github kubernetes-sigs/gateway-api v1.6.0-rc.1
on GitHub

pre-release5 hours ago

Major Changes Since v1.5.1

GEP & API Graduation

  • UDPRoute & TCPRoute Graduation:
    • UDPRoute has graduated to GA. We recommend using the "v1" API version with this API now. The "v1alpha2" version of this API is deprecated and will be removed in the future. (#4923, @zac-nixon)
    • TCPRoute has graduated to GA. We recommend using the "v1" API version with this API now. The "v1alpha2" version of this API is deprecated and will be removed in the future. (#4920, @zac-nixon)
  • GEP Status Updates:

Feature

  • API & Validation Enhancements:
    • API validation updated for HTTPRoute retries: retry.codes must now be unique and retry.attempts must be >= 1. (#4907, @snorwin)
    • Increase the number of allowed Certificate Authority references from 8 to 16. (#4088, @root30)
    • The TLSRoute CRD validation has been adjusted to allow up to 4096 hostnames and rules per TLSRoute resource. Operators must validate kube-apiserver, etcd and Gateway controller behavior with representative manifests prior to enabling the new limit in production. (#4332, @alexanderstephan)
    • BackendTLSPolicy now can be used in combination with other routes types. (#4745, @rikatz)
    • Allow the usage of up to 16 annotations on the gateway infrastructure object. (#4707, @wenisman)
  • Graduations:
    • CORS filter is now part of the standard channel. (#4521, @rikatz)
  • ValidatingAdmissionPolicy (VAP):
    • Adds a VAP that prohibits:
      • Installation of experimental CRDs on top of standard channel CRDs (within the same API group).
      • Installation of monthly releases.
      • Installation of older releases. (#4533, @robscott)
  • Conformance Infrastructure:
    • Added conformance tests for UDPRoute (GEP-2645), a new GATEWAY-UDP conformance profile, a SupportTCPRoute feature, and a UDP/TCP echo server in echo-basic gated on UDP_ECHO_SERVER. (#4861, @zac-nixon)
  • Remove the idleTimeout field from the experimental SessionPersistence API. (#4771, @gcs278)

Documentation

  • Migration & Site Updates:
  • New Documentation:
  • API Specs & Guidance Clarifications:
    • Add missing apidoc for BackendTLSPolicy extended support. (#4828, @rikatz)
    • Add the missing ListenersNotValid programmed reason for listenerSets. (#4586, @davidjumani)
    • Added documentation guidance recommending GRPCRoute for gRPC traffic. (#4513, @kahirokunn)
    • Clarified CORS API documentation to describe behavior based on allowCredentials instead of credentialed requests. (#4663, @snorwin)
    • Previously, implementations were required to reject GRPCRoute and HTTPRoutes on the same hostname (however, few implementations did this). Now, implementations may optionally do this, or allow them to coincide. (#4598, @howardjohn)
    • Updates the documentation around the ListenerConditionConflicted condition. (#4659, @davidjumani)
  • Releases & Results:
    • Add AWS Load Balancer Controller conformance results for v1.5.0 Gateway API. (#4733, @zac-nixon)
  • Fixes:

Bug or Regression

  • IPv6 Support:
    • Fix GatewayFrontendClientCertificateValidationInsecureFallback, GatewayFrontendClientCertificateValidation, and GatewayFrontendInvalidDefaultClientCertificateValidation failing on IPv6 clusters. (#4636, @zirain)
    • Fix GatewayFrontendInvalidDefaultClientCertificateValidation failing on IPv6 clusters. (#4629, @zirain)
  • ValidatingAdmissionPolicy (VAP) Fixes:
    • Fixed an issue where the ValidatingAdmissionPolicy prevented experimental CRDs from being installed at all (instead of only when standard CRDs already exist). (#4603, @howardjohn)
    • Fixed the safe-upgrades ValidatingAdmissionPolicy to allow upgrades of experimental CRDs. (#4557, @snorwin)
  • CRD & Schema Validation:
    • Generated Gateway API CRD install manifests no longer include top-level CustomResourceDefinition status fields with invalid null values, fixing strict schema validation failures in tools such as kubeconform. (#4712, @MatteoFari)
    • Replace omitempty with omitzero for supportedKinds in ListenerStatus to preserve backward compatibility for controllers reconciling older Gateway API versions. (#4551, @snorwin)
  • API & Validation Fixes:
    • It is disallowed to have repeated filters of type CORS. (#4639, @DamianSawicki)
    • Limit HTTPRouteHTTPSListenerDetectMisdirectedRequests to h2 only. (#4665, @zirain)
    • Make explicit call about resource names requiring to be RFC 1035 compliant. (#4787, @rikatz)
    • Make referencegrant.spec field required. (#4845, @bexxmodd)

Test & Conformance

  • New Conformance Tests:
    • Add conformance test ListenerSetAllowedRoutesCrossNamespace which verifies that a ListenerSet only allows routes in its own namespace by default. (#4841, @asauber)
    • Added a conformance test covering the Gateway Accepted condition with reason ListenersNotValid and the Listener Accepted condition with reason UnsupportedProtocol. (#4807, @snorwin)
    • Added conformance test GatewayInvalidParametersRef that verifies a Gateway referencing an invalid parameters is rejected. (#4808, @snorwin)
    • Conformance: add ListenerSet tests for Route parentRef cases. (#4912, @asauber)
    • Implement conformance test for CORS. (#4494, @rikatz)
  • Test Machinery & Framework Updates:
    • Conformance: ExpectMirroredRequest now starts its log window before the requests are sent, so mirrors are not missed on high-latency data planes. (#4952, @lexfrei)
    • The default polling interval for conformance tests has been decreased. This can be modified by the new DefaultPollInterval. (#4570, @howardjohn)
    • The gRPC conformance request helper no longer closes a caller-supplied (injected) Options.GRPCClient; it closes only the DefaultClient it creates internally. This lets implementations reuse a custom gRPC client across requests. (#4953, @lexfrei)
  • Updates & Fixes to Existing Tests:
    • The conflicted=false condition is not required anymore in the listener status for non-conflicted listeners. (#4642, @zhaohuabing)
    • Fix TLSRoute conformance test to stop relying on self-signed certificates. (#4930, @rikatz)
    • Fixed MeshHTTPRoute307Redirect conformance test bug where the wrong manifest was used. (#4806, @jgreeer)
    • Update Gateway version to v1 in UDP conformance test. (#4722, @cnvergence)
    • Updated the TLSRoute conformance tests to allow FINs where previously RST was asserted. (#4615, @howardjohn)

What's Changed

New Contributors

Full Changelog: monthly-2026.05...v1.6.0-rc.1

Check out latest releases or
releases around kubernetes-sigs/gateway-api v1.6.0-rc.1

Don't miss a new gateway-api release

NewReleases is sending notifications on new releases.

Get notifications