stable-2.14.1
This stable release introduces a fix for service discovery on endpoints that
use hostPorts. Previously, the destination service would return the pod IP
associated with the endpoint which could break connectivity on pod restarts.
Discovery responses have been changed to instead return the host IP. This
release also fixes an issue in the multicluster extension where an empty
remoteDiscoverySelector
field in the Link
resource would cause all services
to be exported. Finally, this release includes numerous other fixes and
enhancements and addresses two security vulnerabilities,
CVE-2023-2603 detected in the proxy-init runtime
image's libcap library and RUSTSEC-2023-0052, a
potential CPU usage denial-of-service attack in the proxy's webpki
library
dependency.
-
CLI
-
CNI
- Addressed security vulnerability CVE-2023-2603 in
proxy-init and CNI plugin ([#11296])
- Addressed security vulnerability CVE-2023-2603 in
-
Control Plane
- Changed how hostPort lookups are handled in the destination service.
Previously, when doing service discovery for an endpoint bound on a
hostPort, the destination service would return the corresponding pod IP. On
pod restart, this could lead to loss of connectivity on the client's side.
The destination service now always returns host IPs for service discovery
on an endpoint that uses hostPorts ([#11328]) - Updated HTTPRoute webhook rule to validate all apiVersions of the resource
(thanks @mikutas!) ([#11149])
- Changed how hostPort lookups are handled in the destination service.
-
Helm
-
Multicluster
- Fixed an issue where an empty
remoteDiscoverySelector
field in a
multicluster link would cause all services to be mirrored ([#11309]) - Removed time out from
linkerd multicluster gateways
command; when no
metrics exist the command will return instantly ([#11265]) - Improved help messaging for
linkerd multicluster link
([#11265])
- Fixed an issue where an empty
-
Proxy
- Addressed security vulnerability
RUSTSEC-2023-0052 in the proxy ([#11361])
- Addressed security vulnerability