# Cilium changelog

> eBPF-based networking, observability and security.

- Vendor: Cilium
- Category: Developer Tools
- Official site: https://cilium.io
- Tracked by: What's New (https://whatsnew.fyi/product/cilium)
- Harvested from: GitHub (cilium/cilium)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v1.21.0-pre.0 — 1.21.0-pre.0

- Date: 2026-08-03
- Version: v1.21.0-pre.0
- Original notes: https://github.com/cilium/cilium/releases/tag/v1.21.0-pre.0
- Permalink: https://whatsnew.fyi/product/cilium/releases/v1.21.0-pre.0
- Labels: Pre-release

- **added** — Envoy resources can now be synchronized with Envoy incrementally using the new agent option `--envoy-xds-mode=delta-split` (or Helm value `envoy.xdsMode=delta-split`) to reduce CPU load and policy update latency
- **added** — Add agent side baseline driver and dummy device manager for network driver
- **added** — Add Cilium Network Driver CRDs, helm values and CRD chart entries
- **added** — Add cluster roles and mounts for the network driver feature
- **added** — Add extraInitContainers and disableDefaultVolumes to Helm values to support external certificate management for Hubble and ClusterMesh components
- **added** — Add GatewayAPI HTTPRoute support for hubble-ui in Helm
- **added** — Add Helm value to configure clustermesh apiserver service port
- **changed** — Update iptables from 1.8.8 to 1.8.11
- **changed** — ClusterMesh no longer restarts pods when changing remote clustermesh-apiserver IPs statically defined without a DNS name
- **changed** — Improve CT map adaptive GC interval calculation
- **changed** — Demote stale ADS endpoint warning in envoy
- **changed** — Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service
- **deprecated** — WireGuard Node Encryption is deprecated
- **removed** — Remove the deprecated `cidr` field from `CiliumNode.Status.Azure` interfaces and the deprecated `subnet` field from their addresses; use `interfaces[].subnet.{id,cidr}` instead
- **fixed** — Fix external traffic drops and inconsistencies on secondary ENIs with masquerade enabled
- **fixed** — Azure: stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged
- **fixed** — BPF hostfw: tolerate unknown CT protocols and rely on policies
- **fixed** — Fix IPV4_DIRECT_ROUTING selection on lo device
- **fixed** — Fix spurious warning about endpoints being deleted in endpoint watchdog
- **fixed** — Restore http-idle-timeout as the route idle timeout source in envoy
- **fixed** — Fix spurious 'unable to find ifindex for interface MAC' agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules

Summary of Changes
------------------

**Major Changes:**
* Envoy resources (e.g., Listeners, Network Policies, etc.) can now be synchronized with Envoy incrementally, reducing CPU load and policy update latency. This is enabled by the new agent option value `--envoy-xds-mode=delta-split`. Corresponding Helm value is `envoy.xdsMode=delta-split`. (cilium/cilium#45288, @jrajahalme)
* network driver: add agent side baseline driver and dummy device manager (cilium/cilium#47254, @bersoare)

**Minor Changes:**
* build: Update iptables from 1.8.8 to 1.8.11 (cilium/cilium#47623, @HadrienPatte)
* clustermesh: no longer restart pods when changing remote clustermesh-apiserver IPs statically defined (without a DNS name) (cilium/cilium#47190, @MrFreezeex)
* CT map adaptive GC interval calculation improvements (cilium/cilium#46796, @fristonio)
* Deprecate WireGuard Node Encryption (cilium/cilium#47219, @pchaigno)
* envoy: demote stale ADS endpoint warning (cilium/cilium#47148, @nezdolik)
* Fix external traffic drops/inconsistencies on secondary ENIs with masquerade enabled (cilium/cilium#47008, @monta-riahi)
* helm: Add extraInitContainers and disableDefaultVolumes to support external certificate management for Hubble and ClusterMesh components. (cilium/cilium#46688, @alaashehab-m)
* helm: add GatewayAPI HTTPRoute support for hubble-ui (cilium/cilium#46792, @SchulteMK)
* helm: add value to configure clustermesh apiserver service port (cilium/cilium#47375, @crealte)
* network driver: add Cilium Network Driver CRDs, helm values and CRD chart entries (cilium/cilium#46238, @bersoare)
* network driver: add cluster roles and mounts for the network driver feature (cilium/cilium#46995, @bersoare)
* Removed the deprecated `cidr` field from `CiliumNode.Status.Azure` interfaces and the deprecated `subnet` field from their addresses; use `interfaces[].subnet.{id,cidr}` instead. (cilium/cilium#47461, @jaredledvina)
* Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (cilium/cilium#47529, @julianwiedmann)

**Bugfixes:**
* azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (cilium/cilium#47449, @jaredledvina)
* bpf: hostfw: tolerate unknown CT protocols and rely on policies (cilium/cilium#47343, @smagnani96)
* datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (cilium/cilium#46861, @fdomain)
* endpoint/watchdog: Avoid warning about endpoints being deleted (cilium/cilium#47625, @christarazi)
* envoy: restore http-idle-timeout as the route idle timeout source (cilium/cilium#47583, @aanm)
* Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (cilium/cilium#47295, @aanm)
* Fix abnormal ip allocation caused by hostnetwork pod (cilium/cilium#47552, @haozhangami)
* Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (cilium/cilium#47593, @julianwiedmann)
* Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with `NotAllowedByListeners` when the TCP listener had an explicit `AllowedRoutes.Kinds` restriction. (cilium/cilium#46842, @pidreher)
* gateway-api: preserve duplicate HTTPRoute rule precedence (cilium/cilium#46696, @thorn3r)
* gateway-api: prevent conflicted listeners from reaching ingestion (cilium/cilium#47457, @asauber)
* gateway-api: sync ListenerSet TLS secrets on ListenerSet events (cilium/cilium#47627, @mhofstetter)
* hubble: fix four config knobs that never reach their sink (cilium/cilium#47637, @aanm)
* hubble: Fixed false-positive increments of the `hubble_ring_buffer` lost events metric. (cilium/cilium#46585, @chez-shanpu)
* ipam: wait for pool readiness on fresh multi-pool allocation (cilium/cilium#474

_[Truncated at 4000 characters — full notes: https://github.com/cilium/cilium/releases/tag/v1.21.0-pre.0]_

### v1.20.0 — 1.20.0

- Date: 2026-07-29
- Version: v1.20.0
- Original notes: https://github.com/cilium/cilium/releases/tag/v1.20.0
- Permalink: https://whatsnew.fyi/product/cilium/releases/v1.20.0

- **changed** — Move from Gateway API v1.4 to v1.6.1 with support for capabilities graduated across both upstream releases
- **added** — Gateway API ListenerSets to let application teams attach and manage their own listeners while platform teams retain ownership of shared Gateways
- **added** — Gateway API BackendTLSPolicy support to configure TLS and backend certificate validation for traffic between gateway and application services
- **added** — TCPRoute and UDPRoute support for managing non-HTTP services like databases, DNS servers, and game servers through the Gateway API model
- **added** — Gateway API ExternalAuth filter support to authenticate and authorize HTTPRoute requests through an external service before reaching the application
- **added** — Native CORS support for HTTPRoutes and additional 303, 307, and 308 redirect codes
- **added** — CiliumGatewayClassConfig ability to overwrite, append, or preserve the HTTP Server response header
- **added** — Configurable gRPC-Web translation in CiliumGatewayClassConfig to disable automatic translation for Gateways needing to pass original traffic through unchanged
- **added** — Extensible datapath plugins that let cloud providers extend or instrument Cilium's eBPF datapath with independently versioned programs
- **added** — Automatic netkit selection via bpf.datapathMode=auto to use netkit on supported kernels and fall back to veth on other nodes
- **added** — Dual-stack egress gateway support to configure explicit IPv6 egress IP
- **changed** — IPv4 Egress Gateway traffic now strictly honors the interface selected by the policy, matching existing IPv6 behavior
- **added** — New Hive shell commands to expose route policies and clearer BGP peer output formats
- **changed** — Upgrade GoBGP control plane to v4.6.1 and optimize route-policy reconciliation
- **added** — IPv6 prefix allocation to pods through AWS ENI IPAM in beta
- **added** — Migration support for existing clusters to move from cluster-pool IPAM to multi-pool IPAM without rebuilding

🎉 **Release Announcement** 🎉: We are excited to announce the [Cilium 1.20.0](https://github.com/cilium/cilium/releases/tag/v1.20.0) release!

More than **2,660 new commits** have landed in this release, supported by a community of over **1,100 contributors** and more than **24,800 GitHub stars**! 🤩

⚠️ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the `cilium.io/v2alpha1` `CiliumNodeConfig` API, the libnetwork integration, or a custom CNI configuration. See the [Upgrade Guide](https://docs.cilium.io/en/v1.20/operations/upgrade/#upgrade-notes) for details.

The full changelog can be found [here](https://github.com/cilium/cilium/blob/v1.20/CHANGELOG.md).

Here are some of the highlights:

* ⛩️ **Gateway API**
    * 🚀 **Gateway API v1.6.1**: Cilium moves from Gateway API v1.4 to v1.6.1, bringing support for capabilities that graduated across both upstream releases. ([cilium/cilium#45251](https://github.com/cilium/cilium/pull/45251), @youngnick; [cilium/cilium#46827](https://github.com/cilium/cilium/pull/46827), [cilium/cilium#47274](https://github.com/cilium/cilium/pull/47274), @arybolovlev)
    * 👥 **Delegate Gateway Listeners**: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. ([cilium/cilium#46303](https://github.com/cilium/cilium/pull/46303), [cilium/cilium#46785](https://github.com/cilium/cilium/pull/46785), @asauber)
    * 🔏 **Encrypt Traffic to Backends**: Gateway API `BackendTLSPolicy` support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. ([cilium/cilium#43045](https://github.com/cilium/cilium/pull/43045), @youngnick)
    * 🔀 **TCPRoute and UDPRoute**: Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic. ([cilium/cilium#46184](https://github.com/cilium/cilium/pull/46184), [cilium/cilium#46970](https://github.com/cilium/cilium/pull/46970), @eminaktas; [cilium/cilium#47381](https://github.com/cilium/cilium/pull/47381), @arybolovlev)
    * 🔐 **External Authorization**: HTTPRoute requests can now be authenticated and authorized through an external service before they reach the application, using the Gateway API `ExternalAuth` filter from GEP-1494. ([cilium/cilium#45739](https://github.com/cilium/cilium/pull/45739), @gauteoh)
    * 🎛️ **More HTTP Traffic Controls**: HTTPRoutes gain native CORS support and additional 303, 307 and 308 redirect codes. `CiliumGatewayClassConfig` can also overwrite, append or preserve the HTTP Server response header. ([cilium/cilium#45924](https://github.com/cilium/cilium/pull/45924), @arybolovlev; [cilium/cilium#47232](https://github.com/cilium/cilium/pull/47232), @youngnick; [cilium/cilium#46764](https://github.com/cilium/cilium/pull/46764), @xtineskim)
    * ↔️ **Configurable gRPC-Web Translation**: `CiliumGatewayClassConfig` can disable automatic gRPC-web translation for Gateways that need to pass the original traffic through unchanged. Translation remains enabled by default. ([cilium/cilium#45984](https://github.com/cilium/cilium/pull/45984), @thorn3r)


* 🚠 **Networking**
    * 🔌 **Extensible Datapath**: Datapath plugins let cloud providers extend or instrument Cilium's eBPF datapath with independently versioned programs, without maintaining a Cilium fork. ([cilium/cilium#45028](https://github.com/cilium/cilium/pull/45028), [cilium/cilium#45429](https://github.com/cilium/cilium/pull/45429), [cilium/cilium#45558](https://github.com/cilium/cilium/pull/45558), [cilium/cilium#46673](https://github.com/cilium/cilium/pull/46673), [cilium/cilium#46872](https://github.com/cilium/cilium/pull/46872), @jrife)
    * 🚄 **Automatic Netkit Selection**: Set `bpf.datapathMode=auto` to use netkit automatically on supported kernels and fall

_[Truncated at 4000 characters — full notes: https://github.com/cilium/cilium/releases/tag/v1.20.0]_

### v1.20.0-rc.1 — 1.20.0-rc.1

- Date: 2026-07-21
- Version: v1.20.0-rc.1
- Original notes: https://github.com/cilium/cilium/releases/tag/v1.20.0-rc.1
- Permalink: https://whatsnew.fyi/product/cilium/releases/v1.20.0-rc.1
- Labels: Pre-release

- **deprecated** — Cilium's Beta Mutual Auth support is now deprecated and will be removed in a future version
- **changed** — Promote Multi-Cluster Services API (MCS-API) to a stable support level
- **added** — Add HTTP Server header transformation support to Gateway API
- **changed** — Cilium now supports the additional redirect codes 303, 307, and 308 for HTTPRoute redirects
- **changed** — Avoid operator roles and secret creation in Helm preflight
- **changed** — Update runtime and builder images base to ubuntu 26.04
- **fixed** — Unsubscribe node handler on shutdown in datapath/linux
- **fixed** — Fix masquerade IP selection with route-discovered node addresses
- **fixed** — Relax strict ingress to allow hostport
- **fixed** — Don't run CRD backend with real handler when reading from KVStore in doublewrite
- **fixed** — Fix bug causing Cilium to intercept traffic towards LoadBalancer VIPs when KPR is disabled
- **fixed** — Fix bug where BGP Migration may deadlock
- **fixed** — Fix potential hangs caused by Netlink errors in filterAndDestroySockets
- **fixed** — Add cluster-mesh to the Entity enum validation in policy
- **fixed** — Fix redirect guards affecting route ordering for similar HTTPRoute matches
- **fixed** — Include ext auth into HTTPRoute checks
- **fixed** — Watch backend Service changes for tcp and udp routes in gateway-api
- **fixed** — Watch ServiceImport refs from GRPCRoutes
- **fixed** — Fix races on defaultController in operator/endpointslice
- **fixed** — Fix nil-pointer panic in CiliumNode GC in operator
- **changed** — Optimize route policy reconciliation to reduce unnecessary processing on the cilium agent

Summary of Changes
------------------

**Major Changes:**
* Cilium's Beta Mutual Auth support is now deprecated and will be removed in a future version. (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47162, @youngnick)
* clustermesh: promote Multi-Cluster Services API (MCS-API) to a stable support level and improve its documentation (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#46953, @MrFreezeex)

**Minor Changes:**
* envoy: reject CECs with duplicate filter chains (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#46848, @asauber)
* Gateway API: Add HTTP Server header transformation support (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#46764, @xtineskim)
* gateway-api: Cilium now supports the additional redirect codes 303, 307, and 308 for HTTPRoute redirects. (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47232, @youngnick)
* helm: Avoid operator roles, secret creation in preflight (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#47053, @joestringer)
* images: Update runtime and builder images base to ubuntu 26.04 (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47215, @HadrienPatte)

**Bugfixes:**
* datapath/linux: Unsubscribe node handler on shutdown (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47197, @HadrienPatte)
* datapath: Fix masquerade IP selection with route-discovered node addresses (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#46843, @tsotne95)
* datapath: relax strict ingress to allow hostport (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#47200, @rgo3)
* doublewrite: Don't run CRD backend with real handler when reading from KVStore (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#47144, @HadrienPatte)
* Fix bug causing Cilium to intercept traffic towards LoadBalancer VIPs when KPR is disabled, when the traffic should be delegated to kube-proxy. (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47204, @ajmmm)
* Fix bug where BGP Migration may deadlock (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#46897, @weizhoublue)
* Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#46967, @ysksuzuki)
* fix(policy): add cluster-mesh to the Entity enum validation (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47225, @doniacld)
* gateway-api: fix redirect guards affecting route ordering for similar HTTPRoute matches. (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#46884, @arybolovlev)
* gateway-api: include ext auth into HTTPRoute checks (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47265, @mhofstetter)
* gateway-api: watch backend Service changes for tcp&udp routes (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47239, @mhofstetter)
* gateway-api: watch ServiceImport refs from GRPCRoutes (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47268, @mhofstetter)
* operator/endpointslice: Fix races on defaultController (Backport PR cilium/cilium#47374, Upstream PR cilium/cilium#47102, @mauriciovasquezbernal)
* operator: Fix nil-pointer panic in CiliumNode GC (Backport PR cilium/cilium#47179, Upstream PR cilium/cilium#47127, @HadrienPatte)

**CI Changes:**
* .github: fix conformance-ginkgo sysdump artifact upload path (Backport PR cilium/cilium#47291, Upstream PR cilium/cilium#47187, @aanm)
* .github: retry CLI and binary downloads over transient network errors (Backport PR cilium/cilium#47291, Upstream PR cilium/cilium#47167, @aanm)
* .github: select a usable AZ for EKS us-west-1 (Backport PR cilium/cilium#47291, Upstream PR cilium/cilium#47168, @aanm)
* ci: wait for all AKS nodes to register before labeling nodes-without-cilium (Backport PR cilium/cilium#47397, Upstream PR cilium/cilium#47270, @aanm)
* conformance-aws-cni: skip l7 and fqdn tests by name on chaining mode (Backport PR cilium/cilium#

_[Truncated at 4000 characters — full notes: https://github.com/cilium/cilium/releases/tag/v1.20.0-rc.1]_

### v1.19.6 — 1.19.6

- Date: 2026-07-16
- Version: v1.19.6
- Original notes: https://github.com/cilium/cilium/releases/tag/v1.19.6
- Permalink: https://whatsnew.fyi/product/cilium/releases/v1.19.6

- **changed** — Use L3 sockets for solicited node multicast signaling in datapath/l2responder
- **added** — Add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig
- **fixed** — Fix policy service label selector handling
- **fixed** — Fix IPv6 neighbor solicitation handling in host firewall
- **fixed** — Don't run CRD backend with real handler when reading from KVStore in doublewrite
- **fixed** — Fix race when reading endpoint properties
- **fixed** — Fix cilium_operator_unmanaged_pods gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted
- **fixed** — Fix stale hostport entries if a pod was deleted and immediately recreated in host network
- **fixed** — Fix regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade while the agent was restoring the Pod's network policy
- **fixed** — Fix allowedRoute namespace and kind restrictions on multi-listener Gateways
- **fixed** — Fix host firewall enabled in the live ConfigMap when disabling hostFirewall.enabled via Helm
- **fixed** — Fix ClusterMesh service affinity annotation service.cilium.io/affinity: "none" incorrectly dropping all remote backends
- **fixed** — Fix ctmap gc duration metric recording
- **fixed** — Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes
- **fixed** — Fix potential hangs caused by Netlink errors in filterAndDestroySockets
- **fixed** — Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled if etcd is behind a Kubernetes service
- **fixed** — Fix the UDP tunnel check in the BIG TCP probe
- **fixed** — Fix Hubble policy correlation for port ranges
- **fixed** — Add Gateway check for when hostNetwork is enabled in gateway-api
- **changed** — Each HTTPS and TLS passthrough port now receives its own Envoy listener and RouteConfiguration in gateway-api

Summary of Changes
------------------

**Minor Changes:**
* datapath/l2responder: use l3 sockets for solicited node multicast signaling (Backport PR cilium/cilium#46845, Upstream PR cilium/cilium#46332, @bersoare)
* gateway-api: add support for configuring Gateway access logs through the new `spec.telemetry.accessLogs` field in CiliumGatewayClassConfig. (Backport PR cilium/cilium#46933, Upstream PR cilium/cilium#46403, @arybolovlev)

**Bugfixes:**
* [v1.19] Fix policy service label selector handling (cilium/cilium#46946, @fristonio)
* bpf: fix ipv6 neighbor solicitation handling in host firewall (Backport PR cilium/cilium#46669, Upstream PR cilium/cilium#46325, @atykhyy)
* doublewrite: Don't run CRD backend with real handler when reading from KVStore (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#47144, @HadrienPatte)
* endpoint: Fix race when reading endpoint properties (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#46991, @gandro)
* Fix `cilium_operator_unmanaged_pods` gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (Backport PR cilium/cilium#46975, Upstream PR cilium/cilium#46668, @Suyash1700)
* Fix a bug which could lead to stale hostport entries if a pod was deleted and immediately recreated in host network. (Backport PR cilium/cilium#46793, Upstream PR cilium/cilium#46747, @giorio94)
* Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (Backport PR cilium/cilium#46974, Upstream PR cilium/cilium#46927, @aanm)
* Fix allowedRoute namespace and kind restrictions on multi-listener Gateways. (Backport PR cilium/cilium#46826, Upstream PR cilium/cilium#45693, @eufriction)
* Fix bug that left the host firewall enabled in the live ConfigMap when disabling hostFirewall.enabled (toggling it from true to false) via Helm. (Backport PR cilium/cilium#46669, Upstream PR cilium/cilium#44748, @shibaPuppy)
* Fix ClusterMesh service affinity annotation `service.cilium.io/affinity: "none"` incorrectly dropping all remote backends, causing traffic blackhole when no local endpoints exist. (Backport PR cilium/cilium#46691, Upstream PR cilium/cilium#46635, @mkamadeus)
* Fix ctmap gc duration metric recording (Backport PR cilium/cilium#46975, Upstream PR cilium/cilium#46873, @fristonio)
* Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR cilium/cilium#47002, Upstream PR cilium/cilium#46821, @fristonio)
* Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#46967, @ysksuzuki)
* Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#46444, @giorio94)
* Fix the UDP tunnel check in the BIG TCP probe. (Backport PR cilium/cilium#46793, Upstream PR cilium/cilium#46710, @gentoo-root)
* Fixes a bug where Hubble policy correlation does not work for port ranges. (Backport PR cilium/cilium#46793, Upstream PR cilium/cilium#46643, @squeed)
* gateway-api: Add Gateway check for when hostNetwork is enabled (Backport PR cilium/cilium#46837, Upstream PR cilium/cilium#46350, @xtineskim)
* gateway-api: Each HTTPS and TLS passthrough port now receives its own Envoy listener and RouteConfiguration. (Backport PR cilium/cilium#46826, Upstream PR cilium/cilium#44889, @eufriction)
* ipam/multi-pool: Do now wait for zero prealloc request (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#46867, @pippolo84)
* operator: Fix nil-pointer panic in CiliumNode GC (Backport PR cilium/cilium#47181, Upstream PR cilium/cilium#47127, @HadrienPatte)

**CI Changes:**
* .github: Generate CI binaries with correct module version (Backport PR cilium/cilium#47099, Upstream PR cilium

_[Truncated at 4000 characters — full notes: https://github.com/cilium/cilium/releases/tag/v1.19.6]_

### v1.18.12 — 1.18.12

- Date: 2026-07-16
- Version: v1.18.12
- Original notes: https://github.com/cilium/cilium/releases/tag/v1.18.12
- Permalink: https://whatsnew.fyi/product/cilium/releases/v1.18.12

- **added** — Add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig
- **fixed** — Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes
- **fixed** — Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service
- **fixed** — Add Gateway check for when hostNetwork is enabled
- **fixed** — Do not wait for zero prealloc request in ipam/multi-pool
- **fixed** — Fix cilium policy_change_total metric failure label which caused unnecessary warnings
- **changed** — Return model from Gateway API ingestion
- **changed** — Clarify Hubble static/dynamic exporter file rotation settings in documentation
- **changed** — Fix note about ipv4-native-routing-cidr default value in documentation

Summary of Changes
------------------

**Minor Changes:**
* gateway-api: add support for configuring Gateway access logs through the new `spec.telemetry.accessLogs` field in CiliumGatewayClassConfig. (Backport PR cilium/cilium#47016, Upstream PR cilium/cilium#46403, @arybolovlev)

**Bugfixes:**
* Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR cilium/cilium#47003, Upstream PR cilium/cilium#46821, @fristonio)
* Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service (Backport PR cilium/cilium#47196, Upstream PR cilium/cilium#46444, @giorio94)
* gateway-api: Add Gateway check for when hostNetwork is enabled (Backport PR cilium/cilium#46838, Upstream PR cilium/cilium#46350, @xtineskim)
* ipam/multi-pool: Do now wait for zero prealloc request (Backport PR cilium/cilium#47196, Upstream PR cilium/cilium#46867, @pippolo84)

**CI Changes:**
* .github: Generate CI binaries with correct module version (Backport PR cilium/cilium#47098, Upstream PR cilium/cilium#46742, @joestringer)
* chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR cilium/cilium#46921, Upstream PR cilium/cilium#46840, @sekhar-isovalent)

**Misc Changes:**
* .github: allow fork PR checkout with actions/checkout v7 (Backport PR cilium/cilium#47136, Upstream PR cilium/cilium#47133, @aanm)
* [v1.18] - .github/workflows: unpin cilium/cilium self-references to track main (cilium/cilium#46612, @aanm)
* chore(deps): update all github action dependencies (v1.18) (cilium/cilium#46912, @cilium-renovate[bot])
* chore(deps): update all github action dependencies (v1.18) (cilium/cilium#47111, @cilium-renovate[bot])
* chore(deps): update all-dependencies (v1.18) (cilium/cilium#46909, @cilium-renovate[bot])
* chore(deps): update aws-actions/configure-aws-credentials action to v6.2.2 (v1.18) (cilium/cilium#47125, @cilium-renovate[bot])
* chore(deps): update base-images (v1.18) (cilium/cilium#46776, @cilium-renovate[bot])
* chore(deps): update base-images to v1.25.12 (v1.18) (cilium/cilium#46983, @cilium-renovate[bot])
* chore(deps): update dependency cilium/cilium-cli to v0.19.5 (v1.18) (cilium/cilium#46727, @cilium-renovate[bot])
* chore(deps): update docker.io/library/alpine docker tag to v3.22.5 (v1.18) (cilium/cilium#46775, @cilium-renovate[bot])
* chore(deps): update docker.io/library/golang:1.25.11 docker digest to 00feed3 (v1.18) (cilium/cilium#46659, @cilium-renovate[bot])
* chore(deps): update docker.io/library/golang:1.25.11 docker digest to f188e8c (v1.18) (cilium/cilium#46910, @cilium-renovate[bot])
* chore(deps): update docker.io/library/golang:1.25.12 docker digest to d7912ce (v1.18) (cilium/cilium#47110, @cilium-renovate[bot])
* chore(deps): update gcr.io/distroless/static:nonroot docker digest to d29e660 (v1.18) (cilium/cilium#47040, @cilium-renovate[bot])
* chore(deps): update quay.io/cilium/certgen docker tag to v0.4.6 (v1.18) (cilium/cilium#47041, @cilium-renovate[bot])
* chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc (v1.18) (cilium/cilium#46701, @cilium-renovate[bot])
* chore: BYOCNI loopback for cilium (Backport PR cilium/cilium#46706, Upstream PR cilium/cilium#46646, @sekhar-isovalent)
* chore: optimize building gops and cni/loopback (Backport PR cilium/cilium#46846, Upstream PR cilium/cilium#46781, @sekhar-isovalent)
* ci: always set fail-fast to false on image builds (Backport PR cilium/cilium#47196, Upstream PR cilium/cilium#47064, @aanm)
* docs: clarify Hubble static/dynamic exporter file rotation settings (Backport PR cilium/cilium#47196, Upstream PR cilium/cilium#47026, @maksymbilokur-cisco)
* docs: fix note about ipv4-native-routing-cidr default value (Backport PR cilium/cilium#46794, Upstream PR cilium/cilium#46603, @rptaylor)
* Fix instance of cilium having incorrect sp

_[Truncated at 4000 characters — full notes: https://github.com/cilium/cilium/releases/tag/v1.18.12]_

### v1.17.18 — 1.17.18

- Date: 2026-07-16
- Version: v1.17.18
- Original notes: https://github.com/cilium/cilium/releases/tag/v1.17.18
- Permalink: https://whatsnew.fyi/product/cilium/releases/v1.17.18

- **fixed** — Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes
- **fixed** — Do not wait for zero prealloc request in ipam/multi-pool
- **fixed** — Fix cilium policy_change_total metric having incorrect failure label value which caused unnecessary warnings
- **changed** — Generate CI binaries with correct module version
- **changed** — Generate full Cilium version in worktree

Summary of Changes
------------------

**Bugfixes:**
* Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR cilium/cilium#47006, Upstream PR cilium/cilium#46821, @fristonio)
* ipam/multi-pool: Do now wait for zero prealloc request (Backport PR cilium/cilium#47199, Upstream PR cilium/cilium#46867, @pippolo84)

**CI Changes:**
* .github: Generate CI binaries with correct module version (Backport PR cilium/cilium#47097, Upstream PR cilium/cilium#46742, @joestringer)
* chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR cilium/cilium#46922, Upstream PR cilium/cilium#46840, @sekhar-isovalent)
* v1.17: ariane: Remove Conformance AKS (cilium/cilium#47145, @pchaigno)
* v1.17: workflows: Remove coverage for AKS (cilium/cilium#46998, @pchaigno)

**Misc Changes:**
* .github: allow fork PR checkout with actions/checkout v7 (Backport PR cilium/cilium#47137, Upstream PR cilium/cilium#47133, @aanm)
* [v1.17] - .github/workflows: unpin cilium/cilium self-references to track main (cilium/cilium#46611, @aanm)
* [v1.17] - Reapply ".github/workflows: do not use deployments for environments" (cilium/cilium#46576, @aanm)
* chore(deps): update all github action dependencies (v1.17) (cilium/cilium#46660, @cilium-renovate[bot])
* chore(deps): update all github action dependencies (v1.17) (cilium/cilium#46778, @cilium-renovate[bot])
* chore(deps): update all github action dependencies (v1.17) (cilium/cilium#46916, @cilium-renovate[bot])
* chore(deps): update all github action dependencies (v1.17) (cilium/cilium#47113, @cilium-renovate[bot])
* chore(deps): update all-dependencies (v1.17) (cilium/cilium#46913, @cilium-renovate[bot])
* chore(deps): update aws-actions/configure-aws-credentials action to v6.2.2 (v1.17) (cilium/cilium#47126, @cilium-renovate[bot])
* chore(deps): update base-images to v1.25.12 (v1.17) (cilium/cilium#46984, @cilium-renovate[bot])
* chore(deps): update dependency cilium/cilium-cli to v0.19.5 (v1.17) (cilium/cilium#46728, @cilium-renovate[bot])
* chore(deps): update docker.io/library/golang:1.25.11 docker digest to 00feed3 (v1.17) (cilium/cilium#46661, @cilium-renovate[bot])
* chore(deps): update docker.io/library/golang:1.25.11 docker digest to 995e25c (v1.17) (cilium/cilium#46777, @cilium-renovate[bot])
* chore(deps): update docker.io/library/golang:1.25.11 docker digest to f188e8c (v1.17) (cilium/cilium#46914, @cilium-renovate[bot])
* chore(deps): update docker.io/library/golang:1.25.12 docker digest to d7912ce (v1.17) (cilium/cilium#47112, @cilium-renovate[bot])
* chore(deps): update gcr.io/distroless/static:nonroot docker digest to d29e660 (v1.17) (cilium/cilium#47042, @cilium-renovate[bot])
* chore(deps): update google/cloud-sdk docker tag to v573 (v1.17) (cilium/cilium#46667, @cilium-renovate[bot])
* chore(deps): update quay.io/cilium/certgen docker tag to v0.4.6 (v1.17) (cilium/cilium#47043, @cilium-renovate[bot])
* chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc (v1.17) (cilium/cilium#46702, @cilium-renovate[bot])
* chore: BYOCNI loopback for cilium (Backport PR cilium/cilium#46707, Upstream PR cilium/cilium#46646, @sekhar-isovalent)
* chore: optimize building gops and cni/loopback (Backport PR cilium/cilium#46847, Upstream PR cilium/cilium#46781, @sekhar-isovalent)
* ci: always set fail-fast to false on image builds (Backport PR cilium/cilium#47199, Upstream PR cilium/cilium#47064, @aanm)
* docs: fix note about ipv4-native-routing-cidr default value (Backport PR cilium/cilium#46795, Upstream PR cilium/cilium#46603, @rptaylor)
* Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR cilium/cilium#46795, Upstream PR cilium/cilium#46388, @tommyp1ckles)
* fix(deps): update k8s.io/utils digest to be93311 (v1.17) (cilium/cilium#46915,

_[Truncated at 4000 characters — full notes: https://github.com/cilium/cilium/releases/tag/v1.17.18]_

### v1.20.0-rc.0 — 1.20.0-rc.0

- Date: 2026-07-14
- Version: v1.20.0-rc.0
- Original notes: https://github.com/cilium/cilium/releases/tag/v1.20.0-rc.0
- Permalink: https://whatsnew.fyi/product/cilium/releases/v1.20.0-rc.0
- Labels: Pre-release

- **added** — Add a new policy entity `cluster-mesh` which selects all endpoints in all meshed clusters
- **changed** — Make the `cluster` and `cluster-mesh` policy entities create significantly fewer policy map entries
- **changed** — Bump the default CNI configuration version from 0.3.1 to 1.0.0
- **fixed** — Fix race condition when reading endpoint properties
- **fixed** — Fix `cilium_operator_unmanaged_pods` gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted
- **fixed** — Fix regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade while restoring the Pod's network policy
- **fixed** — Fix ctmap gc duration metric recording
- **fixed** — Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes
- **fixed** — Fix regression preventing Cilium from starting when configured in kvstore mode with KPR disabled if etcd is behind a Kubernetes service
- **fixed** — Fix IPv6 subtraction borrow to avoid pool fragmentation
- **fixed** — Fix issue where invalid regex on an HTTPRoute or GRPCRoute matcher is accepted but causes Envoy to NACK
- **fixed** — Fix IPAM multi-pool to not wait for zero prealloc request
- **changed** — Update cilium/json-mock to v1.4.1 to resolve CI test flakes

Summary of Changes
------------------

**Minor Changes:**
* Adds a new policy entity, `cluster-mesh`, which selects all endpoints in all meshed clusters. Also, makes the `cluster` and `cluster-mesh` create significantly fewer policy map entries. (cilium/cilium#46813, @squeed)
* docs: add ListenerSet documentation (cilium/cilium#46850, @asauber)
* The default CNI configuration version has been bumped from 0.3.1 to 1.0.0. Use the `cni.customConf` Helm value to set it back to 0.3.1 if needed. (cilium/cilium#46971, @gandro)

**Bugfixes:**
* endpoint: Fix race when reading endpoint properties (cilium/cilium#46991, @gandro)
* Fix `cilium_operator_unmanaged_pods` gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (cilium/cilium#46668, @Suyash1700)
* Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (cilium/cilium#46927, @aanm)
* Fix ctmap gc duration metric recording (cilium/cilium#46873, @fristonio)
* Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (cilium/cilium#46821, @fristonio)
* Fix regression preventing Cilium from starting when configured in kvstore mode with KPR disabled, if etcd is behind a Kubernetes service (cilium/cilium#46444, @giorio94)
* fix: handle IPv6 subtraction borrow to avoid pool fragmentation (cilium/cilium#47011, @weizhoublue)
* Fixes an issue where invalid regex on an HTTPRoute or GRPCRoute matcher is accepted but causes Envoy to NACK (cilium/cilium#47005, @0xch4z)
* ipam/multi-pool: Do now wait for zero prealloc request (cilium/cilium#46867, @pippolo84)

**CI Changes:**
* .github: Generate CI binaries with correct module version (cilium/cilium#46742, @joestringer)
* .github: Revert pull_request_target to actions/checkout v6 (cilium/cilium#46940, @joestringer)
* .github: Revert workflow_call to actions/checkout v6 (cilium/cilium#46943, @joestringer)
* ariane: Fix v1.20 image build dependency (cilium/cilium#47153, @joestringer)
* bpf/Makefile: Simplify and fix `MAX_*_OPTIONS` (cilium/cilium#46852, @pchaigno)
* ci: Add ORGANIZATION_STAGING for stable tags (cilium/cilium#46954, @nebril)
* ci: conditional on registry authentication (cilium/cilium#47037, @Artyop)
* ci: keep AKS nodes-without-cilium ready to stop auto-repair reboots (cilium/cilium#46942, @aanm)
* ci: reverse logic for docker auth requirement (cilium/cilium#47081, @Artyop)
* ci: Run KCNP tests via conformance-kind-proxy-embedded (cilium/cilium#45074, @jrajahalme)
* CI: some refactors for waiting images & conformance runtime (cilium/cilium#46957, @Artyop)
* cilium/json-mock is updated to v1.4.1 to resolve ci test flakes. (cilium/cilium#47058, @jrajahalme)
* Collect /proc/net/softnet_stat, /proc/net/snmp and /proc/net/netstat in sysdumps to help diagnose host-level packet drops. (cilium/cilium#46985, @aanm)
* egressgw: add script testing for sysctl (cilium/cilium#46988, @julianwiedmann)
* envoy: cleanup use_nphds in ads code (cilium/cilium#46831, @nezdolik)
* gha/gateway-api: make the conformance job reliable (real skip + CRD-fetch retry) (cilium/cilium#46978, @aanm)
* gha/net-perf-gke: fall back to other zones on GCE stockout (cilium/cilium#46969, @aanm)
* gha/scale: fix scale-5/scale-100 GCE (kops zone + workload node join) (cilium/cilium#46865, @aanm)
* gw-api-ci: Remove crd channel in matrix (cilium/cilium#46679, @xtineskim)
* gw-api-conformance: unskip mesh tests (cilium/cilium#47048, @xtineskim)
* Increase the timeout for the kvstore readiness wait in kind-based CI to avoid flakes on slow etcd image pulls. (cilium/cilium#46882, @aanm)
* renovate: restore updates of docker images (cilium/cilium#47022, @giorio94)
* test/cyclonus: capture logs of every job pod so a runner crash is diagnosable (cilium/cilium#46980, @aanm)
* Use fake external targets on nodes without Cilium in EKS CI workf

_[Truncated at 4000 characters — full notes: https://github.com/cilium/cilium/releases/tag/v1.20.0-rc.0]_

### v1.20.0-pre.4 — 1.20.0-pre.4

- Date: 2026-07-03
- Version: v1.20.0-pre.4
- Original notes: https://github.com/cilium/cilium/releases/tag/v1.20.0-pre.4
- Permalink: https://whatsnew.fyi/product/cilium/releases/v1.20.0-pre.4
- Labels: Pre-release

- **added** — ENI IPAM mode now supports allocating and using IPv6 prefixes
- **removed** — Docker libnetwork plugin has been sunset and is no longer available
- **added** — Envoy: Add ADS (Aggregated Discovery Service) server support
- **added** — Gateway-API: Add TCPRoute and UDPRoute support
- **added** — GatewayAPI: Implement ListenerSets to allow per-namespace control of many Listeners for a single Gateway
- **added** — Introduce datapath plugins to enable third party datapath extensions
- **changed** — Remote-node and world policy entities are now much more efficient by adding a new type of wildcard entry in the policy map
- **added** — Add --reply and --not-reply flags to hubble observe to filter flows by reply direction
- **added** — Add spec.allowFirstIP and spec.allowLastIP to CiliumPodIPPool to allow Multi-Pool IPAM users to make the first and last IPs allocatable
- **added** — Add opt-in Helm value nativeRoutingCIDRFromClusterPool to derive the native routing CIDR from the cluster-pool IPAM CIDR
- **added** — Add support to migrate a cluster from cluster-pool IPAM mode to multi-pool IPAM mode
- **added** — Added cilium-dbg commands to help diagnose policy map pressure
- **added** — Added the policy/mapstate/stage command to cilium-dbg script to show the difference in policy map entries from proposed policies
- **changed** — CIDR selectors in network policies can now match in-cluster IPs
- **changed** — Azure: Return actual public IP from AssignPublicIPAddresses
- **changed** — BGP: Migrate CRDs storage version from v2alpha1 to v2
- **added** — cilium-dbg: add table-json format to bgp/peers and bgp/routes
- **changed** — Clustermesh: update MCS-API to v0.5.1
- **changed** — Daemon: allow --local-router-ipv4/6 without --enable-endpoint-routes

Summary of Changes
------------------

**Major Changes:**
* (Beta) ENI IPAM mode with IPv6: The ENI IPAM mode now supports allocating and using IPv6 prefixes. (cilium/cilium#46756, @41ks)
* As previously announced, docker libnetwork plugin as been sunset and is no longer available. (cilium/cilium#46489, @aanm)
* envoy: Add ADS (Aggregated Discovery Service) server support (cilium/cilium#43887, @nezdolik)
* gateway-api: Add TCPRoute and UDPRoute support (cilium/cilium#46184, @eminaktas)
* GatewayAPI: Implement ListenerSets. Allows per-namespace control of many Listeners for a single Gateway (cilium/cilium#46303, @asauber)
* Introduce datapath plugins to enable third party datapath extensions. (cilium/cilium#46673, @jrife)
* Makes the `remote-node` and `world` policy entities much more efficient by adding a new type of wildcard entry in the policy map. This can reduce policy map usage by thousands of entries in certain circumstances. (cilium/cilium#46438, @squeed)

**Minor Changes:**
* Add --reply and --not-reply flags to hubble observe to filter flows by reply direction. (cilium/cilium#46531, @amaanx86)
* Add `spec.allowFirstIP` and `spec.allowLastIP` to `CiliumPodIPPool` to allow Multi-Pool IPAM users to make the first and last IPs of each allocated pod CIDR allocatable. (cilium/cilium#46323, @SivagurunathanV)
* Add opt-in Helm value `nativeRoutingCIDRFromClusterPool` to derive the native routing CIDR from the cluster-pool IPAM CIDR when it is not explicitly configured. (cilium/cilium#46419, @Harsh63870)
* Add support to migrate a cluster from cluster-pool IPAM mode to multi-pool IPAM mode. (cilium/cilium#46104, @pippolo84)
* Added some commands to cilium-dbg to help diagnose policy map pressure. (cilium/cilium#46038, @squeed)
* Added the `policy/mapstate/stage` command to `cilium-dbg script`. It can show the difference in policy map entries that would be created by a proposed set of policies. (cilium/cilium#46762, @squeed)
* Allow CIDR selectors in network policies to match in-cluster IPs (cilium/cilium#45194, @TheBeeZee)
* azure: Return actual public IP from AssignPublicIPAddresses{VMSS,VM} (cilium/cilium#46327, @HadrienPatte)
* bgp: migrate CRDs storage version from v2alpha1 to v2 (cilium/cilium#46763, @martonra)
* cilium-dbg: add table-json format to bgp/peers and bgp/routes (cilium/cilium#45858, @martonra)
* clustermesh: update MCS-API to v0.5.1 (cilium/cilium#46533, @MrFreezeex)
* daemon: allow --local-router-ipv4/6 without --enable-endpoint-routes (cilium/cilium#46082, @zbb88888)
* datapath/l2responder: use l3 sockets for solicited node multicast signaling (cilium/cilium#46332, @bersoare)
* Different named port numbers for a name from multiple pods are now honored in policy enforcement. (cilium/cilium#45760, @jrajahalme)
* Endpoints created by the CNI plugin are no longer addressable by legacy container-id or pod-name identifiers via the Cilium agent API. Use `cni-attachment-id:<containerID>:<ifName>` or `cep-name:<namespace/name>` instead. (cilium/cilium#46810, @tklauser)
* Extend the information reported by the troubleshoot kvstore and clustermesh commands (cilium/cilium#46516, @giorio94)
* Fix operator not exporting k8s_client metrics (api latency, rate limiter latency, api calls total). (cilium/cilium#46353, @hanapedia)
* gateway-api: add support for configuring Gateway access logs through the new `spec.telemetry.accessLogs` field in CiliumGatewayClassConfig. (cilium/cilium#46403, @arybolovlev)
* Gateway-API: Added useRemoteAddress support. (cilium/cilium#45816, @s3rius)
* gateway-api: Gateway status now reports unsupported listener protocols more precisely. (cilium/cilium#46815, @arybolovlev)
* gateway-api: improve route/gateway listener protocol mismatch message (cilium/cilium#46697, @arybolovlev)
* gateway-api: reject unsupported Gateway infrastructure.parametersRef (cilium/cilium#46730, @arybolovlev)
* metrics: Emit native histograms for all histograms by default (cilium/cilium

_[Truncated at 4000 characters — full notes: https://github.com/cilium/cilium/releases/tag/v1.20.0-pre.4]_

### v1.19.5 — 1.19.5

- Date: 2026-06-16
- Version: v1.19.5
- Original notes: https://github.com/cilium/cilium/releases/tag/v1.19.5
- Permalink: https://whatsnew.fyi/product/cilium/releases/v1.19.5

- **changed** — Extend the information reported by the troubleshoot kvstore and clustermesh commands
- **removed** — Remove loadBalancer.standalone option from helm
- **fixed** — Fix mtu calculation with potential padding in wireguard
- **fixed** — Always add cluster label to node when nodeSelectorLabels is enabled to fix CiliumNetworkPolicy with fromNodes/toNodes with policy-default-local-cluster enabled
- **fixed** — Fix public IP reassignment failure loop on operator restart in azure
- **fixed** — Don't provide default_gateway reconciler when disabled in bgp
- **fixed** — Reduce amount of soft peer resets by service reconciliation and fix potentially missed incorrect metadata update upon failed reconciliation in bgp
- **fixed** — Fix host proxy packet routing to pods in bpf
- **fixed** — Fix weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API
- **fixed** — Add altname to mark cilium owned interfaces and skip changing MTU on interfaces not managed by cilium in datapath/mtu
- **fixed** — Fix a bug that causes the NamespaceSelector field in a CiliumEgressGatewayPolicy to be corrupted and no longer effective
- **fixed** — Fix a rare bug in clustermesh-apiserver that triggers incorrect deletion of a valid endpoint entry from the etcd under high pod churn
- **fixed** — Fix BGP PeerConfig status cleanup so it no longer times out when there are no managed conditions to remove
- **fixed** — Fix bug that would disrupt node connectivity when ClusterIP/LoadBalancer VIPs overlapped with node-local IP addresses
- **fixed** — Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName
- **fixed** — Fix wildcard namespace bypass for selectorless ipBlock rules
- **fixed** — Prevent controller panic during Gateway reconciliation when GatewayClass has an invalid or malformed spec.parametersRef
- **fixed** — Set ready condition in endpointSlice to true in gateway-api
- **fixed** — Fix nil pointer dereference panic due to uninitialized logger
- **fixed** — Fix a race where a reused endpoint ID could have its BPF state directory removed by the outgoing endpoint

Summary of Changes
------------------

**Minor Changes:**
* Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR cilium/cilium#46554, Upstream PR cilium/cilium#46516, @giorio94)
* helm: Remove loadBalancer.standalone option (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#46070, @joestringer)
* wireguard:mtu: fix mtu calculation with potential padding (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#45940, @smagnani96)

**Bugfixes:**
* Always add cluster label to node when `nodeSelectorLabels` is enabled to fix CiliumNetworkPolicy with `fromNodes`/`toNodes` with  `policy-default-local-cluster` enabled (enabled by default in 1.19+) (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#46068, @MrFreezeex)
* azure: Fix public IP reassignment failure loop on operator restart (Backport PR cilium/cilium#46289, Upstream PR cilium/cilium#46240, @HadrienPatte)
* bgp: Don't provide default_gateway reconciler when disabled (Backport PR cilium/cilium#46024, Upstream PR cilium/cilium#45911, @YutaroHayakawa)
* bgp: Reduce amount of soft peer resets by service reconciliation and fix potentially missed incorrect metadata update upon failed reconciliation. (Backport PR cilium/cilium#46245, Upstream PR cilium/cilium#45927, @rastislavs)
* bpf: fix host proxy packet routing to pods (Backport PR cilium/cilium#46024, Upstream PR cilium/cilium#45916, @atykhyy)
* bug: fixed weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#45937, @nickolaev)
* datapath/mtu: add altname to mark cilium owned interfaces and do skip changing MTU on interfaces not managed by cilium (Backport PR cilium/cilium#46028, Upstream PR cilium/cilium#45799, @bersoare)
* Fix a bug that causes the NamespaceSelector field in a CiliumEgressGatewayPolicy to be corrupted, and no longer effective. (Backport PR cilium/cilium#46024, Upstream PR cilium/cilium#45926, @julianwiedmann)
* Fix a rare bug in clustermesh-apiserver that triggers incorrect deletion of a valid endpoint entry from the etcd under high pod churn (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#45780, @adamwathieu)
* Fix BGP PeerConfig status cleanup so it no longer times out when there are no managed conditions to remove. (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#45967, @ysksuzuki)
* Fix bug that would disrupt node connectivity when ClusterIP/LoadBalancer VIPs overlapped with node-local IP addresses. (Backport PR cilium/cilium#46024, Upstream PR cilium/cilium#45572, @ajmmm)
* Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName. (Backport PR cilium/cilium#45966, Upstream PR cilium/cilium#45371, @syedazeez337)
* Fix wildcard namespace bypass for selectorless ipBlock rules (Backport PR cilium/cilium#46456, Upstream PR cilium/cilium#46305, @TheBeeZee)
* fix(gateway-api): Prevent controller panic during Gateway reconciliation when GatewayClass has an invalid or malformed spec.parametersRef. (Backport PR cilium/cilium#46400, Upstream PR cilium/cilium#46340, @arybolovlev)
* fix(gateway-api): set ready condition in endpointSlice to true (Backport PR cilium/cilium#46400, Upstream PR cilium/cilium#46237, @ulrichgiraud)
* fix: nil pointer dereference panic due to uninitialized logger (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#45782, @weizhoublue)
* Fixed a race where a reused endpoint ID could have its BPF state directory removed by the outgoing endpoint (Backport PR cilium/cilium#46554, Upstream PR cilium/cilium#46091, @eyupcanakman)
* Fixed unsolicited IPv6 L2 announcements ignored by receiving hosts, as not conformant to RFC 4861 (Backport PR cilium/cilium#46170, Upstream PR cilium/cilium#46079, @giorio94)
* Fixes a bug where policymap pressure was incorrectly being reported as 0. (Backport PR cilium/cilium#460

_[Truncated at 4000 characters — full notes: https://github.com/cilium/cilium/releases/tag/v1.19.5]_

### v1.18.11 — 1.18.11

- Date: 2026-06-16
- Version: v1.18.11
- Original notes: https://github.com/cilium/cilium/releases/tag/v1.18.11
- Permalink: https://whatsnew.fyi/product/cilium/releases/v1.18.11

- **changed** — Extend the information reported by the troubleshoot kvstore and clustermesh commands
- **fixed** — Fix weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API
- **fixed** — Add altname to mark cilium owned interfaces and skip changing MTU on interfaces not managed by cilium
- **fixed** — Fix memory leak issue with reusing a watch channel hash map from very large StateDB transactions
- **fixed** — Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName
- **fixed** — Fix retries for CiliumNode Get errors in multipool
- **fixed** — Fix nil pointer dereference in filterAndDestroySockets
- **fixed** — Return correct IP family for IPv6 ClusterIP addresses in loadbalancer

Summary of Changes
------------------

**Minor Changes:**
* Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR cilium/cilium#46555, Upstream PR cilium/cilium#46516, @giorio94)

**Bugfixes:**
* bug: fixed weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API (Backport PR cilium/cilium#46249, Upstream PR cilium/cilium#45937, @nickolaev)
* datapath/mtu: add altname to mark cilium owned interfaces and do skip changing MTU on interfaces not managed by cilium (Backport PR cilium/cilium#46085, Upstream PR cilium/cilium#45799, @bersoare)
* Fix memory leak issue with reusing a watch channel hash map from very large StateDB transactions (cilium/cilium#46498, @joamaki)
* Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName. (Backport PR cilium/cilium#46234, Upstream PR cilium/cilium#45371, @syedazeez337)
* multipool: Fix retries for CiliumNode Get errors (Backport PR cilium/cilium#46410, Upstream PR cilium/cilium#46124, @pippolo84)
* sockets: fix nil pointer dereference in filterAndDestroySockets (Backport PR cilium/cilium#46029, Upstream PR cilium/cilium#44843, @umut-polat)

**CI Changes:**
* chore(deps): update lvh-images for conformance-runtime (Backport PR cilium/cilium#46026, Upstream PR cilium/cilium#45922, @julianwiedmann)
* ci:bpftrace: fail curl with corrupted binary download (Backport PR cilium/cilium#46029, Upstream PR cilium/cilium#45948, @smagnani96)
* Fixed an issue where privileged tests failed locally (Backport PR cilium/cilium#46029, Upstream PR cilium/cilium#40150, @AritraDey-Dev)
* gha: make conformance kubespray runner configurable (Backport PR cilium/cilium#46292, Upstream PR cilium/cilium#46171, @giorio94)
* helm: add tmpl files to .helmignore (Backport PR cilium/cilium#46555, Upstream PR cilium/cilium#46445, @sekhar-isovalent)
* helm: allow overriding of registry_prefix in charts (Backport PR cilium/cilium#46292, Upstream PR cilium/cilium#46217, @sekhar-isovalent)

**Misc Changes:**
* [v1.18] - chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 7… (cilium/cilium#46579, @aanm)
* [v1.18] - Reapply ".github/workflows: do not use deployments for environments" (cilium/cilium#46575, @aanm)
* [v1.18] deps: bump various Go packages (cilium/cilium#46186, @ferozsalam)
* [v1.18] loadbalancer: return correct IP family for IPv6 ClusterIP addresses (cilium/cilium#46426, @tklauser)
* chore(deps): update all github action dependencies (v1.18) (cilium/cilium#45998, @cilium-renovate[bot])
* chore(deps): update all github action dependencies (v1.18) (cilium/cilium#46020, @cilium-renovate[bot])
* chore(deps): update all github action dependencies (v1.18) (cilium/cilium#46118, @cilium-renovate[bot])
* chore(deps): update all github action dependencies (v1.18) (cilium/cilium#46271, @cilium-renovate[bot])
* chore(deps): update all github action dependencies (v1.18) (cilium/cilium#46396, @cilium-renovate[bot])
* chore(deps): update all github action dependencies (v1.18) (cilium/cilium#46542, @cilium-renovate[bot])
* chore(deps): update all-dependencies (v1.18) (cilium/cilium#46141, @cilium-renovate[bot])
* chore(deps): update all-dependencies (v1.18) (cilium/cilium#46582, @cilium-renovate[bot])
* chore(deps): update aws-actions/configure-aws-credentials action to v6.1.2 (v1.18) (cilium/cilium#46285, @cilium-renovate[bot])
* chore(deps): update base-images (v1.18) (cilium/cilium#45999, @cilium-renovate[bot])
* chore(deps): update base-images (v1.18) (cilium/cilium#46165, @cilium-renovate[bot])
* chore(deps): update base-images to v1.25.11 (v1.18) (cilium/cilium#46343, @cilium-renovate[bot])
* chore(deps): update cilium/cilium digest to 0fc1dd3 (v1.18) (cilium/cilium#46154, @cilium-renovate[bot])
* chore(deps): update cilium/cilium digest to 11ecd4e (v1.18) (cilium/cilium#46278, @cilium-renovate[bot])
* chore(deps): update cil

_[Truncated at 4000 characters — full notes: https://github.com/cilium/cilium/releases/tag/v1.18.11]_