chore: cherry-pick upstream bug fixes since v1.0.0

.github/workflows/build_and_test.yaml

@@ -71,7 +71,7 @@ jobs:
       - run: make test-coverage GO_TEST_ARGS='-race'
       - name: Upload coverage to Codecov
         if: matrix.os == 'ubuntu-latest'
-        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6.0.2
         with:
           fail_ci_if_error: true
           files: ./out/go-test-coverage.out
@@ -228,7 +228,7 @@ jobs:
             ~/go/pkg/mod
             ~/go/bin
           key: e2e-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
       - env:
           EG_VERSION: ${{ matrix.envoy_gateway_version }}
           TEST_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_BEDROCK_USER_AWS_ACCESS_KEY_ID }}
@@ -266,7 +266,7 @@ jobs:
             ~/go/pkg/mod
             ~/go/bin
           key: e2e-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
       - run: make test-e2e-upgrade
         env:
           # We only need to test the upgrade from the latest stable version of EG.
@@ -296,7 +296,7 @@ jobs:
             ~/go/pkg/mod
             ~/go/bin
           key: e2e-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
       - run: make test-e2e-inference-extension
         env:
           EG_VERSION: v1.8.1
@@ -324,7 +324,7 @@ jobs:
             ~/go/pkg/mod
             ~/go/bin
           key: e2e-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
       - run: make test-e2e-namespaced
         env:
           # We only need to test with the latest stable version of EG, since these e2e tests
@@ -350,7 +350,7 @@ jobs:
             ~/go/pkg/mod
             ~/go/bin
           key: e2e-aigw-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
       - name: Start Ollama server
         run: |
           curl -fsSL https://ollama.com/install.sh | sh && sudo systemctl stop ollama
@@ -395,7 +395,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
       - name: Login into DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}

.github/workflows/codeql.yaml

@@ -37,14 +37,14 @@ jobs:
           cache: true
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
           languages: go
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
           category: "/language:go"

.github/workflows/docker_build_job.yaml

@@ -33,17 +33,17 @@ jobs:
             ~/go/bin
           key: build-container-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
 
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
 
       - name: Set up Docker buildx
         id: buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Login into DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}

.github/workflows/release.yaml

@@ -27,7 +27,7 @@ jobs:
       # To include the helm chart in the release artifact, we build and push it here instead of the separate job.
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
       - name: Login into DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}

.gitignore

@@ -52,3 +52,4 @@ inference-extension-conformance-test-report.yaml
 /aigw
 site/.cursorrules
 /.cursor
+.worktrees/

RELEASES.md

@@ -46,6 +46,12 @@ Migration paths for alpha versions will be the best effort and will be documente
 **For stable versions**, we will never break the APIs unless there is a critical security issue.
 We will provide a migration path in the release notes in case we need to break the APIs.
 
+As of the v1.0.0 release, `v1beta1` is the committed **stable** control-plane API and is
+covered by the stable-version guarantee above. The `v1alpha1` API remains served but
+deprecated, and will be removed in a future release per the deprecation policy. Note that
+`QuotaPolicy` is `v1alpha1`-only and is therefore **not** part of the stable surface; in
+particular, its `serviceQuota` field is accepted but not yet enforced end-to-end.
+
 ### Upgrading the Envoy AI Gateway controller
 
 We guarantee that simply upgrading the controller will not break the existing configuration assuming there's no _un-migrated_ resources including breaking change left in the k8s API server. In other words, after the proper use of the API and migration path described above, the user should be able to upgrade the controller without any issue. However, this does mean that we do NOT guarantee that the existing configuration will work across more than two version of the controller. For example if you are using the version N of the controller, and you want to upgrade to the version N+2, you should first upgrade to the version N+1 while following the migration path if applicable, and then upgrade to the version N+2.

SECURITY.md

@@ -0,0 +1,115 @@
+# Security Policy
+
+The Envoy AI Gateway maintainers and community take security seriously. We
+appreciate your efforts to responsibly disclose your findings, and will make
+every effort to acknowledge your contributions.
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues,
+discussions, pull requests, or any other public channel.**
+
+Instead, please report vulnerabilities privately using one of the following
+channels:
+
+1. **Preferred:** Open a
+   [GitHub Security Advisory](https://github.com/envoyproxy/ai-gateway/security/advisories/new)
+   ("Report a vulnerability" on the repository's **Security** tab). This allows
+   the maintainers to triage the report and collaborate with you privately,
+   directly on GitHub.
+2. **Alternative:** Email the Envoy AI Gateway security team at
+   [envoy-ai-gateway-security@googlegroups.com](mailto:envoy-ai-gateway-security@googlegroups.com).
+
+If the vulnerability relates to Envoy Proxy or Envoy Gateway (the components
+that Envoy AI Gateway is built on top of) rather than Envoy AI Gateway itself,
+please report it to the relevant upstream project:
+
+- Envoy Proxy: https://github.com/envoyproxy/envoy/security/advisories/new
+- Envoy Gateway: email envoy-gateway-security@googlegroups.com (see the
+  [Envoy Gateway security policy](https://github.com/envoyproxy/gateway/blob/main/SECURITY.md))
+
+### What to Include
+
+To help us triage and resolve the issue as quickly as possible, please include
+as much of the following information as you can:
+
+- A description of the vulnerability and its potential impact.
+- The affected version(s) of Envoy AI Gateway.
+- Steps to reproduce the issue, including any sample configuration, requests, or
+  proof-of-concept code.
+- Any known workarounds or suggested remediation.
+
+> **Note**: If your report includes data that has privacy concerns, please
+> sanitize the data prior to sharing it.
+
+## Disclosure Process
+
+After a vulnerability is reported, the maintainers will follow this process:
+
+1. **Acknowledgement** — We aim to acknowledge receipt of your report within
+   **3 business days**.
+2. **Triage** — We will investigate to validate the report, determine the
+   affected versions, and assess the severity and impact.
+3. **Fix and coordination** — We will work on a fix and coordinate a release
+   timeline with you. We aim to resolve or publicly disclose privately reported
+   issues within **90 days** of the initial report.
+4. **Release and disclosure** — Once a fix is available, we will publish the
+   patched release and an accompanying security advisory.
+
+We will keep you informed of the progress throughout the process. If you would
+like to be credited for the discovery, please let us know, and we will include
+an acknowledgement in the advisory (with your consent).
+
+Please keep the details of any reported vulnerability confidential until a fix
+has been released and the embargo has been lifted, so that users have a chance
+to upgrade.
+
+## Supported Versions
+
+Envoy AI Gateway follows the support policy described in
+[RELEASES.md](./RELEASES.md), aligned with the
+[Envoy Gateway release support policy](https://gateway.envoyproxy.io/). Minor
+releases are cut on a roughly quarterly cadence, and each minor release is
+supported for **6 months** after its release date. In practice this means the
+**two most recent minor releases** (the current and the previous `v1.x` line)
+are supported at any given time.
+
+Security fixes are developed on the `main` branch and backported as patch
+releases to every minor release that is still within its support window. We
+strongly recommend that all users run a supported, up-to-date `v1.x` version.
+Reports against unsupported or end-of-life versions may be addressed by asking
+you to reproduce the issue on a supported version.
+
+## Security Updates
+
+Security patches and advisories are announced through:
+
+- The [GitHub Releases page](https://github.com/envoyproxy/ai-gateway/releases)
+- The [GitHub Security Advisories page](https://github.com/envoyproxy/ai-gateway/security/advisories)
+
+We recommend watching the repository and subscribing to these channels to stay
+informed about security updates.
+
+## Best Practices for Secure Usage
+
+To minimize security risks when running Envoy AI Gateway:
+
+- Run the latest supported version and apply patches promptly.
+- Follow the principle of least privilege when configuring credentials and
+  `BackendSecurityPolicy` resources, and store secrets using Kubernetes Secrets
+  (or an external secret manager) rather than in plaintext configuration.
+- Restrict network access to the control plane and management interfaces.
+- Regularly review the security-related documentation under the project
+  [docs](./site/docs/capabilities/security).
+
+## Contact
+
+If you have any general (non-sensitive) questions about this security policy,
+please reach out to the maintainers listed in [MAINTAINERS.md](./MAINTAINERS.md).
+To report a vulnerability, always use one of the private channels described
+above — the [GitHub Security Advisory](https://github.com/envoyproxy/ai-gateway/security/advisories/new)
+flow or the security team at
+[envoy-ai-gateway-security@googlegroups.com](mailto:envoy-ai-gateway-security@googlegroups.com)
+— rather than a public channel.
+
+Thank you for helping to keep Envoy AI Gateway and its users secure.

api/v1alpha1/quota_policy.go

@@ -12,8 +12,10 @@ import (
 )
 
 // QuotaPolicy specifies token quota configuration for inference services.
-// Providing a list of backends in the AIGatewayRouteRule allows failover to a different service
-// if token quota for a service had been exceeded.
+// Generates rate limit configuration and tracks quota usage.
+// Reject requests with 429 once all related quota to that request has been exceeded.
+//
+// TODO: Waiting on next release of Envoyproxy that will support routing based on non-exceeded quotas.
 //
 // +genclient
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
@@ -40,6 +42,9 @@ type QuotaPolicySpec struct {
 	// Quota for all models served by AIServiceBackend(s). This value can be overridden for specific models using the "PerModelQuotas"
 	// configuration.
 	//
+	// Currently, the rate limit configuration is properly set up, but the descriptor set is not being set in the Envoy Configuration
+	// TODO: Add changes in the extension server to support ServiceQuota enforcement.
+	//
 	// +optional
 	ServiceQuota ServiceQuotaDefinition `json:"serviceQuota,omitempty"`
 	// PerModelQuotas specifies quota for different models served by the AIServiceBackend(s) where this
@@ -59,7 +64,7 @@ type ServiceQuotaDefinition struct {
 	// If no expression is specified the "total_tokens" value is used.
 	// For example:
 	//
-	//  * "input_tokens + cached_input_tokens * 0.1 + output_tokens * 6"
+	//  "input_tokens + cached_input_tokens + output_tokens"
 	//
 	// +optional
 	CostExpression *string `json:"costExpression,omitempty"`
@@ -90,13 +95,13 @@ type QuotaDefinition struct {
 	// If no expression is specified the "total_tokens" value is used.
 	// For example:
 	//
-	//  * "input_tokens + cached_input_tokens * 0.1 + output_tokens * 6"
+	//  "input_tokens + cached_input_tokens + output_tokens"
 	//
 	// +optional
 	CostExpression *string `json:"costExpression,omitempty"`
 	// The "Mode" determines how quota is charged to the "DefaultBucket" and matching "BucketRules".
 	// In the "shared" mode the quota is charged to all matching "BucketRules" AND the "DefaultBucket"
-	// and request is allowed only if the quota is available in all matching buckets.
+	// and request is allowed only if the quota is available in at least one matching buckets.
 	// Defaults to "Shared".
 	//
 	// +optional
@@ -133,7 +138,7 @@ type QuotaRule struct {
 	// specific clients using attributes from the traffic flow.
 	// All individual select conditions must hold True for this rule
 	// and its limit to be applied.
-	//
+	// Currently, only header types are honored.
 	//
 	// If no client selectors are specified, the rule applies to all traffic of
 	// the targeted AIServiceBackend.

api/v1beta1/mcp_route.go

@@ -232,6 +232,9 @@ type MCPBackendAPIKey struct {
 	//
 	// Either one of Header or QueryParam can be specified to inject the API key.
 	//
+	// Note: Embedding credentials in URLs (including query parameters) is generally not recommended because URLs can be exposed in logs
+	// and intermediary systems; prefer header-based injection when possible.
+	//
 	// +kubebuilder:validation:Optional
 	// +kubebuilder:validation:MinLength=1
 	// +optional

cmd/aigw/translate.go

@@ -234,21 +234,31 @@ func translateCustomResourceObjects(
 		userDefinedSecretKeys[fmt.Sprintf("%s/%s", s.Namespace, s.Name)] = struct{}{}
 	}
 
+	// Use buffered event channels so that controllers can push gateway sync events without blocking,
+	// This mirrors the production code at controller/controller.go:128
+	const eventChanBuffer = 100
 	bspC := controller.NewBackendSecurityPolicyController(fakeClient, fakeClientSet, logr.FromSlogHandler(logger.Handler()),
-		make(chan event.GenericEvent), make(chan event.GenericEvent))
+		make(chan event.GenericEvent, eventChanBuffer), make(chan event.GenericEvent, eventChanBuffer))
 	aisbC := controller.NewAIServiceBackendController(fakeClient, fakeClientSet, logr.FromSlogHandler(logger.Handler()),
-		make(chan event.GenericEvent))
+		make(chan event.GenericEvent, eventChanBuffer))
 	airC := controller.NewAIGatewayRouteController(fakeClient, fakeClientSet, logr.FromSlogHandler(logger.Handler()),
-		make(chan event.GenericEvent), "/",
+		make(chan event.GenericEvent, eventChanBuffer), "/",
 	)
 	mcpC := controller.NewMCPRouteController(fakeClient, fakeClientSet, logr.FromSlogHandler(logger.Handler()),
-		make(chan event.GenericEvent),
+		make(chan event.GenericEvent, eventChanBuffer),
 	)
-	gwC := controller.NewGatewayController(fakeClient, fakeClientSet, logr.FromSlogHandler(logger.Handler()),
+	gwC := controller.NewGatewayController(fakeClient, fakeClientSet, logr.FromSlogHandler(logger.Handler()), "envoy-gateway-system",
 		"docker.io/envoyproxy/ai-gateway-extproc:latest", "debug", true, func() string {
 			return "aigw-translate"
 		}, false,
 	)
+	// Pre-create Gateways (without reconciling) before reconciling resources so that
+	// syncGateways can resolve the parent Gateway via the fake client.
+	// Otherwise the reconcile would fail with "gateway not found" because the
+	// Gateway is not yet present in the cache at this point.
+	for _, gw := range gws {
+		mustCreate(ctx, fakeClient, gw, logger)
+	}
 	// Create and reconcile the custom resources to store the translated objects.
 	// Note that the order of creation is important as some objects depend on others.
 	for _, btp := range backendTLSPolicies {
@@ -267,7 +277,7 @@ func translateCustomResourceObjects(
 		mustCreateAndReconcile(ctx, fakeClient, mcpRoute, mcpC, logger)
 	}
 	for _, gw := range gws {
-		mustCreateAndReconcile(ctx, fakeClient, gw, gwC, logger)
+		mustReconcile(ctx, gw, gwC, logger)
 	}
 
 	// Now you can retrieve the translated objects from the fake client.
@@ -347,6 +357,16 @@ func mustCreateAndReconcile(
 	logger *slog.Logger,
 ) {
 	mustCreate(ctx, fakeClient, obj, logger)
+	mustReconcile(ctx, obj, c, logger)
+}
+
+// mustReconcile reconciles the object using the provided reconciler.
+func mustReconcile(
+	ctx context.Context,
+	obj client.Object,
+	c reconcile.TypedReconciler[reconcile.Request],
+	logger *slog.Logger,
+) {
 	logger.Info("Fake reconciling", "kind", obj.GetObjectKind().GroupVersionKind().Kind, "name", obj.GetName())
 	_, err := c.Reconcile(ctx, reconcile.Request{NamespacedName: types.NamespacedName{Namespace: obj.GetNamespace(), Name: obj.GetName()}})
 	if err != nil {