DO NOT MERGE: initial v1.4.0 feedback

.custom-gcl.yml

@@ -0,0 +1,6 @@
+version: v2.2.1
+name: golangci-kube-api-linter
+destination: ./bin
+plugins:
+- module: 'sigs.k8s.io/kube-api-linter'
+  version: 'v0.0.0-20250715075424-4fab82d26a8e' # Pin to a commit while there's no tag

.github/dependabot.yml

@@ -30,17 +30,6 @@ updates:
       - ok-to-test
       - release-note-none
 
-  # Dependencies listed in .github/workflows/*.yml
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    labels:
-      - github_actions
-      - dependencies
-      - ok-to-test
-      - release-note-none
-
   # Dependencies listed in Dockerfile
   - package-ecosystem: "docker"
     directory: "/"

.github/workflows/crd-validation.yml

@@ -0,0 +1,32 @@
+name: CRD Validation
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+# Remove all permissions from GITHUB_TOKEN except metadata.
+permissions: {}
+
+jobs:
+  crd-validation:
+    name: CEL
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Available versions at https://raw.githubusercontent.com/kubernetes-sigs/controller-tools/HEAD/envtest-releases.yaml
+        k8s_version: [v1.33.0, v1.32.0, v1.31.0, v1.30.3, v1.29.5]
+        crd_channel: [standard, experimental]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
+        with:
+          persist-credentials: false
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
+      - name: Run CRD Validation tests
+        env:
+          K8S_VERSION: ${{ matrix.k8s_version }}
+          CRD_CHANNEL: ${{ matrix.crd_channel }}
+        run: |
+          make CEL_TEST_K8S_VERSION="${K8S_VERSION}" CEL_TEST_CRD_CHANNEL="${CRD_CHANNEL}" test.crds-validation

.github/workflows/kal.yml

@@ -0,0 +1,28 @@
+name: PR golangci-lint
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+# Remove all permissions from GITHUB_TOKEN except metadata.
+permissions: {}
+
+jobs:
+  golangci:
+    name: kube-api-lint
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
+        name: Checkout code
+        with:
+          persist-credentials: false
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
+      - name: Install Golang CI Lint
+        run: go install github.com/golangci/golangci-lint/v2/cmd/[email protected]
+      - name: Build KAL
+        run: golangci-lint custom
+      - name: run api linter
+        run: ./bin/golangci-kube-api-linter run -c ./.golangci-kal.yml ./...

.golangci-kal.yml

@@ -0,0 +1,38 @@
+version: "2"
+linters:
+  default: none
+  enable:
+    - kubeapilinter
+  settings:
+    custom:
+      kubeapilinter:
+        type: module
+        description: Kube API LInter lints Kube like APIs based on API conventions and best practices.
+        settings:
+          linters:
+            enable:
+              - "duplicatemarkers" # Ensure there are no exact duplicate markers. for types and fields.
+              - "jsontags" # Ensure every field has a json tag.
+              - "nofloats" # Ensure floats are not used.
+              - "nomaps" # Ensure maps are not used.
+              - "nophase" # Phase fields are discouraged by the Kube API conventions, use conditions instead.
+              - "optionalorrequired" # Every field should be marked as `+optional` or `+required`.
+              - "ssatags" # Ensure proper Server-Side Apply (SSA) tags on array fields.
+              - "statussubresource" # All root objects that have a `status` field should have a status subresource.
+              - "uniquemarkers" # Ensure that types and fields do not contain more than a single definition of a marker that should only be present once.
+            disable:
+              - "*"
+          lintersConfig: {}
+  exclusions:
+    generated: strict
+    paths:
+      - conformance/
+    paths-except:
+      - apis/
+      - apisx/
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+run:
+  timeout: 5m
+  tests: false

Makefile

@@ -54,6 +54,10 @@ ROOT := $(abspath $(TOP))
 CONFORMANCE_FLAGS ?=
 GO_TEST_FLAGS ?=
 
+# Flags for CRD validation tests
+CEL_TEST_K8S_VERSION ?= 
+CEL_TEST_CRD_CHANNEL ?= standard
+
 all: generate vet fmt verify test
 
 # Run generators for protos, Deepcopy funcs, CRDs, and docs.
@@ -85,7 +89,8 @@ test:
 # Run tests for CRDs validation
 .PHONY: test.crds-validation
 test.crds-validation:
-	./hack/test-crds-validation.sh $(VERSION)
+	K8S_VERSION=$(CEL_TEST_K8S_VERSION) CRD_CHANNEL=$(CEL_TEST_CRD_CHANNEL) go test ${GO_TEST_FLAGS} -count=1 -timeout=120s --tags=$(CEL_TEST_CRD_CHANNEL) -v ./pkg/test/cel
+	K8S_VERSION=$(CEL_TEST_K8S_VERSION) CRD_CHANNEL=$(CEL_TEST_CRD_CHANNEL) go test ${GO_TEST_FLAGS} -count=1 -timeout=120s -v ./pkg/test/crd
 
 # Run conformance tests against controller implementation
 .PHONY: conformance

OWNERS_ALIASES

@@ -26,15 +26,14 @@ aliases:
     - howardjohn
     - mikemorris
     - kflynn
+    - LiorLieberman
 
   emeritus-gateway-api-mesh-leads:
     - keithmattix
 
   gateway-api-conformance-reviewers:
     - candita
-    - michaelbeaumont
     - sunjayBhatia
-    - xunzhuo
 
   gateway-api-conformance-approvers:
     - arkodg

README.md

@@ -71,7 +71,7 @@ Participation in the Kubernetes community is governed by the
 [spec]: https://gateway-api.sigs.k8s.io/reference/spec/
 [concepts]: https://gateway-api.sigs.k8s.io/concepts/api-overview
 [security-model]: https://gateway-api.sigs.k8s.io/concepts/security-model
-[gh_release]: https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.2.1
+[gh_release]: https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.3.0
 [godoc]: https://pkg.go.dev/sigs.k8s.io/gateway-api
 [conformance-docs]: https://gateway-api.sigs.k8s.io/concepts/conformance/
 [reports-readme]: ./conformance/reports/README.md

RELEASE_MANAGEMENT.md

@@ -107,5 +107,25 @@ volunteers the release may simply end being a smaller **maintenance release**.
 Release candidates--and the eventual final release--must utilize the [Release
 Process](/RELEASE.md) for delivery.
 
+As the release nears completion, the release-manager should proactively reach
+out to implementations to get them ready to send conformance reports for the
+final release when it is cut.
+
 [Release Cycle]:https://gateway-api.sigs.k8s.io/contributing/release-cycle/
 [Milestone]:#github-milestone
+
+## Time Extensions
+
+Extensions to timelines may be requested by contributors. Our guidelines for
+this are based on the Kubernetes process:
+
+* Extensions can be granted on a per-GEP basis
+  * The owners of the GEP have to ask and provide a timeline (measured in
+    days) as to when they believe the GEP will be ready for merge.
+* The request and approval for a GEP extension needs to be in public.
+* Extensions can only be granted with a majority agreement by maintainers
+  / release-managers
+
+For our purposes we use GitHub discussions as the public place for
+requesting/approving extensions. Contributors should use an existing
+discussion for the release when feasible, otherwise create a discussion.