Update the bundle version for VAP and add it as a release step.

RELEASE.md

@@ -110,7 +110,9 @@ The following steps must be done by one of the [Gateway API maintainers][gateway
   in the upcoming steps.
 - Use `git` to cherry-pick all relevant PRs into your branch.
 - Update `pkg/consts/consts.go` with the new semver tag and any updates to the API review URL.
-- Update regex spec.validations.expression in `config/crd/standard/gateway.networking.k8s.io_vap_safeupgrades.yaml` to match older versions. (Look for a regex like `v1.[0-3].`, and replace the `3` with the new minor version number -1).
+- Update `config/crd/standard/gateway.networking.k8s.io_vap_safeupgrades.yaml`
+  - Update regex `spec.validations.expression` to match older versions. (Look for a regex like `v1.[0-3].`, and replace the `3` with the new minor version number -1).
+  - Update the `gateway.networking.k8s.io/bundle-version`.
 - Run the following command `BASE_REF=vmajor.minor.patch make generate` which
   will update generated docs with the correct version info. (Note that you can't
   test with these YAMLs yet as they contain references to elements which wont
@@ -129,7 +131,9 @@ The following steps must be done by one of the [Gateway API maintainers][gateway
 - Cut a `release-major.minor` branch that we can tag things in as needed.
 - Check out the `release-major.minor` release branch locally.
 - Update `pkg/consts/consts.go` with the new semver tag and any updates to the API review URL.
-- Update regex spec.validations.expression in `config/crd/standard/gateway.networking.k8s.io_vap_safeupgrades.yaml` to match older versions.
+- Update `config/crd/standard/gateway.networking.k8s.io_vap_safeupgrades.yaml`
+  - Update regex `spec.validations.expression` to match older versions. (Look for a regex like `v1.[0-3].`, and replace the `3` with the new minor version number -1).
+  - Update the `gateway.networking.k8s.io/bundle-version`.
 - Run the following command `BASE_REF=vmajor.minor.patch make generate` which
   will update generated docs with the correct version info. (Note that you can't
   test with these YAMLs yet as they contain references to elements which wont

pkg/consts/consts.go

@@ -27,7 +27,7 @@ const (
 
 	// BundleVersion is the value used for the "gateway.networking.k8s.io/bundle-version" annotation.
 	// These value must be updated during the release process.
-	BundleVersion = "v1.4.1"
+	BundleVersion = "v0.0.0-dev"
 
 	// ApprovalLink is the value used for the "api-approved.kubernetes.io" annotation.
 	// These value must be updated during the release process.

tests/vap/vap_test.go

@@ -172,25 +172,43 @@ xmeshes.gateway.networking.x-k8s.io: experimental
 		})
 
 		t.Run("should not be able to install CRDs with an older version", func(t *testing.T) {
-			t.Cleanup(func() {
-				_, _ = executeKubectlCommand(t, kubectlLocation, kubeconfigLocation,
-					[]string{"delete", "--wait", "-f", filepath.Join("..", "..", "config", "crd", "standard", "gateway.networking.k8s.io_httproutes.yaml")})
-			})
-
-			// Read test crd into []byte
-			httpCrd, err := os.ReadFile(filepath.Join("..", "..", "config", "crd", "standard", "gateway.networking.k8s.io_httproutes.yaml"))
-			require.NoError(t, err)
-
-			// do replace on gateway.networking.k8s.io/bundle-version: v1.x.0
-			re := regexp.MustCompile(`gateway\.networking\.k8s\.io\/bundle-version: \S*`)
-			sub := []byte("gateway.networking.k8s.io/bundle-version: v1.3.0")
-			oldCrd := re.ReplaceAll(httpCrd, sub)
-
-			// supply crd to stdin of cmd and kubectl apply -f -
-			output, err := executeKubectlCommandStdin(t, kubectlLocation, kubeconfigLocation, bytes.NewReader(oldCrd), []string{"apply", "-f", "-"})
-
-			require.Error(t, err)
-			assert.Contains(t, output, "ValidatingAdmissionPolicy 'safe-upgrades.gateway.networking.k8s.io' with binding 'safe-upgrades.gateway.networking.k8s.io' denied request")
+			versions := []struct {
+				version string
+				fail    bool
+			}{
+				{"v1.0.0", true},
+				{"v1.1.0", true},
+				{"v1.3.0", true},
+				{"v0.0.0-dev", false},
+			}
+
+			for _, v := range versions {
+				t.Run(v.version, func(t *testing.T) {
+					t.Cleanup(func() {
+						_, _ = executeKubectlCommand(t, kubectlLocation, kubeconfigLocation,
+							[]string{"delete", "--wait", "--ignore-not-found", "-f", filepath.Join("..", "..", "config", "crd", "standard", "gateway.networking.k8s.io_httproutes.yaml")})
+					})
+
+					// Read test crd into []byte
+					httpCrd, err := os.ReadFile(filepath.Join("..", "..", "config", "crd", "standard", "gateway.networking.k8s.io_httproutes.yaml"))
+					require.NoError(t, err)
+
+					// do replace on gateway.networking.k8s.io/bundle-version: v1.x.0
+					re := regexp.MustCompile(`gateway\.networking\.k8s\.io\/bundle-version: \S*`)
+					sub := []byte(fmt.Sprintf("gateway.networking.k8s.io/bundle-version: %s", v.version))
+					oldCrd := re.ReplaceAll(httpCrd, sub)
+
+					// supply crd to stdin of cmd and kubectl apply -f -
+					output, err := executeKubectlCommandStdin(t, kubectlLocation, kubeconfigLocation, bytes.NewReader(oldCrd), []string{"apply", "-f", "-"})
+
+					if v.fail {
+						require.Error(t, err, "version %s should be blocked", v.version)
+						assert.Contains(t, output, "ValidatingAdmissionPolicy 'safe-upgrades.gateway.networking.k8s.io' with binding 'safe-upgrades.gateway.networking.k8s.io' denied request")
+					} else {
+						require.NoError(t, err, "output", output)
+					}
+				})
+			}
 		})
 	default:
 		t.Fatalf("invalid CRD channel: %s", crdChannel)