Highlights
ReferenceGrant warnings. Cross-namespace backendRefs (to a Service or ServiceImport) without a permitting ReferenceGrant now emit a CrossNamespaceRefNotPermitted Warning Event on the route and a log warning. Traffic is not blocked.
Important
A future release will block these references, per the Gateway API spec. Find affected routes with kubectl get events -A --field-selector reason=CrossNamespaceRefNotPermitted, then add a ReferenceGrant in the target namespace or repoint the backendRef. See ReferenceGrant.
DNSEndpoint opt-out. Annotate a route with application-networking.k8s.aws/dns-endpoint: disabled to stop the controller from managing its DNSEndpoint. An existing controller-owned DNSEndpoint is deleted; ExternalDNS removes the record only with --policy=sync.
Upgrade notes
- The controller
ClusterRoleaddsget/list/watchonreferencegrants. Helm anddeploy-v2.2.0.yamlinclude it. Without it the controller still works but emits no ReferenceGrant warnings. - No CRD changes.
What's Changed
- chore(deps): bump the github-actions group across 1 directory with 3 updates by @dependabot[bot] in #1009
- feat: warn on cross-namespace backendRefs without a ReferenceGrant by @liucalvin in #1005
- feat: allow opting out of DNSEndpoint creation per route by @moscicky in #1011
- fix: skip ReferenceGrant warnings when RBAC is missing by @liucalvin in #1017
- fix: verify Gateway ownership before IAMAuthPolicy SN cleanup by @liucalvin in #1015
- chore(deps): bump actions/setup-python from 6 to 7 in the github-actions group across 1 directory by @dependabot[bot] in #1014
- chore(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 in /test by @dependabot[bot] in #977
New Contributors
Full Changelog: v2.1.4...v2.2.0