Summary of Changes

Minor Changes

• alibabacloud: support IMDSv2 (token-based) instance metadata access (Backport PR #49336, Upstream PR #49182, @4n4nd)
• Fix conntrack garbage collection deleting CT entries that the datapath reopened between the GC batch read and the delete, which could cascade into NAT mapping deletion and SNAT source-port reallocation for live connections. (Backport PR #49119, Upstream PR #46750, @gyutaeb)
• operator: prevent CNPs with nodeSelector from silently enforcing nothing (Backport PR #49173, Upstream PR #47882, @weizhoublue)

Bugfixes

• azure: Fixed an issue where an interface with an empty MAC field would be reported back the the cilium agent causing it to crash on startup when trying to configure the routes. (Backport PR #49336, Upstream PR #48648, @41ks)
• bpf: icmp: use 576 byte of inner packet to avoid partial csum floor (Backport PR #48907, Upstream PR #48578, @tommyp1ckles)
• cilium-dbg: Print port numbers correctly for map cilium_lb*_reverse_sk (Backport PR #49336, Upstream PR #47134, @jayl1e)
• daemon: fix a bug where L7 DNS policies could remain loaded in the datapath during agent shutdown, causing pods under a wildcard toFQDNs policy to lose DNS resolution for the duration of the restart. (Backport PR #48907, Upstream PR #48747, @41ks)
• endpoint/restore: skip cleanup for reserved internal endpoints (Backport PR #48999, Upstream PR #48272, @fristonio)
• envoy: handle listener additional address changes (Backport PR #48917, Upstream PR #48712, @nezdolik)
• envoy: handle listener address changes in ADS (Backport PR #48917, Upstream PR #48798, @nezdolik)
• envoy: track coalesced ADS snapshot updates (Backport PR #48917, Upstream PR #48631, @nezdolik)
• Fix Gateway API ExternalAuth dropping request bodies when allowedResponseHeaders is unset (Backport PR #49189, Upstream PR #48770, @kirgene)
• Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint (Backport PR #49189, Upstream PR #48905, @fristonio)
• Fix ip6tables chain rename errors being silently ignored during iptables rule reconciliation. (Backport PR #49336, Upstream PR #49024, @maxskokov)
• Fix panic in agent when CiliumLocalRedirectPolicy redirectBackend.toPorts is declared as an empty array. The agent will now reject such a policy. (Backport PR #48907, Upstream PR #48491, @ajmmm)
• Fix PMTU/ICMP replies for IPIP/Geneve DSR for GRO skbs (Backport PR #49189, Upstream PR #48489, @borkmann)
• Fix rare data race in selector cache that could lead to agent panic (Backport PR #49189, Upstream PR #47733, @odinuge)
• Fix restoration of terminating backends. If a terminating backend become active again during restart the backend was incorrectly kept as quarantined. (Backport PR #48797, Upstream PR #48763, @joamaki)
• Fixes a bug where Hubble flows may list the incorrect policy that allowed or denied a flow (Backport PR #49189, Upstream PR #49086, @tsotne95)
• Fixes a bug where the helm value hubble.tls.auto.privateKey settings are no longer ignored in Hubble cert-manager certificates (Backport PR #49189, Upstream PR #49114, @byxorna)
• Fixes an issue where CiliumCIDRGroups with zero-length cidrs (i.e. 0.0.0.0/0) inadvertently selected no traffic. (Backport PR #49336, Upstream PR #48366, @squeed)
• gateway-api: filter CEC controls from infrastructure metadata (Backport PR #48984, Upstream PR #47732, @nezdolik)
• gateway-api: make HTTP route ordering deterministic (Backport PR #49336, Upstream PR #48951, @abduu11aahh)
• gateway-api: Support system CA certificates in BackendTLSPolicy. (Backport PR #49336, Upstream PR #48895, @shreyasrajiv327)
• infraendpoints: Release the health IPv4 when the IPv6 allocation fails (Backport PR #48907, Upstream PR #48816, @HadrienPatte)
• k8s/resource: fix leaked event finalizer on unobserved delete (Backport PR #48907, Upstream PR #48785, @tklauser)
• L7 conformance CI fixes (Backport PR #48999, Upstream PR #47517, @fristonio)
• operator: Do not emit warning when deleting already deleted unmanaged pod (Backport PR #48907, Upstream PR #48765, @gandro)
• operator: fix metrics list default address to work on IPv6-only clusters with dual stack nodes by trying both IPv4 and IPv6 loopback addresses (Backport PR #48907, Upstream PR #48780, @41ks)
• Set ipv6 routing rules when dual stack is enabled (Backport PR #49336, Upstream PR #49188, @fcrespofastly)
• Sockets are no longer destroyed when a Service backend is terminated unless they are still connected to that backend. Unconnected UDP sockets, and sockets that have since disconnected or moved to another backend, used to have their local port silently changed. (Backport PR #49189, Upstream PR #48725, @maxskokov)

CI Changes

• [ci] fix escaping in conformance ginkgo (Backport PR #49189, Upstream PR #48991, @nebril)
• [v1.20] .github: Remove the EKS cluster pool workflows (#49084, @aanm)
• ci: Add support for OIDC (Backport PR #49317, Upstream PR #49007, @aanm)
• ci: cleanup disk space in documentation workflow (Backport PR #48907, Upstream PR #48427, @tklauser)
• ci: Drop the empty floating tag line from CI image digests (Backport PR #49189, Upstream PR #49070, @aanm)
• ci: fix CNI setup and readiness checks in the kubespray job (Backport PR #49336, Upstream PR #48927, @aanm)
• ci: Give Envoy Embedded conformance a bigger runner (Backport PR #49189, Upstream PR #49018, @aanm)
• ci: keep UDPRouteWeightedRouting skipped in the profile job (Backport PR #49189, Upstream PR #49005, @aanm)
• ci: login to docker registry for downgrade image wait (Backport PR #49189, Upstream PR #48983, @nebril)
• ci: Name runner variables after their Ubuntu release and let Renovate bump them (Backport PR #49317, Upstream PR #49065, @aanm)
• ci: Skip redundant setup when base images already exist (Backport PR #49317, Upstream PR #47209, @HadrienPatte)
• ci: Stop passing secrets to the base images workflow (Backport PR #49317, Upstream PR #49082, @aanm)
• gha/conformance-multi-pool: use the local fake external targets (Backport PR #48986, Upstream PR #48558, @aanm)
• gha/e2e-upgrade: gate the after-agent-restart conn-disrupt check (Backport PR #48437, Upstream PR #47440, @aanm)
• gha/setup-aks-cluster: Retry a create that never starts (Backport PR #49317, Upstream PR #48924, @aanm)
• gha: Derive the LVH package cache key once per run (Backport PR #48986, Upstream PR #48656, @aanm)
• gha: don't fail PR tests on reporting errors (Backport PR #49317, Upstream PR #48740, @aanm)
• gha: Grant id-token to the post-release call of release.yaml (Backport PR #49317, Upstream PR #49323, @aanm)
• gha: make external fake targets image configurable (Backport PR #49189, Upstream PR #48941, @giorio94)
• gha: Retry stalled kind image pulls before the install wait expires (Backport PR #49336, Upstream PR #48989, @aanm)
• gha: Skip the duplicate CI image build on push to main (Backport PR #48986, Upstream PR #48736, @aanm)
• gha: survive a GKE zone running out of capacity (Backport PR #48986, Upstream PR #48184, @aanm)
• gha: Tolerate cosign and SBOM failures on pull requests (Backport PR #48986, Upstream PR #48737, @aanm)
• ginkgo: remove Test NodePort with L7 policy tests (Backport PR #49067, Upstream PR #46499, @smagnani96)
• loadbalancer/tests: Fix the graceful termination test restart (Backport PR #49317, Upstream PR #48939, @aanm)
• Migrate Conformance Cluster Mesh workflow to use fake external targets (Backport PR #48654, Upstream PR #48250, @giorio94)
• nodeinit: wait for the kubelet wrapper before writing the bootstrap file (Backport PR #49189, Upstream PR #48739, @aanm)

Misc Changes

• bpf: lxc: switch cilium_nodeport_nat_buffer to auxvar (Backport PR #48741, Upstream PR #48543, @julianwiedmann)
• build: handle git worktrees in documentation make targets (Backport PR #49189, Upstream PR #48966, @utaal)
• chore(deps): update all github action dependencies (v1.20) (#48881, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#49039, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#49152, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#49277, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#48882, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#49153, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#49275, @cilium-renovate[bot])
• chore(deps): update base-images to v1.26.9 (v1.20) (#49262, @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.20.1 (v1.20) (#48978, @cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.31 (v1.20) (#48788, @cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v36.2 (v1.20) (#49038, @cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.38.0 docker digest to fd7dc98 (v1.20) (#49035, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.8 docker digest to 0f063af (v1.20) (#49149, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.8 docker digest to 6c2a553 (v1.20) (#48879, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.9 docker digest to d772206 (v1.20) (#49298, @cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.7.2 (v1.20) (#49036, @cilium-renovate[bot])
• chore(deps): update helm/kind-action action to v1.15.1 (v1.20) (#49289, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.4-1790671085-c3a2a1ff726f00f5b5c0886cab3ad345f97f35b9 (v1.20) (#49111, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1790882336-b64c7306085409b95fb5626db2d2bb7a200b9432 (v1.20) (#49123, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1791291190-5ec36181d464cd75b35b45395a722226cbdd2888 (v1.20) (#49194, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791350265-ae0327a34850b7d1849e8332dbefd4d5bebabe10 (v1.20) (#49216, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791537840-00e749f11f69334c625e53fc1ce2fc6c7f34a51f (v1.20) (#49276, @cilium-renovate[bot])
• chore(deps): update security updates to v1.45.0 [security] (v1.20) (#48814, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#48880, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#49037, @cilium-renovate[bot])
• ciliumendpointslice: Report no CID when the CEP has none (Backport PR #49189, Upstream PR #48933, @aanm)
• connectivity-check: move echo-b to the lower NodePort band (Backport PR #49189, Upstream PR #48926, @aanm)
• docs: note on eBPF ClusterIP translation vs Docker raw-table protection (Backport PR #49189, Upstream PR #47782, @Verbano-Tech)
• envoy: add standalone NPDS unsubscribe regression test (Backport PR #48917, Upstream PR #47818, @nezdolik)
• fix(deps): update k8s.io patch updates stable to v0.36.5 (v1.20) (#49151, @cilium-renovate[bot])
• fix(deps): update module golang.org/x/net to v0.60.0 [security] (v1.20) (#49253, @cilium-renovate[bot])
• fix(deps): update security updates [security] (v1.20) (#48808, @cilium-renovate[bot])
• gateway-api: centralize Gateway validation (Backport PR #48907, Upstream PR #48602, @arybolovlev)
• loadbalancer/writer: add support for SetFrontendSourceRangesFunc (Backport PR #49336, Upstream PR #49068, @0xch4z)

Other Changes

• [v1.20] deps: update gateway api to v1.6.3 (#49305, @mhofstetter)
• [v1.20] node_neighbor_discovery: fix ID in delete query (#48912, @nobleess)
• [v1.20] routing: fix dual-stack ENI router startup with native routing CIDRs (#48709, @monta-riahi)
• install: Update image digests for v1.20.2 (#48751, @cilium-release-bot[bot])

Docker Manifests

cilium

• quay.io/cilium/cilium:v1.20.3@sha256:95cfa5c2427cc6b452c00908778d0566311f572589284af949d06a013db1a849
• quay.io/cilium/cilium:stable@sha256:95cfa5c2427cc6b452c00908778d0566311f572589284af949d06a013db1a849

clustermesh-apiserver

• quay.io/cilium/clustermesh-apiserver:v1.20.3@sha256:5c8dca0d0b77bb593df157be39f6c9c868dc08922bbd0540ac0a56815341b227
• quay.io/cilium/clustermesh-apiserver:stable@sha256:5c8dca0d0b77bb593df157be39f6c9c868dc08922bbd0540ac0a56815341b227

hubble-relay

• quay.io/cilium/hubble-relay:v1.20.3@sha256:c6f819d9c5e0b35ccac63b9f2f1ae213fd9be50588e15d5a444d5d305ad317b5
• quay.io/cilium/hubble-relay:stable@sha256:c6f819d9c5e0b35ccac63b9f2f1ae213fd9be50588e15d5a444d5d305ad317b5

operator-alibabacloud

• quay.io/cilium/operator-alibabacloud:v1.20.3@sha256:615f8c2995e437320571d6f61e623d6848ed3ea357cdaa886ac95bbff29a0b52
• quay.io/cilium/operator-alibabacloud:stable@sha256:615f8c2995e437320571d6f61e623d6848ed3ea357cdaa886ac95bbff29a0b52

operator-aws

• quay.io/cilium/operator-aws:v1.20.3@sha256:49bdd1d54bdf3da2740848c4662854d0d41c0df25cffe8575d71723db08cc0d1
• quay.io/cilium/operator-aws:stable@sha256:49bdd1d54bdf3da2740848c4662854d0d41c0df25cffe8575d71723db08cc0d1

operator-azure

• quay.io/cilium/operator-azure:v1.20.3@sha256:7132b3ff7e33a076ea9fadaa6e4f2b364937ed7b118b92928bdb4706921a2ffa
• quay.io/cilium/operator-azure:stable@sha256:7132b3ff7e33a076ea9fadaa6e4f2b364937ed7b118b92928bdb4706921a2ffa

operator-generic

• quay.io/cilium/operator-generic:v1.20.3@sha256:efdd8d89d6d8f63d21a065fa2f9e17614a2b3ac9371b221af9355f63829e2dbc
• quay.io/cilium/operator-generic:stable@sha256:efdd8d89d6d8f63d21a065fa2f9e17614a2b3ac9371b221af9355f63829e2dbc

operator

• quay.io/cilium/operator:v1.20.3@sha256:c40996c8a413f57db75715e683abc550e7849904aa20b8730822ba532f9b783c
• quay.io/cilium/operator:stable@sha256:c40996c8a413f57db75715e683abc550e7849904aa20b8730822ba532f9b783c

Original source

Summary of Changes

Bugfixes

• endpoint/restore: skip cleanup for reserved internal endpoints (Backport PR #49000, Upstream PR #48272, @fristonio)
• Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint (Backport PR #49176, Upstream PR #48905, @fristonio)
• Fix ip6tables chain rename errors being silently ignored during iptables rule reconciliation. (Backport PR #49334, Upstream PR #49024, @maxskokov)
• Fix rare data race in selector cache that could lead to agent panic (Backport PR #49176, Upstream PR #47733, @odinuge)
• Fix restoration of terminating backends. If a terminating backend become active again during restart the backend was incorrectly kept as quarantined. (Backport PR #48796, Upstream PR #48763, @joamaki)
• gateway-api: filter CEC controls from infrastructure metadata (Backport PR #48985, Upstream PR #47732, @nezdolik)
• L7 conformance CI fixes (Backport PR #49000, Upstream PR #47517, @fristonio)
• operator: Do not emit warning when deleting already deleted unmanaged pod (Backport PR #48908, Upstream PR #48765, @gandro)

CI Changes

• [ci] fix escaping in conformance ginkgo (Backport PR #49176, Upstream PR #48991, @nebril)
• [v1.19] .github: Remove the EKS cluster pool workflows (#49085, @aanm)
• ci: Add support for OIDC (Backport PR #49316, Upstream PR #49007, @aanm)
• ci: cleanup disk space in documentation workflow (Backport PR #48908, Upstream PR #48427, @tklauser)
• ci: Drop the empty floating tag line from CI image digests (Backport PR #49176, Upstream PR #49070, @aanm)
• ci: fix CNI setup and readiness checks in the kubespray job (Backport PR #49334, Upstream PR #48927, @aanm)
• ci: Give Envoy Embedded conformance a bigger runner (Backport PR #49176, Upstream PR #49018, @aanm)
• ci: login to docker registry for downgrade image wait (Backport PR #49176, Upstream PR #48983, @nebril)
• ci: Name runner variables after their Ubuntu release and let Renovate bump them (Backport PR #49316, Upstream PR #49065, @aanm)
• ci: Skip redundant setup when base images already exist (Backport PR #49316, Upstream PR #47209, @HadrienPatte)
• ci: Stop passing secrets to the base images workflow (Backport PR #49316, Upstream PR #49082, @aanm)
• gha/conformance-multi-pool: use the local fake external targets (Backport PR #48987, Upstream PR #48558, @aanm)
• gha/setup-aks-cluster: Retry a create that never starts (Backport PR #49316, Upstream PR #48924, @aanm)
• gha: Derive the LVH package cache key once per run (Backport PR #48987, Upstream PR #48656, @aanm)
• gha: don't fail PR tests on reporting errors (Backport PR #49316, Upstream PR #48740, @aanm)
• gha: Grant id-token to the post-release call of release.yaml (Backport PR #49316, Upstream PR #49323, @aanm)
• gha: make external fake targets image configurable (Backport PR #49176, Upstream PR #48941, @giorio94)
• gha: Retry stalled kind image pulls before the install wait expires (Backport PR #49334, Upstream PR #48989, @aanm)
• gha: Skip the duplicate CI image build on push to main (Backport PR #48987, Upstream PR #48736, @aanm)
• gha: survive a GKE zone running out of capacity (Backport PR #48987, Upstream PR #48184, @aanm)
• gha: Tolerate cosign and SBOM failures on pull requests (Backport PR #48987, Upstream PR #48737, @aanm)
• loadbalancer/tests: Fix the graceful termination test restart (Backport PR #49316, Upstream PR #48939, @aanm)

Misc Changes

• [v1.19] Bump various go modules (#48768, @ferozsalam)
• build: handle git worktrees in documentation make targets (Backport PR #49176, Upstream PR #48966, @utaal)
• chore(deps): update all github action dependencies (v1.19) (#48885, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#49045, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#49157, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#49279, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#48886, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#49158, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#49280, @cilium-renovate[bot])
• chore(deps): update auto-merge-trusted-deps (v1.19) (#49320, @cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#48884, @cilium-renovate[bot])
• chore(deps): update base-images to v1.26.9 (v1.19) (#49154, @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.20.1 (v1.19) (#48979, @cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.31 (v1.19) (#48789, @cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v36.2 (v1.19) (#49044, @cilium-renovate[bot])
• chore(deps): update docker.io/library/alpine docker tag to v3.23.6 (v1.19) (#49041, @cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.37.0 docker digest to bdf57e5 (v1.19) (#49040, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.9 docker digest to d772206 (v1.19) - abandoned (#49299, @cilium-renovate[bot])
• chore(deps): update helm/kind-action action to v1.15.1 (v1.19) (#49295, @cilium-renovate[bot])
• chore(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 [security] (v1.19) (#48815, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1790882336-b64c7306085409b95fb5626db2d2bb7a200b9432 (v1.19) (#49127, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1791291190-5ec36181d464cd75b35b45395a722226cbdd2888 (v1.19) (#49195, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791350265-ae0327a34850b7d1849e8332dbefd4d5bebabe10 (v1.19) (#49217, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791537840-00e749f11f69334c625e53fc1ce2fc6c7f34a51f (v1.19) (#49278, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.19) (patch) (#48883, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.19) (patch) (#49042, @cilium-renovate[bot])
• connectivity-check: move echo-b to the lower NodePort band (Backport PR #49176, Upstream PR #48926, @aanm)
• fix(deps): update k8s.io patch updates stable to v0.35.9 (v1.19) (#49156, @cilium-renovate[bot])
• fix(deps): update module golang.org/x/net to v0.60.0 [security] (v1.19) (#49254, @cilium-renovate[bot])
• fix(deps): update module k8s.io/apimachinery to v0.35.9 (v1.19) (#49043, @cilium-renovate[bot])
• fix(deps): update security updates [security] (v1.19) (#48809, @cilium-renovate[bot])

Other Changes

• [v1.19] node_neighbor_discovery: fix ID in delete query (#48871, @nobleess)
• install: Update image digests for v1.19.8 (#48752, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.9@sha256:f3014d42121a04272cb4a5f4f96dbe7836c9a7919990f17e9b6838e8fd4aa33a

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.9@sha256:032d6fc085cfaccfb02813b9854e8685c5b0da63e0e03b5019f3e6381fe8669d

docker-plugin

quay.io/cilium/docker-plugin:v1.19.9@sha256:bfa40f426c154d7f558ea19d76153af043ab3cbc477b04645130b6f533311f4e

hubble-relay

quay.io/cilium/hubble-relay:v1.19.9@sha256:ec58f6bc69df817c8d78ffd9eb88aa7e10f551e2bba71b4ad03fbdb6e1bc8bd5

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.9@sha256:58a411031bf31b77e9abf2e35ab2417929375f526a71e6359c20caa8f52006d5

operator-aws

quay.io/cilium/operator-aws:v1.19.9@sha256:cd089a3ff79042257f5050d0ffc7d36dc340b028106afbcaa7a4f4614a4e80ad

operator-azure

quay.io/cilium/operator-azure:v1.19.9@sha256:32adcdc31885911d5afd6265ef0e450a399c83c130bea11ede53f951b37ab54c

operator-generic

quay.io/cilium/operator-generic:v1.19.9@sha256:a234406be11ad1bb1d41b111fba2cfe81a099b6c26b2634af95f42f295d35655

operator

quay.io/cilium/operator:v1.19.9@sha256:cf7322f7ee9a1395bbb7562d424cb440c1bd15e70b1640e4abc13d3f70255ffe

Original source

Summary of Changes

Bugfixes:

• Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint (Backport PR #49121, Upstream PR #48905, @fristonio)
• Fix ip6tables chain rename errors being silently ignored during iptables rule reconciliation. (Backport PR #49333, Upstream PR #49024, @maxskokov)
• Fix restoration of terminating backends. If a terminating backend become active again during restart the backend was incorrectly kept as quarantined. (Backport PR #48795, Upstream PR #48763, @joamaki)

CI Changes:

• [ci] fix escaping in conformance ginkgo (Backport PR #49121, Upstream PR #48991, @nebril)
• ci: Add support for OIDC (Backport PR #49315, Upstream PR #49007, @aanm)
• ci: cleanup disk space in documentation workflow (Backport PR #48909, Upstream PR #48427, @tklauser)
• ci: Drop the empty floating tag line from CI image digests (Backport PR #49121, Upstream PR #49070, @aanm)
• ci: fix CNI setup and readiness checks in the kubespray job (Backport PR #49333, Upstream PR #48927, @aanm)
• ci: Give Envoy Embedded conformance a bigger runner (Backport PR #49121, Upstream PR #49018, @aanm)
• ci: login to docker registry for downgrade image wait (Backport PR #49121, Upstream PR #48983, @nebril)
• ci: Name runner variables after their Ubuntu release and let Renovate bump them (Backport PR #49315, Upstream PR #49065, @aanm)
• ci: Skip redundant setup when base images already exist (Backport PR #49315, Upstream PR #47209, @HadrienPatte)
• ci: Stop passing secrets to the base images workflow (Backport PR #49315, Upstream PR #49082, @aanm)
• gha: Derive the LVH package cache key once per run (Backport PR #48988, Upstream PR #48656, @aanm)
• gha: don't fail PR tests on reporting errors (Backport PR #49315, Upstream PR #48740, @aanm)
• gha: Grant id-token to the post-release call of release.yaml (Backport PR #49315, Upstream PR #49323, @aanm)
• gha: make external fake targets image configurable (Backport PR #49121, Upstream PR #48941, @giorio94)
• gha: Retry stalled kind image pulls before the install wait expires (Backport PR #49333, Upstream PR #48989, @aanm)
• gha: survive a GKE zone running out of capacity (Backport PR #48988, Upstream PR #48184, @aanm)

Misc Changes:

• [v1.18] Bump etcd and x/crypto module versions (#48769, @ferozsalam)
• build: handle git worktrees in documentation make targets (Backport PR #49121, Upstream PR #48966, @utaal)
• chore(deps): update all github action dependencies (v1.18) (#48890, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#49050, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#49163, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#49283, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.18) (#48887, @cilium-renovate[bot])
• chore(deps): update auto-merge-trusted-deps (v1.18) (#49321, @cilium-renovate[bot])
• chore(deps): update base-images (v1.18) (#48889, @cilium-renovate[bot])
• chore(deps): update base-images to v1.26.9 (v1.18) (#49263, @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.20.1 (v1.18) (#48980, @cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.31 (v1.18) (#48790, @cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v36.2 (v1.18) (#49049, @cilium-renovate[bot])
• chore(deps): update docker.io/library/alpine docker tag to v3.22.6 (v1.18) (#49047, @cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.37.0 docker digest to bdf57e5 (v1.18) (#49046, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.8 docker digest to 0f063af (v1.18) (#49159, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.9 docker digest to d772206 (v1.18) (#49300, @cilium-renovate[bot])
• chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 534baea (v1.18) (#49160, @cilium-renovate[bot])
• chore(deps): update helm/kind-action action to v1.15.1 (v1.18) (#49296, @cilium-renovate[bot])
• chore(deps): update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.45.0 [security] (v1.18) (#48861, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.7-1790879678-3aca86e6e66670781346552575b4e4685c8b2469 (v1.18) (#49128, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.7-1791018873-971395586d20dcc31cedc8fc9290cf91173014a2 (v1.18) (#49161, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1791291190-5ec36181d464cd75b35b45395a722226cbdd2888 (v1.18) (#49196, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791350265-ae0327a34850b7d1849e8332dbefd4d5bebabe10 (v1.18) (#49218, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791537840-00e749f11f69334c625e53fc1ce2fc6c7f34a51f (v1.18) (#49281, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#48888, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#49048, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#49162, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#49282, @cilium-renovate[bot])
• connectivity-check: move echo-b to the lower NodePort band (Backport PR #49121, Upstream PR #48926, @aanm)
• fix(deps): update module golang.org/x/net to v0.60.0 [security] (v1.18) (#49255, @cilium-renovate[bot])
• fix(deps): update security updates [security] (v1.18) (#48810, @cilium-renovate[bot])

Other Changes:

• [v1.18] node_neighbor_discovery: fix ID in delete query (#48872, @nobleess)
• install: Update image digests for v1.18.14 (#48748, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.15@sha256:ab7ccf148b235887a7824313ddfa3edc10d76fcfb13a38e4d5dd213b08533f0a

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.15@sha256:865239e69ae0af2221de4d88b1316c311e26753be61caa2ee0f3b4308fa0b957

docker-plugin

quay.io/cilium/docker-plugin:v1.18.15@sha256:058e87c42b3d718f484030f7e2f4b94142d85dc62df5d5950922bf756ee2d286

hubble-relay

quay.io/cilium/hubble-relay:v1.18.15@sha256:718c43dbbf1fb7f3a8df54c3739d71657ebf9967232861b1c4c9d6295b23f1a3

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.15@sha256:f1946281b1427016a54caf5a221ce5bcf05835c73fa70c0bd18bfb9c232d2258

operator-aws

quay.io/cilium/operator-aws:v1.18.15@sha256:171c0bfe52b2f96b170267c3117775c1bf2ef371a1e660d040b1842841bd5502

operator-azure

quay.io/cilium/operator-azure:v1.18.15@sha256:0d9f38e41b90bea2f9934cf8c066d1894a518bf3176ff87953b4b82cdb81ee53

operator-generic

quay.io/cilium/operator-generic:v1.18.15@sha256:9b0668bd849b58c01e51db43956f949b8b1b8c11c448c3572edcb8595132ebfb

operator

quay.io/cilium/operator:v1.18.15@sha256:48a9053cc62d04ede83f5f0d8508e507e9e1cd0c3c7e06c719a07c3fc4b0a7be

Original source

Summary of Changes

Major Changes:

LB IPAM: introduce the lbipam.cilium.io/sharing-permit-different-pods annotation to allow sharing an IP between services with externalTrafficPolicy=Local that select different pods. The annotation must be set to "true" on all services in the sharing group and is intended for deployments that steer traffic outside Cilium's built-in announcers. (#45819, @lexfrei)

Minor Changes:

Add Helm values to configure Prometheus metrics container port names for the agent, operator, Envoy, Hubble, Hubble Relay, ClusterMesh API server, KVStoreMesh and etcd, supporting custom scrape configurations that require specific named ports. Existing names remain the defaults. (#48955, @gcampbell12)

Add the internal path template matcher that later PRs use to emit a bounded path label on the Hubble HTTP metrics. No user-facing change on its own. (#47813, @amaanx86)

auth: remove deprecated mutual authentication (#48647, @mhofstetter)

clang: Bump llvm version to v21.1.8 (#48425, @sayboras)

Fix a "No route to host" window on node reboot where BGP advertised routes before BPF programs were attached to native devices. (#46948, @tkna)

Fix conntrack garbage collection deleting CT entries that the datapath reopened between the GC batch read and the delete, which could cascade into NAT mapping deletion and SNAT source-port reallocation for live connections. (#46750, @gyutaeb)

Hubble observer server hardening (#46290, @fristonio)

Hubble Relay startup can now be composed by downstream binaries with additional server options. (#48461, @devodev)

IPsec subnet encryption under ENI, Azure and AlibabaCloud now derives its pod subnets from the VPC CIDRs directly, fixing cases where they were empty (no encryption policies installed) depending on agent startup ordering. AlibabaCloud gains subnet encryption, and the ip-masq-agent non-masquerade CIDRs are no longer treated as pod subnets. (#48493, @HadrienPatte)

LB IPAM: whitespace around the namespaces in the lbipam.cilium.io/sharing-cross-namespace annotation no longer prevents services from sharing an IP. (#48868, @lexfrei)

Migrate Azure IPAM to the Multi-pool allocator (#48449, @jaredledvina)

network driver: operator managed node configs (#47597, @bersoare)

network driver: track DRA allocations separately from device inventory (#48755, @aarcamp)

Setting "policyCidrMatchMode=nodes" no longer causes unnecessary node identities to be allocated, saving space in the IPCache and policy maps. (#48292, @squeed)

The agent option --fixed-identity-mapping is deprecated. It will be removed in a future release. (#48946, @squeed)

Track peer AllowedIPs as netip.Prefix (#47815, @Wise-Wizard)

Bugfixes:

bpf: Fix ICMPv6 checksum handling after NAT of embedded SCTP packets. (#48309, @zihan001)

bpf: icmp: use 576 byte of inner packet to avoid partial csum floor (#48578, @tommyp1ckles)

bpf: lb: Do not drain terminating backends for UDP connections, preventing UDP packet drops during pod deletion and rolling updates.. (#48715, @ankitaojha123)

ciliumendpointslice: fix flaky TestRegisterControllerNoCEPs (#48014, @elskow)

daemon: fix a bug where L7 DNS policies could remain loaded in the datapath during agent shutdown, causing pods under a wildcard toFQDNs policy to lose DNS resolution for the duration of the restart. (#48747, @41ks)

envoy: Corrently render tiers for specific port pass rules (#48854, @jrajahalme)

envoy: handle listener additional address changes (#48712, @nezdolik)

envoy: handle listener address changes in ADS (#48798, @nezdolik)

envoy: track coalesced ADS snapshot updates (#48631, @nezdolik)

Fix proxy_protocol listener filter incorrectly injected into GAMMA CiliumEnvoyConfigs when gatewayAPI.enableProxyProtocol is enabled (#47555, @mkamadeus)

Fix cilium-cli clustermesh 'inspect-policy-default-cluster-local' command (#48390, @fristonio)

Fix Gateway API ExternalAuth dropping request bodies when allowedResponseHeaders is unset (#48770, @kirgene)

Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint (#48905, @fristonio)

Fix panic in agent when CiliumLocalRedirectPolicy redirectBackend.toPorts is declared as an empty array. The agent will now reject such a policy. (#48491, @ajmmm)

Fix PMTU/ICMP replies for IPIP/Geneve DSR for GRO skbs (#48489, @borkmann)

Fix rare data race in selector cache that could lead to agent panic (#47733, @odinuge)

Fix restoration of terminating backends. If a terminating backend become active again during restart the backend was incorrectly kept as quarantined. (#48763, @joamaki)

fix(envoyconfig): retry port allocation on duplicate-address rejections (#48624, @kokhlo)

Fix: MCS EndpointSlice mirroring fails when service names exceed 63 characters (#48783, @weizhoublue)

Fixed a cilium-agent crash (fatal error: concurrent map iteration and map write) when an endpoint's policy was recomputed while incremental policy map changes were applied concurrently. Most commonly triggered by named-port policies under pod churn. (#48098, @nashant)

Fixes a bug that prevents cilium identity creation for pods with named ports when operator-managed-identity was enabled. (#48662, @tamilmani1989)

Fixes a bug where Hubble flows may list the incorrect policy that allowed or denied a flow (#49086, @tsotne95)

infraendpoints: Release the health IPv4 when the IPv6 allocation fails (#48816, @HadrienPatte)

k8s/resource: fix leaked event finalizer on unobserved delete (#48785, @tklauser)

Keep terminating backends in EDS when active backends exist and set their health to DRAINING so Envoy can drain in-flight traffic instead of resetting connections. (#46642, @komapa)

operator: Do not emit warning when deleting already deleted unmanaged pod (#48765, @gandro)

operator: fix metrics list default address to work on IPv6-only clusters with dual stack nodes by trying both IPv4 and IPv6 loopback addresses (#48780, @41ks)

Restore ingress IPs from k8s / local node as a backup when they may be missing from the ipcache. (#47360, @jrajahalme)

Set the resource version when updating CiliumCIDRGroup. (#47712, @bodgit)

Sockets are no longer destroyed when a Service backend is terminated unless they are still connected to that backend. Unconnected UDP sockets, and sockets that have since disconnected or moved to another backend, used to have their local port silently changed. (#48725, @maxskokov)

The cilium-operator now exits when its controller-runtime manager fails, instead of continuing to run with its controllers stopped. (#48385, @ryanjwong)

wireguard: Fixed an issue where transient errors updating WireGuard peers could cause AllowedIPs to remain permanently out-of-sync with the IPCache, resulting in long-term traffic disruption. (#48664, @meel-ayush)

CI Changes:

• [ci] fix escaping in conformance ginkgo (#48991, @nebril)
• ci: Drop the empty floating tag line from CI image digests (#49070, @aanm)
• ci: Give Envoy Embedded conformance a bigger runner (#49018, @aanm)
• ci: Harden CI image build workflows (#48959, @ferozsalam)
• ci: keep UDPRouteWeightedRouting skipped in the profile job (#49005, @aanm)
• ci: login to docker registry for downgrade image wait (#48983, @nebril)
• ci: Name runner variables after their Ubuntu release and let Renovate bump them (#49065, @aanm)
• ci: stop setting removed mutual auth Helm value (#48964, @mhofstetter)
• contrib: Add workflow check-name collision linter (#48568, @christarazi)
• datapath: assert ARP off before up, not the link-local flags (#48610, @aanm)
• Fix the GitHub greeter so that it also welcomes first-time issue reporters. (#48579, @bitflicker64)
• gateway-api: cleanup unused helper functions (#47835, @asauber)
• gh: lint-bpf-checks: clean up disk when running BPF tests (#48601, @julianwiedmann)
• gha/conformance-multi-pool: use the local fake external targets (#48558, @aanm)
• gha: Derive the LVH package cache key once per run (#48656, @aanm)
• gha: make external fake targets image configurable (#48941, @giorio94)
• gha: Skip the duplicate CI image build on push to main (#48736, @aanm)
• gha: Tolerate cosign and SBOM failures on pull requests (#48737, @aanm)
• identity/cache: Fix data races flaking the test package (#48566, @christarazi)
• Increase test coverage in GKE, AKS and EKS conformance workflows. (#47220, @gentoo-root)
• loadbalancer/tests: Fix the graceful termination test restart (#48939, @aanm)
• Makefile: Order the bpf codegen ahead of the Go builds (#48644, @aanm)
• Migrate Conformance Cluster Mesh workflow to use fake external targets (#48250, @giorio94)
• nodeinit: wait for the kubelet wrapper before writing the bootstrap file (#48739, @aanm)
• policy/test: retry endpoint list until it reports ready (#49017, @aanm)
• renovate: Keep LLVM major version for stable branches (#48625, @sayboras)
• Skip embedded proxy conformance CI for non-functional changes (#47305, @AkashKumar7902)
• test: fix the never-taken retry on a partially read JSON line (#48190, @aanm)
• test: Wait for the testds DaemonSet before reading backend pod IPs (#48616, @christarazi)
• tests: Build only the packages a privileged run can execute (#48608, @aanm)
• Update CI image build workflow (#48220, @ferozsalam)

Misc Changes:

• .github: Add testing expectations to PR template (#49099, @joestringer)
• Add Aether to USERS.md with relevant details (#49073, @zozo6015)
• Add desired-device support for Linux VRF links and VRF-bound VLAN devices. (#48653, @harsimran-pabla)
• Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (#48421, @0xch4z)
• Allow Renovate to update Go to v1.26 on Cilium v1.18 and v1.19 (#48705, @ferozsalam)
• aws/ipam: Fix lock order inversion with the operator node (#48645, @aanm)
• bpf, datapath: switch DROP_NOTIFY to runtime config (#48956, @tklauser)
• bpf, datapath: switch socketlb externalIP mitigation to runtime config (#48649, @tklauser)
• bpf: convert HOST_NETNS_COOKIE to runtime config (#48499, @viktor-kurchenko)
• bpf: egressgw: clean up CT tuple initialization (#48629, @julianwiedmann)
• bpf: egressgw: prepare SNAT lookup for host traffic (#48585, @ysksuzuki)
• bpf: lxc: reuse fraginfo from ct_buffer (#48793, @tklauser)
• bpf: lxc: switch cilium_nodeport_nat_buffer to auxvar (#48543, @julianwiedmann)
• bpf: move VLAN_FILTER host to runtime config (#48697, @viktor-kurchenko)
• bpf: nat46: remove dead csum_off assignment (#48458, @fds7280)
• bpf: only set ratelimit key and settings if needed (#48940, @tklauser)
• bpf: policy_log: move send_policy_verdict_notify() variables to auxvar (#48802, @tklauser)
• bpf: turn ENABLE_SIP_VERIFICATION into runtime config (#48762, @andreaterzolo)
• bpf: use DSR_ENCAP_MODE instead of ENABLE_DSR (#48981, @andreaterzolo)
• bpf:policy: remove unnecessary __sync_fetch_and_add on percpu map (#48944, @smagnani96)
• build: handle git worktrees in documentation make targets (#48966, @utaal)
• chore(deps): update all github action dependencies (main) (#48590, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (main) (#48669, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (main) (#48877, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (main) (#49033, @cilium-renovate[bot])
• chore(deps): update all lvh-images main (main) (patch) (#48666, @cilium-renovate[bot])
• chore(deps): update all lvh-images main (main) (patch) (#48874, @cilium-renovate[bot])
• chore(deps): update all lvh-images main (main) (patch) (#49027, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (#48670, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (#48878, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (#48896, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (#49026, @cilium-renovate[bot])
• chore(deps): update dependency bufbuild/buf to v1.73.0 (main) (#48727, @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium to v1.18.14 (main) (#48902, @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium to v1.19.8 (main) (#49028, @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium to v1.20.2 (main) (#48904, @cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.31 (main) (#48787, @cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v36.2 (main) (#49031, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.27.1 docker digest to 3680233 (main) (#48873, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.27.1 docker digest to f44f6e8 (main) (#48665, @cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.7.2 (main) (#49029, @cilium-renovate[bot])
• chore(deps): update ghcr.io/renovatebot/renovate docker tag to v44.103.7 (main) (#48898, @cilium-renovate[bot])
• chore(deps): update ghcr.io/renovatebot/renovate docker tag to v44.104.0 (main) (#48903, @cilium-renovate[bot])
• chore(deps): update ghcr.io/renovatebot/renovate docker tag to v44.115.12 (main) (#49055, @cilium-renovate[bot])
• chore(deps): update ghcr.io/renovatebot/renovate docker tag to v44.115.13 (main) (#49059, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.4-1789133559-b4174f07e1030109459e34436262323af5c3ef0f (main) (#48667, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.4-1789396437-a6bb974d7ad015d17b46eb44fdd7bbfe8256c089 (main) (#48875, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.4-1789992194-283c3f1fedbbc07e75e35f89b9a9ef93ffbe1bc3 (main) (#49030, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.39.1-1790794634-fbfb16f5f9d4c09131542931999a2cbe79a863f8 (main) (#49116, @cilium-renovate[bot])
• chore(deps): update quay.io/goswagger/swagger docker tag to v0.36.6 (main) (#48668, @cilium-renovate[bot])
• ciliumendpointslice: Report no CID when the CEP has none (#48933, @aanm)
• ciliumendpointslice: Use controller-runtime priorityqueue (#48702, @alvaroaleman)
• cleanup: Replace deprecated strings.Title with x/text/cases (#48275, @abraaoteixeira)
• clustermesh: fix context cancellation race on remote connection restart (#48622, @giorio94)
• clustermesh: misc cleanups and improvements to the MCS EndpointSlice mirroring (#48520, @MrFreezeex)
• connectivity-check: move echo-b to the lower NodePort band (#48926, @aanm)
• datapath/loader: include BPF source in template hash (#48623, @tklauser)
• datapath: define ENABLE_PER_PACKET_LB in terms of is_defined() (#48866, @ekoops)
• datapath: get rid of LOCAL_DELIVERY_METRICS (#48640, @ekoops)
• datapath: switch CT monitor report interval and flags to runtime config (#48595, @tklauser)
• datapath: turn ENABLE_HEALTH_CHECK into runtime config (#48713, @ekoops)
• datapath: turn ENABLE_SCTP into runtime config (#48892, @ekoops)
• datapath: turn ENABLE_SOCKET_LB_FULL into runtime config (#48914, @ekoops)
• datapath: turn ENABLE_VTEP into runtime config (#48635, @ekoops)
• datapath: turn SERVICE_NO_BACKEND_RESPONSE into runtime config (#48561, @ekoops)
• datapath: turn TRACE_SOCK_NOTIFY into runtime config (#48628, @ekoops)
• docs: add Hetzner Cloud native routing installation guide (#48615, @ocalzi)
• docs: document Envoy listener redirect and wildcard port in L4 policy (#46751, @PhilipSchmid)
• docs: fix typos in kvstore and deny policy pages (#48612, @magic-peach)
• Docs: list the conditions under which services with the same LB IPAM sharing key receive the same IP. (#48867, @lexfrei)
• docs: note on eBPF ClusterIP translation vs Docker raw-table protection (#47782, @Verbano-Tech)
• docs: remove outdated tip about disabling hubble before enabling UI (#48487, @ekoops)
• docs: remove stale mutual auth metrics mention (#48960, @mhofstetter)
• docs: Update clang version requirements (#48719, @sayboras)
• docs: Update kernel config requirements (#48594, @pchaigno)
• docs: use relative domain name for deathstar service instead of FQDN (#48448, @ekoops)
• envoy: add standalone NPDS unsubscribe regression test (#47818, @nezdolik)
• envoy: policy perf improvements (#48925, @jrajahalme)
• Fix data races on global state under parallel policy tests (#48929, @christarazi)
• Fix Envoy xDS listener handling across restoration, address changes, and rejected updates (#48897, @jrajahalme)
• fix(deps): update all go dependencies main (#48621, @aanm)
• fix(deps): update all go dependencies main (main) (#48696, @cilium-renovate[bot])
• fix(deps): update all go dependencies main (main) (#48698, @cilium-renovate[bot])
• fix(deps): update all go dependencies main (main) (#48876, @cilium-renovate[bot])
• fix(deps): update all go dependencies main (main) (#49032, @cilium-renovate[bot])
• fix(deps): update golang.org/x/exp digest to 85c1c22 (main) (#48699, @cilium-renovate[bot])
• fix(deps): update module github.com/aws/aws-sdk-go-v2/service/ec2 to v1.336.0 (main) (#49060, @cilium-renovate[bot])
• fix(deps): update module github.com/azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v11 to v12 (main) (#49034, @cilium-renovate[bot])
• fix(deps): update module github.com/cilium/hive to v1.0.6 (main) (#49054, @cilium-renovate[bot])
• fix(deps): update module github.com/google/go-github/v90 to v91 (main) (#48671, @cilium-renovate[bot])
• fix(deps): update module github.com/google/go-github/v91 to v92 (main) (#48728, @cilium-renovate[bot])
• fix(deps): update module github.com/gopacket/gopacket to v1.7.2 (main) (#48893, @cilium-renovate[bot])
• fix(route-manager): always set the initial route status to Done (#48522, @andreaterzolo)
• fix: disable auto-direct-node-routing in hybrid mode (#48547, @andreaterzolo)
• fqdn: Improve FQDN garbage collection and DNS response processing performance when many DNS names resolve to the same IP by avoiding repeated scans of deferred DNS names. (#48360, @vipul-21)
• gateway-api: centralize Gateway validation (#48602, @arybolovlev)
• gateway-api: fail Gateway reconcile on GatewayClass lookup errors (#48546, @mhofstetter)
• gateway-api: remove stale TODO comments in helper tests (#48605, @Sanjeevliv)
• GlobalIdentity: use labels.Labels, not LabelArray (#47429, @squeed)
• hive: Remove redundant netip.Prefix config decode hook (#49090, @HadrienPatte)
• In hybrid routing mode, skip SNAT for pod-to-remote-node traffic when source and destination belong to the same subnet topology group, preserving the original Pod source IP for same-subnet communication. (#45670, @OneSizeFitsQuorum)
• Increase bucket size range for endpoint/policy related latency histogram metrics (#48720, @fristonio)
• ipam, routing: Remove the unread VPC CIDRs from RoutingInfo and IPAM results (#48818, @HadrienPatte)
• ipam: centralize CIDRAllocator interface under pkg/ipam/cidralloc (#48822, @ekoops)
• ipam: Migrate IPAMStatus.AssignedStaticIP to ip.Addr (#48971, @HadrienPatte)
• ipam: Migrate IPAM map keys to netip (#48445, @HadrienPatte)
• ipcache/fake: migrate fake IPCache node event addresses to netip.Addr (#47683, @Dasmat13)
• ipcache: migrate CIDR filter to netip (#47779, @dlanov)
• ipmasq: Start the agent from its own cell, drop it from the IPAM path (#48949, @HadrienPatte)
• iptables: parameterize endpoint NOTRACK rule description and report every rule failure (#48252, @vipul-21)
• k8s/resource: Make WithTransform usable across a relist (#48639, @HadrienPatte)
• k8s/resource: remove transitory Resource[T] to Table[T] conversion mechanism (#48791, @tklauser)
• k8s: gateway-api: extract test helpers in k8s testutils package (#48901, @MrFreezeex)
• LB IPAM now reports distinct reasons when a service cannot share a requested IP because of a selector, instead of one message covering three cases. (#48869, @lexfrei)
• network driver: add README file with example configurations (#47389, @bersoare)
• node: Deduplicate node IP accessors and split them per address family (#48611, @HadrienPatte)
• node: Migrate Address.IP from net.IP to netip (#48663, @HadrienPatte)
• operator/clustermesh : decouple clustermesh cell from observers (#48767, @glrf)
• operator: Give the node watcher cells ownership of their state (#48931, @HadrienPatte)
• operator: Transform the Pod informer to the fields actually read (#48750, @HadrienPatte)
• Permit toggling host endpoint drop notifications through the API (#49117, @weizhoublue)
• pkg/ipam: Improved the error message from cloud multipool allocators when they can't assign an IP because the node is waiting to get more IPs assigned to it by the operator (#48717, @41ks)
• pkg/loadbalancer: convert net.IP to netip.Addr (#48724, @utaal)
• Policy & friends: Use labels.Labels rather than labels.LabelArray (#46231, @squeed)
• policy: Add realized BPF policymap assertions to script tests (#48463, @christarazi)
• Prepare cloud endpoint rules for reconciliation (#48382, @pippolo84)
• Prepare for release v1.21.0-pre.2 (#48584, @cilium-release-bot[bot])
• Prune unreachable BPF functions in the Cilium agent before loading the program (#48609, @ti-mo)
• README: Update APAC community meeting time (#48722, @ysksuzuki)
• README: Update releases (#48596, @aanm)
• README: Update releases (#48759, @joestringer)
• renovate: Bump envoy version for main and 1.20 (#49109, @sayboras)
• renovate: Bump envoy version for v1.19 (#49122, @sayboras)
• renovate: Disable platform commits for Go module updates (#48627, @aanm)
• renovate: Enable OSV vulnerability alerts on stable branches (#48803, @aanm)
• renovate: Group golangci-lint with the Go toolchain (#48743, @aanm)
• renovate: Migrate the last custom manager and fail on warnings (#48642, @aanm)
• Share the identity and endpoint list formatters with the script tests (#48972, @christarazi)
• signal: remove SignalCTFillUp (#47573, @julianwiedmann)
• vendor,treewide: Bump StateDB to v0.9.2 and fix NewKeySet usage (#48726, @joamaki)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.21.0-pre.3@sha256:e84ef5f4725a3085ce2fa49dd0df2053147ed373cbfc7b7f8120e776590f6fdc

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.21.0-pre.3@sha256:364e95e6dca80941080c2db59c18b4369ba532cf130045115a0924e1aa85dffa

hubble-relay

quay.io/cilium/hubble-relay:v1.21.0-pre.3@sha256:177078c69eeea1ba6e141e157a9d954122f33ebc12fcf4cef3cd9c72b51fa91b

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.21.0-pre.3@sha256:4bbfc2ef9cad8ce65def2d4cc43e49798656abeaf6f5112ceabf18e694a75383

operator-aws

quay.io/cilium/operator-aws:v1.21.0-pre.3@sha256:becf24a2158cb71424d04377a2339dabb5f99f6033a92ff14815c36dd34e997a

operator-azure

quay.io/cilium/operator-azure:v1.21.0-pre.3@sha256:8d917c81f243ab7476907dd377d9e798faab59711309bea8e726f0eb223061b7

operator-generic

quay.io/cilium/operator-generic:v1.21.0-pre.3@sha256:59545836b8fbcb1f44655419b5f6160f31f415cb5ae9b9c8866aafc397c6ff8a

operator

quay.io/cilium/operator:v1.21.0-pre.3@sha256:fad1dcccb5400f2957e275f31201fe5820a13f3dac3c28f779cd53fec91c63d2

Original source

Summary of Changes

Minor Changes:

gateway-api: node label selector for when hostNetwork is enabled (Backport PR #48636, Upstream PR #47463, @xtineskim)

Bugfixes:

aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR #48418, Upstream PR #48125, @41ks)

aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #48418, Upstream PR #48193, @41ks)

bpf: Fix agent crash when dumping map events (Backport PR #48378, Upstream PR #48273, @joestringer)

bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (Backport PR #48550, Upstream PR #48407, @41ks)

Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (Backport PR #48418, Upstream PR #48262, @giorio94)

datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR #48550, Upstream PR #46861, @fdomain)

endpoint: preserve concurrent policy updates for new endpoints (Backport PR #48213, Upstream PR #48195, @jrajahalme)

ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. (Backport PR #48213, Upstream PR #47034, @41ks)

Fix a pod created immediately after a network policy change reporting a stale policy revision for up to two minutes. (Backport PR #48418, Upstream PR #47642, @aanm)

Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association (Backport PR #48024, Upstream PR #47874, @bryanhorstmann)

Fix BGP defaultGateway peer auto-discovery selecting a default route from a non-main routing table, such as the default via cilium_host route Cilium installs in the from-proxy table, instead of the node's real default gateway. (Backport PR #48418, Upstream PR #47971, @ecbaldwin)

Fix bug where identities may linger for double the amount of the expected time (Backport PR #48418, Upstream PR #48032, @christarazi)

Fix dropping traffic L2Announcement with externalTrafficPolicy: Local (Backport PR #48550, Upstream PR #46399, @yuito-it)

Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. (Backport PR #48017, Upstream PR #47943, @taaahaaa)

Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. (Backport PR #48017, Upstream PR #47929, @shreyasrajiv327)

Fix Hubble Relay remains running during termination (Backport PR #48550, Upstream PR #47942, @xandau)

Fix ICMP error packet handling by adding the missing checksum recalculation performed during NAT for SNATed load-balanced traffic. (Backport PR #48418, Upstream PR #48086, @julianwiedmann)

Fix IPv6 Router Solicitations and Router Advertisements being dropped with "Unsupported protocol for NAT masquerade" on nodes whose BPF masquerade address is a link-local address. (Backport PR #48418, Upstream PR #48094, @ecbaldwin)

Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR #48418, Upstream PR #48391, @fristonio)

Fix multiple regressions in Cilium LocalRedirectPolicy (Backport PR #48634, Upstream PR #46638, @ajmmm)

Fix node-init startup on GKE 1.36.2-gke.2064000 nodes by detecting GKE from the kubelet path instead of container runtime configuration. (Backport PR #48213, Upstream PR #47945, @dlanov)

Fix nodeport egress tuple reuse for closed connections (Backport PR #48418, Upstream PR #48306, @fristonio)

Fix restored ENI endpoints routing rule configuration when masquerading config changes (#48417, @fristonio)

fix(envoyconfig): retry port allocation on duplicate-address rejections (Backport PR #48735, Upstream PR #48624, @kokhlo)

Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR #48213, Upstream PR #47915, @giorio94)

Fixed a cilium-agent crash (fatal error: concurrent map iteration and map write) when an endpoint's policy was recomputed while incremental policy map changes were applied concurrently. Most commonly triggered by named-port policies under pod churn. (Backport PR #48735, Upstream PR #48098, @nashant)

Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (Backport PR #48434, Upstream PR #47635, @aanm)

Fixes a bug where clusters originally created in v1.15 or earlier failed to upgrade due to dropping the CRD version CiliumNodeConfig v2alpha1. (Backport PR #48213, Upstream PR #48087, @squeed)

Fragmented UDP packets were potentially mis-classified as Cilium Wireguard traffic. (Backport PR #48213, Upstream PR #48139, @julianwiedmann)

gateway-api: fix listener programmed status update (Backport PR #48213, Upstream PR #48013, @mhofstetter)

gateway-api: propgate listenerset status update errors (Backport PR #48581, Upstream PR #48130, @mhofstetter)

hubble: fix four config knobs that never reach their sink (Backport PR #48434, Upstream PR #47637, @aanm)

Improve reliability for fast recovery of disrupted TCP connections that access a DSR-enabled Service. (Backport PR #48465, Upstream PR #48254, @julianwiedmann)

lb (fix): require active state for backend when using topology hints (Backport PR #48550, Upstream PR #47054, @CarrySauce)

nodediscovery: Reduced EC2 IMDS load and made ENI node registration more resilient by fetching the instance metadata once instead of on every CiliumNode update. (Backport PR #48603, Upstream PR #48218, @41ks)

operator/ipam: Restore fatal exit when the IPAM node watcher fails (Backport PR #48213, Upstream PR #47778, @HadrienPatte)

Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR #48213, Upstream PR #48015, @giorio94)

The BPF NAT engine now drops ICMP error packets which contain a fragmented TCP/UDP/SCTP packet. (Backport PR #48418, Upstream PR #48174, @julianwiedmann)

When using DSR with --bpf-lb-dsr-dispatch set to "opt" or "geneve" in combination with --enable-pmtu-discovery, fix the outer source IP of the ICMP error message which is generated when a forwarded DSR request exceeds the network interface's MTU. (Backport PR #48114, Upstream PR #48053, @julianwiedmann)

CI Changes:

[v1.20] golangci-lint: Do not run the modernize linter (#48398, @aanm)

.github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR #48550, Upstream PR #48462, @joestringer)

BPF: Refactor nat tests to use scapy fixtures and add checksum coverage (Backport PR #48213, Upstream PR #47222, @tommyp1ckles)

bpf: tests: fix up prog type in ipv6_test (Backport PR #48213, Upstream PR #47736, @julianwiedmann)

bpf: tests: use PROG_TYPE (Backport PR #48213, Upstream PR #47714, @julianwiedmann)

bpf: tests: validate CT entry for DSR connection (Backport PR #48418, Upstream PR #48219, @julianwiedmann)

ci: replace unsupported LLVM installation action (Backport PR #48418, Upstream PR #47776, @bogdankrasko)

ci: resolve renovate PR metadata in base image workflows (Backport PR #48213, Upstream PR #47964, @mhofstetter)

ci: stop asking a PHP app for the AKS runner IP (Backport PR #48418, Upstream PR #48371, @aanm)

ci: use GitHub App client ID in v1.20 image workflow (Backport PR #48213, Upstream PR #47787, @bogdankrasko)

datapath/loader: fix missing complexity coverage for enable_identity_mark (Backport PR #48213, Upstream PR #48037, @tklauser)

gh: verifier: test PR branch before base branch (Backport PR #48418, Upstream PR #47928, @julianwiedmann)

gha/conformance-aks: add a timeout to the cluster create step (Backport PR #48550, Upstream PR #48545, @aanm)

gha/conformance-aks: give the nodes a 64 GiB OS disk (Backport PR #48550, Upstream PR #48481, @aanm)

gha/kubespray: don't wait for CoreDNS before Cilium is installed (Backport PR #48213, Upstream PR #48048, @aanm)

gha: bound the LLVM prereq apt step with a 5m timeout (Backport PR #48213, Upstream PR #48069, @aanm)

gha: compute the ginkgo cache key once, before the matrix (Backport PR #48213, Upstream PR #48127, @aanm)

gha: move GCP auth pin past the STS token exchange retry fix (Backport PR #48418, Upstream PR #48352, @aanm)

gha: publish the external target hostnames as FQDNs (Backport PR #48550, Upstream PR #48478, @aanm)

gha: stop JUnit reports being destroyed by same-name legs (Backport PR #48418, Upstream PR #48203, @aanm)

logging: downgrade canceled response-body reads to info (Backport PR #48418, Upstream PR #48202, @aanm)

Makefile: Order the bpf codegen ahead of the Go builds (Backport PR #48735, Upstream PR #48644, @aanm)

Revert 48441 - disable local accounts on AKS clusters (#48524, @aanm)

test(bpf): parallelize eBPF test execution (Backport PR #48213, Upstream PR #47427, @lconnery)

test/k8s: wait for the L7 visibility policy to be realized (Backport PR #48418, Upstream PR #48365, @aanm)

test: fix the never-taken retry on a partially read JSON line (Backport PR #48634, Upstream PR #48190, @aanm)

tools: complexity: de-couple StackDepth from kernel version (Backport PR #48200, Upstream PR #48236, @julianwiedmann)

workflows: disable local accounts on AKS clusters (#48441, @nbusseneau)

Misc Changes:

Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR #48634, Upstream PR #48421, @0xch4z)

bpf/lib/nat: rename icmpoff (Backport PR #48418, Upstream PR #47797, @tommyp1ckles)

bpf: dsr: use eth_store_proto() in dsr_reply_icmp*() (Backport PR #48213, Upstream PR #47392, @julianwiedmann)

bpf: icmp*: fix up sample length (Backport PR #48114, Upstream PR #48020, @julianwiedmann)

bpf: misc cleanups (Backport PR #48350, Upstream PR #47879, @julianwiedmann)

bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (Backport PR #48284, Upstream PR #46232, @julianwiedmann)

bpf: Reduce stack usage of send_trace_notify (Backport PR #48350, Upstream PR #47911, @joamaki)

chore(deps): update all external docker images dependencies (v1.20) (patch) (#48147, @cilium-renovate[bot])

chore(deps): update all external docker images dependencies to v0.13.6 (v1.20) (#48673, @cilium-renovate[bot])

chore(deps): update all github action dependencies (v1.20) (#48326, @cilium-renovate[bot])

chore(deps): update all github action dependencies (v1.20) (#48506, @cilium-renovate[bot])

chore(deps): update all github action dependencies (v1.20) (#48677, @cilium-renovate[bot])

chore(deps): update all-dependencies (v1.20) (#48149, @cilium-renovate[bot])

chore(deps): update all-dependencies (v1.20) (#48325, @cilium-renovate[bot])

chore(deps): update all-dependencies (v1.20) (#48619, @cilium-renovate[bot])

chore(deps): update base-images (v1.20) (#48327, @cilium-renovate[bot])

chore(deps): update base-images (v1.20) (#48672, @cilium-renovate[bot])

chore(deps): update dependency bufbuild/buf to v1.73.0 (v1.20) (#48729, @cilium-renovate[bot])

chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.20) (#48344, @cilium-renovate[bot])

chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.20) (#48505, @cilium-renovate[bot])

chore(deps): update dependency semver to v3.1.0 (v1.20) (#48730, @cilium-renovate[bot])

chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.20) (#48517, @cilium-renovate[bot])

chore(deps): update google/cloud-sdk docker tag to v581 (v1.20) (#48150, @cilium-renovate[bot])

chore(deps): update helm/kind-action action to v1.15.0 (v1.20) (#48591, @cilium-renovate[bot])

chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1787987562-ac0b61a4c0a45670a3654448d53bd6416b948f62 (v1.20) (#48323, @cilium-renovate[bot])

chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.20) (#48451, @cilium-renovate[bot])

chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.20) (#48674, @cilium-renovate[bot])

chore(deps): update stable lvh-images (v1.20) (patch) (#48148, @cilium-renovate[bot])

chore(deps): update stable lvh-images (v1.20) (patch) (#48324, @cilium-renovate[bot])

chore(deps): update stable lvh-images (v1.20) (patch) (#48504, @cilium-renovate[bot])

chore(deps): update stable lvh-images (v1.20) (patch) (#48675, @cilium-renovate[bot])

ci: disable TCP/UDPRouteWeightedRouting gateway-api conformance tests (Backport PR #48550, Upstream PR #48375, @0xch4z)

datapath: move some feature probes into BPF (Backport PR #48213, Upstream PR #47737, @julianwiedmann)

docs: fix extra closing parenthesis in hive.rst (Backport PR #48634, Upstream PR #48541, @logi74123)

docs: Improve build process (Backport PR #48550, Upstream PR #47751, @joestringer)

docs: remove outdated tip about disabling hubble before enabling UI (Backport PR #48634, Upstream PR #48487, @ekoops)

docs: Remove v1.18 ipsec documentation (Backport PR #48418, Upstream PR #48224, @joestringer)

docs: Update kernel config requirements (Backport PR #48634, Upstream PR #48594, @pchaigno)

Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (Backport PR #48550, Upstream PR #48428, @marcus-chae)

Documentation: document mesh security model (Backport PR #48213, Upstream PR #47912, @bimmlerd)

envoy: Clarify legacy UpdateEnvoyResources (Backport PR #48213, Upstream PR #48066, @jrajahalme)

Fix (eBPF): Pointer-to-Pointer Misuse in IPv6 Trace Notifications (Backport PR #48350, Upstream PR #47908, @weizhoublue)

Fix Component Overview doc link rendering (Backport PR #48634, Upstream PR #48537, @eneiss)

fix(deps): update k8s.io patch updates stable to v0.36.4 (v1.20) (#48118, @cilium-renovate[bot])

fix(deps): update module google.golang.org/grpc to v1.83.1 [security] (v1.20) (#48388, @cilium-renovate[bot])

fix(deps): update module sigs.k8s.io/gateway-api/conformance to v1.6.2 (v1.20) (#48676, @cilium-renovate[bot])

Fixed broken Slack link on Community page. (Backport PR #48418, Upstream PR #48021, @ps-mir)

Fixes: Update node-cache image version to 1.26.5 (Backport PR #48634, Upstream PR #48270, @zyue110026)

gateway-api: avoid logging missing GatewayClass as error (Backport PR #48581, Upstream PR #48529, @mhofstetter)

gateway-api: deduplicate condition merge helpers (Backport PR #48581, Upstream PR #48122, @mhofstetter)

gateway-api: extract BackendTLSPolicy status handling into BackendTLSPolicyStatusManager (Backport PR #48581, Upstream PR #48068, @mhofstetter)

gateway-api: extract gateway address status handling (Backport PR #48581, Upstream PR #48129, @mhofstetter)

gateway-api: extract index & load functionality from controller / reconcile (Backport PR #48581, Upstream PR #47837, @mhofstetter)

gateway-api: extract listener status handling (Backport PR #48581, Upstream PR #48103, @mhofstetter)

gateway-api: extract route status handling into RouteStatusManager (Backport PR #48581, Upstream PR #48023, @mhofstetter)

gateway-api: make gateway-api reconciler client and scheme fields private (Backport PR #48581, Upstream PR #48191, @mhofstetter)

gateway-api: only load referenced services & serviceimports (Backport PR #48581, Upstream PR #48469, @mhofstetter)

gateway-api: put ctx first in route status API (Backport PR #48581, Upstream PR #48074, @mhofstetter)

gateway-api: remove duplicate gateway reconcile error logs (Backport PR #48581, Upstream PR #48186, @mhofstetter)

gateway-api: remove Gateway LBIPAM annotation warning (Backport PR #48581, Upstream PR #48187, @mhofstetter)

gateway-api: remove pre-filtered namespaces concept (Backport PR #48581, Upstream PR #47685, @asauber)

gha/lint-ariane-config: let Renovate manage the Go version (Backport PR #48550, Upstream PR #48467, @aanm)

gha: authenticate release images with OIDC (Backport PR #48599, Upstream PR #48062, @aanm)

gha: authenticate stable Image CI to quay.io with OIDC (Backport PR #48060, Upstream PR #48061, @aanm)

gha: correct and move the OIDC subject comments (Backport PR #48060, Upstream PR #48370, @aanm)

gha: raise the Docker Hub OIDC token lifetime for release builds (Backport PR #48599, Upstream PR #48535, @aanm)

helm: add general busybox image values for substitution (Backport PR #48418, Upstream PR #47973, @0xch4z)

vendor: Bump StateDB to v0.8.4 (#48248, @joamaki)

Other Changes:

[v1.20] bpf: Force-align IPv4 CT tuples used by revSNAT memcpy() (#48395, @julianwiedmann)

install: Update image digests for v1.20.1 (#48039, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01

quay.io/cilium/cilium:stable@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.2@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce

quay.io/cilium/clustermesh-apiserver:stable@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce

hubble-relay

quay.io/cilium/hubble-relay:v1.20.2@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f

quay.io/cilium/hubble-relay:stable@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.2@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38

quay.io/cilium/operator-alibabacloud:stable@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38

operator-aws

quay.io/cilium/operator-aws:v1.20.2@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3

quay.io/cilium/operator-aws:stable@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3

operator-azure

quay.io/cilium/operator-azure:v1.20.2@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a

quay.io/cilium/operator-azure:stable@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a

operator-generic

quay.io/cilium/operator-generic:v1.20.2@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc

quay.io/cilium/operator-generic:stable@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc

operator

quay.io/cilium/operator:v1.20.2@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c

quay.io/cilium/operator:stable@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c

Original source

Summary of Changes

Bugfixes

aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #48604, Upstream PR #48193, @41ks)

bpf: Fix agent crash when dumping map events (Backport PR #48379, Upstream PR #48273, @joestringer)

bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR #47620, Upstream PR #47343, @smagnani96)

datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR #48552, Upstream PR #46861, @fdomain)

Fix Hubble Relay remains running during termination (Backport PR #48552, Upstream PR #47942, @xandau)

Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR #48552, Upstream PR #48391, @fristonio)

Fix nodeport egress tuple reuse for closed connections (Backport PR #48413, Upstream PR #48306, @fristonio)

Fix restored ENI endpoints routing rule configuration when masquerading config changes (#48422, @fristonio)

fix(socketlb): only detach Cilium-owned cgroup programs (Backport PR #48552, Upstream PR #44066, @puwun)

Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR #48214, Upstream PR #47915, @giorio94)

Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (Backport PR #48433, Upstream PR #47635, @aanm)

hubble: fix four config knobs that never reach their sink (Backport PR #48433, Upstream PR #47637, @aanm)

operator: Emit startup logs in the configured log format (Backport PR #48018, Upstream PR #47890, @HadrienPatte)

standalone-dns-proxy: return an error when no endpoint is found (Backport PR #48018, Upstream PR #47791, @vipul-21)

Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR #48413, Upstream PR #48015, @giorio94)

CI Changes

[v1.19] golangci-lint: Do not run the modernize linter (#48399, @aanm)

.github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR #48552, Upstream PR #48462, @joestringer)

BPF: Refactor nat tests to use scapy fixtures and add checksum coverage (Backport PR #48123, Upstream PR #47222, @tommyp1ckles)

bpf: tests: collapse more tests (Backport PR #48063, Upstream PR #46374, @julianwiedmann)

bpf: tests: collapse XDP DSR tests (Backport PR #48063, Upstream PR #46174, @julianwiedmann)

bpf: tests: condense a bunch of LB tests (Backport PR #48063, Upstream PR #46358, @julianwiedmann)

ci: replace unsupported LLVM installation action (Backport PR #48413, Upstream PR #47776, @bogdankrasko)

ci: resolve renovate PR metadata in base image workflows (Backport PR #48214, Upstream PR #47964, @mhofstetter)

ci: stop asking a PHP app for the AKS runner IP (Backport PR #48552, Upstream PR #48371, @aanm)

ci: use GitHub App client ID in v1.19 image workflow (Backport PR #48214, Upstream PR #47786, @bogdankrasko)

gha/conformance-aks: add a timeout to the cluster create step (Backport PR #48552, Upstream PR #48545, @aanm)

gha/conformance-aks: give the nodes a 64 GiB OS disk (Backport PR #48552, Upstream PR #48481, @aanm)

gha/kubespray: don't wait for CoreDNS before Cilium is installed (Backport PR #48214, Upstream PR #48048, @aanm)

gha: bound the LLVM prereq apt step with a 5m timeout (Backport PR #48214, Upstream PR #48069, @aanm)

gha: compute the ginkgo cache key once, before the matrix (Backport PR #48214, Upstream PR #48127, @aanm)

gha: move GCP auth pin past the STS token exchange retry fix (Backport PR #48413, Upstream PR #48352, @aanm)

gha: publish the external target hostnames as FQDNs (Backport PR #48552, Upstream PR #48478, @aanm)

gha: stop JUnit reports being destroyed by same-name legs (Backport PR #48433, Upstream PR #48203, @aanm)

Migrate Conformance Cluster Mesh workflow to use fake external targets (Backport PR #48655, Upstream PR #48250, @giorio94)

Revert 48442 - disable local accounts on AKS clusters (#48525, @aanm)

test(bpf): parallelize eBPF test execution (Backport PR #48214, Upstream PR #47427, @lconnery)

test/k8s: wait for the L7 visibility policy to be realized (Backport PR #48413, Upstream PR #48365, @aanm)

test: fix the never-taken retry on a partially read JSON line (Backport PR #48633, Upstream PR #48190, @aanm)

tools: complexity: de-couple StackDepth from kernel version (Backport PR #48266, Upstream PR #48236, @julianwiedmann)

workflows: disable local accounts on AKS clusters (#48442, @nbusseneau)

Misc Changes

Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR #48633, Upstream PR #48421, @0xch4z)

bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (Backport PR #48285, Upstream PR #46232, @julianwiedmann)

chore(deps): update all external docker images dependencies to v0.13.6 (v1.19) (#48678, @cilium-renovate[bot])

chore(deps): update all github action dependencies (v1.19) (#48332, @cilium-renovate[bot])

chore(deps): update all github action dependencies (v1.19) (#48509, @cilium-renovate[bot])

chore(deps): update all github action dependencies (v1.19) (#48681, @cilium-renovate[bot])

chore(deps): update all-dependencies (v1.19) (#48155, @cilium-renovate[bot])

chore(deps): update all-dependencies (v1.19) (#48331, @cilium-renovate[bot])

chore(deps): update all-dependencies (v1.19) (#48620, @cilium-renovate[bot])

chore(deps): update base-images (v1.19) (#48151, @cilium-renovate[bot])

chore(deps): update base-images to v1.26.8 (v1.19) (#48731, @cilium-renovate[bot])

chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.19) (#48345, @cilium-renovate[bot])

chore(deps): update dependency go to v1.25.14 (v1.19) (#48208, @cilium-renovate[bot])

chore(deps): update dependency protocolbuffers/protobuf to v36 (v1.19) (#48333, @cilium-renovate[bot])

chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.19) (#48508, @cilium-renovate[bot])

chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.19) (#48518, @cilium-renovate[bot])

chore(deps): update golangci/golangci-lint docker tag to v2.13.2 (v1.19) (#48732, @cilium-renovate[bot])

chore(deps): update google/cloud-sdk docker tag to v581 (v1.19) (#48156, @cilium-renovate[bot])

chore(deps): update helm/kind-action action to v1.15.0 (v1.19) (#48592, @cilium-renovate[bot])

chore(deps): update quay.io/cilium/certgen docker tag to v0.4.11 (v1.19) (#48152, @cilium-renovate[bot])

chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.10-1787983435-8f34575affde33ad364d1e669b953993bf1f4125 (v1.19) (#48328, @cilium-renovate[bot])

chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.19) (#48452, @cilium-renovate[bot])

chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.19) (#48679, @cilium-renovate[bot])

chore(deps): update stable lvh-images (v1.19) (patch) (#48153, @cilium-renovate[bot])

chore(deps): update stable lvh-images (v1.19) (patch) (#48329, @cilium-renovate[bot])

chore(deps): update stable lvh-images (v1.19) (patch) (#48507, @cilium-renovate[bot])

chore(deps): update stable lvh-images (v1.19) (patch) (#48680, @cilium-renovate[bot])

docs: Improve build process (Backport PR #48552, Upstream PR #47751, @joestringer)

docs: remove outdated tip about disabling hubble before enabling UI (Backport PR #48633, Upstream PR #48487, @ekoops)

docs: Remove v1.18 ipsec documentation (Backport PR #48413, Upstream PR #48224, @joestringer)

Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (Backport PR #48552, Upstream PR #48428, @marcus-chae)

Documentation: document mesh security model (Backport PR #48413, Upstream PR #47912, @bimmlerd)

Fix byte ordering of TCP fields in BPF integration tests. (Backport PR #48063, Upstream PR #44336, @ajmmm)

Fix Component Overview doc link rendering (Backport PR #48633, Upstream PR #48537, @eneiss)

fix(deps): update k8s.io patch updates stable to v0.35.8 (v1.19) (#48330, @cilium-renovate[bot])

fix(deps): update module k8s.io/apimachinery to v0.35.8 (v1.19) (#48154, @cilium-renovate[bot])

Fixed broken Slack link on Community page. (Backport PR #48413, Upstream PR #48021, @ps-mir)

Fixes: Update node-cache image version to 1.26.5 (Backport PR #48633, Upstream PR #48270, @zyue110026)

gha: authenticate release images with OIDC (Backport PR #48598, Upstream PR #48062, @aanm)

gha: authenticate stable Image CI to quay.io with OIDC (Backport PR #48059, Upstream PR #48061, @aanm)

gha: correct and move the OIDC subject comments (Backport PR #48059, Upstream PR #48370, @aanm)

gha: raise the Docker Hub OIDC token lifetime for release builds (Backport PR #48598, Upstream PR #48535, @aanm)

helm: add general busybox image values for substitution (Backport PR #48413, Upstream PR #47973, @0xch4z)

vendor: Bump StateDB to v0.5.10 (#48247, @joamaki)

Other Changes

Fix verifier error "detect support for FnSetRetval for program type CGroupSock" during feature probing (#48376, @borkmann)

install: Update image digests for v1.19.7 (#48040, @cilium-release-bot[bot])

proxy: Bump envoy to v1.37.x (#48310, @sayboras)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.8@sha256:e9f7ee1f2f3a41e44339612e3b6b88170bdde7679c9c9461f287bb27702a8ecf

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.8@sha256:9c44205b9e6eafed719803682669f63e0a68c549025344c0af520a94b2f3e4bc

docker-plugin

quay.io/cilium/docker-plugin:v1.19.8@sha256:e876814edd154a8f4a2a8a8ac47a10614f7bb9a717d8cee9df352d060242e3a4

hubble-relay

quay.io/cilium/hubble-relay:v1.19.8@sha256:f78768be216b5c00137c7d4da440724d0b49986805d361e7458cc8fe9ff976ff

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.8@sha256:cb4a8685fc74fef8f3e97c3370faf338ba1a8b29a7d5cdc718f3926ae0093b99

operator-aws

quay.io/cilium/operator-aws:v1.19.8@sha256:de1cfe6e9962664e69e021f1cc07ea3b4f973d4ce341d7aebabf97616dd27982

operator-azure

quay.io/cilium/operator-azure:v1.19.8@sha256:b67fcc053fe8caa5ae5f12158c8dc568b3d16201cdea17bb78f3b61b7c1f02d7

operator-generic

quay.io/cilium/operator-generic:v1.19.8@sha256:786ec9bb1a9344435e3e3f994bc4ed3a4a85afa6a314e98681af241f8be79833

operator

quay.io/cilium/operator:v1.19.8@sha256:618fe8acacaa682509b19670b1228fd8184c2c4c1478e23d505ba6502e8bcf3a

Original source

Summary of Changes

Bugfixes

aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #48607, Upstream PR #48193, @41ks)

bpf: Fix agent crash when dumping map events (Backport PR #48380, Upstream PR #48273, @joestringer)

datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR #48554, Upstream PR #46861, @fdomain)

Fix Hubble Relay remains running during termination (Backport PR #48554, Upstream PR #47942, @xandau)

Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR #48554, Upstream PR #48391, @fristonio)

Fix nodeport egress tuple reuse for closed connections (Backport PR #48406, Upstream PR #48306, @fristonio)

Fix restored ENI endpoints routing rule configuration when masquerading config changes (#48423, @fristonio)

fix(socketlb): only detach Cilium-owned cgroup programs (Backport PR #48554, Upstream PR #44066, @puwun)

Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR #48216, Upstream PR #47915, @giorio94)

Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (Backport PR #48432, Upstream PR #47635, @aanm)

hubble: fix four config knobs that never reach their sink (Backport PR #48432, Upstream PR #47637, @aanm)

operator: Emit startup logs in the configured log format (Backport PR #48019, Upstream PR #47890, @HadrienPatte)

Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR #48216, Upstream PR #48015, @giorio94)

CI Changes

.github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR #48554, Upstream PR #48462, @joestringer)

ci: replace unsupported LLVM installation action (Backport PR #48406, Upstream PR #47776, @bogdankrasko)

ci: resolve renovate PR metadata in base image workflows (Backport PR #48216, Upstream PR #47964, @mhofstetter)

ci: use GitHub App client ID in v1.18 image workflow (Backport PR #48216, Upstream PR #47785, @bogdankrasko)

Further GC ratchet test fix races (Backport PR #48019, Upstream PR #43075, @tommyp1ckles)

gha/conformance-aks: add a timeout to the cluster create step (Backport PR #48554, Upstream PR #48545, @aanm)

gha/conformance-aks: give the nodes a 64 GiB OS disk (Backport PR #48554, Upstream PR #48481, @aanm)

gha/kubespray: don't wait for CoreDNS before Cilium is installed (Backport PR #48216, Upstream PR #48048, @aanm)

gha: bound the LLVM prereq apt step with a 5m timeout (Backport PR #48216, Upstream PR #48069, @aanm)

gha: compute the ginkgo cache key once, before the matrix (Backport PR #48216, Upstream PR #48127, @aanm)

gha: move GCP auth pin past the STS token exchange retry fix (Backport PR #48406, Upstream PR #48352, @aanm)

gha: publish the external target hostnames as FQDNs (Backport PR #48554, Upstream PR #48478, @aanm)

gha: stop JUnit reports being destroyed by same-name legs (Backport PR #48432, Upstream PR #48203, @aanm)

Migrate Conformance Cluster Mesh workflow to use fake external targets (Backport PR #48659, Upstream PR #48250, @giorio94)

Revert 48443 - disable local accounts on AKS clusters (#48526, @aanm)

test/k8s: wait for the L7 visibility policy to be realized (Backport PR #48406, Upstream PR #48365, @aanm)

test: fix the never-taken retry on a partially read JSON line (Backport PR #48632, Upstream PR #48190, @aanm)

workflows: disable local accounts on AKS clusters (#48443, @nbusseneau)

Misc Changes

Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR #48632, Upstream PR #48421, @0xch4z)

bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (Backport PR #48295, Upstream PR #46232, @julianwiedmann)

chore(deps): update all external docker images dependencies to v0.13.6 (v1.18) (#48683, @cilium-renovate[bot])

chore(deps): update all github action dependencies (v1.18) (#48161, @cilium-renovate[bot])

chore(deps): update all github action dependencies (v1.18) (#48337, @cilium-renovate[bot])

chore(deps): update all github action dependencies (v1.18) (#48512, @cilium-renovate[bot])

chore(deps): update all github action dependencies (v1.18) (#48685, @cilium-renovate[bot])

chore(deps): update all-dependencies (v1.18) (#48157, @cilium-renovate[bot])

chore(deps): update base-images to v1.26.8 (v1.18) (#48734, @cilium-renovate[bot])

chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.18) (#48346, @cilium-renovate[bot])

chore(deps): update dependency go to v1.25.14 (v1.18) (#48209, @cilium-renovate[bot])

chore(deps): update dependency protocolbuffers/protobuf to v36 (v1.18) (#48338, @cilium-renovate[bot])

chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.18) (#48511, @cilium-renovate[bot])

chore(deps): update docker.io/library/golang docker tag to v1.25.14 (v1.18) (#48158, @cilium-renovate[bot])

chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 224a186 (v1.18) (#48682, @cilium-renovate[bot])

chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.18) (#48519, @cilium-renovate[bot])

chore(deps): update gcr.io/distroless/static:nonroot docker digest to e2e927e (v1.18) (#48700, @cilium-renovate[bot])

chore(deps): update golangci/golangci-lint docker tag to v2.13.1 (v1.18) (#48336, @cilium-renovate[bot])

chore(deps): update golangci/golangci-lint docker tag to v2.13.2 (v1.18) (#48733, @cilium-renovate[bot])

chore(deps): update helm/kind-action action to v1.15.0 (v1.18) (#48593, @cilium-renovate[bot])

chore(deps): update quay.io/cilium/certgen docker tag to v0.4.11 (v1.18) (#48159, @cilium-renovate[bot])

chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.10-1787983435-8f34575affde33ad364d1e669b953993bf1f4125 (v1.18) (#48334, @cilium-renovate[bot])

chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.18) (#48453, @cilium-renovate[bot])

chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.18) (#48684, @cilium-renovate[bot])

chore(deps): update stable lvh-images (v1.18) (patch) (#48160, @cilium-renovate[bot])

chore(deps): update stable lvh-images (v1.18) (patch) (#48335, @cilium-renovate[bot])

chore(deps): update stable lvh-images (v1.18) (patch) (#48510, @cilium-renovate[bot])

chore(deps): update stable lvh-images (v1.18) (patch) (#48515, @cilium-renovate[bot])

docs: remove outdated tip about disabling hubble before enabling UI (Backport PR #48632, Upstream PR #48487, @ekoops)

docs: Remove v1.18 ipsec documentation (Backport PR #48406, Upstream PR #48224, @joestringer)

Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (Backport PR #48554, Upstream PR #48428, @marcus-chae)

Documentation: document mesh security model (Backport PR #48217, Upstream PR #47912, @bimmlerd)

Fix Component Overview doc link rendering (Backport PR #48632, Upstream PR #48537, @eneiss)

fix(deps): update module google.golang.org/grpc to v1.83.1 [security] (v1.18) (#48389, @cilium-renovate[bot])

fix(deps): update module google.golang.org/grpc to v1.83.2 [security] (v1.18) (#48576, @cilium-renovate[bot])

Fixed broken Slack link on Community page. (Backport PR #48406, Upstream PR #48021, @ps-mir)

Fixes: Update node-cache image version to 1.26.5 (Backport PR #48632, Upstream PR #48270, @zyue110026)

gha: authenticate release images with OIDC (Backport PR #48597, Upstream PR #48062, @aanm)

gha: authenticate stable Image CI to quay.io with OIDC (Backport PR #48058, Upstream PR #48061, @aanm)

gha: correct and move the OIDC subject comments (Backport PR #48058, Upstream PR #48370, @aanm)

gha: raise the Docker Hub OIDC token lifetime for release builds (Backport PR #48597, Upstream PR #48535, @aanm)

helm: add general busybox image values for substitution (Backport PR #48406, Upstream PR #47973, @0xch4z)

Other Changes

[v1.18] cilium: revert have_set_retval fix and probe it differently, v2 (#48405, @borkmann)

[v1.18] proxy: Bump envoy to v1.37.x (#48312, @sayboras)

Fix verifier error "detect support for FnSetRetval for program type CGroupSock" during feature probing (#48381, @borkmann)

install: Update image digests for v1.18.13 (#48038, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.14@sha256:0e65a0910d74be4d56ebc8f8a010b566f9177444667dbb8eb5b2d8d840ea5406

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.14@sha256:fc776419ff39e6f384fbddb0db1c603458601277225b3ae6b609219214ad1255

docker-plugin

quay.io/cilium/docker-plugin:v1.18.14@sha256:75277ec46be1543ca62ff5ee998b5681420fcd01f855f27d4f3288802264f343

hubble-relay

quay.io/cilium/hubble-relay:v1.18.14@sha256:828c22fcde4c0f7317ad5bb0f73c42294c6b3e2be286bb9374cf66cea930fb5d

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.14@sha256:6790a4c3cd39412e02563534e7ab42cc211d14ea74e997b8cddd14425c709291

operator-aws

quay.io/cilium/operator-aws:v1.18.14@sha256:ba1996d44f0c17cdd03ba903f874b97f543314673c5af980fb1af3313ea542ac

operator-azure

quay.io/cilium/operator-azure:v1.18.14@sha256:38e802744945d9861b74cd9812250d5dbc2d6a4a24d08571b45cae71418b1c71

operator-generic

quay.io/cilium/operator-generic:v1.18.14@sha256:6a77082c3938edad0433f53c46a90b8da08c9e4a9a255e51a1c2ff410db60104

operator

quay.io/cilium/operator:v1.18.14@sha256:5709d0b8c44f23a528b90833444159eaed8a5f757ec07530fc5f693c3f969ecc

Original source

Summary of Changes
⚠️ Due to a release issue, the v1.21.0-pre.1 has not been completed, instead we are publishing v1.21.0-pre.2. This changelog contains the changes from v1.21.0-pre.0 to v1.21.0-pre.2
Major Changes:
Add support for Gateway API session persistence (#48029, @thorn3r)
Allow use of AWS managed prefix lists in Cilium policies. (#45806, @bodgit)
Enable BPF masquerading by default (#47631, @pchaigno)
network driver: add sriov device manager (#47387, @bersoare)
Minor Changes:
Add cilium-dbg bpf stats report command to collect and display eBPF program runtime statistics. (#47186, @amchelapurath2023)
aws: Use GetSecurityGroupsForVpc to fetch security groups (#47704, @HadrienPatte)
bpf: Support configuring an extended masquerade port range (--node-port-nat-range-ext) for BPF SNAT masquerading. (#47301, @yyyyyymmm)
CiliumPodIPPools now support reservedRanges for multi-pool IPAM. (#46880, @kyounghoonJang)
clustermesh: handle a remote cluster ID change. Also improve cluster ID verification in operator/kvstoremesh similarly to existing agent logic. (#47747, @MrFreezeex)
clustermesh: set tls authMode to cluster by default (#48170, @MrFreezeex)
envoy: Add support for HTTP CONNECT (#45051, @nezdolik)
etcd: add new metrics for watch and paginated list calls (#47602, @odinuge)
gateway-api: node label selector for when hostNetwork is enabled (#47463, @xtineskim)
Helm: user-supplied annotations now take precedence over the chart's prometheus.io/scrape and prometheus.io/port annotations, which no longer render as duplicate keys. (#47850, @amaanx86)
Hubble flow endpoints now include the Kubernetes Pod UID. (#47906, @devodev)
Hubble now populates ingress_allowed_by / egress_allowed_by on policy verdict flows for the host endpoint (host firewall). (#48031, @christarazi)
hubble: surface the datapath ext_err extended drop reason in flows via the new ext_error and ext_drop_reason_desc fields, matching the output of cilium monitor. (#46663, @amaanx86)
install/kubernetes: IPv6 masquerading is now disabled by default when installing with mode ENI matching the IPv4 behavior. (#48071, @41ks)
ipam/eni: Derive ENI primary address usage from CiliumNode spec (#46987, @HadrienPatte)
KVStoreMesh is now unconditionally enabled when the clustermesh-apiserver is enabled. (#48439, @giorio94)
loadbalancer: Add metrics that provide visibility into the capacity and utilisation of ID allocators within the loadbalancer control plane. (#47746, @ajmmm)
Mark CiliumNetworkPolicy resources invalid when their endpointSelector explicitly selects a different Kubernetes namespace. (#47038, @dlanov)
The cilium-dbg preflight migrate-identity utility is deprecated in favor of the "Double Write" identity allocation modes (#48429, @giorio94)
The AWS ENI vpc-id field in the CNI configuration can no longer override the value discovered from IMDS. A warning is logged instead if the two differ. (#47980, @HadrienPatte)
The Cilium Operator will automatically perform a storage version migration for obsolete Cilium-manged objects. (#48210, @squeed)
vendor: Update k8s libraries to v1.37.0 (#48400, @HadrienPatte)
Bugfixes:
.github: Bump cilium/reusable-workflows to v0.1.1 (#48462, @joestringer)
aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (#48125, @41ks)
aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (#48193, @41ks)
bpf: dsr: don't look for TCP header on fragmented packets (#47640, @julianwiedmann)
bpf: Fix agent crash when dumping map events (#48273, @joestringer)
bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (#48407, @41ks)
Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (#48262, @giorio94)
clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (#47824, @MrFreezeex)
datapath: turn ARP off on the base devices before bringing them up (#47838, @aanm)
endpoint/restore: skip cleanup for reserved internal endpoints (#48272, @fristonio)
endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (#47880, @weizhoublue)
endpoint: preserve concurrent policy updates for new endpoints (#48195, @jrajahalme)
ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. (#47034, @41ks)
envoy.httpUpstreamLingerTimeout accepts 0 as a chart value and templates into configmap. (#47741, @jdw6359)
Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (#47765, @julianwiedmann)
Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (#47802, @bimmlerd)
Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (#47727, @aanm)
Fix a pod created immediately after a network policy change reporting a stale policy revision for up to two minutes. (#47642, @aanm)
Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association (#47874, @bryanhorstmann)
Fix an issue where Gateway API URLRewrite ReplaceFullPath filters containing unescaped backreferences were silently bypassed by Envoy out of safety. (#48281, @MasloMaslane)
Fix BGP defaultGateway peer auto-discovery selecting a default route from a non-main routing table, such as the default via cilium_host route Cilium installs in the from-proxy table, instead of the node's real default gateway. (#47971, @ecbaldwin)
Fix bug causing policies using label selectors of long namespace labels being dropped (#47845, @odinuge)
Fix bug where identities may linger for double the amount of the expected time (#48032, @christarazi)
Fix dropping traffic L2Announcement with externalTrafficPolicy: Local (#46399, @yuito-it)
Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. (#47943, @taaahaaa)
Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. (#47929, @shreyasrajiv327)
Fix Hubble Relay remains running during termination (#47942, @xandau)
Fix ICMP error packet handling by adding the missing checksum recalculation performed during NAT for SNATed load-balanced traffic. (#48086, @julianwiedmann)
Fix IPv6 Router Solicitations and Router Advertisements being dropped with "Unsupported protocol for NAT masquerade" on nodes whose BPF masquerade address is a link-local address. (#48094, @ecbaldwin)
Fix missing config setup for 'enable-non-default-deny-policies' flag (#48391, @fristonio)
Fix multiple regressions in Cilium LocalRedirectPolicy (#46638, @ajmmm)
Fix node-init startup on GKE 1.36.2-gke.2064000 nodes by detecting GKE from the kubelet path instead of container runtime configuration. (#47945, @dlanov)
Fix nodeport egress tuple reuse for closed connections (#48306, @fristonio)
fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (#47754, @weizhoublue)
Fix: data race for unlocked map read in regeneration goroutine (#47103, @weizhoublue)
fix: Prevent Installation Failures When Hubble TLS Uses External Certificate Volumes (#47231, @weizhoublue)
Fixed cilium connectivity perf always reporting Cilium version: 0.0.0 instead of the actual detected Cilium version. (#47927, @khaddict)
Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (#47915, @giorio94)
Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (#47635, @aanm)
Fixes a bug where clusters originally created in v1.15 or earlier failed to upgrade due to dropping the CRD version CiliumNodeConfig v2alpha1. (#48087, @squeed)
Fragmented UDP packets were potentially mis-classified as Cilium Wireguard traffic. (#48139, @julianwiedmann)
gateway-api/gamma: refresh CEC owner refs on route recreation (#47840, @mhofstetter)
gateway-api: an HTTPRoute rule with an ExternalAuth filter and no resolvable backend no longer calls the external authorization service before returning its 500 response. (#48242, @eufriction)
gateway-api: filter CEC controls from infrastructure metadata (#47732, @nezdolik)
gateway-api: fix listener programmed status update (#48013, @mhofstetter)
gateway-api: Fixed a bug where a Route parented to a ListenerSet could trigger reconciliation of an unrelated GAMMA Service sharing the same name. (#48235, @eufriction)
gateway-api: mark unresolved backend service ports in route status (#47766, @mhofstetter)
gateway-api: propgate listenerset status update errors (#48130, @mhofstetter)
gateway-api: requeue L4/TLS routes on ServiceImport updates (#47702, @mhofstetter)
Improve reliability for fast recovery of disrupted TCP connections that access a DSR-enabled Service. (#48254, @julianwiedmann)
ipcache: fix CIDR reference counter to use canonical prefixes (#47208, @iwanhae)
l2announcer: use unambiguous separator in Lease name to avoid collision (#48138, @waterWang)
L7 conformance CI fixes (#47517, @fristonio)
lb (fix): require active state for backend when using topology hints (#47054, @CarrySauce)
Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (#47826, @mehrdadbn9)
nodediscovery: Reduced EC2 IMDS load and made ENI node registration more resilient by fetching the instance metadata once instead of on every CiliumNode update. (#48218, @41ks)
operator/ipam: recover ENI IPAM nodes that were dropped from the instance cache by a full ENI resync, instead of requiring an operator restart (#46839, @ryanjwong)
operator/ipam: Restore fatal exit when the IPAM node watcher fails (#47778, @HadrienPatte)
operator: Emit startup logs in the configured log format (#47890, @HadrienPatte)
operator: prevent CNPs with nodeSelector from silently enforcing nothing (#47882, @weizhoublue)
pkg/mtu: Added a fallback to an MTU of 1500 bytes if no network devices are selected for MTU detection. Fixed a bug where Cilium would fail to find the appropriate MTU to use when in IPAM ENI mode with IPv6 enabled. (#47643, @41ks)
Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (#47844, @bimmlerd)
standalone-dns-proxy: return an error when no endpoint is found (#47791, @vipul-21)
Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (#48015, @giorio94)
sysdump: reject collected file names that resolve outside the sysdump directory (#46609, @sage-mode-hunter)
The BPF NAT engine now drops ICMP error packets which contain a fragmented TCP/UDP/SCTP packet. (#48174, @julianwiedmann)
When using DSR with --bpf-lb-dsr-dispatch set to "opt" or "geneve" in combination with --enable-pmtu-discovery, fix the outer source IP of the ICMP error message which is generated when a forwarded DSR request exceeds the network interface's MTU. (#48053, @julianwiedmann)
CI Changes:
.github: Add /default ariane workflows to /test (#48267, @joestringer)
.github: add ariane trigger phrase for e2e upgrade test (#47957, @atykhyy)
.github: Run envoy image check against PR content (#47792, @joestringer)
.github: Simplify permissions for image linter workflow (#47753, @joestringer)
ariane-scheduled: Use gh-run-nr to ensure even distribution (#47807, @gandro)
ariane: move kind-proxy-embedded and kubespray workflows to /test (#47743, @giorio94)
bpf: complexity-tests: de-dup bpf_lxc configs (#48230, @julianwiedmann)
bpf: complexity-tests: remove duplicated configs (#47722, @julianwiedmann)
BPF: Refactor nat tests to use scapy fixtures and add checksum coverage (#47222, @tommyp1ckles)
bpf: tests: fix up prog type in ipv6_test (#47736, @julianwiedmann)
bpf: tests: remove left-over IPV4_DIRECT_ROUTING (#48182, @julianwiedmann)
bpf: tests: remove legacy DSR LB tests (#48530, @julianwiedmann)
bpf: tests: use PROG_TYPE (#47714, @julianwiedmann)
bpf: tests: validate CT entry for DSR connection (#48219, @julianwiedmann)
chore: set cron for arian-scheduled for 30 mins past hour (#47772, @sekhar-isovalent)
ci: cleanup disk space in documentation workflow (#48427, @tklauser)
ci: draft renovate PRs until ciliumbot auto-approval (#47364, @mhofstetter)
CI: extend Cilium LocalRedirectPolicy NodeLocalDNS e2e test coverage to include IPv6. (#48192, @ajmmm)
ci: migrate set-commit-status to cilium/actions (#47771, @bogdankrasko)
ci: monitor additional composite actions with Renovate (#47783, @bogdankrasko)
ci: replace needs-attention action and use app client ID (#47788, @bogdankrasko)
ci: replace unsupported LLVM installation action (#47776, @bogdankrasko)
ci: resolve renovate PR metadata in base image workflows (#47964, @mhofstetter)
ci: skip etcd log fetch when kvstore was never started (#47801, @aanm)
ci: stop asking a PHP app for the AKS runner IP (#48371, @aanm)
ci: update k8s matrixes for 1.36 (#47846, @nbusseneau)
ci: use GitHub App client ID in v1.18 image workflow (#47785, @bogdankrasko)
ci: use GitHub App client ID in v1.19 image workflow (#47786, @bogdankrasko)
ci: use GitHub App client ID in v1.20 image workflow (#47787, @bogdankrasko)
cilium-cli: bump test-connection-disruption image to v0.0.18 (#47806, @aanm)
cilium-cli: disable host-firewall-egress-to-fqdns test on RHEL (#47970, @atykhyy)
cilium-cli: don't count pods rejected before running as live (#47839, @aanm)
cilium-cli: fix nil node crash in conn-disrupt NS-traffic setup (#48431, @aanm)
cilium-cli: keep connectivity perf usable without Cilium (#48128, @aanm)
cilium-cli: Skip HostToWorld if no external IPv6 (#47931, @joamaki)
cli/connectivity: tolerate exec-proxy blips in readiness waits (#48189, @aanm)
datapath/loader: fix missing complexity coverage for enable_identity_mark (#48037, @tklauser)
endpointmanager: Give test endpoints a policy computer (#48447, @aanm)
Fix missing events_map_rate_limit complexity coverage (#47691, @pchaigno)
Fix the Renovate entrypoint to run with the ubuntu group instead of GID 0, and restore builder.sh's rejection of root. (#46652, @bitflicker64)
gh: enable upgrade testing for wireguard with strict-ingress mode (#47756, @julianwiedmann)
gh: remove backport-label-updater for v1.17 (#48180, @julianwiedmann)
gh: renovate: stop managing the v1.17 branch (#47715, @julianwiedmann)
gh: verifier: test PR branch before base branch (#47928, @julianwiedmann)
gha/conformance-aks: add a timeout to the cluster create step (#48545, @aanm)
gha/conformance-aks: give the nodes a 64 GiB OS disk (#48481, @aanm)
gha/e2e-upgrade: gate the after-agent-restart conn-disrupt check (#47440, @aanm)
gha/kubespray: don't wait for CoreDNS before Cilium is installed (#48048, @aanm)
gha/kubespray: run on schedule, rather than on every push (#47719, @giorio94)
gha/lvh-kind: respect Kind image version also when config is provided (#47703, @giorio94)
gha/net-perf-gke: move off us-east5 (#48490, @aanm)
gha/scale-clustermesh: explicitly set authentication mode (#48361, @giorio94)
gha: bound the LLVM prereq apt step with a 5m timeout (#48069, @aanm)
gha: compute the ginkgo cache key once, before the matrix (#48127, @aanm)
gha: don't install LLVM and Clang in integration tests workflow (#47717, @giorio94)
gha: fix checkout of trusted branch in smoke and k8s-kind workflows (#47724, @giorio94)
gha: move GCP auth pin past the STS token exchange retry fix (#48352, @aanm)
gha: publish the external target hostnames as FQDNs (#48478, @aanm)
gha: stop JUnit reports being destroyed by same-name legs (#48203, @aanm)
gha: survive a GKE zone running out of capacity (#48184, @aanm)
golangci-lint: Migrate checks from bash scripts to forbidigo/depguard rules (#47946, @HadrienPatte)
images/scripts: Validate Envoy image vars against sed injection (#47205, @MasloMaslane)
loader: Improve verifier test debugging (#48194, @pchaigno)
loader: Support newer verifier logs (#48207, @pchaigno)
logging: downgrade canceled response-body reads to info (#48202, @aanm)
renovate: point the builder Go caches at the shared /tmp (#48528, @aanm)
Revert "ci: add drop monitor for GKE conformance tests" (#47812, @julianwiedmann)
Revert "gha: don't install LLVM and Clang in integration tests workflow" (#47780, @giorio94)
Revert 48265 - disable local accounts on AKS clusters (#48523, @aanm)
Revert PR 48192 (#48231, @aanm)
Set envoy.httpRetryTimeout to one second and envoy.httpUpstreamLingerTimeout to zero to recover from 5-tuple collisions between L7-LB and non-L7-LB traffic. (#47277, @jrajahalme)
test(bpf): parallelize eBPF test compilation (#47426, @lconnery)
test(bpf): parallelize eBPF test execution (#47427, @lconnery)
test/cyclonus: log the JUnit XML instead of copying it from a dead pod (#47725, @aanm)
test/k8s: wait for the L7 visibility policy to be realized (#48365, @aanm)
tools: complexity: de-couple StackDepth from kernel version (#48236, @julianwiedmann)
workflows: disable local accounts on AKS clusters (#48265, @nbusseneau)
xds: make mock metrics concurrency-safe (#48177, @mhofstetter)
Misc Changes:
.github: Set issue type on bug report and feature templates (#47849, @HadrienPatte)
[CFP-39876]: Add connectivity test for non-global namespace isolation (#46604, @jimassa)
Address Go 1.27 modernize linter warnings (#48201, @tklauser)
api: Migrate SNAT exclusion CIDRs to netip (#47548, @HadrienPatte)
api: Migrate the IPAM address response IP/gateway/CIDRs to netip (#47752, @HadrienPatte)
api: Resync server.gotmpl with go-swagger v0.36.1 (#47773, @HadrienPatte)
api: Type the MAC fields as mac.MAC (#47851, @HadrienPatte)
auth: Observe node table for map cleanup (#48079, @joamaki)
bgp,doc: Remove some outdated document and move LB-IPAM document out of BGP tree (#47796, @YutaroHayakawa)
bgp: Move bgp config flags to bgp cell (#48088, @martonra)
bgp: watch only the local CiliumBGPNodeConfig in the agent to reduce resource usage (#48299, @rastislavs)
bpf, datapath: move ENCAP4_IFINDEX, ENCAP6_IFINDEX to runtime config (#48238, @viktor-kurchenko)
bpf, datapath: move inter-cluster SNAT address to runtime config (#47680, @viktor-kurchenko)
bpf, datapath: move IPv4 router address to runtime config (#48303, @viktor-kurchenko)
bpf, datapath: move IPv4 SNAT exclusion to runtime config (#48065, @viktor-kurchenko)
bpf, datapath: move IPv6 SNAT exclusion to runtime config (#48162, @viktor-kurchenko)
bpf, datapath: move IPv{6,4} direct routing address to runtime config (#47888, @viktor-kurchenko)
bpf, datapath: move the CT_* params to runtime config (#47537, @viktor-kurchenko)
bpf, socketlb: move MKE host to runtime config (#47979, @viktor-kurchenko)
bpf,datapath: simplify RSS runtime configuration (#47883, @viktor-kurchenko)
bpf/lib/nat: rename icmpoff (#47797, @tommyp1ckles)
bpf/nat: Move IPv6 nat entry to map (#47762, @pchaigno)
bpf: Condition ICMPv6 SNAT on IPv6 BPF masquerading (#47554, @julianwiedmann)
bpf: conntrack: don't report SYN-ACK as 'observed SYN' (v2) (#48179, @julianwiedmann)
bpf: dsr: only require DSR-info on SYN packet (#47592, @julianwiedmann)
bpf: extract L3/L4 rewrite+checksum helpers for sharing codebase (#47673, @yushoyamaguchi)
bpf: icmp*: fix up sample length (#48020, @julianwiedmann)
bpf: icmp*: minor cleanups (#48049, @julianwiedmann)
bpf: icmp*: simplify flipping of the L2 addrs (and various XDP cleanups) (#48397, @julianwiedmann)
bpf: ipv6: remove unused ipv6_addr_is_mapped() helper (#48474, @tklauser)
bpf: l2-responder: clarify scope of some variables (#47959, @julianwiedmann)
bpf: l2-responder: remove tmp variable (#48362, @julianwiedmann)
bpf: lb: use dedicated new_backend bool (#47841, @julianwiedmann)
bpf: loader: make AUX per-CPU offset branch-free via power-of-two sizing (#48120, @smagnani96)
bpf: lxc: move lb4_ctx_restore_state() comment to the correct place (#48484, @tklauser)
bpf: lxc: switch cilium_tail_call_buffer* to auxvar (#48521, @julianwiedmann)
bpf: misc cleanups (#47879, @julianwiedmann)
bpf: misc cleanups (#47966, @julianwiedmann)
bpf: misc cleanups (#48298, @julianwiedmann)
bpf: misc. cleanup (#48372, @tklauser)
bpf: narrow variable declaration scopes (#48438, @tklauser)
bpf: nat: extract inner IPv6 header from ICMP payload in-place (#47917, @julianwiedmann)
bpf: nat: simplify snat_v4_calc_icmp_error_csum_diff() (#48296, @julianwiedmann)
bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (#46232, @julianwiedmann)
bpf: Reduce stack usage of send_trace_notify (#47911, @joamaki)
bpf: remove always unused snat_v{4,6}_rev_nat ext_err parameter (#48294, @tklauser)
bpf: remove stubs.h (#48112, @julianwiedmann)
bpf: remove unused router_mac variables (#48283, @tklauser)
bpf: Replace mac_t with union macaddr and mac.Uint64MAC with mac.MAC (#48249, @HadrienPatte)
bpf: srv6: extract maps to srv6_maps.h (#48181, @julianwiedmann)
bpf: srv6: move SRv6 map structs to srv6.h (#47934, @julianwiedmann)
bpf: switch egress encryption strict mode to runtime configuration (#44846, @Bigdelle)
bpf: tailcall: remove _eval() and friends (#48172, @julianwiedmann)
bpf: use eth{load,store}_* helpers instead of open-coding (#48293, @tklauser)
bpf: xdp: use sec_identity_to_tunnel_vni() instead of open-coding (#48473, @tklauser)
bugtool: write empty archive entry when a file cannot be opened (#47409, @FirePheonix)
chore(deps): update all github action dependencies (main) (#47861, @cilium-renovate[bot])
chore(deps): update all github action dependencies (main) (#47987, @cilium-renovate[bot])
chore(deps): update all github action dependencies (main) (#48006, @cilium-renovate[bot])
chore(deps): update all github action dependencies (main) (#48144, @cilium-renovate[bot])
chore(deps): update all github action dependencies (main) (#48321, @cilium-renovate[bot])
chore(deps): update all github action dependencies (main) (#48502, @cilium-renovate[bot])
chore(deps): update all github action dependencies (main) (patch) (#48164, @cilium-renovate[bot])
chore(deps): update all lvh-images main (main) (patch) (#47862, @cilium-renovate[bot])
chore(deps): update all lvh-images main (main) (patch) (#47983, @cilium-renovate[bot])
chore(deps): update all lvh-images main (main) (patch) (#48143, @cilium-renovate[bot])
chore(deps): update all lvh-images main (main) (patch) (#48317, @cilium-renovate[bot])
chore(deps): update all-dependencies (main) (#47744, @cilium-renovate[bot])
chore(deps): update all-dependencies (main) (#47859, @cilium-renovate[bot])
chore(deps): update all-dependencies (main) (#48145, @cilium-renovate[bot])
chore(deps): update all-dependencies (main) (#48204, @cilium-renovate[bot])
chore(deps): update all-dependencies (main) (#48316, @cilium-renovate[bot])
chore(deps): update all-dependencies (main) (#48343, @cilium-renovate[bot])
chore(deps): update all-dependencies (main) (#48503, @cilium-renovate[bot])
chore(deps): update base-images (main) (#47947, @cilium-renovate[bot])
chore(deps): update base-images (main) (#48095, @cilium-renovate[bot])
chore(deps): update base-images (main) (#48322, @cilium-renovate[bot])
chore(deps): update base-images (main) (#48500, @cilium-renovate[bot])
chore(deps): update cilium/cilium action to v1.20.1 (main) (#48165, @cilium-renovate[bot])
chore(deps): update cilium/cilium-cli action to v0.20.0 (main) (#48471, @cilium-renovate[bot])
chore(deps): update dependency renovatebot/renovate to v44.42.0 (main) (#48340, @cilium-renovate[bot])
chore(deps): update dependency renovatebot/renovate to v44.43.0 (main) (#48342, @cilium-renovate[bot])
chore(deps): update dependency renovatebot/renovate to v44.45.1 (main) (#48347, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.26.5 docker digest to 2005724 (main) (#47860, @cilium-renovate[bot])
chore(deps): update docker/setup-qemu-action action to v4.3.0 (main) (#48516, @cilium-renovate[bot])
chore(deps): update module oras.land/oras-go/v2 to v2.6.2 [security] (main) (#47749, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.3-1786448858-9326c1e0ad17d6449851ec3170611f2a66cb9035 (main) (#47907, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.3-1786810643-4408e58b2a8a16a921d3f13c8c690a788655f0ba (main) (#47984, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.3-1786847928-0512632eff02ed4971b16926ae6b82a3c0e07a70 (main) (#47997, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.4-1787987575-140a56cf682197aba29b9d5cd5f786d376ee9286 (main) (#48318, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.4-1788418248-230e609978a4f7e614671e0e7e00a1911b93406c (main) (#48450, @cilium-renovate[bot])
chore(deps): update quay.io/goswagger/swagger docker tag to v0.36.2 (main) (#47863, @cilium-renovate[bot])
chore(deps): update quay.io/goswagger/swagger docker tag to v0.36.4 (main) (#47985, @cilium-renovate[bot])
chore(deps): update quay.io/goswagger/swagger docker tag to v0.36.5 (main) (#48319, @cilium-renovate[bot])
ci: disable TCP/UDPRouteWeightedRouting gateway-api conformance tests (#48375, @0xch4z)
cilium-cli: constrain obsolete service-related log exceptions (#48542, @julianwiedmann)
cilium-cli: Replace reflect.DeepEqual with assert.Equal in tests (#47533, @HadrienPatte)
CLI: add toleration for a single etcd container restart (#48106, @giorio94)
CLI: add toleration for three more log warnings (#48091, @giorio94)
CLI: more log warning tolerations (#48409, @giorio94)
cli: the CLI now considers the ENI IPv6 beta warning log as expected and detects EKS flavor for IPv6 EKS clusters. (#47524, @41ks)
clustermesh/endpointslices: explicitly limit maximum decoder memory (#47932, @giorio94)
clustermesh: add a generic cache store (#48198, @MrFreezeex)
clustermesh: add FuncObserver and generic bridge to ctrlruntime requests (#48028, @MrFreezeex)
clustermesh: start migrating from legacy daemon config to ClusterInfo (#47514, @MrFreezeex)
clustermesh: transition service exports to observer (#47955, @MrFreezeex)
Convert SocketFilter.DestIp to netip.Addr (#47707, @Wise-Wizard)
datapath/iptables: Bring back IPSetFilterFn (#48205, @joamaki)
datapath/iptables: Synchronize node IP sets from table (#48077, @joamaki)
datapath/linux/config: remove duplicate legacy interface ifindex declaration (#48436, @tklauser)
datapath/linux: Reconcile nodes from node table (#48124, @joamaki)
datapath: Migrate IPv{4,6}PodSubnets to ip.Prefix (#48253, @HadrienPatte)
datapath: Migrate auxilary prefixes to netip (#48026, @HadrienPatte)
datapath: move some feature probes into BPF (#47737, @julianwiedmann)
Delete the pkg/cidr package (#48415, @HadrienPatte)
devcontainer: Update to work with new ubuntu 26.04 base and skip redundant nested container exec (#48082, @HadrienPatte)
docs/ipam: Fix incorrect multi-pool IPAM annotation name in documentation (#48126, @hanapedia)
docs: add OpenChoreo to USERS.md (#47924, @kavishkafernando)
docs: add Verbano Tech to USERS.md (#47789, @Verbano-Tech)
docs: Avoid indexing documentation fragments (#48358, @joestringer)
docs: clarify GAMMA DROP_EP_NOT_READY events (#47587, @thorn3r)
docs: Fix chart --version flag (#47709, @joestringer)
docs: fix extra closing parenthesis in hive.rst (#48541, @logi74123)
docs: Improve build process (#47751, @joestringer)
docs: Make render-docs work on macOS. (#47820, @eufriction)
docs: Remove v1.18 ipsec documentation (#48224, @joestringer)
Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (#48428, @marcus-chae)
Document the IPv6 cluster-pool CIDR and per-node mask size relationship for Cluster-pool IPAM. (#46282, @morning-verlu)
Documentation: document mesh security model (#47912, @bimmlerd)
egressgw: replace open-coded CIDR format in CEGP (#47384, @julianwiedmann)
envoy: Clarify legacy UpdateEnvoyResources (#48066, @jrajahalme)
Fix (eBPF): Pointer-to-Pointer Misuse in IPv6 Trace Notifications (#47908, @weizhoublue)
Fix bpf checkpatch.pl style issues (#48305, @joestringer)
Fix Component Overview doc link rendering (#48537, @eneiss)
fix(deps): update all go dependencies main (#47937, @julianwiedmann)
fix(deps): update all go dependencies main (main) (#47958, @cilium-renovate[bot])
fix(deps): update all go dependencies main (main) (#47986, @cilium-renovate[bot])
fix(deps): update all go dependencies main (main) (#48007, @cilium-renovate[bot])
fix(deps): update all go dependencies main (main) (#48117, @cilium-renovate[bot])
fix(deps): update all go dependencies main (main) (#48142, @cilium-renovate[bot])
fix(deps): update all go dependencies main (main) (#48163, @cilium-renovate[bot])
fix(deps): update all go dependencies main (main) (#48320, @cilium-renovate[bot])
fix(deps): update module github.com/azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v10 to v11 (main) (#48146, @cilium-renovate[bot])
fix(deps): update module github.com/google/go-github/v89 to v90 (main) (#47876, @cilium-renovate[bot])
fix(deps): update module google.golang.org/grpc to v1.83.1 [security] (main) (#48387, @cilium-renovate[bot])
fix(deps): update module google.golang.org/grpc to v1.83.2 [security] (main) (#48574, @cilium-renovate[bot])
Fixed broken Slack link on Community page. (#48021, @ps-mir)
Fixed Gateway API TLSRoute, TCPRoute, and UDPRoute backends to require a port, dropping portless entries instead of producing broken nil-port backend config. Fixed HTTPRoute and GRPCRoute RequestMirror backends to apply the same port requirement. (#46474, @marcofranssen)
Fixes: Update node-cache image version to 1.26.5 (#48270, @zyue110026)
fqdn: document serial assumption for DNS over TCP (#48183, @bimmlerd)
gateway-api: allow local path for conformance tests (#47726, @asauber)
gateway-api: avoid logging missing GatewayClass as error (#48529, @mhofstetter)
gateway-api: deduplicate condition merge helpers (#48122, @mhofstetter)
gateway-api: export ReferenceGrant helper to allow reuse (#48234, @eufriction)
gateway-api: extract BackendTLSPolicy status handling into BackendTLSPolicyStatusManager (#48068, @mhofstetter)
gateway-api: extract gateway address status handling (#48129, @mhofstetter)
gateway-api: extract index & load functionality from controller / reconcile (#47837, @mhofstetter)
gateway-api: extract listener status handling (#48103, @mhofstetter)
gateway-api: extract route status handling into RouteStatusManager (#48023, @mhofstetter)
gateway-api: make gateway-api reconciler client and scheme fields private (#48191, @mhofstetter)
gateway-api: only load referenced services & serviceimports (#48469, @mhofstetter)
gateway-api: put ctx first in route status API (#48074, @mhofstetter)
gateway-api: remove duplicate gateway reconcile error logs (#48186, @mhofstetter)
gateway-api: remove Gateway LBIPAM annotation warning (#48187, @mhofstetter)
gateway-api: remove pre-filtered namespaces concept (#47685, @asauber)
gateway-api: remove unnecessary TLSRoute support checks (#47758, @mhofstetter)
gateway-api: return route check errors directly (#47607, @mhofstetter)
gateway-api: validate gRPCRoute header modifiers in status (#47606, @mhofstetter)
gh: remove remaining v1.17 references (#48215, @aanm)
gh: remove v1.17 from bug report template (#48176, @julianwiedmann)
gha/lint-ariane-config: let Renovate manage the Go version (#48467, @aanm)
gha: authenticate Image CI to quay.io with OIDC (#47742, @aanm)
gha: authenticate release images with OIDC (#48062, @aanm)
gha: authenticate stable Image CI to quay.io with OIDC (#48061, @aanm)
gha: correct and move the OIDC subject comments (#48370, @aanm)
gha: raise the Docker Hub OIDC token lifetime for release builds (#48535, @aanm)
golangci-lint: Fix netlink.AddrList escaping the forbidigo check (#47903, @HadrienPatte)
golangci-lint: Forbid stdlib net.Interface* functions (#47902, @HadrienPatte)
health/client: replace deprecated http.Transport.Dial with DialContext (#47858, @uuditmisra)
helm: add general busybox image values for substitution (#47973, @0xch4z)
Hide statedb table indexes behind query helpers (#48119, @tklauser)
hubble: don't fail when marshaling unknown flow extensions (#48374, @glrf)
hubble: Observe node table for peer updates (#48076, @joamaki)
identity, clustermesh: use ClusterInfo for identity (#48314, @viktor-kurchenko)
identity: improve NumericIdentity layout comment (#48494, @viktor-kurchenko)
images/builder: Base on Ubuntu directly instead of the runtime image (#47096, @HadrienPatte)
Improve canned responses for contributors (#47852, @joestringer)
ipam/aws: Extract AWS-only logic from the global pkg/ipam package (#48131, @HadrienPatte)
ipam: Accept native routing CIDR that is a subnet of the VPC CIDR (#47748, @HadrienPatte)
ipam: allow CiliumPodIPPool storage version migration (#48411, @kyounghoonJang)
ipam: Type the cloud provider MAC fields in the CiliumNode status (#48197, @HadrienPatte)
ipcache: add special "remove-all-metadata" placeholder type (#48287, @squeed)
iptables: add cilium comment to node-local-dns NOTRACK rules (#47191, @vipul-21)
k8s/testutils: Validate CRDs on k8s/add and k8s/update by default (#47469, @christarazi)
k8s: migrate from legacy config to ClusterInfo (#47854, @MrFreezeex)
kvstore: drop unused [IPIdentityPair.Mask] (#47628, @giorio94)
lib/auxvars.h: Let AUX() zero value. (#48300, @dylandreimerink)
loadbalancer: format SkipLB addresses with netip (#47562, @YusufKaya00)
mac: Make mac.MAC a [6]byte (#48089, @HadrienPatte)
MAINTAINERS: Add Harsimran Singh Pabla (#48483, @brb)
MAINTAINERS: Add Jordan Rife (#48570, @joestringer)
MAINTAINERS: Add Rastislav Szabo (#48495, @YutaroHayakawa)
Makefile.kind, contrib: add kind environment for topology aware routing (#48228, @gyutaeb)
Migrate the native routing CIDRs from *cidr.CIDR to netip.Prefix (#47459, @HadrienPatte)
neighbordiscovery: Observe node table for neighbor discovery (#48080, @joamaki)
network driver: simplify statedb table management and remove redundant data from the table (#48051, @bersoare)
network driver: use statedb to manage agent state (#47558, @bersoare)
node/manager: Populate node table from manager (#45953, @joamaki)
node: Add NodeWriter and use it in NodeManager (#48100, @joamaki)
node: Bridge SetPrefixClusterMutatorFn to Writer (#48357, @joamaki)
node: Derive cluster-size intervals from table (#48101, @joamaki)
node: In writer restore the cilium internal IP conflict exemption (#48232, @joamaki)
node: Migrate IPv{4,6}IngressIP to netip (#47165, @HadrienPatte)
node: migrate GetNodeID to netip.Addr (#47471, @PragalvaXFREZ)
node: Migrate native routing CIDRs to netip.Prefix (#48010, @HadrienPatte)
node: Node table reconciler registration (#48268, @joamaki)
node: Serve cluster nodes from StateDB (#48081, @joamaki)
Normalize my name in AUTHORS and .mailmap (#48304, @gentoo-root)
operator/endpointslice: fix processing of pods without an identity (#47965, @giorio94)
operator/identitygc: remove write-only type GC fields (#48072, @tklauser)
operator/ipam: Remove the per-node pool-maintainer retry trigger (#47939, @HadrienPatte)
operator: fix CID controller warn log (#47697, @kamilWyszynski1)
policy: migrate from legacy config to ClusterInfo (#47855, @MrFreezeex)
policy: Regenerate endpoint holding a superseded policy (#48386, @christarazi)
Prepare for release v1.21.0-pre.0 (#47700, @cilium-release-bot[bot])
Prepare for release v1.21.0-pre.1 (#48532, @cilium-release-bot[bot])
README: Update releases (#47710, @joestringer)
README: Update releases (#48044, @aanm)
renovate: Allow cilium-envoy v1.38.x for v1.19 and v1.18 (#48311, @sayboras)
renovate: Bump cilium-envoy version (#47892, @sayboras)
renovate: cap golangci-lint to the branch's Go version (#48402, @aanm)
renovate: drop the cooldown for the Go toolchain (#48468, @aanm)
renovate: let gomod major upgrades ignore the vendor directory (#48188, @aanm)
renovate: raise the golang ceiling for v1.20 to below 1.27 (#48401, @aanm)
Revert "cli: drop restarts exclusion for Cilium v1.16 and earlier" (#48115, @giorio94)
Revert 47631 - Enable BPF masquerading by default (#48475, @aanm)
Simplify cilium policy API types validation and parsing (#47154, @fristonio)
slim/k8s: Reduce agent and operator memory usage by removing unused fields from the slim Kubernetes types (#47856, @HadrienPatte)
test: Forbid reflect.DeepEqual in test code (#47891, @HadrienPatte)
Update documentation dependencies (#47750, @joestringer)
Use netip.Addr.Is{4,6} to check address family (#48430, @tklauser)
Use k8s API constants instead of string literals (#47505, @HadrienPatte)
vendor,pkg/{k8s,datapath}: Bump to StateDB v0.9.1 and fix API change (#48404, @joamaki)
vendor: Bump StateDB to v0.8.4 (#48245, @joamaki)
vendor: Bump to StateDB v0.9.0 (#48261, @joamaki)
vendor: Update cel-go module import path (#48341, @HadrienPatte)
vendor: Update controller-tools to v0.22.0-1 (#48408, @HadrienPatte)
wireguard: Reconcile peers from node table (#48078, @joamaki)
Docker Manifests
cilium
quay.io/cilium/cilium:v1.21.0-pre.2@sha256:5ccc6012a4fce1724f6d16571d20a18263511f27ab6df1e1807c397ac2408ff6
clustermesh-apiserver
quay.io/cilium/clustermesh-apiserver:v1.21.0-pre.2@sha256:2444034d41bfc05ea7cf559b11d94c1db686dba74b640f0d3fa5da229a725b5f
hubble-relay
quay.io/cilium/hubble-relay:v1.21.0-pre.2@sha256:708a1ad3f531b1f91e584eae70aa32ae00d5d566291b99948bf982799af0a6e7
operator-alibabacloud
quay.io/cilium/operator-alibabacloud:v1.21.0-pre.2@sha256:36c25de32d6e61379d5e085f4c12fef5a4c1d9338737486e9dc62be47c18eb2f
operator-aws
quay.io/cilium/operator-aws:v1.21.0-pre.2@sha256:5dd1fb486990ef9e03124cf167c94007c0b6894b0f44c2a943d5dddcad8f5749
operator-azure
quay.io/cilium/operator-azure:v1.21.0-pre.2@sha256:09691506aee59eeb3246e0ff843447d0c5eeeb9b416695e8ec1cf5748d53a9fd
operator-generic
quay.io/cilium/operator-generic:v1.21.0-pre.2@sha256:57e9d7c80d17e675f2c685925f876d6358cea19ac0bfa4bb64b19aa702a766dd
operator
quay.io/cilium/operator:v1.21.0-pre.2@sha256:2b177e7ec2a667d2f6a5e1befafa7a68ac78646fdb9c083794282ba26d32ea5f

Original source