Repository: envoyproxy/gateway

Issue:
Support Client Cert Auth for Extension Sever
*Description*:
@nareddyt writes in #5154: 
> Current document says to mount a secret that has a TLS private key. This is incorrect - Envoy Gateway acting as a client should not receive any private key.
> Envoy Gateway doesn't support mTLS when connecting to extension server, so there is no need for private key today.

Envoy Gateway should make it possible to use client cert authentication towards the extension server. 

[optional *Relevant Links*:]
>Any extra documentation required to understand the issue.


Discussion:
@DeeBi9: Hi @guydc I'd like to work on this issue
I was going through the code base in `envoygateway_types.go` and I have already started to refactor the `ExtensionTLS` struct by removing  the `CertificateRef` and adding the: 
1. `CACertificateRef` which refers to `ca.crt` to verify extension server certificate
2.  `ClientCertificateRef` which contains the `tls.crt` and `tls.key` for client certificate

and in `extension_manager.go`, should we explicitly handle the case where `ClientCertificateRef` is not provided? Right now the implementation assumes that mutual TLS is optional, but do we need a separate validation check for this?

Thanks @guydc: Hi @DeeBi9!

Thanks for picking this up! I assigned you to the issue. 
I think that both TLS and MTLS should remain optional, so we should allow for ClientCertificateRef to remain empty. 

I propose that you raise an API pull request so that other maintainers and reviewers can chime-in on the API proposal. We can also discuss if we want to deprecate CertificateRef in 1.4 and remove it entirely in 1.5, or if we remove it already in 1.4. 
 @nareddyt: Hi @DeeBi9 , are you still working on this? I am happy to pick up this PR if not@DeeBi9: Hi @nareddyt, I’m not working on this issue right now. 
@github-actions: This issue has been automatically marked as stale because it has not had activity in the last 30 days.@github-actions: This issue has been automatically marked as stale because it has not had activity in the last 30 days.@wenfengp: Hi @arkodg, could you assign this task to me? @nareddyt is my colleague and I will implement this feature. Thanks.

Here's the API PR, PTAL https://github.com/envoyproxy/gateway/pull/6674

Solution patch:
diff --git a/api/v1alpha1/envoygateway_types.go b/api/v1alpha1/envoygateway_types.go
index a59a35658..85fcc7541 100644
--- a/api/v1alpha1/envoygateway_types.go
+++ b/api/v1alpha1/envoygateway_types.go
@@ -711,11 +711,20 @@ type ExtensionService struct {
 type ExtensionTLS struct {
 	// CertificateRef is a reference to a Kubernetes Secret with a CA certificate in a key named "tls.crt".
 	//
-	// The CA certificate is used by Envoy Gateway the verify the server certificate presented by the extension server.
-	// At this time, Envoy Gateway does not support Client Certificate authentication of Envoy Gateway towards the extension server (mTLS).
+	// The CA certificate is used by Envoy Gateway to verify the server certificate presented by the extension server.
 	//
 	// +kubebuilder:validation:Required
 	CertificateRef gwapiv1.SecretObjectReference `json:"certificateRef"`
+
+	// ClientCertificateRef is a reference to a Kubernetes Secret with a client certificate and key
+	// for client certificate authentication (mTLS). The secret must contain both "tls.crt" and "tls.key" keys.
+	//
+	// When specified, Envoy Gateway will present this client certificate to the extension server
+	// for mTLS authentication. If not specified, only server certificate validation is performed.
+	//
+	// +optional
+	// +notImplementedHide
+	ClientCertificateRef *gwapiv1.SecretObjectReference `json:"clientCertificateRef,omitempty"`
 }
 
 // GRPCStatus defines grpc status codes as defined in https://github.com/grpc/grpc/blob/master/doc/statuscodes.md.
diff --git a/api/v1alpha1/validation/envoygateway_validate.go b/api/v1alpha1/validation/envoygateway_validate.go
index 37d9b63b5..13f83a199 100644
--- a/api/v1alpha1/validation/envoygateway_validate.go
+++ b/api/v1alpha1/validation/envoygateway_validate.go
@@ -10,6 +10,8 @@ import (
 	"net/url"
 	"strings"
 
+	corev1 "k8s.io/api/core/v1"
+
 	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
 )
 
@@ -206,14 +208,18 @@ func validateEnvoyGatewayExtensionManager(extensionManager *egv1a1.ExtensionMana
 	}
 
 	if extensionManager.Service.TLS != nil {
-		certificateRefKind := extensionManager.Service.TLS.CertificateRef.Kind
-
-		if certificateRefKind == nil {
-			return fmt.Errorf("certificateRef empty in extension service server TLS settings")
+		certRef := &extensionManager.Service.TLS.CertificateRef
+		if (certRef.Group != nil && *certRef.Group != corev1.GroupName) ||
+			(certRef.Kind != nil && *certRef.Kind != "Secret") {
+			return fmt.Errorf("unsupported extension server TLS certificateRef group/kind")
 		}
 
-		if *certificateRefKind != "Secret" {
-			return fmt.Errorf("unsupported extension server TLS certificateRef %v", certificateRefKind)
+		if extensionManager.Service.TLS.ClientCertificateRef != nil {
+			clientCertRef := extensionManager.Service.TLS.ClientCertificateRef
+			if (clientCertRef.Group != nil && *clientCertRef.Group != corev1.GroupName) ||
+				(clientCertRef.Kind != nil && *clientCertRef.Kind != "Secret") {
+				return fmt.Errorf("unsupported extension server mTLS clientCertificateRef group/kind")
+			}
 		}
 	}
 	return nil
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index cdbb72f62..23ce0d81f 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -2817,6 +2817,11 @@ func (in *ExtensionServiceRetry) DeepCopy() *ExtensionServiceRetry {
 func (in *ExtensionTLS) DeepCopyInto(out *ExtensionTLS) {
 	*out = *in
 	in.CertificateRef.DeepCopyInto(&out.CertificateRef)
+	if in.ClientCertificateRef != nil {
+		in, out := &in.ClientCertificateRef, &out.ClientCertificateRef
+		*out = new(v1.SecretObjectReference)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtensionTLS.
diff --git a/site/content/en/news/releases/notes/v0.2.0-rc1.md b/site/content/en/news/releases/notes/v0.2.0-rc1.md
deleted file mode 100644
index a2adb24fd..000000000
--- a/site/content/en/news/releases/notes/v0.2.0-rc1.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-title: "v0.2.0-rc1"
-publishdate: 2022-08-31
----
-
-Date: August 31, 2022
-
-## Documentation
-- Added a quickstart guide for users to run and use Envoy Gateway.
-
-## API
-- Added the EnvoyGateway API type for configuring Envoy Gateway.
-- Added the EnvoyProxy API type for configuring managed Envoys.
-
-## Ci
-- Added tooling to build, run, etc. Envoy Gateway.
-
-## Providers
-- Added the Kubernetes provider.
-
-## xDS
-- Added xDS server to configure managed Envoys.
-
-## IR
-- Added xds and infra IRs to decouple user-facing APIs from Envoy Gateway.
-- Added IR validation.
-
-## Translator
-- Added the gatewayapi translator to translate Gateway API and associated resources to the IR and manage
-- Gateway API status.
-
-## Message service
-- Added infra and xds IR watchable map messages for inter-component communication.
-- Added a Runner to each component to support pub/sub between components.
-
-## Infra manager
-- Added Kubernetes Infra Manager to manage Envoy infrastructure running in a Kubernetes cluster.
-
diff --git a/site/content/en/news/releases/notes/v0.2.0-rc2.md b/site/content/en/news/releases/notes/v0.2.0-rc2.md
deleted file mode 100644
index f1fd55075..000000000
--- a/site/content/en/news/releases/notes/v0.2.0-rc2.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-title: "v0.2.0-rc2"
-publishdate: 2022-09-29
----
-
-Date: September 29, 2022
-
-## Documentation
-- Updated and expanded developer documentation.
-- Added `kube-demo` target to demonstrate Envoy Gateway functionality.
-- Added developer debugging documentation.
-
-## Ci
-- Added Gateway API conformance tests.
-
-## Providers
-- Added watchers for dependent resources of managed Envoy infrastructure.
-- Added Gateway namespace/name labels to managed resources.
-- Added support for finalizing the managed GatewayClass.
-
-## xDS
-- Updated xds server and Envoy bootstrap config to use Delta xDS.
-- Added initial support for mTLS between the xDS server and Envoy.
-
-## Translator
-- Expanded support for Gateway API status.
-- Added support for request modifier and redirect filters.
-- Added support to return 500 responses for invalid backends.
-
-## Message service
-- Updated IRs to support managing multiple Envoy fleets.
-
-## Infra manager
-- Separate Envoy infrastructure is created per Gateway.
-
diff --git a/site/content/en/news/releases/notes/v0.3.0-rc.1.md b/site/content/en/news/releases/notes/v0.3.0-rc.1.md
deleted file mode 100644
index dc69be5b0..000000000
--- a/site/content/en/news/releases/notes/v0.3.0-rc.1.md
+++ /dev/null
@@ -1,65 +0,0 @@
----
-title: "v0.3.0-rc.1"
-publishdate: 2023-02-02
----
-
-Date: February 02, 2023
-
-## Documentation
-- Added Support for Multiple Release Versions
-- Added Support for Versioned Docs
-- Added Release Details Docs
-- Refactored Layout for User Docs
-
-## API
-- Upgraded to v0.6.0 Gateway API
-- Added Support for the TCPRoute API
-- Added Support for the UDPRoute API
-- Added Support for the GRPCRoute API (Add to the ListenerStatus.SupportedKinds Field until https://github.com/envoyproxy/gateway/issues/950 is fixed.)
-- Added Support for HTTPRoute URLRewrite Filter
-- Added Support for HTTPRoute RequestMirror Filter
-- Added Support for HTTPRoute ResponseHeaderModifier Filter
-- Added APIs to Manage Envoy Deployment
-- Added Support for Request Authentication
-- Added Support for Global Rate Limiting
-- Added Support for Routes ReferenceGrant
-- Added Support for Namespace Server Config Type
-
-## Ci tooling testing
-- Fixes Make Image Failed in Darwin
-- Fixes Wait for Job Succeeded before conformance test
-- Upgraded Echoserver Image Tag
-- Added Support for User-Facing Version
-- Added Support for Testing EG against Multiple Kubernetes Versions
-
-## Conformance
-- Enabled HTTPRouteInvalidParentRefNotMatchingListenerPort conformance test
-- Enabled GatewayInvalidTLSConfiguration conformance test
-- Enabled GatewayInvalidRouteKind conformance test
-- Enabled HTTPRoutePartiallyInvalidViaInvalidReferenceGrant conformance test
-- Enabled HTTPRouteReferenceGrant conformance test
-- Enabled HTTPRouteMethodMatching conformance test
-
-## IR
-- Added TCP Listener per TLSRoute
-
-## Translator
-- Fixes Remove Stale Listener Condition
-- Added Support for Suffix Matches for Headers
-- Added Support for HTTP Method Matching to HTTPRoute
-- Added Support for Regex Match Type
-- Added Support for HTTPQueryParamMatch
-
-## Providers
-- Refactored Kubernetes Provider to Single Reconciler
-- Upgraded Kube Provider Test Data Manifests to v0.6.0
-- Removed Duplicate Settings from Bootstrap Config
-- Updated Certgen to Use EG Namespace Env
-- Added EnvoyProxy to Translator and Kube Infra Manager
-- Upgraded Envoyproxy Image to envoy-dev latest in Main
-- Removed EG Logs Private Key
-
-## xDS
-- Fixed Start xDS Server Watchable Map Panics
-- Enabled Access Logging for xDS Components
-
diff --git a/site/content/en/news/releases/notes/v0.4.0-rc.1.md b/site/content/en/news/releases/notes/v0.4.0-rc.1.md
deleted file mode 100644
index 3541435e8..000000000
--- a/site/content/en/news/releases/notes/v0.4.0-rc.1.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-title: "v0.4.0-rc.1"
-publishdate: 2023-04-13
----
-
-Date: April 13, 2023
-
-## Documentation
-- Added Docs for Installing and Using egctl
-
-## Installation
-- Added Helm Installation Support
-- Added Support for Ratelimiting Based On IP Subnet
-- Added Gateway API Support Doc
-
-## API
-- Upgraded to Gateway API v0.6.2
-- Added Support for Custom Envoy Proxy Bootstrap Config
-- Added Support for Configuring the Envoy Proxy Image and Service
-- Added Support for Configuring Annotations, Resources, and Securitycontext Settings on Ratelimit Infra and Envoy Proxy
-- Added Support for Using Multiple Certificates on a Single Fully Qualified Domain Name
-- Gateway Status Address is now Populated for ClusterIP type Envoy Services
-- Envoy Proxy Pod and Container SecurityContext is now Configurable
-- Added Custom Envoy Gateway Extensions Framework
-- Added Support for Service Method Match in GRPCRoute
-
-## Ci tooling testing
-- Fixed CI Flakes During Helm Install
-- Added Test To Ensure Static xDS Cluster Has Same Field Values as Dynamic Cluster
-- Added egctl to Build and Test CI Workflow
-- Code Coverage Thresholds are now Enforced by CI
-- Fixed latest-release-check CI Job Failures
-- Added Auto Release Tooling for Charts
-
-## Conformance
-- Enabled GatewayWithAttachedRoutes Test
-- Enabled Enable HTTPRouteInvalidParentRefNotMatchingSectionName Test
-- Enabled Enable HTTPRouteDisallowedKind Test
-- Re-Enabled Gateway/HTTPRouteObservedGenerationBump Test
-
-## Translator
-- Added Support for Dynamic GatewayControllerName in Route Status
-
-## Providers
-- Update GatewayClass Status Based on EnvoyProxy Config Validation
-
-## xDS
-- Added EDS Support
-- Fixed PathSeparatedPrefix and Optimized Logic for Prefixes Ending With Trailing Slash
-- Updated Deprecated RegexMatcher
-- Refactored Authn and Ratelimit Features to Reuse buildXdsCluster
-
-## Cli
-- Added egctl CLI Tool
-- Added egctl Support for Dry Runs of Gateway API Config
-- Added egctl Support for Dumping Envoy Proxy xDS Resources
-
diff --git a/site/content/en/news/releases/notes/v0.5.0-rc.1.md b/site/content/en/news/releases/notes/v0.5.0-rc.1.md
deleted file mode 100644
index 718ce1635..000000000
--- a/site/content/en/news/releases/notes/v0.5.0-rc.1.md
+++ /dev/null
@@ -1,73 +0,0 @@
----
-title: "v0.5.0-rc.1"
-publishdate: 2023-07-26
----
-
-Date: July 26, 2023
-
-## Documentation
-- Added Docs for Installation page using Helm
-- Added Docs for Cert Manager Integration
-- Added Docs for Presentation Links
-- Added Docs for configuring multiple TLS Certificates per Listener
-
-## Installation
-- Added Support for configuring Envoy Gateway Label and Annotations using Helm
-- Increased default Resource defaults for Envoy Gateway to 100m CPU and 256Mi Memory
-- Fixes Helm values for EnvoyGateway startup configuration
-- Added opt-in field to skip creating control plane TLS Certificates allowing users to bring their own certificates.
-
-## API
-- Upgraded to Gateway API v0.7.1
-- Added Support for EnvoyPatchPolicy
-- Added Support for EnvoyProxy Telemetry - Access Logging, Traces and Metrics
-- Added Support for configuring EnvoyProxy Pod Labels
-- Added Support for configuring EnvoyProxy Deployment Strategy Settings, Volumes and Volume Mounts
-- Added Support for configuring EnvoyProxy as a NodePort Type Service
-- Added Support for Distinct RateLimiting for IP Addresses
-- Added Support for converting JWT Claims to Headers, to be used for RateLimiting
-- Added Admin Server for Envoy Gateway
-- Added Pprof Debug Support for Envoy Gateway
-- Added Support to Watch for Resources in Select Namespaces
-
-### Breaking Changes
-- Renamed field in EnvoyGateway API from Extension to ExtensionManager
-
-## Ci tooling testing
-- Added Retest Github Action
-- Added CherryPick Github Action
-- Added E2E Step in Github CI Workflow
-- Added RateLimit E2E Tests
-- Added JWT Claim based RateLimit E2E Tests
-- Added Access Logging E2E tests
-- Added Metrics E2E tests
-- Added Tracing E2E tests
-
-## Conformance
-- Enabled GatewayWithAttachedRoutes Test
-- Enabled HttpRouteRequestMirror Test
-- Skipped HTTPRouteRedirectPortAndScheme Test
-
-## Translator
-### Breaking Changes
-- Renamed IR resources from <namespace>-<name> to <namespace>/<name>
-- which also affects generated Xds Resources
-
-## Providers
-- Reconcile Node resources to be able to compute Status Addresses for Gateway
-- Discard Status before publishing Provider resources to reduce memory consumption
-
-## xDS
-- Fix Init Race in Xds Runner when starting Xds Server and receiving Xds Input
-- Switched to Xds SOTW Server for RateLimit Service Configuration
-- Added Control Plane TLS between EnvoyProxy and RateLimit Service
-- Enabled adding RateLimit Headers when RateLimit is set
-- Allowed GRPCRoute and HTTPRoute to be linked to the same HTTPS Listener
-- Set ALPN in the Xds Listener with TLS enabled.
-- Added Best Practices Default Edge Settings to Xds Resources
-- Compute and Publish EnvoyPatchPolicy status from xds-translator runner
-
-## Cli
-- Added egctl x translate Support to generate default missing Resources
-- Added egctl x translate Support for AuthenticationFilter and EnvoyPatchPolicy
-
diff --git a/site/content/en/news/releases/notes/v0.6.0-rc.1.md b/site/content/en/news/releases/notes/v0.6.0-rc.1.md
deleted file mode 100644
index 2757f5da3..000000000
--- a/site/content/en/news/releases/notes/v0.6.0-rc.1.md
+++ /dev/null
@@ -1,70 +0,0 @@
----
-title: "v0.6.0-rc.1"
-publishdate: 2023-10-27
----
-
-Date: Oct 27, 2023
-
-## Documentation
-- Introduced a new website based on Hugo
-- Added Grafana dashboards and integration docs for EnvoyProxy metrics
-- Added Grafana integration docs for Gateway API metrics
-
-## Installation
-- Added Support for configuring Envoy Gateway Label and Annotations using Helm
-- Increased default Resource defaults for Envoy Gateway to 100m CPU and 256Mi Memory
-- Fixes Helm values for EnvoyGateway startup configuration
-- Added opt-in field to skip creating control plane TLS Certificates allowing users to bring their own certificates.
-
-## API
-- Upgraded to Gateway API v1.0.0
-- Added the ClientTrafficPolicy CRD with Keep Alive Support
-- Added the BackendTrafficPolicy CRD with RateLimit and LoadBalancer Support
-- Added the SecurityPolicy CRD with CORS and JWT Support
-- Added EnvoyGateway Metrics with Prometheus and OpenTelemetry support
-- Added Support for InitContainers in EnvoyProxy CRD
-- Added Support for LoadBalancerIP in EnvoyProxy CRD
-- Added Support for AllocateLoadBalancerNodePorts in EnvoyProxy CRD
-- Added Support for LoadBalancerClass in EnvoyProxy CRD
-- Added Support for selecting EnvoyProxy stats to be generated
-- Added Support for enabling EnvoyProxy Virtual Host metrics
-- Added Support for Merging Gateway resources onto the same infrastructure
-
-### Breaking Changes
-- Removed the AuthenticationFilter CRD
-- Removed the RateLimitFilter CRD
-- Enabled EnvoyProxy Prometheus Endpoint by default with an option to disable it
-- Updated the Bootstrap field within the EnvoyProxy CRD with an additional value
-- field to specify bootstrap config
-
-## Ci tooling testing
-- 
-
-## Conformance
-- 
-
-## Watchable
-- Improved caching of resource by implementing a compare function agnostic of resource order
-
-## Translator
-### Breaking Changes
-- Added support for routing to EndpointSlice endpoints
-- Added support for HTTPRoute Timeouts
-- Added support for multiple RequestMirror filters per HTTPRoute rule
-- Use / instead of - in IR Route Names
-- Added Support to ignore ports in Host header
-
-## Providers
-- Added the generationChangedPredicate to most resources to limit resource reconiliation
-- Improved reconiliation by using the same enqueue request for all resources
-- Added support for reconciling ServiceImport CRD
-- Added support for selectively watching resources based on Namespace Selector
-
-## xDS
-- Fixed Layered Runtime warnings
-- Upgraded to the latest version of go-control-plane that fixed xDS Resource ordering issues for ADS.
-- Added HTTP2 Keep Alives to the xds connection
-
-## Cli
-- Added Support for egctl stats command
-
diff --git a/site/content/en/news/releases/notes/v1.0.0-rc.1.md b/site/content/en/news/releases/notes/v1.0.0-rc.1.md
deleted file mode 100644
index 2a5fbebd6..000000000
--- a/site/content/en/news/releases/notes/v1.0.0-rc.1.md
+++ /dev/null
@@ -1,141 +0,0 @@
----
-title: "v1.0.0-rc.1"
-publishdate: 2023-11-01
----
-
-Date: Nov 1, 2023
-
-## Documentation
-- Added User Guide for local rate limit
-- Added User Guide for circuit breaker
-- Added User Guide for fault injection
-- Added User Guide for EnvoyProxy extraArgs
-- Added User Guide for Timeouts in ClientTrafficPolicy
-- Added User Guide for JWT claim base routing
-- Added User Guide for HTTP Timeout
-- Added User Guide for Retry in BackendTrafficPolicy
-- Added User Guide for basic auth
-- Added User Guide for OIDC
-- Added User Guide for ClientTrafficPolicy
-- Added User Guide for BackendTrafficPolicy
-- Added `Type` and `required` for CRD API doc
-- Updated crd-ref-docs to 0.0.10
-- Updated Envoy proxy image to envoy:distroless-dev in main
-
-## Installation
-- Added Support for Pulling envoyGateway image from a private registry
-- Added Support for Configuring resources for certgen job
-- Added Support for Configuring affinity for EnvoyGateway pod
-
-## API
-- Added Support for Downstream QUIC/HTTP3 in ClientTrafficPolicy CRD
-- Added Support for Downstream MTLS in ClientTrafficPolicy CRD
-- Added Support for enabling EnvoyHeaders in ClientTrafficPolicy CRD
-- Added Support for DisableMergeSlash and escapedSlashesAction in ClientTrafficPolicy CRD
-- Added Support for EnableTrailers in HTTP/1.1 in ClientTrafficPolicy CRD
-- Added Support for Preserving header letter-case on HTTP/1 in ClientTrafficPolicy CRD
-- Added Support for enabling HTTP/1.0 and HTTP/0.9 in ClientTrafficPolicy CRD
-- Added Support for Client IP Detection using XFF in ClientTrafficPolicy CRD
-- Added Support for Client IP Detection using Custom Header in ClientTrafficPolicy CRD
-- Added Support for Connection Timeouts in ClientTrafficPolicy CRD
-- Added Support for Common TLS configuration properties in ClientTrafficPolicy CRD
-- Added Support for Proxy protocol in ClientTrafficPolicy CRD
-- Added Support for TCPKeepAlive in ClientTrafficPolicy CRD
-- Added Support for Local rate limit in BackendTrafficPolicy CRD
-- Added Support for CircuitBreaker in BackendTrafficPolicy CRD
-- Added Support for Fault injection in BackendTrafficPolicy CRD
-- Added Support for Passive Health Checks in BackendTrafficPolicy CRD
-- Added Support for Active Health Checks in BackendTrafficPolicy CRD
-- Added Support for Connection Timeouts in BackendTrafficPolicy CRD
-- Added Support for Compressor/Decompressor in BackendTrafficPolicy CRD
-- Added Support for Retry in BackendTrafficPolicy CRD
-- Added Support for Slow start mode in BackendTrafficPolicy CRD
-- Added Support for Proxy protocol in BackendTrafficPolicy CRD
-- Added Support for TCPKeepAlive in BackendTrafficPolicy CRD
-- Added Support for OIDC in SecurityPolicy CRD
-- Added Support for Basic Auth in SecurityPolicy CRD
-- Added Support for RedirectURL and signoutPath to OIDC in SecurityPolicy CRD
-- Added Support for ExtractFrom headers and params to JWT in SecurityPolicy CRD
-- Added Support for External authorization in SecurityPolicy CRD
-- Added Support for RecomputeRoute field to JWT in SecurityPolicy CRD
-- Added Support for AllowCredentials knob to CORS setting in SecurityPolicy CRD
-- Added Support for Extract from different identifier to JWT in SecurityPolicy CRD
-- Added Support for Secret resource in EnvoyPatchPolicy CRD
-- Added Support for Making the value optional for JSONPatchOperation in EnvoyPatchPolicy CRD
-- Added Support for `From` field to JSONPatchOperation in EnvoyPatchPolicy CRD
-- Added Support for MergeGateways in EnvoyPatchPolicy CRD
-- Added Support for Upstream TLS by implementing BackendTLSPolicy CRD
-- Added Support for LabelSelector type for NamespaceSelectors in EnvoyGateway Configuration
-- Added Support for ratelimit prometheus in EnvoyGateway Configuration
-- Added Support for Gracefully drain listeners before envoy shutdown on pod termination in EnvoyProxy CRD
-- Added Support for Configuring externalTrafficPolicy to the envoy service in EnvoyProxy CRD
-- Added Support for Envoy extra args in EnvoyProxy CRD
-- Added Support for Mergepatch to envoyproxy/ratelimit deployment in EnvoyProxy CRD
-- Added Support for Mergepatch to envoyproxy service in EnvoyProxy CRD
-- Added Support for NodeSelector to PodSpec in EnvoyProxy CRD
-- Added Support for HorizontalPodAutoscaler in EnvoyProxy CRD
-- Added Support for TopologySpreadConstraints to PodSpec in EnvoyProxy CRD
-- Added Support for ImagePullSecrets to PodSpec in EnvoyProxy CRD
-
-### Breaking Changes
-- Use wildcard to match AllowOrigins to CORS in SecurityPolicy CRD
-
-## Conformance
-- Replaced backend image from gcr.io/k8s-staging-ingressconformance/echoserver to gcr.io/k8s-staging-gateway-api/echo-basic
-
-## Testing
-- Added e2e test for header case-preserving
-- Added LoadBalancerIP validation to prevent trailing period
-- Added e2e test for Timeout in ClientTrafficPolicy
-- Added e2e test for jwt claim base routing
-- Added e2e test for OIDC
-- Added e2e test for BackendTrafficPolicy Retry
-
-## Translator
-- Fixed Prefix match to prevent mismatching routes with the same prefix
-- Fixed Multiple reconciling by implementing comparable interface for ir.Infra
-- Fixed EndpointSlice with empty conditions {}
-- Fixed Error handling when parsing the http request timeout
-- Fixed No status when EnvoyPatchPolicy is disabled
-- Fixed Printable for xds and infra IRs
-- Fixed Skip backendRefs with weight set to 0
-- Fixed AND Header matches in ratelimiting not working
-- Fixed Deletion logics when no gatewayclasses exist
-- Fixed Match mergedGateways irKey for ClientTrafficPolicy
-- Fixed Policies should apply only to gateways they were attached to when mergeGateways is true
-- Fixed Listener status is not surfaced for gateways when MergeGateways enabled
-- Fixed GRPCroute websocket not working by moving web socket upgrade config from hcm to route
-- Fixed Configure idle timeout when timeout is set on HTTPRoute
-- Fixed Relaxing HTTPS restriction for OIDC token endpoint
-- Fixed Panic when translating routes with empty backends
-- Fixed Xds translation should be done in a best-effort manner
-- Added Support for validating regex before sending to Envoy
-- Added Support for setting spec.addresses.value into ClusterIP when Service Type is ClusterIP
-- Added Unsupported status condition for filters within BackendRef
-- Added List instead of map for Provider Resources for order stability
-- Added Suffix for oauth cookies to prevent multiple oauth filters from overwriting each other's cookies
-- Added Support for overriding condition to BackendTrafficPolicy and SecurityPolicy
-- Added Support for default retry budget and retry host predicate
-- Added Support for implementing gateway.spec.infrastructure
-- Added Validation for CA Cert in ClientTrafficPolicy
-
-## Providers
-- Added Support for multiple GatewayClass per controller
-- Added SecurityPolicyIndexers in Kubernetes Provider
-- Added Support for generating HMAC secret in CertGen Job
-- Fixed Finalizer logic when deleting Gatewayclasses
-- Fixed MergeGateways panics when restarting control plane
-
-## xDS
-- Added Support for EDS cache
-- Added Support for ADS cache to ensure the rule order
-- Fixed Deprecated field error when using RequestHeaderModifier filter
-- Fixed Envoy rejects XDS at runtime losing all routes on restart
-- Fixed Requests not matching defined routes trigger per-route filters
-- Bumped go-control-plane to v0.12.0
-
-## Cli
-- Added Support for egctl x status
-- Added Support for egctl experimental dashboard envoy-proxy
-- Added Support for egctl config ratelimit
-
diff --git a/site/content/en/news/releases/notes/v1.1.0-rc.1.md b/site/content/en/news/releases/notes/v1.1.0-rc.1.md
deleted file mode 100644
index e0ad9998d..000000000
--- a/site/content/en/news/releases/notes/v1.1.0-rc.1.md
+++ /dev/null
@@ -1,225 +0,0 @@
----
-title: "v1.1.0-rc.1"
-publishdate: 2024-07-08
----
-
-Date: July 8, 2024
-
-## Documentation
-- Added Performance Benchmarking Document
-- Added User Guide for Zipkin Tracing
-- Added User Guide for Customizing Ordering of Filters
-- Added User Guide for External Processing Filter in EnvoyExtensionPolicy
-- Added User Guide for installation of egctl with brew
-- Added User Guide for Client Buffer Size Limit
-- Added User Guide for Client Idle Timeout
-- Added Chinese translation for release notes, roadmap, installation, development, contribution and several User Guides
-- Added User Guide for Backend resource
-- Added GA Blog Post
-- Added Threat Model
-- Added Adopters section to docs
-- Added User Guide and Dashboards for Control Plane and Resource Observability
-- Added User Guide for Connection Limits in ClientTrafficPolicy
-- Added User Guide on using Private Key Provider
-- Added Design Doc for Authorization
-- Added Design Doc for XDS Metadata
-- Added Design Doc for Backend resource
-- Added Design Doc for Control Plane Observability
-- Added Design Doc for EnvoyExtensionPolicy
-- Added Design Doc for External Processing in EnvoyExtensionPolicy
-- Updated Access Logging User Guide to include filtering with CEL Expression
-- Updated Access Logging User Guide to include Metadata
-- Updated Development Guide to require Golang 1.22
-- Updated Quickstart User Guide to fetch GATEWAY_HOST from Gateway resource
-- Updated Site to reflect GA status
-- Updated HTTP Redirect User Guide to not set a redirect port or require a BackendRef
-- Updated Observability User Guides to use gateway-addons-helm
-- Updated Gateway-API User Guide to reflect support for BackendRef filters
-- Updated HTTP Timeouts User Guide to highlight default Envoy timeouts
-- Updated Installation Guide to use server-side apply
-- Updated Installation Guide to refer to values.yaml docs
-- Updated BackendTLSPolicy User Guide to GW-API v1.1.0
-- Updated User Guides to use tabs when applying yaml from file or stdin
-- Updated OIDC User Guide to use HTTPS redirect URLs
-- Updated Order of versions in Site
-- Updated Extensbility User Gudie to use yaml-format patches
-- Updated Quickstart Guide to include next steps
-- Updated CRD docs to include enum values
-- Updated Extensibility User Guide with Envoy Patch Policy examples
-- Updated structure of docs: rename Guides to Tasks, move Contribution
-- Updated Support Matrix
-- Updated egctl x status docs for xRoute and xPolicy
-- Updated egctl User Guide with Install and Uninstall commands
-- Updated GRPCRoute docs to use v1 instead of v1alpha2
-- Fixed Rate Limiting User Guide to use correct CIDR matcher type names
-- Fixed User Guide for JWT-based routing
-- Fixed JSON Access Log Example
-- Use linkinator to detect dead links in docs
-- Use helm-docs to generate chart docs
-- Support Not-Implemented-Hide marker in API docs
-
-## Installation
-- Added new gateway-addons-helm chart for Observability
-- Added support for global image settings for all images in Envoy Gateway helm chart
-- Added Support for PodDistruptionBudget for Envoy Gateway
-- Added Support for TopologySpreadConstraints for Envoy Gateway
-- Added Support for Tolerations for Envoy Gateway
-- Added Support for Ratelimit image pull secrets and pull policy
-- Updated ttlSecondsAfterFinished on certgen job to 30 by default
-- Updated Envoy Gateway ImagePullPolicy to IfNotPresent released charts
-- Remove envoy-gateway-metrics-service and merge its contents into envoy-gateway service
-
-## API
-- Added Support for Gateway-API v1.1.0
-- Added new Backend CRD
-- Added new EnvoyExtensionPolicy CRD
-- Added Support for Plural Target Refs and Target Selectors in xPolicy CRDs
-- Added Support for Backend CRD BackendRefs in HTTPRoute, GRPCRoute and EnvoyExtensionPolicy CRDs
-- Added Support for Custom Extension Server Policy CRDs in EnvoyGateway Config
-- Added Support for Custom ShutDownManager Image in EnvoyGateway Config
-- Added Support for Leader Election in EnvoyGateway Config
-- Added Support for Connecting to Extension Server over Unix Domain Socket in EnvoyGateway Config
-- Added Support for Proxy PodDisruptionBudget in EnvoyProxy CRD
-- Added Support for Running Envoy Proxy as a Daemonset in EnvoyProxy CRD
-- Added Support for Proxy Loadbalancer Source Ranges in EnvoyProxy CRD
-- Added Support for Proxy Prometheus Metrics Compression in EnvoyProxy CRD
-- Added Support for BackendRefs in Access Log, Metric and Trace Sinks in EnvoyProxy CRD
-- Added Support for Rate Limiting Tracing in EnvoyProxy CRD
-- Added Support for Routing to Service IP in EnvoyProxy CRD
-- Added Support for Access Log CEL filters in EnvoyProxy CRD
-- Added Support for Access Log Formatters for File and OpenTelemetry in EnvoyProxy CRD
-- Added Support for Zipkin Tracing in EnvoyProxy CRD
-- Added Support for using the Listener port as a the Container port in EnvoyProxy CRD
-- Added Support for OpenTelemtry Sink Export Settings in EnvoyProxy CRD
-- Added Support for Backend Client Certificate Authentication in EnvoyProxy CRD
-- Added Support for Backend TLS Settings in EnvoyProxy CRD
-- Added Support for HTTP Filter Ordering in EnvoyProxy CRD
-- Added Support for gRPC Access Log Service (ALS) Sink in EnvoyProxy CRD
-- Added Support for OpenTelelemetry Sinks as a BackendRef in EnvoyProxy CRD
-- Added Support for User-Provided name for generate Kubernetes resources in EnvoyProxy CRD
-- Added Support for Per-Endpoint stats in EnvoyProxy CRD
-- Added Support for Targeting SectionNames in ClientTrafficPolicy CRD
-- Added Support for Preserving X-Request-ID header in ClientTrafficPolicy CRD
-- Added Support for Using Downstream Protocol in Upstream connections in ClientTrafficPolicy CRD
-- Added Support for HTTP/2 settings in ClientTrafficPolicy CRD
-- Added Support for Connection Buffer Size Limit in ClientTrafficPolicy CRD
-- Added Support for HTTP Health Check in ClientTrafficPolicy CRD
-- Added Support for Optionally requiring a Client Certificate in ClientTrafficPolicy CRD
-- Added Support for Headers with Underscores CRD in ClientTrafficPolicy CRD
-- Added Support for XFCC header processing in ClientTrafficPolicy CRD
-- Added Support for TCP Listener Idle Timeout in ClientTrafficPolicy CRD
-- Added Support for IdleTimeout in ClientTrafficPolicy CRD
-- Added Support for Connection Limits in ClientTrafficPolicy CRD
-- Added Support for additional OIDC settings related to Resource, Token and Cookie in SecurityPolicy CRD
-- Added Support for Optionally requiring a JWT in SecurityPolicy CRD
-- Added Support for BackendRefs for Ext-Auth in SecurityPolicy CRD
-- Added Support for Authorization in SecurityPolicy CRD
-- Added Support for Ext-Auth failOpen in SecurityPolicy CRD
-- Added Support for Loadbalancer Cookie Consistent Hashing in BackendTrafficPolicy CRD
-- Added Support for Disabling X-RateLimit headers in BackendTrafficPolicy CRD
-- Added Support for Connection Buffer Size Limit in BackendTrafficPolicy CRD
-- Added Support for Loadbalancing Consistent Hash Table Size in BackendTrafficPolicy CRD
-- Added Support for Loadbalancing Header Hash Policy in BackendTrafficPolicy CRD
-- Added Support for Cluster Connection Buffer Size Limit in BackendTrafficPolicy
-- Added Support for more Rate Limit Rules in BackendTrafficPolicy CRD
-- Added Support for Wasm extension in EnvoyExtensionPolicy CRD
-- Added Support for External Processing extension in EnvoyExtensionPolicy CRD
-- Removed Status Print Column from xPolicy CRDs
-
-### Breaking Changes
-- Gateway-API BackendTLSPolicy v1alpha3 is incompatible with previous versions of the CRD
-- xPolicy targetRefs can no longer specify a namespace, since Gateway-API v1.1.0 uses LocalPolicyTargetReferenceWithSectionName in Policy resources
-
-### Deprecations
-- xPolicy targetRef is deprecated, use targetRefs instead
-- SecurityPolicy ExtAuth BackendRef is deprecated, use BackendRefs instead
-- OpenTelemetry Proxy Access Log Host and Port are deprecated, use backendRefs instead
-- OpenTelemetry Proxy Metrics Sink Host and Port are deprecated, use backendRefs instead
-- Proxy Tracing Provider Host and Port are deprecated, use backendRefs instead
-- Envoy Gateway Extension Server Host and Port are deprecated, use BackendEndpoint instead
-
-## Conformance
-- Added Supported Features to Gateway Class
-
-## Testing
-- Added performance benchmarking test
-- Added e2e test for Zipking Tracing
-- Added e2e test for HTTP Health Checks
-- Added e2e test for CEL Access Log Filter
-- Added e2e test for GRPC Access Log Service Sink
-- Added e2e test for XDS Metadata
-- Added e2e test for Wasm from OCI Images and HTTP Source
-- Added e2e test for Service IP Routing
-- Added e2e test for Multiple GatewayClasses
-- Added e2e test for HTTP Full Path rewrite
-- Added e2e test for Backend API
-- Added e2e test for Backend TLS Settings
-- Added e2e test for disabling X-RateLimit Headers
-- Added e2e test for Authorization
-- Added e2e test for BackendRefs in Ext-Auth
-- Added e2e test for Using Client Protocol in Upstream Connection
-- Added e2e test for Backend Client Cert Authentication
-- Added e2e test for External Processing Filter
-- Added e2e test for Merge Gateways Feature
-- Added e2e test for Option JWT authentication
-- Added e2e test for Infrastructure using Server-Side Apply
-- Added e2e test for Connection Limits
-- Added e2e test for Envoy Graceful Shutdown
-- Updated e2e test for Limit to cover multiple listeners
-- Updated e2e test for CORS to not require access-control-expose-headers
-- Run CEL tests on all supported K8s versions
-- Added OSV Scanner for Golang Vulnerabilities and Licenses
-- Added Trivy scanner for Docker images
-
-## Translator
-- Added Support for BackendRef HTTP Filters
-- Added Support for attaching EnvoyProxy to Gateways
-- Added Support for cross-namespace EnvoyProxy reference from GatewayClass
-- Added Support for Backend Traffic Policy for UDPRoute and TCPRoute
-- Added Support for ClientTrafficPolicy for UDPRoute and TCPRoute
-- Added Support for multiple BackendRefs in TCPRoute and UDPRoute
-- Added Metrics related to XDS Server, Infra Manager and Controller
-- Added Support for PolicyStatus in EnvoyPatchPolicy
-- Added Support for Websocket upgrades in HTTP/1 Routes
-- Added Support for custom controller name in egctl
-- Added Support for BackendTLSPolicy CA Certificate reference to Secret
-- Added names to Filter Chains
-- Added Support extension server hooks for TCP and UDP listeners
-- Added Support for attaching EnvoyProxy resource to Gateways
-- Added Support for Exposing Prometheus Port in Rate Limiter Service
-- Added Support for Optional Rate Limit Backend Redis
-- Updated OAuth2 filter to preserve Authorization header if OIDC token forwarding is enabled
-- Updated Default Filter Order to have Fault filter first in the HTTP Filter Chain
-- Updated Ext-Auth Per-Route config to use filter-specific Config Type
-- Updated Overload Manager configuration according to Envoy recommendations by default
-- Updated Infrastructure resource management to user Server-Side Apply
-- Updated Reflection of Errors in Gateway Status when too many addresses are assigned
-- Fixed enforcement of same-namespace for BackendTLSPolicy and target
-- Fixed processing all listeners before returning with an error
-- Fixed creation of infrastructure resources if there are no listeners
-- Fixed use GatewayClass Name for Observability if Merge Gateways is enabled
-- Fixed CORS to not forward Not-Matching Preflights to Backends
-- Fixed BackendTLSPolicy status to fully conform with PolicyStatus
-- Fixed duplication of Ext-Auth, OIDC and Basic Auth Filters
-- Fixed Proxy Protocol Filter to always be the first Listener Filter
-- Fixed Translation Consistency by sorting Gateways
-- Fixed QUIC Listener to only Advertise HTTP/3 over ALPN
-- Fixed SNI matching for TCP Routes with TLS termination
-- Fixed Reconciliation when EnvoyProxy backendRefs changes
-- Fixed Reconciliation when a referenced Secret or ConfigMap changes
-- Fixed ReplaceFullPath not working for root path
-- Fixed Default Application Protocol to TCP for Zipkin Tracing
-- Fixed not appending well-known ports (80, 443) in rediret Location header
-
-## Providers
-- Bumped K8s Client to v0.30.0
-
-## xDS
-- Bumped go-control-plane to v0.12.1
-
-## Cli
-- Added Support for Install and Uninstall Commands to egctl
-- Added Support for xRoute and xPolicy in egctl x status
-- Added Golang version to Envoy Gateway version command
-- Fixed egctl x status gatewayclass example message
-
diff --git a/site/content/en/news/releases/notes/v1.2.0-rc.1.md b/site/content/en/news/releases/notes/v1.2.0-rc.1.md
deleted file mode 100644
index cfdfe12d2..000000000
--- a/site/content/en/news/releases/notes/v1.2.0-rc.1.md
+++ /dev/null
@@ -1,133 +0,0 @@
----
-title: "v1.2.0-rc.1"
-publishdate: 2024-10-25
----
-
-Date: October 25, 2024
-
-## Breaking changes
-- Gateway API GRPCRoute and ReferenceGrant v1alpha2 have been removed.
-- Please refer to the [Gateway API v1.2.0 documentation](https://github.com/kubernetes-sigs/gateway-api/releases) for more information.
-- Removed default CPU limit of the Envoy Gateway deployment
-- Changed default Envoy shutdown settings: drain strategy has been changed to immediate, default minDrainDuration, drainTimeout and terminationGracePeriodSeconds have been set to 10s, 60s and 360s respectively
-
-## New features
-- Added support for Gateway-API v1.2.0
-- Added support for IPv4/IPv6 Dual Stack for Envoy listeners and BackendRef resources
-- Added support for EG standalone(host deployment) mode (experimental)
-- Added support for JWT claims based Authorization in SecurityPolicy CRD
-- Added support for Direct Response in HTTPRouteFilter CRD
-- Added support for Response Override in BackendTrafficPolicy CRD
-- Added support for RequestTimeout in BackendTrafficPolicy CRD
-- Added support for inverting header matches for rate limit in BackendTrafficPolicy CRD
-- Added support for client TLS session resumption in ClientTrafficPolicy CRD
-- Added support for HTTPRouteFilter and path regex rewrite
-- Added support for host header rewrite in HTTPRouteFilter CRD
-- Added support for Listener Access Log in EnvoyProxy CRD
-- Added support for Datadog tracing support in EnvoyProxy CRD
-- Added support for request response sizes stats in EnvoyProxy CRD
-- Added support for wildcard matching for CORS AllowMethods and AllowHeaders settings in SecurityPolicy CRD
-- Added support for match conditions for access log in EnvoyProxy CRD
-- Added support for using BackendCluster to represent OIDCProvider
-- Added support for RecomputeRoute for ExtAuth in SecurityPolicy CRD
-- Added support for sharing token cookies between multiple domains in SecurityPolicy CRD
-- Added support for JSONPatches for proxy bootstrap modifications in EnvoyProxy CRD
-- Added support for LB priority for non xRoute endpoints
-- Added support for configuring the GRPC Health Checker in the BackendTrafficPolicy CRD
-- Added support for early request header mutation in the ClientTrafficPolicy CRD
-- Added support for JsonPath in the EnvoyPatchPolicy CRD
-- Added support for cluster settings for tracing and access log backends in EnvoyProxy CRD
-- Added support for cluster settings for non xRoute-generated backend refs
-- Added support for socket buffer limit field in ClientTrafficPolicy and BackendTrafficPolicy CRD
-- Added support for http2 upstream settings in BackendTrafficPolicy CRD
-- Added support for DNS resolution settings in BackendTrafficPolicy CRD
-- Added support for configuring service annotations in the Envoy Gateway helm chart
-- Added support for configuring priorityClassName to Envoy Gateway helm chart
-- Added support for ratelimit metrics monitoring in grafana in the addons helm chart
-- Added support for default user group and user id for the SecurityContexts in the Envoy Gateway helm chart
-- Added support for maxUnavailable in the PodDisruptionBudget in the Envoy Gateway helm chart
-- Added support for configuring NodeSelector in the Envoy Gateway helm chart
-- Added support for nonce in the OIDC auth flow
-- Added support for choosing an HTTPRoute's non-wildcard hostname as the default Host
-- Added support for returning 500 when EnvoyExtensionTrafficPolicy translation fails
-- Added support for returning 500 when SecurityPolicy translation fails
-- Added support for multiple backendRefs for ExtAuth and ExtProc
-- Added support for session persistence in HTTPRoute rules
-- Added support for the Backend resource for ExtAuth
-- Added support for target selectors on Envoy Gateway Extension Server policies
-- Added support for non-Kubernetes Backends for TLSRoute
-- Added support for fallback to the Backend API
-- Added support for reloadable EnvoyGateway configuration
-- Added support for adding Labels to the Envoy Service
-- Added support for custom name for ratelimit deployment
-- Added default SecurityContext for EG components
-- Added startupProbe to all provisioned containers
-- Added support for local validations for egctl translate and file provider
-- Added support for egctl x collect to collect information from the cluster for debugging
-- Added support for a native prometheus metrics endpoint in the ratelimit server
-
-## Bug fixes
-- Fixed unsupported listener protocol type causing an error while updating Gateway Status
-- Fixed some status updates were being discarded by the status updater
-- Fixed Gateway crash adding BackendTLSPolicy to External Backend of an HTTPRoute
-- Fixed Delay in SecurityPolicy change propagation for HTTPRoute when using targetSelectors
-- Fixed JSONPath not correctly translated to JSONPatch paths
-- Fixed allow empty slowStart when using LeastRequest
-- Fixed Backends which should be rejected are still used as an HTTPRoute's destination
-- Fixed losing timeout settings that originate from the route when translating the backend traffic policy
-- Fixed Backend resources don't get status updates
-- Fixed Active Health check requires expectedStatuses field to work
-- Fixed HTTPHeaderFilter processing doesn't correctly support multiple header values
-- Fixed multiple reference grants in same namespace
-- Fixed upstream get unwanted /.
-- Fixed creation of SecurityPolicy with targetSelectors fails
-- Fixed wrong gateway is chosen as HTTPRoute parent
-- Fixed override issue for EEP
-- Fixed nil pointer err translating hash load balancing
-- Fixed ratelimit does not work across multiple GatewayClasses
-- Fixed upstream mTLS only works for HTTPS listeners
-- Fixed nil pointer if backedtls.minVersion is set but backedtls.maxVersion is not
-- Fixed empty connection limit causes XDS rejection
-- Fixed ratelimit not working with both headers and cidr matches
-- Fixed EDS didn't update when deployments was created after services
-- Fixed RBAC issue for deleting infrastructure resources
-- Fixed customized infrastructure resources not being deleted
-- Fixed Gateways never become ready/programmed when running Envoy as a Daemonset
-- Fixed Ratelimit Deployment ignoring pod labels and annotation merge
-- Fixed the API Server receives unnecessary requests
-- Fixed terminating envoy pods don't respond with "Connection: close" (H1) or GOAWAY(H2) on shutdown, switch to an immediate drain strategy
-- Fixed ratelimit statsd not working
-- Fixed not generating selector of deployment/daemonset based on the custom label configuration of EnvoyProxy
-- Fixed egctl experimental translate using a wrong ns
-
-## Performance improvements
-- Fixed repeated resources and optimize memory usage
-
-## Other changes
-- Removed grafana test framework from the addons helm chart
-- Disabled ALPN for non-HTTP routes
-- Added statPrefix for HCM and TCPProxy
-- Enabled GatewayHTTPListenerIsolation conformance test
-- Enabled GRPC conformance profile
-- Enabled HTTPRouteBackendRequestHeaderModifier conformance test
-- Added e2e test for Daemonset mode
-- Updated upgrades tests to use VERSION env variable
-- Fixed OVS scanner wrong license warnings
-- Added e2e test for TLS session resumption
-- Added heap profile into benchmark report
-- Added e2e test for RecomputeRoute in ExtAuth
-- Added benchmark memory profiles into report
-- Fixed flaky gateway_with_conflicted_listener_cannot_be_merged e2e test
-- Fixed flaky Zipkin Tracing e2e test
-- Added e2e test for cookie based consistent hash load balancing
-- Added e2e test for load balancing
-- Fixed flaky authorization tests
-- Enabled upgrade test
-- Fixed flaky basic auth e2e test
-- Enabled use-client-protocol e2e test
-- Added performance benchmarking test for 1000 HTTPRoutes
-- Added e2e test for Datadog tracing
-- Added e2e tests for ratelimit invert matching headers
-- Reduced readinessProbe failureThreshold and periodSeconds
-- Bumped go-control-plane to v0.13.1
-
diff --git a/site/content/en/news/releases/notes/v1.3.0-rc.1.md b/site/content/en/news/releases/notes/v1.3.0-rc.1.md
deleted file mode 100644
index 673b740f7..000000000
--- a/site/content/en/news/releases/notes/v1.3.0-rc.1.md
+++ /dev/null
@@ -1,107 +0,0 @@
----
-title: "v1.3.0-rc.1"
-publishdate: 2025-01-23
----
-
-Date: January 23, 2025
-
-## Breaking changes
-- The Container `ports` field of the gateway instance has been removed, which will cause the gateway Pod to be rebuilt when upgrading the version.
-- ClientTrafficPolicy previously treated an empty TLS ALPNProtocols list as being undefined and applied Envoy Gateway defaults. An empty TLS ALPNProtocols list is now treated as user-defined disablement of the TLS ALPN extension.
-- Outlier detection (passive health check) is now disabled by default. refer to https://gateway.envoyproxy.io/docs/api/extension_types/#backendtrafficpolicy for working with passive health checks.
-- Envoy Gateway treats errors in calls to an extension service as fail-closed by default. Any error returned from the extension server will replace the affected resource with an "Internal Server Error" immediate response. The previous behavior can be enabled by setting the `failOpen` field to `true` in the extension service configuration.
-- Envoy Gateway now return a 500 response when a ClientTrafficPolicy translation fails for HTTP/GRPC routes, and forwards client traffic to an empty cluster when a ClientTrafficPolicy translation fails for TCP routes.
-- Any issues with `EnvoyProxy` reference in a `Gateway` will prevent the Envoy fleet from being created or result in the deletion of an existing Envoy fleet.
-- Envoy Gateway now returns a 500 response when a BackendTLSPolicy translation fails for HTTP/GRPC/TLS routes.
-
-## Security updates
-- Fixed vulnerability which exposed the Envoy admin interface through the prometheus stats endpoint.
-
-## New features
-- Added support for trusted CIDRs in the ClientIPDetectionSettings API.
-- Added support for sending attributes to external processor in EnvoyExtensionPolicy API.
-- Added support for patching EnvoyProxy.spec.provider.kubernetes.envoyHpa and EnvoyProxy.spec.provider.kubernetes.envoyPDB.
-- Added support for defining rateLimitHpa in EnvoyGateway API.
-- Added support for preserving the user defined HTTPRoute match order in EnvoyProxy API.
-- Added support for response compression in the BackendTrafficPolicy API.
-- Added support for cost specifier in the rate limit API.
-- Added support for specifying dynamic metadata namespaces that External Processing services can access read from and write to in EnvoyExtensionPolicy API.
-- Added support for API Key Authentication in the SecurityPolicy API.
-- Continue using and drain endpoints during their graceful termination, as indicated by their respective EndpointConditions.
-- Added support for GEP-1731 (HTTPRoute Retries).
-- Added support for routing to Backend resources in the GRPCRoute, TCPRoute and UDPRoute APIs.
-- Added support for configuring Max GRPC message size for the Extension Manager in EnvoyGateway config.
-- Added support for configuring tracing sampling rate with Fraction.
-- Added support for dynamic reload of System WellKnownCACertificates in BackendTLSPolicy.
-- Added support for overriding status code in response overrides ClientTrafficPolicy.
-- Added support for AllowModeOverride for ext-proc in EnvoyExtensionPolicy.
-- Added support for configuring remote JWKS settings with BackendCluster in SecurityPolicy.
-- Added support for sending body to Ext-Auth server in SecurityPolicy.
-- Added support for Sending attributes to ext-proc in EnvoyExtensionPolicy.
-- Added support for configuring hostEnvKeys for Wasm extensions in EnvoyExtensionPolicy.
-- Gateway API Route rule name is propagated to XDS metadata as sectionName.
-
-## Bug fixes
-- Fixed a panic in the provider goroutine when the body in the direct response configuration was nil.
-- Fixed Envoy rejecting TCP Listeners that have no attached TCPRoutes.
-- Fixed failed to update SecurityPolicy resources with the `backendRef` field specified.
-- Fixed xDS translation failed when oidc tokenEndpoint and jwt remoteJWKS are specified in the same SecurityPolicy and using the same hostname.
-- Fixed frequent 503 errors when connecting to a Service experiencing high Pod churn.
-- Disabled the retry policy for the JWT provider to reduce requests sent to the JWKS endpoint. Failed async fetches will retry every 1s.
-- Fixed BackendTLSPolicy not supporting the use of a port name as the sectionName in targetRefs.
-- Fixed reference grant from EnvoyExtensionPolicy to the referenced ext-proc backend not being respected.
-- Fixed BackendTrafficPolicy not applying to Gateway Routes when a Route has a Request Timeout defined.
-- Fixed proxies connected to the secondary Envoy Gateway not receiving xDS configuration.
-- Fixed traffic splitting not working when some backends were invalid.
-- Fixed a nil pointer error that occurred when a SecurityPolicy referred to a UDS backend.
-- Fixed an issue where the Gateway API translator did not use the TLS configuration from the BackendTLSPolicy when connecting to the OIDC provider’s well-known endpoint.
-- Fixed a validation failure that occurred when multiple HTTPRoutes referred to the same extension filter.
-- Fixed a nil pointer error caused by accessing the cookie TTL without verifying if it was valid.
-- Fixed unexpected port number shifting in standalone mode.
-- Fixed an issue where the shutdown-manager did not respect the security context of the container spec.
-- Fixed readiness checks failing for single-stack IPv6 Envoy Gateway deployments on dual-stack clusters.
-- Fixed IPv6 dual-stack support not working as intended.
-- Fixed the ability to overwrite control plane certs with the certgen command by using a new command arg (-o).
-- Fixed a panic that occurred following update to the envoy-gateway-config ConfigMap.
-- Fixed prometheus format conversion of ratelimit metrics for remote address.
-- Fixed limitations that prevented creation of FQDN Endpoints with a single-character subdomain in Backend.
-- Fixed issue where SecurityContext of shutdown-manager container was not updated by overriding helm values.
-- Fixed issue with incorrect IPFamily detection for backends.
-
-## Other changes
-- Bumped Gateway API to v1.2.1.
-- Use `V4_PREFERRED` instead of `V4_ONLY` by default for the cluster's `DnsLookupFamily`.
-- EG Listens on IPv4 by default, but if IPFamily is set to IPv6 or DualStack, it listens on :: and enables ipv4_compat for DualStack.
-- Modified the base container image to gcr.io/distroless/base-nossl:nonroot.
-- [SecurityPolicy] Modify the JWT Provider Issuer validation constraint.
-- Add support for Kubernetes 1.32.x in the test matrix, and remove support for Kubernetes 1.28.x.
-- Added metrics and dashboards for Envoy Gateway panics in watchables.
-- Bumped go-control-plane to v0.13.4.
-- Envoy Gateway now validates all XDS resources are before adding them to the snapshot.
-- Increased the maximum amount of endpoints to 64 in Backend.
-- Envoy Gateway would recover from panics in the reconciliation flow.
-- Bumped Golang to 1.23.3.
-- Added e2e test for BackendTLSPolicy with System Truststore.
-- Added e2e test for response code override.
-- Added e2e test remote JWKS Backend Cluster settings.
-- Added e2e test for GRPCRoute, TCPRoute and UDPRoute referencing Backend.
-- Added e2e test for ratelimit cost.
-- Added e2e test for XFF Trusted CIDRs.
-- Added e2e test for Compression.
-- Added e2e test for API Key Auth.
-- Added e2e test for Ext-Proc Metadata Options.
-- Added e2e test for Route order preservation.
-- Added e2e test for OIDC provider with TLS.
-- Added e2e test for Basic Auth.
-- Added e2e tests for IPv6.
-- Added e2e test for Ext-Proc Attributes.
-- Added docs for using OIDC provider with self-singed certificate.
-- Added docs for using dual-stack.
-- Fixed docs for Extension Server RBAC requirements.
-- Added docs for patching bootstrap config with JSONPatch using EnvoyProxy.
-- Added docs for standalone mode.
-- Added docs for OIDC cookieDomain.
-- Added docs for Response Override.
-- Added note on CRD upgrades.
-- Added docs for failover.
-
diff --git a/site/content/en/news/releases/notes/v1.4.0-rc.1.md b/site/content/en/news/releases/notes/v1.4.0-rc.1.md
deleted file mode 100644
index d463c4320..000000000
--- a/site/content/en/news/releases/notes/v1.4.0-rc.1.md
+++ /dev/null
@@ -1,75 +0,0 @@
----
-title: "v1.4.0-rc.1"
-publishdate: 2025-05-01
----
-
-Date: May 1, 2025
-
-## Breaking Changes
-
-- Use a dedicated listener port (19003) for EnvoyProxy readiness.
-- Use the Envoy JSON formatter for the default access log instead of the text formatter.
-- EnvoyGateway now skips xDS snapshot updates in case of errors during xDS translation.
-- When the Extension Manager is configured to Fail Open, translation errors are logged and suppressed.
-- When the Extension Manager is configured not to Fail Open, Envoy Gateway will no longer replace affected resources. Instead, the xDS snapshot update is skipped.
-
-## Security Updates
-
-- Fixed CVE-2025-25294.
-
-## New Features
-
-- Added support for configuring `maxUnavailable` in `KubernetesPodDisruptionBudgetSpec`.
-- Added support for percentage-based request mirroring.
-- Added support for `matchExpressions` in `TargetSelector`.
-- Added a defaulter for Gateway API resources loaded from files to set default values.
-- Added support for defining Lua EnvoyExtensionPolicies.
-- Added a `RequestID` field in `ClientTrafficPolicy.HeaderSettings` to configure Envoy’s `X-Request-ID` behavior.
-- Added support for HorizontalPodAutoscaler in the Helm chart.
-- Added support for distinct header and distinct source CIDR-based local rate limiting.
-- Added support for forwarding the authenticated username to the backend via a configurable header in `BasicAuth`.
-- Added support for HTTP Methods and Headers-based authorization in `SecurityPolicy`.
-- Added support for zone-aware routing.
-- Added support for `BackendTLSPolicy` to target `ServiceImport`.
-- Added support for the `kubernetes.io/h2c` application protocol in `ServiceImport`.
-- Added support for per-host circuit breaker thresholds.
-- Added support for injecting credentials from a Kubernetes Secret into a request header. Credentials can be injected using either an `HTTPRouteFilter` or a `BackendRef` filter.
-- Added support for `egctl` WebSocket in addition to SPDY.
-- Added a Helm chart configuration option to set the `TrafficDistribution` field in the Envoy Gateway Service.
-- Added support for setting the Envoy Proxy log level to `trace`.
-- Added support for global `imageRegistry` and `imagePullSecrets` in the Helm chart.
-- Added support for using a local JWKS (inline string or in a `ConfigMap`) to validate JWT tokens in `SecurityPolicy`.
-- Added support for logging resource statuses in standalone mode.
-- Added support for per-route tracing in `BackendTrafficPolicy`.
-- Added support for configuring retry settings for Extension Service hooks in `EnvoyGateway` config.
-- Added support for request buffering using the Envoy Buffer filter.
-- Added support for the `merge` type in `BackendTrafficPolicy`.
-- Added support for the `OverlappingTLSConfig` condition in Gateway status. This condition is set if there are overlapping hostnames or certificates between listeners. The ALPN protocol is set to `HTTP/1.1` for overlapping listeners to avoid HTTP/2 Connection Coalescing.
-
-## Bug Fixes
-
-- Fixed traffic splitting when filters are attached to the `backendRef`.
-- Added support for Secret and ConfigMap parsing in standalone mode.
-- Bypassed overload manager for stats and ready listeners.
-- Fixed translation of `backendSettings` for `extAuth`.
-- Fixed an issue where the stats compressor was not working.
-- Added support for `BackendTLSPolicy` and `EnvoyExtensionPolicy` parsing in standalone mode.
-- Retriggered reconciliation when a `backendRef` of type `ServiceImport` is updated or when `EndpointSlice(s)` for a `ServiceImport` are updated.
-- Fixed an issue where errors were not logged and returned in the Kubernetes Reconcile method when a `GatewayClass` is not accepted.
-- Fixed allowing an empty text field for OpenTelemetry sink when using JSON format.
-- Fixed an issue where `SamplingFraction` was not working.
-- Fixed Kubernetes resources not being deleted when a customized name was used.
-- No longer treating essential resources (e.g., `namespace`) as missing while loading from a file.
-- No longer setting retriable status codes to `503` when `RetryOn` is configured in `BackendTrafficPolicy`.
-
-## Performance Improvements
-
-- Added a cache for Wasm OCI image permission checks and now checking `pullSecrets` against the OCI image registry in a background goroutine.
-
-## Deprecations  
-
-- Deprecated the `PreserveXRequestID` field.
-
-## Other Changes  
-
-- Updated gateway-api to v1.3.0.
diff --git a/tools/make/docs.mk b/tools/make/docs.mk
index 9f07dcacb..862190a5b 100644
--- a/tools/make/docs.mk
+++ b/tools/make/docs.mk
@@ -181,6 +181,6 @@ docs-markdown-lint:
 
 release-notes-docs: $(tools/release-notes-docs)
 	@$(LOG_TARGET)
-	@for file in $(wildcard release-notes/v*.yaml); do \
+	@for file in $(wildcard release-notes/$(shell cat VERSION).yaml); do \
 		$(tools/release-notes-docs) $$file site/content/en/news/releases/notes; \
 	done



Test patch:
diff --git a/api/v1alpha1/validation/envoygateway_validate_test.go b/api/v1alpha1/validation/envoygateway_validate_test.go
index 57caf957d..de67123b7 100644
--- a/api/v1alpha1/validation/envoygateway_validate_test.go
+++ b/api/v1alpha1/validation/envoygateway_validate_test.go
@@ -405,6 +405,10 @@ func TestValidateEnvoyGateway(t *testing.T) {
 									Kind: &TLSSecretKind,
 									Name: gwapiv1.ObjectName("certificate"),
 								},
+								ClientCertificateRef: &gwapiv1.SecretObjectReference{
+									Kind: &TLSSecretKind,
+									Name: gwapiv1.ObjectName("client-certificate"),
+								},
 							},
 						},
 					},
@@ -438,6 +442,10 @@ func TestValidateEnvoyGateway(t *testing.T) {
 									Kind: &TLSSecretKind,
 									Name: gwapiv1.ObjectName("certificate"),
 								},
+								ClientCertificateRef: &gwapiv1.SecretObjectReference{
+									Kind: &TLSSecretKind,
+									Name: gwapiv1.ObjectName("client-certificate"),
+								},
 							},
 						},
 					},
@@ -478,6 +486,10 @@ func TestValidateEnvoyGateway(t *testing.T) {
 									Kind: &TLSUnrecognizedKind,
 									Name: gwapiv1.ObjectName("certificate"),
 								},
+								ClientCertificateRef: &gwapiv1.SecretObjectReference{
+									Kind: &TLSSecretKind,
+									Name: gwapiv1.ObjectName("client-certificate"),
+								},
 							},
 						},
 					},
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 5caac573a..52bf85323 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -1916,7 +1916,7 @@ _Appears in:_
 
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
-| `certificateRef` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.SecretObjectReference)_ |  true  |  | CertificateRef is a reference to a Kubernetes Secret with a CA certificate in a key named "tls.crt".<br />The CA certificate is used by Envoy Gateway the verify the server certificate presented by the extension server.<br />At this time, Envoy Gateway does not support Client Certificate authentication of Envoy Gateway towards the extension server (mTLS). |
+| `certificateRef` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.SecretObjectReference)_ |  true  |  | CertificateRef is a reference to a Kubernetes Secret with a CA certificate in a key named "tls.crt".<br />The CA certificate is used by Envoy Gateway to verify the server certificate presented by the extension server. |
 
 
 #### ExtractFrom