Illumio Segmentation for Containers

C-VEN support report does not contain container workload firewalls (E-106932)

VEN support reports for C-VENs were missing the active firewall information for all container workloads. This issue is resolved. Support reports now include full firewalls from each network namespace, as gathered by iptables-save and ipset list output.

Conntrack tear-down for containers with policy updates (E-44832)

Although policy was changed to block a container workload from talking to another, traffic was still passing between the workloads, due to a conntrack connection remaining incorrectly active. This issue is resolved. Conntrack connections on sessions affected by a policy change are now properly torn down.

C-VENs not automatically cleaned up after AKS upgrade (E-103895)

After upgrading an AKS cluster, sometimes a few duplicate C-VENs might not be automatically removed as part of the normal upgrade process, and remain in the PCE as "non-active." Note there is no compromise to the security or other functionality of the product.

Workaround: Manually prune the extra unmigrated C-VENs from the PCE by clicking the Unpair button for each of them.

Kubelink does not pair with PCE when a separate management port is used (E-107001)

Kubelink would crash after start when the PCE had front_end_management_https_port set to 9443 instead of 8443, because of a missing label_map URL. This issue is resolved.

Kubelink does not properly apply label mappings with PCE using two-sided management ports (E-105391)

Label mappings are not properly applied when using the LabelMap CRD if the PCE uses two-sided management ports.

Workaround: Use the label map feature only with a PCE that uses only one management port.