AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with numerous operator-facing bug fixes and behavior corrections, alongside dependency and image updates. It also introduces a decoder-memory limit and fixes a CIDR policy bypass that could cause traffic drops after an agent restart.
Check if affected (1)
securityThe endpoint CIDR policy bypass, fixed
Applicability is not stated in the release notes.
The endpoint handling fixes a silent CIDR policy bypass and traffic drops after an agent restart.
A substantial feature and maintenance release with Gateway API, networking, IPAM, policy, observability, and datapath changes, alongside correctness and performance fixes. Operators should review removed or renamed options, changed defaults and requirements, removed metrics and integrations, and the dependency updates addressing security-related issues.
Action needed (11)
securitygoogle. v1.79.3
The google. module is updated to v1.79.3 in the main branch.
securitygoogle. v1.82.1
The google. module is updated to v1.82.1 in the v1.20 branch.
securityhelm. v4.1.4
The helm. module is updated to v4.1.4 in the main branch.
securitygithub. v1.6.3
The github. module is updated to v1.6.3.
securitygithub. v4.1.4
The github. module is updated to v4.1.4.
securitygithub. v0.5.1
The github. module is updated to v0.5.1.
breakingcni. CNI configuration version
The default CNI configuration version for cni. changes from 0.3.1 to 1.0.0.
breakingCilium operator IPAM metrics removal
The IPAM metrics cilium_operator_ipam_ips and cilium_operator_ipam_available_interfaces are removed.
breakingDefault CNI configuration version
The default CNI configuration version changes from 0.3.1 to 1.0.0.
breakingNative histogram default
Native histograms are emitted for all histograms by default.
breakingAgent bootstrap metrics removal
Agent bootstrap metrics are removed.
Check if affected (28)
securitytbid traffic host namespace handling
Applies if you use tbid traffic.
Explicit tbid traffic is prevented from leaking to the host network namespace.
breakingDocker libnetwork plugin removal
Applies if you use the Docker libnetwork plugin.
The Docker libnetwork plugin is sunset and is no longer available in this release.
breakingces-slice-mode removal
Applies if you configure ces-slice-mode.
The deprecated ces-slice-mode option is removed in this release.
Plan ahead (6)
deprecatedBeta Mutual Auth deprecationremoval date not announced
Applies if you use Mutual Auth.
Cilium's Beta Mutual Auth support is deprecated and will be removed in a future version.
deprecatedDeprecated address and interface CIDR fields
Applies if you configure addresses[]. or interfaces[]..
The previous per-address addresses[]. and flat interfaces[]. fields are deprecated.
deprecatedLocal REST BGP API deprecationremoval date not announced
Applies if you use the local REST BGP APIs.
The local REST BGP APIs are deprecated and will be removed in the future.
A maintenance-focused release with correctness fixes, dependency updates, operator troubleshooting improvements, and a security fix for a namespace-bypass issue. It also removes obsolete Helm settings, so configurations using those values need review.
Check if affected (3)
securityWildcard namespace bypass for selectorless ipBlock rules, fixed
Applies if you configure ipBlock.
The wildcard namespace bypass is fixed for selectorless ipBlock rules.
breakingThe loadBalancer. Helm option, removed
Applies if you configure loadBalancer..
The Helm loadBalancer. option is removed from the release.
breakingThe l2podAnnouncements. Helm value, replaced by l2podAnnouncements.
Applies if you configure l2podAnnouncements. and enable L2 pod announcements.
The defunct Helm value l2podAnnouncements. is removed because it rendered a ConfigMap key the agent no longer recognizes and could cause crash loops. l2podAnnouncements. is the replacement.
A maintenance release with operator-relevant bug fixes, new configuration and diagnostic capabilities, and dependency and image updates. Two fixes address security-relevant exposure or policy bypass, and no deprecations or removals are announced.
Check if affected (2)
securityWorld-accessible Envoy admin socket
Applies if envoy runs.
The envoy admin socket creation is fixed so it is not world-accessible in v1.19.2.
securityIngress policy enforcement for local backends
Applies if you use ingress policies and local backends.
Ingress policies no longer bypass enforcement for local backends in v1.19.2.
A maintenance release with bug fixes, dependency and image updates, improved bugtool output, and a GKE channel fix. The Envoy admin socket fix addresses its world-accessible creation.
Check if affected (1)
securityThe Envoy admin socket's accessibility
Applies if Envoy runs.
The Envoy admin socket is no longer created as world-accessible. This fix ships in Cilium v1.17.14.
