Cilium

v1.18.7Networking & Messaging

2026年2月13日

v1.18.7では、運用時に関わる既定値と設定の変更に加え、複数の不具合修正や依存関係・イメージの更新が行われています。セキュリティアドバイザリやセキュリティ専用の修正は公表されていません。

影響確認 (1)

breakingセキュリティラベルからの topology.kubernetes.io ラベル除外
ワークロードがセキュリティラベルに topology.kubernetes.io ラベルを含めることに依存している場合に適用されます。
既定では、topology.kubernetes.io ラベルをセキュリティラベルから除外します。

その他の記録済み変更 27 件すべてvalue changes 15 · fixes 11 · additions 1

chore(deps): update all-dependencies (v1.18)
chore(deps): update base-images (v1.18)×3
chore(deps): update docker.io/library/alpine docker tag to v3.22.3 (v1.18)
chore(deps): update docker.io/library/busybox:… docker digest to … (…)×2
chore(deps): update docker.io/library/ubuntu:24.04 docker digest to cd1dba6 (v1.18)
chore(deps): update gcr.io/distroless/static:nonroot docker digest to f9f84bd (v1.18)
chore(deps): update quay.io/cilium/certgen docker tag to v0.3.2 (v1.18)
chore(deps): update quay.io/cilium/cilium-envoy docker tag to … (…)×4
install: Update image digests for v1.18.6

Add permissions to the cilium-operator so that it can create EndpointSlices when the admission plugin OwnerReferencesPermissionEnforcement is activated
bpf: Correct refinement of inner packet L4 checksum detection
bpf: Fix marker to skip nodeport when punting to proxy
clustermesh: correctly phase out not ready/not service endpoints from global services
Fix a bug with local redirect service entries being created when backend pods weren't ready.
Fix ICMP error packet handling by adding the missing checksum recalculation performed during RevNAT for SNATed load-balanced traffic.
Grant permissions to the cilium-operator so that it can reconcile ingresses when the when the admission plugin OwnerReferencesPermissionEnforcement is activated
helm: Fixed RBAC errors with operator.enabled=false by aligning cilium-tlsinterception-secrets Role/RoleBinding conditionals
loadbalancer: Fix GetInstancesOfService to avoid removing an endpoint from Service A causes all requests to Service B to fail if the name of Service A is the prefix of Service B
Reduces rtnl_mutex contention on SR-IOV nodes by not requesting VF information in netlink RTM_GETLINK operations
multicast: fix nil assignment to node configuration cell.Out map

hubble-relay: Add hubble.relay.logOptions.format and hubble.relay.logOptions.level Helm values to configure log format (text, text-ts, json, json-ts) and level (debug, info, warn, error)

Ciliumをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。今回の破壊的変更も、その一例です。