RATATOSKRATATOSK
로그인

Cilium

v1.20.3Networking & Messaging
2026년 10월 15일

CHECK 1OTHER 56

유지보수에 초점을 둔 릴리스로, 동작 정확성과 호환성을 다듬고 의존성을 업데이트했습니다. 네트워킹과 Gateway API 동작도 개선했으며, 운영자가 별도로 수행할 큰 마이그레이션은 없습니다.

영향 확인 (1)

  • breakingredirectBackend.toPorts 정책 검증 강화

    CiliumLocalRedirectPolicy에 redirectBackend.toPorts를 설정한 경우에 적용됩니다.

    redirectBackend.toPorts를 설정한 CiliumLocalRedirectPolicy는 이제 에이전트가 거부합니다.

그 외 기록된 변경 56건 전체fixes 28 · value changes 25 · constraints 2 · additions 1

fixes (28)

  • Fix conntrack garbage collection deleting CT entries that the datapath reopened between the GC batch read and the delete, which could cascade into NAT mapping deletion and SNAT source-port reallocation for live connections.
  • Fixed an issue where an interface with an empty MAC field would be reported back the the cilium agent causing it to crash on startup when trying to configure the routes.
  • use 576 byte of inner packet to avoid partial csum floor
  • Print port numbers correctly for map cilium_lb*_reverse_sk
  • fix a bug where L7 DNS policies could remain loaded in the datapath during agent shutdown, causing pods under a wildcard toFQDNs policy to lose DNS resolution for the duration of the restart.
  • skip cleanup for reserved internal endpoints
  • handle listener additional address changes
  • handle listener address changes in ADS
  • track coalesced ADS snapshot updates
  • Fix Gateway API ExternalAuth dropping request bodies when allowedResponseHeaders is unset
  • Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint
  • Fix ip6tables chain rename errors being silently ignored during iptables rule reconciliation.
  • Fix PMTU/ICMP replies for IPIP/Geneve DSR for GRO skbs
  • Fix rare data race in selector cache that could lead to agent panic
  • Fix restoration of terminating backends.
  • Fixes a bug where Hubble flows may list the incorrect policy that allowed or denied a flow
  • the helm value hubble.tls.auto.privateKey settings are no longer ignored in Hubble cert-manager certificates
  • Fixes an issue where CiliumCIDRGroups with zero-length cidrs (i.e. 0.0.0.0/0) inadvertently selected no traffic.
  • filter CEC controls from infrastructure metadata
  • make HTTP route ordering deterministic
  • Release the health IPv4 when the IPv6 allocation fails
  • fix leaked event finalizer on unobserved delete
  • Do not emit warning when deleting already deleted unmanaged pod
  • fix metrics list default address to work on IPv6-only clusters with dual stack nodes by trying both IPv4 and IPv6 loopback addresses
  • Set ipv6 routing rules when dual stack is enabled
  • Sockets are no longer destroyed when a Service backend is terminated unless they are still connected to that backend.
  • node_neighbor_discovery: fix ID in delete query
  • routing: fix dual-stack ENI router startup with native routing CIDRs

value changes (25)

  • prevent CNPs with nodeSelector from silently enforcing nothing
  • chore(deps): update all-dependencies (v1.20)×3
  • chore(deps): update base-images to v1.26.9 (v1.20)
  • chore(deps): update dependency cilium/cilium-cli to v0.20.1 (v1.20)
  • chore(deps): update dependency cilium/little-vm-helper to v0.0.31 (v1.20)
  • chore(deps): update dependency protocolbuffers/protobuf to v36.2 (v1.20)
  • chore(deps): update docker.io/library/busybox:1.38.0 docker digest to fd7dc98 (v1.20)
  • chore(deps): update docker.io/library/golang:… docker digest to … (…)×3
  • chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.7.2 (v1.20)
  • chore(deps): update quay.io/cilium/cilium-envoy docker tag to … (…)×5
  • chore(deps): update security updates to v1.45.0 [security] (v1.20)
  • ciliumendpointslice: Report no CID when the CEP has none
  • fix(deps): update k8s.io patch updates stable to v0.36.5 (v1.20)
  • fix(deps): update module golang.org/x/net to v0.60.0 [security] (v1.20)
  • fix(deps): update security updates [security] (v1.20)
  • deps: update gateway api to v1.6.3
  • install: Update image digests for v1.20.2

constraints (2)

  • support IMDSv2 (token-based) instance metadata access
  • Support system CA certificates in BackendTLSPolicy.

additions (1)

  • add support for SetFrontendSourceRangesFunc
Cilium 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗Cilium 릴리스 전체 →