This the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

News

1: Release Notes
2: Security Bulletins

2.1: KIALI-SECURITY-003 - Installation into ad-hoc namespaces
2.2: KIALI-SECURITY-002 - Authentication bypass when using the OpenID login strategy
2.3: KIALI-SECURITY-001 - Authentication bypass using forged credentials

1 - Release Notes

For additional information check our sprint demo videos and blogs.

1.68.0

Sprint Release: May 12, 2023

Features:

Fixes:

1.67.0

Sprint Release: Apr 21, 2023

Features:

Fixes:

Notes:

There have been changes to Namespace Management. The changes are backward compatible but it is recommended to understand the changes regarding Discovery Selector support, cluster-wide access, and accessible-namespaces. For more see here.

Deprecations:

The following settings are deprecated and may be removed in a future release:
- api.namespaces.exclude
- api.namespaces.include
- api.namespaces.label_selector_exclude
- api.namespaces.label_selector_include

It is recommended to instead use Istio Discovery Selectors to limit the namespaces in the mesh.

1.66.1

Sprint Release: Mar 31, 2023

Features:

Fixes:

Notes:

To avoid a known performance degradation, update to v1.66.1 (or later) from v1.66.0.

Deprecations:

Given that the Kiali cache is now mandatory and that there have been several changes to the cache implementation, the .spec.kubernetes_config.cache_* settings have all deprecated and will be removed from the CRD. It is recommended to remove these settings from your CR, if defined.

1.65.0

Sprint Release: Mar 10, 2023

Features:

Fixes:

1.64.0

Sprint Release: Feb 17, 2023

Features:

Fixes:

1.63.2

Sprint Release: Feb 02, 2023

Features:

Fixes:

Notes:

Helm 3.10 is now required to run the Helm Charts.
To avoid a known performance degradation, update to v1.63.2 (or later) from earlier revisions of v1.63.

Deprecations:

The deprecated support for OpenID’s implicit flow has now been removed. If necessary, you must switch to using the more secure authorization code flow.

1.62.1

Sprint Release: Feb 02, 2023

Features:

Fixes:

Notes:

To avoid a known performance degradation, update to v1.62.1 (or later) from v1.62.0.

Deprecations:

The experimental support for multicluster deployment models is now deprecated and may be removed in a future release. New multicluster features are currently being developed within the Kiali community as a replacement.

1.61.0

Sprint Release: Dec 16

Features:

Fixes:

1.60.0

Sprint Release: Nov 25

Features:

Fixes:

Deprecations:

Support for OpenID’s implicit flow is deprecated and will be removed soon. Please, switch to using the authorization code flow which is more secure.

Known Issues:

With the move to a distroless container in v1.59, root CA certificates went missing. This affects the Kiali integration with OpenID. The problem will be fixed in the next release (v1.61). The workaround is to use one of the “-distro” image tags found on the Quay.io repo by specifying it in the deployment.image_version setting of the Kiali CR or server helm chart value. If using the operator, in order to be able to set the deployment.image_version within the Kiali CR, you must enable the allowAdHocKialiImage setting when installing the operator.

1.59.0

Sprint Release: Nov 4, 2022

Features:

Fixes:

1.58.0

Sprint Release: Oct 14, 2022

Features:

Fixes:

1.57.0

Sprint Release: Sep 23

Features:

Fixes:

Upgrade Notes:

The improved control plane card on the Overview page makes use of previously unused metrics. If these metrics have been removed from your environment you will need to add them back for the feature to work. As a result,

Metric	Notes
process_cpu_seconds_total	used to graph cpu usage in the control plane overview card
container_memory_working_set_bytes	used to graph memory usage in the control plane overview card
pilot_proxy_convergence_time_sum	used in control plane overview card to show the average proxy push time
pilot_proxy_convergence_time_count	used in control plane overview card to show the average proxy push time

If these metrics have been removed from your environment you will need to add them back for the feature to work. As a result, we have updated our recommended Prometheus metric thinning configuration. See kiali.io for the updated configuration. The metrics used are not typically very heavy and adding them back should likely not be an issue.

See this FAQ entry for a list of all metrics required by Kiali.

1.56.0

Sprint Release: Sep 2

Features:

Fixes:

k8s api token not auto refreshing (aws eks warning)

2.1 - KIALI-SECURITY-003 - Installation into ad-hoc namespaces

Description

Disclosure date: May 11, 2021
Affected Releases: prior to 1.33.0
Impact Score: 6.6 - AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

A vulnerability was found in the Kiali Operator allowing installation of a specified image into any namespace.

Kiali users are exposed to this vulnerability if all the following conditions are met:

Kiali operator is used for installation.
Kiali CR was edited to install an image into an unapproved namespace.

This vulnerability is filed as CVE-2021-3495

Mitigation

If you can update:

Update to Kiali Operator v1.33.0 or later.

If you can not update:

Ensure only trusted individuals can create or edit a Kiali CRs (resources of kind “kiali”).

2.2 - KIALI-SECURITY-002 - Authentication bypass when using the OpenID login strategy

Description

Disclosure date: March 5, 2021
Affected Releases: 1.26.0, 1.26.1, 1.26.2, 1.27.0, 1.28.0, 1.28.1, 1.29.0, 1.29.1, 1.30.0
Impact Score: 7.0 - AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:X/RC:C

A vulnerability was found in Kiali allowing an attacker to bypass the authentication mechanism. The vulnerability lets an attacker build forged credentials and use them to gain unauthorized access to Kiali.

Kiali users are exposed to this vulnerability if all the following conditions are met:

Kiali is setup with the openid authentication strategy.
As a result of configurations in both Kiali and your OpenID server, Kiali uses the implicit flow of the OpenID specification to negotiate authentication.
Kiali is setup with RBAC turned off.

This vulnerability is filed as CVE-2021-20278

Mitigation

If you can update:

Update to Kiali v1.31.0 or later.
If you need an earlier version, only Kiali 1.26.3 and 1.29.2 are fixed.

If you are locked with an older version of Kiali, you have three options:

Configure Kiali to use the authorization code flow of the OpenID specification; or
Configure Kiali to use the implicit flow of the OpenID specification and enable RBAC; or
Configure Kiali to use any of the other available authentication mechanisms.

2.3 - KIALI-SECURITY-001 - Authentication bypass using forged credentials

Description

Disclosure date: March 25, 2020
Affected Releases: 0.4.0 to 1.15.0
Impact Score: 9.4 - AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

A vulnerability was found in Kiali allowing an attacker to bypass the authentication mechanism. Currently, Kiali has four authentication mechanisms: login, token, openshift and ldap. All are vulnerable.

The vulnerability lets an attacker build forged credentials and use them to gain unauthorized access to Kiali.

Additionally, it was found that Kiali credentials were not being validated properly. Depending on the authentication mechanism configured in Kiali, this could facilitate unauthorized access into Kiali with forged and/or invalid credentials.

These vulnerabilities are filed as CVE-2020-1762 and CVE-2020-1764

Detection

Use the following bash script to check if you are vulnerable:

KIALI_VERSION=$(kubectl get pods -n istio-system -l app=kiali -o yaml | sed -n 's/^.*image: .*:v\(.*\)$/\1/p' | sort -u)
kubectl get deploy kiali -n istio-system -o yaml | grep -q LOGIN_TOKEN_SIGNING_KEY
TEST_KEY_ENV=$?
kubectl get cm kiali -n istio-system -o yaml | grep signing_key | grep -vq kiali
TEST_KEY_CFG=$?
VERSION_ENTRIES=(${KIALI_VERSION//./ })
echo "Your Kiali version found: ${KIALI_VERSION}"
[ ${VERSION_ENTRIES[0]} -lt "1" ] || ([ ${VERSION_ENTRIES[0]} -eq "1" ] && (\
  [ ${VERSION_ENTRIES[1]} -lt "15" ] || ([ ${VERSION_ENTRIES[1]} -eq "15" ] && ( \
  [ ${VERSION_ENTRIES[2]} -le "0" ])))) && echo "Your Kiali version is vulnerable"
[ $TEST_KEY_ENV -eq 1 ] && [ $TEST_KEY_CFG -eq 1 ] && echo "Your Kiali configuration looks vulnerable"

The script output will be similar to this:

Your Kiali version found: 1.14.0
Your Kiali version is vulnerable
Your Kiali configuration looks vulnerable

Mitigation

Update to Kiali 1.15.1 or later.

Alternatively, if you cannot update to version 1.15.1, mitigation is possible by setting a secure signing key when deploying Kiali. If you installed via Kiali operator, you could use the following bash script:

SIGN_KEY=$(chars=abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890; for i in {1..20}; do echo -n "${chars:RANDOM%${#chars}:1}"; done; echo)
kubectl get kiali -n $(kubectl get kiali --all-namespaces --no-headers -o custom-columns=NS:.metadata.namespace) -o yaml | sed "s/spec:/spec:\n    login_token:\n      signing_key: $SIGN_KEY/" | kubectl apply -f -

If you installed via Istio helm charts or istioctl command, you could use the following bash script:

KIALI_INSTALL_NAMESPACE=istio-system
SIGN_KEY=$(chars=abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890; for i in {1..20}; do echo -n "${chars:RANDOM%${#chars}:1}"; done; echo)
kubectl get cm kiali -n $KIALI_INSTALL_NAMESPACE -o yaml | sed "s/server:/login_token:\\n      signing_key: $SIGN_KEY\\n    server:/" | kubectl apply -f -
kubectl delete pod -l app=kiali -n $KIALI_INSTALL_NAMESPACE