Cilium Files

Summary of Changes

Bugfixes:

• envoy: restore http-idle-timeout as the route idle timeout source (Backport PR [#47688], Upstream PR [#47583], @aanm)
• Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR [#47723], Upstream PR [#47765], @julianwiedmann)
• Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR [#47545], Upstream PR [#47295], @aanm)
• Fix abnormal ip allocation caused by hostnetwork pod (Backport PR [#47688], Upstream PR [#47552], @haozhangami)
• Fix BPF LB map key collision where HostPort/NodePort expansion could overwrite a LoadBalancer frontend when the node IP matches the LoadBalancer external IP (e.g. k3s/RKE2 L2 ServiceLB). Also fix a ~30-minute NodePort outage that occurred after deleting a LoadBalancer whose external IP was a node address with a port in the NodePort range. (Backport PR [#47414], Upstream PR [#45314], @syedazeez337)
• Fix bug causing Cilium to intercept traffic towards LoadBalancer VIPs when KPR is disabled, when the traffic should be delegated to kube-proxy. (Backport PR [#47414], Upstream PR [#47204], @ajmmm)
• Fix redirection of egressing traffic that falls in scope of a CiliumEgressGatewayPolicy, when the initial interface is a L3 interface. (Backport PR [#47757], Upstream PR [#45703], @julianwiedmann)
• Fix: Cilium Ingress now automatically reallocates ports and retries when cilium-envoy fails to bind due to port conflicts (Backport PR [#47410], Upstream PR [#42859], @inerplat)
• Fixes an issue where invalid regex on an HTTPRoute or GRPCRoute matcher is accepted but causes Envoy to NACK (Backport PR [#47468], Upstream PR [#47005], @0xch4z)
• fqdn/service: prune SDP identity->IP mapping on delete using newID (Backport PR [#47545], Upstream PR [#47100], @vipul-21)
• gateway-api: GAMMA Routes are now filtered correctly before being passed to model ingestion. (Backport PR [#47468], Upstream PR [#45294], @youngnick)
• ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR [#47886], Upstream PR [#47208], @iwanhae)
• lbipam: prevent reassigning Service LoadBalancer IPs on operator restart when the existing IP belongs to a compatible sharing key group. (Backport PR [#46559], Upstream PR [#46262], @ieth0)
• Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR [#47886], Upstream PR [#47844], @bimmlerd)
• wireguard: Unsubscribe node handler on shutdown (Backport PR [#47804], Upstream PR [#47614], @HadrienPatte)

CI Changes:

• .github: fail smoke IPv6 closed when the test job does not succeed (Backport PR [#47545], Upstream PR [#47441], @aanm)
• .github: retry CLI and binary downloads over transient network errors (Backport PR [#47290], Upstream PR [#47167], @aanm)
• .github: Run envoy image check against PR content (Backport PR [#47886], Upstream PR [#47792], @joestringer)
• .github: Simplify permissions for image linter workflow (Backport PR [#47804], Upstream PR [#47753], @joestringer)
• .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR [#47688], Upstream PR [#47470], @atykhyy)
• [v1.19] ariane: remove reference to the non-existing lint-ariane-config workflow ([#47701], @giorio94)
• ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR [#47804], Upstream PR [#47743], @giorio94)
• bpf/tests: support pkt sizes 1036-1518 bytes (Backport PR [#47443], Upstream PR [#44314], @msune)
• chore: use GH_RUNNER_CILIUM_BASE_AMD64/ARM64 vars for integration-test runners (Backport PR [#47545], Upstream PR [#47182], @bogdankrasko)
• ci: build race images on push events so conformance-race works on stable branches (Backport PR [#47610], Upstream PR [#47608], @aanm)
• ci: build race images on push in the stable image builders (Backport PR [#47610], Upstream PR [#47616], @aanm)
• ci: draft renovate PRs until ciliumbot auto-approval (Backport PR [#47804], Upstream PR [#47364], @mhofstetter)
• ci: fix filtering out md files in bpf checks (Backport PR [#47688], Upstream PR [#47605], @nebril)
• ci: fix three renovate-PR CI flakes (kubectl download retry, merge-upload ref, EKS pool zones) (Backport PR [#47541], Upstream PR [#47357], @aanm)
• CI: fixed external-target readiness gating and ensured sig-network E2E JUnit reports are uploaded on failure. (Backport PR [#47290], Upstream PR [#46860], @aanm)
• ci: migrate set-commit-status to cilium/actions (Backport PR [#47804], Upstream PR [#47771], @bogdankrasko)
• ci: skip etcd log fetch when kvstore was never started (Backport PR [#47886], Upstream PR [#47801], @aanm)
• Collect /proc/net/softnet_stat, /proc/net/snmp and /proc/net/netstat in sysdumps to help diagnose host-level packet drops. (Backport PR [#47290], Upstream PR [#46985], @aanm)
• complexity-diff: Compute percentages of diffs against original values (Backport PR [#47836], Upstream PR [#45657], @pchaigno)
• complexity-diff: Display results on scheduled runs (Backport PR [#47721], Upstream PR [#45595], @pchaigno)
• conformance-aws-cni: skip l7 and fqdn tests by name on chaining mode (Backport PR [#47290], Upstream PR [#47269], @aanm)
• datapath/loader: Fix stack depth parsing for programs with functions (Backport PR [#47814], Upstream PR [#44963], @dylandreimerink)
• Decrease CI costs on AWS (Backport PR [#47290], Upstream PR [#46615], @aanm)
• Fix stack depth reporting in verifier test (Backport PR [#47836], Upstream PR [#46182], @pchaigno)
• gateway-api: fix gatewayclassconfig-nodeport test (Backport PR [#47468], Upstream PR [#47255], @0xch4z)
• gha/e2e: cover etcd behind a service (Backport PR [#47410], Upstream PR [#47235], @giorio94)
• gha/kubespray: run on schedule, rather than on every push (Backport PR [#47734], Upstream PR [#47719], @giorio94)
• gha/lvh-kind: respect Kind image version also when config is provided (Backport PR [#47734], Upstream PR [#47703], @giorio94)
• gha: don't install LLVM and Clang in integration tests workflow (Backport PR [#47734], Upstream PR [#47717], @giorio94)
• gha: dump nodegroup CloudFormation failure events on create failure (Backport PR [#47410], Upstream PR [#47298], @aanm)
• gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR [#47734], Upstream PR [#47724], @giorio94)
• gha: stop scheduled runs emitting spurious artifact warnings (Backport PR [#47290], Upstream PR [#46989], @aanm)
• images/scripts: Validate Envoy image vars against sed injection (Backport PR [#47804], Upstream PR [#47205], @MasloMaslane)
• Increase the timeout for the kvstore readiness wait in kind-based CI to avoid flakes on slow etcd image pulls. (Backport PR [#47290], Upstream PR [#46882], @aanm)
• loader: Reduce number of permutations for load-time configs (Backport PR [#47721], Upstream PR [#44409], @pchaigno)
• loader: Support max stack depth in verifier logs (Backport PR [#47836], Upstream PR [#46109], @pchaigno)
• loader: Support newer verifier logs (Backport PR [#47836], Upstream PR [#45880], @pchaigno)
• pkg/loadbalancer: fix loadbalancer nodeport collision test (Backport PR [#47414], Upstream PR [#46087], @ajmmm)
• pkg/rate: fix TestMaxParallelRequests flake under CI load (Backport PR [#47290], Upstream PR [#46856], @aanm)
• Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR [#47886], Upstream PR [#47780], @giorio94)
• test/cyclonus: capture logs of every job pod so a runner crash is diagnosable (Backport PR [#47290], Upstream PR [#46980], @aanm)
• test/cyclonus: drop --fail-fast so a policy failure can't crash the run (Backport PR [#47410], Upstream PR [#47272], @aanm)
• test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR [#47804], Upstream PR [#47725], @aanm)
• workflows/verifier: Fail on high complexity, stack depth or map count (Backport PR [#47721], Upstream PR [#45659], @pchaigno)
• workflows/verifier: Fix again always-passing workflow status (Backport PR [#47721], Upstream PR [#45899], @pchaigno)
• workflows/verifier: Fix always-passing workflow status (Backport PR [#47721], Upstream PR [#45835], @pchaigno)
• workflows/verifier: Fix commit status (Backport PR [#47721], Upstream PR [#46382], @pchaigno)
• workflows/verifier: Wait for complexity-diff to set workflow status (Backport PR [#47721], Upstream PR [#45681], @pchaigno)

Misc Changes:

• allocator: fix flake in TestWatchRemoteKVStore (Backport PR [#47688], Upstream PR [#47455], @giorio94)
• bpf, testing: define scapy buffers as canonical C variables. (Backport PR [#47443], Upstream PR [#44893], @ldelossa)
• bpf/analyze: Always visit global functions (Backport PR [#47804], Upstream PR [#45917], @pchaigno)
• bpf/lxc: Never allocate ct_buffers on stack (Backport PR [#47723], Upstream PR [#45603], @pchaigno)
• bpf/nat: Move IPv6 nat entry to map (Backport PR [#47723], Upstream PR [#47762], @pchaigno)
• bpf: conntrack: Reduce stack usage of ct_create{4,6} (Backport PR [#47723], Upstream PR [#47582], @dylandreimerink)
• bpf: encap: move & use DSR-GENEVE helpers (Backport PR [#47460], Upstream PR [#45526], @julianwiedmann)
• bpf: Make ipv6_hdrlen_with_fraginfo function global (Backport PR [#47723], Upstream PR [#46295], @pchaigno)
• bpf: Never allocate ct_buffers on the stack (Backport PR [#47723], Upstream PR [#45589], @pchaigno)
• bpf: Reduce stack size for tail_handle_snat_fwd_ipv6 (Backport PR [#47723], Upstream PR [#46360], @pchaigno)
• bpf: rename aux.h to avoid malformed file path error upon go get (Backport PR [#47723], Upstream PR [#45804], @tklauser)
• bugtool: collect snmp6 and dev_snmp6 for IPv6 host packet drops (Backport PR [#47410], Upstream PR [#47353], @aanm)
• chore(deps): update all github action dependencies (v1.19) ([#47324], @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) ([#47490], @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) ([#47867], @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) ([#47993], @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) ([#48009], @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) ([#47679], @cilium-renovate[bot])
• chore(deps): update base-images (v1.19) ([#47489], @cilium-renovate[bot])
• chore(deps): update base-images (v1.19) ([#47950], @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.6 (v1.19) ([#47340], @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.19) ([#47577], @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.12 docker digest to d2e20dc (v1.19) ([#47321], @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.12 docker digest to fe5d57d (v1.19) ([#47866], @cilium-renovate[bot])
• chore(deps): update gcr.io/distroless/static:nonroot docker digest to f7f8f72 (v1.19) ([#47322], @cilium-renovate[bot])
• chore(deps): update github/codeql-action action to v4.37.2 (v1.19) ([#47504], @cilium-renovate[bot])
• chore(deps): update google/cloud-sdk docker tag to v577 (v1.19) ([#47511], @cilium-renovate[bot])
• chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260716143926-092fe0c72997 (v1.19) ([#47487], @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.8 (v1.19) ([#47323], @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1784803288-cf56df1cccc09d7afde2847ff9e6e853dde50b77 (v1.19) ([#47488], @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1786864149-07e8503ff34b9190d7bbe4e57d4e185c4ef8b1de (v1.19) ([#48000], @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.19) (patch) ([#46316], @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.19) (patch) ([#47868], @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.19) (patch) ([#47992], @cilium-renovate[bot])
• docs/clustermesh: remove obsolete reference to service cache (Backport PR [#47410], Upstream PR [#47195], @giorio94)
• docs: add context on recommended CEC and CCEC permissions (Backport PR [#47545], Upstream PR [#45056], @ferozsalam)
• docs: Fix DOCS_BUILDER_REPO env variable for BSD sed compatibility (Backport PR [#47829], Upstream PR [#46033], @arybolovlev)
• docs: Update docs-builder for Makefile usage (Backport PR [#47829], Upstream PR [#45774], @joestringer)
• fix(deps): update k8s.io patch updates stable to v0.35.7 (v1.19) ([#47521], @cilium-renovate[bot])
• fix(deps): update module k8s.io/apimachinery to v0.35.7 (v1.19) ([#47474], @cilium-renovate[bot])
• Fixed the conformance-ginkgo feature status report not being uploaded as an artifact. (Backport PR [#47541], Upstream PR [#47174], @aanm)
• gateway-api: remove SetAllParentCondition route helpers (Backport PR [#47468], Upstream PR [#47086], @0xch4z)
• gha: capture per-pod diagnostics for sig-network conntrack UDP NodePort failures (Backport PR [#47290], Upstream PR [#47140], @aanm)
• gha: let auto-approve match on re-runs (Backport PR [#47290], Upstream PR [#46832], @aanm)
• images ci: free preinstalled toolchains on tight runners before building (Backport PR [#47290], Upstream PR [#47141], @aanm)
• Introduce BPF auxiliary variables (Backport PR [#47723], Upstream PR [#45081], @dylandreimerink)
• policy/k8s: record processing start time for k8s NetworkPolicy updates (Backport PR [#47290], Upstream PR [#46979], @aanm)
• Update all github action dependencies (v1.19) ([#47661], @cilium-renovate[bot])
• Update all github action dependencies (v1.19) ([#47676], @cilium-renovate[bot])
• Update docker.io/library/busybox:1.37.0 Docker digest to 9db7b59 (v1.19) ([#47660], @cilium-renovate[bot])
• Update documentation dependencies (Backport PR [#47829], Upstream PR [#47750], @joestringer)
• Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.19) ([#47662], @cilium-renovate[bot])
• Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.19) ([#47663], @cilium-renovate[bot])

Other Changes:

• [v1.19] Add DNS request checking prior to qname extraction ([#47383], @ferozsalam)
• install: Update image digests for v1.19.6 ([#47252], @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.7@sha256:1b58bcb81c723cf130a0dd2fb2e1132c57f8fbc2ef7bdb85519cfcc36111c77e

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.7@sha256:17186e4639900fcaa7c38260bb8ac622ee56b3b805e2452f24b824e84db9e5e6

docker-plugin

quay.io/cilium/docker-plugin:v1.19.7@sha256:1b29323ca48d785946a16c312c983d41bb058e6ebd1e3172f45b25051c1254e7

hubble-relay

quay.io/cilium/hubble-relay:v1.19.7@sha256:db4b384d0f6aba261e809d58bee54885c70a7e958173a125ebb215391af55e74

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.7@sha256:22f36b3bf2ec9ae0bdd2ca943f7a18b8a36704dce6959d2ac0eef6527ec3b400

operator-aws

quay.io/cilium/operator-aws:v1.19.7@sha256:7218d710e1b3dbc2039cb3bcf285d3cdd7a89ca482f8be0c868362d14824dd3e

operator-azure

quay.io/cilium/operator-azure:v1.19.7@sha256:572f7f69b470fda8ce068a5acb0961b29b8754bb35f95f27f7f2d838b08c3971

operator-generic

quay.io/cilium/operator-generic:v1.19.7@sha256:61e773bfc25a448f1ad3ead605af94b3ef176ba2925cf4bd1b11e09794b72bed

operator

quay.io/cilium/operator:v1.19.7@sha256:283dddce1845b4375e4a733494ae742acd85fef4d4b1b303338b21898a6e386e