Kloak v0.3.0 Release

Released November 1, 2026. Full changelog on GitHub

v0.3.0 changes how Kloak decides which host a connection is for. Host-restricted secrets now rely on virtual IPs and an SNI check instead of reading the DNS answers on the node, which closes gaps with CDNs and shared addresses and adds IPv6. With NRI, a pod is fully prepared before its containers start.

Every hostname in a getkloak.io/hosts annotation gets its own virtual IP, from 198.18.0.0/15 and 2001:2::/48 by default. A pod that references a secret restricted to that host gets the virtual IP in its DNS answers, and its connections to it are redirected to the host's real addresses. The secret is only rewritten on a connection made through the virtual IP, so Kloak knows which host a connection is for even when hosts share addresses, as behind a CDN or a shared ingress. This replaces the node-wide DNS snooping of earlier releases. (#331, #333, #335, #338, #344, #346)

A secret restricted to a hostname is only rewritten on a connection whose TLS ClientHello names that host. Connections without SNI, or with an encrypted ClientHello, are refused. Set controller.ebpf.sniCheck: audit to log mismatches instead of refusing them. (#329)

AAAA answers get the host's virtual IPv6, IPv6 connects are redirected, and TLS records sent over IPv6 are patched. IPv6-only pods are supported. (#339, #361)

With containerd 2.0+ or CRI-O 1.30+, the container runtime waits for Kloak while it creates each pod sandbox and before each container starts. The DNS rewrite is in place before the first lookup, and the TLS uprobes before the first TLS write. Without NRI, Kloak now also attaches to pending pods and init containers. Configure it with controller.nri.enabled and controller.nri.socketPath. (#340, #363, #364)

Secrets are synced into the BPF maps as soon as an enabled Secret or its shadow changes, instead of every 5 seconds, with a resync every 5 minutes. A pod that loses access to a secret loses it at once. (#349, #350)