AI-analyzed release notes for CNCF graduated and incubating projects.
This release fixes the client-side apply migration issue reported in versions 3. and 3.. No security advisories are disclosed.
Action needed (1)
breakingClient-side apply migration failure
The failed to perform client-side apply migration issue present in versions 3. and 3. is fixed in this release.
This release adds operator-visible capabilities and changes several runtime defaults. Ambient mesh behavior, debug endpoint authorization, metrics compression, and istiod memory and circuit-breaker behavior receive particular attention.
Action needed (1)
breakingAutomatic GOMEMLIMIT setting for istiod
istiod now automatically sets GOMEMLIMIT to 90% of its memory limits through the automemlimit library. This reduces the risk of OOM kills while maintaining performance.
Check if affected (4)
breakingDefault iptables reconciliation
Applies when the istio-cni DaemonSet is upgraded.
breakingDefault debug endpoint authorization
Applies to debug endpoints on port 15014.
breakingDefault HTTP compression for Envoy metrics
Applies to Envoy metrics at the Prometheus stats endpoint based on client Accept-Header values.
A maintenance release combining an operator-facing configuration adjustment with bug fixes and routine dependency and image refreshes. No security advisories or security-specific fixes are disclosed.
Action needed (1)
breakingExclusion of topology. labels from security labels by default
The default security-label handling in this release excludes topology. labels from security labels.
This release removes a deprecated v1 adapter wrapper and changes the default span kind in API v3 operations. The remaining release notes do not describe distinct operator-facing changes.
Action needed (1)
breakingDeprecated protofromtraces wrapper removal
The deprecated protofromtraces wrapper has been removed from v1adapter.
A maintenance release with operator-facing removals, default and behavior changes, new CRD fields, expanded configuration support, and dependency updates. No security advisory is disclosed.
Action needed (1)
breakingNodes/proxy RBAC enablement removal
The unnecessary nodes/proxy RBAC enablement is removed.
Check if affected (2)
breakingDefault Ceph image pull policy
Applies if you do not configure ceph image pull policy.
breakingAutomated node fencing code removal
Applies if automated node fencing runs.
This release changes NATS connection authentication and the component spec feature. Dependency and OCI image base updates are also included.
Action needed (1)
breakingThe component spec feature, removed
The component spec feature is removed in this release.
A substantial operator-facing feature and maintenance release with new DNS proxy, installation, configuration, API, metric, and datapath capabilities. It also changes defaults and compatibility requirements, removes deprecated interfaces, migrates BGP APIs, and updates security-related dependencies.
Action needed (15)
securityThe github. dependency, updated
The github. module is updated to v1.7.29.
securityThe github. dependency, updated
The github. module is updated to v2.4.0.
securityThe github. dependency, updated
The github. module is updated to v28.3.3+incompatible.
securityThe golang. dependency, updated
The golang. module is updated to v0.45.0.
securityThe helm. dependency, updated to v3.18.4
The helm. module is updated to v3.18.4.
securityThe helm. dependency, updated to v3.18.5
The helm. module is updated to v3.18.5.
breakingThe plpmtud default, set to blackhole
The default plpmtud mode is now blackhole (blackhole-detected).
breakingThe AddressScopeMax default, set to 254
The default AddressScopeMax is changed to 254, the host scope, for GKE metadata server and HCP use cases. The related setting is --local-max-addr-scope.
breakingThe tls authMode default, set to migration
tls authMode is set to migration by default.
breakingThe CNI deletion timeout, reduced to 1.5 seconds
The CNI deletion timeout is reduced to 1.5 seconds.
breakingThe policy-default-local-cluster default
policy-default-local-cluster is now set by default.
breakingHost firewall bypass, disabled by default
Host firewall bypass is disabled by default.
breakingFQDN match pattern sanitization
FQDN match pattern sanitization is refactored and tightened.
breakingEncrypted traffic forwarding via cilium_host, removed
Forwarding encrypted traffic via cilium_host has been removed.
breakingCNI configuration in the container image, removed
The CNI configuration is no longer installed in the container image.
Check if affected (30)
breakingLocal-cluster default for network policy selectors
Applies if you do not set cluster in network policy selectors.
breakingThe CiliumBGPPeeringPolicy v1 API, removed
Applies if you use CiliumBGPPeeringPolicy.
breakingMutual Authentication, disabled by default
Applies if you enable Mutual Authentication.
Plan ahead (7)
deprecated--enable-ipsec-encrypted-overlay, deprecatedremoval date not announced
Applies if you use --enable-ipsec-encrypted-overlay.
deprecatedKafka match fields and ToRequires and FromRequires, deprecated
Applies if you use ToRequires or FromRequires.
deprecatedTLS certificate and key Helm values, deprecated
Applies if you pass TLS certificates or keys in Helm values.
