v1.6.0

This release enables installations of Authorino v0.28.0, Authorino Operator v0.27.0, Limitador v2.5.0, Limitador Operator v0.19.0, DNS Operator v0.18.0, MCP Gateway v1.0.2, WASM Shim v0.15.0, ConsolePlugin v0.7.1 and Developer Portal Controller v0.3.1

What's Changed

Exciting New Features 🎉

• developer portal cluster roles by @eguzki in #2027
• Tokenratelimit reservation by @eguzki in #2263

Bug Fixing 🐞

• Action sets break ties on identifier by @adam-cattermole in #2184
• CEL injection vulnerability (CVE-2026-108334) by @eguzki in #2370

Other Changes

• fix: Return error from PipelineCommit when change notification fails by @philbrookes in #2013
• fix: Scope extension pipeline actions to their target refs by @philbrookes in #2028
• fix: Notify operator when clearing pipeline-only extension policies by @philbrookes in #2014
• feat: treat DenyAction WithBody as a CEL expression by @crstrn13 in #2020
• fix: reject top-level fail actions in pipeline validation by @crstrn13 in #2024
• feat: add USE_IMAGE_DIGESTS flag for digest-based image references by @mikenairn in #2008
• Use Gateway API infrastructure configuration for X.509 Tier 2 CA bundle mounting by @guicassolato in #2030
• feat: add --pprof-bind-address flag for runtime profiling by @mikenairn in #1979
• Upgrade golang.org/x/net to v0.55.0 by @thomasmaas in #2042
• Fix non-deterministic EnvoyFilter generation by @adam-cattermole in #2045
• Set failure_policy to FAIL_RELOAD by @adam-cattermole in #2044
• RELEASE.md: update for the latest workflow by @eguzki in #2060
• Bump golangci-lint to v2.12.2 by @thomasmaas in #2052
• Cleanup orphaned WasmPlugin objects by @adam-cattermole in #2053
• Revert "Handle error cases" by @adam-cattermole in #2067
• fix verify-prepare-release git diff check by @guicassolato in #1888
• [docs] Tutorial that implements AppID/AppKey pair Auth "a la 3scale" by @didierofrivia in #2066
• MULTIARCH-5995: add ppc64le support to the build by @raja-0940 in #1941
• oidc-policy: compile claim predicates as equality on scalar JWT claims by @SAY-5 in #1914
• Pin github actions to commit SHAs in all workflows by @averevki in #2057
• feat: implement non-blocking error handling with automatic retry by @guicassolato in #2043
• Fixing OIDCPolicy for MCP Gateway use case by @didierofrivia in #2032
• Upgrade Go to 1.26.4 by @thomasmaas in #2050
• docs(observability): update wasm-shim span names by @silvi-t in #2090
• fix: retry transient owner-reference errors for Authorino and Limitador by @Priyanshu-u07 in #2088
• exclude common folders for ai agents by @maksymvavilov in #2092
• Revert "feat(wasm): allow_on_headers_stop_iteration on our PluginConfig" by @adam-cattermole in #2101
• docs: clarify TokenRateLimitPolicy supported endpoints and response formats by @aniketpandey05 in #2106
• fix: restore TLSPolicy reconciliation on issuer readiness changes by @officialasishkumar in #1877
• fix: correct spelling mistakes in type and variable names by @shellyco-code in #2100
• FIX: Prevent operator crash when topology ConfigMap exceeds 1MB limit by @Boomatang in #2048
• observability: scope auto-created Pod/ServiceMonitors to the install namespace by @SAY-5 in #1921
• Propagate OpenShift TLS security profile to Authorino by @philbrookes in #2091
• feat: implement ErrorRegistry retry handling for all reconcilers by @guicassolato in #2094
• fix: read OLM dependency versions from release.yaml instead of Quay by @thomasmaas in #2133
• Update devportal manifests by @adam-cattermole in #2146
• docs(egress): egress observability guide for metrics and access logging by @maksymvavilov in #2108
• ci: consolidate code quality workflows to reduce runner usage by @maksymvavilov in #2150
• Migrate WASM config to new types by @adam-cattermole in #2089
• fix(tracing): propagate observability config to extension-only gateways by @silvi-t in #2119
• fix(docs): rename wasm-shim service to kuadrant-filter by @silvi-t in #2164
• Add documentation for OpenShift TLS security profile propagation by @philbrookes in #2128
• Extensions handshake and session management by @adam-cattermole in #2166
• fix(docs): add identity filter to egress workload identity AuthPolicy by @maksymvavilov in #2152
• Wasm service type consolidation by @adam-cattermole in #2163
• [StepSecurity] ci: Harden GitHub Actions by @step-security-bot in #2072
• Wasm execution config by @adam-cattermole in #2153
• Extensions handshake with operator by @adam-cattermole in #2172
• Replace EnvoyFilter targetRef with workloadSelector by @adam-cattermole in #2171
• feat: add component chart sync tool and automation by @mikenairn in #2170
• Extensions open socket by @adam-cattermole in #2180
• Extensions secret reconciler by @adam-cattermole in #2188
• update dns-operator in go.mod file by @philbrookes in #2192
• Fix console plugin broken on OCP 4.20/4.21 after SDK 4.22 upgrade by @emmaaroche in #2183
• fix: DCO compliance and PR context in chart sync workflow by @mikenairn in #2190
• feat: add job summary and run link to chart sync workflow by @mikenairn in #2196
• fix(observability): use annotated metrics port in istio-pod-monitor by @dwivedipranav-dev in #2147
• chore(deps): update dns-operator chart on main to cdf775c by @kuadrant-dev in #2181
• add type safety for rate limit namespace and scope identifiers by @nXtCyberNet in #1943
• feat: kuadrant CR has now owner reference to Authconfigs by @DaliborD45 in #2185
• Upgrade Go to 1.26.7 and OpenTelemetry to v1.46.0 by @thomasmaas in #2203
• Extensions authenticate via TokenReview and SAR by @adam-cattermole in #2201
• Fix test flakes by @adam-cattermole in #2207
• feat: consolidate dns-operator into kuadrant-operator by @mikenairn in #2178
• build(deps): bump helm.sh/helm/v3 from 3.18.5 to 3.20.2 by @dependabot[bot] in #2213
• build(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.2 by @dependabot[bot] in #2212
• Extensions session liveness by @adam-cattermole in #2214
• Drop supersedingHostSubsets from Authorino CR by @guicassolato in #2220
• fix: component chart sync permissions and missing charts by @mikenairn in #2200
• Add NetworkPolicy reconciler for Authorino and Limitador operands by @Boomatang in #2195
• ADD: Operator network policies by @Boomatang in #2226
• feat: consolidate mcp-gateway into kuadrant-operator by @mikenairn in #2202
• Add default deny-all NetworkPolicy for the operator namespace by @Boomatang in #2221
• chore(deps): update mcp-gateway chart on main to caf6847 by @kuadrant-dev in #2228
• Revert "ADD: blocking network policy" by @azgabur in #2235
• release: validate and expose mcp-gateway version by @mikenairn in #2238
• Own deployer-applied resources with KuadrantControlPlane by @mikenairn in #2236
• Extensions SDK cleans up finalizer correctly by @adam-cattermole in #2241
• test: restore dev DNS provider config after KuadrantControlPlane deletion by @mikenairn in #2246
• Remove developer portal enable/disable toggle from Kuadrant CR by @Anton-Fil in #2247
• chore(deps): update mcp-gateway chart on main to d5f4c63 by @kuadrant-dev in #2248
• docs(egress): add distributed tracing section to observability guide by @maksymvavilov in #2165
• fix: remove fixed MCP controller UID and GID by @trepel in #2255
• test: refactor integration test organisation by @mikenairn in #2261
• Consolidate limitador-operator and authorino-operator by @mikenairn in #2239
• Bump authorino version to v0.27.0 by @averevki in #2118
• test: replace SpecTimeout with NodeTimeout to fix timeout conflicts by @mikenairn in #2268
• test: add MCP Gateway nightly signal by @Patryk-Stefanski in #2237
• Fix: allow WASM plugin access through deny-all NetworkPolicy by @fabikova in #2244
• feat: add reusable dispatch chart sync workflow by @mikenairn in #2265
• ci: declare KUADRANT_DEV_PAT secret in reusable workflow by @mikenairn in #2274
• fix(ci): follow operator Go version in MCP nightly by @Patryk-Stefanski in #2273
• refactor extrenal-api.md by @maksymvavilov in #2223
• chore(deps): update authorino-operator chart on main to 042ea68 by @kuadrant-dev in #2288
• chore(deps): update limitador-operator chart on main to c753bc6 by @kuadrant-dev in #2289
• build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in #2240
• Operator prunes extensions by @adam-cattermole in #2257
• Extensions SDK prunes stale data by @adam-cattermole in #2258
• Extensions sdk rebuilds state on handshake by @adam-cattermole in #2259
• Refactor extensions action proto by @adam-cattermole in #2282
• Add Store action to the extensions SDK by @adam-cattermole in #2283
• fix(ci): stabilize MCP gateway nightly workflow by @Patryk-Stefanski in #2294
• chore(deps): update limitador-operator chart on main to f3e1300 by @kuadrant-dev in #2300
• docs(egress): document TelemetryPolicy custom metric labels by @maksymvavilov in #2245
• chore(deps): bump github.com/google/cel-go from v0.26.0 to v0.29.0 by @thomasmaas in #2292
• chore(deps): update authorino-operator chart on main to 60e659d by @kuadrant-dev in #2304
• Bump Authorino to v0.28.0 and Authorino Operator to v0.27.0 by @guicassolato in #2305
• fix: allow Console to reach console plugin under default-deny by @fabikova in #2301
• chore(deps): bump github.com/containerd/containerd from 1.7.33 to 1.7.35 by @dependabot[bot] in #2249
• fix: skip Add issue to project workflow for dependabot PRs by @thomasmaas in #2290
• test: add Ginkgo labels and refactor integration test configuration by @mikenairn in #2291
• Extensions protocol version validation by @adam-cattermole in #2302
• Add MCP Inspector plugin backend by @jasonmadigan in #2206
• feat: verify dependency images exist on Quay during prepare-release by @thomasmaas in #2134
• Move developer-portal-controller to KuadrantControlPlane lifecycle management by @jasonmadigan in #2269
• docs: TRLP on egress user guide with mock AI API by @maksymvavilov in #2199
• fix: allow metrics scrape for Authorino and Limitador under default-deny by @fabikova in #2308
• test: move MCP Gateway AuthPolicy E2E to operator by @Patryk-Stefanski in #2262
• fix: scope controlplane logger and demote noisy log levels by @mikenairn in #2310
• fix: register NetworkPolicy kind once so operator policies update by @jasonmadigan in #2315
• chore(deps): update mcp-gateway chart on main to eb17020 by @kuadrant-dev in #2256
• chore(deps): update limitador-operator chart on main to 8e70841 by @kuadrant-dev in #2317
• chore(deps): update dns-operator chart on main to 145ce32 by @kuadrant-dev in #2318
• chore(deps): update developer-portal-controller chart on main to a11230e by @kuadrant-dev in #2319
• dataExtraction CRD field, validation, built-in defaults, and wasm config generation for TokenRateLimitPolicy by @eguzki in #2299
• fix: add outlier_detection to Authorino and Limitador gRPC clusters by @thomasmaas in #2281
• Add missing tests/common integration coverage for TokenRateLimitPolicy, fix two enforced-condition bugs found along the way by @eguzki in #2320
• docs: add DNS failover overview and health check cross-reference by @philbrookes in #2306
• deps: bump limitador-operator to v0.19.0 by @eguzki in #2325
• [Release] Kuadrant Operator v1.6.0-rc1 by @kuadrant-dev in #2326
• [backport] rewrite TestDeployerImagePatching to use synthetic fixtures by @mikenairn in #2332
• Release v1.6.0-rc2 by @thomasmaas in #2344
• release v1.6.0-rc4 by @R-Lawton in #2364
• Backport of #2365 by @Boomatang in #2366
• Prepare release 1.6.0-rc5 by @Boomatang in #2367
• Pre release 1.6.0 rc6 by @Boomatang in #2374
• Pre release 1.6.0 rc7 by @Boomatang in #2377
• Prepare relase 1.6.0 by @eguzki in #2378

New Contributors

• @raja-0940 made their first contribution in #1941
• @SAY-5 made their first contribution in #1914
• @Priyanshu-u07 made their first contribution in #2088
• @aniketpandey05 made their first contribution in #2106
• @officialasishkumar made their first contribution in #1877
• @shellyco-code made their first contribution in #2100
• @step-security-bot made their first contribution in #2072
• @emmaaroche made their first contribution in #2183
• @dwivedipranav-dev made their first contribution in #2147
• @nXtCyberNet made their first contribution in #1943
• @Anton-Fil made their first contribution in #2247
• @fabikova made their first contribution in #2244

Full Changelog: v1.5.4...v1.6.0