fix: API key auth by zhaohuabing · Pull Request #8267 · envoyproxy/gateway

zhaohuabing · 2026-02-13T01:46:06Z

This PR reverts the Secrets transform in #8045 since the keys in API key auth secrets are not fixed. An e2e test is also added to prevent regression.

fixes: #8227
release note: yes

netlify · 2026-02-13T01:46:12Z

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name	Link
🔨 Latest commit	`de88d63`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/698e93e83f00b10009dd1634

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

codecov · 2026-02-13T01:54:56Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.81%. Comparing base (e37bcdc) to head (de88d63).
⚠️ Report is 9 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8267   +/-   ##
=======================================
  Coverage   73.80%   73.81%           
=======================================
  Files         241      241           
  Lines       36609    36602    -7     
=======================================
- Hits        27019    27017    -2     
+ Misses       7684     7679    -5     
  Partials     1906     1906

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

arkodg · 2026-02-14T17:36:35Z

hey @zhaohuabing thanks for flagging this, can we raise a first class revert PR with using git revert and link the raised issue there instead, for easier tracking

cc @rudrakhp

zhaohuabing · 2026-02-15T06:58:07Z

hey @zhaohuabing thanks for flagging this, can we raise a first class revert PR with using git revert and link the raised issue there instead, for easier tracking

cc @rudrakhp

This PR only reverts the Secret part in ##8045, the transform for ConfigMap is kept as it is - the API key auth only uses Secrets.

arkodg · 2026-02-15T08:10:05Z

hey @zhaohuabing thanks for flagging this, can we raise a first class revert PR with using git revert and link the raised issue there instead, for easier tracking
cc @rudrakhp

This PR only reverts the Secret part in #8227, the transform for ConfigMap is kept as it is - the API key auth only uses Secrets.

Sometimes we pick the first key from ConfigMaps even if it's not the well known key, so we'll need to revert the complete change

rudrakhp · 2026-02-15T09:39:18Z

Sometimes we pick the first key from ConfigMaps even if it's not the well known key, so we'll need to revert the complete change

@arkodg this is already handled in #8045

This PR reverts the Secrets transform in #8045 since the keys in API key auth secrets are not fixed.

@zhaohuabing ~~are we not getting the first key in these cases? We are already falling back to first key if well known key doesn't exist.~~

PS: Ok I see from the E2E, that key is dynamically determined by the request headers, so fallback to first key is not enough here. Makes sense to revert it for secrets. I don't think we have such a case for ConfigMaps.

* add test for multiple keys Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * revert secret transform Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

* add test for multiple keys Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * revert secret transform Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* api: make ConnectionLimit.Value optional (#8478) * api: make ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> * release-notes: add entry for ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> * fix: add CEL rule to require value when closeDelay is set Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> --------- Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix up release notes Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner (#8387) * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner Signed-off-by: y-rabie <youssef.rabie@procore.com> * polish Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add e2e test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * release note Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * truncate policy status & add tests Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: y-rabie <youssef.rabie@procore.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: y-rabie <youssef.rabie@procore.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: active health check respect endpoint hostname (#8452) revert unrelated changes Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: exclude unmanaged route parents from xPolicy status ancestors (#8321) * add test for mixed managed and unmanaged Gateway parents Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix the policy status when the targeting routes have managed and unmanged Gateway parents Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: add ownerReferences to ratelimit ConfigMap and HPA (#8358) Signed-off-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com> Co-authored-by: Karol Szwaj <karol.szwaj@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: computeHosts doesn't work when listener and route both wildcard (#8186) * fix: computeHosts doesn't work when listener and route both wildcard Signed-off-by: zirain <zirain2009@gmail.com> * remove skipped tests Signed-off-by: zirain <zirain2009@gmail.com> * Update internal/gatewayapi/helpers.go Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies (#8210) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: XListenerSet allows route from same namespace (#8226) Previously, using allowedRoutes/Same for an XListenerSet with an xRoute in the same namespace would return an error. Now it properly allows xRoutes from the same namespace. Signed-off-by: Kris Hicks <khicks@nvidia.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: API key auth (#8267) * add test for multiple keys Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * revert secret transform Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix gen-check Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * add release notes Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * add release notes for envoy proxy image Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> --------- Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> Signed-off-by: y-rabie <youssef.rabie@procore.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com> Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Kris Hicks <khicks@nvidia.com> Co-authored-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: y-rabie <youssef.rabie@procore.com> Co-authored-by: zirain <zirain2009@gmail.com> Co-authored-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Co-authored-by: Kris Hicks <khicks@nvidia.com>

zhaohuabing requested a review from a team as a code owner February 13, 2026 01:46

zhaohuabing marked this pull request as draft February 13, 2026 01:46

add test for multiple keys

5ff9797

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

zhaohuabing force-pushed the fix-8227 branch from 0b7eb4e to 11be11c Compare February 13, 2026 02:34

zhaohuabing added the cherrypick/release-v1.7.1 label Feb 13, 2026

zhaohuabing force-pushed the fix-8227 branch from 11be11c to d6f5ca4 Compare February 13, 2026 02:50

revert secret transform

de88d63

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

zhaohuabing force-pushed the fix-8227 branch from d6f5ca4 to de88d63 Compare February 13, 2026 03:00

zhaohuabing marked this pull request as ready for review February 13, 2026 03:55

zirain approved these changes Feb 13, 2026

View reviewed changes

zhaohuabing requested a review from a team February 14, 2026 00:32

rudrakhp approved these changes Feb 15, 2026

View reviewed changes

zhaohuabing requested a review from arkodg February 15, 2026 14:35

arkodg approved these changes Feb 15, 2026

View reviewed changes

zhaohuabing merged commit 38b0ad1 into envoyproxy:main Feb 16, 2026
36 checks passed

zhaohuabing deleted the fix-8227 branch February 16, 2026 01:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: API key auth#8267

fix: API key auth#8267
zhaohuabing merged 2 commits intoenvoyproxy:mainfrom
zhaohuabing:fix-8227

zhaohuabing commented Feb 13, 2026 •

edited

Loading

Uh oh!

netlify bot commented Feb 13, 2026 •

edited

Loading

Uh oh!

codecov bot commented Feb 13, 2026 •

edited

Loading

Uh oh!

arkodg commented Feb 14, 2026

Uh oh!

zhaohuabing commented Feb 15, 2026 •

edited

Loading

Uh oh!

arkodg commented Feb 15, 2026

Uh oh!

rudrakhp commented Feb 15, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

zhaohuabing commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Uh oh!

codecov bot commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

arkodg commented Feb 14, 2026

Uh oh!

zhaohuabing commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

arkodg commented Feb 15, 2026

Uh oh!

rudrakhp commented Feb 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

zhaohuabing commented Feb 13, 2026 •

edited

Loading

netlify bot commented Feb 13, 2026 •

edited

Loading

codecov bot commented Feb 13, 2026 •

edited

Loading

zhaohuabing commented Feb 15, 2026 •

edited

Loading

rudrakhp commented Feb 15, 2026 •

edited

Loading