v1.8.3

Updated Envoy Gateway to v1.8.3.

Breaking Changes

• Moved EnvoyExtensionPolicy Lua source code from per-route LuaPerRoute overrides to listener-level Lua filters to avoid route-count-dependent memory growth. This changes the generated xDS Lua filter names and configuration layout; EnvoyPatchPolicy resources and extension servers that match the previous envoy.filters.http.lua/<index> keys must be updated.

Security Updates

• Bumped Envoy Gateway to v1.8.3 for security and bug fixes.
• Updated the distroless base image.

Bug Fixes

• Fixed backend (upstream) TLS connections being capped at TLS 1.2 by default; they now default to a max of TLS 1.3 as documented.
• Fixed TLS Secrets being pushed to Envoy and rejected by BoringSSL (KEY_VALUES_MISMATCH), which — with mergeGateways enabled — broke TLS for all Gateways sharing the proxy. A serving certificate chain that contains an expired (or malformed) certificate is now rejected during translation instead of having the expired member silently dropped (which corrupted the chain), and a Secret whose certificate and private key do not match is likewise rejected; both failures are isolated to the referencing listener. CA bundles used for client validation still drop expired CAs.
• Fixed a data race that could crash envoy-gateway with panic: reflect: slice index out of range when the watchable coalesce goroutine compared the xDS IR with reflect.DeepEqual while the translator concurrently mutated resource status in place; the translator now isolates status mutations by deep-copying only the status field of each resource at the start of translation.
• Fixed unreferenced Secret events triggering a full reconciliation whenever the HTTPRouteFilter CRD is installed. Every Secret write in the cluster previously enqueued a reconcile, causing sustained reconcile storms on clusters with high-frequency Secret writers (secret-sync controllers, certificate rotation).
• Fixed Wasm extensions remaining permanently failed after transient errors fetching the Wasm module. Envoy's built-in behavior only retried the fetch once after ~1 second and never re-attempted it, leaving the filter failed until the next configuration update. Envoy Gateway now configures the fetch with up to 10 retries using jittered exponential backoff (1s base interval, 30s max interval).
• Fixed log timestamps regressing to Unix epoch floats (e.g. 1.784e+09) since v1.8.0 by explicitly setting ISO8601TimeEncoder on the production zap encoder config, restoring the expected ISO 8601 format (e.g. 2026-07-14T17:44:06.617Z).
• Fixed IPv6 literal hosts (e.g. [::1], [2001:db8::1]) not being detected in OIDC token/JWKS endpoints, which caused them to be built as STRICT_DNS clusters instead of static ones and bypassed the IP-literal check on the SecurityPolicy token endpoint.
• Fixed the gateway-helm chart resolving the ratelimit image to an outdated build (ff287602 instead of 1e50889b) when global.images.ratelimit.image is set without a tag.

Other Changes

• Bumped the BOE composer dynamic module to v0.10.0, which fixes the waf_tx_duration metric to measure only the time spent in the WAF filter callbacks (the actual WAF-added latency) instead of the lifetime of the entire connection. The WAF transaction is now finalized as soon as inspection completes rather than at stream completion, so long-lived streams no longer leave the transaction pinned or emit the metric much later.
• Bumped the ratelimit service to f2fb1577.