Cilium v1.20.0-pre.4

Summary of Changes

Major Changes:

• (Beta) ENI IPAM mode with IPv6: The ENI IPAM mode now supports allocating and using IPv6 prefixes. (cilium/cilium#46756, @41ks)
• As previously announced, docker libnetwork plugin as been sunset and is no longer available. (cilium/cilium#46489, @aanm)
• envoy: Add ADS (Aggregated Discovery Service) server support (cilium/cilium#43887, @nezdolik)
• gateway-api: Add TCPRoute and UDPRoute support (cilium/cilium#46184, @eminaktas)
• GatewayAPI: Implement ListenerSets. Allows per-namespace control of many Listeners for a single Gateway (cilium/cilium#46303, @asauber)
• Introduce datapath plugins to enable third party datapath extensions. (cilium/cilium#46673, @jrife)
• Makes the remote-node and world policy entities much more efficient by adding a new type of wildcard entry in the policy map. This can reduce policy map usage by thousands of entries in certain circumstances. (cilium/cilium#46438, @squeed)

Minor Changes:

• Add --reply and --not-reply flags to hubble observe to filter flows by reply direction. (cilium/cilium#46531, @amaanx86)
• Add spec.allowFirstIP and spec.allowLastIP to CiliumPodIPPool to allow Multi-Pool IPAM users to make the first and last IPs of each allocated pod CIDR allocatable. (cilium/cilium#46323, @SivagurunathanV)
• Add opt-in Helm value nativeRoutingCIDRFromClusterPool to derive the native routing CIDR from the cluster-pool IPAM CIDR when it is not explicitly configured. (cilium/cilium#46419, @Harsh63870)
• Add support to migrate a cluster from cluster-pool IPAM mode to multi-pool IPAM mode. (cilium/cilium#46104, @pippolo84)
• Added some commands to cilium-dbg to help diagnose policy map pressure. (cilium/cilium#46038, @squeed)
• Added the policy/mapstate/stage command to cilium-dbg script. It can show the difference in policy map entries that would be created by a proposed set of policies. (cilium/cilium#46762, @squeed)
• Allow CIDR selectors in network policies to match in-cluster IPs (cilium/cilium#45194, @TheBeeZee)
• azure: Return actual public IP from AssignPublicIPAddresses{VMSS,VM} (cilium/cilium#46327, @HadrienPatte)
• bgp: migrate CRDs storage version from v2alpha1 to v2 (cilium/cilium#46763, @martonra)
• cilium-dbg: add table-json format to bgp/peers and bgp/routes (cilium/cilium#45858, @martonra)
• clustermesh: update MCS-API to v0.5.1 (cilium/cilium#46533, @MrFreezeex)
• daemon: allow --local-router-ipv4/6 without --enable-endpoint-routes (cilium/cilium#46082, @zbb88888)
• datapath/l2responder: use l3 sockets for solicited node multicast signaling (cilium/cilium#46332, @bersoare)
• Different named port numbers for a name from multiple pods are now honored in policy enforcement. (cilium/cilium#45760, @jrajahalme)
• Endpoints created by the CNI plugin are no longer addressable by legacy container-id or pod-name identifiers via the Cilium agent API. Use cni-attachment-id:<containerID>:<ifName> or cep-name:<namespace/name> instead. (cilium/cilium#46810, @tklauser)
• Extend the information reported by the troubleshoot kvstore and clustermesh commands (cilium/cilium#46516, @giorio94)
• Fix operator not exporting k8s_client metrics (api latency, rate limiter latency, api calls total). (cilium/cilium#46353, @hanapedia)
• gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (cilium/cilium#46403, @arybolovlev)
• Gateway-API: Added useRemoteAddress support. (cilium/cilium#45816, @s3rius)
• gateway-api: Gateway status now reports unsupported listener protocols more precisely. (cilium/cilium#46815, @arybolovlev)
• gateway-api: improve route/gateway listener protocol mismatch message (cilium/cilium#46697, @arybolovlev)
• gateway-api: reject unsupported Gateway infrastructure.parametersRef (cilium/cilium#46730, @arybolovlev)
• metrics: Emit native histograms for all histograms by default (cilium/cilium#46814, @HadrienPatte)
• Miscellaneous improvements to the Cluster Mesh TLS certificates helm settings (cilium/cilium#46464, @giorio94)
• Support configuring Envoy cluster default max pending requests via envoy.clusterMaxPendingRequests helm value or cilium-agent --proxy-cluster-max-connections command-line arg (cilium/cilium#45625, @0xch4z)
• Support strict ingress encryption in native routing mode (cilium/cilium#46415, @rgo3)
• The Cilium agent now waits for a static IP to be assigned before becoming ready if one is requested. (cilium/cilium#46636, @41ks)
• The local REST BGP APIs are deprecated. It will be removed in the future. (cilium/cilium#45762, @martonra)

Bugfixes:

• aws: Assign and track EIP only on the primary ENI (cilium/cilium#46329, @HadrienPatte)
• bpf: fix ipv6 neighbor solicitation handling in host firewall (cilium/cilium#46325, @atykhyy)
• clustermesh: now correctly report that MCS-API ServiceExport are not synced in the Cilium CLI (cilium/cilium#46497, @MrFreezeex)
• endpoint: allow wildcard listener proxy redirects (cilium/cilium#46411, @nezdolik)
• Fix a bug which could lead to stale hostport entries if a pod was deleted and immediately recreated in host network. (cilium/cilium#46747, @giorio94)
• Fix BackendTLSPolicy upstream TLS SDS secret name when using a non-default gatewayAPI.secretsNamespace (cilium/cilium#45203, @daper)
• Fix ClusterMesh service affinity annotation service.cilium.io/affinity: "none" incorrectly dropping all remote backends, causing traffic blackhole when no local endpoints exist. (cilium/cilium#46635, @mkamadeus)
• Fix Hubble flow compact output for policy verdict events with default field masks (cilium/cilium#46672, @glrf)
• fix lb: filter terminating backends from PreferSameNode selection (cilium/cilium#46339, @weizhoublue)
• Fix the UDP tunnel check in the BIG TCP probe. (cilium/cilium#46710, @gentoo-root)
• Fix wildcard namespace bypass for selectorless ipBlock rules (cilium/cilium#46305, @TheBeeZee)
• fix(gateway-api): Prevent controller panic during Gateway reconciliation when GatewayClass has an invalid or malformed spec.parametersRef. (cilium/cilium#46340, @arybolovlev)
• fix(hubble): derive socket flow type from event subtype (cilium/cilium#45692, @Andreagit97)
• Fixed a race where a reused endpoint ID could have its BPF state directory removed by the outgoing endpoint (cilium/cilium#46091, @eyupcanakman)
• Fixed an IPCache notification edge case where deleting a pod IP could cause IPCache consumers to observe stale endpoint attributes for a restored overlapping CIDR entry. (cilium/cilium#45646, @pamelia)
• Fixes a bug where Hubble policy correlation does not work for port ranges. (cilium/cilium#46643, @squeed)
• gateway-api/ingress: set service label on EndpointSlices (cilium/cilium#46242, @mhofstetter)
• gateway-api: Add Gateway check for when hostNetwork is enabled (cilium/cilium#46350, @xtineskim)
• gateway-api: Each HTTPS and TLS passthrough port now receives its own Envoy listener and RouteConfiguration. (cilium/cilium#44889, @eufriction)
• gateway-api: Fix HTTPRoute retry rules so that configured status-code and connection-error retries are actually applied. (cilium/cilium#46433, @markwitz)
• gateway-api: prune stale Gateway API route parent statuses (cilium/cilium#46296, @mhofstetter)
• hubble: fix l7 monitor filtering for AccessLog events (cilium/cilium#46519, @shreyasrajiv327)
• Improve robustness of kvstore keys construction to prevent possible surprising behavior in rare circumstances (cilium/cilium#46412, @giorio94)
• ingress: shorten name of resources (cilium/cilium#46346, @mhofstetter)
• ipam/multi-pool: Fix update of Allocated CIDRs in CiliumNode (cilium/cilium#46678, @pippolo84)
• ipam/multi-pool: Use accessors to get and set CiliumNode pools (cilium/cilium#46258, @pippolo84)
• kvstore: Don't set fake pod CIDRs for remote nodes (cilium/cilium#46299, @pchaigno)
• lbipam: prevent reassigning Service LoadBalancer IPs on operator restart when the existing IP belongs to a compatible sharing key group. (cilium/cilium#46262, @ieth0)
• linux-desired-device: harden link modify codepath (cilium/cilium#46757, @harsimran-pabla)
• Move DNS request checking prior to qname extraction (cilium/cilium#46434, @ferozsalam)
• operator: Fix SPIRE mutual-auth reconciler sending an empty entry Id on update, which caused a silent infinite reconcile loop and SPIRE "Failed to update entry" errors when a registration entry already existed (e.g. after an operator restart, upgrade, or trust-domain change). (cilium/cilium#46311, @haf)

CI Changes:

• .github/workflows: fix ci-kpr-eks failures on workflow_dispatch events (cilium/cilium#46525, @aanm)
• .github/workflows: fix envoy image check path after trusted/untrusted… (cilium/cilium#46558, @aanm)
• .github/workflows: run AKS IPsec conformance on AzureLinux nodes (cilium/cilium#46698, @vipul-21)
• .github: Check out untrusted code to dedicated dir (cilium/cilium#46420, @joestringer)
• .github: Lint Envoy on trusted branch (cilium/cilium#46552, @joestringer)
• .github: Skip wait for lint checks (cilium/cilium#46480, @joestringer)
• bgp: Add multi-peer advertisements component test (cilium/cilium#46235, @rastislavs)
• bgp: Add service aggregation priority component test (cilium/cilium#46878, @rastislavs)
• bgp: Do not use IPv6 NLRI with IPv4 extended nexthop in bgp tests (cilium/cilium#46293, @rastislavs)
• bpf/test: porting tc_nodeport_lb4_nat_lb.c to IPv6 (cilium/cilium#46496, @smagnani96)
• bpf: fix flaky nat4_port_allocation_tcp/udp tests (cilium/cilium#45112, @vipul-21)
• bpf: tests: clean up re-introduced USE_BPF_PROG_FOR_INGRESS_POLICY (cilium/cilium#46782, @julianwiedmann)
• bpf: tests: collapse more tests (cilium/cilium#46374, @julianwiedmann)
• bpf: tests: condense a bunch of LB tests (cilium/cilium#46358, @julianwiedmann)
• bpf: tests: fix up definition for ENABLE_ROUTING (cilium/cilium#46804, @julianwiedmann)
• chore(deps): update all lvh-images main (cilium/cilium#46330, @julianwiedmann)
• chore: check-cilium-envoy-image.sh should get values from Makefile.va… (cilium/cilium#46840, @sekhar-isovalent)
• ci: Auth to image registry in clustermesh upgrade workflow (cilium/cilium#46632, @nebril)
• ci: Disable identity jitter for the network policy e2e tests (cilium/cilium#46477, @christarazi)
• ci: Fix set-runtime-image action (cilium/cilium#46407, @nebril)
• CI: fixed external-target readiness gating and ensured sig-network E2E JUnit reports are uploaded on failure. (cilium/cilium#46860, @aanm)
• ci: increase cilium status wait timeout (cilium/cilium#46705, @smagnani96)
• ci: Log in for docker registry reads (cilium/cilium#46036, @nebril)
• ci: quarantine netkit EKS conformance jobs (cilium/cilium#46621, @aanm)
• ci: Remove merge_group from tests-smoke-conformance.yaml (cilium/cilium#46451, @nebril)
• ci: use PR checks for status check (cilium/cilium#46429, @nebril)
• contrib: fix go test tag check exit status (cilium/cilium#46442, @tklauser)
• datapath: sockets: add test coverage for v4-in-v6 client termination (cilium/cilium#46487, @julianwiedmann)
• Decrease CI costs on AWS (cilium/cilium#46615, @aanm)
• egressgw: add script test support (cilium/cilium#46328, @julianwiedmann)
• Fix workflow change detection for single-commit PRs to main (cilium/cilium#46684, @Demiserular)
• gh: ztunnel-e2e: set commit status to pending on main job (cilium/cilium#46300, @julianwiedmann)
• gha: disable flaky Gateway API tests (cilium/cilium#46875, @arybolovlev)
• ginkgo: remove Tests GH#10983 (cilium/cilium#46494, @smagnani96)
• helm: add tmpl files to .helmignore (cilium/cilium#46445, @sekhar-isovalent)
• hubble: Add Script tests for pkg/hubble/exporter (cilium/cilium#45856, @mereta)
• Introduce scheduled conformance testing on EKS with netkit and netkit-l2. (cilium/cilium#45688, @ajmmm)
• logging: Downgrade leader election lease conflict to info (cilium/cilium#46313, @christarazi)
• Migrate K8sPolicyTestExtended Ginkgo tests to hive component tests for kube-apiserver entity policy. (cilium/cilium#46490, @Harsh63870)
• Move pull_request triggered workflows to ariane (cilium/cilium#45363, @nebril)
• pkg/rate: fix TestMaxParallelRequests flake under CI load (cilium/cilium#46856, @aanm)
• Reapply "ci: Log in for image registry pulls" (cilium/cilium#46376, @nebril)
• Removed address-family split from bpf_redirect helper test coverage. (cilium/cilium#46401, @ajmmm)
• renovate: re-enable cilium/ebpf dependency bump (cilium/cilium#46833, @ti-mo)
• renovate: Update regex for Makefile.values ?= assignment (cilium/cilium#46449, @sayboras)
• Revert "ci: Log in for image registry pulls" (cilium/cilium#46370, @joestringer)
• Revert "ci: use PR checks for status check" (cilium/cilium#46455, @joestringer)
• Revert "workflows/verifier: Run consistent version of tests" (cilium/cilium#46381, @pchaigno)
• Use correct helm chart in reinstall step in conformance-kind-proxy-embedded workflow. (cilium/cilium#46868, @jrajahalme)
• Use external status check workflow in image build CI (cilium/cilium#46469, @nebril)
• workflows/verifier: Fix commit status (cilium/cilium#46382, @pchaigno)

Misc Changes:

• .github: Don't close issues with stable-blocker (cilium/cilium#46759, @joestringer)
• [multi-pool] Miscellaneous minor fixes (cilium/cilium#46492, @pippolo84)
• Add a greeting for first time contributors (cilium/cilium#45551, @xmulligan)
• Add Pagali Payments Service to USERS.md (cilium/cilium#46454, @dverzolla)
• Add support for hybrid routing mode (routing-mode: hybrid), allowing Cilium to dynamically choose between native routing and tunnel encapsulation based on subnet topology. Traffic between pods in directly connected subnets is routed natively for improved throughput, while cross-subnet traffic is tunneled. (cilium/cilium#45001, @vanessachammas)
• alibabacloud: Standardize package layout (cilium/cilium#46349, @HadrienPatte)
• AWS ENI IPAM mode now supports allocating IPv6 prefixes (cilium/cilium#46619, @41ks)
• aws: do not fail ENI parsing when the association has an empty public IP (cilium/cilium#46650, @aanm)
• aws: Standardize package layout (cilium/cilium#46368, @HadrienPatte)
• azure: Standardize package layout (cilium/cilium#46364, @HadrienPatte)
• bgp: fix status condition reporting: update reasons to accurately reflect current condition state (cilium/cilium#46383, @martonra)
• bgp: Reconcile route policies via statedb (cilium/cilium#46818, @rastislavs)
• bgp: update container lab documentation to use the new hive shell commands (cilium/cilium#46336, @martonra)
• bpf : migrate LB algo selection to runtime config (cilium/cilium#46729, @aspsk)
• bpf, xdp: Clear CB region on XDP entry (cilium/cilium#46690, @borkmann)
• bpf: Clean up more comprehensively (cilium/cilium#46241, @joestringer)
• bpf: constify more __ctx_buff and friends (cilium/cilium#46807, @tklauser)
• bpf: Handle IPIP DSR for Pods (cilium/cilium#46103, @borkmann)
• bpf: host, overlay: pull L3 header at first ethertype de-mux point (cilium/cilium#45988, @saiaunghlyanhtet)
• bpf: local_delivery: use CB_DELIVERY_FLAGS to transfer proxy state (cilium/cilium#46291, @julianwiedmann)
• bpf: Make ipv6_hdrlen_with_fraginfo function global (cilium/cilium#46295, @pchaigno)
• bpf: Make snat_v4_needs_masquerade global (cilium/cilium#46504, @pchaigno)
• bpf: Migrate MTU to runtime config (cilium/cilium#46219, @amchelapurath2023)
• bpf: overlay: demote revalidate_data_pull() to revalidate_data() (cilium/cilium#46790, @saiaunghlyanhtet)
• bpf: policy: constify __ctx_buff & friends (cilium/cilium#46341, @julianwiedmann)
• bpf: Reduce stack size for tail_handle_snat_fwd_ipv6 (cilium/cilium#46360, @pchaigno)
• build: Allow local-only images in kind-load-base-images (cilium/cilium#46307, @jrajahalme)
• Bump to Hive v1.0.4-rc2 and fix job stop ordering issues (cilium/cilium#46206, @joamaki)
• ces: avoid panic on empty CiliumNode lookup result (cilium/cilium#46347, @tklauser)
• chore(deps): update all github action dependencies (main) (patch) (cilium/cilium#46662, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#46654, @cilium-renovate[bot])
• chore(deps): update base-images (main) (cilium/cilium#46653, @cilium-renovate[bot])
• chore(deps): update cilium/cilium-cli action to v0.19.5 (main) (cilium/cilium#46725, @cilium-renovate[bot])
• chore(deps): update dependency go to v1.26.4 (main) (cilium/cilium#46393, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.4-1781154076-332f6c5e06ed996f5b6ea43d57f8bba4d103ecec (main) (cilium/cilium#46402, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1782264709-cdc3744d2a0d37948ed88498195c637ece94c44b (main) (cilium/cilium#46699, @cilium-renovate[bot])
• chore(deps): update quay.io/goswagger/swagger docker tag to v0.34.1 (main) (cilium/cilium#46517, @cilium-renovate[bot])
• chore: BYOCNI loopback for cilium (cilium/cilium#46646, @sekhar-isovalent)
• chore: optimize building gops and cni/loopback (cilium/cilium#46781, @sekhar-isovalent)
• ci: Comment out wait-for-base-images (cilium/cilium#46491, @nebril)
• ci: remove non-ariane workflows from config (cilium/cilium#46787, @nebril)
• cilium, docs: Add IPIP example for KPR section (cilium/cilium#46427, @borkmann)
• cilium-dbg: add default arguments to bgp/routes command: loc ipv4 unicast (cilium/cilium#46335, @martonra)
• cilium-dbg: add deprecation warning to REST API based BGP commands (cilium/cilium#46334, @martonra)
• cilium-dbg: migrate bpf ipcache get to net/netip and drop the go-immutable-radix dependency. (cilium/cilium#46181, @WAFriend3416)
• cilium-dbg: remove redundant net.IP formatting in bpf nodeid list (cilium/cilium#46521, @PranjalManhgaye)
• cilium: small doc and ux improvement for ipip (cilium/cilium#46443, @borkmann)
• ciliumenvoyconfig: skip internal listeners when disabling SO_REUSEPORT (cilium/cilium#46276, @liuxu623)
• ciliumenvoyconfig: sort envoy-resources table endpoints (cilium/cilium#46871, @aanm)
• clustermesh: endpoint slices watch and kvstoremesh wiring (cilium/cilium#46506, @MrFreezeex)
• clustermesh: wire the export side of endpoint slice resources (cilium/cilium#46605, @MrFreezeex)
• CODEOWNERS: add fine-grained ownership for bpf/tests/ (cilium/cilium#46858, @julianwiedmann)
• CODEOWNERS: Assign ztunnel tests to ztunnel team (cilium/cilium#46714, @joestringer)
• Correct hostname filtering logic for ListenerSet routes (cilium/cilium#46785, @asauber)
• Datapath Plugins (CFP-41634) Part 3: Collection Instrumentation (cilium/cilium#45558, @jrife)
• datapath/sockets: Add missing unix.IPPROTO_TCP (cilium/cilium#46466, @jrife)
• datapath: add parent ifindex to VLAN desired device table output (cilium/cilium#46380, @tklauser)
• datapath: export enums as Go types (cilium/cilium#45009, @ti-mo)
• datapath: hide device table indexes behind query helpers (cilium/cilium#46430, @tklauser)
• datapath: switch ENABLE_HOST_ROUTING to runtime config (cilium/cilium#46791, @julianwiedmann)
• datapath: use single health reporter for node address reconciler (cilium/cilium#46428, @joamaki)
• deps: bump GoBGP to latest 4.6.1 pre-release commit (cilium/cilium#46802, @ysksuzuki)
• Do not pin cilium/cilium actions (cilium/cilium#46610, @aanm)
• docs: Add missing identity default label filter (cilium/cilium#46628, @justin0u0)
• docs: fix duplicated word in service mesh installation guide (cilium/cilium#46631, @s3onghyun)
• docs: fix note about ipv4-native-routing-cidr default value (cilium/cilium#46603, @rptaylor)
• docs: improve readability in README (cilium/cilium#46600, @devShaik010)
• docs: improve README grammar and consistency (cilium/cilium#46766, @alaotach)
• docs: replace echoserver with echo-basic, for arm64 support (cilium/cilium#46806, @asauber)
• docs: Update ENI IPAM docs for multi-pool allocator migration (cilium/cilium#46797, @HadrienPatte)
• Documentation/ipam: Add a warning for BGP during migration (cilium/cilium#46828, @pippolo84)
• endpoint: Guard ENI routing rule teardown by IP ownership (cilium/cilium#46677, @HadrienPatte)
• endpoint: make named-ports identity labels k8s-safe (cilium/cilium#46520, @jrajahalme)
• envoy: Fix xdsMode defaults (cilium/cilium#46853, @jrajahalme)
• Fix broken gateway-api documentation links (cilium/cilium#46527, @0xch4z)
• Fix Gateway API UDPRoute/TCPRoute programming so routes accepted by one listener are not emitted into another listener that rejects them via allowedRoutes.namespaces. (cilium/cilium#46363, @marcofranssen)
• Fix Getting Started docs link in README (cilium/cilium#46733, @ericdbishop)
• Fix Helm chart documentation that incorrectly referenced envoy.securityContext.capabilities.keepNetBindService; the correct value key is envoy.securityContext.capabilities.keepCapNetBindService. (cilium/cilium#46156, @jokestax)
• Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (cilium/cilium#46388, @tommyp1ckles)
• Fix pointer-address comparison for Gateway API Route ParentReference status handling (cilium/cilium#46355, @weizhoublue)
• fix(deps): update all go dependencies main (main) (cilium/cilium#46394, @cilium-renovate[bot])
• fix(deps): update all go dependencies main (main) (cilium/cilium#46534, @cilium-renovate[bot])
• fix(deps): update all go dependencies main (main) (cilium/cilium#46656, @cilium-renovate[bot])
• fix(deps): update all go dependencies main (main) (cilium/cilium#46772, @cilium-renovate[bot])
• Fix: potential helm validation error with nativeRoutingCIDRFromClusterPool (cilium/cilium#46606, @weizhoublue)
• fix: Prevent missing LoadBalancer IP in Ingress status for dedicated Ingresses with long names (cilium/cilium#46387, @weizhoublue)
• gateway-api: Add gateway-api-conformance-report Makefile target (cilium/cilium#46718, @youngnick)
• gateway-api: bump Gateway API version to 1.6.0. (cilium/cilium#46827, @arybolovlev)
• gateway-api: cleanup use of default gateway api gatewayclass controllername (cilium/cilium#46362, @mhofstetter)
• gateway-api: do not reject listeners when no route kinds are supported (cilium/cilium#46203, @mhofstetter)
• Gateway-api: docs for BackendTLSPolicy (cilium/cilium#46123, @xtineskim)
• gateway-api: fix unit test due to service name label (cilium/cilium#46324, @mhofstetter)
• gateway-api: remove info that TLSRoute is installed (cilium/cilium#46465, @mhofstetter)
• gateway-api: return model from Gateway API ingestion (cilium/cilium#46450, @arybolovlev)
• gha: let auto-approve match on re-runs (cilium/cilium#46832, @aanm)
• helm: Remove unused core Endpoints RBAC from roles (cilium/cilium#46817, @HadrienPatte)
• Improve cilium-dbg status output of module health (cilium/cilium#46739, @joestringer)
• Improve logging when the datapath connector updates buffer margin values. (cilium/cilium#46178, @ajmmm)
• Improve quiet mode and debuggability in build system (cilium/cilium#46071, @joestringer)
• ip: remove unused helper functions (cilium/cilium#46322, @tklauser)
• ipam/eni: accept an ipv4NativeRoutingCIDR that is a subnet of the VPC CIDR again, fixing an agent startup crash with ENI IPAM when the native routing CIDR does not cover the whole VPC. (cilium/cilium#46649, @aanm)
• ipam: fix typos and incorrect references in comments (cilium/cilium#46549, @HadrienPatte)
• ipam: Migrate IPAMSpec.PodCIDRs to ip.Prefix (cilium/cilium#46599, @HadrienPatte)
• ipam: Migrate VirtualNetwork and IPAMCIDR to netip (cilium/cilium#46309, @HadrienPatte)
• ipam: Migrate IPAM allocator public API to netip (cilium/cilium#46345, @HadrienPatte)
• ipam: Reclaim still-advertised released CIDRs on renewed demand (cilium/cilium#46674, @HadrienPatte)
• ipsec: clean up last usage of option.Config.TunnelingEnabled() (cilium/cilium#46786, @julianwiedmann)
• iptables: convert localNodeInfo to netip.Addr (cilium/cilium#46076, @uuditmisra)
• kpr: Add tests for VXLAN + LBModeAnnotation (cilium/cilium#46461, @brb)
• kvstore: add transcode support to commands (cilium/cilium#46283, @MrFreezeex)
• lb: don't disable topology-aware routing because of a terminating Pod (cilium/cilium#45947, @Kimjonghyeon)
• loadbalancer: use netip types in getIPFamilies (cilium/cilium#46356, @tklauser)
• loadbalancer: validate DSR dispatch configuration globally (cilium/cilium#45545, @FelipeYepez)
• Makefile: Generate full Cilium version in worktree (cilium/cilium#46737, @joestringer)
• monitor: fix typo in ICMPv6 neighbour solicitation debug message (cilium/cilium#46879, @Harsh63870)
• mtu: s/encryptEnabled/ipsecEnabled (cilium/cilium#46788, @julianwiedmann)
• netns: Add missing GetNetNSCookie function for non-linux build (cilium/cilium#46637, @devodev)
• node: Migrate Linux node routes from cidr.CIDR to netip.Prefix (cilium/cilium#46417, @HadrienPatte)
• operator/multi-pool: Remove stale allocator.go (cilium/cilium#46367, @pippolo84)
• operator: miscellaneous improvements to the troubleshoot clustermesh command (cilium/cilium#46502, @giorio94)
• pkg/k8s/slim: Remove deprecated and unused Endpoints related code (cilium/cilium#46472, @HadrienPatte)
• plugins/cni: Remove EP configuration hook (cilium/cilium#46812, @gandro)
• policy/compute: Break out policy computation from endpoint (3/3) (cilium/cilium#44900, @christarazi)
• policy/test, identity: Fix script test goroutine leak and well-known identities race (cilium/cilium#46486, @christarazi)
• Prepare for release v1.20.0-pre.3 (cilium/cilium#46297, @cilium-release-bot[bot])
• proxy: use devices table for cilium_net IPv6 lookup (cilium/cilium#46500, @tklauser)
• README: Update releases (cilium/cilium#46315, @joestringer)
• README: Update releases (cilium/cilium#46594, @aanm)
• Reapply ".github/workflows: do not use deployments for environments" (cilium/cilium#46573, @aanm)
• references to the metrics cilium_node_health_connectivity_status and cilium_node_health_connectivity_latency_seconds have been corrected in the documentation. (cilium/cilium#46590, @fgiloux)
• Remove docker libnetwork plugin 2/3 (cilium/cilium#46514, @aanm)
• Remove docker libnetwork plugin 3/3 (cilium/cilium#46515, @aanm)
• Remove obsolete benchmark 'BenchmarkIPIdentityPair_PrefixString' (cilium/cilium#46013, @furkan-asani)
• Remove quotes around certain true/false flags in Makefile (cilium/cilium#45694, @jingyuanliang)
• Remove stale Docker plugin leftovers (cilium/cilium#46709, @tklauser)
• Remove stale FIXME comment in dev-doctor about checking for gomega installation. (cilium/cilium#46524, @bitflicker64)
• renovate: do not pinDigest for golangci/golangci-lint (cilium/cilium#46572, @aanm)
• Revert ".github/workflows: do not use deployments for environments" (cilium/cilium#46348, @aanm)
• test: remove unused helper functions and manifests (cilium/cilium#46752, @tklauser)
• Upgraded cilium/ebpf to version v0.22.0 (cilium/cilium#46783, @dylandreimerink)
• vendor: update json-patch to v5 (cilium/cilium#46614, @aanm)
• vtep: Migrate from net.IP/cidr.CIDR to netip.{Addr,Prefix} (cilium/cilium#46414, @HadrienPatte)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.0-pre.4@sha256:8d1349f4f0d76aefe6fd501b264d63b7331c708529b08e176f02493ea9f6a30f

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.0-pre.4@sha256:5880bfa9f366fa340b85b57dccb48b80ae68e24efd116bd79d6417fa3f3ed244

hubble-relay

quay.io/cilium/hubble-relay:v1.20.0-pre.4@sha256:46ec6122fc792663318f80f3d14addf9356f06738a00c76e86c216ad0961c427

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.0-pre.4@sha256:dfc8fbe80dfef99c801ea0f9dd16b13ea6e91f479478d1242649e7fb4019b15f

operator-aws

quay.io/cilium/operator-aws:v1.20.0-pre.4@sha256:50d9da48e23e8dc8dbda3905e2463d134c4386fcf89d592b44f195440d38abaa

operator-azure

quay.io/cilium/operator-azure:v1.20.0-pre.4@sha256:f03fbd89d25f5b456efe4cbd82c29827fe606132862aed68f8c2f8774a73c555

operator-generic

quay.io/cilium/operator-generic:v1.20.0-pre.4@sha256:665d7c674339fdce579bfb56734abbc74164e0891a0f2d81a207633c881ea06d

operator

quay.io/cilium/operator:v1.20.0-pre.4@sha256:92e6cf04c7ecc3c71feb200c60525ec0a9e24153db80e7519e562ba27f19c426