From a9ae6d7efb1cbd6cc1f06ebca42d492bff545c11 Mon Sep 17 00:00:00 2001 From: Clemens Beck Date: Fri, 28 Aug 2026 12:22:27 +0200 Subject: [PATCH 1/2] ci: add tests for Kubernetes 1.37 * add K8s 1.37 conformance and e2e tests * drop K8s 1.33 conformance tests * update compatibility matrix Signed-off-by: Clemens Beck --- .github/workflows/build_and_test.yaml | 36 +++++++++---------- .../workflows/experimental_conformance.yaml | 12 +++---- site/content/en/news/releases/matrix.md | 2 +- tools/make/kube.mk | 4 +-- 4 files changed, 27 insertions(+), 27 deletions(-) diff --git a/.github/workflows/build_and_test.yaml b/.github/workflows/build_and_test.yaml index 2ce56149c6f..f8ffb168935 100644 --- a/.github/workflows/build_and_test.yaml +++ b/.github/workflows/build_and_test.yaml @@ -161,11 +161,11 @@ jobs: fail-fast: false matrix: target: - - version: v1.33.12 + - version: v1.34.11 ipFamily: ipv4 profile: default gwapiChannel: standard - - version: v1.33.12 + - version: v1.34.11 ipFamily: ipv4 profile: default gwapiChannel: standard @@ -173,36 +173,36 @@ jobs: # this should be able to be run in a private forked repo # with less CPU and memory resources disableParallel: true - - version: v1.34.8 + - version: v1.35.8 ipFamily: ipv4 profile: default gwapiChannel: experimental - - version: v1.35.5 + - version: v1.36.4 ipFamily: ipv6 # only run ipv6 test on this version to save time profile: default gwapiChannel: experimental # TODO: this's IPv4 first, need a way to test IPv6 first. - - version: v1.36.1 + - version: v1.37.0 ipFamily: dual # only run dual test on latest version to save time profile: default gwapiChannel: experimental - - version: v1.36.1 + - version: v1.37.0 ipFamily: dual # only run dual test on latest version to save time gwapiChannel: experimental profile: gateway-namespace-mode - - version: v1.36.1 + - version: v1.37.0 ipFamily: ipv4 profile: xds-name-scheme-v2 gwapiChannel: experimental - - version: v1.36.1 + - version: v1.37.0 ipFamily: ipv4 profile: watch-namespaces gwapiChannel: experimental - - version: v1.36.1 + - version: v1.37.0 ipFamily: ipv4 profile: merge-backends gwapiChannel: experimental - - version: v1.36.1 + - version: v1.37.0 ipFamily: ipv4 profile: debounce gwapiChannel: experimental @@ -255,29 +255,29 @@ jobs: fail-fast: false matrix: target: - - version: v1.33.12 + - version: v1.34.11 ipFamily: ipv4 profile: default - - version: v1.34.8 + - version: v1.35.8 ipFamily: ipv4 profile: default - - version: v1.35.5 + - version: v1.36.4 ipFamily: ipv6 # only run ipv6 test on this version to save time profile: default # TODO: this's IPv4 first, need a way to test IPv6 first. - - version: v1.36.1 + - version: v1.37.0 ipFamily: dual # only run dual test on latest version to save time profile: default - - version: v1.36.1 + - version: v1.37.0 ipFamily: dual # only run dual test on latest version to save time profile: gateway-namespace-mode - - version: v1.36.1 + - version: v1.37.0 ipFamily: ipv4 profile: xds-name-scheme-v2 - - version: v1.36.1 + - version: v1.37.0 ipFamily: ipv4 profile: watch-namespaces - - version: v1.36.1 + - version: v1.37.0 ipFamily: ipv4 profile: debounce diff --git a/.github/workflows/experimental_conformance.yaml b/.github/workflows/experimental_conformance.yaml index 1bc01a550e8..06f0b3de396 100644 --- a/.github/workflows/experimental_conformance.yaml +++ b/.github/workflows/experimental_conformance.yaml @@ -26,26 +26,26 @@ jobs: fail-fast: false matrix: target: - - version: v1.33.12 + - version: v1.34.11 ipFamily: ipv4 profile: default - - version: v1.34.8 + - version: v1.35.8 ipFamily: ipv4 profile: default - - version: v1.35.5 + - version: v1.36.4 # only run ipv6 test on this version to save time ipFamily: ipv6 profile: default # TODO: this's IPv4 first, need a way to test IPv6 first. - - version: v1.36.1 + - version: v1.37.0 # only run dual test on latest version to save time ipFamily: dual profile: default - - version: v1.36.1 + - version: v1.37.0 # only run dual test on latest version to save time ipFamily: dual profile: gateway-namespace-mode - - version: v1.36.1 + - version: v1.37.0 ipFamily: ipv4 profile: watch-namespaces steps: diff --git a/site/content/en/news/releases/matrix.md b/site/content/en/news/releases/matrix.md index 86fb88d1c26..a0d174b8e3e 100644 --- a/site/content/en/news/releases/matrix.md +++ b/site/content/en/news/releases/matrix.md @@ -7,7 +7,7 @@ Envoy Gateway relies on the Envoy Proxy and the Gateway API, and runs within a K | Envoy Gateway version | Envoy Proxy version | Rate Limit version | Gateway API version | Kubernetes version | End of Life | | --------------------- | --------------------------- | ------------------ | ------------------- | -------------------------- | ----------- | -| latest | **dev-latest** | **master** | **v1.6.1** | v1.33, v1.34, v1.35, v1.36 | n/a | +| latest | **dev-latest** | **master** | **v1.6.1** | v1.34, v1.35, v1.36, v1.37 | n/a | | v1.9 | **distroless-v1.39.0** | **17b1956c** | **v1.6.1** | v1.33, v1.34, v1.35, v1.36 | 2027/02/14 | | v1.8 | **distroless-v1.38.0** | **fe26676d** | **v1.5.1** | v1.32, v1.33, v1.34, v1.35 | 2026/11/08 | | v1.7 | **distroless-v1.37.0** | **3fb70258** | **v1.4.1** | v1.32, v1.33, v1.34, v1.35 | 2026/08/05 | diff --git a/tools/make/kube.mk b/tools/make/kube.mk index 2bb7061ce61..ca8ef95f2f5 100644 --- a/tools/make/kube.mk +++ b/tools/make/kube.mk @@ -1,9 +1,9 @@ # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary. # To know the available versions check: # - https://github.com/kubernetes-sigs/controller-tools/blob/main/envtest-releases.yaml -ENVTEST_K8S_VERSION ?= 1.36.0 +ENVTEST_K8S_VERSION ?= 1.37.0 # Need run cel validation across multiple versions of k8s -ENVTEST_K8S_VERSIONS ?= 1.33.0 1.34.1 1.35.0 1.36.0 +ENVTEST_K8S_VERSIONS ?= 1.34.1 1.35.0 1.36.2 1.37.0 # GATEWAY_API_VERSION refers to the version of Gateway API CRDs. # For more details, see https://gateway-api.sigs.k8s.io/guides/getting-started/#installing-gateway-api From 1ec44a3d7c685c862c5f9177f0848bcc1304e0c9 Mon Sep 17 00:00:00 2001 From: Clemens Beck Date: Fri, 28 Aug 2026 12:48:24 +0200 Subject: [PATCH 2/2] Continue to cover ClusterTrustBundle ClusterTrustBundle graduated to GA in K8s 1.37. All 1.37 review environments now enable ClusterTrustBundle. Previously it was tested on K8s 1.33 which introduced ClusterTrustBundle as beta. Signed-off-by: Clemens Beck --- .github/workflows/build_and_test.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build_and_test.yaml b/.github/workflows/build_and_test.yaml index f8ffb168935..cc43347aae1 100644 --- a/.github/workflows/build_and_test.yaml +++ b/.github/workflows/build_and_test.yaml @@ -308,8 +308,8 @@ jobs: # This is not the limit of Envoy Gateway, # but the limit of running e2e tests in github CI. E2E_BACKEND_UPGRADE_QPS: "2000" - # Cluster trust bundle reach beta in v1.33, so we can enable it for v1.33 and later. - ENABLE_CLUSTER_TRUST_BUNDLE: ${{ startsWith(matrix.target.version, 'v1.33') }} + # Cluster trust bundle reach GA in v1.37, so we can enable it for v1.37. + ENABLE_CLUSTER_TRUST_BUNDLE: ${{ startsWith(matrix.target.version, 'v1.37') }} # set ACTIONS_STEP_DEBUG to true if context runner.debug is '1', # which means to dump the current state when there's a case failed. ACTIONS_STEP_DEBUG: ${{ runner.debug == '1' }}