v1.9.1

Updated Envoy Gateway to v1.9.1.

Breaking Changes

• HTTP is no longer accepted as the scheme of the OIDC issuer URL in SecurityPolicy. Policies pointing at a plain-HTTP issuer are now rejected instead of silently configuring an insecure flow.
• OCI Wasm image pulls now require the registry to serve HTTPS. The implicit fallback to plain HTTP has been removed, so an EnvoyExtensionPolicy Wasm extension backed by a plain-HTTP registry fails to load unless that registry is explicitly configured as insecure.
• The 0s initial timeout for SDS and RDS was reverted because it could make Envoy wait indefinitely and block subsequent xDS updates. Both are back to the default 15-second initial timeout.
• The bucket boundaries of the watchable_subscribe_duration_seconds histogram changed from {0.001, 0.01, 0.1, 1, 5, 10} to {0.005, 0.025, 0.1, 0.25, 0.5, 1, 2, 4, 8, 15, 30, 60, 120} to improve latency resolution. The metric name and its _sum/_count series are unchanged, but _bucket series with le="0.001", le="0.01", le="5" and le="10" are no longer emitted. Update any dashboard, alert or recording rule that references the removed boundaries directly; queries that aggregate dynamically by le, such as histogram_quantile(), need no change.

Security Updates

• OAuth2/OIDC session cookies are now encrypted with AES-256-GCM, and the legacy AES-256-CBC decryption path is disabled in the Envoy proxy bootstrap, addressing the padding oracle in CVE-2026-47775. Sessions established before the upgrade were encrypted with AES-256-CBC and are no longer accepted, so users with an active session are redirected to re-authenticate once. This is set in the default bootstrap, so an EnvoyProxy that replaces the bootstrap via spec.bootstrap (type Replace, the default when no type is given) does not receive it; OIDC users with a replacement bootstrap must add envoy.reloadable_features.oauth2_use_gcm_encryption: true and envoy.reloadable_features.oauth2_legacy_cbc_decrypt_compat: false to a layered_runtime static layer themselves.
• Fixed a confused-deputy/PSA-escape issue (GHSA-w42f-28h3-998w) where a tenant-supplied KubernetesContainerSpec.SecurityContext on an EnvoyProxy replaced the hardened default SecurityContext outright instead of merging on top of it, letting a tenant whose EnvoyProxy is materialized in the shared controller namespace drop restrictions (for example, run privileged or as root) that the controller namespace's Pod Security Admission would otherwise enforce.
• Fixed OCI Wasm image pulls silently downgrading to plain HTTP when the registry rejected the HTTPS request, which allowed an on-path attacker to serve arbitrary Wasm code to the Envoy proxies. Plain HTTP is now used only for registries that are explicitly configured as insecure. Wasm image permission handling also no longer risks control-plane availability, and its cache key now includes the CA certificate, so a permission check result is no longer reused across different TLS trust configurations.
• Added validation for the OIDC issuer URL configured in SecurityPolicy.
• Fixed a nil pointer dereference in SecurityPolicy translation for TCPRoutes. A listener with no corresponding xDS IR entry — for example a Gateway listener marked Conflicted for sharing a port with another listener — could panic the control plane during translation, silently dropping that reconcile's IR and status publication.
• Bumped the Go toolchain to 1.26.7, which includes the latest security fixes from upstream Go.

Bug Fixes

• Fixed OIDC flow-state cookies accumulating in the browser and overflowing the request header size limit. Envoy mints a nonce (CSRF) and a PKCE code verifier cookie for every authorization flow it starts, but only deletes the pair belonging to the flow that completes the callback, so abandoned flows leave their cookies behind until they expire. Both cookies are now scoped to the OIDC redirect path, so orphans are no longer sent on every request — this bounds the damage rather than eliminating it, so also consider lowering csrfTokenTTL. The PKCE code verifier cookie is also now named CodeVerifier-<suffix>, carrying the same per-policy suffix as the other OAuth2 cookies, so SecurityPolicies on the same cookie domain no longer delete each other's in-flight flow cookies on logout. On upgrade, a browser already holding flow cookies keeps them at the old path=/ and they expire on the lifetime they were originally issued with; a login in progress across the rollout may need to be retried once.
• Fixed HTTPRoute (and other xRoute) acceptance not being re-evaluated when a namespace's labels changed to newly match, or stop matching, a Gateway listener's allowedRoutes.namespaces.from: Selector, which previously required a controller restart to pick up. Namespace label updates are now watched and affected Gateways re-reconciled automatically.
• Fixed HTTPRoutes attached to a listener that won a hostname conflict being rejected with NoMatchingListenerHostname and omitted from xDS.
• Fixed the controller crash-looping when an extension manager's backendResources references a CRD that is not installed in the cluster.
• The global rate limit cluster is now built from the in-cluster envoy-ratelimit Service and EndpointSlices using EDS instead of resolving a static DNS hostname, so requests keep hitting rate limit service replicas correctly as they scale up and down. When the Service or its endpoints cannot be discovered, it falls back to the previous STRICT_DNS behavior.
• Fixed the File and ALS access log sinks silently falling back to the default JSON fields when telemetry.accessLog.settings[].format sets text without type, which the API accepts.
• Fixed a BackendTrafficPolicy setting a ConsistentHash load balancer having no effect when it targets a UDPRoute. The source IP hash policy is now configured on the UDP proxy. Only the SourceIP consistent hash type applies to UDP, since headers, cookies and query parameters do not exist in a UDP datagram.
• Fixed a controller panic when translating backend credential injection with an invalid header.

Performance Improvements

• Improved reconcile performance by listing the extension manager's resources and backendResources once per GatewayClass instead of once per Gateway.

Other Changes

• Bumped Envoy Gateway to v1.9.1.
• Bumped Envoy to v1.39.1.
• Bumped the Go toolchain to 1.26.7.
• Bumped the Redis image deployed by the TEG Helm chart to 8.6.6.
• Bumped the Keycloak demo chart to 26.7.2.
• Bumped the Rate Limit service. The community edition follows the Envoy Gateway subchart default, which moves to docker.io/envoyproxy/ratelimit:8fe6ea42 with EG v1.9.1. The enterprise and enterprise FIPS editions now pin the Tetrate Rate Limit builds — docker.io/tetrate/ratelimit:v2026.08.31.0 and fips-containers.teg.tetratelabs.com/ratelimit:v2026.08.31.0-fips — replacing the community default the enterprise edition previously inherited and the rolling master-fips tag the FIPS edition tracked.
• Added per-phase tracing spans to the Gateway API and xDS translators, each recording the size of the input it processed, so a slow translation can be attributed to a specific phase — listener processing, HTTP and gRPC route processing, the main policy types, EnvoyPatchPolicy JSON patches, extension server hooks, and xDS resource validation — instead of showing up as one opaque multi-second span.