Connectivity
Changed
- Bump performance test dependencies:
ingress-nginx to 4.3.5 and kong-app to 5.2.3 and remove Release setting from config. - Update Envoy Gateway to v1.9.1.
Removed
- Remove the
karpenter.sh/do-not-disrupt annotation from the Envoy Gateway control-plane pods.
Fixed
- Point the
eg.image fallback at the gsoci.azurecr.io mirror. When both global.images.envoyGateway.image and deployment.envoyGateway.image.repository are empty, the chart resolved the Envoy Gateway control plane, certgen and shutdownManager images to docker.io/envoyproxy/gateway:<chart version> — a tag that never exists upstream, ignoring global.imageRegistry. - Honour
global.imageRegistry and global.imagePullSecrets in the CRD installer Job, so the envoy-gateway-crds image can be pulled from a private mirror like every other image in the chart.
Changed
- Breaking: Use upstream’s
global.imageRegistry value instead of global.image.registry, dropping the image registry patch now that upstream supports the override natively. - Update Envoy Gateway to v1.9.0. Requires Gateway API v1.6 CRDs. Note that Lua
EnvoyExtensionPolicy is now opt-in via config.envoyGateway.extensionApis.enableLua, and EndpointSliceIndex is enabled by default and can raise control plane memory usage. - Pin
gateway-api-crds to 1.9.0 in the e2e and performance test suites. - Update
perf-report claude skill:- the report is posted as a tar file in the PR’s comments.
perf-report no longer needs a cluster_id.- fix the nginx
downstream_rps, cpu_usage and memory_usage queries: they
filtered on the kube-system namespace, but the performance suites install
ingress-nginx into default, so those three metrics were always empty and
the comparison table rendered them as —. - in pipeline mode the skill no longer publishes: the
generate-perf-report
Tekton task creates the branch, uploads the tarball, verifies it and posts the
comment itself, and the agent writes its interpretation to narrative.md
instead. gh moved from the CI allowlist’s allow list to its deny list. - retry Mimir requests in
fetch_metrics.py, so a report survives the stalls
of a kubectl port-forward to the management cluster. - add
.claude/perf-report-ci-settings.json, the permission allowlist used by
the pipeline’s generate-perf-report task (--permission-mode dontAsk). - stop using a
$DIR shell variable in the SKILL.md examples and spell the
script paths out literally. A permission rule cannot match past a variable
assignment, so the DIR=... && python3 "$DIR/fetch_metrics.py" ... form the
examples produced was denied under the CI allowlist even though
Bash(python3 *) is allowed — the agent could not run a single script and
the pipeline reported success with no report.
Added
- Add control plane startup, liveness and readiness probes as configurable values.
Changed
- Apply the CRDs from a dedicated installer image via a
pre-install/pre-upgrade hook Job instead of rendering them as Helm templates. The rendered release no longer contains the CRDs, which kept it from fitting in Helm’s release Secret. - CRDs are applied with server-side apply and are no longer Helm-managed, so
helm uninstall leaves them in place and a CRD rejected by the safe-upgrades policy now surfaces as a failed hook Job. - Reject unknown keys under
install, which previously were silently ignored.
Added
- E2E test suite covering CRD installation, installer hook cleanup, the
safe-upgrades admission policy and the served Gateway API resources. crds.image values to override the installer image. The tag defaults to the chart version.CiliumNetworkPolicy allowing the installer Job to reach the Kubernetes API server, without which the Job cannot apply the CRDs on clusters that default to denying egress. Set ciliumNetworkPolicy.enabled to false to skip it.
Changed
- Upgrade Gateway API CRDs to v1.6.1
- Upgrade Gateway API Inference Extension CRDs to v1.5.0
- Set
install.tcproutes and install.udproutes to standard, following their graduation to the standard channel. Required by Envoy Gateway 1.9, which reconciles them via gateway.networking.k8s.io/v1. - Install the
safe-upgrades ValidatingAdmissionPolicy, which was previously dropped and left its binding orphaned. Set install.admissionPolicies to false to skip both.
Added
- Add
install.xbackends value for the new experimental XBackend CRD. - Add
install.inferencepoolimports and install.inferencemodelrewrites values, whose CRDs shipped without a way to enable them.
Removed
- Remove the alpha
InferencePool CRD (inference.networking.x-k8s.io/v1alpha2), dropped upstream in Inference Extension v1.5.0. install.inferencepools now only accepts standard or "".
Changed
- Chart: Make tolerations configurable.
Changed
- Update Envoy Gateway to v1.8.3.
- Update cert-manager config in the cluster values for all performance test suites.
Added
- Set
karpenter.sh/do-not-disrupt: "true" on the Envoy Gateway control-plane pods, so Karpenter does not voluntarily consolidate them. A control-plane reschedule forces the Envoy proxies to reconnect and can leave them wedged with stale/absent TLS secrets over delta xDS until restarted (see envoyproxy/gateway#9519). - Add
perf-report repo-specific claude skill to automatically generate performance test report as html files.
Changed
- Rebuild with
app-build-suite 2.2.0 (via architect orb 9.6.0): the packaged chart now carries Artifact Hub metadata (artifacthub.io/license and a Support link). No functional chart changes.
Added
- Add configurable
serviceAccount.name/serviceAccount.namespace and azure.mountPath values.
Changed
- Scope AWS values under
aws.*. Root-level values remain supported as a fallback for backward compatibility. - Templatize hardcoded resource, service account and tag values.
- Scope the IAM trust policy to the exact
serviceAccount subject instead of a wildcard match. - Enable Azure Workload Identity for the
azure provider in addition to aks. - Update chart metadata to reflect Azure support.
Removed
- Remove unused
baseDomain value.
