Skip to content

bump cilium to v1.20.0 - #364

Open
vishnukumarkvs wants to merge 2 commits into
coroot:mainfrom
vishnukumarkvs:bump-cilium
Open

bump cilium to v1.20.0#364
vishnukumarkvs wants to merge 2 commits into
coroot:mainfrom
vishnukumarkvs:bump-cilium

Conversation

@vishnukumarkvs

Copy link
Copy Markdown
Contributor

This to fix below CVE's

CVE-2026-33726 (4.3) in github.com/cilium/cilium, fixed in 1.17.14
CVE-2026-41520 (4.4) in github.com/cilium/cilium, fixed in 1.17.15
CVE-2026-53935 (6.9) in github.com/cilium/cilium, fixed in 1.17.16

I have bumped cilium to recent version v1.20.0. It requires few code refactors, as stated below

lbmap reloactions

  • cilium lbmap internal package relocated from pkg/maps/lbmap to pkg/loadbalancer/maps
  • In latest version, support for V1 and V2 are removed for BackendKey 4,6 functions. Hence removed unnecessary fallback
  • In lbmap, BackendId struct is replaced with Union struct

This cilium bump breaks pyroscope import as it also uses latest cilium/ebpf to build. hece these changes: coroot/pyroscope#6

@vishnukumarkvs vishnukumarkvs changed the title bump cilium to v1.20 bump cilium to v1.20.0 Aug 12, 2026
@vishnukumarkvs

Copy link
Copy Markdown
Contributor Author

checking go vet failure

@vishnukumarkvs
vishnukumarkvs marked this pull request as draft August 12, 2026 11:42
@def

def commented Aug 12, 2026

Copy link
Copy Markdown
Member

Just a note: none of these CVEs apply to the agent.

Comment thread go.mod
Comment on lines -222 to +214
github.com/grafana/pyroscope/ebpf => github.com/coroot/pyroscope/ebpf v0.0.0-20260804213318-758a0e72af3a
github.com/grafana/pyroscope/ebpf => github.com/vishnukumarkvs/pyroscope-coroot/ebpf v0.0.0-20260812093720-16395093d5d7

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs to be updated with coroot/pyroscope commit sha of this change: coroot/pyroscope#6

@vishnukumarkvs

Copy link
Copy Markdown
Contributor Author

@def I have tested this private build, but on a EKS cluster (with VPC CNI). So, it might not invoke above cilium cni datapath.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants