Skip to content

feat: support Gateway API 1.6.0 #431

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AlinsRan wants to merge 9 commits into
base: master
Choose a base branch
from
Open

feat: support Gateway API 1.6.0 #431

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
ed6bb92
feat: support Gateway API 1.6.0
AlinsRan Jul 15, 2026
cbb4c43
fix: CI compatibility for Gateway API 1.6.0 CRDs
AlinsRan Jul 15, 2026
2a53041
fix: webhook validators panic on Gateway API 1.6 upgrade
AlinsRan Jul 15, 2026
e2a9587
fix: add required Implementation.Contact to conformance report
AlinsRan Jul 15, 2026
f8c64f9
test: use Gateway-level frontendValidation in downstream mTLS e2e
AlinsRan Jul 15, 2026
0a3442b
fix: bump kind node image to k8s 1.32 for Gateway API 1.6 CRDs
AlinsRan Jul 16, 2026
cf43a47
test: force IPv4 for APISIX TCP tunnel endpoint
AlinsRan Jul 16, 2026
6d34288
test: use WebSocket-capable port-forward for the TCP tunnel
AlinsRan Jul 16, 2026
4014fd0
test: make the WebSocket TCP tunnel self-healing
AlinsRan Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/apisix-conformance-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,10 +52,10 @@ jobs:
- name: Setup Go Env
uses: actions/setup-go@v4
with:
go-version: "1.24"
go-version: "1.26"
- name: Install kind
run: |
go install sigs.k8s.io/kind@v0.23.0
go install sigs.k8s.io/kind@v0.27.0

- name: Login to Registry
uses: docker/login-action@v3
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/apisix-e2e-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ jobs:
- name: Setup Go Env
uses: actions/setup-go@v4
with:
go-version: "1.24"
go-version: "1.26"

- name: Login to Registry
uses: docker/login-action@v3
Expand All @@ -70,7 +70,7 @@ jobs:

- name: Install kind
run: |
go install sigs.k8s.io/kind@v0.23.0
go install sigs.k8s.io/kind@v0.27.0

- name: Install ginkgo
run: |
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/conformance-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,11 +47,11 @@ jobs:
- name: Setup Go Env
uses: actions/setup-go@v4
with:
go-version: "1.24"
go-version: "1.26"

- name: Install kind
run: |
go install sigs.k8s.io/kind@v0.23.0
go install sigs.k8s.io/kind@v0.27.0

- name: Install Helm
run: |
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/e2e-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,11 +53,11 @@ jobs:
- name: Setup Go Env
uses: actions/setup-go@v4
with:
go-version: "1.24"
go-version: "1.26"

- name: Install kind
run: |
go install sigs.k8s.io/kind@v0.23.0
go install sigs.k8s.io/kind@v0.27.0

- name: Install Helm
run: |
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/golangci-lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:
- name: Setup Go Env
uses: actions/setup-go@v4
with:
go-version: "1.24"
go-version: "1.26"

- name: check go path for debug
run: go env
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/lint-checker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ jobs:
- name: Setup Go Env
uses: actions/setup-go@v4
with:
go-version: "1.24"
go-version: "1.26"
- name: run gofmt
working-directory: ./
run: |
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/push-docker-v2-dev.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ jobs:
- name: Setup Go Env
uses: actions/setup-go@v4
with:
go-version: "1.24"
go-version: "1.26"

# - name: Set up QEMU
# uses: docker/setup-qemu-action@v3
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/push-docker.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:
- name: Setup Go Env
uses: actions/setup-go@v4
with:
go-version: "1.24"
go-version: "1.26"

- name: Set up QEMU
uses: docker/setup-qemu-action@v3
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/unit-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ jobs:
- name: Setup Go Env
uses: actions/setup-go@v4
with:
go-version: "1.24"
go-version: "1.26"
- name: Run unit test
working-directory: ./
run: |
Expand Down
23 changes: 23 additions & 0 deletions .golangci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,10 @@
version: "2"
run:
allow-parallel-runners: true
# Pin the analysis target Go version: the go.mod directive is 1.26 (required by
# k8s.io 0.36 / gateway-api 1.6), but the released golangci-lint binary is built
# with an older Go and refuses to target a newer one.
go: "1.24"
linters:
default: none
enable:
Expand Down Expand Up @@ -57,6 +61,25 @@ linters:
- staticcheck
text: "ST1001:"
path: test/.*
# kubebuilder-generated scaffold: controller-runtime v0.24 deprecated
# scheme.Builder, but the generated group-version files still rely on it.
- linters:
- staticcheck
text: "SA1019:.*scheme.Builder"
path: api/.*/groupversion_info.go
# corev1.Endpoints/EndpointSubset are deprecated in k8s v1.33+, but the
# controller still uses them intentionally for endpoint discovery; the
# EndpointSlice migration is tracked separately.
- linters:
- staticcheck
text: 'SA1019:.*corev1\.(Endpoints|EndpointSubset)'
# controller-runtime v0.24 deprecated WithCustomValidator in favour of the
# generic WithValidator, but that path decodes via the generic type and
# panics for our runtime.Object-typed CustomValidators; keep the working API.
- linters:
- staticcheck
text: "WithCustomValidator is deprecated"
path: internal/webhook/.*
paths:
- third_party$
- builtin$
Expand Down
18 changes: 11 additions & 7 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ IMG ?= api7/api7-ingress-controller:$(IMAGE_TAG)
# ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
ENVTEST_K8S_VERSION = 1.30.0
KIND_NAME ?= apisix-ingress-cluster
KIND_NODE_IMAGE ?= kindest/node:v1.30.0@sha256:047357ac0cfea04663786a612ba1eaba9702bef25227a794b52890dd8bcd692e
KIND_NODE_IMAGE ?= kindest/node:v1.32.2@sha256:f226345927d7e348497136874b6d207e0b32cc52154ad8323129352923a3142f

DASHBOARD_VERSION ?= dev
ADC_VERSION ?= 0.22.1
Expand Down Expand Up @@ -55,11 +55,11 @@ BUILDOSSYM="github.com/apache/apisix-ingress-controller/internal/version._buildO
GO_LDFLAGS ?= "-X=$(VERSYM)=$(VERSION) -X=$(GITSHASYM)=$(GITSHA) -X=$(BUILDOSSYM)=$(OSNAME)/$(OSARCH)"

# gateway-api
GATEAY_API_VERSION ?= v1.3.0
## https://github.com/kubernetes-sigs/gateway-api/blob/v1.3.0/pkg/features/httproute.go
GATEAY_API_VERSION ?= v1.6.0
## https://github.com/kubernetes-sigs/gateway-api/blob/v1.6.0/pkg/features/httproute.go
SUPPORTED_EXTENDED_FEATURES = "HTTPRouteDestinationPortMatching,HTTPRouteMethodMatching,HTTPRoutePortRedirect,HTTPRouteRequestMirror,HTTPRouteSchemeRedirect,GatewayAddressEmpty,HTTPRouteResponseHeaderModification,GatewayPort8080,HTTPRouteHostRewrite,HTTPRouteQueryParamMatching,HTTPRoutePathRewrite,HTTPRouteBackendProtocolWebSocket"
CONFORMANCE_TEST_REPORT_OUTPUT ?= $(DIR)/apisix-ingress-controller-conformance-report.yaml
## https://github.com/kubernetes-sigs/gateway-api/blob/v1.3.0/conformance/utils/suite/profiles.go
## https://github.com/kubernetes-sigs/gateway-api/blob/v1.6.0/conformance/utils/suite/profiles.go
CONFORMANCE_PROFILES ?= GATEWAY-HTTP,GATEWAY-GRPC,GATEWAY-TLS

# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
Expand Down Expand Up @@ -328,7 +328,9 @@ endif

.PHONY: install-gateway-api
install-gateway-api: ## Install Gateway API CRDs into the K8s cluster specified in ~/.kube/config.
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/$(GATEAY_API_VERSION)/experimental-install.yaml
# Server-side apply: the v1.6 CRDs exceed the 262144-byte annotation limit of
# client-side apply (last-applied-configuration).
kubectl apply --server-side --force-conflicts -f https://github.com/kubernetes-sigs/gateway-api/releases/download/$(GATEAY_API_VERSION)/experimental-install.yaml

.PHONY: uninstall-gateway-api
uninstall-gateway-api: ## Uninstall Gateway API CRDs from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
Expand Down Expand Up @@ -374,7 +376,7 @@ ADC_BIN ?= $(LOCALBIN)/adc
KUSTOMIZE_VERSION ?= v5.4.2
CONTROLLER_TOOLS_VERSION ?= v0.17.2
ENVTEST_VERSION ?= release-0.18
GOLANGCI_LINT_VERSION ?= v2.1.5
GOLANGCI_LINT_VERSION ?= v2.7.1

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rg -n 'GOLANGCI_LINT_VERSION|golangci-lint/v2/cmd' Makefile
curl -fsSL https://api.github.com/repos/golangci/golangci-lint/pulls/6271 \
  | jq -e '.merged_at != null'
curl -fsSL https://api.github.com/repos/golangci/golangci-lint/releases/tags/v2.9.0 \
  | jq -e '.tag_name == "v2.9.0"'

Repository: api7/api7-ingress-controller

Length of output: 379

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

sed -n '368,408p' Makefile

Repository: api7/api7-ingress-controller

Length of output: 1774

🌐 Web query:

golangci-lint v2.7.1 Go 1.26 support v2.9.0 changelog

💡 Result:

Golangci-lint version 2.9.0, released on February 10, 2026, officially introduced support for Go 1.26 [1][2]. Regarding golangci-lint v2.7.1: This version was released on December 4, 2025 [3]. It does not include support for Go 1.26, as that support was added in the later v2.9.0 release [1][2]. As a general rule, golangci-lint supports Go versions lower than or equal to the version of Go used to compile the specific binary [4][5][6]. To check the Go version used to build your currently installed version of golangci-lint, you can run the command golangci-lint version [5].

Citations:

Bump GOLANGCI_LINT_VERSION to a Go 1.26-capable release.
v2.7.1 predates Go 1.26 support; pin v2.9.0 or later so the source-built golangci-lint can type-check this module.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Makefile` at line 377, Update the GOLANGCI_LINT_VERSION setting to v2.9.0 or
a later release that supports Go 1.26, while preserving the existing
source-build configuration.


## export PATH so that the tools are found
export PATH := $(LOCALBIN):$(PATH)
Expand All @@ -397,7 +399,9 @@ $(ENVTEST): $(LOCALBIN)
.PHONY: golangci-lint
golangci-lint: $(GOLANGCI_LINT) ## Download golangci-lint locally if necessary.
$(GOLANGCI_LINT): $(LOCALBIN)
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b $(LOCALBIN) $(GOLANGCI_LINT_VERSION)
# Build from source with the local Go toolchain: the prebuilt release binary is
# compiled with an older Go and panics type-checking a go 1.26 module.
$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/v2/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))

.PHONY: adc
adc: $(ADC_BIN) ## Download adc locally if necessary.
Expand Down
4 changes: 2 additions & 2 deletions api/v1alpha1/httproutepolicy_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,15 +20,15 @@ package v1alpha1
import (
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
gatewayv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
)

// HTTPRoutePolicySpec defines the desired state of HTTPRoutePolicy.
type HTTPRoutePolicySpec struct {
// TargetRef identifies an API object (i.e. HTTPRoute, Ingress) to apply HTTPRoutePolicy to.
// +kubebuilder:validation:MinItems=1
// +kubebuilder:validation:MaxItems=16
TargetRefs []gatewayv1alpha2.LocalPolicyTargetReferenceWithSectionName `json:"targetRefs"`
TargetRefs []gatewayv1.LocalPolicyTargetReferenceWithSectionName `json:"targetRefs"`
// Priority sets the priority for route. when multiple routes have the same URI path,
// a higher value sets a higher priority in route matching.
Priority *int64 `json:"priority,omitempty" yaml:"priority,omitempty"`
Expand Down
4 changes: 2 additions & 2 deletions api/v1alpha1/l4routepolicy_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ package v1alpha1

import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
gatewayv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
)

// L4RoutePolicySpec defines the desired state of L4RoutePolicy.
Expand All @@ -31,7 +31,7 @@ type L4RoutePolicySpec struct {
// +kubebuilder:validation:MaxItems=16
// +kubebuilder:validation:XValidation:rule="self.all(r, r.kind == 'TCPRoute' || r.kind == 'UDPRoute' || r.kind == 'TLSRoute')",message="targetRefs kind must be TCPRoute, UDPRoute, or TLSRoute"
// +kubebuilder:validation:XValidation:rule="self.all(r, r.group == 'gateway.networking.k8s.io')",message="targetRefs group must be gateway.networking.k8s.io"
TargetRefs []gatewayv1alpha2.LocalPolicyTargetReferenceWithSectionName `json:"targetRefs"`
TargetRefs []gatewayv1.LocalPolicyTargetReferenceWithSectionName `json:"targetRefs"`

// Plugins is the list of APISIX stream plugins to attach to the targeted L4 routes.
// Plugin names should be valid APISIX stream plugin names (e.g., limit-conn, ip-restriction).
Expand Down
6 changes: 3 additions & 3 deletions api/v1alpha1/policies_type.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,9 @@

package v1alpha1

import gatewayv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
import gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"

type PolicyStatus gatewayv1alpha2.PolicyStatus
type PolicyStatus gatewayv1.PolicyStatus

// +kubebuilder:validation:XValidation:rule="self.kind == 'Service' && self.group == \"\""
type BackendPolicyTargetReferenceWithSectionName gatewayv1alpha2.LocalPolicyTargetReferenceWithSectionName
type BackendPolicyTargetReferenceWithSectionName gatewayv1.LocalPolicyTargetReferenceWithSectionName
12 changes: 6 additions & 6 deletions api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

36 changes: 34 additions & 2 deletions config/crd/bases/apisix.apache.org_backendtrafficpolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -590,8 +590,38 @@ spec:
- name
type: object
conditions:
description: Conditions describes the status of the Policy with
respect to the given Ancestor.
description: |-
Conditions describes the status of the Policy with respect to the given Ancestor.

<gateway:util:excludeFromCRD>

Notes for implementors:

Conditions are a listType `map`, which means that they function like a
map with a key of the `type` field _in the k8s apiserver_.

This means that implementations must obey some rules when updating this
section.

* Implementations MUST perform a read-modify-write cycle on this field
before modifying it. That is, when modifying this field, implementations
must be confident they have fetched the most recent version of this field,
and ensure that changes they make are on that recent version.
* Implementations MUST NOT remove or reorder Conditions that they are not
directly responsible for. For example, if an implementation sees a Condition
with type `special.io/SomeField`, it MUST NOT remove, change or update that
Condition.
* Implementations MUST always _merge_ changes into Conditions of the same Type,
rather than creating more than one Condition of the same Type.
* Implementations MUST always update the `observedGeneration` field of the
Condition to the `metadata.generation` of the Gateway at the time of update creation.
* If the `observedGeneration` of a Condition is _greater than_ the value the
implementation knows about, then it MUST NOT perform the update on that Condition,
but must wait for a future reconciliation and status update. (The assumption is that
the implementation's copy of the object is stale and an update will be re-triggered
if relevant.)

</gateway:util:excludeFromCRD>
items:
description: Condition contains details for one aspect of
the current state of this API Resource.
Expand Down Expand Up @@ -674,10 +704,12 @@ spec:
type: string
required:
- ancestorRef
- conditions
- controllerName
type: object
maxItems: 16
type: array
x-kubernetes-list-type: atomic
required:
- ancestors
type: object
Expand Down
Loading
Loading