Repository navigation
Envoy moves to v1.39.5, micro-VM assets to kata 4.3.1, kind and CSI images pinned by digest - #3181
Merged
Dmitry Berkovich (dberkov) merged 5 commits intoOct 24, 2026
Conversation
The release drops the compromised eMudhra intermediate CAs from the image's CA bundle. The egress TLS e2e helper and the nighthawk traffic driver pin the same image.
The csi-nfs-controller patch pulled the floating envoyproxy/envoy:v1.34-latest tag, a minor that no longer gets fixes. It now runs the Envoy the dataplane image is built on. The Cloud SQL Auth Proxy sidecar moves from 2.25.2 to 2.26.3.
rustfs 1.0.0-beta.3 to 1.0.3, aws-cli 2.17.0 to 2.38.5, prometheus v3.5.3 to v3.15.1, opentelemetry-collector-contrib 0.157.0 to 0.163.2. The rustfs env names the manifest sets are unchanged in 1.0.3.
kata 4.3.1 ships a 6.18 guest kernel and an Ubuntu 26.04 rootfs and still bundles virtiofsd 1.14.0. cloud-hypervisor stays v53.0. The SandboxConfig version becomes v2 with the new digests, so a MEMORY snapshot taken on v1 cold boots on its next resume. The agent protos are unchanged since 3.31.0.
Davanum Srinivas (dims)
marked this pull request as ready for review
October 23, 2026 22:49
Collaborator
Will it completely break resume from golden snapshot or it will be cold start with rootfs+volumes? |
The StatefulSet in csi-hostpath-testing.yaml is a local Envoy mTLS proxy that setupCSIHostpath and setup-csi-hostpath-kind.sh deploy on kind. It floated on v1.34-latest too.
Collaborator
Author
Cold start with rootfs and volumes. |
Dmitry Berkovich (dberkov)
approved these changes
Oct 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Envoy v1.39.5 drops the compromised eMudhra intermediate CAs, and so do the prometheus, otel-collector, cloud-sql-proxy and kata releases below. The CSI NFS proxy pulled the floating
envoyproxy/envoy:v1.34-latesttag and the Cloud SQL proxy an unpinned one. The kind overlay images and the kata assets were several releases behind.Change. One commit per area.
v2with digests fromassemble.shon amd64 and arm64 hosts. The kata agent protos are unchanged since 3.31.0.Breaking change. A micro-VM actor whose MEMORY snapshot, its own or its template's golden, was taken on the kata 4.1.0 assets restores at ROOTFS fidelity on its next resume: a fresh guest with its rootfs writes and volumes, no memory state. Recreate templates whose golden you want warm again. Please add the
breaking-changelabel.Tests.
go test ./api/infra/k8s/ate/v1/ ./cmd/ate-setup/... ./cmd/atelet/and shellcheck pass. All 19 e2e suites pass under the micro-VM class on an amd64 KVM host with the new assets.AI use: AI-assisted, I reviewed and tested it.