Changelog
- chore(deps): bump envoy from 1.38.4 to 1.38.7 #19075 #19143 @lukidzi
- chore(deps): bump golang.org/x/net from 0.58.0 to 0.60.0 #19032 @renovate
- feat(kds): name the resource type and size of the largest response when a KDS stream fails with ResourceExhausted #18839 @kumahq
- feat(meshtrafficpermission): merge from and rules #18774 @lukidzi
- feat(xds): let operators restrict default outbound #18851 @lukidzi
- fix(api-server): make kuma.io/origin immutable (backport of #18412) #18991 @bartsmykla
- fix(charts): drain zone ingress before shutdown #18951 @lukidzi
- fix(helm): stop zone proxy roll on 2.14 #18883 @lukidzi
- fix(k8s): drop reserved pod labels from Dataplanes (backport of #18648) #18996 @bartsmykla
- fix(k8s): read system-namespace-only resources from the system namespace only (backport of #19051) #19129 @kumahq
- fix(k8s): ready inbounds behind ignored selector labels in Exclusive mode #19016 @lobkovilya
- fix(kuma-cp): keep ZoneIngress working without inbound tags #19022 @bartsmykla
- fix(kuma-dp): avoid double scrape on otel export #18871 @bartsmykla
- fix(kumactl): warn when the server's major version is higher than kumactl's, including preview servers #19043 @Automaat
- fix(mesh): drop inbound service check #18982 @Automaat
- fix(meshexternalservice): accept SecureDataSource #18867 @lukidzi
- fix(meshhealthcheck): one health check per MES #18878 @lukidzi
- fix(meshhttproute): keep gateway routes valid #19017 @lukidzi
- fix(meshmetric): require client certs for ActiveMTLSBackend #19027 @bartsmykla
- fix(meshpassthrough): correct typo on 2.14 #18880 @lukidzi
- fix(meshpassthrough): validate by filter chain #18988 @slonka
- fix(meshservice): reconcile selector on 2.14 #18877 @lukidzi
- fix(meshservice): skip ServiceTag without mTLS #18920 @lukidzi
- fix(meshtimeout): keep zone egress rule timeouts #18980 @lukidzi
- fix(meshtrafficpermission): reject empty match entries (backport of #19020) #19021 @kumahq
- fix(store): keep labels on the resource after a postgres update (backport of #18929) #18936 @kumahq
- fix(xds): accept legacy SANs for MeshMultiZoneService in identity migration #19056 @bartsmykla
- fix(xds): keep every MES matched by reachable refs #18834 @lukidzi
- fix(xds): send KRI SNI to mesh-scoped zones #18943 @lukidzi
- fix(xds): speed up Envoy stats tag extraction (backport of #18910) #18913 @kumahq
- fix(xds): use port name for explicit outbounds #19002 @lukidzi
- fix: zone CP no longer adds kuma.io/zone to tag-less gateways in Exclusive mode, so they pass validation #18984 @Automaat
- perf(api-server): cache inspection endpoint reads (backport of #18844) #18846 @kumahq