Istio
1.31.1Networking & Messagingセキュリティ上の問題と正確性に関する不具合を修正したメンテナンスリリースです。パフォーマンスの改善と Kiali の更新も含まれています。
影響確認 (5)
security
BackendTLSPolicyの未解決 CA 参照時の平文フォールバック修正BackendTLSPolicyを使用している場合に適用されます。CA参照を解決できない場合に、サイドカープロキシの
BackendTLSPolicyが平文通信へフォールバックする問題を修正しました。security
istioctl analyzeの kubeconfig サニタイズistioctl analyzeを使用している場合に適用されます。istioctl analyzeが istio-system のマルチクラスタシークレットからKubernetesクライアントを作成する際、未サニタイズの kubeconfig を使用していた問題を修正しました。細工したシークレットによる exec 認証プラグインの実行や、その他の安全でない認証フィールドを介したローカルファイルの読み取りを防ぐため、istiod と同じ方法で kubeconfig をサニタイズします。securityカナリア waypoint の namespace 分離適用
istio.とio/use-waypoint-canary serviceEntryVisibilityを使用している場合に適用されます。istio.ラベルがio/use-waypoint-canary serviceEntryVisibilityの NAMESPACE 分離を回避し、NAMESPACE 可視の ServiceEntry が別の namespace の waypoint を経由してカナリアトラフィックを転送できる問題を修正しました。カナリア用 waypoint にもプライマリと同じ namespace 間アクセス拒否を適用します。security
jwksUri取得時の SSRF 対策jwksUriを使用している場合に適用されます。istiod の
jwksUri取得にあった SSRF の隙間を修正しました。デフォルトでダイヤル時にリンクローカルアドレスと既知のクラウドメタデータアドレスをブロックし、取得した応答が有効な JWKS でない場合も拒否します。プライベートアドレスとループバックアドレスは引き続き到達可能で、BLOCKED_CIDRS_IN_JWKS_URISでブロックできます。security
sidecar.アノテーションのテンプレート出力エスケープistio. io/* sidecar.アノテーションを使用している場合に適用されます。istio. io/* sidecar.のistio. io/* proxyImage、bootstrapOverride、logLevel、componentLogLevel、agentLogLevelアノテーションが、出力エスケープなしでサイドカーまたはゲートウェイの注入テンプレートへ展開される問題を修正しました。細工したアノテーション値による生成済み Pod または Deployment 仕様へのフィールド注入を防ぐため、すべてのテンプレート出力箇所で一貫してエスケープします。
その他の記録済み変更 22 件すべてfixes 20 · value changes 2
fixes (20)
- - Fixed an issue in ambient mode where the CNI node agent auto-detected iptables backend ( legacy vs nft ) could flip between agent restarts, causing duplicate redirect rules to be written into already-enrolled pods. ( Issue #61020 )
- - Fixed the ability to clear the Certificate Revocation List (CRL) by either specifying an empty string as the ca-crl.pem or removing it. ( Issue #61073 )
- - Fixed the JWKS resolver forcing all public-key fetches to HTTP/1.1. The custom TLSClientConfig and DialContext used for TLS pinning and CIDR blocking caused Go’s net/http to disable automatic HTTP/2, so ALPN never negotiated h2. HTTP/2 is now re-enabled (matching http.DefaultTransport ), fixing JWKS fetches that fail over HTTP/1.1 through some HTTP CONNECT proxies. ( Issue #61250 )
- - Fixed an issue where istiod CPU usage increased as the number of AuthorizationPolicies increased. ( Issue #61254 )
- - Fixed ALLOW_ANY_DYNAMIC_DNS traffic failing in IPv6-only clusters because Envoy used the IPv4 loopback address to reach the DNS proxy. ( Issue #61330 )
- - Fixed an issue where istiod repeatedly serialized the same workload when pushing workload metadata to Envoy proxies. ( Issue #61502 )
- - Fixed an issue where Envoy proxies subscribed to Workload metadata discovery (MDS) did not receive incremental workload updates for Address-only changes when AMBIENT_SCOPED_ADDRESS_PUSHES was enabled (the default).
- - Fixed an issue where an agentgateway waypoint that a service referenced only as its canary, via the istio.io/use-waypoint-canary label, was not programmed with the routes and policies attached to that service. Connections shifted to the canary waypoint were rejected, because the waypoint had no configuration for the service it was fronting. ( Issue #61036 )
- - Fixed a memory leak affecting Istiod ambient multi-cluster mode where rotating a remote cluster’s credentials leaked that cluster’s entire cached state. ( Issue #60033 )
- - Fixed the default chart’s ValidatingWebhookConfiguration still hardcoding failurePolicy: Ignore , which caused the same field manager conflict on helm upgrade with server-side apply that was previously fixed for the base and istiod charts. ( Issue #61613 )
- - Fixed an issue where istiod permanently retained a copy of every workload resource name for each envoy MDS (WDS, used for telemetry metadata lookups) connection that sent initial_resource_versions .
- - Fixed the sidecar.istio.io/statsFlushInterval annotation producing an invalid Envoy bootstrap for values of one minute or more, and for sub-second values, which prevented the proxy from starting.
- - Fixed the sidecar.istio.io/statsEvictionInterval annotation silently truncating sub-second precision.
- - Fixed a Gateway API issue where a cross-namespace TLS certificateRef or caCertificateRef was resolved before the ReferenceGrant authorization check, so a listener’s ResolvedRefs status could distinguish whether the referenced Secret or ConfigMap existed even when no grant permitted the reference. Authorization now runs first, returning RefNotPermitted for any ungranted cross-namespace reference. Credit : This issue was reported by Darryl Jaskolski.
- - Fixed a memory leak in ambient multi-cluster mode where collections were registered with the krt debugger but never unregistered when a remote cluster was removed or its configuration changed, causing debugger registrations to accumulate over time. ( Issue #60033 )
- - Fixed listener conflict tracking treating a Gateway and a ListenerSet with the same namespace and name as the same object, which caused a conflict recorded for one to mark the other’s winning listener as Conflicted and stop it from being programmed.
- - Fixed ServiceEntries with a present but empty workload selector incorrectly matching all workloads in their namespace.
- - Fixed a pod in a remote cluster, selected by a ServiceEntry may not have been recomputed when it became an endpoint of that service. The recompute was addressed to the cluster istiod runs in rather than the cluster the pod belongs to.
- - Fixed a WorkloadEntry selected by a Service not having its corresponding proxy recomputed when it became an endpoint of that service.
- - Fixed observedGeneration getting stuck on a stale value when a resource is modified again while an earlier status write is still queued.
value changes (2)
- - Improved performance when fetching PeerAuthentications for a given workload.
- - Updated Kiali addon to version v2.31.0.
対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチも、その一例です。