Zum Inhalt springen

Cilium Release Notes

30 Einträge aus 1 Quelle. Zuletzt aktualisiert:

Feed abonnieren:RSS: Feed für Cilium Release NotesAPI: Einträge von Cilium Release Notes als JSON
Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.19.4

Version 1.19.4 filtert EndpointSlices bei gesetztem --k8s-service-proxy-name per Label, sortiert Routen für korrektes Longest-Prefix-Matching beim iptables-Masquerading und behebt Fehler, etwa bei Egress-Gateway-FIB-Lookup und der Anzeige in cilium map list.

Summary of Changes

Minor Changes:

  • cilium-agent: when --k8s-service-proxy-name is set, EndpointSlices are now filtered by the service.kubernetes.io/service-proxy-name label at the watch level, matching how Services are already filtered, operators with hand-managed EndpointSlices must stamp the matching label on those slices. (Backport PR cilium/cilium#45755, Upstream PR cilium/cilium#45504, @HadrienPatte)
  • iptables-based masquerading: Ensure iptables rules respect longest prefix match by sorting routes by mask length when enable-masquerade-to-route-source is enabled (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45192, @liyihuang)
  • operator/spire: make SPIRE client configurable for ztunnel (Backport PR cilium/cilium#45356, Upstream PR cilium/cilium#44136, @nddq)
  • pkg/endpoint: skip logger rebuild on policy revision updates (Backport PR cilium/cilium#45630, Upstream PR cilium/cilium#45533, @sjohnsonpal)

Bugfixes:

  • bpf: egressgw: respect egress ifindex during FIB lookup (Backport PR cilium/cilium#45695, Upstream PR cilium/cilium#45661, @julianwiedmann)
  • bpf: host: fix source identity for IPsec trace in to-netdev (Backport PR cilium/cilium#45594, Upstream PR cilium/cilium#45588, @julianwiedmann)
  • cilium-dbg: cilium map list now displays "unknown" instead of 0 for maps that do not support cache-based entry counting. (Backport PR cilium/cilium#45888, Upstream PR cilium/cilium#44951, @skymensch) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.18.10

Version 1.18.10 behebt unter anderem einen cilium-agent-Absturz bei transienten Netzwerkfehlern, fehlende globale Service-Backends in Cluster Mesh, das Überschreiben von Service-Frontends durch CiliumLocalRedirectPolicy und einen IPsec-Panic.

Summary of Changes

Bugfixes:

  • Fix cilium-agent crash when a transient network error occurs during CiliumNode update. The agent now retries instead of calling Fatal. (Backport PR cilium/cilium#45753, Upstream PR cilium/cilium#44526, @nebojsaj1726)
  • Fix CiliumLocalRedirectPolicy addressMatcher overriding an existing Service's frontend when its backend pods are not yet Ready. (Backport PR cilium/cilium#45585, Upstream PR cilium/cilium#45522, @ysksuzuki)
  • Fix missing global service backends in Cluster Mesh when multiple service ports point to the same target port. (Backport PR cilium/cilium#45354, Upstream PR cilium/cilium#45179, @RiccardoAtzori91)
  • fix(egressGateway): skip unmatched gateways when using multiple gateway (Backport PR cilium/cilium#45631, Upstream PR cilium/cilium#44705, @ieth0)
  • fix(ipsec): panic in parseSPI on malformed input (Backport PR cilium/cilium#45498, Upstream PR cilium/cilium#44815, @isoyuki)

CI Changes:

  • egressgw: add test helpers with explicit reconciliation (Backport PR cilium/cilium#45631, Upstream PR cilium/cilium#41475, @julianwiedmann)
  • gha/clustermesh: use OCI registry for cert-manager (Backport PR cilium/cilium#45354, Upstream PR cilium/cilium#45326, @giorio94)
  • Use extra power github runner if available for multi-pool CI workflow (Backport PR cilium/cilium#45674, Upstream PR cilium/cilium#45555, @fristonio)

Misc Changes: …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.17.16

Version 1.17.16 verhindert, dass der addressMatcher von CiliumLocalRedirectPolicy bestehende Service-Frontends überschreibt (altes Verhalten per --enable-lrp-address-matcher-override=true), behebt einen IPsec-Panic und registriert cluster-pool-IPAM-Metriken.

Summary of Changes

Bugfixes:

  • CiliumLocalRedirectPolicy addressMatcher now refuses to override an existing Service's frontend (prevents cross-namespace traffic hijacking and service-map corruption on policy delete); set --enable-lrp-address-matcher-override=true to restore the legacy behavior. (cilium/cilium#45412, @ysksuzuki)
  • fix(ipsec): panic in parseSPI on malformed input (Backport PR cilium/cilium#45506, Upstream PR cilium/cilium#44815, @isoyuki)
  • Register cluster-pool IPAM metrics related to CiliumNode synchronization with k8s (Backport PR cilium/cilium#45931, Upstream PR cilium/cilium#41531, @pippolo84)

CI Changes:

  • [v1.17] ipam: fix data race in MultiPoolManager node update (cilium/cilium#45383, @Kunalbehbud)
  • gha/clustermesh: use OCI registry for cert-manager (Backport PR cilium/cilium#45350, Upstream PR cilium/cilium#45326, @giorio94)
  • Use extra power github runner if available for multi-pool CI workflow (Backport PR cilium/cilium#45675, Upstream PR cilium/cilium#45555, @fristonio)

Misc Changes:

  • [v1.17] deps: bump go.opentelemetry.io/otel to 1.41.0 (cilium/cilium#45936, @ferozsalam)
  • Add documentation and warnings on DNS interception (Backport PR cilium/cilium#45890, Upstream PR cilium/cilium#45525, @ferozsalam)
  • chore(deps): update all external docker images dependencies to v0.13.5 (v1.17) (patch) (cilium/cilium#45476, @cilium-renovate[bot]) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.20.0-pre.2

Die Vorabversion 1.20.0-pre.2 unterstützt Gateway API v1.5.1 (Migration von TLSRoute v1alpha2 auf v1 nötig), erlaubt das pro-Pod-Deaktivieren der Source-IP-Prüfung und ergänzt unter anderem den Helm-Wert preferIpv6 sowie neue BGP-Shell-Befehle.

Summary of Changes

Major Changes:

  • Allow users to disable source IP verification per-pod by setting an annotation. This requires an annotation on the pod's Namespace as well. (cilium/cilium#43505, @zbb88888)
  • gateway-api: Cilium now supports Gateway API v1.5.1. Please note that this includes moving TLSRoute to v1. To continue safely using TLSRoute, you must migrate from TLSRoute v1alpha2 to TLSRoute v1. (cilium/cilium#45251, @youngnick)

Minor Changes:

  • Add generic preferIpv6 Helm value / --prefer-ipv6 agent flag to prefer IPv6 addresses for health probes and Hubble peer communication when both address families are available. The hubble.preferIpv6 Helm value and --hubble-prefer-ipv6 agent flag are deprecated in favor of the new top-level preferIpv6 and will be removed in Cilium 1.20. (cilium/cilium#45447, @tibrezus)
  • agent, devices: make children interfaces bound to VRF interfaces eligible for device auto-selection. (cilium/cilium#45146, @ldelossa)
  • bgp: add --format option to the bgp/peers command to support table, json, and detailed output formats (cilium/cilium#45534, @martonra)
  • bgp: Add bgp/route-policies shell command (cilium/cilium#45628, @martonra)
  • bpf: add HostPort wildcard lookup to per-packet LB (cilium/cilium#45115, @saiaunghlyanhtet)
  • bpf: Move edt_set_aggregate() above proto switch in cil_from_container (cilium/cilium#45129, @brb) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.19.3

Version 1.19.3 behebt unter anderem einen Performance-Fehler bei der L7-Proxy-Weiterleitung, ein Initialisierungsproblem im KVStore-Identitätsmodus mit etcd hinter einem K8s Service sowie mehrere BGP-, Clustermesh- und Envoy-Fehler und ergänzt Helm-Werte für configDriftDetection.

Summary of Changes

Minor Changes:

  • Fix performance bug in L7 policy proxy redirect handling (Backport PR cilium/cilium#44828, Upstream PR cilium/cilium#44613, @fristonio)
  • Fixes issue where the Cilium agent fails to initialise when using KVStore identity mode with etcd behind a K8s Service (Backport PR cilium/cilium#44828, Upstream PR cilium/cilium#44653, @41ks)
  • helm,docs: add configDriftDetection Helm values and documentation (Backport PR cilium/cilium#44974, Upstream PR cilium/cilium#44703, @PhilipSchmid)

Bugfixes:

  • [v1.19] Fix incorrect policy service selector handling (cilium/cilium#44888, @fristonio)
  • bgp: Fix potential race in service advertisements upon error retry (Backport PR cilium/cilium#45211, Upstream PR cilium/cilium#45049, @rastislavs)
  • clustermesh: fix a bug in the MCS-API CRD installl that could attempt a CRD downgrade when the version label is higher (Backport PR cilium/cilium#44828, Upstream PR cilium/cilium#44738, @MrFreezeex)
  • ctmap: Change order of active maps (Backport PR cilium/cilium#44828, Upstream PR cilium/cilium#44729, @brb)
  • Ensure completion.WaitGroup always has a timeout (Backport PR cilium/cilium#45217, Upstream PR cilium/cilium#44731, @jrajahalme)
  • envoy: Fix xds server npds listeners accounting (Backport PR cilium/cilium#45217, Upstream PR cilium/cilium#44830, @fristonio) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.18.9: Leistungs- und Speicherleck-Fixes

Cilium 1.18.9 behebt einen Performance-Fehler bei der L7-Policy-Proxy-Weiterleitung, mehrere Speicherlecks, einen Hubble-Relay-Panic und Fehler bei statischen Pods und führt neue configDriftDetection-Helm-Werte ein.

Summary of Changes

Minor Changes:

  • Fix performance bug in L7 policy proxy redirect handling (Backport PR cilium/cilium#44827, Upstream PR cilium/cilium#44613, @fristonio)
  • helm,docs: add configDriftDetection Helm values and documentation (Backport PR cilium/cilium#44972, Upstream PR cilium/cilium#44703, @PhilipSchmid)

Bugfixes:

  • [v1.18] Fix incorrect policy service selector handling (cilium/cilium#44949, @fristonio)
  • Ensure completion.WaitGroup always has a timeout (Backport PR cilium/cilium#45218, Upstream PR cilium/cilium#44731, @jrajahalme)
  • envoy: Fix xds server npds listeners accounting (Backport PR cilium/cilium#45218, Upstream PR cilium/cilium#44830, @fristonio)
  • Fix a slow memory leak triggered by incremental policy updates (Backport PR cilium/cilium#45053, Upstream PR cilium/cilium#44328, @odinuge)
  • Fix endpoints for static pods stuck in init identity (Backport PR cilium/cilium#45213, Upstream PR cilium/cilium#45016, @aaroniscode)
  • Fix memory leak triggered by policies being created and deleted (Backport PR cilium/cilium#44827, Upstream PR cilium/cilium#44724, @odinuge)
  • Fix panic in Hubble Relay when new peer address is unresolvable (Backport PR cilium/cilium#45213, Upstream PR cilium/cilium#45021, @pesarkhobeee) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.17.15: Fehlerbehebungen

Cilium 1.17.15 behebt unter anderem falsche Policy-Service-Selektoren, Speicherlecks, einen Hubble-Relay-Panic, Probleme bei Endpoints sowie Fehler in der Dual-Stack-cluster-pool-IPAM.

Summary of Changes

Bugfixes:

  • [v1.17] Fix incorrect policy service selector handling (cilium/cilium#44950, @fristonio)
  • envoy: Fix xds server npds listeners accounting (Backport PR cilium/cilium#45262, Upstream PR cilium/cilium#44830, @fristonio)
  • Fix a slow memory leak triggered by incremental policy updates (Backport PR cilium/cilium#45054, Upstream PR cilium/cilium#44328, @odinuge)
  • Fix issue where endpoints got stuck in "waiting-to-regenerate" (Backport PR cilium/cilium#44825, Upstream PR cilium/cilium#42856, @odinuge)
  • Fix memory leak triggered by policies being created and deleted (Backport PR cilium/cilium#44825, Upstream PR cilium/cilium#44724, @odinuge)
  • Fix panic in Hubble Relay when new peer address is unresolvable (Backport PR cilium/cilium#45238, Upstream PR cilium/cilium#45021, @pesarkhobeee)
  • Fixed a bug in dual-stack cluster-pool IPAM where an operator restart with a pre-existing duplicate IPv6 PodCIDR could cause the affected node's IPv4 PodCIDR to be incorrectly freed and reassigned to another node. (Backport PR cilium/cilium#44868, Upstream PR cilium/cilium#44832, @christarazi)
  • Fixed an issue where policy update ack is never completed after endpoint deletion. (Backport PR cilium/cilium#44820, Upstream PR cilium/cilium#44754, @jrajahalme)
  • Fixed ipcache identity update hang when last proxy listener is removed. (Backport PR cilium/cilium#45262, Upstream PR cilium/cilium#44597, @jrajahalme) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.20.0-pre.1

Cilium 1.20.0-pre.1 bringt unter anderem dynamische Source-IP-Auflösung bei nodeport, ICMPv6-"Destination unreachable" bei IPv6-Egress-Policy-Ablehnungen, PreferSameZone/PreferSameNode-Traffic-Distribution und entfernt Proxylib-Felder aus den CNP- und CCNP-CRDs.

Summary of Changes

Major Changes:

  • nodeport: support n/s dynamic source ip resolution (cilium/cilium#44625, @ldelossa)
  • policy: return ICMPv6 "Destination unreachable" on IPv6 egress policy denials (cilium/cilium#44234, @Andreagit97)

Minor Changes:

  • Add jitter delay to the IPsec key file watcher for key rotations, to avoid thundering herd problem on Cilium agents. (cilium/cilium#44263, @shavyshetty)
  • Add support for PreferSameZone and PreferSameNode traffic distribution (cilium/cilium#44771, @raphink)
  • clustermesh: run official MCS-API conformance in CI (cilium/cilium#44424, @MrFreezeex)
  • Do not run with netkit and per-endpoint routes if kernel does not support netkit scrub attributes. (cilium/cilium#44960, @ajmmm)
  • Fix performance bug in L7 policy proxy redirect handling (cilium/cilium#44613, @fristonio)
  • Fixes issue where the Cilium agent fails to initialise when using KVStore identity mode with etcd behind a K8s Service (cilium/cilium#44653, @41ks)
  • helm,docs: add configDriftDetection Helm values and documentation (cilium/cilium#44703, @PhilipSchmid)
  • IPAM: Add CIDR label to IPAM capacity metric (cilium/cilium#44541, @soggiest)
  • operator: add --leader-election-resource-lock-timeout flag (cilium/cilium#44500, @darox)
  • pkg/policy: Support more tunnel protocols as extended protocols (cilium/cilium#44459, @simplysoft)
  • Proxylib related fields are removed from CNP and CCNP CRDs. (cilium/cilium#44610, @jrajahalme) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.19.2: Fehlerbehebungen und ztunnel-Änderung

Cilium 1.19.2 verlagert die ztunnel-Daemonset-Verwaltung vom Operator zu Helm und behebt unter anderem Probleme beim Neighbor-Reconciler, bei nodeport-L7-LB, in cilium-dbg, bei Clustermesh sowie beim XDP-Upgrade und -Downgrade.

Summary of Changes

Minor Changes:

  • ztunnel/helm: move ztunnel daemonset management from operator to helm (Backport PR cilium/cilium#44593, Upstream PR cilium/cilium#43763, @nddq)

Bugfixes:

  • Add rate limiting to neighbor reconciler to reduce CPU usage and memory churn (Backport PR cilium/cilium#44699, Upstream PR cilium/cilium#43928, @dylandreimerink)
  • bpf: nodeport: use hairpin redirect for L7 LB on bridge devices (Backport PR cilium/cilium#44760, Upstream PR cilium/cilium#44658, @smagnani96)
  • cilium-dbg: fix seg-fault ip get -l reserved:host (Backport PR cilium/cilium#44517, Upstream PR cilium/cilium#44443, @aanm)
  • clustermesh: fix a few minor typo/issues in the MCS-API documentation (Backport PR cilium/cilium#44398, Upstream PR cilium/cilium#44299, @MrFreezeex)
  • clustermesh: fix a goroutine leak related to EndpointSliceSync when removing cluster (Backport PR cilium/cilium#44517, Upstream PR cilium/cilium#44444, @MrFreezeex)
  • clustermesh: fix a race condition where EndpointSlices created just before a cluster is removed could be left uncleaned (Backport PR cilium/cilium#44517, Upstream PR cilium/cilium#44503, @MrFreezeex)
  • Enable Cilium upgrade and downgrade when existing XDP attach types differ from new XDP programs (Backport PR cilium/cilium#44496, Upstream PR cilium/cilium#44209, @dylandreimerink) …

Originalquelle(öffnet in neuem Tab)Problem melden

Angaben zum Datum

Datum aus der Quelle.

Erstmals gesehen am .

Cilium

Cilium 1.18.8 mit Fehlerbehebungen und GKE-Hinweis

Cilium 1.18.8 erlaubt XDP auf Interfaces mit Jumbo-MTU und behebt mehrere Fehler, wobei GKE-Nutzer wegen einer bekannten Regression diese Version überspringen oder auf 1.19.2 aktualisieren sollten.

Known issues

  • Users who deploy Cilium on GKE should skip this version or upgrade to 1.19.2 due to a known regression.

Summary of Changes

Minor Changes:

  • Allow to attach Cilium's XDP program on network interfaces that have jumbo MTU configured and support xdp.frags program type. (Backport PR cilium/cilium#44499, Upstream PR cilium/cilium#41967, @viktor-kurchenko)

Bugfixes:

  • bpf: nodeport: use hairpin redirect for L7 LB on bridge devices (Backport PR cilium/cilium#44758, Upstream PR cilium/cilium#44658, @smagnani96)
  • cilium-dbg: fix seg-fault ip get -l reserved:host (Backport PR cilium/cilium#44519, Upstream PR cilium/cilium#44443, @aanm)
  • Enable Cilium upgrade and downgrade when existing XDP attach types differ from new XDP programs (Backport PR cilium/cilium#44499, Upstream PR cilium/cilium#44209, @dylandreimerink)
  • Fix a bug where node IPv6 updates and deletes were not correctly propagated to the Linux kernel neighbor subsystem. (Backport PR cilium/cilium#44592, Upstream PR cilium/cilium#44540, @tklauser)
  • Fix a bug where removed addresses from EndpointSlices might be missed if multiple EndpointSlices share the same name (Backport PR cilium/cilium#44021, Upstream PR cilium/cilium#43999, @EmilyShepherd) …

Originalquelle(öffnet in neuem Tab)Problem melden

Ähnlich wie Cilium, mit neuen Einträgen