fix(deps): update module go.datum.net/network-services-operator to v0.25.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
go.datum.net/network-services-operator	v0.21.10-0.20260528021428-b0f2347f5359 → v0.25.0

---

Release Notes

datum-cloud/network-services-operator (go.datum.net/network-services-operator)

v0.25.0: — Location coordinates & gateway policy status RBAC fix

Compare Source

Adds map-ready coordinates to Location resources and closes a gap where
Envoy Gateway policy status silently failed to reach tenants.

What's new

• Location coordinates — Location.spec gains an optional coordinates
  (latitude/longitude) field, so consumers like the compute portal's instance
  map no longer need a hand-rolled city-code lookup; existing Locations are
  unaffected. (#​328)
• Gateway policy status RBAC fix — the manager now has status write
  access on gateway.envoyproxy.io resources, so held SecurityPolicy
  conditions (e.g. PendingSecret) and edge status for
  BackendTrafficPolicy/Backend/HTTPRouteFilter reach tenants instead of
  failing silently on every reconcile. (#​324)
• Docs — gateway certificate issuance model reference, and extended
  concision rules to GitHub PR/issue prose.
  (#​307,
  #​325)

[!NOTE]
No breaking schema changes. The only CRD change is the additive, optional
coordinates field on Location above — existing resources and clients
keep working without any update.

v0.24.8

Compare Source

What's Changed

• feat: auto-propagate secrets referenced by gateway policies by @​ecv in #​314
• feat: expose SecurityPolicy status metrics by @​ecv in #​313
• feat: add verification refresh knob to Domain spec by @​ecv in #​299
• feat: generalize controller-health alerts to all controllers by @​ecv in #​306
• docs: track version pins in prod-fidelity e2e env by @​ecv in #​308
• docs: document HTTPRoute attachment contract by @​ecv in #​309
• docs: add running the operator locally guide by @​ecv in #​310
• docs: scope 80-char hard-wrap to commit messages by @​ecv in #​323
• fix: Use relative owner names for Gateway DNS by @​mattdjenkinson in #​318

Full Changelog: datum-cloud/network-services-operator@v0.24.7...v0.24.8

v0.24.7

Compare Source

What's changed

A SecurityPolicy that references a missing OIDC client secret is now held back instead of being pushed to the shared edge proxy. Previously such a policy could poison the proxy's config on its next full refresh and take neighbouring routes down with it; the policy now waits, reports why, and its failure stays contained to its own route.

• Hold SecurityPolicy until its referenced secret is present (#​304)

Full changelog: datum-cloud/network-services-operator@v0.24.6...v0.24.7

v0.24.6: — Connector engage fix & prompt conflict retry

Compare Source

What's Changed

• fix: requeue HTTPProxy promptly on write conflict by @​ecv in #​303
• fix: tolerate clusters without Lease discovery by @​ecv in #​301

Full Changelog: datum-cloud/network-services-operator@v0.24.5...v0.24.6

v0.24.5: — Faster HTTPProxy convergence & gateway class guards

Compare Source

What's Changed

• feat(telemetry): alert on gateway reconcile-error ratio by @​ecv in #​282
• fix: put HTTPProxy Gateway creation on the fast path by @​ecv in #​294
• fix: recreate EndpointSlice on FQDN/IP origin flip by @​ecv in #​296
• feat: reject duplicate domain names on create by @​ecv in #​297
• feat: reject Gateway with unmanaged GatewayClass by @​ecv in #​298
• fix: requeue gateway when its GatewayClass is unavailable by @​ecv in #​300
• test: cover cert cleanup on hostname removal by @​ecv in #​302

Full Changelog: datum-cloud/network-services-operator@v0.24.4...v0.24.5

v0.24.4: — Reap DNS records on hostname removal

Compare Source

What's Changed

• fix: reap DNS record when a hostname is removed by @​mattdjenkinson in #​284
• test: DNS record reap suite for #​283 (stacked on #​284) by @​ecv in #​285
• test: migrate httproute-accepted e2e from infra by @​ecv in #​237
• test: add Network and NetworkContext lifecycle e2e by @​ecv in #​281

Full Changelog: datum-cloud/network-services-operator@v0.24.3...v0.24.4

v0.24.3

Compare Source

What's Changed

• ci: run federated edge e2e against real Karmada by @​ecv in #​280

Full Changelog: datum-cloud/network-services-operator@v0.24.2...v0.24.3

v0.24.2

Compare Source

What's Changed

• fix: allow RESPONSE_CODE_DETAILS and START_TIME in error page by @​mattdjenkinson in #​277

Full Changelog: datum-cloud/network-services-operator@v0.24.1...v0.24.2

v0.24.1

Compare Source

What's Changed

• fix: Let the edge report the protections it was told to run by @​scotwells in #​224
• fix: Confirm the edge is actually running the configuration it was given by @​scotwells in #​225
• test(infra): prod-fidelity edge test env + e2e suite by @​ecv in #​276
• tests: Prove the edge's core guarantees with real traffic by @​scotwells in #​228
• fix: Carry edge policy from the control plane out to the edges by @​scotwells in #​227

Full Changelog: datum-cloud/network-services-operator@v0.24.0...v0.24.1

v0.24.0

Compare Source

What's Changed

• feat(telemetry): implement Envoy access log billing pipeline and E2E test environment by @​JoseSzycho in #​239

Full Changelog: datum-cloud/network-services-operator@v0.23.14...v0.24.0

v0.23.14

Compare Source

What's Changed

• fix(activity-policies): gate create rules on 2xx outcome by @​ecv in #​241
• test: prove activity-policy audit rules gate on 2xx outcome by @​ecv in #​271
• fix: gate ActivityPolicy create/update audit rules on 2xx outcome by @​ecv in #​230
• test: add inverted-paranoia WAF enforcement e2e by @​ecv in #​272
• fix: neutralize persisted inverted TPP on the coraza edge path (#​252 follow-up) by @​ecv in #​274

Full Changelog: datum-cloud/network-services-operator@v0.23.13...v0.23.14

v0.23.13

Compare Source

What's Changed

• docs: delineate cert health-gating from re-issuance by @​ecv in #​262
• fix: install downstream WAF data plane in e2e CI (#​263) by @​ecv in #​268

Full Changelog: datum-cloud/network-services-operator@v0.23.12...v0.23.13

v0.23.12

Compare Source

What's Changed

• fix: flag inverted TrafficProtectionPolicy paranoia levels via status condition by @​ecv in #​252

Full Changelog: datum-cloud/network-services-operator@v0.23.11...v0.23.12

v0.23.11

Compare Source

What's Changed

• fix(test): wait for CA Certificate Ready before reading its secret by @​drewr in #​180
• chore: configure Claude Code datum plugins by @​scotwells in #​114
• fix: pin e2e coraza-waf to a pullable fixed image by @​ecv in #​264

Full Changelog: datum-cloud/network-services-operator@v0.23.10...v0.23.11

v0.23.10

Compare Source

What's Changed

• feat: add automatic re-issuance of failed custom hostname certificates by @​ecv in #​259

Full Changelog: datum-cloud/network-services-operator@v0.23.9...v0.23.10

v0.23.9

Compare Source

What's Changed

• fix: default TPP paranoiaLevels so CRD applies by @​ecv in #​258

Full Changelog: datum-cloud/network-services-operator@v0.23.8...v0.23.9

v0.23.8

Compare Source

What's Changed

• fix: reject inverted TrafficProtectionPolicy paranoia levels at admission by @​ecv in #​251
• fix: retrigger EG translation on TPP spec changes by @​ecv in #​255

Full Changelog: datum-cloud/network-services-operator@v0.23.7...v0.23.8

v0.23.7

Compare Source

What's Changed

• docs: add WASM filter emitter as the recommended approach for telemetry and billing attribution by @​JoseSzycho in #​177
• docs: refactor service registration brief to HTTP traffic metering by @​JoseSzycho in #​181
• docs: design brief for service catalog registration by @​kevwilliams in #​156
• fix: make error-page body Envoy-safe via operator allowlist + startup validation (#​243) by @​ecv in #​244
• test: e2e for TrafficProtectionPolicy Enforce serving traffic (#​243) by @​ecv in #​245
• fix: clone RouteBaseDirectives before per-policy append (#​246) by @​ecv in #​249

New Contributors

• @​kevwilliams made their first contribution in #​156

Full Changelog: datum-cloud/network-services-operator@v0.23.6...v0.23.7

v0.23.6: : detachHTTPRoutes Spec fix

Compare Source

What's Changed

• docs: add CLAUDE.md for Claude Code guidance by @​ecv in #​229
• fix: detachHTTPRoutes uses Spec.ParentRefs not Status.Parents by @​ecv in #​232

Full Changelog: datum-cloud/network-services-operator@v0.23.5...v0.23.6

v0.23.5: : Reject Hostnameless Listeners

Compare Source

What's Changed

• fix: show newly created networking resources in the activity feed by @​scotwells in #​223
• test(e2e): reproduce #​219 hostname-less listener collision by @​ecv in #​221
• fix: clear error for hostname-less tenant listeners by @​ecv in #​220

New Contributors

• @​ecv made their first contribution in #​221

Full Changelog: datum-cloud/network-services-operator@v0.23.4...v0.23.5

v0.23.4: — Isolate invalid TLS certificates

Compare Source

Fixes

• Invalid TLS certificates no longer take down a whole edge listener (#​212, #​217). Every HTTPS hostname on a gateway shares one Envoy :443 listener; previously one customer's unusable certificate (expired, withdrawn, mismatched) made Envoy reject the entire listener, dropping HTTPS for every tenant on that edge. A listener whose certificate is expired, not-yet-valid, missing, mismatched, or not yet issued is now withheld from the downstream gateway, so a bad certificate only affects its own hostname. The listener reports clear, non-technical Programmed / ResolvedRefs status, and self-heals automatically once the certificate issues. A data-plane backstop in the extension server drops only the offending filter chain if a bad certificate ever reaches the edge.

Observability

• Per-listener metrics (withheld listeners, certificate expiry time, gating counter) and extension-server backstop gauges, labelled by gateway/listener/hostname.
• Four alerts: customer listener withheld for a bad certificate, certificate expiring soon, the backstop actively dropping certificates, and — critical — a listener that can't be protected and will have its edge update rejected.
• Runbooks for each alert and ServiceMonitors so operator and extension-server metrics reach Prometheus.

Validated end-to-end on staging: a connector tunnel's :443 listener programs and serves cleanly (200 round-trip) with zero listener rejections.

Full changes: #​217

v0.23.3

Compare Source

What's Changed

• Fix tunnels staying offline at the edge after a connector connects by @​scotwells in #​211
• fix(extension-server): unique connector domain to stop Envoy config NACK by @​scotwells in #​214
• docs(extension-server): document edge re-translation for connector liveness by @​scotwells in #​213
• chore: remove unknown field by @​zachsmith1 in #​133
• test(e2e): fix flaky CA-secret race in gateway-accepted by @​scotwells in #​215

Full Changelog: datum-cloud/network-services-operator@v0.23.2...v0.23.3

v0.23.2

Compare Source

What's Changed

• chore: add last transition resource metrics by @​savme in #​210

Full Changelog: datum-cloud/network-services-operator@v0.23.1...v0.23.2

v0.23.1

Compare Source

What's Changed

• chore: add last transition time metrics by @​savme in #​203

Full Changelog: datum-cloud/network-services-operator@v0.23.0...v0.23.1

v0.23.0: — Connector liveness, offline UX & branded error pages

Compare Source

Highlights

• Connector liveness at the edge (#​208) — a connector's authoritative Ready + connectionDetails now reach the data-plane member cluster via a propagated networking.datumapis.com/upstream-status annotation (Karmada propagates metadata, not the status subresource). Online connectors are now correctly classified and promoted to live tunnels instead of being treated as offline. Generic, opt-in per resource type.
• Branded data-plane error pages (#​205) — edge-generated 5xx responses on the downstream/Connector data plane render a branded page via the extension server's local_reply_config, replacing the (inert) EnvoyPatchPolicy.
• Deterministic offline-connector response (#​207) — an offline connector's user path returns a deliberate tunnel-offline 503 instead of routing to an endpoint-less cluster (no_healthy_upstream).
• Offline connector backendRef in extension-server mode (#​202) — NSO keeps the connector backendRef so the extension server has a cluster to key on (no more bare 500).

Other

• chore: explicit nodeTaintsPolicy
• docs: branded data-plane error pages enhancement proposal

---

Operational note: the branded page also requires the infra-side errorPage enablement (already merged) and a data-plane re-translation (extension-server + envoy-gateway restart) per cluster to fully activate.

v0.22.1: — AI Edge provisioning & cluster-name regression fixes

Compare Source

This is a patch release that fixes a set of regressions surfaced by the v0.22.0 milo library upgrade — most importantly AI Edge hostname/TLS provisioning, which broke for every project — along with downstream watch handling for graduated Gateway API types and a couple of CI/test fixes.

What's fixed

• AI Edge cert/hostname provisioning restored — The v0.22.0 milo bump (v0.7.4 → v0.28.1) changed how project clusters are keyed internally, from slash-prefixed (/my-project) to bare names (my-project), but a leftover webhook workaround still prepended a slash. The result: the gateway webhook rejected every HTTPProxy create/update with cluster /<project> not found, blocking all hostname and TLS certificate provisioning. The workaround is removed; existing resources self-heal on re-reconcile. (#​196)

• Legacy slash-encoded cluster names tolerated everywhere — Downstream resources created before #​196 still carry the old encoding in their meta.datumapis.com/upstream-cluster-name label, which decoded back to /my-project and no longer matched the engaged cluster key — flooding every replica's logs with cluster /<project> not found and silently breaking downstream→upstream event propagation (a cert going Ready or a listener becoming Programmed no longer re-reconciled the upstream Gateway). All decode sites — the gateway/certificate/HTTPRoute watches, the replicator enqueue, the HTTPProxy and TrafficProtectionPolicy controllers, and the iroh-dns decoder — now route through a shared UpstreamClusterNameFromLabel helper that strips the legacy slash. No data migration: resources re-stamp to the new format on their next reconcile. (#​199, #​200)

• Replicator tolerates graduated Gateway API versions — When a downstream type graduates and the older version stops being served (e.g. BackendTLSPolicy v1alpha3 → v1 after the Gateway API 1.5 CRD bump), registering a watch on the old version blocked WaitForCacheSync and stalled the gateway controller entirely, while CRUD against the old version returned 404. The replicator now resolves the served GVK once at setup, falls back to the configured storage version when needed, and uses it consistently across the watch, create, status-fetch, and delete paths. (#​197)

CI & testing

• Kustomize bundle published after the image build — publish-kustomize-bundles no longer runs in parallel with publish-container-image; it now depends on the image job, so the bundle can never pin its references to an image that hasn't been built and pushed yet. (#​201)

• e2e CRDs and a dev bootstrap Taskfile — Installs the missing NSO CRDs on the downstream cluster so the e2e suite passes, and adds a dev Taskfile for spinning up the two-cluster environment (task dev:bootstrap) and running the suite (task dev:test, optionally scoped to a folder). (#​198)

[!NOTE]
No schema or migration changes. This release is fixes only — no CRD changes and no data migration. Resources created before v0.22.0 automatically re-stamp their upstream-cluster-name label to the new format as they reconcile.

Full Changelog: datum-cloud/network-services-operator@v0.22.0...v0.22.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 38 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.26.0 -> 1.26.4
github.com/onsi/ginkgo/v2	v2.27.2 -> v2.28.1
google.golang.org/protobuf	v1.36.11 -> v1.36.12-0.20260120151049-f2248ac996af
k8s.io/api	v0.35.0 -> v0.36.1
k8s.io/apimachinery	v0.35.0 -> v0.36.1
k8s.io/client-go	v0.35.0 -> v0.36.1
k8s.io/component-base	v0.35.0 -> v0.36.1
k8s.io/utils	v0.0.0-20251002143259-bc988d571ff4 -> v0.0.0-20260210185600-b8788abfbbc2
sigs.k8s.io/controller-runtime	v0.23.3 -> v0.24.1
sigs.k8s.io/gateway-api	v1.3.1-0.20250527223622-54df0a899c1c -> v1.5.1
github.com/emicklei/go-restful/v3	v3.12.2 -> v3.13.0
github.com/fsnotify/fsnotify	v1.9.0 -> v1.10.1
github.com/go-openapi/jsonpointer	v0.21.1 -> v0.23.1
github.com/go-openapi/jsonreference	v0.21.0 -> v0.21.6
github.com/google/pprof	v0.0.0-20250403155104-27863c87afa6 -> v0.0.0-20260115054156-294ebfa9ad83
github.com/grpc-ecosystem/grpc-gateway/v2	v2.27.1 -> v2.29.0
github.com/mailru/easyjson	v0.9.0 -> v0.9.1
github.com/spf13/cobra	v1.10.0 -> v1.10.2
github.com/spf13/pflag	v1.0.9 -> v1.0.10
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.62.0 -> v0.68.0
go.opentelemetry.io/otel	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace	v1.37.0 -> v1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	v1.35.0 -> v1.44.0
go.opentelemetry.io/otel/metric	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/sdk	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/trace	v1.43.0 -> v1.44.0
go.opentelemetry.io/proto/otlp	v1.7.1 -> v1.10.0
go.uber.org/zap	v1.27.0 -> v1.28.0
golang.org/x/exp	v0.0.0-20250718183923-645b1fa84792 -> v0.0.0-20260410095643-746e56fc9e2f
golang.org/x/oauth2	v0.34.0 -> v0.36.0
google.golang.org/genproto/googleapis/api	v0.0.0-20250728155136-f173205681a0 -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/genproto/googleapis/rpc	v0.0.0-20250728155136-f173205681a0 -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/grpc	v1.74.2 -> v1.81.1
k8s.io/apiextensions-apiserver	v0.35.0 -> v0.36.1
k8s.io/apiserver	v0.35.0 -> v0.36.1
k8s.io/klog/v2	v2.130.1 -> v2.140.0
k8s.io/kube-openapi	v0.0.0-20250910181357-589584f1c912 -> v0.0.0-20260317180543-43fb72c5454a
sigs.k8s.io/apiserver-network-proxy/konnectivity-client	v0.31.2 -> v0.34.0
sigs.k8s.io/structured-merge-diff/v6	v6.3.2-0.20260122202528-d9cc6641c482 -> v6.3.2