Skip to content

feat: EnvoyPatchPolicy support targetRefs #8713

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zirain wants to merge 11 commits into
base: main
Choose a base branch
from
Open

feat: EnvoyPatchPolicy support targetRefs #8713

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
ccb8b62
api: EnvoyPatchPolicy support targetRefs
zirain Apr 10, 2026
63d20b8
impl targetRefs for EnvoyPatchPolicy
zirain Apr 10, 2026
79d5b8a
fix gen
zirain Apr 10, 2026
61fca99
update e2e
zirain Apr 10, 2026
d59d36b
fix EPP status
zirain Apr 13, 2026
f7983f5
fix codex review comments
zirain Apr 14, 2026
ad7571a
update e2e
zirain Apr 16, 2026
6a5bcf3
Merge branch 'main' into epp-multi-targetrefs
zirain Apr 16, 2026
36b1697
Merge branch 'main' into epp-multi-targetrefs
zirain Apr 19, 2026
5c2d13c
fix
zirain Apr 19, 2026
3036432
add e2e for stale status cleanup
zirain Apr 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion api/v1alpha1/envoypatchpolicy_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ type EnvoyPatchPolicy struct {

// EnvoyPatchPolicySpec defines the desired state of EnvoyPatchPolicy.
// +union
// +kubebuilder:validation:XValidation:rule="(has(self.targetRef) && (!has(self.targetRefs) || size(self.targetRefs) == 0)) || (!has(self.targetRef) && has(self.targetRefs) && size(self.targetRefs) > 0)",message="exactly one of targetRef or targetRefs must be set"
type EnvoyPatchPolicySpec struct {
// Type decides the type of patch.
// Valid EnvoyPatchType values are "JSONPatch".
Expand All @@ -57,7 +58,21 @@ type EnvoyPatchPolicySpec struct {
// This Policy and the TargetRef MUST be in the same namespace
// for this Policy to have effect and be applied to the Gateway
// TargetRef
TargetRef gwapiv1.LocalPolicyTargetReference `json:"targetRef"`
//
// Deprecated: TargetRef is deprecated in favor of TargetRefs to support attaching to multiple resources.
//
// +optional
TargetRef *gwapiv1.LocalPolicyTargetReference `json:"targetRef"`
// TargetRefs is the names of the Gateway API resources this policy
// is being attached to.
// By default, attaching to Gateway is supported and
// when mergeGateways is enabled it should attach to GatewayClass.
// This Policy and the TargetRef MUST be in the same namespace
// for this Policy to have effect and be applied to the Gateway
// TargetRefs.
//
// +optional
TargetRefs []gwapiv1.LocalPolicyTargetReference `json:"targetRefs,omitempty"`
// Priority of the EnvoyPatchPolicy.
// If multiple EnvoyPatchPolicies are applied to the same
// TargetRef, they will be applied in the ascending order of
Expand Down
11 changes: 10 additions & 1 deletion api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

47 changes: 46 additions & 1 deletion charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoypatchpolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,8 @@ spec:
This Policy and the TargetRef MUST be in the same namespace
for this Policy to have effect and be applied to the Gateway
TargetRef

Deprecated: TargetRef is deprecated in favor of TargetRefs to support attaching to multiple resources.
properties:
group:
description: Group is the group of the target resource.
Expand All @@ -163,6 +165,45 @@ spec:
- kind
- name
type: object
targetRefs:
description: |-
TargetRefs is the names of the Gateway API resources this policy
is being attached to.
By default, attaching to Gateway is supported and
when mergeGateways is enabled it should attach to GatewayClass.
This Policy and the TargetRef MUST be in the same namespace
for this Policy to have effect and be applied to the Gateway
TargetRefs.
items:
description: |-
LocalPolicyTargetReference identifies an API object to apply a direct or
inherited policy to. This should be used as part of Policy resources
that can target Gateway API resources. For more information on how this
policy attachment model works, and a sample Policy resource, refer to
the policy attachment documentation for Gateway API.
properties:
group:
description: Group is the group of the target resource.
maxLength: 253
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: Kind is kind of the target resource.
maxLength: 63
minLength: 1
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: Name is the name of the target resource.
maxLength: 253
minLength: 1
type: string
required:
- group
- kind
- name
type: object
type: array
type:
description: |-
Type decides the type of patch.
Expand All @@ -171,9 +212,13 @@ spec:
- JSONPatch
type: string
required:
- targetRef
- type
type: object
x-kubernetes-validations:
- message: exactly one of targetRef or targetRefs must be set
rule: (has(self.targetRef) && (!has(self.targetRefs) || size(self.targetRefs)
== 0)) || (!has(self.targetRef) && has(self.targetRefs) && size(self.targetRefs)
> 0)
status:
description: Status defines the current status of EnvoyPatchPolicy.
properties:
Expand Down
47 changes: 46 additions & 1 deletion charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoypatchpolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,8 @@ spec:
This Policy and the TargetRef MUST be in the same namespace
for this Policy to have effect and be applied to the Gateway
TargetRef

Deprecated: TargetRef is deprecated in favor of TargetRefs to support attaching to multiple resources.
properties:
group:
description: Group is the group of the target resource.
Expand All @@ -162,6 +164,45 @@ spec:
- kind
- name
type: object
targetRefs:
description: |-
TargetRefs is the names of the Gateway API resources this policy
is being attached to.
By default, attaching to Gateway is supported and
when mergeGateways is enabled it should attach to GatewayClass.
This Policy and the TargetRef MUST be in the same namespace
for this Policy to have effect and be applied to the Gateway
TargetRefs.
items:
description: |-
LocalPolicyTargetReference identifies an API object to apply a direct or
inherited policy to. This should be used as part of Policy resources
that can target Gateway API resources. For more information on how this
policy attachment model works, and a sample Policy resource, refer to
the policy attachment documentation for Gateway API.
properties:
group:
description: Group is the group of the target resource.
maxLength: 253
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
kind:
description: Kind is kind of the target resource.
maxLength: 63
minLength: 1
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
type: string
name:
description: Name is the name of the target resource.
maxLength: 253
minLength: 1
type: string
required:
- group
- kind
- name
type: object
type: array
type:
description: |-
Type decides the type of patch.
Expand All @@ -170,9 +211,13 @@ spec:
- JSONPatch
type: string
required:
- targetRef
- type
type: object
x-kubernetes-validations:
- message: exactly one of targetRef or targetRefs must be set
rule: (has(self.targetRef) && (!has(self.targetRefs) || size(self.targetRefs)
== 0)) || (!has(self.targetRef) && has(self.targetRefs) && size(self.targetRefs)
> 0)
status:
description: Status defines the current status of EnvoyPatchPolicy.
properties:
Expand Down
Loading