RATATOSKRATATOSK
로그인

Cilium

v1.20.2Networking & Messaging
2026년 9월 16일

OTHER 65

정확성 수정과 안정성 개선, 의존성 업데이트를 중심으로 한 유지보수 릴리스입니다. 설정과 통합 기능도 일부 추가되었으며, 공개된 취약점 세부 정보는 없습니다.

그 외 기록된 변경 65건 전체fixes 40 · value changes 21 · additions 3 · removals 1

fixes (40)

  • * aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#48125, @41ks)
  • * aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#48193, @41ks)
  • * bpf: Fix agent crash when dumping map events (Backport PR cilium/cilium#48378, Upstream PR cilium/cilium#48273, @joestringer)
  • * bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (Backport PR cilium/cilium#48550, Upstream PR cilium/cilium#48407, @41ks)
  • * Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#48262, @giorio94)
  • * datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR cilium/cilium#48550, Upstream PR cilium/cilium#46861, @fdomain)
  • * endpoint: preserve concurrent policy updates for new endpoints (Backport PR cilium/cilium#48213, Upstream PR cilium/cilium#48195, @jrajahalme)
  • * ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. (Backport PR cilium/cilium#48213, Upstream PR cilium/cilium#47034, @41ks)
  • * Fix a pod created immediately after a network policy change reporting a stale policy revision for up to two minutes. (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#47642, @aanm)
  • * Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association (Backport PR cilium/cilium#48024, Upstream PR cilium/cilium#47874, @bryanhorstmann)
  • * Fix BGP defaultGateway peer auto-discovery selecting a default route from a non-main routing table, such as the default via cilium_host route Cilium installs in the from-proxy table, instead of the node's real default gateway. (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#47971, @ecbaldwin)
  • * Fix bug where identities may linger for double the amount of the expected time (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#48032, @christarazi)
  • * Fix dropping traffic L2Announcement with externalTrafficPolicy: Local (Backport PR cilium/cilium#48550, Upstream PR cilium/cilium#46399, @yuito-it)
  • * Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. (Backport PR cilium/cilium#48017, Upstream PR cilium/cilium#47943, @taaahaaa)
  • * Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. (Backport PR cilium/cilium#48017, Upstream PR cilium/cilium#47929, @shreyasrajiv327)
  • * Fix Hubble Relay remains running during termination (Backport PR cilium/cilium#48550, Upstream PR cilium/cilium#47942, @xandau)
  • * Fix ICMP error packet handling by adding the missing checksum recalculation performed during NAT for SNATed load-balanced traffic. (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#48086, @julianwiedmann)
  • * Fix IPv6 Router Solicitations and Router Advertisements being dropped with "Unsupported protocol for NAT masquerade" on nodes whose BPF masquerade address is a link-local address. (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#48094, @ecbaldwin)
  • * Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#48391, @fristonio)
  • * Fix multiple regressions in Cilium LocalRedirectPolicy (Backport PR cilium/cilium#48634, Upstream PR cilium/cilium#46638, @ajmmm)
  • * Fix node-init startup on GKE 1.36.2-gke.2064000 nodes by detecting GKE from the kubelet path instead of container runtime configuration. (Backport PR cilium/cilium#48213, Upstream PR cilium/cilium#47945, @dlanov)
  • * Fix nodeport egress tuple reuse for closed connections (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#48306, @fristonio)
  • * Fix restored ENI endpoints routing rule configuration when masquerading config changes (cilium/cilium#48417, @fristonio)
  • * fix(envoyconfig): retry port allocation on duplicate-address rejections (Backport PR cilium/cilium#48735, Upstream PR cilium/cilium#48624, @kokhlo)
  • * Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR cilium/cilium#48213, Upstream PR cilium/cilium#47915, @giorio94)
  • * Fixed a cilium-agent crash (fatal error: concurrent map iteration and map write) when an endpoint's policy was recomputed while incremental policy map changes were applied concurrently. Most commonly triggered by named-port policies under pod churn. (Backport PR cilium/cilium#48735, Upstream PR cilium/cilium#48098, @nashant)
  • * Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (Backport PR cilium/cilium#48434, Upstream PR cilium/cilium#47635, @aanm)
  • * Fixes a bug where clusters originally created in v1.15 or earlier failed to upgrade due to dropping the CRD version CiliumNodeConfig v2alpha1. (Backport PR cilium/cilium#48213, Upstream PR cilium/cilium#48087, @squeed)
  • * Fragmented UDP packets were potentially mis-classified as Cilium Wireguard traffic. (Backport PR cilium/cilium#48213, Upstream PR cilium/cilium#48139, @julianwiedmann)
  • * gateway-api: fix listener programmed status update (Backport PR cilium/cilium#48213, Upstream PR cilium/cilium#48013, @mhofstetter)
  • * gateway-api: propgate listenerset status update errors (Backport PR cilium/cilium#48581, Upstream PR cilium/cilium#48130, @mhofstetter)
  • * hubble: fix four config knobs that never reach their sink (Backport PR cilium/cilium#48434, Upstream PR cilium/cilium#47637, @aanm)
  • * Improve reliability for fast recovery of disrupted TCP connections that access a DSR-enabled Service. (Backport PR cilium/cilium#48465, Upstream PR cilium/cilium#48254, @julianwiedmann)
  • * lb (fix): require active state for backend when using topology hints (Backport PR cilium/cilium#48550, Upstream PR cilium/cilium#47054, @CarrySauce)
  • * nodediscovery: Reduced EC2 IMDS load and made ENI node registration more resilient by fetching the instance metadata once instead of on every CiliumNode update. (Backport PR cilium/cilium#48603, Upstream PR cilium/cilium#48218, @41ks)
  • * operator/ipam: Restore fatal exit when the IPAM node watcher fails (Backport PR cilium/cilium#48213, Upstream PR cilium/cilium#47778, @HadrienPatte)
  • * Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR cilium/cilium#48213, Upstream PR cilium/cilium#48015, @giorio94)
  • * The BPF NAT engine now drops ICMP error packets which contain a fragmented TCP/UDP/SCTP packet. (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#48174, @julianwiedmann)
  • * When using DSR with --bpf-lb-dsr-dispatch set to "opt" or "geneve" in combination with --enable-pmtu-discovery, fix the outer source IP of the ICMP error message which is generated when a forwarded DSR request exceeds the network interface's MTU. (Backport PR cilium/cilium#48114, Upstream PR cilium/cilium#48053, @julianwiedmann)
  • * Fix (eBPF): Pointer-to-Pointer Misuse in IPv6 Trace Notifications (Backport PR cilium/cilium#48350, Upstream PR cilium/cilium#47908, @weizhoublue)

value changes (21)

  • * logging: downgrade canceled response-body reads to info (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#48202, @aanm)
  • * chore(deps): update all external docker images dependencies to v0.13.6 (v1.20) (cilium/cilium#48673, @cilium-renovate[bot])
  • * chore(deps): update all-dependencies (v1.20) (cilium/cilium#48149, @cilium-renovate[bot])
  • * chore(deps): update all-dependencies (v1.20) (cilium/cilium#48325, @cilium-renovate[bot])
  • * chore(deps): update all-dependencies (v1.20) (cilium/cilium#48619, @cilium-renovate[bot])
  • * chore(deps): update base-images (v1.20) (cilium/cilium#48327, @cilium-renovate[bot])
  • * chore(deps): update base-images (v1.20) (cilium/cilium#48672, @cilium-renovate[bot])
  • * chore(deps): update dependency bufbuild/buf to v1.73.0 (v1.20) (cilium/cilium#48729, @cilium-renovate[bot])
  • * chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.20) (cilium/cilium#48505, @cilium-renovate[bot])
  • * chore(deps): update dependency semver to v3.1.0 (v1.20) (cilium/cilium#48730, @cilium-renovate[bot])
  • * chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1787987562-ac0b61a4c0a45670a3654448d53bd6416b948f62 (v1.20) (cilium/cilium#48323, @cilium-renovate[bot])
  • * chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.20) (cilium/cilium#48451, @cilium-renovate[bot])
  • * chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.20) (cilium/cilium#48674, @cilium-renovate[bot])
  • * fix(deps): update k8s.io patch updates stable to v0.36.4 (v1.20) (cilium/cilium#48118, @cilium-renovate[bot])
  • * fix(deps): update module google.golang.org/grpc to v1.83.1 [security] (v1.20) (cilium/cilium#48388, @cilium-renovate[bot])
  • * Fixes: Update node-cache image version to 1.26.5 (Backport PR cilium/cilium#48634, Upstream PR cilium/cilium#48270, @zyue110026)
  • * gateway-api: avoid logging missing GatewayClass as error (Backport PR cilium/cilium#48581, Upstream PR cilium/cilium#48529, @mhofstetter)
  • * vendor: Bump StateDB to v0.8.4 (cilium/cilium#48248, @joamaki)
  • * [v1.20] bpf: Force-align IPv4 CT tuples used by revSNAT memcpy() (cilium/cilium#48395, @julianwiedmann)
  • * install: Update image digests for v1.20.1 (cilium/cilium#48039, @cilium-release-bot[bot])
  • chore(deps): update all external docker images dependencies (v1.20)

additions (3)

  • * gateway-api: node label selector for when hostNetwork is enabled (Backport PR cilium/cilium#48636, Upstream PR cilium/cilium#47463, @xtineskim)
  • * Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR cilium/cilium#48634, Upstream PR cilium/cilium#48421, @0xch4z)
  • * helm: add general busybox image values for substitution (Backport PR cilium/cilium#48418, Upstream PR cilium/cilium#47973, @0xch4z)

removals (1)

  • * gateway-api: remove Gateway LBIPAM annotation warning (Backport PR cilium/cilium#48581, Upstream PR cilium/cilium#48187, @mhofstetter)
Cilium 스택에 추가

조치가 필요한 변경이 나오면 주간 메일로 받아볼 수 있습니다. 이번 릴리스처럼 조치가 없는 주에는 메일을 보내지 않습니다.

스택에 추가 →
공식 릴리스 노트 ↗Cilium 릴리스 전체 →