Merge branch 'main' into fix-6752

Author: zirain

.github/workflows/build_and_test.yaml

@@ -86,6 +86,28 @@ jobs:
         verbose: true
         use_oidc: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) }}
 
+  go-benchmark-test:
+    runs-on: ubuntu-latest
+    needs:
+    - changes
+    if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.run_test_workflow == 'true' }}
+    steps:
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
+      with:
+        fetch-depth: 0  # Need main branch access for benchmark comparison
+    - uses: ./tools/github-actions/setup-deps
+
+    - name: Install benchstat
+      run: go install golang.org/x/perf/cmd/benchstat@latest
+    - name: Run Benchmark Comparison
+      continue-on-error: true
+      run: |
+        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+          ./tools/hack/go-benchmark-compare.sh
+        else
+          make go-benchmark
+        fi
+
   build:
     runs-on: ubuntu-latest
     needs: [changes, lint, gen-check, license-check, coverage-test]
@@ -335,7 +357,4 @@ jobs:
     steps:
     - run: |
         echo "CI checks completed"
-        [ "${{
-            contains(needs.*.result, 'failure') ||
-            contains(needs.*.result, 'cancelled')
-          }}" == "false" ] || exit 1
+        [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "false" ] || exit 1

api/v1alpha1/tls_types.go

@@ -75,6 +75,9 @@ type TLSSettings struct {
 	// 2. Other Routes: ALPN is disabled.
 	// 3. Backends: proxy uses the appropriate ALPN options for the backend protocol.
 	// When an empty list is provided, the ALPN TLS extension is disabled.
+	//
+	// Defaults to [h2, http/1.1] if not specified.
+	//
 	// Typical Supported values are:
 	// - http/1.0
 	// - http/1.1

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -935,6 +935,9 @@ spec:
                       2. Other Routes: ALPN is disabled.
                       3. Backends: proxy uses the appropriate ALPN options for the backend protocol.
                       When an empty list is provided, the ALPN TLS extension is disabled.
+
+                      Defaults to [h2, http/1.1] if not specified.
+
                       Typical Supported values are:
                       - http/1.0
                       - http/1.1

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml

@@ -58,6 +58,9 @@ spec:
                       2. Other Routes: ALPN is disabled.
                       3. Backends: proxy uses the appropriate ALPN options for the backend protocol.
                       When an empty list is provided, the ALPN TLS extension is disabled.
+
+                      Defaults to [h2, http/1.1] if not specified.
+
                       Typical Supported values are:
                       - http/1.0
                       - http/1.1

charts/gateway-helm/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -934,6 +934,9 @@ spec:
                       2. Other Routes: ALPN is disabled.
                       3. Backends: proxy uses the appropriate ALPN options for the backend protocol.
                       When an empty list is provided, the ALPN TLS extension is disabled.
+
+                      Defaults to [h2, http/1.1] if not specified.
+
                       Typical Supported values are:
                       - http/1.0
                       - http/1.1

charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml

@@ -57,6 +57,9 @@ spec:
                       2. Other Routes: ALPN is disabled.
                       3. Backends: proxy uses the appropriate ALPN options for the backend protocol.
                       When an empty list is provided, the ALPN TLS extension is disabled.
+
+                      Defaults to [h2, http/1.1] if not specified.
+
                       Typical Supported values are:
                       - http/1.0
                       - http/1.1

internal/cmd/certgen.go

@@ -137,8 +137,8 @@ func patchTopologyInjectorWebhook(ctx context.Context, cli client.Client, cfg *c
 
 	var updated bool
 	desiredBundle := current.Data["ca.crt"]
-	for i, webhook := range webhookCfg.Webhooks {
-		if !bytes.Equal(desiredBundle, webhook.ClientConfig.CABundle) {
+	for i := range webhookCfg.Webhooks {
+		if !bytes.Equal(desiredBundle, webhookCfg.Webhooks[i].ClientConfig.CABundle) {
 			webhookCfg.Webhooks[i].ClientConfig.CABundle = desiredBundle
 			updated = true
 		}

internal/cmd/egctl/config.go

@@ -125,10 +125,10 @@ func fetchRunningEnvoyPods(c kube.CLIClient, nn types.NamespacedName, labelSelec
 		if err != nil {
 			return nil, err
 		}
-		for _, i := range namespaces.Items {
-			podList, err := c.PodsForSelector(i.Name, proxy.EnvoyAppLabelSelector()...)
+		for i := range namespaces.Items {
+			podList, err := c.PodsForSelector(namespaces.Items[i].Name, proxy.EnvoyAppLabelSelector()...)
 			if err != nil {
-				return nil, fmt.Errorf("list pods failed in ns %s: %w", i.Name, err)
+				return nil, fmt.Errorf("list pods failed in ns %s: %w", namespaces.Items[i].Name, err)
 			}
 
 			if len(podList.Items) == 0 {
@@ -170,9 +170,9 @@ func fetchRunningEnvoyPods(c kube.CLIClient, nn types.NamespacedName, labelSelec
 	}
 
 	podsNamespacedNames := make([]types.NamespacedName, 0, len(pods))
-	for _, pod := range pods {
-		podNsName := utils.NamespacedName(&pod)
-		if pod.Status.Phase != "Running" {
+	for i := range pods {
+		podNsName := utils.NamespacedName(&pods[i])
+		if pods[i].Status.Phase != "Running" {
 			return podsNamespacedNames, fmt.Errorf("pod %s is not running", podNsName)
 		}
 

internal/cmd/egctl/config_ratelimit.go

@@ -106,14 +106,14 @@ func fetchRunningRateLimitPods(cli kubernetes.CLIClient, namespace string, label
 	}
 
 	rlNN := []types.NamespacedName{}
-	for _, rlPod := range rlPods.Items {
+	for i := range rlPods.Items {
 		rlPodNsName := types.NamespacedName{
-			Namespace: rlPod.Namespace,
-			Name:      rlPod.Name,
+			Namespace: rlPods.Items[i].Namespace,
+			Name:      rlPods.Items[i].Name,
 		}
 
 		// Check that the rate limit pod is ready properly and can accept external traffic
-		if !checkRateLimitPodStatusReady(rlPod.Status) {
+		if !checkRateLimitPodStatusReady(&rlPods.Items[i].Status) {
 			continue
 		}
 
@@ -127,7 +127,7 @@ func fetchRunningRateLimitPods(cli kubernetes.CLIClient, namespace string, label
 }
 
 // checkRateLimitPodStatusReady Check that the rate limit pod is ready
-func checkRateLimitPodStatusReady(status corev1.PodStatus) bool {
+func checkRateLimitPodStatusReady(status *corev1.PodStatus) bool {
 	if status.Phase != corev1.PodRunning {
 		return false
 	}

internal/cmd/egctl/config_test.go

@@ -520,7 +520,7 @@ func TestCheckRateLimitPodStatusReady(t *testing.T) {
 
 	for _, tc := range cases {
 		t.Run(tc.caseName, func(t *testing.T) {
-			actual := checkRateLimitPodStatusReady(tc.status)
+			actual := checkRateLimitPodStatusReady(&tc.status)
 			require.Equal(t, tc.expect, actual)
 		})
 	}