Skip to content

v3.4.2

Latest
Latest

Choose a tag to compare

View all tags
@shraddhabang shraddhabang released this 13 Jul 22:16
v3.4.2
22f6cd7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v3.4.2 Release Notes

📚 Quick Links

v3.4.2 (requires Kubernetes 1.22+)

Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.4.2

Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

CRD Updates

  • No CRD updates required for this release.

IAM Policy Updates

  • No IAM policy changes required for this release.

Gateway API updates

  • No Gateway API CRD updates required for this release.

🔒 Security Fix

  • Cross-Kind Route Precedence Fix (PR #4818): Fixed a vulnerability where ALB listener rule priority was determined by route kind rather than route specificity when HTTPRoute and GRPCRoute share a hostname on the same Gateway listener. Previously, HTTPRoute would always receive a lower ALB priority number (evaluated first) than a specific GRPCRoute, allowing cross-namespace traffic interception. The controller now uses a unified precedence comparator that orders rules by hostname specificity → path type → path length → method constraint → header count → creation timestamp, regardless of route kind.

    Affected configurations: Shared Gateways with AllowedRoutes.Namespaces.From: All (or a namespace selector admitting multiple tenants) where both HTTPRoute and GRPCRoute attach to the same HTTPS listener with the same hostname.

    Workaround for unpatched versions: Restrict Gateway listener AllowedRoutes.Namespaces.From to Same or use a restrictive namespace Selector.

🔧 Enhancements and Fixes

  • [Security fix] Unified cross-kind route precedence for HTTPRoute/GRPCRoute — specific routes now correctly outrank catch-all routes regardless of kind (#4818)
  • [Bug fix] Fix e2e test gRPC service name mismatch in cross-kind precedence test (#4830)
  • [Enhancement] Upgrade Go toolchain from 1.26.4 to 1.26.5 — fixes CVE-2026-39822 and CVE-2026-42505

Documentation Updates

  • Add guidance on migrating between services without downtime (#4819)

🌟 Complete Change Log

  • fix(gateway): Unified cross-kind route precedence for HTTPRoute/GRPCRoute by @shraddhabang in #4818
  • fix(e2e): Use correct gRPC service name in cross-kind precedence test by @shraddhabang in #4830
  • docs: add guidance on migrating between services without downtime by @Thiru-2004-varul in #4819

New Contributors

Full Changelog: v3.4.1...v3.4.2

Assets 4
Loading