Cilium Files

Summary of Changes

Bugfixes: * Fix "No mapping for NAT masquerade" flakes in the CI, make NAT LRU fallbacks more robust. (Backport PR [#41369], Upstream PR [#40971], @gentoo-root)

CI Changes: * .github/worfklows: copy cilium-cli binary from container (Backport PR [#41618], Upstream PR [#41524], @aanm) * .github/workflows: add timeout to Install node local DNS step (Backport PR [#41266], Upstream PR [#41120], @aanm) * .github/workflows: simplify ginkgo workflow (Backport PR [#41618], Upstream PR [#41396], @aanm) * .github: fix upload artifacts for features.json (Backport PR [#41369], Upstream PR [#41119], @aanm) * add missing extraArgs in CI (Backport PR [#41369], Upstream PR [#41005], @aanm) * checkpatch: bump checkpatch version, and minor adaptations (Backport PR [#41369], Upstream PR [#41290], @giorio94) * ci-aks: Fix concurrency for ipsec tests ([#41161], @joestringer) * ci: Fix Scheduled Test ([#41235], @brlbil) * ci: simplify scheduled test (Backport PR [#41265], Upstream PR [#41261], @brlbil) * gha: run checkpatch check only on PR events (Backport PR [#41369], Upstream PR [#41308], @giorio94) * pkg/metrics: define default CIDR policies values (Backport PR [#41476], Upstream PR [#41422], @aanm)

Misc Changes: * .github/workflows: add step 5 as part of the image build process (Backport PR [#41178], Upstream PR [#41113], @aanm) * build-images-release: specify main branch on reusable jobs (Backport PR [#41178], Upstream PR [#41530], @aanm) * checkpatch: Update image digest (Backport PR [#41476], Upstream PR [#41360], @HadrienPatte) * chore(deps): update all github action dependencies (v1.17) ([#41569], @cilium-renovate[bot]) * chore(deps): update all-dependencies (v1.17) ([#41127], @cilium-renovate[bot]) * chore(deps): update all-dependencies (v1.17) ([#41341], @cilium-renovate[bot]) * chore(deps): update all-dependencies (v1.17) ([#41440], @cilium-renovate[bot]) * chore(deps): update all-dependencies (v1.17) ([#41510], @cilium-renovate[bot]) * chore(deps): update all-dependencies (v1.17) ([#41613], @cilium-renovate[bot]) * chore(deps): update all-dependencies (v1.17) ([#41717], @cilium-renovate[bot]) * chore(deps): update dependency protocolbuffers/protobuf to v32 (v1.17) ([#41221], @cilium-renovate[bot]) * chore(deps): update dependency protocolbuffers/protobuf to v32.1 (v1.17) ([#41664], @cilium-renovate[bot]) * chore(deps): update docker.io/library/golang:1.24.6 docker digest to 8d9e57c (v1.17) ([#41352], @cilium-renovate[bot]) * chore(deps): update go to v1.24.7 (v1.17) ([#41568], @cilium-renovate[bot]) * chore(deps): update google/cloud-sdk docker tag to v535 (v1.17) ([#41353], @cilium-renovate[bot]) * chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.33.7-1756004918-79963736ba1b039ff10f7dcb65fa43c5dd6556ed (v1.17) ([#41377], @cilium-renovate[bot]) * chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.33.8-1756960543-c60e96750d287b709de24243dd71a769147da7d1 (v1.17) ([#41517], @cilium-renovate[bot]) * chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.33.9-1757593597-298d4cf0a4058d027aa846ef3647123e8411d2b0 (v1.17) ([#41662], @cilium-renovate[bot]) * chore(deps): update quay.io/cilium/cilium-llvm docker tag to v1755973935 (v1.17) ([#41356], @cilium-renovate[bot]) * chore(deps): update stable lvh-images (v1.17) (patch) ([#41441], @cilium-renovate[bot]) * chore(deps): update stable lvh-images (v1.17) (patch) ([#41663], @cilium-renovate[bot]) * ci: Update workflow permissions (Backport PR [#41476], Upstream PR [#41383], @kyle-c-simmons) * docs: document portmap binary requirements (Backport PR [#41369], Upstream PR [#41300], @nbusseneau) * Fix release script steps (Backport PR [#41178], Upstream PR [#41502], @aanm) * install: bump startup script version (Backport PR [#41369], Upstream PR [#41299], @Artyop) * lower log severity for stale metadata to avoid CI issue (Backport PR [#41476], Upstream PR [#41389], @liyihuang) * metrics/features: remove aws-vpc-cni (Backport PR [#41624], Upstream PR [#41498], @aanm) * Support extending cilium-agent dnsPolicy as a downstream packager (Backport PR [#41266], Upstream PR [#41010], @devodev) * Update all github action dependencies (v1.17) ([#41220], @cilium-renovate[bot]) * Update docker.io/library/golang:1.24.6 Docker digest to e155b51 (v1.17) ([#41218], @cilium-renovate[bot]) * Update stable lvh-images (v1.17) (patch) ([#41219], @cilium-renovate[bot]) * workflows/conformance-ginkgo: fix steps for stable branches (Backport PR [#41618], Upstream PR [#41599], @aanm)

Other Changes: * [v1.17] envoy: Start serving listeners only after clusters have been ACKed ([#41606], @jrajahalme) * [v1.17] workflows/release: add secrets for step 4 and 5 ([#41734], @jrajahalme) * Fix a bug that caused the kernel verifier on pre-v5.7 kernels to reject the bpf_sock program with "invalid func unknown#122" when the LocalRedirectPolicy feature is enabled. ([#41449], @julianwiedmann) * GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service. ([#41257], @youngnick) * install: Update image digests for v1.17.7 ([#41181], @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.17.8@sha256:6d7ea72ed311eeca4c75a1f17617a3d596fb6038d30d00799090679f82a01636

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.8@sha256:3ac210d94d37a77ec010f9ac4c705edc8f15f22afa2b9a6f0e2a7d64d2360586

docker-plugin

quay.io/cilium/docker-plugin:v1.17.8@sha256:0c06b8bfa91d0fe79f7ad0e1bc30b910d530a6d36a977571b6038c7b12b9e7c1

hubble-relay

quay.io/cilium/hubble-relay:v1.17.8@sha256:2e576bf7a02291c07bffbc1ca0a66a6c70f4c3eb155480e5b3ac027bedd2858b

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.8@sha256:72c25a405ad8e58d2cf03f7ea2b6696ed1edcfb51716b5f85e45c6c4fcaa6056

operator-aws

quay.io/cilium/operator-aws:v1.17.8@sha256:28012f7d0f4f23e9f6c7d6a5dd931afa326bbac3e8103f3f6f22b9670847dffa

operator-azure

quay.io/cilium/operator-azure:v1.17.8@sha256:619f9febf3efef2724a26522b253e4595cd33c274f5f49925e29a795fdc2d2d7

operator-generic

quay.io/cilium/operator-generic:v1.17.8@sha256:5468807b9c31997f3a1a14558ec7c20c5b962a2df6db633b7afbe2f45a15da1c

operator

quay.io/cilium/operator:v1.17.8@sha256:31ff7c28d2cc96f97c5246fa03d4e31a089600f0d896e7e16a48e83090ee83bc