Affected by GO-2025-4167 and 4 other vulnerabilities

GO-2025-4167: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium

GO-2026-4856: Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium

GO-2026-5400: Cillium exposes sensitive information included in the cilium-bugtool debug archive in github.com/cilium/cilium

GO-2026-5905: Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium

GO-2026-5914: CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation in github.com/cilium/cilium

k8s

package

v1.16.13 Latest Latest Go to latest Published: Aug 13, 2025 License: Apache-2.0 Imports: 29 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/cilium/cilium

Links

Documentation ¶

Constants ¶

This section is empty.

Variables ¶

View Source

var Cell = cell.Module(
	"policy-k8s-watcher",
	"Watches K8s policy related objects",

	cell.Invoke(startK8sPolicyWatcher),
)

Cell starts the K8s policy watcher. The K8s policy watcher watches all policy related K8s resources (Kubernetes NetworkPolicy (KNP), CiliumNetworkPolicy (CNP), ClusterwideCiliumNetworkPolicy (CCNP), and CiliumCIDRGroup (CCG)), translates them to Cilium's own policy representation (api.Rules) and updates the policy repository (via PolicyManager) accordingly.

Functions ¶

This section is empty.

Types ¶

type CNPMetrics ¶ added in v1.16.6

type CNPMetrics interface {
	AddCNP(cec *cilium_v2.CiliumNetworkPolicy)
	DelCNP(cec *cilium_v2.CiliumNetworkPolicy)
	AddCCNP(spec *cilium_v2.CiliumNetworkPolicy)
	DelCCNP(spec *cilium_v2.CiliumNetworkPolicy)
}

func NewCNPMetricsNoop ¶ added in v1.16.6

func NewCNPMetricsNoop() CNPMetrics

type PolicyManager ¶

type PolicyManager interface {
	PolicyAdd(rules api.Rules, opts *policy.AddOptions) (newRev uint64, err error)
	PolicyDelete(labels labels.LabelArray, opts *policy.DeleteOptions) (newRev uint64, err error)
}

type PolicyWatcherParams ¶

type PolicyWatcherParams struct {
	cell.In

	Lifecycle cell.Lifecycle

	ClientSet client.Clientset
	Config    *option.DaemonConfig
	Logger    logrus.FieldLogger

	K8sResourceSynced *synced.Resources
	K8sAPIGroups      *synced.APIGroups

	PolicyManager promise.Promise[PolicyManager]
	ServiceCache  *k8s.ServiceCache

	CiliumNetworkPolicies            resource.Resource[*cilium_v2.CiliumNetworkPolicy]
	CiliumClusterwideNetworkPolicies resource.Resource[*cilium_v2.CiliumClusterwideNetworkPolicy]
	CiliumCIDRGroups                 resource.Resource[*cilium_v2_alpha1.CiliumCIDRGroup]
	NetworkPolicies                  resource.Resource[*slim_networking_v1.NetworkPolicy]

	MetricsManager CNPMetrics
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL