yolokube/core-deployments

Watch

Fork 0

Update Helm release cilium to v1.19.6 #2100

Open

renovate wants to merge 1 commit from renovate/cilium-1.x into main

renovate commented

2026-06-16 15:02:50 +02:00

Collaborator

This PR contains the following updates:

Package	Update	Change
cilium (source)	patch	`1.19.4` → `1.19.6`

Release Notes

cilium/cilium (cilium)

Summary of Changes

Minor Changes:

datapath/l2responder: use l3 sockets for solicited node multicast signaling (Backport PR #46845, Upstream PR #46332, @bersoare)
gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR #46933, Upstream PR #46403, @arybolovlev)

Bugfixes:

[v1.19] Fix policy service label selector handling (#46946, @fristonio)
bpf: fix ipv6 neighbor solicitation handling in host firewall (Backport PR #46669, Upstream PR #46325, @atykhyy)
doublewrite: Don't run CRD backend with real handler when reading from KVStore (Backport PR #47181, Upstream PR #47144, @HadrienPatte)
endpoint: Fix race when reading endpoint properties (Backport PR #47181, Upstream PR #46991, @gandro)
Fix cilium_operator_unmanaged_pods gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (Backport PR #46975, Upstream PR #46668, @Suyash1700)
Fix a bug which could lead to stale hostport entries if a pod was deleted and immediately recreated in host network. (Backport PR #46793, Upstream PR #46747, @giorio94)
Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (Backport PR #46974, Upstream PR #46927, @aanm)
Fix allowedRoute namespace and kind restrictions on multi-listener Gateways. (Backport PR #46826, Upstream PR #45693, @eufriction)
Fix bug that left the host firewall enabled in the live ConfigMap when disabling hostFirewall.enabled (toggling it from true to false) via Helm. (Backport PR #46669, Upstream PR #44748, @shibaPuppy)
Fix ClusterMesh service affinity annotation service.cilium.io/affinity: "none" incorrectly dropping all remote backends, causing traffic blackhole when no local endpoints exist. (Backport PR #46691, Upstream PR #46635, @mkamadeus)
Fix ctmap gc duration metric recording (Backport PR #46975, Upstream PR #46873, @fristonio)
Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR #47002, Upstream PR #46821, @fristonio)
Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR #47181, Upstream PR #46967, @ysksuzuki)
Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service (Backport PR #47181, Upstream PR #46444, @giorio94)
Fix the UDP tunnel check in the BIG TCP probe. (Backport PR #46793, Upstream PR #46710, @gentoo-root)
Fixes a bug where Hubble policy correlation does not work for port ranges. (Backport PR #46793, Upstream PR #46643, @squeed)
gateway-api: Add Gateway check for when hostNetwork is enabled (Backport PR #46837, Upstream PR #46350, @xtineskim)
gateway-api: Each HTTPS and TLS passthrough port now receives its own Envoy listener and RouteConfiguration. (Backport PR #46826, Upstream PR #44889, @eufriction)
ipam/multi-pool: Do now wait for zero prealloc request (Backport PR #47181, Upstream PR #46867, @pippolo84)
operator: Fix nil-pointer panic in CiliumNode GC (Backport PR #47181, Upstream PR #47127, @HadrienPatte)

CI Changes:

.github: Generate CI binaries with correct module version (Backport PR #47099, Upstream PR #46742, @joestringer)
chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR #46920, Upstream PR #46840, @sekhar-isovalent)
ci: Auth to image registry in clustermesh upgrade workflow (Backport PR #46691, Upstream PR #46632, @nebril)
ci: Remove merge_group from tests-smoke-conformance.yaml (Backport PR #46888, Upstream PR #46451, @nebril)
Fix workflow change detection for single-commit PRs to main (Backport PR #46793, Upstream PR #46684, @Demiserular)
Further GC ratchet test fix races (Backport PR #47224, Upstream PR #43075, @tommyp1ckles)

Misc Changes:

(minor) docs: update reference to aws-cli image (Backport PR #46975, Upstream PR #46923, @squeed)
.github: allow fork PR checkout with actions/checkout v7 (Backport PR #47135, Upstream PR #47133, @aanm)
[v1.19] - .github/workflows: unpin cilium/cilium self-references to track main (#46613, @aanm)
[v1.19] - Reapply ".github/workflows: do not use deployments for environments" (#46574, @aanm)
[v1.19] vendor: bump github.com/cilium/statedb to v0.5.9 (#47083, @giorio94)
bgp: fix status condition reporting: update reasons to accurately reflect current condition state (Backport PR #46920, Upstream PR #46383, @martonra)
bpf: Condition ICMP SNAT on BPF masquerading and inter-cluster SNAT (Backport PR #47181, Upstream PR #47021, @pchaigno)
chore(deps): update all github action dependencies (v1.19) (#46658, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46908, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#47109, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#46906, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#47045, @cilium-renovate[bot])
chore(deps): update aws-actions/configure-aws-credentials action to v6.2.2 (v1.19) (#47124, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#46774, @cilium-renovate[bot])
chore(deps): update base-images to v1.25.12 (v1.19) (#46982, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.5 (v1.19) (#46726, @cilium-renovate[bot])
chore(deps): update docker.io/library/alpine docker tag to v3.23.5 (v1.19) (#46773, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.11 docker digest to 00feed3 (v1.19) (#46657, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.4.6 (v1.19) (#47039, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc (v1.19) (#46700, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/image-tester docker tag to v1783861476 (v1.19) (#47122, @cilium-renovate[bot])
chore: BYOCNI loopback for cilium (Backport PR #46691, Upstream PR #46646, @sekhar-isovalent)
chore: optimize building gops and cni/loopback (Backport PR #46845, Upstream PR #46781, @sekhar-isovalent)
ci: always set fail-fast to false on image builds (Backport PR #47181, Upstream PR #47064, @aanm)
ci: remove non-ariane workflows from config (Backport PR #46845, Upstream PR #46787, @nebril)
clustermesh: add reusable backend selector constructor (Backport PR #46691, Upstream PR #45648, @viktor-kurchenko)
docs: clarify Hubble static/dynamic exporter file rotation settings (Backport PR #47181, Upstream PR #47026, @maksymbilokur-cisco)
docs: fix note about ipv4-native-routing-cidr default value (Backport PR #46793, Upstream PR #46603, @rptaylor)
Egress Gateway: handle nil events (Backport PR #47181, Upstream PR #46476, @tommyp1ckles)
endpoint: reap restart-preserved policy map entries once ready (Backport PR #47063, Upstream PR #47062, @aanm)
endpoint: sync desired policy before reload on the restore path (restore-path hardening) (Backport PR #47076, Upstream PR #47075, @aanm)
Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR #46793, Upstream PR #46388, @tommyp1ckles)
Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR #46845, Upstream PR #46388, @tommyp1ckles)
fix(deps): update k8s.io/utils digest to be93311 (v1.19) (#46907, @cilium-renovate[bot])
fix(deps): update k8s.io/utils digest to cf1189d (v1.19) (#47115, @cilium-renovate[bot])
Fixed Gateway API reconciler incorrectly reporting "Accepted HTTPRoute" in the status condition message for GRPCRoute and TLSRoute resources. (Backport PR #46826, Upstream PR #44962, @eufriction)
gateway-api: return model from Gateway API ingestion (Backport PR #46933, Upstream PR #46450, @arybolovlev)
gha: fail fast in external-target provisioning scripts instead of swallowing failures (Backport PR #47181, Upstream PR #47085, @aanm)
Improve cilium-dbg status output of module health (Backport PR #46845, Upstream PR #46739, @joestringer)
loadbalancer: proxy ports are now resolved per frontend instead of per service, preventing one port from losing its L7 redirect when multiple listeners share a service. (Backport PR #46826, Upstream PR #45949, @eufriction)
loadbalancer: validate DSR dispatch configuration globally (Backport PR #46793, Upstream PR #45545, @FelipeYepez)
Makefile: Generate full Cilium version in worktree (Backport PR #46793, Upstream PR #46737, @joestringer)
Revert restore-path policy map changes (#46927, #47062, #47075) (Backport PR #47213, Upstream PR #47202, @aanm)
Upgraded cilium/ebpf to version v0.22.0 (Backport PR #46845, Upstream PR #46783, @dylandreimerink)

Other Changes:

install: Update image digests for v1.19.5 (#46593, @cilium-release-bot[bot])
v1.19: gateway-api: fix sds secrets in golden tests (#47229, @0xch4z)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.6@sha256:accab5fe6ab7134fcd6f916acc9e4c785382a022128ae5495ec4a45fbe18c9a6

docker-plugin

quay.io/cilium/docker-plugin:v1.19.6@sha256:81a8d37e541edfff4016037373853e8e875f1ea0433c58b9ab54b314c305b9ec

hubble-relay

quay.io/cilium/hubble-relay:v1.19.6@sha256:6782a49e3f28eba015701c4410a5ec7fa096fe9a562f879b4372dbecd827ea44

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.6@sha256:031e332cdec61a9ebaca42f044e7e2f5b876ba96ac0ccf1d42acd5954779efaf

operator-aws

quay.io/cilium/operator-aws:v1.19.6@sha256:546d13ac511cf82441b5e9e99e03d0e054b788513ceb1a883e620b8284d5ccc3

operator-azure

quay.io/cilium/operator-azure:v1.19.6@sha256:e555430b7f5e4c407daab1afbec3c431ec016a53f1f1b848f67b9242cd3adedd

operator-generic

quay.io/cilium/operator-generic:v1.19.6@sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665

operator

quay.io/cilium/operator:v1.19.6@sha256:37e36840be5a0882a9a065b2308859785e960a742aed0aeac794e0ac4aabdf90

Summary of Changes

Minor Changes:

Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR #46554, Upstream PR #46516, @giorio94)
helm: Remove loadBalancer.standalone option (Backport PR #46170, Upstream PR #46070, @joestringer)
wireguard:mtu: fix mtu calculation with potential padding (Backport PR #46170, Upstream PR #45940, @smagnani96)

Bugfixes:

Always add cluster label to node when nodeSelectorLabels is enabled to fix CiliumNetworkPolicy with fromNodes/toNodes with policy-default-local-cluster enabled (enabled by default in 1.19+) (Backport PR #46170, Upstream PR #46068, @MrFreezeex)
azure: Fix public IP reassignment failure loop on operator restart (Backport PR #46289, Upstream PR #46240, @HadrienPatte)
bgp: Don't provide default_gateway reconciler when disabled (Backport PR #46024, Upstream PR #45911, @YutaroHayakawa)
bgp: Reduce amount of soft peer resets by service reconciliation and fix potentially missed incorrect metadata update upon failed reconciliation. (Backport PR #46245, Upstream PR #45927, @rastislavs)
bpf: fix host proxy packet routing to pods (Backport PR #46024, Upstream PR #45916, @atykhyy)
bug: fixed weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API (Backport PR #46170, Upstream PR #45937, @nickolaev)
datapath/mtu: add altname to mark cilium owned interfaces and do skip changing MTU on interfaces not managed by cilium (Backport PR #46028, Upstream PR #45799, @bersoare)
Fix a bug that causes the NamespaceSelector field in a CiliumEgressGatewayPolicy to be corrupted, and no longer effective. (Backport PR #46024, Upstream PR #45926, @julianwiedmann)
Fix a rare bug in clustermesh-apiserver that triggers incorrect deletion of a valid endpoint entry from the etcd under high pod churn (Backport PR #46170, Upstream PR #45780, @adamwathieu)
Fix BGP PeerConfig status cleanup so it no longer times out when there are no managed conditions to remove. (Backport PR #46170, Upstream PR #45967, @ysksuzuki)
Fix bug that would disrupt node connectivity when ClusterIP/LoadBalancer VIPs overlapped with node-local IP addresses. (Backport PR #46024, Upstream PR #45572, @ajmmm)
Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName. (Backport PR #45966, Upstream PR #45371, @syedazeez337)
Fix wildcard namespace bypass for selectorless ipBlock rules (Backport PR #46456, Upstream PR #46305, @TheBeeZee)
fix(gateway-api): Prevent controller panic during Gateway reconciliation when GatewayClass has an invalid or malformed spec.parametersRef. (Backport PR #46400, Upstream PR #46340, @arybolovlev)
fix(gateway-api): set ready condition in endpointSlice to true (Backport PR #46400, Upstream PR #46237, @ulrichgiraud)
fix: nil pointer dereference panic due to uninitialized logger (Backport PR #46170, Upstream PR #45782, @weizhoublue)
Fixed a race where a reused endpoint ID could have its BPF state directory removed by the outgoing endpoint (Backport PR #46554, Upstream PR #46091, @eyupcanakman)
Fixed unsolicited IPv6 L2 announcements ignored by receiving hosts, as not conformant to RFC 4861 (Backport PR #46170, Upstream PR #46079, @giorio94)
Fixes a bug where policymap pressure was incorrectly being reported as 0. (Backport PR #46024, Upstream PR #45791, @squeed)
gateway-api/ingress: set service label on EndpointSlices (Backport PR #46400, Upstream PR #46242, @mhofstetter)
gateway-api: fix GatewayClass field index (Backport PR #46289, Upstream PR #46127, @thorn3r)
gateway-api: prune stale Gateway API route parent statuses (Backport PR #46400, Upstream PR #46296, @mhofstetter)
Improve robustness of kvstore keys construction to prevent possible surprising behavior in rare circumstances (Backport PR #46554, Upstream PR #46412, @giorio94)
iptables: match wireguard packets by proto+port instead of packet mark (Backport PR #46289, Upstream PR #45974, @bersoare)
multipool: Fix retries for CiliumNode Get errors (Backport PR #46408, Upstream PR #46124, @pippolo84)
sockets: fix nil pointer dereference in filterAndDestroySockets (Backport PR #46024, Upstream PR #44843, @umut-polat)
The internal representation of load-balancing backends has been refactored to efficiently support thousands of services referencing a shared backend. (#46462, @joamaki)

CI Changes:

chore(deps): update lvh-images for conformance-runtime (Backport PR #46025, Upstream PR #45922, @julianwiedmann)
ci:bpftrace: fail curl with corrupted binary download (Backport PR #46024, Upstream PR #45948, @smagnani96)
fix the race condition for the TestRouterIDAllocation bgp test case (Backport PR #46289, Upstream PR #44545, @liyihuang)
gha: make conformance kubespray runner configurable (Backport PR #46289, Upstream PR #46171, @giorio94)
helm: add tmpl files to .helmignore (Backport PR #46554, Upstream PR #46445, @sekhar-isovalent)
helm: allow overriding of registry_prefix in charts (Backport PR #46289, Upstream PR #46217, @sekhar-isovalent)
ipam: Deflake TestMarkForReleaseNoAllocate (Backport PR #46289, Upstream PR #46188, @pippolo84)
Move pull_request triggered workflows to ariane (Backport PR #46452, Upstream PR #45363, @nebril)
Reapply "ci: Log in for image registry pulls" (Backport PR #46495, Upstream PR #46376, @nebril)

Misc Changes:

[v1.19] - chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 7… (#46578, @aanm)
[v1.19] Backport health command fixes from 46102 (#46250, @joamaki)
[v1.19] deps: bump various go packages (#46185, @ferozsalam)
[v1.19] loadbalancer: return correct IP family for IPv6 ClusterIP addresses (#46425, @tklauser)
bpf: local_delivery: add CB flag for "use_redirect_peer" (Backport PR #46204, Upstream PR #46169, @julianwiedmann)
bpf: local_delivery: condense usage of skb cb slots (Backport PR #46204, Upstream PR #46064, @julianwiedmann)
bpf: local_delivery: use CB_DELIVERY_FLAGS to transfer proxy state (Backport PR #46554, Upstream PR #46291, @julianwiedmann)
chore(deps): update all github action dependencies (v1.19) (#45994, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46016, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46117, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46268, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46280, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46395, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46538, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#45468, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#46581, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#45995, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#46164, @cilium-renovate[bot])
chore(deps): update base-images to v1.25.11 (v1.19) (#46342, @cilium-renovate[bot])
chore(deps): update cilium/cilium digest to 0fc1dd3 (v1.19) (#46153, @cilium-renovate[bot])
chore(deps): update cilium/cilium digest to 11ecd4e (v1.19) (#46277, @cilium-renovate[bot])
chore(deps): update cilium/cilium digest to cd47774 (v1.19) (#46137, @cilium-renovate[bot])
chore(deps): update cilium/cilium digest to e1b3ec8 (v1.19) (#46007, @cilium-renovate[bot])
chore(deps): update cilium/cilium-cli action to v0.19.3 (v1.19) (#46120, @cilium-renovate[bot])
chore(deps): update dependency bufbuild/buf to v1.70.0 (v1.19) (#46267, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.4 (v1.19) (#46150, @cilium-renovate[bot])
chore(deps): update dependency cilium/little-vm-helper to v0.0.30 (v1.19) (#46266, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v35.1 (v1.19) (#46570, @cilium-renovate[bot])
chore(deps): update docker.io/library/busybox:1.37.0 docker digest to 9532d8c (v1.19) (#46535, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.10 docker digest to cd05a37 (v1.19) (#46138, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.11 docker digest to 379065f (v1.19) (#46536, @cilium-renovate[bot])
chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.12 (v1.19) (#46560, @cilium-renovate[bot])
chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260518104151-5ebe05f9440b (v1.19) (#46139, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.4.5 (v1.19) (#46561, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752 (v1.19) (#46377, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#45392, @cilium-renovate[bot])
docs: Add caveats on Kubernetes versions when using host L7 DNS policies (Backport PR #46289, Upstream PR #45843, @atykhyy)
docs: Document BTF as a requirement (Backport PR #46289, Upstream PR #46063, @pchaigno)
docs: fix Markdown-style hyperlink in mutual-authentication.rst (Backport PR #46024, Upstream PR #45751, @bitflicker64)
Fix broken gateway-api documentation links (Backport PR #46554, Upstream PR #46527, @0xch4z)
Fix pointer-address comparison for Gateway API Route ParentReference status handling (Backport PR #46400, Upstream PR #46355, @weizhoublue)
fix(deps): update k8s.io patch updates stable to v0.35.5 (v1.19) (#46140, @cilium-renovate[bot])
fix(deps): update k8s.io patch updates stable to v0.35.5 (v1.19) (patch) (#46015, @cilium-renovate[bot])
fix(deps): update k8s.io patch updates stable to v0.35.6 (v1.19) (#46562, @cilium-renovate[bot])
fix(deps): update k8s.io/utils digest to ff6756f (v1.19) (#45996, @cilium-renovate[bot])
fix(deps): update module k8s.io/apimachinery to v0.35.5 (v1.19) (#45997, @cilium-renovate[bot])
fix(deps): update module k8s.io/apimachinery to v0.35.6 (v1.19) (#46537, @cilium-renovate[bot])
Miscellaneous improvements to the fake client (Backport PR #46024, Upstream PR #45784, @giorio94)
operator: miscellaneous improvements to the troubleshoot clustermesh command (Backport PR #46554, Upstream PR #46502, @giorio94)
Remove defunct l2podAnnouncements.interface Helm value that rendered a configmap key the agent no longer recognises, causing crash-loops when L2 pod announcements were enabled. Users must use l2podAnnouncements.interfacePattern instead. (Backport PR #46170, Upstream PR #46093, @salamidrus)
Revert ".github/workflows: do not use deployments for environments" (Backport PR #46400, Upstream PR #46348, @aanm)

Other Changes:

[v1.19] proxy: Bump upstream version to v1.37.x (#46439, @sayboras)
install: Update image digests for v1.19.4 (#45961, @cilium-release-bot[bot])
v1.19: kvstore: Don't set fake pod CIDRs for remote nodes (#46361, @pchaigno)
vendor: bump statedb to v0.5.8 (#46505, @giorio94)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.5@sha256:5ed9334b2254315740f9e2a8b6645bf69920f79ef14f436931579d2038784f9b

docker-plugin

quay.io/cilium/docker-plugin:v1.19.5@sha256:4006d5558390120774a5a903a706dfd64089082bd653b7cb45e9e5a93ff4efea

hubble-relay

quay.io/cilium/hubble-relay:v1.19.5@sha256:24409bfa1bca075c92acb26ba4b49cd573d99d68d5370f7cc825078185222a0c

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.5@sha256:c9706343dde700804c2f50c09a2f8291797c707d1747fd50f70c939c23747c16

operator-aws

quay.io/cilium/operator-aws:v1.19.5@sha256:b8473618e8d2bf8a610da445c8c37e1d1e8221aecd05989456d87a7588d66707

operator-azure

quay.io/cilium/operator-azure:v1.19.5@sha256:8600299cb121f9df00fd32b93fa74de89ed49dd3a67e3d7301c07325c04c77f8

operator-generic

quay.io/cilium/operator-generic:v1.19.5@sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4

operator

quay.io/cilium/operator:v1.19.5@sha256:07a25f6a248d77f0c8417d21b5ea5424a81fe551421e4baf04dc79b1360e832e

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | patch | `1.19.4` → `1.19.6` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.19.6`](https://github.com/cilium/cilium/releases/tag/v1.19.6): 1.19.6 [Compare Source](https://github.com/cilium/cilium/compare/1.19.5...1.19.6) ## Summary of Changes **Minor Changes:** - datapath/l2responder: use l3 sockets for solicited node multicast signaling (Backport PR [#46845](https://github.com/cilium/cilium/issues/46845), Upstream PR [#46332](https://github.com/cilium/cilium/issues/46332), [@bersoare](https://github.com/bersoare)) - gateway-api: add support for configuring Gateway access logs through the new `spec.telemetry.accessLogs` field in CiliumGatewayClassConfig. (Backport PR [#46933](https://github.com/cilium/cilium/issues/46933), Upstream PR [#46403](https://github.com/cilium/cilium/issues/46403), [@arybolovlev](https://github.com/arybolovlev)) **Bugfixes:** - \[v1.19] Fix policy service label selector handling ([#46946](https://github.com/cilium/cilium/issues/46946), [@fristonio](https://github.com/fristonio)) - bpf: fix ipv6 neighbor solicitation handling in host firewall (Backport PR [#46669](https://github.com/cilium/cilium/issues/46669), Upstream PR [#46325](https://github.com/cilium/cilium/issues/46325), [@atykhyy](https://github.com/atykhyy)) - doublewrite: Don't run CRD backend with real handler when reading from KVStore (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#47144](https://github.com/cilium/cilium/issues/47144), [@HadrienPatte](https://github.com/HadrienPatte)) - endpoint: Fix race when reading endpoint properties (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#46991](https://github.com/cilium/cilium/issues/46991), [@gandro](https://github.com/gandro)) - Fix `cilium_operator_unmanaged_pods` gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (Backport PR [#46975](https://github.com/cilium/cilium/issues/46975), Upstream PR [#46668](https://github.com/cilium/cilium/issues/46668), [@Suyash1700](https://github.com/Suyash1700)) - Fix a bug which could lead to stale hostport entries if a pod was deleted and immediately recreated in host network. (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#46747](https://github.com/cilium/cilium/issues/46747), [@giorio94](https://github.com/giorio94)) - Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (Backport PR [#46974](https://github.com/cilium/cilium/issues/46974), Upstream PR [#46927](https://github.com/cilium/cilium/issues/46927), [@aanm](https://github.com/aanm)) - Fix allowedRoute namespace and kind restrictions on multi-listener Gateways. (Backport PR [#46826](https://github.com/cilium/cilium/issues/46826), Upstream PR [#45693](https://github.com/cilium/cilium/issues/45693), [@eufriction](https://github.com/eufriction)) - Fix bug that left the host firewall enabled in the live ConfigMap when disabling hostFirewall.enabled (toggling it from true to false) via Helm. (Backport PR [#46669](https://github.com/cilium/cilium/issues/46669), Upstream PR [#44748](https://github.com/cilium/cilium/issues/44748), [@shibaPuppy](https://github.com/shibaPuppy)) - Fix ClusterMesh service affinity annotation `service.cilium.io/affinity: "none"` incorrectly dropping all remote backends, causing traffic blackhole when no local endpoints exist. (Backport PR [#46691](https://github.com/cilium/cilium/issues/46691), Upstream PR [#46635](https://github.com/cilium/cilium/issues/46635), [@mkamadeus](https://github.com/mkamadeus)) - Fix ctmap gc duration metric recording (Backport PR [#46975](https://github.com/cilium/cilium/issues/46975), Upstream PR [#46873](https://github.com/cilium/cilium/issues/46873), [@fristonio](https://github.com/fristonio)) - Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR [#47002](https://github.com/cilium/cilium/issues/47002), Upstream PR [#46821](https://github.com/cilium/cilium/issues/46821), [@fristonio](https://github.com/fristonio)) - Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#46967](https://github.com/cilium/cilium/issues/46967), [@ysksuzuki](https://github.com/ysksuzuki)) - Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#46444](https://github.com/cilium/cilium/issues/46444), [@giorio94](https://github.com/giorio94)) - Fix the UDP tunnel check in the BIG TCP probe. (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#46710](https://github.com/cilium/cilium/issues/46710), [@gentoo-root](https://github.com/gentoo-root)) - Fixes a bug where Hubble policy correlation does not work for port ranges. (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#46643](https://github.com/cilium/cilium/issues/46643), [@squeed](https://github.com/squeed)) - gateway-api: Add Gateway check for when hostNetwork is enabled (Backport PR [#46837](https://github.com/cilium/cilium/issues/46837), Upstream PR [#46350](https://github.com/cilium/cilium/issues/46350), [@xtineskim](https://github.com/xtineskim)) - gateway-api: Each HTTPS and TLS passthrough port now receives its own Envoy listener and RouteConfiguration. (Backport PR [#46826](https://github.com/cilium/cilium/issues/46826), Upstream PR [#44889](https://github.com/cilium/cilium/issues/44889), [@eufriction](https://github.com/eufriction)) - ipam/multi-pool: Do now wait for zero prealloc request (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#46867](https://github.com/cilium/cilium/issues/46867), [@pippolo84](https://github.com/pippolo84)) - operator: Fix nil-pointer panic in CiliumNode GC (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#47127](https://github.com/cilium/cilium/issues/47127), [@HadrienPatte](https://github.com/HadrienPatte)) **CI Changes:** - .github: Generate CI binaries with correct module version (Backport PR [#47099](https://github.com/cilium/cilium/issues/47099), Upstream PR [#46742](https://github.com/cilium/cilium/issues/46742), [@joestringer](https://github.com/joestringer)) - chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR [#46920](https://github.com/cilium/cilium/issues/46920), Upstream PR [#46840](https://github.com/cilium/cilium/issues/46840), [@sekhar-isovalent](https://github.com/sekhar-isovalent)) - ci: Auth to image registry in clustermesh upgrade workflow (Backport PR [#46691](https://github.com/cilium/cilium/issues/46691), Upstream PR [#46632](https://github.com/cilium/cilium/issues/46632), [@nebril](https://github.com/nebril)) - ci: Remove merge\_group from tests-smoke-conformance.yaml (Backport PR [#46888](https://github.com/cilium/cilium/issues/46888), Upstream PR [#46451](https://github.com/cilium/cilium/issues/46451), [@nebril](https://github.com/nebril)) - Fix workflow change detection for single-commit PRs to main (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#46684](https://github.com/cilium/cilium/issues/46684), [@Demiserular](https://github.com/Demiserular)) - Further GC ratchet test fix races (Backport PR [#47224](https://github.com/cilium/cilium/issues/47224), Upstream PR [#43075](https://github.com/cilium/cilium/issues/43075), [@tommyp1ckles](https://github.com/tommyp1ckles)) **Misc Changes:** - (minor) docs: update reference to aws-cli image (Backport PR [#46975](https://github.com/cilium/cilium/issues/46975), Upstream PR [#46923](https://github.com/cilium/cilium/issues/46923), [@squeed](https://github.com/squeed)) - .github: allow fork PR checkout with actions/checkout v7 (Backport PR [#47135](https://github.com/cilium/cilium/issues/47135), Upstream PR [#47133](https://github.com/cilium/cilium/issues/47133), [@aanm](https://github.com/aanm)) - \[v1.19] - .github/workflows: unpin cilium/cilium self-references to track main ([#46613](https://github.com/cilium/cilium/issues/46613), [@aanm](https://github.com/aanm)) - \[v1.19] - Reapply ".github/workflows: do not use deployments for environments" ([#46574](https://github.com/cilium/cilium/issues/46574), [@aanm](https://github.com/aanm)) - \[v1.19] vendor: bump github.com/cilium/statedb to v0.5.9 ([#47083](https://github.com/cilium/cilium/issues/47083), [@giorio94](https://github.com/giorio94)) - bgp: fix status condition reporting: update reasons to accurately reflect current condition state (Backport PR [#46920](https://github.com/cilium/cilium/issues/46920), Upstream PR [#46383](https://github.com/cilium/cilium/issues/46383), [@martonra](https://github.com/martonra)) - bpf: Condition ICMP SNAT on BPF masquerading and inter-cluster SNAT (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#47021](https://github.com/cilium/cilium/issues/47021), [@pchaigno](https://github.com/pchaigno)) - chore(deps): update all github action dependencies (v1.19) ([#46658](https://github.com/cilium/cilium/issues/46658), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#46908](https://github.com/cilium/cilium/issues/46908), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#47109](https://github.com/cilium/cilium/issues/47109), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.19) ([#46906](https://github.com/cilium/cilium/issues/46906), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.19) ([#47045](https://github.com/cilium/cilium/issues/47045), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update aws-actions/configure-aws-credentials action to v6.2.2 (v1.19) ([#47124](https://github.com/cilium/cilium/issues/47124), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.19) ([#46774](https://github.com/cilium/cilium/issues/46774), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images to v1.25.12 (v1.19) ([#46982](https://github.com/cilium/cilium/issues/46982), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.19.5 (v1.19) ([#46726](https://github.com/cilium/cilium/issues/46726), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/alpine docker tag to v3.23.5 (v1.19) ([#46773](https://github.com/cilium/cilium/issues/46773), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.25.11 docker digest to [`00feed3`](https://github.com/cilium/cilium/commit/00feed3) (v1.19) ([#46657](https://github.com/cilium/cilium/issues/46657), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/certgen docker tag to v0.4.6 (v1.19) ([#47039](https://github.com/cilium/cilium/issues/47039), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc (v1.19) ([#46700](https://github.com/cilium/cilium/issues/46700), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/image-tester docker tag to v1783861476 (v1.19) ([#47122](https://github.com/cilium/cilium/issues/47122), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore: BYOCNI loopback for cilium (Backport PR [#46691](https://github.com/cilium/cilium/issues/46691), Upstream PR [#46646](https://github.com/cilium/cilium/issues/46646), [@sekhar-isovalent](https://github.com/sekhar-isovalent)) - chore: optimize building gops and cni/loopback (Backport PR [#46845](https://github.com/cilium/cilium/issues/46845), Upstream PR [#46781](https://github.com/cilium/cilium/issues/46781), [@sekhar-isovalent](https://github.com/sekhar-isovalent)) - ci: always set fail-fast to false on image builds (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#47064](https://github.com/cilium/cilium/issues/47064), [@aanm](https://github.com/aanm)) - ci: remove non-ariane workflows from config (Backport PR [#46845](https://github.com/cilium/cilium/issues/46845), Upstream PR [#46787](https://github.com/cilium/cilium/issues/46787), [@nebril](https://github.com/nebril)) - clustermesh: add reusable backend selector constructor (Backport PR [#46691](https://github.com/cilium/cilium/issues/46691), Upstream PR [#45648](https://github.com/cilium/cilium/issues/45648), [@viktor-kurchenko](https://github.com/viktor-kurchenko)) - docs: clarify Hubble static/dynamic exporter file rotation settings (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#47026](https://github.com/cilium/cilium/issues/47026), [@maksymbilokur-cisco](https://github.com/maksymbilokur-cisco)) - docs: fix note about ipv4-native-routing-cidr default value (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#46603](https://github.com/cilium/cilium/issues/46603), [@rptaylor](https://github.com/rptaylor)) - Egress Gateway: handle nil events (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#46476](https://github.com/cilium/cilium/issues/46476), [@tommyp1ckles](https://github.com/tommyp1ckles)) - endpoint: reap restart-preserved policy map entries once ready (Backport PR [#47063](https://github.com/cilium/cilium/issues/47063), Upstream PR [#47062](https://github.com/cilium/cilium/issues/47062), [@aanm](https://github.com/aanm)) - endpoint: sync desired policy before reload on the restore path (restore-path hardening) (Backport PR [#47076](https://github.com/cilium/cilium/issues/47076), Upstream PR [#47075](https://github.com/cilium/cilium/issues/47075), [@aanm](https://github.com/aanm)) - Fix instance of cilium having incorrect specified policy\_change\_total failure label "failure" value which caused unnecessary warnings. (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#46388](https://github.com/cilium/cilium/issues/46388), [@tommyp1ckles](https://github.com/tommyp1ckles)) - Fix instance of cilium having incorrect specified policy\_change\_total failure label "failure" value which caused unnecessary warnings. (Backport PR [#46845](https://github.com/cilium/cilium/issues/46845), Upstream PR [#46388](https://github.com/cilium/cilium/issues/46388), [@tommyp1ckles](https://github.com/tommyp1ckles)) - fix(deps): update k8s.io/utils digest to [`be93311`](https://github.com/cilium/cilium/commit/be93311) (v1.19) ([#46907](https://github.com/cilium/cilium/issues/46907), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update k8s.io/utils digest to [`cf1189d`](https://github.com/cilium/cilium/commit/cf1189d) (v1.19) ([#47115](https://github.com/cilium/cilium/issues/47115), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Fixed Gateway API reconciler incorrectly reporting "Accepted HTTPRoute" in the status condition message for GRPCRoute and TLSRoute resources. (Backport PR [#46826](https://github.com/cilium/cilium/issues/46826), Upstream PR [#44962](https://github.com/cilium/cilium/issues/44962), [@eufriction](https://github.com/eufriction)) - gateway-api: return model from Gateway API ingestion (Backport PR [#46933](https://github.com/cilium/cilium/issues/46933), Upstream PR [#46450](https://github.com/cilium/cilium/issues/46450), [@arybolovlev](https://github.com/arybolovlev)) - gha: fail fast in external-target provisioning scripts instead of swallowing failures (Backport PR [#47181](https://github.com/cilium/cilium/issues/47181), Upstream PR [#47085](https://github.com/cilium/cilium/issues/47085), [@aanm](https://github.com/aanm)) - Improve cilium-dbg status output of module health (Backport PR [#46845](https://github.com/cilium/cilium/issues/46845), Upstream PR [#46739](https://github.com/cilium/cilium/issues/46739), [@joestringer](https://github.com/joestringer)) - loadbalancer: proxy ports are now resolved per frontend instead of per service, preventing one port from losing its L7 redirect when multiple listeners share a service. (Backport PR [#46826](https://github.com/cilium/cilium/issues/46826), Upstream PR [#45949](https://github.com/cilium/cilium/issues/45949), [@eufriction](https://github.com/eufriction)) - loadbalancer: validate DSR dispatch configuration globally (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#45545](https://github.com/cilium/cilium/issues/45545), [@FelipeYepez](https://github.com/FelipeYepez)) - Makefile: Generate full Cilium version in worktree (Backport PR [#46793](https://github.com/cilium/cilium/issues/46793), Upstream PR [#46737](https://github.com/cilium/cilium/issues/46737), [@joestringer](https://github.com/joestringer)) - Revert restore-path policy map changes ([#46927](https://github.com/cilium/cilium/issues/46927), [#47062](https://github.com/cilium/cilium/issues/47062), [#47075](https://github.com/cilium/cilium/issues/47075)) (Backport PR [#47213](https://github.com/cilium/cilium/issues/47213), Upstream PR [#47202](https://github.com/cilium/cilium/issues/47202), [@aanm](https://github.com/aanm)) - Upgraded cilium/ebpf to version v0.22.0 (Backport PR [#46845](https://github.com/cilium/cilium/issues/46845), Upstream PR [#46783](https://github.com/cilium/cilium/issues/46783), [@dylandreimerink](https://github.com/dylandreimerink)) **Other Changes:** - install: Update image digests for v1.19.5 ([#46593](https://github.com/cilium/cilium/issues/46593), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) - v1.19: gateway-api: fix sds secrets in golden tests ([#47229](https://github.com/cilium/cilium/issues/47229), [@0xch4z](https://github.com/0xch4z)) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.19.6@sha256:accab5fe6ab7134fcd6f916acc9e4c785382a022128ae5495ec4a45fbe18c9a6` ##### docker-plugin `quay.io/cilium/docker-plugin:v1.19.6@sha256:81a8d37e541edfff4016037373853e8e875f1ea0433c58b9ab54b314c305b9ec` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.19.6@sha256:6782a49e3f28eba015701c4410a5ec7fa096fe9a562f879b4372dbecd827ea44` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.19.6@sha256:031e332cdec61a9ebaca42f044e7e2f5b876ba96ac0ccf1d42acd5954779efaf` ##### operator-aws `quay.io/cilium/operator-aws:v1.19.6@sha256:546d13ac511cf82441b5e9e99e03d0e054b788513ceb1a883e620b8284d5ccc3` ##### operator-azure `quay.io/cilium/operator-azure:v1.19.6@sha256:e555430b7f5e4c407daab1afbec3c431ec016a53f1f1b848f67b9242cd3adedd` ##### operator-generic `quay.io/cilium/operator-generic:v1.19.6@sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665` ##### operator `quay.io/cilium/operator:v1.19.6@sha256:37e36840be5a0882a9a065b2308859785e960a742aed0aeac794e0ac4aabdf90` ### [`v1.19.5`](https://github.com/cilium/cilium/releases/tag/v1.19.5): 1.19.5 [Compare Source](https://github.com/cilium/cilium/compare/1.19.4...1.19.5) ## Summary of Changes **Minor Changes:** - Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR [#46554](https://github.com/cilium/cilium/issues/46554), Upstream PR [#46516](https://github.com/cilium/cilium/issues/46516), [@giorio94](https://github.com/giorio94)) - helm: Remove loadBalancer.standalone option (Backport PR [#46170](https://github.com/cilium/cilium/issues/46170), Upstream PR [#46070](https://github.com/cilium/cilium/issues/46070), [@joestringer](https://github.com/joestringer)) - wireguard:mtu: fix mtu calculation with potential padding (Backport PR [#46170](https://github.com/cilium/cilium/issues/46170), Upstream PR [#45940](https://github.com/cilium/cilium/issues/45940), [@smagnani96](https://github.com/smagnani96)) **Bugfixes:** - Always add cluster label to node when `nodeSelectorLabels` is enabled to fix CiliumNetworkPolicy with `fromNodes`/`toNodes` with `policy-default-local-cluster` enabled (enabled by default in 1.19+) (Backport PR [#46170](https://github.com/cilium/cilium/issues/46170), Upstream PR [#46068](https://github.com/cilium/cilium/issues/46068), [@MrFreezeex](https://github.com/MrFreezeex)) - azure: Fix public IP reassignment failure loop on operator restart (Backport PR [#46289](https://github.com/cilium/cilium/issues/46289), Upstream PR [#46240](https://github.com/cilium/cilium/issues/46240), [@HadrienPatte](https://github.com/HadrienPatte)) - bgp: Don't provide default\_gateway reconciler when disabled (Backport PR [#46024](https://github.com/cilium/cilium/issues/46024), Upstream PR [#45911](https://github.com/cilium/cilium/issues/45911), [@YutaroHayakawa](https://github.com/YutaroHayakawa)) - bgp: Reduce amount of soft peer resets by service reconciliation and fix potentially missed incorrect metadata update upon failed reconciliation. (Backport PR [#46245](https://github.com/cilium/cilium/issues/46245), Upstream PR [#45927](https://github.com/cilium/cilium/issues/45927), [@rastislavs](https://github.com/rastislavs)) - bpf: fix host proxy packet routing to pods (Backport PR [#46024](https://github.com/cilium/cilium/issues/46024), Upstream PR [#45916](https://github.com/cilium/cilium/issues/45916), [@atykhyy](https://github.com/atykhyy)) - bug: fixed weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API (Backport PR [#46170](https://github.com/cilium/cilium/issues/46170), Upstream PR [#45937](https://github.com/cilium/cilium/issues/45937), [@nickolaev](https://github.com/nickolaev)) - datapath/mtu: add altname to mark cilium owned interfaces and do skip changing MTU on interfaces not managed by cilium (Backport PR [#46028](https://github.com/cilium/cilium/issues/46028), Upstream PR [#45799](https://github.com/cilium/cilium/issues/45799), [@bersoare](https://github.com/bersoare)) - Fix a bug that causes the NamespaceSelector field in a CiliumEgressGatewayPolicy to be corrupted, and no longer effective. (Backport PR [#46024](https://github.com/cilium/cilium/issues/46024), Upstream PR [#45926](https://github.com/cilium/cilium/issues/45926), [@julianwiedmann](https://github.com/julianwiedmann)) - Fix a rare bug in clustermesh-apiserver that triggers incorrect deletion of a valid endpoint entry from the etcd under high pod churn (Backport PR [#46170](https://github.com/cilium/cilium/issues/46170), Upstream PR [#45780](https://github.com/cilium/cilium/issues/45780), [@adamwathieu](https://github.com/adamwathieu)) - Fix BGP PeerConfig status cleanup so it no longer times out when there are no managed conditions to remove. (Backport PR [#46170](https://github.com/cilium/cilium/issues/46170), Upstream PR [#45967](https://github.com/cilium/cilium/issues/45967), [@ysksuzuki](https://github.com/ysksuzuki)) - Fix bug that would disrupt node connectivity when ClusterIP/LoadBalancer VIPs overlapped with node-local IP addresses. (Backport PR [#46024](https://github.com/cilium/cilium/issues/46024), Upstream PR [#45572](https://github.com/cilium/cilium/issues/45572), [@ajmmm](https://github.com/ajmmm)) - Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName. (Backport PR [#45966](https://github.com/cilium/cilium/issues/45966), Upstream PR [#45371](https://github.com/cilium/cilium/issues/45371), [@syedazeez337](https://github.com/syedazeez337)) - Fix wildcard namespace bypass for selectorless ipBlock rules (Backport PR [#46456](https://github.com/cilium/cilium/issues/46456), Upstream PR [#46305](https://github.com/cilium/cilium/issues/46305), [@TheBeeZee](https://github.com/TheBeeZee)) - fix(gateway-api): Prevent controller panic during Gateway reconciliation when GatewayClass has an invalid or malformed spec.parametersRef. (Backport PR [#46400](https://github.com/cilium/cilium/issues/46400), Upstream PR [#46340](https://github.com/cilium/cilium/issues/46340), [@arybolovlev](https://github.com/arybolovlev)) - fix(gateway-api): set ready condition in endpointSlice to true (Backport PR [#46400](https://github.com/cilium/cilium/issues/46400), Upstream PR [#46237](https://github.com/cilium/cilium/issues/46237), [@ulrichgiraud](https://github.com/ulrichgiraud)) - fix: nil pointer dereference panic due to uninitialized logger (Backport PR [#46170](https://github.com/cilium/cilium/issues/46170), Upstream PR [#45782](https://github.com/cilium/cilium/issues/45782), [@weizhoublue](https://github.com/weizhoublue)) - Fixed a race where a reused endpoint ID could have its BPF state directory removed by the outgoing endpoint (Backport PR [#46554](https://github.com/cilium/cilium/issues/46554), Upstream PR [#46091](https://github.com/cilium/cilium/issues/46091), [@eyupcanakman](https://github.com/eyupcanakman)) - Fixed unsolicited IPv6 L2 announcements ignored by receiving hosts, as not conformant to RFC 4861 (Backport PR [#46170](https://github.com/cilium/cilium/issues/46170), Upstream PR [#46079](https://github.com/cilium/cilium/issues/46079), [@giorio94](https://github.com/giorio94)) - Fixes a bug where policymap pressure was incorrectly being reported as 0. (Backport PR [#46024](https://github.com/cilium/cilium/issues/46024), Upstream PR [#45791](https://github.com/cilium/cilium/issues/45791), [@squeed](https://github.com/squeed)) - gateway-api/ingress: set service label on EndpointSlices (Backport PR [#46400](https://github.com/cilium/cilium/issues/46400), Upstream PR [#46242](https://github.com/cilium/cilium/issues/46242), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: fix GatewayClass field index (Backport PR [#46289](https://github.com/cilium/cilium/issues/46289), Upstream PR [#46127](https://github.com/cilium/cilium/issues/46127), [@thorn3r](https://github.com/thorn3r)) - gateway-api: prune stale Gateway API route parent statuses (Backport PR [#46400](https://github.com/cilium/cilium/issues/46400), Upstream PR [#46296](https://github.com/cilium/cilium/issues/46296), [@mhofstetter](https://github.com/mhofstetter)) - Improve robustness of kvstore keys construction to prevent possible surprising behavior in rare circumstances (Backport PR [#46554](https://github.com/cilium/cilium/issues/46554), Upstream PR [#46412](https://github.com/cilium/cilium/issues/46412), [@giorio94](https://github.com/giorio94)) - iptables: match wireguard packets by proto+port instead of packet mark (Backport PR [#46289](https://github.com/cilium/cilium/issues/46289), Upstream PR [#45974](https://github.com/cilium/cilium/issues/45974), [@bersoare](https://github.com/bersoare)) - multipool: Fix retries for CiliumNode Get errors (Backport PR [#46408](https://github.com/cilium/cilium/issues/46408), Upstream PR [#46124](https://github.com/cilium/cilium/issues/46124), [@pippolo84](https://github.com/pippolo84)) - sockets: fix nil pointer dereference in filterAndDestroySockets (Backport PR [#46024](https://github.com/cilium/cilium/issues/46024), Upstream PR [#44843](https://github.com/cilium/cilium/issues/44843), [@umut-polat](https://github.com/umut-polat)) - The internal representation of load-balancing backends has been refactored to efficiently support thousands of services referencing a shared backend. ([#46462](https://github.com/cilium/cilium/issues/46462), [@joamaki](https://github.com/joamaki)) **CI Changes:** - chore(deps): update lvh-images for conformance-runtime (Backport PR [#46025](https://github.com/cilium/cilium/issues/46025), Upstream PR [#45922](https://github.com/cilium/cilium/issues/45922), [@julianwiedmann](https://github.com/julianwiedmann)) - ci:bpftrace: fail curl with corrupted binary download (Backport PR [#46024](https://github.com/cilium/cilium/issues/46024), Upstream PR [#45948](https://github.com/cilium/cilium/issues/45948), [@smagnani96](https://github.com/smagnani96)) - fix the race condition for the TestRouterIDAllocation bgp test case (Backport PR [#46289](https://github.com/cilium/cilium/issues/46289), Upstream PR [#44545](https://github.com/cilium/cilium/issues/44545), [@liyihuang](https://github.com/liyihuang)) - gha: make conformance kubespray runner configurable (Backport PR [#46289](https://github.com/cilium/cilium/issues/46289), Upstream PR [#46171](https://github.com/cilium/cilium/issues/46171), [@giorio94](https://github.com/giorio94)) - helm: add tmpl files to .helmignore (Backport PR [#46554](https://github.com/cilium/cilium/issues/46554), Upstream PR [#46445](https://github.com/cilium/cilium/issues/46445), [@sekhar-isovalent](https://github.com/sekhar-isovalent)) - helm: allow overriding of registry\_prefix in charts (Backport PR [#46289](https://github.com/cilium/cilium/issues/46289), Upstream PR [#46217](https://github.com/cilium/cilium/issues/46217), [@sekhar-isovalent](https://github.com/sekhar-isovalent)) - ipam: Deflake TestMarkForReleaseNoAllocate (Backport PR [#46289](https://github.com/cilium/cilium/issues/46289), Upstream PR [#46188](https://github.com/cilium/cilium/issues/46188), [@pippolo84](https://github.com/pippolo84)) - Move `pull_request` triggered workflows to ariane (Backport PR [#46452](https://github.com/cilium/cilium/issues/46452), Upstream PR [#45363](https://github.com/cilium/cilium/issues/45363), [@nebril](https://github.com/nebril)) - Reapply "ci: Log in for image registry pulls" (Backport PR [#46495](https://github.com/cilium/cilium/issues/46495), Upstream PR [#46376](https://github.com/cilium/cilium/issues/46376), [@nebril](https://github.com/nebril)) **Misc Changes:** - \[v1.19] - chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 7… ([#46578](https://github.com/cilium/cilium/issues/46578), [@aanm](https://github.com/aanm)) - \[v1.19] Backport health command fixes from 46102 ([#46250](https://github.com/cilium/cilium/issues/46250), [@joamaki](https://github.com/joamaki)) - \[v1.19] deps: bump various go packages ([#46185](https://github.com/cilium/cilium/issues/46185), [@ferozsalam](https://github.com/ferozsalam)) - \[v1.19] loadbalancer: return correct IP family for IPv6 ClusterIP addresses ([#46425](https://github.com/cilium/cilium/issues/46425), [@tklauser](https://github.com/tklauser)) - bpf: local\_delivery: add CB flag for "use\_redirect\_peer" (Backport PR [#46204](https://github.com/cilium/cilium/issues/46204), Upstream PR [#46169](https://github.com/cilium/cilium/issues/46169), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: local\_delivery: condense usage of skb cb slots (Backport PR [#46204](https://github.com/cilium/cilium/issues/46204), Upstream PR [#46064](https://github.com/cilium/cilium/issues/46064), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: local\_delivery: use CB\_DELIVERY\_FLAGS to transfer proxy state (Backport PR [#46554](https://github.com/cilium/cilium/issues/46554), Upstream PR [#46291](https://github.com/cilium/cilium/issues/46291), [@julianwiedmann](https://github.com/julianwiedmann)) - chore(deps): update all github action dependencies (v1.19) ([#45994](https://github.com/cilium/cilium/issues/45994), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#46016](https://github.com/cilium/cilium/issues/46016), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#46117](https://github.com/cilium/cilium/issues/46117), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#46268](https://github.com/cilium/cilium/issues/46268), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#46280](https://github.com/cilium/cilium/issues/46280), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#46395](https://github.com/cilium/cilium/issues/46395), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.19) ([#46538](https://github.com/cilium/cilium/issues/46538), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.19) ([#45468](https://github.com/cilium/cilium/issues/45468), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.19) ([#46581](https://github.com/cilium/cilium/issues/46581), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.19) ([#45995](https://github.com/cilium/cilium/issues/45995), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.19) ([#46164](https://github.com/cilium/cilium/issues/46164), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images to v1.25.11 (v1.19) ([#46342](https://github.com/cilium/cilium/issues/46342), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update cilium/cilium digest to [`0fc1dd3`](https://github.com/cilium/cilium/commit/0fc1dd3) (v1.19) ([#46153](https://github.com/cilium/cilium/issues/46153), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update cilium/cilium digest to [`11ecd4e`](https://github.com/cilium/cilium/commit/11ecd4e) (v1.19) ([#46277](https://github.com/cilium/cilium/issues/46277), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update cilium/cilium digest to [`cd47774`](https://github.com/cilium/cilium/commit/cd47774) (v1.19) ([#46137](https://github.com/cilium/cilium/issues/46137), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update cilium/cilium digest to [`e1b3ec8`](https://github.com/cilium/cilium/commit/e1b3ec8) (v1.19) ([#46007](https://github.com/cilium/cilium/issues/46007), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update cilium/cilium-cli action to v0.19.3 (v1.19) ([#46120](https://github.com/cilium/cilium/issues/46120), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency bufbuild/buf to v1.70.0 (v1.19) ([#46267](https://github.com/cilium/cilium/issues/46267), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.19.4 (v1.19) ([#46150](https://github.com/cilium/cilium/issues/46150), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/little-vm-helper to v0.0.30 (v1.19) ([#46266](https://github.com/cilium/cilium/issues/46266), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf to v35.1 (v1.19) ([#46570](https://github.com/cilium/cilium/issues/46570), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/busybox:1.37.0 docker digest to [`9532d8c`](https://github.com/cilium/cilium/commit/9532d8c) (v1.19) ([#46535](https://github.com/cilium/cilium/issues/46535), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.25.10 docker digest to [`cd05a37`](https://github.com/cilium/cilium/commit/cd05a37) (v1.19) ([#46138](https://github.com/cilium/cilium/issues/46138), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.25.11 docker digest to [`379065f`](https://github.com/cilium/cilium/commit/379065f) (v1.19) ([#46536](https://github.com/cilium/cilium/issues/46536), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.12 (v1.19) ([#46560](https://github.com/cilium/cilium/issues/46560), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260518104151-5ebe05f9440b (v1.19) ([#46139](https://github.com/cilium/cilium/issues/46139), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/certgen docker tag to v0.4.5 (v1.19) ([#46561](https://github.com/cilium/cilium/issues/46561), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752 (v1.19) ([#46377](https://github.com/cilium/cilium/issues/46377), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.19) (patch) ([#45392](https://github.com/cilium/cilium/issues/45392), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - docs: Add caveats on Kubernetes versions when using host L7 DNS policies (Backport PR [#46289](https://github.com/cilium/cilium/issues/46289), Upstream PR [#45843](https://github.com/cilium/cilium/issues/45843), [@atykhyy](https://github.com/atykhyy)) - docs: Document BTF as a requirement (Backport PR [#46289](https://github.com/cilium/cilium/issues/46289), Upstream PR [#46063](https://github.com/cilium/cilium/issues/46063), [@pchaigno](https://github.com/pchaigno)) - docs: fix Markdown-style hyperlink in mutual-authentication.rst (Backport PR [#46024](https://github.com/cilium/cilium/issues/46024), Upstream PR [#45751](https://github.com/cilium/cilium/issues/45751), [@bitflicker64](https://github.com/bitflicker64)) - Fix broken gateway-api documentation links (Backport PR [#46554](https://github.com/cilium/cilium/issues/46554), Upstream PR [#46527](https://github.com/cilium/cilium/issues/46527), [@0xch4z](https://github.com/0xch4z)) - Fix pointer-address comparison for Gateway API Route ParentReference status handling (Backport PR [#46400](https://github.com/cilium/cilium/issues/46400), Upstream PR [#46355](https://github.com/cilium/cilium/issues/46355), [@weizhoublue](https://github.com/weizhoublue)) - fix(deps): update k8s.io patch updates stable to v0.35.5 (v1.19) ([#46140](https://github.com/cilium/cilium/issues/46140), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update k8s.io patch updates stable to v0.35.5 (v1.19) (patch) ([#46015](https://github.com/cilium/cilium/issues/46015), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update k8s.io patch updates stable to v0.35.6 (v1.19) ([#46562](https://github.com/cilium/cilium/issues/46562), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update k8s.io/utils digest to [`ff6756f`](https://github.com/cilium/cilium/commit/ff6756f) (v1.19) ([#45996](https://github.com/cilium/cilium/issues/45996), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module k8s.io/apimachinery to v0.35.5 (v1.19) ([#45997](https://github.com/cilium/cilium/issues/45997), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module k8s.io/apimachinery to v0.35.6 (v1.19) ([#46537](https://github.com/cilium/cilium/issues/46537), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Miscellaneous improvements to the fake client (Backport PR [#46024](https://github.com/cilium/cilium/issues/46024), Upstream PR [#45784](https://github.com/cilium/cilium/issues/45784), [@giorio94](https://github.com/giorio94)) - operator: miscellaneous improvements to the troubleshoot clustermesh command (Backport PR [#46554](https://github.com/cilium/cilium/issues/46554), Upstream PR [#46502](https://github.com/cilium/cilium/issues/46502), [@giorio94](https://github.com/giorio94)) - Remove defunct `l2podAnnouncements.interface` Helm value that rendered a configmap key the agent no longer recognises, causing crash-loops when L2 pod announcements were enabled. Users must use `l2podAnnouncements.interfacePattern` instead. (Backport PR [#46170](https://github.com/cilium/cilium/issues/46170), Upstream PR [#46093](https://github.com/cilium/cilium/issues/46093), [@salamidrus](https://github.com/salamidrus)) - Revert ".github/workflows: do not use deployments for environments" (Backport PR [#46400](https://github.com/cilium/cilium/issues/46400), Upstream PR [#46348](https://github.com/cilium/cilium/issues/46348), [@aanm](https://github.com/aanm)) **Other Changes:** - \[v1.19] proxy: Bump upstream version to v1.37.x ([#46439](https://github.com/cilium/cilium/issues/46439), [@sayboras](https://github.com/sayboras)) - install: Update image digests for v1.19.4 ([#45961](https://github.com/cilium/cilium/issues/45961), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) - v1.19: kvstore: Don't set fake pod CIDRs for remote nodes ([#46361](https://github.com/cilium/cilium/issues/46361), [@pchaigno](https://github.com/pchaigno)) - vendor: bump statedb to v0.5.8 ([#46505](https://github.com/cilium/cilium/issues/46505), [@giorio94](https://github.com/giorio94)) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.19.5@sha256:5ed9334b2254315740f9e2a8b6645bf69920f79ef14f436931579d2038784f9b` ##### docker-plugin `quay.io/cilium/docker-plugin:v1.19.5@sha256:4006d5558390120774a5a903a706dfd64089082bd653b7cb45e9e5a93ff4efea` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.19.5@sha256:24409bfa1bca075c92acb26ba4b49cd573d99d68d5370f7cc825078185222a0c` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.19.5@sha256:c9706343dde700804c2f50c09a2f8291797c707d1747fd50f70c939c23747c16` ##### operator-aws `quay.io/cilium/operator-aws:v1.19.5@sha256:b8473618e8d2bf8a610da445c8c37e1d1e8221aecd05989456d87a7588d66707` ##### operator-azure `quay.io/cilium/operator-azure:v1.19.5@sha256:8600299cb121f9df00fd32b93fa74de89ed49dd3a67e3d7301c07325c04c77f8` ##### operator-generic `quay.io/cilium/operator-generic:v1.19.5@sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4` ##### operator `quay.io/cilium/operator:v1.19.5@sha256:07a25f6a248d77f0c8417d21b5ea5424a81fe551421e4baf04dc79b1360e832e` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added 1 commit

2026-06-16 15:02:50 +02:00

Update Helm release cilium to v1.19.5

ci/woodpecker/push/yamllint Pipeline was successful

Details

e67529624c