v1.9.2

Updated Envoy Gateway to v1.9.2.

Breaking Changes

• Lua scripts that use the getfenv, setfenv, newproxy or module globals now fail Strict Lua validation, which is the default mode. Rewrite the script without them, or set EnvoyProxy.spec.lua.validationType to InsecureSyntax or Disabled.
• In ControllerNamespace mode, user-defined EnvoyProxy resources may no longer name, mount or reference the controller-owned resources. See the security updates below for the exact rules; an EnvoyProxy that relied on any of them is now rejected.

Security Updates

• Hardened the Lua validation sandbox by blocking the getfenv, setfenv, newproxy and module globals.
• Prevented user-defined proxies from conflicting with or using controller-owned resources in ControllerNamespace mode. The following are now rejected: resource names colliding with envoy-gateway or envoy-gateway-config; service account names matching the controller's own service account or the certgen service account (<fullname>-certgen, where <fullname> is the Helm release fullname, defaulting to envoy-gateway); volumes mounting the envoy-gateway Secret or ConfigMap; and environment variables referencing those resources via secretKeyRef, configMapKeyRef or envFrom.
• Added an EnvoyProxyPatch runtime flag to EnvoyGateway. EnvoyProxy Kubernetes resource patch fields can grant arbitrary access to resources applied by Envoy Gateway's more privileged service account when the EnvoyProxy is namespace-scoped and tenant-authored. The flag is enabled by default to preserve the existing behavior; multi-tenant clusters where tenants can author their own EnvoyProxy resources should disable it through runtimeFlags.disabled.
• Fixed a panic in the xDS server's Kubernetes JWT authentication when the TokenReview response contains an Extra field without the pod name key (authentication.kubernetes.io/pod-name). Such tokens, for example service account tokens not bound to a pod, are now rejected with an Unauthenticated error instead of crashing the control plane.
• Bumped the Go toolchain to 1.26.8, which includes the latest security fixes from upstream Go.
• Bumped the Tetrate Rate Limit builds pinned by the enterprise and enterprise FIPS editions, picking up the google.golang.org/grpc 1.83.2, grpc-gateway 2.30.0 and OpenTelemetry 1.45.0 dependency fixes.

Bug Fixes

• WAF directives of ExtendedSecurityPolicies are now sent on the route configuration (DynamicModuleFilterPerRoute in the route's typedPerFilterConfig) instead of on the listener's HTTP filter. Editing them no longer changes the listener, so Envoy no longer drains it and drops long-lived connections for every route on it. The first rollout changes the listener once as the directives move off it. Requests that match no route are no longer inspected by a Gateway- or GatewayClass-level WAF; they still get a 404 and never reach a backend.
• The WAF dynamic module now shares its WAF instances across configuration updates instead of rebuilding them on every update, and the waf_tx_duration metric is recorded in microseconds as documented.
• Fixed a duplicate filter chain matcher error when a TLS listener with no attached routes shares a port with an HTTPS listener, which caused Envoy to reject every subsequent xDS update to that listener.
• Fixed HTTPS and TLS listeners from different merged Gateways sharing a port and a hostname being accepted, which produced two Envoy filter chains with the same SNI match and caused Envoy to reject the listener.
• Fixed mergeBackends applying a whole-Gateway BackendTrafficPolicy's entire cluster-scoped feature set to merged UDP and TCP clusters regardless of the backend's protocol. Enabling cluster deduplication could put healthCheck, circuitBreaker, tcpKeepalive, proxyProtocol, http2, useClientProtocol and HttpProtocolOptions on a cluster that udp_proxy routes to, most damagingly running TCP/HTTP health checks against a UDP-only port. A merged cluster now receives only what the same policy would produce for that protocol without mergeBackends.
• Fixed mergeBackends being unnecessarily disabled for HTTP and gRPC rules using gateway-level ConsistentHash load balancing.
• Fixed the xDS translator emitting equivalent-but-byte-different resources on every reconcile: filter typed_config was marshaled non-deterministically, so proto map fields (such as an access log's json_format) re-ordered their keys each translation and caused repeated no-op xDS pushes. Typed configs are now marshaled deterministically.
• Fixed ClientTrafficPolicy rejecting BoringSSL equal-preference cipher groups such as [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305] as an unsupported cipher suite. Each member of a group is now validated on its own.
• Fixed local rate limiting for Distinct client selectors to retain up to 10,000 per-value token buckets per wildcard descriptor by applying the cache limit to each route's filter configuration instead of relying on Envoy's default of 20.
• Fixed rateLimitDeployment.pod.priorityClassName being ignored when rendering the rate limit Deployment, so the configured PriorityClass is now applied to the rate limit pod the same way it is for the Envoy proxy Deployment.
• Fixed the shutdown manager exiting after the minimum drain period while UDP proxy sessions were still active. The drain now also waits for udp.*.downstream_sess_active to reach the exit threshold. UDP sessions only close on their idle timeout (60s by default), so a proxy that has handled UDP traffic recently may wait until the drain timeout before exiting.
• Fixed a panic during shutdown caused by closing the shared infraIR/pResources channels and resource maps before all runner goroutines still consuming or writing to them had exited.

Performance Improvements

• Reduced control-plane memory on gateways where many backends validate against the same CA by storing each upstream CA bundle once per gateway and referencing it by a digest of its content, instead of carrying a copy on every route destination.
• Reduced xDS translation work for listeners with many routes by computing GeoIP header removals once per listener.
• Reduced repeated JSON decoding and encoding when JSONPath patches match multiple locations.

Other Changes

• Bumped Envoy Gateway to v1.9.2.
• Bumped the Go toolchain to 1.26.8.
• Bumped the Redis image deployed by the TEG Helm chart to 8.6.7.
• Bumped the Keycloak demo chart to 26.7.4.
• Envoy stays at v1.39.1, matching Envoy Gateway v1.9.2.
• Bumped the BOE composer dynamic module to 0.12.0, which also adds versioned-suffix support to Go plugin loader URLs and moves to Go 1.27.1.
• Bumped the Rate Limit service. The community edition follows the Envoy Gateway subchart default, which moves to docker.io/envoyproxy/ratelimit:0482748e with EG v1.9.2. The enterprise and enterprise FIPS editions now pin docker.io/tetrate/ratelimit:v2026.09.30.1 and fips-containers.teg.tetratelabs.com/ratelimit:v2026.09.30.1. The FIPS image no longer carries a -fips tag suffix, since that registry only serves FIPS builds.
• The TEG control-plane image now pins its distroless base image by digest, so the exact base can be verified and reproduced.