Skip to content
Release Radar

Gateway API

Networking

Kubernetes next-generation routing and traffic management API

kubernetes-sigs/gateway-apiWebsiteDocumentation
v1.6.249 days after v1.6.1
View on GitHub

Release history

v1.6.2

CompareGitHub

v1.6.2

Major Changes Since v1.6.1

Bug or Regression

  • HTTPRequestRedirectFilter status codes 303, 307, and 308 are Extended conformance, not Core. (#5173, @kflynn)

Other (Cleanup or Flake)

  • Fix flaky TCPRouteWeightedRouting and UDPRouteWeightedRouting conformance tests by adding a data-plane readiness check before performing weighted routing assertions. (#5064, @arybolovlev)
  • Fix FailFast not working as expected (#5204, @zirain)
  • Allow disabling parallel tests at the suite level (#5184, @zirain)

v1.6.1

Major Changes Since v1.6.0

Test & Conformance

  • Change the port used in TCPRouteMultipleRoutesAttachment. (#5053, @davidjumani)
  • Respect CleanupTestResources for BackendTLSPolicy, TCPRouteMultipleRoutesAttachment and UDPRouteMultipleRoutesAttachment(#5065, @snorwin)
  • Fix SetupTimeoutConfig() not respecting defaults for ListenerSetMustHaveCondition, ListenerSetListenersMustHaveConditions, and RequiredConsecutiveSuccesses. (#5066, @immanuwell)
  • Honour tcpRouteMustHaveCondition and udpRouteMustHaveCondition timeouts which were silently ignore. (#5067, @immanuwell)

Other (Cleanup or Flake)

  • Fix GatewayStaticAddresses test flake by waiting for status.addresses to be published instead of assuming it appears atomically with Programmed. (#5038, @howardjohn)
  • Fix GatewayInfrastructure test flake by polling for generated infrastructure resources instead of assuming immediate visibility after the gateway is accepted. (#5047, @howardjohn)
  • Fix flaky TCPRouteWeightedRouting and UDPRouteWeightedRouting conformance tests by adding a data-plane readiness check before performing weighted routing assertions. (#5064, @arybolovlev)

v1.6.0

Changes Since v1.5.1

GEP & API Graduation

  • UDPRoute & TCPRoute Graduation:
    • UDPRoute has graduated to GA. We recommend using the "v1" API version with this API now. The "v1alpha2" version of this API is deprecated and will be removed in the future. (#4923, @zac-nixon)
    • TCPRoute has graduated to GA. We recommend using the "v1" API version with this API now. The "v1alpha2" version of this API is deprecated and will be removed in the future. (#4920, @zac-nixon)
  • GEP Status Updates:

Feature

  • API & Validation Enhancements:
    • API validation updated for HTTPRoute retries: retry.codes must now be unique and retry.attempts must be >= 1. (#4907, @snorwin)
    • Increase the number of allowed Certificate Authority references from 8 to 16. (#4088, @root30)
    • The TLSRoute CRD validation has been adjusted to allow up to 1024 hostnames and rules per TLSRoute resource. Operators must validate kube-apiserver, etcd and Gateway controller behavior with representative manifests prior to enabling the new limit in production. (#4332, @alexanderstephan)
    • BackendTLSPolicy now can be used in combination with other routes types. (#4745, @rikatz)
    • Allow the usage of up to 16 annotations on the gateway infrastructure object. (#4707, @wenisman)
  • Conformance Infrastructure:
    • Added conformance tests for UDPRoute (GEP-2645), a new GATEWAY-UDP conformance profile, a SupportTCPRoute feature, and a UDP/TCP echo server in echo-basic gated on UDP_ECHO_SERVER. (#4861, @zac-nixon)
  • Remove the idleTimeout field from the experimental SessionPersistence API. (#4771, @gcs278)

Documentation

  • Migration & Site Updates:
  • API Specs & Guidance Clarifications:
    • Add missing apidoc for BackendTLSPolicy extended support. (#4828, @rikatz)
    • Add the missing ListenersNotValid programmed reason for listenerSets. (#4586, @davidjumani)
    • Added documentation guidance recommending GRPCRoute for gRPC traffic. (#4513, @kahirokunn)
    • Clarified CORS API documentation to describe behavior based on allowCredentials instead of credentialed requests. (#4663, @snorwin)
    • Previously, implementations were required to reject GRPCRoute and HTTPRoutes on the same hostname (however, few implementations did this). Now, implementations may optionally do this, or allow them to coincide. (#4598, @howardjohn)
    • Updates the documentation around the ListenerConditionConflicted condition. (#4659, @davidjumani)
  • Fixes:

Bug or Regression

  • IPv6 Support:
    • Fix GatewayFrontendClientCertificateValidationInsecureFallback, GatewayFrontendClientCertificateValidation, and GatewayFrontendInvalidDefaultClientCertificateValidation failing on IPv6 clusters. (#4636, @zirain)
    • Fix GatewayFrontendInvalidDefaultClientCertificateValidation failing on IPv6 clusters. (#4629, @zirain)
  • ValidatingAdmissionPolicy (VAP) Fixes:
    • Fixed an issue where the ValidatingAdmissionPolicy prevented experimental CRDs from being installed at all (instead of only when standard CRDs already exist). (#4603, @howardjohn)
    • Fixed the safe-upgrades ValidatingAdmissionPolicy to allow upgrades of experimental CRDs. (#4557, @snorwin)
  • CRD & Schema Validation:
    • Generated Gateway API CRD install manifests no longer include top-level CustomResourceDefinition status fields with invalid null values, fixing strict schema validation failures in tools such as kubeconform. (#4712, @MatteoFari)
    • Replace omitempty with omitzero for supportedKinds in ListenerStatus to preserve backward compatibility for controllers reconciling older Gateway API versions. (#4551, @snorwin)
  • API & Validation Fixes:
    • It is disallowed to have repeated filters of type CORS. (#4639, @DamianSawicki)
    • Limit HTTPRouteHTTPSListenerDetectMisdirectedRequests to h2 only. (#4665, @zirain)
    • Make explicit call about resource names requiring to be RFC 1035 compliant. (#4787, @rikatz)
    • Make referencegrant.spec field required. (#4845, @bexxmodd)

Test & Conformance

  • New Conformance Tests:
    • Add conformance test ListenerSetAllowedRoutesCrossNamespace which verifies that a ListenerSet only allows routes in its own namespace by default. (#4841, @asauber)
    • Added a conformance test covering the Gateway Accepted condition with reason ListenersNotValid and the Listener Accepted condition with reason UnsupportedProtocol. (#4807, @snorwin)
    • Added conformance test GatewayInvalidParametersRef that verifies a Gateway referencing an invalid parameters is rejected. (#4808, @snorwin)
    • Conformance: add ListenerSet tests for Route parentRef cases. (#4912, @asauber)
  • Test Machinery & Framework Updates:
    • Conformance: ExpectMirroredRequest now starts its log window before the requests are sent, so mirrors are not missed on high-latency data planes. (#4952, @lexfrei)
    • The default polling interval for conformance tests has been decreased. This can be modified by the new DefaultPollInterval. (#4570, @howardjohn)
    • The gRPC conformance request helper no longer closes a caller-supplied (injected) Options.GRPCClient; it closes only the DefaultClient it creates internally. This lets implementations reuse a custom gRPC client across requests. (#4953, @lexfrei)
  • Updates & Fixes to Existing Tests:
    • The conflicted=false condition is not required anymore in the listener status for non-conflicted listeners. (#4642, @zhaohuabing)
    • Fix TLSRoute conformance test to stop relying on self-signed certificates. (#4930, @rikatz)
    • Fixed MeshHTTPRoute307Redirect conformance test bug where the wrong manifest was used. (#4806, @jgreeer)
    • Update Gateway version to v1 in UDP conformance test. (#4722, @cnvergence)
    • Updated the TLSRoute conformance tests to allow FINs where previously RST was asserted. (#4615, @howardjohn)
    • conformance: add missing gateway-api/skip-this-for-readiness annotation to invalid gateways (#5027, @snorwin)
    • The GRPCRouteWeight conformance test now sends its distribution-sampling requests through the injectable Options.GRPCClient instead of a hardcoded DefaultClient, allowing implementations that supply a custom gRPC client to run it. (#5004, @lexfrei)
    • The HTTPRouteRequestPercentageMirror conformance test now derives its acceptance band from the binomial standard deviation instead of a flat ±15% relative tolerance, removing sampling-variance flakes at low mirror percentages. (#5005, @lexfrei)
    • Removed HTTPRoute retry tests with connection errors and backend timeouts (#4994, @snorwin)

What's Changed

…(truncated)

Warning: The Experimental channel CRDs are too large for a standard kubectl apply. To work around this please use kubectl apply --server-side=true instead -- or, even better, use kuberc to make server-side apply the default.

Gateway API v1.5.1

Major Changes Since v1.5.0

GEP

  • Updates the documentation around the ListenerConditionConflicted condition (#4669, @davidjumani)

Conformance

  • Limit HTTPRouteHTTPSListenerDetectMisdirectedRequests to h2 only (#4665, @zirain)
  • Fix conformance test not working on IPv6 (#4646, @zirain)
  • The conflicted=false condition is not required anymore in the listener status for non-conflicted listeners. (#4664, @zhaohuabing)
  • Updated the TLSRoute conformance tests to allow FINs where previously RST was asserted (#4624, @howardjohn)

What's Changed

Full Changelog: https://github.com/kubernetes-sigs/gateway-api/compare/v1.5.0...v1.5.1

Warning: The Experimental channel CRDs are too large for a standard kubectl apply. To work around this please use kubectl apply --server-side=true instead -- or, even better, use kuberc to make server-side apply the default.

Gateway API v1.5.0

Major Changes Since v1.4.1

Breaking Changes

TLSRoute v1alpha2 and XListenerSet

TLSRoute and ListenerSet have graduated to the Standard channel as v1. In 1.5.0, TLSRoute v1alpha2 is present only in the Experimental channel; in 1.6, it will be removed from the Experimental channel too.

Additionally, note that TLSRoute's CEL validation requires Kubernetes 1.31 or higher.

Upgrades and ValidatingAdmissionPolicy

Gateway API 1.5 introduces a validating admission policy (VAP) called safe-upgrades.gateway.networking.k8s.io to guard against two specific concerns:

  • It prevents installing Experimental CRDs once you've installed Standard CRDs.
  • It prevents downgrading to a version prior to 1.5 after you've installed Gateway API 1.5.

These actions can't be known to be safe without detailed knowledge about your application and users. If you need to perform them, delete the safe-upgrades.gateway.networking.k8s.io VAP first.

New Features

In this release, the following major features are moving to the Standard channel and are now considered generally available:

Additionally, the ReferenceGrant resource is moving to v1.

Experimental

  • Gateway/HTTPRoute level authentication (GEP-1494)

Full Changelog

Full Changelog: https://github.com/kubernetes-sigs/gateway-api/compare/v1.4.1...v1.5.0

Dependencies

Added

  • github.com/Masterminds/semver/v3: v3.4.0
  • github.com/chzyer/readline: v1.5.1
  • github.com/gkampitakis/ciinfo: v0.3.2
  • github.com/gkampitakis/go-diff: v1.3.2
  • github.com/gkampitakis/go-snaps: v0.5.15
  • github.com/ianlancetaylor/demangle: f615e6b
  • github.com/joshdk/go-junit: v1.0.0
  • github.com/maruel/natural: v1.1.1
  • github.com/mfridman/tparse: v0.18.0
  • github.com/tidwall/gjson: v1.18.0
  • github.com/tidwall/match: v1.1.1
  • github.com/tidwall/pretty: v1.2.1
  • github.com/tidwall/sjson: v1.2.5

Changed

  • cloud.google.com/go/compute/metadata: v0.7.0 → v0.9.0
  • github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp: v1.29.0 → v1.30.0
  • github.com/cncf/xds/go: 2ac532f → 0feb691
  • github.com/envoyproxy/go-control-plane/envoy: v1.32.4 → v1.35.0
  • github.com/envoyproxy/go-control-plane: v0.13.4 → 75eaa19
  • github.com/go-jose/go-jose/v4: v4.1.1 → v4.1.3
  • github.com/google/pprof: d1b30fe → 294ebfa
  • github.com/mailru/easyjson: v0.9.0 → v0.9.1
  • github.com/miekg/dns: v1.1.68 → v1.1.72
  • github.com/onsi/ginkgo/v2: v2.22.0 → v2.28.0
  • github.com/onsi/gomega: v1.38.1 → v1.39.1
  • github.com/prometheus/client_golang: v1.23.0 → v1.23.2
  • github.com/prometheus/common: v0.65.0 → v0.66.1
  • github.com/prometheus/procfs: v0.17.0 → v0.19.2
  • github.com/rogpeppe/go-internal: v1.13.1 → v1.14.1
  • github.com/spf13/cobra: v1.9.1 → v1.10.2
  • github.com/spf13/pflag: v1.0.7 → v1.0.10
  • github.com/spiffe/go-spiffe/v2: v2.5.0 → v2.6.0
  • github.com/stretchr/testify: v1.11.0 → v1.11.1
  • go.etcd.io/bbolt: v1.4.2 → v1.4.3
  • go.etcd.io/etcd/api/v3: v3.6.4 → v3.6.5
  • go.etcd.io/etcd/client/pkg/v3: v3.6.4 → v3.6.5
  • go.etcd.io/etcd/client/v3: v3.6.4 → v3.6.5
  • go.etcd.io/etcd/pkg/v3: v3.6.4 → v3.6.5
  • go.etcd.io/etcd/server/v3: v3.6.4 → v3.6.5
  • go.opentelemetry.io/auto/sdk: v1.1.0 → v1.2.1
  • go.opentelemetry.io/contrib/detectors/gcp: v1.36.0 → v1.38.0
  • go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: v0.58.0 → v0.61.0
  • go.opentelemetry.io/otel/metric: v1.37.0 → v1.38.0
  • go.opentelemetry.io/otel/sdk/metric: v1.37.0 → v1.38.0
  • go.opentelemetry.io/otel/sdk: v1.37.0 → v1.38.0
  • go.opentelemetry.io/otel/trace: v1.37.0 → v1.38.0
  • go.opentelemetry.io/otel: v1.37.0 → v1.38.0
  • go.opentelemetry.io/proto/otlp: v1.5.0 → v1.7.0
  • go.uber.org/zap: v1.27.0 → v1.27.1
  • go.yaml.in/yaml/v2: v2.4.2 → v2.4.3
  • golang.org/x/crypto: v0.41.0 → v0.47.0
  • golang.org/x/mod: v0.27.0 → v0.32.0
  • golang.org/x/net: v0.43.0 → v0.49.0
  • golang.org/x/oauth2: v0.30.0 → v0.34.0
  • golang.org/x/sync: v0.16.0 → v0.19.0
  • golang.org/x/sys: v0.35.0 → v0.40.0
  • golang.org/x/telemetry: 1a19826 → bd525da
  • golang.org/x/term: v0.34.0 → v0.39.0
  • golang.org/x/text: v0.28.0 → v0.33.0
  • golang.org/x/time: v0.12.0 → v0.14.0
  • golang.org/x/tools: v0.36.0 → v0.41.0
  • google.golang.org/genproto/googleapis/api: 8d1bb00 → ab9386a
  • google.golang.org/genproto/googleapis/rpc: ef028d9 → ab9386a
  • google.golang.org/grpc: v1.75.1 → v1.78.0
  • google.golang.org/protobuf: v1.36.8 → v1.36.11
  • k8s.io/api: v0.34.1 → v0.35.1
  • k8s.io/apiextensions-apiserver: v0.34.1 → v0.35.1
  • k8s.io/apimachinery: v0.34.1 → v0.35.1
  • k8s.io/apiserver: v0.34.1 → v0.35.1
  • k8s.io/client-go: v0.34.1 → v0.35.1
  • k8s.io/code-generator: v0.34.1 → v0.35.1
  • k8s.io/component-base: v0.34.1 → v0.35.1
  • k8s.io/gengo/v2: c297c0c → ec3ebc5
  • k8s.io/kms: v0.34.1 → v0.35.1
  • k8s.io/kube-openapi: d7b6acb → 589584f
  • k8s.io/utils: 0af2bda → 914a6e7
  • sigs.k8s.io/controller-runtime: v0.22.1 → v0.23.1
  • sigs.k8s.io/controller-tools: v0.19.0 → v0.20.1
  • sigs.k8s.io/structured-merge-diff/v6: v6.3.0 → v6.3.2

Removed

  • github.com/kisielk/errcheck: v1.5.0
  • github.com/kisielk/gotool: v1.0.0
  • github.com/pkg/errors: v0.9.1
  • github.com/zeebo/errs: v1.4.0
  • golang.org/x/xerrors: 5ec99f8