What's New in 26.4

Review the new and updated features in this release.

Tampering Event Details

Tampering Details provides additional context for agent.tampering events by showing information specific to the type of tampering detected. For process policy tampering, it displays when the tampering occurred, the action taken, and an optional mark. For firewall tampering, it displays when it occurred, the affected process and kernel functions, and an optional process name. Navigate to Troubleshoot > Events to view these details.

Support for hybrid MSP tenant migration

As part of the upgrade from legacy SaaS clusters to the Illumio Console, the MSP Portal now allows administrators to access both legacy SaaS tenants and tenants who upgrade to the Illumio Console.

This feature provides support during the transition period to make sure that MSP administrators have an uninterrupted experience in the MSP Portal.

Accessing the Illumio Console child tenants: When an MSP administrator selects a new browser tab that has been upgraded to the Illumio Console, the tenant will open in a new browser, launching a full Illumio Console session. Legacy child tenants continue to open in the same tab as before.
New tenant provisioning: The Add Tenant action in the MSP Portal is automatically disabled if the default target cluster for new tenant creation has been upgraded to the Illumio Console. This prevents MSP administrators from accidentally provisioning new tenants on an upgraded cluster through the legacy MSP Portal flow.

MSP and MSSP customers can submit an Illumio support ticket to request provisioning and deprovisioning of new tenants on the Illumio Console.

Note

This feature is relevant during the transition period only.

Pod policy convergence visibility

With this release, Illumio expands Kubernetes Policy Convergence status. The synchronization state for Kubernetes pods displays in the Servers & Endpoints > Workloads > Kubernetes Workloads Summary within the PCE UI. This information represents a distinct C-VEN convergence state, separate from "Policy Sync," which indicates Kubelink’s acknowledgment of the policy. The increased transparency and visibility helps you understand synchronization progress across the pods in a workload. The same information displays in Infrastructure > Container Clusters for a selected Kubernetes Workload.

Display Kubernetes pod errors in host workloads

Host workloads now report CLAS Kubernetes workload synchronization status through their existing sync status and error fields. A workload indicates Synced only after Kubelink reports a CLAS sync status with zero errors. When errors are reported, the status and error message transition to the agent error state.

Changed APIs in 26.4.0 (Schemas)

Here's a summary of the new and enhanced APIs in this release.

Changed Common Schemas

In this release, three common schemas have been changed:

common-container_policy_convergence_errors

This schema transitions the data model from a singular error-reporting structure to a bulk/batch processing model.

},
      "pod_names": {
        "description": "Names of the k8s Pods",
        "type": "array",
        "items": {
          "type": "string"
        }
      },
      "workloads": {
        "description": "Host Workloads that represent the k8s Nodes where the Pods are running",
        "type": "array",
        "items": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "href",
            "name"
          ],
          "properties": {
            "href": {
              "type": "string"
            },
            "name": {
              "description": "Workload name",
              "type": "string"
            }
          }

Instead of processing single string and object fields (pod_name and workload), the schema now uses arrays (pod_names and workloads). This allows the system to group and handle multiple affected Kubernetes Pods and Nodes simultaneously in a single event payload.

For newly added workloads, the schema increases data visibility by making the human-readable name a required field alongside the API href.

common-pairing_profile_ven_type
This schema update modifies the allowed enum values for the pairing profile VEN type (common-pairing_profile_ven_type) by adding support for Data Processing Units (DPUs) to the allowed enumeration list.
```
[
     "+",
     "dpu"
   ]
```
common-ven_type
While common-pairing_profile_ven_type added "dpu" specifically to the pairing profiles configuration, this change updates the underlying VEN type classification.
```
[
      "+",
      "dpu"
    ]
```
Data Processing Unit (dpu) is implemented via SmartNICs/hardware accelerators such as NVIDIA BlueField ).

Changed Schemas

Several schemas have been changed to add properties:

network_device_config

This schema update introduces a new property, configure, to the network device configuration schema, adding a native mechanism for toggling configuration permissions.

{
  "properties": {
    "configure": {
      "description": "Boolean flag to indicate if the device can be configured",
      "type": "boolean"
    }
  }
}

This addition introduces granular control over device management. It lets you flag certain network devices as "read-only" or unconfigurable by toggling this boolean.

optional_features_put

This update modifies the schema definition used to update optional system features (optional_features_put). It introduces four new feature flags to the allowed options configuration under the name enum property, while leaving all existing options unchanged.

{
  "items": {
    "oneOf": [
      [
        "~",
        {
          "properties": {
            "name": {
              "enum": [
           ---------------------------------     
                [
                  "+",
                  "linux_outbound_process_enforcement"
                ],
          ----------------------------------
                [
                  "+",
                  "mtwl"
                ],
          ----------------------------------      
                [
                  "+",
                  "pce_nla"
                ],
                [
                  "+",
                  "policy_generator"
         -----------------------------------

linux_outbound_process_enforcement: Extends outbound process-level firewall enforcement to Linux environments (complementing the existing windows_outbound_process_enforcement).

mtwl: Introduces a new feature toggle

pce_nla: Adds support for PCE Network Location Awareness configurations.

policy_generator: Introduces a toggle for automated security policy generation utility features.

By expanding this enum, the PUT request can now accept, configure, and toggle these four new distinct functionalities.

It allows infrastructure operators to selectively enable advanced platform capabilities, such as Linux process firewalls, automated policy generators, or location-awareness features, during a system settings update.

traffic_flows_workload

This change introduces a hierarchical, multi-tiered labeling architecture for workloads in traffic flow logs.

{
  "properties": {
    "sub_labels": {
      "description": "List of sub-label sets associated with the workload",
      "type": "array",
      "items": {
        "$ref": "traffic_flows_endpoint_labels.schema.json"
      }
    }
  }
}

By supporting arrays of traffic_flows_endpoint_labels, the system can now track and filter traffic using more granular sub-labels.

users_login_get

This schema update enhances the user login retrieval data model by adding an explicit property, a new field named domain_name, for tracking corporate or network domain boundaries during a GET request.

{
  "properties": {
    "domain_name": {
      "type": "string",
      "description": "User's domain name (e.g. illumio.com)"
    }
  }
}

This field captures the specific corporate or organizational domain name associated with the logging-in user account.

Illumio REST APIs 26.x