v1.8.4

Updated Envoy Gateway to v1.8.4.

Breaking Changes

• HTTP is no longer accepted as the scheme of the OIDC issuer URL in SecurityPolicy. Policies pointing at a plain-HTTP issuer are now rejected instead of silently configuring an insecure flow.
• OCI Wasm image pulls now require the registry to serve HTTPS. The implicit fallback to plain HTTP has been removed, so an EnvoyExtensionPolicy Wasm extension backed by a plain-HTTP registry fails to load unless that registry is explicitly configured as insecure.
• The SDS (Secret Discovery Service) reference secret url field must now include the unix:// scheme, for example unix:///var/run/secrets/workload-spiffe-uds/socket. Bare filesystem paths that were previously accepted are now rejected and must be updated.

Security Updates

• OAuth2/OIDC session cookies are now encrypted with AES-256-GCM, and the legacy AES-256-CBC decryption path is disabled in the Envoy proxy bootstrap, addressing the padding oracle in CVE-2026-47775. Sessions established before the upgrade were encrypted with AES-256-CBC and are no longer accepted, so users with an active session are redirected to re-authenticate once. This is set in the default bootstrap, so an EnvoyProxy that replaces the bootstrap via spec.bootstrap (type Replace, the default when no type is given) does not receive it; OIDC users with a replacement bootstrap must add envoy.reloadable_features.oauth2_use_gcm_encryption: true and envoy.reloadable_features.oauth2_legacy_cbc_decrypt_compat: false to a layered_runtime static layer themselves.
• Fixed a confused-deputy/PSA-escape issue (GHSA-w42f-28h3-998w) where a tenant-supplied KubernetesContainerSpec.SecurityContext on an EnvoyProxy replaced the hardened default SecurityContext outright instead of merging on top of it, letting a tenant whose EnvoyProxy is materialized in the shared controller namespace drop restrictions (for example, run privileged or as root) that the controller namespace's Pod Security Admission would otherwise enforce.
• Fixed OCI Wasm image pulls silently downgrading to plain HTTP when the registry rejected the HTTPS request, which allowed an on-path attacker to serve arbitrary Wasm code to the Envoy proxies. Plain HTTP is now used only for registries that are explicitly configured as insecure. Wasm image permission handling also no longer risks control-plane availability, and its cache key now includes the CA certificate, so a permission check result is no longer reused across different TLS trust configurations.
• Added validation for the OIDC issuer URL configured in SecurityPolicy.
• Fixed a nil pointer dereference in SecurityPolicy translation for TCPRoutes. A listener with no corresponding xDS IR entry — for example a Gateway listener marked Conflicted for sharing a port with another listener — could panic the control plane during translation, silently dropping that reconcile's IR and status publication.
• Bumped Envoy to 1.38.4 and the Go toolchain to 1.26.7, which include the latest upstream security fixes.

Bug Fixes

• Fixed route and policy status never being written under high watch-event churn. When the informer cache lagged behind the API server, the status updater's cache-backed Get could return NotFound for a freshly created object and silently skip the status write, leaving the object with an empty status until a controller restart. The status updater now confirms a NotFound against an uncached reader before dropping the update.
• Fixed the control plane crash-looping at startup on clusters whose Gateway API CRD bundle omits ListenerSet, GRPCRoute or TLSRoute — such as GKE's managed gateway-api-crds addon — or omits BackendTLSPolicy, such as OpenShift's Ingress-Operator-managed set. Those watches are now conditional on the CRD being present.
• Fixed the control plane overriding the replica count computed by an HPA. The proxy and rate limit Deployments are applied with server-side apply using ForceOwnership, so rendering spec.replicas made the controller the owner of that field and every subsequent reconciliation reset the replica count to the statically configured value. The replicas field is now omitted from the generated Deployment when an HPA is configured (envoyHpa / rateLimitHpa). Use minReplicas to set a lower bound instead.
• Fixed OIDC flow-state cookies accumulating in the browser and overflowing the request header size limit. Envoy mints a nonce (CSRF) and a PKCE code verifier cookie for every authorization flow it starts, but only deletes the pair belonging to the flow that completes the callback, so abandoned flows leave their cookies behind until they expire. Both cookies are now scoped to the OIDC redirect path, so orphans are no longer sent on every request — this bounds the damage rather than eliminating it, so also consider lowering csrfTokenTTL. The PKCE code verifier cookie is also now named CodeVerifier-<suffix>, carrying the same per-policy suffix as the other OAuth2 cookies, so SecurityPolicies on the same cookie domain no longer delete each other's in-flight flow cookies on logout. On upgrade, a browser already holding flow cookies keeps them at the old path=/ and they expire on the lifetime they were originally issued with; a login in progress across the rollout may need to be retried once.
• Fixed HTTPRoute (and other xRoute) acceptance not being re-evaluated when a namespace's labels changed to newly match, or stop matching, a Gateway listener's allowedRoutes.namespaces.from: Selector, which previously required a controller restart to pick up. Namespace label updates are now watched and affected Gateways re-reconciled automatically.
• Fixed ListenerSet not being reconciled when a referenced TLS Secret is created or updated after the ListenerSet. Secret watches previously only indexed Gateway certificateRefs, so cert-manager style late Secret creation left the ListenerSet stuck with Programmed=False until an unrelated reconcile.
• Fixed Gateway TLS Secret validation rejecting valid ECDSA private keys when tls.key includes an EC PARAMETERS PEM block before the private key.
• Added validation for the SDS cluster URI to ensure Unix Domain Socket (unix://) URLs are well-formed, rejecting a host component and requiring a path, instead of silently producing an invalid socket address.
• Fixed ConsistentHash load balancing not pinning a client to a single backend when a route splits traffic across multiple weighted backendRefs. use_hash_policy is now set on the generated weighted clusters, so the request's hash policy selects the weighted cluster deterministically instead of at random per request.
• Fixed a BackendTrafficPolicy setting a ConsistentHash load balancer having no effect when it targets a UDPRoute. The source IP hash policy is now configured on the UDP proxy. Only the SourceIP consistent hash type applies to UDP, since headers, cookies and query parameters do not exist in a UDP datagram.
• The global rate limit cluster is now built from the in-cluster envoy-ratelimit Service and EndpointSlices using EDS instead of resolving a static DNS hostname, so requests keep hitting rate limit service replicas correctly as they scale up and down. When the Service or its endpoints cannot be discovered, it falls back to the previous STRICT_DNS behavior.
• Fixed the File and ALS access log sinks silently falling back to the default JSON fields when telemetry.accessLog.settings[].format sets text without type, which the API accepts.
• Fixed the controller crash-looping when an extension manager's backendResources references a CRD that is not installed in the cluster.
• Fixed deduplication of CA certificates in ClientTrafficPolicy mTLS.
• Fixed a controller panic when translating backend credential injection with an invalid header.

Performance Improvements

• Fixed translation latency growing quadratically when many policies share the same target by capping each policy's status.ancestors at the CRD limit as ancestors are added, instead of only truncating during post-processing.
• Improved reconcile performance by listing the extension manager's resources and backendResources once per GatewayClass instead of once per Gateway.

Other Changes

• Bumped Envoy Gateway to v1.8.4.
• Bumped Envoy to v1.38.4.
• Bumped the Go toolchain to 1.26.7.
• Bumped the BOE composer dynamic module to v0.11.0.
• Bumped the Rate Limit service to docker.io/envoyproxy/ratelimit:8fe6ea42, matching the Envoy Gateway v1.8.4 subchart default.
• Bumped the Redis image deployed by the TEG Helm chart to 8.6.6.
• Bumped the Keycloak demo chart to 26.7.2.
• Added per-phase tracing spans to the Gateway API and xDS translators, each recording the size of the input it processed, so a slow translation can be attributed to a specific phase — listener processing, HTTP and gRPC route processing, the main policy types, EnvoyPatchPolicy JSON patches, extension server hooks, and xDS resource validation — instead of showing up as one opaque multi-second span.