Cilium v1.20.0-rc.0

Summary of Changes

Minor Changes:

• Adds a new policy entity, cluster-mesh, which selects all endpoints in all meshed clusters. Also, makes the cluster and cluster-mesh create significantly fewer policy map entries. (cilium/cilium#46813, @squeed)
• docs: add ListenerSet documentation (cilium/cilium#46850, @asauber)
• The default CNI configuration version has been bumped from 0.3.1 to 1.0.0. Use the cni.customConf Helm value to set it back to 0.3.1 if needed. (cilium/cilium#46971, @gandro)

Bugfixes:

• endpoint: Fix race when reading endpoint properties (cilium/cilium#46991, @gandro)
• Fix cilium_operator_unmanaged_pods gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (cilium/cilium#46668, @Suyash1700)
• Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (cilium/cilium#46927, @aanm)
• Fix ctmap gc duration metric recording (cilium/cilium#46873, @fristonio)
• Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (cilium/cilium#46821, @fristonio)
• Fix regression preventing Cilium from starting when configured in kvstore mode with KPR disabled, if etcd is behind a Kubernetes service (cilium/cilium#46444, @giorio94)
• fix: handle IPv6 subtraction borrow to avoid pool fragmentation (cilium/cilium#47011, @weizhoublue)
• Fixes an issue where invalid regex on an HTTPRoute or GRPCRoute matcher is accepted but causes Envoy to NACK (cilium/cilium#47005, @0xch4z)
• ipam/multi-pool: Do now wait for zero prealloc request (cilium/cilium#46867, @pippolo84)

CI Changes:

• .github: Generate CI binaries with correct module version (cilium/cilium#46742, @joestringer)
• .github: Revert pull_request_target to actions/checkout v6 (cilium/cilium#46940, @joestringer)
• .github: Revert workflow_call to actions/checkout v6 (cilium/cilium#46943, @joestringer)
• ariane: Fix v1.20 image build dependency (cilium/cilium#47153, @joestringer)
• bpf/Makefile: Simplify and fix MAX_*_OPTIONS (cilium/cilium#46852, @pchaigno)
• ci: Add ORGANIZATION_STAGING for stable tags (cilium/cilium#46954, @nebril)
• ci: conditional on registry authentication (cilium/cilium#47037, @Artyop)
• ci: keep AKS nodes-without-cilium ready to stop auto-repair reboots (cilium/cilium#46942, @aanm)
• ci: reverse logic for docker auth requirement (cilium/cilium#47081, @Artyop)
• ci: Run KCNP tests via conformance-kind-proxy-embedded (cilium/cilium#45074, @jrajahalme)
• CI: some refactors for waiting images & conformance runtime (cilium/cilium#46957, @Artyop)
• cilium/json-mock is updated to v1.4.1 to resolve ci test flakes. (cilium/cilium#47058, @jrajahalme)
• Collect /proc/net/softnet_stat, /proc/net/snmp and /proc/net/netstat in sysdumps to help diagnose host-level packet drops. (cilium/cilium#46985, @aanm)
• egressgw: add script testing for sysctl (cilium/cilium#46988, @julianwiedmann)
• envoy: cleanup use_nphds in ads code (cilium/cilium#46831, @nezdolik)
• gha/gateway-api: make the conformance job reliable (real skip + CRD-fetch retry) (cilium/cilium#46978, @aanm)
• gha/net-perf-gke: fall back to other zones on GCE stockout (cilium/cilium#46969, @aanm)
• gha/scale: fix scale-5/scale-100 GCE (kops zone + workload node join) (cilium/cilium#46865, @aanm)
• gw-api-ci: Remove crd channel in matrix (cilium/cilium#46679, @xtineskim)
• gw-api-conformance: unskip mesh tests (cilium/cilium#47048, @xtineskim)
• Increase the timeout for the kvstore readiness wait in kind-based CI to avoid flakes on slow etcd image pulls. (cilium/cilium#46882, @aanm)
• renovate: restore updates of docker images (cilium/cilium#47022, @giorio94)
• test/cyclonus: capture logs of every job pod so a runner crash is diagnosable (cilium/cilium#46980, @aanm)
• Use fake external targets on nodes without Cilium in EKS CI workflows for better stability. (cilium/cilium#45246, @gentoo-root)

Misc Changes:

• (minor) docs: update reference to aws-cli image (cilium/cilium#46923, @squeed)
• bpf/nat: Document needs_ct flag in code (cilium/cilium#47017, @pchaigno)
• bpf: Condition ICMP SNAT on BPF masquerading and inter-cluster SNAT (cilium/cilium#47021, @pchaigno)
• bpf: include drop_reasons.h directly where DROP_* constants are used (cilium/cilium#46960, @tklauser)
• bpf: local_delivery: adopt new calling convention (cilium/cilium#46205, @julianwiedmann)
• bpf: make validate_ethertype to accept const ptr (cilium/cilium#46958, @aspsk)
• chore(deps): update all github action dependencies (main) (cilium/cilium#46905, @cilium-renovate[bot])
• chore(deps): update all lvh-images main (main) (patch) (cilium/cilium#46918, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#46902, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#47033, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#47073, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#47107, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#47119, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#47120, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (cilium/cilium#47121, @cilium-renovate[bot])
• chore(deps): update base-images to v1.26.5 (main) (cilium/cilium#46981, @cilium-renovate[bot])
• chore(deps): update dependency renovatebot/renovate to v43.253.0 (main) (cilium/cilium#47114, @cilium-renovate[bot])
• chore(deps): update dependency renovatebot/renovate to v43.253.1 (main) (cilium/cilium#47118, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang docker tag to v1.26.4 (main) (cilium/cilium#46903, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.5 docker digest to 079e598 (main) (cilium/cilium#47108, @cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.7.0 (main) (cilium/cilium#47029, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1782911245-7cffc778c923f68a77954a53b1a98d6b5353f004 (main) (cilium/cilium#47028, @cilium-renovate[bot])
• ci: adjust condition for "Create imagePullSecret" (cilium/cilium#46968, @mhofstetter)
• ci: always set fail-fast to false on image builds (cilium/cilium#47064, @aanm)
• ci: kind add support for kubeadm.k8s.io/v1beta4 InitConfiguration patch (cilium/cilium#47059, @viktor-kurchenko)
• Cilium bpf policy maps are renamed to "cilium_policy_v3_" prefix to account for the semantic change with policy identity aggregation. (cilium/cilium#47080, @jrajahalme)
• cilium-cni: Fixed a bug where the CNI plugin would fail in ENI IPAM mode if IPv4 is disabled. (cilium/cilium#46937, @41ks)
• docs/community: Add link to community calendar (cilium/cilium#46999, @mauriciovasquezbernal)
• docs: add Gateway API access logs example. (cilium/cilium#46926, @arybolovlev)
• docs: Align metrics reference with code implementation (cilium/cilium#46887, @HadrienPatte)
• docs: clarify Hubble static/dynamic exporter file rotation settings (cilium/cilium#47026, @maksymbilokur-cisco)
• docs: fix typos and grammar in documentation (cilium/cilium#47056, @magic-peach)
• docs: Update ENI IPAM docs to add IPv6 beta support (cilium/cilium#46925, @41ks)
• docs: update Gateway API version to 1.6.0 (cilium/cilium#46961, @eminaktas)
• Egress Gateway: handle nil events (cilium/cilium#46476, @tommyp1ckles)
• egressgw: populate egressIfIndex for IPv6-only CEGP with default selector (cilium/cilium#46965, @julianwiedmann)
• endpoint: reap restart-preserved policy map entries once ready (cilium/cilium#47062, @aanm)
• endpoint: sync desired policy before reload on the restore path (restore-path hardening) (cilium/cilium#47075, @aanm)
• envoy/xdsnew: Fix completion callback queueing (cilium/cilium#46885, @jrajahalme)
• envoy: demote warn log message to info (cilium/cilium#46973, @nezdolik)
• envoy: fix cluster locality handling (cilium/cilium#46976, @viktor-kurchenko)
• Fix a Cilium Operator shutdown deadlock between CiliumNode GC and node taint sync. (cilium/cilium#47036, @ysksuzuki)
• Fix Envoy coalesced updates NACK (cilium/cilium#46938, @jrajahalme)
• gateway-api: fix operator startup failures caused by registering optional Gateway API resources when their CRDs are not installed. (cilium/cilium#46955, @arybolovlev)
• gateway-api: remove SetAllParentCondition route helpers (cilium/cilium#47086, @0xch4z)
• gateway-api: update TCPRoute and UDPRoute to v1 (cilium/cilium#46970, @eminaktas)
• gha/renovate: use actions/create-github-app-token from renovate envir… (cilium/cilium#46994, @aanm)
• gha: fail fast in external-target provisioning scripts instead of swallowing failures (cilium/cilium#47085, @aanm)
• github: bump ci-l7 test timeout (cilium/cilium#46945, @jrajahalme)
• hubble: Remove dead Kafka L7 protocol handling (cilium/cilium#46997, @sayboras)
• images/runtime: Update iptables-wrapper to upstream v3 (Go) (cilium/cilium#46694, @HadrienPatte)
• ipam/service/allocator: fix IPv6 offset aliasing (cilium/cilium#46952, @tklauser)
• policy/k8s: record processing start time for k8s NetworkPolicy updates (cilium/cilium#46979, @aanm)
• policy: Consolidate policyCache into the policy compute cell (cilium/cilium#46460, @christarazi)
• Prepare for release v1.20.0-pre.4 (cilium/cilium#46889, @cilium-release-bot[bot])
• Prepare v1.20 stable branch (cilium/cilium#47007, @joestringer)
• Revert "cilium-dbg: Add preflight validator for cilium-configmap" (cilium/cilium#47052, @joestringer)
• update README.rst with v1.20.0-pre.4 (cilium/cilium#46895, @aanm)
• vendor: bump github.com/cilium/statedb to v0.8.3 (cilium/cilium#47082, @giorio94)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.0-rc.0@sha256:ab193b2335b06bf608b2ac987cca608b717d00f7d8f76ef50492c4e8ef059b5a

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.0-rc.0@sha256:87583396de788357b50dcc241194c312044692cf9cc86d89affa2503c4464b68

hubble-relay

quay.io/cilium/hubble-relay:v1.20.0-rc.0@sha256:586cb0a600616e99a917c59ef15f107fd051343f25302dab5d4c4aecf9da1f2b

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.0-rc.0@sha256:70d175146578da9f4cff3ac4419215bcea8c848188699c7b78c1febd8e3f2a80

operator-aws

quay.io/cilium/operator-aws:v1.20.0-rc.0@sha256:80cadb9f896c6dc0fa4f4078fdaebf8d8d53017411864c7cb2ff40a5b171c269

operator-azure

quay.io/cilium/operator-azure:v1.20.0-rc.0@sha256:f76e7ce8a396e9503fa34513e108c500b95052ff9f6d7c976a45c3c84b678a1b

operator-generic

quay.io/cilium/operator-generic:v1.20.0-rc.0@sha256:d6d4db70657d7fae197174f7c3d796eb23a54a6312658d85dfd42456ccc365bb

operator

quay.io/cilium/operator:v1.20.0-rc.0@sha256:b8fecbdc5123d765c26b50ca4738b8f6c47fd47f4d8d7214501d3e4dfefa3e21