Buoyant Enterprise for Linkerd

July 24, 2026

The 2.20.1 stable point release fixes a panic in linkerd policy generate, and fixes a corner case in proxy behavior where connections to undefined service ports were incorrectly allowed if a corresponding ServiceProfile existed for that Service. This release also updates dependencies to address reported CVEs in underlying components, and provides optional FIPS binaries.

This release technically contains a minor breaking change, in service of conforming to the stated documentation. Since Linkerd 2.19, the documented behavior with respect to ports that are not declared in a Service spec is to match the behavior of kubeproxy: Linkerd should deny connections to those ports. However, the original implementation of this behavior incorrectly allowed those connections if a ServiceProfile existed.

In this release, we’ve fixed Linkerd’s behavior to match the documentation: connections to ports that are not defined in the Service spec are now denied, even when a ServiceProfile exists for that Service. See Upgrade guidance below for details.

Previous release: enterprise-2.20.0.

Supported Kubernetes versions

For this release, the minimum supported Kubernetes version remains 1.31, and the maximum supported Kubernetes version remains 1.35.

Who should upgrade?

Customers who require FIPS support or need bug fixes introduced in 2.20 should upgrade when feasible.

Other users may upgrade to this release at their convenience to take advantage of the fixes and addressed CVEs.

Upgrade guidance

Customers who use ServiceProfiles and currently connect to ports on Services that are not defined in the Service spec should add those ports to the corresponding Service spec before upgrading. All other customers can upgrade safely without changes.

See the instructions in Upgrading BEL for how to upgrade.

To upgrade with BEL’s lifecycle automation operator, you will need Buoyant Extension v0.40.3 or later.

Changelog