[release-1.5] cherry pick for v1.5.0

VERSION

@@ -1 +1 @@
-v1.5.0-rc.2
+v1.5.0

api/v1alpha1/envoygateway_helpers.go

@@ -109,6 +109,16 @@ func (e *EnvoyGateway) GatewayNamespaceMode() bool {
 		*e.Provider.Kubernetes.Deploy.Type == KubernetesDeployModeTypeGatewayNamespace
 }
 
+// TopologyInjectorDisabled checks whether the provided EnvoyGateway disables TopologyInjector
+func (e *EnvoyGateway) TopologyInjectorDisabled() bool {
+	if e.Provider != nil &&
+		e.Provider.Kubernetes != nil &&
+		e.Provider.Kubernetes.TopologyInjector != nil {
+		return ptr.Deref(e.Provider.Kubernetes.TopologyInjector.Disable, false)
+	}
+	return false
+}
+
 // defaultRuntimeFlags are the default runtime flags for Envoy Gateway.
 var defaultRuntimeFlags = map[RuntimeFlag]bool{
 	XDSNameSchemeV2: false,

api/v1alpha1/ratelimit_types.go

@@ -285,9 +285,9 @@ type RateLimitValue struct {
 }
 
 // RateLimitUnit specifies the intervals for setting rate limits.
-// Valid RateLimitUnit values are "Second", "Minute", "Hour", and "Day".
+// Valid RateLimitUnit values are "Second", "Minute", "Hour", "Day", "Month" and "Year".
 //
-// +kubebuilder:validation:Enum=Second;Minute;Hour;Day
+// +kubebuilder:validation:Enum=Second;Minute;Hour;Day;Month;Year
 type RateLimitUnit string
 
 // RateLimitUnit constants.
@@ -303,4 +303,10 @@ const (
 
 	// RateLimitUnitDay specifies the rate limit interval to be 1 day.
 	RateLimitUnitDay RateLimitUnit = "Day"
+
+	// RateLimitUnitMonth specifies the rate limit interval to be 1 month.
+	RateLimitUnitMonth RateLimitUnit = "Month"
+
+	// RateLimitUnitYear specifies the rate limit interval to be 1 year.
+	RateLimitUnitYear RateLimitUnit = "Year"
 )

api/v1alpha1/shared_types.go

@@ -231,7 +231,7 @@ type KubernetesContainerSpec struct {
 	// Image specifies the EnvoyProxy container image to be used including a tag, instead of the default image.
 	// This field is mutually exclusive with ImageRepository.
 	//
-	// +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._/-]+:[a-zA-Z0-9._-]+$')",message="Image must include a tag and allowed characters only (e.g., 'repo:tag')."
+	// +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._/-]+(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')",message="Image must include a tag and allowed characters only (e.g., 'repo:tag')."
 	// +optional
 	Image *string `json:"image,omitempty"`
 

charts/gateway-crds-helm/Chart.yaml

@@ -1,24 +1,25 @@
 apiVersion: v2
 name: gateway-crds-helm
-description: A Helm chart for Kubernetes
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+description: A Helm chart for Envoy Gateway CRDs
 type: application
 
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-# Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.0
+version: v0.0.0-latest
+appVersion: "latest"
+icon: https://raw.githubusercontent.com/envoyproxy/gateway/main/site/assets/icons/logo.svg
+
+maintainers:
+  - name: envoy-gateway-steering-committee
+    url: https://github.com/envoyproxy/gateway/blob/main/GOVERNANCE.md
+  - name: envoy-gateway-maintainers
+    url: https://github.com/envoyproxy/gateway/blob/main/CODEOWNERS
+
+keywords:
+  - gateway-api
+  - envoyproxy
+  - envoy-gateway
+  - eg
+
+home: https://gateway.envoyproxy.io/
 
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application. Versions are not expected to
-# follow Semantic Versioning. They should reflect the version the application is using.
-# It is recommended to use it with quotes.
-appVersion: "1.16.0"
+sources:
+  - https://github.com/envoyproxy/gateway

charts/gateway-crds-helm/README.md

@@ -1,8 +1,21 @@
 # gateway-crds-helm
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.16.0](https://img.shields.io/badge/AppVersion-1.16.0-informational?style=flat-square)
+![Version: v0.0.0-latest](https://img.shields.io/badge/Version-v0.0.0--latest-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square)
 
-A Helm chart for Kubernetes
+A Helm chart for Envoy Gateway CRDs
+
+**Homepage:** <https://gateway.envoyproxy.io/>
+
+## Maintainers
+
+| Name | Email | Url |
+| ---- | ------ | --- |
+| envoy-gateway-steering-committee |  | <https://github.com/envoyproxy/gateway/blob/main/GOVERNANCE.md> |
+| envoy-gateway-maintainers |  | <https://github.com/envoyproxy/gateway/blob/main/CODEOWNERS> |
+
+## Source Code
+
+* <https://github.com/envoyproxy/gateway>
 
 ## Usage
 

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml

@@ -1031,12 +1031,14 @@ spec:
                                 unit:
                                   description: |-
                                     RateLimitUnit specifies the intervals for setting rate limits.
-                                    Valid RateLimitUnit values are "Second", "Minute", "Hour", and "Day".
+                                    Valid RateLimitUnit values are "Second", "Minute", "Hour", "Day", "Month" and "Year".
                                   enum:
                                   - Second
                                   - Minute
                                   - Hour
                                   - Day
+                                  - Month
+                                  - Year
                                   type: string
                               required:
                               - requests
@@ -1280,12 +1282,14 @@ spec:
                                 unit:
                                   description: |-
                                     RateLimitUnit specifies the intervals for setting rate limits.
-                                    Valid RateLimitUnit values are "Second", "Minute", "Hour", and "Day".
+                                    Valid RateLimitUnit values are "Second", "Minute", "Hour", "Day", "Month" and "Year".
                                   enum:
                                   - Second
                                   - Minute
                                   - Hour
                                   - Day
+                                  - Month
+                                  - Year
                                   type: string
                               required:
                               - requests

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml

@@ -614,7 +614,7 @@ spec:
                                 x-kubernetes-validations:
                                 - message: Image must include a tag and allowed characters
                                     only (e.g., 'repo:tag').
-                                  rule: self.matches('^[a-zA-Z0-9._/-]+:[a-zA-Z0-9._-]+$')
+                                  rule: self.matches('^[a-zA-Z0-9._/-]+(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
                               imageRepository:
                                 description: |-
                                   ImageRepository specifies the container image repository to be used without specifying a tag.
@@ -4459,7 +4459,7 @@ spec:
                                 x-kubernetes-validations:
                                 - message: Image must include a tag and allowed characters
                                     only (e.g., 'repo:tag').
-                                  rule: self.matches('^[a-zA-Z0-9._/-]+:[a-zA-Z0-9._-]+$')
+                                  rule: self.matches('^[a-zA-Z0-9._/-]+(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
                               imageRepository:
                                 description: |-
                                   ImageRepository specifies the container image repository to be used without specifying a tag.

charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml

@@ -1030,12 +1030,14 @@ spec:
                                 unit:
                                   description: |-
                                     RateLimitUnit specifies the intervals for setting rate limits.
-                                    Valid RateLimitUnit values are "Second", "Minute", "Hour", and "Day".
+                                    Valid RateLimitUnit values are "Second", "Minute", "Hour", "Day", "Month" and "Year".
                                   enum:
                                   - Second
                                   - Minute
                                   - Hour
                                   - Day
+                                  - Month
+                                  - Year
                                   type: string
                               required:
                               - requests
@@ -1279,12 +1281,14 @@ spec:
                                 unit:
                                   description: |-
                                     RateLimitUnit specifies the intervals for setting rate limits.
-                                    Valid RateLimitUnit values are "Second", "Minute", "Hour", and "Day".
+                                    Valid RateLimitUnit values are "Second", "Minute", "Hour", "Day", "Month" and "Year".
                                   enum:
                                   - Second
                                   - Minute
                                   - Hour
                                   - Day
+                                  - Month
+                                  - Year
                                   type: string
                               required:
                               - requests

charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml

@@ -613,7 +613,7 @@ spec:
                                 x-kubernetes-validations:
                                 - message: Image must include a tag and allowed characters
                                     only (e.g., 'repo:tag').
-                                  rule: self.matches('^[a-zA-Z0-9._/-]+:[a-zA-Z0-9._-]+$')
+                                  rule: self.matches('^[a-zA-Z0-9._/-]+(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
                               imageRepository:
                                 description: |-
                                   ImageRepository specifies the container image repository to be used without specifying a tag.
@@ -4458,7 +4458,7 @@ spec:
                                 x-kubernetes-validations:
                                 - message: Image must include a tag and allowed characters
                                     only (e.g., 'repo:tag').
-                                  rule: self.matches('^[a-zA-Z0-9._/-]+:[a-zA-Z0-9._-]+$')
+                                  rule: self.matches('^[a-zA-Z0-9._/-]+(:[a-zA-Z0-9._-]+)?(@sha256:[a-z0-9]+)?$')
                               imageRepository:
                                 description: |-
                                   ImageRepository specifies the container image repository to be used without specifying a tag.

examples/envoy-ext-auth/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.24.4 AS builder
+FROM golang:1.24.6 AS builder
 
 ARG GO_LDFLAGS=""
 

examples/envoy-ext-auth/go.mod

@@ -1,6 +1,6 @@
 module github.com/envoyproxy/gateway-grcp-ext-auth
 
-go 1.24.4
+go 1.24.6
 
 require (
 	github.com/envoyproxy/go-control-plane/envoy v1.32.4

examples/extension-server/go.mod

@@ -1,6 +1,6 @@
 module github.com/exampleorg/envoygateway-extension
 
-go 1.24.4
+go 1.24.6
 
 require (
 	github.com/envoyproxy/gateway v1.3.1

examples/grpc-ext-proc/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.24.4 AS builder
+FROM golang:1.24.6 AS builder
 
 ARG GO_LDFLAGS=""
 

examples/grpc-ext-proc/go.mod

@@ -1,6 +1,6 @@
 module github.com/envoyproxy/gateway-grpc-ext-proc
 
-go 1.24.4
+go 1.24.6
 
 require (
 	github.com/envoyproxy/go-control-plane/envoy v1.32.4

examples/preserve-case-backend/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.24.4 AS builder
+FROM golang:1.24.6 AS builder
 
 ARG GO_LDFLAGS=""
 

examples/preserve-case-backend/go.mod

@@ -1,6 +1,6 @@
 module github.com/envoyproxy/gateway-preserve-case-backend
 
-go 1.24.4
+go 1.24.6
 
 require github.com/valyala/fasthttp v1.64.0
 

examples/simple-extension-server/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.24.4 AS builder
+FROM golang:1.24.6 AS builder
 
 ARG GO_LDFLAGS=""
 

examples/simple-extension-server/go.mod

@@ -1,6 +1,6 @@
 module github.com/envoyproxy/gateway-simple-extension-server
 
-go 1.24.4
+go 1.24.6
 
 require (
 	github.com/envoyproxy/gateway v1.4.2

examples/static-file-server/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.24.4 AS builder
+FROM golang:1.24.6 AS builder
 
 ARG GO_LDFLAGS=""
 

examples/static-file-server/go.mod

@@ -1,3 +1,3 @@
 module github.com/envoyproxy/static-file-server
 
-go 1.24.4
+go 1.24.6

go.mod

@@ -1,6 +1,6 @@
 module github.com/envoyproxy/gateway
 
-go 1.24.4
+go 1.24.6
 
 // Replace the otelgrpc version because of k8s.io/client-go v0.33.3
 replace go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 => go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.58.0
@@ -21,7 +21,7 @@ require (
 	github.com/envoyproxy/go-control-plane v0.13.5-0.20250622153809-434b6986176d
 	github.com/envoyproxy/go-control-plane/contrib v1.32.5-0.20250430092421-68a532e11403
 	github.com/envoyproxy/go-control-plane/envoy v1.32.5-0.20250622153809-434b6986176d
-	github.com/envoyproxy/go-control-plane/ratelimit v0.1.0
+	github.com/envoyproxy/go-control-plane/ratelimit v0.1.1-0.20250805143705-d51f8590a549
 	github.com/envoyproxy/ratelimit v1.4.1-0.20230427142404-e2a87f41d3a7
 	github.com/evanphx/json-patch v5.9.11+incompatible
 	github.com/evanphx/json-patch/v5 v5.9.11

go.sum

@@ -317,8 +317,8 @@ github.com/envoyproxy/go-control-plane/contrib v1.32.5-0.20250430092421-68a532e1
 github.com/envoyproxy/go-control-plane/contrib v1.32.5-0.20250430092421-68a532e11403/go.mod h1:Xkwx/TGvEKRCL2mitdiuQWOD1ECvfM5krWWVo2vI2Zk=
 github.com/envoyproxy/go-control-plane/envoy v1.32.5-0.20250622153809-434b6986176d h1:mbxMT8XP3hEorIeTp4Yvcz5qKzE2n2q4IMU3SxuikaQ=
 github.com/envoyproxy/go-control-plane/envoy v1.32.5-0.20250622153809-434b6986176d/go.mod h1:09qwbGVuSWWAyN5t/b3iyVfz5+z8QWGrzkoqm/8SbEs=
-github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
-github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
+github.com/envoyproxy/go-control-plane/ratelimit v0.1.1-0.20250805143705-d51f8590a549 h1:5K0vH5H4dtCIO8+w/yq6vDaMcGn9RoPrHfmPAFAztwU=
+github.com/envoyproxy/go-control-plane/ratelimit v0.1.1-0.20250805143705-d51f8590a549/go.mod h1:KxtyvDAPIEkqUUvF9ooo5gSGVOtQ08wUTnQe5LsJC6c=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
 github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=

internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml

@@ -1127,14 +1127,6 @@ xds:
                   useRemoteAddress: true
               name: default/eg/http
             maxConnectionsToAcceptPerSocketEvent: 1
-            metadata:
-              filterMetadata:
-                envoy-gateway:
-                  resources:
-                  - kind: Gateway
-                    name: eg
-                    namespace: default
-                    sectionName: http
             name: default/eg/http
             perConnectionBufferLimitBytes: 32768
       - activeState:
@@ -1247,14 +1239,6 @@ xds:
                   useRemoteAddress: true
               name: default/eg/grpc
             maxConnectionsToAcceptPerSocketEvent: 1
-            metadata:
-              filterMetadata:
-                envoy-gateway:
-                  resources:
-                  - kind: Gateway
-                    name: eg
-                    namespace: default
-                    sectionName: grpc
             name: default/eg/grpc
             perConnectionBufferLimitBytes: 32768
       - activeState:

internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json

@@ -978,20 +978,6 @@
                     "name": "default/eg/http"
                   },
                   "maxConnectionsToAcceptPerSocketEvent": 1,
-                  "metadata": {
-                    "filterMetadata": {
-                      "envoy-gateway": {
-                        "resources": [
-                          {
-                            "kind": "Gateway",
-                            "name": "eg",
-                            "namespace": "default",
-                            "sectionName": "http"
-                          }
-                        ]
-                      }
-                    }
-                  },
                   "name": "default/eg/http",
                   "perConnectionBufferLimitBytes": 32768
                 }
@@ -1144,20 +1130,6 @@
                     "name": "default/eg/grpc"
                   },
                   "maxConnectionsToAcceptPerSocketEvent": 1,
-                  "metadata": {
-                    "filterMetadata": {
-                      "envoy-gateway": {
-                        "resources": [
-                          {
-                            "kind": "Gateway",
-                            "name": "eg",
-                            "namespace": "default",
-                            "sectionName": "grpc"
-                          }
-                        ]
-                      }
-                    }
-                  },
                   "name": "default/eg/grpc",
                   "perConnectionBufferLimitBytes": 32768
                 }