Merge branch 'main' into tests/nfr-tests-edge

Author: ciarams87

.pre-commit-config.yaml

@@ -26,7 +26,7 @@ repos:
         exclude: (^examples/|^docs/|.*_test.go$)
 
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.28.0
+    rev: v8.29.0
     hooks:
       - id: gitleaks
 

go.mod

@@ -3,7 +3,7 @@ module github.com/nginx/nginx-gateway-fabric/v2
 go 1.24.2
 
 require (
-	github.com/envoyproxy/go-control-plane/envoy v1.35.0
+	github.com/envoyproxy/go-control-plane/envoy v1.36.0
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/go-logr/logr v1.4.3
 	github.com/google/go-cmp v0.7.0

go.sum

@@ -45,8 +45,8 @@ github.com/ebitengine/purego v0.8.4 h1:CF7LEKg5FFOsASUj0+QwaXf8Ht6TlFxg09+S9wz0o
 github.com/ebitengine/purego v0.8.4/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
 github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/envoyproxy/go-control-plane/envoy v1.35.0 h1:ixjkELDE+ru6idPxcHLj8LBVc2bFP7iBytj353BoHUo=
-github.com/envoyproxy/go-control-plane/envoy v1.35.0/go.mod h1:09qwbGVuSWWAyN5t/b3iyVfz5+z8QWGrzkoqm/8SbEs=
+github.com/envoyproxy/go-control-plane/envoy v1.36.0 h1:yg/JjO5E7ubRyKX3m07GF3reDNEnfOboJ0QySbH736g=
+github.com/envoyproxy/go-control-plane/envoy v1.36.0/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98=
 github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
 github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
 github.com/evanphx/json-patch v0.5.2 h1:xVCHIVMUu1wtM/VkR9jVZ45N3FhZfYMMYGorLCR8P3k=

internal/controller/nginx/modules/package-lock.json

@@ -10,9 +10,9 @@
     "clean": "rm -rf node_modules coverage"
   },
   "devDependencies": {
-    "@vitest/coverage-v8": "^4.0.6",
+    "@vitest/coverage-v8": "^4.0.7",
     "prettier": "3.6.2",
-    "vitest": "^4.0.6"
+    "vitest": "^4.0.7"
   },
   "type": "module"
 }

internal/controller/nginx/modules/package.json

@@ -2,6 +2,8 @@ package provisioner
 
 import (
 	"maps"
+	"slices"
+	"strings"
 
 	appsv1 "k8s.io/api/apps/v1"
 	autoscalingv2 "k8s.io/api/autoscaling/v2"
@@ -83,8 +85,56 @@ func serviceSpecSetter(
 	objectMeta metav1.ObjectMeta,
 ) controllerutil.MutateFn {
 	return func() error {
+		const managedKeysAnnotation = "gateway.nginx.org/internal-managed-annotation-keys"
+
+		// Track which annotation keys NGF currently manages
+		currentManagedKeys := make(map[string]bool)
+		for k := range objectMeta.Annotations {
+			currentManagedKeys[k] = true
+		}
+
+		// Get previously managed keys from existing service
+		var previousManagedKeys map[string]bool
+		if prevKeysStr, ok := service.Annotations[managedKeysAnnotation]; ok {
+			previousManagedKeys = make(map[string]bool)
+			for _, k := range strings.Split(prevKeysStr, ",") {
+				if k != "" {
+					previousManagedKeys[k] = true
+				}
+			}
+		}
+
+		// Start with existing annotations (preserves external controller annotations)
+		mergedAnnotations := make(map[string]string)
+		for k, v := range service.Annotations {
+			// Skip the internal tracking annotation
+			if k == managedKeysAnnotation {
+				continue
+			}
+			// Remove annotations that NGF previously managed but no longer wants
+			if previousManagedKeys != nil && previousManagedKeys[k] && !currentManagedKeys[k] {
+				continue // Remove this annotation
+			}
+			mergedAnnotations[k] = v
+		}
+
+		// Apply NGF-managed annotations (take precedence)
+		for k, v := range objectMeta.Annotations {
+			mergedAnnotations[k] = v
+		}
+
+		// Store current managed keys for next reconciliation
+		if len(currentManagedKeys) > 0 {
+			var managedKeysList []string
+			for k := range currentManagedKeys {
+				managedKeysList = append(managedKeysList, k)
+			}
+			slices.Sort(managedKeysList) // Sort for deterministic output
+			mergedAnnotations[managedKeysAnnotation] = strings.Join(managedKeysList, ",")
+		}
+
 		service.Labels = objectMeta.Labels
-		service.Annotations = objectMeta.Annotations
+		service.Annotations = mergedAnnotations
 		service.Spec = spec
 		return nil
 	}