Kubernetes Gateway API v1.5 Is Out, TLSRoute Goes Stable, and Upgrades Get Safer
The Kubernetes project released Gateway API v1.5 on April 21, 2026. The update pushes several previously experimental features into the Standard channel, signaling production readiness for teams who held back waiting for stability.
The biggest news is that Kubernetes Gateway API v1.5 graduates TLSRoute and ListenerSet to the Standard channel as v1. That means both resources now carry full backwards compatibility guarantees. Teams can rely on them without worrying about breaking changes in future minor releases. Notably, teams still running TLSRoute v1alpha2 in the Experimental channel should plan ahead. That version will be removed from the Experimental channel entirely in v1.6. Also worth flagging, TLSRoute’s CEL validation requires Kubernetes 1.31 or higher, so clusters on older versions will need to upgrade before adopting it.
Beyond TLSRoute and ListenerSet, the release also promotes Gateway Client Certificate Validation and Certificate Selection for Gateway TLS Origination to the Standard channel. Both features are now generally available. The Reference Grant resource additionally moves to v1 in this release.
The release also introduces a new validating admission policy (VAP) named safe-upgrades.gateway.networking.k8s.io. It guards against two risky actions that can silently break clusters, installing Experimental CRDs over already-installed Standard CRDs, and downgrading to a version prior to v1.5 after upgrading to it. Both scenarios are difficult to reverse safely. The VAP blocks them by default. Teams that intentionally need to perform either action must first delete the VAP manually.
One practical note for operators, the Experimental channel CRDs in v1.5 are too large for a standard kubectl apply. The Kubernetes team recommends using kubectl apply server-side=true instead, or configuring kuberc to make server-side apply the default behavior.
Broader adoption is already tracking the release. Google Kubernetes Engine now supports Gateway API v1.5, starting with GKE version 1.35.2-gke.1842000 Cloudscoop, and the GKE Gateway controller passes core conformance tests for this version. Traefik Proxy also now supports Gateway API v1.5.1 Kubernetes, covering all HTTPRoute core and several extended features including BackendTLSPolicy, GRPCRoute, and TLSRoute from the Standard channel.
For teams still running the older Ingress API, the Kubernetes project has a dedicated migration tool worth exploring. Ingress2Gateway 1.0, released in March 2026. It provides a structured path from Ingress to Gateway API. The full release notes and installation instructions for Gateway API v1.5 are available at the official GitHub release page.
