Affected by GO-2025-3635 and 5 other vulnerabilities

GO-2025-3635: In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium

GO-2025-4167: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium

GO-2026-4856: Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium

GO-2026-5400: Cillium exposes sensitive information included in the cilium-bugtool debug archive in github.com/cilium/cilium

GO-2026-5905: Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium

GO-2026-5914: CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation in github.com/cilium/cilium

ciliumenvoyconfig

package

v1.17.2 Latest Latest Go to latest Published: Mar 13, 2025 License: Apache-2.0 Imports: 65 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/cilium/cilium

Links

Documentation ¶

Index ¶

Variables
func NewCECTable(db *statedb.DB) (statedb.RWTable[*CEC], error)
type CEC
type CECMetrics
type CECName
type PortAllocator

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	CECTableName = "ciliumenvoyconfigs"

	CECByName = cecNameIndex.Query

	CECByServiceName = cecServiceIndex.Query
)

View Source

var Cell = cell.Module(
	"ciliumenvoyconfig",
	"CiliumEnvoyConfig",

	cell.Config(cecConfig{}),
	cell.Invoke(registerCECK8sReconciler),
	cell.ProvidePrivate(newCECManager),
	cell.ProvidePrivate(newCECResourceParser),
	cell.ProvidePrivate(newEnvoyServiceBackendSyncer),
	cell.ProvidePrivate(newPortAllocator),

	experimentalCell,
)

Cell provides support for the CRD CiliumEnvoyConfig that backs Ingress, Gateway API and L7 loadbalancing.

Functions ¶

func NewCECTable ¶ added in v1.17.0

func NewCECTable(db *statedb.DB) (statedb.RWTable[*CEC], error)

Types ¶

type CEC ¶ added in v1.17.0

type CEC struct {
	Name k8sTypes.NamespacedName
	Spec *ciliumv2.CiliumEnvoyConfigSpec

	Selector         labels.Selector `json:"-"`
	SelectsLocalNode bool
	Listeners        part.Map[string, uint16]

	// FrontendsRevision is the latest revision of [experimental.Frontend] from
	// which the [Resources.Endpoints] were updated. This is used to coordinate
	// updates between the reflector and the backendController.
	FrontendsRevision statedb.Revision

	// Resources is the parsed envoy.Resources.
	Resources envoy.Resources `json:"-"`

	// ReconciledResources is the last successfully reconciled resources.
	// Updated by the reconciliation operations.
	ReconciledResources *envoy.Resources `json:"-"`

	// Status is the reconciliation status of [Resources] towards Envoy.
	Status reconciler.Status
}

func (*CEC) Clone ¶ added in v1.17.0

func (cec *CEC) Clone() *CEC

func (*CEC) GetStatus ¶ added in v1.17.0

func (cec *CEC) GetStatus() reconciler.Status

func (*CEC) SetStatus ¶ added in v1.17.0

func (cec *CEC) SetStatus(newStatus reconciler.Status) *CEC

func (*CEC) TableHeader ¶ added in v1.17.0

func (*CEC) TableHeader() []string

func (*CEC) TableRow ¶ added in v1.17.0

func (cec *CEC) TableRow() []string

type CECMetrics ¶ added in v1.16.6

type CECMetrics interface {
	AddCEC(cec *ciliumv2.CiliumEnvoyConfigSpec)
	DelCEC(cec *ciliumv2.CiliumEnvoyConfigSpec)
	AddCCEC(spec *ciliumv2.CiliumEnvoyConfigSpec)
	DelCCEC(spec *ciliumv2.CiliumEnvoyConfigSpec)
}

type CECName ¶ added in v1.17.0

type CECName = k8sTypes.NamespacedName

type PortAllocator ¶

type PortAllocator interface {
	AllocateCRDProxyPort(name string) (uint16, error)
	AckProxyPort(ctx context.Context, name string) error
	ReleaseProxyPort(name string) error
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL