Aleksei Sviridkin 5b92ca3fc8 fix(cilium): serve HTTPS and passthrough on one port from one listener ...

When a Gateway needs per-port Envoy listeners, the operator emits one
listener per HTTPS port and, with two or more passthrough ports, one per
passthrough port, all named listener-<port>. A port carrying both gets
two listeners with one name, and the agent skips the whole
CiliumEnvoyConfig, so every listener of the Gateway stops serving while
its status stays green. With one passthrough port the port is instead
mapped to two listeners in the CEC services. A tenant Gateway with
HTTPS and passthrough on 443 plus a passthrough listener on a native
port reaches the first case.

The patch puts the passthrough filter chains of such a port on its
HTTPS listener and leaves the port out of the passthrough listeners and
service mappings.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-10-09 17:53:14 +03:00

..

application-definition-crd

docs(api): separate the healthCheckExprs failure modes

2026-09-23 00:05:35 +03:00

backup-controller

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

backupstrategy-controller

fix(backups): give each Postgres instance its own default WAL prefix

2026-10-06 16:35:42 +03:00

bootbox

…

bootbox-rd

…

bucket

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

bucket-rd

…

capi-operator

…

capi-providers-bootstrap

…

capi-providers-core

fix(capi): ship the core provider manifests the repository actually holds

2026-09-25 16:26:13 +02:00

capi-providers-cpprovider

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

capi-providers-infraprovider

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

capi-providers-infraprovider-proxmox

feat(cluster-api): add Proxmox infrastructure provider package

2026-09-25 16:23:45 +02:00

capi-providers-ipam-in-cluster

feat(cluster-api): add in-cluster IPAM provider package

2026-09-25 16:23:45 +02:00

cert-manager

fix(cert-manager): enable the Gateway API solver in the controller

2026-10-07 14:14:35 +03:00

cert-manager-crds

test(cert-manager-crds): pin the keep annotation on the CRDs

2026-08-07 14:36:06 +03:00

cert-manager-issuers

fix(platform): declare the injected _cluster values in system charts

2026-09-07 02:23:47 +03:00

cilium

fix(cilium): serve HTTPS and passthrough on one port from one listener

2026-10-09 17:53:14 +03:00

cilium-networkpolicy

fix(cilium): deny world ingress to etcd's HTTP port on Talos v1.14

2026-09-30 04:23:38 +03:00

clickhouse-operator

…

clickhouse-rd

feat(clickhouse): add configurable version parameter

2026-08-24 23:41:27 +03:00

cluster-autoscaler

…

clustersecret-operator

…

computeplane-rd

docs(computeplane): nodeGroups allowlist drops unlisted fields, not pass-through

2026-08-25 16:39:19 +03:00

coredns

…

cozy-proxy

feat(cozy-proxy): update to v0.4.0 with arm64 images

2026-09-28 21:41:31 +03:00

cozystack-api

fix(api): leave failed golden images out of the image options (#4568)

2026-10-05 15:14:25 +03:00

cozystack-basics

feat(redis)!: refuse external access without TLS at admission (#4639)

2026-10-06 16:39:23 +03:00

cozystack-controller

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

cozystack-scheduler

feat(cozystack-scheduler): update to v0.4.0 with arm64 images

2026-09-28 21:41:32 +03:00

dashboard

fix(dashboard): drop the resource map ConfigMaps once the map is unreadable (#4789)

2026-10-08 16:49:58 +03:00

etcd-operator

fix(etcd-operator): gate VMServiceScrape on VictoriaMetrics operator CRD (#3960)

2026-10-07 16:54:10 +04:00

etcd-operator-crds

chore(etcd-operator): bump to v0.5.6

2026-09-23 21:22:43 +04:00

etcd-rd

docs(etcd): note that affinity is not applied to existing members

2026-09-01 12:47:46 +03:00

external-dns

[external-dns] Set resources requests/limits on external-dns container

2026-07-03 19:14:15 +03:00

external-dns-rd

…

external-secrets-operator

fix(external-secrets): move the webhook off the kubelet's port

2026-07-20 04:49:57 +03:00

flux-plunger

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

flux-shard-operator

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

forklift

feat(migration): tenant self-service VM import from VMware vSphere

2026-09-07 17:03:44 +02:00

forklift-operator

feat(migration): tenant self-service VM import from VMware vSphere

2026-09-07 17:03:44 +02:00

foundationdb-operator

fix(foundationdb-operator)!: drop the amd64-only 7.1 init container

2026-09-26 20:30:50 +03:00

foundationdb-rd

…

gateway-api-crds

test(gateway-api-crds): pin the vendored bundle version in the suite

2026-09-03 22:17:04 +03:00

goldpinger

[goldpinger] Set resources requests/limits on goldpinger DaemonSet

2026-07-03 19:14:27 +03:00

gpu-operator

feat(kubernetes): default gpu-operator to an OS-provided driver on Talos

2026-09-29 17:09:13 +02:00

grafana-operator

chore(deps): update container image & action digests

2026-09-24 16:55:04 +03:00

hami

…

harbor

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

harbor-rd

docs(harbor): say what managementWhitelist overrides and trusts

2026-09-24 15:53:00 +03:00

hetzner-robotlb

chore(hetzner-robotlb): update robotlb to 0.1.0

2026-09-29 10:50:55 +05:00

info-rd

…

ingress-nginx

docs(cilium): re-anchor comments the v1.20.2 bump made stale

2026-10-09 02:04:40 +03:00

ingress-rd

…

kafka-operator

…

kafka-rd

feat(apps): declare the Kubernetes and Kafka name caps in their charts

2026-09-23 10:59:51 +03:00

kamaji

fix(kamaji): drop any subchart nested under the vendored kamaji chart (#4459)

2026-10-05 15:14:48 +03:00

keda

chore: drop private cluster, host and personal names from the tree

2026-10-07 04:38:06 +03:00

keycloak

feat(keycloak): update keycloak-kms-proxy to 0.2.3 with arm64 images

2026-09-28 21:41:32 +03:00

keycloak-configure

test(keycloak): pin organizationsEnabled rendering in configure-kk

2026-09-29 17:10:10 +02:00

keycloak-operator

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

kilo

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

kubeovn

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

kubeovn-plunger

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

kubeovn-webhook

docs(cilium): re-anchor comments the v1.20.2 bump made stale

2026-10-09 02:04:40 +03:00

kubernetes-nodes-rd

fix(kubernetes-nodes): refuse a resources.cpu that cannot be a core count

2026-10-01 22:10:40 +03:00

kubernetes-rd

feat(kubernetes): deploy the Proxmox cloud-controller-manager with the cluster

2026-09-29 21:04:05 +02:00

kubernetes-worker-image

fix(kubernetes-worker-image): wait for goldens to import before Ready

2026-09-29 22:15:59 +03:00

kuberture

fix(build): name the repository of the keda and kuberture pins

2026-09-27 07:57:31 +03:00

kubevirt

fix(kubevirt): route the export proxy to the Service KubeVirt creates (#4637)

2026-10-07 11:19:32 +03:00

kubevirt-cdi

fix(cdi): validate kubevirt-cdi values against a schema (#4417)

2026-09-23 20:07:06 +04:00

kubevirt-cdi-operator

fix(kubevirt-cdi-operator): pin the vendored CDI release

2026-09-22 23:45:58 +03:00

kubevirt-csi-node

fix(kubernetes): pin KubeVirt CSI sidecars to SIG Storage releases

2026-08-21 15:51:53 +03:00

kubevirt-instancetypes

fix(kubevirt-instancetypes): restore persistent EFI/TPM state

2026-07-06 09:49:50 +05:00

kubevirt-operator

test(kubevirt): add a unit-test target for the operator package

2026-09-07 01:23:29 +03:00

lineage-controller-webhook

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

linstor

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

linstor-gui

chore: drop private cluster, host and personal names from the tree

2026-10-07 04:38:06 +03:00

linstor-scheduler

test(tests): fail absence-only cases when the template renders nothing

2026-10-01 22:27:17 +03:00

local-ccm

…

local-storage

feat(local-storage): add opt-in OpenEBS LocalPV hostpath package

2026-10-07 11:30:45 +03:00

mariadb-operator

fix(mariadb): correct webhook cert-manager override key path

2026-09-28 17:41:20 +05:30

mariadb-rd

feat(mariadb)!: generate every user password, root included

2026-09-24 18:10:57 +03:00

metallb

fix(build): pass the shared buildx flags from every image target

2026-09-26 14:32:44 +03:00

metrics-server

fix(metrics-server): move the listener off the kubelet's port

2026-07-20 05:24:04 +03:00

migration-controller

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

mongodb-operator

…

mongodb-rd

fix(mongodb): apply the storage once per job, and pin the terms that decide ownership

2026-09-29 10:14:44 +04:00

monitoring

chore: drop private cluster, host and personal names from the tree

2026-10-07 04:38:06 +03:00

monitoring-agents

docs(monitoring-agents): note what object count the 2Gi limit covers

2026-10-07 04:56:09 +03:00

monitoring-rd

fix(monitoring): count a central request as the receiver admitted it

2026-10-06 09:39:04 +03:00

multus

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

nats

…

nats-rd

feat(nats): publish ca.crt-only trust anchor to tenants

2026-08-12 18:42:13 +03:00

nfs-driver

…

objectstorage-controller

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

openbao

…

openbao-rd

…

opencost

…

opensearch-operator

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

opensearch-rd

feat(opensearch)!: issue the HTTP API certificate from cert-manager

2026-09-11 01:23:13 +03:00

ouroboros

test(system): anchor index-addressed negative asserts to what they name

2026-08-12 15:28:37 +03:00

piraeus-operator

fix(linstor): use severity warning instead of warn in piraeus-datastore alerts

2026-09-30 13:53:06 +03:00

piraeus-operator-crds

…

postgres-operator

fix(postgres-operator): count every scraped empty queue in the WAL backlog rule

2026-09-30 11:11:03 +03:00

postgres-rd

feat(redis,postgres): certify the per-engine external hostname

2026-10-07 04:43:15 +03:00

prometheus-operator-crds

fix(prometheus-operator-crds): keep the CRDs on uninstall

2026-08-07 14:37:46 +03:00

proxmox-csi

feat(kubernetes): add the Proxmox CSI driver, with its controller in this cluster

2026-09-29 21:04:05 +02:00

qdrant

…

qdrant-rd

feat(qdrant): publish ca.crt-only trust anchor to tenants

2026-08-09 21:06:46 +03:00

rabbitmq-operator

fix(rabbitmq): bound the topology operator Secret cache

2026-09-29 17:08:17 +02:00

rabbitmq-rd

fix(rabbitmq): describe the preset as filling what resources leaves unset

2026-09-22 17:47:55 +04:00

redis-operator

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

redis-rd

feat(redis)!: refuse external access without TLS at admission

2026-10-03 01:42:57 +03:00

reloader

fix(reloader): add startupProbe to survive slow first start under load

2026-07-28 12:16:57 +03:00

seaweedfs

test(tests): fail absence-only cases when the template renders nothing

2026-10-01 22:27:17 +03:00

seaweedfs-db

…

seaweedfs-rd

fix(seaweedfs): raise the number of buckets a volume server can serve

2026-09-17 00:54:48 +03:00

securitygroup-controller

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

snapshot-controller

…

talos-log-collector

chore(deps): update container image & action digests

2026-09-24 16:55:04 +03:00

tcp-balancer-rd

docs(tcp-balancer): say that whitelistHTTP needs a non-empty whitelist

2026-09-23 11:18:19 +04:00

telepresence

…

tenant-rd

fix(monitoring): count a central request as the receiver admitted it

2026-10-06 09:39:04 +03:00

valkey-rd

feat(valkey): register Valkey application in the platform

2026-09-01 11:43:10 +04:00

velero

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

vertical-pod-autoscaler

test(tests): fail absence-only cases when the template renders nothing

2026-10-01 22:27:17 +03:00

vertical-pod-autoscaler-crds

fix(vertical-pod-autoscaler-crds): keep the CRDs on uninstall

2026-08-07 14:37:46 +03:00

victoria-metrics-operator

…

virtualprivatecloud-rd

feat(vpc): expose allowSubnets per subnet

2026-09-29 18:47:18 +03:00

vm-default-images

fix(vm-default-images): wait for golden images to import before Ready

2026-09-29 22:15:58 +03:00

vm-disk-rd

fix(vm-disk): keep the Helm install from waiting on the DataVolume

2026-10-02 14:01:13 +03:00

vm-instance-rd

fix(vm-instance): make the netplan network-data opt-in

2026-10-06 16:11:33 +03:00

vpn-rd

…

vsnap-crd

fix(vsnap-crd): keep the CRDs when the release is uninstalled

2026-08-07 14:37:46 +03:00

.gitattributes

chore(codeowners): don't gate per-app generated files on architect review

2026-08-03 14:08:36 +03:00

Makefile

…