Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update module github.com/cilium/cilium to v1.14.16 [security] #453

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update module github.com/cilium/cilium to v1.14.16 [security] #453

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Aug 6, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
github.com/cilium/cilium v1.14.5 -> v1.14.16 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-28248

Impact

Cilium's HTTP policies are not consistently applied to all traffic in the scope of the policies, leading to HTTP traffic being incorrectly and intermittently forwarded when it should be dropped.

Patches

This issue affects:

  • Cilium v1.13 between v1.13.9 and v1.13.12 inclusive
  • Cilium v1.14 between v1.14.0 and v1.14.7 inclusive
  • Cilium v1.15.0 and v1.15.1

This issue has been patched in:

  • Cilium v1.15.2
  • Cilium v1.14.8
  • Cilium v1.13.13

Workarounds

There is no workaround for this issue – affected users are strongly encouraged to upgrade.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @​romikps for discovering and reporting this issue, and @​sayboras and @​jrajahalme for preparing the fix.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium internal security team, and your report will be treated as top priority.

CVE-2024-28249

Impact

In Cilium clusters with IPsec enabled and traffic matching Layer 7 policies:

  • Traffic that should be IPsec-encrypted between a node's Envoy proxy and pods on other nodes is sent unencrypted
  • Traffic that should be IPsec-encrypted between a node's DNS proxy and pods on other nodes is sent unencrypted

Note: For clusters running in native routing mode, IPsec encryption is not applied to connections which are selected by a L7 Egress Network Policy or a DNS Policy. This is a known limitation of Cilium's IPsec encryption which will continue to apply after upgrading to the latest Cilium versions described below.

Patches

This issue affects:

  • Cilium v1.15 before v1.15.2
  • Cilium v1.14 before v1.14.8
  • Cilium v1.13 before v1.13.13
  • Cilium v1.4 to v1.12 inclusive

This issue has been resolved in:

  • Cilium v1.15.2
  • Cilium v1.14.8
  • Cilium v1.13.13

Workarounds

There is no workaround to this issue.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @​jschwinger233, @​julianwiedmann, @​giorio94, and @​jrajahalme for their work in triaging and resolving this issue.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you have found a vulnerability in Cilium, we strongly encourage you to report it to our private security mailing list at [email protected]. This is a private mailing list that only members of the Cilium internal security team are subscribed to, and your report will be treated as top priority.

CVE-2024-28250

Impact

In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies:

  • Traffic that should be WireGuard-encrypted is sent unencrypted between a node's Envoy proxy and pods on other nodes.
  • Traffic that should be WireGuard-encrypted is sent unencrypted between a node's DNS proxy and pods on other nodes.

Patches

This issue affects:

  • In native routing mode (routingMode=native):
    • Cilium v1.14 versions before v1.14.8
    • Cilium v1.15 versions before v1.15.2
  • In tunneling mode (routingMode=tunnel):
    • Cilium v1.14 versions before v1.14.4
    • Cilium v1.14.4 if encryption.wireguard.encapsulate is set to false (default).

This issue has been resolved in:

  • In native routing mode (routingMode=native):
    • Cilium v1.14.8
    • Cilium v1.15.2
  • In tunneling mode (routingMode=tunnel):
    • Cilium v1.14.4. NOTE encryption.wireguard.encapsulate must be set to true.

Workarounds

There is no workaround to this issue.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @​brb, @​giorio94, @​gandro and @​jschwinger233 for their work on triaging and remediating this issue.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list at [email protected]. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and your report will be treated as top priority.

CVE-2024-28860

Impact

Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective.

In particular, Cilium is vulnerable to the following attacks by a man-in-the-middle attacker:

  • Chosen plaintext attacks
  • Key recovery attacks
  • Replay attacks

These attacks are possible due to an ESP sequence number collision when multiple nodes are configured with the same key. Fixed versions of Cilium use unique keys for each IPsec tunnel established between nodes, resolving all of the above attacks.

Important: After upgrading, users must perform a key rotation using the instructions here to ensure that they are no longer vulnerable to this issue. Please note that the key rotation instructions have recently been updated, and users must use the new instructions to properly establish secure IPsec tunnels. To validate that the new instructions have been followed properly, ensure that the IPsec Kubernetes secret contains a "+" sign.

Patches

All prior versions of Cilium that support IPsec transparent encryption (Cilium 1.4 onwards) are affected by this issue.

Patched versions:

  • Cilium 1.15.3
  • Cilium 1.14.9
  • Cilium 1.13.14

Workarounds

There is no workaround to this issue. IPsec transparent encryption users are strongly encouraged to upgrade.

Acknowledgements

The Cilium community has worked together with members of Cure53 and Isovalent to prepare these mitigations. Special thanks to @​NikAleksandrov and @​pchaigno for their work on remediating the issue. Thanks to Marsh Ray, Senior Software Developer at Microsoft, for input and guidance on the fix.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: [email protected] - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.

CVE-2024-37307

Impact

The output of cilium-bugtool can contain sensitive data when the tool is run (with the --envoy-dump flag set) against Cilium deployments with the Envoy proxy enabled.

Users of the following features are affected:

The sensitive data includes:

  • The CA certificate, certificate chain, and private key used by Cilium HTTP Network Policies, and when using Ingress/Gateway API
  • The API keys used in Kafka-related network policy

cilium-bugtool is a debugging tool that is typically invoked manually and does not run during the normal operation of a Cilium cluster.

Patches

This issue affects:

  • Cilium v1.13 between v1.13.0 and v1.13.16 inclusive
  • Cilium v1.14 between v1.14.0 and v1.14.11 inclusive
  • Cilium v1.15 between v1.15.0 and v1.15.5 inclusive

This issue has been patched in:

  • Cilium v1.15.6
  • Cilium v1.14.12
  • Cilium v1.13.17

Workarounds

There is no workaround to this issue.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @​sayboras for their work on triaging and remediating this issue.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.

CVE-2024-25630

Impact

For Cilium users who are using CRDs to store Cilium state (the default configuration) and Wireguard transparent encryption, responses from pods to the Ingress and health endpoints are not encrypted. Traffic from the Ingress and health endpoints to pods is not affected by this issue. The health endpoint is only used for Cilium's internal health checks.

Patches

This issue affects Cilium v1.14 before v1.14.7.

This issue has been patched in Cilium v1.14.7.

Workarounds

There is no workaround to this issue - affected users are encouraged to upgrade.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @​gandro for their work on triaging and remediating this issue.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and your report will be treated as top priority.

CVE-2024-25631

Impact

For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted.

Patches

This issue affects Cilium v1.14 before v1.14.7.

This issue has been patched in Cilium v1.14.7.

Workarounds

There is no workaround to this issue - affected users are encouraged to upgrade.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @​giorio94 and @​gandro for their work on triaging and remediating this issue.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list at [email protected]. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and your report will be treated as top priority.

CVE-2024-42488

Impact

A race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass.

Patches

This issue was fixed in https://github.com/cilium/cilium/pull/33511.

This issue affects:

  • All versions of Cilium before v1.14.14
  • Cilium v1.15 between v1.15.0 and v1.15.7 inclusive

This issue has been patched in:

  • Cilium v1.14.14
  • Cilium v1.15.8

Workarounds

As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected.

Acknowledgements

The Cilium community has worked together with members of Google and Isovalent to prepare these mitigations. Special thanks to @​skmatti for raising and resolving this issue.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.

CVE-2024-47825

Impact

A policy rule denying a prefix that is broader than /32 may be ignored if there is

  • A policy rule referencing a more narrow prefix (CIDRSet or toFQDN) and
  • This narrower policy rule specifies either enableDefaultDeny: false or - toEntities: all

Note that a rule specifying toEntities: world or toEntities: 0.0.0.0/0 is insufficient, it must be to entity all.

As an example, given the below policies, traffic is allowed to 1.1.1.2, when it should be denied:

apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: block-scary-range
spec:
  endpointSelector: {}
  egressDeny:
  - toCIDRSet:
    - cidr: 1.0.0.0/8

---

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: evade-deny
spec:
  endpointSelector: {}
  egress:
  - toCIDR:
    - 1.1.1.2/32
  - toEntities:
    - all

Patches

This issue affects:

  • Cilium v1.14 between v1.14.0 and v1.14.15 inclusive
  • Cilium v1.15 between v1.15.0 and v1.15.9 inclusive

This issue has been patched in:

  • Cilium v1.14.16
  • Cilium v1.15.10

Workarounds

Users with policies using enableDefaultDeny: false can work around this issue by removing this configuration option and explicitly defining any allow rules required.

No workaround is available to users with egress policies that explicitly specify toEntities: all.

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @​squeed, @​christarazi, and @​jrajahalme for their work in triaging and resolving this issue.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated with top priority.

Release Notes

cilium/cilium (github.com/cilium/cilium)

v1.14.16: 1.14.16

Compare Source

Summary of Changes

Bugfixes:

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests

cilium

docker.io/cilium/cilium:v1.14.16@​sha256:8a31c16a4b3fcd0fbfdbfe3348710bfb766a5bcc8225ee5c4057d3a7cbcbafb2
quay.io/cilium/cilium:v1.14.16@​sha256:8a31c16a4b3fcd0fbfdbfe3348710bfb766a5bcc8225ee5c4057d3a7cbcbafb2

clustermesh-apiserver

docker.io/cilium/clustermesh-apiserver:v1.14.16@​sha256:19c1318e555d8ee9dbec9d86fe8e7e6c43a2dd7eeb29eb88ea7af28d21971186
quay.io/cilium/clustermesh-apiserver:v1.14.16@​sha256:19c1318e555d8ee9dbec9d86fe8e7e6c43a2dd7eeb29eb88ea7af28d21971186

docker-plugin

docker.io/cilium/docker-plugin:v1.14.16@​sha256:ccb1aee7af60693fe434924b0bbbb0a625382335ca2767d485a0bc855df5943d
quay.io/cilium/docker-plugin:v1.14.16@​sha256:ccb1aee7af60693fe434924b0bbbb0a625382335ca2767d485a0bc855df5943d

hubble-relay

docker.io/cilium/hubble-relay:v1.14.16@​sha256:ba715eaa50036c45ac39b2e4d08ee1794ac8dbfe6af339c48dba1402416da8f9
quay.io/cilium/hubble-relay:v1.14.16@​sha256:ba715eaa50036c45ac39b2e4d08ee1794ac8dbfe6af339c48dba1402416da8f9

kvstoremesh

docker.io/cilium/kvstoremesh:v1.14.16@​sha256:c22860631b97e671d08a21524da5283322ec6b7750760e78df5718169a987fa0
quay.io/cilium/kvstoremesh:v1.14.16@​sha256:c22860631b97e671d08a21524da5283322ec6b7750760e78df5718169a987fa0

operator-alibabacloud

docker.io/cilium/operator-alibabacloud:v1.14.16@​sha256:a647eae904c9210c3fa566a540c28bc6de525a92fd5049de1a3331c0b224d8b7
quay.io/cilium/operator-alibabacloud:v1.14.16@​sha256:a647eae904c9210c3fa566a540c28bc6de525a92fd5049de1a3331c0b224d8b7

operator-aws

docker.io/cilium/operator-aws:v1.14.16@​sha256:013da30c41a2ca04c56b3b4b51ebda57bac2aec8a0107031e445d636e913dca1
quay.io/cilium/operator-aws:v1.14.16@​sha256:013da30c41a2ca04c56b3b4b51ebda57bac2aec8a0107031e445d636e913dca1

operator-azure

docker.io/cilium/operator-azure:v1.14.16@​sha256:91b811091e98456543b4b7569039213bef954881a079a9796481275430994448
quay.io/cilium/operator-azure:v1.14.16@​sha256:91b811091e98456543b4b7569039213bef954881a079a9796481275430994448

operator-generic

docker.io/cilium/operator-generic:v1.14.16@​sha256:21243c0dcbc3d505ddf661835fc9a6aa6393e439893cbfd86c20b381c709d2b8
quay.io/cilium/operator-generic:v1.14.16@​sha256:21243c0dcbc3d505ddf661835fc9a6aa6393e439893cbfd86c20b381c709d2b8

operator

docker.io/cilium/operator:v1.14.16@​sha256:d5f68e5238d9fa608537f05abfa1296c188715439329128a9f78a7d0f6c078ef
quay.io/cilium/operator:v1.14.16@​sha256:d5f68e5238d9fa608537f05abfa1296c188715439329128a9f78a7d0f6c078ef

v1.14.15: 1.14.15

Compare Source

We are happy to release Cilium v1.14.15!

This release brings us upstream filter chains for L7 LB policy enforcement, bugfixes, CI fixes and many many more! See summary of changes below!

Summary of Changes

Minor Changes:

Bugfixes:

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests

cilium

docker.io/cilium/cilium:v1.14.15@​sha256:9a7977e8a685ac8ef8477c6be76a10d2aabf680bfe13916fa8ba7fec4429705d
quay.io/cilium/cilium:v1.14.15@​sha256:9a7977e8a685ac8ef8477c6be76a10d2aabf680bfe13916fa8ba7fec4429705d

clustermesh-apiserver

docker.io/cilium/clustermesh-apiserver:v1.14.15@​sha256:1254404bd6a9c9cd0702727f5fe9bf26477a3dac3fa6cb144a57c84b328d079b
quay.io/cilium/clustermesh-apiserver:v1.14.15@​sha256:1254404bd6a9c9cd0702727f5fe9bf26477a3dac3fa6cb144a57c84b328d079b

docker-plugin

docker.io/cilium/docker-plugin:v1.14.15@​sha256:5d123a4fd747b42a5ea3153930b23b93b0803ea881a6dbac26531deeb926cb9f
quay.io/cilium/docker-plugin:v1.14.15@​sha256:5d123a4fd747b42a5ea3153930b23b93b0803ea881a6dbac26531deeb926cb9f

hubble-relay

docker.io/cilium/hubble-relay:v1.14.15@​sha256:f104b07f38d0fa206bc41d5bd7a02ea42e32b18de7022f8401492bad35bbedc7
quay.io/cilium/hubble-relay:v1.14.15@​sha256:f104b07f38d0fa206bc41d5bd7a02ea42e32b18de7022f8401492bad35bbedc7

kvstoremesh

docker.io/cilium/kvstoremesh:v1.14.15@​sha256:93d81162805edf7145a9b6f2b22790c51a730f439f7644399d55cfc083c665e0
quay.io/cilium/kvstoremesh:v1.14.15@​sha256:93d81162805edf7145a9b6f2b22790c51a730f439f7644399d55cfc083c665e0

operator-alibabacloud

docker.io/cilium/operator-alibabacloud:v1.14.15@​sha256:db526ebf79874a0376c37fa987a820ff572a5a9b9c23697c393ab5d8721a20dd
quay.io/cilium/operator-alibabacloud:v1.14.15@​sha256:db526ebf79874a0376c37fa987a820ff572a5a9b9c23697c393ab5d8721a20dd

operator-aws

docker.io/cilium/operator-aws:v1.14.15@​sha256:e17ee0a65edf75f13e9fb380ef2dc4c80096d8a08581f8b8a65386e35589a175
quay.io/cilium/operator-aws:v1.14.15@​sha256:e17ee0a65edf75f13e9fb380ef2dc4c80096d8a08581f8b8a65386e35589a175

operator-azure

docker.io/cilium/operator-azure:v1.14.15@​sha256:e4ce4f4bce9431493efc59aba38277dd831836c3112af34e48e97c3d6bf4d668
quay.io/cilium/operator-azure:v1.14.15@​sha256:e4ce4f4bce9431493efc59aba38277dd831836c3112af34e48e97c3d6bf4d668

operator-generic

docker.io/cilium/operator-generic:v1.14.15@​sha256:233c4ab72cd6a06e8b4c8bed4991d625df8389e6225b27bc72f088c10036b870
quay.io/cilium/operator-generic:v1.14.15@​sha256:233c4ab72cd6a06e8b4c8bed4991d625df8389e6225b27bc72f088c10036b870

operator

docker.io/cilium/operator:v1.14.15@​sha256:064d2449a4ceaaf8bab2f14fb49544061bb4a9d508d78ea3596b3be03c20b82f
quay.io/cilium/operator:v1.14.15@​sha256:064d2449a4ceaaf8bab2f14fb49544061bb4a9d508d78ea3596b3be03c20b82f

v1.14.14: 1.14.14

Compare Source

Security Advisories

This release addresses GHSA-q7w8-72mr-vpgw.

Summary of Changes

Bugfixes:

  • DNS Proxy: Allow SO_LINGER to be set to the socket to upstream (Backport PR #​33815, Upstream PR #​33592, @​gandro)
  • Fix bug causing etcd upsertion/deletion events to be potentially missed during the initial synchronization, when Cilium operates in KVStore mode, or Cluster Mesh is enabled. (Backport PR #​34184, Upstream PR #​34091, @​giorio94)
  • Fix rare race condition afflicting clustermesh while stopping the retrieval of the remote cluster configuration, possibly causing a deadlock (Backport PR #​33815, Upstream PR #​33735, @​giorio94)
  • pkg/metrics: fix data race warning on metrics init hook. (Backport PR #​33963, Upstream PR #​33823, @​tommyp1ckles)
  • Report the correct drop reason when a packet is dropped by the bpf_lxc program. (Backport PR #​31735, Upstream PR #​33551, @​julianwiedmann)
  • The cilium agent will now recover from stale nodeID mappings which could occur in clusters with high node churn, possibly manifesting itself in dropped IPsec traffic. (Backport PR #​34150, Upstream PR #​33666, @​bimmlerd)

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests

cilium

docker.io/cilium/cilium:v1.14.14@​sha256:43d664501afbf35496e494dae0c5a7f8680a51ed9084997bea9c64bf4451a637
quay.io/cilium/cilium:v1.14.14@​sha256:43d664501afbf35496e494dae0c5a7f8680a51ed9084997bea9c64bf4451a637

clustermesh-apiserver

docker.io/cilium/clustermesh-apiserver:v1.14.14@​sha256:43171d3f988ffa7b5ef58b7f329bab77a5382c620b56ed9a64909e4358174135
quay.io/cilium/clustermesh-apiserver:v1.14.14@​sha256:43171d3f988ffa7b5ef58b7f329bab77a5382c620b56ed9a64909e4358174135

docker-plugin

docker.io/cilium/docker-plugin:v1.14.14@​sha256:8f4722b3fc3b64438065eeb8d4a003f8166032bf2bc1bad0480495cd7f9feef2
quay.io/cilium/docker-plugin:v1.14.14@​sha256:8f4722b3fc3b64438065eeb8d4a003f8166032bf2bc1bad0480495cd7f9feef2

hubble-relay

docker.io/cilium/hubble-relay:v1.14.14@​sha256:6fdad9d7ce64efbb966745005a2060223d9677cc4407177171b865691ab00aac
quay.io/cilium/hubble-relay:v1.14.14@​sha256:6fdad9d7ce64efbb966745005a2060223d9677cc4407177171b865691ab00aac

kvstoremesh

docker.io/cilium/kvstoremesh:v1.14.14@​sha256:ac7b4ddc38abfa0a27a503c7453dc8a8d4b3b1b1e785b02fda3ccbe613987c41
quay.io/cilium/kvstoremesh:v1.14.14@​sha256:ac7b4ddc38abfa0a27a503c7453dc8a8d4b3b1b1e785b02fda3ccbe613987c41

operator-alibabacloud

docker.io/cilium/operator-alibabacloud:v1.14.14@​sha256:2a88642e1c76548a0c4d8e8fe2facaed5f6955040bdd4729a6d1090eafde5e49
quay.io/cilium/operator-alibabacloud:v1.14.14@​sha256:2a88642e1c76548a0c4d8e8fe2facaed5f6955040bdd4729a6d1090eafde5e49

operator-aws

docker.io/cilium/operator-aws:v1.14.14@​sha256:adb1ea6a98b2715c5bed74ba4ab9fab89f6862aff462a5a05acd0d8c39d3af80
quay.io/cilium/operator-aws:v1.14.14@​sha256:adb1ea6a98b2715c5bed74ba4ab9fab89f6862aff462a5a05acd0d8c39d3af80

operator-azure

docker.io/cilium/operator-azure:v1.14.14@​sha256:4a88010d124b70ca1b1df90e0ca40bd79a99e344f72bfc821b9ef490421d0f51
quay.io/cilium/operator-azure:v1.14.14@​sha256:4a88010d124b70ca1b1df90e0ca40bd79a99e344f72bfc821b9ef490421d0f51

operator-generic

docker.io/cilium/operator-generic:v1.14.14@​sha256:0f2c8178bd20189fc9aeaa71224e6becdf71b42642209610b57390f7b798aae2
quay.io/cilium/operator-generic:v1.14.14@​sha256:0f2c8178bd20189fc9aeaa71224e6becdf71b42642209610b57390f7b798aae2

operator

docker.io/cilium/operator:v1.14.14@​sha256:8d1445bb129ccc56e6f2410369e0c9bacbb3ae9b7fde522c76734f01005e9ded
quay.io/cilium/operator:v1.14.14@​sha256:8d1445bb129ccc56e6f2410369e0c9bacbb3ae9b7fde522c76734f01005e9ded

v1.14.13: 1.14.13

Compare Source

Summary of Changes

We are pleased to release Cilium v1.14.13, which includes and updated Hubble UI, as well as stability and bug fixes. Thanks to all contributors, reviewers, testers, and users!

Minor Changes:

Bugfixes:

  • envoy: Avoid short circuit backend filtering (Backport PR #​33534, Upstream PR #​33403, @​sayboras)
  • Fix service connection to terminating backend, when the service has no more backends available. (Backport PR

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate Renovate
Copy link
Contributor Author

renovate bot commented Aug 6, 2024 •
edited
Loading

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 24 additional dependencies were updated

Details:

Package Change
github.com/docker/docker v25.0.5+incompatible -> v27.1.1+incompatible
golang.org/x/mod v0.16.0 -> v0.19.0
golang.org/x/sync v0.6.0 -> v0.7.0
golang.org/x/sys v0.18.0 -> v0.22.0
google.golang.org/grpc v1.62.1 -> v1.64.0
google.golang.org/protobuf v1.33.0 -> v1.34.2
cloud.google.com/go/compute v1.23.3 -> v1.25.1
github.com/Microsoft/go-winio v0.6.1 -> v0.6.2
github.com/containerd/containerd v1.7.14 -> v1.7.20
github.com/distribution/reference v0.5.0 -> v0.6.0
github.com/go-jose/go-jose/v3 v3.0.1 -> v3.0.3
github.com/go-logr/logr v1.4.1 -> v1.4.2
go.opentelemetry.io/otel v1.24.0 -> v1.28.0
go.opentelemetry.io/otel/metric v1.24.0 -> v1.28.0
go.opentelemetry.io/otel/sdk v1.21.0 -> v1.28.0
go.opentelemetry.io/otel/trace v1.24.0 -> v1.28.0
golang.org/x/crypto v0.21.0 -> v0.25.0
golang.org/x/net v0.22.0 -> v0.27.0
golang.org/x/term v0.18.0 -> v0.22.0
golang.org/x/text v0.14.0 -> v0.16.0
golang.org/x/tools v0.19.0 -> v0.23.0
google.golang.org/api v0.153.0 -> v0.169.0
google.golang.org/genproto/googleapis/rpc v0.0.0-20240311173647-c811ad7063a7 -> v0.0.0-20240701130421-f6361c86f094
k8s.io/utils v0.0.0-20240102154912-e7106e64919e -> v0.0.0-20240310230437-4693a0247e57

@renovate renovate bot force-pushed the renovate/go-github.com-cilium-cilium-vulnerability branch from 00497d8 to c328d44 Compare August 15, 2024 23:05
@renovate renovate bot changed the title fix(deps): update module github.com/cilium/cilium to v1.14.12 [security] fix(deps): update module github.com/cilium/cilium to v1.14.14 [security] Aug 15, 2024
@renovate renovate bot force-pushed the renovate/go-github.com-cilium-cilium-vulnerability branch from c328d44 to 4568735 Compare October 21, 2024 19:52
@renovate renovate bot changed the title fix(deps): update module github.com/cilium/cilium to v1.14.14 [security] fix(deps): update module github.com/cilium/cilium to v1.14.16 [security] Oct 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants