This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

News

1 - Release Notes

For additional information check our sprint demo videos and blogs.

2.31.0

Release: August 21, 2026

Features:

Fixes:

2.30.0

Release: August 03, 2026

Features:

Fixes:

Upgrade Change Notes:

The fix for custom health status configuration could affect existing users. Degraded health status could now be reported as Failure. The behavior is correct, but could be unexepected. If affected, ensure proper setting of the failure threshold in your custom health configuration.

2.29.0

Release: July 13, 2026

Features:

Fixes:

2.28.0

Release: June 22, 2026

Features:

Fixes:

2.27.0

Release: June 01, 2026

Features:

Fixes:

The following fields are no longer used by the Kiali CR and will be ignored if currently set. The standard constant values are now used.

  • spec.istio_labels.egress_gateway_label
  • spec.istio_labels.ingress_gateway_label
  • spec.istio_labels.injection_label_name
  • spec.istio_labels.injection_label_rev

2.26.0

Release: May 29, 2026

Features:

Fixes:

2.25.0

Release: April 20, 2026

Features:

Fixes:

2.24.0

Release: March 30, 2026

Features:

Fixes:

Upgrade Change Notes:

kiali_health_status metric

Starting in v2.22, when the health cache and kiali metrics are both enabled (true by default) Kiali would also write a new metric, kiali_health_status. The initial implementation proved to be too heavy from a cardinality perspective. This metric has been redefined in v2.24 and will now generate a much lower cardinality of time series. Also, it is now opt-in, controlled by spec.server.observability.metrics.health_status.enabled. So, by default in v2.24, this metric will be disabled. The metric name remains the same, although attributes have been altered. Unless manually manipulated, existing series will remain in Prometheus until they naturally expire.

2.23.0

Release: March 09, 2026

Features:

Fixes:

2.22.0

Release: February 16, 2026

Features:

Fixes:

Upgrade Change Notes:

Health Status Pre-Compute and Caching

Kiali v2.22 introduces health status pre-compute and caching which is enabled by default. Production mesh sizes are growing and Kiali render times have been increasing, particularly for the Overview and List pages. In response, Kiali v2.22 changes its approach to health status calculation. In prior versions Kiali calculated health “on-demand”, based on the user’s selected duration, configuration settings, and other information, such as pod status. Starting in v2.22 Kiali will pre-calculate health status using a single, configurable duration, 5 minutes by default. The cached values increase the responsiveness of the Overview and List pages. Other pages, such as the Traffic graph and Detail pages will continue to calculate health status on-demand, and is based on the user’s selected duration. Users may notice that the Duration Dropdown selector has been removed from the Overview and List pages.

Users may notice an increase in backend resource utilization, as the Kiali server will now be calculating and refreshing health status, independent of user sessions. The Kiali CR introduces the following new configuration:

spec.health_config.compute.duration: 5m spec.health_config.compute.refresh_interval: 3m spec.health_config.compute.timeout: 10m

spec.kiali_internal.health_cache.enabled: false

It is recommended to keep the health cache enabled, as not all features will fall back to on-demand calculation.

Any questions, comments or feedback appreciated. Visit #kiali on Istio Slack or start a Discussion in Github at https://github.com/kiali/kiali.

2.21.0

Release: January 26, 2026

Features:

Fixes:

Upgrade Change Notes:

Traffic Graph Caching

Kiali v2.21 introduces traffic graph caching. Enabled by default. When a user navigates to the Traffic Graph and renders the initial graph, Kiali will start a background job to regenerate the graph periodically, based on the refresh interval set in the UI. The background job will cache the resulting graph and return it on subsequent UI requests. This can greatly improve re-render times, especially for larger graphs. Note that the initial graph render time will be unchanged. It is still recommended to use “Manual” refresh when working with large meshes, in order to fully define the desired graph before performing the initial request. Any fundamental change to the graph definition will invalidate the cache and restart a new refresh job. Users can navigate away and then back to the traffic graph, and resume with the latest cached graph, within the timeout period (10m by default).

Backend resource utilization may be affected, although is not anticipated to change significantly. The caching can be disabled in the Kiali config via:

spec.kiali_internal.graph_cache.enabled: false

Any questions, comments or feedback appreciated. Visit #kiali on Istio Slack or start a Discussion in Github at https://github.com/kiali/kiali.

2.20.0

Release: December 22, 2025

Features:

Fixes:

2.19.0

Release: November 24, 2025

Features:

Fixes:

2.18.0

Release: November 03, 2025

Features:

Fixes:

2.17.0

Release: October 13, 2025

Features:

Fixes:

Upgrade Change Notes:

The following fields are no longer used by the Kiali CR and MUST be removed, if currently set.

  • spec.external_services.istio.registry

2.16.0

Release: September 22, 2025

Features:

Fixes:

Upgrade Change Notes:

Discovery Selectors

Kiali now properly supports Istio control planes deployed into different namespaces. As part of this support both the spec.istio_namespace and spec.external_services.istio.root_namespace configuration fields have been removed. As such, Kiali Discovery Selectors, when defined, must include Istio’s control plane namespace(s). If you are using Kiali Discovery Selectors, please ensure that this new requirement is met. Note that Kiali’s deployment namespace is always included, and so co-located Istio control planes will be discovered.

The following fields are no longer used by the Kiali CR and MUST be removed, if currently set.

  • spec.external_services.istio.root_namespace

2.15.0

Release: September 02, 2025

Features:

Fixes:

Upgrade Change Notes:

Version 2.15.0 introduces a CRD schema for Kiali. The CRD version has not changed. But, validation will now occur on the cluster when the Kiali CRs are created or modified.

2.14.0

Release: August 08, 2025

Features:

Fixes:

Upgrade Change Notes:

The following fields are no longer used by the Kiali CR and MUST be removed, if currently set.

  • no longer used
    • spec.istio_namespace
    • spec.in_cluster
    • spec.deployment.remote_secret_path
  • now auto-discovered
    • spec.external_services.istio.config_map_name
    • spec.external_services.istio.istiod_pod_monitoring_port
    • spec.external_services.istio.envoy_admin_local_port
    • spec.external_services.istio.istio_canary_version
    • spec.external_services.istio.istio_injection_annotation
    • spec.external_services.istio.istio_sidecar_annotation
    • spec.external_services.istio.istiod_deployment_name
    • spec.external_services.istio.istiod_pod_monitoring_port
    • spec.external_services.istio.url_service_version

2.13.0

Release: July 21, 2025

Features:

Fixes:

2.12.0

Release: Jun 30, 2025

Features:

Fixes:

2.11.0

Release: Jun 09, 2025

Features:

Fixes:

2.10.0

Release: May 18, 2025

Features:

Fixes:

2.9.0

Release: Apr 25, 2025

Features:

Fixes:

2.8.0

Release: Apr 07, 2025

Features:

Fixes:

Deprecations:

After a 4 month deprecation period the support for Kiali’s original, Cytoscape-based, graph implementation has ended. The ‘spec.kiali_feature_flags.ui_defaults.graph.impl’ configuration setting is no longer supported, and the sole implementation going forward uses PatternFly Topology. This has allowed for a significant cleanup of the Kiali code base, and removal of several dated dependencies. We’d like to thank the Cytoscape project, without which Kiali would not have existed. It is an excellent library, and our migration to PatternFly was motivated by a need to settle on a uniform component library.

2.7.0

Release: Mar 17, 2025

Features:

Fixes:

2.6.0

Release: Feb 21, 2025

Features:

Fixes:

Upgrade Notes:

The default values for the following Kiali CR fields have changed:

  • spec.istio_labels.app_label_name
    • previous default: “app”
    • new default: unset
  • spec.istio_labels.version_label_name
    • previous default: “version”
    • new default: unset

The change is related to the work done for Kiali issue 7603, included with this release. By default Kiali now allows for a mixing app labeling schemes, using the same set of app and version label pairings recognized by Istio:

  • service.istio.io/canonical-name, service.istio.io/canonical-revision
  • app.kubernetes.io/name, app.kubernetes.io/version
  • app, version

Users can configure a single labeling scheme by setting the existing CR fields, or leaving them set when upgrading.

2.5.0

Release: Feb 03, 2025

Features:

Fixes:

2.4.0

Release: Jan 13, 2025

Features:

Fixes:

2.3.0

Release: Dec 23, 2024

Features:

Fixes:

2.2.0

Release: Dec 02, 2024

Features:

Fixes:

2.1.0

Release: Nov 11, 2024

Features:

Fixes:

Deprecations:

  • RedHat Community Operator
    • The community operator created confusion as to which operator to use on OpenShift. It will no longer be updated and will eventually be removed. OpenShift users are encouraged to use the productized operator, which is included with licensed copies of OpenShift.

2.0.0

Release: Oct 21, 2024

The first major Kiali release in over 5 years! There are two main reasons for the major version update:

  1. There is a breaking change in Kiali’s namespace management configuration. To limit the namespaces accessible to Kiali, or made visible to users, Kiali v2.0 users will configure Discovery Selectors.

There is no longer support for the following deprecated configuration settings:

  • spec.deployment.accessible_namespaces
  • api.namespaces.exclude
  • api.namespaces.include
  • api.namespaces.label_selector_exclude
  • api.namespaces.label_selector_include
  1. Kiali has a new traffic graph implementation.

The Cytoscape implementation has been deprecated and is no longer the default. Kiali has moved to PatternFly Topology to align with the rest of the Kiali interface, which is already implemented using PatternFly components. The old graph implementation will be removed as soon as the Kiali maintainers believe the new implementation has proven itself in the field. Until that time, it can still be accessed by setting:

spec:
  kiali_feature_flags:
    ui_defaults:
      graph:
        impl: "cy"

Features:

Fixes:

1.89.4

Release: Sep 30, 2024

Features:

The next feature release will be Kiali v 2.0.0

Fixes:

1.89.3

Release: Sep 09, 2024

Features:

The next feature release will be Kiali v 2.0.0

Fixes:

1.89.0

Release: Aug 19, 2024

Features:

Fixes:

1.88.0

Release: Jul 29, 2024

Features:

Fixes:

1.87.0

Release: Jul 08, 2024

Features:

Fixes:

Deprecations:

  • Kiali is deprecating its current namespace selection approach. For a description of the new mechanism see https://github.com/kiali/kiali/blob/master/design/KEPS/namespace-discovery/proposal.md. The following configuration is deprecated:
    • spec.deployment.accessible_namespaces
  • Note that the following settings have already been deprecated and will soon be removed:
    • api.namespaces.exclude
    • api.namespaces.include
    • api.namespaces.label_selector_exclude
    • api.namespaces.label_selector_include

1.86.0

Release: Jun 17, 2024

Features:

Fixes:

1.85.0

Release: May 27

Features:

Fixes:

1.84.0

Release: May 06, 2024

Features:

Fixes:

1.83.0

Release: Apr 12, 2024

Features:

  • n/a

Fixes:

1.82.0

Release: Mar 22, 2024

Features:

Fixes:

1.81.0

Release: Mar 01, 2024

Features:

Fixes:

1.80.0

Release: Feb 09, 2024

Features:

Fixes:

1.79.0

Release: Jan 19, 2024

Features:

Fixes:

1.78.0

Release: Dec 08, 2023

Features:

Fixes:

Deprecations:

  • Kiali is deprecating use of the Jaeger exporter for Kiali’s own traces. Kiali will move to supporting only the OTel exporter.

1.77.0

Release: Nov 17, 2023

Features:

Fixes:

1.76.0

Release: Oct 27, 2023

Features:

Fixes:

1.75.0

Release: Oct 06, 2023

Features:

Fixes:

1.74.0

Release: Sep 15, 2023

Features:

Fixes:

2 - Security Bulletins

Kiali releases every three weeks and so generally resolves CVEs in new releases only. Golang vulnerabilities are typically resolved in a timely way, as the Go version for release builds increments fairly often. Occasionally, critical CVEs may be resolved in patch releases for supported versions. Additionally, not every CVE reported against a Kiali dependency is actually a vulnerability. For reported CVEs that are proven not to affect Kiali, see the table below:

CVE Description Notes
CVE-2024-33599 nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow Kiali is not affected. As per the CVE description (see https://www.cve.org/CVERecord?id=CVE-2024-33599), this vulnerability is only present in the nscd binary. The Kiali Server image does not have this binary; run this command to confirm: podman run --user root -it --rm --entrypoint '' quay.io/kiali/kiali:v2.2.0 ls -R / | grep nscd
CVE-2024-2961 The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set Kiali is not affected. ISO-2022-CN-EXT has been removed. To confirm, run the validation command `podman run -it --rm --entrypoint '' quay.io/kiali/kiali:v2.2.0 iconv -l | grep -E 'CN-?EXT'`. See https://access.redhat.com/security/cve/CVE-2024-2961
CVE-2023-37920 A flaw was found in the python-certifi package. This issue occurs when the e-Tugra root certificate in Certifi is removed, resulting in an unspecified error that has an unknown impact and attack vector. Kiali is not affected. This was fixed in RHEL9 base images with RHBA-2024:5691. Per the CVE page, these certs are included and marked as 'don't trust', but will not be removed until Mozilla removes them. Browsers are most at risk, which already understand and parse 'don't trust after'. Furthermore, note that Microsoft has not removed the certificate from their code-signing CA list that are merged with Mozilla's CA list, so the certificate is still there marked as trusted for code signing. See: https://access.redhat.com/security/cve/cve-2023-37920 and https://access.redhat.com/errata/RHBA-2024:5691
CVE-2022-27191 golang.org/x/crypto/ssh allows an attacker to crash a server in certain circumstances involving AddHostKey Kiali does not use the AddHostKey API; furthermore, neither Kiali nor its dependencies import this component. Thus Kiali is not susceptible to this vulnerability.
CVE-2022-1996 github.com/emicklei/go-restful Despite the package dependency Kiali is not susceptible to this vulnerability
CVE-2019-1010022 GNU Libc current is affected by: Mitigation bypass. This is a disputed CVE. According to upstream, it is not a security issue. For details, please see https://sourceware.org/bugzilla/show_bug.cgi?id=22850 and https://security-tracker.debian.org/tracker/CVE-2019-1010022

For Kiali-specific vulnerabilities there will be releases made as needed. At release time a security bulletin will be release as well. For prior bulletins see below:

2.1 - KIALI-SECURITY-003 - Installation into ad-hoc namespaces

Description

A vulnerability was found in the Kiali Operator allowing installation of a specified image into any namespace.

Kiali users are exposed to this vulnerability if all the following conditions are met:

  • Kiali operator is used for installation.
  • Kiali CR was edited to install an image into an unapproved namespace.

This vulnerability is filed as CVE-2021-3495

Mitigation

If you can update:

  • Update to Kiali Operator v1.33.0 or later.

If you can not update:

  • Ensure only trusted individuals can create or edit a Kiali CRs (resources of kind “kiali”).

2.2 - KIALI-SECURITY-002 - Authentication bypass when using the OpenID login strategy

Description

A vulnerability was found in Kiali allowing an attacker to bypass the authentication mechanism. The vulnerability lets an attacker build forged credentials and use them to gain unauthorized access to Kiali.

Kiali users are exposed to this vulnerability if all the following conditions are met:

  • Kiali is setup with the openid authentication strategy.
  • As a result of configurations in both Kiali and your OpenID server, Kiali uses the implicit flow of the OpenID specification to negotiate authentication.
  • Kiali is setup with RBAC turned off.

This vulnerability is filed as CVE-2021-20278

Mitigation

If you can update:

  • Update to Kiali v1.31.0 or later.
  • If you need an earlier version, only Kiali 1.26.3 and 1.29.2 are fixed.

If you are locked with an older version of Kiali, you have three options:

  • Configure Kiali to use the authorization code flow of the OpenID specification; or
  • Configure Kiali to use the implicit flow of the OpenID specification and enable RBAC; or
  • Configure Kiali to use any of the other available authentication mechanisms.

2.3 - KIALI-SECURITY-001 - Authentication bypass using forged credentials

Description

A vulnerability was found in Kiali allowing an attacker to bypass the authentication mechanism. Currently, Kiali has four authentication mechanisms: login, token, openshift and ldap. All are vulnerable.

The vulnerability lets an attacker build forged credentials and use them to gain unauthorized access to Kiali.

Additionally, it was found that Kiali credentials were not being validated properly. Depending on the authentication mechanism configured in Kiali, this could facilitate unauthorized access into Kiali with forged and/or invalid credentials.

These vulnerabilities are filed as CVE-2020-1762 and CVE-2020-1764

Detection

Use the following bash script to check if you are vulnerable:

KIALI_VERSION=$(kubectl get pods -n istio-system -l app=kiali -o yaml | sed -n 's/^.*image: .*:v\(.*\)$/\1/p' | sort -u)
kubectl get deploy kiali -n istio-system -o yaml | grep -q LOGIN_TOKEN_SIGNING_KEY
TEST_KEY_ENV=$?
kubectl get cm kiali -n istio-system -o yaml | grep signing_key | grep -vq kiali
TEST_KEY_CFG=$?
VERSION_ENTRIES=(${KIALI_VERSION//./ })
echo "Your Kiali version found: ${KIALI_VERSION}"
[ ${VERSION_ENTRIES[0]} -lt "1" ] || ([ ${VERSION_ENTRIES[0]} -eq "1" ] && (\
  [ ${VERSION_ENTRIES[1]} -lt "15" ] || ([ ${VERSION_ENTRIES[1]} -eq "15" ] && ( \
  [ ${VERSION_ENTRIES[2]} -le "0" ])))) && echo "Your Kiali version is vulnerable"
[ $TEST_KEY_ENV -eq 1 ] && [ $TEST_KEY_CFG -eq 1 ] && echo "Your Kiali configuration looks vulnerable"

The script output will be similar to this:

Your Kiali version found: 1.14.0
Your Kiali version is vulnerable
Your Kiali configuration looks vulnerable

Mitigation

  • Update to Kiali 1.15.1 or later.

Alternatively, if you cannot update to version 1.15.1, mitigation is possible by setting a secure signing key when deploying Kiali. If you installed via Kiali operator, you could use the following bash script:

SIGN_KEY=$(chars=abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890; for i in {1..20}; do echo -n "${chars:RANDOM%${#chars}:1}"; done; echo)
kubectl get kiali -n $(kubectl get kiali --all-namespaces --no-headers -o custom-columns=NS:.metadata.namespace) -o yaml | sed "s/spec:/spec:\n    login_token:\n      signing_key: $SIGN_KEY/" | kubectl apply -f -

If you installed via Istio helm charts or istioctl command, you could use the following bash script:

KIALI_INSTALL_NAMESPACE=istio-system
SIGN_KEY=$(chars=abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890; for i in {1..20}; do echo -n "${chars:RANDOM%${#chars}:1}"; done; echo)
kubectl get cm kiali -n $KIALI_INSTALL_NAMESPACE -o yaml | sed "s/server:/login_token:\\n      signing_key: $SIGN_KEY\\n    server:/" | kubectl apply -f -
kubectl delete pod -l app=kiali -n $KIALI_INSTALL_NAMESPACE