Zum Inhalt springen

Cilium Release Notes

30 Einträge aus 1 Quelle. Zuletzt aktualisiert:

Feed abonnieren:RSS: Feed für Cilium Release NotesAPI: Einträge von Cilium Release Notes als JSON
Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.21.0-pre.3: LB-IPAM-Annotation, Helm-Werte, Mutual Auth entfernt

Cilium 1.21.0-pre.3 führt die Annotation lbipam.cilium.io/sharing-permit-different-pods für das Teilen einer IP zwischen Services mit externalTrafficPolicy=Local ein, ergänzt Helm-Werte für Prometheus-Metrik-Portnamen, entfernt die veraltete Mutual Authentication und behebt ein „No route to host“-Problem beim Node-Neustart mit BGP.

Summary of Changes

Major Changes:

  • LB IPAM: introduce the lbipam.cilium.io/sharing-permit-different-pods annotation to allow sharing an IP between services with externalTrafficPolicy=Local that select different pods. The annotation must be set to "true" on all services in the sharing group and is intended for deployments that steer traffic outside Cilium's built-in announcers. (cilium/cilium#45819, @lexfrei)

Minor Changes:

  • Add Helm values to configure Prometheus metrics container port names for the agent, operator, Envoy, Hubble, Hubble Relay, ClusterMesh API server, KVStoreMesh and etcd, supporting custom scrape configurations that require specific named ports. Existing names remain the defaults. (cilium/cilium#48955, @gcampbell12)
  • Add the internal path template matcher that later PRs use to emit a bounded path label on the Hubble HTTP metrics. No user-facing change on its own. (cilium/cilium#47813, @amaanx86)
  • auth: remove deprecated mutual authentication (cilium/cilium#48647, @mhofstetter)
  • clang: Bump llvm version to v21.1.8 (cilium/cilium#48425, @sayboras)
  • Fix a "No route to host" window on node reboot where BGP advertised routes before BPF programs were attached to native devices. (cilium/cilium#46948, @tkna) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.20.2: Gateway-API-Node-Selector und mehrere Fehlerbehebungen

Cilium 1.20.2 ergänzt einen Node-Label-Selector für Gateway API bei aktiviertem hostNetwork und behebt Fehler bei AWS-ENI-IPAM mit Prefix Delegation, einen Agent-Absturz beim Dump von Map-Events, fehlende Egress-Drop-Metriken bei policy-deny-response: icmp sowie eine seltene Race Condition in Cluster Mesh.

Summary of Changes

Minor Changes:

  • gateway-api: node label selector for when hostNetwork is enabled (Backport PR cilium/cilium#48636, Upstream PR cilium/cilium#47463, @xtineskim)

Bugfixes:

  • aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#48125, @41ks)
  • aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#48193, @41ks)
  • bpf: Fix agent crash when dumping map events (Backport PR cilium/cilium#48378, Upstream PR cilium/cilium#48273, @joestringer)
  • bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (Backport PR cilium/cilium#48550, Upstream PR cilium/cilium#48407, @41ks)
  • Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#48262, @giorio94)
  • datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR cilium/cilium#48550, Upstream PR cilium/cilium#46861, @fdomain) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.19.8: Fehlerbehebungen für AWS-IPAM, Agent und Hubble Relay

Cilium 1.19.8 behebt mehrere Fehler, darunter die IP-Allokation bei AWS-Prefix-Delegation, einen Agent-Absturz beim Dump von Map-Events, das Weiterlaufen von Hubble Relay beim Beenden, die Wiederverwendung von NodePort-Egress-Tupeln und das Entfernen fremder cgroup-Programme durch socketlb.

Summary of Changes

Bugfixes:

  • aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR cilium/cilium#48604, Upstream PR cilium/cilium#48193, @41ks)
  • bpf: Fix agent crash when dumping map events (Backport PR cilium/cilium#48379, Upstream PR cilium/cilium#48273, @joestringer)
  • bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR cilium/cilium#47620, Upstream PR cilium/cilium#47343, @smagnani96)
  • datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR cilium/cilium#48552, Upstream PR cilium/cilium#46861, @fdomain)
  • Fix Hubble Relay remains running during termination (Backport PR cilium/cilium#48552, Upstream PR cilium/cilium#47942, @xandau)
  • Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR cilium/cilium#48552, Upstream PR cilium/cilium#48391, @fristonio)
  • Fix nodeport egress tuple reuse for closed connections (Backport PR cilium/cilium#48413, Upstream PR cilium/cilium#48306, @fristonio)
  • Fix restored ENI endpoints routing rule configuration when masquerading config changes (cilium/cilium#48422, @fristonio)
  • fix(socketlb): only detach Cilium-owned cgroup programs (Backport PR cilium/cilium#48552, Upstream PR cilium/cilium#44066, @puwun) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.18.14: Fehlerbehebungen für AWS-IPAM, Agent und Hubble Relay

Cilium 1.18.14 behebt mehrere Fehler, darunter die IP-Allokation bei AWS-Prefix-Delegation, einen Agent-Absturz beim Dump von Map-Events, das Weiterlaufen von Hubble Relay beim Beenden, die Wiederverwendung von NodePort-Egress-Tupeln und das Entfernen fremder cgroup-Programme durch socketlb.

Summary of Changes

Bugfixes:

  • aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR cilium/cilium#48607, Upstream PR cilium/cilium#48193, @41ks)
  • bpf: Fix agent crash when dumping map events (Backport PR cilium/cilium#48380, Upstream PR cilium/cilium#48273, @joestringer)
  • datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR cilium/cilium#48554, Upstream PR cilium/cilium#46861, @fdomain)
  • Fix Hubble Relay remains running during termination (Backport PR cilium/cilium#48554, Upstream PR cilium/cilium#47942, @xandau)
  • Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR cilium/cilium#48554, Upstream PR cilium/cilium#48391, @fristonio)
  • Fix nodeport egress tuple reuse for closed connections (Backport PR cilium/cilium#48406, Upstream PR cilium/cilium#48306, @fristonio)
  • Fix restored ENI endpoints routing rule configuration when masquerading config changes (cilium/cilium#48423, @fristonio)
  • fix(socketlb): only detach Cilium-owned cgroup programs (Backport PR cilium/cilium#48554, Upstream PR cilium/cilium#44066, @puwun) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.21.0-pre.2: Session Persistence, BPF Masquerading, SR-IOV

Cilium 1.21.0-pre.2 bringt unter anderem Gateway-API-Session-Persistence, AWS Managed Prefix Lists in Policies, standardmäßig aktiviertes BPF Masquerading und einen SR-IOV-Device-Manager für den Network Driver, ersetzt dabei das nicht abgeschlossene pre.1.

Summary of Changes

⚠️ Due to a release issue, the v1.21.0-pre.1 has not been completed, instead we are publishing v1.21.0-pre.2. This changelog contains the changes from v1.21.0-pre.0 to v1.21.0-pre.2

Major Changes:

  • Add support for Gateway API session persistence (cilium/cilium#48029, @thorn3r)
  • Allow use of AWS managed prefix lists in Cilium policies. (cilium/cilium#45806, @bodgit)
  • Enable BPF masquerading by default (cilium/cilium#47631, @pchaigno)
  • network driver: add sriov device manager (cilium/cilium#47387, @bersoare)

Minor Changes:

  • Add cilium-dbg bpf stats report command to collect and display eBPF program runtime statistics. (cilium/cilium#47186, @amchelapurath2023)
  • aws: Use GetSecurityGroupsForVpc to fetch security groups (cilium/cilium#47704, @HadrienPatte)
  • bpf: Support configuring an extended masquerade port range (--node-port-nat-range-ext) for BPF SNAT masquerading. (cilium/cilium#47301, @yyyyyymmm)
  • CiliumPodIPPools now support reservedRanges for multi-pool IPAM. (cilium/cilium#46880, @kyounghoonJang)
  • clustermesh: handle a remote cluster ID change. Also improve cluster ID verification in operator/kvstoremesh similarly to existing agent logic. (cilium/cilium#47747, @MrFreezeex)
  • clustermesh: set tls authMode to cluster by default (cilium/cilium#48170, @MrFreezeex)
  • envoy: Add support for HTTP CONNECT (cilium/cilium#45051, @nezdolik) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.20.1: Schnellere DSR-Wiederherstellung und Bugfixes

Cilium 1.20.1 überarbeitet die Cluster-Mesh-Dokumentation, beschleunigt die Wiederherstellung unterbrochener TCP-Verbindungen zu DSR-Services und behebt mehrere Fehler, etwa redundante CiliumNode-Updates unter Azure und die MCS-API-CRD-Installation in Clustermesh.

Summary of Changes

Major Changes:

  • docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR cilium/cilium#47615, Upstream PR cilium/cilium#47351, @MrFreezeex)

Minor Changes:

  • envoy: demote stale ADS endpoint warning (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47148, @nezdolik)
  • Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR cilium/cilium#47881, Upstream PR cilium/cilium#47529, @julianwiedmann)

Bugfixes:

  • azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47449, @jaredledvina)
  • bpf: dsr: don't look for TCP header on fragmented packets (Backport PR cilium/cilium#47881, Upstream PR cilium/cilium#47640, @julianwiedmann)
  • bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR cilium/cilium#47621, Upstream PR cilium/cilium#47343, @smagnani96)
  • clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47824, @MrFreezeex) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.19.7: Fixes für Envoy-Timeout, BPF-Verifier und LB-Map

Cilium 1.19.7 behebt mehrere Fehler, darunter den Envoy-Route-Idle-Timeout, einen BPF-Verifier-Reject auf Kerneln vor 5.12 mit IPv6, Kollisionen in der BPF-LB-Map bei HostPort/NodePort sowie unerwünschtes Abfangen von LoadBalancer-VIP-Traffic bei deaktiviertem KPR.

Summary of Changes

Bugfixes:

  • envoy: restore http-idle-timeout as the route idle timeout source (Backport PR cilium/cilium#47688, Upstream PR cilium/cilium#47583, @aanm)
  • Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR cilium/cilium#47723, Upstream PR cilium/cilium#47765, @julianwiedmann)
  • Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR cilium/cilium#47545, Upstream PR cilium/cilium#47295, @aanm)
  • Fix abnormal ip allocation caused by hostnetwork pod (Backport PR cilium/cilium#47688, Upstream PR cilium/cilium#47552, @haozhangami)
  • Fix BPF LB map key collision where HostPort/NodePort expansion could overwrite a LoadBalancer frontend when the node IP matches the LoadBalancer external IP (e.g. k3s/RKE2 L2 ServiceLB). Also fix a ~30-minute NodePort outage that occurred after deleting a LoadBalancer whose external IP was a node address with a port in the NodePort range. (Backport PR cilium/cilium#47414, Upstream PR cilium/cilium#45314, @syedazeez337)
  • Fix bug causing Cilium to intercept traffic towards LoadBalancer VIPs when KPR is disabled, when the traffic should be delegated to kube-proxy. (Backport PR cilium/cilium#47414, Upstream PR cilium/cilium#47204, @ajmmm) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.18.13: VRRP und IGMP in Host Firewall, Bugfixes

Cilium 1.18.13 unterstützt VRRP und IGMP in der Host Firewall und behebt Fehler bei der IP-Allokation durch hostNetwork-Pods, mögliche Hänger durch Netlink-Fehler und den CIDR-Referenzzähler im ipcache.

Summary of Changes

Major Changes:

  • Add support for VRRP and IGMP protocols in host firewall (Backport PR cilium/cilium#47619, Upstream PR cilium/cilium#39872, @aditighag)

Bugfixes:

  • bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR cilium/cilium#47619, Upstream PR cilium/cilium#47343, @smagnani96)
  • Fix abnormal ip allocation caused by hostnetwork pod (Backport PR cilium/cilium#47687, Upstream PR cilium/cilium#47552, @haozhangami)
  • Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR cilium/cilium#47799, Upstream PR cilium/cilium#46967, @ysksuzuki)
  • ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR cilium/cilium#47887, Upstream PR cilium/cilium#47208, @iwanhae)

CI Changes:

  • .github: retry CLI and binary downloads over transient network errors (Backport PR cilium/cilium#47289, Upstream PR cilium/cilium#47167, @aanm)
  • bpf: test: improve network policy testing (Backport PR cilium/cilium#47619, Upstream PR cilium/cilium#41906, @julianwiedmann)
  • bpf: tests: IGMP improvements (Backport PR cilium/cilium#47619, Upstream PR cilium/cilium#43684, @julianwiedmann)
  • chore: use GH_RUNNER_CILIUM_BASE_AMD64/ARM64 vars for integration-test runners (Backport PR cilium/cilium#47547, Upstream PR cilium/cilium#47182, @bogdankrasko) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.21.0-pre.0: Envoy-xDS-Delta-Modus und Network-Driver-Baseline

Cilium 1.21.0-pre.0 ermöglicht über --envoy-xds-mode=delta-split die inkrementelle Synchronisation von Envoy-Ressourcen, fügt einen Network-Driver-Baseline hinzu, deprecated WireGuard Node Encryption und bringt diverse Helm-Optionen sowie Fehlerbehebungen.

Summary of Changes

Major Changes:

  • Envoy resources (e.g., Listeners, Network Policies, etc.) can now be synchronized with Envoy incrementally, reducing CPU load and policy update latency. This is enabled by the new agent option value --envoy-xds-mode=delta-split. Corresponding Helm value is envoy.xdsMode=delta-split. (cilium/cilium#45288, @jrajahalme)
  • network driver: add agent side baseline driver and dummy device manager (cilium/cilium#47254, @bersoare)

Minor Changes:

  • build: Update iptables from 1.8.8 to 1.8.11 (cilium/cilium#47623, @HadrienPatte)
  • clustermesh: no longer restart pods when changing remote clustermesh-apiserver IPs statically defined (without a DNS name) (cilium/cilium#47190, @MrFreezeex)
  • CT map adaptive GC interval calculation improvements (cilium/cilium#46796, @fristonio)
  • Deprecate WireGuard Node Encryption (cilium/cilium#47219, @pchaigno)
  • envoy: demote stale ADS endpoint warning (cilium/cilium#47148, @nezdolik)
  • Fix external traffic drops/inconsistencies on secondary ENIs with masquerade enabled (cilium/cilium#47008, @monta-riahi)
  • helm: Add extraInitContainers and disableDefaultVolumes to support external certificate management for Hubble and ClusterMesh components. (cilium/cilium#46688, @alaashehab-m)
  • helm: add GatewayAPI HTTPRoute support for hubble-ui (cilium/cilium#46792, @SchulteMK)
  • helm: add value to configure clustermesh apiserver service port (cilium/cilium#47375, @crealte) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.20.0 mit Gateway API v1.6.1 und Upgrade-Hinweisen

Cilium 1.20.0 ist veröffentlicht und bringt unter anderem Gateway API v1.6.1, wobei beim Upgrade Maßnahmen nötig sein können, falls Mutual Authentication, Envoy-Go-Erweiterungen, Kafka-Policies, die CiliumNodeConfig-API v2alpha1, die libnetwork-Integration oder eine eigene CNI-Konfiguration genutzt werden.

🎉 Release Announcement 🎉: We are excited to announce the Cilium 1.20.0 release!

More than 2,660 new commits have landed in this release, supported by a community of over 1,100 contributors and more than 24,800 GitHub stars! 🤩

⚠️ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the cilium.io/v2alpha1 CiliumNodeConfig API, the libnetwork integration, or a custom CNI configuration. See the Upgrade Guide for details.

The full changelog can be found here.

Here are some of the highlights:

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.20.0-rc.1: Mutual Auth veraltet, MCS API stabil

Cilium 1.20.0-rc.1 markiert Beta-Mutual-Auth als veraltet, stuft die Multi-Cluster Services API auf stabil hoch und ergänzt Gateway-API-Funktionen wie HTTP-Server-Header-Transformation sowie die Redirect-Codes 303, 307 und 308.

Summary of Changes

Major Changes:

  • Cilium's Beta Mutual Auth support is now deprecated and will be removed in a future version. (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47162, @youngnick)
  • clustermesh: promote Multi-Cluster Services API (MCS-API) to a stable support level and improve its documentation (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#46953, @MrFreezeex)

Minor Changes:

  • envoy: reject CECs with duplicate filter chains (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#46848, @asauber)
  • Gateway API: Add HTTP Server header transformation support (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#46764, @xtineskim)
  • gateway-api: Cilium now supports the additional redirect codes 303, 307, and 308 for HTTPRoute redirects. (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47232, @youngnick)
  • helm: Avoid operator roles, secret creation in preflight (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#47053, @joestringer)
  • images: Update runtime and builder images base to ubuntu 26.04 (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47215, @HadrienPatte)

Bugfixes:

  • datapath/linux: Unsubscribe node handler on shutdown (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47197, @HadrienPatte) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.19.6: Gateway-Access-Logs konfigurierbar, Fehlerbehebungen

Cilium 1.19.6 ermöglicht die Konfiguration von Gateway-Access-Logs über spec.telemetry.accessLogs in CiliumGatewayClassConfig und behebt mehrere Fehler, etwa bei der IPv6-Neighbor-Solicitation in der Host Firewall, einer Endpoint-Race-Condition und veralteten Hostport-Einträgen.

Summary of Changes

Minor Changes:

  • datapath/l2responder: use l3 sockets for solicited node multicast signaling (Backport PR cilium/cilium#46845, Upstream PR cilium/cilium#46332, @bersoare)
  • gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR cilium/cilium#46933, Upstream PR cilium/cilium#46403, @arybolovlev)

Bugfixes:

  • [v1.19] Fix policy service label selector handling (cilium/cilium#46946, @fristonio)
  • bpf: fix ipv6 neighbor solicitation handling in host firewall (Backport PR cilium/cilium#46669, Upstream PR cilium/cilium#46325, @atykhyy)
  • doublewrite: Don't run CRD backend with real handler when reading from KVStore (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#47144, @HadrienPatte)
  • endpoint: Fix race when reading endpoint properties (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#46991, @gandro)
  • Fix cilium_operator_unmanaged_pods gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (Backport PR cilium/cilium#46975, Upstream PR cilium/cilium#46668, @Suyash1700)
  • Fix a bug which could lead to stale hostport entries if a pod was deleted and immediately recreated in host network. (Backport PR cilium/cilium#46793, Upstream PR cilium/cilium#46747, @giorio94) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.18.12: Gateway-Access-Logs und Fehlerbehebungen

Cilium 1.18.12 ermöglicht die Konfiguration von Gateway-Access-Logs über spec.telemetry.accessLogs in CiliumGatewayClassConfig und behebt fehlerhafte Policy-Ablehnungen bei L7-Load-Balancing, ein Startproblem im kvstore-Modus mit KPR sowie weitere Fehler.

Summary of Changes

Minor Changes:

  • gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR cilium/cilium#47016, Upstream PR cilium/cilium#46403, @arybolovlev)

Bugfixes:

  • Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR cilium/cilium#47003, Upstream PR cilium/cilium#46821, @fristonio)
  • Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service (Backport PR cilium/cilium#47196, Upstream PR cilium/cilium#46444, @giorio94)
  • gateway-api: Add Gateway check for when hostNetwork is enabled (Backport PR cilium/cilium#46838, Upstream PR cilium/cilium#46350, @xtineskim)
  • ipam/multi-pool: Do now wait for zero prealloc request (Backport PR cilium/cilium#47196, Upstream PR cilium/cilium#46867, @pippolo84)

CI Changes:

  • .github: Generate CI binaries with correct module version (Backport PR cilium/cilium#47098, Upstream PR cilium/cilium#46742, @joestringer)
  • chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR cilium/cilium#46921, Upstream PR cilium/cilium#46840, @sekhar-isovalent)

Misc Changes:

  • .github: allow fork PR checkout with actions/checkout v7 (Backport PR cilium/cilium#47136, Upstream PR cilium/cilium#47133, @aanm) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.17.18: Fehlerbehebungen bei L7-Load-Balancing und ipam

Cilium 1.17.18 behebt fehlerhafte Policy-Ablehnungen bei Traffic zu L7-Load-Balanced-Services nach Änderung der Remote Identity sowie ein Problem im ipam/multi-pool bei Null-Prealloc-Anfragen, der Rest betrifft CI und Wartung.

Summary of Changes

Bugfixes:

  • Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR cilium/cilium#47006, Upstream PR cilium/cilium#46821, @fristonio)
  • ipam/multi-pool: Do now wait for zero prealloc request (Backport PR cilium/cilium#47199, Upstream PR cilium/cilium#46867, @pippolo84)

CI Changes:

  • .github: Generate CI binaries with correct module version (Backport PR cilium/cilium#47097, Upstream PR cilium/cilium#46742, @joestringer)
  • chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR cilium/cilium#46922, Upstream PR cilium/cilium#46840, @sekhar-isovalent)
  • v1.17: ariane: Remove Conformance AKS (cilium/cilium#47145, @pchaigno)
  • v1.17: workflows: Remove coverage for AKS (cilium/cilium#46998, @pchaigno)

Misc Changes:

  • .github: allow fork PR checkout with actions/checkout v7 (Backport PR cilium/cilium#47137, Upstream PR cilium/cilium#47133, @aanm)
  • [v1.17] - .github/workflows: unpin cilium/cilium self-references to track main (cilium/cilium#46611, @aanm)
  • [v1.17] - Reapply ".github/workflows: do not use deployments for environments" (cilium/cilium#46576, @aanm)
  • chore(deps): update all github action dependencies (v1.17) (cilium/cilium#46660, @cilium-renovate[bot])
  • chore(deps): update all github action dependencies (v1.17) (cilium/cilium#46778, @cilium-renovate[bot]) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.20.0-rc.0: Entity cluster-mesh und CNI-Version 1.0.0

Cilium 1.20.0-rc.0 fügt die Policy-Entity cluster-mesh hinzu, hebt die Standard-CNI-Konfigurationsversion von 0.3.1 auf 1.0.0 an und behebt mehrere Fehler, darunter kurzzeitig verworfene Verbindungen beim Agent-Neustart und fehlerhafte Policy-Ablehnungen bei L7-Load-Balancing.

Summary of Changes

Minor Changes:

  • Adds a new policy entity, cluster-mesh, which selects all endpoints in all meshed clusters. Also, makes the cluster and cluster-mesh create significantly fewer policy map entries. (cilium/cilium#46813, @squeed)
  • docs: add ListenerSet documentation (cilium/cilium#46850, @asauber)
  • The default CNI configuration version has been bumped from 0.3.1 to 1.0.0. Use the cni.customConf Helm value to set it back to 0.3.1 if needed. (cilium/cilium#46971, @gandro)

Bugfixes:

  • endpoint: Fix race when reading endpoint properties (cilium/cilium#46991, @gandro)
  • Fix cilium_operator_unmanaged_pods gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (cilium/cilium#46668, @Suyash1700)
  • Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (cilium/cilium#46927, @aanm)
  • Fix ctmap gc duration metric recording (cilium/cilium#46873, @fristonio)
  • Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (cilium/cilium#46821, @fristonio)
  • Fix regression preventing Cilium from starting when configured in kvstore mode with KPR disabled, if etcd is behind a Kubernetes service (cilium/cilium#46444, @giorio94) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.20.0-pre.4

Die Vorabversion 1.20.0-pre.4 bringt unter anderem ENI-IPAM mit IPv6 (Beta), ADS-Server-Unterstützung für Envoy, TCPRoute/UDPRoute und ListenerSets in Gateway API sowie Datapath-Plugins, während das Docker-libnetwork-Plugin entfällt.

Summary of Changes

Major Changes:

  • (Beta) ENI IPAM mode with IPv6: The ENI IPAM mode now supports allocating and using IPv6 prefixes. (cilium/cilium#46756, @41ks)
  • As previously announced, docker libnetwork plugin as been sunset and is no longer available. (cilium/cilium#46489, @aanm)
  • envoy: Add ADS (Aggregated Discovery Service) server support (cilium/cilium#43887, @nezdolik)
  • gateway-api: Add TCPRoute and UDPRoute support (cilium/cilium#46184, @eminaktas)
  • GatewayAPI: Implement ListenerSets. Allows per-namespace control of many Listeners for a single Gateway (cilium/cilium#46303, @asauber)
  • Introduce datapath plugins to enable third party datapath extensions. (cilium/cilium#46673, @jrife)
  • Makes the remote-node and world policy entities much more efficient by adding a new type of wildcard entry in the policy map. This can reduce policy map usage by thousands of entries in certain circumstances. (cilium/cilium#46438, @squeed)

Minor Changes:

  • Add --reply and --not-reply flags to hubble observe to filter flows by reply direction. (cilium/cilium#46531, @amaanx86)
  • Add spec.allowFirstIP and spec.allowLastIP to CiliumPodIPPool to allow Multi-Pool IPAM users to make the first and last IPs of each allocated pod CIDR allocatable. (cilium/cilium#46323, @SivagurunathanV) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.19.5

Version 1.19.5 enthält Fehlerbehebungen unter anderem zu Cluster-Labels bei nodeSelectorLabels, Azure-Public-IP-Neuzuweisung, BGP-Resets und Host-Proxy-Routing sowie eine korrigierte WireGuard-MTU-Berechnung und die Entfernung der Helm-Option loadBalancer.standalone.

Summary of Changes

Minor Changes:

  • Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR cilium/cilium#46554, Upstream PR cilium/cilium#46516, @giorio94)
  • helm: Remove loadBalancer.standalone option (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#46070, @joestringer)
  • wireguard:mtu: fix mtu calculation with potential padding (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#45940, @smagnani96)

Bugfixes:

  • Always add cluster label to node when nodeSelectorLabels is enabled to fix CiliumNetworkPolicy with fromNodes/toNodes with policy-default-local-cluster enabled (enabled by default in 1.19+) (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#46068, @MrFreezeex)
  • azure: Fix public IP reassignment failure loop on operator restart (Backport PR cilium/cilium#46289, Upstream PR cilium/cilium#46240, @HadrienPatte)
  • bgp: Don't provide default_gateway reconciler when disabled (Backport PR cilium/cilium#46024, Upstream PR cilium/cilium#45911, @YutaroHayakawa)
  • bgp: Reduce amount of soft peer resets by service reconciliation and fix potentially missed incorrect metadata update upon failed reconciliation. (Backport PR cilium/cilium#46245, Upstream PR cilium/cilium#45927, @rastislavs)
  • bpf: fix host proxy packet routing to pods (Backport PR cilium/cilium#46024, Upstream PR cilium/cilium#45916, @atykhyy) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.18.11

Version 1.18.11 behebt unter anderem das Traffic-Splitting für TLSRoute-Passthrough, einen Speicherleck-Fehler bei großen StateDB-Transaktionen, TLS-Passthrough-Routen bei gemischten Listenern und einen Nil-Pointer-Fehler und erweitert die troubleshoot-Befehle.

Summary of Changes

Minor Changes:

  • Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR cilium/cilium#46555, Upstream PR cilium/cilium#46516, @giorio94)

Bugfixes:

  • bug: fixed weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API (Backport PR cilium/cilium#46249, Upstream PR cilium/cilium#45937, @nickolaev)
  • datapath/mtu: add altname to mark cilium owned interfaces and do skip changing MTU on interfaces not managed by cilium (Backport PR cilium/cilium#46085, Upstream PR cilium/cilium#45799, @bersoare)
  • Fix memory leak issue with reusing a watch channel hash map from very large StateDB transactions (cilium/cilium#46498, @joamaki)
  • Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName. (Backport PR cilium/cilium#46234, Upstream PR cilium/cilium#45371, @syedazeez337)
  • multipool: Fix retries for CiliumNode Get errors (Backport PR cilium/cilium#46410, Upstream PR cilium/cilium#46124, @pippolo84)
  • sockets: fix nil pointer dereference in filterAndDestroySockets (Backport PR cilium/cilium#46029, Upstream PR cilium/cilium#44843, @umut-polat)

CI Changes:

  • chore(deps): update lvh-images for conformance-runtime (Backport PR cilium/cilium#46026, Upstream PR cilium/cilium#45922, @julianwiedmann) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.17.17

Version 1.17.17 behebt Retries bei CiliumNode-Get-Fehlern im Multipool-Modus und erweitert die Ausgaben der troubleshoot-Befehle für kvstore und clustermesh.

Summary of Changes

Minor Changes:

  • Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR cilium/cilium#46556, Upstream PR cilium/cilium#46516, @giorio94)

Bugfixes:

  • multipool: Fix retries for CiliumNode Get errors (Backport PR cilium/cilium#46413, Upstream PR cilium/cilium#46124, @pippolo84)

CI Changes:

  • chore(deps): update lvh-images for conformance-runtime (Backport PR cilium/cilium#46027, Upstream PR cilium/cilium#45922, @julianwiedmann)
  • ci:bpftrace: fail curl with corrupted binary download (Backport PR cilium/cilium#46030, Upstream PR cilium/cilium#45948, @smagnani96)
  • helm: add tmpl files to .helmignore (Backport PR cilium/cilium#46556, Upstream PR cilium/cilium#46445, @sekhar-isovalent)
  • helm: allow overriding of registry_prefix in charts (Backport PR cilium/cilium#46294, Upstream PR cilium/cilium#46217, @sekhar-isovalent)

Misc Changes:

  • [v1.17] - chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 7… (cilium/cilium#46580, @aanm)
  • [v1.17] deps: bump various Go packages (cilium/cilium#46187, @ferozsalam)
  • chore(deps): update all github action dependencies (v1.17) (cilium/cilium#46002, @cilium-renovate[bot])
  • chore(deps): update all github action dependencies (v1.17) (cilium/cilium#46018, @cilium-renovate[bot])
  • chore(deps): update all github action dependencies (v1.17) (cilium/cilium#46119, @cilium-renovate[bot]) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.20.0-pre.3

Die Vorabversion 1.20.0-pre.3 unterstützt den ExternalAuth-Filter für HTTPRoutes in Gateway API, hebt cilium-envoy auf v1.37.x an und ergänzt unter anderem den Helm-Wert encryption.ztunnel.ca.type sowie Azure-IPAM-Änderungen.

Summary of Changes

Major Changes:

  • Gateway API: ExternalAuth filter support for HTTPRoutes Cilium now supports the ExternalAuth filter type in HTTPRoutes (GEP-1494). Routes can delegate authorization decisions to an external service using either gRPC (Envoy ext_authz protocol) or HTTP. Configurable options include allowed request/response headers, request body forwarding, path prefix, and TLS-backed auth backends via BackendTLSPolicy. (cilium/cilium#45739, @gauteoh)
  • proxy: Bump cilium-envoy to v1.37.x (cilium/cilium#45851, @sayboras)

Minor Changes:

  • Add encryption.ztunnel.ca.type Helm value to select ztunnel's CA backend (spire|internal, default internal). (cilium/cilium#45861, @nddq)
  • Add helm.sh/chart standard label (cilium/cilium#45771, @chernetskyi)
  • Adds optional fields for subject and private key options in certificate template when cert-manager is used to generate clustermesh-apiserver and hubble TLS certificates. (cilium/cilium#45972, @owayss)
  • alibabacloud: Migrate IP/CIDR fields to ip.Addr/Prefix wrappers (cilium/cilium#46210, @HadrienPatte)
  • Azure IPAM: track subnet once per AzureInterface on CiliumNode status, matching AWS and AlibabaCloud IPAM models. The previous per-address addresses[].subnet and flat interfaces[].cidr fields are deprecated. (cilium/cilium#45985, @jaredledvina)
  • azure: Remove duplicate GetInstance call in per-instance resync (cilium/cilium#46192, @HadrienPatte) …

Originalquelle(öffnet in neuem Tab)Problem melden

Ähnlich wie Cilium, mit neuen Einträgen