2.12.15

Changelog

• chore(deps): bump coredns to v1.14.7 #18318 @lukidzi
• chore(deps): bump distroless base images #18120 @bartsmykla
• chore(deps): bump envoy from 1.35.13 to 1.36.10 #18223 @lukidzi
• chore(deps): bump github.com/cilium/ebpf from 0.19.0 to 0.22.0 #18106 @renovate
• chore(deps): bump github.com/moby/go-archive from 0.1.0 to 0.3.3 #18112 @bartsmykla
• chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 #18358 @renovate
• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.2 #18311 #18588 @renovate
• chore(deps): security update #18065 #18138 @kumahq
• chore(helm): control plane, hook, ingress and egress containers now drop all Linux capabilities and disallow privilege escalation #18130 @bartsmykla
• feat(labels): compute kuma.io/display-name for all resources (backport of #17162) #18163 @kumahq
• feat(labels): compute kuma.io/origin on global and zone control planes (backport of #17176) (backport of #18279) #18372 @kumahq
• fix(k8s): enforce control-plane-owned labels on read (backport of #18271) #18395 @kumahq
• fix(k8s): reject user-set service-account label (backport of #18273) #18287 @kumahq
• fix(k8s): scope gateway mapper logger per call #18216 @lukidzi
• fix(labels): make Compute authoritative for zone, env, namespace and service-account (backport of #18410) #18575 @kumahq
• fix(meshmetric): honor includeUnused sidecar flag #18483 @kumahq
• fix(meshtls): apply tls params without inbounds (backport of #18444) #18448 @kumahq
• perf(rules): cut allocations in rule building (backport of #17954) #18049 @kumahq