envoy-gateway-app release v1.10.0

Changed

• Breaking: Use upstream’s global.imageRegistry value instead of global.image.registry, dropping the image registry patch now that upstream supports the override natively.
• Update Envoy Gateway to v1.9.0. Requires Gateway API v1.6 CRDs. Note that Lua EnvoyExtensionPolicy is now opt-in via config.envoyGateway.extensionApis.enableLua, and EndpointSliceIndex is enabled by default and can raise control plane memory usage.
• Pin gateway-api-crds to 1.9.0 in the e2e and performance test suites.
• Update perf-report claude skill:
  • the report is posted as a tar file in the PR’s comments.
  • perf-report no longer needs a cluster_id.
  • fix the nginx downstream_rps, cpu_usage and memory_usage queries: they filtered on the kube-system namespace, but the performance suites install ingress-nginx into default, so those three metrics were always empty and the comparison table rendered them as —.
  • in pipeline mode the skill no longer publishes: the generate-perf-report Tekton task creates the branch, uploads the tarball, verifies it and posts the comment itself, and the agent writes its interpretation to narrative.md instead. gh moved from the CI allowlist’s allow list to its deny list.
  • retry Mimir requests in fetch_metrics.py, so a report survives the stalls of a kubectl port-forward to the management cluster.
  • add .claude/perf-report-ci-settings.json, the permission allowlist used by the pipeline’s generate-perf-report task (--permission-mode dontAsk).
  • stop using a $DIR shell variable in the SKILL.md examples and spell the script paths out literally. A permission rule cannot match past a variable assignment, so the DIR=... && python3 "$DIR/fetch_metrics.py" ... form the examples produced was denied under the CI allowlist even though Bash(python3 *) is allowed — the agent could not run a single script and the pipeline reported success with no report.

Added

• Add control plane startup, liveness and readiness probes as configurable values.