chore: update helm charts

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

Update Request | Renovate Bot

This PR contains the following updates:

Package	Update	Change
cilium (source)	minor	v1.18.3 → 1.20.1
kube-prometheus-stack (source)	minor	56.0.0 → 56.21.4
rook-ceph	minor	v1.18.5 → v1.20.6
rook-ceph-cluster	minor	v1.18.5 → v1.20.6

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

cilium/cilium (cilium)

v1.20.1

Compare Source

v1.20.0: 1.20.0

Compare Source

🎉 Release Announcement 🎉: We are excited to announce the Cilium 1.20.0 release!

More than 2,660 new commits have landed in this release, supported by a community of over 1,100 contributors and more than 24,800 GitHub stars! 🤩

⚠️ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the cilium.io/v2alpha1 CiliumNodeConfig API, the libnetwork integration, or a custom CNI configuration. See the Upgrade Guide for details.

The full changelog can be found here.

Here are some of the highlights:

• ⛩️ Gateway API

  • 🚀 Gateway API v1.6.1: Cilium moves from Gateway API v1.4 to v1.6.1, bringing support for capabilities that graduated across both upstream releases. (cilium/cilium#45251, @​youngnick; cilium/cilium#46827, cilium/cilium#47274, @​arybolovlev)
  • 👥 Delegate Gateway Listeners: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. (cilium/cilium#46303, cilium/cilium#46785, @​asauber)
  • 🔏 Encrypt Traffic to Backends: Gateway API BackendTLSPolicy support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. (cilium/cilium#43045, @​youngnick)
  • 🔀 TCPRoute and UDPRoute: Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic. (cilium/cilium#46184, cilium/cilium#46970, @​eminaktas; cilium/cilium#47381, @​arybolovlev)
  • 🔐 External Authorization: HTTPRoute requests can now be authenticated and authorized through an external service before they reach the application, using the Gateway API ExternalAuth filter from GEP-1494. (cilium/cilium#45739, @​gauteoh)
  • 🎛️ More HTTP Traffic Controls: HTTPRoutes gain native CORS support and additional 303, 307 and 308 redirect codes. CiliumGatewayClassConfig can also overwrite, append or preserve the HTTP Server response header. (cilium/cilium#45924, @​arybolovlev; cilium/cilium#47232, @​youngnick; cilium/cilium#46764, @​xtineskim)
  • ↔️ Configurable gRPC-Web Translation: CiliumGatewayClassConfig can disable automatic gRPC-web translation for Gateways that need to pass the original traffic through unchanged. Translation remains enabled by default. (cilium/cilium#45984, @​thorn3r)

• 🚠 Networking

  • 🔌 Extensible Datapath: Datapath plugins let cloud providers extend or instrument Cilium's eBPF datapath with independently versioned programs, without maintaining a Cilium fork. (cilium/cilium#45028, cilium/cilium#45429, cilium/cilium#45558, cilium/cilium#46673, cilium/cilium#46872, @​jrife)
  • 🚄 Automatic Netkit Selection: Set bpf.datapathMode=auto to use netkit automatically on supported kernels and fall back to veth on other nodes. The default remains veth. (cilium/cilium#43062, @​ajmmm)
  • 📤 Egress Gateway Improvements: Dual-stack clusters can configure an explicit IPv6 egress IP. IPv4 Egress Gateway traffic also strictly honors the interface selected by the policy, matching the existing IPv6 behavior. (cilium/cilium#44524, @​yykkibbb; cilium/cilium#45833, @​julianwiedmann)
  • 🔍 Better BGP Tooling and Reconciliation: New Hive shell commands expose route policies and clearer peer output formats. The control plane moves to GoBGP v4.6.1 and optimizes route-policy reconciliation. (cilium/cilium#45628, cilium/cilium#45534, @​martonra; cilium/cilium#45952, cilium/cilium#46928, @​rastislavs)

• 🌐 IPAM and IP Selection

  • ☁️ IPv6 for AWS ENI IPAM (Beta): Cilium can now allocate IPv6 prefixes to pods through AWS ENI IPAM, building on the move to the multi-pool allocator. (cilium/cilium#46756, cilium/cilium#46619, @​41ks; cilium/cilium#45154, cilium/cilium#45958, @​HadrienPatte)
  • 🔄 Migrate to Multi-Pool IPAM: Existing clusters can move from cluster-pool IPAM to multi-pool IPAM without being rebuilt. (cilium/cilium#46104, @​pippolo84)
  • 🧭 Dynamic NodePort Source Addresses: NodePort can use the kernel FIB to select the preferred source address dynamically before SNATing north-south traffic, on supported kernels. (cilium/cilium#44625, @​ldelossa)
  • 🔵 Prefer IPv6 Consistently: The new top-level preferIpv6 option applies to both Cilium health probes and Hubble peer communication when IPv4 and IPv6 are available. (cilium/cilium#45447, @​tibrezus)

• 🕸️ Services and Cluster Mesh

  • 📍 Topology-Aware Service Traffic: Cilium's service load balancer now supports the Kubernetes PreferSameZone and PreferSameNode traffic distribution hints. (cilium/cilium#44771, @​raphink)
  • ⚖️ Weighted Maglev Backends: Maglev now honors the service.cilium.io/weight annotation on EndpointSlices. A weight of zero drains new connections while allowing existing connections to continue. (cilium/cilium#46061, @​mhofstetter)
  • 🌉 More Load-Balancing Options with VXLAN: Clusters using VXLAN can use per-Service load-balancing mode annotations, including compatible DSR configurations such as IPIP dispatch. (cilium/cilium#45600, @​brb)
  • 🤖 Stable MCS API Support: Cilium's implementation of the Kubernetes Multi-Cluster Services API is now stable and recommended for portable service discovery through ClusterMesh. (cilium/cilium#45404, cilium/cilium#46953, @​MrFreezeex)

• 🔒 Encryption and Network Policy

  • 🚇 Improved Ztunnel Identity Management: The ztunnel path now supports either an internal certificate authority or SPIRE-issued workload identities, alongside new Prometheus metrics for enrollment and connection health. It transparently encrypts enrolled pod-to-pod connections, including traffic between pods on the same node. (cilium/cilium#43763, cilium/cilium#44275, cilium/cilium#44136, cilium/cilium#45861, @​nddq; cilium/cilium#45096, @​gokulMSFT)
  • 🛡️ Kubernetes ClusterNetworkPolicy (KCNP): Cilium now supports the upstream, cluster-scoped policy API, including Admin and Baseline policy tiers alongside namespaced Kubernetes NetworkPolicy. (cilium/cilium#42338, @​TheBeeZee; cilium/cilium#46253, @​aanm)
  • ⛔ Friendlier IPv6 Policy Denials: Cilium can return ICMPv6 Destination Unreachable responses when network policy denies IPv6 egress traffic, matching the IPv4 capability introduced in Cilium 1.19. (cilium/cilium#44234, @​Andreagit97)
  • 🌐 Select the Entire Cluster Mesh: The new cluster-mesh policy entity selects every endpoint across a mesh, making cross-cluster security policies easier to express. (cilium/cilium#46813, @​squeed)
  • ☁️ Standardize AWS VPC Group Policies: Policies that reference AWS VPC groups are now transformed into CiliumCIDRGroup resources, bringing external IP groups into the standard Cilium policy model. (cilium/cilium#44704, @​squeed)
  • 🛂 Per-Pod Source IP Verification Control: Trusted workloads that need to send traffic with non-local source addresses can disable source IP verification through a pod annotation, guarded by a namespace-level opt-in. (cilium/cilium#43505, @​zbb88888)

• ⚙️ Day 2 Operations and Observability

  • 🔧 Detect Configuration Drift: Cilium can expose how many ConfigMap settings an agent has not yet applied, making it easier to identify when a restart is required after a configuration change. (cilium/cilium#44703, @​PhilipSchmid)
  • ⏱️ Understand Agent Start-Up Time: New Hive lifecycle and Kubernetes resource-sync metrics show how long individual resources and components take to initialize. (cilium/cilium#44802, cilium/cilium#44639, @​ILL1A)
  • 🛰️ Correlate More Hubble Verdicts with Policies: Hubble can now identify the policy responsible for audit verdicts. (cilium/cilium#45373, @​Rajneesh180)
  • 📊 Standalone DNS Proxy Metrics: The Standalone DNS Proxy now exports DNS metrics back through Cilium, improving visibility when DNS policy processing runs outside the agent. (cilium/cilium#45222, cilium/cilium#44601, @​vipul-21)

• 🌅 Performance and Scale

  • 💾 Aggregated Load-Balancer State: Cilium's internal backend representation has been flattened to efficiently support thousands of Services that share the same backends. (cilium/cilium#44511, @​joamaki)
  • 📡 More Efficient Envoy Updates: New ADS and Delta xDS modes provide consistent or incremental delivery of Envoy resources, reducing CPU usage and policy update latency. (cilium/cilium#43887, @​nezdolik; cilium/cilium#45288, @​jrajahalme)
  • 🗂️ Optimized BPF Policy Map Encoding: Semantic wildcard identities for remote-node and world reduce BPF policy-map pressure, particularly in larger clusters. (cilium/cilium#46438, @​squeed)
  • 📦 Smaller CNI Binary: The cilium-cni binary has been reduced from roughly 77 MB to 16 MB, shrinking both the Cilium image and its footprint on every node. (cilium/cilium#45845, @​giorio94)
  • 🛠️ Updated Dependencies and Foundations: Cilium 1.20 updates to Kubernetes v1.36, Envoy v1.37.x, Gateway API v1.6.1, GoBGP v4.6.1 and MCS API v0.5.2. Runtime and builder images now use Ubuntu 26.04, and the default CNI configuration version moves from 0.3.1 to 1.0.0. (cilium/cilium#45499, cilium/cilium#47215, @​HadrienPatte; cilium/cilium#45851, @​sayboras; cilium/cilium#47274, @​arybolovlev; cilium/cilium#45952, @​rastislavs; cilium/cilium#47166, @​MrFreezeex; cilium/cilium#46971, @​gandro)

• 🏠 Community

  • ❤️ Production Case Studies: Many end-users have told their stories running Cilium in production. Read and watch more from: Asana, Etraveli, Michelin, OpenAI, Suse, Telefónica's acens, and Zynga. If your company wants to submit their case studies let us know. We would love to hear your feedback!
  • 🇳🇱 Amsterdam Events: The community gathered at CiliumCon and Cilium Developer Summit in Amsterdam. Watch the talks from CiliumCon.
  • 🇺🇸 Salt Lake City Events: Meet us at the upcoming CiliumCon and Cilium Developer Summit at KubeCon + CloudNativeCon North America in Salt Lake City, November 9-12.
  • 🤖 Generative AI Policy: The Cilium community adopted a Generative AI Policy that encourages community members to connect and communicate with one another without the use of AI, while recognizing that different people work best with their own tools of choice.
  • 📚 Cilium Books: Two new books landed for readers at every level — Cilium: Up and Running (O'Reilly), a practitioner's deep dive and Buzzing Beyond Clouds: The Illustrated Children's Guide to Cilium, the follow-up to the eBPF children's guide.

❤️ Thank You: Cilium 1.20 was made possible by contributors, reviewers and maintainers from across the community, including engineers from Datadog, Google, Microsoft and many other organizations.

To keep up to date with all the latest Cilium releases, join #release 🎉

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93
quay.io/cilium/cilium:stable@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.0@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92
quay.io/cilium/clustermesh-apiserver:stable@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92

hubble-relay

quay.io/cilium/hubble-relay:v1.20.0@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94
quay.io/cilium/hubble-relay:stable@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.0@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9
quay.io/cilium/operator-alibabacloud:stable@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9

operator-aws

quay.io/cilium/operator-aws:v1.20.0@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa
quay.io/cilium/operator-aws:stable@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa

operator-azure

quay.io/cilium/operator-azure:v1.20.0@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c
quay.io/cilium/operator-azure:stable@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c

operator-generic

quay.io/cilium/operator-generic:v1.20.0@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3
quay.io/cilium/operator-generic:stable@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3

operator

quay.io/cilium/operator:v1.20.0@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c
quay.io/cilium/operator:stable@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c

v1.19.7

Compare Source

v1.19.6: 1.19.6

Compare Source

Summary of Changes

Minor Changes:

• datapath/l2responder: use l3 sockets for solicited node multicast signaling (Backport PR #​46845, Upstream PR #​46332, @​bersoare)
• gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR #​46933, Upstream PR #​46403, @​arybolovlev)

Bugfixes:

• [v1.19] Fix policy service label selector handling (#​46946, @​fristonio)
• bpf: fix ipv6 neighbor solicitation handling in host firewall (Backport PR #​46669, Upstream PR #​46325, @​atykhyy)
• doublewrite: Don't run CRD backend with real handler when reading from KVStore (Backport PR #​47181, Upstream PR #​47144, @​HadrienPatte)
• endpoint: Fix race when reading endpoint properties (Backport PR #​47181, Upstream PR #​46991, @​gandro)
• Fix cilium_operator_unmanaged_pods gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (Backport PR #​46975, Upstream PR #​46668, @​Suyash1700)
• Fix a bug which could lead to stale hostport entries if a pod was deleted and immediately recreated in host network. (Backport PR #​46793, Upstream PR #​46747, @​giorio94)
• Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (Backport PR #​46974, Upstream PR #​46927, @​aanm)
• Fix allowedRoute namespace and kind restrictions on multi-listener Gateways. (Backport PR #​46826, Upstream PR #​45693, @​eufriction)
• Fix bug that left the host firewall enabled in the live ConfigMap when disabling hostFirewall.enabled (toggling it from true to false) via Helm. (Backport PR #​46669, Upstream PR #​44748, @​shibaPuppy)
• Fix ClusterMesh service affinity annotation service.cilium.io/affinity: "none" incorrectly dropping all remote backends, causing traffic blackhole when no local endpoints exist. (Backport PR #​46691, Upstream PR #​46635, @​mkamadeus)
• Fix ctmap gc duration metric recording (Backport PR #​46975, Upstream PR #​46873, @​fristonio)
• Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR #​47002, Upstream PR #​46821, @​fristonio)
• Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR #​47181, Upstream PR #​46967, @​ysksuzuki)
• Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service (Backport PR #​47181, Upstream PR #​46444, @​giorio94)
• Fix the UDP tunnel check in the BIG TCP probe. (Backport PR #​46793, Upstream PR #​46710, @​gentoo-root)
• Fixes a bug where Hubble policy correlation does not work for port ranges. (Backport PR #​46793, Upstream PR #​46643, @​squeed)
• gateway-api: Add Gateway check for when hostNetwork is enabled (Backport PR #​46837, Upstream PR #​46350, @​xtineskim)
• gateway-api: Each HTTPS and TLS passthrough port now receives its own Envoy listener and RouteConfiguration. (Backport PR #​46826, Upstream PR #​44889, @​eufriction)
• ipam/multi-pool: Do now wait for zero prealloc request (Backport PR #​47181, Upstream PR #​46867, @​pippolo84)
• operator: Fix nil-pointer panic in CiliumNode GC (Backport PR #​47181, Upstream PR #​47127, @​HadrienPatte)

CI Changes:

• .github: Generate CI binaries with correct module version (Backport PR #​47099, Upstream PR #​46742, @​joestringer)
• chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR #​46920, Upstream PR #​46840, @​sekhar-isovalent)
• ci: Auth to image registry in clustermesh upgrade workflow (Backport PR #​46691, Upstream PR #​46632, @​nebril)
• ci: Remove merge_group from tests-smoke-conformance.yaml (Backport PR #​46888, Upstream PR #​46451, @​nebril)
• Fix workflow change detection for single-commit PRs to main (Backport PR #​46793, Upstream PR #​46684, @​Demiserular)
• Further GC ratchet test fix races (Backport PR #​47224, Upstream PR #​43075, @​tommyp1ckles)

Misc Changes:

• (minor) docs: update reference to aws-cli image (Backport PR #​46975, Upstream PR #​46923, @​squeed)
• .github: allow fork PR checkout with actions/checkout v7 (Backport PR #​47135, Upstream PR #​47133, @​aanm)
• [v1.19] - .github/workflows: unpin cilium/cilium self-references to track main (#​46613, @​aanm)
• [v1.19] - Reapply ".github/workflows: do not use deployments for environments" (#​46574, @​aanm)
• [v1.19] vendor: bump github.com/cilium/statedb to v0.5.9 (#​47083, @​giorio94)
• bgp: fix status condition reporting: update reasons to accurately reflect current condition state (Backport PR #​46920, Upstream PR #​46383, @​martonra)
• bpf: Condition ICMP SNAT on BPF masquerading and inter-cluster SNAT (Backport PR #​47181, Upstream PR #​47021, @​pchaigno)
• chore(deps): update all github action dependencies (v1.19) (#​46658, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46908, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​47109, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#​46906, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#​47045, @​cilium-renovate[bot])
• chore(deps): update aws-actions/configure-aws-credentials action to v6.2.2 (v1.19) (#​47124, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#​46774, @​cilium-renovate[bot])
• chore(deps): update base-images to v1.25.12 (v1.19) (#​46982, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.5 (v1.19) (#​46726, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/alpine docker tag to v3.23.5 (v1.19) (#​46773, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.11 docker digest to 00feed3 (v1.19) (#​46657, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.6 (v1.19) (#​47039, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc (v1.19) (#​46700, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/image-tester docker tag to v1783861476 (v1.19) (#​47122, @​cilium-renovate[bot])
• chore: BYOCNI loopback for cilium (Backport PR #​46691, Upstream PR #​46646, @​sekhar-isovalent)
• chore: optimize building gops and cni/loopback (Backport PR #​46845, Upstream PR #​46781, @​sekhar-isovalent)
• ci: always set fail-fast to false on image builds (Backport PR #​47181, Upstream PR #​47064, @​aanm)
• ci: remove non-ariane workflows from config (Backport PR #​46845, Upstream PR #​46787, @​nebril)
• clustermesh: add reusable backend selector constructor (Backport PR #​46691, Upstream PR #​45648, @​viktor-kurchenko)
• docs: clarify Hubble static/dynamic exporter file rotation settings (Backport PR #​47181, Upstream PR #​47026, @​maksymbilokur-cisco)
• docs: fix note about ipv4-native-routing-cidr default value (Backport PR #​46793, Upstream PR #​46603, @​rptaylor)
• Egress Gateway: handle nil events (Backport PR #​47181, Upstream PR #​46476, @​tommyp1ckles)
• endpoint: reap restart-preserved policy map entries once ready (Backport PR #​47063, Upstream PR #​47062, @​aanm)
• endpoint: sync desired policy before reload on the restore path (restore-path hardening) (Backport PR #​47076, Upstream PR #​47075, @​aanm)
• Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR #​46793, Upstream PR #​46388, @​tommyp1ckles)
• Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR #​46845, Upstream PR #​46388, @​tommyp1ckles)
• fix(deps): update k8s.io/utils digest to be93311 (v1.19) (#​46907, @​cilium-renovate[bot])
• fix(deps): update k8s.io/utils digest to cf1189d (v1.19) (#​47115, @​cilium-renovate[bot])
• Fixed Gateway API reconciler incorrectly reporting "Accepted HTTPRoute" in the status condition message for GRPCRoute and TLSRoute resources. (Backport PR #​46826, Upstream PR #​44962, @​eufriction)
• gateway-api: return model from Gateway API ingestion (Backport PR #​46933, Upstream PR #​46450, @​arybolovlev)
• gha: fail fast in external-target provisioning scripts instead of swallowing failures (Backport PR #​47181, Upstream PR #​47085, @​aanm)
• Improve cilium-dbg status output of module health (Backport PR #​46845, Upstream PR #​46739, @​joestringer)
• loadbalancer: proxy ports are now resolved per frontend instead of per service, preventing one port from losing its L7 redirect when multiple listeners share a service. (Backport PR #​46826, Upstream PR #​45949, @​eufriction)
• loadbalancer: validate DSR dispatch configuration globally (Backport PR #​46793, Upstream PR #​45545, @​FelipeYepez)
• Makefile: Generate full Cilium version in worktree (Backport PR #​46793, Upstream PR #​46737, @​joestringer)
• Revert restore-path policy map changes (#​46927, #​47062, #​47075) (Backport PR #​47213, Upstream PR #​47202, @​aanm)
• Upgraded cilium/ebpf to version v0.22.0 (Backport PR #​46845, Upstream PR #​46783, @​dylandreimerink)

Other Changes:

• install: Update image digests for v1.19.5 (#​46593, @​cilium-release-bot[bot])
• v1.19: gateway-api: fix sds secrets in golden tests (#​47229, @​0xch4z)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.6@sha256:accab5fe6ab7134fcd6f916acc9e4c785382a022128ae5495ec4a45fbe18c9a6

docker-plugin

quay.io/cilium/docker-plugin:v1.19.6@sha256:81a8d37e541edfff4016037373853e8e875f1ea0433c58b9ab54b314c305b9ec

hubble-relay

quay.io/cilium/hubble-relay:v1.19.6@sha256:6782a49e3f28eba015701c4410a5ec7fa096fe9a562f879b4372dbecd827ea44

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.6@sha256:031e332cdec61a9ebaca42f044e7e2f5b876ba96ac0ccf1d42acd5954779efaf

operator-aws

quay.io/cilium/operator-aws:v1.19.6@sha256:546d13ac511cf82441b5e9e99e03d0e054b788513ceb1a883e620b8284d5ccc3

operator-azure

quay.io/cilium/operator-azure:v1.19.6@sha256:e555430b7f5e4c407daab1afbec3c431ec016a53f1f1b848f67b9242cd3adedd

operator-generic

quay.io/cilium/operator-generic:v1.19.6@sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665

operator

quay.io/cilium/operator:v1.19.6@sha256:37e36840be5a0882a9a065b2308859785e960a742aed0aeac794e0ac4aabdf90

v1.19.5: 1.19.5

Compare Source

Summary of Changes

Minor Changes:

• Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR #​46554, Upstream PR #​46516, @​giorio94)
• helm: Remove loadBalancer.standalone option (Backport PR #​46170, Upstream PR #​46070, @​joestringer)
• wireguard:mtu: fix mtu calculation with potential padding (Backport PR #​46170, Upstream PR #​45940, @​smagnani96)

Bugfixes:

• Always add cluster label to node when nodeSelectorLabels is enabled to fix CiliumNetworkPolicy with fromNodes/toNodes with policy-default-local-cluster enabled (enabled by default in 1.19+) (Backport PR #​46170, Upstream PR #​46068, @​MrFreezeex)
• azure: Fix public IP reassignment failure loop on operator restart (Backport PR #​46289, Upstream PR #​46240, @​HadrienPatte)
• bgp: Don't provide default_gateway reconciler when disabled (Backport PR #​46024, Upstream PR #​45911, @​YutaroHayakawa)
• bgp: Reduce amount of soft peer resets by service reconciliation and fix potentially missed incorrect metadata update upon failed reconciliation. (Backport PR #​46245, Upstream PR #​45927, @​rastislavs)
• bpf: fix host proxy packet routing to pods (Backport PR #​46024, Upstream PR #​45916, @​atykhyy)
• bug: fixed weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API (Backport PR #​46170, Upstream PR #​45937, @​nickolaev)
• datapath/mtu: add altname to mark cilium owned interfaces and do skip changing MTU on interfaces not managed by cilium (Backport PR #​46028, Upstream PR #​45799, @​bersoare)
• Fix a bug that causes the NamespaceSelector field in a CiliumEgressGatewayPolicy to be corrupted, and no longer effective. (Backport PR #​46024, Upstream PR #​45926, @​julianwiedmann)
• Fix a rare bug in clustermesh-apiserver that triggers incorrect deletion of a valid endpoint entry from the etcd under high pod churn (Backport PR #​46170, Upstream PR #​45780, @​adamwathieu)
• Fix BGP PeerConfig status cleanup so it no longer times out when there are no managed conditions to remove. (Backport PR #​46170, Upstream PR #​45967, @​ysksuzuki)
• Fix bug that would disrupt node connectivity when ClusterIP/LoadBalancer VIPs overlapped with node-local IP addresses. (Backport PR #​46024, Upstream PR #​45572, @​ajmmm)
• Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName. (Backport PR #​45966, Upstream PR #​45371, @​syedazeez337)
• Fix wildcard namespace bypass for selectorless ipBlock rules (Backport PR #​46456, Upstream PR #​46305, @​TheBeeZee)
• fix(gateway-api): Prevent controller panic during Gateway reconciliation when GatewayClass has an invalid or malformed spec.parametersRef. (Backport PR #​46400, Upstream PR #​46340, @​arybolovlev)
• fix(gateway-api): set ready condition in endpointSlice to true (Backport PR #​46400, Upstream PR #​46237, @​ulrichgiraud)
• fix: nil pointer dereference panic due to uninitialized logger (Backport PR #​46170, Upstream PR #​45782, @​weizhoublue)
• Fixed a race where a reused endpoint ID could have its BPF state directory removed by the outgoing endpoint (Backport PR #​46554, Upstream PR #​46091, @​eyupcanakman)
• Fixed unsolicited IPv6 L2 announcements ignored by receiving hosts, as not conformant to RFC 4861 (Backport PR #​46170, Upstream PR #​46079, @​giorio94)
• Fixes a bug where policymap pressure was incorrectly being reported as 0. (Backport PR #​46024, Upstream PR #​45791, @​squeed)
• gateway-api/ingress: set service label on EndpointSlices (Backport PR #​46400, Upstream PR #​46242, @​mhofstetter)
• gateway-api: fix GatewayClass field index (Backport PR #​46289, Upstream PR #​46127, @​thorn3r)
• gateway-api: prune stale Gateway API route parent statuses (Backport PR #​46400, Upstream PR #​46296, @​mhofstetter)
• Improve robustness of kvstore keys construction to prevent possible surprising behavior in rare circumstances (Backport PR #​46554, Upstream PR #​46412, @​giorio94)
• iptables: match wireguard packets by proto+port instead of packet mark (Backport PR #​46289, Upstream PR #​45974, @​bersoare)
• multipool: Fix retries for CiliumNode Get errors (Backport PR #​46408, Upstream PR #​46124, @​pippolo84)
• sockets: fix nil pointer dereference in filterAndDestroySockets (Backport PR #​46024, Upstream PR #​44843, @​umut-polat)
• The internal representation of load-balancing backends has been refactored to efficiently support thousands of services referencing a shared backend. (#​46462, @​joamaki)

CI Changes:

• chore(deps): update lvh-images for conformance-runtime (Backport PR #​46025, Upstream PR #​45922, @​julianwiedmann)
• ci:bpftrace: fail curl with corrupted binary download (Backport PR #​46024, Upstream PR #​45948, @​smagnani96)
• fix the race condition for the TestRouterIDAllocation bgp test case (Backport PR #​46289, Upstream PR #​44545, @​liyihuang)
• gha: make conformance kubespray runner configurable (Backport PR #​46289, Upstream PR #​46171, @​giorio94)
• helm: add tmpl files to .helmignore (Backport PR #​46554, Upstream PR #​46445, @​sekhar-isovalent)
• helm: allow overriding of registry_prefix in charts (Backport PR #​46289, Upstream PR #​46217, @​sekhar-isovalent)
• ipam: Deflake TestMarkForReleaseNoAllocate (Backport PR #​46289, Upstream PR #​46188, @​pippolo84)
• Move pull_request triggered workflows to ariane (Backport PR #​46452, Upstream PR #​45363, @​nebril)
• Reapply "ci: Log in for image registry pulls" (Backport PR #​46495, Upstream PR #​46376, @​nebril)

Misc Changes:

• [v1.19

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.