Istio
1.31.1Networking & Messaging보안 취약점과 정확성 문제를 수정한 유지보수 릴리스이며, 성능 개선과 Kiali 업데이트도 포함합니다. 운영 환경에서 관련 기능을 사용하는 경우 보안 동작과 설정 처리를 확인할 수 있습니다.
영향 확인 (5)
security
BackendTLSPolicy의 평문 연결 허용 수정BackendTLSPolicy를 사용하는 경우 적용됩니다.CA 참조를 확인하지 못하면 사이드카 프록시에서 평문 연결이 허용되던
BackendTLSPolicy동작을 수정했습니다. GHSA-qm8v-g4f9-qhjx에 해당하는 문제입니다.security
istioctl analyze의 멀티클러스터 시크릿 처리 보완istioctl analyze를 사용하는 경우 적용됩니다.istio-system멀티클러스터 시크릿에서 검증 없이kubeconfig를 만들어 Kubernetes 클라이언트를 생성하던istioctl analyze동작을 수정했습니다. 이제istiod와 같은 방식으로kubeconfig를 정제하므로, 조작된 시크릿이exec인증 플러그인을 실행하거나 로컬 파일을 읽는 문제가 차단됩니다.security카나리 웨이포인트의 네임스페이스 격리 적용
istio.와io/use-waypoint-canary serviceEntryVisibility를 함께 사용하는 경우 적용됩니다.istio.레이블이io/use-waypoint-canary serviceEntryVisibility의NAMESPACE격리를 우회하던 문제를 수정했습니다. 이제 카나리 웨이포인트에도 기본 웨이포인트와 같은 네임스페이스 간 접근 거부가 적용됩니다.security
jwksUri조회의 SSRF 차단 보완jwksUri를 사용하는 경우 적용됩니다.istiod의RequestAuthenticationjwksUri조회에서 발생하던 SSRF 허점을 수정했습니다. 이제 연결 단계에서 링크 로컬 주소와169.같은 클라우드 메타데이터 주소를 기본 차단하고, 유효한254. 169. 254 JWKS가 아닌 응답도 거부합니다. 사설 주소와 루프백 주소는 계속 접근할 수 있으며,BLOCKED_CIDRS_IN_JWKS_URIS로 차단 범위를 설정할 수 있습니다.security
sidecar.애너테이션 출력 이스케이프 적용istio. io/* sidecar.애너테이션을 사용하는 경우 적용됩니다.istio. io/* sidecar.애너테이션의istio. io/* proxyImage,bootstrapOverride,logLevel,componentLogLevel,agentLogLevel값이 사이드카와 게이트웨이 주입 템플릿에 출력 이스케이프 없이 삽입되던 문제를 수정했습니다. 이제 모든 템플릿 삽입 지점에서 값을 일관되게 이스케이프하므로, 조작된 값으로 생성되는 파드나 배포 사양에 필드를 추가하는 문제가 차단됩니다.
그 외 기록된 변경 22건 전체fixes 20 · value changes 2
fixes (20)
- - Fixed an issue in ambient mode where the CNI node agent auto-detected iptables backend ( legacy vs nft ) could flip between agent restarts, causing duplicate redirect rules to be written into already-enrolled pods. ( Issue #61020 )
- - Fixed the ability to clear the Certificate Revocation List (CRL) by either specifying an empty string as the ca-crl.pem or removing it. ( Issue #61073 )
- - Fixed the JWKS resolver forcing all public-key fetches to HTTP/1.1. The custom TLSClientConfig and DialContext used for TLS pinning and CIDR blocking caused Go’s net/http to disable automatic HTTP/2, so ALPN never negotiated h2. HTTP/2 is now re-enabled (matching http.DefaultTransport ), fixing JWKS fetches that fail over HTTP/1.1 through some HTTP CONNECT proxies. ( Issue #61250 )
- - Fixed an issue where istiod CPU usage increased as the number of AuthorizationPolicies increased. ( Issue #61254 )
- - Fixed ALLOW_ANY_DYNAMIC_DNS traffic failing in IPv6-only clusters because Envoy used the IPv4 loopback address to reach the DNS proxy. ( Issue #61330 )
- - Fixed an issue where istiod repeatedly serialized the same workload when pushing workload metadata to Envoy proxies. ( Issue #61502 )
- - Fixed an issue where Envoy proxies subscribed to Workload metadata discovery (MDS) did not receive incremental workload updates for Address-only changes when AMBIENT_SCOPED_ADDRESS_PUSHES was enabled (the default).
- - Fixed an issue where an agentgateway waypoint that a service referenced only as its canary, via the istio.io/use-waypoint-canary label, was not programmed with the routes and policies attached to that service. Connections shifted to the canary waypoint were rejected, because the waypoint had no configuration for the service it was fronting. ( Issue #61036 )
- - Fixed a memory leak affecting Istiod ambient multi-cluster mode where rotating a remote cluster’s credentials leaked that cluster’s entire cached state. ( Issue #60033 )
- - Fixed the default chart’s ValidatingWebhookConfiguration still hardcoding failurePolicy: Ignore , which caused the same field manager conflict on helm upgrade with server-side apply that was previously fixed for the base and istiod charts. ( Issue #61613 )
- - Fixed an issue where istiod permanently retained a copy of every workload resource name for each envoy MDS (WDS, used for telemetry metadata lookups) connection that sent initial_resource_versions .
- - Fixed the sidecar.istio.io/statsFlushInterval annotation producing an invalid Envoy bootstrap for values of one minute or more, and for sub-second values, which prevented the proxy from starting.
- - Fixed the sidecar.istio.io/statsEvictionInterval annotation silently truncating sub-second precision.
- - Fixed a Gateway API issue where a cross-namespace TLS certificateRef or caCertificateRef was resolved before the ReferenceGrant authorization check, so a listener’s ResolvedRefs status could distinguish whether the referenced Secret or ConfigMap existed even when no grant permitted the reference. Authorization now runs first, returning RefNotPermitted for any ungranted cross-namespace reference. Credit : This issue was reported by Darryl Jaskolski.
- - Fixed a memory leak in ambient multi-cluster mode where collections were registered with the krt debugger but never unregistered when a remote cluster was removed or its configuration changed, causing debugger registrations to accumulate over time. ( Issue #60033 )
- - Fixed listener conflict tracking treating a Gateway and a ListenerSet with the same namespace and name as the same object, which caused a conflict recorded for one to mark the other’s winning listener as Conflicted and stop it from being programmed.
- - Fixed ServiceEntries with a present but empty workload selector incorrectly matching all workloads in their namespace.
- - Fixed a pod in a remote cluster, selected by a ServiceEntry may not have been recomputed when it became an endpoint of that service. The recompute was addressed to the cluster istiod runs in rather than the cluster the pod belongs to.
- - Fixed a WorkloadEntry selected by a Service not having its corresponding proxy recomputed when it became an endpoint of that service.
- - Fixed observedGeneration getting stuck on a stale value when a resource is modified again while an earlier status write is still queued.
value changes (2)
- - Improved performance when fetching PeerAuthentications for a given workload.
- - Updated Kiali addon to version v2.31.0.
조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 보안 패치 같은 것들입니다.