RATATOSKRATATOSK
로그인

Cilium

v1.20.1Networking & Messaging
2026년 8월 18일

CHECK 1OTHER 51

운영자 관점의 버그 수정과 동작 보정이 다수 포함되어 있으며, 의존성과 이미지 업데이트도 반영되었습니다. 디코더 메모리 상한이 새로 적용되었고, 별도의 보안 권고 식별자는 제시되지 않았지만 `CIDR` 정책 우회 문제는 보안 수정에 해당합니다.

영향 확인 (1)

  • security에이전트 재시작 뒤 endpoint의 CIDR 정책 우회 수정

    endpoint 기능을 사용하며 에이전트를 재시작한 뒤에 적용됩니다.

    에이전트 재시작 뒤 endpoint에서 조용히 발생하던 CIDR 정책 우회와 트래픽 드롭을 수정했습니다.

그 외 기록된 변경 51건 전체fixes 29 · value changes 21 · constraints 1

fixes (29)

  • * azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47449, @jaredledvina)
  • * bpf: dsr: don't look for TCP header on fragmented packets (Backport PR cilium/cilium#47881, Upstream PR cilium/cilium#47640, @julianwiedmann)
  • * bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR cilium/cilium#47621, Upstream PR cilium/cilium#47343, @smagnani96)
  • * clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47824, @MrFreezeex)
  • * datapath: turn ARP off on the base devices before bringing them up (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47838, @aanm)
  • * endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47625, @christarazi)
  • * envoy.httpUpstreamLingerTimeout accepts 0 as a chart value and templates into configmap. (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47741, @jdw6359)
  • * envoy: restore http-idle-timeout as the route idle timeout source (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47583, @aanm)
  • * Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47765, @julianwiedmann)
  • * Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR cilium/cilium#47967, Upstream PR cilium/cilium#47802, @bimmlerd)
  • * Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47727, @aanm)
  • * Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47295, @aanm)
  • * Fix abnormal ip allocation caused by hostnetwork pod (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47552, @haozhangami)
  • * Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR cilium/cilium#47881, Upstream PR cilium/cilium#47593, @julianwiedmann)
  • * fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47754, @weizhoublue)
  • * Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with NotAllowedByListeners when the TCP listener had an explicit AllowedRoutes.Kinds restriction. (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#46842, @pidreher)
  • * gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR cilium/cilium#47954, Upstream PR cilium/cilium#47840, @mhofstetter)
  • * gateway-api: mark unresolved backend service ports in route status (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47766, @mhofstetter)
  • * gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#46696, @thorn3r)
  • * gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47457, @asauber)
  • * gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47702, @mhofstetter)
  • * gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47627, @mhofstetter)
  • * ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47208, @iwanhae)
  • * l2announcer: re-evaluate services on frontend changes (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47579, @mhofstetter)
  • * Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR cilium/cilium#47954, Upstream PR cilium/cilium#47826, @mehrdadbn9)
  • * Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47844, @bimmlerd)
  • * standalone-dns-proxy: return an error when no endpoint is found (Backport PR cilium/cilium#47954, Upstream PR cilium/cilium#47791, @vipul-21)
  • * wireguard: Unsubscribe node handler on shutdown (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47614, @HadrienPatte)
  • * Gateway API: the Gateway address status no longer reports a bogus "<nil>" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47466, @locker95)

value changes (21)

  • * envoy: demote stale ADS endpoint warning (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47148, @nezdolik)
  • * Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR cilium/cilium#47881, Upstream PR cilium/cilium#47529, @julianwiedmann)
  • * operator: Emit startup logs in the configured log format (Backport PR cilium/cilium#47954, Upstream PR cilium/cilium#47890, @HadrienPatte)
  • * chore(deps): update all-dependencies (v1.20) (cilium/cilium#47678, @cilium-renovate[bot])
  • * chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) (cilium/cilium#47988, @cilium-renovate[bot])
  • * chore(deps): update docker.io/library/golang:1.26.5 docker digest to 705e964 (v1.20) (cilium/cilium#47949, @cilium-renovate[bot])
  • * chore(deps): update docker.io/library/golang:1.26.5 docker digest to 7caba52 (v1.20) (cilium/cilium#47864, @cilium-renovate[bot])
  • * chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) (cilium/cilium#47899, @cilium-renovate[bot])
  • * chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) (cilium/cilium#47989, @cilium-renovate[bot])
  • * chore(deps): update stable lvh-images (v1.20) (patch) (cilium/cilium#47865, @cilium-renovate[bot])
  • * chore(deps): update stable lvh-images (v1.20) (patch) (cilium/cilium#47990, @cilium-renovate[bot])
  • * gateway-api: remove unnecessary TLSRoute support checks (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47758, @mhofstetter)
  • * gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47599, @mhofstetter)
  • * gateway-api: return route check errors directly (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47607, @mhofstetter)
  • * gateway-api: unify Gateway API listener parentRef matching (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#46670, @arybolovlev)
  • * gateway-api: validate gRPCRoute header modifiers in status (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47606, @mhofstetter)
  • * Update docker.io/library/busybox:1.38.0 Docker digest to dc2d74b (v1.20) (cilium/cilium#47655, @cilium-renovate[bot])
  • * Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) (cilium/cilium#47657, @cilium-renovate[bot])
  • * Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) (cilium/cilium#47659, @cilium-renovate[bot])
  • * Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) (cilium/cilium#47658, @cilium-renovate[bot])
  • * install: Update image digests for v1.20.0 (cilium/cilium#47584, @cilium-release-bot[bot])

constraints (1)

  • * clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR cilium/cilium#47962, Upstream PR cilium/cilium#47932, @giorio94)
Cilium 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 보안 패치 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗Cilium 릴리스 전체 →