kumahq/kuma v3.0.0 on GitHub

We are excited to announce Kuma 3.0!

Kuma 3.0 is a major release. It removes the legacy APIs that 2.x deprecated and changes several defaults, so most deployments need changes before the upgrade. Read the upgrade guide before you upgrade.

Notable Changes

Legacy policies removed - the 12 legacy policies (TrafficPermission, TrafficRoute, TrafficLog, TrafficTrace, HealthCheck, CircuitBreaker, Retry, Timeout, RateLimit, FaultInjection, VirtualOutbound and ProxyTemplate) and the legacy ExternalService are gone. Use the Mesh* targetRef policies and MeshExternalService. A new Mesh no longer comes with default policies.

Mesh.mtls removed - use MeshIdentity and MeshTrust for mTLS.

Services without tags - the kuma.io/service tag and the inbound tags are removed from Dataplane, and meshServices is removed from Mesh, so MeshService is always on.

Zone proxies are mesh-scoped only - the standalone ZoneIngress and ZoneEgress resources are removed.

Built-in gateway removed - MeshGateway, MeshGatewayRoute, MeshGatewayInstance and MeshGatewayConfig are gone, together with the north-south Gateway API support.

Control plane modes - standalone mode is removed, and a global control plane must run on Universal.

Data plane - by default, data plane proxies get outbounds only for their reachableBackends, delta xDS is the only xDS protocol, and CoreDNS and the eBPF transparent proxy are removed.

Stricter resources - names of Mesh, Zone, MeshService, MeshExternalService and MeshMultiZoneService must be RFC 1035 labels, fields that are not in the schema are rejected, and control-plane-owned labels are validated.

Multizone - zones authenticate to the global control plane with zone tokens, and zone token secrets are no longer synced to zones.

Performance - many KDS, xDS and API server performance improvements.

Changelog

chore(helm): the control plane and hook containers now drop all Linux capabilities and disallow privilege escalation #18124 @bartsmykla
control plane now computes the kuma.io/display-name label for all resources #17162 @lobkovilya
feat(api-server)!: remove legacy overview paths #18367 @Automaat
feat(api-server)!: remove legacy policies endpoint #18375 @Automaat
feat(api-server)!: remove ServiceInsight endpoints #18376 @Automaat
feat(api-server): add isInsight and adminOnly to _resources entries #18544 @Automaat
feat(api-server): add clusters to layout listeners #18353 @Automaat
feat(api-server): add create-only resource endpoints #18990 @lobkovilya
feat(api-server): add KRI overview endpoint #18351 @Automaat
feat(api-server): add mesh _overview endpoints #18349 @Automaat
feat(api-server): add pluggable per-route metadata provider #17365 @bartsmykla
feat(api-server): filter overviews by status #18352 @Automaat
feat(api-server): remove cross-mesh resource listing #18999 @Automaat
feat(api-server): remove legacy per-policy inspect endpoints #18405 @Automaat
feat(ca): increase default cert lifetime to 5 days #17878 @lukidzi
feat(config)!: remove experimental auto reachable services #17200 @Automaat
feat(db): add tolerateNewerDBVersions flag #17019 @slonka
feat(defaults)!: stop auto-creating default TrafficPermission/TrafficRoute #17316 @Automaat
feat(deps)!: migrate module path to /v3 #16997 @Automaat
feat(dns)!: remove CoreDNS from data plane #17230 @lukidzi
feat(dp)!: select reachableBackends by labels only #18832 @lukidzi
feat(gateway)!: drop legacy connection policies + GatewayRoute #17446 @Automaat
feat(gatewayapi): accept MeshService as parent and backend ref #18013 @Automaat
feat(gatewayapi): honor parentRef port names #18051 @Automaat
feat(gatewayapi): route mesh gRPC traffic with GRPCRoute #18280 @Automaat
feat(helm): configurable zone proxy probes #17228 @lukidzi
feat(intercp): add version to catalog instance #17164 @slonka
feat(kds): add zone-version header to KDS client #17670 @lobkovilya
feat(kds): authenticate zones with zone token #18803 @lukidzi
feat(kds): name the resource type and size of the largest response when a KDS stream fails with ResourceExhausted #18727 @lukidzi
feat(kds): stop syncing zone token secrets #18855 @lukidzi
feat(kubernetes): reject global mode in bootstrap on k8s #17479 @Automaat
feat(kuma-cp)!: remove inbound tags from Dataplane #17867 @Automaat
feat(kuma-cp): default DPP refresh interval to 10s #18384 @lukidzi
feat(kuma-cp): default inboundTagsDisabled to true #17596 @Automaat
feat(kuma-cp): reject fields not in the schema on resource write #18858 @bartsmykla
feat(kuma-cp): reload TLS certs without restart #17882 @lukidzi
feat(kuma-dp): default unifiedResourceNaming to true #17483 @Automaat
feat(kuma-dp): log resolved DNS queries, and add a per-component log level for kuma-dp #18554 @Automaat
feat(labels): compute kuma.io/origin on global and zone control planes #17176 @lobkovilya
feat(labels): drop the legacy proxy label scrub from Compute #18753 @lobkovilya
feat(labels): enforce kuma.io/origin and kuma.io/zone on read #18579 @lobkovilya
feat(labels): reject a control-plane-owned label whose value differs from the computed one #18760 @lobkovilya
feat(labels): reject unknown reserved keys and validate user-settable label values on every write #18759 @lobkovilya
feat(mads): restrict to universal deployment mode #17868 @Automaat
feat(mesh)!: remove kuma.io/service tag #18392 @Automaat
feat(mesh)!: remove legacy policy resource definitions #17484 @Automaat
feat(mesh): default nil meshServices to Exclusive #17102 @Automaat
feat(mesh): remove meshServices.mode API from Mesh #17476 @Automaat
feat(meshhttproute): support backend request header modifiers #18278 @Automaat
feat(meshidentity): make the SPIFFE ID immutable #18669 @Automaat
feat(meshidentity): validate user-supplied CAs #17930 @lukidzi
feat(meshpassthrough)!: default to None #18842 @lukidzi
feat(meshtls): remove deprecated from[] #17598 @lukidzi
feat(motb): deprecate inline OTel endpoint #16023 @bartsmykla
feat(policy)!: drop MeshAccessLog OTel Endpoint for BackendRef #17564 @Automaat
feat(policy)!: remove deprecated from[] from MeshCircuitBreaker #17570 @Automaat
feat(policy): MLBS on zone proxy egress #17718 @lukidzi
feat(readiness): gate on identity cert #18558 @Automaat
feat(resources)!: enforce RFC 1035 names #18026 @lukidzi
feat(store)!: always enable resource store cache #18729 @Automaat
feat(tproxy): remove eBPF transparent proxy feature #17225 @lukidzi
feat(validation): restrict crossZone to MeshMultizoneService #18210 @Automaat
feat(xds)!: default reachableBackends to empty #18831 @lukidzi
feat(xds)!: drop legacy CircuitBreaker from xDS generation #17345 @Automaat
feat(xds)!: drop legacy HealthCheck from xDS generation #17324 @Automaat
feat(xds)!: drop legacy Timeout consumption from xDS generation #17398 @Automaat
feat(xds)!: drop RateLimit from xDS generation #17323 @Automaat
feat(xds)!: drop TrafficPermission from xDS generation #17428 @Automaat
feat(xds)!: drop TrafficRoute from xDS generation #17423 @Automaat
feat(xds)!: drop TrafficTrace from xDS generation #17384 @Automaat
feat(xds)!: drop VirtualOutbound from xDS generation #17415 @Automaat
feat(xds): add mesh context build duration metric #18685 @Automaat
feat(xds): make delta xDS the default and remove SOTW #17040 @Automaat
feat(xds): unified-name for empty listener tags #17563 @lukidzi
feat(xds): warn on stream close after large send #16784 @Automaat
fix API server configuration error aggregation #18421 @Automaat
fix applying resources whose name is longer than 63 characters on Universal #18336 @lobkovilya
fix malformed API label filters #18420 @Automaat
fix(api): align HTTP API with its error schema #19155 @kumahq
fix(api-server)!: match layout to generated xDS #18837 @lukidzi
fix(api-server): align catalog writability #18449 @Automaat
fix(api-server): always render zone in a zone overview #18663 @Automaat
fix(api-server): check kuma.io/origin on federated zones for every resource type #18698 @lobkovilya
fix(api-server): inline REST for non-proto specs #18545 @Automaat
fix(api-server): make kuma.io/origin immutable and reject writes to foreign-origin resources #18412 @lobkovilya
fix(api-server): make startup transactional #18423 @Automaat
fix(api-server): reject kuma.io/zone on Global and validate kuma.io/mesh on every mode #18419 @lobkovilya
fix(api-server): rules panic and role validation #16978 @Automaat
fix(api-server): send Content-Type on GUI fallback responses #18399 @Automaat
fix(api-server): validate name path parameters #19156 @kumahq
fix(auth): require workload-bound token for workload-derived identity #17474 @bartsmykla
fix(charts): drain zone egress before shutdown #18568 @lukidzi
fix(charts): drain zone ingress before shutdown #18950 @lukidzi
fix(config): enforce RFC1123 compliance for zone names #18011 @Automaat
fix(dashboards): use labels emitted by kuma-dp #18574 @lukidzi
fix(dataplane): reject unknown enum values #19111 @kumahq
fix(gatewayapi): break HTTPRoute conflicts by creationTimestamp #18272 @Automaat
fix(gatewayapi): deny traffic when a backendRef is not permitted #18267 @Automaat
fix(gatewayapi): fail closed on missing backendRef port #18141 @Automaat
fix(gatewayapi): fail closed when a backendRef does not resolve #18009 @Automaat
fix(gatewayapi): give a generated producer route the producer role #18203 @Automaat
fix(gatewayapi): harden generated meshhttproute names #18274 @Automaat
fix(gatewayapi): reject headless service route parents #18150 @Automaat
fix(gatewayapi): reject route filters the mesh cannot apply #18297 @Automaat
fix(gatewayapi): require ReferenceGrant for cross-namespace backendRefs #18075 @Automaat
fix(helm): allow universal global control plane #18212 @slonka
fix(helm): deny loopback admin and restore parentEnv in universal mode #18452 @bartsmykla
fix(helm): drop legacy Gateway API route CRUD from control-plane workloads RBAC #19045 @kumahq
fix(helm): honor dataPlane.image.pullPolicy in the injected sidecar and init containers #19025 @Automaat
fix(helm): label system namespace on upgrade #19047 @slonka
fix(helm): match Zone in the defaulting webhook #18601 @Automaat
fix(helm): restore global zone sync service #18256 @slonka
fix(helm): skip installing CRDs by default when installing in universal #16078 @lahabana
fix(helm): stop zone proxy roll on upgrade #18882 @lukidzi
fix(insights): don't mark data plane proxies as degraded because of ignored inbounds #18734 @Automaat
fix(inspect-api): skip DNS validation for HostnameGenerator hostnames #17016 @lobkovilya
fix(intercp): distinguish unreachable leader from leader change #17068 @Automaat
fix(k8s): always probe the sidecar readiness port #18346 @Automaat
fix(k8s): copy node labels to Dataplane labels #17480 @lukidzi
fix(k8s): dedup inbounds only when tags disabled #17197 @lukidzi
fix(k8s): default sidecar concurrency to 2 #18696 @lukidzi
fix(k8s): drop Mesh owner from MeshZoneAddress #18749 @lukidzi
fix(k8s): drop reserved pod labels before computing Dataplane labels #18411 #18648 @lobkovilya
fix(k8s): enforce control-plane-owned labels on read #18271 @lobkovilya
fix(k8s): parse kuma.io/gateway as a boolean #18354 @Automaat
fix(k8s): read system-namespace-only resources from the system namespace only #19051 @lobkovilya
fix(k8s): reconcile pods that match a Service only once ignoredServiceSelectorLabels are stripped #18441 @Automaat
fix(k8s): reject mesh not matching ownerReference #18060 @Automaat
fix(k8s): reject user-set service-account label #18273 @lukidzi
fix(k8s): stop dropping traffic on selector move #18561 @lukidzi
fix(kds): attribute zone-to-global synced resources by the connecting zone's client-id #17456 @bartsmykla
fix(kds): keep 2.14 zones serving MeshServices behind a 3.0 global #18870 @bartsmykla
fix(kds): keep zone KDS multiplex alive when a diagnostic rpc stream fails #19009 @kumahq
fix(kds): omit MeshTrust status from sync #18598 @Automaat
fix(kds): only accept subscribed resource types #19062 @slonka
fix(kds): replace rather than merge when reading a spec from the JSON wire form #18672 @Automaat
fix(kds): restore event-based watchdog intervals #18621 @Automaat
fix(kds): retry sync updates on write conflicts #17738 @lukidzi
fix(kds): survive oversized Envoy admin responses #18127 @lukidzi
fix(kuma): unwrap DeletedFinalStateUnknown in k8s event listener #17066 @Automaat
fix(kuma-cp): advertise a zone ingress node that serves traffic #18078 @lukidzi
fix(kuma-cp): leave headroom below GOMEMLIMIT #18853 @lukidzi
fix(kuma-dp): avoid double scrape on otel export (backport of #18871) #18906 @kumahq
fix(kuma-dp): restrict readiness reporter to /ready #17317 @bartsmykla
fix(kumactl): strip kuma.io/zone from federation exports #18730 @bartsmykla
fix(kumactl): use current policy inspect API #18425 @Automaat
fix(kumactl): warn when the server's major version is higher than kumactl's, including preview servers #19042 @Automaat
fix(labels): make Compute authoritative for zone, env, namespace and service-account #18410 @lobkovilya
fix(mesh): gateway tag not required tagless #17610 @Automaat
fix(meshaccesslog): match rule-scoped route ids #17548 @Automaat
fix(meshhttproute): 503 for valid all-zero refs #19053 @slonka
fix(meshhttproute): resolve mirror backendRef #17676 @lukidzi
fix(meshhttproute): return 404 when no route rule matches #18268 @Automaat
fix(meshhttproute): return 500 for unresolvable backendref shares #18146 @Automaat
fix(meshhttproute): return 503 for zero-weight backends #18340 @Automaat
fix(meshhttproute): sort pathless match as root #19018 @lukidzi
fix(meshidentity): reconcile labels on generated MeshTrusts #18989 @lobkovilya
fix(meshidentity): reconcile the MeshTrust trust domain when it changes #18607 @Automaat
fix(meshmetric): honor includeUnused sidecar flag #18477 @Automaat
fix(meshmetric): require client certs for ActiveMTLSBackend #19026 @bartsmykla
fix(meshpassthrough): correct validator typo #18879 @lukidzi
fix(meshpassthrough): drop duplicate chain matches #18226 @lukidzi
fix(meshpassthrough): keep mysql port excludes #19024 @slonka
fix(meshpassthrough): resolve domain matches in the sidecar so they pin the destination #18658 @Automaat
fix(meshproxypatch): honor circuit breaker patches #18207 @lukidzi
fix(meshproxypatch): match unified listener names #17545 @Automaat
fix(meshservice): identities fallback tagless #17657 @Automaat
fix(meshservice): reconcile generated selector #18876 @lukidzi
fix(meshservice): stop telling clients to originate mTLS before the destination can terminate it #18475 @Automaat
fix(meshtimeout): keep zone egress rule timeouts #18979 @lukidzi
fix(meshtimeout): rules/to are mutually exclusive #17589 @Automaat
fix(meshtls): allow TLS 1.3 on outbound mTLS #18865 @lukidzi
fix(meshtls): apply the TLS version and ciphers to the upstream side of proxies that have no inbounds, such as delegated gateways #18444 @Automaat
fix(meshtls): honor inbound ports and tls bounds #17847 @lukidzi
fix(meshtls): sort inbound SAN matchers for stable config #17144 @lukidzi
fix(meshtrafficpermission): reject empty match entries #19020 @bartsmykla
fix(mtls): derive identity without tags #17606 @Automaat
fix(mtls): drop legacy identity secret when MeshIdentity is assigned #16947 @lukidzi
fix(mtp): unified naming for zone egress #17560 @Automaat
fix(oas): always serve dataplane outbound address #18668 @Automaat
fix(oas): render proto enums as string enums #18350 @Automaat
fix(oas): require pagination fields on list endpoints #18666 @Automaat
fix(observability): use NoBackendRefsConfigured reason when no MeshOpenTelemetryBackend references are configured #19010 @kumahq
fix(policy): scope producer role to own namespace #18848 @slonka
fix(resyncer): change log level from error to info #18269 @lobkovilya
fix(ServiceInsight): keep delegated gateways when meshServices.mode is Exclusive #17431 @lobkovilya
fix(store): keep labels on the resource after a postgres update #18929 @lobkovilya
fix(tokens): correct admin token extraction hint #18828 @slonka
fix(tokens): reject a non-string kid header and recover from dp-server handler panics #17465 @bartsmykla
fix(version): accept the previous major's last minor as compatible #19135 @kumahq
fix(xds): avoid panic when fetching resources fails in base mesh context #17675 @lobkovilya
fix(xds): build cross-zone SNI from port name #17739 @lukidzi
fix(xds): de-gate mTLS-only paths for MeshIdentity #17931 @lukidzi
fix(xds): do not mutate the cached Dataplane #18751 @lukidzi
fix(xds): drop MES with unloadable TLS material #18873 @lukidzi
fix(xds): drop resourceVersion from Dataplane hash #17127 @Automaat
fix(xds): empty reachable labels select all #18860 @lukidzi
fix(xds): fix inbound cluster name lookup #17504 @Automaat
fix(xds): fix unified naming detection for zone proxies #17511 @Automaat
fix(xds): ignore workload status in mesh hash #17064 @Automaat
fix(xds): keep every MES matched by reachable refs #18833 @lukidzi
fix(xds): pick up recreated same-name policies #18731 @lukidzi
fix(xds): probe fallback route uses unified cluster name #17498 @Automaat
fix(xds): reject unsupported SOTW streams #18343 @Automaat
fix(xds): resync dataplanes when identity is ready #17764 @lukidzi
fix(xds): skip zone egress without identity #18747 @lukidzi
fix(xds): speed up Envoy stats tag extraction #18910 @bartsmykla
fix(xds): throttle dataplane cert issuance on CA failure #17448 @slonka
fix(xds): unified naming for zone-proxy admin cluster #17543 @Automaat
fix(xds): use resolved dataplane addr in mesh ctx #17836 @lukidzi
fix(xds): validate labels of the Dataplane passed to kuma-dp run #18898 @lobkovilya
fix(xds): wait for destination TLS before mTLS #17848 @lukidzi
fix: preserve explicit inbound service-tag identity for mixed-label Universal dataplanes after inboundTagsDisabled removal #17728 @Automaat
honor the API server maximum TLS version #18422 @Automaat
KDS no longer tears down the stream when the store rejects a single synced resource - the resource is NACKed and the rest of the batch is applied. #18077 @lukidzi
perf(api-server): cache inspection endpoint reads #18844 @slonka
perf(api-server): cache the dataplane _rules inspection endpoint (backport of #17760) #18843 @kumahq
perf(k8s): reuse manager informers for events #18852 @lukidzi
perf(kds): align flush ticks across zones #18624 @Automaat
perf(kds): cache the zone lookup in sync filter #18626 @Automaat
perf(kds): carry unchanged types over verbatim #18625 @Automaat
perf(kds): reuse versions for unchanged types #18622 @Automaat
perf(kds): share mapped resources across zones #18638 @Automaat
perf(mads): reuse MeshMetric matches per mesh #18687 @Automaat
perf(matchers): add LRU cache for MatchedPolicies #17017 @Automaat
perf(xds): rebuild mesh context parts on their own #18684 @Automaat
perf(xds): replace proto.Equal with content hashes in reconcile #17008 @Automaat
perf(xds): reuse unchanged mesh context parts #18683 @Automaat
perf(xds): stabilize policy matching hash #18686 @Automaat
refactor(api)!: remove the kuma.io/gateway label and annotation #18662 @Automaat
refactor(api)!: remove the ServiceInsight resource #18538 @Automaat
refactor(core): remove Kafka as a supported protocol #17831 @Automaat
refactor(dataplane): mark gateways with a label #18366 @Automaat
refactor(defaults)!: a new Mesh no longer comes with default policies #18661 @bartsmykla
refactor(defaults): remove default policy updates #18342 @Automaat
refactor(mesh)!: drop non-Exclusive meshServices.mode branches #17457 @Automaat
refactor(targetref)!: narrow backendRef kinds #18391 @Automaat
refactor(xds): remove legacy reachableServices #17615 @lukidzi
Remove the BUILTIN gateway type, the gatewayBuiltin insight statistics and the ?gateway=builtin filter #18058 @lukidzi
Remove unused control plane DNS settings and correct the control plane configuration reference. #19146 @lobkovilya
Removed a noisy info log emitted on every MADS snapshot generation when both MeshMetrics and Mesh 'metrics' were configured. #17069 @lobkovilya
chore(deps): bump Kong/kong-mesh-v3-readiness from 0.1.0 to 0.6.4 #17021 #17023 #17026 #17950 #18183 #18464 #18717 #18957 #19089 @renovate
chore(deps): bump ci-tools/release-tool from 1.4.6 to 1.5.0 #19013 @kumahq
chore(deps): bump cirello.io/pglock from 1.16.1 to 1.18.0 #17334 #18961 #19092 @renovate
chore(deps): bump coredns from 1.14.2 to 1.14.6 #17368 @renovate
chore(deps): bump debian from 13.5 to 13.7 #17645 #18815 @renovate
chore(deps): bump debian:13.5 from 4ae6766 to d07d1b5 #16950 #17043 @renovate
chore(deps): bump debian:13.6 from fac46bf to f324c7f #17937 #18237 @renovate
chore(deps): bump debian:13.7 from 9cc0800 to 913f670 #19077 @renovate
chore(deps): bump envoy from 1.38.2 to 1.39.4 #17022 #17427 #18228 #19070 #19144 @lukidzi,@renovate
chore(deps): bump gcr.io/distroless/base-nossl-debian12:debug from 35a3865 to 51c3587 #17325 #17485 #18085 #18171 @renovate
chore(deps): bump gcr.io/distroless/base-nossl-debian12:debug-nonroot from 6cec643 to 83b8737 #17326 #17486 #18086 #18172 @renovate
chore(deps): bump gcr.io/distroless/static-debian12:debug-nonroot from f414196 to d5563cc #17327 #17487 #18087 #18173 @renovate
chore(deps): bump gcr.io/k8s-staging-build-image/distroless-iptables from 0.9.2 to 0.11.0 #16956 #17335 #17637 #18817 @renovate
chore(deps): bump ghcr.io/kumahq/ubuntu-netools:main from 5a7b674 to 7403610 #16951 #17044 #17104 #17329 #17488 #17629 #17938 #18088 #18174 #18458 #19078 @renovate
chore(deps): bump ghcr.io/spiffe/spire-agent from 1.15.1 to 1.15.2 #17638 @renovate
chore(deps): bump ghcr.io/spiffe/spire-server from 1.15.1 to 1.15.2 #17337 @renovate
chore(deps): bump ginkgo from 2.29.0 to 2.33.1 #16961 #17053 #18091 #18705 #18818 #19085 @renovate
chore(deps): bump github.com/bakito/go-log-logr-adapter:v0.0.3-0.20251124112456-a79f5cb04181 from a79f5cb to ddf65ac #17045 @renovate
chore(deps): bump github.com/bakito/go-log-logr-adapter:v0.0.3-0.20260622121138-ddf65ac69581 from ddf65ac to ea51ed6 #17630 @renovate
chore(deps): bump github.com/bakito/go-log-logr-adapter:v0.0.3-0.20260720125501-ea51ed66dcc4 from ea51ed6 to f0426b3 #17782 @renovate
chore(deps): bump github.com/cilium/ebpf from 0.21.0 to 0.22.0 #17054 @renovate
chore(deps): bump github.com/containernetworking/cni from 1.3.0 to 1.3.1 #18461 @renovate
chore(deps): bump github.com/emicklei/go-restful/v3 from 3.13.0 to 3.14.0 #19093 @renovate
chore(deps): bump github.com/envoyproxy/go-control-plane* #18123 @renovate
chore(deps): bump github.com/exaring/otelpgx from 0.11.1 to 0.13.0 #18706 #19094 @renovate
chore(deps): bump github.com/go-logr/logr from 1.4.3 to 1.4.4 #17639 @renovate
chore(deps): bump github.com/golang-migrate/migrate/v4 from 4.19.1 to 4.20.1 #18707 @renovate
chore(deps): bump github.com/gruntwork-io/terratest from 1.0.0 to 1.0.1 #17049 @renovate
chore(deps): bump github.com/jackc/pgx/v5 from 5.10.0 to 5.11.0 #18708 @renovate
chore(deps): bump github.com/miekg/dns from 1.1.72 to 1.1.73 #18179 @renovate
chore(deps): bump github.com/moby/go-archive from 0.2.0 to 0.3.3 #18109 @bartsmykla
chore(deps): bump github.com/onsi/gomega from 1.41.0 to 1.44.0 #16962 #17050 #18246 #18809 #18891 @renovate
chore(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.25.0 #17646 #19095 @renovate
chore(deps): bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 #18462 @renovate
chore(deps): bump github.com/prometheus/common from 0.68.1 to 0.72.0 #16986 #17647 #18467 #18962 @renovate
chore(deps): bump github.com/sethvargo/go-retry from 0.3.0 to 0.5.0 #17648 #19097 @renovate
chore(deps): bump github.com/shopspring/decimal from 1.4.0 to 1.5.0 #19098 @renovate
chore(deps): bump github.com/spiffe/go-spiffe/v2 from 2.7.0 to 2.9.0 #16987 #18810 #19099 @renovate
chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 #18188 @renovate
chore(deps): bump github.com/testcontainers/testcontainers-go from 0.43.0 to 0.44.0 #17949 @renovate
chore(deps): bump go.opentelemetry.io/proto/otlp from 1.10.0 to 1.11.1 #17649 #18955 @renovate
chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.56.0 #16963 #17192 #18347 @renovate
chore(deps): bump golang.org/x/exp from 055de63 to faecfb2 #16952 #17330 #17489 #17783 #18089 #18175 #18255 #18702 #19079 @renovate
chore(deps): bump golang.org/x/mod from 0.38.0 to 0.40.0 #18068 @renovate
chore(deps): bump golang.org/x/net from 0.59.0 to 0.60.0 #19029 @renovate
chore(deps): bump golang.org/x/tools from 0.46.0 to 0.52.0 #17055 #17342 #18714 #18963 #19104 @renovate
chore(deps): bump golangci-lint from 2.12.2 to 2.14.0 #18189 #18242 #18892 @renovate
chore(deps): bump google.golang.org/genproto/googleapis/* from 3dc84a4 to fad4113 #16953 #16980 #17105 #17631 #17784 #17939 #18176 #18238 #18459 #18703 #18805 #18884 #19080 @renovate
chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.84.0 #17110 #17515 #17789 #17999 #18181 #18243 #18819 @renovate
chore(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 #18093 @renovate
chore(deps): bump helm from 4.2.0 to 4.3.0 #16957 #16984 #17338 #18094 #18715 @renovate
chore(deps): bump jdx/mise-action from 4.3.0 to 5.1.1" #18977 @lukidzi
chore(deps): bump k8s.io/kube-openapi from 865597e to be32def #16981 #17046 #17331 #17632 #18177 @renovate
chore(deps): bump k8s.io/utils from ff6756f to cf1189d #16982 #17047 #17332 @renovate
chore(deps): bump kindest/node from 1.36.1 to 1.37.0 #18248 @renovate
chore(deps): bump kubectl from 1.36.1 to 1.37.1 #16958 #17642 #18184 #18253 #18889 @renovate
chore(deps): bump kubernetes monorepo from 0.36.1 to 0.36.2 #16959 @renovate
chore(deps): bump kubernetes monorepo from 0.36.2 to 0.36.3 #17643 @renovate
chore(deps): bump kubernetes monorepo from 0.36.3 to 0.36.4 #18185 @renovate
chore(deps): bump kubernetes monorepo from 0.36.4 to 0.37.0 #18249 @renovate
chore(deps): bump kubernetes monorepo from 0.37.0 to 0.37.1 - autoclosed #18890 @renovate
chore(deps): bump opentelemetry-go monorepo #17951 #18250 #18964 @renovate
chore(deps): bump opentelemetry-go-contrib monorepo from 0.69.0 to 0.70.0 #17952 @renovate
chore(deps): bump opentelemetry-go-contrib monorepo from 0.70.0 to 0.71.0 #18251 @renovate
chore(deps): bump opentelemetry-go-contrib monorepo from 0.71.0 to 0.72.0 #18965 @renovate
chore(deps): bump postgres:latest from 8ff36f3 to 74935e7 #16955 #17048 #17333 #17633 #17941 #18090 #18239 #18806 #18885 #19081 @renovate
chore(deps): bump projectcalico/tigera-operator from 3.32.0 to 3.33.0 #17051 #18245 #18966 @renovate
chore(deps): bump protobuf monorepo #16968 @renovate
chore(deps): bump sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.2 #18468 #18813 #18959 @renovate
chore(deps): bump sigs.k8s.io/controller-tools from 0.21.0 to 0.22.0 #18469 @renovate
chore(deps): bump sigs.k8s.io/gateway-api from 1.5.1 to 1.6.0 #17111 @renovate
chore(deps): bump spire from 1.15.2 to 1.15.3 #18186 @renovate
chore(deps): bump testcontainers-go monorepo #16989 @renovate
chore(deps): security update #17620 #18066 #18136 @kumahq
chore(deps): use latest kumahq/kuma-gui #16971 #16974 #16975 #17024 #17039 #17041 #17071 #17082 #17083 #17165 #17198 #17354 #17382 #17425 #17493 #17549 #17717 #17750 #17817 #17896 #17908 #17975 #18012 #18102 #18116 #18125 #18142 #18149 #18152 #18197 #18204 #18211 #18277 #18292 #18335 #18362 #18404 #18573 #18599 #18660 #18694 #18724 #18726 #18761 #18835 #18836 #18845 #18847 #18849 #18856 #18869 #18874 #18897 #18903 #18909 #18927 #19004 #19048 #19138 #19162 @kumahq

kumahq/kuma v3.0.0 3.0.0 on GitHub

Notable Changes

Changelog

kumahq/kuma v3.0.0
3.0.0

on GitHub