v1.9.0-rc.1

What's Changed

• Add Flux installation guide by @matheuscscp in #8864
• fix(api): increase RateLimitSelectCondition.headers MaxItems from 16 to 64 by @wucm667 in #8906
• skip invalid listener first in IR by @zirain in #8577
• feat: policy field owner by @kkk777-7 in #8538
• docs(tasks): add documentation for Dynamic Modules configuration example by @sjoukedv in #8908
• fix: remove cross ns policy attachment status by @zhaohuabing in #8901
• build(deps): bump npm-check-updates from 22.0.1 to 22.1.0 in /site by @dependabot[bot] in #8918
• build(deps): bump sigs.k8s.io/controller-runtime from 0.23.3 to 0.24.0 in /examples/extension-server by @dependabot[bot] in #8924
• build(deps): bump the helm group across 1 directory with 2 updates by @dependabot[bot] in #8925
• build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 in the actions group across 1 directory by @dependabot[bot] in #8920
• feat: add runner event metrics by @zirain in #8802
• build(deps): bump sigs.k8s.io/mcs-api from 0.4.1 to 0.5.0 by @dependabot[bot] in #8923
• fix: respect backend endpoint hostname for health checks by @arkodg in #8929
• fix(helm): propagate commonLabels to RBAC resources by @mvanhorn in #8818
• fix(translator): set ListenerSet and listener Accepted:True for InvalidCertificateRef by @apkatsikas in #8871
• fix: do not downgrade ALPN for only hostnames-overlapping listeners by @zhaohuabing in #8934
• build(deps): bump the gomod group across 6 directories with 9 updates by @dependabot[bot] in #8931
• feat: enableDeferredCreationStats by default by @zirain in #8937
• bump golang to 1.26.3 by @zirain in #8943
• chore: mute OSV scanner by @zirain in #8945
• chore: use os.Stdout instead of t.Output() by @zirain in #8860
• [release/v1.7] update docs and add release notes by @cnvergence in #8947
• [release/v1.7] add benchmark report for v1.7.3 by @cnvergence in #8954
• fix: restore last transition time in merge status conditions by @rudrakhp in #8962
• docs: fix the version in release announcement link by @cnvergence in #8966
• [release/v1.8] v1.8.0 release docs and announcement by @jukie in #8942
• build(deps): bump the actions group across 1 directory with 4 updates by @dependabot[bot] in #8976
• build(deps): bump npm-check-updates from 22.1.0 to 22.2.0 in /site by @dependabot[bot] in #8972
• chore: remove unnecessary overlapping hostnames in the http3 test yaml by @zhaohuabing in #8963
• build(deps): bump the gomod group across 2 directories with 2 updates by @dependabot[bot] in #8973
• build(deps): bump the k8s-io group across 1 directory with 6 updates by @dependabot[bot] in #8974
• fix: add unary interceptor and fix fail-open auth in GatewayNamespaceMode by @cnvergence in #8986
• build(deps): bump the helm group across 1 directory with 2 updates by @dependabot[bot] in #8978
• build(deps): bump sigs.k8s.io/controller-runtime from 0.24.0 to 0.24.1 by @dependabot[bot] in #8975
• bump lastVersionTag to v1.8.0 by @jukie in #8992
• feat: add envoyproxy status by @zirain in #8475
• build(deps): bump sigs.k8s.io/controller-runtime from 0.24.0 to 0.24.1 in /examples/extension-server by @dependabot[bot] in #8977
• Add gateway-api v1.5.1 mention to v1.8.0 release notes by @jukie in #8999
• Update benchmarks dashboard for v1.8.0 by @jukie in #9002
• Update non--crash-security--bug.md by @guydc in #9000
• update docs links to 1.8.0 by @zhaohuabing in #9005
• chore: fix gateway API docs links by @zhaohuabing in #9006
• [release/v1.8] fix benchmark report for v1.8.0 by @jukie in #9007
• fix(charts): add Gateway API v1.5 ListenerSet metrics to kube-state-metrics by @samuelmasuy in #9001
• fix(charts): split combined autoscaling/policy RBAC rule in infra-manager by @samuelmasuy in #9013
• fix: applyBackendTLSSetting panic by @zirain in #8998
• fix(xds): hot-reload xDS server cert in GatewayNamespaceMode by @nguyenptk in #8959
• docs: move v1.8 CRD upgrade note by @arkodg in #9017
• docs: add bandwidth docs by @kkk777-7 in #8939
• fix(helm): correct typo in HPA maxReplicas required message by @benjaminch in #9032
• docs: highlight Gateway API compatibility by @zhaohuabing in #9010
• build(deps): bump distroless/base-nossl from f71dcb6 to 20f009e in /tools/docker/envoy-gateway by @dependabot[bot] in #9038
• chore: replace Deprecated CEL ParsedExpr Oneof With CelExprParsed by @zhaohuabing in #8982
• chore: update release note for v1.9 by @kkk777-7 in #9045
• build(deps): bump the gomod group across 5 directories with 6 updates by @dependabot[bot] in #9040
• build(deps): bump the helm group across 1 directory with 2 updates by @dependabot[bot] in #9041
• feat: disabled automountServiceAccountToken by default by @zirain in #9051
• feat: allow to custom pod securityContext in gateway-helm by @zirain in #9036
• fix: bump osv scanner by @jukie in #9070
• chore: add deprecated field check by @kkk777-7 in #9072
• docs: fix ClientTrafficPolicy verification steps by @apkatsikas in #9076
• fix backend.tls.clientCertificateRef override test by @guydc in #9077
• add depkeep to enterprise support by @pkuzco in #9046
• lua: deprecate disableLua in favor of enableLua by @rudrakhp in #9081
• chore: fix osv scan by @zhaohuabing in #9080
• fix: allow IANA cipher names by @zhaohuabing in #9073
• chore: address comment by @zirain in #9055
• build(deps): bump the actions group across 1 directory with 4 updates by @dependabot[bot] in #9090
• build(deps): bump cel.dev/expr from 0.25.1 to 0.25.2 by @dependabot[bot] in #9089
• build(deps): bump busybox from 1487d0a to fd8d9aa in /tools/docker/envoy-gateway by @dependabot[bot] in #9087
• build(deps): bump github.com/docker/cli from 29.5.1+incompatible to 29.5.2+incompatible in the gomod group across 1 directory by @dependabot[bot] in #9088
• build(deps): bump the helm group across 1 directory with 4 updates by @dependabot[bot] in #9092
• fix(gatewayapi): prefer sectioned BackendTLSPolicy over wildcard for same target by @AlecDiraimondo in #9068
• chore: hide ForwardIDToken by @zhaohuabing in #9085
• chore: fix docs link by @zirain in #9101
• build(deps): bump npm-check-updates from 22.2.0 to 22.2.1 in /site by @dependabot[bot] in #9091
• fix: encode TLS secrets with canonical PEM formatting by @cnvergence in #8744
• chore: update deprecated docker libraries by @cnvergence in #9106
• build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #9109
• docs: copy Lua extensions security warning to v1.8 and v1.7 by @rudrakhp in #9113
• fix: MaxStreamDuration should worked for non-route cluster by @zirain in #9028
• feat: authorization path match by @kkk777-7 in #9008
• build(deps): bump the helm group across 1 directory with 2 updates by @dependabot[bot] in #9108
• chore: update testdata on main by @jukie in #9123
• fix(egctl): skip missing CRDs in x status bulk modes by @jeremiahsnapp in #9099
• fix(gatewayapi): reject unsupported BackendRef URLRewrite path rewrites by @Aditya7880900936 in #9131
• fix: force HTTP1 for Service/ServiceImport with websocket appProtocol by @zhaohuabing in #9138
• feat: add requestBody payload to HTTP active health checker by @michalskalski in #9111
• chore: bump golang to 1.26.4 by @zirain in #9147
• fix: move validation admission policy outside of crds directory by @zhaohuabing in #9024
• fix: alway include the controller namespace in the watched namespaces by @zhaohuabing in #9100
• build(deps): bump github.com/quic-go/quic-go from 0.59.0 to 0.59.1 in /test by @dependabot[bot] in #9160
• build(deps): bump npm-check-updates from 22.2.1 to 22.2.2 in /site by @dependabot[bot] in #9157
• build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #9158
• build(deps): bump the gomod group across 1 directory with 16 updates by @dependabot[bot] in #9159
• build(deps): bump github.com/quic-go/quic-go from 0.59.0 to 0.59.1 in /tools by @dependabot[bot] in #9164
• fix rate limit validation on K8s 1.36 by @beckcl in #9166
• Add release notes for v1.8.1 by @jukie in #9170
• Add release notes for v1.7.4 by @cnvergence in #9124
• fix github SA for June release by @zirain in #9173
• chore: fix date and nit by @zirain in #9177
• build(deps): bump opentelemetry-collector from 0.157.2 to 0.158.0 in /charts/gateway-addons-helm in the helm group across 1 directory by @dependabot[bot] in #9156
• Bump VERSION to v1.8.1 by @jukie in #9175
• docs: update benckmark for 1.8.1 and 1.7.4 by @zirain in #9179
• docs: TLSRoute with TLS termination by @zhaohuabing in #9107
• docs: explain how to scrape proxy metrics with an existing Prometheus by @SAY-5 in #9052
• fix(validation): allow IPv6 to be specific in loadBalancerSourceRanges by @rissson in #9050
• fix(egctl): return config errors when port forwarding fails by @immanuwell in #9056
• chore: fix codecov by @zhaohuabing in #9188
• fix: allow Backend TLS to disable ALPN with an empty list by @zhaohuabing in #9162
• fix(gatewayapi): sort api key auth credentials by @nobbs in #9042
• fix(status): separate listener programmed state from HTTPRoute Accepted condition by @apkatsikas in #9129
• build(deps): bump npm-check-updates from 22.2.2 to 22.2.3 in /site by @dependabot[bot] in #9201
• build(deps): bump github/codeql-action from 4.36.1 to 4.36.2 in the actions group across 1 directory by @dependabot[bot] in #9203
• feat(auto_host_sni): allow configuring the sni automatically from the upstream endpoint by @nacx in #9137
• fix(egctl): correct user-facing grammar in help text by @immanuwell in #9217
• fix: reject ExternalName Service as a route backend by @zhaohuabing in #9190
• fix(status): fall back to service externalIPs for Gateway addresses by @jvlxz in #9209
• fix: don't duplicate ValidatingAdmissionPolicy in install.yaml by @jukie in #9182
• feat(xds): add xdsNACKTotal metric by @QuantumEnigmaa in #9205
• feat: source rate limit value from dynamic metadata by @kanurag94 in #9216
• fix(listenerset): implement hostname conflict listener precedence by @zirain in #9192
• fix: correct the config hot reload validation order by @MengjiaLiang in #9214
• build(deps): bump the helm group across 1 directory with 4 updates by @dependabot[bot] in #9202
• build(deps): bump the k8s-io group across 1 directory with 6 updates by @dependabot[bot] in #9241
• build(deps): bump the gomod group across 2 directories with 6 updates by @dependabot[bot] in #9240
• fix: deduplicate CA certificates in ClientTrafficPolicy mTLS by @yuehaii in #8909
• feat(policy): support ListenerSet as targetRef for ClientTrafficPolicy by @apkatsikas in #9026
• fix(docs): links still pointing to /contributions by @M4tteoP in #9255
• fix: renew expired TLS certificates in e2e test fixtures by @rudrakhp with @Copilot in #9256
• feat(api): Add filterContext field to Lua type in EnvoyExtensionPolicy by @norman-zon in #8730
• build(deps): bump js-yaml and markdownlint-cli in /tools by @dependabot[bot] in #9258
• docs: update release schedule information by @apkatsikas in #9257
• docs: update Client Traffic Policy docs with new ListenerSet information by @apkatsikas in #9262
• build(deps): bump undici from 7.24.7 to 7.28.0 in /tools by @dependabot[bot] in #9261
• build(deps-dev): bump tar from 7.5.13 to 7.5.16 in /site by @dependabot[bot] in #9260
• feat: option to disable automatic X-Forwarded-For append/add by @lextiz in #8576
• build(deps): bump markdown-it and markdownlint-cli in /tools by @dependabot[bot] in #9259
• feat: add FailedRefetchDuration to RemoteJWKS by @jukie in #9265
• build(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 in /tools by @dependabot[bot] in #9266
• build(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 by @dependabot[bot] in #9267
• feat(helm): add CRDs dependency toggle by @cilindrox in #8850
• fix: proxy protocol with httpProtocolOptions by @zhaohuabing in #9234
• fix: validate API Key auth ExtractFrom by @zhaohuabing in #9250
• fix: XRateLimitHeadersOptionDisabled constant value must match CRD enum by @gianniskt in #9224
• fix(ratelimit): shared global ratelimit with cost not working by @zirain in #9245
• chore: run dependabot on release branch by @zirain in #9230
• fix(gatewayapi): http retry without backoff by @zirain in #9238
• chore: update dependabot by @zirain in #9299
• chore: use pinned docker image by @zirain in #9300
• build(deps): bump npm-check-updates from 22.2.3 to 22.2.7 in /site by @dependabot[bot] in #9277
• perf: resolve ClientTrafficPolicy targets once by @jukie in #9272
• build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #9282
• build(deps): bump the gomod group across 1 directory with 2 updates by @dependabot[bot] in #9283
• build(deps): bump the helm group across 1 directory with 2 updates by @dependabot[bot] in #9279
• chore: split release notes by @zhaohuabing in #9312
• build(deps-dev): bump autoprefixer from 10.5.0 to 10.5.1 in /site by @dependabot[bot] in #9321
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 in /tools/github-actions/setup-deps in the actions group across 1 directory by @dependabot[bot] in #9325
• chore: ignore k8s.io and go-control-plane on release branches by @zirain in #9331
• feat: support for deployment.envoyGateway.strategy by @zirain in #9318
• build(deps): bump otel/opentelemetry-collector-contrib from 0.154.0 to 0.155.0 in /charts/gateway-addons-helm in the helm group across 1 directory by @dependabot[bot] in #9344
• build(deps-dev): bump autoprefixer from 10.5.1 to 10.5.2 in /site by @dependabot[bot] in #9343
• ci: add tests for Kubernetes 1.36 by @beckcl in #8990
• chore: update pr template to help reduce review effort by @zhaohuabing in #9350
• helm: follow-up docs and template wording by @jukie in #9317
• Add release notes for v1.8.2 by @jukie in #9361
• fix: consolidate destination AppProtocol handling by @zhaohuabing in #9337
• fix: panic with empty deploy by @zirain in #9365
• fix: use target resource namespace in BTP RoutingType index by @Aias00 in #9359
• chore: bump envoy go-control-plane by @zirain in #9375
• fix: DaemonSet pod not using the configured custom ServiceAccount name by @zirain in #9347
• ratelimit: refactor shared and non-shared ratelimit rules by @zirain in #9332
• fix: use int64 format for ratelimit Requests field by @jukie in #9377
• docs: describe uint32 vs int32 range issue by @jukie in #9379
• feat: CEL-based Authorization policy by @zhaohuabing in #8981
• feat: Bump gatewayapi v1.6.0 by @zirain in #9232
• build(deps): bump npm-check-updates from 22.2.7 to 22.2.9 in /site by @dependabot[bot] in #9387
• deps: ignore gateway-api on release branch by @zirain in #9393
• chore: update skipped tests by @zirain in #9394
• build(deps): bump opentelemetry-collector from 0.159.0 to 0.159.2 in /charts/gateway-addons-helm in the helm group across 1 directory by @dependabot[bot] in #9388
• build(deps): bump the gomod group across 6 directories with 6 updates by @dependabot[bot] in #9398
• Update sync-dashboard for v1.8.2 by @jukie in #9403
• feat: support listenerset policy attach in security policy by @kkk777-7 in #9270
• docs(gateway-helm): clarify envoyProxy image values by @immanuwell in #9222
• fix: prevent GatewayNamespace mode from hijacking pre-existing ServiceAccounts and ConfigMaps by @yuehaii in #9215
• fix: allow trailing dot in Backend FQDN hostnames by @NeddM in #9098
• feat: support statusOnError field in EnvoyExtensionPolicy ExtProc by @dragon3 in #9044
• detect ipv6 literal hosts in url2cluster and token endpoint check by @dxbjavid in #9165
• feat(api): add ClientTrafficPolicy.clientIPDetection.downstreamRemoteAddress for L4-transparent geoip by @sboulkour in #8956
• fix: register ListenerSet and route indexes in offline controller by @Aias00 in #9320
• build(deps): bump the gomod group across 1 directory with 2 updates by @dependabot[bot] in #9436
• build(deps): bump the helm group across 1 directory with 2 updates by @dependabot[bot] in #9434
• build(deps): bump the actions group across 1 directory with 6 updates by @dependabot[bot] in #9439
• chore: bump golang to 1.26.5 by @zhaohuabing in #9437
• Add release notes for 1.7.5 by @cnvergence in #9433
• docs: update 1.8 install docs by @zhaohuabing in #9451
• [release/v1.7] add benchmark report for v1.7.5 by @cnvergence in #9453
• feat(helm): harden control-plane and certgen securityContext by @jukie in #9069
• perf: deduplicate JWT authn providers by @Aias00 in #9430
• e2e: add stats for WASM by @zirain in #9424
• fix: UDP/TCP RouteMultipleRoutesAttachment conformance test by @zirain in #9247
• docs: document vulnerability disclosure process by @arkodg in #9227
• perf: introduce endpoint slice indexer by @kkk777-7 in #9221
• Revert LuaPerRoute source materialization for Lua by @arkodg in #9426
• feat: support HTTPFilter for GRPCRoute by @zhaohuabing in #9404
• fix: default backend TLS max version to 1.3 by @vishwas-bm in #9412
• feat(ctp): add allowExpiredCertificate to tls.clientValidation by @daanvinken in #9199
• docs: fix invalid proxy protocol example by @hegerdes in #9479
• refactor: use stdlib maps and slices instead of golang.org/x/exp by @mmmommm in #9482
• fix(listenerset): implement listener conflict precedence for protocol conflicts by @zirain in #9196
• feat: wrap watch.namespaces helm template check in a with block by @cnvergence in #9067
• Support off and critical log level by @wweiwei-li in #9271
• build(deps): bump the actions group across 1 directory with 9 updates by @dependabot[bot] in #9506
• build(deps-dev): bump autoprefixer from 10.5.2 to 10.5.3 in /site by @dependabot[bot] in #9495
• build(deps): bump the helm group across 1 directory with 2 updates by @dependabot[bot] in #9501
• build(deps): bump markdownlint-cli from 0.49.0 to 0.49.1 in /tools by @dependabot[bot] in #9496
• build(deps): bump sigs.k8s.io/mcs-api from 0.5.0 to 0.5.2 by @dependabot[bot] in #9500
• build(deps): bump the gomod group across 1 directory with 4 updates by @dependabot[bot] in #9499
• build(deps): bump distroless/base-nossl from 20f009e to 86554c4 in /tools/docker/envoy-gateway by @dependabot[bot] in #9494
• fix: redirect port leaking across multiple listeners by @Aias00 in #9349
• fix: add default retry policy for Envoy wasm module fetch by @jukie in #9462
• fix/refactor: deep copy status in translator for all resources by @rudrakhp in #9458
• conformance: fix GatewayListenerUnsupportedProtocol test by @zirain in #9490
• fix(logs): restore ISO 8601 timestamp format by @wiegandf in #9493
• fix: unreferenced Secret events trigger reconciliation when HTTPRouteFilter CRD exists by @Greyeye in #9488
• bump Gateway API to v1.6.1 by @zirain in #9515
• Add release notes for v1.8.3 by @jukie in #9518
• feat: support client and overall tracing sampling by @Ri7ay in #9402
• refactor: use field owner pattern to merge BTPs by @rudrakhp in #9514
• api: add host normalization to ClientTrafficPolicy by @sboulkour in #9115
• Fix(ext-proc-examples): Add RequestBody and ResponseBody handling in request processing by @abe-servescale in #9183
• feat(translator): Support ignoreFailure to tolerate invalid JWT by @sinitax in #9313
• feat(ext_proc): add support for observability mode by @skos-ninja in #8536
• fix(xds): use DnsCluster extension for DNS clusters by @andreademurtas in #9155
• feat: allow RateLimitRedisSettings.url to be sourced from a Secret by @guanchzhou in #9143
• chore: fix gen by @zirain in #9533
• Remove 1.8.3 release page by @jukie in #9526
• docs: recommend ListenerSet over mergeGateways by @zhaohuabing in #9524
• feat(helm): add startupProbe to envoy-gateway deployment by @cleman95 in #8820
• fix: reject TLS secret when certificate and private key do not match by @zhaohuabing in #9480
• feat: support consistent hash for non-route backends by @zhaohuabing in #9231
• build(deps-dev): bump autoprefixer from 10.5.3 to 10.5.4 in /site by @dependabot[bot] in #9542
• build(deps): bump codespell from 2.4.2 to 2.4.3 in /tools/src/codespell by @dependabot[bot] in #9544
• build(deps): bump loki from 7.0.0 to 7.1.0 in /charts/gateway-addons-helm in the helm group across 1 directory by @dependabot[bot] in #9545
• build(deps): bump the actions group across 2 directories with 6 updates by @dependabot[bot] in #9549
• feat: use grpc status errors in jwtinterceptor by @cnvergence in #9020
• Add release note for fix to ratelimit fallback tag by @jukie in #9553
• build(deps): bump linkinator from 7.6.1 to 8.0.0 in /tools by @dependabot[bot] in #9543
• Update benchmark dashboard for v1.8.3 by @jukie in #9560
• fix: dedupe SAN entries before checking algorithm uniqueness by @dmavrodiev in #9472
• build(deps): bump the gomod group across 5 directories with 7 updates by @dependabot[bot] in #9546
• Bump metallb and kind by @jukie in #9562
• Create 1.8.3 release page and final release steps by @jukie in #9561
• docs: point community meeting calendar to LFX platform by @zhaohuabing in #9569
• fix: bound policy ancestors on the fly to avoid O(N^2) translation latency by @zhaohuabing in #9558
• docs: explain invert field in global rate limit example by @Aditya7880900936 in #9572
• ci: wire standalone test suite into GitHub Actions by @takumi12311123 in #9127
• deps: bump dependencies flagged by OSV scan by @zhaohuabing in #9575
• fix(cors validation) allow all RFC-3986 compliant schemes by @christopherbii in #9049
• feat(xds): support SNI based dynamic forward proxy for TLSRoute by @andreademurtas in #9184
• fix: handle EC parameters before TLS private keys by @jvlxz in #9338
• test: fix mismatched tls.key in tlsroute dynamic resolver testdata by @zhaohuabing in #9582
• fix: eliminate port race in setupFakeEnvoyStats test helper by @muwaqar-cflt in #9580
• feat: support listenerset reference grant by @kkk777-7 in #9481
• fix: allow TLSv1.3 for remote JWKS fetching by @michaelbeaumont in #9531
• fix: allow requests:0 for global rate limit block rules by @mvanhorn in #9333
• fix: validate SDS URL by @zirain in #9030
• fix: confirm NotFound against the API server before dropping status writes by @zhaohuabing in #9566
• feat(oidc): forward id token by @zhaohuabing in #9367
• api: make RateLimitRedisSettings.url a pointer by @guanchzhou in #9538
• fix(docs): replace dead Envoy Slack invite link by @zhaohuabing in #9586
• feat(xds): raise xDS gRPC server default receive limit and make it configurable by @linmosko in #9564
• fix: eliminate cfg.Logger data race in server()'s reload/shutdown path by @muwaqar-cflt in #9581
• fix: make ListenerSet and GRPCRoute watches optional by @zhaohuabing in #9583
• build(deps): bump npm-check-updates from 22.2.9 to 23.0.0 in /site by @dependabot[bot] in #9595
• build(deps): bump linkinator from 8.0.0 to 8.0.2 in /tools by @dependabot[bot] in #9596
• build(deps): bump the actions group across 1 directory with 10 updates by @dependabot[bot] in #9602
• feat: envoy extension policy listenerset attach by @kkk777-7 in #9425
• build(deps): bump the helm group across 1 directory with 2 updates by @dependabot[bot] in #9599
• api: add OOB BackendUtilization by @jukie in #9400
• build(deps): bump the gomod group across 3 directories with 5 updates by @dependabot[bot] in #9598
• fix: don't set Deployment replicas when an HPA is configured by @zhaohuabing in #9594
• feat: support listenerset policy attach in backend traffic policy by @kkk777-7 in #9419
• feat(infra): Add remote infrastructure provider by @zac-nixon in #9027
• fix: use shared system trust store sds secret by @guydc in #9357
• tweak: test indent by @kkk777-7 in #9612
• feat: add MergeBackends option for backend cluster deduplication by @muwaqar-cflt in #9477
• build(deps): bump the k8s-io group across 1 directory with 6 updates by @dependabot[bot] in #9601
• follow up listenerset policy attachment by @kkk777-7 in #9621
• chore: fix testdata for CTP status truncated by @zirain in #9640
• fix(bootstrap): drop removed envoy.restart_features.use_eds_cache_for_ads guard by @Aias00 in #9610
• fix: initial fetch timed out for type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret by @yuehaii in #9532
• feat: add CSRF origin validation to SecurityPolicy by @albsga4 in #8836
• docs: add Release Notes link to top navigation menu by @amarkdotdev in #9620
• chore: regen xds translator testdata for initialFetchTimeout by @zhaohuabing in #9643
• feat: Implement BackendUtilization LB OutOfBand reporting by @jukie in #9593
• feat/HTTPRouteFilter: host rewrite from path by @zhaohuabing in #8964
• chore: fix gen by @zirain in #9648
• feat: add support for tls.crt in BackendTlsPolicy by @gcleroux in #8329
• chore: fix OSV-scanner reported vulnerabilities by @zhaohuabing in #9655
• feat(extensionserver): Support policy resources targetting HTTPRoute and GRPCRoute by @HusseinKabbout in #9249
• fix(translator): allow UDS + IP mixed endpoints by @guydc in #9654
• fix(gatewayapi): don't skip MergeBackends precedence-index claims for policies that set nothing by @muwaqar-cflt in #9590
• build(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in #9667
• build(deps): bump busybox from fd8d9aa to dc2d74b in /tools/docker/envoy-gateway by @dependabot[bot] in #9658
• build(deps): bump linkinator from 8.0.2 to 8.0.3 in /tools by @dependabot[bot] in #9659
• build(deps): bump k8s.io/api from 0.36.0 to 0.36.3 in /examples/remote-infra in the k8s-io group across 1 directory by @dependabot[bot] in #9666
• build(deps): bump the helm group across 1 directory with 3 updates by @dependabot[bot] in #9664
• build(deps): bump the gomod group across 7 directories with 3 updates by @dependabot[bot] in #9663
• build(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in /test by @dependabot[bot] in #9677
• api: add more timeout fields to ClientTimeout by @HusseinKabbout in #9315
• add communityinviter.com to LINKINATOR_IGNORE to pass docs lint ci by @mmmommm in #9684
• build(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 by @dependabot[bot] in #9678
• chore: bump kube-api-linter by @sivchari in #9682
• refactor: only include cluster-scoped traffic features in BackendCluster by @zhaohuabing in #9642
• feat(gatewayapi): support SDS listener certificate references by @Sharvash in #9525
• api: increase RateLimitSelectCondition headers MaxItems from 64 to 128 by @sivchari in #9681
• api: add Week unit to BackendTrafficPolicy RateLimitUnit by @Danyal-Khalid in #9693
• feat(api): add Selector to MergeBackendsConfig to restrict cluster deduplication by @muwaqar-cflt in #9624
• feat: merge support for eep by @kkk777-7 in #9638
• fix: filter NodePort status.addresses to nodes running Envoy when externalTrafficPolicy is Local by @yuehaii in #9605
• feat(BackendTrafficPolicy): Support matching on response header for response override by @HusseinKabbout in #9354
• feat(translator): active healthcheck logs by @guydc in #9651
• replace ptr.To with new by @mmmommm in #9703
• v1.9.0-rc.1 release by @kkk777-7 in #9708
• fix: osv by @kkk777-7 in #9709
• bump ratelimit, dynamic modules, and proxy versions for v1.9.0-rc.1 by @kkk777-7 in #9710

New Contributors

• @matheuscscp made their first contribution in #8864
• @wucm667 made their first contribution in #8906
• @sjoukedv made their first contribution in #8908
• @mvanhorn made their first contribution in #8818
• @apkatsikas made their first contribution in #8871
• @samuelmasuy made their first contribution in #9001
• @nguyenptk made their first contribution in #8959
• @benjaminch made their first contribution in #9032
• @pkuzco made their first contribution in #9046
• @AlecDiraimondo made their first contribution in #9068
• @jeremiahsnapp made their first contribution in #9099
• @SAY-5 made their first contribution in #9052
• @rissson made their first contribution in #9050
• @immanuwell made their first contribution in #9056
• @nobbs made their first contribution in #9042
• @jvlxz made their first contribution in #9209
• @kanurag94 made their first contribution in #9216
• @MengjiaLiang made their first contribution in #9214
• @yuehaii made their first contribution in #8909
• @M4tteoP made their first contribution in #9255
• @rudrakhp with @Copilot made their first contribution in #9256
• @norman-zon made their first contribution in #8730
• @cilindrox made their first contribution in #8850
• @gianniskt made their first contribution in #9224
• @NeddM made their first contribution in #9098
• @dragon3 made their first contribution in #9044
• @dxbjavid made their first contribution in #9165
• @sboulkour made their first contribution in #8956
• @vishwas-bm made their first contribution in #9412
• @daanvinken made their first contribution in #9199
• @hegerdes made their first contribution in #9479
• @wweiwei-li made their first contribution in #9271
• @wiegandf made their first contribution in #9493
• @Greyeye made their first contribution in #9488
• @abe-servescale made their first contribution in #9183
• @sinitax made their first contribution in #9313
• @skos-ninja made their first contribution in #8536
• @andreademurtas made their first contribution in #9155
• @guanchzhou made their first contribution in #9143
• @cleman95 made their first contribution in #8820
• @dmavrodiev made their first contribution in #9472
• @takumi12311123 made their first contribution in #9127
• @christopherbii made their first contribution in #9049
• @muwaqar-cflt made their first contribution in #9580
• @zac-nixon made their first contribution in #9027
• @albsga4 made their first contribution in #8836
• @amarkdotdev made their first contribution in #9620
• @gcleroux made their first contribution in #8329
• @HusseinKabbout made their first contribution in #9249
• @sivchari made their first contribution in #9682
• @Sharvash made their first contribution in #9525
• @Danyal-Khalid made their first contribution in #9693

Full Changelog: v1.8.3...v1.9.0-rc.1