v2.14.4
Breaking Changes📦 kumaView on GitHub →
⚠ 1 breaking✨ 2 features🐛 13 fixes🔧 15 symbols
Summary
This release includes dependency updates, security hardening for containers, and new features for computing resource labels. Several bug fixes have been implemented across various components including API server, Kubernetes integration, KDS, and XDS.
⚠️ Breaking Changes
- Control plane, hook, ingress, and egress containers now drop all Linux capabilities and disallow privilege escalation. This is a security hardening measure. If your deployment relies on these containers having specific capabilities or privilege escalation, you may need to adjust your security context or RBAC policies.
✨ New Features
- Compute `kuma.io/display-name` for all resources.
- Compute `kuma.io/origin` on global and zone control planes.
🐛 Bug Fixes
- Avoid nil dereference in the API server's _layout.
- Drop terminating egress from endpoints in Kubernetes.
- Enforce control-plane-owned labels on read in Kubernetes.
- Reject user-set service-account label in Kubernetes.
- Scope gateway mapper logger per call in Kubernetes.
- Retry sync updates on write conflicts for KDS.
- Advertise a zone ingress node that serves traffic.
- Bind readiness wildcard on Kubernetes for kuma-dp.
- Resolve mirror backendRef for MeshHTTPRoute.
- Honor circuit breaker patches for MeshProxyPatch.
- Build cross-zone SNI from port name for XDS.
- Do not mutate the cached Dataplane in XDS.
- Resolve MeshZoneAddress hostname for EDS in XDS.