Merge branch 'main' of ssh://github.com/envoyproxy/ai-gateway

Author: siddharth1036

.codespell.ignorewords

@@ -5,3 +5,9 @@ charset = utf-8
 end_of_line = lf
 insert_final_newline = true
 trim_trailing_whitespace = true
+
+# Automatically formatted by prettier, which sometimes has trailing whitespace
+# in codeblocks. We don't need to check here since it's the formatting is checked
+# instead.
+[*.md]
+trim_trailing_whitespace = false

.codespell.skip

@@ -1,2 +1,4 @@
 CHAT_MODEL=qwen2.5:0.5b
+THINKING_MODEL=qwen3:1.7b
+COMPLETION_MODEL=qwen2.5:0.5b
 EMBEDDINGS_MODEL=all-minilm:33m

.editorconfig

@@ -1,5 +1,5 @@
 blank_issues_enabled: false
 contact_links:
-- name: "Crash bug"
-  url: https://github.com/envoyproxy/envoy/security/policy
-  about: "Please file any crash bug with [email protected]."
+  - name: "Crash bug"
+    url: https://github.com/envoyproxy/envoy/security/policy
+    about: "Please file any crash bug with [email protected]."

.env.ollama

@@ -1,15 +1,16 @@
 ---
 name: Feature request
 about: Suggest an idea for this project
-title: ''
+title: ""
 labels: enhancement,triage
-assignees: ''
-
+assignees: ""
 ---
 
-*Description*:
->Describe the desired behavior, what scenario it enables and how it
-would be used.
+_Description_:
+
+> Describe the desired behavior, what scenario it enables and how it
+> would be used.
 
 [optional *Relevant Links*:]
->Any extra documentation required to understand the issue.
+
+> Any extra documentation required to understand the issue.

.github/ISSUE_TEMPLATE/config.yml

@@ -1,26 +1,29 @@
 ---
 name: Bug
 about: Bugs
-title: ''
+title: ""
 labels: bug,triage
-assignees: ''
-
+assignees: ""
 ---
 
-*Description*:
->What issue is being seen? Describe what should be happening instead of
-the bug, for example: Envoy should not crash, the expected value isn't
-returned, etc.
+_Description_:
+
+> What issue is being seen? Describe what should be happening instead of
+> the bug, for example: Envoy should not crash, the expected value isn't
+> returned, etc.
+
+_Repro steps_:
 
-*Repro steps*:
 > Include sample requests, environment, etc. All data and inputs
-required to reproduce the bug.
+> required to reproduce the bug.
+
+> **Note**: If there are privacy concerns, sanitize the data prior to
+> sharing.
+
+_Environment_:
 
->**Note**: If there are privacy concerns, sanitize the data prior to
-sharing.
+> Include the environment like gateway version, envoy version and so on.
 
-*Environment*:
->Include the environment like gateway version, envoy version and so on.
+_Logs_:
 
-*Logs*:
->Include the access logs and the Envoy logs.
+> Include the access logs and the Envoy logs.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,14 +1,15 @@
 ---
 name: Other
 about: Questions, design proposals, tech debt, etc.
-title: ''
+title: ""
 labels: triage
-assignees: ''
-
+assignees: ""
 ---
 
-*Description*:
->Describe the issue.
+_Description_:
+
+> Describe the issue.
 
 [optional *Relevant Links*:]
->Any extra documentation required to understand the issue.
+
+> Any extra documentation required to understand the issue.

.github/ISSUE_TEMPLATE/non--crash-security--bug.md

@@ -20,5 +20,6 @@ ignore:
   - "tests/internal/e2elib/**/*"
   - "tests/internal/testenvironment/**/*"
   - "tests/internal/testopeninference/openai_proxy.go"
+  - "tests/internal/testmcp/**/*"
   - "internal/testing/**/*"
   - "internal/controller/controller.go"

.github/ISSUE_TEMPLATE/other.md

@@ -2,18 +2,18 @@ name: Build and Test
 on:
   pull_request:
     branches:
-      - 'main'
+      - "main"
       # Release branches are like "release/v0.1", "release/v0.2", etc. where we backport the changes to non EOL versions.
       # The branch will be created from the main branch after the initial release tag is cut. For example, when we cut v0.8.0 release,
       # we will create a branch "release/v0.8" from the main branch. For rc release, we simply iterate on main branch.
       #
       # See RELEASES.md for more details.
-      - 'release/**'
+      - "release/**"
 
   push:
     branches:
-      - 'main'
-      - 'release/**'
+      - "main"
+      - "release/**"
 
 concurrency:
   # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-concurrency-to-cancel-any-in-progress-job-or-run
@@ -38,8 +38,8 @@ jobs:
               - '!**/*.md'
               - '!site/**'
               - '!netlify.toml'
-          predicate-quantifier: every  # Make the filters be AND-ed
-          token: ""  # don't use github api
+          predicate-quantifier: every # Make the filters be AND-ed
+          token: "" # don't use github api
     outputs:
       code: ${{ steps.changes.outputs.code }}
 
@@ -74,18 +74,30 @@ jobs:
       - name: Start Ollama server
         if: matrix.os == 'ubuntu-latest'
         run: |
-          curl -fsSL https://ollama.com/install.sh | sh
+          curl -fsSL https://ollama.com/install.sh | sh && sudo systemctl stop ollama
+          nohup ollama serve > ollama.log 2>&1 &
           timeout 30 sh -c 'until nc -z localhost 11434; do sleep 1; done'
-          ollama pull qwen3:0.6b
-
+          grep _MODEL .env.ollama | cut -d= -f2 | xargs -I{} ollama pull {}
+        env:
+          OLLAMA_CONTEXT_LENGTH: 131072 # Larger context for goose
+          OLLAMA_HOST: 0.0.0.0
+      # Download Envoy via func-e using implicit default version `aigw` would
+      # otherwise need to download during test runs.
+      - name: Download Envoy via func-e
+        run: go tool -modfile=tools/go.mod func-e run --version
+        env:
+          FUNC_E_HOME: /tmp/envoy-gateway # hard-coded directory in EG
       - env:
           TEST_AWS_ACCESS_KEY_ID: ${{ secrets.AWS_BEDROCK_USER_AWS_ACCESS_KEY_ID }}
           TEST_AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_BEDROCK_USER_AWS_SECRET_ACCESS_KEY }}
           TEST_OPENAI_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_OPENAI_API_KEY }}
+          TEST_GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: make test-coverage
+      - if: failure()
+        run: cat ollama.log || true
       - name: Upload coverage to Codecov
         if: matrix.os == 'ubuntu-latest'
-        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24  # v5.4.3
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
         with:
           fail_ci_if_error: true
           files: ./out/go-test-coverage.out
@@ -157,9 +169,9 @@ jobs:
         # Once it's supported, the following "binary installation" steps below can be just removed and
         # we can simply exec.Cmd with "go tool -modfile=tools/go.mod func-e run" with the envoy version configured via ENVOY_VERSION env var.
         include:
-          - version: 1.35.0  # NOTE: when updating this, also update the comment in the CONTRIBUTING.md file.
+          - version: 1.35.0 # NOTE: when updating this, also update the comment in the CONTRIBUTING.md file.
             os: ubuntu-latest
-          - version: 1.35.0  # NOTE: when updating this, also update the comment in the CONTRIBUTING.md file.
+          - version: 1.35.0 # NOTE: when updating this, also update the comment in the CONTRIBUTING.md file.
             os: macos-latest
           - version: latest
             os: ubuntu-latest
@@ -199,6 +211,7 @@ jobs:
           TEST_GROK_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_GROK_API_KEY }}
           TEST_SAMBANOVA_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_SAMBANOVA_API_KEY }}
           TEST_DEEPINFRA_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_DEEPINFRA_API_KEY }}
+          TEST_GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: make test-extproc
 
   test_e2e:
@@ -242,23 +255,51 @@ jobs:
           TEST_GEMINI_API_KEY: ${{ secrets.ENVOY_AI_GATEWAY_GEMINI_API_KEY }}
         run: make test-e2e
 
+  test_e2e_upgrade:
+    needs: changes
+    if: ${{ needs.changes.outputs.code == 'true' }}
+    name: E2E Test for Upgrades (k8s ${{ matrix.k8s-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Note: this is to simply ensure that the controller working as expected with or without
+        # extproc being inserted as a k8s sidecar (init container with the restartPolicy=always).
+        # On newer k8s versions (v1.33+), that is always enabled by default, so we only need to test
+        # on older versions. After v1.32 reaches EOL, we can remove the older k8s versions from here.
+        k8s-version:
+          - v1.33.4
+          - v1.32.8
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          cache: false
+          go-version-file: go.mod
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/.cache/golangci-lint
+            ~/go/pkg/mod
+            ~/go/bin
+          key: e2e-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
+      - uses: docker/setup-buildx-action@v3
+      - run: make test-e2e-upgrade
+        env:
+          # We only need to test the upgrade from the latest stable version of EG.
+          EG_VERSION: v1.5.0
+          K8S_VERSION: ${{ matrix.k8s-version }}
+
   test_e2e_inference_extension:
     needs: changes
     if: ${{ needs.changes.outputs.code == 'true' }}
-    name: E2E Test for Inference Extensions (Envoy Gateway ${{ matrix.name }})
+    name: E2E Test for Inference Extensions
     # TODO: make it possible to run this job on macOS as well, which is a bit tricky due to the nested
     # virtualization is not supported on macOS runners.
     # E.g. Use https://github.com/douglascamata/setup-docker-macos-action  per the comment in
     # https://github.com/actions/runner-images/issues/17#issuecomment-1971073406
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: latest
-            envoy_gateway_version: v0.0.0-latest
-          - name: v1.5.0
-            envoy_gateway_version: v1.5.0
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -275,12 +316,90 @@ jobs:
           key: e2e-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
       - uses: docker/setup-buildx-action@v3
       - run: make test-e2e-inference-extension
+        env:
+          # We only need to test with the latest stable version of EG, since these e2e tests
+          # do not depend on the EG version.
+          EG_VERSION: v1.5.0
+
+  test_e2e_namespaced:
+    needs: changes
+    if: ${{ needs.changes.outputs.code == 'true' }}
+    name: E2E Test for Namespaced Controller
+    # TODO: make it possible to run this job on macOS as well, which is a bit tricky due to the nested
+    # virtualization is not supported on macOS runners.
+    # E.g. Use https://github.com/douglascamata/setup-docker-macos-action  per the comment in
+    # https://github.com/actions/runner-images/issues/17#issuecomment-1971073406
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          cache: false
+          go-version-file: go.mod
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/.cache/golangci-lint
+            ~/go/pkg/mod
+            ~/go/bin
+          key: e2e-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
+      - uses: docker/setup-buildx-action@v3
+      - run: make test-e2e-namespaced
+        env:
+          # We only need to test with the latest stable version of EG, since these e2e tests
+          # do not depend on the EG version.
+          EG_VERSION: v1.5.0
+
+  test_e2e_aigw:
+    needs: changes
+    name: E2E Test for aigw CLI
+    if: ${{ needs.changes.outputs.code == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          cache: false
+          go-version-file: go.mod
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/.cache/golangci-lint
+            ~/go/pkg/mod
+            ~/go/bin
+          key: e2e-aigw-test-${{ hashFiles('**/go.mod', '**/go.sum', '**/Makefile') }}
+      - uses: docker/setup-buildx-action@v3
+      - name: Start Ollama server
+        run: |
+          curl -fsSL https://ollama.com/install.sh | sh && sudo systemctl stop ollama
+          nohup ollama serve > ollama.log 2>&1 &
+          timeout 30 sh -c 'until nc -z localhost 11434; do sleep 1; done'
+          grep _MODEL .env.ollama | cut -d= -f2 | xargs -I{} ollama pull {}
+        env:
+          OLLAMA_CONTEXT_LENGTH: 131072 # Larger context for goose
+          OLLAMA_HOST: 0.0.0.0
+      # Download Envoy via func-e using implicit default version `aigw` would
+      # otherwise need to download during test runs.
+      - name: Download Envoy via func-e
+        run: go tool -modfile=tools/go.mod func-e run --version
+        env:
+          FUNC_E_HOME: /tmp/envoy-gateway # hard-coded directory in EG
+      - name: Install Goose
+        env:
+          GOOSE_VERSION: v1.8.0
+        run: |
+          curl -fsSL https://github.com/block/goose/releases/download/stable/download_cli.sh | CONFIGURE=false bash
+      - run: make test-e2e-aigw
+      - if: failure()
+        run: cat ollama.log || true
 
   docker_push:
     # Docker builds are verified in test_e2e job, so we only need to push the images when the event is a push event.
     if: github.event_name == 'push'
     name: Push Docker Images
-    needs: [unittest, test_crdcel, test_controller, test_extproc, test_e2e, test_e2e_inference_extension]
+    needs: [ci-required]
     uses: ./.github/workflows/docker_build_job.yaml
     secrets: inherit
 
@@ -312,7 +431,9 @@ jobs:
       - test_controller
       - test_extproc
       - test_e2e
+      - test_e2e_upgrade
       - test_e2e_inference_extension
+      - test_e2e_aigw
     # We need this to run always to force-fail (and not skip) if any needed
     # job has failed. Otherwise, a skipped job will not fail the workflow.
     if: always()