docs(mesh): update docs and changelog

app/_data/kong_versions.yml

@@ -333,13 +333,15 @@
 - edition: mesh
   version: 2.4.4
   release: 2.4.x
-  latest: true
   releaseDate: "2023-08-29"
   endOfLifeDate: "2024-08-29"
   branch: release-2.4
 - edition: mesh
   version: 2.5.0
   release: 2.5.x
+  latest: true
+  releaseDate: "2023-11-15"
+  endOfLifeDate: "2024-11-15"
   branch: release-2.5
 - edition: mesh
   version: preview

app/mesh/2.5.x/kuma-cp.yaml

@@ -720,6 +720,11 @@ experimental:
   # If true then control plane computes reachable services automatically based on MeshTrafficPermission.
   # Lack of MeshTrafficPermission is treated as Deny the traffic.
   autoReachableServices: false # ENV: KUMA_EXPERIMENTAL_AUTO_REACHABLE_SERVICES
+  # KDSSyncNameWithHashSuffix if true then during KDS sync resource name is going to be suffixed with hash.
+  # The hash is computed based on various resource characteristics like mesh, namespace, etc. The feature prevents name
+  # collisions when syncing policies with the same names but different meshes from Global(Universal) to Zone(Kubernetes).
+  # More extensive explanation of the problem and solution can be found in the MADR https://github.com/kumahq/kuma/blob/master/docs/madr/decisions/029-kds-sync-hash-suffix.md
+  KDSSyncNameWithHashSuffix: false # ENV: KUMA_EXPERIMENTAL_KDS_SYNC_NAME_WITH_HASH_SUFFIX
 proxy:
   gateway:
     # Sets the envoy runtime value to limit maximum number of incoming

app/mesh/dev/crds/kuma.io_meshloadbalancingstrategies.yaml

@@ -414,7 +414,6 @@ spec:
                                             type: array
                                         required:
                                         - type
-                                        - zones
                                         type: object
                                     required:
                                     - to
@@ -480,8 +479,6 @@ spec:
                                     - key
                                     type: object
                                   type: array
-                              required:
-                              - affinityTags
                               type: object
                           type: object
                       type: object

app/mesh/dev/kuma-cp.yaml

@@ -701,7 +701,7 @@ experimental:
   # format you can downgrade your cp
   useTagFirstVirtualOutboundModel: false # ENV: KUMA_EXPERIMENTAL_USE_TAG_FIRST_VIRTUAL_OUTBOUND_MODEL
   # If true, KDS will sync using incremental xDS updates
-  kdsDeltaEnabled: false # ENV: KUMA_EXPERIMENTAL_KDS_DELTA_ENABLED
+  kdsDeltaEnabled: true # ENV: KUMA_EXPERIMENTAL_KDS_DELTA_ENABLED
   # List of prefixes that will be used to filter out tags by keys from ingress' available services section.
   # This can trim the size of the ZoneIngress object significantly.
   # The drawback is that you cannot use filtered out tags for traffic routing.
@@ -720,6 +720,11 @@ experimental:
   # If true then control plane computes reachable services automatically based on MeshTrafficPermission.
   # Lack of MeshTrafficPermission is treated as Deny the traffic.
   autoReachableServices: false # ENV: KUMA_EXPERIMENTAL_AUTO_REACHABLE_SERVICES
+  # KDSSyncNameWithHashSuffix if true then during KDS sync resource name is going to be suffixed with hash.
+  # The hash is computed based on various resource characteristics like mesh, namespace, etc. The feature prevents name
+  # collisions when syncing policies with the same names but different meshes from Global(Universal) to Zone(Kubernetes).
+  # More extensive explanation of the problem and solution can be found in the MADR https://github.com/kumahq/kuma/blob/master/docs/madr/decisions/029-kds-sync-hash-suffix.md
+  KDSSyncNameWithHashSuffix: false # ENV: KUMA_EXPERIMENTAL_KDS_SYNC_NAME_WITH_HASH_SUFFIX
 proxy:
   gateway:
     # Sets the envoy runtime value to limit maximum number of incoming