feat: allow RateLimitRedisSettings.url to be sourced from a Secret by guanchzhou · Pull Request #9143 · envoyproxy/gateway

guanchzhou · 2026-06-02T11:52:49Z

What type of PR is this?

feat

What this PR does / why we need it:

Adds an optional urlRef field to RateLimitRedisSettings, mutually exclusive with url, that sources the global rate limit Redis URL from a Kubernetes Secret key:

rateLimit:
  backend:
    type: Redis
    redis:
      urlRef:
        secretKeyRef:
          name: ratelimit-redis-redisstd
          key: REDIS_ENDPOINT

This unblocks GitOps workflows where the Redis endpoint is provisioned dynamically by an external controller (e.g. Crossplane writes a connection Secret) rather than baked into the EnvoyGateway config as a literal string.

Design notes:

The rate-limit Deployment renders REDIS_URL via valueFrom.secretKeyRef, so the control plane never reads the secret value (mirrors how the Redis password is already injected). The referenced Secret must exist in the Envoy Gateway namespace.
Secret-only for now: a Redis URL can embed credentials in userinfo, and this matches the existing tls.certificateRef (Secret-only) precedent. configMapKeyRef can be added later as a non-breaking addition.
Exactly-one-of url/urlRef is enforced by a struct-level CEL rule (has(self.url) != has(self.urlRef)) and mirrored in Go config validation. url becomes optional but remains fully backward-compatible.
Includes the Validate() Secret/key existence check, unit + golden deployment tests, regenerated API reference, a docs example, and a release note.

Which issue(s) this PR fixes:

Fixes #9022

Release Notes: Yes

Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

netlify · 2026-06-02T11:52:55Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`54aa6a2`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a560807882d0d000862ce1b
😎 Deploy Preview	https://deploy-preview-9143--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e27bf30412

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

Signed-off-by: Andrey Maltsev <guanchzhou@gmail.com>

…ter (envoyproxy#9022) Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

zhaohuabing · 2026-06-08T08:01:20Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1c060f8d5c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

An optional Secret reference lets the rate limit container start even when the referenced Secret/key is absent, leaving REDIS_URL unset and global rate limiting nonfunctional instead of waiting for the externally provisioned Secret. Reject optional=true in Go config validation (with a mirrored CEL rule) so the Secret reference stays required. Addresses Codex review feedback on envoyproxy#9143. Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

zirain · 2026-06-10T01:41:53Z

@codex review

chatgpt-codex-connector · 2026-06-10T01:45:11Z

Codex Review: Didn't find any major issues. Nice work!

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

codecov · 2026-06-10T01:51:19Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.44%. Comparing base (c9e6a44) to head (54aa6a2).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9143      +/-   ##
==========================================
+ Coverage   75.41%   75.44%   +0.03%     
==========================================
  Files         252      252              
  Lines       41660    41691      +31     
==========================================
+ Hits        31416    31454      +38     
+ Misses       8115     8108       -7     
  Partials     2129     2129

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

Covers the patch-coverage gaps flagged by Codecov: nil redis settings, non-NotFound Secret get errors, the TLS certificateRef path in ratelimit.Validate, and ValidateRedisURL called directly. Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

zirain · 2026-06-14T13:41:39Z

you didn't need to rebase frequently, the maintainer will do that if needed before merging.

# Conflicts: # release-notes/current.yaml

zirain

Thanks!

arkodg · 2026-07-20T04:52:52Z

+	// Mutually exclusive with URLRef.
+	//
+	// +optional
+	URL string `json:"url,omitempty"`


this needs to be made a ptr

hey @guanchzhou can you address this as a follow up

Definitely @arkodg, thank you.

Done in #9538 — changed url to *string. Thanks @arkodg.

* api: make RateLimitRedisSettings.url a pointer Follow-up to #9143. url became optional (mutually exclusive with urlRef) but stayed a non-pointer string, so an unset value could not be distinguished from an explicit empty string. Make it *string so nil means unset, per review feedback. Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com> * api: use ptr.Deref for redis URL presence check Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com> --------- Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

guanchzhou added 7 commits June 2, 2026 14:49

api: add urlRef to RateLimitRedisSettings (envoyproxy#9022)

d066408

Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

api: validate ratelimit redis urlRef (envoyproxy#9022)

221d1e5

Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

infra: render REDIS_URL from secret when urlRef set (envoyproxy#9022)

e3d936e

Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

infra: validate ratelimit redis urlRef secret exists (envoyproxy#9022)

3283f6c

Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

generated: regenerate API reference for redis urlRef (envoyproxy#9022)

e2700fc

Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

docs: add ratelimit redis urlRef example (envoyproxy#9022)

d4a10fb

Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

docs: add release note for redis urlRef (envoyproxy#9022)

e27bf30

Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

guanchzhou requested a review from a team as a code owner June 2, 2026 11:52

guanchzhou mentioned this pull request Jun 2, 2026

Allow RateLimitRedisSettings.url to be sourced from a Secret or ConfigMap #9022

Closed

chatgpt-codex-connector Bot reviewed Jun 2, 2026

View reviewed changes

Comment thread internal/infrastructure/kubernetes/ratelimit/resource.go Outdated

guanchzhou and others added 6 commits June 2, 2026 15:05

fix: validate secret-sourced ratelimit redis url value (envoyproxy#9022)

f9381d1

Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

Merge branch 'main' into redis-url-secret-ref-pr

fcb80a1

Signed-off-by: Andrey Maltsev <guanchzhou@gmail.com>

fix: don't block ratelimit infra when urlRef secret is provisioned la…

e0546ed

…ter (envoyproxy#9022) Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

Merge branch 'main' into redis-url-secret-ref-pr

2c52a51

Merge branch 'main' into redis-url-secret-ref-pr

e6d2dfa

Merge branch 'main' into redis-url-secret-ref-pr

1c060f8

chatgpt-codex-connector Bot reviewed Jun 8, 2026

View reviewed changes

Comment thread internal/infrastructure/kubernetes/ratelimit/resource.go

guanchzhou and others added 2 commits June 8, 2026 13:15

Merge branch 'main' into redis-url-secret-ref-pr

ded3ca5

guanchzhou and others added 3 commits June 10, 2026 10:58

fix(lint): use new() builtin instead of ptr.To in validation tests

5e907f0

Signed-off-by: Andrey Maltsev <maltsev.andrey@gmail.com>

Merge branch 'main' into redis-url-secret-ref-pr

042e518

zirain previously approved these changes Jun 12, 2026

View reviewed changes

Merge branch 'main' into redis-url-secret-ref-pr

0cff992

Merge remote-tracking branch 'origin/main' into redis-url-secret-ref-pr

3032d2c

# Conflicts: # release-notes/current.yaml

guanchzhou dismissed zirain’s stale review via 3032d2c June 25, 2026 10:38

Merge branch 'main' into redis-url-secret-ref-pr

54aa6a2

zirain added this to the v1.9.0-rc.1 Release milestone Jul 14, 2026

zirain approved these changes Jul 14, 2026

View reviewed changes

arkodg reviewed Jul 20, 2026

View reviewed changes

arkodg approved these changes Jul 20, 2026

View reviewed changes

arkodg merged commit 6c72ce4 into envoyproxy:main Jul 20, 2026
62 of 68 checks passed

guanchzhou deleted the redis-url-secret-ref-pr branch July 21, 2026 08:01

guanchzhou mentioned this pull request Jul 21, 2026

api: make RateLimitRedisSettings.url a pointer #9538

Merged

Uh oh!

Conversation

guanchzhou commented Jun 2, 2026

Uh oh!

netlify Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

zhaohuabing commented Jun 8, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

zirain commented Jun 10, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jun 10, 2026

Uh oh!

codecov Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

zirain commented Jun 14, 2026

Uh oh!

zirain left a comment

Choose a reason for hiding this comment

Uh oh!

arkodg Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

arkodg Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

guanchzhou Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

guanchzhou Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

netlify Bot commented Jun 2, 2026 •

edited

Loading

codecov Bot commented Jun 10, 2026 •

edited

Loading