From 60938b318c68b3ade6a1dd466067e08d83bc3314 Mon Sep 17 00:00:00 2001 From: marcopiraccini Date: Mon, 3 Aug 2026 17:36:54 +0200 Subject: [PATCH 1/4] query routing config Signed-off-by: marcopiraccini --- chart/templates/deployment/_icc.yaml | 4 ++++ chart/values.yaml | 12 ++++++++++++ 2 files changed, 16 insertions(+) diff --git a/chart/templates/deployment/_icc.yaml b/chart/templates/deployment/_icc.yaml index 2dd9d01..ec1bda2 100644 --- a/chart/templates/deployment/_icc.yaml +++ b/chart/templates/deployment/_icc.yaml @@ -139,6 +139,10 @@ spec: - name: PLT_SKEW_COOKIE_MAX_AGE value: "{{ . }}" {{- end }} + {{- with dig "features" "skew_protection" "routing_mode" nil . }} + - name: PLT_SKEW_ROUTING_MODE + value: "{{ . }}" + {{- end }} - name: DEV_K8S value: '{{ dig "features" "dev_mode" "enable" false . | toString }}' diff --git a/chart/values.yaml b/chart/values.yaml index 4e93394..cd76118 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -93,6 +93,18 @@ services: check_interval_ms: 60000 # How often to check draining versions (1 min) traffic_window_ms: 1800000 # Time window for traffic activity tracking (30 min) cookie_max_age: 43200 # Max age for session cookie in seconds (12h) + # How clients carry their version: `cookie` (the gateway sets __plt_dpl) + # or `query` (a ?dpl baked into the built assets). Cluster-wide, because + # whether builds bake it is a property of your build pipeline. A version + # not built with its own id keeps the cookie automatically, so switching + # cannot silently unprotect anything. + # + # `query` requires a gateway controller that implements queryParams + # matching. That is Extended support in the Gateway API, not Core, so a + # fully conformant controller may lack it -- check that yours reports the + # HTTPRouteQueryParamMatching conformance feature. Verified on Envoy + # Gateway v1.4.2. Cookie mode has no such prerequisite. + routing_mode: cookie # Available levels: debug, info, warn, error log_level: warn From d0ad0149cde461de0436a786877943d5dd8e76e5 Mon Sep 17 00:00:00 2001 From: marcopiraccini Date: Tue, 4 Aug 2026 16:11:50 +0200 Subject: [PATCH 2/4] default query routing for skew Signed-off-by: marcopiraccini --- chart/values.yaml | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/chart/values.yaml b/chart/values.yaml index cd76118..8a6e495 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -93,18 +93,23 @@ services: check_interval_ms: 60000 # How often to check draining versions (1 min) traffic_window_ms: 1800000 # Time window for traffic activity tracking (30 min) cookie_max_age: 43200 # Max age for session cookie in seconds (12h) - # How clients carry their version: `cookie` (the gateway sets __plt_dpl) - # or `query` (a ?dpl baked into the built assets). Cluster-wide, because - # whether builds bake it is a property of your build pipeline. A version - # not built with its own id keeps the cookie automatically, so switching - # cannot silently unprotect anything. + # How clients carry their version: `query` (the default -- a ?dpl baked + # into the built assets) or `cookie` (the gateway sets __plt_dpl). + # Cluster-wide, because whether builds bake the id is a property of your + # build pipeline, not of an individual app. # - # `query` requires a gateway controller that implements queryParams + # The two are strictly exclusive and there is NO fallback between them. + # In query mode a version whose image was not built with its own id as + # PLT_DEPLOYMENT_ID gets no pinning rule at all -- it is unprotected, not + # silently downgraded to a cookie. Set `cookie` if your builds do not + # pass PLT_DEPLOYMENT_ID yet. + # + # `query` also requires a gateway controller that implements queryParams # matching. That is Extended support in the Gateway API, not Core, so a # fully conformant controller may lack it -- check that yours reports the # HTTPRouteQueryParamMatching conformance feature. Verified on Envoy # Gateway v1.4.2. Cookie mode has no such prerequisite. - routing_mode: cookie + routing_mode: query # Available levels: debug, info, warn, error log_level: warn From 4064508ccc4de276597e22cd8012eb34853ba3e6 Mon Sep 17 00:00:00 2001 From: marcopiraccini Date: Thu, 6 Aug 2026 18:37:39 +0200 Subject: [PATCH 3/4] renamed PLT_SKEW_ROUTING_MODE to PLT_SKEW_DEFAULT_ROUTING_MODE Signed-off-by: marcopiraccini --- chart/templates/deployment/_icc.yaml | 4 ++-- chart/values.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/chart/templates/deployment/_icc.yaml b/chart/templates/deployment/_icc.yaml index ec1bda2..8369cfc 100644 --- a/chart/templates/deployment/_icc.yaml +++ b/chart/templates/deployment/_icc.yaml @@ -139,8 +139,8 @@ spec: - name: PLT_SKEW_COOKIE_MAX_AGE value: "{{ . }}" {{- end }} - {{- with dig "features" "skew_protection" "routing_mode" nil . }} - - name: PLT_SKEW_ROUTING_MODE + {{- with dig "features" "skew_protection" "default_routing_mode" nil . }} + - name: PLT_SKEW_DEFAULT_ROUTING_MODE value: "{{ . }}" {{- end }} - name: DEV_K8S diff --git a/chart/values.yaml b/chart/values.yaml index 8a6e495..347008e 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -109,7 +109,7 @@ services: # fully conformant controller may lack it -- check that yours reports the # HTTPRouteQueryParamMatching conformance feature. Verified on Envoy # Gateway v1.4.2. Cookie mode has no such prerequisite. - routing_mode: query + default_routing_mode: query # Available levels: debug, info, warn, error log_level: warn From e3d5bbab9a63786c4ba0b8e7e9924cf1db16536e Mon Sep 17 00:00:00 2001 From: marcopiraccini Date: Thu, 6 Aug 2026 18:52:59 +0200 Subject: [PATCH 4/4] default query routing for skew Signed-off-by: marcopiraccini --- chart/values.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/chart/values.yaml b/chart/values.yaml index 347008e..0d36f6e 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -95,8 +95,10 @@ services: cookie_max_age: 43200 # Max age for session cookie in seconds (12h) # How clients carry their version: `query` (the default -- a ?dpl baked # into the built assets) or `cookie` (the gateway sets __plt_dpl). - # Cluster-wide, because whether builds bake the id is a property of your - # build pipeline, not of an individual app. + # This is the cluster default; an application can override it in ICC. + # It exists because both reasons for needing `cookie` -- a gateway that + # cannot match query params, or a build pipeline that cannot stamp the + # id -- are usually properties of the cluster rather than of one app. # # The two are strictly exclusive and there is NO fallback between them. # In query mode a version whose image was not built with its own id as