Project: Kuma (Orchestration & Management / Service Mesh)
File: CHANGELOG.md

<!-- Autogenerated with (github.com/kumahq/ci-tools) release-tool changelog.md --> Released on 2024/04/25 fix(jobs): jobs termination after CP restart (#10085) fix(gatewayapi): validate presence of all required Gateway API resources (backport of #10079) (#10082) fix(gateway): handle implicit kuma.io/service in pod annotation (#10076) fix(transparent-proxy): stop logging all to stderr when installing tproxy (backport of #10045) (#10047) Released on 2024/05/17 chore(deps): manually bump go to 1.21.10 (backport of #10209) @kumahq chore(deps): upgrade Envoy to version 1.28.3 @lukidzi chore(deps): use latest kumahq/kuma-gui @kumahq fix(gatewayapi): validate presence of all required Gateway API resources (backport of #10079) @kumahq fix(jobs): jobs termination after CP restart (backport of #10085) @kumahq fix(kds): fix retry on NACK and add backoff (backport of #9736) @kumahq fix(kuma-cp): consistently check for expiring ZoneIngress/ZoneEgress certs (backport of #10160, #10162, #10161) @kumahq fix(kuma-cp): filter out old dangling zone resources in global @michaelbeaumont fix(transparent-proxy): stop logging all to stderr when installing tproxy (backport of #10045) @kumahq Released on 2024/04/23 chore(deps): upgrade Envoy to version 1.29.4 @lukidzi feat(k8s): opt-in to support tls for GAPI in all namespaces @jakubdyszkiewicz fix(helm): include GatewayClass only if installing a zone CP in Kubernetes mode @michaelbeaumont Released on 2024/04/17 chore(deps): bump Envoy from 1.28.0 to 1.29.3 @lukidzi chore(deps): bump Kong/public-shared-actions from 2.0.2 to 2.1.0 @dependabot chore(deps): bump actions/cache from 3 to 4.0.2 @dependabot chore(deps): bump actions/checkout from 4.1.1 to 4.1.2 @dependabot chore(deps): bump actions/create-github-app-token from 1.8.0 to 1.9.3 @dependabot chore(deps): bump actions/upload-artifact from 4.3.0 to 4.3.1 @dependabot chore(deps): bump cirello.io/pglock from 1.14.1 to 1.14.2 @dependabot chore(deps): bump debian from `b16cef8` to `b37bc25` @dependabot chore(deps): bump distroless/base-nossl-debian11 from `61c9d7a` to `4cba3ac` @dependabot chore(deps): bump distroless/static-debian11 from `1e5b9bb` to `459f8ab` @dependabot chore(deps): bump github.com/cilium/ebpf from 0.12.3 to 0.14.0 @dependabot chore(deps): bump github.com/containernetworking/plugins from 1.4.0 to 1.4.1 @dependabot chore(deps): bump github.com/docker/docker from 25.0.3+incompatible to 25.0.5+incompatible @dependabot chore(deps): bump github.com/emicklei/go-restful/v3 from 3.11.2 to 3.12.0 @dependabot chore(deps): bump github.com/exaring/otelpgx from 0.5.3 to 0.5.4 @dependabot chore(deps): bump github.com/golang/protobuf from 1.5.3 to 1.5.4 @dependabot chore(deps): bump github.com/gruntwork-io/terratest from 0.46.11 to 0.46.13 @dependabot chore(deps): bump github.com/jackc/pgx/v5 from 5.5.2 to 5.5.5 @dependabot chore(deps): bump github.com/onsi/ginkgo/v2 from 2.15.0 to 2.17.1 @dependabot chore(deps): bump github.com/onsi/gomega from 1.31.1 to 1.32.0 @dependabot chore(deps): bump github.com/prometheus/client_golang from 1.18.0 to 1.19.0 @dependabot chore(deps): bump github.com/prometheus/client_model from 0.5.0 to 0.6.1 @dependabot chore(deps): bump github.com/prometheus/common from 0.46.0 to 0.52.2 @dependabot chore(deps): bump github.com/spiffe/go-spiffe/v2 from 2.1.7 to 2.2.0 @dependabot chore(deps): bump github.com/testcontainers/testcontainers-go from 0.27.0 to 0.30.0 @dependabot chore(deps): bump github.com/tonglil/opentelemetry-go-datadog-propagator from 0.1.1 to 0.1.2 @dependabot chore(deps): bump github/codeql-action from 3.23.2 to 3.24.10 @dependabot chore(deps): bump go.uber.org/zap from 1.26.0 to 1.27.0 @dependabot chore(deps): bump golang.org/x/net from 0.20.0 to 0.24.0 @dependabot chore(deps): bump golang.org/x/sys from 0.17.0 to 0.19.0 @dependabot chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 @dependabot chore(deps): bump gonum.org/v1/gonum from 0.14.0 to 0.15.0 @dependabot chore(deps): bump google.golang.org/grpc from 1.61.0 to 1.63.2 @dependabot chore(deps): bump helm.sh/helm/v3 from 3.14.0 to 3.14.3 @dependabot chore(deps): bump iptables version @slonka chore(deps): bump kumahq/ubuntu-netools from `3f0fefb` to `9eba4ba` @dependabot chore(deps): bump peter-evans/create-pull-request from 5.0.2 to 6.0.2 @dependabot chore(deps): bump postgres from `49c276f` to `5b06192` @dependabot chore(deps): bump prometheus/common to v0.48.0 @slonka chore(deps): bump sigs.k8s.io/controller-runtime from 0.17.0 to 0.17.3 @dependabot chore(deps): bump sigs.k8s.io/gateway-api @michaelbeaumont chore(deps): bump slsa-framework/slsa-github-generator from 1.9.0 to 1.10.0 @dependabot chore(deps): bump the go-opentelemetry-io group with 1 update @dependabot chore(deps): bump the go-opentelemetry-io group with 10 updates @dependabot chore(deps): bump the go-opentelemetry-io group with 8 updates @dependabot chore(deps): bump the k8s-libs group with 5 updates @dependabot chore(deps): bump ubuntu from jammy-20240111 to jammy-20240227 @dependabot chore(deps): downgrade go-control-plane to v0.11.2-0.20231010133108-1dfbe83bcebc @lobkovilya chore(deps): downgrade to golang v1.21.7 @michaelbeaumont chore(deps): security update @kumahq chore(deps): update golang to v1.22, golangci-lint to

@michaelbeaumont chore(deps): upload sbom to gh release/tag assets @Automaat chore(deps): use latest kumahq/kuma-gui @kumahq feat(GatewayAPI): promote our Gateway API implementation to GA @bartsmykla feat(GatewayAPI): use MeshHTTPRoutes instead of MeshGatewayRoutes internally @bartsmykla feat(MeshGatewayInstance): deprecate kuma.io/service and generate serviceName @lukidzi feat(MeshHTTPRoute): set name of route action equal to hash of matches @lukidzi feat(MeshMetric) profiles @slonka feat(MeshMetric): add possibility to configure multiple opentelemetry backends @Automaat feat(MeshMetric): add possibility to configure refresh interval for open telemetry backend in meshmetric @Automaat feat(MeshMetric): disable rollup of clusters @slonka feat(MeshMetric): filter out internal clusters @slonka feat(MeshMetric): manually remove regex @slonka feat(MeshMetric): properly handle `appendProfiles` @slonka feat(MeshMetric): usedonly filters @slonka feat(MeshRateLimit): support targetRef: MeshHTTPRoute for Gateway @lukidzi feat(MeshRetry): allow configuration for MeshHTTPRoute @lukidzi feat(MeshService): add first iteration of resource @michaelbeaumont feat(MeshService): backend ref outbound to mesh service on Dataplane @jakubdyszkiewicz feat(MeshService): k8s controller to convert service @jakubdyszkiewicz feat(MeshService): xds generation @michaelbeaumont feat(MeshTimeout): added possibility to target MeshHTTPRoute for MeshGateway @lukidzi feat(MeshTrafficPermission): apply default deny @jakubdyszkiewicz feat(ServiceInsight): add zones to service insights @jakubdyszkiewicz feat(ZoneIngress): generate an empty direct response listener for empty zone ingress gateway @jijiechen feat(api-server): add format and include_eds to admin api @lahabana feat(api-server): add type filter to service-insights @lahabana feat(api-server): return `config_dump` response in the same format as envoy admin @lukidzi feat(auth): add possibility to restrict /config access @lahabana feat(components): exponential backoff for resilient components @jakubdyszkiewicz feat(k8s): add `experimental.sidecarContainers` to Helm chart @michaelbeaumont feat(k8s): add drain when using native sidecars @michaelbeaumont feat(k8s): add possibility to not add owner reference @lahabana feat(k8s): add sidecar startup probe with sidecar feature @michaelbeaumont feat(k8s): copy node topology labels @lukidzi feat(k8s): do not set mesh owner reference on synced resources @jakubdyszkiewicz feat(k8s): enable init container mesh access by default when using native sidecars @michaelbeaumont feat(k8s): sidecar containers @michaelbeaumont feat(kds): add kds client version to outgoing context @slonka feat(kds): add span for admin requests to zone CPs @michaelbeaumont feat(kds): stats of kds client versions @jakubdyszkiewicz feat(kuma-cni): add a init container to validate that iptables rules are applied @jijiechen feat(kuma-cp): add a helper function to get all kuma targetRef kinds to be used in child repos @jijiechen feat(kuma-cp): add ability to selectively enable core resources @michaelbeaumont feat(kuma-cp): add plugin policy toggles @slonka feat(kuma-cp): remove grpc support from mads @Automaat feat(kuma-cp): resilient component backoff config @Automaat feat(kuma-dp): migrate to prometheus otel sdk when using meshmetric @Automaat feat(kuma-dp): use Envoy `--drain-strategy immediate` @michaelbeaumont feat(kumactl): support for new Inspect API endpoint `_config` @lobkovilya feat(pgx): configure idle timeout @lukidzi feat(policies): deprecated `from @lobkovilya feat(policies): shadow mode for policies @lobkovilya feat(resources): add status @jakubdyszkiewicz feat(resources): generate core resource @jakubdyszkiewicz feat(tracing): add tracing to intercp gRPC server and client @michaelbeaumont feat(transparent-proxy): add automatic iptables type detection @bartsmykla feat(transparent-proxy): deprecate argument 'redirect-inbound-port-v6' and introduce 'ip-family-mode' @jijiechen feat(transparent-proxy): drop all capabilities for sidecar containers @jijiechen feat(transparent-proxy): init container scc hardening @jijiechen fix(GatewayAPI): add missing Name param to query params matcher on MeshHTTPRoute @bartsmykla fix(GatewayAPI): don't add HTTPRoute status if Kuma isn't the controller @michaelbeaumont fix(GatewayAPI): make MeshHTTPRoute conversion port redirect gapi conformant @bartsmykla fix(GatewayAPI): set mesh properly during owned object reconciliation @bartsmykla fix(MeshGateway): don't rewrite / with trailing slash @michaelbeaumont fix(MeshGateway): fix MeshTCPRoute on MeshGateway @lahabana fix(MeshHTTPRoute): allow

service name for GAMMA compliance @bartsmykla fix(MeshHTTPRoute): allow no backendRefs when RequestRedirect filter present @bartsmykla fix(MeshHTTPRoute): fix response headers filter in gateway route generation @bartsmykla fix(MeshHTTPRoute): order rules by match priority @michaelbeaumont fix(MeshHTTPRoute): trim "/" path match suffix when converting HTTPRoute @bartsmykla fix(MeshHealthCheck): isolate MeshGateway config based on hostname @michaelbeaumont fix(MeshLoadBalancingStrategy): configure builtin gateway @lukidzi fix(MeshMetric): otel endpoint validation @Automaat fix(MeshTCPRoute): allow MeshGateway listener tags @michaelbeaumont fix(api-server): return 404 when a mesh doesn't exist @lahabana fix(defaults): change meshsubset to mesh for gateway's meshtimeout @lukidzi fix(helm): missing postgres tls mode when it is set to verifyNone @AyushSenapati fix(helm): use kuma name in ingress and egress pdb selectors @slavogiez fix(k8s): create builtin CA once @jakubdyszkiewicz fix(kds): fix memory leak on kds error @Automaat fix(kds): fix retry on NACK and add backoff @slonka fix(kds): run filters before ZoneWatcher @lukidzi fix(kuma-cni): fix the subject namespace reference in Helm Chart @jijiechen fix(kuma-cp): change the "direction" of the diff in inspect shadow responses @lobkovilya fix(kuma-cp): clone outbound tags @lukidzi fix(kuma-cp): copy annotations when adding/update k8s object @lukidzi fix(kuma-cp): fix long polling issues in mads @Automaat fix(kuma-cp): ignore shadow policies on ZoneEgress @lobkovilya fix(kuma-cp): kds sync on upgrade doubles the number of policies @lobkovilya fix(kuma-cp): prevent violating kubernetes label limit @jakubdyszkiewicz fix(kuma-cp): return wrapped forward KDS client errors @lukidzi fix(kuma-cp): use display-name label to check if resource is referenced @lobkovilya fix(kumactl): correctly print new style resources @lahabana fix(kumactl): npe when creating new core resources @michaelbeaumont fix(pgx): use default MaxConnLifetimeJitter value for jitter @lukidzi fix(policies): don't set empty kuma.io service when using MeshHTTPRoute @lukidzi fix(policies): fix metrics labels @Automaat fix(transparent-proxy): make iptables mode detection more defensive @bartsmykla fix(xds): duplicated listeners @jakubdyszkiewicz perf(k8s): ignore serviceless pods from vips list @jakubdyszkiewicz perf(vips): group DB calls for CreateOrUpdateVIPConfigs @nicoche Released on 2024/04/07 chore(deps): security update @kumahq chore(deps): update Envoy to v1.28.2 @michaelbeaumont Released on 2024/04/07 chore(deps): security update @kumahq chore(deps): update Envoy to v1.28.2 @michaelbeaumont Released on 2024/04/05 Revert "feat(images/kuma-init): use iptables-wrapper to use correct iptables version (backport of #9701) (#9726)" @bartsmykla chore(deps): security update @kumahq chore(deps): update Envoy to v1.27.4 @michaelbeaumont Released on 2024/04/05 Revert "feat(images/kuma-init): use iptables-wrapper to use correct iptables version (backport of #9701) (#9725)" @bartsmykla chore(deps): security update @kumahq chore(deps): update Envoy to v1.26.8 @michaelbeaumont Released on 2024/04/05 Revert "feat(images/kuma-init): use iptables-wrapper to use correct iptables version (backport of #9701) (#9727)" @bartsmykla chore(deps): security update @kumahq chore(deps): update Envoy to v1.26.8 @michaelbeaumont Released on 2024/04/02 fix(transparent-proxy): make iptables mode detection more defensive (backport of #9776) @kumahq Released on 2024/04/02 fix(transparent-proxy): make iptables mode detection more defensive (backport of #9776) @kumahq Released on 2024/03/29 chore(deps): security update @kumahq feat(transparent-proxy): add automatic iptables type detection (backport of #9750) @kumahq fix(MeshHTTPRoute): fix response headers filter in gateway route generation (backport of #9652) @kumahq Released on 2024/03/29 chore(deps): security update @kumahq feat(transparent-proxy): add automatic iptables type detection (backport of #9750) @kumahq Released on 2024/03/15 chore(deps): security update @kumahq Released on 2024/03/15 chore(deps): security update @kumahq chore(deps): use latest kumahq/kuma-gui @kumahq Released on 2024/03/15 chore(deps): security update @kumahq Released on 2024/03/15 chore(deps): manual security update release-2.2 @lobkovilya chore(deps): security update @kumahq Released on 2024/03/13 chore(deps): security update @kumahq fix(kuma-cp): clone outbound tags (backport of #9592) @kumahq fix(xds): duplicated listeners (backport of #9542) @kumahq Released on 2024/02/20 chore(deps): security update @kumahq chore(deps): update iptables version (backport of #9200) @kumahq chore(deps): upgrade envoy to v1.28.1 @lukidzi fix(gatewayapi): don't add HTTPRoute status if Kuma isn't the controller (backport of #9228) @kumahq Released on 2024/02/20 chore(deps): update iptables version (backport of #9200) @kumahq chore(deps): upgrade envoy to v1.27.3 @lukidzi Released on 2024/02/20 chore(deps): update iptables version (backport of #9200) @kumahq chore(deps): upgrade envoy to v1.26.7 @lukidzi Released on 2024/02/20 chore(deps): update iptables version (backport of #9200) @kumahq chore(deps): upgrade envoy to v1.26.7 @lukidzi Released on 2024/02/16 chore(deps): downgrade go-control-plane to v0.11.2-0.20231010133108-1dfbe83bcebc (backport of #9163) @kumahq chore(deps): security update @kumahq chore(deps): update iptables version (backport of #9200) @kumahq chore(deps): upgrade envoy to v1.28.1 @lukidzi chore(deps): use latest kumahq/kuma-gui @kumahq fix(MeshGateway): fix MeshTCPRoute on MeshGateway (backport

#9167) @kumahq fix(MeshTCPRoute): allow MeshGateway listener tags @michaelbeaumont fix(defaults): change meshsubset to mesh for gateway's meshtimeout (backport of #9192) @kumahq fix(gatewayapi): don't add HTTPRoute status if Kuma isn't the controller (backport of #9228) @kumahq fix(kubernetes): create builtin CA once (backport of #9124) @kumahq fix(kuma-cp): copy annotations when adding/update k8s object (backport of #9254) @kumahq fix(kuma-cp): kds sync on upgrade doubles the number of policies (backport of #9259) @kumahq fix(kuma-cp): prevent violating kubernetes label limit (backport of #9191) @kumahq Released on 2024/02/02 chore(deps): bump the go-opentelemetry-io group with 3 updates (backport of #8347) @kumahq chore(deps): security update @kumahq chore(deps): update go from 1.21.5 to 1.21.6 (backport of #8944) @kumahq chore(deps): update go to 1.21.4 (backport of #8341) @kumahq chore(deps): update go to 1.21.5 (backport of #8616) @kumahq fix(ZoneIngress): subset routing when tag is present on all subsets (backport of #8443) @kumahq fix(k8s): don't temporarily remove all AvailableServices on ZoneIngress Pod reconciliations (backport of #8301) @kumahq fix(kds): race condition on fill metadata (backport of #8872) @kumahq Released on 2024/02/02 chore(deps): security update @kumahq chore(deps): update go from 1.21.5 to 1.21.6 (backport of #8944) @kumahq chore(deps): update go to 1.21.4 (backport of #8341) @kumahq chore(deps): update go to 1.21.5 (backport of #8616) @kumahq chore(deps): upgrade envoy to 1.26.6 @lukidzi fix(MeshTrafficPermission): support permissive mtls (backport of #8171) @kumahq fix(k8s): don't temporarily remove all AvailableServices on ZoneIngress Pod reconciliations (backport of #8301) @kumahq fix(k8s): fix VIPs configmap entries with invalid keys for ExternalName services (backport of #8168) @kumahq fix(kds): race condition on fill metadata (backport of #8872) @kumahq Released on 2024/02/01 chore(deps): bump actions/cache from 3.3.2 to 4.0.0 @dependabot chore(deps): bump actions/checkout from 3.1.0 to 4.1.1 @dependabot chore(deps): bump actions/download-artifact and actions/upload-artifact from 3 to 4 @michaelbeaumont chore(deps): bump actions/github-script from 6 to 7 @dependabot chore(deps): bump actions/setup-go from 4 to 5 @dependabot chore(deps): bump actions/upload-artifact from 3.1.0 to 4.2.0 @dependabot chore(deps): bump debian from `fab22df` to `b16cef8` @dependabot chore(deps): bump distroless/base-nossl-debian11 from `1ae8df5` to `61c9d7a` @dependabot chore(deps): bump distroless/static-debian11 from `cdb2034` to `1e5b9bb` @dependabot chore(deps): bump github.com/bakito/go-log-logr-adapter from v0.0.2 to latest @michaelbeaumont chore(deps): bump github.com/containerd/containerd from 1.7.7 to 1.7.11 @dependabot chore(deps): bump github.com/containernetworking/plugins from 1.3.0 to 1.4.0 @dependabot chore(deps): bump github.com/emicklei/go-restful/v3 from 3.11.0 to 3.11.2 @dependabot chore(deps): bump github.com/envoyproxy/go-control-plane from 0.11.1 to 0.12.0 @dependabot chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 1.0.2 to 1.0.4 @dependabot chore(deps): bump github.com/evanphx/json-patch/v5 from 5.7.0 to 5.8.1 @dependabot chore(deps): bump github.com/exaring/otelpgx from 0.5.2 to 0.5.3 @dependabot chore(deps): bump github.com/go-logr/logr from 1.3.0 to 1.4.1 @dependabot chore(deps): bump github.com/golang-migrate/migrate/v4 from 4.16.2 to 4.17.0 @dependabot chore(deps): bump github.com/google/uuid from 1.4.0 to 1.6.0 @dependabot chore(deps): bump github.com/gruntwork-io/terratest from 0.46.7 to 0.46.11 @dependabot chore(deps): bump github.com/jackc/pgx/v5 from 5.5.0 to 5.5.2 @dependabot chore(deps): bump github.com/miekg/dns from 1.1.56 to 1.1.58 @dependabot chore(deps): bump github.com/onsi/ginkgo/v2 from 2.13.1 to 2.15.0 @dependabot chore(deps): bump github.com/onsi/gomega from 1.30.0 to 1.31.1 @dependabot chore(deps): bump github.com/prometheus/client_golang from 1.17.0 to 1.18.0 @dependabot chore(deps): bump github.com/prometheus/common from 0.45.0 to 0.46.0 @dependabot chore(deps): bump github.com/spiffe/go-spiffe/v2 from 2.1.6 to 2.1.7 @dependabot chore(deps): bump github.com/testcontainers/testcontainers-go from 0.26.0 to 0.27.0 @dependabot chore(deps): bump github/codeql-action from 2 to 3.23.1 @dependabot chore(deps): bump golang from 1.21.4 to 1.21.6 @jakubdyszkiewicz,@michaelbeaumont chore(deps): bump golang.org/x/crypto from 0.16.0 to 0.17.0 @dependabot chore(deps): bump golang.org/x/net from 0.18.0 to 0.20.0 @dependabot chore(deps): bump golang.org/x/sys from 0.14.1-0.20231108175955-e4099bfacb8c to 0.16.0 @dependabot chore(deps): bump google.golang.org/grpc from 1.59.0 to 1.61.0 @dependabot chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.32.0 @dependabot chore(deps): bump helm.sh/helm/v3 from 3.13.2 to 3.14.0 @dependabot chore(deps): bump ossf/scorecard-action from 2.1.2 to 2.3.1 @dependabot chore(deps): bump postgres from `e213539` to `49c276f` @dependabot chore(deps): bump sigs.k8s.io/controller-runtime from 0.16.3 to 0.17.0 @dependabot chore(deps): bump sigs.k8s.io/controller-tools from 0.13.0 to

@dependabot chore(deps): bump the go-opentelemetry-io group with 3 updates @dependabot chore(deps): bump the go-opentelemetry-io group with 5 updates @dependabot chore(deps): bump the k8s-libs group from 0.28.3 to 0.28.4 @dependabot chore(deps): bump the k8s-libs group with 1 update @dependabot chore(deps): bump the k8s-libs group with 3 updates @dependabot chore(deps): bump the k8s-libs group with 4 updates @dependabot chore(deps): bump ubuntu from `2b7412e` to `6042500` @dependabot chore(deps): fix update insecure dependencies by setting bigger swap @slonka chore(deps): more explicit image tag in envoy.Dockerfile @michaelbeaumont chore(deps): security update @kumahq chore(deps): tag ubuntu image more explicitly @michaelbeaumont chore(deps): use latest kumahq/kuma-gui @kumahq feat(ExternalService): make ExternalServices independent of TrafficPermission @lukidzi feat(ExternalService): validate same value for service and address @jakubdyszkiewicz feat(MeshAccessLog): select gateway listeners @michaelbeaumont feat(MeshCircuitBreaker): select MeshGateway listeners @michaelbeaumont feat(MeshFaultInjection): select MeshGateway listeners @michaelbeaumont feat(MeshFaultInjection): support ExternalServices with ZoneEgress @lukidzi feat(MeshHTTPRoute): add basic gRPC support @lukidzi feat(MeshHTTPRoute): add hostToBackendHostname rewrite with MeshGateway @michaelbeaumont feat(MeshHTTPRoute): basic MeshGateway support @michaelbeaumont feat(MeshHTTPRoute): support hostnames with MeshGateway @michaelbeaumont feat(MeshHealthCheck): select MeshGateway listeners @michaelbeaumont feat(MeshLoadBalancingStrategy): add option to configure ActiveRequestBias @lukidzi feat(MeshLoadBalancingStrategy): select MeshGateway listeners @michaelbeaumont feat(MeshLoadBalancingStrategy): support kind MeshGateway @michaelbeaumont feat(MeshMetric): add create conflicts to the metric @jakubdyszkiewicz feat(MeshMetric): implement OpenTelemetry API for MeshMetric @Automaat feat(MeshRateLimit): select MeshGateway listeners @michaelbeaumont feat(MeshRateLimit): support ExternalServices with ZoneEgress @lukidzi feat(MeshRetry): select MeshGateway listeners @michaelbeaumont feat(MeshTCPRoute): add kafka protocol support @lukidzi feat(MeshTCPRoute): support MeshGateway @michaelbeaumont feat(MeshTimeout): add RequestHeadersTimeout option and configure MeshGateway @lukidzi feat(MeshTimeout): select MeshGateway listeners @michaelbeaumont feat(MeshTrace): select MeshGateway listeners @michaelbeaumont feat(MeshTrace): support kind MeshGateway @michaelbeaumont feat(api-server): add /_resources endpoint @lahabana feat(api-server): add _rules api to MeshGateways @lahabana feat(api-server): add dataplanes/_rules new inspect api @lahabana feat(api-server): skip auth on specific endpoints @jakubdyszkiewicz feat(bootstrap): support customizing corefile template from kuma-cp @jijiechen feat(dataplane): ignored listeners with ignored labels in selector @jakubdyszkiewicz feat(grafana): change fixed interval to rate interval variable @jakubdyszkiewicz feat(gui): add disabled in the index.html and remove disabled page @lahabana feat(injector): add ephemeral-storage resource request/limit for sidecars @jijiechen feat(intercp): drop leader on cp shutdown @jakubdyszkiewicz feat(k8s): show ZoneEgress zone as column @michaelbeaumont feat(k8s): show ZoneIngress zone as column @michaelbeaumont feat(kds): add zoneCP info in zone-insights @lahabana feat(kds): log additional gRPC status codes at info level @michaelbeaumont feat(kuma-cp): added comment and more explicit structure @lukidzi feat(kuma-cp): create default target ref policies @lukidzi feat(kuma-cp): deprecate standalone mode @jakubdyszkiewicz feat(kuma-cp): disable the default creation of TrafficPermission and TrafficRoute @lukidzi feat(kuma-cp): enable zone-originated MeshGateway @lobkovilya feat(kuma-cp): enable zone-originated policies @lobkovilya feat(kuma-cp): hash-suffix remove feature flag @lobkovilya feat(kuma-cp): move protocol information to mesh context @lukidzi feat(kuma-cp): require `kuma.io/origin: zone` label when creating zone-origination policies @lobkovilya feat(kuma-cp): support cross-zone MeshTCPRoute @michaelbeaumont feat(kuma-cp): support labels in ResourceMeta @lobkovilya feat(kuma-cp): use labels for KDS sync @lobkovilya feat(kuma-dp): add coredns logging flag @timothy-spencer feat(kumactl): basic export command @jakubdyszkiewicz,@slonka feat(kumactl): export in kube format @jakubdyszkiewicz feat(kumactl): make k8s resources applicable on other clusters @jakubdyszkiewicz feat(kumactl): more profiles in export @jakubdyszkiewicz feat(mads): extend MADS service to use data from MeshMetric policy @slonka feat(policy): Add `MeshMetric` api @Automaat feat(policy): Implement dynamic DPP configuration based on `MeshMetric` policy @Automaat feat(policy): add OpenTelemetry support for MeshMetric @Automaat feat(policy): add `MeshMetric` policy e2e tests @Automaat feat(policy): add possibility to target only gateways/sidecars @lukidzi feat(policy): add tags to backends for support VirtualOutbounds @lukidzi feat(policy): allow policies with from and to configuring egress @lukidzi feat(policy): implement MeshMetric xds @Automaat feat(policy): support MeshGateway listener matching @michaelbeaumont feat(resources): add

label @jakubdyszkiewicz feat(routes): handle routing if there are no TrafficRoutes @michaelbeaumont feat(universal): add VIPREFRESHINTERVAL @nicoche feat(vip): record generation metrics @nicoche feat(xds): do not generate independent listener for vips, use additional_addresses instead @jijiechen feat(zone): create Zone resources on zone cp automatically and generate ZoneInsights @jakubdyszkiewicz fix(MeshCircuitBreaker): revert validator and check if config is empty @lukidzi fix(MeshFaultInjection): handle listener protocol correctly @michaelbeaumont fix(MeshHTTPRoute): generate better resources when using HTTPS @michaelbeaumont fix(MeshHTTPRoute): make ordering more consistent @michaelbeaumont fix(MeshHTTPRoute): use 302 as default status code on Universal to match Kubernetes @michaelbeaumont fix(MeshHealthCheck): handle gateway listener protocol correctly @michaelbeaumont fix(MeshRateLimit): remove validation of Mesh type and proxyTypes for @lukidzi fix(MeshRetry): handle gateway listener protocol correctly @michaelbeaumont fix(ZoneEgress): rewrite host header on ExternalService requests @michaelbeaumont fix(ZoneIngress): subset routing when tag is present on all subsets @michaelbeaumont fix(ZoneWatch): stop watching Zone if ZoneInsight not found @michaelbeaumont fix(api): secret in k8s format @jakubdyszkiewicz fix(gateway): check if external service from context when no trafficpermission @lukidzi fix(gateway): isolate routes to SNI matches @michaelbeaumont fix(k8s): support injection with label kuma.io/sidecar-injection: 'true' @michaelbeaumont fix(kds): avoid rare cases where onStreamClosed is called with no state @lahabana fix(kds): fix deletion of previous zones in components @lahabana fix(kds): fix resource sync @lukidzi fix(kds): make status tracker work when there's no metadata @lahabana fix(kds): race condition on fill metadata @jakubdyszkiewicz fix(kuma-cp): assign `extensions` in `ZoneInsightSink` constructor @bartsmykla fix(kuma-cp): don't remove Service if MeshGateway is absent for a while (i.e. due to renaming) @lobkovilya fix(kuma-cp): don't run outbound proxy generator when there is no TrafficRoute @michaelbeaumont fix(kuma-cp): enable hash-suffix only if Zone has KDS feature @lobkovilya fix(kuma-cp): failure during the migration from non-federated to federated zone @lobkovilya fix(kuma-cp): fix address check to not be loopback ipv4 and ipv6 @lukidzi fix(kuma-cp): global upgrade @lobkovilya fix(kuma-cp): make metadata retrieve method public @lukidzi fix(kuma-cp): return sorted list of k8s secrets @lukidzi fix(kuma-cp): set creationTime on KDS sync @lobkovilya fix(kuma-cp): treat envoy admin errors as 4xx @lobkovilya fix(kuma-cp): upgrade from Zone CP without labels to new one @lobkovilya fix(kuma-cp): use column names in sql insert @lobkovilya fix(kuma-cp): use pagination store for secret store @lukidzi fix(metrics): fix kds metrics for simple watchdog @slonka fix(metrics): unify zone name in metrics for k8s and universal @slonka fix(policy): allow period in targetRef names @michaelbeaumont fix(policy): first lexicographically wins, kind MeshGateway with tags over kind MeshGateway @michaelbeaumont fix(policy): improve validator messages, allow string failoverthreshold @lahabana fix(policy): support delegated gateways @michaelbeaumont fix(vips): skip ignored listeners @jakubdyszkiewicz Released on 2024/02/01 chore(deps): security update @kumahq chore(deps): update go from 1.21.5 to 1.21.6 (backport of #8944) @kumahq chore(deps): update go to 1.21.5 (backport of #8616) @kumahq fix(kds): race condition on fill metadata (backport of #8872) @kumahq fix(kuma-cp): assign `extensions` in `ZoneInsightSink` constructor (backport of #8940) @kumahq fix(vips): skip ignored listeners (backport of #8937) @kumahq Released on 2024/02/01 chore(deps): security update @kumahq chore(deps): update go from 1.21.5 to 1.21.6 (backport of #8944) @kumahq chore(deps): update go to 1.21.4 (backport of #8341) @kumahq chore(deps): update go to 1.21.5 (backport of #8616) @kumahq chore(deps): upgrade envoy to 1.25.11 @lukidzi fix(MeshTrafficPermission): support permissive mtls (backport of #8171) @kumahq fix(k8s): don't temporarily remove all AvailableServices on ZoneIngress Pod reconciliations (backport of #8301) @kumahq fix(k8s): fix VIPs configmap entries with invalid keys for ExternalName services (backport of #8168) @kumahq Released on 2023/12/05 feat(dataplane): ignored listeners with ignored labels in selector (backport of #8463) @kumahq fix(ZoneIngress): subset routing when tag is present on all subsets (backport of #8443) @kumahq fix(metrics): fix kds metrics for simple watchdog (backport of #8428) @kumahq Released on 2023/11/15 chore(deps): bump actions/checkout from 3 to 4 @dependabot chore(deps): bump actions/setup-node from 3 to 4 @dependabot chore(deps): bump cirello.io/pglock from 1.14.0 to 1.14.1 @dependabot chore(deps): bump debian from `b91baba` to `7d3e881` @dependabot chore(deps): bump distroless/base-nossl-debian11 from `6579e1f` to `1ae8df5` @dependabot chore(deps): bump distroless/static-debian11 from `312a533` to `cdb2034` @dependabot chore(deps): bump envoy from 1.27.0 to 1.27.1 @lahabana chore(deps): bump github.com/cilium/ebpf from 0.11.0 to 0.12.2 @dependabot chore(deps): bump github.com/cyphar/filepath-securejoin from 0.2.3 to 0.2.4 @dependabot chore(deps): bump github.com/docker/docker from 24.0.6+incompatible to

@dependabot chore(deps): bump github.com/evanphx/json-patch/v5 from 5.6.0 to 5.7.0 @dependabot chore(deps): bump github.com/exaring/otelpgx from 0.5.1 to 0.5.2 @dependabot chore(deps): bump github.com/go-logr/logr from 1.2.4 to 1.3.0 @dependabot chore(deps): bump github.com/google/uuid from 1.3.0 to 1.4.0 @dependabot chore(deps): bump github.com/gruntwork-io/terratest from 0.43.13 to 0.46.1 @dependabot chore(deps): bump github.com/miekg/dns from 1.1.55 to 1.1.56 @dependabot chore(deps): bump github.com/onsi/ginkgo/v2 from 2.11.0 to 2.13.0 @dependabot chore(deps): bump github.com/onsi/gomega from 1.27.10 to 1.29.0 @dependabot chore(deps): bump github.com/prometheus/client_golang from 1.16.0 to 1.17.0 @dependabot chore(deps): bump github.com/prometheus/client_model from 0.4.1-0.20230718164431-9a2bf3000d16 to 0.5.0 @dependabot chore(deps): bump github.com/slok/go-http-metrics from 0.10.0 to 0.11.0 @dependabot chore(deps): bump github.com/spf13/viper from 1.16.0 to 1.17.0 @dependabot chore(deps): bump github.com/testcontainers/testcontainers-go from 0.23.0 to 0.26.0 @dependabot chore(deps): bump github.com/tonglil/opentelemetry-go-datadog-propagator from 0.1.0 to 0.1.1 @dependabot chore(deps): bump go from 1.20.7 to 1.21.1 @lukidzi chore(deps): bump go version to 1.21.3 @slonka chore(deps): bump go.uber.org/zap from 1.25.0 to 1.26.0 @dependabot chore(deps): bump golang.org/x/net from 0.14.0 to 0.16.0 @dependabot chore(deps): bump golang.org/x/net to v0.17.0, google.golang.org/grpc to v1.58.3 @michaelbeaumont chore(deps): bump golang.org/x/sys from 0.11.0 to 0.12.0 @dependabot chore(deps): bump golang.org/x/text from 0.12.0 to 0.13.0 @dependabot chore(deps): bump golangci-lint from v1.53.3 to v1.54.1 @michaelbeaumont chore(deps): bump google.golang.org/grpc from 1.57.0 to 1.59.0 @dependabot chore(deps): bump helm.sh/helm/v3 from 3.12.3 to 3.13.1 @dependabot chore(deps): bump k8s.io/apiextensions-apiserver from v0.28.1 to v0.28.2 @michaelbeaumont chore(deps): bump sigs.k8s.io/controller-runtime from 0.15.1 to 0.16.3 @dependabot chore(deps): bump sigs.k8s.io/gateway-api from 0.8.0-rc1 to v1.0.0 @dependabot,@michaelbeaumont chore(deps): bump sigs.k8s.io/yaml from 1.3.0 to 1.4.0 @dependabot chore(deps): bump the go-opentelemetry-io group with 3 updates @dependabot chore(deps): bump the go-opentelemetry-io group with 3 updates @slonka chore(deps): bump the go-opentelemetry-io-contrib group with 2 updates @dependabot chore(deps): bump the go-opentelemetry-io-otel group with 2 updates @dependabot chore(deps): bump the k8s-libs group with 3 updates @dependabot chore(deps): bump tibdex/github-app-token from 1.8.0 to 2.1.0 @dependabot chore(deps): bump ubuntu from `ec050c3` to `2b7412e` @dependabot chore(deps): downgrade testcontainers-go from v0.24.0 to v0.23.0 @jakubdyszkiewicz chore(deps): update gateway-api @michaelbeaumont chore(deps): update go to 1.21.4 @slonka chore(deps): upgrade envoy to 1.28.0 @lukidzi chore(deps): upgrade github.com/gruntwork-io/terratest to v0.43.13 @lukidzi chore(deps): use latest kumahq/kuma-gui @kumahq feat(ExternalService): add skip hostname verification for external services @alparslanavci feat(MeshLoadBalancingStrategy): new locality aware api @Automaat,@lukidzi feat(MeshProxyPatch): allow policy to target MeshGateway resources @bartsmykla feat(api-server): add /_overview for all types that have overviews @lahabana feat(api-server): add filtering on list external-services and dataplanes @lahabana feat(api-server): added query parameter to filter services by name @lukidzi feat(api-server): implement new Global Insight endpoint @Automaat feat(api-server): new inspect api @lahabana feat(docs): add generated openapi docs @lahabana feat(dp-token): allow validator to define keys not scoped to a mesh @nicoche feat(events): configurable buffers and predicates @jakubdyszkiewicz feat(gui): adds storeType

variable @johncowen feat(helm): add configurable service port for cp ingress @lahabana feat(helm): add loadBalancerSourceRanges on global zone sync service @slavogiez feat(helm): add possibility to run universal zone cp on kubernetes @Automaat feat(helm): add service-account features to egress and ingress @lahabana feat(helm): add support for controlplane deployment annotations @slavogiez feat(helm): allow to define service accounts annotations @lukidzi feat(helm): allow to disable tls-checksum generation @lukidzi feat(helm): minReadySeconds for control plane @jakubdyszkiewicz feat(insights): jitter zone insights upsert @jakubdyszkiewicz feat(insights): metrics of reason and result @jakubdyszkiewicz feat(insights): multiple workers @jakubdyszkiewicz feat(kds): add metrics to event based watchdog @jakubdyszkiewicz feat(kds): add user-agent with useful version info @lahabana feat(kds): allow to delay full resync when ticker @lukidzi feat(kds): allow to disable KDS SOTW grpc api @lukidzi feat(kds): better error handling @jakubdyszkiewicz feat(kds): compact subscriptions in insights @jakubdyszkiewicz feat(kds): enable delta by default @lahabana feat(kds): execute filters on envoy admin streams @jakubdyszkiewicz feat(kds): experimental event based watchdog @jakubdyszkiewicz feat(kds): introduce zone health checks @michaelbeaumont feat(kds): pass resource keys to resourceStore for delta kds @lukidzi feat(kds): resource sync metric @jakubdyszkiewicz feat(kds): response backoff @jakubdyszkiewicz feat(kds): use hash-suffix for KDS sync @lobkovilya feat(kuma-cp): add HealthCheck unary endpoint @michaelbeaumont feat(kuma-cp): add basedOnKuma in cp_info metric @lahabana feat(kuma-cp): add locality aware implementation for egress @Automaat feat(kuma-cp): add support for Gateway in MeshLoadBalancingStrategy @Automaat feat(kuma-cp): allow to disable backend validation @lukidzi feat(kuma-cp): make OpenTelemetry control plane tracing fully configurable @michaelbeaumont feat(kuma-cp): move KDS hash suffix under a feature flag @lobkovilya feat(kuma-dp): support setting Envoy's --component-log-level @michaelbeaumont feat(kumactl): support new inspect api @lahabana feat(rsa): add support for PKIX encoded pubkeys @nicoche feat(store): add owner reference to the secrets @slonka feat(store): added postgres index for owner columns @lukidzi feat(store): allow ResourceStore to be customized @bartsmykla feat(store): conflict metrics @jakubdyszkiewicz feat(store): consistent gets for read replica @jakubdyszkiewicz feat(store): support postgres reader replica @jakubdyszkiewicz feat(tenants): add extension points for sharding @jakubdyszkiewicz feat(transparent-proxy): add `--exclude-outbound-ports-for-uids` @lahabana feat(transparent-proxy): allow to wait for xtables lock and retry when installing tproxy fails @bartsmykla feat(xds): auto reachable services based on MeshTrafficPermission @jakubdyszkiewicz fix(MeshFaultInjection): include tags negation in header matching @bartsmykla fix(MeshGateway): ensure that duplicate listeners are not added when crossMesh is enabled on a listener and Routes specify hostnames @ttreptow fix(MeshTrafficPermission): support permissive mtls @jakubdyszkiewicz fix(TrafficRoute): use default value when choiceCount is 0 @lukidzi fix(api-server): 400 error on admin operations on not yet connected stream @slonka fix(api-server): always remove empty array in inspect gw api @lahabana fix(api-server): avoid panic when there no insight for entity @lahabana fix(api-server): dataplane overview pagination @jakubdyszkiewicz fix(api-server): empty list instead of null @jakubdyszkiewicz fix(api-server): improve HandleError to handle rest_errors.Error and fix Unauthenticated error handling @bartsmykla fix(api-server): improve error handling and return status @lahabana fix(core): better lifecycle when context is getting cancelled @lahabana fix(envoy): remove apple flag @lukidzi fix(gatewayapi): don't set RefNotPermitted for GAMMA routes @michaelbeaumont fix(gatewayapi): don't set listener ResolvedRefs based on routes ResolvedRefs @michaelbeaumont fix(helm): do not run webhooks on kube-system @lahabana fix(helm): make CNI configmap and serviceaccount support custom namespace @slavogiez fix(helm): use bitnami/kubectl image for helm hooks @lahabana fix(insights): have subscription gc also work for zoneEgress insights @lahabana fix(insights): improve ZoneInsight subscription management @michaelbeaumont fix(k8s): add namespace to `deleteObjectIfExist` in pod controller @slonka fix(k8s): don't temporarily remove all AvailableServices on ZoneIngress Pod reconciliations @slonka fix(k8s): fix VIPs configmap entries with invalid keys for ExternalName services @bartsmykla fix(kds): call CloseSend and exit a goroutine when sync fails to start @lukidzi fix(kds): delta delivery metric @jakubdyszkiewicz fix(kds): don't inc KdsGenerationErrors when context canceled @michaelbeaumont fix(kds): experimental watchdog concurrent map write @jakubdyszkiewicz fix(kds): set error when KDS clients fails in goroutine @lukidzi fix(kds): try returning unavailable on app context finish @slonka fix(kds): use deprecated method in otel @slonka fix(kuma-cni): support port exclusion for UIDs @lobkovilya fix(kuma-cp): change affinityTag field in MeshLoadBalancingStrategy t @Automaat fix(kuma-cp): cleanup interval should be calculated based on "expirationTime" for hashCache @lobkovilya fix(kuma-cp): don't add `postStart` hook to builtin gateway even if `waitForDataplaneReady: true` @lobkovilya fix(kuma-cp): don't configure RBAC rules on Prometheus listener @lobkovilya fix(kuma-cp): fix Zone{In|E}gress sync when no mesh @bartsmykla fix(kuma-cp): meta validation compatible with Kubernetes naming rules @lobkovilya fix(kuma-cp): specifying IPv6 Envoy Admin address breaks readiness/liveness probes @lobkovilya fix(kuma-cp): take proper context for resync @lukidzi fix(kuma-cp): use GetConsistent store when validating default mesh resources @lukidzi fix(kuma-cp): using policy name with

causes hash to be inserted in the wrong place on the zone @lobkovilya fix(kuma-dp): advise user to check pod events when data plane rejected by webhooks @jijiechen fix(kuma-dp): fix build @Automaat fix(kuma-dp): fix incorrect dataplane name due to mangled env vars @bartsmykla fix(kumactl): add `--mesh` parameter to `inspect <policy>` @lahabana fix(observability): add annotation to make observability while running CNI work @slonka fix(policy): improve targetRef name and tags validation @alparslanavci fix(store): fix passing logs to pglock @slonka fix(store): use customizer for postgres ro pool @jakubdyszkiewicz fix(transparent-proxy): fix --wait flags for iptables legacy @bartsmykla fix(xds): backwards compatibility on access logs paths @jakubdyszkiewicz fix(xds): use stable hashes for outbound cluster names @michaelbeaumont perf(insights): fetch dp overviews once @jakubdyszkiewicz perf(insights): fetch external services once @lukidzi perf(insights): refresh only changed @jakubdyszkiewicz perf(store): postgres transactions @jakubdyszkiewicz perf(xds): put the Gatewaylisteners in the Proxy @lahabana Released on 2023/11/06 chore(deps): security update @kumahq fix(MeshTrafficPermission): support permissive mtls (backport of #8171) @kumahq fix(k8s): fix VIPs configmap entries with invalid keys for ExternalName services (backport of #8168) @kumahq fix(kuma-cp): fix ZoneIngress/ZoneEgress sync when no mesh (backport of #8129) @kumahq Released on 2023/10/11 chore(deps): bump envoy from 1.27.0 to 1.27.1 @lahabana chore(deps): bump go version to 1.21.3 (backport of #8001) @kumahq chore(deps): bump golang.org/x/net to v0.17.0, google.golang.org/grpc to v1.57.1 @michaelbeaumont Released on 2023/10/11 chore(deps): bump envoy from 1.26.4 to 1.26.5 @lahabana chore(deps): bump go from 1.20.7 to 1.21.1 @kumahq chore(deps): bump go version to 1.21.3 (backport of #8001) @kumahq chore(deps): bump golang.org/x/net to v0.17.0, google.golang.org/grpc to v1.57.1 @michaelbeaumont chore(deps): bump golangci-lint from v1.53.3 to v1.53.3 @kumahq chore(deps): security update @kumahq chore(deps): update CoreDNS to v1.11.1 (backport of #7523) @kumahq fix(kuma-cp): set error when KDS clients fails in goroutine (backport of #7725) @kumahq fix(kuma-cp): specifying IPv6 Envoy Admin address breaks readiness/liveness probes (backport of #7909) @kumahq fix(metrics): hijacker should not pass accept-encoding (backport of #7572) @kumahq Released on 2023/10/11 chore(deps): bump envoy from 1.25.9 to 1.25.10 @lahabana chore(deps): bump go from 1.20.7 to 1.21.1 @kumahq chore(deps): bump go version to 1.21.3 (backport of #8001) @kumahq chore(deps): bump golang.org/x/net to v0.17.0, google.golang.org/grpc to v1.57.1 @michaelbeaumont chore(deps): bump golangci-lint from v1.53.3 to v1.53.3 @kumahq chore(deps): security update @kumahq chore(deps): update CoreDNS to v1.11.1 (backport of #7523) @kumahq fix(kuma-cp): set error when KDS clients fails in goroutine (backport of #7725) @kumahq fix(kuma-cp): specifying IPv6 Envoy Admin address breaks readiness/liveness probes (backport of #7909) @kumahq fix(metrics): hijacker should not pass accept-encoding (backport of #7572) @kumahq Released on 2023/10/11 chore(deps): bump envoy from 1.24.10 to 1.24.11 @lahabana chore(deps): bump go from 1.20.7 to 1.21.1 @kumahq chore(deps): bump go version to 1.21.3 (backport of #8001) @kumahq chore(deps): bump golang.org/x/net to v0.17.0, google.golang.org/grpc to v1.57.1 @michaelbeaumont chore(deps): security update @kumahq chore(deps): update CoreDNS to v1.11.1 (backport of #7523) @kumahq fix(kuma-cp): set error when KDS clients fails in goroutine (backport of #7725) @kumahq fix(kuma-cp): specifying IPv6 Envoy Admin address breaks readiness/liveness probes (backport of #7909) @kumahq fix(metrics): hijacker should not pass accept-encoding (backport of #7572) @kumahq Released on 2023/10/11 chore(deps): bump envoy from 1.24.10 to 1.24.11 @lahabana chore(deps): bump go from 1.18 to 1.21.1 @kumahq,@michaelbeaumont chore(deps): bump go version to 1.21.3 (backport of #8001) @kumahq chore(deps): bump golang.org/x/net to v0.17.0, google.golang.org/grpc to v1.57.1 @michaelbeaumont chore(deps): bump golangci-lint from v1.53.3 to v1.53.3 @kumahq chore(deps): security update @kumahq chore(deps): update CoreDNS to v1.11.1 (backport of #7523) @kumahq fix(containerd): only build cgroups on linux (backport of #7408) @kumahq fix(kuma-cp): set error when KDS clients fails in goroutine (backport of #7725) @kumahq fix(kuma-cp): specifying IPv6 Envoy Admin address breaks readiness/liveness probes (backport of #7909) @kumahq fix(metrics): hijacker should not pass accept-encoding (backport of #7572) @kumahq fix(sec): get rid of dependency on containerd (backport of #7387) @kumahq Released on 2023/10/02 chore(deps): bump go from 1.20.7 to 1.21.1 @kumahq chore(deps): security update @kumahq feat(kds): add user-agent with useful version info (backport of #7886) @kumahq feat(kds): better error handling (backport of #7868) @kumahq feat(transparent-proxy): allow to wait for xtables lock and retry when installing tproxy fails (backport

#7870) @kumahq fix(kds): call CloseSend and exit a goroutine when sync fails to start (backport of #7869) @kumahq fix(kuma-cp): set error when KDS clients fails in goroutine (backport of #7725) @kumahq fix(kuma-cp): specifying IPv6 Envoy Admin address breaks readiness/liveness probes (backport of #7909) @kumahq Released on 2023/09/07 chore(deps): bump sigs.k8s.io/controller-runtime from 0.15.1 to 0.16.1 @kumahq chore(deps): bump sigs.k8s.io/gateway-api from 0.8.0-rc1 to 0.8.0 @kumahq chore(deps): bump the go-opentelemetry-io-contrib group with 2 updates (backport of #7613) @kumahq chore(deps): bump the go-opentelemetry-io-otel group with 2 updates (backport of #7607) @kumahq chore(deps): bump the k8s-libs group with 3 updates (backport of #7606) @kumahq fix(kumactl): add `--mesh` parameter to `inspect <policy>` (backport of #7696) @kumahq fix(xds): backwards compatibility on access logs paths (backport of #7662) @kumahq Released on 2023/08/28 chore(deps): bump CoreDNS from v1.10.1 to v1.11.1 @michaelbeaumont chore(deps): bump cirello.io/pglock from 1.13.0 to 1.14.0 @dependabot chore(deps): bump debian from `3d868b5` to `b91baba` @dependabot chore(deps): bump envoy to 1.26.3 @lukidzi chore(deps): bump github.com/cilium/ebpf from 0.10.0 to 0.11.0 @dependabot chore(deps): bump github.com/emicklei/go-restful/v3 from 3.10.2 to 3.11.0 @dependabot chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 1.0.1 to 1.0.2 @dependabot chore(deps): bump github.com/exaring/otelpgx from 0.5.0 to 0.5.1 @dependabot chore(deps): bump github.com/jackc/pgx/v5 from 5.4.1 to 5.4.3 @dependabot chore(deps): bump github.com/onsi/gomega from 1.27.8 to 1.27.10 @dependabot chore(deps): bump github.com/testcontainers/testcontainers-go from 0.20.1 to 0.23.0 @dependabot chore(deps): bump go.opentelemetry.io/proto/otlp from 0.20.0 to 1.0.0 @dependabot chore(deps): bump go.uber.org/zap from 1.24.0 to 1.25.0 @dependabot chore(deps): bump golang.org/x/net from 0.11.0 to 0.14.0 @dependabot chore(deps): bump golang.org/x/sys from 0.9.0 to 0.11.0 @dependabot chore(deps): bump golang.org/x/text from 0.10.0 to 0.12.0 @dependabot chore(deps): bump golangci-lint from v1.51.2 to v1.53.3 @lahabana chore(deps): bump gonum.org/v1/gonum from 0.13.0 to 0.14.0 @dependabot chore(deps): bump google.golang.org/grpc from 1.56.0 to 1.57.0 @dependabot chore(deps): bump google.golang.org/protobuf from 1.30.0 to 1.31.0 @dependabot chore(deps): bump helm.sh/helm/v3 from 3.12.1 to 3.12.3 @dependabot chore(deps): bump k8s.io/apiextensions-apiserver from 0.27.3 to 0.27.4 @michaelbeaumont chore(deps): bump sigs.k8s.io/controller-runtime from 0.15.0 to 0.15.1 @dependabot chore(deps): bump sigs.k8s.io/controller-tools from 0.12.0 to 0.13.0 @dependabot chore(deps): bump sigs.k8s.io/gateway-api from 0.7.1-0.20230727082008-1764e458047d to 0.8.0-rc1 @dependabot,@michaelbeaumont chore(deps): bump the k8s-libs group with 3 updates @dependabot chore(deps): bump ubuntu from `0bced47` to `ec050c3` @dependabot chore(deps): update go from 1.20.5 to 1.20.6 @slonka chore(deps): update testcontainers-go to 0.22.0 @slonka chore(deps): update to go 1.20.7 @slonka chore(deps): upgrade envoy to 1.26.4 @lukidzi chore(deps): upgrade envoy to 1.27.0 @lukidzi chore(deps): use latest kumahq/kuma-gui @kumahq chore(release): merge release-2.3 @michaelbeaumont feat(MeshHealthCheck): allow top level targetRef kind MeshGateway @michaelbeaumont feat(MeshRetry): allow top level targetRef kind MeshGateway @michaelbeaumont feat(MeshTimeout): allow top level targetRef.kind MeshGateway @michaelbeaumont feat(VirtualOutbound): support multizone @jakubdyszkiewicz feat(api-server): add isTargetRefBased in /policies @lahabana feat(api-server): add service unavailable error @slonka feat(api-server): allow WebService customization in plugins @michaelbeaumont feat(api-server): error status is an int @jakubdyszkiewicz feat(cni): add retry for CNI config file check @StuAtKong feat(insights): add event to trigger computation @jakubdyszkiewicz feat(insights): change metrics to milliseconds @jakubdyszkiewicz feat(k8s): show `targetRef` `kind`/`name` in kubectl output @michaelbeaumont feat(kuma-cp): add 'renewDeadline' and 'leaseDuration' config params @lobkovilya feat(kuma-cp): add info about presence of auth token in zoneInsight @Automaat feat(kuma-cp): add observability to k8s auth cache @jakubdyszkiewicz feat(kuma-cp): add opentelemetry traces to pgx @michaelbeaumont feat(kuma-cp): add tracing to KDS server @michaelbeaumont feat(kuma-cp): allow to disable resources count metrics @lukidzi feat(kuma-cp): better xds metrics @jakubdyszkiewicz feat(kuma-cp): block application container start until dp is ready @lukidzi feat(kuma-cp): extend ZoneInsight api with information about usage of @Automaat feat(kuma-cp): force routing through zone egress @jakubdyszkiewicz feat(kuma-cp): implement TLS listener for prometheus @lukidzi feat(kuma-cp): introduce OpenTelemetry tracing @michaelbeaumont feat(kuma-cp): support Datadog propagation for tracing @michaelbeaumont feat(kuma-dp): don't require NETBINDSERVICE capability @michaelbeaumont feat(kumactl): define User-Agent @mmorel-35 feat(metrics): expose kube controller manager metrics @jakubdyszkiewicz feat(metrics): support OpenMetrics from applications @AyushSenapati feat(observability): add traceId in error messages @lahabana feat(observability): components metrics @jakubdyszkiewicz feat(policy): add

`MeshGateway` @michaelbeaumont feat(watchdog): don't call onError if error was Canceled @michaelbeaumont feat(xds): filter-chain builder constructor require name @mmorel-35 feat(xds): named resources (clusters) builders require name @mmorel-35 feat(xds): named resources (listeners) builders require name @mmorel-35 feat(xds): named resources (routes configuration) builders require name @mmorel-35 feat(zoneproxies): check empty listeners @jakubdyszkiewicz fix(MeshTrafficPermission): use serviceName instead of resource name for egress MTP @lukidzi fix(api-server): return 400 when PUT/POST resource is invalid @lahabana fix(containerd): only build cgroups on linux @slonka fix(dataplane_watchdog): fix outdated comment @nicoche fix(egress): routing using MeshHTTPRoute and VirtualOutbound @jakubdyszkiewicz fix(insights): rewrite insights to allow more efficiency @lahabana fix(intercp): properly track idleness of pool connections @michaelbeaumont fix(k8s): tolerate unknown `appProtocol` @michaelbeaumont fix(kuma-cp): cancel OnTick when watchdog stopped @michaelbeaumont fix(kuma-cp): do not require certs on https api port @jakubdyszkiewicz fix(kuma-cp): don't fail when 2 headless services pointing to the same service @lukidzi fix(kuma-cp): don't leak goroutine on every tick in SimpleWatchdog @lukidzi fix(kuma-cp): don't return from opentelemetry Start @michaelbeaumont fix(kuma-cp): handle advertised address in zone ingress @jakubdyszkiewicz fix(kuma-cp): handle external services with permissive mtls @jakubdyszkiewicz fix(kuma-cp): order resources for building VIPs @lukidzi fix(kuma-cp): pass context via snapshot reconciler to generateCerts @michaelbeaumont fix(kuma-cp): put metadata xds callbacks before sync @lobkovilya fix(kuma-cp): universal mode don't log on every lock acquire attempt @michaelbeaumont fix(kuma-dp): pass sockets in metadata from dp to cp @lahabana fix(kumactl): treat 404 as resource not found error @slonka fix(metrics): hijacker should not pass accept-encoding @jakubdyszkiewicz fix(sec): get rid of dependency on containerd @slonka perf(kuma-cp): trim zone ingress and service insights @jakubdyszkiewicz perf(xds): use aggregated mesh context for zone proxies @jakubdyszkiewicz perf(zoneingress): only pick resources from proper mesh @jakubdyszkiewicz Released on 2023/08/09 chore(deps): bump go from 1.18 to 1.20.7 @michaelbeaumont chore(deps): security update @kumahq fix(sec): get rid of dependency on containerd (backport of #7387) @kumahq Released on 2023/08/04 chore(deps): security update @kumahq chore(deps): update go from 1.20.5 to 1.20.6 (backport of #7414) @kumahq chore(deps): update to go 1.20.7 (backport of #7429) @kumahq chore(deps): upgrade envoy to 1.25.9 @lukidzi fix(containerd): only build cgroups on linux (backport of #7408) @kumahq fix(kuma-cp): don't leak goroutine on every tick in SimpleWatchdog (backport of #7348) @kumahq fix(kuma-cp): order resources for building VIPs (backport of #7333) @kumahq fix(sec): get rid of dependency on containerd (backport of #7387) @kumahq Released on 2023/08/03 chore(deps): security update @kumahq chore(deps): update go from 1.20.5 to 1.20.6 (backport of #7414) @kumahq chore(deps): update to go 1.20.7 (backport of #7429) @kumahq chore(deps): upgrade envoy to 1.26.4 @lukidzi fix(containerd): only build cgroups on linux (backport of #7408) @kumahq fix(kuma-cp): don't leak goroutine on every tick in SimpleWatchdog (backport of #7348) @kumahq fix(kuma-cp): order resources for building VIPs (backport of #7333) @kumahq fix(sec): get rid of dependency on containerd (backport of #7387) @kumahq Released on 2023/07/27 chore(deps): upgrade envoy to 1.24.10 @lukidzi fix(kuma-cp): don't leak goroutine on every tick in SimpleWatchdog (backport of #7348) @kumahq fix(kuma-cp): order resources for building VIPs (backport of #7333) @kumahq Released on 2023/07/27 chore(deps): upgrade envoy to 1.24.10 @lukidzi fix(kuma-cp): order resources for building VIPs (backport of #7333) @kumahq Released on 2023/07/27 chore(deps): upgrade envoy to 1.24.10 @lukidzi fix(kuma-cp): order resources for building VIPs (backport of #7333) @kumahq Released on 2023/07/21 chore(deps): bump envoy to 1.26.3 which fix @lukidzi chore(deps): use latest kumahq/kuma-gui @kumahq fix(MeshTrafficPermission): use serviceName instead of resource name for egress MTP (backport of #7225) @kumahq fix(kuma-cp): cancel OnTick when watchdog stopped (backport of #7221) @kumahq fix(kuma-cp): do not require certs on https api port (backport of #7102) @kumahq fix(kuma-cp): don't fail when 2 headless services pointing to the same service (backport

#7282) @kumahq fix(kuma-cp): handle external services with permissive mtls (backport of #7179) @kumahq fix(kuma-cp): pass context via snapshot reconciler to generateCerts (backport of #7231) @kumahq fix(kuma-cp): put metadata xds callbacks before sync (backport of #7230) @kumahq fix(kumactl): treat 404 as resource not found error (backport of #7297) @kumahq Released on 2023/07/21 chore(deps): bump envoy to 1.25.8 which fix @lukidzi fix(kuma-cp): cancel OnTick when watchdog stopped (backport of #7221) @kumahq fix(kuma-cp): do not require certs on https api port (backport of #7102) @kumahq fix(kuma-cp): don't fail when 2 headless services pointing to the same service (backport of #7282) @kumahq fix(kuma-cp): handle external services with permissive mtls (backport of #7179) @kumahq fix(kuma-cp): pass context via snapshot reconciler to generateCerts (backport of #7231) @kumahq fix(kuma-cp): put metadata xds callbacks before sync (backport of #7230) @kumahq Released on 2023/07/19 chore(deps): bump envoy to 1.24.9 which fix @lukidzi fix(kuma-cp): cancel OnTick when watchdog stopped (backport of #7221) @kumahq fix(kuma-cp): don't fail when 2 headless services pointing to the same service (backport of #7282) @kumahq fix(kuma-cp): handle external services with permissive mtls (backport of #7179) @kumahq fix(kuma-cp): pass context via snapshot reconciler to generateCerts (backport of #7231) @kumahq fix(kuma-cp): put metadata xds callbacks before sync (backport of #7230) @kumahq Released on 2023/07/19 chore(deps): bump envoy to 1.24.9 which fix @lukidzi fix(kuma-cp): don't fail when 2 headless services pointing to the same service (backport of #7282) @kumahq fix(kuma-cp): handle external services with permissive mtls (backport of #7179) @kumahq Released on 2023/07/19 chore(deps): bump envoy to 1.24.9 which fix @lukidzi fix(kuma-cp): don't fail when 2 headless services pointing to the same service (backport of #7282) @kumahq Released on 2023/06/22 chore(deps): bump Envoy from v1.25.4 to v1.26.2 @lukidzi,@michaelbeaumont chore(deps): bump cirello.io/pglock from 1.11.0 to 1.13.0 @dependabot chore(deps): bump controller-runtime from v0.14.6 to v0.15.0 @dependabot,@michaelbeaumont chore(deps): bump gateway-api from v0.7.0 to c9540a9cf448 @dependabot,@michaelbeaumont chore(deps): bump github.com/containernetworking/plugins from 1.2.0 to 1.3.0 @dependabot chore(deps): bump github.com/docker/distribution from 2.8.1+incompatible to 2.8.2+incompatible @dependabot chore(deps): bump github.com/envoyproxy/go-control-plane from 0.11.0 to 0.11.1 @dependabot chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.10.1 to 1.0.1 @dependabot chore(deps): bump github.com/go-logr/zapr from 1.2.3 to 1.2.4 @dependabot chore(deps): bump github.com/golang-migrate/migrate/v4 from 4.15.2 to 4.16.2 @dependabot chore(deps): bump github.com/lib/pq from 1.10.7 to 1.10.9 @dependabot chore(deps): bump github.com/miekg/dns from 1.1.53 to 1.1.54 @dependabot chore(deps): bump github.com/onsi/ginkgo/v2 from 2.9.2 to 2.10.0 @dependabot chore(deps): bump github.com/onsi/gomega from 1.27.6 to 1.27.8 @dependabot chore(deps): bump github.com/prometheus/client_golang from 1.14.0 to 1.15.1 @dependabot chore(deps): bump github.com/prometheus/client_model from 0.3.0 to 0.4.0 @dependabot chore(deps): bump github.com/prometheus/common from 0.42.0 to 0.44.0 @dependabot chore(deps): bump github.com/spf13/viper from 1.15.0 to 1.16.0 @dependabot chore(deps): bump github.com/spiffe/go-spiffe/v2 from 2.1.4 to 2.1.6 @dependabot chore(deps): bump github.com/testcontainers/testcontainers-go from 0.18.0 to 0.20.1 @dependabot chore(deps): bump go.opentelemetry.io/proto/otlp from 0.19.0 to 0.20.0 @dependabot chore(deps): bump golang from 1.20.4 to 1.20.5 @lahabana,@lukidzi chore(deps): bump golang.org/x/net from 0.9.0 to 0.10.0 @dependabot chore(deps): bump golang.org/x/sys from 0.7.0 to 0.8.0 @dependabot chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.55.0 @dependabot chore(deps): bump k8s.io/klog/v2 from 2.90.1 to 2.100.1 @dependabot chore(deps): bump k8s.io/kubectl from 0.26.3 to 0.27.2 @dependabot chore(deps): bump sigs.k8s.io/controller-tools from 0.11.3 to

@dependabot chore(deps): use latest kumahq/kuma-gui @kumahq feat(MeshCircuitBreaker): support MeshGateways @michaelbeaumont feat(MeshGateway): add TLS passthrough listeners @michaelbeaumont feat(MeshGateway): support termination on TLS listeners @michaelbeaumont feat(MeshHealthCheck): support MeshGateway @michaelbeaumont feat(MeshLoadBalancingStrategy): add builtin gateway support @michaelbeaumont feat(MeshRetry): add host selection predicates @johnharris85 feat(api-server): add ability to get k8s format of a resource @lahabana feat(api-server): make errors compliant with aip 193 @lahabana feat(client): Consolidate HTTP Client @mmorel-35 feat(cni): k8s make namespace configurable @mmorel-35 feat(config): improve configurability @slonka feat(docker/kumactl): make entrypoint consistent with kuma-cp and kuma-dp images @bartsmykla feat(envoyadmin): support passing kds envoy operations via http proxy @jakubdyszkiewicz feat(helm): Add logOutputPath support to chart @ashman1984 feat(helm): add possibility to extend secrets for cp in helm charts when reusing kuma charts @Automaat feat(helm): enable NodePort customization @mmorel-35 feat(helm): remove hostNetwork: true from CNI DaemonSet @michaelbeaumont feat(helm): set readOnlyRootFilesystem on CNI, more explicit templates @michaelbeaumont feat(helm): validate zone name on install @mmorel-35 feat(insights): include tenant id in insights info key @jakubdyszkiewicz feat(insights): include tenant id in rate limitter key @jakubdyszkiewicz feat(intercp): pass tenant id @jakubdyszkiewicz feat(intercp): use global tenant for catalog request @jakubdyszkiewicz feat(k8s): add read-only root FS to sidecar @dascole feat(k8s): show `Dataplane` services in `kubectl` output @michaelbeaumont feat(kds): configurable server stream interceptors @jakubdyszkiewicz feat(kds): multitenancy @jakubdyszkiewicz feat(kds): opt-in insecure skip verify in zone cp client @jakubdyszkiewicz feat(kuma-cp): top-level MeshHTTPRoute targetRef for MeshTimeout @lobkovilya feat(kuma-cp): add possibility to configure concurrent reconciliation @Automaat feat(kuma-cp): add possibility to configure kubernetes client qps and @Automaat feat(kuma-cp): allow to override resource store plugin @jakubdyszkiewicz feat(kuma-cp): allow to specify protocol for globalZone sync service @lukidzi feat(kuma-cp): implement MeshTrafficPermisson for ExternalServices with ZoneEgress @lukidzi feat(kuma-cp): improve BuildRules algorithm @lobkovilya feat(kuma-cp): introduce tag first Virtual Outbound model @Automaat feat(kuma-cp): multitenancy adjustments @jakubdyszkiewicz feat(kuma-cp): multitenant counter metrics @jakubdyszkiewicz feat(kuma-cp): remove unnecessary reconciliation of pods on configmap @Automaat feat(kuma-cp): support MeshHTTPRoute targetRef @lobkovilya feat(mesh): allow disabling default policy creation @johnharris85 feat(meshaccesslog): use "type" to express oneof @lobkovilya feat(meshtrace): use "type" to express oneof @lobkovilya feat(mtls): generate certificates for Address and AdvertisedAddress for Dataplane and Ingress @mmorel-35 feat(multitenancy): postgres events @jakubdyszkiewicz feat(policy): add MeshTCPRoute @bartsmykla feat(resources): retry upsert on resource already exist @jakubdyszkiewicz feat(tls): remove commonName in certificate generation @mmorel-35 feat(ui): add mode in the config in the index.html @lahabana feat(webhook): make init ordering configurable first/last @johnharris85 feat(webhook): warn/fail if containers use same UID as sidecar @johnharris85 fix(GatewayAPI): convert HTTP header names to lowercase @michaelbeaumont fix(GatewayAPI): don't panic if an HTTPRoute references a Gateway with a nonexistent GatewayClass @michaelbeaumont fix(GatewayAPI): don't share HTTPRoute conditions between parentRefs @michaelbeaumont fix(GatewayAPI): npe errors @michaelbeaumont fix(GatewayAPI): reconcile Gateways on Secret changes @michaelbeaumont fix(MeshGateway): don't strip ports from host @michaelbeaumont fix(MeshGateway): tweak route precedence to match Gateway API @michaelbeaumont fix(MeshGatewayInstance): don't overwrite annotations/labels in managed Service @michaelbeaumont fix(MeshHTTPRoute): assume default catch all path (any path starting with "/") in route match when not explicitly set @bartsmykla fix(MeshHTTPRoute): only configure HTTP outbounds or with an explicit matching rule @michaelbeaumont fix(MeshHTTPRoute): rename Prefix to PathPrefix @michaelbeaumont fix(MeshHTTPRoute): require at least one match @michaelbeaumont fix(MeshRetry): set MeshGateway retry on routes not virtual hosts @michaelbeaumont fix(MeshRetry): support MeshGateway @lobkovilya fix(MeshTimeout): only apply Mesh targeted HTTP timeouts for MeshGateway @michaelbeaumont fix(MeshTimeout): set idle timeout on gateways, use route action instead of hcm @michaelbeaumont fix(MeshTrace): create spans with MeshGateway @michaelbeaumont fix(api-server): service-insights should never return items: null @lahabana fix(config): add delta xds flag to defaults @johnharris85 fix(gateway): don't skip retry policy with retry methods @bartsmykla fix(helm): change CNI priorityClass from system-cluster-critical to system-node-critical @michaelbeaumont fix(helm): correct appProtocol configurations for https @johnharris85 fix(helm): update HPA API version @johnharris85 fix(helm): use correct secret for CP CA in ingress/egress @michaelbeaumont fix(insights): react on events @jakubdyszkiewicz fix(kds): trim system namespace suffix from names of plugin originated policies when syncing resources from global to zones in multizone

@bartsmykla fix(kuma-cp): add backward compatible reading of virtual outbound from config @Automaat fix(kuma-cp): add missing validation for MeshTimeout @lobkovilya fix(kuma-cp): make finalizer tenant aware @lukidzi fix(kuma-cp): make store changes processing more reliable @lukidzi fix(kuma-cp): make zone insight context independent from parent @lukidzi fix(kuma-cp): race condition when proxy connects to the same CP in less than KUMAXDSDATAPLANEDEREGISTRATIONDELAY @lobkovilya fix(kuma-cp): replace err with log when TargetRef can't be resolved @lobkovilya fix(kuma-cp): reset idleTimeout from the old Timeout policy @lobkovilya fix(kuma-cp): use port instead of target port of a headless service @jakubdyszkiewicz fix(kuma-cp): wait between the proxy termination and its deregistration @lobkovilya fix(kuma-dp): honour app content-type @AyushSenapati fix(kumactl): return after loading configuration from memory @lukidzi fix(multitenancy): global tenant in intercp when creating certs @jakubdyszkiewicz perf(k8s): don't reconcile all pods when a service changes @lahabana perf(k8s): omit fetching other dataplanes when vips are in the config map @jakubdyszkiewicz refactor(kds): remove unnecessary function nesting for MapZoneTokenSigningKeyGlobalToPublicKey resource mapper in kds context @bartsmykla Released on 2023/06/21 chore(deps): bump go version from 1.20.3 to 1.20.5 @lukidzi chore(deps): upgrade envoy to 1.25.7 @lukidzi fix(MeshGatewayInstance): don't overwrite annotations/labels in managed Service (backport of #7069) @kumahq fix(gateway): don't skip retry policy with retry methods (backport of #6896) @kumahq fix(kuma-cp): make store changes processing more reliable (backport of #6728) @kumahq Released on 2023/06/21 chore(deps): upgrade envoy to 1.24.8 @lukidzi chore(deps): use latest kumahq/kuma-gui @kumahq fix(MeshGatewayInstance): don't overwrite annotations/labels in managed Service (backport of #7069) @kumahq fix(docker/kumactl): add entrypoint to kumactl img (backport #6593) @mergify fix(gateway): don't skip retry policy with retry methods (backport of #6896) @kumahq fix(kuma-cp): make store changes processing more reliable (backport of #6728) @kumahq Released on 2023/06/21 chore(deps): upgrade envoy to 1.24.8 @lukidzi fix(MeshGatewayInstance): don't overwrite annotations/labels in managed Service (backport of #7069) @kumahq fix(gateway): don't skip retry policy with retry methods (backport of #6896) @kumahq fix(kuma-cp): make store changes processing more reliable (backport of #6728) @kumahq Released on 2023/06/21 chore(deps): upgrade envoy to 1.24.8 @lukidzi fix(MeshGatewayInstance): don't overwrite annotations/labels in managed Service (backport of #7069) @kumahq fix(gateway): don't skip retry policy with retry methods (backport of #6896) @kumahq fix(kuma-cp): make store changes processing more reliable (backport of #6728) @kumahq Released on 2023/05/03 chore(deps): bump golang from 1.20.2 to 1.20.3 @mergify chore(deps): use latest kumahq/kuma-gui @kumahq fix(docker/kumactl): add entrypoint to kumactl img (backport #6593) @mergify Released on 2023/04/14 Modify helm.sh script to make sure no duplicate manifests will be present in packaged chart @bartsmykla chore(deps): bump Envoy from 1.22.2 to 1.22.7 @lahabana chore(deps): bump actions/setup-go from 3 to 4 @dependabot chore(deps): bump cirello.io/pglock from 1.10.0 to 1.11.0 @dependabot chore(deps): bump coredns from 1.10.0 to 1.10.1 @michaelbeaumont chore(deps): bump github.com/cilium/ebpf from 0.9.1 to 0.10.0 @dependabot chore(deps): bump github.com/containerd/cgroups from 1.0.4 to 1.1.0 @dependabot chore(deps): bump github.com/containerd/containerd from 1.6.15 to 1.6.18 @dependabot chore(deps): bump github.com/emicklei/go-restful/v3 from 3.10.1 to 3.10.2 @dependabot chore(deps): bump github.com/envoyproxy/go-control-plane from 0.10.3 to 0.11.0 @dependabot chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.9.1 to 0.10.1 @dependabot chore(deps): bump github.com/go-logr/logr from 1.2.3 to 1.2.4 @dependabot chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.4.3 to 4.5.0 @dependabot chore(deps): bump github.com/golang/protobuf from 1.5.2 to 1.5.3 @dependabot chore(deps): bump github.com/gruntwork-io/terratest from 0.41.9 to 0.41.15 @dependabot chore(deps): bump github.com/miekg/dns from 1.1.50 to 1.1.53 @dependabot chore(deps): bump github.com/onsi/ginkgo/v2 from 2.7.0 to 2.9.2 @dependabot chore(deps): bump github.com/onsi/gomega from 1.25.0 to 1.27.6 @dependabot chore(deps): bump github.com/prometheus/common from 0.39.0 to 0.42.0 @dependabot chore(deps): bump github.com/prometheus/prometheus from 0.41.0 to 0.42.0 @dependabot chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 @dependabot chore(deps): bump github.com/spiffe/go-spiffe from 0.0.0-20190820222348-6adcf1eecbcc to github.com/spiffe/go-spiffe/v2 @dependabot chore(deps): bump github.com/spiffe/go-spiffe/v2 from 2.1.2 to 2.1.4 @dependabot chore(deps): bump github.com/testcontainers/testcontainers-go from 0.15.0 to 0.18.0 @dependabot chore(deps): bump github.com/vishvananda/netns to 0.0.4 @mmorel-35 chore(deps): bump go from 1.18 to 1.20.2 @jakubdyszkiewicz,@lahabana chore(deps): bump go.uber.org/multierr from 1.9.0 to 1.11.0 @dependabot chore(deps): bump golang.org/x/net from 0.5.0 to 0.8.0 @dependabot chore(deps): bump golang.org/x/sys from 0.4.0 to 0.7.0 @dependabot chore(deps): bump golang.org/x/text from 0.6.0 to 0.8.0 @dependabot chore(deps): bump google.golang.org/grpc from 1.52.0 to 1.54.0 @dependabot chore(deps): bump google.golang.org/protobuf from 1.28.1 to 1.30.0 @dependabot chore(deps): bump gopkg.in/natefinch/lumberjack.v2 from 2.0.0 to 2.2.1 @dependabot chore(deps): bump helm.sh/helm/v3 from 3.11.0 to 3.11.2 @dependabot chore(deps): bump k8s.io/apiextensions-apiserver from 0.26.1 to 0.26.3 @dependabot chore(deps): bump k8s.io/klog/v2 from 2.90.0 to

@dependabot chore(deps): bump k8s.io/kubectl from 0.26.1 to 0.26.3 @dependabot chore(deps): bump sigs.k8s.io/controller-runtime from 0.14.1 to 0.14.6 @dependabot chore(deps): bump sigs.k8s.io/controller-tools from 0.11.1 to 0.11.3 @dependabot chore(deps): bump sigs.k8s.io/gateway-api from v0.5.1 to v0.6.0 @michaelbeaumont chore(deps): bump tibdex/github-app-token from 1.7.0 to 1.8.0 @dependabot chore(deps): remove dependency on github.com/prometheus/prometheus @lahabana chore(deps): security update @kumahq chore(deps): use latest kumahq/kuma-gui @kumahq feat(GatewayAPI): support HTTPRoutePathRedirect @michaelbeaumont feat(GatewayAPI): support ResponseHeaderModifier in HTTPRoute @michaelbeaumont feat(GatewayAPI): update to v0.6.2 @michaelbeaumont feat(MeshAccessLog): support OpenTelemetry @michaelbeaumont feat(MeshGateway): auto host rewrite for gateway route @bartsmykla feat(MeshGateway): support deployment customization for MeshGatewayInstance @johnharris85 feat(MeshHTTPRoute): add RequestMirror filter @lobkovilya feat(MeshHTTPRoute): add header matching @michaelbeaumont feat(MeshHTTPRoute): add path modifier to redirect @lobkovilya feat(MeshHTTPRoute): cross-zone support @michaelbeaumont feat(MeshProxyPatch): add json patch support @bartsmykla feat(MeshRetry): add host selection predicates @johnharris85 feat(MeshTrace): add support for opentelemetry trace backend @frzifus feat(api-server): manual mTLS @jakubdyszkiewicz feat(api-server): whoami endpoint @jakubdyszkiewicz feat(auth): separate authenticators for dp and zone proxy @jakubdyszkiewicz feat(helm): add default CNI resources @michaelbeaumont feat(helm): dynamic admission server port @d4kine feat(helm): make egress resources configurable @dascole feat(helm): make it possbile to install universal cp on k8s @slonka feat(k8s): add a configuration option to list allowed service accounts @slonka feat(k8s): add annotation `prometheus.metrics.kuma.io/aggregate-application-address` to scrape custom address on k8s @slonka feat(k8s): set

pod annotation @michaelbeaumont feat(kds): allow running non-tls KDS server @slonka feat(kds): delta KDS @lukidzi feat(kds): enable nack backoff @jakubdyszkiewicz feat(kuma-cp): allow Mesh default resources regeneration without deletion and restart @michaelbeaumont feat(kuma-cp): init container first by default @zekth feat(kumactl): generate public key command @jakubdyszkiewicz feat(kumactl): remove ca-cert or skip-verify requirement @jakubdyszkiewicz feat(persistence): change lib/pq to pgx @slonka feat(persistence): create pgx store @slonka feat(policies): extend policy matching API to work with egress and external services @lobkovilya feat(policies): implement MeshLoadBalancingStrategy @lobkovilya feat(tokens): allow kid to be a string @jakubdyszkiewicz feat(tokens): issue tokens offline @jakubdyszkiewicz feat(tokens): offline validation @jakubdyszkiewicz feat(tproxy): make tproxy v2 and CNI v2 default @bartsmykla fix(GatewayAPI): always set an explicit HTTPRoute Parents in status @michaelbeaumont fix(GatewayAPI): correctly handle invalid backendRefs @michaelbeaumont fix(MeshHTTPRoute): filter URLRewrite should be configured with ClusterSpecifier @lobkovilya fix(MeshRetry): guard against multiple previous priorities @johnharris85 fix(MeshTimeout): apply MeshTimeout defaults when one of `from` or `to` section is missing @Automaat fix(ca/builtin): be less verbose when creating CA secrets @michaelbeaumont fix(docker): set `SHELL` to an existing binary @michaelbeaumont fix(docker): use no ssl image @slonka fix(helm): add appProtocol to services we create @lahabana fix(helm): don't include taint controller env when cni disabled @lukidzi fix(helm): dont specify a default type for extraSecrets @wheelerlaw fix(helm): make it possible to use custom CA in egress and ingress @lahabana fix(helm): postgres client cert setup @slonka fix(helm): remove universal on kubernetes env vars that are supposed to be provided via secrets @slonka fix(helm): security contexts for ebpf cleanup hook @bartsmykla fix(helm): set CP memory limits, by default equal to memory request, set CP CPU requests @michaelbeaumont fix(helm): set migration container resources and securityContext @michaelbeaumont fix(helm): set readOnlyRootFilesystem/runAsNonRoot, create a ServiceAccount in correct release namespace @michaelbeaumont fix(helm): set readOnlyRootFilesystem/runAsUser/runAsGroup on ingress/egress deployments @michaelbeaumont fix(helm): upgrade CRDs instead of installing missing CRDs @jakubdyszkiewicz fix(helm): use emptyDir at /tmp with CP @michaelbeaumont fix(kuma-cni): ipv6 iptables with provided gateway and CNI V2 @jakubdyszkiewicz fix(kuma-cp): allow names of the resource to be longer and validate the length @lukidzi fix(kuma-cp): change default value for KubeOutboundsAsVIPs @Automaat fix(kuma-cp): change validation of resources synced to global @jakubdyszkiewicz fix(kuma-cp): don't let CA requests for other meshes block generation @michaelbeaumont fix(kuma-cp): traffic split with internal and external service @lobkovilya fix(kuma-cp): zone ingress mixes services with the same name in different meshes @lobkovilya fix(kumactl): don't check compatibility when talking to a preview version @lahabana fix(policy): merging of policies results in not applying policy on some outbounds @jakubdyszkiewicz fix(tproxy): allow disabling ipv6 for tproxy @bartsmykla Released on 2023/04/07 chore(deps): bump coredns from 1.10.0 to 1.10.1 @mergify chore(deps): bump gorestful and jwt @lahabana chore(deps): remove dependency on github.com/prometheus/prometheus (backport #6204) @mergify chore(deps): security update @kumahq chore(deps): upgrade envoy to v1.22.10 (backport #6483) @mergify fix(kuma-cni): ipv6 iptables with provided gateway and CNI V2 (backport #6374) @mergify fix(policy): matcher with same key not the same value (backport #6460) @mergify Released on 2023/04/06 chore(deps): bump coredns from 1.10.0 to 1.10.1 @mergify chore(deps): remove dependency on github.com/prometheus/prometheus (backport #6204) @mergify chore(deps): security update @kumahq chore(deps): upgrade envoy to v1.22.10 @michaelbeaumont fix(kuma-cni): ipv6 iptables with provided gateway and CNI V2 (backport #6374) @mergify fix(kuma-cp): add components in runtime (backport #6350) @mergify fix(kuma-cp): don't let CA requests for other meshes block generation (backport #6282) @mergify fix(policy): matcher with same key not the same value (backport #6460) @mergify Released on 2023/04/06 chore(deps): bump coredns from 1.10.0 to 1.10.1 @mergify chore(deps): bump gorestful and jwt @lahabana chore(deps): security update @kumahq chore(deps): upgrade envoy to v1.22.10 (backport #6483) @mergify fix(kuma-cni): ipv6 iptables with provided gateway and CNI V2 (backport #6374) @mergify Released on 2023/04/06 chore(deps): bump coredns from 1.10.0 to 1.10.1 @mergify chore(deps): bump gorestful and jwt (backport #6203) @mergify chore(deps): security update @kumahq chore(deps): upgrade envoy to v1.22.10 (backport #6483) @mergify Released on 2023/02/14 chore(deps): bump Envoy from 1.22.2 to 1.22.7 @mergify chore(deps): security update @kumahq chore(deps): use latest kumahq/kuma-gui @kumahq feat(api-server): manual mTLS (backport #5979) @mergify fix(helm): use custom CA in egress and ingress too (backport #5980) @mergify fix(tproxy): fix disabling ipv6 for tproxy (backport #5923) @mergify Released on 2023/02/14 chore(deps): bump Envoy from 1.22.2 to 1.22.7 @mergify chore(deps): security update @kumahq fix(tproxy): fix disabling ipv6 for tproxy (backport #5923) @mergify Released on 2023/02/14 chore(deps): bump Envoy from 1.22.2 to 1.22.7 @mergify chore(deps): security update @kumahq fix(tproxy): fix disabling ipv6 for tproxy (backport #5923) @mergify Released on 2023/02/14 chore(deps): bump Envoy from 1.22.2 to 1.22.7 @mergify chore(deps): security update @kumahq Released on 2023/02/14 chore(deps): bump Envoy from 1.22.2 to 1.22.7 @mergify chore(deps): security update @kumahq Released on 2023/01/30 chore(deps): bump alpine from 3.16.2 to 3.17.0 @dependabot chore(deps): bump github.com/Masterminds/semver/v3 from 3.1.1 to 3.2.0 @dependabot chore(deps): bump github.com/Masterminds/sprig/v3 from 3.2.2 to 3.2.3 @dependabot chore(deps): bump github.com/containerd/containerd from 1.6.8 to 1.6.12 @dependabot chore(deps): bump github.com/containernetworking/plugins from 1.1.1 to 1.2.0 @dependabot chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.6.13 to 0.9.1 @dependabot chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.4.2 to 4.4.3 @dependabot chore(deps): bump github.com/gruntwork-io/terratest from 0.40.24 to 0.41.8 @dependabot,@lahabana chore(deps): bump github.com/kumahq/kuma-net from 0.8.7 to 0.8.10 @lukidzi chore(deps): bump github.com/onsi/ginkgo/v2 from 2.4.0 to 2.7.0 @dependabot chore(deps): bump github.com/onsi/gomega from 1.23.0 to 1.25.0 @dependabot chore(deps): bump github.com/prometheus/client_golang from 1.13.0 to 1.14.0 @dependabot chore(deps): bump github.com/prometheus/common from 0.37.0 to 0.39.0 @dependabot chore(deps): bump github.com/prometheus/prometheus from 0.39.1 to 0.41.0 @dependabot chore(deps): bump github.com/sethvargo/go-retry from 0.2.3 to 0.2.4 @dependabot chore(deps): bump github.com/shopspring/decimal from 1.2.0 to 1.3.1 @dependabot chore(deps): bump github.com/spf13/viper from 1.13.0 to 1.15.0 @dependabot chore(deps): bump go.uber.org/multierr from 1.8.0 to 1.9.0 @dependabot chore(deps): bump go.uber.org/zap from 1.23.0 to 1.24.0 @dependabot chore(deps): bump golang.org/x/net from 0.1.0 to 0.5.0 @dependabot chore(deps): bump golang.org/x/sys from 0.1.0 to 0.4.0 @dependabot chore(deps): bump golang.org/x/text from 0.4.0 to 0.6.0 @dependabot chore(deps): bump golang.org/x/time from 0.1.0 to 0.3.0 @dependabot chore(deps): bump google.golang.org/grpc from 1.50.1 to 1.52.0 @dependabot chore(deps): bump helm.sh/helm/v3 from 3.8.1 to 3.11.0 @dependabot chore(deps): bump istio.io/pkg from v0.0.0-20201202160453-b7f8c8c88ca3 to v0.0.0-20221115183735-2aabb09bf0bb @mmorel-35 chore(deps): bump k8s.io/apiextensions-apiserver from 0.25.3 to 0.25.4 @mmorel-35 chore(deps): bump k8s.io/client-go from 0.25.3 to 0.25.4 @dependabot chore(deps): bump k8s.io/klog/v2 from 2.80.1 to 2.90.0 @dependabot chore(deps): bump sigs.k8s.io/controller-runtime from 0.13.0 to

@dependabot chore(deps): bump sigs.k8s.io/controller-tools from 0.10.0 to 0.11.1, @dependabot chore(deps): bump tibdex/github-app-token from 1.6.0 to 1.8.0 @dependabot chore(deps): install dev tools and split if more repos @lukidzi chore(deps): security update @kumahq chore(deps): update coreDNS to 1.10.0 @lahabana chore(deps): update to emicklei/go-restful/v3 v3.10.1 and remove `/tokens` @dependabot chore(deps): upgrade k3d @lukidzi chore(deps): use latest kumahq/kuma-gui @kumahq chore(deps): use sigs.k8s.io/yaml @mmorel-35 feat(MeshAccessLog): add OmitEmptyValues to MeshAccessLog format @mmorel-35 feat(MeshGatewayInstance): respect `kuma.io/mesh` label @michaelbeaumont feat(MeshGatewayRoute): response header filter @michaelbeaumont feat(api-server): ability to set rootUrl for GUI and API @lahabana feat(api-server): add name search to dataplane overview @lahabana feat(api-server): contain matches on name and tags @lahabana feat(build): consistent docker images @slonka feat(build): idempotent build @slonka feat(gateway): add support for match header PRESENT and ABSENT @lahabana feat(gui): serve index from all paths without extension @lahabana feat(helm): add tolerations to Helm chart @KrustyHack feat(helm): allow injecting env from parent projects @slonka feat(helm): use object instead of list for plugins.policies @michaelbeaumont feat(kuma-cp): add possibility to run diagnostics on TLS @mmorel-35 feat(kuma-cp): added configuration of plugins and its order @lukidzi feat(kuma-cp): intOrString as decimal in the API @jakubdyszkiewicz feat(kuma-cp): intercp communication protocol @jakubdyszkiewicz feat(kuma-cp): recover from watchdog panics @jakubdyszkiewicz feat(kuma-cp): remove value of secret when logging Secret Resources @Automaat feat(kumactl): added option to install transparent proxy with docker @lukidzi feat(policy): allow merging by a complex key @michaelbeaumont feat(policy): append policy slices @jakubdyszkiewicz feat(policy): don't use protobuf for DataSource in policies @Automaat feat(policy): implement MeshCircuitBreaker policy @bartsmykla,@lobkovilya feat(policy): implement MeshFaultInjection policy @lukidzi feat(policy): implement MeshHTTPRoute policy @michaelbeaumont,@slonka feat(policy): implement MeshHealthCheck policy @lahabana,@lobkovilya,@michaelbeaumont,@slonka feat(policy): implement MeshProxyPatch policy @jakubdyszkiewicz feat(policy): implement MeshRateLimit policy @lobkovilya,@lukidzi feat(policy): implement MeshRetry policy @lobkovilya,@slonka feat(policy): implement MeshTimeout policy @Automaat,@michaelbeaumont feat(policy): improve rules api @lahabana feat(policy): validate schema only during the user's input unmarshal @lobkovilya feat(security): add dependabot security updates to release branches @slonka fix(MeshAccessLog): update API to align with the memo @lobkovilya fix(MeshGateway): properly apply Service template annotations to existing Service @michaelbeaumont fix(MeshTrace): adjust MeshTrace to follow the memo @lobkovilya fix(api-server): fix tags filter value with `:` @lahabana fix(api-server): remove spec from inspect policy output @lahabana fix(api-server): return 400 on invalid resource name @lahabana fix(gateway): be more lenient with prefix paths trailing slashes @michaelbeaumont fix(gui): add version and basedOnKuma to index.html @lahabana fix(kuma-cp): add option to disable `sslsni` in universal @michaelbeaumont fix(kuma-cp): allow to set policies order from others projects @lukidzi fix(kuma-cp): change way of setting if resource is read only @lukidzi fix(kuma-cp): concurrent mesh cache map write @michaelbeaumont fix(kuma-cp): don't cache filtered data @lukidzi fix(kuma-cp): filtering of name prefix on K8S @jakubdyszkiewicz fix(kuma-cp): fix appending of pointer to slice in policies config @Automaat fix(kuma-cp): fix kafka_type tag creation regex @Automaat fix(kuma-cp): fixed error when logging ExternalServiceResourceList and MeshResourceList @Automaat fix(kuma-cp): forward envoy admin operations to proper instance @jakubdyszkiewicz fix(kuma-cp): increase kuma-init memory limit when using ebpf @lukidzi fix(kuma-cp): kds deadlock @jakubdyszkiewicz fix(kuma-cp): make validate list aware of the mesh @slonka fix(kuma-cp): memory store keeps children after owner update @jakubdyszkiewicz fix(kuma-cp): only put policies in MeshInsight @lahabana fix(kuma-cp): retrieve name from owner not parsing pod name for Deployments/CronJob @lukidzi fix(kuma-cp): use sni to verify upstream certificate san when specified instead of address @jamesdbloom fix(kuma-cp): warn when using deprecated token id @lahabana fix(kuma-dp): allow to configure address of application to scrape @lukidzi fix(kuma-dp): tolerate endline in token file @lahabana fix(kumactl): remove PodSecurityPolicy from install observability @michaelbeaumont fix(kumactl): set klog to avoid logs from k8s @lahabana fix(kumactl): use the same client in `kumactl apply` @lahabana fix(policy): change percentage field from int to intOrString @lukidzi fix(policy): fix

to have correct metadata @lahabana fix(policy): make targetRef required @AyushSenapati fix(policy): remove superfluous var usage @AyushSenapati fix(policy): use GatewayAPI style header modifier in all policies @lahabana fix(policy): use PascalCase for all constants @lahabana fix(universal): don't set sslsni option if not disabled (backport #5419) @mergify fix(xds): don't read metadata in ProxyBuilders @lahabana fix(xds): sort resources when building MeshContext @lobkovilya Released on 2023/01/12 chore(deps): bump helm.sh/helm/v3 from 3.8.1 to 3.10.3 @mergify chore(deps): update coreDNS to 1.10.0 (backport #5626) @mergify chore(helm): remove duplicate keys in resources (backport #4681) @mergify chore: remove Apache license header from generated files (backport #5565) @mergify chore: upgrade golang to 1.18.9 (backport #5607) @mergify fix(kuma-cp): don't cache filtered data (backport #5574) @mergify Released on 2023/01/11 chore(deps): bump helm.sh/helm/v3 from 3.8.1 to 3.10.3 @mergify chore(deps): update coreDNS to 1.10.0 (backport #5626) @mergify chore: remove Apache license header from generated files (backport #5565) @mergify chore: upgrade golang to 1.18.9 (backport #5607) @mergify fix(kuma-cp): don't cache filtered data (backport #5574) @mergify Released on 2023/01/11 chore(deps): bump helm.sh/helm/v3 from 3.8.1 to 3.10.3 @mergify chore(deps): update coreDNS to 1.10.0 (backport #5626) @mergify chore: remove Apache license header from generated files (backport #5565) @mergify chore: upgrade golang to 1.18.9 (backport #5607) @mergify fix(kuma-cp): don't cache filtered data (backport #5574) @mergify Released on 2023/01/11 chore(deps): bump helm.sh/helm/v3 from 3.8.1 to 3.10.3 @mergify chore(deps): update coreDNS to 1.10.0 (backport #5626) @mergify chore(helm): remove duplicate keys in resources (backport #4681) @mergify chore: remove Apache license header from generated files (backport #5565) @mergify chore: upgrade golang to 1.18.9 (backport #5607) @mergify fix(kuma-cp): don't cache filtered data (backport #5574) @mergify Released on 2023/01/11 chore(deps): bump helm.sh/helm/v3 from 3.8.1 to 3.10.3 @mergify chore(deps): update coreDNS to 1.10.0 (backport #5626) @mergify chore(helm): remove duplicate keys in resources (backport #4681) @mergify chore: remove Apache license header from generated files (backport #5565) @mergify chore: upgrade golang to 1.18.9 (backport #5607) @mergify fix(kuma-cp): don't cache filtered data (backport #5574) @mergify Released on 2022/12/05 chore: back-ports api base path fix @kleinfreund feat(kuma-cp): remove value of secret when logging Secret Resources (backport #5384) @mergify fix(kuma-cp): add option to disable `sslsni` in universal (backport #5318) @mergify fix(kuma-cp): change way of setting if resource is read only (backport #5345) @mergify fix(kuma-cp): kds deadlock (backport #5373) @mergify fix(kuma-cp): use sni to verify upstream certificate san when specified along with address (backport #5347) @mergify fix(xds): don't read metadata in ProxyBuilders (backport #5414) @mergify fix: sort resources when building MeshContext (backport #5391) @mergify Released on 2022/12/05 feat(kuma-cp): remove value of secret when logging Secret Resources (backport #5384) @mergify fix(kuma-cp): kds deadlock (backport #5373) @mergify fix: sort resources when building MeshContext (backport #5391) @mergify Released on 2022/11/04 chore(.github): remove old release workflow @lobkovilya chore(api): remove DENYWITHSHADOW_ALLOW @lobkovilya chore(api): remove unused method and types @lobkovilya chore(api): remove unused timestamp.proto import @michaelbeaumont chore(api): skip Compute when building inbound access logs @jakubdyszkiewicz chore(bootstrap): improve validator policy bootstrap @lahabana chore(deps): bump actions/setup-go from 2 to 3 @dependabot chore(deps): bump cirello.io/pglock from 1.9.0 to 1.10.0 @dependabot chore(deps): bump github.com/Masterminds/sprig to 3.2.2 @mmorel-35 chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 0.6.7 to 0.6.13 @dependabot chore(deps): bump github.com/google/go-cmp from 0.5.8 to 0.5.9 @dependabot chore(deps): bump github.com/gruntwork-io/terratest from 0.40.20 to 0.40.24 @dependabot chore(deps): bump github.com/kumahq/kuma-net from 0.8.1 to 0.8.2 @dependabot chore(deps): bump github.com/lib/pq from 1.10.6 to 1.10.7 @dependabot chore(deps): bump github.com/onsi/ginkgo/v2 from 2.1.4 to 2.4.0 @dependabot chore(deps): bump github.com/onsi/gomega from 1.20.0 to 1.23.0 @dependabot chore(deps): bump github.com/prometheus/client_model from 0.2.0 to 0.3.0 @dependabot chore(deps): bump github.com/prometheus/prometheus from 0.37.0 to 0.39.1 @dependabot chore(deps): bump github.com/spf13/cobra from 1.5.0 to 1.6.1 @dependabot chore(deps): bump github.com/spf13/viper from 1.12.0 to 1.13.0 @dependabot chore(deps): bump github.com/testcontainers/testcontainers-go from 0.13.0 to 0.15.0 @dependabot chore(deps): bump go.uber.org/zap from 1.22.0 to 1.23.0 @dependabot chore(deps): bump golang.org/x/text from

to 0.4.0 @dependabot chore(deps): bump google.golang.org/grpc from 1.48.0 to 1.50.1 @dependabot chore(deps): bump k8s.io dependencies from 0.24.3 to 0.25.3 @michaelbeaumont chore(deps): bump k8s.io/client-go from 0.25.1 to 0.25.2 @dependabot chore(deps): bump kumahq/kuma-gui to f3dba73d4c264b094b6b351a8b44f2d5a0dc4ecb @kleinfreund,@kumahq chore(deps): bump sigs.k8s.io/controller-runtime from 0.12.3 to 0.13.0 @dependabot chore(deps): bump sigs.k8s.io/controller-tools from 0.9.2 to 0.10.0 @dependabot chore(deps): update kuma-grafana-datasource @bartsmykla chore(gateway): remove invalid options for MeshGatewayRoute @michaelbeaumont chore(gui): removes update/gui command @kleinfreund chore(helm): remove unused `critical-pod` annotation @michaelbeaumont chore(helm): switch merbridge image registry to upstream @bartsmykla chore(kuma-cp): adjust timeout in cp probes @jakubdyszkiewicz chore(kuma-cp): config cleanup @jakubdyszkiewicz chore(kuma-cp): improve logging in K8S controllers @jakubdyszkiewicz chore(kuma-cp): improve test xds client @jakubdyszkiewicz chore(kuma-cp): remove disabling metrics from kuma-cp.defaults @lahabana chore(kuma-cp): resource manager wrapper @jakubdyszkiewicz chore(kuma-init): use iptables-legacy in kuma-init @bartsmykla chore(pkg/gc): don't rely on core.Now var for time @lahabana chore(plugins): remove some unecessary interfaces and methods @lahabana chore(proto): remove protos for new policies @lobkovilya chore(test): added resource builder @jakubdyszkiewicz chore(test): added support for GRPC to test-server @lobkovilya chore(test): make unit test compatible with IPV6 host @jakubdyszkiewicz chore(xds): drop deprecated envoy.config.route.v3.HeaderMatcher.exact_match @michaelbeaumont docs(MADR): new tracing policy proposal @michaelbeaumont docs(MADR): update MADR 007 @lobkovilya docs(gateway): explain the semantics of a PREFIX match @michaelbeaumont docs(gateway): explain the semantics of a prefix rewrite to / @michaelbeaumont docs(proto): fixed default serviceAddress and upgrade docs @lukidzi docs(proto): rewrite dataplane proto docs @jakubdyszkiewicz feat(ebpf): CNI uses libbpf CO:RE @lukidzi feat(ebpf): refactor merbridge using libbpf with CO:RE @bartsmykla feat(ebpf): transparent proxy with eBPF in init containers @bartsmykla feat(gateway): add MeshGateway support to MeshAccessLog @michaelbeaumont feat(gateway): add `crossMesh` to `MeshGatewayConfig` @michaelbeaumont feat(gateway): add service-upstream annotation for delegated nginx @michaelbeaumont feat(gateway): install `kuma` `GatewayClass` if gateway API CRDs present @michaelbeaumont feat(gateway): match new policies to MeshGateways @michaelbeaumont feat(inspect): implement rule-based view for new policies @jakubdyszkiewicz,@lobkovilya feat(kuma-cp): add flag to disable taint controller @jakubdyszkiewicz feat(kuma-cp): add possibility to restrict TLS version and ciphers @lahabana feat(kuma-cp): add possibility to run MADS on TLS @lahabana feat(kuma-cp): add possibility to split datadog services based on traffic direction and destination @Automaat feat(kuma-cp): added validation for backend name @Automaat feat(kuma-cp): created default control plane user @jakubdyszkiewicz feat(kuma-cp): extensible token issuers @jakubdyszkiewicz feat(kuma-cp): move Mesh Cache to runtime @Automaat feat(kuma-cp): universal resources schema validation @slonka feat(kuma-cp): use zone token to auth zone ingress @jakubdyszkiewicz feat(kuma-dp): publish metrics with text_readouts from envoy @Automaat feat(kumactl): add option to install with experimental transparent proxy @michaelbeaumont feat(kumactl): use exclude ports for uids from kuma-net @slonka feat(policy): Add MeshAccessLog policy @michaelbeaumont,@slonka feat(policy): Add MeshTrace policy @michaelbeaumont,@slonka feat(policy): Add MeshTrafficPermission policy @lobkovilya feat(policy): add interfaces for policy plugins @lahabana feat(policy): reimplemented matching for new policies @lahabana,@lobkovilya feat(service-insights): add external service in api @lahabana fix(.github): links in PR template @michaelbeaumont fix(.github): use github app in pr-comment action @lahabana fix(api): nil dereference in MeshAccessLog configurer @lobkovilya fix(cni): add empty registry to experimental cni @slonka fix(cni): hook up log level to cni @slonka fix(cni): make cni logs available via kubectl logs @slonka fix(cni): retry loading images @slonka fix(docs): fixed location of developer tools in DEVELOPER.md docs @Automaat fix(gateway): add support for retryOn @lahabana fix(gateway): cross-mesh gateways with same service @michaelbeaumont fix(gateway): don't create invalid envoy config when routes and listeners don't match @michaelbeaumont fix(gateway): route URL prefix rewriting @michaelbeaumont fix(gateway): skip ExternalService if none match @michaelbeaumont fix(gateway): sort routes @michaelbeaumont fix(gatewayapi): don't NPE if the `GatewayClass` ref doesn't exist @michaelbeaumont fix(gatewayapi): reconcile Gateways and HTTPRoutes on ReferenceGrant changes @michaelbeaumont fix(gatewayapi): update gateway-api and fix failing RouteKind tests @michaelbeaumont fix(helm): customize location of kuma-init repository for ebpf cleanup @lukidzi fix(helm): use `podAnnotations` everywhere possible @lahabana fix(kuma-cp): collapsed grafana dashboards @jakubdyszkiewicz fix(kuma-cp): deep copy tags when

outbounds @bartsmykla fix(kuma-cp): disable statsForAllMethods in grpc stats @jakubdyszkiewicz fix(kuma-cp): do not override source address when TP is not enabled @lukidzi fix(kuma-cp): multiple external services pointing to same address @slonka fix(kuma-cp): override grafana plugin files by default @slonka fix(kuma-cp): reissue admin tls cert on dp address change @jakubdyszkiewicz fix(kuma-cp): remove Dataplane for Pod without IP @jakubdyszkiewicz fix(kuma-cp): return content type of inspect endpoints @jakubdyszkiewicz fix(kuma-dp): resilient TCP access log streamer @jakubdyszkiewicz fix(kumactl): get APIVersions from k8s server @michaelbeaumont fix(tools): add 'v' prefix to preview version format @michaelbeaumont fix(tools): support both GitHub app tokens and PATs @michaelbeaumont perf(kuma-cp): avoid rebuilding endpoint map @jakubdyszkiewicz refactor(kuma-dp): add xds authentication customization @michaelbeaumont Released on 2022/10/07 fix(tools): support both GitHub app tokens and PATs (backport #4869) by @mergify in https://github.com/kumahq/kuma/pull/4872 fix(kuma-cp): remove Dataplane for Pod without IP (backport #4964) by @mergify in https://github.com/kumahq/kuma/pull/4980 fix(): do not override source address when TP is not enabled (backport #4951) by @mergify in https://github.com/kumahq/kuma/pull/4961 fix(kuma-cp): deep copy tags when gen. outbounds (backport #5070) by @mergify in https://github.com/kumahq/kuma/pull/5071 fix(gateway): add support for retryOn (backport #5091) by @mergify in https://github.com/kumahq/kuma/pull/5098 Released on 2022/10/06 fix(helm): always run Helm version update by @michaelbeaumont in https://github.com/kumahq/kuma/pull/4604 chore(helm): update to 1.7.1 by @michaelbeaumont in https://github.com/kumahq/kuma/pull/4603 Revert "fix(helm): always run Helm version update (#4604)" by @michaelbeaumont in https://github.com/kumahq/kuma/pull/4609 fix(kuma-cp): deep copy tags when gen. outbounds (backport #5070) by @mergify in https://github.com/kumahq/kuma/pull/5072 fix(kuma-cp): remove Dataplane for Pod without IP (backport #4964) by @mergify in https://github.com/kumahq/kuma/pull/5096 Released on 2022/10/06 fix(core): validate both old and new objects on Update (backport #4589) by @michaelbeaumont in https://github.com/kumahq/kuma/pull/4593 fix(kuma-cp): deep copy tags when gen. outbounds (backport #5070) by @mergify in https://github.com/kumahq/kuma/pull/5090 fix(kuma-cp): remove Dataplane for Pod without IP (backport #4964) by @mergify in https://github.com/kumahq/kuma/pull/5097 Released on 2022/08/22 CNI v2 with lots of improvements: taint controller to prevent race condition @slonka all logs are easily accessible via `kubectl logs` command which greatly simplifies observability @slonka it uses new transparent engine implemented in kuma-net @slonka URL rewrite in Builtin Gateway: support URL rewriting @michaelbeaumont Stats and Clusters in the GUI: execute stats and clusters from the control plane @jakubdyszkiewicz Extra `retryOn` options for Retry: add extra http retryOn options @johnharris85 Better support for TCP logging: resilient tcp TCP access log streamer @parkanzky @jakubdyszkiewicz Filtering Envoy metrics: added option to define filter for Envoy metrics @lukidzi Projected service account token: support for projected service account token @lukidzi remove duplicate keys in resources @michaelbeaumont add containersecuritycontext to CNI daemonset @jakubdyszkiewicz fix extraConfigMap and cp labels @lahabana use image.global.registry for imageExperimental @jakubdyszkiewicz `ListenerReason` for unresolved certificate refs, enable ReferenceGrant conformance tests @michaelbeaumont check hostname intersection between HTTPRoute and Gateway listener @michaelbeaumont create MeshGatewayInstance in same Mesh as Gateway @michaelbeaumont don't create invalid envoy config when routes and listeners don't match

#4837) @mergify hostname intersections, use new RouteReasons @michaelbeaumont improve HTTPRoute statuses with unresolved BackendRefs @michaelbeaumont npe without any timeout @michaelbeaumont rbac permissions for ReferenceGrant @michaelbeaumont workaround label value max length with hash @michaelbeaumont check if kuma annotation or label is set but ignore value @lukidzi delete an empty TimeoutConfigurer @lobkovilya do not modify external service tags @jakubdyszkiewicz don't deploy Pod/Service webhooks in global @michaelbeaumont don't fail generation if other mesh CAs are misconfigured @michaelbeaumont external service datasource validation @jakubdyszkiewicz fix builtdns annotations for kubernetes @lahabana generate cluster name hash based on tags not config @lukidzi grant delete Pods in kuma-system namespace to control plane @michaelbeaumont localhost exposed application shouldn't be reachable @lukidzi make options for policies simpler @lahabana protect sort from empty locality @jakubdyszkiewicz registering dp on reconnect @jakubdyszkiewicz support GC service account @lobkovilya validate both old and new objects on Update @michaelbeaumont validation error with user tokens @jakubdyszkiewicz access log path on windows when cp is on linux @jakubdyszkiewicz fix multi OS build of accesslogs @lahabana have envoy version check always work @lahabana propagate context for metrics aggregate @lukidzi set prometheus content-type when returning metrics @lukidzi add operations now create non-existent path elements @michaelbeaumont new policy matching proposal @lobkovilya mention mesh name in gateway instance status @lahabana add listener connection limits @michaelbeaumont add loadBalancerIP to MeshGatewayInstance @michaelbeaumont allow MeshGateway Dataplane Pods to bind privileged ports @michaelbeaumont configure overload_manager based on max memory @michaelbeaumont multi-zone cross-mesh MeshGateway @michaelbeaumont propagate x-kuma-tags from MeshGateways @michaelbeaumont send default static payload for empty gateway @tharun208 set `pathwithescapedslashesaction` @michaelbeaumont set cluster HTTP2 stream and connection window size @michaelbeaumont set cluster perconnectionbufferlimitbytes @michaelbeaumont set globaldownstreammax_connections to 50000 @michaelbeaumont update to Gateway API v0.5.0, support v1beta1 resources @michaelbeaumont validate listeners for collapsibility @michaelbeaumont add MeshGateway dashboard @michaelbeaumont config cleanup (backport #4855) @mergify don't set deprecated dnsresolverconfig @michaelbeaumont don't set deprecated known_suffixes @michaelbeaumont remove deprecated Cluster.Http2ProtocolOptions @michaelbeaumont remove versions_ws @lahabana replace deprecated adminaccesslog_path @lahabana add /policies endpoint to list all registered policies @lahabana authenticate DP every time @jakubdyszkiewicz enrich policies endpoint @jakubdyszkiewicz identify gateway service by deployment @parkanzky separate CA for Envoy Admin communication @jakubdyszkiewicz use remote address for Gateway @jakubdyszkiewicz add operations now create non-existent path elements @michaelbeaumont remove envoy admin port flag @tharun208 detect memory limit only on linux @jakubdyszkiewicz add a limit to the prom TSDB size @lahabana remove old flags in install tp @lahabana add MeshGateway to `install demo` @michaelbeaumont add install control-plane --registry flag @michaelbeaumont create MADR for MeshTrafficPermission @lobkovilya new policy matching proposal @lobkovilya policy matching, replace 'conf' with 'default' @lobkovilya add cni ebpf plugin @bartsmykla implement the cni plugin @slonka @slonka @slonka @mergify @slonka @slonka @mergify @slonka @slonka @mergify taint controller @jakubdyszkiewicz use our cni with calico @slonka update demo to latest version @lahabana update Kuma GUI @kleinfreund @lahabana use github.com/emicklei/go-restful/v3 @mmorel-35 bump alpine from 3.16.0 to 3.16.2 in /tools/releases/dockerfiles @dependabot bump github.com/containerd/cgroups from 1.0.3 to 1.0.4 @dependabot bump github.com/containernetworking/cni from 0.8.1 to 1.1.2 @dependabot bump github.com/golang-jwt/jwt/v4 from 4.4.1 to 4.4.2 @dependabot bump github.com/golang-migrate/migrate/v4 from 4.15.0 to 4.15.2 @dependabot bump github.com/gruntwork-io/terratest from 0.40.15 to 0.40.20 @dependabot bump github.com/miekg/dns from 1.1.49 to 1.1.50 @dependabot bump github.com/onsi/gomega from 1.19.0 to 1.20.0 @dependabot bump github.com/prometheus/client_golang from 1.12.2 to 1.13.0 @dependabot bump github.com/prometheus/common from 0.34.0 to 0.37.0 @dependabot bump github.com/spf13/cobra from 1.4.0 to 1.5.0 @dependabot bump go.uber.org/zap from 1.21.0 to 1.22.0 @dependabot bump google.golang.org/grpc from 1.47.0 to 1.48.0 @dependabot bump google.golang.org/protobuf from 1.28.0 to 1.28.1 @dependabot bump k8s.io/apiextensions-apiserver from 0.24.0 to 0.24.3 @dependabot bump sigs.k8s.io/controller-runtime from 0.12.1 to 0.12.3 @dependabot bump sigs.k8s.io/controller-tools from 0.9.0 to 0.9.2 @dependabot Released on 2022/07/13 Nil pinter exception without any timeout (#4550) Use remote address for Gateway (#4538) Update demo to latest version (#4587) Grant delete Pods in kuma-system namespace to control plane (#4575) Don't fail generation if other mesh CAs are misconfigured (#4517) Don't override timeout values for ExternalServices (#4568) Access log path on windows when cp is on linux (#4518) Fix extraConfigMap and cp labels (#4541) Avoid `-<arch>` in version of the

(#4527) Released on 2022/06/13 Cross Mesh Communication: add cross-mesh `MeshGateway` listeners @michaelbeaumont ContainerPatch: allow custom configuration of Kubernetes' `kuma-init` and `kuma-sidecar` containers by introducing `ContainerPatch` CRD / / @parkanzky, @bartsmykla Observability: hijack application metrics to enable scraping metrics from mTLSed applications without prometheus in the mesh / @lukidzi unified installation of `metrics/logging/tracing` into one command `observability` / @lukidzi, @lahabana ARM64 support: added arm build and release pipeline @lukidzi release for arm64 now publish correct arch image @lukidzi upgrade kubectl to version with ARM support @lukidzi support ARM Linux/Darwin for dev/tools @lukidzi introduced map of arch for a specific build @lukidzi do not exclude arm64 files from docker @lukidzi Gateway: add `GatewayClass.Spec.ParametersRef` support @michaelbeaumont cp annotations from gateway to svc @johnharris85 only reconcile Gateway when GatewayClass is Ready @michaelbeaumont auto generate hostname for crossMesh listeners / @michaelbeaumont Helm: set host network var in helm/cp-deployment.yaml @SallyBlichWalkMe add resource management for jobs @gdasson option for automountSAT=false on cp @gdasson helm chart improvements @bartsmykla CP: experimental transparent proxy annotation @parkanzky graceful shutdown on Universal using HDS @jakubdyszkiewicz intercept signal for different platforms @jakubdyszkiewicz XDS config dump on Global CP @jakubdyszkiewicz validate DP compat on kuma backend @parkanzky DP: graceful shutdown of kuma-dp @jakubdyszkiewicz Gateway: use MeshGatewayInstance mesh annotation when matching / @michaelbeaumont Helm: remove replica from cp-deployment.yaml when autoscaling enabled / @gustoliv CP: fix '/config_dump' request if Global CP is on Kubernetes / @lobkovilya add the latest version to compatibility matrix @parkanzky DP: clarify error log message when kuma-dp is wrongly connecting to global-cp @slonka Kumactl: fix transparent proxy --skip-conntrack-zone-split flag value @bartsmykla Gateway: add /finalizers permission for OwnerReferencesPermissionEnforcement plugin @michaelbeaumont don't match on ALPN in gateway (#4198) @wjrbetts Helm: delete 'kubernetes.io/arch' node selector @lobkovilya CP: don't always recompute mesh contexts @michaelbeaumont don't run dataplane gc in global @lahabana graceful components @jakubdyszkiewicz memory store cannot delete a parent @jakubdyszkiewicz protocol check should be case-insensitive @lukidzi remove dns server from control plane @lahabana automatically detect dns lookup family for cp cluster @slonka ZoneIngress: graceful start of many ZoneIngresses @jakubdyszkiewicz ZoneEgress: resolve zone-ingress advertized address @lahabana do not change ip to ZoneEgress address @lukidzi Kumactl: remove flag '--experimental-meshgateway' @lobkovilya Timeout Policy: deprecate 'timeout.grpc' section / @lobkovilya Other: delete dns-server 5653 port from configuration and helm files / @lobkovilya support kube-linter tools to analyze Kubernetes YAML files @mangoGoForward upgrade envoy to 1.22.1 / @lobkovilya upgrade kuma-cni to 0.0.10 @lobkovilya upgrade tproxy iptables to v0.2.2 @bartsmykla upgrade GUI to the latest version / @jakubdyszkiewicz, @lahabana, @bartsmykla upgrade protoc and regenerate files @lukidzi bump github.com/golang-migrate/migrate/v4 from 4.15.1 to 4.15.2 @dependabot bump github.com/gruntwork-io/terratest from 0.40.6 to 0.40.10 @dependabot bump github.com/lib/pq from 1.10.5 to 1.10.6 @dependabot bump github.com/miekg/dns from 1.1.48 to 1.1.49 @dependabot bump github.com/onsi/ginkgo/v2 from 2.1.3 to 2.1.4 @dependabot bump github.com/prometheus/client_golang from 1.12.1 to 1.12.2 @dependabot bump github.com/prometheus/common from 0.33.0 to 0.34.0 @dependabot bump github.com/spf13/viper from 1.10.0 to 1.11.0 @dependabot bump google.golang.org/grpc from 1.45.0 to 1.46.2 @dependabot bump k8s.io/apiextensions-apiserver from 0.23.5 to 0.24.0 @dependabot / bump sigs.k8s.io/controller-runtime from 0.11.2 to 0.12.1 / @dependabot automate policy generation @lobkovilya Released on 2022/06/10 CP: do not change ip to ZoneEgress address (backport #4193) memory store cannot delete a parent (backport #4194) upgrade envoy to 1.21.3 @lobkovilya Released on 2022/06/10 upgrade envoy to 1.21.3 @lobkovilya Released on 2022/04/11 Gateway: release K8s GatewayAPI as preview @jakubdyszkiewicz,@michaelbeaumont use MeshGatewayInstance name for generated objects @michaelbeaumont Inspect api: add gateways to policy inspect @michaelbeaumont ZoneEgress: Make zoneegress available in standalone mode @lahabana added locality aware lb for external service @lukidzi make zoneegress routing opt-in @lukidzi support RateLimit and FaultInjections @lobkovilya Helm: Allow customization of image tags in Helm chart @gdasson Expose kuma-cp's metric port so it can be scraped by self-deployed prometheus. @jbehrends add resource limits option for control plane deployment @gdasson fail if

and appVersion incompatible @michaelbeaumont set version to track appVersion @michaelbeaumont expose kuma-cp gui through ingress @lukidzi allow specifying security context @gdasson @bartsmykla Other: feat(k8s): ability to set custom service account token volume @johnharris85 feat(k8s): shutdown kuma-dp container for any owner kind @lukidzi feat(k8s): support startupProbes @lahabana feat(kuma-cp): add uptime, policies, gateway dps to reports @parkanzky feat(kuma-cp): add metrics and timeouts to CA interface @parkanzky feat(kumactl): add --values and --set to kumactl install control-plane @lahabana feat(transparent-proxy): add experimental tproxy iptables generation @bartsmykla bump alpine from 3.15.0 to 3.15.2 in /tools/releases/dockerfiles @dependabot bump github.com/envoyproxy/protoc-gen-validate from 0.6.3 to 0.6.7 @dependabot bump github.com/go-logr/logr from 1.2.2 to 1.2.3 @dependabot bump github.com/golang-jwt/jwt/v4 from 4.3.0 to 4.4.1 @dependabot bump github.com/k8s/ from 0.23.4 to 0.23.5 @lahabana bump github.com/miekg/dns from 1.1.46 to 1.1.47 @dependabot bump github.com/onsi/gomega from 1.18.1 to 1.19.0 @dependabot bump github.com/spf13/cobra from 1.3.0 to 1.4.0 @dependabot bump go.uber.org/multierr from 1.7.0 to 1.8.0 @dependabot bump google.golang.org/grpc from 1.44.0 to 1.45.0 @dependabot bump google.golang.org/protobuf from 1.27.1 to 1.28.0 @dependabot bump helm.sh/helm/v3 from 3.8.0 to 3.8.1 @dependabot bump sigs.k8s.io/gateway-api from 0.4.1 to 0.4.2 @dependabot remove dependency on spire @lahabana chore(k8s): replace cni registry @lobkovilya chore(k8s): use appProtocol from service by default @jakubdyszkiewicz chore(kuma-dp): cleanup bootstrap version field @tharun208 fix(gateway): fix status updating in MeshGatewayInstance reconciliation @michaelbeaumont fix(gateway): gateway instance service reconciliation loops forever @jakubdyszkiewicz fix(gateway): gateway reconciliation loops forever @jakubdyszkiewicz fix(gateway): gateway tls listeners without hostnames @jakubdyszkiewicz fix(gateway): ignore non TCP protocol for provided gateway @lahabana fix(gateway): mesh gateway instance service target port @jakubdyszkiewicz fix(gateway): skip creating MeshGateways without proper attachment @jakubdyszkiewicz fix(helm): add prefix to `app` label in ingress/egress deployment @lahabana fix(helm): fix other template prefix in ingress/egress @lahabana fix(helm): remove wildcard rbac version @johnharris85 fix(k8s): reconcile serviceMaps when using mesh namespace annotation @lahabana fix(kuma-cp): avoid generating excessive envoy clusters @lobkovilya fix(kuma-cp): default policy creation @lobkovilya fix(kuma-cp): guard the nil version in metadata @jakubdyszkiewicz fix(kuma-cp): provide better message when running with an in-memory database @lukidzi fix(kuma-dp): better error message when the token is invalid @lahabana fix(kumactl): add mesh flag to only commands that uses it @tharun208 fix(kumactl): split yaml correctly in `kumactl apply` @lahabana fix(proxytemplate): avoid validation error @marcoferrer fix(proxytemplate): execute hooks before proxy template modifications @jakubdyszkiewicz perf(k8s): move outbounds from Dataplane to Config @jakubdyszkiewicz Released on 2022/04/06 chore(k8s): replace cni registry (backport #4070) fix(kuma-cp): default policy creation (backport #4073) fix(kuma-cp): guard the nil version in metadata (backport #3969) Released on 2022/02/23 feat(): zone egress feat(kuma-cp) data plane proxy membership feat(kuma-cp): reachable services in transparent proxying feat(inspect-api): retrieve full XDS config feat(): inspect api support feat(kuma-cp): add proxytemplate to matched policies for inspect poli contributed by @tharun208 feat(kuma-cp): enable traffic route for inspect endpoints contributed by @tharun208 feat(): move adminPort to DPP resource feat(helm): add imagePullSecrets support contributed by @johnharris85 feat(): enable Gateway with runtime flag feat(kumactl): add --api-timeout flag feat: allow for ca/identity secrets for every mesh feat(kuma-cp): allow extra cm in kuma cp chart contributed by @wjrbetts feat(kuma-cp): add gui link in index api response contributed by @tharun208 feat(): allow

to be in separate k8s secret feat(kumactl): add type of logging and tracing backends with name in table output contributed by @tharun208 feat(kuma-cp): enable client side gRPC keepalive feat(gui): new onboarding view feat(gui): link to documentation from policy view fix(kuma-cp): do not update unchanged insights fix(): do not annotate gateway services with ingress upstream fix(): properly escape DB password when creating postgres connection string fix(kuma-cp): fix missing label sidecar injection fix(kuma-dp): fix conntrack collisions contributed by @johnharris85 fix(conf): remove invalid health check fields from example contributed by @tharun208 fix(kuma-dp): binary lookup function skips not available directories fix(k8s): make sure controllers start after leader election fix(build): fix gomega matchers for inspect resources command test contributed by @tharun208 fix(kumactl): ignore any unregistered CRDs, not only from the root chart fix(kumactl): print meta before spec for Kuma resources fix(kuma-cp): add cp selector to global sync service fix(kuma-cp) do not override other dataplane with dp lifecycle fix(helm) Add support to customize nodeport contributed by @bhiravabhatla perf(kuma-cp): use mesh snapshot in proxy builder perf(kuma-cp): use mesh snapshot in gateway perf(kuma-cp): share mesh context improvement(metadata): include name of annotation to parse error message contributed by @ChinYing-Li refactor(insights): delete method GetLatestSubscription for insights contributed by @tharun208 refactor(kuma-cp): unify mesh determination for k8s objects refactor(): replace ensureDefaultXXX functions with a single generic function contributed by @tharun208 chore(zone-ingress): delete deprecated env KUMADATAPLANEADMIN_PORT chore(k8s): remove GetBool method and use GetEnabled contributed by @tharun208 chore(): generate CRD types chore(dataplane)!: disallow using 0.0.0.0 in networking.address for dp chore(kuma-cp): consolidate mesh defaults creation chore(config): remove ability to disable insights chore(): remove old Ingress chore(): upgrade Envoy to v1.21.1 chore(grafana): update to latest grafana plugin version ci(): release on every commit in master and release branches Released on 2021/12/15 feat: add kubernetes tags automatically perf: update Mesh and ServiceInsights only when really needed perf: eliminate uneccessary JSON marshalling feat: sidecar injection webhook based on labels chore: upgrade gui to new version test: fix postgress tests permissions feat: add affinity to CP and Ingress pods contributed by @andrey-dubnik chore: bump github.com/golang-jwt/jwt/v4 from 4.1.0 to 4.2.0 feat: consolidate tokens logic to support expiration, rotation, revocation and RSA256 fix: simplify cluster creation with endpoints fix: enable metrics hijacker for current version of Kuma fix: switch to mTLS when CP communicates with Envoy Admin chore: bump github.com/spiffe/spire from 0.12.3 to 1.1.1 chore: bump github.com/spf13/viper from 1.8.1 to 1.9.0 fix: validate cp url in dp conf chore: send reports to tls endpoint chore: check explicit service account name feat: inspect other dependencies versions chore: add area/gateway label chore: remove dp token from xds metadata refactor: move from io/ioutil to io and os packages contributed by @Juneezee fix: validate newly generated xDS snapshots chore: bump k8s.io/apiextensions-apiserver from 0.22.3 to 0.22.4 chore: bump helm chart version to 0.8 Released on 2021/11/19 chore() scripts for build, publish and fetch Envoy binaries chore(kuma-cp) upgrade gui to new version chore(kuma-cp) Use go structs instead of gotemplate for bootstrap chore(deps): bump github.com/slok/go-http-metrics from 0.9.0 to 0.10.0 Disable reporting by default chore(kumactl) remove install CRDs filter function feat(kuma-dp) Add conf to disable service vip chore(kuma-cp) update some TODO comments feat(kuma-cp) Add

annotation fix(kuma-dp) match gateway cluster names in the hijacker feat: add ECDSA certificate generator support feat: add more global resources to GlobalInsights feat: allow creating secrets for the not yet existing mesh contributed by cloudwiz feat: don't add v6 in DNS when v6 is disabled fix: explicitly disable dns in env when disabled in injector feat: added support for https tracing endpoint contributed by sudeeptoroy fix: normalize generating TLS certificates fix: zero downtime when enabling permissive mTLS feat: add deprecation notice for kuma-prometheus-sd feat: add GlobalInsights api endpoint fix: duplicate TLS certificate usage chore: add command argument count parameters feat: aggregate dp stats by type in MeshInsight chore: delete CLI flag '--bootstrap-version' feat: show the effective Dataplane address feat: aggregate services in MeshInsight fix: allow only one healthcheck feat: give CA managers all backends at once chore: normalize timeout configurer API fix: locality-aware lb for external-services feat: add install control-plane --version flag for all components feat: add zone selector to Kuma Mesh dashboard fix: possible to delete resources on Zone CP fix: make cluster names contextually unique feat: automatically enable gzip content on gateways feat: add Gateway TLS termination support feat: add gateway support for external services fix: enable secrets support for Gateway resources feat: initial connection policy support for Gateway feat: add access to generate zone ingress token feat: user token with RSA256 feat: prefix system users and groups with mesh-system feat: localhost is not an admin on kubernetes feat: user token enabled by default feat: Admin User Token bootstrap chore: refactor access control for individual access feat: support plugin based authentication including user tokens feat: User Token for API Server authentication chore: refactor authz and authn to plugins chore(kuma-cp) upgrade gui to new version chore() upgrade to Go 1.17.3 chore(deps): bump github.com/operator-framework/operator-lib chore(deps): bump github.com/gruntwork-io/terratest chore: update helm and controller-runtime chore: bump github.com/lib/pq from 1.10.3 to 1.10.4 chore: bump google.golang.org/grpc from 1.41.0 to 1.42.0 chore: bump github.com/prometheus/common from 0.31.1 to 0.32.1 chore: bump github.com/envoyproxy/protoc-gen-validate chore: bump github.com/google/uuid from 1.2.0 to 1.3.0 chore: bump sigs.k8s.io/controller-runtime from 0.10.2 to 0.10.3 chore: bump k8s.io/client-go from 0.22.2 to 0.22.3 chore: bump k8s.io/apiextensions-apiserver from 0.22.2 to 0.22.3 chore: bump k8s.io/api from 0.22.2 to 0.22.3 chore: bump github.com/golang-migrate/migrate/v4 chore: bump helm.sh/helm/v3 from 3.6.1 to 3.7.1 chore: bump github.com/miekg/dns from 1.0.14 to 1.1.43 in /pkg/transparentproxy/istio Released on 2021/10/06 fix: disable zone fix: limit number of postgres connection by default feat: add zone selector to Kuma Service to Service dashboard feat: add zone selector to Kuma Service dashboard feat: add zone selector to Kuma Dataplane dashboard fix: fix duplicates in dataplane list in Kuma Services dashboard chore: migrate install resources from rbac API v1beta1 to v1 fix: fault injection matching fix: delete kuma.io/region and kuma.io/sub-zone feat: print control plane version with version cmd fix: Only warn about version compatibility where it makes sense perf: remove insight update rate limit burst perf: apply ratelimit to service insights feat: adds support for specifying specific IP for cloud provider load balancers for ingress service contributed by @jamesdbloom fix: send tool output to stdout fix: switch to a Kuma fork of go-control-plane chore: parametrize label on the deployment perf: set Node only on first DiscoveryRequest feat: verify ServiceAccountToken bound to a Pod feat: internal dns should resolve AAAA records fix: Add FORMERR and NOTIMP in alternate default coredns conf fix: virtual probes with query fix: Avoid calling `Send()` from different goroutines feat: automatically set proxy concurrency feat: Improve builtin grafana setup to have traces and logs linked fix: Show gateway services in service-insights fix: Correct bad merging of duration fix: Ensure outbounds are set when migrating from old to new fix: get rid of regex for parsing IPs feat: add CP config to ZoneInsights feat: generate GatewayRoute clusters feat: add GatewayRoute route generation feat: match gateway routes feat: initial gateway TrafficRoute support feat: add a GatewayRoute resource chore: update base image for kuma-dp chore: change Go JWT version to fix security vunerability chore: bump go.uber.org/zap from 1.17.0 to 1.19.1 chore: bump google.golang.org/grpc from 1.38.0 to 1.40.0 chore: bump github.com/miekg/dns from 1.1.42 to 1.1.43 chore: upgrade github.com/spf13/cobra chore: bump alpine in /tools/releases/dockerfiles chore: bump github.com/onsi/gomega from 1.13.0 to 1.16.0 chore: update envoy to 1.18.4 Released on 2021/08/24 feat: remove provided ca cert validation contributed by Nikita Pande (@nikita15p) feat: Use kuma-sd in kumactl install metrics feat: Add new datasource to kumactl install metrics fix: remove extra endline in traffic log default template fix: TLSInspector is causing tcp healthcheck failures feat: Add rate-limit to outbound interfaces fix: print a newline with transparent proxy setup message chore: bump alpine in /tools/releases/dockerfiles chore: annotate required fields in proto files chore: remove MADS v1alpha1 chore: parametrize kuma tracing in ZipkinCollectorURL chore: Add the number of services to usage stats feat: Add the permissive mTLS mode chore: open CAProvider and MeshValidator for extensions feat: Add entity for virtual-outbound fix: Don't set

in debug log chore(kuma-cp) upgrade gui to new version , , , , , , feat: Build kuma on Windows , , feat: Add CA backend stats in Dataplane and Mesh Insights fix: missing key for kv in reports logging chore: split listener configurers across source files feat: add simple HTTP connection configurers feat: add virtual host domain name configurer feat: return instance and cluster IDs in kuma-cp API statuses tests: allow kuma-specific const to be overridden feat: Intermediate CA support fix: Avoid nil dereferencing in dp validator chore: consistently use utils package for protobuf wrappers fix: subscription finalizer, rev 2 tests: fix flaky test for locality aware loadbalancing fix: DP tracking lock consistency fix chore: Certificates over ADS chore: migrate DiscoveryRequest/Response in KDS to V3 feat: Rewrite dns persistence to allow virtual-outbound to be added fix: deleted default policy is created on Kuma CP restart chore: Move kumactl logging arguments to where they can be parameterized chore: add route and virtual host configuration helpers chore: fix kumactl generate dataplane proxy-type flag deprecation message contributed by Tharun Rajendran chore: Simplify resource-gen.go by generating `ResourceDescriptor` chore: Replace netcat with test server feat: configure SNI on ExternalService chore: add importas to golangci-lint contributed by Tharun Rajendran chore: add to resource-gen.go generation of kds options chore: add to

generation of kumactl options fix: add owner when create ZoneIngressInsight fix: hijacker merge labels chore: improve resource-gen by auto generating ws code fix: clarify invalid resource type message fix: implement TextMarshaler for JSON keys chore: simplify resourceWsDefinition and server init fix: Stop adding outbounds to dp for vips chore() make port validation consistent Released on 2021/07/29 fix(kumactl) warn about fail to check the CP version fix(kuma-cp) handle missing connection info chore(xds) rename logger to have consistent naming style contributed by burntcarrot fix(kuma-cp) set better keep-alive for bootstrap fix(kuma-dp) validate the DP proxy type fix(kuma-cp) use the typed config for TLS Inspector Released on 2021/07/16 feat: add datadog traffic tracing refactor: add kumactl install tracing context chore: improve kumactl install transparent-proxy flags description, add extra validation fix: broken SDS auth and XDS generation on rapid DP restarts fix: allow verbose log levels chore: use resource types for DataplaneInsight tracking chore: improve resource manager initialization readability chore: upgrade gui to new version , , fix: allocate a new VIP for ExternalService host fix: stop components on leader election lost chore: generate system resource wrappers , chore: remove access log V2 chore: generate DeepCopy interfaces chore: disable log sampling chore: upgrade Protocol Buffers chore: change default number of insights subscriptions chore: make the authentication interface type oblivious fix: fix hds disabled on dpserver contributed by Bastien Chatelard chore: refactor xDS metadata to store a generic resource feat: change KDS max message limit Released on 2021/06/30 fix: Dataplane/ZoneIngress/Zone status problem when control plane forcefully exits chore: reduce memory usage by reducing cache key size contributed by nhamlh fix: ZoneIngress always shows up as 'offline' feat: dataplane use advertise address to add a routable ip if address is not public ip contributed by sudeeptoroy fix: builtin DNS resolve alias with dots feat: add SNI to TLSed ExternalServices fix: fix race condition in cache contributed by nhamlh fix: supported versions of Kuma DP in the GUI Released on 2021/06/17 feat: Introduce ZoneIngress feat: enable dataplane dns by default feat: add --verbose flag to kuma-init feat: log rotation contributed by @nikita15p feat: mads, allow specifying fetch-timeout via query param contributed by @austince feat: mads, add support for HTTP long polling contributed by @austince feat(mads) implement v1 API contributed by @austince feat: add RateLimit policy feat: TrafficRoute L7 feat: allow renegotiation for TLS in ExternalServices feat: pass header when communicating with CP contributed by sudeeptoroy feat: change default traffic route policy feat: command to install kong enterprise ingress feat: add postgres max idle connections configuration contributed by @nikita15p feat: add kumactl --no-config flag feat: nodeselector across all pods with HELM feat: enable forwarding XFCC header contributed by @jewertow feat: TrafficPermission for ExternalServices feat: metrics hijacker feat: extend CircuitBreaker chore: remove API V2 chore: bump webhooks version chore: drop deprecated Envoy options chore: dockerfiles, add a user for kuma-cp chore: bump cni version to 0.0.9 chore: rename remote cp to zone cp chore: bump versions of logging, metrics, tracing chore: parametrize bitnami/kubectl chore: backwards compatible metrics chore: upgrade Envoy version to 1.18.3 chore updated go-control-plane contributed by @sudeeptoroy chore: fix misspelled words contributed by @tharun208 chore: upgrade GUI chore namespace source names for v1 API contributed by @austince chore: use cmux for MADS server chore: Add internal support for outbound UDP listeners contributed by @lahabana chore: Avoid generating duplicate subsets in ingress contributed by @lahabana chore: upgrade to apiextensions.k8s.io/v1 contributed by @austince fix: Clear snapshots from cache on disconnect contributed by @lahabana fix: use service account name to identify sync fix: raise the regex program size limit fix: pass query parameters through the metrics hijacker fix: matching endpoints by