RATATOSKRATATOSK
ログイン

Cilium

v1.20.1Networking & Messaging
2026年8月18日

CHECK 1OTHER 51

運用時の不具合や挙動を修正し、依存関係とイメージも更新されています。デコーダメモリ上限の適用も含まれ、セキュリティアドバイザリ識別子は示されていませんが、CIDRポリシーの迂回に関する修正があります。

影響確認 (1)

  • security再起動後のCIDRポリシー迂回とトラフィック停止の修正

    エージェントの再起動後にendpoint機能を使用している場合に適用されます。

    エージェントの再起動後にendpoint機能を使用すると、CIDRポリシーが迂回されてトラフィックが停止する問題を修正しました。

その他の記録済み変更 51 件すべてfixes 29 · value changes 21 · constraints 1

fixes (29)

  • * azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47449, @jaredledvina)
  • * bpf: dsr: don't look for TCP header on fragmented packets (Backport PR cilium/cilium#47881, Upstream PR cilium/cilium#47640, @julianwiedmann)
  • * bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR cilium/cilium#47621, Upstream PR cilium/cilium#47343, @smagnani96)
  • * clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47824, @MrFreezeex)
  • * datapath: turn ARP off on the base devices before bringing them up (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47838, @aanm)
  • * endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47625, @christarazi)
  • * envoy.httpUpstreamLingerTimeout accepts 0 as a chart value and templates into configmap. (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47741, @jdw6359)
  • * envoy: restore http-idle-timeout as the route idle timeout source (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47583, @aanm)
  • * Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47765, @julianwiedmann)
  • * Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR cilium/cilium#47967, Upstream PR cilium/cilium#47802, @bimmlerd)
  • * Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47727, @aanm)
  • * Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47295, @aanm)
  • * Fix abnormal ip allocation caused by hostnetwork pod (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47552, @haozhangami)
  • * Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR cilium/cilium#47881, Upstream PR cilium/cilium#47593, @julianwiedmann)
  • * fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47754, @weizhoublue)
  • * Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with NotAllowedByListeners when the TCP listener had an explicit AllowedRoutes.Kinds restriction. (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#46842, @pidreher)
  • * gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR cilium/cilium#47954, Upstream PR cilium/cilium#47840, @mhofstetter)
  • * gateway-api: mark unresolved backend service ports in route status (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47766, @mhofstetter)
  • * gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#46696, @thorn3r)
  • * gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47457, @asauber)
  • * gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47702, @mhofstetter)
  • * gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47627, @mhofstetter)
  • * ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47208, @iwanhae)
  • * l2announcer: re-evaluate services on frontend changes (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47579, @mhofstetter)
  • * Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR cilium/cilium#47954, Upstream PR cilium/cilium#47826, @mehrdadbn9)
  • * Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47844, @bimmlerd)
  • * standalone-dns-proxy: return an error when no endpoint is found (Backport PR cilium/cilium#47954, Upstream PR cilium/cilium#47791, @vipul-21)
  • * wireguard: Unsubscribe node handler on shutdown (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47614, @HadrienPatte)
  • * Gateway API: the Gateway address status no longer reports a bogus "<nil>" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47466, @locker95)

value changes (21)

  • * envoy: demote stale ADS endpoint warning (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47148, @nezdolik)
  • * Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR cilium/cilium#47881, Upstream PR cilium/cilium#47529, @julianwiedmann)
  • * operator: Emit startup logs in the configured log format (Backport PR cilium/cilium#47954, Upstream PR cilium/cilium#47890, @HadrienPatte)
  • * chore(deps): update all-dependencies (v1.20) (cilium/cilium#47678, @cilium-renovate[bot])
  • * chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) (cilium/cilium#47988, @cilium-renovate[bot])
  • * chore(deps): update docker.io/library/golang:1.26.5 docker digest to 705e964 (v1.20) (cilium/cilium#47949, @cilium-renovate[bot])
  • * chore(deps): update docker.io/library/golang:1.26.5 docker digest to 7caba52 (v1.20) (cilium/cilium#47864, @cilium-renovate[bot])
  • * chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) (cilium/cilium#47899, @cilium-renovate[bot])
  • * chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) (cilium/cilium#47989, @cilium-renovate[bot])
  • * chore(deps): update stable lvh-images (v1.20) (patch) (cilium/cilium#47865, @cilium-renovate[bot])
  • * chore(deps): update stable lvh-images (v1.20) (patch) (cilium/cilium#47990, @cilium-renovate[bot])
  • * gateway-api: remove unnecessary TLSRoute support checks (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47758, @mhofstetter)
  • * gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47599, @mhofstetter)
  • * gateway-api: return route check errors directly (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47607, @mhofstetter)
  • * gateway-api: unify Gateway API listener parentRef matching (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#46670, @arybolovlev)
  • * gateway-api: validate gRPCRoute header modifiers in status (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47606, @mhofstetter)
  • * Update docker.io/library/busybox:1.38.0 Docker digest to dc2d74b (v1.20) (cilium/cilium#47655, @cilium-renovate[bot])
  • * Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) (cilium/cilium#47657, @cilium-renovate[bot])
  • * Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) (cilium/cilium#47659, @cilium-renovate[bot])
  • * Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) (cilium/cilium#47658, @cilium-renovate[bot])
  • * install: Update image digests for v1.20.0 (cilium/cilium#47584, @cilium-release-bot[bot])

constraints (1)

  • * clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR cilium/cilium#47962, Upstream PR cilium/cilium#47932, @giorio94)
Ciliumをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチも、その一例です。

スタックに追加 →
公式リリースノート ↗Ciliumのリリース一覧 →