RATATOSKRATATOSK
ログイン

Cilium

v1.20.3Networking & Messaging
2026年10月15日

CHECK 1OTHER 56

保守性を重視したリリースで、正確性や互換性の修正、依存関係の更新が含まれます。ネットワークと Gateway API の動作も改善されていますが、オペレーター側で大きな移行を必要とする変更はありません。

影響確認 (1)

  • breakingCiliumLocalRedirectPolicy の redirectBackend.toPorts を拒否

    CiliumLocalRedirectPolicy に redirectBackend.toPorts を設定している場合に適用されます。

    redirectBackend.toPorts を設定した CiliumLocalRedirectPolicy は、エージェントが受け付けなくなりました。

その他の記録済み変更 56 件すべてfixes 28 · value changes 25 · constraints 2 · additions 1

fixes (28)

  • Fix conntrack garbage collection deleting CT entries that the datapath reopened between the GC batch read and the delete, which could cascade into NAT mapping deletion and SNAT source-port reallocation for live connections.
  • Fixed an issue where an interface with an empty MAC field would be reported back the the cilium agent causing it to crash on startup when trying to configure the routes.
  • use 576 byte of inner packet to avoid partial csum floor
  • Print port numbers correctly for map cilium_lb*_reverse_sk
  • fix a bug where L7 DNS policies could remain loaded in the datapath during agent shutdown, causing pods under a wildcard toFQDNs policy to lose DNS resolution for the duration of the restart.
  • skip cleanup for reserved internal endpoints
  • handle listener additional address changes
  • handle listener address changes in ADS
  • track coalesced ADS snapshot updates
  • Fix Gateway API ExternalAuth dropping request bodies when allowedResponseHeaders is unset
  • Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint
  • Fix ip6tables chain rename errors being silently ignored during iptables rule reconciliation.
  • Fix PMTU/ICMP replies for IPIP/Geneve DSR for GRO skbs
  • Fix rare data race in selector cache that could lead to agent panic
  • Fix restoration of terminating backends.
  • Fixes a bug where Hubble flows may list the incorrect policy that allowed or denied a flow
  • the helm value hubble.tls.auto.privateKey settings are no longer ignored in Hubble cert-manager certificates
  • Fixes an issue where CiliumCIDRGroups with zero-length cidrs (i.e. 0.0.0.0/0) inadvertently selected no traffic.
  • filter CEC controls from infrastructure metadata
  • make HTTP route ordering deterministic
  • Release the health IPv4 when the IPv6 allocation fails
  • fix leaked event finalizer on unobserved delete
  • Do not emit warning when deleting already deleted unmanaged pod
  • fix metrics list default address to work on IPv6-only clusters with dual stack nodes by trying both IPv4 and IPv6 loopback addresses
  • Set ipv6 routing rules when dual stack is enabled
  • Sockets are no longer destroyed when a Service backend is terminated unless they are still connected to that backend.
  • node_neighbor_discovery: fix ID in delete query
  • routing: fix dual-stack ENI router startup with native routing CIDRs

value changes (25)

  • prevent CNPs with nodeSelector from silently enforcing nothing
  • chore(deps): update all-dependencies (v1.20)×3
  • chore(deps): update base-images to v1.26.9 (v1.20)
  • chore(deps): update dependency cilium/cilium-cli to v0.20.1 (v1.20)
  • chore(deps): update dependency cilium/little-vm-helper to v0.0.31 (v1.20)
  • chore(deps): update dependency protocolbuffers/protobuf to v36.2 (v1.20)
  • chore(deps): update docker.io/library/busybox:1.38.0 docker digest to fd7dc98 (v1.20)
  • chore(deps): update docker.io/library/golang:… docker digest to … (…)×3
  • chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.7.2 (v1.20)
  • chore(deps): update quay.io/cilium/cilium-envoy docker tag to … (…)×5
  • chore(deps): update security updates to v1.45.0 [security] (v1.20)
  • ciliumendpointslice: Report no CID when the CEP has none
  • fix(deps): update k8s.io patch updates stable to v0.36.5 (v1.20)
  • fix(deps): update module golang.org/x/net to v0.60.0 [security] (v1.20)
  • fix(deps): update security updates [security] (v1.20)
  • deps: update gateway api to v1.6.3
  • install: Update image digests for v1.20.2

constraints (2)

  • support IMDSv2 (token-based) instance metadata access
  • Support system CA certificates in BackendTLSPolicy.

additions (1)

  • add support for SetFrontendSourceRangesFunc
Ciliumをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回の破壊的変更も、その一例です。

スタックに追加 →
公式リリースノート ↗Ciliumのリリース一覧 →