2.9.0

We are excited to announce the latest release !

Notable Changes

MeshService and MeshMultiZoneService

A new, more robust way of representing services and managing the traffic in Kuma. Read more here and here.

Producer consumer policies

A new, more Kubernetes-native way of managing policies by service owners. Fully compatible with multi-zone deployments. Read more here.

Selective mTLS with a new MeshTLS policy

Roll out mTLS by leveraging permissive mTLS settings on individual services. Read more here.

More robust transparent proxying

Transparent proxy is now more consistent, easier to configure and observe.

Changelog

• chore(deps): bump Kong/public-shared-actions from 2.3.0 to 2.7.3 #11139 #11218 #11263 #11310 #11518 #11598 #11696 @dependabot
• chore(deps): bump coredns from v1.11.1 to v1.11.3 #11568 @michaelbeaumont
• chore(deps): bump debian from 12.5 to 27586f4 #10756 #11007 #11142 #11357 #11596 @dependabot
• chore(deps): bump distroless/base-nossl-debian11 from 1dcd82e to d66c60e #10823 @dependabot
• chore(deps): bump distroless/static-debian11 from 459f8ab to 55716e8 #10824 @dependabot
• chore(deps): bump envoy from 1.30.2 to 1.30.6 #10645 #10692 #11488 @lukidzi
• chore(deps): bump github.com/Masterminds/semver/v3 from 3.2.1 to 3.3.0 #11259 @dependabot
• chore(deps): bump github.com/Masterminds/sprig/v3 from 3.2.3 to 3.3.0 #11281 @dependabot
• chore(deps): bump github.com/cilium/ebpf from 0.15.0 to 0.16.0 #11006 @dependabot
• chore(deps): bump github.com/containernetworking/cni from 1.2.1 to 1.2.3 #10703 #10939 @dependabot
• chore(deps): bump github.com/docker/docker from 27.0.3+incompatible to 27.1.1+incompatible #11012 #11084 @dependabot
• chore(deps): bump github.com/envoyproxy/protoc-gen-validate from 1.0.4 to 1.1.0 #11097 @dependabot
• chore(deps): bump github.com/exaring/otelpgx from 0.6.1 to 0.6.2 #10701 @dependabot
• chore(deps): bump github.com/golang-migrate/migrate/v4 from 4.17.1 to 4.18.1 #11353 @dependabot
• chore(deps): bump github.com/gruntwork-io/terratest from 0.46.15 to 0.47.2 #10700 #10899 #11282 #11677 @dependabot
• chore(deps): bump github.com/jackc/pgx/v5 from 5.6.0 to 5.7.1 #11358 #11436 @dependabot
• chore(deps): bump github.com/miekg/dns from 1.1.61 to 1.1.62 #11117 @dependabot
• chore(deps): bump github.com/moby/sys/mountinfo from 0.7.1 to 0.7.2 #10938 @dependabot
• chore(deps): bump github.com/onsi/ginkgo/v2 from 2.19.0 to 2.20.2 #11005 #11099 #11212 #11258 @dependabot
• chore(deps): bump github.com/onsi/gomega from 1.33.1 to 1.34.2 #11004 #11048 #11262 @dependabot
• chore(deps): bump github.com/prometheus/client_golang from 1.19.1 to 1.20.4 #11119 #11215 #11352 #11522 @dependabot
• chore(deps): bump github.com/prometheus/common from 0.54.0 to 0.60.0 #10702 #11260 #11313 #11356 #11681 @dependabot
• chore(deps): bump github.com/sethvargo/go-retry from 0.2.4 to 0.3.0 #11046 @dependabot
• chore(deps): bump github.com/slok/go-http-metrics from 0.11.0 to 0.13.0 #10037 #11354 @dependabot
• chore(deps): bump github.com/spiffe/go-spiffe/v2 from 2.3.0 to 2.4.0 #11680 @dependabot
• chore(deps): bump github.com/testcontainers/testcontainers-go from 0.31.0 to 0.33.0 #10827 #11214 @dependabot
• chore(deps): bump github.com/tonglil/opentelemetry-go-datadog-propagator from 0.1.2 to 0.1.3 #10699 @dependabot
• chore(deps): bump github.com/vishvananda/netlink from 1.2.1-beta.2 to 1.3.0 #11213 @dependabot
• chore(deps): bump go from 1.22.7 to 1.23.2 #11363 #11631 @michaelbeaumont,@slonka
• chore(deps): bump golang.org/x/net from 0.26.0 to 0.30.0 #10826 #11096 #11355 #11683 @dependabot
• chore(deps): bump golang.org/x/sys from 0.21.0 to 0.26.0 #10825 #11047 #11098 #11314 #11679 @dependabot
• chore(deps): bump golang.org/x/text from 0.16.0 to 0.19.0 #11100 #11315 #11678 @dependabot
• chore(deps): bump gonum.org/v1/gonum from 0.15.0 to 0.15.1 #11138 @dependabot
• chore(deps): bump google.golang.org/grpc from 1.64.0 to 1.67.0 #10758 #11521 @dependabot
• chore(deps): bump google.golang.org/protobuf from 1.34.2 to 1.35.1 #11699 @dependabot
• chore(deps): bump helm.sh/helm/v3 from 3.14.4 to 3.16.1 #10531 #10898 #11118 #11435 @dependabot
• chore(deps): bump kumahq/ubuntu-netools from 8675216 to 4243009 #10704 @dependabot
• chore(deps): bump postgres from 46aa2ee to 4ec37d2 #10755 #11008 #11101 #11136 #11351 #11600 @dependabot
• chore(deps): bump sigs.k8s.io/controller-tools from 0.16.1 to 0.16.2 #11280 @dependabot
• chore(deps): bump sigs.k8s.io/gateway-api from 1.1.0 to 1.2.0 #11676 @dependabot
• chore(deps): bump the go-opentelemetry-io group across 1 directory with 9 updates #10767 @dependabot
• chore(deps): bump the go-opentelemetry-io group with 9 updates #11211 #11433 @dependabot
• chore(deps): bump the k8s-libs group across 1 directory with 10 updates #10759 @dependabot
• chore(deps): bump the k8s-libs group with 5 updates #10937 @dependabot
• chore(deps): bump the k8s-libs group with 6 updates #11432 @dependabot
• chore(deps): bump the k8s-libs group with 8 updates #11137 @dependabot
• chore(deps): bump ubuntu from jammy-20240530 to jammy-20240808 #11141 @dependabot
• chore(deps): security update #11331 @kumahq
• ch...

2.8.4

Changelog

• chore(deps): bump coredns from v1.11.1 to v1.11.3 #11574 @kumahq
• chore(deps): bump golang from 1.22.7 to 1.22.8 #11630 @Icarus9913
• chore(deps): security update #11330 @kumahq
• chore(deps): upgrade envoy to 1.30.6 #11487 @lukidzi
• fix(MeshTrace): invalid sampling default values (backport of #11548) #11551 @kumahq
• fix(egress): same external service tag in multiple meshes (backport of #11667) #11671 @kumahq
• fix(meshgateway): do not override annotations from deployment (backport of #10698) #11616 @kumahq
• fix(xds): eds deadlock on initial fetch timeout (backport of #11602) #11606 @kumahq
• revert(kuma-cp): do not use additional addresses (backport of #11601) #11609 @kumahq

2.7.8

Changelog

• chore(deps): bump coredns from v1.11.1 to v1.11.3 #11575 @kumahq
• chore(deps): bump golang from 1.22.7 to 1.22.8 #11629 @Icarus9913
• chore(deps): security update #11329 @kumahq
• chore(deps): upgrade envoy to 1.29.9 #11486 @lukidzi
• fix(MeshTrace): invalid sampling default values (backport of #11548) #11552 @kumahq
• fix(egress): same external service tag in multiple meshes (backport of #11667) #11670 @kumahq
• fix(meshgateway): do not override annotations from deployment (backport of #10698) #11618 @kumahq
• fix(xds): eds deadlock on initial fetch timeout (backport of #11602) #11605 @kumahq
• revert(kuma-cp): do not use additional addresses (backport of #11601) #11612 @kumahq

2.6.12

This is a patch release that every user should upgrade to.

Changelog

• chore(deps): bump coredns from v1.11.1 to v1.11.3 #11576 @kumahq
• chore(deps): bump golang from 1.22.7 to 1.22.8 #11628 @Icarus9913
• chore(deps): security update #11333 @kumahq
• chore(deps): upgrade envoy to 1.28.7 #11485 @lukidzi
• fix(MeshTrace): invalid sampling default values (backport of #11548) #11553 @kumahq
• fix(egress): same external service tag in multiple meshes (backport of #11667) #11669 @kumahq
• fix(meshgateway): do not override annotations from deployment (backport of #10698) #11619 @kumahq
• fix(xds): eds deadlock on initial fetch timeout (backport of #11602) #11607 @kumahq
• revert(kuma-cp): do not use additional addresses (backport of #11601) #11611 @kumahq

2.5.11

This is a patch release that every user should upgrade to.

Changelog

• chore(deps): bump coredns from v1.11.1 to v1.11.3 #11573 @kumahq
• chore(deps): bump golang from 1.22.7 to 1.22.8 #11627 @Icarus9913
• chore(deps): security update #11332 @kumahq
• chore(deps): upgrade envoy to 1.28.7 #11484 @lukidzi
• fix(egress): same external service tag in multiple meshes (backport of #11667) #11668 @kumahq
• fix(meshgateway): do not override annotations from deployment (backport of #10698) #11617 @kumahq
• fix(xds): eds deadlock on initial fetch timeout (backport of #11602) #11608 @kumahq

2.8.3

This is a patch release that every user should upgrade to.

Changelog

• chore(deps): bump Kong/public-shared-actions from 2.3.0 to 2.4.0 #11147 @kumahq
• chore(deps): bump github.com/testcontainers/testcontainers-go from 0.31.0 to 0.32.0 #11158 @kumahq
• chore(deps): security update #11199 @kumahq
• feat(kuma-dp): respond probes of kuma-sidecar from kuma-dp process instead of Envoy (backport of #11107) #11238 @kumahq
• fix(kuma-cp): paginate Secrets correctly in universal (backport of #10954) #10959 @kumahq
• fix(meshhttproute): deref pointer to weight or use default 1 (backport of #11051) #11130 @kumahq
• fix(meshmetric): add missing timestamp in mapper (backport of #10966) #10980 @kumahq
• fix(xds): explicitly set initial fetch timeout to zero to keep Envoy wait for xds resources (backport of #11024) #11025 @kumahq

2.7.7

This is a patch release that every user should upgrade to.

Changelog

• chore(deps): bump Kong/public-shared-actions from 2.3.0 to 2.4.0 #11150 @kumahq
• chore(deps): bump github.com/testcontainers/testcontainers-go from 0.31.0 to 0.32.0 #11156 @kumahq
• chore(deps): security update #11198 @kumahq
• feat(kuma-dp): respond probes of kuma-sidecar from kuma-dp process instead of Envoy (backport of #11107) #11242 @kumahq
• fix(kuma-cp): paginate Secrets correctly in universal (backport of #10954) #10958 @kumahq
• fix(meshhttproute): deref pointer to weight or use default 1 (backport of #11051) #11129 @kumahq
• fix(meshmetric): add missing timestamp in mapper (backport of #10966) #10978 @kumahq
• fix(xds): explicitly set initial fetch timeout to zero to keep Envoy wait for xds resources (backport of #11024) #11026 @kumahq

2.6.11

This is a patch release that every user should upgrade to.

Changelog

• chore(deps): security update #11200 @kumahq
• feat(kuma-dp): respond probes of kuma-sidecar from kuma-dp process instead of Envoy #11241 @kumahq
• fix(kuma-cp): paginate Secrets correctly in universal (backport of #10954) #10955 @kumahq
• fix(meshhttproute): deref pointer to weight or use default 1 (backport of #11051) #11127 @kumahq
• fix(meshmetric): add missing timestamp in mapper (backport of #10966) #10977 @kumahq
• fix(xds): explicitly set initial fetch timeout to zero to keep Envoy wait for xds resources (backport of #11024) #11028 @kumahq

2.5.10

This is a patch release that every user should upgrade to.

Changelog

• chore(deps): security update #11196 @kumahq
• feat(kuma-dp): respond probes of kuma-sidecar from kuma-dp process instead of Envoy #11239 @kumahq
• fix(kuma-cp): paginate Secrets correctly in universal (backport of #10954) #10957 @kumahq
• fix(xds): explicitly set initial fetch timeout to zero to keep Envoy wait for xds resources (backport of #11024) #11029 @kumahq

2.4.10

This is a patch release that every user should upgrade to.

Changelog

• chore(deps): update go to 1.22.5 (backport of #10096) #10855 @kumahq
• chore(deps): upgrade envoy with DNS fix #10930 @michaelbeaumont