fix: read L4 routes and ReferenceGrant as v1 instead of the older versions - #456
Merged
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 4 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (13)
📝 WalkthroughWalkthroughGateway API route and ChangesGateway API v1 migration
Estimated code review effort: 3 (Moderate) | ~30 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
internal/controller/utils.go (1)
1509-1520: 🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy liftPropagate ReferenceGrant list errors.
If
cli.Listfails,checkReferenceGrantreturnsfalse. Callers then treat an API or RBAC failure as a missingReferenceGrant. They can reportRefNotPermittedand skip a valid cross-namespace reference.Return the list error from
checkReferenceGrant. Propagate it through reconciliation so controller-runtime can retry.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/controller/utils.go` around lines 1509 - 1520, Change checkReferenceGrant to return the cli.List error instead of converting failures to false, then update every caller in reconciliation to propagate that error to controller-runtime for retry while preserving the existing permission result for successful list operations.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/utils/cluster_test.go`:
- Around line 269-270: Update both discovery handler write calls in the test,
including the handlers around the TCPRoute response and the additional location
noted, to check and handle the error returned by http.ResponseWriter.Write
instead of discarding it. Follow the surrounding test error-handling convention
and ensure failed mock responses cause the test to fail.
---
Outside diff comments:
In `@internal/controller/utils.go`:
- Around line 1509-1520: Change checkReferenceGrant to return the cli.List error
instead of converting failures to false, then update every caller in
reconciliation to propagate that error to controller-runtime for retry while
preserving the existing permission result for successful list operations.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 8414d01d-1ead-4d96-8da0-dbd0f7e2517a
📒 Files selected for processing (44)
config/webhook/manifests.yamldocs/en/latest/concepts/gateway-api.mdexamples/httpbin/tcproute.yamlinternal/adc/translator/l4route_test.gointernal/adc/translator/policies.gointernal/adc/translator/tcproute.gointernal/adc/translator/tlsroute.gointernal/adc/translator/udproute.gointernal/controller/consumer_controller_test.gointernal/controller/gateway_controller.gointernal/controller/gateway_controller_refgrant_test.gointernal/controller/grpcroute_controller.gointernal/controller/httproute_controller.gointernal/controller/indexer/indexer.gointernal/controller/indexer/tlsroute.gointernal/controller/policies.gointernal/controller/tcproute_controller.gointernal/controller/tlsroute_controller.gointernal/controller/udproute_controller.gointernal/controller/utils.gointernal/controller/utils_listenerstatus_test.gointernal/controller/utils_parentref_test.gointernal/manager/controllers.gointernal/manager/run.gointernal/provider/api7ee/provider.gointernal/provider/api7ee/status.gointernal/provider/apisix/provider.gointernal/provider/apisix/status.gointernal/types/k8s.gointernal/types/route_adapter.gointernal/webhook/v1/consumer_webhook_test.gointernal/webhook/v1/ownership.gointernal/webhook/v1/tcproute_webhook.gointernal/webhook/v1/tcproute_webhook_test.gointernal/webhook/v1/udproute_webhook.gointernal/webhook/v1/udproute_webhook_test.gopkg/utils/cluster_test.gotest/e2e/framework/manifests/webhook.yamltest/e2e/gatewayapi/gateway.gotest/e2e/gatewayapi/tcproute.gotest/e2e/gatewayapi/tlsroute.gotest/e2e/gatewayapi/udproute.gotest/e2e/scaffold/k8s.gotest/e2e/webhook/helpers.go
💤 Files with no reviewable changes (1)
- test/e2e/scaffold/k8s.go
Comment on lines
+269
to
270
| _, _ = w.Write([]byte(`{"kind":"APIResourceList","groupVersion":"gateway.networking.k8s.io/v1",` + | ||
| `"resources":[{"name":"tcproutes","kind":"TCPRoute"}]}`)) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Check errors returned by w.Write.
Both discovery handlers discard the error returned by http.ResponseWriter.Write. Check the error so a failed mock response cannot be silently accepted.
As per coding guidelines, every function return value must be checked for errors.
Also applies to: 278-279
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/utils/cluster_test.go` around lines 269 - 270, Update both discovery
handler write calls in the test, including the handlers around the TCPRoute
response and the additional location noted, to check and handle the error
returned by http.ResponseWriter.Write instead of discarding it. Follow the
surrounding test error-handling convention and ensure failed mock responses
cause the test to fail.
Source: Coding guidelines
…sions Sync of apache/apisix-ingress-controller#2839. Gateway API 1.6 promoted TCPRoute, UDPRoute and TLSRoute to v1 and deprecated v1alpha2, but the controller still registered, watched, indexed and validated all three through sigs.k8s.io/gateway-api/apis/v1alpha2. That is not only a deprecation warning on every informer re-list. In the 1.6 standard channel CRDs the v1alpha2 version is `served: false`, so for anyone who installs that channel the CRD probe in setupGatewayAPIControllers finds nothing and the three L4 reconcilers are silently skipped -- L4 routing does not work at all. Our own Makefile installs the experimental channel, which still serves v1alpha2, which is why CI never caught it. Envoy Gateway hit the same failure with TLSRoute (envoyproxy/gateway#8326). Switch every reference to apis/v1: scheme registration, the CRD probe, the field indexers, the three reconcilers, the translator, the status writers for both the APISIX and API7 EE providers, the route adapters and the TCPRoute/UDPRoute validating webhooks. The v1alpha2 rule and status types are already aliases of their v1 counterparts, so this is a version switch rather than a behavior change. ReferenceGrant moves to v1 as well. That one is not urgent -- v1beta1 is not deprecated and remains the storage version -- but every symbol used from apis/v1beta1 exists in apis/v1, so reading it through the version the API now leads with is free. The webhook paths move from /validate-gateway-networking-k8s-io-v1alpha2-* to -v1-*, config/webhook/manifests.yaml is regenerated to match, and the hand-written e2e webhook manifest is synced by hand. Manifests that still declare an older version keep working wherever the installed CRDs serve it, since the API server converts them before they reach the informer. Examples, e2e manifests and the docs support table now use v1. BREAKING CHANGE: L4 routing now requires Gateway API 1.6 or later, which is the first release that serves the v1 versions of TCPRoute, UDPRoute and TLSRoute.
AlinsRan
force-pushed
the
feat/l4route-refgrant-v1
branch
from
August 10, 2026 08:35
6ff8456 to
e4076ad
Compare
Contributor
conformance test report - apisix-standalone modeapiVersion: gateway.networking.k8s.io/v1
date: "2026-08-10T08:43:38Z"
gatewayAPIChannel: experimental
gatewayAPIVersion: v1.6.0
implementation:
contact:
- https://github.com/apache/apisix-ingress-controller/issues
organization: APISIX
project: apisix-ingress-controller
url: https://github.com/apache/apisix-ingress-controller.git
version: v2.0.0
kind: ConformanceReport
mode: default
profiles:
- core:
result: partial
skippedTests:
- HTTPRouteHTTPSListener
- HTTPRouteInvalidBackendRefUnknownKind
- HTTPRouteInvalidCrossNamespaceBackendRef
- HTTPRouteInvalidNonExistentBackendRef
- HTTPRouteListenerHostnameMatching
- HTTPRouteMultipleGateways
- HTTPRouteNoBackendRefs
statistics:
Failed: 0
Passed: 30
Skipped: 7
extended:
result: partial
skippedTests:
- HTTPRouteRedirectPortAndScheme
statistics:
Failed: 0
Passed: 12
Skipped: 1
supportedFeatures:
- GatewayAddressEmpty
- GatewayPort8080
- HTTPRouteBackendProtocolWebSocket
- HTTPRouteDestinationPortMatching
- HTTPRouteHostRewrite
- HTTPRouteMethodMatching
- HTTPRoutePathRewrite
- HTTPRoutePortRedirect
- HTTPRouteQueryParamMatching
- HTTPRouteRequestMirror
- HTTPRouteResponseHeaderModification
- HTTPRouteSchemeRedirect
unsupportedFeatures:
- BackendTLSPolicy
- BackendTLSPolicySANValidation
- GatewayBackendClientCertificate
- GatewayFrontendClientCertificateValidation
- GatewayFrontendClientCertificateValidationInsecureFallback
- GatewayHTTPListenerIsolation
- GatewayHTTPSListenerDetectMisdirectedRequests
- GatewayInfrastructurePropagation
- GatewayStaticAddresses
- HTTPRoute303RedirectStatusCode
- HTTPRoute307RedirectStatusCode
- HTTPRoute308RedirectStatusCode
- HTTPRouteBackendProtocolH2C
- HTTPRouteBackendRequestHeaderModification
- HTTPRouteBackendTimeout
- HTTPRouteCORS
- HTTPRouteNamedRouteRule
- HTTPRouteParentRefPort
- HTTPRoutePathRedirect
- HTTPRouteRequestMultipleMirrors
- HTTPRouteRequestPercentageMirror
- HTTPRouteRequestTimeout
- HTTPRouteRetry
- HTTPRouteRetryBackendTimeout
- HTTPRouteRetryConnectionError
- ListenerSet
name: GATEWAY-HTTP
summary: Core tests partially succeeded with 7 test skips. Extended tests partially
succeeded with 1 test skips.
- core:
result: partial
skippedTests:
- GRPCRouteListenerHostnameMatching
statistics:
Failed: 0
Passed: 14
Skipped: 1
extended:
result: success
statistics:
Failed: 0
Passed: 1
Skipped: 0
supportedFeatures:
- GatewayAddressEmpty
- GatewayPort8080
unsupportedFeatures:
- GatewayBackendClientCertificate
- GatewayFrontendClientCertificateValidation
- GatewayFrontendClientCertificateValidationInsecureFallback
- GatewayHTTPListenerIsolation
- GatewayHTTPSListenerDetectMisdirectedRequests
- GatewayInfrastructurePropagation
- GatewayStaticAddresses
- ListenerSet
name: GATEWAY-GRPC
summary: Core tests partially succeeded with 1 test skips. Extended tests succeeded.
- core:
result: partial
skippedTests:
- TLSRouteHostnameIntersection
- TLSRouteInvalidBackendRefNonexistent
- TLSRouteInvalidBackendRefUnknownKind
- TLSRouteSimpleSameNamespace
statistics:
Failed: 0
Passed: 16
Skipped: 4
extended:
result: partial
skippedTests:
- TLSRouteTerminateSimpleSameNamespace
statistics:
Failed: 0
Passed: 3
Skipped: 1
supportedFeatures:
- GatewayAddressEmpty
- GatewayPort8080
- TLSRouteModeTerminate
unsupportedFeatures:
- GatewayBackendClientCertificate
- GatewayFrontendClientCertificateValidation
- GatewayFrontendClientCertificateValidationInsecureFallback
- GatewayHTTPListenerIsolation
- GatewayHTTPSListenerDetectMisdirectedRequests
- GatewayInfrastructurePropagation
- GatewayStaticAddresses
- ListenerSet
- TLSRouteModeMixed
name: GATEWAY-TLS
summary: Core tests partially succeeded with 4 test skips. Extended tests partially
succeeded with 1 test skips.
succeededProvisionalTests:
- GatewayOptionalAddressValue |
Contributor
conformance test report - apisix modeapiVersion: gateway.networking.k8s.io/v1
date: "2026-08-10T08:44:00Z"
gatewayAPIChannel: experimental
gatewayAPIVersion: v1.6.0
implementation:
contact:
- https://github.com/apache/apisix-ingress-controller/issues
organization: APISIX
project: apisix-ingress-controller
url: https://github.com/apache/apisix-ingress-controller.git
version: v2.0.0
kind: ConformanceReport
mode: default
profiles:
- core:
result: partial
skippedTests:
- HTTPRouteHTTPSListener
- HTTPRouteInvalidBackendRefUnknownKind
- HTTPRouteInvalidCrossNamespaceBackendRef
- HTTPRouteInvalidNonExistentBackendRef
- HTTPRouteListenerHostnameMatching
- HTTPRouteMultipleGateways
- HTTPRouteNoBackendRefs
statistics:
Failed: 0
Passed: 30
Skipped: 7
extended:
result: partial
skippedTests:
- HTTPRouteRedirectPortAndScheme
statistics:
Failed: 0
Passed: 12
Skipped: 1
supportedFeatures:
- GatewayAddressEmpty
- GatewayPort8080
- HTTPRouteBackendProtocolWebSocket
- HTTPRouteDestinationPortMatching
- HTTPRouteHostRewrite
- HTTPRouteMethodMatching
- HTTPRoutePathRewrite
- HTTPRoutePortRedirect
- HTTPRouteQueryParamMatching
- HTTPRouteRequestMirror
- HTTPRouteResponseHeaderModification
- HTTPRouteSchemeRedirect
unsupportedFeatures:
- BackendTLSPolicy
- BackendTLSPolicySANValidation
- GatewayBackendClientCertificate
- GatewayFrontendClientCertificateValidation
- GatewayFrontendClientCertificateValidationInsecureFallback
- GatewayHTTPListenerIsolation
- GatewayHTTPSListenerDetectMisdirectedRequests
- GatewayInfrastructurePropagation
- GatewayStaticAddresses
- HTTPRoute303RedirectStatusCode
- HTTPRoute307RedirectStatusCode
- HTTPRoute308RedirectStatusCode
- HTTPRouteBackendProtocolH2C
- HTTPRouteBackendRequestHeaderModification
- HTTPRouteBackendTimeout
- HTTPRouteCORS
- HTTPRouteNamedRouteRule
- HTTPRouteParentRefPort
- HTTPRoutePathRedirect
- HTTPRouteRequestMultipleMirrors
- HTTPRouteRequestPercentageMirror
- HTTPRouteRequestTimeout
- HTTPRouteRetry
- HTTPRouteRetryBackendTimeout
- HTTPRouteRetryConnectionError
- ListenerSet
name: GATEWAY-HTTP
summary: Core tests partially succeeded with 7 test skips. Extended tests partially
succeeded with 1 test skips.
- core:
result: partial
skippedTests:
- GRPCRouteListenerHostnameMatching
statistics:
Failed: 0
Passed: 14
Skipped: 1
extended:
result: success
statistics:
Failed: 0
Passed: 1
Skipped: 0
supportedFeatures:
- GatewayAddressEmpty
- GatewayPort8080
unsupportedFeatures:
- GatewayBackendClientCertificate
- GatewayFrontendClientCertificateValidation
- GatewayFrontendClientCertificateValidationInsecureFallback
- GatewayHTTPListenerIsolation
- GatewayHTTPSListenerDetectMisdirectedRequests
- GatewayInfrastructurePropagation
- GatewayStaticAddresses
- ListenerSet
name: GATEWAY-GRPC
summary: Core tests partially succeeded with 1 test skips. Extended tests succeeded.
- core:
result: partial
skippedTests:
- TLSRouteHostnameIntersection
- TLSRouteInvalidBackendRefNonexistent
- TLSRouteInvalidBackendRefUnknownKind
- TLSRouteSimpleSameNamespace
statistics:
Failed: 0
Passed: 16
Skipped: 4
extended:
result: partial
skippedTests:
- TLSRouteTerminateSimpleSameNamespace
statistics:
Failed: 0
Passed: 3
Skipped: 1
supportedFeatures:
- GatewayAddressEmpty
- GatewayPort8080
- TLSRouteModeTerminate
unsupportedFeatures:
- GatewayBackendClientCertificate
- GatewayFrontendClientCertificateValidation
- GatewayFrontendClientCertificateValidationInsecureFallback
- GatewayHTTPListenerIsolation
- GatewayHTTPSListenerDetectMisdirectedRequests
- GatewayInfrastructurePropagation
- GatewayStaticAddresses
- ListenerSet
- TLSRouteModeMixed
name: GATEWAY-TLS
summary: Core tests partially succeeded with 4 test skips. Extended tests partially
succeeded with 1 test skips.
succeededProvisionalTests:
- GatewayOptionalAddressValue |
Contributor
conformance test reportapiVersion: gateway.networking.k8s.io/v1
date: "2026-08-10T09:03:24Z"
gatewayAPIChannel: experimental
gatewayAPIVersion: v1.6.0
implementation:
contact:
- https://github.com/apache/apisix-ingress-controller/issues
organization: APISIX
project: apisix-ingress-controller
url: https://github.com/apache/apisix-ingress-controller.git
version: v2.0.0
kind: ConformanceReport
mode: default
profiles:
- core:
failedTests:
- GatewayModifyListeners
- HTTPRouteMultipleGateways
- HTTPRouteNoBackendRefs
result: failure
skippedTests:
- HTTPRouteHTTPSListener
statistics:
Failed: 3
Passed: 33
Skipped: 1
extended:
result: partial
skippedTests:
- HTTPRouteRedirectPortAndScheme
statistics:
Failed: 0
Passed: 12
Skipped: 1
supportedFeatures:
- GatewayAddressEmpty
- GatewayPort8080
- HTTPRouteBackendProtocolWebSocket
- HTTPRouteDestinationPortMatching
- HTTPRouteHostRewrite
- HTTPRouteMethodMatching
- HTTPRoutePathRewrite
- HTTPRoutePortRedirect
- HTTPRouteQueryParamMatching
- HTTPRouteRequestMirror
- HTTPRouteResponseHeaderModification
- HTTPRouteSchemeRedirect
unsupportedFeatures:
- BackendTLSPolicy
- BackendTLSPolicySANValidation
- GatewayBackendClientCertificate
- GatewayFrontendClientCertificateValidation
- GatewayFrontendClientCertificateValidationInsecureFallback
- GatewayHTTPListenerIsolation
- GatewayHTTPSListenerDetectMisdirectedRequests
- GatewayInfrastructurePropagation
- GatewayStaticAddresses
- HTTPRoute303RedirectStatusCode
- HTTPRoute307RedirectStatusCode
- HTTPRoute308RedirectStatusCode
- HTTPRouteBackendProtocolH2C
- HTTPRouteBackendRequestHeaderModification
- HTTPRouteBackendTimeout
- HTTPRouteCORS
- HTTPRouteNamedRouteRule
- HTTPRouteParentRefPort
- HTTPRoutePathRedirect
- HTTPRouteRequestMultipleMirrors
- HTTPRouteRequestPercentageMirror
- HTTPRouteRequestTimeout
- HTTPRouteRetry
- HTTPRouteRetryBackendTimeout
- HTTPRouteRetryConnectionError
- ListenerSet
name: GATEWAY-HTTP
summary: Core tests failed with 3 test failures. Extended tests partially succeeded
with 1 test skips.
- core:
failedTests:
- GatewayModifyListeners
result: failure
statistics:
Failed: 1
Passed: 14
Skipped: 0
extended:
result: success
statistics:
Failed: 0
Passed: 1
Skipped: 0
supportedFeatures:
- GatewayAddressEmpty
- GatewayPort8080
unsupportedFeatures:
- GatewayBackendClientCertificate
- GatewayFrontendClientCertificateValidation
- GatewayFrontendClientCertificateValidationInsecureFallback
- GatewayHTTPListenerIsolation
- GatewayHTTPSListenerDetectMisdirectedRequests
- GatewayInfrastructurePropagation
- GatewayStaticAddresses
- ListenerSet
name: GATEWAY-GRPC
summary: Core tests failed with 1 test failures. Extended tests succeeded.
- core:
failedTests:
- GatewayModifyListeners
- TLSRouteHostnameIntersection
- TLSRouteInvalidBackendRefNonexistent
- TLSRouteInvalidBackendRefUnknownKind
- TLSRouteSimpleSameNamespace
result: failure
statistics:
Failed: 5
Passed: 15
Skipped: 0
extended:
failedTests:
- TLSRouteTerminateSimpleSameNamespace
result: failure
statistics:
Failed: 1
Passed: 3
Skipped: 0
supportedFeatures:
- GatewayAddressEmpty
- GatewayPort8080
- TLSRouteModeTerminate
unsupportedFeatures:
- GatewayBackendClientCertificate
- GatewayFrontendClientCertificateValidation
- GatewayFrontendClientCertificateValidationInsecureFallback
- GatewayHTTPListenerIsolation
- GatewayHTTPSListenerDetectMisdirectedRequests
- GatewayInfrastructurePropagation
- GatewayStaticAddresses
- ListenerSet
- TLSRouteModeMixed
name: GATEWAY-TLS
summary: Core tests failed with 5 test failures. Extended tests failed with 1 test
failures.
succeededProvisionalTests:
- GatewayOptionalAddressValue |
shreemaan-abhishek
approved these changes
Aug 10, 2026
nic-6443
approved these changes
Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sync of apache/apisix-ingress-controller#2839.
Problem
Gateway API 1.6 promoted TCPRoute, UDPRoute and TLSRoute to
v1and deprecatedv1alpha2, but the controller still registers, watches, indexes and validates all three throughsigs.k8s.io/gateway-api/apis/v1alpha2. Every informer re-list logs:That warning is the visible half. The real problem is that in the 1.6 standard channel CRDs,
v1alpha2isserved: false:So for anyone installing the standard channel,
HasAPIResourceinsetupGatewayAPIControllersfinds nothing, and the TCPRoute, UDPRoute and TLSRoute reconcilers are silently skipped — L4 routing does not work at all. Ourmake install-gateway-apiinstalls the experimental channel, which still servesv1alpha2, which is why CI never caught this. Envoy Gateway hit the identical failure with TLSRoute: envoyproxy/gateway#8326.Solution
Switch every reference to
apis/v1:internal/manager/run.go) and the CRD probe (internal/manager/controllers.go)/validate-gateway-networking-k8s-io-v1alpha2-*to-v1-*,config/webhook/manifests.yamlis regenerated to match, and the hand-written e2e webhook manifest is syncedThe
v1alpha2rule and status types are already type aliases of theirv1counterparts, so this is a version switch rather than a behavior change.ReferenceGrant moves to
v1as well. That one is not urgent —v1beta1is not deprecated and remains the storage version — but every symbol used fromapis/v1beta1exists inapis/v1, so reading it through the version the API now leads with is free.User manifests that still declare an older version keep working wherever the installed CRDs serve it, because the API server converts them before they reach the informer (the Gateway API CRDs use
conversion.strategy: None, so it is a no-op version relabel). Examples, e2e manifests and the docs support table now usev1.One schema difference worth noting:
v1tightensTCPRouteSpec.RulesfromMaxItems=16toMaxItems=1. The translator iterates rules and is unaffected, and every manifest in this repo already carries a single rule.Breaking change
L4 routing now requires Gateway API 1.6 or later, the first release that serves the
v1versions of TCPRoute, UDPRoute and TLSRoute.go.modand the Makefile are already on 1.6.0.Verification
go build ./...,go vet ./...,gofmt -lcleanmake lint— 0 issuesgo test ./internal/... ./pkg/...— all packages passSummary by CodeRabbit
New Features
Documentation
Bug Fixes