[pull] main from envoyproxy:main

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,6 @@
 **What type of PR is this?**
 <!--
-Your PR title should be descriptive, and generally start with type that contains a subsystem name with `()` if necessary 
+Your PR title should be descriptive, and generally start with type that contains a subsystem name with `()` if necessary
 and summary followed by a colon. format `chore/docs/api/feat/fix/refactor/style/test: summary`.
 Examples:
 * "docs: fix grammar error"
@@ -23,3 +23,9 @@ a new PR, and we will review the API part first. It will save you lots of implem
 Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
 -->
 Fixes #
+
+<!--
+For any non-trivial changes, you need to provide a brief description of the changes in the release notes.
+Please add the description to the release-notes/current.yaml file and include this file in the PR.
+-->
+Release Notes: Yes/No

.github/dependabot.yml

@@ -6,64 +6,52 @@
 version: 2
 updates:
   - package-ecosystem: docker
-    directory: /tools/docker/envoy-gateway/
-    schedule:
-      interval: weekly
-  - package-ecosystem: docker
-    directory: /site
+    directories:
+      - /tools/docker/envoy-gateway/
+      - /site
     schedule:
       interval: weekly
   - package-ecosystem: github-actions
-    directory: /
+    directories:
+      - /
+      - /tools/github-actions/setup-deps
     schedule:
       interval: weekly
     ignore:
       # skip to update retest, because it won't work with the latest version
       - dependency-name: "envoyproxy/toolshed/gh-actions/retest"
-  - package-ecosystem: github-actions
-    directory: /tools/github-actions/setup-deps
-    schedule:
-      interval: weekly
   - package-ecosystem: gomod
-    directory: /
+    directories:
+      - "/"
+      - "examples/extension-server"
     schedule:
       interval: weekly
     groups:
       k8s.io:
         patterns:
           - "k8s.io/*"
+          - "sigs.k8s.io/*"
       go.opentelemetry.io:
         patterns:
           - "go.opentelemetry.io/*"
+      golang.org:
+        patterns:
+          - "golang.org/*"
+          - "google.golang.org/*"
+          - "google.golang.org/genproto/googleapis/*"
   - package-ecosystem: pip
-    directory: /tools/src/codespell
-    schedule:
-      interval: weekly
-  - package-ecosystem: gomod
-    directory: /tools/src/helm-docs
-    schedule:
-      interval: weekly
-  - package-ecosystem: gomod
-    directory: /tools/src/buf
+    directories:
+      - /tools/src/codespell
+      - /tools/src/sphinx-build
+      - /tools/src/yamllint
     schedule:
       interval: weekly
   - package-ecosystem: gomod
-    directory: /tools/src/golangci-lint
-    schedule:
-      interval: weekly
-  - package-ecosystem: gomod
-    directory: /tools/src/kind
-    schedule:
-      interval: weekly
-  - package-ecosystem: gomod
-    directory: /tools/src/setup-envtest
-    schedule:
-      interval: weekly
-  - package-ecosystem: pip
-    directory: /tools/src/sphinx-build
-    schedule:
-      interval: weekly
-  - package-ecosystem: pip
-    directory: /tools/src/yamllint
+    directories:
+      - /tools/src/helm-docs
+      - /tools/src/buf
+      - /tools/src/golangci-lint
+      - /tools/src/kind
+      - /tools/src/setup-envtest
     schedule:
       interval: weekly

.github/markdown_lint_config.json

@@ -49,5 +49,7 @@
   "MD048": false,
   "MD049": false,
   "MD050": false,
-  "MD051": false
+  "MD051": false,
+  "MD055": false,
+  "MD056": false
 }

.github/workflows/build_and_test.yaml

@@ -20,7 +20,7 @@ jobs:
   lint:
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - uses: ./tools/github-actions/setup-deps
     # Generate the installation manifests first, so it can check
     # for errors while running `make -k lint`
@@ -31,14 +31,14 @@ jobs:
   gen-check:
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - uses: ./tools/github-actions/setup-deps
     - run: make -k gen-check
 
   license-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - uses: ./tools/github-actions/setup-deps
     - run: make -k licensecheck
 
@@ -48,33 +48,33 @@ jobs:
       contents: read   #  for actions/checkout
       id-token: write  #  for fetching OIDC token
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - uses: ./tools/github-actions/setup-deps
 
     # test
     - name: Run Coverage Tests
       run: make go.test.coverage
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673  # v4.5.0
+      uses: codecov/codecov-action@7f8b4b4bde536c465e797be725718b88c5d95e0e  # v5.1.1
       with:
         fail_ci_if_error: true
         files: ./coverage.xml
         name: codecov-envoy-gateway
         verbose: true
-        use_oidc: true
+        use_oidc: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) }}
 
   build:
     runs-on: ubuntu-latest
     needs: [lint, gen-check, license-check, coverage-test]
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - uses: ./tools/github-actions/setup-deps
 
     - name: Build EG Multiarch Binaries
       run: make build-multiarch PLATFORMS="linux_amd64 linux_arm64"
 
     - name: Upload EG Binaries
-      uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b  # v4.3.4
+      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882  # v4.4.3
       with:
         name: envoy-gateway
         path: bin/
@@ -83,10 +83,11 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build]
     strategy:
+      fail-fast: false
       matrix:
-        version: [ v1.27.13, v1.28.9, v1.29.4, v1.30.0 ]
+        version: [ v1.29.10, v1.30.6, v1.31.4, v1.32.0 ]
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
@@ -111,10 +112,20 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build]
     strategy:
+      fail-fast: false
       matrix:
-        version: [ v1.27.13, v1.28.9, v1.29.4, v1.30.0 ]
+        target:
+        - version: v1.29.10
+          ipFamily: ipv4
+        - version: v1.30.6
+          ipFamily: ipv4
+        - version: v1.31.4
+          ipFamily: ipv6  # only run ipv6 test on this version to save time
+        # TODO: this's IPv4 first, need a way to test IPv6 first.
+        - version: v1.32.0
+          ipFamily: dual  # only run dual test on latest version to save time
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
@@ -131,8 +142,10 @@ jobs:
     # E2E
     - name: Run E2E Tests
       env:
-        KIND_NODE_TAG: ${{ matrix.version }}
+        KIND_NODE_TAG: ${{ matrix.target.version }}
         IMAGE_PULL_POLICY: IfNotPresent
+        IP_FAMILY: ${{ matrix.target.ipFamily }}
+        E2E_TIMEOUT: 1h
       run: make e2e
 
   benchmark-test:
@@ -141,13 +154,16 @@ jobs:
     if: ${{ ! startsWith(github.event_name, 'push') }}
     needs: [build]
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - uses: ./tools/github-actions/setup-deps
 
+    - name: Setup Graphviz
+      uses: ts-graphviz/setup-graphviz@b1de5da23ed0a6d14e0aeee8ed52fdd87af2363c  # v2.0.2
+
     # Benchmark
     - name: Run Benchmark tests
       env:
-        KIND_NODE_TAG: v1.28.9
+        KIND_NODE_TAG: v1.29.10
         IMAGE_PULL_POLICY: IfNotPresent
         # Args for benchmark test
         BENCHMARK_RPS: 10000
@@ -160,12 +176,25 @@ jobs:
 
     - name: Read Benchmark report
       run: cat test/benchmark/benchmark_report/benchmark_report.md
+  resilience-test:
+    runs-on: ubuntu-latest
+    if: ${{ ! startsWith(github.event_name, 'push') }}
+    needs: [build]
+    steps:
+    - uses: actions/[email protected]
+    - uses: ./tools/github-actions/setup-deps
+    - name: Resilience Test
+      env:
+        KIND_NODE_TAG: v1.28.13
+        IMAGE_PULL_POLICY: IfNotPresent
+        CUSTOM_CNI: "true"
+      run: make resilience
 
   publish:
     runs-on: ubuntu-latest
     needs: [conformance-test, e2e-test]
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
@@ -182,7 +211,7 @@ jobs:
     # build and push image
     - name: Login to DockerHub
       if: github.event_name == 'push'
-      uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446  # v3.2.0
+      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  # v3.3.0
       with:
         username: ${{ secrets.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_PASSWORD }}
@@ -205,4 +234,6 @@ jobs:
       if: github.event_name == 'push' && github.ref == 'refs/heads/main'
       # use `0.0.0` as the default latest version.
       # use `Always` image pull policy for latest version.
-      run: IMAGE_PULL_POLICY=Always OCI_REGISTRY=oci://docker.io/envoyproxy CHART_VERSION=v0.0.0-latest TAG=latest make helm-push
+      run: |
+        IMAGE_PULL_POLICY=Always OCI_REGISTRY=oci://docker.io/envoyproxy CHART_VERSION=v0.0.0-latest TAG=latest make helm-push
+        IMAGE_PULL_POLICY=Always OCI_REGISTRY=oci://docker.io/envoyproxy CHART_VERSION=0.0.0-latest TAG=latest make helm-push

.github/workflows/codeql.yml

@@ -32,18 +32,18 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - uses: ./tools/github-actions/setup-deps
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@2d790406f505036ef40ecba973cc774a50395aac  # v3.25.13
+      uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae  # v3.27.9
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@2d790406f505036ef40ecba973cc774a50395aac  # v3.25.13
+      uses: github/codeql-action/autobuild@df409f7d9260372bd5f19e5b04e83cb3c43714ae  # v3.27.9
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@2d790406f505036ef40ecba973cc774a50395aac  # v3.25.13
+      uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae  # v3.27.9
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/docs.yaml

@@ -3,14 +3,12 @@ on:
   push:
     branches:
     - "main"
-    - "release/v*"
     paths:
     - 'site/**'
     - 'tools/make/docs.mk'
   pull_request:
     branches:
     - "main"
-    - "release/v*"
     paths:
     - 'site/**'
     - 'tools/make/docs.mk'
@@ -23,7 +21,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Check out code
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         ref: ${{ github.event.pull_request.head.sha }}
 
@@ -48,7 +46,7 @@ jobs:
       contents: write
     steps:
     - name: Git checkout
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         submodules: true
         ref: ${{ github.event.pull_request.head.sha }}
@@ -62,7 +60,7 @@ jobs:
         extended: true
 
     - name: Setup Node
-      uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b  # v4.1.0
+      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0
       with:
         node-version: '18'
 

.github/workflows/experimental_conformance.yaml

@@ -3,10 +3,11 @@ on:
   push:
     paths:
     - 'charts/gateway-helm/crds/gatewayapi-crds.yaml'
+    - 'test/conformance/experimental_conformance_test.go'
   pull_request:
     paths:
     - 'charts/gateway-helm/crds/gatewayapi-crds.yaml'
-    - 'test/conformance/*.go'
+    - 'test/conformance/experimental_conformance_test.go'
   # Add workflow_dispatch to trigger this workflow manually by maintainers.
   workflow_dispatch:
 
@@ -18,9 +19,9 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        version: [ v1.27.13, v1.28.9, v1.29.4, v1.30.0 ]
+        version: [ v1.29.10, v1.30.6, v1.31.4, v1.32.0 ]
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - uses: ./tools/github-actions/setup-deps
 
     # gateway api experimental conformance
@@ -32,7 +33,7 @@ jobs:
       run: make experimental-conformance
 
     - name: Upload Conformance Report
-      uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b  # v4.3.4
+      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882  # v4.4.3
       with:
         name: conformance-report-k8s-${{ matrix.version }}
         path: ./test/conformance/conformance-report-k8s-${{ matrix.version }}.yaml