2.14.2

Changelog

• chore(deps): bump coredns from 1.14.2 to 1.14.6 #17400 @kumahq
• chore(deps): security update #17521 #17621 #17683 @kumahq
• chore(deps): use latest kumahq/kuma-gui #17726 @kumahq
• feat(api-server): add pluggable per-route metadata provider (backport of #17365) #17374 @kumahq
• feat(xds): unified-name for empty listener tags (backport of #17563) #17671 @kumahq
• fix(ServiceInsight): keep delegated gateways when meshServices.mode is Exclusive (backport of #17431) #17455 @kumahq
• fix(api-server): return after HandleError in inspect handlers #17571 @lobkovilya
• fix(auth): require workload-bound token for workload-derived identity (backport of #17474) #17502 @kumahq
• fix(k8s): copy node labels to Dataplane labels (backport of #17480) #17569 @kumahq
• fix(kds): attribute zone-to-global synced resources by the connecting zone's client-id (backport of #17456) #17458 @kumahq
• fix(kuma-dp): restrict readiness reporter to /ready (backport of #17317) #17418 @kumahq
• fix(mesh): gateway tag not required tagless #17611 @Automaat
• fix(meshaccesslog): match rule-scoped route ids #17550 @Automaat
• fix(meshproxypatch): match unified listener names #17546 @Automaat
• fix(meshservice): identities fallback tagless #17658 @Automaat
• fix(mtls): derive identity without tags #17609 @Automaat
• fix(mtp): unified naming for zone egress #17561 @Automaat
• fix(tokens): reject a non-string kid header and recover from dp-server handler panics (backport of #17465) #17468 @bartsmykla
• fix(xds): fix inbound cluster name lookup #17505 @Automaat
• fix(xds): fix unified naming detection for zone proxies #17512 @Automaat
• fix(xds): probe fallback route uses unified cluster name #17499 @Automaat
• fix(xds): throttle dataplane cert issuance on CA failure (backport of #17448) #17711 @kumahq
• fix(xds): unified naming for zone-proxy admin cluster #17544 @Automaat
• fix(xds): zone fallback for tagless dataplanes #17674 @Automaat