Cilium

Summary of Changes

Major Changes:

• Envoy resources (e.g., Listeners, Network Policies, etc.) can now be synchronized with Envoy incrementally, reducing CPU load and policy update latency. This is enabled by the new agent option value --envoy-xds-mode=delta-split. Corresponding Helm value is envoy.xdsMode=delta-split. (cilium/cilium#45288, @jrajahalme)
• network driver: add agent side baseline driver and dummy device manager (cilium/cilium#47254, @bersoare)

Minor Changes:

• build: Update iptables from 1.8.8 to 1.8.11 (cilium/cilium#47623, @HadrienPatte)
• clustermesh: no longer restart pods when changing remote clustermesh-apiserver IPs statically defined (without a DNS name) (cilium/cilium#47190, @MrFreezeex)
• CT map adaptive GC interval calculation improvements (cilium/cilium#46796, @fristonio)
• Deprecate WireGuard Node Encryption (cilium/cilium#47219, @pchaigno)
• envoy: demote stale ADS endpoint warning (cilium/cilium#47148, @nezdolik)
• Fix external traffic drops/inconsistencies on secondary ENIs with masquerade enabled (cilium/cilium#47008, @monta-riahi)
• helm: Add extraInitContainers and disableDefaultVolumes to support external certificate management for Hubble and ClusterMesh components. (cilium/cilium#46688, @alaashehab-m)
• helm: add GatewayAPI HTTPRoute support for hubble-ui (cilium/cilium#46792, @SchulteMK)
• helm: add value to configure clustermesh apiserver service port (cilium/cilium#47375, @crealte)
• network driver: add Cilium Network Driver CRDs, helm values and CRD chart entries (cilium/cilium#46238, @bersoare)
• network driver: add cluster roles and mounts for the network driver feature (cilium/cilium#46995, @bersoare)
• Removed the deprecated cidr field from CiliumNode.Status.Azure interfaces and the deprecated subnet field from their addresses; use interfaces[].subnet.{id,cidr} instead. (cilium/cilium#47461, @jaredledvina)
• Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (cilium/cilium#47529, @julianwiedmann)

Bugfixes:

• azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (cilium/cilium#47449, @jaredledvina)
• bpf: hostfw: tolerate unknown CT protocols and rely on policies (cilium/cilium#47343, @smagnani96)
• datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (cilium/cilium#46861, @fdomain)
• endpoint/watchdog: Avoid warning about endpoints being deleted (cilium/cilium#47625, @christarazi)
• envoy: restore http-idle-timeout as the route idle timeout source (cilium/cilium#47583, @aanm)
• Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (cilium/cilium#47295, @aanm)
• Fix abnormal ip allocation caused by hostnetwork pod (cilium/cilium#47552, @haozhangami)
• Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (cilium/cilium#47593, @julianwiedmann)
• Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with NotAllowedByListeners when the TCP listener had an explicit AllowedRoutes.Kinds restriction. (cilium/cilium#46842, @pidreher)
• gateway-api: preserve duplicate HTTPRoute rule precedence (cilium/cilium#46696, @thorn3r)
• gateway-api: prevent conflicted listeners from reaching ingestion (cilium/cilium#47457, @asauber)
• gateway-api: sync ListenerSet TLS secrets on ListenerSet events (cilium/cilium#47627, @mhofstetter)
• hubble: fix four config knobs that never reach their sink (cilium/cilium#47637, @aanm)
• hubble: Fixed false-positive increments of the hubble_ring_buffer lost events metric. (cilium/cilium#46585, @chez-shanpu)
• ipam: wait for pool readiness on fresh multi-pool allocation (cilium/cilium#47497, @fr4nsyz)
• l2announcer: re-evaluate services on frontend changes (cilium/cilium#47579, @mhofstetter)
• operator/endpointslice: Fix races on slim controller (cilium/cilium#47228, @mauriciovasquezbernal)
• wireguard: Unsubscribe node handler on shutdown (cilium/cilium#47614, @HadrienPatte)

CI Changes:

• .github: add python3-scapy for BPF unit tests (cilium/cilium#47535, @msune)
• .github: quarantine outside-to-nodeport L7 test on non-PD EKS legs (cilium/cilium#47390, @aanm)
• .github: recalibrate CL2 scale thresholds for policy delay and agent memory (cilium/cilium#47170, @aanm)
• .github: run all quarantined EKS tests in a single tolerated step (cilium/cilium#47534, @aanm)
• .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (cilium/cilium#47470, @atykhyy)
• .github: test the default ENI behaviour on the EKS pull request leg (cilium/cilium#47569, @aanm)
• bpf/complexity-tests: Cover L7 LB (cilium/cilium#47060, @pchaigno)
• bpf/tests: remove stale make run references (cilium/cilium#47556, @msune)
• bpf: tests: egressgw: be explicit about CT tuple type (cilium/cilium#47183, @julianwiedmann)
• ci: Bump Renovate to 43.288.0 to restore commit sign-off (cilium/cilium#47689, @HadrienPatte)
• ci: fix filtering out md files in bpf checks (cilium/cilium#47605, @nebril)
• ci: helm override failsafe in ginkgo workflow (cilium/cilium#47348, @Artyop)
• ci: Separate Go major upgrades into their own Renovate PR (cilium/cilium#47382, @HadrienPatte)
• ci: Skip redundant setup when base images already exist (cilium/cilium#47209, @HadrienPatte)
• Improve coverage of TrafficPolicy configuration permutations in the loadbalancer control plane. (cilium/cilium#47362, @ajmmm)
• loader/test: Add endpoint-routes to overlay/wg (cilium/cilium#47525, @brb)
• loader/test: Add endpoint-routes to test permutations (cilium/cilium#47077, @brb)
• test: allowlist the leader election read timeout in ginkgo log check (cilium/cilium#47612, @aanm)

Misc Changes:

• .github: allow fork PR checkout in v1.20 build-images workflows (cilium/cilium#47243, @aanm)
• .github: don't drop ciliumbot's approval when pruning reviewers (cilium/cilium#47138, @aanm)
• Add cilium-io reviewers and committers to CODEOWNERS (cilium/cilium#47236, @xmulligan)
• Add helm option to configure envoy static runtime config (cilium/cilium#46820, @fristonio)
• Add PayPal as a user of Cilium in USERS.md (cilium/cilium#47380, @dpaks)
• Add scope and disclosure information to SECURITY.md (cilium/cilium#47180, @ferozsalam)
• Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (cilium/cilium#46116, @amaanx86)
• allocator: fix flake in TestWatchRemoteKVStore (cilium/cilium#47455, @giorio94)
• bgp: register route-policy statedb only when BGP control plane enabled (cilium/cilium#47447, @martonra)
• bgp: remove bgp-operator-crd-storage-version-migrator job (cilium/cilium#47248, @martonra)
• bgp: Use GoBGP configuration directly in script test (cilium/cilium#47152, @YutaroHayakawa)
• bpf,datapath: move MONITOR_AGGREGATION to runtime config (cilium/cilium#47366, @viktor-kurchenko)
• bpf,datapath: move RSS source prefixes to runtime config (cilium/cilium#47363, @viktor-kurchenko)
• bpf,datapath: move STRICT_IPV4_NET[_SIZE] macros to runtime config (cilium/cilium#47358, @viktor-kurchenko)
• bpf: conntrack: don't report SYN-ACK as 'observed SYN' (cilium/cilium#47448, @julianwiedmann)
• bpf: conntrack: Reduce stack usage of ct_create{4,6} (cilium/cilium#47582, @dylandreimerink)
• bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (cilium/cilium#47388, @julianwiedmann)
• bpf: dsr: use eth_store_proto() in dsr_reply_icmp*() (cilium/cilium#47392, @julianwiedmann)
• chore(datapath): remove unused CILIUM_LB_SOURCE_RANGE_MAP_MAX_ENTRIES (cilium/cilium#47093, @lconnery)
• chore(deps): update all github action dependencies (main) (cilium/cilium#46944, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (main) (cilium/cilium#47309, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (main) (cilium/cilium#47481, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (main) (patch) (cilium/cilium#47476, @cilium-renovate[bot])
• chore(deps): update all lvh-images main (main) (patch) (cilium/cilium#47312, @cilium-renovate[bot])
• chore(deps): update all lvh-images main (main) (patch) (cilium/cilium#47477, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#47310, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#47475, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#47499, @cilium-renovate[bot])
• chore(deps): update cilium/cilium-cli action to v0.19.6 (main) (cilium/cilium#47337, @cilium-renovate[bot])
• chore(deps): update cilium/cilium-cli action to v0.19.7 (main) (cilium/cilium#47575, @cilium-renovate[bot])
• chore(deps): update dependency bufbuild/buf to v1.72.0 (main) (cilium/cilium#47479, @cilium-renovate[bot])
• chore(deps): update dependency renovatebot/renovate to v43.272.9 (main) (cilium/cilium#47501, @cilium-renovate[bot])
• chore(deps): update dependency renovatebot/renovate to v43.273.0 (main) (cilium/cilium#47502, @cilium-renovate[bot])
• chore(deps): update dependency renovatebot/renovate to v43.274.0 (main) (cilium/cilium#47507, @cilium-renovate[bot])
• chore(deps): update dependency renovatebot/renovate to v43.275.0 (main) (cilium/cilium#47508, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.5 docker digest to 3aff665 (main) (cilium/cilium#47311, @cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.7.1 (main) (cilium/cilium#47478, @cilium-renovate[bot])
• chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43.281.1 (main) (cilium/cilium#47515, @cilium-renovate[bot])
• chore(deps): update github/codeql-action action to v4.37.2 (main) (cilium/cilium#47506, @cilium-renovate[bot])
• chore(deps): update google/cloud-sdk docker tag to v576 (main) (cilium/cilium#47336, @cilium-renovate[bot])
• chore(deps): update google/cloud-sdk docker tag to v577 (main) (cilium/cilium#47509, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1784087459-5c6d365aae12510675d55f3576539472045d6b03 (main) (cilium/cilium#47313, @cilium-renovate[bot])
• chore(deps): update quay.io/goswagger/swagger docker tag to v0.35.0 (main) (cilium/cilium#47030, @cilium-renovate[bot])
• chore(deps): update quay.io/goswagger/swagger docker tag to v0.35.3 (main) (cilium/cilium#47472, @cilium-renovate[bot])
• clustermesh: MCS-API endpoint slice mirror simplification (cilium/cilium#47123, @MrFreezeex)
• clustermesh: move service, service export, endpointslice sync to clustermesh-apiserver pkg (cilium/cilium#46738, @MrFreezeex)
• clustermesh: remove legacy labels/annotations fields (cilium/cilium#47217, @MrFreezeex)
• CODEOWNERS: Update codeowners for security rename (cilium/cilium#47432, @joestringer)
• contrib: fix lock-check pattern matching (cilium/cilium#47458, @ILL1A)
• Convert the etcd debug (troubleshoot) dialer from net.IP to netip.Addr. (cilium/cilium#47428, @Wise-Wizard)
• datapath/linux/device: remove unused ops fields (cilium/cilium#46836, @tklauser)
• docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (cilium/cilium#47600, @41ks)
• docs: fix broken hive/cell pkg.go.dev link (cilium/cilium#47105, @mailnike)
• docs: fix version string typo in CRD documentation (cilium/cilium#47057, @magic-peach)
• docs: Remove "not stable" installation instructions (cilium/cilium#47646, @joestringer)
• docs: update Gateway API conformance badge (cilium/cilium#47581, @arybolovlev)
• docs: Update Gateway API installation guide (cilium/cilium#47446, @arybolovlev)
• egressgw: remove deprecated IPv4 policy map (cilium/cilium#46053, @julianwiedmann)
• envoy/xds: use netip.ParseAddr to validate the node IP (cilium/cilium#47516, @Atishyy27)
• fix(deps): update all go dependencies main (main) (cilium/cilium#47473, @cilium-renovate[bot])
• fix(deps): update all go dependencies main (main) (cilium/cilium#47498, @cilium-renovate[bot])
• fix(deps): update all go dependencies main (major) (main) (major) (cilium/cilium#47393, @cilium-renovate[bot])
• fix(deps): update module github.com/go-openapi/loads to v0.25.0 (main) (cilium/cilium#47480, @cilium-renovate[bot])
• fix(deps): update module google.golang.org/grpc to v1.82.1 [security] (main) (cilium/cilium#47420, @cilium-renovate[bot])
• Gateway API: the Gateway address status no longer reports a bogus "" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (cilium/cilium#47466, @locker95)
• gateway-api: report invalid HTTPRoute header modifiers in status (cilium/cilium#47599, @mhofstetter)
• gateway-api: unify Gateway API listener parentRef matching (cilium/cilium#46670, @arybolovlev)
• gh: Add Delta xDS test run (cilium/cilium#47211, @jrajahalme)
• gitattributes: Restore rST syntax highlighting for upgrade notes (cilium/cilium#47467, @HadrienPatte)
• ipam: Migrate PoolCIDR and UpsertPool to netip (cilium/cilium#47338, @HadrienPatte)
• loadbalancer: clustermesh: wire clustermesh epslice to lb reflector (cilium/cilium#46627, @MrFreezeex)
• Migrate Node.IPv{4,6}HealthIP and RoutingInfo.Configure to netip (cilium/cilium#47001, @HadrienPatte)
• Node IPAM now logs at info level the Nodes it excludes from load balancer selection (deletion, autoscaler taint, or exclude-from-external-load-balancers label). (cilium/cilium#46893, @icarosapucaia)
• node: Add transitional Prefix type for kvstore-safe netip migration (cilium/cilium#46929, @HadrienPatte)
• node: Migrate Node alloc-CIDR fields from *cidr.CIDR to netip (cilium/cilium#47253, @HadrienPatte)
• operator/endpointslice: context-related fixes (cilium/cilium#47189, @mauriciovasquezbernal)
• operator: Replace reflect.DeepEqual with assert.Equal in tests (cilium/cilium#47424, @HadrienPatte)
• pkg/bpf: introduce [bpf.IterableMap] interface to simplify mock testing (cilium/cilium#47084, @giorio94)
• plugins, examples: Remove extra whitespace from example files (cilium/cilium#47398, @jrife)
• policy: Reject bare IP addresses in CIDR policy fields (cilium/cilium#47150, @HadrienPatte)
• Prepare for v1.21 development cycle (cilium/cilium#46962, @joestringer)
• README: Update releases (cilium/cilium#47161, @joestringer)
• README: Update releases (cilium/cilium#47263, @joestringer)
• README: Update releases (cilium/cilium#47407, @joestringer)
• README: Update releases (cilium/cilium#47585, @aanm)
• Remove Algolia reference from the docs (cilium/cilium#46876, @xmulligan)
• Remove stale TODO comment in daemon/cmd/daemon_main.go (cilium/cilium#47399, @vanessachammas)
• Revert "bpf: conntrack: don't report SYN-ACK as 'observed SYN'" (cilium/cilium#47594, @julianwiedmann)
• secretsync: modernize annotation copy and fix codeowners (cilium/cilium#47207, @nezdolik)
• Update all github action dependencies (main) (cilium/cilium#47653, @cilium-renovate[bot])
• Update all github action dependencies (main) (cilium/cilium#47674, @cilium-renovate[bot])
• Update all-dependencies (main) (cilium/cilium#47654, @cilium-renovate[bot])
• Update all-dependencies (main) (cilium/cilium#47669, @cilium-renovate[bot])
• Update quay.io/goswagger/swagger Docker tag to v0.36.1 (main) (cilium/cilium#47652, @cilium-renovate[bot])

Known issues

The installation docs for this version contain the following installation command, which does not work:

$ cilium install 1.21.0-pre.0

To install correctly, please use the following command.

$ cilium install --version 1.21.0-pre.0

Docker Manifests

cilium

quay.io/cilium/cilium:v1.21.0-pre.0@sha256:86081047ee204fd4a720fdd8a6620efa0e13929f6c5376fb7ac73aea08de0f48

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.21.0-pre.0@sha256:b860bf0b0fd04a651f7d51ec0bf2c9d6068f3d466acfe43aa960017f60b054a6

hubble-relay

quay.io/cilium/hubble-relay:v1.21.0-pre.0@sha256:a2512b80359d21eedf16286ff9bbee811f7f42ab9219174f16a43b09faa10058

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.21.0-pre.0@sha256:e9f2a024f08213838f565decb2f28c64f50ce4efee68cced1a489568be84ecb1

operator-aws

quay.io/cilium/operator-aws:v1.21.0-pre.0@sha256:6c1902db9b43c6200b963ba103271a87bed91b852eb268ad784d1b89d43b5a72

operator-azure

quay.io/cilium/operator-azure:v1.21.0-pre.0@sha256:75212a2fa8170cad45aded7bdc54890643f95ad22a15354cc7af5a21cc5523d7

operator-generic

quay.io/cilium/operator-generic:v1.21.0-pre.0@sha256:b99e5621eec1c9f8b8306a494762b5efe906be1b84eba6704d70386d0142e24f

operator

quay.io/cilium/operator:v1.21.0-pre.0@sha256:791b25ac5fe32c850b8078c6c185027016bda7748e3658aab144d16ac6bb87e4

🎉 Release Announcement 🎉: We are excited to announce the Cilium 1.20.0 release!

More than 2,660 new commits have landed in this release, supported by a community of over 1,100 contributors and more than 24,800 GitHub stars! 🤩

⚠️ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the cilium.io/v2alpha1 CiliumNodeConfig API, the libnetwork integration, or a custom CNI configuration. See the Upgrade Guide for details.

The full changelog can be found here.

Here are some of the highlights:

• ⛩️ Gateway API

  • 🚀 Gateway API v1.6.1: Cilium moves from Gateway API v1.4 to v1.6.1, bringing support for capabilities that graduated across both upstream releases. (cilium/cilium#45251, @youngnick; cilium/cilium#46827, cilium/cilium#47274, @arybolovlev)
  • 👥 Delegate Gateway Listeners: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. (cilium/cilium#46303, cilium/cilium#46785, @asauber)
  • 🔏 Encrypt Traffic to Backends: Gateway API BackendTLSPolicy support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. (cilium/cilium#43045, @youngnick)
  • 🔀 TCPRoute and UDPRoute: Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic. (cilium/cilium#46184, cilium/cilium#46970, @eminaktas; cilium/cilium#47381, @arybolovlev)
  • 🔐 External Authorization: HTTPRoute requests can now be authenticated and authorized through an external service before they reach the application, using the Gateway API ExternalAuth filter from GEP-1494. (cilium/cilium#45739, @gauteoh)
  • 🎛️ More HTTP Traffic Controls: HTTPRoutes gain native CORS support and additional 303, 307 and 308 redirect codes. CiliumGatewayClassConfig can also overwrite, append or preserve the HTTP Server response header. (cilium/cilium#45924, @arybolovlev; cilium/cilium#47232, @youngnick; cilium/cilium#46764, @xtineskim)
  • ↔️ Configurable gRPC-Web Translation: CiliumGatewayClassConfig can disable automatic gRPC-web translation for Gateways that need to pass the original traffic through unchanged. Translation remains enabled by default. (cilium/cilium#45984, @thorn3r)

• 🚠 Networking

  • 🔌 Extensible Datapath: Datapath plugins let cloud providers extend or instrument Cilium's eBPF datapath with independently versioned programs, without maintaining a Cilium fork. (cilium/cilium#45028, cilium/cilium#45429, cilium/cilium#45558, cilium/cilium#46673, cilium/cilium#46872, @jrife)
  • 🚄 Automatic Netkit Selection: Set bpf.datapathMode=auto to use netkit automatically on supported kernels and fall back to veth on other nodes. The default remains veth. (cilium/cilium#43062, @ajmmm)
  • 📤 Egress Gateway Improvements: Dual-stack clusters can configure an explicit IPv6 egress IP. IPv4 Egress Gateway traffic also strictly honors the interface selected by the policy, matching the existing IPv6 behavior. (cilium/cilium#44524, @yykkibbb; cilium/cilium#45833, @julianwiedmann)
  • 🔍 Better BGP Tooling and Reconciliation: New Hive shell commands expose route policies and clearer peer output formats. The control plane moves to GoBGP v4.6.1 and optimizes route-policy reconciliation. (cilium/cilium#45628, cilium/cilium#45534, @martonra; cilium/cilium#45952, cilium/cilium#46928, @rastislavs)

• 🌐 IPAM and IP Selection

  • ☁️ IPv6 for AWS ENI IPAM (Beta): Cilium can now allocate IPv6 prefixes to pods through AWS ENI IPAM, building on the move to the multi-pool allocator. (cilium/cilium#46756, cilium/cilium#46619, @41ks; cilium/cilium#45154, cilium/cilium#45958, @HadrienPatte)
  • 🔄 Migrate to Multi-Pool IPAM: Existing clusters can move from cluster-pool IPAM to multi-pool IPAM without being rebuilt. (cilium/cilium#46104, @pippolo84)
  • 🧭 Dynamic NodePort Source Addresses: NodePort can use the kernel FIB to select the preferred source address dynamically before SNATing north-south traffic, on supported kernels. (cilium/cilium#44625, @ldelossa)
  • 🔵 Prefer IPv6 Consistently: The new top-level preferIpv6 option applies to both Cilium health probes and Hubble peer communication when IPv4 and IPv6 are available. (cilium/cilium#45447, @tibrezus)

• 🕸️ Services and Cluster Mesh

  • 📍 Topology-Aware Service Traffic: Cilium's service load balancer now supports the Kubernetes PreferSameZone and PreferSameNode traffic distribution hints. (cilium/cilium#44771, @raphink)
  • ⚖️ Weighted Maglev Backends: Maglev now honors the service.cilium.io/weight annotation on EndpointSlices. A weight of zero drains new connections while allowing existing connections to continue. (cilium/cilium#46061, @mhofstetter)
  • 🌉 More Load-Balancing Options with VXLAN: Clusters using VXLAN can use per-Service load-balancing mode annotations, including compatible DSR configurations such as IPIP dispatch. (cilium/cilium#45600, @brb)
  • 🤖 Stable MCS API Support: Cilium's implementation of the Kubernetes Multi-Cluster Services API is now stable and recommended for portable service discovery through ClusterMesh. (cilium/cilium#45404, cilium/cilium#46953, @MrFreezeex)

• 🔒 Encryption and Network Policy

  • 🚇 Improved Ztunnel Identity Management: The ztunnel path now supports either an internal certificate authority or SPIRE-issued workload identities, alongside new Prometheus metrics for enrollment and connection health. It transparently encrypts enrolled pod-to-pod connections, including traffic between pods on the same node. (cilium/cilium#43763, cilium/cilium#44275, cilium/cilium#44136, cilium/cilium#45861, @nddq; cilium/cilium#45096, @gokulMSFT)
  • 🛡️ Kubernetes ClusterNetworkPolicy (KCNP): Cilium now supports the upstream, cluster-scoped policy API, including Admin and Baseline policy tiers alongside namespaced Kubernetes NetworkPolicy. (cilium/cilium#42338, @TheBeeZee; cilium/cilium#46253, @aanm)
  • ⛔ Friendlier IPv6 Policy Denials: Cilium can return ICMPv6 Destination Unreachable responses when network policy denies IPv6 egress traffic, matching the IPv4 capability introduced in Cilium 1.19. (cilium/cilium#44234, @Andreagit97)
  • 🌐 Select the Entire Cluster Mesh: The new cluster-mesh policy entity selects every endpoint across a mesh, making cross-cluster security policies easier to express. (cilium/cilium#46813, @squeed)
  • ☁️ Standardize AWS VPC Group Policies: Policies that reference AWS VPC groups are now transformed into CiliumCIDRGroup resources, bringing external IP groups into the standard Cilium policy model. (cilium/cilium#44704, @squeed)
  • 🛂 Per-Pod Source IP Verification Control: Trusted workloads that need to send traffic with non-local source addresses can disable source IP verification through a pod annotation, guarded by a namespace-level opt-in. (cilium/cilium#43505, @zbb88888)

• ⚙️ Day 2 Operations and Observability

  • 🔧 Detect Configuration Drift: Cilium can expose how many ConfigMap settings an agent has not yet applied, making it easier to identify when a restart is required after a configuration change. (cilium/cilium#44703, @PhilipSchmid)
  • ⏱️ Understand Agent Start-Up Time: New Hive lifecycle and Kubernetes resource-sync metrics show how long individual resources and components take to initialize. (cilium/cilium#44802, cilium/cilium#44639, @ILL1A)
  • 🛰️ Correlate More Hubble Verdicts with Policies: Hubble can now identify the policy responsible for audit verdicts. (cilium/cilium#45373, @Rajneesh180)
  • 📊 Standalone DNS Proxy Metrics: The Standalone DNS Proxy now exports DNS metrics back through Cilium, improving visibility when DNS policy processing runs outside the agent. (cilium/cilium#45222, cilium/cilium#44601, @vipul-21)

• 🌅 Performance and Scale

  • 💾 Aggregated Load-Balancer State: Cilium's internal backend representation has been flattened to efficiently support thousands of Services that share the same backends. (cilium/cilium#44511, @joamaki)
  • 📡 More Efficient Envoy Updates: New ADS and Delta xDS modes provide consistent or incremental delivery of Envoy resources, reducing CPU usage and policy update latency. (cilium/cilium#43887, @nezdolik; cilium/cilium#45288, @jrajahalme)
  • 🗂️ Optimized BPF Policy Map Encoding: Semantic wildcard identities for remote-node and world reduce BPF policy-map pressure, particularly in larger clusters. (cilium/cilium#46438, @squeed)
  • 📦 Smaller CNI Binary: The cilium-cni binary has been reduced from roughly 77 MB to 16 MB, shrinking both the Cilium image and its footprint on every node. (cilium/cilium#45845, @giorio94)
  • 🛠️ Updated Dependencies and Foundations: Cilium 1.20 updates to Kubernetes v1.36, Envoy v1.37.x, Gateway API v1.6.1, GoBGP v4.6.1 and MCS API v0.5.2. Runtime and builder images now use Ubuntu 26.04, and the default CNI configuration version moves from 0.3.1 to 1.0.0. (cilium/cilium#45499, cilium/cilium#47215, @HadrienPatte; cilium/cilium#45851, @sayboras; cilium/cilium#47274, @arybolovlev; cilium/cilium#45952, @rastislavs; cilium/cilium#47166, @MrFreezeex; cilium/cilium#46971, @gandro)

• 🏠 Community

  • ❤️ Production Case Studies: Many end-users have told their stories running Cilium in production. Read and watch more from: Asana, Etraveli, Michelin, OpenAI, Suse, Telefónica's acens, and Zynga. If your company wants to submit their case studies let us know. We would love to hear your feedback!
  • 🇳🇱 Amsterdam Events: The community gathered at CiliumCon and Cilium Developer Summit in Amsterdam. Watch the talks from CiliumCon.
  • 🇺🇸 Salt Lake City Events: Meet us at the upcoming CiliumCon and Cilium Developer Summit at KubeCon + CloudNativeCon North America in Salt Lake City, November 9-12.
  • 🤖 Generative AI Policy: The Cilium community adopted a Generative AI Policy that encourages community members to connect and communicate with one another without the use of AI, while recognizing that different people work best with their own tools of choice.
  • 📚 Cilium Books: Two new books landed for readers at every level — Cilium: Up and Running (O'Reilly), a practitioner's deep dive and Buzzing Beyond Clouds: The Illustrated Children's Guide to Cilium, the follow-up to the eBPF children's guide.

❤️ Thank You: Cilium 1.20 was made possible by contributors, reviewers and maintainers from across the community, including engineers from Datadog, Google, Microsoft and many other organizations.

To keep up to date with all the latest Cilium releases, join #release 🎉

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93 quay.io/cilium/cilium:stable@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.0@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92 quay.io/cilium/clustermesh-apiserver:stable@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92

hubble-relay

quay.io/cilium/hubble-relay:v1.20.0@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94 quay.io/cilium/hubble-relay:stable@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.0@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9 quay.io/cilium/operator-alibabacloud:stable@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9

operator-aws

quay.io/cilium/operator-aws:v1.20.0@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa quay.io/cilium/operator-aws:stable@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa

operator-azure

quay.io/cilium/operator-azure:v1.20.0@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c quay.io/cilium/operator-azure:stable@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c

operator-generic

quay.io/cilium/operator-generic:v1.20.0@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3 quay.io/cilium/operator-generic:stable@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3

operator

quay.io/cilium/operator:v1.20.0@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c quay.io/cilium/operator:stable@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c

Summary of Changes

Major Changes:

• Cilium's Beta Mutual Auth support is now deprecated and will be removed in a future version. (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47162, @youngnick)
• clustermesh: promote Multi-Cluster Services API (MCS-API) to a stable support level and improve its documentation (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#46953, @MrFreezeex)

Minor Changes:

• envoy: reject CECs with duplicate filter chains (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#46848, @asauber)
• Gateway API: Add HTTP Server header transformation support (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#46764, @xtineskim)
• gateway-api: Cilium now supports the additional redirect codes 303, 307, and 308 for HTTPRoute redirects. (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47232, @youngnick)
• helm: Avoid operator roles, secret creation in preflight (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#47053, @joestringer)
• images: Update runtime and builder images base to ubuntu 26.04 (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47215, @HadrienPatte)

Bugfixes:

• datapath/linux: Unsubscribe node handler on shutdown (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47197, @HadrienPatte)
• datapath: Fix masquerade IP selection with route-discovered node addresses (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#46843, @tsotne95)
• datapath: relax strict ingress to allow hostport (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#47200, @rgo3)
• doublewrite: Don't run CRD backend with real handler when reading from KVStore (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#47144, @HadrienPatte)
• Fix bug causing Cilium to intercept traffic towards LoadBalancer VIPs when KPR is disabled, when the traffic should be delegated to kube-proxy. (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47204, @ajmmm)
• Fix bug where BGP Migration may deadlock (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#46897, @weizhoublue)
• Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#46967, @ysksuzuki)
• fix(policy): add cluster-mesh to the Entity enum validation (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47225, @doniacld)
• gateway-api: fix redirect guards affecting route ordering for similar HTTPRoute matches. (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#46884, @arybolovlev)
• gateway-api: include ext auth into HTTPRoute checks (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47265, @mhofstetter)
• gateway-api: watch backend Service changes for tcp&udp routes (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47239, @mhofstetter)
• gateway-api: watch ServiceImport refs from GRPCRoutes (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47268, @mhofstetter)
• operator/endpointslice: Fix races on defaultController (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47102, @mauriciovasquezbernal)
• operator: Fix nil-pointer panic in CiliumNode GC (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#47127, @HadrienPatte)

CI Changes:

• .github: fix conformance-ginkgo sysdump artifact upload path (Backport PR cilium/cilium#47291, Upstream PR cilium/cilium#47187, @aanm)
• .github: retry CLI and binary downloads over transient network errors (Backport PR cilium/cilium#47291, Upstream PR cilium/cilium#47167, @aanm)
• .github: select a usable AZ for EKS us-west-1 (Backport PR cilium/cilium#47291, Upstream PR cilium/cilium#47168, @aanm)
• ci: wait for all AKS nodes to register before labeling nodes-without-cilium (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47270, @aanm)
• conformance-aws-cni: skip l7 and fqdn tests by name on chaining mode (Backport PR cilium/cilium#47291, Upstream PR cilium/cilium#47269, @aanm)
• egressgw: remove redundant rp_filter assertion from privileged test (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47106, @Avr8)
• envoy: add ads locality test (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#47032, @viktor-kurchenko)
• gha/e2e: cover etcd behind a service (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47235, @giorio94)
• gha: dump nodegroup CloudFormation failure events on create failure (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47298, @aanm)
• gha: stop scheduled runs emitting spurious artifact warnings (Backport PR cilium/cilium#47291, Upstream PR cilium/cilium#46989, @aanm)
• policy/compute: Fix flaky TestRecomputeIdentityPolicy (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#47101, @christarazi)
• test/cyclonus: drop --fail-fast so a policy failure can't crash the run (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47272, @aanm)
• test/helpers: allowlist renamed leader-election lease-lock retrieval error (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47249, @aanm)

Misc Changes:

• .github: allow fork PR checkout with actions/checkout v7 (Backport PR cilium/cilium#47173, Upstream PR cilium/cilium#47133, @aanm)
• [v1.20] Revert "routing: add hybrid routing mode support" (cilium/cilium#47373, @joestringer)
• Add an example datapath plugin. (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#46872, @jrife)
• bgp: Optimize route policy reconciliation to reduce unnecessary processing on the cilium agent (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#46928, @rastislavs)
• bugtool: collect snmp6 and dev_snmp6 for IPv6 host packet drops (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47353, @aanm)
• chore(deps): update all github action dependencies (v1.20) (cilium/cilium#47320, @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.6 (v1.20) (cilium/cilium#47339, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.5 docker digest to 3aff665 (v1.20) (cilium/cilium#47314, @cilium-renovate[bot])
• chore(deps): update gcr.io/distroless/static:nonroot docker digest to f7f8f72 (v1.20) (cilium/cilium#47315, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.8 (v1.20) (cilium/cilium#47317, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (cilium/cilium#47318, @cilium-renovate[bot])
• docs/clustermesh: remove obsolete reference to service cache (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47195, @giorio94)
• docs: Add "action required" release notes for 1.20 (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47372, @joestringer)
• docs: egressgw: clarify egress interface/IP selection (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47185, @julianwiedmann)
• docs: mark TCPRoute/UDPRoute as unsupported under host network mode (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47171, @PhilipSchmid)
• docs: Update NetworkPolicy and ClusterNetworkPolicy documentation (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47227, @TheBeeZee)
• egressgw: use node-addresses table to resolve EgressIPs (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47350, @julianwiedmann)
• fix(deps): update k8s.io/utils digest to cf1189d (v1.20) (cilium/cilium#47316, @cilium-renovate[bot])
• Fix: Prune Removed ParentRefs During L4 Route Status Reconciliation (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47160, @weizhoublue)
• gateway-api(deps): bump upstream dependencies to v1.6.1. (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47274, @arybolovlev)
• gateway-api: Add TCP and UDP gateway conformance profiles (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47381, @arybolovlev)
• gateway-api: cleanup hardcoded Cilium GatewayClass controllerclass (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47210, @mhofstetter)
• gateway-api: drop redundant TLS secret watch predicate (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47240, @mhofstetter)
• gha: capture per-pod diagnostics for sig-network conntrack UDP NodePort failures (Backport PR cilium/cilium#47291, Upstream PR cilium/cilium#47140, @aanm)
• gha: fix features-tested warnings for l7-perf and mcs-api (Backport PR cilium/cilium#47291, Upstream PR cilium/cilium#47172, @aanm)
• images ci: free preinstalled toolchains on tight runners before building (Backport PR cilium/cilium#47291, Upstream PR cilium/cilium#47141, @aanm)
• pkg/loadbalancer: add hidden --bpf-lb-enable-wildcard-entries flag (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#46647, @ajmmm)
• Policy: Use separate placeholder identities for aggregation (Backport PR cilium/cilium#47256, Upstream PR cilium/cilium#47216, @squeed)
• Reformat upgrade docs for v1.21+ (Backport PR cilium/cilium#47257, Upstream PR cilium/cilium#47192, @joestringer)
• resource: fix possible goroutine leak in filtered resource (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47129, @giorio94)
• Revert restore-path policy map changes (#46927, #47062, #47075) (Backport PR cilium/cilium#47201, Upstream PR cilium/cilium#47202, @aanm)
• vendor: sync mcs-api to v0.5.2 tag instead of hash pinning (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#47166, @MrFreezeex)

Other Changes:

• install: Update image digests for v1.20.0-rc.0 (cilium/cilium#47158, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.0-rc.1@sha256:d552b4daced018e2e7226676a49cc559875a0700fb5615487ae42a1ef144d7c1

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.0-rc.1@sha256:4ba24eec61ba533f1dc21d1aa090c271adf74e647e658edd6bd8d5621626ef11

hubble-relay

quay.io/cilium/hubble-relay:v1.20.0-rc.1@sha256:89aa40b188e6a0a9853e91585d6e4e523d314702bbe6bbf47c665bd7b4de0956

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.0-rc.1@sha256:8650459b08038fad5c37b29af4d00fb1c42f1dbe24d76f5895453295be0462bc

operator-aws

quay.io/cilium/operator-aws:v1.20.0-rc.1@sha256:4853a31e1bef9a39f5d088d97aa490134a432b3151d17835cc7eca5b4f0e9db4

operator-azure

quay.io/cilium/operator-azure:v1.20.0-rc.1@sha256:f33370df60af802d67ad4ab305cf86d267e9edef1da7f7612d618d0c0c38a4a6

operator-generic

quay.io/cilium/operator-generic:v1.20.0-rc.1@sha256:6367acf5da879bbada1f31c80d1ccd5d9ac53a7d4b3392178462d50579a4d2e2

operator

quay.io/cilium/operator:v1.20.0-rc.1@sha256:89a45547da41fa70dd565312e7457ad2a0f2bd0eb8d988b2f04a7b0ad0cf8806

Summary of Changes

Minor Changes:

• datapath/l2responder: use l3 sockets for solicited node multicast signaling (Backport PR cilium/cilium#46845, Upstream PR cilium/cilium#46332, @bersoare)
• gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR cilium/cilium#46933, Upstream PR cilium/cilium#46403, @arybolovlev)

Bugfixes:

• [v1.19] Fix policy service label selector handling (cilium/cilium#46946, @fristonio)
• bpf: fix ipv6 neighbor solicitation handling in host firewall (Backport PR cilium/cilium#46669, Upstream PR cilium/cilium#46325, @atykhyy)
• doublewrite: Don't run CRD backend with real handler when reading from KVStore (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#47144, @HadrienPatte)
• endpoint: Fix race when reading endpoint properties (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#46991, @gandro)
• Fix cilium_operator_unmanaged_pods gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (Backport PR cilium/cilium#46975, Upstream PR cilium/cilium#46668, @Suyash1700)
• Fix a bug which could lead to stale hostport entries if a pod was deleted and immediately recreated in host network. (Backport PR cilium/cilium#46793, Upstream PR cilium/cilium#46747, @giorio94)
• Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (Backport PR cilium/cilium#46974, Upstream PR cilium/cilium#46927, @aanm)
• Fix allowedRoute namespace and kind restrictions on multi-listener Gateways. (Backport PR cilium/cilium#46826, Upstream PR cilium/cilium#45693, @eufriction)
• Fix bug that left the host firewall enabled in the live ConfigMap when disabling hostFirewall.enabled (toggling it from true to false) via Helm. (Backport PR cilium/cilium#46669, Upstream PR cilium/cilium#44748, @shibaPuppy)
• Fix ClusterMesh service affinity annotation service.cilium.io/affinity: "none" incorrectly dropping all remote backends, causing traffic blackhole when no local endpoints exist. (Backport PR cilium/cilium#46691, Upstream PR cilium/cilium#46635, @mkamadeus)
• Fix ctmap gc duration metric recording (Backport PR cilium/cilium#46975, Upstream PR cilium/cilium#46873, @fristonio)
• Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR cilium/cilium#47002, Upstream PR cilium/cilium#46821, @fristonio)
• Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#46967, @ysksuzuki)
• Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#46444, @giorio94)
• Fix the UDP tunnel check in the BIG TCP probe. (Backport PR cilium/cilium#46793, Upstream PR cilium/cilium#46710, @gentoo-root)
• Fixes a bug where Hubble policy correlation does not work for port ranges. (Backport PR cilium/cilium#46793, Upstream PR cilium/cilium#46643, @squeed)
• gateway-api: Add Gateway check for when hostNetwork is enabled (Backport PR cilium/cilium#46837, Upstream PR cilium/cilium#46350, @xtineskim)
• gateway-api: Each HTTPS and TLS passthrough port now receives its own Envoy listener and RouteConfiguration. (Backport PR cilium/cilium#46826, Upstream PR cilium/cilium#44889, @eufriction)
• ipam/multi-pool: Do now wait for zero prealloc request (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#46867, @pippolo84)
• operator: Fix nil-pointer panic in CiliumNode GC (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#47127, @HadrienPatte)

CI Changes:

• .github: Generate CI binaries with correct module version (Backport PR cilium/cilium#47099, Upstream PR cilium/cilium#46742, @joestringer)
• chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR cilium/cilium#46920, Upstream PR cilium/cilium#46840, @sekhar-isovalent)
• ci: Auth to image registry in clustermesh upgrade workflow (Backport PR cilium/cilium#46691, Upstream PR cilium/cilium#46632, @nebril)
• ci: Remove merge_group from tests-smoke-conformance.yaml (Backport PR cilium/cilium#46888, Upstream PR cilium/cilium#46451, @nebril)
• Fix workflow change detection for single-commit PRs to main (Backport PR cilium/cilium#46793, Upstream PR cilium/cilium#46684, @Demiserular)
• Further GC ratchet test fix races (Backport PR cilium/cilium#47224, Upstream PR cilium/cilium#43075, @tommyp1ckles)

Misc Changes:

• (minor) docs: update reference to aws-cli image (Backport PR cilium/cilium#46975, Upstream PR cilium/cilium#46923, @squeed)
• .github: allow fork PR checkout with actions/checkout v7 (Backport PR cilium/cilium#47135, Upstream PR cilium/cilium#47133, @aanm)
• [v1.19] - .github/workflows: unpin cilium/cilium self-references to track main (cilium/cilium#46613, @aanm)
• [v1.19] - Reapply ".github/workflows: do not use deployments for environments" (cilium/cilium#46574, @aanm)
• [v1.19] vendor: bump github.com/cilium/statedb to v0.5.9 (cilium/cilium#47083, @giorio94)
• bgp: fix status condition reporting: update reasons to accurately reflect current condition state (Backport PR cilium/cilium#46920, Upstream PR cilium/cilium#46383, @martonra)
• bpf: Condition ICMP SNAT on BPF masquerading and inter-cluster SNAT (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#47021, @pchaigno)
• chore(deps): update all github action dependencies (v1.19) (cilium/cilium#46658, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (cilium/cilium#46908, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (cilium/cilium#47109, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (cilium/cilium#46906, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (cilium/cilium#47045, @cilium-renovate[bot])
• chore(deps): update aws-actions/configure-aws-credentials action to v6.2.2 (v1.19) (cilium/cilium#47124, @cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (cilium/cilium#46774, @cilium-renovate[bot])
• chore(deps): update base-images to v1.25.12 (v1.19) (cilium/cilium#46982, @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.5 (v1.19) (cilium/cilium#46726, @cilium-renovate[bot])
• chore(deps): update docker.io/library/alpine docker tag to v3.23.5 (v1.19) (cilium/cilium#46773, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.11 docker digest to 00feed3 (v1.19) (cilium/cilium#46657, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.6 (v1.19) (cilium/cilium#47039, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc (v1.19) (cilium/cilium#46700, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/image-tester docker tag to v1783861476 (v1.19) (cilium/cilium#47122, @cilium-renovate[bot])
• chore: BYOCNI loopback for cilium (Backport PR cilium/cilium#46691, Upstream PR cilium/cilium#46646, @sekhar-isovalent)
• chore: optimize building gops and cni/loopback (Backport PR cilium/cilium#46845, Upstream PR cilium/cilium#46781, @sekhar-isovalent)
• ci: always set fail-fast to false on image builds (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#47064, @aanm)
• ci: remove non-ariane workflows from config (Backport PR cilium/cilium#46845, Upstream PR cilium/cilium#46787, @nebril)
• clustermesh: add reusable backend selector constructor (Backport PR cilium/cilium#46691, Upstream PR cilium/cilium#45648, @viktor-kurchenko)
• docs: clarify Hubble static/dynamic exporter file rotation settings (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#47026, @maksymbilokur-cisco)
• docs: fix note about ipv4-native-routing-cidr default value (Backport PR cilium/cilium#46793, Upstream PR cilium/cilium#46603, @rptaylor)
• Egress Gateway: handle nil events (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#46476, @tommyp1ckles)
• endpoint: reap restart-preserved policy map entries once ready (Backport PR cilium/cilium#47063, Upstream PR cilium/cilium#47062, @aanm)
• endpoint: sync desired policy before reload on the restore path (restore-path hardening) (Backport PR cilium/cilium#47076, Upstream PR cilium/cilium#47075, @aanm)
• Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR cilium/cilium#46793, Upstream PR cilium/cilium#46388, @tommyp1ckles)
• Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR cilium/cilium#46845, Upstream PR cilium/cilium#46388, @tommyp1ckles)
• fix(deps): update k8s.io/utils digest to be93311 (v1.19) (cilium/cilium#46907, @cilium-renovate[bot])
• fix(deps): update k8s.io/utils digest to cf1189d (v1.19) (cilium/cilium#47115, @cilium-renovate[bot])
• Fixed Gateway API reconciler incorrectly reporting "Accepted HTTPRoute" in the status condition message for GRPCRoute and TLSRoute resources. (Backport PR cilium/cilium#46826, Upstream PR cilium/cilium#44962, @eufriction)
• gateway-api: return model from Gateway API ingestion (Backport PR cilium/cilium#46933, Upstream PR cilium/cilium#46450, @arybolovlev)
• gha: fail fast in external-target provisioning scripts instead of swallowing failures (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#47085, @aanm)
• Improve cilium-dbg status output of module health (Backport PR cilium/cilium#46845, Upstream PR cilium/cilium#46739, @joestringer)
• loadbalancer: proxy ports are now resolved per frontend instead of per service, preventing one port from losing its L7 redirect when multiple listeners share a service. (Backport PR cilium/cilium#46826, Upstream PR cilium/cilium#45949, @eufriction)
• loadbalancer: validate DSR dispatch configuration globally (Backport PR cilium/cilium#46793, Upstream PR cilium/cilium#45545, @FelipeYepez)
• Makefile: Generate full Cilium version in worktree (Backport PR cilium/cilium#46793, Upstream PR cilium/cilium#46737, @joestringer)
• Revert restore-path policy map changes (#46927, #47062, #47075) (Backport PR cilium/cilium#47213, Upstream PR cilium/cilium#47202, @aanm)
• Upgraded cilium/ebpf to version v0.22.0 (Backport PR cilium/cilium#46845, Upstream PR cilium/cilium#46783, @dylandreimerink)

Other Changes:

• install: Update image digests for v1.19.5 (cilium/cilium#46593, @cilium-release-bot[bot])
• v1.19: gateway-api: fix sds secrets in golden tests (cilium/cilium#47229, @0xch4z)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.6@sha256:accab5fe6ab7134fcd6f916acc9e4c785382a022128ae5495ec4a45fbe18c9a6

docker-plugin

quay.io/cilium/docker-plugin:v1.19.6@sha256:81a8d37e541edfff4016037373853e8e875f1ea0433c58b9ab54b314c305b9ec

hubble-relay

quay.io/cilium/hubble-relay:v1.19.6@sha256:6782a49e3f28eba015701c4410a5ec7fa096fe9a562f879b4372dbecd827ea44

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.6@sha256:031e332cdec61a9ebaca42f044e7e2f5b876ba96ac0ccf1d42acd5954779efaf

operator-aws

quay.io/cilium/operator-aws:v1.19.6@sha256:546d13ac511cf82441b5e9e99e03d0e054b788513ceb1a883e620b8284d5ccc3

operator-azure

quay.io/cilium/operator-azure:v1.19.6@sha256:e555430b7f5e4c407daab1afbec3c431ec016a53f1f1b848f67b9242cd3adedd

operator-generic

quay.io/cilium/operator-generic:v1.19.6@sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665

operator

quay.io/cilium/operator:v1.19.6@sha256:37e36840be5a0882a9a065b2308859785e960a742aed0aeac794e0ac4aabdf90

Summary of Changes

Minor Changes:

• gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR cilium/cilium#47016, Upstream PR cilium/cilium#46403, @arybolovlev)

Bugfixes:

• Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR cilium/cilium#47003, Upstream PR cilium/cilium#46821, @fristonio)
• Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service (Backport PR cilium/cilium#47196, Upstream PR cilium/cilium#46444, @giorio94)
• gateway-api: Add Gateway check for when hostNetwork is enabled (Backport PR cilium/cilium#46838, Upstream PR cilium/cilium#46350, @xtineskim)
• ipam/multi-pool: Do now wait for zero prealloc request (Backport PR cilium/cilium#47196, Upstream PR cilium/cilium#46867, @pippolo84)

CI Changes:

• .github: Generate CI binaries with correct module version (Backport PR cilium/cilium#47098, Upstream PR cilium/cilium#46742, @joestringer)
• chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR cilium/cilium#46921, Upstream PR cilium/cilium#46840, @sekhar-isovalent)

Misc Changes:

• .github: allow fork PR checkout with actions/checkout v7 (Backport PR cilium/cilium#47136, Upstream PR cilium/cilium#47133, @aanm)
• [v1.18] - .github/workflows: unpin cilium/cilium self-references to track main (cilium/cilium#46612, @aanm)
• chore(deps): update all github action dependencies (v1.18) (cilium/cilium#46912, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (cilium/cilium#47111, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.18) (cilium/cilium#46909, @cilium-renovate[bot])
• chore(deps): update aws-actions/configure-aws-credentials action to v6.2.2 (v1.18) (cilium/cilium#47125, @cilium-renovate[bot])
• chore(deps): update base-images (v1.18) (cilium/cilium#46776, @cilium-renovate[bot])
• chore(deps): update base-images to v1.25.12 (v1.18) (cilium/cilium#46983, @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.5 (v1.18) (cilium/cilium#46727, @cilium-renovate[bot])
• chore(deps): update docker.io/library/alpine docker tag to v3.22.5 (v1.18) (cilium/cilium#46775, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.11 docker digest to 00feed3 (v1.18) (cilium/cilium#46659, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.11 docker digest to f188e8c (v1.18) (cilium/cilium#46910, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.12 docker digest to d7912ce (v1.18) (cilium/cilium#47110, @cilium-renovate[bot])
• chore(deps): update gcr.io/distroless/static:nonroot docker digest to d29e660 (v1.18) (cilium/cilium#47040, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.6 (v1.18) (cilium/cilium#47041, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc (v1.18) (cilium/cilium#46701, @cilium-renovate[bot])
• chore: BYOCNI loopback for cilium (Backport PR cilium/cilium#46706, Upstream PR cilium/cilium#46646, @sekhar-isovalent)
• chore: optimize building gops and cni/loopback (Backport PR cilium/cilium#46846, Upstream PR cilium/cilium#46781, @sekhar-isovalent)
• ci: always set fail-fast to false on image builds (Backport PR cilium/cilium#47196, Upstream PR cilium/cilium#47064, @aanm)
• docs: clarify Hubble static/dynamic exporter file rotation settings (Backport PR cilium/cilium#47196, Upstream PR cilium/cilium#47026, @maksymbilokur-cisco)
• docs: fix note about ipv4-native-routing-cidr default value (Backport PR cilium/cilium#46794, Upstream PR cilium/cilium#46603, @rptaylor)
• Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR cilium/cilium#46794, Upstream PR cilium/cilium#46388, @tommyp1ckles)
• fix(deps): update k8s.io/utils digest to be93311 (v1.18) (cilium/cilium#46911, @cilium-renovate[bot])
• fix(deps): update k8s.io/utils digest to cf1189d (v1.18) (cilium/cilium#47116, @cilium-renovate[bot])
• gateway-api: return model from Gateway API ingestion (Backport PR cilium/cilium#47016, Upstream PR cilium/cilium#46450, @arybolovlev)
• gha: fail fast in external-target provisioning scripts instead of swallowing failures (Backport PR cilium/cilium#47196, Upstream PR cilium/cilium#47085, @aanm)
• images ci: free preinstalled toolchains on tight runners before building (Backport PR cilium/cilium#47196, Upstream PR cilium/cilium#47141, @aanm)
• images: Only build gops for the relevant platform (Backport PR cilium/cilium#46706, Upstream PR cilium/cilium#41160, @HadrienPatte)
• Makefile: Generate full Cilium version in worktree (Backport PR cilium/cilium#46794, Upstream PR cilium/cilium#46737, @joestringer)

Other Changes:

• install: Update image digests for v1.18.11 (cilium/cilium#46592, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.12@sha256:94149589d9b77fe3a78f900121b36fab51b1ede0c4190924e2328facc37de210

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.12@sha256:29ae8a306bfa644b5a5e305a50dc54d7461ae173a3361d1b1ab6c2aade346a71

docker-plugin

quay.io/cilium/docker-plugin:v1.18.12@sha256:cf931f0713ba15696553b71e4aae719747a6f137631e41760f5b0ac83ebd5b58

hubble-relay

quay.io/cilium/hubble-relay:v1.18.12@sha256:308b186791faf8a8a9322ce64d2e12f66fa82a3f4659e7a79b31829b6195df61

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.12@sha256:c2b3ed511cd5193f51888cc36ec699151685d92b28c9bcd975ec1c1011653f37

operator-aws

quay.io/cilium/operator-aws:v1.18.12@sha256:da54cc50e76e6439205c2816b29a791c09584de5f60a39ae2821d471eabe78f8

operator-azure

quay.io/cilium/operator-azure:v1.18.12@sha256:b435e3e41629ffea2687e58c7be6dfb29b4862ca0b517990ae40fe1effb36044

operator-generic

quay.io/cilium/operator-generic:v1.18.12@sha256:86899c73438812b2761ac6fa435ea4e65f68e70d1ae54ac806fec8805d1ce011

operator

quay.io/cilium/operator:v1.18.12@sha256:2ad7a424177b025f011d60fa279ce9bd6b3fe471626656cde0e9de126ae38cc1

Summary of Changes

Bugfixes:

• Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR cilium/cilium#47006, Upstream PR cilium/cilium#46821, @fristonio)
• ipam/multi-pool: Do now wait for zero prealloc request (Backport PR cilium/cilium#47199, Upstream PR cilium/cilium#46867, @pippolo84)

CI Changes:

• .github: Generate CI binaries with correct module version (Backport PR cilium/cilium#47097, Upstream PR cilium/cilium#46742, @joestringer)
• chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR cilium/cilium#46922, Upstream PR cilium/cilium#46840, @sekhar-isovalent)
• v1.17: ariane: Remove Conformance AKS (cilium/cilium#47145, @pchaigno)
• v1.17: workflows: Remove coverage for AKS (cilium/cilium#46998, @pchaigno)

Misc Changes:

• .github: allow fork PR checkout with actions/checkout v7 (Backport PR cilium/cilium#47137, Upstream PR cilium/cilium#47133, @aanm)
• [v1.17] - .github/workflows: unpin cilium/cilium self-references to track main (cilium/cilium#46611, @aanm)
• [v1.17] - Reapply ".github/workflows: do not use deployments for environments" (cilium/cilium#46576, @aanm)
• chore(deps): update all github action dependencies (v1.17) (cilium/cilium#46660, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.17) (cilium/cilium#46778, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.17) (cilium/cilium#46916, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.17) (cilium/cilium#47113, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.17) (cilium/cilium#46913, @cilium-renovate[bot])
• chore(deps): update aws-actions/configure-aws-credentials action to v6.2.2 (v1.17) (cilium/cilium#47126, @cilium-renovate[bot])
• chore(deps): update base-images to v1.25.12 (v1.17) (cilium/cilium#46984, @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.5 (v1.17) (cilium/cilium#46728, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.11 docker digest to 00feed3 (v1.17) (cilium/cilium#46661, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.11 docker digest to 995e25c (v1.17) (cilium/cilium#46777, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.11 docker digest to f188e8c (v1.17) (cilium/cilium#46914, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.12 docker digest to d7912ce (v1.17) (cilium/cilium#47112, @cilium-renovate[bot])
• chore(deps): update gcr.io/distroless/static:nonroot docker digest to d29e660 (v1.17) (cilium/cilium#47042, @cilium-renovate[bot])
• chore(deps): update google/cloud-sdk docker tag to v573 (v1.17) (cilium/cilium#46667, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.6 (v1.17) (cilium/cilium#47043, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc (v1.17) (cilium/cilium#46702, @cilium-renovate[bot])
• chore: BYOCNI loopback for cilium (Backport PR cilium/cilium#46707, Upstream PR cilium/cilium#46646, @sekhar-isovalent)
• chore: optimize building gops and cni/loopback (Backport PR cilium/cilium#46847, Upstream PR cilium/cilium#46781, @sekhar-isovalent)
• ci: always set fail-fast to false on image builds (Backport PR cilium/cilium#47199, Upstream PR cilium/cilium#47064, @aanm)
• docs: fix note about ipv4-native-routing-cidr default value (Backport PR cilium/cilium#46795, Upstream PR cilium/cilium#46603, @rptaylor)
• Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR cilium/cilium#46795, Upstream PR cilium/cilium#46388, @tommyp1ckles)
• fix(deps): update k8s.io/utils digest to be93311 (v1.17) (cilium/cilium#46915, @cilium-renovate[bot])
• fix(deps): update k8s.io/utils digest to cf1189d (v1.17) (cilium/cilium#47117, @cilium-renovate[bot])
• images ci: free preinstalled toolchains on tight runners before building (Backport PR cilium/cilium#47199, Upstream PR cilium/cilium#47141, @aanm)
• images: Only build gops for the relevant platform (Backport PR cilium/cilium#46707, Upstream PR cilium/cilium#41160, @HadrienPatte)
• Makefile: Generate full Cilium version in worktree (Backport PR cilium/cilium#46795, Upstream PR cilium/cilium#46737, @joestringer)

Other Changes:

• install: Update image digests for v1.17.17 (cilium/cilium#46591, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.17.18@sha256:2f2c611db8de2f9c4846ee80fa3371617218dcd0cce42cf0d7d40b4d06458a23

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.18@sha256:55d0c9c2f282c305bfa7476923e98863ea0a4d5b3f159bf4ece9d782275dd9a4

docker-plugin

quay.io/cilium/docker-plugin:v1.17.18@sha256:387ff37fcf944a167ae0fdde77449cf20fe5b6494046a33709974f32e6794619

hubble-relay

quay.io/cilium/hubble-relay:v1.17.18@sha256:b7b5bc482d0dd7087e044a6bedfbd9f1dc946b2bc41d4bc420715a0378d972cc

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.18@sha256:e3b0e541717591b2e92bbd129d1da8f4636ae2be148a52c275c1a6b2f080ac0a

operator-aws

quay.io/cilium/operator-aws:v1.17.18@sha256:425a69265c17dc3482fce364ff7ea5e0d5fe721b5d439644b1bc6a8f148298fb

operator-azure

quay.io/cilium/operator-azure:v1.17.18@sha256:b4dfc72d84942de62ccbbedfde4fb242a85026f4c724d43b5da03e9727aeaf4e

operator-generic

quay.io/cilium/operator-generic:v1.17.18@sha256:ec68d574d2288f2d8cb0ae50778c1a0b08a6165cfcb6ba5bc5595d99ed3f7bda

operator

quay.io/cilium/operator:v1.17.18@sha256:f460bbe0eebdb2e013ada724d1eb47ad7be260503d36eb110c7f26d8e740f31f

Summary of Changes

Minor Changes:

• Adds a new policy entity, cluster-mesh, which selects all endpoints in all meshed clusters. Also, makes the cluster and cluster-mesh create significantly fewer policy map entries. (cilium/cilium#46813, @squeed)
• docs: add ListenerSet documentation (cilium/cilium#46850, @asauber)
• The default CNI configuration version has been bumped from 0.3.1 to 1.0.0. Use the cni.customConf Helm value to set it back to 0.3.1 if needed. (cilium/cilium#46971, @gandro)

Bugfixes:

• endpoint: Fix race when reading endpoint properties (cilium/cilium#46991, @gandro)
• Fix cilium_operator_unmanaged_pods gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (cilium/cilium#46668, @Suyash1700)
• Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (cilium/cilium#46927, @aanm)
• Fix ctmap gc duration metric recording (cilium/cilium#46873, @fristonio)
• Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (cilium/cilium#46821, @fristonio)
• Fix regression preventing Cilium from starting when configured in kvstore mode with KPR disabled, if etcd is behind a Kubernetes service (cilium/cilium#46444, @giorio94)
• fix: handle IPv6 subtraction borrow to avoid pool fragmentation (cilium/cilium#47011, @weizhoublue)
• Fixes an issue where invalid regex on an HTTPRoute or GRPCRoute matcher is accepted but causes Envoy to NACK (cilium/cilium#47005, @0xch4z)
• ipam/multi-pool: Do now wait for zero prealloc request (cilium/cilium#46867, @pippolo84)

CI Changes:

• .github: Generate CI binaries with correct module version (cilium/cilium#46742, @joestringer)
• .github: Revert pull_request_target to actions/checkout v6 (cilium/cilium#46940, @joestringer)
• .github: Revert workflow_call to actions/checkout v6 (cilium/cilium#46943, @joestringer)
• ariane: Fix v1.20 image build dependency (cilium/cilium#47153, @joestringer)
• bpf/Makefile: Simplify and fix MAX_*_OPTIONS (cilium/cilium#46852, @pchaigno)
• ci: Add ORGANIZATION_STAGING for stable tags (cilium/cilium#46954, @nebril)
• ci: conditional on registry authentication (cilium/cilium#47037, @Artyop)
• ci: keep AKS nodes-without-cilium ready to stop auto-repair reboots (cilium/cilium#46942, @aanm)
• ci: reverse logic for docker auth requirement (cilium/cilium#47081, @Artyop)
• ci: Run KCNP tests via conformance-kind-proxy-embedded (cilium/cilium#45074, @jrajahalme)
• CI: some refactors for waiting images & conformance runtime (cilium/cilium#46957, @Artyop)
• cilium/json-mock is updated to v1.4.1 to resolve ci test flakes. (cilium/cilium#47058, @jrajahalme)
• Collect /proc/net/softnet_stat, /proc/net/snmp and /proc/net/netstat in sysdumps to help diagnose host-level packet drops. (cilium/cilium#46985, @aanm)
• egressgw: add script testing for sysctl (cilium/cilium#46988, @julianwiedmann)
• envoy: cleanup use_nphds in ads code (cilium/cilium#46831, @nezdolik)
• gha/gateway-api: make the conformance job reliable (real skip + CRD-fetch retry) (cilium/cilium#46978, @aanm)
• gha/net-perf-gke: fall back to other zones on GCE stockout (cilium/cilium#46969, @aanm)
• gha/scale: fix scale-5/scale-100 GCE (kops zone + workload node join) (cilium/cilium#46865, @aanm)
• gw-api-ci: Remove crd channel in matrix (cilium/cilium#46679, @xtineskim)
• gw-api-conformance: unskip mesh tests (cilium/cilium#47048, @xtineskim)
• Increase the timeout for the kvstore readiness wait in kind-based CI to avoid flakes on slow etcd image pulls. (cilium/cilium#46882, @aanm)
• renovate: restore updates of docker images (cilium/cilium#47022, @giorio94)
• test/cyclonus: capture logs of every job pod so a runner crash is diagnosable (cilium/cilium#46980, @aanm)
• Use fake external targets on nodes without Cilium in EKS CI workflows for better stability. (cilium/cilium#45246, @gentoo-root)

Misc Changes:

• (minor) docs: update reference to aws-cli image (cilium/cilium#46923, @squeed)
• bpf/nat: Document needs_ct flag in code (cilium/cilium#47017, @pchaigno)
• bpf: Condition ICMP SNAT on BPF masquerading and inter-cluster SNAT (cilium/cilium#47021, @pchaigno)
• bpf: include drop_reasons.h directly where DROP_* constants are used (cilium/cilium#46960, @tklauser)
• bpf: local_delivery: adopt new calling convention (cilium/cilium#46205, @julianwiedmann)
• bpf: make validate_ethertype to accept const ptr (cilium/cilium#46958, @aspsk)
• chore(deps): update all github action dependencies (main) (cilium/cilium#46905, @cilium-renovate[bot])
• chore(deps): update all lvh-images main (main) (patch) (cilium/cilium#46918, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#46902, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#47033, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#47073, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#47107, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#47119, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#47120, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#47121, @cilium-renovate[bot])
• chore(deps): update base-images to v1.26.5 (main) (cilium/cilium#46981, @cilium-renovate[bot])
• chore(deps): update dependency renovatebot/renovate to v43.253.0 (main) (cilium/cilium#47114, @cilium-renovate[bot])
• chore(deps): update dependency renovatebot/renovate to v43.253.1 (main) (cilium/cilium#47118, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang docker tag to v1.26.4 (main) (cilium/cilium#46903, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.5 docker digest to 079e598 (main) (cilium/cilium#47108, @cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.7.0 (main) (cilium/cilium#47029, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1782911245-7cffc778c923f68a77954a53b1a98d6b5353f004 (main) (cilium/cilium#47028, @cilium-renovate[bot])
• ci: adjust condition for "Create imagePullSecret" (cilium/cilium#46968, @mhofstetter)
• ci: always set fail-fast to false on image builds (cilium/cilium#47064, @aanm)
• ci: kind add support for kubeadm.k8s.io/v1beta4 InitConfiguration patch (cilium/cilium#47059, @viktor-kurchenko)
• Cilium bpf policy maps are renamed to "cilium_policy_v3_" prefix to account for the semantic change with policy identity aggregation. (cilium/cilium#47080, @jrajahalme)
• cilium-cni: Fixed a bug where the CNI plugin would fail in ENI IPAM mode if IPv4 is disabled. (cilium/cilium#46937, @41ks)
• docs/community: Add link to community calendar (cilium/cilium#46999, @mauriciovasquezbernal)
• docs: add Gateway API access logs example. (cilium/cilium#46926, @arybolovlev)
• docs: Align metrics reference with code implementation (cilium/cilium#46887, @HadrienPatte)
• docs: clarify Hubble static/dynamic exporter file rotation settings (cilium/cilium#47026, @maksymbilokur-cisco)
• docs: fix typos and grammar in documentation (cilium/cilium#47056, @magic-peach)
• docs: Update ENI IPAM docs to add IPv6 beta support (cilium/cilium#46925, @41ks)
• docs: update Gateway API version to 1.6.0 (cilium/cilium#46961, @eminaktas)
• Egress Gateway: handle nil events (cilium/cilium#46476, @tommyp1ckles)
• egressgw: populate egressIfIndex for IPv6-only CEGP with default selector (cilium/cilium#46965, @julianwiedmann)
• endpoint: reap restart-preserved policy map entries once ready (cilium/cilium#47062, @aanm)
• endpoint: sync desired policy before reload on the restore path (restore-path hardening) (cilium/cilium#47075, @aanm)
• envoy/xdsnew: Fix completion callback queueing (cilium/cilium#46885, @jrajahalme)
• envoy: demote warn log message to info (cilium/cilium#46973, @nezdolik)
• envoy: fix cluster locality handling (cilium/cilium#46976, @viktor-kurchenko)
• Fix a Cilium Operator shutdown deadlock between CiliumNode GC and node taint sync. (cilium/cilium#47036, @ysksuzuki)
• Fix Envoy coalesced updates NACK (cilium/cilium#46938, @jrajahalme)
• gateway-api: fix operator startup failures caused by registering optional Gateway API resources when their CRDs are not installed. (cilium/cilium#46955, @arybolovlev)
• gateway-api: remove SetAllParentCondition route helpers (cilium/cilium#47086, @0xch4z)
• gateway-api: update TCPRoute and UDPRoute to v1 (cilium/cilium#46970, @eminaktas)
• gha/renovate: use actions/create-github-app-token from renovate envir… (cilium/cilium#46994, @aanm)
• gha: fail fast in external-target provisioning scripts instead of swallowing failures (cilium/cilium#47085, @aanm)
• github: bump ci-l7 test timeout (cilium/cilium#46945, @jrajahalme)
• hubble: Remove dead Kafka L7 protocol handling (cilium/cilium#46997, @sayboras)
• images/runtime: Update iptables-wrapper to upstream v3 (Go) (cilium/cilium#46694, @HadrienPatte)
• ipam/service/allocator: fix IPv6 offset aliasing (cilium/cilium#46952, @tklauser)
• policy/k8s: record processing start time for k8s NetworkPolicy updates (cilium/cilium#46979, @aanm)
• policy: Consolidate policyCache into the policy compute cell (cilium/cilium#46460, @christarazi)
• Prepare for release v1.20.0-pre.4 (cilium/cilium#46889, @cilium-release-bot[bot])
• Prepare v1.20 stable branch (cilium/cilium#47007, @joestringer)
• Revert "cilium-dbg: Add preflight validator for cilium-configmap" (cilium/cilium#47052, @joestringer)
• update README.rst with v1.20.0-pre.4 (cilium/cilium#46895, @aanm)
• vendor: bump github.com/cilium/statedb to v0.8.3 (cilium/cilium#47082, @giorio94)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.0-rc.0@sha256:ab193b2335b06bf608b2ac987cca608b717d00f7d8f76ef50492c4e8ef059b5a

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.0-rc.0@sha256:87583396de788357b50dcc241194c312044692cf9cc86d89affa2503c4464b68

hubble-relay

quay.io/cilium/hubble-relay:v1.20.0-rc.0@sha256:586cb0a600616e99a917c59ef15f107fd051343f25302dab5d4c4aecf9da1f2b

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.0-rc.0@sha256:70d175146578da9f4cff3ac4419215bcea8c848188699c7b78c1febd8e3f2a80

operator-aws

quay.io/cilium/operator-aws:v1.20.0-rc.0@sha256:80cadb9f896c6dc0fa4f4078fdaebf8d8d53017411864c7cb2ff40a5b171c269

operator-azure

quay.io/cilium/operator-azure:v1.20.0-rc.0@sha256:f76e7ce8a396e9503fa34513e108c500b95052ff9f6d7c976a45c3c84b678a1b

operator-generic

quay.io/cilium/operator-generic:v1.20.0-rc.0@sha256:d6d4db70657d7fae197174f7c3d796eb23a54a6312658d85dfd42456ccc365bb

operator

quay.io/cilium/operator:v1.20.0-rc.0@sha256:b8fecbdc5123d765c26b50ca4738b8f6c47fd47f4d8d7214501d3e4dfefa3e21

Summary of Changes

Major Changes:

• (Beta) ENI IPAM mode with IPv6: The ENI IPAM mode now supports allocating and using IPv6 prefixes. (cilium/cilium#46756, @41ks)
• As previously announced, docker libnetwork plugin as been sunset and is no longer available. (cilium/cilium#46489, @aanm)
• envoy: Add ADS (Aggregated Discovery Service) server support (cilium/cilium#43887, @nezdolik)
• gateway-api: Add TCPRoute and UDPRoute support (cilium/cilium#46184, @eminaktas)
• GatewayAPI: Implement ListenerSets. Allows per-namespace control of many Listeners for a single Gateway (cilium/cilium#46303, @asauber)
• Introduce datapath plugins to enable third party datapath extensions. (cilium/cilium#46673, @jrife)
• Makes the remote-node and world policy entities much more efficient by adding a new type of wildcard entry in the policy map. This can reduce policy map usage by thousands of entries in certain circumstances. (cilium/cilium#46438, @squeed)

Minor Changes:

• Add --reply and --not-reply flags to hubble observe to filter flows by reply direction. (cilium/cilium#46531, @amaanx86)
• Add spec.allowFirstIP and spec.allowLastIP to CiliumPodIPPool to allow Multi-Pool IPAM users to make the first and last IPs of each allocated pod CIDR allocatable. (cilium/cilium#46323, @SivagurunathanV)
• Add opt-in Helm value nativeRoutingCIDRFromClusterPool to derive the native routing CIDR from the cluster-pool IPAM CIDR when it is not explicitly configured. (cilium/cilium#46419, @Harsh63870)
• Add support to migrate a cluster from cluster-pool IPAM mode to multi-pool IPAM mode. (cilium/cilium#46104, @pippolo84)
• Added some commands to cilium-dbg to help diagnose policy map pressure. (cilium/cilium#46038, @squeed)
• Added the policy/mapstate/stage command to cilium-dbg script. It can show the difference in policy map entries that would be created by a proposed set of policies. (cilium/cilium#46762, @squeed)
• Allow CIDR selectors in network policies to match in-cluster IPs (cilium/cilium#45194, @TheBeeZee)
• azure: Return actual public IP from AssignPublicIPAddresses{VMSS,VM} (cilium/cilium#46327, @HadrienPatte)
• bgp: migrate CRDs storage version from v2alpha1 to v2 (cilium/cilium#46763, @martonra)
• cilium-dbg: add table-json format to bgp/peers and bgp/routes (cilium/cilium#45858, @martonra)
• clustermesh: update MCS-API to v0.5.1 (cilium/cilium#46533, @MrFreezeex)
• daemon: allow --local-router-ipv4/6 without --enable-endpoint-routes (cilium/cilium#46082, @zbb88888)
• datapath/l2responder: use l3 sockets for solicited node multicast signaling (cilium/cilium#46332, @bersoare)
• Different named port numbers for a name from multiple pods are now honored in policy enforcement. (cilium/cilium#45760, @jrajahalme)
• Endpoints created by the CNI plugin are no longer addressable by legacy container-id or pod-name identifiers via the Cilium agent API. Use cni-attachment-id:<containerID>:<ifName> or cep-name:<namespace/name> instead. (cilium/cilium#46810, @tklauser)
• Extend the information reported by the troubleshoot kvstore and clustermesh commands (cilium/cilium#46516, @giorio94)
• Fix operator not exporting k8s_client metrics (api latency, rate limiter latency, api calls total). (cilium/cilium#46353, @hanapedia)
• gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (cilium/cilium#46403, @arybolovlev)
• Gateway-API: Added useRemoteAddress support. (cilium/cilium#45816, @s3rius)
• gateway-api: Gateway status now reports unsupported listener protocols more precisely. (cilium/cilium#46815, @arybolovlev)
• gateway-api: improve route/gateway listener protocol mismatch message (cilium/cilium#46697, @arybolovlev)
• gateway-api: reject unsupported Gateway infrastructure.parametersRef (cilium/cilium#46730, @arybolovlev)
• metrics: Emit native histograms for all histograms by default (cilium/cilium#46814, @HadrienPatte)
• Miscellaneous improvements to the Cluster Mesh TLS certificates helm settings (cilium/cilium#46464, @giorio94)
• Support configuring Envoy cluster default max pending requests via envoy.clusterMaxPendingRequests helm value or cilium-agent --proxy-cluster-max-connections command-line arg (cilium/cilium#45625, @0xch4z)
• Support strict ingress encryption in native routing mode (cilium/cilium#46415, @rgo3)
• The Cilium agent now waits for a static IP to be assigned before becoming ready if one is requested. (cilium/cilium#46636, @41ks)
• The local REST BGP APIs are deprecated. It will be removed in the future. (cilium/cilium#45762, @martonra)

Bugfixes:

• aws: Assign and track EIP only on the primary ENI (cilium/cilium#46329, @HadrienPatte)
• bpf: fix ipv6 neighbor solicitation handling in host firewall (cilium/cilium#46325, @atykhyy)
• clustermesh: now correctly report that MCS-API ServiceExport are not synced in the Cilium CLI (cilium/cilium#46497, @MrFreezeex)
• endpoint: allow wildcard listener proxy redirects (cilium/cilium#46411, @nezdolik)
• Fix a bug which could lead to stale hostport entries if a pod was deleted and immediately recreated in host network. (cilium/cilium#46747, @giorio94)
• Fix BackendTLSPolicy upstream TLS SDS secret name when using a non-default gatewayAPI.secretsNamespace (cilium/cilium#45203, @daper)
• Fix ClusterMesh service affinity annotation service.cilium.io/affinity: "none" incorrectly dropping all remote backends, causing traffic blackhole when no local endpoints exist. (cilium/cilium#46635, @mkamadeus)
• Fix Hubble flow compact output for policy verdict events with default field masks (cilium/cilium#46672, @glrf)
• fix lb: filter terminating backends from PreferSameNode selection (cilium/cilium#46339, @weizhoublue)
• Fix the UDP tunnel check in the BIG TCP probe. (cilium/cilium#46710, @gentoo-root)
• Fix wildcard namespace bypass for selectorless ipBlock rules (cilium/cilium#46305, @TheBeeZee)
• fix(gateway-api): Prevent controller panic during Gateway reconciliation when GatewayClass has an invalid or malformed spec.parametersRef. (cilium/cilium#46340, @arybolovlev)
• fix(hubble): derive socket flow type from event subtype (cilium/cilium#45692, @Andreagit97)
• Fixed a race where a reused endpoint ID could have its BPF state directory removed by the outgoing endpoint (cilium/cilium#46091, @eyupcanakman)
• Fixed an IPCache notification edge case where deleting a pod IP could cause IPCache consumers to observe stale endpoint attributes for a restored overlapping CIDR entry. (cilium/cilium#45646, @pamelia)
• Fixes a bug where Hubble policy correlation does not work for port ranges. (cilium/cilium#46643, @squeed)
• gateway-api/ingress: set service label on EndpointSlices (cilium/cilium#46242, @mhofstetter)
• gateway-api: Add Gateway check for when hostNetwork is enabled (cilium/cilium#46350, @xtineskim)
• gateway-api: Each HTTPS and TLS passthrough port now receives its own Envoy listener and RouteConfiguration. (cilium/cilium#44889, @eufriction)
• gateway-api: Fix HTTPRoute retry rules so that configured status-code and connection-error retries are actually applied. (cilium/cilium#46433, @markwitz)
• gateway-api: prune stale Gateway API route parent statuses (cilium/cilium#46296, @mhofstetter)
• hubble: fix l7 monitor filtering for AccessLog events (cilium/cilium#46519, @shreyasrajiv327)
• Improve robustness of kvstore keys construction to prevent possible surprising behavior in rare circumstances (cilium/cilium#46412, @giorio94)
• ingress: shorten name of resources (cilium/cilium#46346, @mhofstetter)
• ipam/multi-pool: Fix update of Allocated CIDRs in CiliumNode (cilium/cilium#46678, @pippolo84)
• ipam/multi-pool: Use accessors to get and set CiliumNode pools (cilium/cilium#46258, @pippolo84)
• kvstore: Don't set fake pod CIDRs for remote nodes (cilium/cilium#46299, @pchaigno)
• lbipam: prevent reassigning Service LoadBalancer IPs on operator restart when the existing IP belongs to a compatible sharing key group. (cilium/cilium#46262, @ieth0)
• linux-desired-device: harden link modify codepath (cilium/cilium#46757, @harsimran-pabla)
• Move DNS request checking prior to qname extraction (cilium/cilium#46434, @ferozsalam)
• operator: Fix SPIRE mutual-auth reconciler sending an empty entry Id on update, which caused a silent infinite reconcile loop and SPIRE "Failed to update entry" errors when a registration entry already existed (e.g. after an operator restart, upgrade, or trust-domain change). (cilium/cilium#46311, @haf)

CI Changes:

• .github/workflows: fix ci-kpr-eks failures on workflow_dispatch events (cilium/cilium#46525, @aanm)
• .github/workflows: fix envoy image check path after trusted/untrusted… (cilium/cilium#46558, @aanm)
• .github/workflows: run AKS IPsec conformance on AzureLinux nodes (cilium/cilium#46698, @vipul-21)
• .github: Check out untrusted code to dedicated dir (cilium/cilium#46420, @joestringer)
• .github: Lint Envoy on trusted branch (cilium/cilium#46552, @joestringer)
• .github: Skip wait for lint checks (cilium/cilium#46480, @joestringer)
• bgp: Add multi-peer advertisements component test (cilium/cilium#46235, @rastislavs)
• bgp: Add service aggregation priority component test (cilium/cilium#46878, @rastislavs)
• bgp: Do not use IPv6 NLRI with IPv4 extended nexthop in bgp tests (cilium/cilium#46293, @rastislavs)
• bpf/test: porting tc_nodeport_lb4_nat_lb.c to IPv6 (cilium/cilium#46496, @smagnani96)
• bpf: fix flaky nat4_port_allocation_tcp/udp tests (cilium/cilium#45112, @vipul-21)
• bpf: tests: clean up re-introduced USE_BPF_PROG_FOR_INGRESS_POLICY (cilium/cilium#46782, @julianwiedmann)
• bpf: tests: collapse more tests (cilium/cilium#46374, @julianwiedmann)
• bpf: tests: condense a bunch of LB tests (cilium/cilium#46358, @julianwiedmann)
• bpf: tests: fix up definition for ENABLE_ROUTING (cilium/cilium#46804, @julianwiedmann)
• chore(deps): update all lvh-images main (cilium/cilium#46330, @julianwiedmann)
• chore: check-cilium-envoy-image.sh should get values from Makefile.va… (cilium/cilium#46840, @sekhar-isovalent)
• ci: Auth to image registry in clustermesh upgrade workflow (cilium/cilium#46632, @nebril)
• ci: Disable identity jitter for the network policy e2e tests (cilium/cilium#46477, @christarazi)
• ci: Fix set-runtime-image action (cilium/cilium#46407, @nebril)
• CI: fixed external-target readiness gating and ensured sig-network E2E JUnit reports are uploaded on failure. (cilium/cilium#46860, @aanm)
• ci: increase cilium status wait timeout (cilium/cilium#46705, @smagnani96)
• ci: Log in for docker registry reads (cilium/cilium#46036, @nebril)
• ci: quarantine netkit EKS conformance jobs (cilium/cilium#46621, @aanm)
• ci: Remove merge_group from tests-smoke-conformance.yaml (cilium/cilium#46451, @nebril)
• ci: use PR checks for status check (cilium/cilium#46429, @nebril)
• contrib: fix go test tag check exit status (cilium/cilium#46442, @tklauser)
• datapath: sockets: add test coverage for v4-in-v6 client termination (cilium/cilium#46487, @julianwiedmann)
• Decrease CI costs on AWS (cilium/cilium#46615, @aanm)
• egressgw: add script test support (cilium/cilium#46328, @julianwiedmann)
• Fix workflow change detection for single-commit PRs to main (cilium/cilium#46684, @Demiserular)
• gh: ztunnel-e2e: set commit status to pending on main job (cilium/cilium#46300, @julianwiedmann)
• gha: disable flaky Gateway API tests (cilium/cilium#46875, @arybolovlev)
• ginkgo: remove Tests GH#10983 (cilium/cilium#46494, @smagnani96)
• helm: add tmpl files to .helmignore (cilium/cilium#46445, @sekhar-isovalent)
• hubble: Add Script tests for pkg/hubble/exporter (cilium/cilium#45856, @mereta)
• Introduce scheduled conformance testing on EKS with netkit and netkit-l2. (cilium/cilium#45688, @ajmmm)
• logging: Downgrade leader election lease conflict to info (cilium/cilium#46313, @christarazi)
• Migrate K8sPolicyTestExtended Ginkgo tests to hive component tests for kube-apiserver entity policy. (cilium/cilium#46490, @Harsh63870)
• Move pull_request triggered workflows to ariane (cilium/cilium#45363, @nebril)
• pkg/rate: fix TestMaxParallelRequests flake under CI load (cilium/cilium#46856, @aanm)
• Reapply "ci: Log in for image registry pulls" (cilium/cilium#46376, @nebril)
• Removed address-family split from bpf_redirect helper test coverage. (cilium/cilium#46401, @ajmmm)
• renovate: re-enable cilium/ebpf dependency bump (cilium/cilium#46833, @ti-mo)
• renovate: Update regex for Makefile.values ?= assignment (cilium/cilium#46449, @sayboras)
• Revert "ci: Log in for image registry pulls" (cilium/cilium#46370, @joestringer)
• Revert "ci: use PR checks for status check" (cilium/cilium#46455, @joestringer)
• Revert "workflows/verifier: Run consistent version of tests" (cilium/cilium#46381, @pchaigno)
• Use correct helm chart in reinstall step in conformance-kind-proxy-embedded workflow. (cilium/cilium#46868, @jrajahalme)
• Use external status check workflow in image build CI (cilium/cilium#46469, @nebril)
• workflows/verifier: Fix commit status (cilium/cilium#46382, @pchaigno)

Misc Changes:

• .github: Don't close issues with stable-blocker (cilium/cilium#46759, @joestringer)
• [multi-pool] Miscellaneous minor fixes (cilium/cilium#46492, @pippolo84)
• Add a greeting for first time contributors (cilium/cilium#45551, @xmulligan)
• Add Pagali Payments Service to USERS.md (cilium/cilium#46454, @dverzolla)
• Add support for hybrid routing mode (routing-mode: hybrid), allowing Cilium to dynamically choose between native routing and tunnel encapsulation based on subnet topology. Traffic between pods in directly connected subnets is routed natively for improved throughput, while cross-subnet traffic is tunneled. (cilium/cilium#45001, @vanessachammas)
• alibabacloud: Standardize package layout (cilium/cilium#46349, @HadrienPatte)
• AWS ENI IPAM mode now supports allocating IPv6 prefixes (cilium/cilium#46619, @41ks)
• aws: do not fail ENI parsing when the association has an empty public IP (cilium/cilium#46650, @aanm)
• aws: Standardize package layout (cilium/cilium#46368, @HadrienPatte)
• azure: Standardize package layout (cilium/cilium#46364, @HadrienPatte)
• bgp: fix status condition reporting: update reasons to accurately reflect current condition state (cilium/cilium#46383, @martonra)
• bgp: Reconcile route policies via statedb (cilium/cilium#46818, @rastislavs)
• bgp: update container lab documentation to use the new hive shell commands (cilium/cilium#46336, @martonra)
• bpf : migrate LB algo selection to runtime config (cilium/cilium#46729, @aspsk)
• bpf, xdp: Clear CB region on XDP entry (cilium/cilium#46690, @borkmann)
• bpf: Clean up more comprehensively (cilium/cilium#46241, @joestringer)
• bpf: constify more __ctx_buff and friends (cilium/cilium#46807, @tklauser)
• bpf: Handle IPIP DSR for Pods (cilium/cilium#46103, @borkmann)
• bpf: host, overlay: pull L3 header at first ethertype de-mux point (cilium/cilium#45988, @saiaunghlyanhtet)
• bpf: local_delivery: use CB_DELIVERY_FLAGS to transfer proxy state (cilium/cilium#46291, @julianwiedmann)
• bpf: Make ipv6_hdrlen_with_fraginfo function global (cilium/cilium#46295, @pchaigno)
• bpf: Make snat_v4_needs_masquerade global (cilium/cilium#46504, @pchaigno)
• bpf: Migrate MTU to runtime config (cilium/cilium#46219, @amchelapurath2023)
• bpf: overlay: demote revalidate_data_pull() to revalidate_data() (cilium/cilium#46790, @saiaunghlyanhtet)
• bpf: policy: constify __ctx_buff & friends (cilium/cilium#46341, @julianwiedmann)
• bpf: Reduce stack size for tail_handle_snat_fwd_ipv6 (cilium/cilium#46360, @pchaigno)
• build: Allow local-only images in kind-load-base-images (cilium/cilium#46307, @jrajahalme)
• Bump to Hive v1.0.4-rc2 and fix job stop ordering issues (cilium/cilium#46206, @joamaki)
• ces: avoid panic on empty CiliumNode lookup result (cilium/cilium#46347, @tklauser)
• chore(deps): update all github action dependencies (main) (patch) (cilium/cilium#46662, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#46654, @cilium-renovate[bot])
• chore(deps): update base-images (main) (cilium/cilium#46653, @cilium-renovate[bot])
• chore(deps): update cilium/cilium-cli action to v0.19.5 (main) (cilium/cilium#46725, @cilium-renovate[bot])
• chore(deps): update dependency go to v1.26.4 (main) (cilium/cilium#46393, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.4-1781154076-332f6c5e06ed996f5b6ea43d57f8bba4d103ecec (main) (cilium/cilium#46402, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1782264709-cdc3744d2a0d37948ed88498195c637ece94c44b (main) (cilium/cilium#46699, @cilium-renovate[bot])
• chore(deps): update quay.io/goswagger/swagger docker tag to v0.34.1 (main) (cilium/cilium#46517, @cilium-renovate[bot])
• chore: BYOCNI loopback for cilium (cilium/cilium#46646, @sekhar-isovalent)
• chore: optimize building gops and cni/loopback (cilium/cilium#46781, @sekhar-isovalent)
• ci: Comment out wait-for-base-images (cilium/cilium#46491, @nebril)
• ci: remove non-ariane workflows from config (cilium/cilium#46787, @nebril)
• cilium, docs: Add IPIP example for KPR section (cilium/cilium#46427, @borkmann)
• cilium-dbg: add default arguments to bgp/routes command: loc ipv4 unicast (cilium/cilium#46335, @martonra)
• cilium-dbg: add deprecation warning to REST API based BGP commands (cilium/cilium#46334, @martonra)
• cilium-dbg: migrate bpf ipcache get to net/netip and drop the go-immutable-radix dependency. (cilium/cilium#46181, @WAFriend3416)
• cilium-dbg: remove redundant net.IP formatting in bpf nodeid list (cilium/cilium#46521, @PranjalManhgaye)
• cilium: small doc and ux improvement for ipip (cilium/cilium#46443, @borkmann)
• ciliumenvoyconfig: skip internal listeners when disabling SO_REUSEPORT (cilium/cilium#46276, @liuxu623)
• ciliumenvoyconfig: sort envoy-resources table endpoints (cilium/cilium#46871, @aanm)
• clustermesh: endpoint slices watch and kvstoremesh wiring (cilium/cilium#46506, @MrFreezeex)
• clustermesh: wire the export side of endpoint slice resources (cilium/cilium#46605, @MrFreezeex)
• CODEOWNERS: add fine-grained ownership for bpf/tests/ (cilium/cilium#46858, @julianwiedmann)
• CODEOWNERS: Assign ztunnel tests to ztunnel team (cilium/cilium#46714, @joestringer)
• Correct hostname filtering logic for ListenerSet routes (cilium/cilium#46785, @asauber)
• Datapath Plugins (CFP-41634) Part 3: Collection Instrumentation (cilium/cilium#45558, @jrife)
• datapath/sockets: Add missing unix.IPPROTO_TCP (cilium/cilium#46466, @jrife)
• datapath: add parent ifindex to VLAN desired device table output (cilium/cilium#46380, @tklauser)
• datapath: export enums as Go types (cilium/cilium#45009, @ti-mo)
• datapath: hide device table indexes behind query helpers (cilium/cilium#46430, @tklauser)
• datapath: switch ENABLE_HOST_ROUTING to runtime config (cilium/cilium#46791, @julianwiedmann)
• datapath: use single health reporter for node address reconciler (cilium/cilium#46428, @joamaki)
• deps: bump GoBGP to latest 4.6.1 pre-release commit (cilium/cilium#46802, @ysksuzuki)
• Do not pin cilium/cilium actions (cilium/cilium#46610, @aanm)
• docs: Add missing identity default label filter (cilium/cilium#46628, @justin0u0)
• docs: fix duplicated word in service mesh installation guide (cilium/cilium#46631, @s3onghyun)
• docs: fix note about ipv4-native-routing-cidr default value (cilium/cilium#46603, @rptaylor)
• docs: improve readability in README (cilium/cilium#46600, @devShaik010)
• docs: improve README grammar and consistency (cilium/cilium#46766, @alaotach)
• docs: replace echoserver with echo-basic, for arm64 support (cilium/cilium#46806, @asauber)
• docs: Update ENI IPAM docs for multi-pool allocator migration (cilium/cilium#46797, @HadrienPatte)
• Documentation/ipam: Add a warning for BGP during migration (cilium/cilium#46828, @pippolo84)
• endpoint: Guard ENI routing rule teardown by IP ownership (cilium/cilium#46677, @HadrienPatte)
• endpoint: make named-ports identity labels k8s-safe (cilium/cilium#46520, @jrajahalme)
• envoy: Fix xdsMode defaults (cilium/cilium#46853, @jrajahalme)
• Fix broken gateway-api documentation links (cilium/cilium#46527, @0xch4z)
• Fix Gateway API UDPRoute/TCPRoute programming so routes accepted by one listener are not emitted into another listener that rejects them via allowedRoutes.namespaces. (cilium/cilium#46363, @marcofranssen)
• Fix Getting Started docs link in README (cilium/cilium#46733, @ericdbishop)
• Fix Helm chart documentation that incorrectly referenced envoy.securityContext.capabilities.keepNetBindService; the correct value key is envoy.securityContext.capabilities.keepCapNetBindService. (cilium/cilium#46156, @jokestax)
• Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (cilium/cilium#46388, @tommyp1ckles)
• Fix pointer-address comparison for Gateway API Route ParentReference status handling (cilium/cilium#46355, @weizhoublue)
• fix(deps): update all go dependencies main (main) (cilium/cilium#46394, @cilium-renovate[bot])
• fix(deps): update all go dependencies main (main) (cilium/cilium#46534, @cilium-renovate[bot])
• fix(deps): update all go dependencies main (main) (cilium/cilium#46656, @cilium-renovate[bot])
• fix(deps): update all go dependencies main (main) (cilium/cilium#46772, @cilium-renovate[bot])
• Fix: potential helm validation error with nativeRoutingCIDRFromClusterPool (cilium/cilium#46606, @weizhoublue)
• fix: Prevent missing LoadBalancer IP in Ingress status for dedicated Ingresses with long names (cilium/cilium#46387, @weizhoublue)
• gateway-api: Add gateway-api-conformance-report Makefile target (cilium/cilium#46718, @youngnick)
• gateway-api: bump Gateway API version to 1.6.0. (cilium/cilium#46827, @arybolovlev)
• gateway-api: cleanup use of default gateway api gatewayclass controllername (cilium/cilium#46362, @mhofstetter)
• gateway-api: do not reject listeners when no route kinds are supported (cilium/cilium#46203, @mhofstetter)
• Gateway-api: docs for BackendTLSPolicy (cilium/cilium#46123, @xtineskim)
• gateway-api: fix unit test due to service name label (cilium/cilium#46324, @mhofstetter)
• gateway-api: remove info that TLSRoute is installed (cilium/cilium#46465, @mhofstetter)
• gateway-api: return model from Gateway API ingestion (cilium/cilium#46450, @arybolovlev)
• gha: let auto-approve match on re-runs (cilium/cilium#46832, @aanm)
• helm: Remove unused core Endpoints RBAC from roles (cilium/cilium#46817, @HadrienPatte)
• Improve cilium-dbg status output of module health (cilium/cilium#46739, @joestringer)
• Improve logging when the datapath connector updates buffer margin values. (cilium/cilium#46178, @ajmmm)
• Improve quiet mode and debuggability in build system (cilium/cilium#46071, @joestringer)
• ip: remove unused helper functions (cilium/cilium#46322, @tklauser)
• ipam/eni: accept an ipv4NativeRoutingCIDR that is a subnet of the VPC CIDR again, fixing an agent startup crash with ENI IPAM when the native routing CIDR does not cover the whole VPC. (cilium/cilium#46649, @aanm)
• ipam: fix typos and incorrect references in comments (cilium/cilium#46549, @HadrienPatte)
• ipam: Migrate IPAMSpec.PodCIDRs to ip.Prefix (cilium/cilium#46599, @HadrienPatte)
• ipam: Migrate VirtualNetwork and IPAMCIDR to netip (cilium/cilium#46309, @HadrienPatte)
• ipam: Migrate IPAM allocator public API to netip (cilium/cilium#46345, @HadrienPatte)
• ipam: Reclaim still-advertised released CIDRs on renewed demand (cilium/cilium#46674, @HadrienPatte)
• ipsec: clean up last usage of option.Config.TunnelingEnabled() (cilium/cilium#46786, @julianwiedmann)
• iptables: convert localNodeInfo to netip.Addr (cilium/cilium#46076, @uuditmisra)
• kpr: Add tests for VXLAN + LBModeAnnotation (cilium/cilium#46461, @brb)
• kvstore: add transcode support to commands (cilium/cilium#46283, @MrFreezeex)
• lb: don't disable topology-aware routing because of a terminating Pod (cilium/cilium#45947, @Kimjonghyeon)
• loadbalancer: use netip types in getIPFamilies (cilium/cilium#46356, @tklauser)
• loadbalancer: validate DSR dispatch configuration globally (cilium/cilium#45545, @FelipeYepez)
• Makefile: Generate full Cilium version in worktree (cilium/cilium#46737, @joestringer)
• monitor: fix typo in ICMPv6 neighbour solicitation debug message (cilium/cilium#46879, @Harsh63870)
• mtu: s/encryptEnabled/ipsecEnabled (cilium/cilium#46788, @julianwiedmann)
• netns: Add missing GetNetNSCookie function for non-linux build (cilium/cilium#46637, @devodev)
• node: Migrate Linux node routes from cidr.CIDR to netip.Prefix (cilium/cilium#46417, @HadrienPatte)
• operator/multi-pool: Remove stale allocator.go (cilium/cilium#46367, @pippolo84)
• operator: miscellaneous improvements to the troubleshoot clustermesh command (cilium/cilium#46502, @giorio94)
• pkg/k8s/slim: Remove deprecated and unused Endpoints related code (cilium/cilium#46472, @HadrienPatte)
• plugins/cni: Remove EP configuration hook (cilium/cilium#46812, @gandro)
• policy/compute: Break out policy computation from endpoint (3/3) (cilium/cilium#44900, @christarazi)
• policy/test, identity: Fix script test goroutine leak and well-known identities race (cilium/cilium#46486, @christarazi)
• Prepare for release v1.20.0-pre.3 (cilium/cilium#46297, @cilium-release-bot[bot])
• proxy: use devices table for cilium_net IPv6 lookup (cilium/cilium#46500, @tklauser)
• README: Update releases (cilium/cilium#46315, @joestringer)
• README: Update releases (cilium/cilium#46594, @aanm)
• Reapply ".github/workflows: do not use deployments for environments" (cilium/cilium#46573, @aanm)
• references to the metrics cilium_node_health_connectivity_status and cilium_node_health_connectivity_latency_seconds have been corrected in the documentation. (cilium/cilium#46590, @fgiloux)
• Remove docker libnetwork plugin 2/3 (cilium/cilium#46514, @aanm)
• Remove docker libnetwork plugin 3/3 (cilium/cilium#46515, @aanm)
• Remove obsolete benchmark 'BenchmarkIPIdentityPair_PrefixString' (cilium/cilium#46013, @furkan-asani)
• Remove quotes around certain true/false flags in Makefile (cilium/cilium#45694, @jingyuanliang)
• Remove stale Docker plugin leftovers (cilium/cilium#46709, @tklauser)
• Remove stale FIXME comment in dev-doctor about checking for gomega installation. (cilium/cilium#46524, @bitflicker64)
• renovate: do not pinDigest for golangci/golangci-lint (cilium/cilium#46572, @aanm)
• Revert ".github/workflows: do not use deployments for environments" (cilium/cilium#46348, @aanm)
• test: remove unused helper functions and manifests (cilium/cilium#46752, @tklauser)
• Upgraded cilium/ebpf to version v0.22.0 (cilium/cilium#46783, @dylandreimerink)
• vendor: update json-patch to v5 (cilium/cilium#46614, @aanm)
• vtep: Migrate from net.IP/cidr.CIDR to netip.{Addr,Prefix} (cilium/cilium#46414, @HadrienPatte)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.0-pre.4@sha256:8d1349f4f0d76aefe6fd501b264d63b7331c708529b08e176f02493ea9f6a30f

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.0-pre.4@sha256:5880bfa9f366fa340b85b57dccb48b80ae68e24efd116bd79d6417fa3f3ed244

hubble-relay

quay.io/cilium/hubble-relay:v1.20.0-pre.4@sha256:46ec6122fc792663318f80f3d14addf9356f06738a00c76e86c216ad0961c427

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.0-pre.4@sha256:dfc8fbe80dfef99c801ea0f9dd16b13ea6e91f479478d1242649e7fb4019b15f

operator-aws

quay.io/cilium/operator-aws:v1.20.0-pre.4@sha256:50d9da48e23e8dc8dbda3905e2463d134c4386fcf89d592b44f195440d38abaa

operator-azure

quay.io/cilium/operator-azure:v1.20.0-pre.4@sha256:f03fbd89d25f5b456efe4cbd82c29827fe606132862aed68f8c2f8774a73c555

operator-generic

quay.io/cilium/operator-generic:v1.20.0-pre.4@sha256:665d7c674339fdce579bfb56734abbc74164e0891a0f2d81a207633c881ea06d

operator

quay.io/cilium/operator:v1.20.0-pre.4@sha256:92e6cf04c7ecc3c71feb200c60525ec0a9e24153db80e7519e562ba27f19c426

Summary of Changes

Minor Changes:

• Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR cilium/cilium#46554, Upstream PR cilium/cilium#46516, @giorio94)
• helm: Remove loadBalancer.standalone option (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#46070, @joestringer)
• wireguard:mtu: fix mtu calculation with potential padding (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#45940, @smagnani96)

Bugfixes:

• Always add cluster label to node when nodeSelectorLabels is enabled to fix CiliumNetworkPolicy with fromNodes/toNodes with policy-default-local-cluster enabled (enabled by default in 1.19+) (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#46068, @MrFreezeex)
• azure: Fix public IP reassignment failure loop on operator restart (Backport PR cilium/cilium#46289, Upstream PR cilium/cilium#46240, @HadrienPatte)
• bgp: Don't provide default_gateway reconciler when disabled (Backport PR cilium/cilium#46024, Upstream PR cilium/cilium#45911, @YutaroHayakawa)
• bgp: Reduce amount of soft peer resets by service reconciliation and fix potentially missed incorrect metadata update upon failed reconciliation. (Backport PR cilium/cilium#46245, Upstream PR cilium/cilium#45927, @rastislavs)
• bpf: fix host proxy packet routing to pods (Backport PR cilium/cilium#46024, Upstream PR cilium/cilium#45916, @atykhyy)
• bug: fixed weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#45937, @nickolaev)
• datapath/mtu: add altname to mark cilium owned interfaces and do skip changing MTU on interfaces not managed by cilium (Backport PR cilium/cilium#46028, Upstream PR cilium/cilium#45799, @bersoare)
• Fix a bug that causes the NamespaceSelector field in a CiliumEgressGatewayPolicy to be corrupted, and no longer effective. (Backport PR cilium/cilium#46024, Upstream PR cilium/cilium#45926, @julianwiedmann)
• Fix a rare bug in clustermesh-apiserver that triggers incorrect deletion of a valid endpoint entry from the etcd under high pod churn (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#45780, @adamwathieu)
• Fix BGP PeerConfig status cleanup so it no longer times out when there are no managed conditions to remove. (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#45967, @ysksuzuki)
• Fix bug that would disrupt node connectivity when ClusterIP/LoadBalancer VIPs overlapped with node-local IP addresses. (Backport PR cilium/cilium#46024, Upstream PR cilium/cilium#45572, @ajmmm)
• Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName. (Backport PR cilium/cilium#45966, Upstream PR cilium/cilium#45371, @syedazeez337)
• Fix wildcard namespace bypass for selectorless ipBlock rules (Backport PR cilium/cilium#46456, Upstream PR cilium/cilium#46305, @TheBeeZee)
• fix(gateway-api): Prevent controller panic during Gateway reconciliation when GatewayClass has an invalid or malformed spec.parametersRef. (Backport PR cilium/cilium#46400, Upstream PR cilium/cilium#46340, @arybolovlev)
• fix(gateway-api): set ready condition in endpointSlice to true (Backport PR cilium/cilium#46400, Upstream PR cilium/cilium#46237, @ulrichgiraud)
• fix: nil pointer dereference panic due to uninitialized logger (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#45782, @weizhoublue)
• Fixed a race where a reused endpoint ID could have its BPF state directory removed by the outgoing endpoint (Backport PR cilium/cilium#46554, Upstream PR cilium/cilium#46091, @eyupcanakman)
• Fixed unsolicited IPv6 L2 announcements ignored by receiving hosts, as not conformant to RFC 4861 (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#46079, @giorio94)
• Fixes a bug where policymap pressure was incorrectly being reported as 0. (Backport PR cilium/cilium#46024, Upstream PR cilium/cilium#45791, @squeed)
• gateway-api/ingress: set service label on EndpointSlices (Backport PR cilium/cilium#46400, Upstream PR cilium/cilium#46242, @mhofstetter)
• gateway-api: fix GatewayClass field index (Backport PR cilium/cilium#46289, Upstream PR cilium/cilium#46127, @thorn3r)
• gateway-api: prune stale Gateway API route parent statuses (Backport PR cilium/cilium#46400, Upstream PR cilium/cilium#46296, @mhofstetter)
• Improve robustness of kvstore keys construction to prevent possible surprising behavior in rare circumstances (Backport PR cilium/cilium#46554, Upstream PR cilium/cilium#46412, @giorio94)
• iptables: match wireguard packets by proto+port instead of packet mark (Backport PR cilium/cilium#46289, Upstream PR cilium/cilium#45974, @bersoare)
• multipool: Fix retries for CiliumNode Get errors (Backport PR cilium/cilium#46408, Upstream PR cilium/cilium#46124, @pippolo84)
• sockets: fix nil pointer dereference in filterAndDestroySockets (Backport PR cilium/cilium#46024, Upstream PR cilium/cilium#44843, @umut-polat)
• The internal representation of load-balancing backends has been refactored to efficiently support thousands of services referencing a shared backend. (cilium/cilium#46462, @joamaki)

CI Changes:

• chore(deps): update lvh-images for conformance-runtime (Backport PR cilium/cilium#46025, Upstream PR cilium/cilium#45922, @julianwiedmann)
• ci:bpftrace: fail curl with corrupted binary download (Backport PR cilium/cilium#46024, Upstream PR cilium/cilium#45948, @smagnani96)
• fix the race condition for the TestRouterIDAllocation bgp test case (Backport PR cilium/cilium#46289, Upstream PR cilium/cilium#44545, @liyihuang)
• gha: make conformance kubespray runner configurable (Backport PR cilium/cilium#46289, Upstream PR cilium/cilium#46171, @giorio94)
• helm: add tmpl files to .helmignore (Backport PR cilium/cilium#46554, Upstream PR cilium/cilium#46445, @sekhar-isovalent)
• helm: allow overriding of registry_prefix in charts (Backport PR cilium/cilium#46289, Upstream PR cilium/cilium#46217, @sekhar-isovalent)
• ipam: Deflake TestMarkForReleaseNoAllocate (Backport PR cilium/cilium#46289, Upstream PR cilium/cilium#46188, @pippolo84)
• Move pull_request triggered workflows to ariane (Backport PR cilium/cilium#46452, Upstream PR cilium/cilium#45363, @nebril)
• Reapply "ci: Log in for image registry pulls" (Backport PR cilium/cilium#46495, Upstream PR cilium/cilium#46376, @nebril)

Misc Changes:

• [v1.19] - chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 7… (cilium/cilium#46578, @aanm)
• [v1.19] Backport health command fixes from 46102 (cilium/cilium#46250, @joamaki)
• [v1.19] deps: bump various go packages (cilium/cilium#46185, @ferozsalam)
• [v1.19] loadbalancer: return correct IP family for IPv6 ClusterIP addresses (cilium/cilium#46425, @tklauser)
• bpf: local_delivery: add CB flag for "use_redirect_peer" (Backport PR cilium/cilium#46204, Upstream PR cilium/cilium#46169, @julianwiedmann)
• bpf: local_delivery: condense usage of skb cb slots (Backport PR cilium/cilium#46204, Upstream PR cilium/cilium#46064, @julianwiedmann)
• bpf: local_delivery: use CB_DELIVERY_FLAGS to transfer proxy state (Backport PR cilium/cilium#46554, Upstream PR cilium/cilium#46291, @julianwiedmann)
• chore(deps): update all github action dependencies (v1.19) (cilium/cilium#45994, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (cilium/cilium#46016, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (cilium/cilium#46117, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (cilium/cilium#46268, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (cilium/cilium#46280, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (cilium/cilium#46395, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (cilium/cilium#46538, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (cilium/cilium#45468, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (cilium/cilium#46581, @cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (cilium/cilium#45995, @cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (cilium/cilium#46164, @cilium-renovate[bot])
• chore(deps): update base-images to v1.25.11 (v1.19) (cilium/cilium#46342, @cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to 0fc1dd3 (v1.19) (cilium/cilium#46153, @cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to 11ecd4e (v1.19) (cilium/cilium#46277, @cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to cd47774 (v1.19) (cilium/cilium#46137, @cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to e1b3ec8 (v1.19) (cilium/cilium#46007, @cilium-renovate[bot])
• chore(deps): update cilium/cilium-cli action to v0.19.3 (v1.19) (cilium/cilium#46120, @cilium-renovate[bot])
• chore(deps): update dependency bufbuild/buf to v1.70.0 (v1.19) (cilium/cilium#46267, @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.4 (v1.19) (cilium/cilium#46150, @cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.30 (v1.19) (cilium/cilium#46266, @cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v35.1 (v1.19) (cilium/cilium#46570, @cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.37.0 docker digest to 9532d8c (v1.19) (cilium/cilium#46535, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.10 docker digest to cd05a37 (v1.19) (cilium/cilium#46138, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.11 docker digest to 379065f (v1.19) (cilium/cilium#46536, @cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.12 (v1.19) (cilium/cilium#46560, @cilium-renovate[bot])
• chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260518104151-5ebe05f9440b (v1.19) (cilium/cilium#46139, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.5 (v1.19) (cilium/cilium#46561, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752 (v1.19) (cilium/cilium#46377, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.19) (patch) (cilium/cilium#45392, @cilium-renovate[bot])
• docs: Add caveats on Kubernetes versions when using host L7 DNS policies (Backport PR cilium/cilium#46289, Upstream PR cilium/cilium#45843, @atykhyy)
• docs: Document BTF as a requirement (Backport PR cilium/cilium#46289, Upstream PR cilium/cilium#46063, @pchaigno)
• docs: fix Markdown-style hyperlink in mutual-authentication.rst (Backport PR cilium/cilium#46024, Upstream PR cilium/cilium#45751, @bitflicker64)
• Fix broken gateway-api documentation links (Backport PR cilium/cilium#46554, Upstream PR cilium/cilium#46527, @0xch4z)
• Fix pointer-address comparison for Gateway API Route ParentReference status handling (Backport PR cilium/cilium#46400, Upstream PR cilium/cilium#46355, @weizhoublue)
• fix(deps): update k8s.io patch updates stable to v0.35.5 (v1.19) (cilium/cilium#46140, @cilium-renovate[bot])
• fix(deps): update k8s.io patch updates stable to v0.35.5 (v1.19) (patch) (cilium/cilium#46015, @cilium-renovate[bot])
• fix(deps): update k8s.io patch updates stable to v0.35.6 (v1.19) (cilium/cilium#46562, @cilium-renovate[bot])
• fix(deps): update k8s.io/utils digest to ff6756f (v1.19) (cilium/cilium#45996, @cilium-renovate[bot])
• fix(deps): update module k8s.io/apimachinery to v0.35.5 (v1.19) (cilium/cilium#45997, @cilium-renovate[bot])
• fix(deps): update module k8s.io/apimachinery to v0.35.6 (v1.19) (cilium/cilium#46537, @cilium-renovate[bot])
• Miscellaneous improvements to the fake client (Backport PR cilium/cilium#46024, Upstream PR cilium/cilium#45784, @giorio94)
• operator: miscellaneous improvements to the troubleshoot clustermesh command (Backport PR cilium/cilium#46554, Upstream PR cilium/cilium#46502, @giorio94)
• Remove defunct l2podAnnouncements.interface Helm value that rendered a configmap key the agent no longer recognises, causing crash-loops when L2 pod announcements were enabled. Users must use l2podAnnouncements.interfacePattern instead. (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#46093, @salamidrus)
• Revert ".github/workflows: do not use deployments for environments" (Backport PR cilium/cilium#46400, Upstream PR cilium/cilium#46348, @aanm)

Other Changes:

• [v1.19] proxy: Bump upstream version to v1.37.x (cilium/cilium#46439, @sayboras)
• install: Update image digests for v1.19.4 (cilium/cilium#45961, @cilium-release-bot[bot])
• v1.19: kvstore: Don't set fake pod CIDRs for remote nodes (cilium/cilium#46361, @pchaigno)
• vendor: bump statedb to v0.5.8 (cilium/cilium#46505, @giorio94)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.5@sha256:5ed9334b2254315740f9e2a8b6645bf69920f79ef14f436931579d2038784f9b

docker-plugin

quay.io/cilium/docker-plugin:v1.19.5@sha256:4006d5558390120774a5a903a706dfd64089082bd653b7cb45e9e5a93ff4efea

hubble-relay

quay.io/cilium/hubble-relay:v1.19.5@sha256:24409bfa1bca075c92acb26ba4b49cd573d99d68d5370f7cc825078185222a0c

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.5@sha256:c9706343dde700804c2f50c09a2f8291797c707d1747fd50f70c939c23747c16

operator-aws

quay.io/cilium/operator-aws:v1.19.5@sha256:b8473618e8d2bf8a610da445c8c37e1d1e8221aecd05989456d87a7588d66707

operator-azure

quay.io/cilium/operator-azure:v1.19.5@sha256:8600299cb121f9df00fd32b93fa74de89ed49dd3a67e3d7301c07325c04c77f8

operator-generic

quay.io/cilium/operator-generic:v1.19.5@sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4

operator

quay.io/cilium/operator:v1.19.5@sha256:07a25f6a248d77f0c8417d21b5ea5424a81fe551421e4baf04dc79b1360e832e

Summary of Changes

Minor Changes:

• Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR cilium/cilium#46555, Upstream PR cilium/cilium#46516, @giorio94)

Bugfixes:

• bug: fixed weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API (Backport PR cilium/cilium#46249, Upstream PR cilium/cilium#45937, @nickolaev)
• datapath/mtu: add altname to mark cilium owned interfaces and do skip changing MTU on interfaces not managed by cilium (Backport PR cilium/cilium#46085, Upstream PR cilium/cilium#45799, @bersoare)
• Fix memory leak issue with reusing a watch channel hash map from very large StateDB transactions (cilium/cilium#46498, @joamaki)
• Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName. (Backport PR cilium/cilium#46234, Upstream PR cilium/cilium#45371, @syedazeez337)
• multipool: Fix retries for CiliumNode Get errors (Backport PR cilium/cilium#46410, Upstream PR cilium/cilium#46124, @pippolo84)
• sockets: fix nil pointer dereference in filterAndDestroySockets (Backport PR cilium/cilium#46029, Upstream PR cilium/cilium#44843, @umut-polat)

CI Changes:

• chore(deps): update lvh-images for conformance-runtime (Backport PR cilium/cilium#46026, Upstream PR cilium/cilium#45922, @julianwiedmann)
• ci:bpftrace: fail curl with corrupted binary download (Backport PR cilium/cilium#46029, Upstream PR cilium/cilium#45948, @smagnani96)
• Fixed an issue where privileged tests failed locally (Backport PR cilium/cilium#46029, Upstream PR cilium/cilium#40150, @AritraDey-Dev)
• gha: make conformance kubespray runner configurable (Backport PR cilium/cilium#46292, Upstream PR cilium/cilium#46171, @giorio94)
• helm: add tmpl files to .helmignore (Backport PR cilium/cilium#46555, Upstream PR cilium/cilium#46445, @sekhar-isovalent)
• helm: allow overriding of registry_prefix in charts (Backport PR cilium/cilium#46292, Upstream PR cilium/cilium#46217, @sekhar-isovalent)

Misc Changes:

• [v1.18] - chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 7… (cilium/cilium#46579, @aanm)
• [v1.18] - Reapply ".github/workflows: do not use deployments for environments" (cilium/cilium#46575, @aanm)
• [v1.18] deps: bump various Go packages (cilium/cilium#46186, @ferozsalam)
• [v1.18] loadbalancer: return correct IP family for IPv6 ClusterIP addresses (cilium/cilium#46426, @tklauser)
• chore(deps): update all github action dependencies (v1.18) (cilium/cilium#45998, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (cilium/cilium#46020, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (cilium/cilium#46118, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (cilium/cilium#46271, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (cilium/cilium#46396, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (cilium/cilium#46542, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.18) (cilium/cilium#46141, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.18) (cilium/cilium#46582, @cilium-renovate[bot])
• chore(deps): update aws-actions/configure-aws-credentials action to v6.1.2 (v1.18) (cilium/cilium#46285, @cilium-renovate[bot])
• chore(deps): update base-images (v1.18) (cilium/cilium#45999, @cilium-renovate[bot])
• chore(deps): update base-images (v1.18) (cilium/cilium#46165, @cilium-renovate[bot])
• chore(deps): update base-images to v1.25.11 (v1.18) (cilium/cilium#46343, @cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to 0fc1dd3 (v1.18) (cilium/cilium#46154, @cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to 11ecd4e (v1.18) (cilium/cilium#46278, @cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to 81d4870 (v1.18) (cilium/cilium#46281, @cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to af87cb7 (v1.18) (cilium/cilium#46151, @cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to cd47774 (v1.18) (cilium/cilium#46142, @cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to e1b3ec8 (v1.18) (cilium/cilium#46008, @cilium-renovate[bot])
• chore(deps): update cilium/cilium-cli action to v0.19.3 (v1.18) (cilium/cilium#46144, @cilium-renovate[bot])
• chore(deps): update dependency bufbuild/buf to v1.70.0 (v1.18) (cilium/cilium#46270, @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.4 (v1.18) (cilium/cilium#46157, @cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.30 (v1.18) (cilium/cilium#46269, @cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v35.1 (v1.18) (cilium/cilium#46566, @cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.37.0 docker digest to 9532d8c (v1.18) (cilium/cilium#46539, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.10 docker digest to cd05a37 (v1.18) (cilium/cilium#46143, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.11 docker digest to 379065f (v1.18) (cilium/cilium#46540, @cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.12 (v1.18) (cilium/cilium#46563, @cilium-renovate[bot])
• chore(deps): update golangci/golangci-lint docker tag to v2.12.1 (v1.18) (cilium/cilium#45831, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.5 (v1.18) (cilium/cilium#46564, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752 (v1.18) (cilium/cilium#46378, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (cilium/cilium#45393, @cilium-renovate[bot])
• docs: fix Markdown-style hyperlink in mutual-authentication.rst (Backport PR cilium/cilium#46029, Upstream PR cilium/cilium#45751, @bitflicker64)
• fix(deps): update k8s.io patch updates stable to v0.33.12 (v1.18) (cilium/cilium#46145, @cilium-renovate[bot])
• fix(deps): update k8s.io patch updates stable to v0.33.12 (v1.18) (patch) (cilium/cilium#46017, @cilium-renovate[bot])
• fix(deps): update k8s.io patch updates stable to v0.33.12 (v1.18) (patch) (cilium/cilium#46019, @cilium-renovate[bot])
• fix(deps): update k8s.io patch updates stable to v0.33.13 (v1.18) (cilium/cilium#46565, @cilium-renovate[bot])
• fix(deps): update k8s.io/utils digest to ff6756f (v1.18) (cilium/cilium#46000, @cilium-renovate[bot])
• fix(deps): update module k8s.io/apimachinery to v0.33.12 (v1.18) (cilium/cilium#46001, @cilium-renovate[bot])
• fix(deps): update module k8s.io/apimachinery to v0.33.13 (v1.18) (cilium/cilium#46541, @cilium-renovate[bot])
• Revert ".github/workflows: do not use deployments for environments" (Backport PR cilium/cilium#46404, Upstream PR cilium/cilium#46348, @aanm)

Other Changes:

• [v1.18] proxy: Bump upstream version to v1.37.x (cilium/cilium#46440, @sayboras)
• install: Update image digests for v1.18.10 (cilium/cilium#45963, @cilium-release-bot[bot])
• v1.18: kvstore: Don't set fake pod CIDRs for remote nodes (cilium/cilium#46321, @pchaigno)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.11@sha256:e6945db60ad6d3b384e06ed678dbcee65f57f2f9fdcc64e976e7319f3db2b485

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.11@sha256:c78852680bab64e114fe3b89c8025f57e0a5ad3a302cd43fc4eb7e013f30cd05

docker-plugin

quay.io/cilium/docker-plugin:v1.18.11@sha256:506f2d535290e0b95d6cbee4a3fe03d96b73b20cbd5a12d2849b159be51e3236

hubble-relay

quay.io/cilium/hubble-relay:v1.18.11@sha256:6ec25d68c8cc0bf9c5d2f321149016eaa7d4a371475805b0b7fb61bcebad972c

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.11@sha256:b30b486ea7eb23a37c947e4606ccb1bc484ea31e9a236363fe696de0f174e1fb

operator-aws

quay.io/cilium/operator-aws:v1.18.11@sha256:75803337f8aa78caa543404775ec4fcdc55d6e856fedbacf1ade9e105f80fe00

operator-azure

quay.io/cilium/operator-azure:v1.18.11@sha256:c520cddc03a0ad7a4f5e45be644ebb29eb28fce1efdb373952c045f7dab9232c

operator-generic

quay.io/cilium/operator-generic:v1.18.11@sha256:00d6032de7b3e6ff8a1a990d29beaef5f9d01e40e87dc49b6c9b6c1fe080a327

operator

quay.io/cilium/operator:v1.18.11@sha256:b420faa2524b3753336d00c546a70d723a60ad1723a33ee06ad3c1b4e2d2f106