[release/v1.7] bump envoy ratelimit to c8765e89 (#8500)

cnvergence · web-flow · commit 3f75d826cc1d · 2026-03-12T12:27:19.000+01:00
* [release/v1.7] bump envoy ratelimit to c8765e89

Signed-off-by: Karol Szwaj &lt;karol.szwaj@gmail.com&gt;

* [release/v1.7] add release note

Signed-off-by: Karol Szwaj &lt;karol.szwaj@gmail.com&gt;

* make generate

Signed-off-by: Karol Szwaj &lt;karol.szwaj@gmail.com&gt;

---------

Signed-off-by: Karol Szwaj &lt;karol.szwaj@gmail.com&gt;
diff --git a/api/v1alpha1/shared_types.go b/api/v1alpha1/shared_types.go
@@ -31,7 +31,7 @@ const (
 	// DefaultShutdownManagerImage is the default image used for the shutdown manager.
 	DefaultShutdownManagerImage = "docker.io/envoyproxy/gateway-dev:latest"
 	// DefaultRateLimitImage is the default image used by ratelimit.
-	DefaultRateLimitImage = "docker.io/envoyproxy/ratelimit:3fb70258"
+	DefaultRateLimitImage = "docker.io/envoyproxy/ratelimit:c8765e89"
 	// HTTPProtocol is the common-used http protocol.
 	HTTPProtocol = "http"
 	// GRPCProtocol is the common-used grpc protocol.
diff --git a/charts/gateway-helm/README.md b/charts/gateway-helm/README.md
@@ -103,7 +103,7 @@ helm uninstall eg -n envoy-gateway-system
 | global.images.envoyGateway.image | string | `nil` |  |
 | global.images.envoyGateway.pullPolicy | string | `nil` |  |
 | global.images.envoyGateway.pullSecrets | list | `[]` |  |
-| global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:3fb70258"` |  |
+| global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:c8765e89"` |  |
 | global.images.ratelimit.pullPolicy | string | `"IfNotPresent"` |  |
 | global.images.ratelimit.pullSecrets | list | `[]` |  |
 | hpa.behavior | object | `{}` |  |
diff --git a/charts/gateway-helm/values.tmpl.yaml b/charts/gateway-helm/values.tmpl.yaml
@@ -19,7 +19,7 @@ global:
       pullSecrets: []
     ratelimit:
       # This is the full image name including the hub, repo, and tag.
-      image: "docker.io/envoyproxy/ratelimit:3fb70258"
+      image: "docker.io/envoyproxy/ratelimit:c8765e89"
       # Specify image pull policy if default behavior isn't desired.
       # Default behavior: latest images will be Always else IfNotPresent.
       pullPolicy: IfNotPresent
diff --git a/internal/envoygateway/config/loader/testdata/default.yaml b/internal/envoygateway/config/loader/testdata/default.yaml
@@ -9,7 +9,7 @@ provider:
   kubernetes:
     rateLimitDeployment:
       container:
-        image: docker.io/envoyproxy/ratelimit:3fb70258
+        image: docker.io/envoyproxy/ratelimit:c8765e89
       patch:
         type: StrategicMerge
         value:
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/default.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/default.yaml
@@ -84,7 +84,7 @@ spec:
           value: :19001
         - name: PROMETHEUS_MAPPER_YAML
           value: /etc/statsd-exporter/conf.yaml
-        image: docker.io/envoyproxy/ratelimit:3fb70258
+        image: docker.io/envoyproxy/ratelimit:c8765e89
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/disable-prometheus.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/disable-prometheus.yaml
@@ -74,7 +74,7 @@ spec:
           value: tcp
         - name: REDIS_URL
           value: redis.redis.svc:6379
-        image: docker.io/envoyproxy/ratelimit:3fb70258
+        image: docker.io/envoyproxy/ratelimit:c8765e89
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/enable-tracing-custom.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/enable-tracing-custom.yaml
@@ -99,7 +99,7 @@ spec:
           value: "0.6"
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: http://trace-collector.envoy-gateway-system.svc.cluster.local:4317
-        image: docker.io/envoyproxy/ratelimit:3fb70258
+        image: docker.io/envoyproxy/ratelimit:c8765e89
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/enable-tracing.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/enable-tracing.yaml
@@ -99,7 +99,7 @@ spec:
           value: "1.0"
         - name: OTEL_EXPORTER_OTLP_ENDPOINT
           value: http://trace-collector.envoy-gateway-system.svc.cluster.local:4318
-        image: docker.io/envoyproxy/ratelimit:3fb70258
+        image: docker.io/envoyproxy/ratelimit:c8765e89
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/merge-annotations.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/merge-annotations.yaml
@@ -86,7 +86,7 @@ spec:
           value: :19001
         - name: PROMETHEUS_MAPPER_YAML
           value: /etc/statsd-exporter/conf.yaml
-        image: docker.io/envoyproxy/ratelimit:3fb70258
+        image: docker.io/envoyproxy/ratelimit:c8765e89
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/merge-labels.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/merge-labels.yaml
@@ -86,7 +86,7 @@ spec:
           value: :19001
         - name: PROMETHEUS_MAPPER_YAML
           value: /etc/statsd-exporter/conf.yaml
-        image: docker.io/envoyproxy/ratelimit:3fb70258
+        image: docker.io/envoyproxy/ratelimit:c8765e89
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/patch-deployment-containers.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/patch-deployment-containers.yaml
@@ -86,7 +86,7 @@ spec:
           value: :19001
         - name: PROMETHEUS_MAPPER_YAML
           value: /etc/statsd-exporter/conf.yaml
-        image: docker.io/envoyproxy/ratelimit:3fb70258
+        image: docker.io/envoyproxy/ratelimit:c8765e89
         imagePullPolicy: Always
         livenessProbe:
           failureThreshold: 3
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/patch-deployment.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/patch-deployment.yaml
@@ -84,7 +84,7 @@ spec:
           value: :19001
         - name: PROMETHEUS_MAPPER_YAML
           value: /etc/statsd-exporter/conf.yaml
-        image: docker.io/envoyproxy/ratelimit:3fb70258
+        image: docker.io/envoyproxy/ratelimit:c8765e89
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/with-node-selector.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/with-node-selector.yaml
@@ -84,7 +84,7 @@ spec:
           value: :19001
         - name: PROMETHEUS_MAPPER_YAML
           value: /etc/statsd-exporter/conf.yaml
-        image: docker.io/envoyproxy/ratelimit:3fb70258
+        image: docker.io/envoyproxy/ratelimit:c8765e89
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
diff --git a/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/with-topology-spread-constraints.yaml b/internal/infrastructure/kubernetes/ratelimit/testdata/deployments/with-topology-spread-constraints.yaml
@@ -84,7 +84,7 @@ spec:
           value: :19001
         - name: PROMETHEUS_MAPPER_YAML
           value: /etc/statsd-exporter/conf.yaml
-        image: docker.io/envoyproxy/ratelimit:3fb70258
+        image: docker.io/envoyproxy/ratelimit:c8765e89
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
diff --git a/release-notes/v1.7.1.yaml b/release-notes/v1.7.1.yaml
@@ -7,7 +7,7 @@ breaking changes: |
 security updates: |
   Bump golang to `1.25.8` for security fixes to the go command and the `crypto/tls` package.
   Bump Envoy Proxy image to v1.37.1 for fixing several security issues and bug fixes. For more details, please refer to the [Envoy Proxy v1.37.1 release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.37.1).
-
+  Bump Envoy ratelimit image to `c8765e89` with security fixes for Go.
 
 # New features or capabilities added in this release.
 new features: |
diff --git a/site/content/en/latest/install/gateway-helm-api.md b/site/content/en/latest/install/gateway-helm-api.md
@@ -67,7 +67,7 @@ The Helm chart for Envoy Gateway
 | global.images.envoyGateway.image | string | `nil` |  |
 | global.images.envoyGateway.pullPolicy | string | `nil` |  |
 | global.images.envoyGateway.pullSecrets | list | `[]` |  |
-| global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:3fb70258"` |  |
+| global.images.ratelimit.image | string | `"docker.io/envoyproxy/ratelimit:c8765e89"` |  |
 | global.images.ratelimit.pullPolicy | string | `"IfNotPresent"` |  |
 | global.images.ratelimit.pullSecrets | list | `[]` |  |
 | hpa.behavior | object | `{}` |  |
diff --git a/site/content/en/news/releases/notes/v1.6.3.md b/site/content/en/news/releases/notes/v1.6.3.md
@@ -11,7 +11,7 @@ Date: January 26, 2026
 ## Security updates
 - Bump golang to `v1.25.6`.
 - Bump Envoy proxy version to `v1.36.4`. Includes security patches for CVE-2025-0913. Ref: https://github.com/envoyproxy/envoy/releases/tag/v1.36.4.
-- Bump Envoy rate limit version to `3fb70258`.
+- Bump Envoy rate limit version to `c8765e89`.
 
 ## New features
 -
diff --git a/test/helm/gateway-helm/certgen-annotations.out.yaml b/test/helm/gateway-helm/certgen-annotations.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/certgen-args.out.yaml b/test/helm/gateway-helm/certgen-args.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/certgen-labels.out.yaml b/test/helm/gateway-helm/certgen-labels.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/certjen-custom-scheduling.out.yaml b/test/helm/gateway-helm/certjen-custom-scheduling.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/control-plane-with-pdb.out.yaml b/test/helm/gateway-helm/control-plane-with-pdb.out.yaml
@@ -53,7 +53,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/default-config.out.yaml b/test/helm/gateway-helm/default-config.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/deployment-annotations.out.yaml b/test/helm/gateway-helm/deployment-annotations.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/deployment-custom-topology.out.yaml b/test/helm/gateway-helm/deployment-custom-topology.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/deployment-images-config.out.yaml b/test/helm/gateway-helm/deployment-images-config.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/deployment-priorityclass.out.yaml b/test/helm/gateway-helm/deployment-priorityclass.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/deployment-repo-no-registry.out.yaml b/test/helm/gateway-helm/deployment-repo-no-registry.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/deployment-securitycontext.out.yaml b/test/helm/gateway-helm/deployment-securitycontext.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config-watch.out.yaml b/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config-watch.out.yaml
@@ -40,7 +40,7 @@ data:
           type: GatewayNamespace
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config.out.yaml b/test/helm/gateway-helm/envoy-gateway-gateway-namespace-config.out.yaml
@@ -40,7 +40,7 @@ data:
           type: GatewayNamespace
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/envoy-gateway-gateway-namespace-namespaceselector.out.yaml b/test/helm/gateway-helm/envoy-gateway-gateway-namespace-namespaceselector.out.yaml
@@ -40,7 +40,7 @@ data:
           type: GatewayNamespace
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/global-pullsecrets-override-deployment.in.yaml b/test/helm/gateway-helm/global-pullsecrets-override-deployment.in.yaml
@@ -12,7 +12,7 @@ global:
         - key5: "value5"
         - key6: "value6"
     ratelimit:
-      image: "docker.io/envoyproxy/ratelimit:3fb70258"
+      image: "docker.io/envoyproxy/ratelimit:c8765e89"
 
 deployment:
   envoyGateway:
diff --git a/test/helm/gateway-helm/global-pullsecrets-override-deployment.out.yaml b/test/helm/gateway-helm/global-pullsecrets-override-deployment.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: private.registry/envoyproxy/ratelimit:3fb70258
+            image: private.registry/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/global-pullsecrets-override-global.in.yaml b/test/helm/gateway-helm/global-pullsecrets-override-global.in.yaml
@@ -12,4 +12,4 @@ global:
         - key5: "value5"
         - key6: "value6"
     ratelimit:
-      image: "docker.io/envoyproxy/ratelimit:3fb70258"
+      image: "docker.io/envoyproxy/ratelimit:c8765e89"
diff --git a/test/helm/gateway-helm/global-pullsecrets-override-global.out.yaml b/test/helm/gateway-helm/global-pullsecrets-override-global.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: private.registry/envoyproxy/ratelimit:3fb70258
+            image: private.registry/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/global-registry-override-deployment.in.yaml b/test/helm/gateway-helm/global-registry-override-deployment.in.yaml
@@ -5,7 +5,7 @@ global:
       image: "docker.io/envoyproxy/gateway-dev:latest"
       pullPolicy: Always
     ratelimit:
-      image: "docker.io/envoyproxy/ratelimit:3fb70258"
+      image: "docker.io/envoyproxy/ratelimit:c8765e89"
 
 deployment:
   envoyGateway:
diff --git a/test/helm/gateway-helm/global-registry-override-deployment.out.yaml b/test/helm/gateway-helm/global-registry-override-deployment.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: private.registry/envoyproxy/ratelimit:3fb70258
+            image: private.registry/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/global-registry-override-global.in.yaml b/test/helm/gateway-helm/global-registry-override-global.in.yaml
@@ -5,4 +5,4 @@ global:
       image: "docker.io/envoyproxy/gateway-dev:latest"
       pullPolicy: Always
     ratelimit:
-      image: "docker.io/envoyproxy/ratelimit:3fb70258"
+      image: "docker.io/envoyproxy/ratelimit:c8765e89"
diff --git a/test/helm/gateway-helm/global-registry-override-global.out.yaml b/test/helm/gateway-helm/global-registry-override-global.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: private.registry/envoyproxy/ratelimit:3fb70258
+            image: private.registry/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/horizontal-pod-autoscaler-disabled.out.yaml b/test/helm/gateway-helm/horizontal-pod-autoscaler-disabled.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/horizontal-pod-autoscaler.out.yaml b/test/helm/gateway-helm/horizontal-pod-autoscaler.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/service-customization.out.yaml b/test/helm/gateway-helm/service-customization.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
diff --git a/test/helm/gateway-helm/webhook-disabled.out.yaml b/test/helm/gateway-helm/webhook-disabled.out.yaml
@@ -38,7 +38,7 @@ data:
       kubernetes:
         rateLimitDeployment:
           container:
-            image: docker.io/envoyproxy/ratelimit:3fb70258
+            image: docker.io/envoyproxy/ratelimit:c8765e89
           patch:
             type: StrategicMerge
             value:
