merge all commit to fix CLA (#16725)

Author: zirain

.spelling

@@ -37,6 +37,7 @@
 1.26.x.
 1.27.3
 1.27.x
+1.27.x.
 1.3.x
 1.3.x.
 1.4.x
@@ -302,6 +303,7 @@ cpuset
 CR
 CRD
 CRDs
+CRLs
 CRs
 crypto
 CryptoMB
@@ -571,6 +573,7 @@ GenAI
 Geneve
 GHSA-8mq4-c2v5-3h39
 GiB
+GIDs
 git
 GitHub
 GitOps
@@ -656,6 +659,7 @@ intranode
 Invasiveness
 IOPs
 ip
+ipallocate
 ipBlocks
 IPs
 IPsec
@@ -814,6 +818,7 @@ linktitle
 linter
 linters
 Lior
+ListenerSets
 list_by_publishdate
 Liu
 liveness
@@ -918,6 +923,7 @@ network1
 network2
 networking.istio.io
 NetworkPolicy
+nftables
 nginx
 NICs
 NiFi
@@ -1230,6 +1236,7 @@ subnetworks
 subresource
 subresources
 substring
+subzone
 Sudheendra
 Sumit
 Superfeet
@@ -1273,6 +1280,7 @@ TLS
 TLS-secured
 ToC
 Tokio
+tolerations
 toolbelt
 toolchain
 topologySpreadConstraints
@@ -1340,13 +1348,15 @@ v1.21.0
 v1.22
 v1.26
 v1.27
+v1.27.
 v1.28
 v1.29
 v1.30
 v1.31
 v1.32
 v1.33
 v1.34
+v1.35
 v1.5
 v1.55
 v1.55.1

content/en/docs/releases/supported-releases/index.md

@@ -70,6 +70,7 @@ Please keep up-to-date and use a supported version.
 
 | Minor Releases | Patched versions with no known CVEs |
 |----------------|-------------------------------------|
+| 1.27.x         | 1.27.0+                             |
 | 1.26.x         | 1.26.0+                             |
 | 1.25.x         | 1.25.3+                             |
 
@@ -81,6 +82,7 @@ The relationship between the two project's versions:
 
 | Istio version | Envoy release branch |
 |---------------|----------------------|
+| 1.27.x        | release/v1.35        |
 | 1.26.x        | release/v1.34        |
 | 1.25.x        | release/v1.33        |
 

content/en/news/releases/1.27.x/_index.md

@@ -0,0 +1,8 @@
+---
+title: 1.27.x Releases
+description: Announcements for the 1.27 release and its associated patch releases.
+weight: 6
+list_by_publishdate: true
+layout: release-grid
+decoration: dot
+---

content/en/news/releases/1.27.x/announcing-1.27/_index.md

@@ -0,0 +1,58 @@
+---
+title: Announcing Istio 1.27.0
+linktitle: 1.27.0
+subtitle: Major Release
+description: Istio 1.27 Release Announcement.
+publishdate: 2025-08-11
+release: 1.27.0
+aliases:
+    - /news/announcing-1.27
+    - /news/announcing-1.27.0
+---
+
+We are pleased to announce the release of Istio 1.27. Thank you to all our contributors, testers, users and enthusiasts for helping us get the 1.27.0 release published!
+We would like to thank the Release Managers for this release, **Jianpeng He** from Tetrate, **Faseela K** from Ericsson Software Technology, and **Gustavo Meira** from Microsoft.
+
+{{< relnote >}}
+
+{{< tip >}}
+Istio 1.27.0 is officially supported on Kubernetes versions 1.29 to 1.33.
+{{< /tip >}}
+
+## What’s new?
+
+### Inference Extension Support
+
+[Gateway API Inference Extension](https://gateway-api-inference-extension.sigs.k8s.io/) is an official Kubernetes project designed to optimize the self-hosting of Generative AI models on Kubernetes. It provides a standardized, vendor-neutral approach to intelligent AI traffic management.
+
+Istio 1.27 includes a [fully-compliant implementation](https://gateway-api-inference-extension.sigs.k8s.io/implementations/gateways/#istio) of the extension when using the Gateway API for cluster ingress traffic control.
+
+[Learn more about the extension and Istio's implementation](/blog/2025/inference-extension-support/).
+
+### Ambient Multicluster
+
+Support for multi-cluster deployments in ambient mode is now available in Alpha. This enables multiple ambient mode clusters to be connected into the same mesh, expanding the scope of no-sidecar networking to larger and more distributed environments.
+
+In this initial release, testing has been focused on multi-network, multi-primary topologies, where each cluster runs its own control plane. Support for more complex topologies will follow as the baseline feature matures.
+
+### CRL Support for Plugged-in CAs
+
+Certificate Revocation List (CRL) support is now available for users who have "plugged in" their own certificate authority, rather than using the default provided by Istio.  This allows proxies to validate and reject revoked certificates, strengthening the security posture of mesh deployments using plugged-in CAs.
+
+### ListenerSets Support
+
+The new [ListenerSets](https://gateway-api.sigs.k8s.io/geps/gep-1713) API allows you to define a reusable set of listeners that can be attached to a `Gateway` resource. This promotes consistency and reduces duplication when managing multiple Gateways that share common listener configurations.
+
+### Native nftables Support in Sidecar Mode
+
+Istio now supports the [native nftables](https://github.com/istio/istio/issues/47821) backend in Sidecar mode. nftables is the modern successor to iptables, providing better performance, improved maintainability, and more flexible rule management for transparent traffic redirection to and from the Envoy sidecar proxy.
+
+Many major Linux distributions are adopting nftables as the default packet filtering framework, and Istio’s native support ensures compatibility with this shift.
+
+Support for nftables in ambient mode is actively being developed and will arrive in a future release.
+
+## Upgrading to 1.27
+
+We would like to hear from you regarding your experience upgrading to Istio 1.27. You can provide feedback in the `#release-1.27` channel in our [Slack workspace](https://slack.istio.io/).
+
+Would you like to contribute directly to Istio? Find and join one of our [Working Groups](https://github.com/istio/community/blob/master/WORKING-GROUPS.md) and help us improve.