Kubernetes Gateway API Updates & Release Notes

Major Themes

Graduating to Standard

• HTTPRoute Retries (GEP-1731): the retry configuration of an HTTPRoute rule (codes, attempts and backoff) is promoted to the Standard channel, together with the HTTPRouteRetryCodes and HTTPRouteRetryConnectionError conformance features. The backoff field is implementation-specific because backoff behavior, especially jitter, varies between implementations. (#5357, @snorwin, #5359, @mikemorris)

New in Experimental

• Gateway Address Routability (GEP-5093): routability is expressed per Gateway address, so a single Gateway can serve addresses of different scopes. Valid values are empty (implementation default), Cluster, or a domain-prefixed implementation-specific value. (#5304, @rikatz)
• Standardized Attribute Dictionary (GEP-5253): a shared, vendor-neutral set of traffic attributes, based on OpenTelemetry semantic conventions, for use by features such as XTelemetryPolicy. (#5256, @gkhom)
• Session Persistence on Backend (GEP-1619 and GEP-4894): session persistence is configured on the XBackend resource, and the route-inline and BackendTrafficPolicy attachment points are deprecated. (#4876, #5298, @gcs278)
• Pre-routing Filters (GEP-5224): listener filters that run before routing decisions, for use cases such as external authentication and payload processing, with the new GatewayListenerFilters feature. Filters can be set on both Gateway and ListenerSet listeners. (#5315, @jaellio, #5370, @snorwin)
• ClusterTrustBundle in caCertificateRefs (GEP-5075): BackendTLSPolicy and Gateway frontend TLS validation can reference a ClusterTrustBundle through the existing caCertificateRefs field, instead of copying CA bundles into every namespace. (#5272, #5356, @davidesalerno)
• TelemetryPolicy for Distributed Tracing (GEP-4768): the XTelemetryPolicy API standardizes tracing configuration for Gateways without vendor-specific CRDs. Metrics and access logs are not covered yet. (#5323, @gkhom)

Major Changes Since v1.6.3

Breaking Changes

Experimental API changes (no effect on the Standard channel):

• SessionPersistence API: sessionName moved to cookie.name (Extended, optional) and header.name (Core, required), cookieConfig renamed to cookie, and HeaderConfig added. (#4873, @gcs278)
• SessionPersistence API: the cookie Path now defaults to / instead of being computed from route matches, and the new cookie.path field (Extended) allows explicit path configuration. (#5046, @gcs278)
• SessionPersistence: route-inline and BackendTrafficPolicy session persistence are deprecated in favor of the Backend resource. (#4876, @gcs278)
• XBackend: spec.port.port was renamed to spec.port.number, spec.port.name was removed, and backendRef.port is now prohibited when referencing an XBackend. (#5287, @gcs278)

Go types:

• BackendAncestorStatus.AncestorRef was renamed in the generated Go types for consistency with docs and JSON/YAML serialization. (#5187, @Stevenjin8)
• ForwardBodyConfig.MaxSize changed type from uint16 to int32. (#5099, @arjunxplorer)

Conformance features:

• The HTTPRouteRetry and HTTPRouteRetryBackendTimeout features were removed. HTTPRouteRetryCodes was added and HTTPRouteRetryConnectionError is retained. (#5167, @snorwin)
• The HTTPRouteBackendRequestRedirect feature and its test were removed. (#5279, @snorwin)
• Go was upgraded to 1.27 (go 1.27.0 directive in go.mod and conformance/go.mod) and Kubernetes dependencies to v0.37. (#5297, @snorwin, #5232, @snorwin, #5388, @howardjohn)

GEP & API Graduation

GEP Status Updates:

• GEP-4768 (TelemetryPolicy): add the proposal, then the experimental XTelemetryPolicy API (#4872, @gkhom, #5323, #5345, @robscott)
• GEP-5093 (Gateway Address Routability): add as Provisional, move to Implementable, then to Experimental. (#5094, @usize, #5263, @rikatz, #5304, @rikatz)
• GEP-5224 (Pre-routing filters): add as Provisional, move to Implementable, then to Experimental. (#5235, @jaellio, #5271, @jaellio, #5315, @jaellio)
• GEP-5075 (ClusterTrustBundle caCertificateRef): add as Provisional, move to Experimental, then use caCertificateRefs instead of a dedicated reference type. (#5259, @davidesalerno, #5272, @davidesalerno, #5356, @davidesalerno)
• GEP-5253: Standardized Attribute Dictionary. (#5256, @gkhom)
• GEP-4359: Gateway API Regex. (#4764, @Stevenjin8)
• GEP-4360: Regex-based Path Rewrites. (#4695, @Stevenjin8)
• GEP-1619 (Session Persistence): synced with API updates and made the Backend the attachment point. (#4870, #4876, @gcs278)
• GEP-1731 (HTTPRoute Retries): aligned retry semantics with implementations, then loosened the backoff definition so it no longer requires an exponential strategy, and promoted the retry configuration, including backoff, to the Standard channel. (#5167, @snorwin, #5359, @mikemorris)
• GEP-4894 (Backend): deferred SelectorRef in favor of the Selector field. (#5158, @gcs278)

Graduations to Standard:

• HTTPRoute retry configuration (retry.codes and retry.attempts) is promoted to the Standard channel, and the HTTPRouteRetryCodes and HTTPRouteRetryConnectionError features are now Standard. retry.backoff (implementation-specific) is promoted with them. (#5357, @snorwin)
• HTTPRoute and GRPCRoute rule name uniqueness validation is now enforced in the Standard channel. (#5009, @snorwin)
• BackendTLSPolicy SANs and TLS options are now marked as Standard channel. (#4999, @Suvink)
• The TLSRouteMixedMode feature is now Standard channel. (#5412, @rikatz)

Feature

New Experimental APIs and Fields

• Experimental XTelemetryPolicy API (GEP-4768). (#5323, @gkhom, #5345, @robscott)
• XBackend supports a new EndpointSelector type that routes to in-cluster pods selected by label. (#5255, @gcs278)
• XBackend supports session persistence for the EndpointSelector type. (#5298, @gcs278)
• XBackend TLS mode was refactored and its CEL validation fixed. (#5316, @snorwin)
• Gateway address routability (GEP-5093), including the GatewayAddressRoutability and GatewayAddressRoutabilityCluster features. (#5304, @rikatz)
• Pre-routing listener filters (GEP-5224), with the new GatewayListenerFilters feature. (#5315, @jaellio)
• Pre-routing listener filters (filters) were added to ListenerSet. (#5370, @snorwin)
• ClusterTrustBundle can be referenced through caCertificateRefs in BackendTLSPolicy and Gateway frontend TLS validation, with the new ClusterTrustBundle feature. (#5272, @davidesalerno, #5356, @davidesalerno)

API & Validation Enhancements

• HTTPRouteRetry.Attempts now defaults to 1, and its minimum was lowered from 1 to 0 so retries can be disabled per rule. (#5269, @snorwin, #5387, @mikemorris)
• Added CEL validation enforcing that TLS is disabled for H2C and enabled for HTTP2. Added a new WSS protocol value for WebSockets over TLS. (#5312, @snorwin)
• Added the GatewayRouteHostnameIntersectionPrecedence feature so implementations can opt in to resolving *Route precedence using the original Route hostnames instead of the calculated Listener/Route intersection. (#5212, @rostislavbobo)
• Replaced immutable CEL validation rules with the +k8s:immutable marker. (#4902, @chinmaychahar)

Release Artifacts

• Releases now contain OpenAPIv2 schema definitions. (#4686, @Rycieos)

Documentation

New and Updated Documentation

• Added documentation for XBackend. (#4931, @keithmattix)
• Added TCP and UDP examples and documentation. (#4932, @zac-nixon)
• Added ListenerSet to the SectionName interpretation table. (#4880, @apkatsikas)
• Stopped referring to ListenerSet as experimental. (#5228, @linuzctl)
• Aligned the GRPCRoute hostname cross-serving godoc with the relaxed site docs. (#5176, @lexfrei)
• Clarified that implementations should only retry HTTPRoute requests on connection errors when it is safe to do so, and that backoff specifies the base interval of a backoff strategy rather than the minimum interval. The precise backoff curve and jitter are implementation-specific, and implementations that retry immediately with no backoff must not advertise support for backoff. (#5269, @snorwin, #5359, @mikemorris)
• Marked Upstream TLS (BackendTLSPolicy) as Standard channel since v1.4.0. (#4965, @anneheartrecord)
• Corrected API groups in the GEP-709 ReferenceGrant example. (#5310, @deepujain)
• Corrected conformance feature selection guidance. (#5175, @immanuwell)
• Updated the API reference format for readability. (#5156, @youngnick)

Site & Project

• Removed the old MkDocs and Python environments. (#5165, @rikatz)
• Added dark mode image support. (#5203, @robscott)
• Added a GitHub repository link to the site navbar. (#5305, @yashrajshuklaaa)
• Added an AI Policy document and AI disclosure to the pull request template. (#5151, @youngnick, #5208, @youngnick)

Implementations & Conformance Reports

• Added or updated conformance reports for Agentgateway, Airlock Microgateway, AWS Load Balancer Controller, Calico, Cilium, Cloudflare Tunnel Gateway Controller, GKE Gateway, Gravitee, Higress, Istio, Kgateway, Kong Operator, Linkerd, NGINX Gateway Fabric, Traefik Proxy and WSO2 Gateway.
• Envoy Gateway moved to Conformant. (#5186, @zirain)
• HAProxy Ingress was renamed to N42 Gateway. (#5268, @jcmoraisjr)

Bug or Regression

• Fixed the generator so that inline references are supported on experimental validation, and fixed generator tag recognition for experimental markers. (#5288, #5303, @rikatz)
• Fixed the backend port name CEL expression and added a unit test. (#5193, @snorwin)
• Fixed an always-true scheme check in conformance redirect port validation. (#5201, @immanuwell)
• Added CEL validation for LabelKey in XBackend's endpointSelector.matchLabels. (#5397, @snorwin)

Test & Conformance

New Conformance Tests

• Added a conformance test for GRPCRouteFilterRequestHeaderModifier (new GRPCRouteRequestHeaderModifier feature). (#4060, @salonichf5)
• Added a BackendTLSPolicy conformance test for GRPCRoute. (#4882, @Thealisyed)
• Added a BackendTLSPolicy with TLSRoute Terminate conformance test. (#4875, @davidesalerno)
• Added a Gateway maximum name length conformance test. (#5035, @arjunexplorer)
• Added an HTTPRoute rule precedence conformance test. (#5128, @thorn3r)
• Added a conformance test covering shared and dedicated routes across multiple Gateways for GRPCRoute. (#5281, @snorwin)
• Added conformance tests validating that Gateway resolves HTTPRoute precedence using original route hostname specificity rather than the calculated listener/route hostname intersection. (#5124, @rostislavbobo)
• Added conformance tests validating that Gateway resolves GRPCRoute precedence using original route hostname specificity rather than the calculated listener/route hostname intersection. (#5346, @rostislavbobo)
• Added conformance tests validating that Gateway resolves TLSRoute precedence using original route hostname specificity rather than the calculated listener/route hostname intersection. (#5361, @rostislavbobo)
• Extended the HTTPRoute same-hostname intersection conformance test to cover path prefix and header matching across multiple attached Routes. (#5410, @rostislavbobo)
• Added conformance tests for URLRewrite filters at HTTPBackendRef level (HTTPRouteBackendURLRewrite). (#4823, @Srujan-rai)
• Added unit tests for the echo response parser. (#4635, @archy-rock3t-cloud)

Test Machinery & Framework Updates

• The conformance suite now supports an injectable WebSocket dialer (ConformanceOptions.WebSocketDialer). It defaults to the previous websocket.Dial behavior when unset. (#4936, @lexfrei)
• The conformance gRPC DefaultClient is now safe for concurrent SendRPC and reusable after Close. (#4946, @lexfrei)
• Base-resource cleanup now waits for deletion to complete, so the suite can be re-run in a single process (go test -count>1). (#4948, @lexfrei)
• RouteMustHaveParents now runs the observedGeneration check against the status it just read. Implementations whose status lags the Route generation may now fail where they previously passed. (#5206, @lexfrei)
• Report an error when a conformance manifest is missing from every configured filesystem. (#5216, @immanuwell)
• Conformance report Implementation.URL is now validated as a well-formed http(s) URL. (#5209, @yashrajshuklaaa)
• The conformance echo server images moved to a dedicated repository (kubernetes-sigs/gateway-api-conformance-images). (#5090, @snorwin)
• Use the timeout config more consistently. (#5150, @howardjohn)
• Preserve = in conformance key-value flags. (#5034, @immanuwell)

Updates & Fixes to Existing Tests

• Expect RefNotPermitted for a cross-namespace certificateRef to a nonexistent secret. (#5306, @PetrMc)
• Wait for mesh weighted routes to be programmed. (#5214, @Automaat)
• Retry the failure-path assertion in the client certificate validation test. (#5097, @yashrajshuklaaa)
• Added containerPorts to the echo pod in the mesh conformance manifest. (#5055, @AnirbanNandi)
• Foreign status entries on HTTPRoutes, BackendTLSPolicy and Gateway are now preserved by conformance tests. (#5206, @lexfrei)
• Removed the HTTPRoute retry tests that required unsafe retries and added a retry-with-backend-timeout case. (#5339, @snorwin)
• Fixed a nil Group pointer dereference panic in gatewayListenersMatch and listenerSetListenersMatch when the actual SupportedKinds list is empty. (#5411, @Ujjwaljain16)
• Fixed parentRefToString in the conformance helpers printing a pointer address instead of the namespace name. (#5399, @Ujjwaljain16)
• Replaced coredns with echo-basic in the UDPRoute conformance tests and base manifests. (#5408, @linolayani)
• Updated TCPRoute conformance test manifests and helpers from v1alpha2 to v1. (#5365, @davidjumani)
• Removed remaining references to removed alpha APIs from conformance and CEL/CRD/VAP tests. (#5368, @rikatz)

Other (Cleanup or Flake)

• Mark HTTPRouteBackendURLRewrite tests as provisional. (#5270, @snorwin)
• Removed the provisional flag from conformance tests that are now stable. (#5254, @rikatz)
• Added a make lint target. (#5198, @youngnick)
• Added a new implist tool. (#5191, @youngnick)
• Fixed the package declared as main so that it can be imported as utils. (#5275, @yashrajshuklaaa)
• Bumped the Go toolchain to 1.26.8 to fix stdlib CVEs. (#5280, @yashrajshuklaaa)
• Marked generated OpenAPI files as generated in PRs. (#5261, @youngnick)

Full Changelog

Full Changelog: v1.6.3...v1.7.0

Dependencies

Only changes to modules directly required by the root, conformance, tests and tools modules are listed below.

Added

• github.com/spf13/cobra: v1.10.2
• sigs.k8s.io/gateway-api-conformance-images: v0.2.0

Changed

• github.com/stretchr/testify: v1.11.1 → v1.12.1
• golang.org/x/mod: v0.36.0 → v0.42.0
• golang.org/x/net: v0.55.0 → v0.61.0
• golang.org/x/sync: v0.20.0 → v0.24.0
• golang.org/x/tools: v0.45.0 → v0.52.0
• google.golang.org/grpc: v1.81.1 → v1.84.0
• k8s.io/api: v0.36.1 → v0.37.1
• k8s.io/apiextensions-apiserver: v0.36.1 → v0.37.1
• k8s.io/apimachinery: v0.36.1 → v0.37.1
• k8s.io/client-go: v0.36.1 → v0.37.1
• k8s.io/code-generator: v0.36.1 → v0.37.1
• k8s.io/kube-openapi: 927ab1f → d427ff9
• k8s.io/utils: 28399d8 → be93311
• sigs.k8s.io/controller-runtime: v0.24.1 → v0.25.2
• sigs.k8s.io/controller-tools: v0.21.0 → v0.22.0
• sigs.k8s.io/structured-merge-diff/v6: v6.4.0 → v6.4.2

Removed

• github.com/miekg/dns: v1.1.72

Original source

Note: v1.7.0-rc.2 was retired due to a problem on its release manifests

Major Changes Since v1.7.0-rc.1

Feature

• Added pre-routing listener filters (filters) to ListenerSet (GEP-5224). (#5370, @snorwin)

Bug or Regression

• Reverted HTTPRouteRetry.Attempts back to *int and lowered its minimum value to 0 so retries can be disabled per rule. (#5387, @mikemorris)
• Added CEL validation for LabelKey in XBackend's endpointSelector.matchLabels. (#5397, @snorwin)
• Marked the TLSRouteMixedMode feature as Standard channel rather than Experimental. (#5412, @rikatz)
• Lowered the go directive in go.mod and conformance/go.mod from 1.27.1 to 1.27.0 to avoid forcing consumers onto a specific Go patch version. (#5388, @howardjohn)

Test & Conformance

• Extended the HTTPRoute same-hostname intersection conformance test to cover path prefix and header matching across multiple attached Routes. (#5410, @rostislavbobo)
• Fixed a nil Group pointer dereference panic in gatewayListenersMatch and listenerSetListenersMatch when the actual SupportedKinds list is empty. (#5411, @Ujjwaljain16)
• Fixed parentRefToString in the conformance helpers printing a pointer address instead of the namespace name. (#5399, @Ujjwaljain16)
• Replaced coredns with echo-basic in the UDPRoute conformance tests and base manifests. (#5408, @linolayani)
• Updated TCPRoute conformance test manifests and helpers from v1alpha2 to v1. (#5365, @davidjumani)
• Removed remaining references to removed alpha APIs from conformance and CEL/CRD/VAP tests. (#5368, @rikatz)

Original source

v1.6.3

Major Changes Since v1.6.2

Conformance

• Conformance tests for stable features (notable TCPRoute and UDPRoute) are no longer marked as "provisional" (#5260, @rikatz)
• Force the timeout for the ExpectMirroredRequest conformance test to MaxTimeToConsistency (#5296, @kl52752)
• Actually remove unused namespaces in Mesh conformance tests (#5251, @xtineskim)
• Add the GatewayInvalidParametersRef conformance test (#5236, @kl52752)

Build

• Ensure the Go toolchain matches go.work (#5234, @snorwin)

Original source

v1.6.2

Major Changes Since v1.6.1

Bug or Regression

HTTPRequestRedirectFilter status codes 303, 307, and 308 are Extended conformance, not Core. (#5173, @kflynn)

Other (Cleanup or Flake)

• Fix flaky TCPRouteWeightedRouting and UDPRouteWeightedRouting conformance tests by adding a data-plane readiness check before performing weighted routing assertions. (#5064, @arybolovlev)
• Fix FailFast not working as expected (#5204, @zirain)
• Allow disabling parallel tests at the suite level (#5184, @zirain)

Original source

v1.6.1

Major Changes Since v1.6.0

Test & Conformance

• Change the port used in TCPRouteMultipleRoutesAttachment. (#5053, @davidjumani)
• Respect CleanupTestResources for BackendTLSPolicy, TCPRouteMultipleRoutesAttachment and UDPRouteMultipleRoutesAttachment(#5065, @snorwin)
• Fix SetupTimeoutConfig() not respecting defaults for ListenerSetMustHaveCondition, ListenerSetListenersMustHaveConditions, and RequiredConsecutiveSuccesses. (#5066, @immanuwell)
• Honour tcpRouteMustHaveCondition and udpRouteMustHaveCondition timeouts which were silently ignore. (#5067, @immanuwell)

Other (Cleanup or Flake)

• Fix GatewayStaticAddresses test flake by waiting for status.addresses to be published instead of assuming it appears atomically with Programmed. (#5038, @howardjohn)
• Fix GatewayInfrastructure test flake by polling for generated infrastructure resources instead of assuming immediate visibility after the gateway is accepted. (#5047, @howardjohn)
• Fix flaky TCPRouteWeightedRouting and UDPRouteWeightedRouting conformance tests by adding a data-plane readiness check before performing weighted routing assertions. (#5064, @arybolovlev)

Original source

v1.6.0

Changes Since v1.5.1

GEP & API Graduation

UDPRoute & TCPRoute Graduation

• UDPRoute has graduated to GA. We recommend using the "v1" API version with this API now. The "v1alpha2" version of this API is deprecated and will be removed in the future. (#4923, @zac-nixon)
• TCPRoute has graduated to GA. We recommend using the "v1" API version with this API now. The "v1alpha2" version of this API is deprecated and will be removed in the future. (#4920, @zac-nixon)

GEP Status Updates

• Add GEP for the XBackend resource into Experimental status (#4488, @keithmattix)
• Move TCPRoute GEP to Standard (#4783, @zac-nixon)
• Move UDPRoute GEP to Standard (#5030, @rikatz)

Feature

API & Validation Enhancements

• API validation updated for HTTPRoute retries: retry.codes must now be unique and retry.attempts must be >= 1. (#4907, @snorwin)
• Increase the number of allowed Certificate Authority references from 8 to 16. (#4088, @root30)
• The TLSRoute CRD validation has been adjusted to allow up to 1024 hostnames and rules per TLSRoute resource. Operators must validate kube-apiserver, etcd and Gateway controller behavior with representative manifests prior to enabling the new limit in production. (#4332, @alexanderstephan)
• BackendTLSPolicy now can be used in combination with other routes types. (#4745, @rikatz)
• Allow the usage of up to 16 annotations on the gateway infrastructure object. (#4707, @wenisman)

Conformance Infrastructure

• Added conformance tests for UDPRoute (GEP-2645), a new GATEWAY-UDP conformance profile, a SupportTCPRoute feature, and a UDP/TCP echo server in echo-basic gated on UDP_ECHO_SERVER. (#4861, @zac-nixon)
• Remove the idleTimeout field from the experimental SessionPersistence API. (#4771, @gcs278)

Documentation

Migration & Site Updates

• Migrate documentation from MkDocs to Docsy. (#4734, @iromanycheva-eng)
• The new wizard should be available at https://gateway-api.sigs.k8s.io/wizard. (#4584, @bexxmodd)

API Specs & Guidance Clarifications

• Add missing apidoc for BackendTLSPolicy extended support. (#4828, @rikatz)
• Add the missing ListenersNotValid programmed reason for listenerSets. (#4586, @davidjumani)
• Added documentation guidance recommending GRPCRoute for gRPC traffic. (#4513, @kahirokunn)
• Clarified CORS API documentation to describe behavior based on allowCredentials instead of credentialed requests. (#4663, @snorwin)
• Previously, implementations were required to reject GRPCRoute and HTTPRoutes on the same hostname (however, few implementations did this). Now, implementations may optionally do this, or allow them to coincide. (#4598, @howardjohn)
• Updates the documentation around the ListenerConditionConflicted condition. (#4659, @davidjumani)

Fixes

• Grammar fix in docs for concepts/use cases. (#4798, @jkburges)

Bug or Regression

IPv6 Support

• Fix GatewayFrontendClientCertificateValidationInsecureFallback, GatewayFrontendClientCertificateValidation, and GatewayFrontendInvalidDefaultClientCertificateValidation failing on IPv6 clusters. (#4636, @zirain)
• Fix GatewayFrontendInvalidDefaultClientCertificateValidation failing on IPv6 clusters. (#4629, @zirain)

ValidatingAdmissionPolicy (VAP) Fixes

• Fixed an issue where the ValidatingAdmissionPolicy prevented experimental CRDs from being installed at all (instead of only when standard CRDs already exist). (#4603, @howardjohn)
• Fixed the safe-upgrades ValidatingAdmissionPolicy to allow upgrades of experimental CRDs. (#4557, @snorwin)

CRD & Schema Validation

• Generated Gateway API CRD install manifests no longer include top-level CustomResourceDefinition status fields with invalid null values, fixing strict schema validation failures in tools such as kubeconform. (#4712, @MatteoFari)
• Replace omitempty with omitzero for supportedKinds in ListenerStatus to preserve backward compatibility for controllers reconciling older Gateway API versions. (#4551, @snorwin)

API & Validation Fixes

• It is disallowed to have repeated filters of type CORS. (#4639, @DamianSawicki)
• Limit HTTPRouteHTTPSListenerDetectMisdirectedRequests to h2 only. (#4665, @zirain)
• Make explicit call about resource names requiring to be RFC 1035 compliant. (#4787, @rikatz)
• Make referencegrant.spec field required. (#4845, @bexxmodd)

Test & Conformance

New Conformance Tests

• Add conformance test ListenerSetAllowedRoutesCrossNamespace which verifies that a ListenerSet only allows routes in its own namespace by default. (#4841, @asauber)
• Added a conformance test covering the Gateway Accepted condition with reason ListenersNotValid and the Listener Accepted condition with reason UnsupportedProtocol. (#4807, @snorwin)
• Added conformance test GatewayInvalidParametersRef that verifies a Gateway referencing an invalid parameters is rejected. (#4808, @snorwin)
• Conformance: add ListenerSet tests for Route parentRef cases. (#4912, @asauber)

Test Machinery & Framework Updates

• Conformance: ExpectMirroredRequest now starts its log window before the requests are sent, so mirrors are not missed on high-latency data planes. (#4952, @lexfrei)
• The default polling interval for conformance tests has been decreased. This can be modified by the new DefaultPollInterval. (#4570, @howardjohn)
• The gRPC conformance request helper no longer closes a caller-supplied (injected) Options.GRPCClient; it closes only the DefaultClient it creates internally. This lets implementations reuse a custom gRPC client across requests. (#4953, @lexfrei)

Updates & Fixes to Existing Tests

• The conflicted=false condition is not required anymore in the listener status for non-conflicted listeners. (#4642, @zhaohuabing)
• Fix TLSRoute conformance test to stop relying on self-signed certificates. (#4930, @rikatz)
• Fixed MeshHTTPRoute307Redirect conformance test bug where the wrong manifest was used. (#4806, @jgreeer)
• Update Gateway version to v1 in UDP conformance test. (#4722, @cnvergence)
• Updated the TLSRoute conformance tests to allow FINs where previously RST was asserted. (#4615, @howardjohn)
• conformance: add missing gateway-api/skip-this-for-readiness annotation to invalid gateways (#5027, @snorwin)
• The GRPCRouteWeight conformance test now sends its distribution-sampling requests through the injectable Options.GRPCClient instead of a hardcoded DefaultClient, allowing implementations that supply a custom gRPC client to run it. (#5004, @lexfrei)
• The HTTPRouteRequestPercentageMirror conformance test now derives its acceptance band from the binomial standard deviation instead of a flat ±15% relative tolerance, removing sampling-variance flakes at low mirror percentages. (#5005, @lexfrei)
• Removed HTTPRoute retry tests with connection errors and backend timeouts (#4994, @snorwin)

What's Changed

• TLSRoute: Add conformance test for with Invalid BackendRef Kind by @rostislavbobo in #4504
• TLSRoute: Add conformance test for with nonexistent BackendRef by @rostislavbobo in #4507
• CORS: HTTPCORSFilter and GEP 1767 clean-ups by @DamianSawicki in #4506
• Finalize CORS gep adjustments by @rikatz in #4515
• docs: update broken link for Acnodal EPIC and Cilium Slack by @natherz97 in #4422
• conformance test: CORS by @rikatz in #4494
• [main] Promote client-certificate validation features to Standard by @k8s-infra-cherrypick-robot in #4532
• conformance: Re-add ListenerSetAllowedRoutesSupportedKinds by @davidjumani in #4512
• Update docs about cert-manager by @adrianmoisey in #4539
• CORS conformance fixes regarding credentials and wildcards by @DamianSawicki in #4542
• fix: FailFast should return when test failed by @zirain in #4540
• cleanup: fix typo by @snorwin in #4546
• cleanup: align types for listener ResolvedRefs condition reason by @snorwin in #4543
• fix: use omitzero instead of omitempty for supportedKinds to ensure backward compatibility by @snorwin in #4551
• remove copyright years after 2025 by @LiorLieberman in #4562
• conformance: client certificate AllowInsecureFallback validation mode tests by @snorwin in #4468
• Add script to verify release artifacts. by @bexxmodd in #4527
• fix: enable safe-upgrades VAP to permit upgrades of experimental CRDs by @snorwin in #4557
• bump lychee and fix local links by @rikatz in #4573
• Documentation for GEP-91 Client Certificate Validation Configuration by @kl52752 in #4552
• Docs gep 3155 by @kl52752 in #4553
• fix: Update listener set programmed conditions by @davidjumani in #4586
• Add missing IgnoreWhitespace: true by @DamianSawicki in #4567
• fix: Remove missing namespace in example manifests by @davidjumani in #4591
• TLSRoute: Add conformance tests for connection rejection by @rostislavbobo in #4583
• Update CEL validation of allowOrigins by @DamianSawicki in #4594
• docs: prevent patch releases from invalidating conformance reports. by @howardjohn in #4596
• conformance: tune and allow configuring polling interval by @howardjohn in #4570
• safe-upgrade: allow installing experimental when no current CRD is in… by @howardjohn in #4603
• mark promoted features on GEP lists by @rikatz in #4601
• docs: Add documentation for ListenerSets by @davidjumani in #4568
• docs: Update site-docs for 1.5 by @kflynn in #4609
• tlsroute: allow FIN or RST instead of just RST by @howardjohn in #4615
• Fix for release artifact validation CI by @bexxmodd in #4620
• fix: propagate context and fix defer leak in DumpEchoLogs by @samzong in #4617
• docs: Document 404 behavior when request doesn't match any Listener by @AlirezaPourchali in #4408
• fix GatewayFrontendInvalidDefaultClientCertificateValidation test by @zirain in #4629
• fix: improve GatewayMustHaveAttachedListeners log by @zirain in #4623
• fix: align short name by @zirain in #4619
• Add Hostname concept and explanation document by @youngnick in #4516
• Add 204 as a possible cors preflight response code by @jcmoraisjr in #4627
• Controller matching wizard by @bexxmodd in #4584
• fix: use JoinHostPort by @zirain in #4636
• Disallow repeated CORS filters by CEL by @DamianSawicki in #4639
• fix SetupTimeoutConfig by @zirain in #4630
• Minute clean-ups in conformance tests for CORS by @DamianSawicki in #4634
• Creates a consts for common values in conformance by @carmal891 in #4541
• fix: fix typo error by @yuluo-yx in #4638
• docs: add total column to conformance reports by @howardjohn in #4597
• docs: fix broken links from security-model rename by @pl4nty in #4658
• update ListenerConditionConflicted condition docs by @davidjumani in #4659
• allow absent conflict condition for non-conflicted listeners by @zhaohuabing in #4642
• limit HTTPRouteHTTPSListenerDetectMisdirectedRequests to h2 only by @zirain in #4665
• Docs: Remove deprecated copy_on_write option by @Seo-yul in #4678
• add a way to override timeout configs with a flag by @LiorLieberman in #4671
• docs: fix mkdocs redirects warning by @Seo-yul in #4680
• docs: Add feature names to guides and concepts pages by @robscott in #4672
• implement findings on gh actions by @rikatz in #4622
• some formatting changes to wizard ui. by @bexxmodd in #4656
• conformance: fix ListenerSetAllowedRoutesSupportedKinds flaking by @howardjohn in #4675
• align TLSRoute with hostname concept by @vinayakray19 in #4650
• CORS: clarify API documentation and remove conformance tests for credentialed requests by @snorwin in #4663
• 2734 - update gateway infrastructure annotations to 16 by @wenisman in #4707
• docs: Include patch versions in wizard data and add v1.5 features by @snorwin in #4710
• GatewayInfrastructure: use uncached client lookups by @howardjohn in #4717
• conformance: Move Inference Extension conformance helper functions to gateway-api/conformance by @ericdbishop in #4602
• Define union features by @rikatz in #4452
• generator: omit top-level CRD status from manifests by @MatteoFari in #4712
• conformance: update tests to use gatewayv1 APIs by @cnvergence in #4722
• Make monthly release action to be manually triggered with supplied tag. by @bexxmodd in #4736
• Add well-known labels package for GEP-1762 by @carmal891 in #4705
• Add Google Analytics loader and event tracking for wizard by @iromanycheva-eng in #4721
• start using images from registry.k8s.io by @upodroid in #4728
• Specify the usage of BackendTLSPolicy as a union feature by @rikatz in #4745
• Add gateway:util:excludeFromCRD comments for complex CEL validations by @AndrewCharlesHay in #4714
• conformance: make weight test 100x faster by @howardjohn in #4740
• Update HTTPRoute BackendRefs public docs to match API spec. by @briantkennedy in #4758
• docs: better feature comparison table by @howardjohn in #4744
• docs: clarify RequestHeaderModifier set behavior by @ShaanveerS in #4684
• conformance: Add tests for omitted and empty backendRefs by @optix2000 in #4750
• cleanup-test-resources option by @zhaohuabing in #4776
• GEP-1619: Remove idleTimeout from SessionPersistence API by @gcs278 in #4771
• Add session persistence conformance test plan by @salonichf5 in #4482
• Make explicit call about resource name restrictions by @rikatz in #4787
• Fix Google Analytics custom events in Controller Matching Wizard by @iromanycheva-eng in #4782
• docs: update ReferenceGrant API references to v1 by @JoeyC-Dev in #4796
• Issue-4087: Increase MaxItems for CACertificateRefs validation by @root30 in #4088
• Fix grammar/sentence by @jkburges in #4798
• fix mismatched annotation by @davidxia in #4793
• stop building arm64 images on preverify jobs by @rikatz in #4803
• V1.5 Implementations page review by @youngnick in #4741
• Update the bundle version for VAP and add it as a release step. by @bexxmodd in #4759
• Fix MeshHTTPRoute307Redirect conformance test by @jgreeer in #4806
• Mkdocs Migration Python CLI for #3860 by @RoseWrightdev in #3999
• Make conformance reports require just major and minor GW API versions by @rikatz in #4792
• fix: drop GRPCRoute from supported kinds assertion as the test does not require to support them by @snorwin in #4805
• test(conformance): add test for Gateway Accepted condition with InvalidParameters reason by @snorwin in #4808
• EXP: UDPRoute by @zac-nixon in #4720
• Bump golangci-lint (and KAL) to support Go 1.26 by @erikgb in #4820
• Bump K8s dependencies to 1.36 by @erikgb in #4819
• fix: add j2_line_comment_prefix back to mkdocs configuration by @JoeyC-Dev in #4822
• PROVISIONAL: Backend GEP by @keithmattix in #4818
• #4826 Fix inconsistencies in ListenerSet example by @vovtz in #4827
• test(conformance): add tests for Gateway listener Accepted condition with UnsupportedProtocol reason by @snorwin in #4807
• Add missing API doc for BackendTLSPolicy as union feature by @rikatz in #4828
• EXP: TCPRoute GEP by @zac-nixon in #4783
• Update RELEASE.md by @kflynn in #4836
• gep-4768: Standardized Telemetry API (provisional) by @gkhom in #4775
• docs: Add guidance preferring GRPCRoute for gRPC by @kahirokunn in #4513
• Increase TLSRoute hostnames limit from 16 to 1024 by @alexanderstephan in #4332
• [gep-1713] ListenerSet: Fix typos and other inconsistencies by @dprotaso in #4824
• grpc: do not require unique hostnames with http by @howardjohn in #4598
• Enable golangci-lint modernize linter by @erikgb in #4821
• conformance: add cross-namespace ListenerSet AllowedRoutes test by @asauber in #4841
• [breaking change] Remove optional marker from ReferenceGrant.Spec by @bexxmodd in #4845
• Prevent arbitrary code execution hack scripts by @bexxmodd in #4846
• Fix Stored DOM XSS in Controller Wizard by @bexxmodd in #4848
• Migrate documentation from MkDocs to Docsy by @iromanycheva-eng in #4734
• Remove legacy mkdocs files by @rikatz in #4855
• add GEP 3965: Implementation-Specific Matches by @howardjohn in #4676
• fix wizard theme compatibility for dark mode by @bexxmodd in #4857
• Add verify-crdify script to detect breaking changes in CRDs by @ElenaZvereva in #4830
• Secure monthly-release workflow by @bexxmodd in #4849
• test: retry simulation for echo-basic backend by @snorwin in #4862
• bump controller-tools by @rikatz in #4864
• docs: fix header background color by @snorwin in #4863
• fix: initialize retry count map to prevent nil map panic by @snorwin in #4866
• docs: add front matter to GEP pages to fix search links by @gcs278 in #4868
• cleanup: fix docs build variable mismatch and script error handling by @samzong in #4616
• EXP: Backend Resource by @keithmattix in #4488
• docs: ensure example files reference proper pages + update API version by @JoeyC-Dev in #4840
• docs: fix broken links in README.md by @arybolovlev in #4877
• feat(echo-basic): Add UDP Echo server by @zac-nixon in #4871
• Update UDPRoute gep to add more conformance and clarification by @rikatz in #4879
• Update TCPRoute gep to add more conformance and clarification by @rikatz in #4878
• test(conformance): Add TCPRoute conformance tests for GEP-2644 by @zac-nixon in #4874
• test(conformance): add normative tests for HTTPRoute retries by @snorwin in #4817
• test(conformance): Add UDPRoute conformance tests for GEP-2645 by @zac-nixon in #4861
• Add guidance on API documentation by @rikatz in #4160
• Set release title to tag name in monthly release workflow by @bexxmodd in #4886
• conformance: make timeout and other fields configurable via yaml by @ericdbishop in #4773
• test: enhance retry simulation with TCP failure mode and retry delay by @snorwin in #4897
• test: remove backoff from normative HTTPRoute retry tests by @snorwin in #4898
• [release-1.6] bump dependencies and remove deprecated h2c package by @k8s-infra-cherrypick-robot in #4904
• [release-1.6] Skip conformance options test to avoid replacing flags by @k8s-infra-cherrypick-robot in #4906
• [release-1.6] api: use listType=set for HTTPRoute retry status codes and validate retry attempts >= 1 by @k8s-infra-cherrypick-robot in #4907
• [release-1.6] test(conformance) Touch up L4 conformance by @k8s-infra-cherrypick-robot in #4909
• [release-1.6] test(conformance): add test for HTTPRoute retries with timeouts by @k8s-infra-cherrypick-robot in #4910
• [release-1.6] conformance: add ListenerSet tests for Route parentRefs by @k8s-infra-cherrypick-robot in #4912
• [release-1.6] feat(apis): Promote TCPRoute to v1 by @k8s-infra-cherrypick-robot in #4920
• [release-1.6] feat(apis): Promote UDPRoute to v1 by @k8s-infra-cherrypick-robot in #4923
• [release-1.6] EXP: XBackend Implementation by @k8s-infra-cherrypick-robot in #4924
• [release-1.6] stop using selfsigned certificate on tlsroute tests and reuse cert function by @k8s-infra-cherrypick-robot in #4930
• [release-1.6] conformance: check pods in namespaces by @k8s-infra-cherrypick-robot in #4944
• [release-1.6] conformance: start the mirror log window before the requests are sent by @k8s-infra-cherrypick-robot in #4952
• [release-1.6] Close only the gRPC client the request helper owns by @k8s-infra-cherrypick-robot in #4953
• release v1.6.0-rc.1 by @bexxmodd in #4957
• Correct Backend in changelog by @keithmattix in #4964
• [release-1.6] Run Gateway and BackendTLSPolicy conformance tests in parallel by @k8s-infra-cherrypick-robot in #4967
• [release-1.6] chore: Update TCP && UDP Route version in conformance tests by @k8s-infra-cherrypick-robot in #4981
• [release-1.6] fix: Invalid listener in TCPRouteInvalidNonTCPListener by @k8s-infra-cherrypick-robot in #4984
• [release-1.6] fix: remove HTTPRoute retry tests with connection errors and backend timeouts by @snorwin in #4994
• [release-1.6] test(conformance): add test covering shared and dedicated routes across multiple Gateways by @k8s-infra-cherrypick-robot in #4997
• [release-1.6] conformance: avoid mirror log races (Backport of #4887) by @youngnick in #5002
• [release-1.6] Derive percentage-mirror tolerance from the binomial standard deviation by @k8s-infra-cherrypick-robot in #5005
• [release-1.6] Route the GRPCRouteWeight sampler through the injectable GRPCClient by @k8s-infra-cherrypick-robot in #5004
• [release-1.6] Add an injectable WebSocket dialer to the conformance suite by @k8s-infra-cherrypick-robot in #5003
• Preping v1.6.0-rc.2 release. by @bexxmodd in #5007
• [release-1.6] conformance: add missing gateway-api/skip-this-for-readiness annotation to invalid gateways by @k8s-infra-cherrypick-robot in #5027
• version bump and changelog update for v1.6.0 release. by @bexxmodd in #5029

New Contributors

• @natherz97 made their first contribution in #4422
• @jukie made their first contribution in #4525
• @samzong made their first contribution in #4617
• @AlirezaPourchali made their first contribution in #4408
• @abdallahmahran10 made their first contribution in #4610
• @yuluo-yx made their first contribution in #4638
• @pl4nty made their first contribution in #4657
• @vinayakray19 made their first contribution in #4650
• @szkaraddd made their first contribution in #4702
• @tyxeron made their first contribution in #4694
• @wenisman made their first contribution in #4707
• @MatteoFari made their first contribution in #4712
• @upodroid made their first contribution in #4728
• @AndrewCharlesHay made their first contribution in #4714
• @ShaanveerS made their first contribution in #4684
• @optix2000 made their first contribution in #4750
• @jkburges made their first contribution in #4798
• @davidxia made their first contribution in #4793
• @RoseWrightdev made their first contribution in #3999
• @vovtz made their first contribution in #4827
• @gkhom made their first contribution in #4775
• @alexanderstephan made their first contribution in #4332
• @perbu made their first contribution in #4831
• @ElenaZvereva made their first contribution in #4830
• @arybolovlev made their first contribution in #4877

Full Changelog: v1.5.1...v1.6.0

Original source