Changelog
- chore(deps): bump coredns to v1.14.7 #18319 @lukidzi
- chore(deps): bump distroless base images #18119 @bartsmykla
- chore(deps): bump envoy from 1.36.9 to 1.36.10 #18224 @lukidzi
- chore(deps): bump github.com/cilium/ebpf from 0.20.0 to 0.22.0 #18108 @renovate
- chore(deps): bump github.com/google/cel-go from 0.29.0 to 0.30.0 #18140 @renovate
- chore(deps): bump github.com/moby/go-archive from 0.1.0 to 0.3.3 #18111 @bartsmykla
- chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 #18359 @renovate
- chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 #18589 @renovate
- chore(deps): security update #18067 #18306 @kumahq
- chore(helm): control plane, hook, ingress and egress containers now drop all Linux capabilities and disallow privilege escalation #18129 @bartsmykla
- feat(labels): compute
kuma.io/display-namefor all resources (backport of #17162) #18164 @kumahq - feat(labels): compute
kuma.io/originon global and zone control planes (backport of #17176) (backport of #18279) #18370 @kumahq - fix(k8s): enforce control-plane-owned labels on read (backport of #18271) #18396 @kumahq
- fix(k8s): reconcile pods that match a Service only once ignoredServiceSelectorLabels are stripped #18540 @kumahq
- fix(k8s): reject user-set service-account label (backport of #18273) #18288 @kumahq
- fix(k8s): scope gateway mapper logger per call #18215 @lukidzi
- fix(labels): make Compute authoritative for zone, env, namespace and service-account (backport of #18410) #18578 @kumahq
- fix(meshhttproute): resolve mirror backendRef (backport of #17676) #17850 @kumahq
- fix(meshidentity): reconcile the MeshTrust trust domain when it changes #18617 @kumahq
- fix(meshmetric): honor includeUnused sidecar flag #18482 @kumahq
- fix(meshtls): apply tls params without inbounds (backport of #18444) #18445 @kumahq
- fix(xds): stop status-only writes forcing mesh-wide xDS recomputation #18623 @kumahq
- perf(rules): cut allocations in rule building (backport of #17954) #18046 @kumahq