Skip to content

1.12.0
Compare
Choose a tag to compare
@aanm aanm released this 20 Jul 14:57
v1.12.0
This tag was signed with the committer’s verified signature.
aanm André Martins
GPG key ID: A38D2FBA880D16AB
Learn about vigilant mode.
9447cd1

The Cilium core team are excited to announce the Cilium 1.12 release. 🎉

✨ Release Highlights

  • New Integrated Ingress Controller
  • Cilium Service Mesh (Multi control plane, sidecar/sidecar-free, Envoy CRD)
  • Multi-Cluster Service Affinity, Connecting clusters with Helm, Lightweight cluster support
  • Stable Egress Gateway, NAT46 for Services, Quarantine service backends
  • Dynamic Allocation of PodCIDRs, AWS ENI prefix delegation, IPv6 for BGP, BBR
  • Automatic Helm Values, AKS BYOCNI, Improved Chaining, Hubble CLI Improvements

Summary of Changes

Major Changes:

  • Add cilium ingress controller implementation (#18867, @sayboras)
  • Add integration for external VXLAN Tunnel Endpoint devices (#17370, @vincentmli)
  • Add support for CiliumEnvoyConfig CRD. (#18894, @michi-covalent)
  • Add support for enabling BBR congestion control for Pods, and move bandwidth manager out of beta. (#19287, @borkmann)
  • Add support for Kubernetes v1.24.0 (#19545, @aanm)
  • Adding support for AWS ENI prefix delegation - IPv4 Only (#18463, @hemanthmalla)
  • Cilium: initial NAT46/64 implementation (#18779, @borkmann)
  • Delegated IPAM plugin (#19219, @wedaly)
  • Enables ICMP network policy function by default (#20174, @chez-shanpu)
  • Implementation of a GoBGP backed BGP control plane. (#18860, @ldelossa)
  • Promote egress gateway to stable (#19320, @jibi)
  • Support dynamic allocation of pod CIDRs in cluster pool v2 IPAM mode (#18887, @gandro)
  • Support setting service backend states such as quarantine, maintenance so that these backends are not selected for load-balancing service traffic. (#18814, @aditighag)

Minor Changes:

  • add an option to wait for kube-proxy (Backport PR #20563, Upstream PR #20517, @michi-covalent)
  • Add emptyDir volume for frontend container of hubble-ui (#20027, @mkilchhofer)
  • Add metric on number of requests rejected by DNS Proxy semaphore (Backport PR #20534, Upstream PR #20491, @rahulkjoshi)
  • Add Prometheus gRPC metrics for hubble and hubble-relay (Backport PR #20519, Upstream PR #20376, @chancez)
  • Add source filter for the cilium fqdn cache list command (#19980, @ungureanuvladvictor)
  • Add support for aws-cni chaining in IPv6 EKS clusters (#18522, @mKeRix)
  • Add support for disabling ENI PD at node level (Backport PR #20401, Upstream PR #20308, @hemanthmalla)
  • Add support for getting earliest events from Observer API (#19819, @chancez)
  • Add support for L7 policies with VTEP integration (#19473, @vincentmli)
  • Add support to opt-in for using ENI's primary IP for allocations (#20050, @hemanthmalla)
  • Add unreachable route for pod IP on deletion (#18505, @lbernail)
  • Align values.yaml with templates (#17243, @dungdm93)
  • Allow unloading DNS policy rules on graceful shutdown (#18701, @tklauser)
  • api,cli: add identity range in status response & cli output (#18152, @ArthurChiao)
  • api: Add cni chaining status in status API. (#18345, @sayboras)
  • AWS EC2 Instance tag filter (#19181, @prune998)
  • aws: Add ability to mark ENIs as unmanaged (#19096, @gandro)
  • bgp: Check the Condition.Ready field when adding ready endpoints (#20176, @ysksuzuki)
  • bpf, Hubble: Add is_reply information (when available) at the TO_OVERLAY observability point (#19185, @qmonnet)
  • CA certificates in Envoy TLS validation contexts are supported via k8s Secrets with 'ca.crt' key. (Backport PR #20534, Upstream PR #20458, @jrajahalme)
  • Change default prometheus ports to new reserved Cilium ports (#20156, @knfoo)
  • Cilium Istio integration is updated to Istio release 1.10.6 (Backport PR #20519, Upstream PR #18384, @jrajahalme)
  • cli/metrics: Sort label in metrics list command (#18455, @sayboras)
  • clustermesh: Add support for service-affinity (#19521, @sayboras)
  • clustermesh: added new command-line options k8s-kubeconfig-path and clustermesh-health-port (#18803, @abocim)
  • daemon: add support for IPv6 native routing CIDR (#17332, @jibi)
  • daemon: Don't auto disable session affinity (Backport PR #20519, Upstream PR #16179, @brb)
  • daemon: Rename host-reachable services to socket LB (Backport PR #20534, Upstream PR #20369, @brb)
  • daemon: Split --bpf-lb-map-max into multiple options (#19326, @koncha99)
  • daemon: Support the wildcard option for directRoutingDevice (#17930, @ysksuzuki)
  • datapath: make tc filter priority configurable (#18896, @intel-dlanders)
  • datapath: Remove !CONNTRACK (#18502, @brb)
  • datapath: Remove !CONNTRACK (v2) (#18551, @brb)
  • docs: Update alibabacloud RAM permission requirements (#19077, @jaffcheng)
  • Dynamic Per Resource Timeouts (#19991, @tommyp1ckles)
  • egressgw: emit a warning rather than a fatal error when L7 proxy is enabled (#19608, @jibi)
  • Enable VTEP integration dynamic ARP resolution for Cilium-managed pod (#18758, @vincentmli)
  • Envoy upstream connections no longer use the original source address for any destination associated with a CIDR or toFQDNs policy. (#19255, @jrajahalme)
  • feat(helm): allow to set Hubble Relay and UI service type and nodePort (#19450, @raphink)
  • Fix an issue where PodDisruptionBudgets were not created by the Helm chart (#18317, @lic17)
  • helm: Add bpf-root configuration value in helms (#18335, @sayboras)
  • helm: add description for some Helm values (#19658, @my-git9)
  • helm: Create cilium IngressClass (#19524, @sayboras)
  • helm: Move tls related helm option to 1.12 in upgrade docs (#19089, @sayboras)
  • helm: Remove duplicated key hostAliases (Backport PR #20333, Upstream PR #20278, @sayboras)
  • helm: Set Linux nodeSelector for nodeinit and preflight (Backport PR #20333, Upstream PR #20216, @gandro)
  • helm: support lookup remote CA (#17434, @dungdm93)
  • helm: Upgrade certgen to the latest version v0.1.8 (#18607, @sayboras)
  • hubble: Add "flows-to-world" metric to monitor policy decisions on traffic that reaches outside the cluster. (#17790, @michi-covalent)
  • Improve policy import performance, particularly with CIDR policies (#18433, @joestringer)
  • Improve verbosity of drop notification messages. (Backport PR #20519, Upstream PR #20387, @aspsk)
  • In the case of recovering the services, cilium will not fail directly on the first service recovery error but will try to recover other services. (#18422, @chowmean)
  • ingress: Add SocketOptions configuration (#19549, @sayboras)
  • ingress: Avoid plain text TLS secret in CEC (#19410, @sayboras)
  • ingress: Fix conformance tests for host-rules and path-rule (#19321, @sayboras)
  • ingress: Set max stream duration as 0 (#19550, @sayboras)
  • install/kubernetes: Add CAP_IPC_LOCK for mmap (#19812, @sayboras)
  • install: add tolerations for the certgen cronjob (#18019, @wolffberg)
  • Introduce a new CRD (CiliumEgressGatewayPolicy) for Egress Gateway configuration. Deprecate the previous CRD (CiliumEgressNATPolicy). (#19561, @julianwiedmann)
  • k8s/crds: Allow ingress entity in CNP (Backport PR #20563, Upstream PR #20536, @sayboras)
  • Making operator aware of pending pod backlog on nodes for IP allocations (#19007, @hemanthmalla)
  • Move the BGP Control Plane to utilize CiliumNode objects. This enable support for IPAM driven PodCIDR announcements. (#19872, @ldelossa)
  • Prefers k8s node IP when picking masquerading IPs (#16849, @liuyuan10)
  • proxy: Add proxy common http options arguments to agent (#19138, @jmcshane)
  • Remove privileged mode in Cilium's DaemonSet (#14446, @aanm)
  • Rename bpf.hostRouting to bpf.hostLegacyRouting in ciliumconfig (#19064, @chenk008)
  • Runtime device detection (#17460, @joamaki)
  • Update cilium agent Grafana dashboard to filter by pod (Backport PR #20333, Upstream PR #20307, @ungureanuvladvictor)
  • Update to CNI spec version 1.0.0 (#19719, @tklauser)
  • Use direct routing device only when tunneling is disabled and BPF Host Routing or NodePort are enabled. (#18815, @YutaroHayakawa)
  • vtep: VTEP map implementation to improve VTEP integration feature (#18824, @vincentmli)

Bugfixes:

  • node-init now takes enableIPv4Masquerade into account on GKE. (Backport PR #20519, Upstream PR #19533, @bmcustodio)
  • Add/Fix traces for the packets received from the network in IPSec + native routing. (#18704, @YutaroHayakawa)
  • Additional FQDN selector identity tracking fixes (Backport PR #17988, Upstream PR #17788, @joestringer)
  • alibabacloud: Fix derived VPC CIDR block (#19056, @jaffcheng)
  • allocator: fix out-of-valid-range identities being allocated (#18151, @ArthurChiao)
  • bgpv1: Use IP address used for peering as a nexthop (#19402, @YutaroHayakawa)
  • bpf: Don't emit policy verdict post-L7 (Backport PR #20401, Upstream PR #20245, @joestringer)
  • bpf: Provision HostPort also for case of Maglev (Backport PR #20401, Upstream PR #20379, @borkmann)
  • bug: Fixed a rare CiliumIdentity race deletion. (Backport PR #20333, Upstream PR #19936, @nathanjsweet)
  • cilium: Fix node mismatch endpoint restoration bug when the CiliumEndPoint CRD is disabled. (#19040, @zhanghe9702)
  • contrib: Fix passing ipFamily to kind.sh (#19707, @brb)
  • daemon, option: Fix vlan bpf bypass ids loading (Backport PR #20401, Upstream PR #20282, @pippolo84)
  • daemon: Fix issue where stale router IPs were not cleaned up (Backport PR #20519, Upstream PR #20389, @gandro)
  • datapath: Fix IPv6 DSR (#18713, @brb)
  • datapath: Fix missing monitor events for NodePort BPF traffic when monitor-aggregation set to > none (#18454, @brb)
  • endpoint: Fix packets to host dropped with the chaining mode and host firewall (#19734, @ysksuzuki)
  • Envoy version checking is now disabled whenever L7 proxy is disabled too (Backport PR #20519, Upstream PR #20440, @bmcustodio)
  • Fix a bug where agent would log warnings such as "JoinEP: Failed to load program" in legitimate cases where endpoints are getting deleted. (#18216, @aditighag)
  • Fix agent crash when IPv6 is partially disabled in the host kernel. (#18716, @pchaigno)
  • Fix blackhole route error when cleanup (#20042, @soulseen)
  • Fix config map options validation (Backport PR #20401, Upstream PR #20304, @pippolo84)
  • Fix drop of large packets redirected through an egress gateway node when running in native routing mode. (Backport PR #20401, Upstream PR #20269, @pchaigno)
  • Fix error propagation in bpf_lxc (#20144, @DolceTriade)
  • fix identity gc to return correct max/min id (Backport PR #20401, Upstream PR #20361, @dkhachyan)
  • Fix mtu setting for tunnel interface in init.sh (Backport PR #20563, Upstream PR #20552, @ChengyuanLiCY)
  • Fix the bugs when empty CiliumEndpointSlices were created and leaked. (Backport PR #20519, Upstream PR #20251, @alan-kut)
  • Fixed PodCIDR announcement being overwritten by SVC announcement (Backport PR #20519, Upstream PR #20413, @dylandreimerink)
  • Fixed removal of stale bpf_netdev tc filters for interfaces with a dot in the name (#18344, @stek29)
  • Fixes a bug in the BGP control plane which causes the wrong BGP virtual servers to be selected for reconciliation or removal (#19659, @ldelossa)
  • helm: Fix cluster-id arguments in clustermesh deployment (Backport PR #20333, Upstream PR #20312, @sayboras)
  • helm: Fix Hubble Service when ServiceMonitor is being used (#19220, @juissi-t)
  • helm: Fix invalid type for Certificate spec.ipAddresses (#19211, @superbrothers)
  • helm: Relax hubble ui image versions validation (#20039, @sayboras)
  • hubble/parser/threefour: check (*Parser).linkGetter before accessing it (Backport PR #20519, Upstream PR #20446, @tklauser)
  • ipsec: fix stale keys reclaim logic (Backport PR #20401, Upstream PR #19932, @jibi)
  • ipsec: set interface ID different from 0 (#18789, @tormath1)
  • makefile: fix unstripped docker images build (#18339, @zhanghe9702)
  • nodediscovery: make LocalNode return a deep copy of localNode (Backport PR #20401, Upstream PR #20392, @jibi)
  • Only apply XDP acceleration for IPv6 Nodeport when enabled (with --bpf-lb-acceleration=native). (#19534, @julianwiedmann)
  • pkg/k8s/version: Also set EndpointSlice when forcing version (Backport PR #20534, Upstream PR #20383, @joamaki)
  • Restore patch in ciliumnetworkpolicies/status ClusterRole (Backport PR #20401, Upstream PR #20373, @pippolo84)
  • Revert "pkg/endpoint: Pass endpoint alive context to regeneration tasks" (#18253, @aditighag)
  • Revert Prometheus client to fix 'cilium metrics list' (#19496, @ti-mo)
  • vtep: fix pod src identity in send_trace_notify (Backport PR #20534, Upstream PR #19434, @vincentmli)

CI Changes:

Misc Changes:

Other Changes:

Contributors

twpayne, ghost, and 137 other contributors
Assets 2
Loading