming * fix failures

shaneutt added the do-not-merge DEPRECATED. Indicates that a PR should not merge. Label can only be manually applied/removed. label Aug 28, 2025

shaneutt added this to Release v1.4.0 Aug 28, 2025

k8s-ci-robot added the kind/gep PRs related to Gateway Enhancement Proposal(GEP) label Aug 28, 2025

k8s-ci-robot requested review from howardjohn and LiorLieberman August 28, 2025 12:16

k8s-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Aug 28, 2025

shaneutt requested review from robscott, youngnick, mlavacca, danwinship, aojea and bowei and removed request for howardjohn and LiorLieberman August 28, 2025 12:28

shaneutt moved this to Review in Release v1.4.0 Aug 28, 2025

aojea reviewed Aug 29, 2025

View reviewed changes

Skaronator mentioned this pull request Sep 4, 2025

CFP: Support basic-auth/oauth2/mTLS for north-south traffic (GatewayAPI/Ingress) cilium/cilium#23797

Open

	// +listType=map
	// +listMapKey=type
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=8
	// +required
	Conditions []metav1.Condition `json:"conditions,omitempty"`

DO NOT MERGE: initial v1.4.0 feedback #4042

Are you sure you want to change the base?

DO NOT MERGE: initial v1.4.0 feedback #4042

Conversation

shaneutt commented Aug 28, 2025

Uh oh!

k8s-ci-robot commented Aug 28, 2025

Uh oh!

k8s-ci-robot commented Aug 28, 2025

Uh oh!

k8s-ci-robot commented Aug 28, 2025

Uh oh!

k8s-ci-robot commented Aug 28, 2025

Uh oh!

aojea Aug 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

aojea Aug 29, 2025 •

edited

Loading