AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with numerous operator-facing bug fixes and behavior corrections, alongside dependency and image updates. It also introduces a decoder-memory limit and fixes a CIDR policy bypass that could cause traffic drops after an agent restart.
Check if affected (1)
securityThe endpoint CIDR policy bypass, fixed
Applicability is not stated in the release notes.
The endpoint handling fixes a silent CIDR policy bypass and traffic drops after an agent restart.
A maintenance release that adds host-firewall protocol support, corrects networking and stability defects, and changes runtime behavior and observability. It also updates dependencies and container images, including a gRPC security fix with no disclosed vulnerability.
Action needed (1)
securityThe google. dependency, updated to v1.
The google. module is updated to v1. in the v1.18 release line. The release note marks this dependency update as a security fix, but does not disclose the vulnerability.
A substantial feature and maintenance release with Gateway API, networking, IPAM, policy, observability, and datapath changes, alongside correctness and performance fixes. Operators should review removed or renamed options, changed defaults and requirements, removed metrics and integrations, and the dependency updates addressing security-related issues.
Action needed (11)
securitygoogle. v1.79.3
The google. module is updated to v1.79.3 in the main branch.
securitygoogle. v1.82.1
The google. module is updated to v1.82.1 in the v1.20 branch.
securityhelm. v4.1.4
The helm. module is updated to v4.1.4 in the main branch.
securitygithub. v1.6.3
The github. module is updated to v1.6.3.
securitygithub. v4.1.4
The github. module is updated to v4.1.4.
securitygithub. v0.5.1
The github. module is updated to v0.5.1.
breakingcni. CNI configuration version
The default CNI configuration version for cni. changes from 0.3.1 to 1.0.0.
breakingCilium operator IPAM metrics removal
The IPAM metrics cilium_operator_ipam_ips and cilium_operator_ipam_available_interfaces are removed.
breakingDefault CNI configuration version
The default CNI configuration version changes from 0.3.1 to 1.0.0.
breakingNative histogram default
Native histograms are emitted for all histograms by default.
breakingAgent bootstrap metrics removal
Agent bootstrap metrics are removed.
Check if affected (28)
securitytbid traffic host namespace handling
Applies if you use tbid traffic.
Explicit tbid traffic is prevented from leaking to the host network namespace.
breakingDocker libnetwork plugin removal
Applies if you use the Docker libnetwork plugin.
The Docker libnetwork plugin is sunset and is no longer available in this release.
breakingces-slice-mode removal
Applies if you configure ces-slice-mode.
The deprecated ces-slice-mode option is removed in this release.
Plan ahead (6)
deprecatedBeta Mutual Auth deprecationremoval date not announced
Applies if you use Mutual Auth.
Cilium's Beta Mutual Auth support is deprecated and will be removed in a future version.
deprecatedDeprecated address and interface CIDR fields
Applies if you configure addresses[]. or interfaces[]..
The previous per-address addresses[]. and flat interfaces[]. fields are deprecated.
deprecatedLocal REST BGP API deprecationremoval date not announced
Applies if you use the local REST BGP APIs.
The local REST BGP APIs are deprecated and will be removed in the future.
A maintenance-focused release with correctness fixes, dependency updates, operator troubleshooting improvements, and a security fix for a namespace-bypass issue. It also removes obsolete Helm settings, so configurations using those values need review.
Check if affected (3)
securityWildcard namespace bypass for selectorless ipBlock rules, fixed
Applies if you configure ipBlock.
The wildcard namespace bypass is fixed for selectorless ipBlock rules.
breakingThe loadBalancer. Helm option, removed
Applies if you configure loadBalancer..
The Helm loadBalancer. option is removed from the release.
breakingThe l2podAnnouncements. Helm value, replaced by l2podAnnouncements.
Applies if you configure l2podAnnouncements. and enable L2 pod announcements.
The defunct Helm value l2podAnnouncements. is removed because it rendered a ConfigMap key the agent no longer recognizes and could cause crash loops. l2podAnnouncements. is the replacement.
A maintenance release with several operator-visible fixes, narrower EndpointSlice watch behavior, Helm configurability, and dependency and image updates. The EndpointSlice filtering change affects configurations that set a service proxy name, while the release also updates the github. dependency.
Action needed (2)
securityThe github. module update
The github. module is updated to v0..
breakingService-label filtering for EndpointSlice watches
The loadbalancer/reflectors component filters EndpointSlice watches by service labels.
Check if affected (1)
breakingLabel filtering for EndpointSlices
Applies if you set --k8s-service-proxy-name.
When --k8s-service-proxy-name is set, EndpointSlices are filtered at the watch level by the service. label, matching the existing Services filtering. Operators that manage EndpointSlices themselves must add the matching label to those slices.
A maintenance release with an enforced policy behavior change, bug fixes, new metrics, and Helm image overrides. It also updates dependencies and container images and refreshes container image manifests.
Action needed (1)
securityThe github. dependency update
The github. module is updated to v0. in v1.17.16.
Check if affected (1)
breakingCiliumLocalRedirectPolicy addressMatcher override behavior
Applies if you use addressMatcher in CiliumLocalRedirectPolicy and do not enable --enable-lrp-address-matcher-override=true.
In v1.17.16, CiliumLocalRedirectPolicy addressMatcher refuses to override an existing Service frontend. Set --enable-lrp-address-matcher-override=true to restore the legacy behavior.
Cilium v1.18.10 contains correctness fixes, Helm support for overriding images, and dependency and image updates. The github. update is marked as a security update, but no advisory identifier is provided.
Action needed (1)
securityThe github. module update to v0.5.1
Cilium v1.18.10 updates the github. module to v0.5.1 as an undisclosed security update.
Cilium v1.19.3 combines operator-relevant bug fixes with configuration and CLI additions, along with dependency and image updates. The release is relevant to deployments using the affected functionality and to users tracking dependency changes.
Action needed (1)
securityThe github. module update
The github. module is updated to v4.1.4 in the v1.19.3 release. The update is marked as security-related.
Cilium v1.18.9 contains correctness fixes and dependency updates. It also includes security-related changes, including an injection-prevention fix and a security-tagged module update.
Action needed (2)
securityRegex dollar-sign escaping for injection prevention
Regex handling now escapes the $ character to prevent injection. The fix ships in Cilium v1.18.9.
securityThe github. dependency update
The github. module is updated to v4.1.4 in Cilium v1.18.9. The release note marks this dependency update as security-related.
A maintenance release with operator-relevant bug fixes, new configuration and diagnostic capabilities, and dependency and image updates. Two fixes address security-relevant exposure or policy bypass, and no deprecations or removals are announced.
Check if affected (2)
securityWorld-accessible Envoy admin socket
Applies if envoy runs.
The envoy admin socket creation is fixed so it is not world-accessible in v1.19.2.
securityIngress policy enforcement for local backends
Applies if you use ingress policies and local backends.
Ingress policies no longer bypass enforcement for local backends in v1.19.2.
A maintenance release with bug fixes, dependency and image updates, improved bugtool output, and a GKE channel fix. The Envoy admin socket fix addresses its world-accessible creation.
Check if affected (1)
securityThe Envoy admin socket's accessibility
Applies if Envoy runs.
The Envoy admin socket is no longer created as world-accessible. This fix ships in Cilium v1.17.14.
A substantial operator-facing feature and maintenance release with new DNS proxy, installation, configuration, API, metric, and datapath capabilities. It also changes defaults and compatibility requirements, removes deprecated interfaces, migrates BGP APIs, and updates security-related dependencies.
Action needed (15)
securityThe github. dependency, updated
The github. module is updated to v1.7.29.
securityThe github. dependency, updated
The github. module is updated to v2.4.0.
securityThe github. dependency, updated
The github. module is updated to v28.3.3+incompatible.
securityThe golang. dependency, updated
The golang. module is updated to v0.45.0.
securityThe helm. dependency, updated to v3.18.4
The helm. module is updated to v3.18.4.
securityThe helm. dependency, updated to v3.18.5
The helm. module is updated to v3.18.5.
breakingThe plpmtud default, set to blackhole
The default plpmtud mode is now blackhole (blackhole-detected).
breakingThe AddressScopeMax default, set to 254
The default AddressScopeMax is changed to 254, the host scope, for GKE metadata server and HCP use cases. The related setting is --local-max-addr-scope.
breakingThe tls authMode default, set to migration
tls authMode is set to migration by default.
breakingThe CNI deletion timeout, reduced to 1.5 seconds
The CNI deletion timeout is reduced to 1.5 seconds.
breakingThe policy-default-local-cluster default
policy-default-local-cluster is now set by default.
breakingHost firewall bypass, disabled by default
Host firewall bypass is disabled by default.
breakingFQDN match pattern sanitization
FQDN match pattern sanitization is refactored and tightened.
breakingEncrypted traffic forwarding via cilium_host, removed
Forwarding encrypted traffic via cilium_host has been removed.
breakingCNI configuration in the container image, removed
The CNI configuration is no longer installed in the container image.
Check if affected (30)
breakingLocal-cluster default for network policy selectors
Applies if you do not set cluster in network policy selectors.
Network policy selectors without an explicit cluster now allow communication only with the local cluster by default.
breakingThe CiliumBGPPeeringPolicy v1 API, removed
Applies if you use CiliumBGPPeeringPolicy.
Support for the older CiliumBGPPeeringPolicy v1 API is removed. BGP configuration uses the cilium. APIs instead.
breakingMutual Authentication, disabled by default
Applies if you enable Mutual Authentication.
The out-of-band Mutual Authentication feature is disabled by default pending community feedback.
Plan ahead (7)
deprecated--enable-ipsec-encrypted-overlay, deprecatedremoval date not announced
Applies if you use --enable-ipsec-encrypted-overlay.
The special IPsec mode for enabling encrypted overlay with Multicast, configured by --enable-ipsec-encrypted-overlay, is deprecated and will be removed in a future release.
deprecatedKafka match fields and ToRequires and FromRequires, deprecated
Applies if you use ToRequires or FromRequires.
Kafka protocol match fields (beta), along with the ToRequires and FromRequires policy fields, are deprecated.
deprecatedTLS certificate and key Helm values, deprecated
Applies if you pass TLS certificates or keys in Helm values.
Passing TLS certificates and keys in Helm values is deprecated.
