Kuma Files

Changelog

• chore(deps): bump coredns to v1.14.7 #18319 @lukidzi
• chore(deps): bump distroless base images #18119 @bartsmykla
• chore(deps): bump envoy from 1.36.9 to 1.36.10 #18224 @lukidzi
• chore(deps): bump github.com/cilium/ebpf from 0.20.0 to 0.22.0 #18108 @renovate
• chore(deps): bump github.com/google/cel-go from 0.29.0 to 0.30.0 #18140 @renovate
• chore(deps): bump github.com/moby/go-archive from 0.1.0 to 0.3.3 #18111 @bartsmykla
• chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 #18359 @renovate
• chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 #18589 @renovate
• chore(deps): security update #18067 #18306 @kumahq
• chore(helm): control plane, hook, ingress and egress containers now drop all Linux capabilities and disallow privilege escalation #18129 @bartsmykla
• feat(labels): compute kuma.io/display-name for all resources (backport of [#17162]) #18164 @kumahq
• feat(labels): compute kuma.io/origin on global and zone control planes (backport of [#17176]) (backport of [#18279]) #18370 @kumahq
• fix(k8s): enforce control-plane-owned labels on read (backport of [#18271]) #18396 @kumahq
• fix(k8s): reconcile pods that match a Service only once ignoredServiceSelectorLabels are stripped #18540 @kumahq
• fix(k8s): reject user-set service-account label (backport of [#18273]) #18288 @kumahq
• fix(k8s): scope gateway mapper logger per call #18215 @lukidzi
• fix(labels): make Compute authoritative for zone, env, namespace and service-account (backport of [#18410]) #18578 @kumahq
• fix(meshhttproute): resolve mirror backendRef (backport of [#17676]) #17850 @kumahq
• fix(meshidentity): reconcile the MeshTrust trust domain when it changes #18617 @kumahq
• fix(meshmetric): honor includeUnused sidecar flag #18482 @kumahq
• fix(meshtls): apply tls params without inbounds (backport of [#18444]) #18445 @kumahq
• fix(xds): stop status-only writes forcing mesh-wide xDS recomputation #18623 @kumahq
• perf(rules): cut allocations in rule building (backport of [#17954]) #18046 @kumahq