Skip to content

feat(container): update image gateway-helm ( 1.7.3 → 1.8.3 ) - #3347

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/gateway-helm-1.x
Open

feat(container): update image gateway-helm ( 1.7.3 → 1.8.3 )#3347
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/gateway-helm-1.x

Conversation

@renovate

@renovate renovate Bot commented May 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
gateway-helm (source) minor 1.7.3 → 1.8.3

Release Notes

envoyproxy/gateway (gateway-helm)

v1.8.3

Compare Source

v1.8.3

Compare Source

v1.8.2

Compare Source

Release Announcement

Check out the v1.8.2 release announcement to learn more about the release.

What's Changed

Full Changelog: envoyproxy/gateway@v1.8.1...v1.8.2

v1.8.2

Compare Source

Release Announcement

Check out the v1.8.2 release announcement to learn more about the release.

What's Changed

Full Changelog: envoyproxy/gateway@v1.8.1...v1.8.2

v1.8.1

Compare Source

Release Announcement

Check out the v1.8.1 release announcement to learn more about the release.

What's Changed

Full Changelog: envoyproxy/gateway@v1.8.0...v1.8.1

v1.8.1

Compare Source

Release Announcement

Check out the v1.8.1 release announcement to learn more about the release.

What's Changed

Full Changelog: envoyproxy/gateway@v1.8.0...v1.8.1

v1.8.0

Compare Source

Release Announcement

Check out the v1.8.0 release announcement to learn more about the release.

What's Changed

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/Chicago)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

github-actions Bot commented May 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Path: infrastructure/envoy-gateway
Version: 1.7.3 -> 1.8.3

--- /tmp/tmp.ssUz3uh49s	2026-08-12 03:56:01.064742796 +0000
+++ /tmp/tmp.dy7Yu4FYaQ	2026-08-12 03:56:01.847764358 +0000
@@ -4,7 +4,7 @@
 kind: ServiceAccount
 metadata:
   name: envoy-gateway
-  namespace: 'default'
+  namespace: default
 
 ---
 # Source: envoy-gateway/charts/gateway-helm/templates/envoy-gateway-config.yaml
@@ -12,7 +12,7 @@
 kind: ConfigMap
 metadata:
   name: envoy-gateway-config
-  namespace: 'default'
+  namespace: default
 data:
   envoy-gateway.yaml: |
     apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -28,7 +28,7 @@
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:05c08d03
+            image: docker.io/envoyproxy/ratelimit:1e50889b
           patch:
             type: StrategicMerge
             value:
@@ -39,7 +39,7 @@
                     - imagePullPolicy: IfNotPresent
                       name: envoy-ratelimit
         shutdownManager:
-          image: docker.io/envoyproxy/gateway:v1.7.3
+          image: docker.io/envoyproxy/gateway:v1.8.3
       type: Kubernetes
 
 ---
@@ -140,6 +140,7 @@
       - gateway.networking.k8s.io
     resources:
       - gateways
+      - listenersets
       - grpcroutes
       - httproutes
       - referencegrants
@@ -155,6 +156,7 @@
       - gateway.networking.k8s.io
     resources:
       - gateways/status
+      - listenersets/status
       - grpcroutes/status
       - httproutes/status
       - tcproutes/status
@@ -164,20 +166,6 @@
     verbs:
       - update
   - apiGroups:
-      - gateway.networking.x-k8s.io
-    resources:
-      - xlistenersets
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - gateway.networking.x-k8s.io
-    resources:
-      - xlistenersets/status
-    verbs:
-      - update
-  - apiGroups:
       - ""
     resources:
       - pods
@@ -202,7 +190,7 @@
 subjects:
   - kind: ServiceAccount
     name: 'envoy-gateway'
-    namespace: 'default'
+    namespace: default
 
 ---
 # Source: envoy-gateway/charts/gateway-helm/templates/infra-manager-rbac.yaml
@@ -210,7 +198,7 @@
 kind: Role
 metadata:
   name: release-name-gateway-helm-infra-manager
-  namespace: 'default'
+  namespace: default
 rules:
   - apiGroups:
       - ""
@@ -225,6 +213,7 @@
       - delete
       - deletecollection
       - patch
+      - watch
   - apiGroups:
       - apps
     resources:
@@ -233,9 +222,11 @@
     verbs:
       - create
       - get
+      - list
       - delete
       - deletecollection
       - patch
+      - watch
   - apiGroups:
       - autoscaling
       - policy
@@ -249,6 +240,7 @@
       - delete
       - deletecollection
       - patch
+      - watch
   - apiGroups:
       - certificates.k8s.io
     resources:
@@ -264,7 +256,7 @@
 kind: Role
 metadata:
   name: release-name-gateway-helm-leader-election-role
-  namespace: 'default'
+  namespace: default
 rules:
   - apiGroups:
       - ""
@@ -304,7 +296,7 @@
 kind: RoleBinding
 metadata:
   name: release-name-gateway-helm-infra-manager
-  namespace: 'default'
+  namespace: default
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -312,7 +304,7 @@
 subjects:
   - kind: ServiceAccount
     name: 'envoy-gateway'
-    namespace: 'default'
+    namespace: default
 
 ---
 # Source: envoy-gateway/charts/gateway-helm/templates/leader-election-rbac.yaml
@@ -320,7 +312,7 @@
 kind: RoleBinding
 metadata:
   name: release-name-gateway-helm-leader-election-rolebinding
-  namespace: 'default'
+  namespace: default
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -328,7 +320,7 @@
 subjects:
   - kind: ServiceAccount
     name: 'envoy-gateway'
-    namespace: 'default'
+    namespace: default
 
 ---
 # Source: envoy-gateway/charts/error-pages/templates/common.yaml
@@ -355,7 +347,7 @@
 kind: Service
 metadata:
   name: envoy-gateway
-  namespace: 'default'
+  namespace: default
 spec:
   type: ClusterIP
   selector:
@@ -461,7 +453,7 @@
 kind: Deployment
 metadata:
   name: envoy-gateway
-  namespace: 'default'
+  namespace: default
 spec:
   replicas: 1
   selector:
@@ -484,7 +476,7 @@
                   fieldPath: metadata.namespace
             - name: KUBERNETES_CLUSTER_DOMAIN
               value: cluster.local
-          image: docker.io/envoyproxy/gateway:v1.7.3
+          image: docker.io/envoyproxy/gateway:v1.8.3
           imagePullPolicy: IfNotPresent
           livenessProbe:
             httpGet:
@@ -863,12 +855,81 @@
       control-plane: envoy-gateway
 
 ---
+# Source: envoy-gateway/charts/gateway-helm/charts/crds/templates/gatewayapi-safe-upgrade-policy.yaml
+#
+# config/crd/experimental/gateway.networking.k8s.io_vap_safeupgrades.yaml
+#
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  annotations:
+    gateway.networking.k8s.io/bundle-version: v1.5.0-dev
+    gateway.networking.k8s.io/channel: standard
+  name: "safe-upgrades.gateway.networking.k8s.io"
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+      - apiGroups: [ "apiextensions.k8s.io" ]
+        apiVersions: [ "v1" ]
+        operations: [ "CREATE", "UPDATE" ]
+        resources: [ "*" ]
+  validations:
+    - expression: "object.spec.group != 'gateway.networking.k8s.io' || oldObject ==
+        null || ( has(object.metadata.annotations) &&
+        object.metadata.annotations.exists(k, k ==
+        'gateway.networking.k8s.io/channel') &&
+        object.metadata.annotations['gateway.networking.k8s.io/channel'] ==
+        'standard' ) || ( oldObject != null &&
+        has(oldObject.metadata.annotations) &&
+        oldObject.metadata.annotations.exists(k, k ==
+        'gateway.networking.k8s.io/channel') &&
+        oldObject.metadata.annotations['gateway.networking.k8s.io/channel'] ==
+        'experimental' )"
+      message: "Installing experimental CRDs on top of standard channel CRDs is
+        prohibited by default. Uninstall ValidatingAdmissionPolicy
+        safe-upgrades.gateway.networking.k8s.io to install experimental CRDs on
+        top of standard channel CRDs."
+      reason: Invalid
+    - expression: "object.spec.group != 'gateway.networking.k8s.io' ||
+        (has(object.metadata.annotations) &&
+        object.metadata.annotations.exists(k, k ==
+        'gateway.networking.k8s.io/bundle-version') &&
+        !matches(object.metadata.annotations['gateway.networking.k8s.io/bundle-\
+        version'], 'v1.[0-4].\\\\d+') &&
+        !matches(object.metadata.annotations['gateway.networking.k8s.io/bundle-\
+        version'], 'v0'))" #TODO Kubernetes 1.37: Migrate to kubernetes semver library
+      message: "Installing CRDs with version before v1.5.0 is prohibited by default.
+        Uninstall ValidatingAdmissionPolicy
+        safe-upgrades.gateway.networking.k8s.io to install older versions."
+      reason: Invalid
+
+---
+# Source: envoy-gateway/charts/gateway-helm/charts/crds/templates/gatewayapi-safe-upgrade-policy.yaml
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  annotations:
+    gateway.networking.k8s.io/bundle-version: v1.5.0-dev
+    gateway.networking.k8s.io/channel: standard
+  name: safe-upgrades.gateway.networking.k8s.io
+spec:
+  policyName: safe-upgrades.gateway.networking.k8s.io
+  validationActions: [ Deny ]
+  matchResources:
+    resourceRules:
+      - apiGroups: [ "apiextensions.k8s.io" ]
+        apiVersions: [ "v1" ]
+        resources: [ "customresourcedefinitions" ]
+        operations: [ "CREATE", "UPDATE" ]
+
+---
 # Source: envoy-gateway/charts/gateway-helm/templates/certgen-rbac.yaml
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: release-name-gateway-helm-certgen
-  namespace: 'default'
+  namespace: default
   annotations:
     "helm.sh/hook": pre-install, pre-upgrade
     "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD.
@@ -917,7 +978,7 @@
 subjects:
   - kind: ServiceAccount
     name: 'release-name-gateway-helm-certgen'
-    namespace: 'default'
+    namespace: default
 
 ---
 # Source: envoy-gateway/charts/gateway-helm/templates/certgen-rbac.yaml
@@ -925,7 +986,7 @@
 kind: Role
 metadata:
   name: release-name-gateway-helm-certgen
-  namespace: 'default'
+  namespace: default
   annotations:
     "helm.sh/hook": pre-install, pre-upgrade
     "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD.
@@ -945,7 +1006,7 @@
 kind: RoleBinding
 metadata:
   name: release-name-gateway-helm-certgen
-  namespace: 'default'
+  namespace: default
   annotations:
     "helm.sh/hook": pre-install, pre-upgrade
     "helm.sh/hook-weight": "-1" # Ensure rbac is created before the certgen job when using ArgoCD.
@@ -956,7 +1017,7 @@
 subjects:
   - kind: ServiceAccount
     name: 'release-name-gateway-helm-certgen'
-    namespace: 'default'
+    namespace: default
 
 ---
 # Source: envoy-gateway/charts/gateway-helm/templates/certgen.yaml
@@ -964,7 +1025,7 @@
 kind: Job
 metadata:
   name: release-name-gateway-helm-certgen
-  namespace: 'default'
+  namespace: default
   annotations:
     "helm.sh/hook": pre-install, pre-upgrade
 spec:
@@ -986,7 +1047,7 @@
                   fieldPath: metadata.namespace
             - name: KUBERNETES_CLUSTER_DOMAIN
               value: cluster.local
-          image: docker.io/envoyproxy/gateway:v1.7.3
+          image: docker.io/envoyproxy/gateway:v1.8.3
           imagePullPolicy: IfNotPresent
           name: envoy-gateway-certgen
           securityContext:
@@ -1022,7 +1083,7 @@
     clientConfig:
       service:
         name: envoy-gateway
-        namespace: 'default'
+        namespace: default
         path: "/inject-pod-topology"
         port: 9443
     failurePolicy: Ignore

@renovate
renovate Bot force-pushed the renovate/gateway-helm-1.x branch from c6fa496 to 9f06699 Compare May 22, 2026 21:16
@renovate
renovate Bot force-pushed the renovate/gateway-helm-1.x branch from 9f06699 to 22bf6ee Compare June 5, 2026 08:51
@renovate renovate Bot changed the title feat(container): update image gateway-helm ( 1.7.3 → 1.8.0 ) feat(container): update image gateway-helm ( 1.7.3 → 1.8.1 ) Jun 5, 2026
@renovate
renovate Bot force-pushed the renovate/gateway-helm-1.x branch from 22bf6ee to 8d73d13 Compare June 18, 2026 17:45
@renovate
renovate Bot force-pushed the renovate/gateway-helm-1.x branch from 8d73d13 to 8142051 Compare July 1, 2026 21:55
@renovate renovate Bot changed the title feat(container): update image gateway-helm ( 1.7.3 → 1.8.1 ) feat(container): update image gateway-helm ( 1.7.3 → 1.8.2 ) Jul 1, 2026
@renovate
renovate Bot force-pushed the renovate/gateway-helm-1.x branch 2 times, most recently from 272f849 to 2b58734 Compare July 22, 2026 20:52
@renovate renovate Bot changed the title feat(container): update image gateway-helm ( 1.7.3 → 1.8.2 ) feat(container): update image gateway-helm ( 1.7.3 → 1.8.3 ) Jul 22, 2026
@renovate
renovate Bot force-pushed the renovate/gateway-helm-1.x branch from 2b58734 to 4f06b12 Compare July 30, 2026 16:06
@renovate
feat(container): update image gateway-helm ( 1.7.3 → 1.8.3 )
a6b0519 
| datasource | package                           | from  | to    |
| ---------- | --------------------------------- | ----- | ----- |
| docker     | docker.io/envoyproxy/gateway-helm | 1.7.3 | 1.8.3 |


Signed-off-by: Roger Rumao <rogerrum@users.noreply.github.com>
@renovate
renovate Bot force-pushed the renovate/gateway-helm-1.x branch from 4f06b12 to a6b0519 Compare August 12, 2026 03:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate/container type/minor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants