feat: policy field owner by kkk777-7 · Pull Request #8538 · envoyproxy/gateway

kkk777-7 · 2026-03-17T16:17:32Z

What this PR does / why we need it:
follow up #7918

introduce PolicyFieldOwners to fixes below issues when parent/route Policy merge

handle LocalObjectReference/BackendRef correctly
handle IR Config name correctly

Which issue(s) this PR fixes:

Fixes #

Release Notes: No

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

netlify · 2026-03-17T16:17:55Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`3428bd3`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69f8a998e7ff7500089462c0
😎 Deploy Preview	https://deploy-preview-8538--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2026-03-17T16:28:24Z

Codecov Report

❌ Patch coverage is 90.97744% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.70%. Comparing base (0fe9137) to head (3428bd3).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/gatewayapi/securitypolicy.go	90.97%	6 Missing and 6 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8538      +/-   ##
==========================================
+ Coverage   74.66%   74.70%   +0.03%     
==========================================
  Files         251      251              
  Lines       40257    40492     +235     
==========================================
+ Hits        30058    30248     +190     
- Misses       8130     8168      +38     
- Partials     2069     2076       +7

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

kkk777-7 · 2026-04-09T15:36:43Z

/retest

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

kkk777-7 · 2026-04-16T06:53:22Z

/retest

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

zhaohuabing · 2026-04-24T08:20:58Z

@codex review

chatgpt-codex-connector · 2026-04-24T08:33:06Z

Codex Review: Didn't find any major issues. 👍

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

kkk777-7 · 2026-04-30T03:41:10Z

cc @arkodg @rudrakhp

we've discussed about owner logic in slack.
I've updated owner logic.

rudrakhp · 2026-04-30T09:24:07Z

Can we add a release-notes/current.yaml entry?
Also, the "Namespace Behavior with Secret References" section being deleted from security-policy.md leaves no replacement guidance, can we add a short note stating the new rule?

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

kkk777-7 · 2026-05-04T07:23:53Z

            clientID: client1.apps.googleusercontent.com
            clientSecret: '[redacted]'
-            cookieSuffix: 811c9dc5
+            cookieSuffix: c3556d06


this value derived from parent policy UID.

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

* fix(api): increase RateLimitSelectCondition.headers MaxItems from 16 to 64 (#8906) * fix(api): increase RateLimitSelectCondition.headers MaxItems from 16 to 64 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: wucm667 <stevenwucongmin@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * feat: policy field owner (#8538) * feat: policy field owner Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * skip invalid listener first in IR (#8577) * skip invalid listener Signed-off-by: zirain <zirain2009@gmail.com> * fix specValid Signed-off-by: zirain <zirain2009@gmail.com> * nit Signed-off-by: zirain <zirain2009@gmail.com> * fix Signed-off-by: zirain <zirain2009@gmail.com> * MUST NOT pick one conflicting Listener as the winner Signed-off-by: zirain <zirain2009@gmail.com> * update Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix: remove cross ns policy attachment status (#8901) * Revert "add warning for partially accepted targets" This reverts commit 5d88fbb. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * remove warning condition for cross-ns policy attachments without referenceGrants Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * feat: add runner event metrics (#8802) * add metrics for runner Signed-off-by: zirain <zirain2009@gmail.com> * rename Signed-off-by: zirain <zirain2009@gmail.com> * rename Signed-off-by: zirain <zirain2009@gmail.com> * reuse Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com> Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix: respect backend endpoint hostname for health checks (#8929) * fix: respect backend endpoint hostname for health checks ### Summary - Keep BackendTrafficPolicy HTTP health check hostnames as explicit cluster-level hosts, and leave route-derived host fallback to xDS cluster translation. - Preserve Backend endpoint hostnames as per-endpoint overrides via Endpoint.HealthCheckConfig.hostname, ahead of the route fallback. - Update gatewayapi/xDS fixtures, release notes, and generated API docs/CRDs for the host selection order. ### Test plan - go test ./internal/ir - go test ./internal/xds/translator - go test ./internal/gatewayapi -run TestTranslate/backendtrafficpolicy - go test ./internal/gatewayapi -run TestTranslate/(clienttrafficpolicy-http-health-check|envoyextensionpolicy-with-extproc-with-retries|envoyextensionpolicy-with-extproc-with-traffic-features|envoyproxy-accesslog-with-traffic|envoyproxy-tracing-backend-uds|envoyproxy-tracing-backend|securitypolicy-with-jwt-backendcluster|securitypolicy-with-jwt-backendsettings) - make generate - make manifests - git diff --check Signed-off-by: Arko Dasgupta <arkodg@gmail.com> Co-authored-by: Codex <noreply@openai.com> * fix gen Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: Arko Dasgupta <arkodg@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> Co-authored-by: Codex <noreply@openai.com> Co-authored-by: zirain <zirain2009@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix(helm): propagate commonLabels to RBAC resources (#8818) * feat(helm): propagate commonLabels to RBAC resources Issue #8817 reported that 'helm template ... --set commonLabels.custom-label=custom-value' left ClusterRole, ClusterRoleBinding, Role, and RoleBinding resources unlabelled. The other resources in the chart already include 'eg.labels' in their metadata - which picks up 'commonLabels' via the helper at _helpers.tpl:43 - but envoy-gateway-rbac.yaml didn't set any labels block. Add 'labels: {{- include "eg.labels" . | nindent 4 }}' on every Role / RoleBinding / ClusterRole / ClusterRoleBinding declared in envoy-gateway-rbac.yaml. Matches the existing labels pattern used in certgen-rbac.yaml and envoy-gateway-deployment.yaml. Scopes are '$' inside the watched-namespaces 'range' and '.' at the template root, same rule the helper block inside the file already used. Verified locally with: helm dependency update charts/gateway-helm envsubst < charts/gateway-helm/values.tmpl.yaml > \ charts/gateway-helm/values.yaml helm template eg charts/gateway-helm \ --set commonLabels.custom-label=custom-value | yq ... All four RBAC resources now emit 'custom-label: custom-value' in their metadata.labels, matching the issue's repro steps. Cert-gen RBAC resources already carried it; this PR brings the core envoy-gateway RBAC set into parity. Fixes #8817 Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * chore: regenerate helm-template snapshots for RBAC labels Run 'make helm-template.gateway-helm' to regenerate the snapshot fixtures after the envoy-gateway-rbac.yaml labels change. Adds the 'labels:' block to the RBAC resources in all 27 test cases. Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix gen Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add release note Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix(translator): set ListenerSet and listener Accepted:True for InvalidCertificateRef (#8871) * fix(translator): set ListenerSet and listener Accepted:True for InvalidCertificateRef When a ListenerSet listener has an unresolvable TLS certificate reference (InvalidCertificateRef or RefNotPermitted), Accepted: False was incorrectly set on both the listener and ListenerSet object. The Gateway API spec places InvalidCertificateRef exclusively under ResolvedRefs, not Accepted — a missing certificate is a reference resolution concern, not a structural one. Fixes #8870 Signed-off-by: apkatsikas <apkatsikas@gmail.com> * chore: fix gofumpt formatting in validateListenerConditions Signed-off-by: apkatsikas <apkatsikas@gmail.com> * fix(translator): separate RefNotPermitted from InvalidCertificateRef handling Unlike InvalidCertificateRef, RefNotPermitted should not set Accepted:True. Update unit test fixtures to match. Signed-off-by: apkatsikas <apkatsikas@gmail.com> * fix gen Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: apkatsikas <apkatsikas@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix: do not downgrade ALPN for only hostnames-overlapping listeners (#8934) fix: do not downgrade ALPN for overlapping hostnames withoug SANs overlapping Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * feat: enableDeferredCreationStats by default (#8937) * feat: enableDeferredCreationStats by default Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * fix: restore last transition time in merge status conditions (#8962) * fix: restore last transition time in merge status conditions Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> * add release note Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> --------- Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> * [release/v1.8] v1.8.0 release notes Cherry-picked release-notes/v1.8.0.yaml and VERSION bump from #8942. Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> --------- Signed-off-by: wucm667 <stevenwucongmin@gmail.com> Signed-off-by: jukie <10012479+jukie@users.noreply.github.com> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com> Signed-off-by: Arko Dasgupta <arkodg@gmail.com> Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Signed-off-by: apkatsikas <apkatsikas@gmail.com> Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Co-authored-by: wucm667 <109257021+wucm667@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Kota Kimura <86363983+kkk777-7@users.noreply.github.com> Co-authored-by: zirain <zirain2009@gmail.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> Co-authored-by: Codex <noreply@openai.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Andrew Katsikas <apkatsikas@gmail.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

feat: policy field owner

24ad4d5

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

kkk777-7 commented Mar 17, 2026

View reviewed changes

Comment thread internal/gatewayapi/testdata/securitypolicy-with-merge-multi-gateway-same-listener.in.yaml

Comment thread internal/gatewayapi/testdata/securitypolicy-with-merge-multi-gateway-same-listener.in.yaml

kkk777-7 force-pushed the fix-merge-policy-ref branch from 233556d to 3a7dc97 Compare March 17, 2026 16:54

update gatewayapi test input

c9abe3a

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

kkk777-7 force-pushed the fix-merge-policy-ref branch from 3a7dc97 to c9abe3a Compare March 17, 2026 17:06

kkk777-7 commented Mar 17, 2026

View reviewed changes

Comment thread internal/gatewayapi/testdata/securitypolicy-with-merge-needs-fieldowner.out.yaml

Comment thread internal/gatewayapi/testdata/securitypolicy-with-merge-needs-fieldowner.out.yaml

Comment thread internal/gatewayapi/testdata/securitypolicy-with-merge-needs-fieldowner.out.yaml

kkk777-7 added 2 commits March 18, 2026 09:35

fix lint

678c747

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

fix comments and docs

d1df896

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

kkk777-7 marked this pull request as ready for review March 18, 2026 06:36

kkk777-7 requested a review from a team as a code owner March 18, 2026 06:36

kkk777-7 added this to the v1.8.0-rc.1 Release milestone Mar 18, 2026

zhaohuabing reviewed Mar 19, 2026

View reviewed changes

Comment thread internal/gatewayapi/securitypolicy.go Outdated

arkodg requested a review from rudrakhp March 19, 2026 07:04

rudrakhp reviewed Mar 19, 2026

View reviewed changes

Comment thread internal/gatewayapi/securitypolicy.go Outdated

zhaohuabing requested a review from a team March 24, 2026 02:09

Merge branch 'main' into fix-merge-policy-ref

0931e78

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

zhaohuabing mentioned this pull request Apr 14, 2026

fix: ContextExtensions merge behavior #8747

Merged

zhaohuabing closed this in #8747 Apr 15, 2026

zhaohuabing reopened this Apr 15, 2026

kkk777-7 added 3 commits April 16, 2026 00:13

Merge branch 'main' into fix-merge-policy-ref

57dc79c

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

remove ptr

48d6e7c

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

update: owner key of contextExtensions

145ef59

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

kkk777-7 added 2 commits April 17, 2026 14:25

Merge branch 'main' into fix-merge-policy-ref

8ba7ba7

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

Merge branch 'main' into fix-merge-policy-ref

95b9dd3

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

jukie requested a review from a team April 28, 2026 04:46

update: merge owner logic

9bfdafb

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

kkk777-7 dismissed jukie’s stale review via d736d64 April 30, 2026 03:23

kkk777-7 force-pushed the fix-merge-policy-ref branch from d736d64 to 9bfdafb Compare April 30, 2026 03:28

rudrakhp reviewed Apr 30, 2026

View reviewed changes

Comment thread internal/gatewayapi/securitypolicy.go Outdated

refactor: build policy owner

c553d76

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

arkodg modified the milestones: v1.8.0-rc.1 Release, v1.8.0 Release Apr 30, 2026

kkk777-7 and others added 3 commits April 30, 2026 23:31

add: release note and behavior of policy references

2906e1d

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

Merge branch 'main' into fix-merge-policy-ref

e4975cb

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

Merge branch 'main' into fix-merge-policy-ref

e200a36

rudrakhp previously approved these changes Apr 30, 2026

View reviewed changes

rudrakhp requested review from jukie and zhaohuabing April 30, 2026 17:06

arkodg previously approved these changes May 4, 2026

View reviewed changes

kkk777-7 added 2 commits May 4, 2026 16:19

Merge branch 'main' into fix-merge-policy-ref

c6cd09a

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

address codex comments

edac8d2

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

kkk777-7 dismissed stale reviews from arkodg and rudrakhp via edac8d2 May 4, 2026 07:19

kkk777-7 commented May 4, 2026

View reviewed changes

rudrakhp previously approved these changes May 4, 2026

View reviewed changes

fix: yaml lint

3428bd3

Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>

kkk777-7 dismissed rudrakhp’s stale review via 3428bd3 May 4, 2026 14:13

rudrakhp approved these changes May 4, 2026

View reviewed changes

arkodg approved these changes May 4, 2026

View reviewed changes

arkodg merged commit 8cad3e6 into envoyproxy:main May 4, 2026
40 of 42 checks passed

kkk777-7 mentioned this pull request May 13, 2026

Handling secret references during policy merges #8094

Closed

Conversation

kkk777-7 commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

codecov Bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kkk777-7 commented Apr 9, 2026

Uh oh!

kkk777-7 commented Apr 16, 2026

Uh oh!

zhaohuabing commented Apr 24, 2026

Uh oh!

chatgpt-codex-connector Bot commented Apr 24, 2026

Uh oh!

kkk777-7 commented Apr 30, 2026

Uh oh!

Uh oh!

rudrakhp commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kkk777-7 May 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

kkk777-7 commented Mar 17, 2026 •

edited

Loading

netlify Bot commented Mar 17, 2026 •

edited

Loading

codecov Bot commented Mar 17, 2026 •

edited

Loading

rudrakhp commented Apr 30, 2026 •

edited

Loading