Cilium Files

Summary of Changes

Major Changes:

• docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR [#47615], Upstream PR [#47351], @MrFreezeex)

Minor Changes:

• envoy: demote stale ADS endpoint warning (Backport PR [#47805], Upstream PR [#47148], @nezdolik)
• Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR [#47881], Upstream PR [#47529], @julianwiedmann)

Bugfixes:

• azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR [#47690], Upstream PR [#47449], @jaredledvina)
• bpf: dsr: don't look for TCP header on fragmented packets (Backport PR [#47881], Upstream PR [#47640], @julianwiedmann)
• bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR [#47621], Upstream PR [#47343], @smagnani96)
• clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR [#47885], Upstream PR [#47824], @MrFreezeex)
• datapath: turn ARP off on the base devices before bringing them up (Backport PR [#47885], Upstream PR [#47838], @aanm)
• endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR [#47690], Upstream PR [#47625], @christarazi)
• endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR [#47954], Upstream PR [#47880], @weizhoublue)
• envoy.httpUpstreamLingerTimeout accepts 0 as a chart value and templates into configmap. (Backport PR [#47885], Upstream PR [#47741], @jdw6359)
• envoy: restore http-idle-timeout as the route idle timeout source (Backport PR [#47690], Upstream PR [#47583], @aanm)
• Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR [#47805], Upstream PR [#47765], @julianwiedmann)
• Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR [#47967], Upstream PR [#47802], @bimmlerd)
• Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR [#47805], Upstream PR [#47727], @aanm)
• Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR [#47690], Upstream PR [#47295], @aanm)
• Fix abnormal ip allocation caused by hostnetwork pod (Backport PR [#47690], Upstream PR [#47552], @haozhangami)
• Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR [#47881], Upstream PR [#47593], @julianwiedmann)
• fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR [#47885], Upstream PR [#47754], @weizhoublue)
• Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with NotAllowedByListeners when the TCP listener had an explicit AllowedRoutes.Kinds restriction. (Backport PR [#47690], Upstream PR [#46842], @pidreher)
• gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR [#47954], Upstream PR [#47840], @mhofstetter)
• gateway-api: mark unresolved backend service ports in route status (Backport PR [#47885], Upstream PR [#47766], @mhofstetter)
• gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR [#47690], Upstream PR [#46696], @thorn3r)
• gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR [#47690], Upstream PR [#47457], @asauber)
• gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR [#47805], Upstream PR [#47702], @mhofstetter)
• gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR [#47690], Upstream PR [#47627], @mhofstetter)
• ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR [#47885], Upstream PR [#47208], @iwanhae)
• l2announcer: re-evaluate services on frontend changes (Backport PR [#47690], Upstream PR [#47579], @mhofstetter)
• Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR [#47954], Upstream PR [#47826], @mehrdadbn9)
• operator: Emit startup logs in the configured log format (Backport PR [#47954], Upstream PR [#47890], @HadrienPatte)
• Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR [#47885], Upstream PR [#47844], @bimmlerd)
• standalone-dns-proxy: return an error when no endpoint is found (Backport PR [#47954], Upstream PR [#47791], @vipul-21)
• wireguard: Unsubscribe node handler on shutdown (Backport PR [#47805], Upstream PR [#47614], @HadrienPatte)

CI Changes:

• .github: add python3-scapy for BPF unit tests (Backport PR [#47690], Upstream PR [#47535], @msune)
• .github: run all quarantined EKS tests in a single tolerated step (Backport PR [#47690], Upstream PR [#47534], @aanm)
• .github: Run envoy image check against PR content (Backport PR [#47805], Upstream PR [#47792], @joestringer)
• .github: Simplify permissions for image linter workflow (Backport PR [#47805], Upstream PR [#47753], @joestringer)
• .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR [#47690], Upstream PR [#47470], @atykhyy)
• .github: test the default ENI behaviour on the EKS pull request leg (Backport PR [#47690], Upstream PR [#47569], @aanm)
• ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR [#47805], Upstream PR [#47743], @giorio94)
• bpf/complexity-tests: Cover L7 LB (Backport PR [#47805], Upstream PR [#47060], @pchaigno)
• ci: build race images on push events so conformance-race works on stable branches (Backport PR [#47609], Upstream PR [#47608], @aanm)
• ci: build race images on push in the stable image builders (Backport PR [#47609], Upstream PR [#47616], @aanm)
• ci: draft renovate PRs until ciliumbot auto-approval (Backport PR [#47805], Upstream PR [#47364], @mhofstetter)
• ci: fix filtering out md files in bpf checks (Backport PR [#47690], Upstream PR [#47605], @nebril)
• ci: migrate set-commit-status to cilium/actions (Backport PR [#47805], Upstream PR [#47771], @bogdankrasko)
• ci: skip etcd log fetch when kvstore was never started (Backport PR [#47885], Upstream PR [#47801], @aanm)
• Fix missing events_map_rate_limit complexity coverage (Backport PR [#47805], Upstream PR [#47691], @pchaigno)
• gha/kubespray: run on schedule, rather than on every push (Backport PR [#47731], Upstream PR [#47719], @giorio94)
• gha/lvh-kind: respect Kind image version also when config is provided (Backport PR [#47731], Upstream PR [#47703], @giorio94)
• gha: don't install LLVM and Clang in integration tests workflow (Backport PR [#47731], Upstream PR [#47717], @giorio94)
• gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR [#47731], Upstream PR [#47724], @giorio94)
• images/scripts: Validate Envoy image vars against sed injection (Backport PR [#47805], Upstream PR [#47205], @MasloMaslane)
• Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR [#47885], Upstream PR [#47780], @giorio94)
• test(bpf): parallelize eBPF test compilation (Backport PR [#47954], Upstream PR [#47426], @lconnery)
• test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR [#47805], Upstream PR [#47725], @aanm)
• test: allowlist the leader election read timeout in ginkgo log check (Backport PR [#47690], Upstream PR [#47612], @aanm)

Misc Changes:

• Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR [#47690], Upstream PR [#46116], @amaanx86)
• allocator: fix flake in TestWatchRemoteKVStore (Backport PR [#47690], Upstream PR [#47455], @giorio94)
• bpf/nat: Move IPv6 nat entry to map (Backport PR [#47805], Upstream PR [#47762], @pchaigno)
• bpf: conntrack: Reduce stack usage of ct_create{4,6} (Backport PR [#47805], Upstream PR [#47582], @dylandreimerink)
• bpf: dsr: only require DSR-info on SYN packet (Backport PR [#47881], Upstream PR [#47592], @julianwiedmann)
• bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR [#47881], Upstream PR [#47388], @julianwiedmann)
• bpf: lb: use dedicated new_backend bool (Backport PR [#47881], Upstream PR [#47841], @julianwiedmann)
• chore(deps): update all github action dependencies (v1.20) ([#47991], @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) ([#48008], @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) ([#47678], @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) ([#47576], @cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) ([#47988], @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.5 docker digest to 705e964 (v1.20) ([#47949], @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.5 docker digest to 7caba52 (v1.20) ([#47864], @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) ([#47899], @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) ([#47989], @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) ([#47865], @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) ([#47990], @cilium-renovate[bot])
• clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR [#47962], Upstream PR [#47932], @giorio94)
• docs: clarify GAMMA DROP_EP_NOT_READY events (Backport PR [#47885], Upstream PR [#47587], @thorn3r)
• docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR [#47690], Upstream PR [#47600], @41ks)
• docs: Remove "not stable" installation instructions (Backport PR [#47798], Upstream PR [#47646], @joestringer)
• docs: update Gateway API conformance badge (Backport PR [#47690], Upstream PR [#47581], @arybolovlev)
• docs: Update Gateway API installation guide (Backport PR [#47690], Upstream PR [#47446], @arybolovlev)
• Gateway API: the Gateway address status no longer reports a bogus "<nil>" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR [#47690], Upstream PR [#47466], @locker95)
• gateway-api: remove unnecessary TLSRoute support checks (Backport PR [#47885], Upstream PR [#47758], @mhofstetter)
• gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR [#47690], Upstream PR [#47599], @mhofstetter)
• gateway-api: return route check errors directly (Backport PR [#47805], Upstream PR [#47607], @mhofstetter)
• gateway-api: unify Gateway API listener parentRef matching (Backport PR [#47690], Upstream PR [#46670], @arybolovlev)
• gateway-api: validate gRPCRoute header modifiers in status (Backport PR [#47805], Upstream PR [#47606], @mhofstetter)
• operator: Replace reflect.DeepEqual with assert.Equal in tests (Backport PR [#47690], Upstream PR [#47424], @HadrienPatte)
• Update all github action dependencies (v1.20) ([#47656], @cilium-renovate[bot])
• Update all github action dependencies (v1.20) ([#47675], @cilium-renovate[bot])
• Update docker.io/library/busybox:1.38.0 Docker digest to dc2d74b (v1.20) ([#47655], @cilium-renovate[bot])
• Update documentation dependencies (Backport PR [#47798], Upstream PR [#47750], @joestringer)
• Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) ([#47657], @cilium-renovate[bot])
• Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) ([#47659], @cilium-renovate[bot])
• Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) ([#47658], @cilium-renovate[bot])

Other Changes:

• install: Update image digests for v1.20.0 ([#47584], @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5 quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5

hubble-relay

quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4 quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c

operator-aws

quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7 quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7

operator-azure

quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031 quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031

operator-generic

quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf

operator

quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d