Skip to content

chore(deps): update helm release cilium to v1.14.3

Yellowhat requested to merge renovate/cilium-1.x into main

This MR contains the following updates:

Package Update Change
cilium (source) patch 1.14.2 -> 1.14.3

⚠ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

cilium/cilium (cilium)

v1.14.3: 1.14.3

Compare Source

We are pleased to release Cilium v1.14.3. This is bug fix release addressing the recent HTTP/2 Stream Cancellation Attack (CVE-2023-44487) and other bugs:

Summary of Changes

Minor Changes:

Bugfixes:

  • bpf: lxc: support Pod->Service->Pod hairpinning with endpoint routes (Backport MR #​28123, Upstream MR #​27798, @​ti-mo)
  • bpf: overlay: fix missing DBG_DECAP for Inter-Cluster-SNAT (Backport MR #​28494, Upstream MR #​28466, @​julianwiedmann)
  • Change routing-mode and tunnel-protocol based on .Values.tunnel and .Values.routingMode (Backport MR #​28282, Upstream MR #​27841, @​macmiranda)
  • datapath: fix NodePort to remote hostns backend with tunnel config (Backport MR #​28494, Upstream MR #​27323, @​michaelasp)
  • envoy: Sync supported resources to fix not found issue (Backport MR #​28349, Upstream MR #​28272, @​sayboras)
  • Fix a bug that causes pod-to-pod traffic between nodes to be dropped when IPsec is enabled and kube-proxy installed rules in both iptables-nft and iptables-legacy. (Backport MR #​28442, Upstream MR #​28258, @​pchaigno)
  • fix bug: pull skb data in cil_from_netdev path for HIGH_SCALE_IPCACHE mode (Backport MR #​28095, Upstream MR #​27913, @​sofat1989)
  • Fix Gateway API HttpRoute cannot strip path prefix. (Backport MR #​28282, Upstream MR #​28018, @​chaunceyjiang)
  • Fix hubble metric labeling when only directed Source/Destination Ingress/Egress options are specified. (Backport MR #​28095, Upstream MR #​27792, @​marqc)
  • Fix minor bug where the previous Cilium proxy port was not reused (Backport MR #​28127, Upstream MR #​27634, @​christarazi)
  • Fix the trace notification for hairpinned reply traffic, to indicate the correct security identity for the client. (Backport MR #​28282, Upstream MR #​28133, @​julianwiedmann)
  • Fix wrong host and router IP being used for some IPv6 deployments, which was causing various connectivity problems. (Backport MR #​28435, Upstream MR #​28417, @​ti-mo)
  • Fix: Gateway API double slash while stripping path prefix (Backport MR #​28442, Upstream MR #​28294, @​nxy7)
  • Fixes a bug causing panic when counting IPsec keys number via "cilium encrypt status". (Backport MR #​28282, Upstream MR #​27996, @​jschwinger233)
  • fqdn proxy: fix data race by using separate sessionUDPFactories (Backport MR #​28282, Upstream MR #​28163, @​mhofstetter)
  • ipam/multipool: Fix bug where allocator was unable to update CiliumNode (Backport MR #​28095, Upstream MR #​27963, @​gandro)
  • ipcache: fix flapping labels in SelectorCache when reserved:host identity has multiple IPs (Backport MR #​28418, Upstream MR #​28332, @​squeed)
  • Must have port for Service reference (Backport MR #​28282, Upstream MR #​27959, @​chaunceyjiang)
  • pkg/k8s: use a deep copy of CNP in UpdateStatus to avoid race condition (Backport MR #​28494, Upstream MR #​28364, @​aanm)
  • pkg/node: Updates GetIPv6AllocCIDRs() to Properly Return Secondary CIDRs (Backport MR #​28095, Upstream MR #​27855, @​danehans)
  • resource: Fix race condition in handling of Kubernetes object delete event retrying. In the very rare case when an object was created, deleted and re-created with the same name and the handling of the first deletion failed, the handling of delete event may have been retried even though the object was re-created. Only affected features using the Resource-library (LB IPAM, Mutual Auth and ClusterMesh). (Backport MR #​28494, Upstream MR #​27340, @​joamaki)
  • Restore host-stack bypass for pod-to-pod traffic in a configuration with kube-proxy, tunnel routing and per-endpoint routes. (Backport MR #​28095, Upstream MR #​27908, @​julianwiedmann)

CI Changes:

Misc Changes:

Other Changes:

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Merge request reports