ops/homelab

Fork 0

chore(deps): update helm release cilium to v1.20.4 #93

Open

renovate-bot wants to merge 1 commit from renovate/cilium-1.x into main

renovate-bot commented

2026-07-16 17:06:25 +00:00

Member

This PR contains the following updates:

Package	Update	Change
cilium (source)	minor	`1.19.5` → `1.20.4`

Release Notes

cilium/cilium (cilium)

`v1.20.4`: 1.20.4

Compare Source

Security patch release

Out-of-band security patch release to fix CVE-2026-111943 (golang/go#82345): upgrades Go to 1.26.10 so that the compromised eMudhra intermediate CA certificates are no longer trusted, and updates all dependencies to their latest patch versions.

Summary of Changes

Minor Changes:

alibabacloud: support RRSA (RAM Roles for Service Accounts) credentials in the IPAM allocator, alongside static AccessKeys and ECS instance RAM roles (Backport PR #49474, Upstream PR #49093, @4n4nd)

Bugfixes:

Allow wildcard CIDR selectors to match nodes when --policy-cidr-match-mode=nodes is configured (Backport PR #49474, Upstream PR #47828, @TheBeeZee)
bpf: nat: fix outer ICMP checksum for ICMP/SCTP NAT error packets (Backport PR #49474, Upstream PR #48819, @fds7280)
CiliumEnvoyConfig now only redirects Services in its own namespace, as documented; service references in CiliumClusterwideEnvoyConfig without a namespace default to "default" again. (Backport PR #49474, Upstream PR #49076, @maxskokov)
datapath: Fix NAT46x64 gateway prefix conversion panic (Backport PR #49474, Upstream PR #49177, @HadrienPatte)
Fix an issue where terminating backends were evicted from BPF maps when trafficDistribution was enabled. (Backport PR #49474, Upstream PR #48349, @taesung320)
Fix invalid L4 checksum on IPv6 ClusterIP reverse NAT for CHECKSUM_PARTIAL packets on kernels < 6.12, affecting the case when packets are bridged/tunneled from the client pod to a remote host (Backport PR #49474, Upstream PR #49204, @liuyuan10)
Fix regression in Cilium 1.20.3 where the Gateway API implementation would incorrectly handle BackendTLSPolicy configurations, leading to high Cilium CPU usage and inability to forward traffic. (Backport PR #49568, Upstream PR #49525, @youngnick)
Fixes an issue in LBIPAM where on service upsert, if IP allocations are not changed the sharing index is not updated. (Backport PR #49474, Upstream PR #48938, @0xch4z)
nodediscovery: in IPAM ENI and Azure modes the operator now treats nodes as running in multi-pool mode from the very first event. (Backport PR #49390, Upstream PR #49242, @41ks)
Reduce transient DNS SERVFAIL/REFUSED for pods that query immediately at startup by pushing/applying Standalone DNS Proxy policy snapshots more frequently (Backport PR #49474, Upstream PR #49112, @QxBytes)
Remove the unused pebble binary from the cilium image to clear its Go standard library vulnerability findings. (Backport PR #49474, Upstream PR #49380, @aanm)

CI Changes:

[v1.20] ci: ignore transient xDS mode drift during downgrade (#49515, @jrajahalme)
ci: Pass the auto-committer secrets to the base images workflow (Backport PR #49467, Upstream PR #49453, @aanm)
renovate: Open one trusted PR per branch (Backport PR #49416, Upstream PR #49381, @aanm)

Misc Changes:

chore(deps): update auto-merge-trusted-deps (v1.20) (#49319, @cilium-renovate[bot])
chore(deps): update auto-merge-trusted-deps (v1.20) (#49445, @cilium-renovate[bot])
chore(deps): update dependency sphinxcontrib-openapi to v0.10.0 (v1.20) (#49438, @cilium-renovate[bot])
clarify co sign documentation to use minimum version to verify signing key (Backport PR #49474, Upstream PR #49401, @mfahlandt)
Fix Envoy xDS listener handling across restoration, address changes, and rejected updates (Backport PR #49383, Upstream PR #48897, @jrajahalme)

Other Changes:

install: Update image digests for v1.20.3 (#49392, @cilium-release-bot[bot])
route-reconciler: add prune exclusion logic and use it in the linuxNodeHandler (#49170, @andreaterzolo)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.4@sha256:20fe92e4c86641233a450098c158d2d29085f3419931ab6bf681d2485dedf16e
quay.io/cilium/cilium:stable@sha256:20fe92e4c86641233a450098c158d2d29085f3419931ab6bf681d2485dedf16e

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.4@sha256:aeac78ae77d166b86630310f2eb53fbc92014eda36ada8e6b2d7f2b8f2dadbfa
quay.io/cilium/clustermesh-apiserver:stable@sha256:aeac78ae77d166b86630310f2eb53fbc92014eda36ada8e6b2d7f2b8f2dadbfa

hubble-relay

quay.io/cilium/hubble-relay:v1.20.4@sha256:cb23408209697ed30d2bc462e1f01eb622ea4423a891458f78bc88d7255bbfc1
quay.io/cilium/hubble-relay:stable@sha256:cb23408209697ed30d2bc462e1f01eb622ea4423a891458f78bc88d7255bbfc1

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.4@sha256:163a08ee4438780638899742e95521e1a37edeb676c6e5c924d320c4c0bd09ad
quay.io/cilium/operator-alibabacloud:stable@sha256:163a08ee4438780638899742e95521e1a37edeb676c6e5c924d320c4c0bd09ad

operator-aws

quay.io/cilium/operator-aws:v1.20.4@sha256:caab27c6e3286a596d502f76aa6cffe2efab6e8a92234a0d10d2eed3eda85c7c
quay.io/cilium/operator-aws:stable@sha256:caab27c6e3286a596d502f76aa6cffe2efab6e8a92234a0d10d2eed3eda85c7c

operator-azure

quay.io/cilium/operator-azure:v1.20.4@sha256:0669c35e9f1638bbdd6cf5c64163e7ee4ea4ef440e223050e60665811369b4ec
quay.io/cilium/operator-azure:stable@sha256:0669c35e9f1638bbdd6cf5c64163e7ee4ea4ef440e223050e60665811369b4ec

operator-generic

quay.io/cilium/operator-generic:v1.20.4@sha256:7a7a3489dc66ad67e420d285c8a8d2e169b0957ad15e120f593d27081bf38d82
quay.io/cilium/operator-generic:stable@sha256:7a7a3489dc66ad67e420d285c8a8d2e169b0957ad15e120f593d27081bf38d82

operator

quay.io/cilium/operator:v1.20.4@sha256:f94e9812f191e0c31b5cfe6cb1f38f5c349d4f159f2030e621d179d826257263
quay.io/cilium/operator:stable@sha256:f94e9812f191e0c31b5cfe6cb1f38f5c349d4f159f2030e621d179d826257263

`v1.20.3`: 1.20.3

Compare Source

Summary of Changes

Minor Changes:

alibabacloud: support IMDSv2 (token-based) instance metadata access (Backport PR #49336, Upstream PR #49182, @4n4nd)
Fix conntrack garbage collection deleting CT entries that the datapath reopened between the GC batch read and the delete, which could cascade into NAT mapping deletion and SNAT source-port reallocation for live connections. (Backport PR #49119, Upstream PR #46750, @gyutaeb)
operator: prevent CNPs with nodeSelector from silently enforcing nothing (Backport PR #49173, Upstream PR #47882, @weizhoublue)

Bugfixes:

azure: Fixed an issue where an interface with an empty MAC field would be reported back the the cilium agent causing it to crash on startup when trying to configure the routes. (Backport PR #49336, Upstream PR #48648, @41ks)
bpf: icmp: use 576 byte of inner packet to avoid partial csum floor (Backport PR #48907, Upstream PR #48578, @tommyp1ckles)
cilium-dbg: Print port numbers correctly for map cilium_lb*_reverse_sk (Backport PR #49336, Upstream PR #47134, @jayl1e)
daemon: fix a bug where L7 DNS policies could remain loaded in the datapath during agent shutdown, causing pods under a wildcard toFQDNs policy to lose DNS resolution for the duration of the restart. (Backport PR #48907, Upstream PR #48747, @41ks)
endpoint/restore: skip cleanup for reserved internal endpoints (Backport PR #48999, Upstream PR #48272, @fristonio)
envoy: handle listener additional address changes (Backport PR #48917, Upstream PR #48712, @nezdolik)
envoy: handle listener address changes in ADS (Backport PR #48917, Upstream PR #48798, @nezdolik)
envoy: track coalesced ADS snapshot updates (Backport PR #48917, Upstream PR #48631, @nezdolik)
Fix Gateway API ExternalAuth dropping request bodies when allowedResponseHeaders is unset (Backport PR #49189, Upstream PR #48770, @kirgene)
Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint (Backport PR #49189, Upstream PR #48905, @fristonio)
Fix ip6tables chain rename errors being silently ignored during iptables rule reconciliation. (Backport PR #49336, Upstream PR #49024, @maxskokov)
Fix panic in agent when CiliumLocalRedirectPolicy redirectBackend.toPorts is declared as an empty array. The agent will now reject such a policy. (Backport PR #48907, Upstream PR #48491, @ajmmm)
Fix PMTU/ICMP replies for IPIP/Geneve DSR for GRO skbs (Backport PR #49189, Upstream PR #48489, @borkmann)
Fix rare data race in selector cache that could lead to agent panic (Backport PR #49189, Upstream PR #47733, @odinuge)
Fix restoration of terminating backends. If a terminating backend become active again during restart the backend was incorrectly kept as quarantined. (Backport PR #48797, Upstream PR #48763, @joamaki)
Fixes a bug where Hubble flows may list the incorrect policy that allowed or denied a flow (Backport PR #49189, Upstream PR #49086, @tsotne95)
Fixes a bug where the helm value hubble.tls.auto.privateKey settings are no longer ignored in Hubble cert-manager certificates (Backport PR #49189, Upstream PR #49114, @byxorna)
Fixes an issue where CiliumCIDRGroups with zero-length cidrs (i.e. 0.0.0.0/0) inadvertently selected no traffic. (Backport PR #49336, Upstream PR #48366, @squeed)
gateway-api: filter CEC controls from infrastructure metadata (Backport PR #48984, Upstream PR #47732, @nezdolik)
gateway-api: make HTTP route ordering deterministic (Backport PR #49336, Upstream PR #48951, @abduu11aahh)
gateway-api: Support system CA certificates in BackendTLSPolicy. (Backport PR #49336, Upstream PR #48895, @shreyasrajiv327)
infraendpoints: Release the health IPv4 when the IPv6 allocation fails (Backport PR #48907, Upstream PR #48816, @HadrienPatte)
k8s/resource: fix leaked event finalizer on unobserved delete (Backport PR #48907, Upstream PR #48785, @tklauser)
L7 conformance CI fixes (Backport PR #48999, Upstream PR #47517, @fristonio)
operator: Do not emit warning when deleting already deleted unmanaged pod (Backport PR #48907, Upstream PR #48765, @gandro)
operator: fix metrics list default address to work on IPv6-only clusters with dual stack nodes by trying both IPv4 and IPv6 loopback addresses (Backport PR #48907, Upstream PR #48780, @41ks)
Set ipv6 routing rules when dual stack is enabled (Backport PR #49336, Upstream PR #49188, @fcrespofastly)
Sockets are no longer destroyed when a Service backend is terminated unless they are still connected to that backend. Unconnected UDP sockets, and sockets that have since disconnected or moved to another backend, used to have their local port silently changed. (Backport PR #49189, Upstream PR #48725, @maxskokov)

CI Changes:

[ci] fix escaping in conformance ginkgo (Backport PR #49189, Upstream PR #48991, @nebril)
[v1.20] .github: Remove the EKS cluster pool workflows (#49084, @aanm)
ci: Add support for OIDC (Backport PR #49317, Upstream PR #49007, @aanm)
ci: cleanup disk space in documentation workflow (Backport PR #48907, Upstream PR #48427, @tklauser)
ci: Drop the empty floating tag line from CI image digests (Backport PR #49189, Upstream PR #49070, @aanm)
ci: fix CNI setup and readiness checks in the kubespray job (Backport PR #49336, Upstream PR #48927, @aanm)
ci: Give Envoy Embedded conformance a bigger runner (Backport PR #49189, Upstream PR #49018, @aanm)
ci: keep UDPRouteWeightedRouting skipped in the profile job (Backport PR #49189, Upstream PR #49005, @aanm)
ci: login to docker registry for downgrade image wait (Backport PR #49189, Upstream PR #48983, @nebril)
ci: Name runner variables after their Ubuntu release and let Renovate bump them (Backport PR #49317, Upstream PR #49065, @aanm)
ci: Skip redundant setup when base images already exist (Backport PR #49317, Upstream PR #47209, @HadrienPatte)
ci: Stop passing secrets to the base images workflow (Backport PR #49317, Upstream PR #49082, @aanm)
gha/conformance-multi-pool: use the local fake external targets (Backport PR #48986, Upstream PR #48558, @aanm)
gha/e2e-upgrade: gate the after-agent-restart conn-disrupt check (Backport PR #48437, Upstream PR #47440, @aanm)
gha/setup-aks-cluster: Retry a create that never starts (Backport PR #49317, Upstream PR #48924, @aanm)
gha: Derive the LVH package cache key once per run (Backport PR #48986, Upstream PR #48656, @aanm)
gha: don't fail PR tests on reporting errors (Backport PR #49317, Upstream PR #48740, @aanm)
gha: Grant id-token to the post-release call of release.yaml (Backport PR #49317, Upstream PR #49323, @aanm)
gha: make external fake targets image configurable (Backport PR #49189, Upstream PR #48941, @giorio94)
gha: Retry stalled kind image pulls before the install wait expires (Backport PR #49336, Upstream PR #48989, @aanm)
gha: Skip the duplicate CI image build on push to main (Backport PR #48986, Upstream PR #48736, @aanm)
gha: survive a GKE zone running out of capacity (Backport PR #48986, Upstream PR #48184, @aanm)
gha: Tolerate cosign and SBOM failures on pull requests (Backport PR #48986, Upstream PR #48737, @aanm)
ginkgo: remove Test NodePort with L7 policy tests (Backport PR #49067, Upstream PR #46499, @smagnani96)
loadbalancer/tests: Fix the graceful termination test restart (Backport PR #49317, Upstream PR #48939, @aanm)
Migrate Conformance Cluster Mesh workflow to use fake external targets (Backport PR #48654, Upstream PR #48250, @giorio94)
nodeinit: wait for the kubelet wrapper before writing the bootstrap file (Backport PR #49189, Upstream PR #48739, @aanm)

Misc Changes:

bpf: lxc: switch cilium_nodeport_nat_buffer to auxvar (Backport PR #48741, Upstream PR #48543, @julianwiedmann)
build: handle git worktrees in documentation make targets (Backport PR #49189, Upstream PR #48966, @utaal)
chore(deps): update all github action dependencies (v1.20) (#48881, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.20) (#49039, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.20) (#49152, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.20) (#49277, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.20) (#48882, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.20) (#49153, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.20) (#49275, @cilium-renovate[bot])
chore(deps): update base-images to v1.26.9 (v1.20) (#49262, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.20.1 (v1.20) (#48978, @cilium-renovate[bot])
chore(deps): update dependency cilium/little-vm-helper to v0.0.31 (v1.20) (#48788, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v36.2 (v1.20) (#49038, @cilium-renovate[bot])
chore(deps): update docker.io/library/busybox:1.38.0 docker digest to fd7dc98 (v1.20) (#49035, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.26.8 docker digest to 0f063af (v1.20) (#49149, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.26.8 docker digest to 6c2a553 (v1.20) (#48879, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.26.9 docker digest to d772206 (v1.20) (#49298, @cilium-renovate[bot])
chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.7.2 (v1.20) (#49036, @cilium-renovate[bot])
chore(deps): update helm/kind-action action to v1.15.1 (v1.20) (#49289, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.4-1790671085-c3a2a1ff726f00f5b5c0886cab3ad345f97f35b9 (v1.20) (#49111, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1790882336-b64c7306085409b95fb5626db2d2bb7a200b9432 (v1.20) (#49123, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1791291190-5ec36181d464cd75b35b45395a722226cbdd2888 (v1.20) (#49194, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791350265-ae0327a34850b7d1849e8332dbefd4d5bebabe10 (v1.20) (#49216, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791537840-00e749f11f69334c625e53fc1ce2fc6c7f34a51f (v1.20) (#49276, @cilium-renovate[bot])
chore(deps): update security updates to v1.45.0 [security] (v1.20) (#48814, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.20) (patch) (#48880, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.20) (patch) (#49037, @cilium-renovate[bot])
ciliumendpointslice: Report no CID when the CEP has none (Backport PR #49189, Upstream PR #48933, @aanm)
connectivity-check: move echo-b to the lower NodePort band (Backport PR #49189, Upstream PR #48926, @aanm)
docs: note on eBPF ClusterIP translation vs Docker raw-table protection (Backport PR #49189, Upstream PR #47782, @Verbano-Tech)
envoy: add standalone NPDS unsubscribe regression test (Backport PR #48917, Upstream PR #47818, @nezdolik)
fix(deps): update k8s.io patch updates stable to v0.36.5 (v1.20) (#49151, @cilium-renovate[bot])
fix(deps): update module golang.org/x/net to v0.60.0 [security] (v1.20) (#49253, @cilium-renovate[bot])
fix(deps): update security updates [security] (v1.20) (#48808, @cilium-renovate[bot])
gateway-api: centralize Gateway validation (Backport PR #48907, Upstream PR #48602, @arybolovlev)
loadbalancer/writer: add support for SetFrontendSourceRangesFunc (Backport PR #49336, Upstream PR #49068, @0xch4z)

Other Changes:

[v1.20] deps: update gateway api to v1.6.3 (#49305, @mhofstetter)
[v1.20] node_neighbor_discovery: fix ID in delete query (#48912, @nobleess)
[v1.20] routing: fix dual-stack ENI router startup with native routing CIDRs (#48709, @monta-riahi)
install: Update image digests for v1.20.2 (#48751, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.3@sha256:95cfa5c2427cc6b452c00908778d0566311f572589284af949d06a013db1a849
quay.io/cilium/cilium:stable@sha256:95cfa5c2427cc6b452c00908778d0566311f572589284af949d06a013db1a849

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.3@sha256:5c8dca0d0b77bb593df157be39f6c9c868dc08922bbd0540ac0a56815341b227
quay.io/cilium/clustermesh-apiserver:stable@sha256:5c8dca0d0b77bb593df157be39f6c9c868dc08922bbd0540ac0a56815341b227

hubble-relay

quay.io/cilium/hubble-relay:v1.20.3@sha256:c6f819d9c5e0b35ccac63b9f2f1ae213fd9be50588e15d5a444d5d305ad317b5
quay.io/cilium/hubble-relay:stable@sha256:c6f819d9c5e0b35ccac63b9f2f1ae213fd9be50588e15d5a444d5d305ad317b5

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.3@sha256:615f8c2995e437320571d6f61e623d6848ed3ea357cdaa886ac95bbff29a0b52
quay.io/cilium/operator-alibabacloud:stable@sha256:615f8c2995e437320571d6f61e623d6848ed3ea357cdaa886ac95bbff29a0b52

operator-aws

quay.io/cilium/operator-aws:v1.20.3@sha256:49bdd1d54bdf3da2740848c4662854d0d41c0df25cffe8575d71723db08cc0d1
quay.io/cilium/operator-aws:stable@sha256:49bdd1d54bdf3da2740848c4662854d0d41c0df25cffe8575d71723db08cc0d1

operator-azure

quay.io/cilium/operator-azure:v1.20.3@sha256:7132b3ff7e33a076ea9fadaa6e4f2b364937ed7b118b92928bdb4706921a2ffa
quay.io/cilium/operator-azure:stable@sha256:7132b3ff7e33a076ea9fadaa6e4f2b364937ed7b118b92928bdb4706921a2ffa

operator-generic

quay.io/cilium/operator-generic:v1.20.3@sha256:efdd8d89d6d8f63d21a065fa2f9e17614a2b3ac9371b221af9355f63829e2dbc
quay.io/cilium/operator-generic:stable@sha256:efdd8d89d6d8f63d21a065fa2f9e17614a2b3ac9371b221af9355f63829e2dbc

operator

quay.io/cilium/operator:v1.20.3@sha256:c40996c8a413f57db75715e683abc550e7849904aa20b8730822ba532f9b783c
quay.io/cilium/operator:stable@sha256:c40996c8a413f57db75715e683abc550e7849904aa20b8730822ba532f9b783c

`v1.20.2`: 1.20.2

Compare Source

Summary of Changes

Minor Changes:

gateway-api: node label selector for when hostNetwork is enabled (Backport PR #48636, Upstream PR #47463, @xtineskim)

Bugfixes:

aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR #48418, Upstream PR #48125, @41ks)
aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #48418, Upstream PR #48193, @41ks)
bpf: Fix agent crash when dumping map events (Backport PR #48378, Upstream PR #48273, @joestringer)
bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (Backport PR #48550, Upstream PR #48407, @41ks)
Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (Backport PR #48418, Upstream PR #48262, @giorio94)
datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR #48550, Upstream PR #46861, @fdomain)
endpoint: preserve concurrent policy updates for new endpoints (Backport PR #48213, Upstream PR #48195, @jrajahalme)
ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. (Backport PR #48213, Upstream PR #47034, @41ks)
Fix a pod created immediately after a network policy change reporting a stale policy revision for up to two minutes. (Backport PR #48418, Upstream PR #47642, @aanm)
Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association (Backport PR #48024, Upstream PR #47874, @bryanhorstmann)
Fix BGP defaultGateway peer auto-discovery selecting a default route from a non-main routing table, such as the default via cilium_host route Cilium installs in the from-proxy table, instead of the node's real default gateway. (Backport PR #48418, Upstream PR #47971, @ecbaldwin)
Fix bug where identities may linger for double the amount of the expected time (Backport PR #48418, Upstream PR #48032, @christarazi)
Fix dropping traffic L2Announcement with externalTrafficPolicy: Local (Backport PR #48550, Upstream PR #46399, @yuito-it)
Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. (Backport PR #48017, Upstream PR #47943, @taaahaaa)
Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. (Backport PR #48017, Upstream PR #47929, @shreyasrajiv327)
Fix Hubble Relay remains running during termination (Backport PR #48550, Upstream PR #47942, @xandau)
Fix ICMP error packet handling by adding the missing checksum recalculation performed during NAT for SNATed load-balanced traffic. (Backport PR #48418, Upstream PR #48086, @julianwiedmann)
Fix IPv6 Router Solicitations and Router Advertisements being dropped with "Unsupported protocol for NAT masquerade" on nodes whose BPF masquerade address is a link-local address. (Backport PR #48418, Upstream PR #48094, @ecbaldwin)
Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR #48418, Upstream PR #48391, @fristonio)
Fix multiple regressions in Cilium LocalRedirectPolicy (Backport PR #48634, Upstream PR #46638, @ajmmm)
Fix node-init startup on GKE 1.36.2-gke.2064000 nodes by detecting GKE from the kubelet path instead of container runtime configuration. (Backport PR #48213, Upstream PR #47945, @dlanov)
Fix nodeport egress tuple reuse for closed connections (Backport PR #48418, Upstream PR #48306, @fristonio)
Fix restored ENI endpoints routing rule configuration when masquerading config changes (#48417, @fristonio)
fix(envoyconfig): retry port allocation on duplicate-address rejections (Backport PR #48735, Upstream PR #48624, @kokhlo)
Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR #48213, Upstream PR #47915, @giorio94)
Fixed a cilium-agent crash (fatal error: concurrent map iteration and map write) when an endpoint's policy was recomputed while incremental policy map changes were applied concurrently. Most commonly triggered by named-port policies under pod churn. (Backport PR #48735, Upstream PR #48098, @nashant)
Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (Backport PR #48434, Upstream PR #47635, @aanm)
Fixes a bug where clusters originally created in v1.15 or earlier failed to upgrade due to dropping the CRD version CiliumNodeConfig v2alpha1. (Backport PR #48213, Upstream PR #48087, @squeed)
Fragmented UDP packets were potentially mis-classified as Cilium Wireguard traffic. (Backport PR #48213, Upstream PR #48139, @julianwiedmann)
gateway-api: fix listener programmed status update (Backport PR #48213, Upstream PR #48013, @mhofstetter)
gateway-api: propgate listenerset status update errors (Backport PR #48581, Upstream PR #48130, @mhofstetter)
hubble: fix four config knobs that never reach their sink (Backport PR #48434, Upstream PR #47637, @aanm)
Improve reliability for fast recovery of disrupted TCP connections that access a DSR-enabled Service. (Backport PR #48465, Upstream PR #48254, @julianwiedmann)
lb (fix): require active state for backend when using topology hints (Backport PR #48550, Upstream PR #47054, @CarrySauce)
nodediscovery: Reduced EC2 IMDS load and made ENI node registration more resilient by fetching the instance metadata once instead of on every CiliumNode update. (Backport PR #48603, Upstream PR #48218, @41ks)
operator/ipam: Restore fatal exit when the IPAM node watcher fails (Backport PR #48213, Upstream PR #47778, @HadrienPatte)
Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR #48213, Upstream PR #48015, @giorio94)
The BPF NAT engine now drops ICMP error packets which contain a fragmented TCP/UDP/SCTP packet. (Backport PR #48418, Upstream PR #48174, @julianwiedmann)
When using DSR with --bpf-lb-dsr-dispatch set to "opt" or "geneve" in combination with --enable-pmtu-discovery, fix the outer source IP of the ICMP error message which is generated when a forwarded DSR request exceeds the network interface's MTU. (Backport PR #48114, Upstream PR #48053, @julianwiedmann)

CI Changes:

[v1.20] golangci-lint: Do not run the modernize linter (#48398, @aanm)
.github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR #48550, Upstream PR #48462, @joestringer)
BPF: Refactor nat tests to use scapy fixtures and add checksum coverage (Backport PR #48213, Upstream PR #47222, @tommyp1ckles)
bpf: tests: fix up prog type in ipv6_test (Backport PR #48213, Upstream PR #47736, @julianwiedmann)
bpf: tests: use PROG_TYPE (Backport PR #48213, Upstream PR #47714, @julianwiedmann)
bpf: tests: validate CT entry for DSR connection (Backport PR #48418, Upstream PR #48219, @julianwiedmann)
ci: replace unsupported LLVM installation action (Backport PR #48418, Upstream PR #47776, @bogdankrasko)
ci: resolve renovate PR metadata in base image workflows (Backport PR #48213, Upstream PR #47964, @mhofstetter)
ci: stop asking a PHP app for the AKS runner IP (Backport PR #48418, Upstream PR #48371, @aanm)
ci: use GitHub App client ID in v1.20 image workflow (Backport PR #48213, Upstream PR #47787, @bogdankrasko)
datapath/loader: fix missing complexity coverage for enable_identity_mark (Backport PR #48213, Upstream PR #48037, @tklauser)
gh: verifier: test PR branch before base branch (Backport PR #48418, Upstream PR #47928, @julianwiedmann)
gha/conformance-aks: add a timeout to the cluster create step (Backport PR #48550, Upstream PR #48545, @aanm)
gha/conformance-aks: give the nodes a 64 GiB OS disk (Backport PR #48550, Upstream PR #48481, @aanm)
gha/kubespray: don't wait for CoreDNS before Cilium is installed (Backport PR #48213, Upstream PR #48048, @aanm)
gha: bound the LLVM prereq apt step with a 5m timeout (Backport PR #48213, Upstream PR #48069, @aanm)
gha: compute the ginkgo cache key once, before the matrix (Backport PR #48213, Upstream PR #48127, @aanm)
gha: move GCP auth pin past the STS token exchange retry fix (Backport PR #48418, Upstream PR #48352, @aanm)
gha: publish the external target hostnames as FQDNs (Backport PR #48550, Upstream PR #48478, @aanm)
gha: stop JUnit reports being destroyed by same-name legs (Backport PR #48418, Upstream PR #48203, @aanm)
logging: downgrade canceled response-body reads to info (Backport PR #48418, Upstream PR #48202, @aanm)
Makefile: Order the bpf codegen ahead of the Go builds (Backport PR #48735, Upstream PR #48644, @aanm)
Revert 48441 - disable local accounts on AKS clusters (#48524, @aanm)
test(bpf): parallelize eBPF test execution (Backport PR #48213, Upstream PR #47427, @lconnery)
test/k8s: wait for the L7 visibility policy to be realized (Backport PR #48418, Upstream PR #48365, @aanm)
test: fix the never-taken retry on a partially read JSON line (Backport PR #48634, Upstream PR #48190, @aanm)
tools: complexity: de-couple StackDepth from kernel version (Backport PR #48200, Upstream PR #48236, @julianwiedmann)
workflows: disable local accounts on AKS clusters (#48441, @nbusseneau)

Misc Changes:

Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR #48634, Upstream PR #48421, @0xch4z)
bpf/lib/nat: rename icmpoff (Backport PR #48418, Upstream PR #47797, @tommyp1ckles)
bpf: dsr: use eth_store_proto() in dsr_reply_icmp*() (Backport PR #48213, Upstream PR #47392, @julianwiedmann)
bpf: icmp*: fix up sample length (Backport PR #48114, Upstream PR #48020, @julianwiedmann)
bpf: misc cleanups (Backport PR #48350, Upstream PR #47879, @julianwiedmann)
bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (Backport PR #48284, Upstream PR #46232, @julianwiedmann)
bpf: Reduce stack usage of send_trace_notify (Backport PR #48350, Upstream PR #47911, @joamaki)
chore(deps): update all external docker images dependencies (v1.20) (patch) (#48147, @cilium-renovate[bot])
chore(deps): update all external docker images dependencies to v0.13.6 (v1.20) (#48673, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.20) (#48326, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.20) (#48506, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.20) (#48677, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.20) (#48149, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.20) (#48325, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.20) (#48619, @cilium-renovate[bot])
chore(deps): update base-images (v1.20) (#48327, @cilium-renovate[bot])
chore(deps): update base-images (v1.20) (#48672, @cilium-renovate[bot])
chore(deps): update dependency bufbuild/buf to v1.73.0 (v1.20) (#48729, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.20) (#48344, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.20) (#48505, @cilium-renovate[bot])
chore(deps): update dependency semver to v3.1.0 (v1.20) (#48730, @cilium-renovate[bot])
chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.20) (#48517, @cilium-renovate[bot])
chore(deps): update google/cloud-sdk docker tag to v581 (v1.20) (#48150, @cilium-renovate[bot])
chore(deps): update helm/kind-action action to v1.15.0 (v1.20) (#48591, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1787987562-ac0b61a4c0a45670a3654448d53bd6416b948f62 (v1.20) (#48323, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.20) (#48451, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.20) (#48674, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.20) (patch) (#48148, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.20) (patch) (#48324, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.20) (patch) (#48504, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.20) (patch) (#48675, @cilium-renovate[bot])
ci: disable TCP/UDPRouteWeightedRouting gateway-api conformance tests (Backport PR #48550, Upstream PR #48375, @0xch4z)
datapath: move some feature probes into BPF (Backport PR #48213, Upstream PR #47737, @julianwiedmann)
docs: fix extra closing parenthesis in hive.rst (Backport PR #48634, Upstream PR #48541, @logi74123)
docs: Improve build process (Backport PR #48550, Upstream PR #47751, @joestringer)
docs: remove outdated tip about disabling hubble before enabling UI (Backport PR #48634, Upstream PR #48487, @ekoops)
docs: Remove v1.18 ipsec documentation (Backport PR #48418, Upstream PR #48224, @joestringer)
docs: Update kernel config requirements (Backport PR #48634, Upstream PR #48594, @pchaigno)
Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (Backport PR #48550, Upstream PR #48428, @marcus-chae)
Documentation: document mesh security model (Backport PR #48213, Upstream PR #47912, @bimmlerd)
envoy: Clarify legacy UpdateEnvoyResources (Backport PR #48213, Upstream PR #48066, @jrajahalme)
Fix (eBPF): Pointer-to-Pointer Misuse in IPv6 Trace Notifications (Backport PR #48350, Upstream PR #47908, @weizhoublue)
Fix Component Overview doc link rendering (Backport PR #48634, Upstream PR #48537, @eneiss)
fix(deps): update k8s.io patch updates stable to v0.36.4 (v1.20) (#48118, @cilium-renovate[bot])
fix(deps): update module google.golang.org/grpc to v1.83.1 [security] (v1.20) (#48388, @cilium-renovate[bot])
fix(deps): update module sigs.k8s.io/gateway-api/conformance to v1.6.2 (v1.20) (#48676, @cilium-renovate[bot])
Fixed broken Slack link on Community page. (Backport PR #48418, Upstream PR #48021, @ps-mir)
Fixes: Update node-cache image version to 1.26.5 (Backport PR #48634, Upstream PR #48270, @zyue110026)
gateway-api: avoid logging missing GatewayClass as error (Backport PR #48581, Upstream PR #48529, @mhofstetter)
gateway-api: deduplicate condition merge helpers (Backport PR #48581, Upstream PR #48122, @mhofstetter)
gateway-api: extract BackendTLSPolicy status handling into BackendTLSPolicyStatusManager (Backport PR #48581, Upstream PR #48068, @mhofstetter)
gateway-api: extract gateway address status handling (Backport PR #48581, Upstream PR #48129, @mhofstetter)
gateway-api: extract index & load functionality from controller / reconcile (Backport PR #48581, Upstream PR #47837, @mhofstetter)
gateway-api: extract listener status handling (Backport PR #48581, Upstream PR #48103, @mhofstetter)
gateway-api: extract route status handling into RouteStatusManager (Backport PR #48581, Upstream PR #48023, @mhofstetter)
gateway-api: make gateway-api reconciler client and scheme fields private (Backport PR #48581, Upstream PR #48191, @mhofstetter)
gateway-api: only load referenced services & serviceimports (Backport PR #48581, Upstream PR #48469, @mhofstetter)
gateway-api: put ctx first in route status API (Backport PR #48581, Upstream PR #48074, @mhofstetter)
gateway-api: remove duplicate gateway reconcile error logs (Backport PR #48581, Upstream PR #48186, @mhofstetter)
gateway-api: remove Gateway LBIPAM annotation warning (Backport PR #48581, Upstream PR #48187, @mhofstetter)
gateway-api: remove pre-filtered namespaces concept (Backport PR #48581, Upstream PR #47685, @asauber)
gha/lint-ariane-config: let Renovate manage the Go version (Backport PR #48550, Upstream PR #48467, @aanm)
gha: authenticate release images with OIDC (Backport PR #48599, Upstream PR #48062, @aanm)
gha: authenticate stable Image CI to quay.io with OIDC (Backport PR #48060, Upstream PR #48061, @aanm)
gha: correct and move the OIDC subject comments (Backport PR #48060, Upstream PR #48370, @aanm)
gha: raise the Docker Hub OIDC token lifetime for release builds (Backport PR #48599, Upstream PR #48535, @aanm)
helm: add general busybox image values for substitution (Backport PR #48418, Upstream PR #47973, @0xch4z)
vendor: Bump StateDB to v0.8.4 (#48248, @joamaki)

Other Changes:

[v1.20] bpf: Force-align IPv4 CT tuples used by revSNAT memcpy() (#48395, @julianwiedmann)
install: Update image digests for v1.20.1 (#48039, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01
quay.io/cilium/cilium:stable@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.2@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce
quay.io/cilium/clustermesh-apiserver:stable@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce

hubble-relay

quay.io/cilium/hubble-relay:v1.20.2@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f
quay.io/cilium/hubble-relay:stable@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.2@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38
quay.io/cilium/operator-alibabacloud:stable@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38

operator-aws

quay.io/cilium/operator-aws:v1.20.2@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3
quay.io/cilium/operator-aws:stable@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3

operator-azure

quay.io/cilium/operator-azure:v1.20.2@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a
quay.io/cilium/operator-azure:stable@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a

operator-generic

quay.io/cilium/operator-generic:v1.20.2@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc
quay.io/cilium/operator-generic:stable@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc

operator

quay.io/cilium/operator:v1.20.2@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c
quay.io/cilium/operator:stable@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c

`v1.20.1`: 1.20.1

Compare Source

Summary of Changes

Major Changes:

docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR #47615, Upstream PR #47351, @MrFreezeex)

Minor Changes:

envoy: demote stale ADS endpoint warning (Backport PR #47805, Upstream PR #47148, @nezdolik)
Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR #47881, Upstream PR #47529, @julianwiedmann)

Bugfixes:

azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR #47690, Upstream PR #47449, @jaredledvina)
bpf: dsr: don't look for TCP header on fragmented packets (Backport PR #47881, Upstream PR #47640, @julianwiedmann)
bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR #47621, Upstream PR #47343, @smagnani96)
clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR #47885, Upstream PR #47824, @MrFreezeex)
datapath: turn ARP off on the base devices before bringing them up (Backport PR #47885, Upstream PR #47838, @aanm)
endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR #47690, Upstream PR #47625, @christarazi)
endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR #47954, Upstream PR #47880, @weizhoublue)
envoy.httpUpstreamLingerTimeout accepts 0 as a chart value and templates into configmap. (Backport PR #47885, Upstream PR #47741, @jdw6359)
envoy: restore http-idle-timeout as the route idle timeout source (Backport PR #47690, Upstream PR #47583, @aanm)
Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR #47805, Upstream PR #47765, @julianwiedmann)
Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR #47967, Upstream PR #47802, @bimmlerd)
Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR #47805, Upstream PR #47727, @aanm)
Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR #47690, Upstream PR #47295, @aanm)
Fix abnormal ip allocation caused by hostnetwork pod (Backport PR #47690, Upstream PR #47552, @haozhangami)
Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR #47881, Upstream PR #47593, @julianwiedmann)
fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR #47885, Upstream PR #47754, @weizhoublue)
Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with NotAllowedByListeners when the TCP listener had an explicit AllowedRoutes.Kinds restriction. (Backport PR #47690, Upstream PR #46842, @pidreher)
gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR #47954, Upstream PR #47840, @mhofstetter)
gateway-api: mark unresolved backend service ports in route status (Backport PR #47885, Upstream PR #47766, @mhofstetter)
gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR #47690, Upstream PR #46696, @thorn3r)
gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR #47690, Upstream PR #47457, @asauber)
gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR #47805, Upstream PR #47702, @mhofstetter)
gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR #47690, Upstream PR #47627, @mhofstetter)
ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR #47885, Upstream PR #47208, @iwanhae)
l2announcer: re-evaluate services on frontend changes (Backport PR #47690, Upstream PR #47579, @mhofstetter)
Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR #47954, Upstream PR #47826, @mehrdadbn9)
operator: Emit startup logs in the configured log format (Backport PR #47954, Upstream PR #47890, @HadrienPatte)
Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR #47885, Upstream PR #47844, @bimmlerd)
standalone-dns-proxy: return an error when no endpoint is found (Backport PR #47954, Upstream PR #47791, @vipul-21)
wireguard: Unsubscribe node handler on shutdown (Backport PR #47805, Upstream PR #47614, @HadrienPatte)

CI Changes:

.github: add python3-scapy for BPF unit tests (Backport PR #47690, Upstream PR #47535, @msune)
.github: run all quarantined EKS tests in a single tolerated step (Backport PR #47690, Upstream PR #47534, @aanm)
.github: Run envoy image check against PR content (Backport PR #47805, Upstream PR #47792, @joestringer)
.github: Simplify permissions for image linter workflow (Backport PR #47805, Upstream PR #47753, @joestringer)
.github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR #47690, Upstream PR #47470, @atykhyy)
.github: test the default ENI behaviour on the EKS pull request leg (Backport PR #47690, Upstream PR #47569, @aanm)
ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR #47805, Upstream PR #47743, @giorio94)
bpf/complexity-tests: Cover L7 LB (Backport PR #47805, Upstream PR #47060, @pchaigno)
ci: build race images on push events so conformance-race works on stable branches (Backport PR #47609, Upstream PR #47608, @aanm)
ci: build race images on push in the stable image builders (Backport PR #47609, Upstream PR #47616, @aanm)
ci: draft renovate PRs until ciliumbot auto-approval (Backport PR #47805, Upstream PR #47364, @mhofstetter)
ci: fix filtering out md files in bpf checks (Backport PR #47690, Upstream PR #47605, @nebril)
ci: migrate set-commit-status to cilium/actions (Backport PR #47805, Upstream PR #47771, @bogdankrasko)
ci: skip etcd log fetch when kvstore was never started (Backport PR #47885, Upstream PR #47801, @aanm)
Fix missing events_map_rate_limit complexity coverage (Backport PR #47805, Upstream PR #47691, @pchaigno)
gha/kubespray: run on schedule, rather than on every push (Backport PR #47731, Upstream PR #47719, @giorio94)
gha/lvh-kind: respect Kind image version also when config is provided (Backport PR #47731, Upstream PR #47703, @giorio94)
gha: don't install LLVM and Clang in integration tests workflow (Backport PR #47731, Upstream PR #47717, @giorio94)
gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR #47731, Upstream PR #47724, @giorio94)
images/scripts: Validate Envoy image vars against sed injection (Backport PR #47805, Upstream PR #47205, @MasloMaslane)
Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR #47885, Upstream PR #47780, @giorio94)
test(bpf): parallelize eBPF test compilation (Backport PR #47954, Upstream PR #47426, @lconnery)
test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR #47805, Upstream PR #47725, @aanm)
test: allowlist the leader election read timeout in ginkgo log check (Backport PR #47690, Upstream PR #47612, @aanm)

Misc Changes:

Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR #47690, Upstream PR #46116, @amaanx86)
allocator: fix flake in TestWatchRemoteKVStore (Backport PR #47690, Upstream PR #47455, @giorio94)
bpf/nat: Move IPv6 nat entry to map (Backport PR #47805, Upstream PR #47762, @pchaigno)
bpf: conntrack: Reduce stack usage of ct_create{4,6} (Backport PR #47805, Upstream PR #47582, @dylandreimerink)
bpf: dsr: only require DSR-info on SYN packet (Backport PR #47881, Upstream PR #47592, @julianwiedmann)
bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR #47881, Upstream PR #47388, @julianwiedmann)
bpf: lb: use dedicated new_backend bool (Backport PR #47881, Upstream PR #47841, @julianwiedmann)
chore(deps): update all github action dependencies (v1.20) (#47991, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.20) (#48008, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.20) (#47678, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) (#47576, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) (#47988, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.26.5 docker digest to 705e964 (v1.20) (#47949, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.26.5 docker digest to 7caba52 (v1.20) (#47864, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) (#47899, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) (#47989, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.20) (patch) (#47865, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.20) (patch) (#47990, @cilium-renovate[bot])
clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR #47962, Upstream PR #47932, @giorio94)
docs: clarify GAMMA DROP_EP_NOT_READY events (Backport PR #47885, Upstream PR #47587, @thorn3r)
docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR #47690, Upstream PR #47600, @41ks)
docs: Remove "not stable" installation instructions (Backport PR #47798, Upstream PR #47646, @joestringer)
docs: update Gateway API conformance badge (Backport PR #47690, Upstream PR #47581, @arybolovlev)
docs: Update Gateway API installation guide (Backport PR #47690, Upstream PR #47446, @arybolovlev)
Gateway API: the Gateway address status no longer reports a bogus "" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR #47690, Upstream PR #47466, @locker95)
gateway-api: remove unnecessary TLSRoute support checks (Backport PR #47885, Upstream PR #47758, @mhofstetter)
gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR #47690, Upstream PR #47599, @mhofstetter)
gateway-api: return route check errors directly (Backport PR #47805, Upstream PR #47607, @mhofstetter)
gateway-api: unify Gateway API listener parentRef matching (Backport PR #47690, Upstream PR #46670, @arybolovlev)
gateway-api: validate gRPCRoute header modifiers in status (Backport PR #47805, Upstream PR #47606, @mhofstetter)
operator: Replace reflect.DeepEqual with assert.Equal in tests (Backport PR #47690, Upstream PR #47424, @HadrienPatte)
Update all github action dependencies (v1.20) (#47656, @cilium-renovate[bot])
Update all github action dependencies (v1.20) (#47675, @cilium-renovate[bot])
Update docker.io/library/busybox:1.38.0 Docker digest to dc2d74b (v1.20) (#47655, @cilium-renovate[bot])
Update documentation dependencies (Backport PR #47798, Upstream PR #47750, @joestringer)
Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) (#47657, @cilium-renovate[bot])
Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) (#47659, @cilium-renovate[bot])
Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) (#47658, @cilium-renovate[bot])

Other Changes:

install: Update image digests for v1.20.0 (#47584, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b
quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5
quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5

hubble-relay

quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4
quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c
quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c

operator-aws

quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7
quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7

operator-azure

quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031
quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031

operator-generic

quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf
quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf

operator

quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d
quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d

`v1.20.0`: 1.20.0

Compare Source

🎉 Release Announcement 🎉: We are excited to announce the Cilium 1.20.0 release!

More than 2,660 new commits have landed in this release, supported by a community of over 1,100 contributors and more than 24,800 GitHub stars! 🤩

⚠️ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the cilium.io/v2alpha1 CiliumNodeConfig API, the libnetwork integration, or a custom CNI configuration. See the Upgrade Guide for details.

The full changelog can be found here.

Here are some of the highlights:

⛩️ Gateway API
- 🚀 Gateway API v1.6.1: Cilium moves from Gateway API v1.4 to v1.6.1, bringing support for capabilities that graduated across both upstream releases. (cilium/cilium#45251, @youngnick; cilium/cilium#46827, cilium/cilium#47274, @arybolovlev)
- 👥 Delegate Gateway Listeners: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. (cilium/cilium#46303, cilium/cilium#46785, @asauber)
- 🔏 Encrypt Traffic to Backends: Gateway API BackendTLSPolicy support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. (cilium/cilium#43045, @youngnick)
- 🔀 TCPRoute and UDPRoute: Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic. (cilium/cilium#46184, cilium/cilium#46970, @eminaktas; cilium/cilium#47381, @arybolovlev)
- 🔐 External Authorization: HTTPRoute requests can now be authenticated and authorized through an external service before they reach the application, using the Gateway API ExternalAuth filter from GEP-1494. (cilium/cilium#45739, @gauteoh)
- 🎛️ More HTTP Traffic Controls: HTTPRoutes gain native CORS support and additional 303, 307 and 308 redirect codes. CiliumGatewayClassConfig can also overwrite, append or preserve the HTTP Server response header. (cilium/cilium#45924, @arybolovlev; cilium/cilium#47232, @youngnick; cilium/cilium#46764, @xtineskim)
- ↔️ Configurable gRPC-Web Translation: CiliumGatewayClassConfig can disable automatic gRPC-web translation for Gateways that need to pass the original traffic through unchanged. Translation remains enabled by default. (cilium/cilium#45984, @thorn3r)
🚠 Networking
- 🔌 Extensible Datapath: Datapath plugins let cloud providers extend or instrument Cilium's eBPF datapath with independently versioned programs, without maintaining a Cilium fork. (cilium/cilium#45028, cilium/cilium#45429, cilium/cilium#45558, cilium/cilium#46673, cilium/cilium#46872, @jrife)
- 🚄 Automatic Netkit Selection: Set bpf.datapathMode=auto to use netkit automatically on supported kernels and fall back to veth on other nodes. The default remains veth. (cilium/cilium#43062, @ajmmm)
- 📤 Egress Gateway Improvements: Dual-stack clusters can configure an explicit IPv6 egress IP. IPv4 Egress Gateway traffic also strictly honors the interface selected by the policy, matching the existing IPv6 behavior. (cilium/cilium#44524, @yykkibbb; cilium/cilium#45833, @julianwiedmann)
- 🔍 Better BGP Tooling and Reconciliation: New Hive shell commands expose route policies and clearer peer output formats. The control plane moves to GoBGP v4.6.1 and optimizes route-policy reconciliation. (cilium/cilium#45628, cilium/cilium#45534, @martonra; cilium/cilium#45952, cilium/cilium#46928, @rastislavs)
🌐 IPAM and IP Selection
- ☁️ IPv6 for AWS ENI IPAM (Beta): Cilium can now allocate IPv6 prefixes to pods through AWS ENI IPAM, building on the move to the multi-pool allocator. (cilium/cilium#46756, cilium/cilium#46619, @41ks; cilium/cilium#45154, cilium/cilium#45958, @HadrienPatte)
- 🔄 Migrate to Multi-Pool IPAM: Existing clusters can move from cluster-pool IPAM to multi-pool IPAM without being rebuilt. (cilium/cilium#46104, @pippolo84)
- 🧭 Dynamic NodePort Source Addresses: NodePort can use the kernel FIB to select the preferred source address dynamically before SNATing north-south traffic, on supported kernels. (cilium/cilium#44625, @ldelossa)
- 🔵 Prefer IPv6 Consistently: The new top-level preferIpv6 option applies to both Cilium health probes and Hubble peer communication when IPv4 and IPv6 are available. (cilium/cilium#45447, @tibrezus)
🕸️ Services and Cluster Mesh
- 📍 Topology-Aware Service Traffic: Cilium's service load balancer now supports the Kubernetes PreferSameZone and PreferSameNode traffic distribution hints. (cilium/cilium#44771, @raphink)
- ⚖️ Weighted Maglev Backends: Maglev now honors the service.cilium.io/weight annotation on EndpointSlices. A weight of zero drains new connections while allowing existing connections to continue. (cilium/cilium#46061, @mhofstetter)
- 🌉 More Load-Balancing Options with VXLAN: Clusters using VXLAN can use per-Service load-balancing mode annotations, including compatible DSR configurations such as IPIP dispatch. (cilium/cilium#45600, @brb)
- 🤖 Stable MCS API Support: Cilium's implementation of the Kubernetes Multi-Cluster Services API is now stable and recommended for portable service discovery through ClusterMesh. (cilium/cilium#45404, cilium/cilium#46953, @MrFreezeex)
🔒 Encryption and Network Policy
- 🚇 Improved Ztunnel Identity Management: The ztunnel path now supports either an internal certificate authority or SPIRE-issued workload identities, alongside new Prometheus metrics for enrollment and connection health. It transparently encrypts enrolled pod-to-pod connections, including traffic between pods on the same node. (cilium/cilium#43763, cilium/cilium#44275, cilium/cilium#44136, cilium/cilium#45861, @nddq; cilium/cilium#45096, @gokulMSFT)
- 🛡️ Kubernetes ClusterNetworkPolicy (KCNP): Cilium now supports the upstream, cluster-scoped policy API, including Admin and Baseline policy tiers alongside namespaced Kubernetes NetworkPolicy. (cilium/cilium#42338, @TheBeeZee; cilium/cilium#46253, @aanm)
- ⛔ Friendlier IPv6 Policy Denials: Cilium can return ICMPv6 Destination Unreachable responses when network policy denies IPv6 egress traffic, matching the IPv4 capability introduced in Cilium 1.19. (cilium/cilium#44234, @Andreagit97)
- 🌐 Select the Entire Cluster Mesh: The new cluster-mesh policy entity selects every endpoint across a mesh, making cross-cluster security policies easier to express. (cilium/cilium#46813, @squeed)
- ☁️ Standardize AWS VPC Group Policies: Policies that reference AWS VPC groups are now transformed into CiliumCIDRGroup resources, bringing external IP groups into the standard Cilium policy model. (cilium/cilium#44704, @squeed)
- 🛂 Per-Pod Source IP Verification Control: Trusted workloads that need to send traffic with non-local source addresses can disable source IP verification through a pod annotation, guarded by a namespace-level opt-in. (cilium/cilium#43505, @zbb88888)
⚙️ Day 2 Operations and Observability
- 🔧 Detect Configuration Drift: Cilium can expose how many ConfigMap settings an agent has not yet applied, making it easier to identify when a restart is required after a configuration change. (cilium/cilium#44703, @PhilipSchmid)
- ⏱️ Understand Agent Start-Up Time: New Hive lifecycle and Kubernetes resource-sync metrics show how long individual resources and components take to initialize. (cilium/cilium#44802, cilium/cilium#44639, @ILL1A)
- 🛰️ Correlate More Hubble Verdicts with Policies: Hubble can now identify the policy responsible for audit verdicts. (cilium/cilium#45373, @Rajneesh180)
- 📊 Standalone DNS Proxy Metrics: The Standalone DNS Proxy now exports DNS metrics back through Cilium, improving visibility when DNS policy processing runs outside the agent. (cilium/cilium#45222, cilium/cilium#44601, @vipul-21)
🌅 Performance and Scale
- 💾 Aggregated Load-Balancer State: Cilium's internal backend representation has been flattened to efficiently support thousands of Services that share the same backends. (cilium/cilium#44511, @joamaki)
- 📡 More Efficient Envoy Updates: New ADS and Delta xDS modes provide consistent or incremental delivery of Envoy resources, reducing CPU usage and policy update latency. (cilium/cilium#43887, @nezdolik; cilium/cilium#45288, @jrajahalme)
- 🗂️ Optimized BPF Policy Map Encoding: Semantic wildcard identities for remote-node and world reduce BPF policy-map pressure, particularly in larger clusters. (cilium/cilium#46438, @squeed)
- 📦 Smaller CNI Binary: The cilium-cni binary has been reduced from roughly 77 MB to 16 MB, shrinking both the Cilium image and its footprint on every node. (cilium/cilium#45845, @giorio94)
- 🛠️ Updated Dependencies and Foundations: Cilium 1.20 updates to Kubernetes v1.36, Envoy v1.37.x, Gateway API v1.6.1, GoBGP v4.6.1 and MCS API v0.5.2. Runtime and builder images now use Ubuntu 26.04, and the default CNI configuration version moves from 0.3.1 to 1.0.0. (cilium/cilium#45499, cilium/cilium#47215, @HadrienPatte; cilium/cilium#45851, @sayboras; cilium/cilium#47274, @arybolovlev; cilium/cilium#45952, @rastislavs; cilium/cilium#47166, @MrFreezeex; cilium/cilium#46971, @gandro)
🏠 Community
- ❤️ Production Case Studies: Many end-users have told their stories running Cilium in production. Read and watch more from: Asana, Etraveli, Michelin, OpenAI, Suse, Telefónica's acens, and Zynga. If your company wants to submit their case studies let us know. We would love to hear your feedback!
- 🇳🇱 Amsterdam Events: The community gathered at CiliumCon and Cilium Developer Summit in Amsterdam. Watch the talks from CiliumCon.
- 🇺🇸 Salt Lake City Events: Meet us at the upcoming CiliumCon and Cilium Developer Summit at KubeCon + CloudNativeCon North America in Salt Lake City, November 9-12.
- 🤖 Generative AI Policy: The Cilium community adopted a Generative AI Policy that encourages community members to connect and communicate with one another without the use of AI, while recognizing that different people work best with their own tools of choice.
- 📚 Cilium Books: Two new books landed for readers at every level — Cilium: Up and Running (O'Reilly), a practitioner's deep dive and Buzzing Beyond Clouds: The Illustrated Children's Guide to Cilium, the follow-up to the eBPF children's guide.

❤️ Thank You: Cilium 1.20 was made possible by contributors, reviewers and maintainers from across the community, including engineers from Datadog, Google, Microsoft and many other organizations.

To keep up to date with all the latest Cilium releases, join #release 🎉

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93
quay.io/cilium/cilium:stable@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.0@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92
quay.io/cilium/clustermesh-apiserver:stable@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92

hubble-relay

quay.io/cilium/hubble-relay:v1.20.0@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94
quay.io/cilium/hubble-relay:stable@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.0@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9
quay.io/cilium/operator-alibabacloud:stable@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9

operator-aws

quay.io/cilium/operator-aws:v1.20.0@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa
quay.io/cilium/operator-aws:stable@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa

operator-azure

quay.io/cilium/operator-azure:v1.20.0@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c
quay.io/cilium/operator-azure:stable@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c

operator-generic

quay.io/cilium/operator-generic:v1.20.0@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3
quay.io/cilium/operator-generic:stable@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3

operator

quay.io/cilium/operator:v1.20.0@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c
quay.io/cilium/operator:stable@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c

`v1.19.10`: 1.19.10

Compare Source

Security patch release

Summary of Changes

Bugfixes:

CiliumEnvoyConfig now only redirects Services in its own namespace, as documented; service references in CiliumClusterwideEnvoyConfig without a namespace default to "default" again. (Backport PR #49475, Upstream PR #49076, @maxskokov)

CI Changes:

.github: Clear CI images on e2e patch downgrades (Backport PR #49567, Upstream PR #49566, @aanm)
ci: Pass the auto-committer secrets to the base images workflow (Backport PR #49415, Upstream PR #49453, @aanm)
renovate: Open one trusted PR per branch (Backport PR #49415, Upstream PR #49381, @aanm)

Misc Changes:

chore(deps): update auto-merge-trusted-deps (v1.19) (#49440, @cilium-renovate[bot])
chore(deps): update auto-merge-trusted-deps (v1.19) (#49529, @cilium-renovate[bot])
chore(deps): update auto-merge-trusted-deps (v1.19) (#49564, @cilium-renovate[bot])
clarify co sign documentation to use minimum version to verify signing key (Backport PR #49475, Upstream PR #49401, @mfahlandt)
Prepare for release v1.19.10 (#49546, @cilium-release-bot[bot])
Revert "Prepare for release v1.19.10" (#49569, @aanm)

Other Changes:

Gateway API: backport listener hostname, port and protocol conflict detection (#49450, @asauber)
install: Update image digests for v1.19.9 (#49389, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.10@sha256:e86fb55fa703ada191fbd4489513daa19674952c8c3c4985dc3c77ce51ac4f27

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.10@sha256:1ddfab3ccd3dc372b190c1d48b8a0f9eba5a3436586dfb1b974a94f7dc07ab1a

docker-plugin

quay.io/cilium/docker-plugin:v1.19.10@sha256:318e6b9864a83d35b3fbfd245ba04c976d47f875b1eda4af4a59da3e8331a79a

hubble-relay

quay.io/cilium/hubble-relay:v1.19.10@sha256:93089f137c7a55c6550b547902e230827d26a2dc4cb396b65751e87e4206293a

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.10@sha256:618cfb4a601d2d70d6fa5ea0887099f9c8071d234e5567f52e3c8501a1b35114

operator-aws

quay.io/cilium/operator-aws:v1.19.10@sha256:6d6eab4c1c808dbbfcd3d7028132f775ea513fcf1ea9f5f32d9b33518efd8087

operator-azure

quay.io/cilium/operator-azure:v1.19.10@sha256:0069f45920ab88b8ea8b587879fdcbf150dd7d9843309e5d94b374bcab2020e4

operator-generic

quay.io/cilium/operator-generic:v1.19.10@sha256:b3d1c26d4bc58e307282bad9639b4d598e73f91be1430028f36bc5fdce19a85c

operator

quay.io/cilium/operator:v1.19.10@sha256:f9f4f8249c32c7a3c6b82e08ef456428095374c28f49df9a63badbaa290e7076

`v1.19.9`: 1.19.9

Compare Source

Summary of Changes

Bugfixes:

endpoint/restore: skip cleanup for reserved internal endpoints (Backport PR #49000, Upstream PR #48272, @fristonio)
Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint (Backport PR #49176, Upstream PR #48905, @fristonio)
Fix ip6tables chain rename errors being silently ignored during iptables rule reconciliation. (Backport PR #49334, Upstream PR #49024, @maxskokov)
Fix rare data race in selector cache that could lead to agent panic (Backport PR #49176, Upstream PR #47733, @odinuge)
Fix restoration of terminating backends. If a terminating backend become active again during restart the backend was incorrectly kept as quarantined. (Backport PR #48796, Upstream PR #48763, @joamaki)
gateway-api: filter CEC controls from infrastructure metadata (Backport PR #48985, Upstream PR #47732, @nezdolik)
L7 conformance CI fixes (Backport PR #49000, Upstream PR #47517, @fristonio)
operator: Do not emit warning when deleting already deleted unmanaged pod (Backport PR #48908, Upstream PR #48765, @gandro)

CI Changes:

[ci] fix escaping in conformance ginkgo (Backport PR #49176, Upstream PR #48991, @nebril)
[v1.19] .github: Remove the EKS cluster pool workflows (#49085, @aanm)
ci: Add support for OIDC (Backport PR #49316, Upstream PR #49007, @aanm)
ci: cleanup disk space in documentation workflow (Backport PR #48908, Upstream PR #48427, @tklauser)
ci: Drop the empty floating tag line from CI image digests (Backport PR #49176, Upstream PR #49070, @aanm)
ci: fix CNI setup and readiness checks in the kubespray job (Backport PR #49334, Upstream PR #48927, @aanm)
ci: Give Envoy Embedded conformance a bigger runner (Backport PR #49176, Upstream PR #49018, @aanm)
ci: login to docker registry for downgrade image wait (Backport PR #49176, Upstream PR #48983, @nebril)
ci: Name runner variables after their Ubuntu release and let Renovate bump them (Backport PR #49316, Upstream PR #49065, @aanm)
ci: Skip redundant setup when base images already exist (Backport PR #49316, Upstream PR #47209, @HadrienPatte)
ci: Stop passing secrets to the base images workflow (Backport PR #49316, Upstream PR #49082, @aanm)
gha/conformance-multi-pool: use the local fake external targets (Backport PR #48987, Upstream PR #48558, @aanm)
gha/setup-aks-cluster: Retry a create that never starts (Backport PR #49316, Upstream PR #48924, @aanm)
gha: Derive the LVH package cache key once per run (Backport PR #48987, Upstream PR #48656, @aanm)
gha: don't fail PR tests on reporting errors (Backport PR #49316, Upstream PR #48740, @aanm)
gha: Grant id-token to the post-release call of release.yaml (Backport PR #49316, Upstream PR #49323, @aanm)
gha: make external fake targets image configurable (Backport PR #49176, Upstream PR #48941, @giorio94)
gha: Retry stalled kind image pulls before the install wait expires (Backport PR #49334, Upstream PR #48989, @aanm)
gha: Skip the duplicate CI image build on push to main (Backport PR #48987, Upstream PR #48736, @aanm)
gha: survive a GKE zone running out of capacity (Backport PR #48987, Upstream PR #48184, @aanm)
gha: Tolerate cosign and SBOM failures on pull requests (Backport PR #48987, Upstream PR #48737, @aanm)
loadbalancer/tests: Fix the graceful termination test restart (Backport PR #49316, Upstream PR #48939, @aanm)

Misc Changes:

[v1.19] Bump various go modules (#48768, @ferozsalam)
build: handle git worktrees in documentation make targets (Backport PR #49176, Upstream PR #48966, @utaal)
chore(deps): update all github action dependencies (v1.19) (#48885, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#49045, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#49157, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#49279, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#48886, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#49158, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#49280, @cilium-renovate[bot])
chore(deps): update auto-merge-trusted-deps (v1.19) (#49320, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#48884, @cilium-renovate[bot])
chore(deps): update base-images to v1.26.9 (v1.19) (#49154, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.20.1 (v1.19) (#48979, @cilium-renovate[bot])
chore(deps): update dependency cilium/little-vm-helper to v0.0.31 (v1.19) (#48789, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v36.2 (v1.19) (#49044, @cilium-renovate[bot])
chore(deps): update docker.io/library/alpine docker tag to v3.23.6 (v1.19) (#49041, @cilium-renovate[bot])
chore(deps): update docker.io/library/busybox:1.37.0 docker digest to bdf57e5 (v1.19) (#49040, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.26.9 docker digest to d772206 (v1.19) - abandoned (#49299, @cilium-renovate[bot])
chore(deps): update helm/kind-action action to v1.15.1 (v1.19) (#49295, @cilium-renovate[bot])
chore(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 [security] (v1.19) (#48815, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1790882336-b64c7306085409b95fb5626db2d2bb7a200b9432 (v1.19) (#49127, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1791291190-5ec36181d464cd75b35b45395a722226cbdd2888 (v1.19) (#49195, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791350265-ae0327a34850b7d1849e8332dbefd4d5bebabe10 (v1.19) (#49217, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791537840-00e749f11f69334c625e53fc1ce2fc6c7f34a51f (v1.19) (#49278, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#48883, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#49042, @cilium-renovate[bot])
connectivity-check: move echo-b to the lower NodePort band (Backport PR #49176, Upstream PR #48926, @aanm)
fix(deps): update k8s.io patch updates stable to v0.35.9 (v1.19) (#49156, @cilium-renovate[bot])
fix(deps): update module golang.org/x/net to v0.60.0 [security] (v1.19) (#49254, @cilium-renovate[bot])
fix(deps): update module k8s.io/apimachinery to v0.35.9 (v1.19) (#49043, @cilium-renovate[bot])
fix(deps): update security updates [security] (v1.19) (#48809, @cilium-renovate[bot])

Other Changes:

[v1.19] node_neighbor_discovery: fix ID in delete query (#48871, @nobleess)
install: Update image digests for v1.19.8 (#48752, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.9@sha256:f3014d42121a04272cb4a5f4f96dbe7836c9a7919990f17e9b6838e8fd4aa33a

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.9@sha256:032d6fc085cfaccfb02813b9854e8685c5b0da63e0e03b5019f3e6381fe8669d

docker-plugin

quay.io/cilium/docker-plugin:v1.19.9@sha256:bfa40f426c154d7f558ea19d76153af043ab3cbc477b04645130b6f533311f4e

hubble-relay

quay.io/cilium/hubble-relay:v1.19.9@sha256:ec58f6bc69df817c8d78ffd9eb88aa7e10f551e2bba71b4ad03fbdb6e1bc8bd5

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.9@sha256:58a411031bf31b77e9abf2e35ab2417929375f526a71e6359c20caa8f52006d5

operator-aws

quay.io/cilium/operator-aws:v1.19.9@sha256:cd089a3ff79042257f5050d0ffc7d36dc340b028106afbcaa7a4f4614a4e80ad

operator-azure

quay.io/cilium/operator-azure:v1.19.9@sha256:32adcdc31885911d5afd6265ef0e450a399c83c130bea11ede53f951b37ab54c

operator-generic

quay.io/cilium/operator-generic:v1.19.9@sha256:a234406be11ad1bb1d41b111fba2cfe81a099b6c26b2634af95f42f295d35655

operator

quay.io/cilium/operator:v1.19.9@sha256:cf7322f7ee9a1395bbb7562d424cb440c1bd15e70b1640e4abc13d3f70255ffe

`v1.19.8`: 1.19.8

Compare Source

Summary of Changes

Bugfixes:

aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #48604, Upstream PR #48193, @41ks)
bpf: Fix agent crash when dumping map events (Backport PR #48379, Upstream PR #48273, @joestringer)
bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR #47620, Upstream PR #47343, @smagnani96)
datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR #48552, Upstream PR #46861, @fdomain)
Fix Hubble Relay remains running during termination (Backport PR #48552, Upstream PR #47942, @xandau)
Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR #48552, Upstream PR #48391, @fristonio)
Fix nodeport egress tuple reuse for closed connections (Backport PR #48413, Upstream PR #48306, @fristonio)
Fix restored ENI endpoints routing rule configuration when masquerading config changes (#48422, @fristonio)
fix(socketlb): only detach Cilium-owned cgroup programs (Backport PR #48552, Upstream PR #44066, @puwun)
Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR #48214, Upstream PR #47915, @giorio94)
Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (Backport PR #48433, Upstream PR #47635, @aanm)
hubble: fix four config knobs that never reach their sink (Backport PR #48433, Upstream PR #47637, @aanm)
operator: Emit startup logs in the configured log format (Backport PR #48018, Upstream PR #47890, @HadrienPatte)
standalone-dns-proxy: return an error when no endpoint is found (Backport PR #48018, Upstream PR #47791, @vipul-21)
Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR #48413, Upstream PR #48015, @giorio94)

CI Changes:

[v1.19] golangci-lint: Do not run the modernize linter (#48399, @aanm)
.github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR #48552, Upstream PR #48462, @joestringer)
BPF: Refactor nat tests to use scapy fixtures and add checksum coverage (Backport PR #48123, Upstream PR #47222, @tommyp1ckles)
bpf: tests: collapse more tests (Backport PR #48063, Upstream PR #46374, @julianwiedmann)
bpf: tests: collapse XDP DSR tests (Backport PR #48063, Upstream PR #46174, @julianwiedmann)
bpf: tests: condense a bunch of LB tests (Backport PR #48063, Upstream PR #46358, @julianwiedmann)
ci: replace unsupported LLVM installation action (Backport PR #48413, Upstream PR #47776, @bogdankrasko)
ci: resolve renovate PR metadata in base image workflows (Backport PR #48214, Upstream PR #47964, @mhofstetter)
ci: stop asking a PHP app for the AKS runner IP (Backport PR #48552, Upstream PR #48371, @aanm)
ci: use GitHub App client ID in v1.19 image workflow (Backport PR #48214, Upstream PR #47786, @bogdankrasko)
gha/conformance-aks: add a timeout to the cluster create step (Backport PR #48552, Upstream PR #48545, @aanm)
gha/conformance-aks: give the nodes a 64 GiB OS disk (Backport PR #48552, Upstream PR #48481, @aanm)
gha/kubespray: don't wait for CoreDNS before Cilium is installed (Backport PR #48214, Upstream PR #48048, @aanm)
gha: bound the LLVM prereq apt step with a 5m timeout (Backport PR #48214, Upstream PR #48069, @aanm)
gha: compute the ginkgo cache key once, before the matrix (Backport PR #48214, Upstream PR #48127, @aanm)
gha: move GCP auth pin past the STS token exchange retry fix (Backport PR #48413, Upstream PR #48352, @aanm)
gha: publish the external target hostnames as FQDNs (Backport PR #48552, Upstream PR #48478, @aanm)
gha: stop JUnit reports being destroyed by same-name legs (Backport PR #48433, Upstream PR #48203, @aanm)
Migrate Conformance Cluster Mesh workflow to use fake external targets (Backport PR #48655, Upstream PR #48250, @giorio94)
Revert 48442 - disable local accounts on AKS clusters (#48525, @aanm)
test(bpf): parallelize eBPF test execution (Backport PR #48214, Upstream PR #47427, @lconnery)
test/k8s: wait for the L7 visibility policy to be realized (Backport PR #48413, Upstream PR #48365, @aanm)
test: fix the never-taken retry on a partially read JSON line (Backport PR #48633, Upstream PR #48190, @aanm)
tools: complexity: de-couple StackDepth from kernel version (Backport PR #48266, Upstream PR #48236, @julianwiedmann)
workflows: disable local accounts on AKS clusters (#48442, @nbusseneau)

Misc Changes:

Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR #48633, Upstream PR #48421, @0xch4z)
bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (Backport PR #48285, Upstream PR #46232, @julianwiedmann)
chore(deps): update all external docker images dependencies to v0.13.6 (v1.19) (#48678, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#48332, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#48509, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#48681, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#48155, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#48331, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#48620, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#48151, @cilium-renovate[bot])
chore(deps): update base-images to v1.26.8 (v1.19) (#48731, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.19) (#48345, @cilium-renovate[bot])
chore(deps): update dependency go to v1.25.14 (v1.19) (#48208, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v36 (v1.19) (#48333, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.19) (#48508, @cilium-renovate[bot])
chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.19) (#48518, @cilium-renovate[bot])
chore(deps): update golangci/golangci-lint docker tag to v2.13.2 (v1.19) (#48732, @cilium-renovate[bot])
chore(deps): update google/cloud-sdk docker tag to v581 (v1.19) (#48156, @cilium-renovate[bot])
chore(deps): update helm/kind-action action to v1.15.0 (v1.19) (#48592, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.4.11 (v1.19) (#48152, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.10-1787983435-8f34575affde33ad364d1e669b953993bf1f4125 (v1.19) (#48328, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.19) (#48452, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.19) (#48679, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#48153, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#48329, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#48507, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#48680, @cilium-renovate[bot])
docs: Improve build process (Backport PR #48552, Upstream PR #47751, @joestringer)
docs: remove outdated tip about disabling hubble before enabling UI (Backport PR #48633, Upstream PR #48487, @ekoops)
docs: Remove v1.18 ipsec documentation (Backport PR #48413, Upstream PR #48224, @joestringer)
Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (Backport PR #48552, Upstream PR #48428, @marcus-chae)
Documentation: document mesh security model (Backport PR #48413, Upstream PR #47912, @bimmlerd)
Fix byte ordering of TCP fields in BPF integration tests. (Backport PR #48063, Upstream PR #44336, @ajmmm)
Fix Component Overview doc link rendering (Backport PR #48633, Upstream PR #48537, @eneiss)
fix(deps): update k8s.io patch updates stable to v0.35.8 (v1.19) (#48330, @cilium-renovate[bot])
fix(deps): update module k8s.io/apimachinery to v0.35.8 (v1.19) (#48154, @cilium-renovate[bot])
Fixed broken Slack link on Community page. (Backport PR #48413, Upstream PR #48021, @ps-mir)
Fixes: Update node-cache image version to 1.26.5 (Backport PR #48633, Upstream PR #48270, @zyue110026)
gha: authenticate release images with OIDC (Backport PR #48598, Upstream PR #48062, @aanm)
gha: authenticate stable Image CI to quay.io with OIDC (Backport PR #48059, Upstream PR #48061, @aanm)
gha: correct and move the OIDC subject comments (Backport PR #48059, Upstream PR #48370, @aanm)
gha: raise the Docker Hub OIDC token lifetime for release builds (Backport PR #48598, Upstream PR #48535, @aanm)
helm: add general busybox image values for substitution (Backport PR #48413, Upstream PR #47973, @0xch4z)
vendor: Bump StateDB to v0.5.10 (#48247, @joamaki)

Other Changes:

Fix verifier error "detect support for FnSetRetval for program type CGroupSock" during feature probing (#48376, @borkmann)
install: Update image digests for v1.19.7 (#48040, @cilium-release-bot[bot])
proxy: Bump envoy to v1.37.x (#48310, @sayboras)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.8@sha256:e9f7ee1f2f3a41e44339612e3b6b88170bdde7679c9c9461f287bb27702a8ecf

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.8@sha256:9c44205b9e6eafed719803682669f63e0a68c549025344c0af520a94b2f3e4bc

docker-plugin

quay.io/cilium/docker-plugin:v1.19.8@sha256:e876814edd154a8f4a2a8a8ac47a10614f7bb9a717d8cee9df352d060242e3a4

hubble-relay

quay.io/cilium/hubble-relay:v1.19.8@sha256:f78768be216b5c00137c7d4da440724d0b49986805d361e7458cc8fe9ff976ff

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.8@sha256:cb4a8685fc74fef8f3e97c3370faf338ba1a8b29a7d5cdc718f3926ae0093b99

operator-aws

quay.io/cilium/operator-aws:v1.19.8@sha256:de1cfe6e9962664e69e021f1cc07ea3b4f973d4ce341d7aebabf97616dd27982

operator-azure

quay.io/cilium/operator-azure:v1.19.8@sha256:b67fcc053fe8caa5ae5f12158c8dc568b3d16201cdea17bb78f3b61b7c1f02d7

operator-generic

quay.io/cilium/operator-generic:v1.19.8@sha256:786ec9bb1a9344435e3e3f994bc4ed3a4a85afa6a314e98681af241f8be79833

operator

quay.io/cilium/operator:v1.19.8@sha256:618fe8acacaa682509b19670b1228fd8184c2c4c1478e23d505ba6502e8bcf3a

`v1.19.7`: 1.19.7

Compare Source

Summary of Changes

Bugfixes:

envoy: restore http-idle-timeout as the route idle timeout source (Backport PR #47688, Upstream PR #47583, @aanm)
Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR #47723, Upstream PR #47765, @julianwiedmann)
Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR #47545, Upstream PR #47295, @aanm)
Fix abnormal ip allocation caused by hostnetwork pod (Backport PR #47688, Upstream PR #47552, @haozhangami)
Fix BPF LB map key collision where HostPort/NodePort expansion could overwrite a LoadBalancer frontend when the node IP matches the LoadBalancer external IP (e.g. k3s/RKE2 L2 ServiceLB). Also fix a ~30-minute NodePort outage that occurred after deleting a LoadBalancer whose external IP was a node address with a port in the NodePort range. (Backport PR #47414, Upstream PR #45314, @syedazeez337)
Fix bug causing Cilium to intercept traffic towards LoadBalancer VIPs when KPR is disabled, when the traffic should be delegated to kube-proxy. (Backport PR #47414, Upstream PR #47204, @ajmmm)
Fix redirection of egressing traffic that falls in scope of a CiliumEgressGatewayPolicy, when the initial interface is a L3 interface. (Backport PR #47757, Upstream PR #45703, @julianwiedmann)
Fix: Cilium Ingress now automatically reallocates ports and retries when cilium-envoy fails to bind due to port conflicts (Backport PR #47410, Upstream PR #42859, @inerplat)
Fixes an issue where invalid regex on an HTTPRoute or GRPCRoute matcher is accepted but causes Envoy to NACK (Backport PR #47468, Upstream PR #47005, @0xch4z)
fqdn/service: prune SDP identity->IP mapping on delete using newID (Backport PR #47545, Upstream PR #47100, @vipul-21)
gateway-api: GAMMA Routes are now filtered correctly before being passed to model ingestion. (Backport PR #47468, Upstream PR #45294, @youngnick)
ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR #47886, Upstream PR #47208, @iwanhae)
lbipam: prevent reassigning Service LoadBalancer IPs on operator restart when the existing IP belongs to a compatible sharing key group. (Backport PR #46559, Upstream PR #46262, @ieth0)
Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR #47886, Upstream PR #47844, @bimmlerd)
wireguard: Unsubscribe node handler on shutdown (Backport PR #47804, Upstream PR #47614, @HadrienPatte)

CI Changes:

.github: fail smoke IPv6 closed when the test job does not succeed (Backport PR #47545, Upstream PR #47441, @aanm)
.github: retry CLI and binary downloads over transient network errors (Backport PR #47290, Upstream PR #47167, @aanm)
.github: Run envoy image check against PR content (Backport PR #47886, Upstream PR #47792, @joestringer)
.github: Simplify permissions for image linter workflow (Backport PR #47804, Upstream PR #47753, @joestringer)
.github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR #47688, Upstream PR #47470, @atykhyy)
[v1.19] ariane: remove reference to the non-existing lint-ariane-config workflow (#47701, @giorio94)
ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR #47804, Upstream PR #47743, @giorio94)
bpf/tests: support pkt sizes 1036-1518 bytes (Backport PR #47443, Upstream PR #44314, @msune)
chore: use GH_RUNNER_CILIUM_BASE_AMD64/ARM64 vars for integration-test runners (Backport PR #47545, Upstream PR #47182, @bogdankrasko)
ci: build race images on push events so conformance-race works on stable branches (Backport PR #47610, Upstream PR #47608, @aanm)
ci: build race images on push in the stable image builders (Backport PR #47610, Upstream PR #47616, @aanm)
ci: draft renovate PRs until ciliumbot auto-approval (Backport PR #47804, Upstream PR #47364, @mhofstetter)
ci: fix filtering out md files in bpf checks (Backport PR #47688, Upstream PR #47605, @nebril)
ci: fix three renovate-PR CI flakes (kubectl download retry, merge-upload ref, EKS pool zones) (Backport PR #47541, Upstream PR #47357, @aanm)
CI: fixed external-target readiness gating and ensured sig-network E2E JUnit reports are uploaded on failure. (Backport PR #47290, Upstream PR #46860, @aanm)
ci: migrate set-commit-status to cilium/actions (Backport PR #47804, Upstream PR #47771, @bogdankrasko)
ci: skip etcd log fetch when kvstore was never started (Backport PR #47886, Upstream PR #47801, @aanm)
Collect /proc/net/softnet_stat, /proc/net/snmp and /proc/net/netstat in sysdumps to help diagnose host-level packet drops. (Backport PR #47290, Upstream PR #46985, @aanm)
complexity-diff: Compute percentages of diffs against original values (Backport PR #47836, Upstream PR #45657, @pchaigno)
complexity-diff: Display results on scheduled runs (Backport PR #47721, Upstream PR #45595, @pchaigno)
conformance-aws-cni: skip l7 and fqdn tests by name on chaining mode (Backport PR #47290, Upstream PR #47269, @aanm)
datapath/loader: Fix stack depth parsing for programs with functions (Backport PR #47814, Upstream PR #44963, @dylandreimerink)
Decrease CI costs on AWS (Backport PR #47290, Upstream PR #46615, @aanm)
Fix stack depth reporting in verifier test (Backport PR #47836, Upstream PR #46182, @pchaigno)
gateway-api: fix gatewayclassconfig-nodeport test (Backport PR #47468, Upstream PR #47255, @0xch4z)
gha/e2e: cover etcd behind a service (Backport PR #47410, Upstream PR #47235, @giorio94)
gha/kubespray: run on schedule, rather than on every push (Backport PR #47734, Upstream PR #47719, @giorio94)
gha/lvh-kind: respect Kind image version also when config is provided (Backport PR #47734, Upstream PR #47703, @giorio94)
gha: don't install LLVM and Clang in integration tests workflow (Backport PR #47734, Upstream PR #47717, @giorio94)
gha: dump nodegroup CloudFormation failure events on create failure (Backport PR #47410, Upstream PR #47298, @aanm)
gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR #47734, Upstream PR #47724, @giorio94)
gha: stop scheduled runs emitting spurious artifact warnings (Backport PR #47290, Upstream PR #46989, @aanm)
images/scripts: Validate Envoy image vars against sed injection (Backport PR #47804, Upstream PR #47205, @MasloMaslane)
Increase the timeout for the kvstore readiness wait in kind-based CI to avoid flakes on slow etcd image pulls. (Backport PR #47290, Upstream PR #46882, @aanm)
loader: Reduce number of permutations for load-time configs (Backport PR #47721, Upstream PR #44409, @pchaigno)
loader: Support max stack depth in verifier logs (Backport PR #47836, Upstream PR #46109, @pchaigno)
loader: Support newer verifier logs (Backport PR #47836, Upstream PR #45880, @pchaigno)
pkg/loadbalancer: fix loadbalancer nodeport collision test (Backport PR #47414, Upstream PR #46087, @ajmmm)
pkg/rate: fix TestMaxParallelRequests flake under CI load (Backport PR #47290, Upstream PR #46856, @aanm)
Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR #47886, Upstream PR #47780, @giorio94)
test/cyclonus: capture logs of every job pod so a runner crash is diagnosable (Backport PR #47290, Upstream PR #46980, @aanm)
test/cyclonus: drop --fail-fast so a policy failure can't crash the run (Backport PR #47410, Upstream PR #47272, @aanm)
test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR #47804, Upstream PR #47725, @aanm)
workflows/verifier: Fail on high complexity, stack depth or map count (Backport PR #47721, Upstream PR #45659, @pchaigno)
workflows/verifier: Fix again always-passing workflow status (Backport PR #47721, Upstream PR #45899, @pchaigno)
workflows/verifier: Fix always-passing workflow status (Backport PR #47721, Upstream PR #45835, @pchaigno)
workflows/verifier: Fix commit status (Backport PR #47721, Upstream PR #46382, @pchaigno)
workflows/verifier: Wait for complexity-diff to set workflow status (Backport PR #47721, Upstream PR #45681, @pchaigno)

Misc Changes:

allocator: fix flake in TestWatchRemoteKVStore (Backport PR #47688, Upstream PR #47455, @giorio94)
bpf, testing: define scapy buffers as canonical C variables. (Backport PR #47443, Upstream PR #44893, @ldelossa)
bpf/analyze: Always visit global functions (Backport PR #47804, Upstream PR #45917, @pchaigno)
bpf/lxc: Never allocate ct_buffers on stack (Backport PR #47723, Upstream PR #45603, @pchaigno)
bpf/nat: Move IPv6 nat entry to map (Backport PR #47723, Upstream PR #47762, @pchaigno)
bpf: conntrack: Reduce stack usage of ct_create{4,6} (Backport PR #47723, Upstream PR #47582, @dylandreimerink)
bpf: encap: move & use DSR-GENEVE helpers (Backport PR #47460, Upstream PR #45526, @julianwiedmann)
bpf: Make ipv6_hdrlen_with_fraginfo function global (Backport PR #47723, Upstream PR #46295, @pchaigno)
bpf: Never allocate ct_buffers on the stack (Backport PR #47723, Upstream PR #45589, @pchaigno)
bpf: Reduce stack size for tail_handle_snat_fwd_ipv6 (Backport PR #47723, Upstream PR #46360, @pchaigno)
bpf: rename aux.h to avoid malformed file path error upon go get (Backport PR #47723, Upstream PR #45804, @tklauser)
bugtool: collect snmp6 and dev_snmp6 for IPv6 host packet drops (Backport PR #47410, Upstream PR #47353, @aanm)
chore(deps): update all github action dependencies (v1.19) (#47324, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#47490, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#47867, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#47993, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#48009, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#47679, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#47489, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#47950, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.6 (v1.19) (#47340, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.19) (#47577, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.12 docker digest to d2e20dc (v1.19) (#47321, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.12 docker digest to fe5d57d (v1.19) (#47866, @cilium-renovate[bot])
chore(deps): update gcr.io/distroless/static:nonroot docker digest to f7f8f72 (v1.19) (#47322, @cilium-renovate[bot])
chore(deps): update github/codeql-action action to v4.37.2 (v1.19) (#47504, @cilium-renovate[bot])
chore(deps): update google/cloud-sdk docker tag to v577 (v1.19) (#47511, @cilium-renovate[bot])
chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260716143926-092fe0c72997 (v1.19) (#47487, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.4.8 (v1.19) (#47323, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1784803288-cf56df1cccc09d7afde2847ff9e6e853dde50b77 (v1.19) (#47488, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1786864149-07e8503ff34b9190d7bbe4e57d4e185c4ef8b1de (v1.19) (#48000, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#46316, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#47868, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#47992, @cilium-renovate[bot])
docs/clustermesh: remove obsolete reference to service cache (Backport PR #47410, Upstream PR #47195, @giorio94)
docs: add context on recommended CEC and CCEC permissions (Backport PR #47545, Upstream PR #45056, @ferozsalam)
docs: Fix DOCS_BUILDER_REPO env variable for BSD sed compatibility (Backport PR #47829, Upstream PR #46033, @arybolovlev)
docs: Update docs-builder for Makefile usage (Backport PR #47829, Upstream PR #45774, @joestringer)
fix(deps): update k8s.io patch updates stable to v0.35.7 (v1.19) (#47521, @cilium-renovate[bot])
fix(deps): update module k8s.io/apimachinery to v0.35.7 (v1.19) (#47474, @cilium-renovate[bot])
Fixed the conformance-ginkgo feature status report not being uploaded as an artifact. (Backport PR #47541, Upstream PR #47174, @aanm)
gateway-api: remove SetAllParentCondition route helpers (Backport PR #47468, Upstream PR #47086, @0xch4z)
gha: capture per-pod diagnostics for sig-network conntrack UDP NodePort failures (Backport PR #47290, Upstream PR #47140, @aanm)
gha: let auto-approve match on re-runs (Backport PR #47290, Upstream PR #46832, @aanm)
images ci: free preinstalled toolchains on tight runners before building (Backport PR #47290, Upstream PR #47141, @aanm)
Introduce BPF auxiliary variables (Backport PR #47723, Upstream PR #45081, @dylandreimerink)
policy/k8s: record processing start time for k8s NetworkPolicy updates (Backport PR #47290, Upstream PR #46979, @aanm)
Update all github action dependencies (v1.19) (#47661, @cilium-renovate[bot])
Update all github action dependencies (v1.19) (#47676, @cilium-renovate[bot])
Update docker.io/library/busybox:1.37.0 Docker digest to 9db7b59 (v1.19) (#47660, @cilium-renovate[bot])
Update documentation dependencies (Backport PR #47829, Upstream PR #47750, @joestringer)
Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.19) (#47662, @cilium-renovate[bot])
Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.19) (#47663, @cilium-renovate[bot])

Other Changes:

[v1.19] Add DNS request checking prior to qname extraction (#47383, @ferozsalam)
install: Update image digests for v1.19.6 (#47252, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.7@sha256:1b58bcb81c723cf130a0dd2fb2e1132c57f8fbc2ef7bdb85519cfcc36111c77e

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.7@sha256:17186e4639900fcaa7c38260bb8ac622ee56b3b805e2452f24b824e84db9e5e6

docker-plugin

quay.io/cilium/docker-plugin:v1.19.7@sha256:1b29323ca48d785946a16c312c983d41bb058e6ebd1e3172f45b25051c1254e7

hubble-relay

quay.io/cilium/hubble-relay:v1.19.7@sha256:db4b384d0f6aba261e809d58bee54885c70a7e958173a125ebb215391af55e74

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.7@sha256:22f36b3bf2ec9ae0bdd2ca943f7a18b8a36704dce6959d2ac0eef6527ec3b400

operator-aws

quay.io/cilium/operator-aws:v1.19.7@sha256:7218d710e1b3dbc2039cb3bcf285d3cdd7a89ca482f8be0c868362d14824dd3e

operator-azure

quay.io/cilium/operator-azure:v1.19.7@sha256:572f7f69b470fda8ce068a5acb0961b29b8754bb35f95f27f7f2d838b08c3971

operator-generic

quay.io/cilium/operator-generic:v1.19.7@sha256:61e773bfc25a448f1ad3ead605af94b3ef176ba2925cf4bd1b11e09794b72bed

operator

quay.io/cilium/operator:v1.19.7@sha256:283dddce1845b4375e4a733494ae742acd85fef4d4b1b303338b21898a6e386e

`v1.19.6`: 1.19.6

Compare Source

Summary of Changes

Minor Changes:

datapath/l2responder: use l3 sockets for solicited node multicast signaling (Backport PR #46845, Upstream PR #46332, @bersoare)
gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR #46933, Upstream PR #46403, @arybolovlev)

Bugfixes:

[v1.19] Fix policy service label selector handling (#46946, @fristonio)
bpf: fix ipv6 neighbor solicitation handling in host firewall (Backport PR #46669, Upstream PR #46325, @atykhyy)
doublewrite: Don't run CRD backend with real handler when reading from KVStore (Backport PR #47181, Upstream PR #47144, @HadrienPatte)
endpoint: Fix race when reading endpoint properties (Backport PR #47181, Upstream PR #46991, @gandro)
Fix cilium_operator_unmanaged_pods gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (Backport PR #46975, Upstream PR #46668, @Suyash1700)
Fix a bug which could lead to stale hostport entries if a pod was deleted and immediately recreated in host network. (Backport PR #46793, Upstream PR #46747, @giorio94)
Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (Backport PR #46974, Upstream PR #46927, @aanm)
Fix allowedRoute namespace and kind restrictions on multi-listener Gateways. (Backport PR #46826, Upstream PR #45693, @eufriction)
Fix bug that left the host firewall enabled in the live ConfigMap when disabling hostFirewall.enabled (toggling it from true to false) via Helm. (Backport PR #46669, Upstream PR #44748, @shibaPuppy)
Fix ClusterMesh service affinity annotation service.cilium.io/affinity: "none" incorrectly dropping all remote backends, causing traffic blackhole when no local endpoints exist. (Backport PR #46691, Upstream PR #46635, @mkamadeus)
Fix ctmap gc duration metric recording (Backport PR #46975, Upstream PR #46873, @fristonio)
Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR #47002, Upstream PR #46821, @fristonio)
Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR #47181, Upstream PR #46967, @ysksuzuki)
Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service (Backport PR #47181, Upstream PR #46444, @giorio94)
Fix the UDP tunnel check in the BIG TCP probe. (Backport PR #46793, Upstream PR #46710, @gentoo-root)
Fixes a bug where Hubble policy correlation does not work for port ranges. (Backport PR #46793, Upstream PR #46643, @squeed)
gateway-api: Add Gateway check for when hostNetwork is enabled (Backport PR #46837, Upstream PR #46350, @xtineskim)
gateway-api: Each HTTPS and TLS passthrough port now receives its own Envoy listener and RouteConfiguration. (Backport PR #46826, Upstream PR #44889, @eufriction)
ipam/multi-pool: Do now wait for zero prealloc request (Backport PR #47181, Upstream PR #46867, @pippolo84)
operator: Fix nil-pointer panic in CiliumNode GC (Backport PR #47181, Upstream PR #47127, @HadrienPatte)

CI Changes:

.github: Generate CI binaries with correct module version (Backport PR #47099, Upstream PR #46742, @joestringer)
chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR #46920, Upstream PR #46840, @sekhar-isovalent)
ci: Auth to image registry in clustermesh upgrade workflow (Backport PR #46691, Upstream PR #46632, @nebril)
ci: Remove merge_group from tests-smoke-conformance.yaml (Backport PR #46888, Upstream PR #46451, @nebril)
Fix workflow change detection for single-commit PRs to main (Backport PR #46793, Upstream PR #46684, @Demiserular)
Further GC ratchet test fix races (Backport PR #47224, Upstream PR #43075, @tommyp1ckles)

Misc Changes:

(minor) docs: update reference to aws-cli image (Backport PR #46975, Upstream PR #46923, @squeed)
.github: allow fork PR checkout with actions/checkout v7 (Backport PR #47135, Upstream PR #47133, @aanm)
[v1.19] - .github/workflows: unpin cilium/cilium self-references to track main (#46613, @aanm)
[v1.19] - Reapply ".github/workflows: do not use deployments for environments" (#46574, @aanm)
[v1.19] vendor: bump github.com/cilium/statedb to v0.5.9 (#47083, @giorio94)
bgp: fix status condition reporting: update reasons to accurately reflect current condition state (Backport PR #46920, Upstream PR #46383, @martonra)
bpf: Condition ICMP SNAT on BPF masquerading and inter-cluster SNAT (Backport PR #47181, Upstream PR #47021, @pchaigno)
chore(deps): update all github action dependencies (v1.19) (#46658, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46908, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#47109, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#46906, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#47045, @cilium-renovate[bot])
chore(deps): update aws-actions/configure-aws-credentials action to v6.2.2 (v1.19) (#47124, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#46774, @cilium-renovate[bot])
chore(deps): update base-images to v1.25.12 (v1.19) (#46982, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.5 (v1.19) (#46726, @cilium-renovate[bot])
chore(deps): update docker.io/library/alpine docker tag to v3.23.5 (v1.19) (#46773, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.11 docker digest to 00feed3 (v1.19) (#46657, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.4.6 (v1.19) (#47039, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc (v1.19) (#46700, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/image-tester docker tag to v1783861476 (v1.19) (#47122, @cilium-renovate[bot])
chore: BYOCNI loopback for cilium (Backport PR #46691, Upstream PR #46646, @sekhar-isovalent)
chore: optimize building gops and cni/loopback (Backport PR #46845, Upstream PR #46781, @sekhar-isovalent)
ci: always set fail-fast to false on image builds (Backport PR #47181, Upstream PR #47064, @aanm)
ci: remove non-ariane workflows from config (Backport PR #46845, Upstream PR #46787, @nebril)
clustermesh: add reusable backend selector constructor (Backport PR #46691, Upstream PR #45648, @viktor-kurchenko)
docs: clarify Hubble static/dynamic exporter file rotation settings (Backport PR #47181, Upstream PR #47026, @maksymbilokur-cisco)
docs: fix note about ipv4-native-routing-cidr default value (Backport PR #46793, Upstream PR #46603, @rptaylor)
Egress Gateway: handle nil events (Backport PR #47181, Upstream PR #46476, @tommyp1ckles)
endpoint: reap restart-preserved policy map entries once ready (Backport PR #47063, Upstream PR #47062, @aanm)
endpoint: sync desired policy before reload on the restore path (restore-path hardening) (Backport PR #47076, Upstream PR #47075, @aanm)
Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR #46793, Upstream PR #46388, @tommyp1ckles)
Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR #46845, Upstream PR #46388, @tommyp1ckles)
fix(deps): update k8s.io/utils digest to be93311 (v1.19) (#46907, @cilium-renovate[bot])
fix(deps): update k8s.io/utils digest to cf1189d (v1.19) (#47115, @cilium-renovate[bot])
Fixed Gateway API reconciler incorrectly reporting "Accepted HTTPRoute" in the status condition message for GRPCRoute and TLSRoute resources. (Backport PR #46826, Upstream PR #44962, @eufriction)
gateway-api: return model from Gateway API ingestion (Backport PR #46933, Upstream PR #46450, @arybolovlev)
gha: fail fast in external-target provisioning scripts instead of swallowing failures (Backport PR #47181, Upstream PR #47085, @aanm)
Improve cilium-dbg status output of module health (Backport PR #46845, Upstream PR #46739, @joestringer)
loadbalancer: proxy ports are now resolved per frontend instead of per service, preventing one port from losing its L7 redirect when multiple listeners share a service. (Backport PR #46826, Upstream PR #45949, @eufriction)
loadbalancer: validate DSR dispatch configuration globally (Backport PR #46793, Upstream PR #45545, @FelipeYepez)
Makefile: Generate full Cilium version in worktree (Backport PR #46793, Upstream PR #46737, @joestringer)
Revert restore-path policy map changes (#46927, #47062, #47075) (Backport PR #47213, Upstream PR #47202, @aanm)
Upgraded cilium/ebpf to version v0.22.0 (Backport PR #46845, Upstream PR #46783, @dylandreimerink)

Other Changes:

install: Update image digests for v1.19.5 (#46593, @cilium-release-bot[bot])
v1.19: gateway-api: fix sds secrets in golden tests (#47229, @0xch4z)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.6@sha256:accab5fe6ab7134fcd6f916acc9e4c785382a022128ae5495ec4a45fbe18c9a6

docker-plugin

quay.io/cilium/docker-plugin:v1.19.6@sha256:81a8d37e541edfff4016037373853e8e875f1ea0433c58b9ab54b314c305b9ec

hubble-relay

quay.io/cilium/hubble-relay:v1.19.6@sha256:6782a49e3f28eba015701c4410a5ec7fa096fe9a562f879b4372dbecd827ea44

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.6@sha256:031e332cdec61a9ebaca42f044e7e2f5b876ba96ac0ccf1d42acd5954779efaf

operator-aws

quay.io/cilium/operator-aws:v1.19.6@sha256:546d13ac511cf82441b5e9e99e03d0e054b788513ceb1a883e620b8284d5ccc3

operator-azure

quay.io/cilium/operator-azure:v1.19.6@sha256:e555430b7f5e4c407daab1afbec3c431ec016a53f1f1b848f67b9242cd3adedd

operator-generic

quay.io/cilium/operator-generic:v1.19.6@sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665

operator

quay.io/cilium/operator:v1.19.6@sha256:37e36840be5a0882a9a065b2308859785e960a742aed0aeac794e0ac4aabdf90

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | minor | `1.19.5` → `1.20.4` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.20.4`](https://github.com/cilium/cilium/releases/tag/v1.20.4): 1.20.4 [Compare Source](https://github.com/cilium/cilium/compare/1.20.3...1.20.4) ## Security patch release Out-of-band security patch release to fix CVE-2026-111943 ([golang/go#82345](https://github.com/golang/go/issues/82345)): upgrades Go to 1.26.10 so that the compromised eMudhra intermediate CA certificates are no longer trusted, and updates all dependencies to their latest patch versions. ## Summary of Changes **Minor Changes:** - alibabacloud: support RRSA (RAM Roles for Service Accounts) credentials in the IPAM allocator, alongside static AccessKeys and ECS instance RAM roles (Backport PR [#49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#49093](https://github.com/cilium/cilium/issues/49093), [@4n4nd](https://github.com/4n4nd)) **Bugfixes:** - Allow wildcard CIDR selectors to match nodes when --policy-cidr-match-mode=nodes is configured (Backport PR [#49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#47828](https://github.com/cilium/cilium/issues/47828), [@TheBeeZee](https://github.com/TheBeeZee)) - bpf: nat: fix outer ICMP checksum for ICMP/SCTP NAT error packets (Backport PR [#49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#48819](https://github.com/cilium/cilium/issues/48819), [@fds7280](https://github.com/fds7280)) - CiliumEnvoyConfig now only redirects Services in its own namespace, as documented; service references in CiliumClusterwideEnvoyConfig without a namespace default to "default" again. (Backport PR [#49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#49076](https://github.com/cilium/cilium/issues/49076), [@maxskokov](https://github.com/maxskokov)) - datapath: Fix NAT46x64 gateway prefix conversion panic (Backport PR [#49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#49177](https://github.com/cilium/cilium/issues/49177), [@HadrienPatte](https://github.com/HadrienPatte)) - Fix an issue where terminating backends were evicted from BPF maps when trafficDistribution was enabled. (Backport PR [#49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#48349](https://github.com/cilium/cilium/issues/48349), [@taesung320](https://github.com/taesung320)) - Fix invalid L4 checksum on IPv6 ClusterIP reverse NAT for CHECKSUM\_PARTIAL packets on kernels < 6.12, affecting the case when packets are bridged/tunneled from the client pod to a remote host (Backport PR [#49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#49204](https://github.com/cilium/cilium/issues/49204), [@liuyuan10](https://github.com/liuyuan10)) - Fix regression in Cilium 1.20.3 where the Gateway API implementation would incorrectly handle BackendTLSPolicy configurations, leading to high Cilium CPU usage and inability to forward traffic. (Backport PR [#49568](https://github.com/cilium/cilium/issues/49568), Upstream PR [#49525](https://github.com/cilium/cilium/issues/49525), [@youngnick](https://github.com/youngnick)) - Fixes an issue in LBIPAM where on service upsert, if IP allocations are not changed the sharing index is not updated. (Backport PR [#49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#48938](https://github.com/cilium/cilium/issues/48938), [@0xch4z](https://github.com/0xch4z)) - nodediscovery: in IPAM ENI and Azure modes the operator now treats nodes as running in multi-pool mode from the very first event. (Backport PR [#49390](https://github.com/cilium/cilium/issues/49390), Upstream PR [#49242](https://github.com/cilium/cilium/issues/49242), [@41ks](https://github.com/41ks)) - Reduce transient DNS SERVFAIL/REFUSED for pods that query immediately at startup by pushing/applying Standalone DNS Proxy policy snapshots more frequently (Backport PR [#49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#49112](https://github.com/cilium/cilium/issues/49112), [@QxBytes](https://github.com/QxBytes)) - Remove the unused pebble binary from the cilium image to clear its Go standard library vulnerability findings. (Backport PR [#49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#49380](https://github.com/cilium/cilium/issues/49380), [@aanm](https://github.com/aanm)) **CI Changes:** - \[v1.20] ci: ignore transient xDS mode drift during downgrade ([#49515](https://github.com/cilium/cilium/issues/49515), [@jrajahalme](https://github.com/jrajahalme)) - ci: Pass the auto-committer secrets to the base images workflow (Backport PR [#49467](https://github.com/cilium/cilium/issues/49467), Upstream PR [#49453](https://github.com/cilium/cilium/issues/49453), [@aanm](https://github.com/aanm)) - renovate: Open one trusted PR per branch (Backport PR [#49416](https://github.com/cilium/cilium/issues/49416), Upstream PR [#49381](https://github.com/cilium/cilium/issues/49381), [@aanm](https://github.com/aanm)) **Misc Changes:** - chore(deps): update auto-merge-trusted-deps (v1.20) ([#49319](https://github.com/cilium/cilium/issues/49319), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update auto-merge-trusted-deps (v1.20) ([#49445](https://github.com/cilium/cilium/issues/49445), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency sphinxcontrib-openapi to v0.10.0 (v1.20) ([#49438](https://github.com/cilium/cilium/issues/49438), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - clarify co sign documentation to use minimum version to verify signing key (Backport PR [#49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#49401](https://github.com/cilium/cilium/issues/49401), [@mfahlandt](https://github.com/mfahlandt)) - Fix Envoy xDS listener handling across restoration, address changes, and rejected updates (Backport PR [#49383](https://github.com/cilium/cilium/issues/49383), Upstream PR [#48897](https://github.com/cilium/cilium/issues/48897), [@jrajahalme](https://github.com/jrajahalme)) **Other Changes:** - install: Update image digests for v1.20.3 ([#49392](https://github.com/cilium/cilium/issues/49392), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) - route-reconciler: add prune exclusion logic and use it in the linuxNodeHandler ([#49170](https://github.com/cilium/cilium/issues/49170), [@andreaterzolo](https://github.com/andreaterzolo)) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.4@sha256:20fe92e4c86641233a450098c158d2d29085f3419931ab6bf681d2485dedf16e` `quay.io/cilium/cilium:stable@sha256:20fe92e4c86641233a450098c158d2d29085f3419931ab6bf681d2485dedf16e` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.4@sha256:aeac78ae77d166b86630310f2eb53fbc92014eda36ada8e6b2d7f2b8f2dadbfa` `quay.io/cilium/clustermesh-apiserver:stable@sha256:aeac78ae77d166b86630310f2eb53fbc92014eda36ada8e6b2d7f2b8f2dadbfa` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.4@sha256:cb23408209697ed30d2bc462e1f01eb622ea4423a891458f78bc88d7255bbfc1` `quay.io/cilium/hubble-relay:stable@sha256:cb23408209697ed30d2bc462e1f01eb622ea4423a891458f78bc88d7255bbfc1` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.4@sha256:163a08ee4438780638899742e95521e1a37edeb676c6e5c924d320c4c0bd09ad` `quay.io/cilium/operator-alibabacloud:stable@sha256:163a08ee4438780638899742e95521e1a37edeb676c6e5c924d320c4c0bd09ad` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.4@sha256:caab27c6e3286a596d502f76aa6cffe2efab6e8a92234a0d10d2eed3eda85c7c` `quay.io/cilium/operator-aws:stable@sha256:caab27c6e3286a596d502f76aa6cffe2efab6e8a92234a0d10d2eed3eda85c7c` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.4@sha256:0669c35e9f1638bbdd6cf5c64163e7ee4ea4ef440e223050e60665811369b4ec` `quay.io/cilium/operator-azure:stable@sha256:0669c35e9f1638bbdd6cf5c64163e7ee4ea4ef440e223050e60665811369b4ec` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.4@sha256:7a7a3489dc66ad67e420d285c8a8d2e169b0957ad15e120f593d27081bf38d82` `quay.io/cilium/operator-generic:stable@sha256:7a7a3489dc66ad67e420d285c8a8d2e169b0957ad15e120f593d27081bf38d82` ##### operator `quay.io/cilium/operator:v1.20.4@sha256:f94e9812f191e0c31b5cfe6cb1f38f5c349d4f159f2030e621d179d826257263` `quay.io/cilium/operator:stable@sha256:f94e9812f191e0c31b5cfe6cb1f38f5c349d4f159f2030e621d179d826257263` ### [`v1.20.3`](https://github.com/cilium/cilium/releases/tag/v1.20.3): 1.20.3 [Compare Source](https://github.com/cilium/cilium/compare/1.20.2...1.20.3) ## Summary of Changes **Minor Changes:** - alibabacloud: support IMDSv2 (token-based) instance metadata access (Backport PR [#49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#49182](https://github.com/cilium/cilium/issues/49182), [@4n4nd](https://github.com/4n4nd)) - Fix conntrack garbage collection deleting CT entries that the datapath reopened between the GC batch read and the delete, which could cascade into NAT mapping deletion and SNAT source-port reallocation for live connections. (Backport PR [#49119](https://github.com/cilium/cilium/issues/49119), Upstream PR [#46750](https://github.com/cilium/cilium/issues/46750), [@gyutaeb](https://github.com/gyutaeb)) - operator: prevent CNPs with nodeSelector from silently enforcing nothing (Backport PR [#49173](https://github.com/cilium/cilium/issues/49173), Upstream PR [#47882](https://github.com/cilium/cilium/issues/47882), [@weizhoublue](https://github.com/weizhoublue)) **Bugfixes:** - azure: Fixed an issue where an interface with an empty MAC field would be reported back the the cilium agent causing it to crash on startup when trying to configure the routes. (Backport PR [#49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#48648](https://github.com/cilium/cilium/issues/48648), [@41ks](https://github.com/41ks)) - bpf: icmp: use 576 byte of inner packet to avoid partial csum floor (Backport PR [#48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#48578](https://github.com/cilium/cilium/issues/48578), [@tommyp1ckles](https://github.com/tommyp1ckles)) - cilium-dbg: Print port numbers correctly for map cilium\_lb\*\_reverse\_sk (Backport PR [#49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#47134](https://github.com/cilium/cilium/issues/47134), [@jayl1e](https://github.com/jayl1e)) - daemon: fix a bug where L7 DNS policies could remain loaded in the datapath during agent shutdown, causing pods under a wildcard toFQDNs policy to lose DNS resolution for the duration of the restart. (Backport PR [#48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#48747](https://github.com/cilium/cilium/issues/48747), [@41ks](https://github.com/41ks)) - endpoint/restore: skip cleanup for reserved internal endpoints (Backport PR [#48999](https://github.com/cilium/cilium/issues/48999), Upstream PR [#48272](https://github.com/cilium/cilium/issues/48272), [@fristonio](https://github.com/fristonio)) - envoy: handle listener additional address changes (Backport PR [#48917](https://github.com/cilium/cilium/issues/48917), Upstream PR [#48712](https://github.com/cilium/cilium/issues/48712), [@nezdolik](https://github.com/nezdolik)) - envoy: handle listener address changes in ADS (Backport PR [#48917](https://github.com/cilium/cilium/issues/48917), Upstream PR [#48798](https://github.com/cilium/cilium/issues/48798), [@nezdolik](https://github.com/nezdolik)) - envoy: track coalesced ADS snapshot updates (Backport PR [#48917](https://github.com/cilium/cilium/issues/48917), Upstream PR [#48631](https://github.com/cilium/cilium/issues/48631), [@nezdolik](https://github.com/nezdolik)) - Fix Gateway API ExternalAuth dropping request bodies when allowedResponseHeaders is unset (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#48770](https://github.com/cilium/cilium/issues/48770), [@kirgene](https://github.com/kirgene)) - Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#48905](https://github.com/cilium/cilium/issues/48905), [@fristonio](https://github.com/fristonio)) - Fix ip6tables chain rename errors being silently ignored during iptables rule reconciliation. (Backport PR [#49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#49024](https://github.com/cilium/cilium/issues/49024), [@maxskokov](https://github.com/maxskokov)) - Fix panic in agent when CiliumLocalRedirectPolicy `redirectBackend.toPorts` is declared as an empty array. The agent will now reject such a policy. (Backport PR [#48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#48491](https://github.com/cilium/cilium/issues/48491), [@ajmmm](https://github.com/ajmmm)) - Fix PMTU/ICMP replies for IPIP/Geneve DSR for GRO skbs (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#48489](https://github.com/cilium/cilium/issues/48489), [@borkmann](https://github.com/borkmann)) - Fix rare data race in selector cache that could lead to agent panic (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#47733](https://github.com/cilium/cilium/issues/47733), [@odinuge](https://github.com/odinuge)) - Fix restoration of terminating backends. If a terminating backend become active again during restart the backend was incorrectly kept as quarantined. (Backport PR [#48797](https://github.com/cilium/cilium/issues/48797), Upstream PR [#48763](https://github.com/cilium/cilium/issues/48763), [@joamaki](https://github.com/joamaki)) - Fixes a bug where Hubble flows may list the incorrect policy that allowed or denied a flow (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#49086](https://github.com/cilium/cilium/issues/49086), [@tsotne95](https://github.com/tsotne95)) - Fixes a bug where the helm value `hubble.tls.auto.privateKey` settings are no longer ignored in Hubble cert-manager certificates (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#49114](https://github.com/cilium/cilium/issues/49114), [@byxorna](https://github.com/byxorna)) - Fixes an issue where CiliumCIDRGroups with zero-length cidrs (i.e. 0.0.0.0/0) inadvertently selected no traffic. (Backport PR [#49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#48366](https://github.com/cilium/cilium/issues/48366), [@squeed](https://github.com/squeed)) - gateway-api: filter CEC controls from infrastructure metadata (Backport PR [#48984](https://github.com/cilium/cilium/issues/48984), Upstream PR [#47732](https://github.com/cilium/cilium/issues/47732), [@nezdolik](https://github.com/nezdolik)) - gateway-api: make HTTP route ordering deterministic (Backport PR [#49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#48951](https://github.com/cilium/cilium/issues/48951), [@abduu11aahh](https://github.com/abduu11aahh)) - gateway-api: Support system CA certificates in BackendTLSPolicy. (Backport PR [#49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#48895](https://github.com/cilium/cilium/issues/48895), [@shreyasrajiv327](https://github.com/shreyasrajiv327)) - infraendpoints: Release the health IPv4 when the IPv6 allocation fails (Backport PR [#48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#48816](https://github.com/cilium/cilium/issues/48816), [@HadrienPatte](https://github.com/HadrienPatte)) - k8s/resource: fix leaked event finalizer on unobserved delete (Backport PR [#48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#48785](https://github.com/cilium/cilium/issues/48785), [@tklauser](https://github.com/tklauser)) - L7 conformance CI fixes (Backport PR [#48999](https://github.com/cilium/cilium/issues/48999), Upstream PR [#47517](https://github.com/cilium/cilium/issues/47517), [@fristonio](https://github.com/fristonio)) - operator: Do not emit warning when deleting already deleted unmanaged pod (Backport PR [#48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#48765](https://github.com/cilium/cilium/issues/48765), [@gandro](https://github.com/gandro)) - operator: fix `metrics list` default address to work on IPv6-only clusters with dual stack nodes by trying both IPv4 and IPv6 loopback addresses (Backport PR [#48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#48780](https://github.com/cilium/cilium/issues/48780), [@41ks](https://github.com/41ks)) - Set ipv6 routing rules when dual stack is enabled (Backport PR [#49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#49188](https://github.com/cilium/cilium/issues/49188), [@fcrespofastly](https://github.com/fcrespofastly)) - Sockets are no longer destroyed when a Service backend is terminated unless they are still connected to that backend. Unconnected UDP sockets, and sockets that have since disconnected or moved to another backend, used to have their local port silently changed. (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#48725](https://github.com/cilium/cilium/issues/48725), [@maxskokov](https://github.com/maxskokov)) **CI Changes:** - \[ci] fix escaping in conformance ginkgo (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#48991](https://github.com/cilium/cilium/issues/48991), [@nebril](https://github.com/nebril)) - \[v1.20] .github: Remove the EKS cluster pool workflows ([#49084](https://github.com/cilium/cilium/issues/49084), [@aanm](https://github.com/aanm)) - ci: Add support for OIDC (Backport PR [#49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#49007](https://github.com/cilium/cilium/issues/49007), [@aanm](https://github.com/aanm)) - ci: cleanup disk space in documentation workflow (Backport PR [#48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#48427](https://github.com/cilium/cilium/issues/48427), [@tklauser](https://github.com/tklauser)) - ci: Drop the empty floating tag line from CI image digests (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#49070](https://github.com/cilium/cilium/issues/49070), [@aanm](https://github.com/aanm)) - ci: fix CNI setup and readiness checks in the kubespray job (Backport PR [#49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#48927](https://github.com/cilium/cilium/issues/48927), [@aanm](https://github.com/aanm)) - ci: Give Envoy Embedded conformance a bigger runner (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#49018](https://github.com/cilium/cilium/issues/49018), [@aanm](https://github.com/aanm)) - ci: keep UDPRouteWeightedRouting skipped in the profile job (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#49005](https://github.com/cilium/cilium/issues/49005), [@aanm](https://github.com/aanm)) - ci: login to docker registry for downgrade image wait (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#48983](https://github.com/cilium/cilium/issues/48983), [@nebril](https://github.com/nebril)) - ci: Name runner variables after their Ubuntu release and let Renovate bump them (Backport PR [#49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#49065](https://github.com/cilium/cilium/issues/49065), [@aanm](https://github.com/aanm)) - ci: Skip redundant setup when base images already exist (Backport PR [#49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#47209](https://github.com/cilium/cilium/issues/47209), [@HadrienPatte](https://github.com/HadrienPatte)) - ci: Stop passing secrets to the base images workflow (Backport PR [#49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#49082](https://github.com/cilium/cilium/issues/49082), [@aanm](https://github.com/aanm)) - gha/conformance-multi-pool: use the local fake external targets (Backport PR [#48986](https://github.com/cilium/cilium/issues/48986), Upstream PR [#48558](https://github.com/cilium/cilium/issues/48558), [@aanm](https://github.com/aanm)) - gha/e2e-upgrade: gate the after-agent-restart conn-disrupt check (Backport PR [#48437](https://github.com/cilium/cilium/issues/48437), Upstream PR [#47440](https://github.com/cilium/cilium/issues/47440), [@aanm](https://github.com/aanm)) - gha/setup-aks-cluster: Retry a create that never starts (Backport PR [#49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#48924](https://github.com/cilium/cilium/issues/48924), [@aanm](https://github.com/aanm)) - gha: Derive the LVH package cache key once per run (Backport PR [#48986](https://github.com/cilium/cilium/issues/48986), Upstream PR [#48656](https://github.com/cilium/cilium/issues/48656), [@aanm](https://github.com/aanm)) - gha: don't fail PR tests on reporting errors (Backport PR [#49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#48740](https://github.com/cilium/cilium/issues/48740), [@aanm](https://github.com/aanm)) - gha: Grant id-token to the post-release call of release.yaml (Backport PR [#49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#49323](https://github.com/cilium/cilium/issues/49323), [@aanm](https://github.com/aanm)) - gha: make external fake targets image configurable (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#48941](https://github.com/cilium/cilium/issues/48941), [@giorio94](https://github.com/giorio94)) - gha: Retry stalled kind image pulls before the install wait expires (Backport PR [#49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#48989](https://github.com/cilium/cilium/issues/48989), [@aanm](https://github.com/aanm)) - gha: Skip the duplicate CI image build on push to main (Backport PR [#48986](https://github.com/cilium/cilium/issues/48986), Upstream PR [#48736](https://github.com/cilium/cilium/issues/48736), [@aanm](https://github.com/aanm)) - gha: survive a GKE zone running out of capacity (Backport PR [#48986](https://github.com/cilium/cilium/issues/48986), Upstream PR [#48184](https://github.com/cilium/cilium/issues/48184), [@aanm](https://github.com/aanm)) - gha: Tolerate cosign and SBOM failures on pull requests (Backport PR [#48986](https://github.com/cilium/cilium/issues/48986), Upstream PR [#48737](https://github.com/cilium/cilium/issues/48737), [@aanm](https://github.com/aanm)) - ginkgo: remove `Test NodePort with L7 policy` tests (Backport PR [#49067](https://github.com/cilium/cilium/issues/49067), Upstream PR [#46499](https://github.com/cilium/cilium/issues/46499), [@smagnani96](https://github.com/smagnani96)) - loadbalancer/tests: Fix the graceful termination test restart (Backport PR [#49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#48939](https://github.com/cilium/cilium/issues/48939), [@aanm](https://github.com/aanm)) - Migrate Conformance Cluster Mesh workflow to use fake external targets (Backport PR [#48654](https://github.com/cilium/cilium/issues/48654), Upstream PR [#48250](https://github.com/cilium/cilium/issues/48250), [@giorio94](https://github.com/giorio94)) - nodeinit: wait for the kubelet wrapper before writing the bootstrap file (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#48739](https://github.com/cilium/cilium/issues/48739), [@aanm](https://github.com/aanm)) **Misc Changes:** - bpf: lxc: switch cilium\_nodeport\_nat\_buffer to auxvar (Backport PR [#48741](https://github.com/cilium/cilium/issues/48741), Upstream PR [#48543](https://github.com/cilium/cilium/issues/48543), [@julianwiedmann](https://github.com/julianwiedmann)) - build: handle git worktrees in documentation make targets (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#48966](https://github.com/cilium/cilium/issues/48966), [@utaal](https://github.com/utaal)) - chore(deps): update all github action dependencies (v1.20) ([#48881](https://github.com/cilium/cilium/issues/48881), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#49039](https://github.com/cilium/cilium/issues/49039), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#49152](https://github.com/cilium/cilium/issues/49152), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#49277](https://github.com/cilium/cilium/issues/49277), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#48882](https://github.com/cilium/cilium/issues/48882), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#49153](https://github.com/cilium/cilium/issues/49153), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#49275](https://github.com/cilium/cilium/issues/49275), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images to v1.26.9 (v1.20) ([#49262](https://github.com/cilium/cilium/issues/49262), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.20.1 (v1.20) ([#48978](https://github.com/cilium/cilium/issues/48978), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/little-vm-helper to v0.0.31 (v1.20) ([#48788](https://github.com/cilium/cilium/issues/48788), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf to v36.2 (v1.20) ([#49038](https://github.com/cilium/cilium/issues/49038), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/busybox:1.38.0 docker digest to [`fd7dc98`](https://github.com/cilium/cilium/commit/fd7dc98) (v1.20) ([#49035](https://github.com/cilium/cilium/issues/49035), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.8 docker digest to [`0f063af`](https://github.com/cilium/cilium/commit/0f063af) (v1.20) ([#49149](https://github.com/cilium/cilium/issues/49149), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.8 docker digest to [`6c2a553`](https://github.com/cilium/cilium/commit/6c2a553) (v1.20) ([#48879](https://github.com/cilium/cilium/issues/48879), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.9 docker digest to [`d772206`](https://github.com/cilium/cilium/commit/d772206) (v1.20) ([#49298](https://github.com/cilium/cilium/issues/49298), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.7.2 (v1.20) ([#49036](https://github.com/cilium/cilium/issues/49036), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update helm/kind-action action to v1.15.1 (v1.20) ([#49289](https://github.com/cilium/cilium/issues/49289), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.4-1790671085-c3a2a1ff726f00f5b5c0886cab3ad345f97f35b9 (v1.20) ([#49111](https://github.com/cilium/cilium/issues/49111), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1790882336-b64c7306085409b95fb5626db2d2bb7a200b9432 (v1.20) ([#49123](https://github.com/cilium/cilium/issues/49123), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1791291190-5ec36181d464cd75b35b45395a722226cbdd2888 (v1.20) ([#49194](https://github.com/cilium/cilium/issues/49194), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791350265-ae0327a34850b7d1849e8332dbefd4d5bebabe10 (v1.20) ([#49216](https://github.com/cilium/cilium/issues/49216), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791537840-00e749f11f69334c625e53fc1ce2fc6c7f34a51f (v1.20) ([#49276](https://github.com/cilium/cilium/issues/49276), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update security updates to v1.45.0 \[security] (v1.20) ([#48814](https://github.com/cilium/cilium/issues/48814), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#48880](https://github.com/cilium/cilium/issues/48880), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#49037](https://github.com/cilium/cilium/issues/49037), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - ciliumendpointslice: Report no CID when the CEP has none (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#48933](https://github.com/cilium/cilium/issues/48933), [@aanm](https://github.com/aanm)) - connectivity-check: move echo-b to the lower NodePort band (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#48926](https://github.com/cilium/cilium/issues/48926), [@aanm](https://github.com/aanm)) - docs: note on eBPF ClusterIP translation vs Docker raw-table protection (Backport PR [#49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#47782](https://github.com/cilium/cilium/issues/47782), [@Verbano-Tech](https://github.com/Verbano-Tech)) - envoy: add standalone NPDS unsubscribe regression test (Backport PR [#48917](https://github.com/cilium/cilium/issues/48917), Upstream PR [#47818](https://github.com/cilium/cilium/issues/47818), [@nezdolik](https://github.com/nezdolik)) - fix(deps): update k8s.io patch updates stable to v0.36.5 (v1.20) ([#49151](https://github.com/cilium/cilium/issues/49151), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module golang.org/x/net to v0.60.0 \[security] (v1.20) ([#49253](https://github.com/cilium/cilium/issues/49253), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update security updates \[security] (v1.20) ([#48808](https://github.com/cilium/cilium/issues/48808), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - gateway-api: centralize Gateway validation (Backport PR [#48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#48602](https://github.com/cilium/cilium/issues/48602), [@arybolovlev](https://github.com/arybolovlev)) - loadbalancer/writer: add support for SetFrontendSourceRangesFunc (Backport PR [#49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#49068](https://github.com/cilium/cilium/issues/49068), [@0xch4z](https://github.com/0xch4z)) **Other Changes:** - \[v1.20] deps: update gateway api to v1.6.3 ([#49305](https://github.com/cilium/cilium/issues/49305), [@mhofstetter](https://github.com/mhofstetter)) - \[v1.20] node\_neighbor\_discovery: fix ID in delete query ([#48912](https://github.com/cilium/cilium/issues/48912), [@nobleess](https://github.com/nobleess)) - \[v1.20] routing: fix dual-stack ENI router startup with native routing CIDRs ([#48709](https://github.com/cilium/cilium/issues/48709), [@monta-riahi](https://github.com/monta-riahi)) - install: Update image digests for v1.20.2 ([#48751](https://github.com/cilium/cilium/issues/48751), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.3@sha256:95cfa5c2427cc6b452c00908778d0566311f572589284af949d06a013db1a849` `quay.io/cilium/cilium:stable@sha256:95cfa5c2427cc6b452c00908778d0566311f572589284af949d06a013db1a849` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.3@sha256:5c8dca0d0b77bb593df157be39f6c9c868dc08922bbd0540ac0a56815341b227` `quay.io/cilium/clustermesh-apiserver:stable@sha256:5c8dca0d0b77bb593df157be39f6c9c868dc08922bbd0540ac0a56815341b227` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.3@sha256:c6f819d9c5e0b35ccac63b9f2f1ae213fd9be50588e15d5a444d5d305ad317b5` `quay.io/cilium/hubble-relay:stable@sha256:c6f819d9c5e0b35ccac63b9f2f1ae213fd9be50588e15d5a444d5d305ad317b5` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.3@sha256:615f8c2995e437320571d6f61e623d6848ed3ea357cdaa886ac95bbff29a0b52` `quay.io/cilium/operator-alibabacloud:stable@sha256:615f8c2995e437320571d6f61e623d6848ed3ea357cdaa886ac95bbff29a0b52` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.3@sha256:49bdd1d54bdf3da2740848c4662854d0d41c0df25cffe8575d71723db08cc0d1` `quay.io/cilium/operator-aws:stable@sha256:49bdd1d54bdf3da2740848c4662854d0d41c0df25cffe8575d71723db08cc0d1` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.3@sha256:7132b3ff7e33a076ea9fadaa6e4f2b364937ed7b118b92928bdb4706921a2ffa` `quay.io/cilium/operator-azure:stable@sha256:7132b3ff7e33a076ea9fadaa6e4f2b364937ed7b118b92928bdb4706921a2ffa` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.3@sha256:efdd8d89d6d8f63d21a065fa2f9e17614a2b3ac9371b221af9355f63829e2dbc` `quay.io/cilium/operator-generic:stable@sha256:efdd8d89d6d8f63d21a065fa2f9e17614a2b3ac9371b221af9355f63829e2dbc` ##### operator `quay.io/cilium/operator:v1.20.3@sha256:c40996c8a413f57db75715e683abc550e7849904aa20b8730822ba532f9b783c` `quay.io/cilium/operator:stable@sha256:c40996c8a413f57db75715e683abc550e7849904aa20b8730822ba532f9b783c` ### [`v1.20.2`](https://github.com/cilium/cilium/releases/tag/v1.20.2): 1.20.2 [Compare Source](https://github.com/cilium/cilium/compare/1.20.1...1.20.2) ## Summary of Changes **Minor Changes:** - gateway-api: node label selector for when hostNetwork is enabled (Backport PR [#48636](https://github.com/cilium/cilium/issues/48636), Upstream PR [#47463](https://github.com/cilium/cilium/issues/47463), [@xtineskim](https://github.com/xtineskim)) **Bugfixes:** - aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48125](https://github.com/cilium/cilium/issues/48125), [@41ks](https://github.com/41ks)) - aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48193](https://github.com/cilium/cilium/issues/48193), [@41ks](https://github.com/41ks)) - bpf: Fix agent crash when dumping map events (Backport PR [#48378](https://github.com/cilium/cilium/issues/48378), Upstream PR [#48273](https://github.com/cilium/cilium/issues/48273), [@joestringer](https://github.com/joestringer)) - bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48407](https://github.com/cilium/cilium/issues/48407), [@41ks](https://github.com/41ks)) - Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48262](https://github.com/cilium/cilium/issues/48262), [@giorio94](https://github.com/giorio94)) - datapath/linux/config: fix IPV4\_DIRECT\_ROUTING selection on lo device (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#46861](https://github.com/cilium/cilium/issues/46861), [@fdomain](https://github.com/fdomain)) - endpoint: preserve concurrent policy updates for new endpoints (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48195](https://github.com/cilium/cilium/issues/48195), [@jrajahalme](https://github.com/jrajahalme)) - ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47034](https://github.com/cilium/cilium/issues/47034), [@41ks](https://github.com/41ks)) - Fix a pod created immediately after a network policy change reporting a stale policy revision for up to two minutes. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#47642](https://github.com/cilium/cilium/issues/47642), [@aanm](https://github.com/aanm)) - Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association (Backport PR [#48024](https://github.com/cilium/cilium/issues/48024), Upstream PR [#47874](https://github.com/cilium/cilium/issues/47874), [@bryanhorstmann](https://github.com/bryanhorstmann)) - Fix BGP `defaultGateway` peer auto-discovery selecting a default route from a non-main routing table, such as the `default via cilium_host` route Cilium installs in the from-proxy table, instead of the node's real default gateway. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#47971](https://github.com/cilium/cilium/issues/47971), [@ecbaldwin](https://github.com/ecbaldwin)) - Fix bug where identities may linger for double the amount of the expected time (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48032](https://github.com/cilium/cilium/issues/48032), [@christarazi](https://github.com/christarazi)) - Fix dropping traffic L2Announcement with externalTrafficPolicy: Local (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#46399](https://github.com/cilium/cilium/issues/46399), [@yuito-it](https://github.com/yuito-it)) - Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. (Backport PR [#48017](https://github.com/cilium/cilium/issues/48017), Upstream PR [#47943](https://github.com/cilium/cilium/issues/47943), [@taaahaaa](https://github.com/taaahaaa)) - Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. (Backport PR [#48017](https://github.com/cilium/cilium/issues/48017), Upstream PR [#47929](https://github.com/cilium/cilium/issues/47929), [@shreyasrajiv327](https://github.com/shreyasrajiv327)) - Fix Hubble Relay remains running during termination (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#47942](https://github.com/cilium/cilium/issues/47942), [@xandau](https://github.com/xandau)) - Fix ICMP error packet handling by adding the missing checksum recalculation performed during NAT for SNATed load-balanced traffic. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48086](https://github.com/cilium/cilium/issues/48086), [@julianwiedmann](https://github.com/julianwiedmann)) - Fix IPv6 Router Solicitations and Router Advertisements being dropped with "Unsupported protocol for NAT masquerade" on nodes whose BPF masquerade address is a link-local address. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48094](https://github.com/cilium/cilium/issues/48094), [@ecbaldwin](https://github.com/ecbaldwin)) - Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48391](https://github.com/cilium/cilium/issues/48391), [@fristonio](https://github.com/fristonio)) - Fix multiple regressions in Cilium LocalRedirectPolicy (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#46638](https://github.com/cilium/cilium/issues/46638), [@ajmmm](https://github.com/ajmmm)) - Fix node-init startup on GKE 1.36.2-gke.2064000 nodes by detecting GKE from the kubelet path instead of container runtime configuration. (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47945](https://github.com/cilium/cilium/issues/47945), [@dlanov](https://github.com/dlanov)) - Fix nodeport egress tuple reuse for closed connections (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48306](https://github.com/cilium/cilium/issues/48306), [@fristonio](https://github.com/fristonio)) - Fix restored ENI endpoints routing rule configuration when masquerading config changes ([#48417](https://github.com/cilium/cilium/issues/48417), [@fristonio](https://github.com/fristonio)) - fix(envoyconfig): retry port allocation on duplicate-address rejections (Backport PR [#48735](https://github.com/cilium/cilium/issues/48735), Upstream PR [#48624](https://github.com/cilium/cilium/issues/48624), [@kokhlo](https://github.com/kokhlo)) - Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47915](https://github.com/cilium/cilium/issues/47915), [@giorio94](https://github.com/giorio94)) - Fixed a cilium-agent crash (`fatal error: concurrent map iteration and map write`) when an endpoint's policy was recomputed while incremental policy map changes were applied concurrently. Most commonly triggered by named-port policies under pod churn. (Backport PR [#48735](https://github.com/cilium/cilium/issues/48735), Upstream PR [#48098](https://github.com/cilium/cilium/issues/48098), [@nashant](https://github.com/nashant)) - Fixed five configuration options that were accepted but silently ignored: `vtep-sync-interval`, `enable-xt-socket-fallback`, `eni-delete-on-termination` with a custom CNI configuration, the `enableIdentityMark` Helm value outside CNI chaining mode, and `lb-retry-backoff-max`. (Backport PR [#48434](https://github.com/cilium/cilium/issues/48434), Upstream PR [#47635](https://github.com/cilium/cilium/issues/47635), [@aanm](https://github.com/aanm)) - Fixes a bug where clusters originally created in v1.15 or earlier failed to upgrade due to dropping the CRD version CiliumNodeConfig v2alpha1. (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48087](https://github.com/cilium/cilium/issues/48087), [@squeed](https://github.com/squeed)) - Fragmented UDP packets were potentially mis-classified as Cilium Wireguard traffic. (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48139](https://github.com/cilium/cilium/issues/48139), [@julianwiedmann](https://github.com/julianwiedmann)) - gateway-api: fix listener programmed status update (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48013](https://github.com/cilium/cilium/issues/48013), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: propgate listenerset status update errors (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48130](https://github.com/cilium/cilium/issues/48130), [@mhofstetter](https://github.com/mhofstetter)) - hubble: fix four config knobs that never reach their sink (Backport PR [#48434](https://github.com/cilium/cilium/issues/48434), Upstream PR [#47637](https://github.com/cilium/cilium/issues/47637), [@aanm](https://github.com/aanm)) - Improve reliability for fast recovery of disrupted TCP connections that access a DSR-enabled Service. (Backport PR [#48465](https://github.com/cilium/cilium/issues/48465), Upstream PR [#48254](https://github.com/cilium/cilium/issues/48254), [@julianwiedmann](https://github.com/julianwiedmann)) - lb (fix): require active state for backend when using topology hints (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#47054](https://github.com/cilium/cilium/issues/47054), [@CarrySauce](https://github.com/CarrySauce)) - nodediscovery: Reduced EC2 IMDS load and made ENI node registration more resilient by fetching the instance metadata once instead of on every CiliumNode update. (Backport PR [#48603](https://github.com/cilium/cilium/issues/48603), Upstream PR [#48218](https://github.com/cilium/cilium/issues/48218), [@41ks](https://github.com/41ks)) - operator/ipam: Restore fatal exit when the IPAM node watcher fails (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47778](https://github.com/cilium/cilium/issues/47778), [@HadrienPatte](https://github.com/HadrienPatte)) - Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48015](https://github.com/cilium/cilium/issues/48015), [@giorio94](https://github.com/giorio94)) - The BPF NAT engine now drops ICMP error packets which contain a fragmented TCP/UDP/SCTP packet. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48174](https://github.com/cilium/cilium/issues/48174), [@julianwiedmann](https://github.com/julianwiedmann)) - When using DSR with --bpf-lb-dsr-dispatch set to "opt" or "geneve" in combination with --enable-pmtu-discovery, fix the outer source IP of the ICMP error message which is generated when a forwarded DSR request exceeds the network interface's MTU. (Backport PR [#48114](https://github.com/cilium/cilium/issues/48114), Upstream PR [#48053](https://github.com/cilium/cilium/issues/48053), [@julianwiedmann](https://github.com/julianwiedmann)) **CI Changes:** - \[v1.20] golangci-lint: Do not run the modernize linter ([#48398](https://github.com/cilium/cilium/issues/48398), [@aanm](https://github.com/aanm)) - .github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48462](https://github.com/cilium/cilium/issues/48462), [@joestringer](https://github.com/joestringer)) - BPF: Refactor nat tests to use scapy fixtures and add checksum coverage (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47222](https://github.com/cilium/cilium/issues/47222), [@tommyp1ckles](https://github.com/tommyp1ckles)) - bpf: tests: fix up prog type in ipv6\_test (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47736](https://github.com/cilium/cilium/issues/47736), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: tests: use PROG\_TYPE (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47714](https://github.com/cilium/cilium/issues/47714), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: tests: validate CT entry for DSR connection (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48219](https://github.com/cilium/cilium/issues/48219), [@julianwiedmann](https://github.com/julianwiedmann)) - ci: replace unsupported LLVM installation action (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#47776](https://github.com/cilium/cilium/issues/47776), [@bogdankrasko](https://github.com/bogdankrasko)) - ci: resolve renovate PR metadata in base image workflows (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47964](https://github.com/cilium/cilium/issues/47964), [@mhofstetter](https://github.com/mhofstetter)) - ci: stop asking a PHP app for the AKS runner IP (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48371](https://github.com/cilium/cilium/issues/48371), [@aanm](https://github.com/aanm)) - ci: use GitHub App client ID in v1.20 image workflow (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47787](https://github.com/cilium/cilium/issues/47787), [@bogdankrasko](https://github.com/bogdankrasko)) - datapath/loader: fix missing complexity coverage for enable\_identity\_mark (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48037](https://github.com/cilium/cilium/issues/48037), [@tklauser](https://github.com/tklauser)) - gh: verifier: test PR branch before base branch (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#47928](https://github.com/cilium/cilium/issues/47928), [@julianwiedmann](https://github.com/julianwiedmann)) - gha/conformance-aks: add a timeout to the cluster create step (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48545](https://github.com/cilium/cilium/issues/48545), [@aanm](https://github.com/aanm)) - gha/conformance-aks: give the nodes a 64 GiB OS disk (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48481](https://github.com/cilium/cilium/issues/48481), [@aanm](https://github.com/aanm)) - gha/kubespray: don't wait for CoreDNS before Cilium is installed (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48048](https://github.com/cilium/cilium/issues/48048), [@aanm](https://github.com/aanm)) - gha: bound the LLVM prereq apt step with a 5m timeout (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48069](https://github.com/cilium/cilium/issues/48069), [@aanm](https://github.com/aanm)) - gha: compute the ginkgo cache key once, before the matrix (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48127](https://github.com/cilium/cilium/issues/48127), [@aanm](https://github.com/aanm)) - gha: move GCP auth pin past the STS token exchange retry fix (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48352](https://github.com/cilium/cilium/issues/48352), [@aanm](https://github.com/aanm)) - gha: publish the external target hostnames as FQDNs (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48478](https://github.com/cilium/cilium/issues/48478), [@aanm](https://github.com/aanm)) - gha: stop JUnit reports being destroyed by same-name legs (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48203](https://github.com/cilium/cilium/issues/48203), [@aanm](https://github.com/aanm)) - logging: downgrade canceled response-body reads to info (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48202](https://github.com/cilium/cilium/issues/48202), [@aanm](https://github.com/aanm)) - Makefile: Order the bpf codegen ahead of the Go builds (Backport PR [#48735](https://github.com/cilium/cilium/issues/48735), Upstream PR [#48644](https://github.com/cilium/cilium/issues/48644), [@aanm](https://github.com/aanm)) - Revert 48441 - disable local accounts on AKS clusters ([#48524](https://github.com/cilium/cilium/issues/48524), [@aanm](https://github.com/aanm)) - test(bpf): parallelize eBPF test execution (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47427](https://github.com/cilium/cilium/issues/47427), [@lconnery](https://github.com/lconnery)) - test/k8s: wait for the L7 visibility policy to be realized (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48365](https://github.com/cilium/cilium/issues/48365), [@aanm](https://github.com/aanm)) - test: fix the never-taken retry on a partially read JSON line (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#48190](https://github.com/cilium/cilium/issues/48190), [@aanm](https://github.com/aanm)) - tools: complexity: de-couple StackDepth from kernel version (Backport PR [#48200](https://github.com/cilium/cilium/issues/48200), Upstream PR [#48236](https://github.com/cilium/cilium/issues/48236), [@julianwiedmann](https://github.com/julianwiedmann)) - workflows: disable local accounts on AKS clusters ([#48441](https://github.com/cilium/cilium/issues/48441), [@nbusseneau](https://github.com/nbusseneau)) **Misc Changes:** - Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#48421](https://github.com/cilium/cilium/issues/48421), [@0xch4z](https://github.com/0xch4z)) - bpf/lib/nat: rename icmpoff (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#47797](https://github.com/cilium/cilium/issues/47797), [@tommyp1ckles](https://github.com/tommyp1ckles)) - bpf: dsr: use eth\_store\_proto() in dsr\_reply\_icmp\*() (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47392](https://github.com/cilium/cilium/issues/47392), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: icmp\*: fix up sample length (Backport PR [#48114](https://github.com/cilium/cilium/issues/48114), Upstream PR [#48020](https://github.com/cilium/cilium/issues/48020), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: misc cleanups (Backport PR [#48350](https://github.com/cilium/cilium/issues/48350), Upstream PR [#47879](https://github.com/cilium/cilium/issues/47879), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (Backport PR [#48284](https://github.com/cilium/cilium/issues/48284), Upstream PR [#46232](https://github.com/cilium/cilium/issues/46232), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: Reduce stack usage of send\_trace\_notify (Backport PR [#48350](https://github.com/cilium/cilium/issues/48350), Upstream PR [#47911](https://github.com/cilium/cilium/issues/47911), [@joamaki](https://github.com/joamaki)) - chore(deps): update all external docker images dependencies (v1.20) (patch) ([#48147](https://github.com/cilium/cilium/issues/48147), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all external docker images dependencies to v0.13.6 (v1.20) ([#48673](https://github.com/cilium/cilium/issues/48673), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#48326](https://github.com/cilium/cilium/issues/48326), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#48506](https://github.com/cilium/cilium/issues/48506), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#48677](https://github.com/cilium/cilium/issues/48677), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#48149](https://github.com/cilium/cilium/issues/48149), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#48325](https://github.com/cilium/cilium/issues/48325), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#48619](https://github.com/cilium/cilium/issues/48619), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.20) ([#48327](https://github.com/cilium/cilium/issues/48327), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.20) ([#48672](https://github.com/cilium/cilium/issues/48672), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency bufbuild/buf to v1.73.0 (v1.20) ([#48729](https://github.com/cilium/cilium/issues/48729), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.20) ([#48344](https://github.com/cilium/cilium/issues/48344), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.20) ([#48505](https://github.com/cilium/cilium/issues/48505), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency semver to v3.1.0 (v1.20) ([#48730](https://github.com/cilium/cilium/issues/48730), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.20) ([#48517](https://github.com/cilium/cilium/issues/48517), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update google/cloud-sdk docker tag to v581 (v1.20) ([#48150](https://github.com/cilium/cilium/issues/48150), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update helm/kind-action action to v1.15.0 (v1.20) ([#48591](https://github.com/cilium/cilium/issues/48591), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1787987562-ac0b61a4c0a45670a3654448d53bd6416b948f62 (v1.20) ([#48323](https://github.com/cilium/cilium/issues/48323), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.20) ([#48451](https://github.com/cilium/cilium/issues/48451), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.20) ([#48674](https://github.com/cilium/cilium/issues/48674), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#48148](https://github.com/cilium/cilium/issues/48148), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#48324](https://github.com/cilium/cilium/issues/48324), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#48504](https://github.com/cilium/cilium/issues/48504), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#48675](https://github.com/cilium/cilium/issues/48675), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - ci: disable TCP/UDPRouteWeightedRouting gateway-api conformance tests (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48375](https://github.com/cilium/cilium/issues/48375), [@0xch4z](https://github.com/0xch4z)) - datapath: move some feature probes into BPF (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47737](https://github.com/cilium/cilium/issues/47737), [@julianwiedmann](https://github.com/julianwiedmann)) - docs: fix extra closing parenthesis in hive.rst (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#48541](https://github.com/cilium/cilium/issues/48541), [@logi74123](https://github.com/logi74123)) - docs: Improve build process (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#47751](https://github.com/cilium/cilium/issues/47751), [@joestringer](https://github.com/joestringer)) - docs: remove outdated tip about disabling hubble before enabling UI (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#48487](https://github.com/cilium/cilium/issues/48487), [@ekoops](https://github.com/ekoops)) - docs: Remove v1.18 ipsec documentation (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48224](https://github.com/cilium/cilium/issues/48224), [@joestringer](https://github.com/joestringer)) - docs: Update kernel config requirements (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#48594](https://github.com/cilium/cilium/issues/48594), [@pchaigno](https://github.com/pchaigno)) - Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48428](https://github.com/cilium/cilium/issues/48428), [@marcus-chae](https://github.com/marcus-chae)) - Documentation: document mesh security model (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47912](https://github.com/cilium/cilium/issues/47912), [@bimmlerd](https://github.com/bimmlerd)) - envoy: Clarify legacy UpdateEnvoyResources (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48066](https://github.com/cilium/cilium/issues/48066), [@jrajahalme](https://github.com/jrajahalme)) - Fix (eBPF): Pointer-to-Pointer Misuse in IPv6 Trace Notifications (Backport PR [#48350](https://github.com/cilium/cilium/issues/48350), Upstream PR [#47908](https://github.com/cilium/cilium/issues/47908), [@weizhoublue](https://github.com/weizhoublue)) - Fix Component Overview doc link rendering (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#48537](https://github.com/cilium/cilium/issues/48537), [@eneiss](https://github.com/eneiss)) - fix(deps): update k8s.io patch updates stable to v0.36.4 (v1.20) ([#48118](https://github.com/cilium/cilium/issues/48118), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module google.golang.org/grpc to v1.83.1 \[security] (v1.20) ([#48388](https://github.com/cilium/cilium/issues/48388), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module sigs.k8s.io/gateway-api/conformance to v1.6.2 (v1.20) ([#48676](https://github.com/cilium/cilium/issues/48676), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Fixed broken Slack link on Community page. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48021](https://github.com/cilium/cilium/issues/48021), [@ps-mir](https://github.com/ps-mir)) - Fixes: Update node-cache image version to 1.26.5 (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#48270](https://github.com/cilium/cilium/issues/48270), [@zyue110026](https://github.com/zyue110026)) - gateway-api: avoid logging missing GatewayClass as error (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48529](https://github.com/cilium/cilium/issues/48529), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: deduplicate condition merge helpers (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48122](https://github.com/cilium/cilium/issues/48122), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract BackendTLSPolicy status handling into BackendTLSPolicyStatusManager (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48068](https://github.com/cilium/cilium/issues/48068), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract gateway address status handling (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48129](https://github.com/cilium/cilium/issues/48129), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract index & load functionality from controller / reconcile (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#47837](https://github.com/cilium/cilium/issues/47837), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract listener status handling (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48103](https://github.com/cilium/cilium/issues/48103), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract route status handling into RouteStatusManager (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48023](https://github.com/cilium/cilium/issues/48023), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: make gateway-api reconciler client and scheme fields private (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48191](https://github.com/cilium/cilium/issues/48191), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: only load referenced services & serviceimports (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48469](https://github.com/cilium/cilium/issues/48469), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: put ctx first in route status API (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48074](https://github.com/cilium/cilium/issues/48074), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: remove duplicate gateway reconcile error logs (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48186](https://github.com/cilium/cilium/issues/48186), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: remove Gateway LBIPAM annotation warning (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48187](https://github.com/cilium/cilium/issues/48187), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: remove pre-filtered namespaces concept (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#47685](https://github.com/cilium/cilium/issues/47685), [@asauber](https://github.com/asauber)) - gha/lint-ariane-config: let Renovate manage the Go version (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48467](https://github.com/cilium/cilium/issues/48467), [@aanm](https://github.com/aanm)) - gha: authenticate release images with OIDC (Backport PR [#48599](https://github.com/cilium/cilium/issues/48599), Upstream PR [#48062](https://github.com/cilium/cilium/issues/48062), [@aanm](https://github.com/aanm)) - gha: authenticate stable Image CI to quay.io with OIDC (Backport PR [#48060](https://github.com/cilium/cilium/issues/48060), Upstream PR [#48061](https://github.com/cilium/cilium/issues/48061), [@aanm](https://github.com/aanm)) - gha: correct and move the OIDC subject comments (Backport PR [#48060](https://github.com/cilium/cilium/issues/48060), Upstream PR [#48370](https://github.com/cilium/cilium/issues/48370), [@aanm](https://github.com/aanm)) - gha: raise the Docker Hub OIDC token lifetime for release builds (Backport PR [#48599](https://github.com/cilium/cilium/issues/48599), Upstream PR [#48535](https://github.com/cilium/cilium/issues/48535), [@aanm](https://github.com/aanm)) - helm: add general busybox image values for substitution (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#47973](https://github.com/cilium/cilium/issues/47973), [@0xch4z](https://github.com/0xch4z)) - vendor: Bump StateDB to v0.8.4 ([#48248](https://github.com/cilium/cilium/issues/48248), [@joamaki](https://github.com/joamaki)) **Other Changes:** - \[v1.20] bpf: Force-align IPv4 CT tuples used by revSNAT memcpy() ([#48395](https://github.com/cilium/cilium/issues/48395), [@julianwiedmann](https://github.com/julianwiedmann)) - install: Update image digests for v1.20.1 ([#48039](https://github.com/cilium/cilium/issues/48039), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01` `quay.io/cilium/cilium:stable@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.2@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce` `quay.io/cilium/clustermesh-apiserver:stable@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.2@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f` `quay.io/cilium/hubble-relay:stable@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.2@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38` `quay.io/cilium/operator-alibabacloud:stable@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.2@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3` `quay.io/cilium/operator-aws:stable@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.2@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a` `quay.io/cilium/operator-azure:stable@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.2@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc` `quay.io/cilium/operator-generic:stable@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc` ##### operator `quay.io/cilium/operator:v1.20.2@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c` `quay.io/cilium/operator:stable@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c` ### [`v1.20.1`](https://github.com/cilium/cilium/releases/tag/v1.20.1): 1.20.1 [Compare Source](https://github.com/cilium/cilium/compare/1.20.0...1.20.1) ## Summary of Changes **Major Changes:** - docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR [#47615](https://github.com/cilium/cilium/issues/47615), Upstream PR [#47351](https://github.com/cilium/cilium/issues/47351), [@MrFreezeex](https://github.com/MrFreezeex)) **Minor Changes:** - envoy: demote stale ADS endpoint warning (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47148](https://github.com/cilium/cilium/issues/47148), [@nezdolik](https://github.com/nezdolik)) - Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR [#47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#47529](https://github.com/cilium/cilium/issues/47529), [@julianwiedmann](https://github.com/julianwiedmann)) **Bugfixes:** - azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47449](https://github.com/cilium/cilium/issues/47449), [@jaredledvina](https://github.com/jaredledvina)) - bpf: dsr: don't look for TCP header on fragmented packets (Backport PR [#47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#47640](https://github.com/cilium/cilium/issues/47640), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR [#47621](https://github.com/cilium/cilium/issues/47621), Upstream PR [#47343](https://github.com/cilium/cilium/issues/47343), [@smagnani96](https://github.com/smagnani96)) - clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47824](https://github.com/cilium/cilium/issues/47824), [@MrFreezeex](https://github.com/MrFreezeex)) - datapath: turn ARP off on the base devices before bringing them up (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47838](https://github.com/cilium/cilium/issues/47838), [@aanm](https://github.com/aanm)) - endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47625](https://github.com/cilium/cilium/issues/47625), [@christarazi](https://github.com/christarazi)) - endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR [#47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#47880](https://github.com/cilium/cilium/issues/47880), [@weizhoublue](https://github.com/weizhoublue)) - envoy.httpUpstreamLingerTimeout accepts `0` as a chart value and templates into configmap. (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47741](https://github.com/cilium/cilium/issues/47741), [@jdw6359](https://github.com/jdw6359)) - envoy: restore http-idle-timeout as the route idle timeout source (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47583](https://github.com/cilium/cilium/issues/47583), [@aanm](https://github.com/aanm)) - Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47765](https://github.com/cilium/cilium/issues/47765), [@julianwiedmann](https://github.com/julianwiedmann)) - Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR [#47967](https://github.com/cilium/cilium/issues/47967), Upstream PR [#47802](https://github.com/cilium/cilium/issues/47802), [@bimmlerd](https://github.com/bimmlerd)) - Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47727](https://github.com/cilium/cilium/issues/47727), [@aanm](https://github.com/aanm)) - Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47295](https://github.com/cilium/cilium/issues/47295), [@aanm](https://github.com/aanm)) - Fix abnormal ip allocation caused by hostnetwork pod (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47552](https://github.com/cilium/cilium/issues/47552), [@haozhangami](https://github.com/haozhangami)) - Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR [#47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#47593](https://github.com/cilium/cilium/issues/47593), [@julianwiedmann](https://github.com/julianwiedmann)) - fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47754](https://github.com/cilium/cilium/issues/47754), [@weizhoublue](https://github.com/weizhoublue)) - Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with `NotAllowedByListeners` when the TCP listener had an explicit `AllowedRoutes.Kinds` restriction. (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#46842](https://github.com/cilium/cilium/issues/46842), [@pidreher](https://github.com/pidreher)) - gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR [#47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#47840](https://github.com/cilium/cilium/issues/47840), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: mark unresolved backend service ports in route status (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47766](https://github.com/cilium/cilium/issues/47766), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#46696](https://github.com/cilium/cilium/issues/46696), [@thorn3r](https://github.com/thorn3r)) - gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47457](https://github.com/cilium/cilium/issues/47457), [@asauber](https://github.com/asauber)) - gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47702](https://github.com/cilium/cilium/issues/47702), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47627](https://github.com/cilium/cilium/issues/47627), [@mhofstetter](https://github.com/mhofstetter)) - ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47208](https://github.com/cilium/cilium/issues/47208), [@iwanhae](https://github.com/iwanhae)) - l2announcer: re-evaluate services on frontend changes (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47579](https://github.com/cilium/cilium/issues/47579), [@mhofstetter](https://github.com/mhofstetter)) - Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR [#47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#47826](https://github.com/cilium/cilium/issues/47826), [@mehrdadbn9](https://github.com/mehrdadbn9)) - operator: Emit startup logs in the configured log format (Backport PR [#47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#47890](https://github.com/cilium/cilium/issues/47890), [@HadrienPatte](https://github.com/HadrienPatte)) - Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47844](https://github.com/cilium/cilium/issues/47844), [@bimmlerd](https://github.com/bimmlerd)) - standalone-dns-proxy: return an error when no endpoint is found (Backport PR [#47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#47791](https://github.com/cilium/cilium/issues/47791), [@vipul-21](https://github.com/vipul-21)) - wireguard: Unsubscribe node handler on shutdown (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47614](https://github.com/cilium/cilium/issues/47614), [@HadrienPatte](https://github.com/HadrienPatte)) **CI Changes:** - .github: add python3-scapy for BPF unit tests (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47535](https://github.com/cilium/cilium/issues/47535), [@msune](https://github.com/msune)) - .github: run all quarantined EKS tests in a single tolerated step (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47534](https://github.com/cilium/cilium/issues/47534), [@aanm](https://github.com/aanm)) - .github: Run envoy image check against PR content (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47792](https://github.com/cilium/cilium/issues/47792), [@joestringer](https://github.com/joestringer)) - .github: Simplify permissions for image linter workflow (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47753](https://github.com/cilium/cilium/issues/47753), [@joestringer](https://github.com/joestringer)) - .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47470](https://github.com/cilium/cilium/issues/47470), [@atykhyy](https://github.com/atykhyy)) - .github: test the default ENI behaviour on the EKS pull request leg (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47569](https://github.com/cilium/cilium/issues/47569), [@aanm](https://github.com/aanm)) - ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47743](https://github.com/cilium/cilium/issues/47743), [@giorio94](https://github.com/giorio94)) - bpf/complexity-tests: Cover L7 LB (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47060](https://github.com/cilium/cilium/issues/47060), [@pchaigno](https://github.com/pchaigno)) - ci: build race images on push events so conformance-race works on stable branches (Backport PR [#47609](https://github.com/cilium/cilium/issues/47609), Upstream PR [#47608](https://github.com/cilium/cilium/issues/47608), [@aanm](https://github.com/aanm)) - ci: build race images on push in the stable image builders (Backport PR [#47609](https://github.com/cilium/cilium/issues/47609), Upstream PR [#47616](https://github.com/cilium/cilium/issues/47616), [@aanm](https://github.com/aanm)) - ci: draft renovate PRs until ciliumbot auto-approval (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47364](https://github.com/cilium/cilium/issues/47364), [@mhofstetter](https://github.com/mhofstetter)) - ci: fix filtering out md files in bpf checks (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47605](https://github.com/cilium/cilium/issues/47605), [@nebril](https://github.com/nebril)) - ci: migrate set-commit-status to cilium/actions (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47771](https://github.com/cilium/cilium/issues/47771), [@bogdankrasko](https://github.com/bogdankrasko)) - ci: skip etcd log fetch when kvstore was never started (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47801](https://github.com/cilium/cilium/issues/47801), [@aanm](https://github.com/aanm)) - Fix missing `events_map_rate_limit` complexity coverage (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47691](https://github.com/cilium/cilium/issues/47691), [@pchaigno](https://github.com/pchaigno)) - gha/kubespray: run on schedule, rather than on every push (Backport PR [#47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#47719](https://github.com/cilium/cilium/issues/47719), [@giorio94](https://github.com/giorio94)) - gha/lvh-kind: respect Kind image version also when config is provided (Backport PR [#47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#47703](https://github.com/cilium/cilium/issues/47703), [@giorio94](https://github.com/giorio94)) - gha: don't install LLVM and Clang in integration tests workflow (Backport PR [#47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#47717](https://github.com/cilium/cilium/issues/47717), [@giorio94](https://github.com/giorio94)) - gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR [#47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#47724](https://github.com/cilium/cilium/issues/47724), [@giorio94](https://github.com/giorio94)) - images/scripts: Validate Envoy image vars against sed injection (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47205](https://github.com/cilium/cilium/issues/47205), [@MasloMaslane](https://github.com/MasloMaslane)) - Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47780](https://github.com/cilium/cilium/issues/47780), [@giorio94](https://github.com/giorio94)) - test(bpf): parallelize eBPF test compilation (Backport PR [#47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#47426](https://github.com/cilium/cilium/issues/47426), [@lconnery](https://github.com/lconnery)) - test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47725](https://github.com/cilium/cilium/issues/47725), [@aanm](https://github.com/aanm)) - test: allowlist the leader election read timeout in ginkgo log check (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47612](https://github.com/cilium/cilium/issues/47612), [@aanm](https://github.com/aanm)) **Misc Changes:** - Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#46116](https://github.com/cilium/cilium/issues/46116), [@amaanx86](https://github.com/amaanx86)) - allocator: fix flake in TestWatchRemoteKVStore (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47455](https://github.com/cilium/cilium/issues/47455), [@giorio94](https://github.com/giorio94)) - bpf/nat: Move IPv6 nat entry to map (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47762](https://github.com/cilium/cilium/issues/47762), [@pchaigno](https://github.com/pchaigno)) - bpf: conntrack: Reduce stack usage of `ct_create{4,6}` (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47582](https://github.com/cilium/cilium/issues/47582), [@dylandreimerink](https://github.com/dylandreimerink)) - bpf: dsr: only require DSR-info on SYN packet (Backport PR [#47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#47592](https://github.com/cilium/cilium/issues/47592), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR [#47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#47388](https://github.com/cilium/cilium/issues/47388), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: lb: use dedicated new\_backend bool (Backport PR [#47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#47841](https://github.com/cilium/cilium/issues/47841), [@julianwiedmann](https://github.com/julianwiedmann)) - chore(deps): update all github action dependencies (v1.20) ([#47991](https://github.com/cilium/cilium/issues/47991), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#48008](https://github.com/cilium/cilium/issues/48008), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#47678](https://github.com/cilium/cilium/issues/47678), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) ([#47576](https://github.com/cilium/cilium/issues/47576), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) ([#47988](https://github.com/cilium/cilium/issues/47988), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`705e964`](https://github.com/cilium/cilium/commit/705e964) (v1.20) ([#47949](https://github.com/cilium/cilium/issues/47949), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`7caba52`](https://github.com/cilium/cilium/commit/7caba52) (v1.20) ([#47864](https://github.com/cilium/cilium/issues/47864), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) ([#47899](https://github.com/cilium/cilium/issues/47899), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) ([#47989](https://github.com/cilium/cilium/issues/47989), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47865](https://github.com/cilium/cilium/issues/47865), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47990](https://github.com/cilium/cilium/issues/47990), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR [#47962](https://github.com/cilium/cilium/issues/47962), Upstream PR [#47932](https://github.com/cilium/cilium/issues/47932), [@giorio94](https://github.com/giorio94)) - docs: clarify GAMMA DROP\_EP\_NOT\_READY events (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47587](https://github.com/cilium/cilium/issues/47587), [@thorn3r](https://github.com/thorn3r)) - docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47600](https://github.com/cilium/cilium/issues/47600), [@41ks](https://github.com/41ks)) - docs: Remove "not stable" installation instructions (Backport PR [#47798](https://github.com/cilium/cilium/issues/47798), Upstream PR [#47646](https://github.com/cilium/cilium/issues/47646), [@joestringer](https://github.com/joestringer)) - docs: update Gateway API conformance badge (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47581](https://github.com/cilium/cilium/issues/47581), [@arybolovlev](https://github.com/arybolovlev)) - docs: Update Gateway API installation guide (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47446](https://github.com/cilium/cilium/issues/47446), [@arybolovlev](https://github.com/arybolovlev)) - Gateway API: the Gateway address status no longer reports a bogus "<nil>" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47466](https://github.com/cilium/cilium/issues/47466), [@locker95](https://github.com/locker95)) - gateway-api: remove unnecessary TLSRoute support checks (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47758](https://github.com/cilium/cilium/issues/47758), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47599](https://github.com/cilium/cilium/issues/47599), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: return route check errors directly (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47607](https://github.com/cilium/cilium/issues/47607), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: unify Gateway API listener parentRef matching (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#46670](https://github.com/cilium/cilium/issues/46670), [@arybolovlev](https://github.com/arybolovlev)) - gateway-api: validate gRPCRoute header modifiers in status (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47606](https://github.com/cilium/cilium/issues/47606), [@mhofstetter](https://github.com/mhofstetter)) - operator: Replace `reflect.DeepEqual` with `assert.Equal` in tests (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47424](https://github.com/cilium/cilium/issues/47424), [@HadrienPatte](https://github.com/HadrienPatte)) - Update all github action dependencies (v1.20) ([#47656](https://github.com/cilium/cilium/issues/47656), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update all github action dependencies (v1.20) ([#47675](https://github.com/cilium/cilium/issues/47675), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update docker.io/library/busybox:1.38.0 Docker digest to [`dc2d74b`](https://github.com/cilium/cilium/commit/dc2d74b) (v1.20) ([#47655](https://github.com/cilium/cilium/issues/47655), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update documentation dependencies (Backport PR [#47798](https://github.com/cilium/cilium/issues/47798), Upstream PR [#47750](https://github.com/cilium/cilium/issues/47750), [@joestringer](https://github.com/joestringer)) - Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) ([#47657](https://github.com/cilium/cilium/issues/47657), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) ([#47659](https://github.com/cilium/cilium/issues/47659), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) ([#47658](https://github.com/cilium/cilium/issues/47658), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) **Other Changes:** - install: Update image digests for v1.20.0 ([#47584](https://github.com/cilium/cilium/issues/47584), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` `quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` `quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` `quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` `quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` `quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` `quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` `quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` ##### operator `quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` `quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` ### [`v1.20.0`](https://github.com/cilium/cilium/releases/tag/v1.20.0): 1.20.0 [Compare Source](https://github.com/cilium/cilium/compare/1.19.10...1.20.0) 🎉 **Release Announcement** 🎉: We are excited to announce the [Cilium 1.20.0](https://github.com/cilium/cilium/releases/tag/v1.20.0) release! More than **2,660 new commits** have landed in this release, supported by a community of over **1,100 contributors** and more than **24,800 GitHub stars**! 🤩 ⚠️ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the `cilium.io/v2alpha1` `CiliumNodeConfig` API, the libnetwork integration, or a custom CNI configuration. See the [Upgrade Guide](https://docs.cilium.io/en/v1.20/operations/upgrade/#upgrade-notes) for details. The full changelog can be found [here](https://github.com/cilium/cilium/blob/v1.20/CHANGELOG.md). Here are some of the highlights: - ⛩️ **Gateway API** - 🚀 **Gateway API v1.6.1**: Cilium moves from Gateway API v1.4 to v1.6.1, bringing support for capabilities that graduated across both upstream releases. ([cilium/cilium#45251](https://github.com/cilium/cilium/pull/45251), [@youngnick](https://github.com/youngnick); [cilium/cilium#46827](https://github.com/cilium/cilium/pull/46827), [cilium/cilium#47274](https://github.com/cilium/cilium/pull/47274), [@arybolovlev](https://github.com/arybolovlev)) - 👥 **Delegate Gateway Listeners**: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. ([cilium/cilium#46303](https://github.com/cilium/cilium/pull/46303), [cilium/cilium#46785](https://github.com/cilium/cilium/pull/46785), [@asauber](https://github.com/asauber)) - 🔏 **Encrypt Traffic to Backends**: Gateway API `BackendTLSPolicy` support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. ([cilium/cilium#43045](https://github.com/cilium/cilium/pull/43045), [@youngnick](https://github.com/youngnick)) - 🔀 **TCPRoute and UDPRoute**: Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic. ([cilium/cilium#46184](https://github.com/cilium/cilium/pull/46184), [cilium/cilium#46970](https://github.com/cilium/cilium/pull/46970), [@eminaktas](https://github.com/eminaktas); [cilium/cilium#47381](https://github.com/cilium/cilium/pull/47381), [@arybolovlev](https://github.com/arybolovlev)) - 🔐 **External Authorization**: HTTPRoute requests can now be authenticated and authorized through an external service before they reach the application, using the Gateway API `ExternalAuth` filter from GEP-1494. ([cilium/cilium#45739](https://github.com/cilium/cilium/pull/45739), [@gauteoh](https://github.com/gauteoh)) - 🎛️ **More HTTP Traffic Controls**: HTTPRoutes gain native CORS support and additional 303, 307 and 308 redirect codes. `CiliumGatewayClassConfig` can also overwrite, append or preserve the HTTP Server response header. ([cilium/cilium#45924](https://github.com/cilium/cilium/pull/45924), [@arybolovlev](https://github.com/arybolovlev); [cilium/cilium#47232](https://github.com/cilium/cilium/pull/47232), [@youngnick](https://github.com/youngnick); [cilium/cilium#46764](https://github.com/cilium/cilium/pull/46764), [@xtineskim](https://github.com/xtineskim)) - ↔️ **Configurable gRPC-Web Translation**: `CiliumGatewayClassConfig` can disable automatic gRPC-web translation for Gateways that need to pass the original traffic through unchanged. Translation remains enabled by default. ([cilium/cilium#45984](https://github.com/cilium/cilium/pull/45984), [@thorn3r](https://github.com/thorn3r)) - 🚠 **Networking** - 🔌 **Extensible Datapath**: Datapath plugins let cloud providers extend or instrument Cilium's eBPF datapath with independently versioned programs, without maintaining a Cilium fork. ([cilium/cilium#45028](https://github.com/cilium/cilium/pull/45028), [cilium/cilium#45429](https://github.com/cilium/cilium/pull/45429), [cilium/cilium#45558](https://github.com/cilium/cilium/pull/45558), [cilium/cilium#46673](https://github.com/cilium/cilium/pull/46673), [cilium/cilium#46872](https://github.com/cilium/cilium/pull/46872), [@jrife](https://github.com/jrife)) - 🚄 **Automatic Netkit Selection**: Set `bpf.datapathMode=auto` to use netkit automatically on supported kernels and fall back to veth on other nodes. The default remains veth. ([cilium/cilium#43062](https://github.com/cilium/cilium/pull/43062), [@ajmmm](https://github.com/ajmmm)) - 📤 **Egress Gateway Improvements**: Dual-stack clusters can configure an explicit IPv6 egress IP. IPv4 Egress Gateway traffic also strictly honors the interface selected by the policy, matching the existing IPv6 behavior. ([cilium/cilium#44524](https://github.com/cilium/cilium/pull/44524), [@yykkibbb](https://github.com/yykkibbb); [cilium/cilium#45833](https://github.com/cilium/cilium/pull/45833), [@julianwiedmann](https://github.com/julianwiedmann)) - 🔍 **Better BGP Tooling and Reconciliation**: New Hive shell commands expose route policies and clearer peer output formats. The control plane moves to GoBGP v4.6.1 and optimizes route-policy reconciliation. ([cilium/cilium#45628](https://github.com/cilium/cilium/pull/45628), [cilium/cilium#45534](https://github.com/cilium/cilium/pull/45534), [@martonra](https://github.com/martonra); [cilium/cilium#45952](https://github.com/cilium/cilium/pull/45952), [cilium/cilium#46928](https://github.com/cilium/cilium/pull/46928), [@rastislavs](https://github.com/rastislavs)) - 🌐 **IPAM and IP Selection** - ☁️ **IPv6 for AWS ENI IPAM (Beta)**: Cilium can now allocate IPv6 prefixes to pods through AWS ENI IPAM, building on the move to the multi-pool allocator. ([cilium/cilium#46756](https://github.com/cilium/cilium/pull/46756), [cilium/cilium#46619](https://github.com/cilium/cilium/pull/46619), [@41ks](https://github.com/41ks); [cilium/cilium#45154](https://github.com/cilium/cilium/pull/45154), [cilium/cilium#45958](https://github.com/cilium/cilium/pull/45958), [@HadrienPatte](https://github.com/HadrienPatte)) - 🔄 **Migrate to Multi-Pool IPAM**: Existing clusters can move from cluster-pool IPAM to multi-pool IPAM without being rebuilt. ([cilium/cilium#46104](https://github.com/cilium/cilium/pull/46104), [@pippolo84](https://github.com/pippolo84)) - 🧭 **Dynamic NodePort Source Addresses**: NodePort can use the kernel FIB to select the preferred source address dynamically before SNATing north-south traffic, on supported kernels. ([cilium/cilium#44625](https://github.com/cilium/cilium/pull/44625), [@ldelossa](https://github.com/ldelossa)) - 🔵 **Prefer IPv6 Consistently**: The new top-level `preferIpv6` option applies to both Cilium health probes and Hubble peer communication when IPv4 and IPv6 are available. ([cilium/cilium#45447](https://github.com/cilium/cilium/pull/45447), [@tibrezus](https://github.com/tibrezus)) - 🕸️ **Services and Cluster Mesh** - 📍 **Topology-Aware Service Traffic**: Cilium's service load balancer now supports the Kubernetes `PreferSameZone` and `PreferSameNode` traffic distribution hints. ([cilium/cilium#44771](https://github.com/cilium/cilium/pull/44771), [@raphink](https://github.com/raphink)) - ⚖️ **Weighted Maglev Backends**: Maglev now honors the `service.cilium.io/weight` annotation on EndpointSlices. A weight of zero drains new connections while allowing existing connections to continue. ([cilium/cilium#46061](https://github.com/cilium/cilium/pull/46061), [@mhofstetter](https://github.com/mhofstetter)) - 🌉 **More Load-Balancing Options with VXLAN**: Clusters using VXLAN can use per-Service load-balancing mode annotations, including compatible DSR configurations such as IPIP dispatch. ([cilium/cilium#45600](https://github.com/cilium/cilium/pull/45600), [@brb](https://github.com/brb)) - 🤖 **Stable MCS API Support**: Cilium's implementation of the Kubernetes Multi-Cluster Services API is now stable and recommended for portable service discovery through ClusterMesh. ([cilium/cilium#45404](https://github.com/cilium/cilium/pull/45404), [cilium/cilium#46953](https://github.com/cilium/cilium/pull/46953), [@MrFreezeex](https://github.com/MrFreezeex)) - 🔒 **Encryption and Network Policy** - 🚇 **Improved Ztunnel Identity Management**: The ztunnel path now supports either an internal certificate authority or SPIRE-issued workload identities, alongside new Prometheus metrics for enrollment and connection health. It transparently encrypts enrolled pod-to-pod connections, including traffic between pods on the same node. ([cilium/cilium#43763](https://github.com/cilium/cilium/pull/43763), [cilium/cilium#44275](https://github.com/cilium/cilium/pull/44275), [cilium/cilium#44136](https://github.com/cilium/cilium/pull/44136), [cilium/cilium#45861](https://github.com/cilium/cilium/pull/45861), [@nddq](https://github.com/nddq); [cilium/cilium#45096](https://github.com/cilium/cilium/pull/45096), [@gokulMSFT](https://github.com/gokulMSFT)) - 🛡️ **Kubernetes ClusterNetworkPolicy (KCNP)**: Cilium now supports the upstream, cluster-scoped policy API, including Admin and Baseline policy tiers alongside namespaced Kubernetes NetworkPolicy. ([cilium/cilium#42338](https://github.com/cilium/cilium/pull/42338), [@TheBeeZee](https://github.com/TheBeeZee); [cilium/cilium#46253](https://github.com/cilium/cilium/pull/46253), [@aanm](https://github.com/aanm)) - ⛔ **Friendlier IPv6 Policy Denials**: Cilium can return ICMPv6 Destination Unreachable responses when network policy denies IPv6 egress traffic, matching the IPv4 capability introduced in Cilium 1.19. ([cilium/cilium#44234](https://github.com/cilium/cilium/pull/44234), [@Andreagit97](https://github.com/Andreagit97)) - 🌐 **Select the Entire Cluster Mesh**: The new `cluster-mesh` policy entity selects every endpoint across a mesh, making cross-cluster security policies easier to express. ([cilium/cilium#46813](https://github.com/cilium/cilium/pull/46813), [@squeed](https://github.com/squeed)) - ☁️ **Standardize AWS VPC Group Policies**: Policies that reference AWS VPC groups are now transformed into `CiliumCIDRGroup` resources, bringing external IP groups into the standard Cilium policy model. ([cilium/cilium#44704](https://github.com/cilium/cilium/pull/44704), [@squeed](https://github.com/squeed)) - 🛂 **Per-Pod Source IP Verification Control**: Trusted workloads that need to send traffic with non-local source addresses can disable source IP verification through a pod annotation, guarded by a namespace-level opt-in. ([cilium/cilium#43505](https://github.com/cilium/cilium/pull/43505), [@zbb88888](https://github.com/zbb88888)) - ⚙️ **Day 2 Operations and Observability** - 🔧 **Detect Configuration Drift**: Cilium can expose how many ConfigMap settings an agent has not yet applied, making it easier to identify when a restart is required after a configuration change. ([cilium/cilium#44703](https://github.com/cilium/cilium/pull/44703), [@PhilipSchmid](https://github.com/PhilipSchmid)) - ⏱️ **Understand Agent Start-Up Time**: New Hive lifecycle and Kubernetes resource-sync metrics show how long individual resources and components take to initialize. ([cilium/cilium#44802](https://github.com/cilium/cilium/pull/44802), [cilium/cilium#44639](https://github.com/cilium/cilium/pull/44639), [@ILL1A](https://github.com/ILL1A)) - 🛰️ **Correlate More Hubble Verdicts with Policies**: Hubble can now identify the policy responsible for audit verdicts. ([cilium/cilium#45373](https://github.com/cilium/cilium/pull/45373), [@Rajneesh180](https://github.com/Rajneesh180)) - 📊 **Standalone DNS Proxy Metrics**: The Standalone DNS Proxy now exports DNS metrics back through Cilium, improving visibility when DNS policy processing runs outside the agent. ([cilium/cilium#45222](https://github.com/cilium/cilium/pull/45222), [cilium/cilium#44601](https://github.com/cilium/cilium/pull/44601), [@vipul-21](https://github.com/vipul-21)) - 🌅 **Performance and Scale** - 💾 **Aggregated Load-Balancer State**: Cilium's internal backend representation has been flattened to efficiently support thousands of Services that share the same backends. ([cilium/cilium#44511](https://github.com/cilium/cilium/pull/44511), [@joamaki](https://github.com/joamaki)) - 📡 **More Efficient Envoy Updates**: New ADS and Delta xDS modes provide consistent or incremental delivery of Envoy resources, reducing CPU usage and policy update latency. ([cilium/cilium#43887](https://github.com/cilium/cilium/pull/43887), [@nezdolik](https://github.com/nezdolik); [cilium/cilium#45288](https://github.com/cilium/cilium/pull/45288), [@jrajahalme](https://github.com/jrajahalme)) - 🗂️ **Optimized BPF Policy Map Encoding**: Semantic wildcard identities for remote-node and world reduce BPF policy-map pressure, particularly in larger clusters. ([cilium/cilium#46438](https://github.com/cilium/cilium/pull/46438), [@squeed](https://github.com/squeed)) - 📦 **Smaller CNI Binary**: The `cilium-cni` binary has been reduced from roughly 77 MB to 16 MB, shrinking both the Cilium image and its footprint on every node. ([cilium/cilium#45845](https://github.com/cilium/cilium/pull/45845), [@giorio94](https://github.com/giorio94)) - 🛠️ **Updated Dependencies and Foundations**: Cilium 1.20 updates to Kubernetes v1.36, Envoy v1.37.x, Gateway API v1.6.1, GoBGP v4.6.1 and MCS API v0.5.2. Runtime and builder images now use Ubuntu 26.04, and the default CNI configuration version moves from 0.3.1 to 1.0.0. ([cilium/cilium#45499](https://github.com/cilium/cilium/pull/45499), [cilium/cilium#47215](https://github.com/cilium/cilium/pull/47215), [@HadrienPatte](https://github.com/HadrienPatte); [cilium/cilium#45851](https://github.com/cilium/cilium/pull/45851), [@sayboras](https://github.com/sayboras); [cilium/cilium#47274](https://github.com/cilium/cilium/pull/47274), [@arybolovlev](https://github.com/arybolovlev); [cilium/cilium#45952](https://github.com/cilium/cilium/pull/45952), [@rastislavs](https://github.com/rastislavs); [cilium/cilium#47166](https://github.com/cilium/cilium/pull/47166), [@MrFreezeex](https://github.com/MrFreezeex); [cilium/cilium#46971](https://github.com/cilium/cilium/pull/46971), [@gandro](https://github.com/gandro)) - 🏠 **Community** - ❤️ **Production Case Studies**: Many end-users have told their stories running Cilium in production. Read and watch more from: [Asana](https://www.youtube.com/watch?v=mxjiSCnrb3c), [Etraveli](https://www.youtube.com/watch?v=KWS-NaZd62M\&list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ\&index=7), [Michelin](https://www.cncf.io/case-studies/michelin-2/), [OpenAI](https://isovalent.com/blog/post/openai-isovalent-networking-kubernetes-case-study/), [Suse](https://www.youtube.com/watch?v=bgCg1tS72ME\&list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ\&index=8), [Telefónica's acens](https://blogs.cisco.com/sp/telefonicas-acens-and-cisco-driving-the-next-generation-of-cloud-native-services-with-isovalent), and [Zynga](https://www.cncf.io/case-studies/zynga/). If your company wants to submit their case studies let us know. We would love to hear your feedback! - 🇳🇱 **Amsterdam Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and [Cilium Developer Summit](https://github.com/cilium/dev-summits/tree/main/2026-EU) in Amsterdam. [Watch the talks](https://www.youtube.com/playlist?list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ) from CiliumCon. - 🇺🇸 **Salt Lake City Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developer Summit at KubeCon + CloudNativeCon North America in Salt Lake City, November 9-12. - 🤖 **Generative AI Policy**: The Cilium community adopted a [Generative AI Policy](https://github.com/cilium/community/blob/main/AI-POLICY.md) that encourages community members to connect and communicate with one another without the use of AI, while recognizing that different people work best with their own tools of choice. - 📚 **Cilium Books**: Two new books landed for readers at every level — *[Cilium: Up and Running](https://isovalent.com/books/cilium-up-and-running/)* (O'Reilly), a practitioner's deep dive and *[Buzzing Beyond Clouds: The Illustrated Children's Guide to Cilium](https://isovalent.com/books/children-guide-to-cilium/)*, the follow-up to the eBPF children's guide. ❤️ **Thank You**: Cilium 1.20 was made possible by contributors, reviewers and maintainers from across the community, including engineers from Datadog, Google, Microsoft and many other organizations. To keep up to date with all the latest Cilium releases, join #release 🎉 #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93` `quay.io/cilium/cilium:stable@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.0@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92` `quay.io/cilium/clustermesh-apiserver:stable@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.0@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94` `quay.io/cilium/hubble-relay:stable@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.0@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9` `quay.io/cilium/operator-alibabacloud:stable@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.0@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa` `quay.io/cilium/operator-aws:stable@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.0@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c` `quay.io/cilium/operator-azure:stable@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.0@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3` `quay.io/cilium/operator-generic:stable@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3` ##### operator `quay.io/cilium/operator:v1.20.0@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c` `quay.io/cilium/operator:stable@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c` ### [`v1.19.10`](https://github.com/cilium/cilium/releases/tag/v1.19.10): 1.19.10 [Compare Source](https://github.com/cilium/cilium/compare/1.19.9...1.19.10) ## Security patch release Out-of-band security patch release to fix CVE-2026-111943 ([golang/go#82345](https://github.com/golang/go/issues/82345)): upgrades Go to 1.26.10 so that the compromised eMudhra intermediate CA certificates are no longer trusted, and updates all dependencies to their latest patch versions. ## Summary of Changes **Bugfixes:** - CiliumEnvoyConfig now only redirects Services in its own namespace, as documented; service references in CiliumClusterwideEnvoyConfig without a namespace default to "default" again. (Backport PR [#49475](https://github.com/cilium/cilium/issues/49475), Upstream PR [#49076](https://github.com/cilium/cilium/issues/49076), [@maxskokov](https://github.com/maxskokov)) **CI Changes:** - .github: Clear CI images on e2e patch downgrades (Backport PR [#49567](https://github.com/cilium/cilium/issues/49567), Upstream PR [#49566](https://github.com/cilium/cilium/issues/49566), [@aanm](https://github.com/aanm)) - ci: Pass the auto-committer secrets to the base images workflow (Backport PR [#49415](https://github.com/cilium/cilium/issues/49415), Upstream PR [#49453](https://github.com/cilium/cilium/issues/49453), [@aanm](https://github.com/aanm)) - renovate: Open one trusted PR per branch (Backport PR [#49415](https://github.com/cilium/cilium/issues/49415), Upstream PR [#49381](https://github.com/cilium/cilium/issues/49381), [@aanm](https://github.com/aanm)) **Misc Changes:** - chore(deps): update auto-merge-trusted-deps (v1.19) ([#49440](https://github.com/cilium/cilium/issues/49440), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update auto-merge-trusted-deps (v1.19) ([#49529](https://github.com/cilium/cilium/issues/49529), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update auto-merge-trusted-deps (v1.19) ([#49564](https://github.com/cilium/cilium/issues/49564), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - clarify co sign documentation to use minimum version to verify signing key (Backport PR [#49475](https://github.com/cilium/cilium/issues/49475), Upstream PR [#49401](https://github.com/cilium/cilium/issues/49401), [@mfahlandt](https://github.com/mfahlandt)) - Prepare for release v1.19.10 ([#49546](https://github.com/cilium/cilium/issues/49546), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) - Revert "Prepare for release v1.19.10" ([#49569](https://github.com/cilium/cilium/issues/49569), [@aanm](https://github.com/aanm)) **Other Changes:** - Gateway API: backport listener hostname, port and protocol conflict detection ([#49450](https://github.com/cilium/cilium/issues/49450), [@asauber](https://github.com/asauber)) - install: Update image digests for v1.19.9 ([#49389](https://github.com/cilium/cilium/issues/49389), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.19.10@sha256:e86fb55fa703ada191fbd4489513daa19674952c8c3c4985dc3c77ce51ac4f27` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.19.10@sha256:1ddfab3ccd3dc372b190c1d48b8a0f9eba5a3436586dfb1b974a94f7dc07ab1a` ##### docker-plugin `quay.io/cilium/docker-plugin:v1.19.10@sha256:318e6b9864a83d35b3fbfd245ba04c976d47f875b1eda4af4a59da3e8331a79a` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.19.10@sha256:93089f137c7a55c6550b547902e230827d26a2dc4cb396b65751e87e4206293a` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.19.10@sha256:618cfb4a601d2d70d6fa5ea0887099f9c8071d234e5567f52e3c8501a1b35114` ##### operator-aws `quay.io/cilium/operator-aws:v1.19.10@sha256:6d6eab4c1c808dbbfcd3d7028132f775ea513fcf1ea9f5f32d9b33518efd8087` ##### operator-azure `quay.io/cilium/operator-azure:v1.19.10@sha256:0069f45920ab88b8ea8b587879fdcbf150dd7d9843309e5d94b374bcab2020e4` ##### operator-generic `quay.io/cilium/operator-generic:v1.19.10@sha256:b3d1c26d4bc58e307282bad9639b4d598e73f91be1430028f36bc5fdce19a85c` ##### operator `quay.io/cilium/operator:v1.19.10@sha256:f9f4f8249c32c7a3c6b82e08ef456428095374c28f49df9a63badbaa290e7076` ### [`v1.19.9`](https://github.com/cilium/cilium/releases/tag/v1.19.9): 1.19.9 [Compare Source](https://github.com/cilium/cilium/compare/1.19.8...1.19.9) ## Summary of Changes **Bugfixes:** - endpoint/restore: skip cleanup for reserved internal endpoints (Backport PR [#49000](https://github.com/cilium/cilium/issues/49000), Upstream PR [#48272](https://github.com/cilium/cilium/issues/48272), [@fristonio](https://github.com/fristonio)) - Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint (Backport PR [#49176](https://github.com/cilium/cilium/issues/49176), Upstream PR [#48905](https://github.com/cilium/cilium/issues/48905), [@fristonio](https://github.com/fristonio)) - Fix ip6tables chain rename errors being silently ignored during iptables rule reconciliation. (Backport PR [#49334](https://github.com/cilium/cilium/issues/49334), Upstream PR [#49024](https://github.com/cilium/cilium/issues/49024), [@maxskokov](https://github.com/maxskokov)) - Fix rare data race in selector cache that could lead to agent panic (Backport PR [#49176](https://github.com/cilium/cilium/issues/49176), Upstream PR [#47733](https://github.com/cilium/cilium/issues/47733), [@odinuge](https://github.com/odinuge)) - Fix restoration of terminating backends. If a terminating backend become active again during restart the backend was incorrectly kept as quarantined. (Backport PR [#48796](https://github.com/cilium/cilium/issues/48796), Upstream PR [#48763](https://github.com/cilium/cilium/issues/48763), [@joamaki](https://github.com/joamaki)) - gateway-api: filter CEC controls from infrastructure metadata (Backport PR [#48985](https://github.com/cilium/cilium/issues/48985), Upstream PR [#47732](https://github.com/cilium/cilium/issues/47732), [@nezdolik](https://github.com/nezdolik)) - L7 conformance CI fixes (Backport PR [#49000](https://github.com/cilium/cilium/issues/49000), Upstream PR [#47517](https://github.com/cilium/cilium/issues/47517), [@fristonio](https://github.com/fristonio)) - operator: Do not emit warning when deleting already deleted unmanaged pod (Backport PR [#48908](https://github.com/cilium/cilium/issues/48908), Upstream PR [#48765](https://github.com/cilium/cilium/issues/48765), [@gandro](https://github.com/gandro)) **CI Changes:** - \[ci] fix escaping in conformance ginkgo (Backport PR [#49176](https://github.com/cilium/cilium/issues/49176), Upstream PR [#48991](https://github.com/cilium/cilium/issues/48991), [@nebril](https://github.com/nebril)) - \[v1.19] .github: Remove the EKS cluster pool workflows ([#49085](https://github.com/cilium/cilium/issues/49085), [@aanm](https://github.com/aanm)) - ci: Add support for OIDC (Backport PR [#49316](https://github.com/cilium/cilium/issues/49316), Upstream PR [#49007](https://github.com/cilium/cilium/issues/49007), [@aanm](https://github.com/aanm)) - ci: cleanup disk space in documentation workflow (Backport PR [#48908](https://github.com/cilium/cilium/issues/48908), Upstream PR [#48427](https://github.com/cilium/cilium/issues/48427), [@tklauser](https://github.com/tklauser)) - ci: Drop the empty floating tag line from CI image digests (Backport PR [#49176](https://github.com/cilium/cilium/issues/49176), Upstream PR [#49070](https://github.com/cilium/cilium/issues/49070), [@aanm](https://github.com/aanm)) - ci: fix CNI setup and readiness checks in the kubespray job (Backport PR [#49334](https://github.com/cilium/cilium/issues/49334), Upstream PR [#48927](https://github.com/cilium/cilium/issues/48927), [@aanm](https://github.com/aanm)) - ci: Give Envoy Embedded conformance a bigger runner (Backport PR [#49176](https://github.com/cilium/cilium/issues/49176), Upstream PR [#49018](https://github.com/cilium/cilium/issues/49018), [@aanm](https://github.com/aanm)) - ci: login to docker registry for downgrade image wait (Backport PR [#49176](https://github.com/cilium/cilium/issues/49176), Upstream PR [#48983](https://github.com/cilium/cilium/issues/48983), [@nebril](https://github.com/nebril)) - ci: Name runner variables after their Ubuntu release and let Renovate bump them (Backport PR [#49316](https://github.com/cilium/cilium/issues/49316), Upstream PR [#49065](https://github.com/cilium/cilium/issues/49065), [@aanm](https://github.com/aanm)) - ci: Skip redundant setup when base images already exist (Backport PR [#49316](https://github.com/cilium/cilium/issues/49316), Upstream PR [#47209](https://github.com/cilium/cilium/issues/47209), [@HadrienPatte](https://github.com/HadrienPatte)) - ci: Stop passing secrets to the base images workflow (Backport PR [#49316](https://github.com/cilium/cilium/issues/49316), Upstream PR [#49082](https://github.com/cilium/cilium/issues/49082), [@aanm](https://github.com/aanm)) - gha/conformance-multi-pool: use the local fake external targets (Backport PR [#48987](https://github.com/cilium/cilium/issues/48987), Upstream PR [#48558](https://github.com/cilium/cilium/issues/48558), [@aanm](https://github.com/aanm)) - gha/setup-aks-cluster: Retry a create that never starts (Backport PR [#49316](https://github.com/cilium/cilium/issues/49316), Upstream PR [#48924](https://github.com/cilium/cilium/issues/48924), [@aanm](https://github.com/aanm)) - gha: Derive the LVH package cache key once per run (Backport PR [#48987](https://github.com/cilium/cilium/issues/48987), Upstream PR [#48656](https://github.com/cilium/cilium/issues/48656), [@aanm](https://github.com/aanm)) - gha: don't fail PR tests on reporting errors (Backport PR [#49316](https://github.com/cilium/cilium/issues/49316), Upstream PR [#48740](https://github.com/cilium/cilium/issues/48740), [@aanm](https://github.com/aanm)) - gha: Grant id-token to the post-release call of release.yaml (Backport PR [#49316](https://github.com/cilium/cilium/issues/49316), Upstream PR [#49323](https://github.com/cilium/cilium/issues/49323), [@aanm](https://github.com/aanm)) - gha: make external fake targets image configurable (Backport PR [#49176](https://github.com/cilium/cilium/issues/49176), Upstream PR [#48941](https://github.com/cilium/cilium/issues/48941), [@giorio94](https://github.com/giorio94)) - gha: Retry stalled kind image pulls before the install wait expires (Backport PR [#49334](https://github.com/cilium/cilium/issues/49334), Upstream PR [#48989](https://github.com/cilium/cilium/issues/48989), [@aanm](https://github.com/aanm)) - gha: Skip the duplicate CI image build on push to main (Backport PR [#48987](https://github.com/cilium/cilium/issues/48987), Upstream PR [#48736](https://github.com/cilium/cilium/issues/48736), [@aanm](https://github.com/aanm)) - gha: survive a GKE zone running out of capacity (Backport PR [#48987](https://github.com/cilium/cilium/issues/48987), Upstream PR [#48184](https://github.com/cilium/cilium/issues/48184), [@aanm](https://github.com/aanm)) - gha: Tolerate cosign and SBOM failures on pull requests (Backport PR [#48987](https://github.com/cilium/cilium/issues/48987), Upstream PR [#48737](https://github.com/cilium/cilium/issues/48737), [@aanm](https://github.com/aanm)) - loadbalancer/tests: Fix the graceful termination test restart (Backport PR [#49316](https://github.com/cilium/cilium/issues/49316), Upstream PR [#48939](https://github.com/cilium/cilium/issues/48939), [@aanm](https://github.com/aanm)) **Misc Changes:** - \[v1.19] Bump various go modules ([#48768](https://github.com/cilium/cilium/issues/48768), [@ferozsalam](https://github.com/ferozsalam)) - build: handle git worktrees in documentation make targets (Backport PR [#49176](https://github.com/cilium/cilium/issues/49176), Upstream PR [#48966](https://github.com/cilium/cilium/issues/48966), [@utaal](https://github.com/utaal)) - chore(deps): update all github action dependencies (v1.19) ([#48885](https://github.com/cilium/cilium/issues/48885), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#49045](https://github.com/cilium/cilium/issues/49045), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#49157](https://github.com/cilium/cilium/issues/49157), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#49279](https://github.com/cilium/cilium/issues/49279), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.19) ([#48886](https://github.com/cilium/cilium/issues/48886), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.19) ([#49158](https://github.com/cilium/cilium/issues/49158), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.19) ([#49280](https://github.com/cilium/cilium/issues/49280), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update auto-merge-trusted-deps (v1.19) ([#49320](https://github.com/cilium/cilium/issues/49320), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.19) ([#48884](https://github.com/cilium/cilium/issues/48884), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images to v1.26.9 (v1.19) ([#49154](https://github.com/cilium/cilium/issues/49154), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.20.1 (v1.19) ([#48979](https://github.com/cilium/cilium/issues/48979), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/little-vm-helper to v0.0.31 (v1.19) ([#48789](https://github.com/cilium/cilium/issues/48789), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf to v36.2 (v1.19) ([#49044](https://github.com/cilium/cilium/issues/49044), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/alpine docker tag to v3.23.6 (v1.19) ([#49041](https://github.com/cilium/cilium/issues/49041), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/busybox:1.37.0 docker digest to [`bdf57e5`](https://github.com/cilium/cilium/commit/bdf57e5) (v1.19) ([#49040](https://github.com/cilium/cilium/issues/49040), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.9 docker digest to [`d772206`](https://github.com/cilium/cilium/commit/d772206) (v1.19) - abandoned ([#49299](https://github.com/cilium/cilium/issues/49299), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update helm/kind-action action to v1.15.1 (v1.19) ([#49295](https://github.com/cilium/cilium/issues/49295), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 \[security] (v1.19) ([#48815](https://github.com/cilium/cilium/issues/48815), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1790882336-b64c7306085409b95fb5626db2d2bb7a200b9432 (v1.19) ([#49127](https://github.com/cilium/cilium/issues/49127), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1791291190-5ec36181d464cd75b35b45395a722226cbdd2888 (v1.19) ([#49195](https://github.com/cilium/cilium/issues/49195), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791350265-ae0327a34850b7d1849e8332dbefd4d5bebabe10 (v1.19) ([#49217](https://github.com/cilium/cilium/issues/49217), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791537840-00e749f11f69334c625e53fc1ce2fc6c7f34a51f (v1.19) ([#49278](https://github.com/cilium/cilium/issues/49278), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.19) (patch) ([#48883](https://github.com/cilium/cilium/issues/48883), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.19) (patch) ([#49042](https://github.com/cilium/cilium/issues/49042), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - connectivity-check: move echo-b to the lower NodePort band (Backport PR [#49176](https://github.com/cilium/cilium/issues/49176), Upstream PR [#48926](https://github.com/cilium/cilium/issues/48926), [@aanm](https://github.com/aanm)) - fix(deps): update k8s.io patch updates stable to v0.35.9 (v1.19) ([#49156](https://github.com/cilium/cilium/issues/49156), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module golang.org/x/net to v0.60.0 \[security] (v1.19) ([#49254](https://github.com/cilium/cilium/issues/49254), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module k8s.io/apimachinery to v0.35.9 (v1.19) ([#49043](https://github.com/cilium/cilium/issues/49043), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update security updates \[security] (v1.19) ([#48809](https://github.com/cilium/cilium/issues/48809), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) **Other Changes:** - \[v1.19] node\_neighbor\_discovery: fix ID in delete query ([#48871](https://github.com/cilium/cilium/issues/48871), [@nobleess](https://github.com/nobleess)) - install: Update image digests for v1.19.8 ([#48752](https://github.com/cilium/cilium/issues/48752), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.19.9@sha256:f3014d42121a04272cb4a5f4f96dbe7836c9a7919990f17e9b6838e8fd4aa33a` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.19.9@sha256:032d6fc085cfaccfb02813b9854e8685c5b0da63e0e03b5019f3e6381fe8669d` ##### docker-plugin `quay.io/cilium/docker-plugin:v1.19.9@sha256:bfa40f426c154d7f558ea19d76153af043ab3cbc477b04645130b6f533311f4e` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.19.9@sha256:ec58f6bc69df817c8d78ffd9eb88aa7e10f551e2bba71b4ad03fbdb6e1bc8bd5` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.19.9@sha256:58a411031bf31b77e9abf2e35ab2417929375f526a71e6359c20caa8f52006d5` ##### operator-aws `quay.io/cilium/operator-aws:v1.19.9@sha256:cd089a3ff79042257f5050d0ffc7d36dc340b028106afbcaa7a4f4614a4e80ad` ##### operator-azure `quay.io/cilium/operator-azure:v1.19.9@sha256:32adcdc31885911d5afd6265ef0e450a399c83c130bea11ede53f951b37ab54c` ##### operator-generic `quay.io/cilium/operator-generic:v1.19.9@sha256:a234406be11ad1bb1d41b111fba2cfe81a099b6c26b2634af95f42f295d35655` ##### operator `quay.io/cilium/operator:v1.19.9@sha256:cf7322f7ee9a1395bbb7562d424cb440c1bd15e70b1640e4abc13d3f70255ffe` ### [`v1.19.8`](https://github.com/cilium/cilium/releases/tag/v1.19.8): 1.19.8 [Compare Source](https://github.com/cilium/cilium/compare/1.19.7...1.19.8) ## Summary of Changes **Bugfixes:** - aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR [#48604](https://github.com/cilium/cilium/issues/48604), Upstream PR [#48193](https://github.com/cilium/cilium/issues/48193), [@41ks](https://github.com/41ks)) - bpf: Fix agent crash when dumping map events (Backport PR [#48379](https://github.com/cilium/cilium/issues/48379), Upstream PR [#48273](https://github.com/cilium/cilium/issues/48273), [@joestringer](https://github.com/joestringer)) - bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR [#47620](https://github.com/cilium/cilium/issues/47620), Upstream PR [#47343](https://github.com/cilium/cilium/issues/47343), [@smagnani96](https://github.com/smagnani96)) - datapath/linux/config: fix IPV4\_DIRECT\_ROUTING selection on lo device (Backport PR [#48552](https://github.com/cilium/cilium/issues/48552), Upstream PR [#46861](https://github.com/cilium/cilium/issues/46861), [@fdomain](https://github.com/fdomain)) - Fix Hubble Relay remains running during termination (Backport PR [#48552](https://github.com/cilium/cilium/issues/48552), Upstream PR [#47942](https://github.com/cilium/cilium/issues/47942), [@xandau](https://github.com/xandau)) - Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR [#48552](https://github.com/cilium/cilium/issues/48552), Upstream PR [#48391](https://github.com/cilium/cilium/issues/48391), [@fristonio](https://github.com/fristonio)) - Fix nodeport egress tuple reuse for closed connections (Backport PR [#48413](https://github.com/cilium/cilium/issues/48413), Upstream PR [#48306](https://github.com/cilium/cilium/issues/48306), [@fristonio](https://github.com/fristonio)) - Fix restored ENI endpoints routing rule configuration when masquerading config changes ([#48422](https://github.com/cilium/cilium/issues/48422), [@fristonio](https://github.com/fristonio)) - fix(socketlb): only detach Cilium-owned cgroup programs (Backport PR [#48552](https://github.com/cilium/cilium/issues/48552), Upstream PR [#44066](https://github.com/cilium/cilium/issues/44066), [@puwun](https://github.com/puwun)) - Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR [#48214](https://github.com/cilium/cilium/issues/48214), Upstream PR [#47915](https://github.com/cilium/cilium/issues/47915), [@giorio94](https://github.com/giorio94)) - Fixed five configuration options that were accepted but silently ignored: `vtep-sync-interval`, `enable-xt-socket-fallback`, `eni-delete-on-termination` with a custom CNI configuration, the `enableIdentityMark` Helm value outside CNI chaining mode, and `lb-retry-backoff-max`. (Backport PR [#48433](https://github.com/cilium/cilium/issues/48433), Upstream PR [#47635](https://github.com/cilium/cilium/issues/47635), [@aanm](https://github.com/aanm)) - hubble: fix four config knobs that never reach their sink (Backport PR [#48433](https://github.com/cilium/cilium/issues/48433), Upstream PR [#47637](https://github.com/cilium/cilium/issues/47637), [@aanm](https://github.com/aanm)) - operator: Emit startup logs in the configured log format (Backport PR [#48018](https://github.com/cilium/cilium/issues/48018), Upstream PR [#47890](https://github.com/cilium/cilium/issues/47890), [@HadrienPatte](https://github.com/HadrienPatte)) - standalone-dns-proxy: return an error when no endpoint is found (Backport PR [#48018](https://github.com/cilium/cilium/issues/48018), Upstream PR [#47791](https://github.com/cilium/cilium/issues/47791), [@vipul-21](https://github.com/vipul-21)) - Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR [#48413](https://github.com/cilium/cilium/issues/48413), Upstream PR [#48015](https://github.com/cilium/cilium/issues/48015), [@giorio94](https://github.com/giorio94)) **CI Changes:** - \[v1.19] golangci-lint: Do not run the modernize linter ([#48399](https://github.com/cilium/cilium/issues/48399), [@aanm](https://github.com/aanm)) - .github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR [#48552](https://github.com/cilium/cilium/issues/48552), Upstream PR [#48462](https://github.com/cilium/cilium/issues/48462), [@joestringer](https://github.com/joestringer)) - BPF: Refactor nat tests to use scapy fixtures and add checksum coverage (Backport PR [#48123](https://github.com/cilium/cilium/issues/48123), Upstream PR [#47222](https://github.com/cilium/cilium/issues/47222), [@tommyp1ckles](https://github.com/tommyp1ckles)) - bpf: tests: collapse more tests (Backport PR [#48063](https://github.com/cilium/cilium/issues/48063), Upstream PR [#46374](https://github.com/cilium/cilium/issues/46374), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: tests: collapse XDP DSR tests (Backport PR [#48063](https://github.com/cilium/cilium/issues/48063), Upstream PR [#46174](https://github.com/cilium/cilium/issues/46174), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: tests: condense a bunch of LB tests (Backport PR [#48063](https://github.com/cilium/cilium/issues/48063), Upstream PR [#46358](https://github.com/cilium/cilium/issues/46358), [@julianwiedmann](https://github.com/julianwiedmann)) - ci: replace unsupported LLVM installation action (Backport PR [#48413](https://github.com/cilium/cilium/issues/48413), Upstream PR [#47776](https://github.com/cilium/cilium/issues/47776), [@bogdankrasko](https://github.com/bogdankrasko)) - ci: resolve renovate PR metadata in base image workflows (Backport PR [#48214](https://github.com/cilium/cilium/issues/48214), Upstream PR [#47964](https://github.com/cilium/cilium/issues/47964), [@mhofstetter](https://github.com/mhofstetter)) - ci: stop asking a PHP app for the AKS runner IP (Backport PR [#48552](https://github.com/cilium/cilium/issues/48552), Upstream PR [#48371](https://github.com/cilium/cilium/issues/48371), [@aanm](https://github.com/aanm)) - ci: use GitHub App client ID in v1.19 image workflow (Backport PR [#48214](https://github.com/cilium/cilium/issues/48214), Upstream PR [#47786](https://github.com/cilium/cilium/issues/47786), [@bogdankrasko](https://github.com/bogdankrasko)) - gha/conformance-aks: add a timeout to the cluster create step (Backport PR [#48552](https://github.com/cilium/cilium/issues/48552), Upstream PR [#48545](https://github.com/cilium/cilium/issues/48545), [@aanm](https://github.com/aanm)) - gha/conformance-aks: give the nodes a 64 GiB OS disk (Backport PR [#48552](https://github.com/cilium/cilium/issues/48552), Upstream PR [#48481](https://github.com/cilium/cilium/issues/48481), [@aanm](https://github.com/aanm)) - gha/kubespray: don't wait for CoreDNS before Cilium is installed (Backport PR [#48214](https://github.com/cilium/cilium/issues/48214), Upstream PR [#48048](https://github.com/cilium/cilium/issues/48048), [@aanm](https://github.com/aanm)) - gha: bound the LLVM prereq apt step with a 5m timeout (Backport PR [#48214](https://github.com/cilium/cilium/issues/48214), Upstream PR [#48069](https://github.com/cilium/cilium/issues/48069), [@aanm](https://github.com/aanm)) - gha: compute the ginkgo cache key once, before the matrix (Backport PR [#48214](https://github.com/cilium/cilium/issues/48214), Upstream PR [#48127](https://github.com/cilium/cilium/issues/48127), [@aanm](https://github.com/aanm)) - gha: move GCP auth pin past the STS token exchange retry fix (Backport PR [#48413](https://github.com/cilium/cilium/issues/48413), Upstream PR [#48352](https://github.com/cilium/cilium/issues/48352), [@aanm](https://github.com/aanm)) - gha: publish the external target hostnames as FQDNs (Backport PR [#48552](https://github.com/cilium/cilium/issues/48552), Upstream PR [#48478](https://github.com/cilium/cilium/issues/48478), [@aanm](https://github.com/aanm)) - gha: stop JUnit reports being destroyed by same-name legs (Backport PR [#48433](https://github.com/cilium/cilium/issues/48433), Upstream PR [#48203](https://github.com/cilium/cilium/issues/48203), [@aanm](https://github.com/aanm)) - Migrate Conformance Cluster Mesh workflow to use fake external targets (Backport PR [#48655](https://github.com/cilium/cilium/issues/48655), Upstream PR [#48250](https://github.com/cilium/cilium/issues/48250), [@giorio94](https://github.com/giorio94)) - Revert 48442 - disable local accounts on AKS clusters ([#48525](https://github.com/cilium/cilium/issues/48525), [@aanm](https://github.com/aanm)) - test(bpf): parallelize eBPF test execution (Backport PR [#48214](https://github.com/cilium/cilium/issues/48214), Upstream PR [#47427](https://github.com/cilium/cilium/issues/47427), [@lconnery](https://github.com/lconnery)) - test/k8s: wait for the L7 visibility policy to be realized (Backport PR [#48413](https://github.com/cilium/cilium/issues/48413), Upstream PR [#48365](https://github.com/cilium/cilium/issues/48365), [@aanm](https://github.com/aanm)) - test: fix the never-taken retry on a partially read JSON line (Backport PR [#48633](https://github.com/cilium/cilium/issues/48633), Upstream PR [#48190](https://github.com/cilium/cilium/issues/48190), [@aanm](https://github.com/aanm)) - tools: complexity: de-couple StackDepth from kernel version (Backport PR [#48266](https://github.com/cilium/cilium/issues/48266), Upstream PR [#48236](https://github.com/cilium/cilium/issues/48236), [@julianwiedmann](https://github.com/julianwiedmann)) - workflows: disable local accounts on AKS clusters ([#48442](https://github.com/cilium/cilium/issues/48442), [@nbusseneau](https://github.com/nbusseneau)) **Misc Changes:** - Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR [#48633](https://github.com/cilium/cilium/issues/48633), Upstream PR [#48421](https://github.com/cilium/cilium/issues/48421), [@0xch4z](https://github.com/0xch4z)) - bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (Backport PR [#48285](https://github.com/cilium/cilium/issues/48285), Upstream PR [#46232](https://github.com/cilium/cilium/issues/46232), [@julianwiedmann](https://github.com/julianwiedmann)) - chore(deps): update all external docker images dependencies to v0.13.6 (v1.19) ([#48678](https://github.com/cilium/cilium/issues/48678), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#48332](https://github.com/cilium/cilium/issues/48332), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#48509](https://github.com/cilium/cilium/issues/48509), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#48681](https://github.com/cilium/cilium/issues/48681), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.19) ([#48155](https://github.com/cilium/cilium/issues/48155), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.19) ([#48331](https://github.com/cilium/cilium/issues/48331), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.19) ([#48620](https://github.com/cilium/cilium/issues/48620), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.19) ([#48151](https://github.com/cilium/cilium/issues/48151), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images to v1.26.8 (v1.19) ([#48731](https://github.com/cilium/cilium/issues/48731), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.19) ([#48345](https://github.com/cilium/cilium/issues/48345), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency go to v1.25.14 (v1.19) ([#48208](https://github.com/cilium/cilium/issues/48208), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf to v36 (v1.19) ([#48333](https://github.com/cilium/cilium/issues/48333), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.19) ([#48508](https://github.com/cilium/cilium/issues/48508), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.19) ([#48518](https://github.com/cilium/cilium/issues/48518), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update golangci/golangci-lint docker tag to v2.13.2 (v1.19) ([#48732](https://github.com/cilium/cilium/issues/48732), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update google/cloud-sdk docker tag to v581 (v1.19) ([#48156](https://github.com/cilium/cilium/issues/48156), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update helm/kind-action action to v1.15.0 (v1.19) ([#48592](https://github.com/cilium/cilium/issues/48592), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/certgen docker tag to v0.4.11 (v1.19) ([#48152](https://github.com/cilium/cilium/issues/48152), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.10-1787983435-8f34575affde33ad364d1e669b953993bf1f4125 (v1.19) ([#48328](https://github.com/cilium/cilium/issues/48328), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.19) ([#48452](https://github.com/cilium/cilium/issues/48452), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.19) ([#48679](https://github.com/cilium/cilium/issues/48679), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.19) (patch) ([#48153](https://github.com/cilium/cilium/issues/48153), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.19) (patch) ([#48329](https://github.com/cilium/cilium/issues/48329), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.19) (patch) ([#48507](https://github.com/cilium/cilium/issues/48507), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.19) (patch) ([#48680](https://github.com/cilium/cilium/issues/48680), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - docs: Improve build process (Backport PR [#48552](https://github.com/cilium/cilium/issues/48552), Upstream PR [#47751](https://github.com/cilium/cilium/issues/47751), [@joestringer](https://github.com/joestringer)) - docs: remove outdated tip about disabling hubble before enabling UI (Backport PR [#48633](https://github.com/cilium/cilium/issues/48633), Upstream PR [#48487](https://github.com/cilium/cilium/issues/48487), [@ekoops](https://github.com/ekoops)) - docs: Remove v1.18 ipsec documentation (Backport PR [#48413](https://github.com/cilium/cilium/issues/48413), Upstream PR [#48224](https://github.com/cilium/cilium/issues/48224), [@joestringer](https://github.com/joestringer)) - Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (Backport PR [#48552](https://github.com/cilium/cilium/issues/48552), Upstream PR [#48428](https://github.com/cilium/cilium/issues/48428), [@marcus-chae](https://github.com/marcus-chae)) - Documentation: document mesh security model (Backport PR [#48413](https://github.com/cilium/cilium/issues/48413), Upstream PR [#47912](https://github.com/cilium/cilium/issues/47912), [@bimmlerd](https://github.com/bimmlerd)) - Fix byte ordering of TCP fields in BPF integration tests. (Backport PR [#48063](https://github.com/cilium/cilium/issues/48063), Upstream PR [#44336](https://github.com/cilium/cilium/issues/44336), [@ajmmm](https://github.com/ajmmm)) - Fix Component Overview doc link rendering (Backport PR [#48633](https://github.com/cilium/cilium/issues/48633), Upstream PR [#48537](https://github.com/cilium/cilium/issues/48537), [@eneiss](https://github.com/eneiss)) - fix(deps): update k8s.io patch updates stable to v0.35.8 (v1.19) ([#48330](https://github.com/cilium/cilium/issues/48330), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module k8s.io/apimachinery to v0.35.8 (v1.19) ([#48154](https://github.com/cilium/cilium/issues/48154), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Fixed broken Slack link on Community page. (Backport PR [#48413](https://github.com/cilium/cilium/issues/48413), Upstream PR [#48021](https://github.com/cilium/cilium/issues/48021), [@ps-mir](https://github.com/ps-mir)) - Fixes: Update node-cache image version to 1.26.5 (Backport PR [#48633](https://github.com/cilium/cilium/issues/48633), Upstream PR [#48270](https://github.com/cilium/cilium/issues/48270), [@zyue110026](https://github.com/zyue110026)) - gha: authenticate release images with OIDC (Backport PR [#48598](https://github.com/cilium/cilium/issues/48598), Upstream PR [#48062](https://github.com/cilium/cilium/issues/48062), [@aanm](https://github.com/aanm)) - gha: authenticate stable Image CI to quay.io with OIDC (Backport PR [#48059](https://github.com/cilium/cilium/issues/48059), Upstream PR [#48061](https://github.com/cilium/cilium/issues/48061), [@aanm](https://github.com/aanm)) - gha: correct and move the OIDC subject comments (Backport PR [#48059](https://github.com/cilium/cilium/issues/48059), Upstream PR [#48370](https://github.com/cilium/cilium/issues/48370), [@aanm](https://github.com/aanm)) - gha: raise the Docker Hub OIDC token lifetime for release builds (Backport PR [#48598](https://github.com/cilium/cilium/issues/48598), Upstream PR [#48535](https://github.com/cilium/cilium/issues/48535), [@aanm](https://github.com/aanm)) - helm: add general busybox image values for substitution (Backport PR [#48413](https://github.com/cilium/cilium/issues/48413), Upstream PR [#47973](https://github.com/cilium/cilium/issues/47973), [@0xch4z](https://github.com/0xch4z)) - vendor: Bump StateDB to v0.5.10 ([#48247](https://github.com/cilium/cilium/issues/48247), [@joamaki](https://github.com/joamaki)) **Other Changes:** - Fix verifier error "detect support for FnSetRetval for program type CGroupSock" during feature probing ([#48376](https://github.com/cilium/cilium/issues/48376), [@borkmann](https://github.com/borkmann)) - install: Update image digests for v1.19.7 ([#48040](https://github.com/cilium/cilium/issues/48040), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) - proxy: Bump envoy to v1.37.x ([#48310](https://github.com/cilium/cilium/issues/48310), [@sayboras](https://github.com/sayboras)) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.19.8@sha256:e9f7ee1f2f3a41e44339612e3b6b88170bdde7679c9c9461f287bb27702a8ecf` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.19.8@sha256:9c44205b9e6eafed719803682669f63e0a68c549025344c0af520a94b2f3e4bc` ##### docker-plugin `quay.io/cilium/docker-plugin:v1.19.8@sha256:e876814edd154a8f4a2a8a8ac47a10614f7bb9a717d8cee9df352d060242e3a4` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.19.8@sha256:f78768be216b5c00137c7d4da440724d0b49986805d361e7458cc8fe9ff976ff` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.19.8@sha256:cb4a8685fc74fef8f3e97c3370faf338ba1a8b29a7d5cdc718f3926ae0093b99` ##### operator-aws `quay.io/cilium/operator-aws:v1.19.8@sha256:de1cfe6e9962664e69e021f1cc07ea3b4f973d4ce341d7aebabf97616dd27982` ##### operator-azure `quay.io/cilium/operator-azure:v1.19.8@sha256:b67fcc053fe8caa5ae5f12158c8dc568b3d16201cdea17bb78f3b61b7c1f02d7` ##### operator-generic `quay.io/cilium/operator-generic:v1.19.8@sha256:786ec9bb1a9344435e3e3f994bc4ed3a4a85afa6a314e98681af241f8be79833` ##### operator `quay.io/cilium/operator:v1.19.8@sha256:618fe8acacaa682509b19670b1228fd8184c2c4c1478e23d505ba6502e8bcf3a` ### [`v1.19.7`](https://github.com/cilium/cilium/releases/tag/v1.19.7): 1.19.7 [Compare Source](https://github.com/cilium/cilium/compare/1.19.6...1.19.7) ## Summary of Changes **Bugfixes:** - envoy: restore http-idle-timeout as the route idle timeout source (Backport PR [#47688](https://github.com/cilium/cilium/issues/47688), Upstream PR [#47583](https://github.com/cilium/cilium/issues/47583), [@aanm](https://github.com/aanm)) - Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR [#47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#47765](https://github.com/cilium/cilium/issues/47765), [@julianwiedmann](https://github.com/julianwiedmann)) - Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR [#47545](https://github.com/cilium/cilium/issues/47545), Upstream PR [#47295](https://github.com/cilium/cilium/issues/47295), [@aanm](https://github.com/aanm)) - Fix abnormal ip allocation caused by hostnetwork pod (Backport PR [#47688](https://github.com/cilium/cilium/issues/47688), Upstream PR [#47552](https://github.com/cilium/cilium/issues/47552), [@haozhangami](https://github.com/haozhangami)) - Fix BPF LB map key collision where HostPort/NodePort expansion could overwrite a LoadBalancer frontend when the node IP matches the LoadBalancer external IP (e.g. k3s/RKE2 L2 ServiceLB). Also fix a \~30-minute NodePort outage that occurred after deleting a LoadBalancer whose external IP was a node address with a port in the NodePort range. (Backport PR [#47414](https://github.com/cilium/cilium/issues/47414), Upstream PR [#45314](https://github.com/cilium/cilium/issues/45314), [@syedazeez337](https://github.com/syedazeez337)) - Fix bug causing Cilium to intercept traffic towards LoadBalancer VIPs when KPR is disabled, when the traffic should be delegated to kube-proxy. (Backport PR [#47414](https://github.com/cilium/cilium/issues/47414), Upstream PR [#47204](https://github.com/cilium/cilium/issues/47204), [@ajmmm](https://github.com/ajmmm)) - Fix redirection of egressing traffic that falls in scope of a CiliumEgressGatewayPolicy, when the initial interface is a L3 interface. (Backport PR [#47757](https://github.com/cilium/cilium/issues/47757), Upstream PR [#45703](https://github.com/cilium/cilium/issues/45703), [@julianwiedmann](https://github.com/julianwiedmann)) - Fix: Cilium Ingress now automatically reallocates ports and retries when cilium-envoy fails to bind due to port conflicts (Backport PR [#47410](https://github.com/cilium/cilium/issues/47410), Upstream PR [#42859](https://github.com/cilium/cilium/issues/42859), [@inerplat](https://github.com/inerplat)) - Fixes an issue where invalid regex on an HTTPRoute or GRPCRoute matcher is accepted but causes Envoy to NACK (Backport PR [#47468](https://github.com/cilium/cilium/issues/47468), Upstream PR [#47005](https://github.com/cilium/cilium/issues/47005), [@0xch4z](https://github.com/0xch4z)) - fqdn/service: prune SDP identity->IP mapping on delete using newID (Backport PR [#47545](https://github.com/cilium/cilium/issues/47545), Upstream PR [#47100](https://github.com/cilium/cilium/issues/47100), [@vipul-21](https://github.com/vipul-21)) - gateway-api: GAMMA Routes are now filtered correctly before being passed to model ingestion. (Backport PR [#47468](https://github.com/cilium/cilium/issues/47468), Upstream PR [#45294](https://github.com/cilium/cilium/issues/45294), [@youngnick](https://github.com/youngnick)) - ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR [#47886](https://github.com/cilium/cilium/issues/47886), Upstream PR [#47208](https://github.com/cilium/cilium/issues/47208), [@iwanhae](https://github.com/iwanhae)) - lbipam: prevent reassigning Service LoadBalancer IPs on operator restart when the existing IP belongs to a compatible sharing key group. (Backport PR [#46559](https://github.com/cilium/cilium/issues/46559), Upstream PR [#46262](https://github.com/cilium/cilium/issues/46262), [@ieth0](https://github.com/ieth0)) - Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR [#47886](https://github.com/cilium/cilium/issues/47886), Upstream PR [#47844](https://github.com/cilium/cilium/issues/47844), [@bimmlerd](https://github.com/bimmlerd)) - wireguard: Unsubscribe node handler on shutdown (Backport PR [#47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#47614](https://github.com/cilium/cilium/issues/47614), [@HadrienPatte](https://github.com/HadrienPatte)) **CI Changes:** - .github: fail smoke IPv6 closed when the test job does not succeed (Backport PR [#47545](https://github.com/cilium/cilium/issues/47545), Upstream PR [#47441](https://github.com/cilium/cilium/issues/47441), [@aanm](https://github.com/aanm)) - .github: retry CLI and binary downloads over transient network errors (Backport PR [#47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#47167](https://github.com/cilium/cilium/issues/47167), [@aanm](https://github.com/aanm)) - .github: Run envoy image check against PR content (Backport PR [#47886](https://github.com/cilium/cilium/issues/47886), Upstream PR [#47792](https://github.com/cilium/cilium/issues/47792), [@joestringer](https://github.com/joestringer)) - .github: Simplify permissions for image linter workflow (Backport PR [#47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#47753](https://github.com/cilium/cilium/issues/47753), [@joestringer](https://github.com/joestringer)) - .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR [#47688](https://github.com/cilium/cilium/issues/47688), Upstream PR [#47470](https://github.com/cilium/cilium/issues/47470), [@atykhyy](https://github.com/atykhyy)) - \[v1.19] ariane: remove reference to the non-existing lint-ariane-config workflow ([#47701](https://github.com/cilium/cilium/issues/47701), [@giorio94](https://github.com/giorio94)) - ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR [#47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#47743](https://github.com/cilium/cilium/issues/47743), [@giorio94](https://github.com/giorio94)) - bpf/tests: support pkt sizes 1036-1518 bytes (Backport PR [#47443](https://github.com/cilium/cilium/issues/47443), Upstream PR [#44314](https://github.com/cilium/cilium/issues/44314), [@msune](https://github.com/msune)) - chore: use GH\_RUNNER\_CILIUM\_BASE\_AMD64/ARM64 vars for integration-test runners (Backport PR [#47545](https://github.com/cilium/cilium/issues/47545), Upstream PR [#47182](https://github.com/cilium/cilium/issues/47182), [@bogdankrasko](https://github.com/bogdankrasko)) - ci: build race images on push events so conformance-race works on stable branches (Backport PR [#47610](https://github.com/cilium/cilium/issues/47610), Upstream PR [#47608](https://github.com/cilium/cilium/issues/47608), [@aanm](https://github.com/aanm)) - ci: build race images on push in the stable image builders (Backport PR [#47610](https://github.com/cilium/cilium/issues/47610), Upstream PR [#47616](https://github.com/cilium/cilium/issues/47616), [@aanm](https://github.com/aanm)) - ci: draft renovate PRs until ciliumbot auto-approval (Backport PR [#47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#47364](https://github.com/cilium/cilium/issues/47364), [@mhofstetter](https://github.com/mhofstetter)) - ci: fix filtering out md files in bpf checks (Backport PR [#47688](https://github.com/cilium/cilium/issues/47688), Upstream PR [#47605](https://github.com/cilium/cilium/issues/47605), [@nebril](https://github.com/nebril)) - ci: fix three renovate-PR CI flakes (kubectl download retry, merge-upload ref, EKS pool zones) (Backport PR [#47541](https://github.com/cilium/cilium/issues/47541), Upstream PR [#47357](https://github.com/cilium/cilium/issues/47357), [@aanm](https://github.com/aanm)) - CI: fixed external-target readiness gating and ensured sig-network E2E JUnit reports are uploaded on failure. (Backport PR [#47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#46860](https://github.com/cilium/cilium/issues/46860), [@aanm](https://github.com/aanm)) - ci: migrate set-commit-status to cilium/actions (Backport PR [#47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#47771](https://github.com/cilium/cilium/issues/47771), [@bogdankrasko](https://github.com/bogdankrasko)) - ci: skip etcd log fetch when kvstore was never started (Backport PR [#47886](https://github.com/cilium/cilium/issues/47886), Upstream PR [#47801](https://github.com/cilium/cilium/issues/47801), [@aanm](https://github.com/aanm)) - Collect /proc/net/softnet\_stat, /proc/net/snmp and /proc/net/netstat in sysdumps to help diagnose host-level packet drops. (Backport PR [#47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#46985](https://github.com/cilium/cilium/issues/46985), [@aanm](https://github.com/aanm)) - complexity-diff: Compute percentages of diffs against original values (Backport PR [#47836](https://github.com/cilium/cilium/issues/47836), Upstream PR [#45657](https://github.com/cilium/cilium/issues/45657), [@pchaigno](https://github.com/pchaigno)) - complexity-diff: Display results on scheduled runs (Backport PR [#47721](https://github.com/cilium/cilium/issues/47721), Upstream PR [#45595](https://github.com/cilium/cilium/issues/45595), [@pchaigno](https://github.com/pchaigno)) - conformance-aws-cni: skip l7 and fqdn tests by name on chaining mode (Backport PR [#47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#47269](https://github.com/cilium/cilium/issues/47269), [@aanm](https://github.com/aanm)) - datapath/loader: Fix stack depth parsing for programs with functions (Backport PR [#47814](https://github.com/cilium/cilium/issues/47814), Upstream PR [#44963](https://github.com/cilium/cilium/issues/44963), [@dylandreimerink](https://github.com/dylandreimerink)) - Decrease CI costs on AWS (Backport PR [#47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#46615](https://github.com/cilium/cilium/issues/46615), [@aanm](https://github.com/aanm)) - Fix stack depth reporting in verifier test (Backport PR [#47836](https://github.com/cilium/cilium/issues/47836), Upstream PR [#46182](https://github.com/cilium/cilium/issues/46182), [@pchaigno](https://github.com/pchaigno)) - gateway-api: fix gatewayclassconfig-nodeport test (Backport PR [#47468](https://github.com/cilium/cilium/issues/47468), Upstream PR [#47255](https://github.com/cilium/cilium/issues/47255), [@0xch4z](https://github.com/0xch4z)) - gha/e2e: cover etcd behind a service (Backport PR [#47410](https://github.com/cilium/cilium/issues/47410), Upstream PR [#47235](https://github.com/cilium/cilium/issues/47235), [@giorio94](https://github.com/giorio94)) - gha/kubespray: run on schedule, rather than on every push (Backport PR [#47734](https://github.com/cilium/cilium/issues/47734), Upstream PR [#47719](https://github.com/cilium/cilium/issues/47719), [@giorio94](https://github.com/giorio94)) - gha/lvh-kind: respect Kind image version also when config is provided (Backport PR [#47734](https://github.com/cilium/cilium/issues/47734), Upstream PR [#47703](https://github.com/cilium/cilium/issues/47703), [@giorio94](https://github.com/giorio94)) - gha: don't install LLVM and Clang in integration tests workflow (Backport PR [#47734](https://github.com/cilium/cilium/issues/47734), Upstream PR [#47717](https://github.com/cilium/cilium/issues/47717), [@giorio94](https://github.com/giorio94)) - gha: dump nodegroup CloudFormation failure events on create failure (Backport PR [#47410](https://github.com/cilium/cilium/issues/47410), Upstream PR [#47298](https://github.com/cilium/cilium/issues/47298), [@aanm](https://github.com/aanm)) - gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR [#47734](https://github.com/cilium/cilium/issues/47734), Upstream PR [#47724](https://github.com/cilium/cilium/issues/47724), [@giorio94](https://github.com/giorio94)) - gha: stop scheduled runs emitting spurious artifact warnings (Backport PR [#47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#46989](https://github.com/cilium/cilium/issues/46989), [@aanm](https://github.com/aanm)) - images/scripts: Validate Envoy image vars against sed injection (Backport PR [#47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#47205](https://github.com/cilium/cilium/issues/47205), [@MasloMaslane](https://github.com/MasloMaslane)) - Increase the timeout for the kvstore readiness wait in kind-based CI to avoid flakes on slow etcd image pulls. (Backport PR [#47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#46882](https://github.com/cilium/cilium/issues/46882), [@aanm](https://github.com/aanm)) - loader: Reduce number of permutations for load-time configs (Backport PR [#47721](https://github.com/cilium/cilium/issues/47721), Upstream PR [#44409](https://github.com/cilium/cilium/issues/44409), [@pchaigno](https://github.com/pchaigno)) - loader: Support max stack depth in verifier logs (Backport PR [#47836](https://github.com/cilium/cilium/issues/47836), Upstream PR [#46109](https://github.com/cilium/cilium/issues/46109), [@pchaigno](https://github.com/pchaigno)) - loader: Support newer verifier logs (Backport PR [#47836](https://github.com/cilium/cilium/issues/47836), Upstream PR [#45880](https://github.com/cilium/cilium/issues/45880), [@pchaigno](https://github.com/pchaigno)) - pkg/loadbalancer: fix loadbalancer nodeport collision test (Backport PR [#47414](https://github.com/cilium/cilium/issues/47414), Upstream PR [#46087](https://github.com/cilium/cilium/issues/46087), [@ajmmm](https://github.com/ajmmm)) - pkg/rate: fix TestMaxParallelRequests flake under CI load (Backport PR [#47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#46856](https://github.com/cilium/cilium/issues/46856), [@aanm](https://github.com/aanm)) - Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR [#47886](https://github.com/cilium/cilium/issues/47886), Upstream PR [#47780](https://github.com/cilium/cilium/issues/47780), [@giorio94](https://github.com/giorio94)) - test/cyclonus: capture logs of every job pod so a runner crash is diagnosable (Backport PR [#47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#46980](https://github.com/cilium/cilium/issues/46980), [@aanm](https://github.com/aanm)) - test/cyclonus: drop --fail-fast so a policy failure can't crash the run (Backport PR [#47410](https://github.com/cilium/cilium/issues/47410), Upstream PR [#47272](https://github.com/cilium/cilium/issues/47272), [@aanm](https://github.com/aanm)) - test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR [#47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#47725](https://github.com/cilium/cilium/issues/47725), [@aanm](https://github.com/aanm)) - workflows/verifier: Fail on high complexity, stack depth or map count (Backport PR [#47721](https://github.com/cilium/cilium/issues/47721), Upstream PR [#45659](https://github.com/cilium/cilium/issues/45659), [@pchaigno](https://github.com/pchaigno)) - workflows/verifier: Fix again always-passing workflow status (Backport PR [#47721](https://github.com/cilium/cilium/issues/47721), Upstream PR [#45899](https://github.com/cilium/cilium/issues/45899), [@pchaigno](https://github.com/pchaigno)) - workflows/verifier: Fix always-passing workflow status (Backport PR [#47721](https://github.com/cilium/cilium/issues/47721), Upstream PR [#45835](https://github.com/cilium/cilium/issues/45835), [@pchaigno](https://github.com/pchaigno)) - workflows/verifier: Fix commit status (Backport PR [#47721](https://github.com/cilium/cilium/issues/47721), Upstream PR [#46382](https://github.com/cilium/cilium/issues/46382), [@pchaigno](https://github.com/pchaigno)) - workflows/verifier: Wait for `complexity-diff` to set workflow status (Backport PR [#47721](https://github.com/cilium/cilium/issues/47721), Upstream PR [#45681](https://github.com/cilium/cilium/issues/45681), [@pchaigno](https://github.com/pchaigno)) **Misc Changes:** - allocator: fix flake in TestWatchRemoteKVStore (Backport PR [#47688](https://github.com/cilium/cilium/issues/47688), Upstream PR [#47455](https://github.com/cilium/cilium/issues/47455), [@giorio94](https://github.com/giorio94)) - bpf, testing: define scapy buffers as canonical C variables. (Backport PR [#47443](https://github.com/cilium/cilium/issues/47443), Upstream PR [#44893](https://github.com/cilium/cilium/issues/44893), [@ldelossa](https://github.com/ldelossa)) - bpf/analyze: Always visit global functions (Backport PR [#47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#45917](https://github.com/cilium/cilium/issues/45917), [@pchaigno](https://github.com/pchaigno)) - bpf/lxc: Never allocate `ct_buffers` on stack (Backport PR [#47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#45603](https://github.com/cilium/cilium/issues/45603), [@pchaigno](https://github.com/pchaigno)) - bpf/nat: Move IPv6 nat entry to map (Backport PR [#47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#47762](https://github.com/cilium/cilium/issues/47762), [@pchaigno](https://github.com/pchaigno)) - bpf: conntrack: Reduce stack usage of `ct_create{4,6}` (Backport PR [#47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#47582](https://github.com/cilium/cilium/issues/47582), [@dylandreimerink](https://github.com/dylandreimerink)) - bpf: encap: move & use DSR-GENEVE helpers (Backport PR [#47460](https://github.com/cilium/cilium/issues/47460), Upstream PR [#45526](https://github.com/cilium/cilium/issues/45526), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: Make `ipv6_hdrlen_with_fraginfo` function global (Backport PR [#47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#46295](https://github.com/cilium/cilium/issues/46295), [@pchaigno](https://github.com/pchaigno)) - bpf: Never allocate `ct_buffers` on the stack (Backport PR [#47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#45589](https://github.com/cilium/cilium/issues/45589), [@pchaigno](https://github.com/pchaigno)) - bpf: Reduce stack size for `tail_handle_snat_fwd_ipv6` (Backport PR [#47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#46360](https://github.com/cilium/cilium/issues/46360), [@pchaigno](https://github.com/pchaigno)) - bpf: rename `aux.h` to avoid malformed file path error upon `go get` (Backport PR [#47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#45804](https://github.com/cilium/cilium/issues/45804), [@tklauser](https://github.com/tklauser)) - bugtool: collect snmp6 and dev\_snmp6 for IPv6 host packet drops (Backport PR [#47410](https://github.com/cilium/cilium/issues/47410), Upstream PR [#47353](https://github.com/cilium/cilium/issues/47353), [@aanm](https://github.com/aanm)) - chore(deps): update all github action dependencies (v1.19) ([#47324](https://github.com/cilium/cilium/issues/47324), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#47490](https://github.com/cilium/cilium/issues/47490), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#47867](https://github.com/cilium/cilium/issues/47867), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#47993](https://github.com/cilium/cilium/issues/47993), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#48009](https://github.com/cilium/cilium/issues/48009), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.19) ([#47679](https://github.com/cilium/cilium/issues/47679), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.19) ([#47489](https://github.com/cilium/cilium/issues/47489), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.19) ([#47950](https://github.com/cilium/cilium/issues/47950), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.19.6 (v1.19) ([#47340](https://github.com/cilium/cilium/issues/47340), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.19) ([#47577](https://github.com/cilium/cilium/issues/47577), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.25.12 docker digest to [`d2e20dc`](https://github.com/cilium/cilium/commit/d2e20dc) (v1.19) ([#47321](https://github.com/cilium/cilium/issues/47321), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.25.12 docker digest to [`fe5d57d`](https://github.com/cilium/cilium/commit/fe5d57d) (v1.19) ([#47866](https://github.com/cilium/cilium/issues/47866), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update gcr.io/distroless/static:nonroot docker digest to [`f7f8f72`](https://github.com/cilium/cilium/commit/f7f8f72) (v1.19) ([#47322](https://github.com/cilium/cilium/issues/47322), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update github/codeql-action action to v4.37.2 (v1.19) ([#47504](https://github.com/cilium/cilium/issues/47504), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update google/cloud-sdk docker tag to v577 (v1.19) ([#47511](https://github.com/cilium/cilium/issues/47511), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260716143926-092fe0c72997 (v1.19) ([#47487](https://github.com/cilium/cilium/issues/47487), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/certgen docker tag to v0.4.8 (v1.19) ([#47323](https://github.com/cilium/cilium/issues/47323), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1784803288-cf56df1cccc09d7afde2847ff9e6e853dde50b77 (v1.19) ([#47488](https://github.com/cilium/cilium/issues/47488), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1786864149-07e8503ff34b9190d7bbe4e57d4e185c4ef8b1de (v1.19) ([#48000](https://github.com/cilium/cilium/issues/48000), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.19) (patch) ([#46316](https://github.com/cilium/cilium/issues/46316), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.19) (patch) ([#47868](https://github.com/cilium/cilium/issues/47868), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.19) (patch) ([#47992](https://github.com/cilium/cilium/issues/47992), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - docs/clustermesh: remove obsolete reference to service cache (Backport PR [#47410](https://github.com/cilium/cilium/issues/47410), Upstream PR [#47195](https://github.com/cilium/cilium/issues/47195), [@giorio94](https://github.com/giorio94)) - docs: add context on recommended CEC and CCEC permissions (Backport PR [#47545](https://github.com/cilium/cilium/issues/47545), Upstream PR [#45056](https://github.com/cilium/cilium/issues/45056), [@ferozsalam](https://github.com/ferozsalam)) - docs: Fix DOCS\_BUILDER\_REPO env variable for BSD sed compatibility (Backport PR [#47829](https://github.com/cilium/cilium/issues/47829), Upstream PR [#46033](https://github.com/cilium/cilium/issues/46033), [@arybolovlev](https://github.com/arybolovlev)) - docs: Update docs-builder for Makefile usage (Backport PR [#47829](https://github.com/cilium/cilium/issues/47829), Upstream PR [#45774](https://github.com/cilium/cilium/issues/45774), [@joestringer](https://github.com/joestringer)) - fix(deps): update k8s.io patch updates stable to v0.35.7 (v1.19) ([#47521](https://github.com/cilium/cilium/issues/47521), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module k8s.io/apimachinery to v0.35.7 (v1.19) ([#47474](https://github.com/cilium/cilium/issues/47474), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Fixed the conformance-ginkgo feature status report not being uploaded as an artifact. (Backport PR [#47541](https://github.com/cilium/cilium/issues/47541), Upstream PR [#47174](https://github.com/cilium/cilium/issues/47174), [@aanm](https://github.com/aanm)) - gateway-api: remove SetAllParentCondition route helpers (Backport PR [#47468](https://github.com/cilium/cilium/issues/47468), Upstream PR [#47086](https://github.com/cilium/cilium/issues/47086), [@0xch4z](https://github.com/0xch4z)) - gha: capture per-pod diagnostics for sig-network conntrack UDP NodePort failures (Backport PR [#47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#47140](https://github.com/cilium/cilium/issues/47140), [@aanm](https://github.com/aanm)) - gha: let auto-approve match on re-runs (Backport PR [#47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#46832](https://github.com/cilium/cilium/issues/46832), [@aanm](https://github.com/aanm)) - images ci: free preinstalled toolchains on tight runners before building (Backport PR [#47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#47141](https://github.com/cilium/cilium/issues/47141), [@aanm](https://github.com/aanm)) - Introduce BPF auxiliary variables (Backport PR [#47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#45081](https://github.com/cilium/cilium/issues/45081), [@dylandreimerink](https://github.com/dylandreimerink)) - policy/k8s: record processing start time for k8s NetworkPolicy updates (Backport PR [#47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#46979](https://github.com/cilium/cilium/issues/46979), [@aanm](https://github.com/aanm)) - Update all github action dependencies (v1.19) ([#47661](https://github.com/cilium/cilium/issues/47661), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update all github action dependencies (v1.19) ([#47676](https://github.com/cilium/cilium/issues/47676), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update docker.io/library/busybox:1.37.0 Docker digest to [`9db7b59`](https://github.com/cilium/cilium/commit/9db7b59) (v1.19) ([#47660](https://github.com/cilium/cilium/issues/47660), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update documentation dependencies (Backport PR [#47829](https://github.com/cilium/cilium/issues/47829), Upstream PR [#47750](https://github.com/cilium/cilium/issues/47750), [@joestringer](https://github.com/joestringer)) - Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.19) ([#47662](https://github.com/cilium/cilium/issues/47662), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.19) ([#47663](https://github.com/cilium/cilium/issues/47663), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) **Other Changes:** - \[v1.19] Add DNS request checking prior to qname extraction ([#47383](https://github.com/cilium/cilium/issues/47383), [@ferozsalam](https://github.com/ferozsalam)) - install: Update image digests for v1.19.6 ([#47252](https://github.com/cilium/cilium/issues/47252), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.19.7@sha256:1b58bcb81c723cf130a0dd2fb2e1132c57f8fbc2ef7bdb85519cfcc36111c77e` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.19.7@sha256:17186e4639900fcaa7c38260bb8ac622ee56b3b805e2452f24b824e84db9e5e6` ##### docker-plugin `quay.io/cilium/docker-plugin:v1.19.7@sha256:1b29323ca48d785946a16c312c983d41bb058e6ebd1e3172f45b25051c1254e7` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.19.7@sha256:db4b384d0f6aba261e809d58bee54885c70a7e958173a125ebb215391af55e74` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.19.7@sha256:22f36b3bf2ec9ae0bdd2ca943f7a18b8a36704dce6959d2ac0eef6527ec3b400` ##### operator-aws `quay.io/cilium/operator-aws:v1.19.7@sha256:7218d710e1b3dbc2039cb3bcf285d3cdd7a89ca482f8be0c868362d14824dd3e` ##### operator-azure `quay.io/cilium/operator-azure:v1.19.7@sha256:572f7f69b470fda8ce068a5acb0961b29b8754bb35f95f27f7f2d838b08c3971` ##### operator-generic `quay.io/cilium/operator-generic:v1.19.7@sha256:61e773bfc25a448f1ad3ead605af94b3ef176ba2925cf4bd1b11e09794b72bed` ##### operator `quay.io/cilium/operator:v1.19.7@sha256:283dddce1845b4375e4a733494ae742acd85fef4d4b1b303338b21898a6e386e` ### [`v1.19.6`](https://github.com/cilium/cilium/releases/tag/v1.19.6): 1.19.6 [Compare Source](https://github.com/cilium/cilium/compare/1.19.5...1.19.6) ## Summary of Changes **Minor Changes:** - datapath/l2responder: use l3 sockets for solicited node multicast signaling (Backport PR [#46845](https://github.com/cilium/cilium/issues/46845), Upstream PR [#46332](https://github.com/cilium/cilium/issues/46332), [@bersoare](https://github.com/bersoare)) - gateway-api: add support for configuring Gateway access logs through the new `spec.telemetry.accessLogs` field in CiliumGatewayClassConfig. (Backport PR [#46933](https://github.com/cilium/cilium/issues/46933), Upstream PR [#46403](https://github.com/cilium/cilium/issues/46403), [@arybolovlev](https://github.com/arybolovlev)) **Bugfixes:** - \[v1.19] Fix policy service label selector handling ([#46946](https://github.com/cilium/cilium/issues/46946), [@fristonio](https://github.com/fristonio)) - bpf: fix ipv6 neighbor solicitation handling in host firewall (Backport PR [#46669](https://github.com/cilium/cilium/issues/46669), Upstream PR [#46325](https://github.com/cilium/cilium/issues/46325), [@atykhyy](https://github.com/atykhyy)) - doublewrite: Don't run CRD backend with real handler when reading from KVStore (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#47144](https://github.com/cilium/cilium/issues/47144), [@HadrienPatte](https://github.com/HadrienPatte)) - endpoint: Fix race when reading endpoint properties (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#46991](https://github.com/cilium/cilium/issues/46991), [@gandro](https://github.com/gandro)) - Fix `cilium_operator_unmanaged_pods` gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (Backport PR [#46975](https://github.com/cilium/cilium/issues/46975), Upstream PR [#46668](https://github.com/cilium/cilium/issues/46668), [@Suyash1700](https://github.com/Suyash1700)) - Fix a bug which could lead to stale hostport entries if a pod was deleted and immediately recreated in host network. (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#46747](https://github.com/cilium/cilium/issues/46747), [@giorio94](https://github.com/giorio94)) - Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (Backport PR [#46974](https://github.com/cilium/cilium/issues/46974), Upstream PR [#46927](https://github.com/cilium/cilium/issues/46927), [@aanm](https://github.com/aanm)) - Fix allowedRoute namespace and kind restrictions on multi-listener Gateways. (Backport PR [#46826](https://github.com/cilium/cilium/issues/46826), Upstream PR [#45693](https://github.com/cilium/cilium/issues/45693), [@eufriction](https://github.com/eufriction)) - Fix bug that left the host firewall enabled in the live ConfigMap when disabling hostFirewall.enabled (toggling it from true to false) via Helm. (Backport PR [#46669](https://github.com/cilium/cilium/issues/46669), Upstream PR [#44748](https://github.com/cilium/cilium/issues/44748), [@shibaPuppy](https://github.com/shibaPuppy)) - Fix ClusterMesh service affinity annotation `service.cilium.io/affinity: "none"` incorrectly dropping all remote backends, causing traffic blackhole when no local endpoints exist. (Backport PR [#46691](https://github.com/cilium/cilium/issues/46691), Upstream PR [#46635](https://github.com/cilium/cilium/issues/46635), [@mkamadeus](https://github.com/mkamadeus)) - Fix ctmap gc duration metric recording (Backport PR [#46975](https://github.com/cilium/cilium/issues/46975), Upstream PR [#46873](https://github.com/cilium/cilium/issues/46873), [@fristonio](https://github.com/fristonio)) - Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR [#47002](https://github.com/cilium/cilium/issues/47002), Upstream PR [#46821](https://github.com/cilium/cilium/issues/46821), [@fristonio](https://github.com/fristonio)) - Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#46967](https://github.com/cilium/cilium/issues/46967), [@ysksuzuki](https://github.com/ysksuzuki)) - Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#46444](https://github.com/cilium/cilium/issues/46444), [@giorio94](https://github.com/giorio94)) - Fix the UDP tunnel check in the BIG TCP probe. (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#46710](https://github.com/cilium/cilium/issues/46710), [@gentoo-root](https://github.com/gentoo-root)) - Fixes a bug where Hubble policy correlation does not work for port ranges. (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#46643](https://github.com/cilium/cilium/issues/46643), [@squeed](https://github.com/squeed)) - gateway-api: Add Gateway check for when hostNetwork is enabled (Backport PR [#46837](https://github.com/cilium/cilium/issues/46837), Upstream PR [#46350](https://github.com/cilium/cilium/issues/46350), [@xtineskim](https://github.com/xtineskim)) - gateway-api: Each HTTPS and TLS passthrough port now receives its own Envoy listener and RouteConfiguration. (Backport PR [#46826](https://github.com/cilium/cilium/issues/46826), Upstream PR [#44889](https://github.com/cilium/cilium/issues/44889), [@eufriction](https://github.com/eufriction)) - ipam/multi-pool: Do now wait for zero prealloc request (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#46867](https://github.com/cilium/cilium/issues/46867), [@pippolo84](https://github.com/pippolo84)) - operator: Fix nil-pointer panic in CiliumNode GC (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#47127](https://github.com/cilium/cilium/issues/47127), [@HadrienPatte](https://github.com/HadrienPatte)) **CI Changes:** - .github: Generate CI binaries with correct module version (Backport PR [#47099](https://github.com/cilium/cilium/issues/47099), Upstream PR [#46742](https://github.com/cilium/cilium/issues/46742), [@joestringer](https://github.com/joestringer)) - chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR [#46920](https://github.com/cilium/cilium/issues/46920), Upstream PR [#46840](https://github.com/cilium/cilium/issues/46840), [@sekhar-isovalent](https://github.com/sekhar-isovalent)) - ci: Auth to image registry in clustermesh upgrade workflow (Backport PR [#46691](https://github.com/cilium/cilium/issues/46691), Upstream PR [#46632](https://github.com/cilium/cilium/issues/46632), [@nebril](https://github.com/nebril)) - ci: Remove merge\_group from tests-smoke-conformance.yaml (Backport PR [#46888](https://github.com/cilium/cilium/issues/46888), Upstream PR [#46451](https://github.com/cilium/cilium/issues/46451), [@nebril](https://github.com/nebril)) - Fix workflow change detection for single-commit PRs to main (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#46684](https://github.com/cilium/cilium/issues/46684), [@Demiserular](https://github.com/Demiserular)) - Further GC ratchet test fix races (Backport PR [#47224](https://github.com/cilium/cilium/issues/47224), Upstream PR [#43075](https://github.com/cilium/cilium/issues/43075), [@tommyp1ckles](https://github.com/tommyp1ckles)) **Misc Changes:** - (minor) docs: update reference to aws-cli image (Backport PR [#46975](https://github.com/cilium/cilium/issues/46975), Upstream PR [#46923](https://github.com/cilium/cilium/issues/46923), [@squeed](https://github.com/squeed)) - .github: allow fork PR checkout with actions/checkout v7 (Backport PR [#47135](https://github.com/cilium/cilium/issues/47135), Upstream PR [#47133](https://github.com/cilium/cilium/issues/47133), [@aanm](https://github.com/aanm)) - \[v1.19] - .github/workflows: unpin cilium/cilium self-references to track main ([#46613](https://github.com/cilium/cilium/issues/46613), [@aanm](https://github.com/aanm)) - \[v1.19] - Reapply ".github/workflows: do not use deployments for environments" ([#46574](https://github.com/cilium/cilium/issues/46574), [@aanm](https://github.com/aanm)) - \[v1.19] vendor: bump github.com/cilium/statedb to v0.5.9 ([#47083](https://github.com/cilium/cilium/issues/47083), [@giorio94](https://github.com/giorio94)) - bgp: fix status condition reporting: update reasons to accurately reflect current condition state (Backport PR [#46920](https://github.com/cilium/cilium/issues/46920), Upstream PR [#46383](https://github.com/cilium/cilium/issues/46383), [@martonra](https://github.com/martonra)) - bpf: Condition ICMP SNAT on BPF masquerading and inter-cluster SNAT (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#47021](https://github.com/cilium/cilium/issues/47021), [@pchaigno](https://github.com/pchaigno)) - chore(deps): update all github action dependencies (v1.19) ([#46658](https://github.com/cilium/cilium/issues/46658), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#46908](https://github.com/cilium/cilium/issues/46908), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#47109](https://github.com/cilium/cilium/issues/47109), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.19) ([#46906](https://github.com/cilium/cilium/issues/46906), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.19) ([#47045](https://github.com/cilium/cilium/issues/47045), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update aws-actions/configure-aws-credentials action to v6.2.2 (v1.19) ([#47124](https://github.com/cilium/cilium/issues/47124), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.19) ([#46774](https://github.com/cilium/cilium/issues/46774), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images to v1.25.12 (v1.19) ([#46982](https://github.com/cilium/cilium/issues/46982), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.19.5 (v1.19) ([#46726](https://github.com/cilium/cilium/issues/46726), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/alpine docker tag to v3.23.5 (v1.19) ([#46773](https://github.com/cilium/cilium/issues/46773), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.25.11 docker digest to [`00feed3`](https://github.com/cilium/cilium/commit/00feed3) (v1.19) ([#46657](https://github.com/cilium/cilium/issues/46657), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/certgen docker tag to v0.4.6 (v1.19) ([#47039](https://github.com/cilium/cilium/issues/47039), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc (v1.19) ([#46700](https://github.com/cilium/cilium/issues/46700), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/image-tester docker tag to v1783861476 (v1.19) ([#47122](https://github.com/cilium/cilium/issues/47122), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore: BYOCNI loopback for cilium (Backport PR [#46691](https://github.com/cilium/cilium/issues/46691), Upstream PR [#46646](https://github.com/cilium/cilium/issues/46646), [@sekhar-isovalent](https://github.com/sekhar-isovalent)) - chore: optimize building gops and cni/loopback (Backport PR [#46845](https://github.com/cilium/cilium/issues/46845), Upstream PR [#46781](https://github.com/cilium/cilium/issues/46781), [@sekhar-isovalent](https://github.com/sekhar-isovalent)) - ci: always set fail-fast to false on image builds (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#47064](https://github.com/cilium/cilium/issues/47064), [@aanm](https://github.com/aanm)) - ci: remove non-ariane workflows from config (Backport PR [#46845](https://github.com/cilium/cilium/issues/46845), Upstream PR [#46787](https://github.com/cilium/cilium/issues/46787), [@nebril](https://github.com/nebril)) - clustermesh: add reusable backend selector constructor (Backport PR [#46691](https://github.com/cilium/cilium/issues/46691), Upstream PR [#45648](https://github.com/cilium/cilium/issues/45648), [@viktor-kurchenko](https://github.com/viktor-kurchenko)) - docs: clarify Hubble static/dynamic exporter file rotation settings (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#47026](https://github.com/cilium/cilium/issues/47026), [@maksymbilokur-cisco](https://github.com/maksymbilokur-cisco)) - docs: fix note about ipv4-native-routing-cidr default value (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#46603](https://github.com/cilium/cilium/issues/46603), [@rptaylor](https://github.com/rptaylor)) - Egress Gateway: handle nil events (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#46476](https://github.com/cilium/cilium/issues/46476), [@tommyp1ckles](https://github.com/tommyp1ckles)) - endpoint: reap restart-preserved policy map entries once ready (Backport PR [#47063](https://github.com/cilium/cilium/issues/47063), Upstream PR [#47062](https://github.com/cilium/cilium/issues/47062), [@aanm](https://github.com/aanm)) - endpoint: sync desired policy before reload on the restore path (restore-path hardening) (Backport PR [#47076](https://github.com/cilium/cilium/issues/47076), Upstream PR [#47075](https://github.com/cilium/cilium/issues/47075), [@aanm](https://github.com/aanm)) - Fix instance of cilium having incorrect specified policy\_change\_total failure label "failure" value which caused unnecessary warnings. (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#46388](https://github.com/cilium/cilium/issues/46388), [@tommyp1ckles](https://github.com/tommyp1ckles)) - Fix instance of cilium having incorrect specified policy\_change\_total failure label "failure" value which caused unnecessary warnings. (Backport PR [#46845](https://github.com/cilium/cilium/issues/46845), Upstream PR [#46388](https://github.com/cilium/cilium/issues/46388), [@tommyp1ckles](https://github.com/tommyp1ckles)) - fix(deps): update k8s.io/utils digest to [`be93311`](https://github.com/cilium/cilium/commit/be93311) (v1.19) ([#46907](https://github.com/cilium/cilium/issues/46907), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update k8s.io/utils digest to [`cf1189d`](https://github.com/cilium/cilium/commit/cf1189d) (v1.19) ([#47115](https://github.com/cilium/cilium/issues/47115), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Fixed Gateway API reconciler incorrectly reporting "Accepted HTTPRoute" in the status condition message for GRPCRoute and TLSRoute resources. (Backport PR [#46826](https://github.com/cilium/cilium/issues/46826), Upstream PR [#44962](https://github.com/cilium/cilium/issues/44962), [@eufriction](https://github.com/eufriction)) - gateway-api: return model from Gateway API ingestion (Backport PR [#46933](https://github.com/cilium/cilium/issues/46933), Upstream PR [#46450](https://github.com/cilium/cilium/issues/46450), [@arybolovlev](https://github.com/arybolovlev)) - gha: fail fast in external-target provisioning scripts instead of swallowing failures (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#47085](https://github.com/cilium/cilium/issues/47085), [@aanm](https://github.com/aanm)) - Improve cilium-dbg status output of module health (Backport PR [#46845](https://github.com/cilium/cilium/issues/46845), Upstream PR [#46739](https://github.com/cilium/cilium/issues/46739), [@joestringer](https://github.com/joestringer)) - loadbalancer: proxy ports are now resolved per frontend instead of per service, preventing one port from losing its L7 redirect when multiple listeners share a service. (Backport PR [#46826](https://github.com/cilium/cilium/issues/46826), Upstream PR [#45949](https://github.com/cilium/cilium/issues/45949), [@eufriction](https://github.com/eufriction)) - loadbalancer: validate DSR dispatch configuration globally (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#45545](https://github.com/cilium/cilium/issues/45545), [@FelipeYepez](https://github.com/FelipeYepez)) - Makefile: Generate full Cilium version in worktree (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#46737](https://github.com/cilium/cilium/issues/46737), [@joestringer](https://github.com/joestringer)) - Revert restore-path policy map changes ([#46927](https://github.com/cilium/cilium/issues/46927), [#47062](https://github.com/cilium/cilium/issues/47062), [#47075](https://github.com/cilium/cilium/issues/47075)) (Backport PR [#47213](https://github.com/cilium/cilium/issues/47213), Upstream PR [#47202](https://github.com/cilium/cilium/issues/47202), [@aanm](https://github.com/aanm)) - Upgraded cilium/ebpf to version v0.22.0 (Backport PR [#46845](https://github.com/cilium/cilium/issues/46845), Upstream PR [#46783](https://github.com/cilium/cilium/issues/46783), [@dylandreimerink](https://github.com/dylandreimerink)) **Other Changes:** - install: Update image digests for v1.19.5 ([#46593](https://github.com/cilium/cilium/issues/46593), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) - v1.19: gateway-api: fix sds secrets in golden tests ([#47229](https://github.com/cilium/cilium/issues/47229), [@0xch4z](https://github.com/0xch4z)) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.19.6@sha256:accab5fe6ab7134fcd6f916acc9e4c785382a022128ae5495ec4a45fbe18c9a6` ##### docker-plugin `quay.io/cilium/docker-plugin:v1.19.6@sha256:81a8d37e541edfff4016037373853e8e875f1ea0433c58b9ab54b314c305b9ec` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.19.6@sha256:6782a49e3f28eba015701c4410a5ec7fa096fe9a562f879b4372dbecd827ea44` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.19.6@sha256:031e332cdec61a9ebaca42f044e7e2f5b876ba96ac0ccf1d42acd5954779efaf` ##### operator-aws `quay.io/cilium/operator-aws:v1.19.6@sha256:546d13ac511cf82441b5e9e99e03d0e054b788513ceb1a883e620b8284d5ccc3` ##### operator-azure `quay.io/cilium/operator-azure:v1.19.6@sha256:e555430b7f5e4c407daab1afbec3c431ec016a53f1f1b848f67b9242cd3adedd` ##### operator-generic `quay.io/cilium/operator-generic:v1.19.6@sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665` ##### operator `quay.io/cilium/operator:v1.19.6@sha256:37e36840be5a0882a9a065b2308859785e960a742aed0aeac794e0ac4aabdf90` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-07-16 17:06:25 +00:00

Update Helm release cilium to v1.19.6

ci/crow/push/dns-test Pipeline failed

Details

ci/crow/pr/dns-test Pipeline failed

Details

ci/crow/pr/tanka-test Pipeline failed

Details

ci/crow/push/tanka-test Pipeline failed

Details

a9ba7a00af

renovate-bot changed title from ~~Update Helm release cilium to v1.19.6~~ to chore(deps): update helm release cilium to v1.19.6

2026-07-17 23:08:38 +00:00

renovate-bot changed title from ~~chore(deps): update helm release cilium to v1.19.6~~ to Update Helm release cilium to v1.19.6

2026-07-21 01:06:34 +00:00

renovate-bot changed title from ~~Update Helm release cilium to v1.19.6~~ to chore(deps): update helm release cilium to v1.19.6

2026-07-21 02:06:46 +00:00

renovate-bot changed title from ~~chore(deps): update helm release cilium to v1.19.6~~ to chore(deps): update helm release cilium to v1.20.0

2026-08-01 01:12:45 +00:00

renovate-bot force-pushed renovate/cilium-1.x from 8f13738683 to 10802f631e

2026-09-21 19:17:36 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update helm release cilium to v1.20.0~~ to chore(deps): update helm release cilium to v1.20.2

2026-09-21 19:17:53 +00:00

renovate-bot force-pushed renovate/cilium-1.x from 10802f631e to 30e0bbf70d

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

2026-10-15 15:10:44 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update helm release cilium to v1.20.2~~ to chore(deps): update helm release cilium to v1.20.3

2026-10-15 15:10:49 +00:00

renovate-bot changed title from ~~chore(deps): update helm release cilium to v1.20.3~~ to chore(deps): update helm release cilium to v1.20.4

2026-10-23 15:12:07 +00:00

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

This pull request is broken due to missing fork information.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/cilium-1.x:renovate/cilium-1.x

git switch renovate/cilium-1.x

Merge

Merge the changes and update on Forgejo.

git switch main

git merge --no-ff renovate/cilium-1.x

git switch renovate/cilium-1.x

git rebase main

git switch main

git merge --ff-only renovate/cilium-1.x

git switch renovate/cilium-1.x

git rebase main

git switch main

git merge --no-ff renovate/cilium-1.x

git switch main

git merge --squash renovate/cilium-1.x

git switch main

git merge --ff-only renovate/cilium-1.x

git switch main

git merge renovate/cilium-1.x

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

ops/homelab!93

No description provided.

Rows
Columns

chore(deps): update helm release cilium to v1.20.4 #93

Release Notes

v1.20.4: 1.20.4

Security patch release

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.20.3: 1.20.3

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.20.2: 1.20.2

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.20.1: 1.20.1

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.20.0: 1.20.0

Docker Manifests

cilium

clustermesh-apiserver

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.19.10: 1.19.10

Security patch release

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.19.9: 1.19.9

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

`v1.20.4`: 1.20.4

`v1.20.3`: 1.20.3

`v1.20.2`: 1.20.2

`v1.20.1`: 1.20.1

`v1.20.0`: 1.20.0

`v1.19.10`: 1.19.10

`v1.19.9`: 1.19.9

`v1.19.8`: 1.19.8

`v1.19.7`: 1.19.7

`v1.19.6`: 1.19.6