v1.6.0-rc.2

Major Changes Since v1.6.0-rc.1

Bug or Regression

• ⚠️ Breaking Change: TLS must now be configured for listeners using the HTTPS protocol. (#4985, @snorwin)

Test & Conformance

• The GRPCRouteWeight conformance test now sends its distribution-sampling requests through the injectable Options.GRPCClient instead of a hardcoded DefaultClient, allowing implementations that supply a custom gRPC client to run it. (#5004, @lexfrei)
• The HTTPRouteRequestPercentageMirror conformance test now derives its acceptance band from the binomial standard deviation instead of a flat ±15% relative tolerance, removing sampling-variance flakes at low mirror percentages. (#5005, @lexfrei)
• Removed HTTPRoute retry tests with connection errors and backend timeouts (#4994, @snorwin)

What's Changed

• Update RELEASE.md by @kflynn in #4836
• Conformance report for NGINX Gateway Fabric 2.6.0 by @ciarams87 in #4837
• gep-4768: Standardized Telemetry API (provisional) by @gkhom in #4775
• docs: Add guidance preferring GRPCRoute for gRPC by @kahirokunn in #4513
• Increase TLSRoute hostnames limit from 16 to 1024 by @alexanderstephan in #4332
• build(deps): bump the non-k8s group across 2 directories with 1 update by @dependabot[bot] in #4838
• [gep-1713] ListenerSet: Fix typos and other inconsistencies by @dprotaso in #4824
• grpc: do not require unique hostnames with http by @howardjohn in #4598
• Add Ciilum conformance report for v1.5.1 by @youngnick in #4829
• Add conformance report for Varnish Gateway v0.20.0 by @perbu in #4831
• Enable golangci-lint modernize linter by @erikgb in #4821
• conformance: add cross-namespace ListenerSet AllowedRoutes test by @asauber in #4841
• [breaking change] Remove optional marker from ReferenceGrant.Spec by @bexxmodd in #4845
• Prevent arbitrary code execution hack scripts by @bexxmodd in #4846
• Fix Stored DOM XSS in Controller Wizard by @bexxmodd in #4848
• Migrate documentation from MkDocs to Docsy by @iromanycheva-eng in #4734
• Remove legacy mkdocs files by @rikatz in #4855
• add GEP 3965: Implementation-Specific Matches by @howardjohn in #4676
• fix wizard theme compatibility for dark mode by @bexxmodd in #4857
• build(deps): bump actions/setup-node from 4.1.0 to 6.4.0 by @dependabot[bot] in #4850
• Add verify-crdify script to detect breaking changes in CRDs by @ElenaZvereva in #4830
• Secure monthly-release workflow by @bexxmodd in #4849
• build(deps-dev): bump autoprefixer from 10.4.27 to 10.5.0 in /site by @dependabot[bot] in #4852
• test: retry simulation for echo-basic backend by @snorwin in #4862
• bump controller-tools by @rikatz in #4864
• docs: fix header background color by @snorwin in #4863
• build(deps): bump the k8s-io group across 4 directories with 5 updates by @dependabot[bot] in #4865
• fix: initialize retry count map to prevent nil map panic by @snorwin in #4866
• docs: add front matter to GEP pages to fix search links by @gcs278 in #4868
• cleanup: fix docs build variable mismatch and script error handling by @samzong in #4616
• EXP: Backend Resource by @keithmattix in #4488
• Update Envoy Gateway conformance report for v1.5.1 by @jukie in #4860
• docs: ensure example files reference proper pages + update API version by @JoeyC-Dev in #4840
• docs: fix broken links in README.md by @arybolovlev in #4877
• feat(echo-basic): Add UDP Echo server by @zac-nixon in #4871
• Update UDPRoute gep to add more conformance and clarification by @rikatz in #4879
• Update TCPRoute gep to add more conformance and clarification by @rikatz in #4878
• test(conformance): Add TCPRoute conformance tests for GEP-2644 by @zac-nixon in #4874
• test(conformance): add normative tests for HTTPRoute retries by @snorwin in #4817
• test(conformance): Add UDPRoute conformance tests for GEP-2645 by @zac-nixon in #4861
• Add guidance on API documentation by @rikatz in #4160
• Set release title to tag name in monthly release workflow by @bexxmodd in #4886
• conformance: make timeout and other fields configurable via yaml by @ericdbishop in #4773
• test: enhance retry simulation with TCP failure mode and retry delay by @snorwin in #4897
• test: remove backoff from normative HTTPRoute retry tests by @snorwin in #4898
• [release-1.6] bump dependencies and remove deprecated h2c package by @k8s-infra-cherrypick-robot in #4904
• [release-1.6] Skip conformance options test to avoid replacing flags by @k8s-infra-cherrypick-robot in #4906
• [release-1.6] api: use listType=set for HTTPRoute retry status codes and validate retry attempts >= 1 by @k8s-infra-cherrypick-robot in #4907
• [release-1.6] test(conformance) Touch up L4 conformance by @k8s-infra-cherrypick-robot in #4909
• [release-1.6] test(conformance): add test for HTTPRoute retries with timeouts by @k8s-infra-cherrypick-robot in #4910
• [release-1.6] conformance: add ListenerSet tests for Route parentRefs by @k8s-infra-cherrypick-robot in #4912
• [release-1.6] feat(apis): Promote TCPRoute to v1 by @k8s-infra-cherrypick-robot in #4920
• [release-1.6] feat(apis): Promote UDPRoute to v1 by @k8s-infra-cherrypick-robot in #4923
• [release-1.6] EXP: XBackend Implementation by @k8s-infra-cherrypick-robot in #4924
• [release-1.6] stop using selfsigned certificate on tlsroute tests and reuse cert function by @k8s-infra-cherrypick-robot in #4930
• [release-1.6] conformance: check pods in namespaces by @k8s-infra-cherrypick-robot in #4944
• [release-1.6] conformance: start the mirror log window before the requests are sent by @k8s-infra-cherrypick-robot in #4952
• [release-1.6] Close only the gRPC client the request helper owns by @k8s-infra-cherrypick-robot in #4953
• release v1.6.0-rc.1 by @bexxmodd in #4957
• Correct Backend in changelog by @keithmattix in #4964
• [release-1.6] Run Gateway and BackendTLSPolicy conformance tests in parallel by @k8s-infra-cherrypick-robot in #4967
• [release-1.6] chore: Update TCP && UDP Route version in conformance tests by @k8s-infra-cherrypick-robot in #4981
• [release-1.6] fix: enforce TLS configuration for HTTPS listeners via CEL by @k8s-infra-cherrypick-robot in #4985
• [release-1.6] fix: Invalid listener in TCPRouteInvalidNonTCPListener by @k8s-infra-cherrypick-robot in #4984
• [release-1.6] fix: remove HTTPRoute retry tests with connection errors and backend timeouts by @snorwin in #4994
• [release-1.6] test(conformance): add test covering shared and dedicated routes across multiple Gateways by @k8s-infra-cherrypick-robot in #4997
• [release-1.6] document tightened listener API validation as breaking change in CHANGELOG by @snorwin in #4983
• [release-1.6] conformance: avoid mirror log races (Backport of #4887) by @youngnick in #5002
• [release-1.6] Derive percentage-mirror tolerance from the binomial standard deviation by @k8s-infra-cherrypick-robot in #5005
• [release-1.6] Route the GRPCRouteWeight sampler through the injectable GRPCClient by @k8s-infra-cherrypick-robot in #5004
• [release-1.6] Add an injectable WebSocket dialer to the conformance suite by @k8s-infra-cherrypick-robot in #5003
• Preping v1.6.0-rc.2 release. by @bexxmodd in #5007

New Contributors

• @gkhom made their first contribution in #4775
• @alexanderstephan made their first contribution in #4332
• @perbu made their first contribution in #4831
• @ElenaZvereva made their first contribution in #4830
• @arybolovlev made their first contribution in #4877

Full Changelog: monthly-2026.05...v1.6.0-rc.2