2.14.4

Changelog

• chore(deps): bump coredns to v1.14.7 #18320 @lukidzi
• chore(deps): bump envoy from 1.38.3 to 1.38.4 #18225 @lukidzi
• chore(deps): bump github.com/cilium/ebpf from 0.21.0 to 0.22.0 #18107 @renovate
• chore(deps): bump github.com/google/cel-go from 0.29.0 to 0.30.0 #18139 @renovate
• chore(deps): bump github.com/moby/go-archive from 0.2.0 to 0.3.3 #18110 @bartsmykla
• chore(deps): security update #18064 #18305 @kumahq
• chore(helm): control plane, hook, ingress and egress containers now drop all Linux capabilities and disallow privilege escalation #18128 @bartsmykla
• feat(labels): compute kuma.io/display-name for all resources (backport of #17162) #18161 @kumahq
• feat(labels): compute kuma.io/origin on global and zone control planes (backport of #17176) #18279 @kumahq
• fix(api-server): avoid nil deref in _layout #18144 @lukidzi
• fix(k8s): drop terminating egress from endpoints #18145 @lukidzi
• fix(k8s): enforce control-plane-owned labels on read (backport of #18271) #18281 @kumahq
• fix(k8s): reject user-set service-account label (backport of #18273) #18289 @kumahq
• fix(k8s): scope gateway mapper logger per call #18214 @lukidzi
• fix(kds): retry sync updates on write conflicts (backport of #17738) #17841 @kumahq
• fix(kuma-cp): advertise a zone ingress node that serves traffic #18213 @kumahq
• fix(kuma-dp): bind readiness wildcard on k8s #18341 @Automaat
• fix(meshhttproute): resolve mirror backendRef (backport of #17676) #17849 @kumahq
• fix(meshproxypatch): honor circuit breaker patches (backport of #18207) #18257 @kumahq
• fix(xds): build cross-zone SNI from port name (backport of #17739) #17840 @kumahq
• fix(xds): do not mutate the cached Dataplane #18008 @slonka
• fix(xds): resolve MeshZoneAddress hostname for EDS #17843 @lukidzi
• perf(rules): cut allocations in rule building #17954 @slonka