{
"schemaVersion": 3,
"dataset": {
"version": 3,
"date": "2026-08-13",
"group": {
"id": "platform-infrastructure",
"name": "Platform / Networking / Runtime Infrastructure"
},
"repository": {
"id": "cilium",
"repo": "cilium/cilium",
"name": "Cilium",
"keywords": [
"Cilium"
]
},
"context": {
"repository": "cilium/cilium",
"url": "https://github.com/cilium/cilium",
"description": "eBPF-based Networking, Security, and Observability",
"homepage": "https://cilium.io",
"language": "Go",
"topics": [
"bpf",
"cncf",
"cni",
"containers",
"ebpf",
"k8s",
"kernel",
"kubernetes",
"kubernetes-networking",
"loadbalancing",
"monitoring",
"networking",
"observability",
"security",
"troubleshooting",
"xdp"
],
"license": "Apache-2.0",
"defaultBranch": "main",
"stars": 24924,
"forks": 3962,
"openIssues": 1083,
"archived": false,
"collectedAt": "2026-08-13T18:01:58.717486+00:00"
},
"news": {
"repository": "cilium/cilium",
"collectedAt": "2026-08-13T18:01:58.717486+00:00",
"latestRelease": {
"repository": "cilium/cilium",
"tag": "v1.20.0",
"title": "1.20.0",
"url": "https://github.com/cilium/cilium/releases/tag/v1.20.0",
"publishedAt": "2026-07-29T15:00:29Z",
"notes": "π **Release Announcement** π: We are excited to announce the [Cilium 1.20.0](https://github.com/cilium/cilium/releases/tag/v1.20.0) release!\r\n\r\nMore than **2,660 new commits** have landed in this release, supported by a community of over **1,100 contributors** and more than **24,800 GitHub stars**! π€©\r\n\r\nβ οΈ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the `cilium.io/v2alpha1` `CiliumNodeConfig` API, the libnetwork integration, or a custom CNI configuration. See the [Upgrade Guide](https://docs.cilium.io/en/v1.20/operations/upgrade/#upgrade-notes) for details.\r\n\r\nThe full changelog can be found [here](https://github.com/cilium/cilium/blob/v1.20/CHANGELOG.md).\r\n\r\nHere are some of the highlights:\r\n\r\n* β©οΈ **Gateway API**\r\n * π **Gateway API v1.6.1**: Cilium moves from Gateway API v1.4 to v1.6.1, bringing support for capabilities that graduated across both upstream releases. ([cilium/cilium#45251](https://github.com/cilium/cilium/pull/45251), @youngnick; [cilium/cilium#46827](https://github.com/cilium/cilium/pull/46827), [cilium/cilium#47274](https://github.com/cilium/cilium/pull/47274), @arybolovlev)\r\n * π₯ **Delegate Gateway Listeners**: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. ([cilium/cilium#46303](https://github.com/cilium/cilium/pull/46303), [cilium/cilium#46785](https://github.com/cilium/cilium/pull/46785), @asauber)\r\n * π **Encrypt Traffic to Backends**: Gateway API `BackendTLSPolicy` support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. ([cilium/cilium#43045](https://github.com/cilium/cilium/pull/43045), @youngnick)\r\n * π **TCPRoute and UDPRoute**: Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic. ([cilium/cilium#46184](https://github.com/cilium/cilium/pull/46184), [cilium/cilium#46970](https://github.com/cilium/cilium/pull/46970), @eminaktas; [cilium/cilium#47381](https://github.com/cilium/cilium/pull/47381), @arybolovlev)\r\n * π **External Authorization**: HTTPRoute requests can now be authenticated and authorized through an external service before they reach the application, using the Gateway API `ExternalAuth` filter from GEP-1494. ([cilium/cilium#45739](https://github.com/cilium/cilium/pull/45739), @gauteoh)\r\n * ποΈ **More HTTP Traffic Controls**: HTTPRoutes gain native CORS support and additional 303, 307 and 308 redirect codes. `CiliumGatewayClassConfig` can also overwrite, append or preserve the HTTP Server response header. ([cilium/cilium#45924](https://github.com/cilium/cilium/pull/45924), @arybolovlev; [cilium/cilium#47232](https://github.com/cilium/cilium/pull/47232), @youngnick; [cilium/cilium#46764](https://github.com/cilium/cilium/pull/46764), @xtineskim)\r\n * βοΈ **Configurable gRPC-Web Translation**: `CiliumGatewayClassConfig` can disable automatic gRPC-web translation for Gateways that need to pass the original traffic through unchanged. Translation remains enabled by default. ([cilium/cilium#45984](https://github.com/cilium/cilium/pull/45984), @thorn3r)\r\n\r\n\r\n* π **Networking**\r\n * π **Extensible Datapath**: Datapath plugins let cloud providers extend or instrument Cilium's eBPF datapath with independently versioned programs, without maintaining a Cilium fork. ([cilium/cilium#45028](https://github.com/cilium/cilium/pull/45028), [cilium/cilium#45429](https://github.com/cilium/cilium/pull/45429), [cilium/cilium#45558](https://github.com/cilium/cilium/pull/45558), [cilium/cilium#46673](https://github.com/cilium/cilium/pull/46673), [cilium/cilium#46872](https://github.com/cilium/cilium/pull/46872), @jrife)\r\n * π **Automatic Netkit Selection**: Set `bpf.datapathMode=auto` to use netkit automatically on supported kernels and fall back to veth on other nodes. The default remains veth. ([cilium/cilium#43062](https://github.com/cilium/cilium/pull/43062), @ajmmm)\r\n * π€ **Egress Gateway Improvements**: Dual-stack clusters can configure an explicit IPv6 egress IP. IPv4 Egress Gateway traffic also strictly honors the interface selected by the policy, matching the existing IPv6 behavior. ([cilium/cilium#44524](https://github.com/cilium/cilium/pull/44524), @yykkibbb; [cilium/cilium#45833](https://github.com/cilium/cilium/pull/45833), @julianwiedmann)\r\n * π **Better BGP Tooling and Reconciliation**: New Hive shell commands expose route policies and clearer peer output formats. The control plane moves to GoBGP v4.6.1 and optimizes route-policy reconciliation. ([cilium/cilium#45628](https://github.com/cilium/cilium/pull/45628), [cilium/cilium#45534](https://github.com/cilium/cilium/pull/45534), @martonra; [cilium/cilium#45952](https://github.com/cilium/cilium/pull/45952), [cilium/cilium#46928](https://github.com/cilium/cilium/pull/46928), @rastislavs)\r\n\r\n\r\n* π **IPAM and IP Selection**\r\n * βοΈ **IPv6 for AWS ENI IPAM (Beta)**: Cilium can now allocate IPv6 prefixes to pods through AWS ENI IPAM, building on the move to the multi-pool allocator. ([cilium/cilium#46756](https://github.com/cilium/cilium/pull/46756), [cilium/cilium#46619](https://github.com/cilium/cilium/pull/46619), @41ks; [cilium/cilium#45154](https://github.com/cilium/cilium/pull/45154), [cilium/cilium#45958](https://github.com/cilium/cilium/pull/45958), @HadrienPatte)\r\n * π **Migrate to Multi-Pool IPAM**: Existing clusters can move from cluster-pool IPAM to multi-pool IPAM without being rebuilt. ([cilium/cilium#46104](https://github.com/cilium/cilium/pull/46104), @pippolo84)\r\n * π§ **Dynamic NodePort Source Addresses**: NodePort can use the kernel FIB to select the preferred source address dynamically before SNATing north-south traffic, on supported kernels. ([cilium/cilium#44625](https://github.com/cilium/cilium/pull/44625), @ldelossa)\r\n * π΅ **Prefer IPv6 Consistently**: The new top-level `preferIpv6` option applies to both Cilium health probes and Hubble peer communication when IPv4 and IPv6 are available. ([cilium/cilium#45447](https://github.com/cilium/cilium/pull/45447), @tibrezus)\r\n\r\n\r\n* πΈοΈ **Services and Cluster Mesh**\r\n * π **Topology-Aware Service Traffic**: Cilium's service load balancer now supports the Kubernetes `PreferSameZone` and `PreferSameNode` traffic distribution hints. ([cilium/cilium#44771](https://github.com/cilium/cilium/pull/44771), @raphink)\r\n * βοΈ **Weighted Maglev Backends**: Maglev now honors the `service.cilium.io/weight` annotation on EndpointSlices. A weight of zero drains new connections while allowing existing connections to continue. ([cilium/cilium#46061](https://github.com/cilium/cilium/pull/46061), @mhofstetter)\r\n * π **More Load-Balancing Options with VXLAN**: Clusters using VXLAN can use per-Service load-balancing mode annotations, including compatible DSR configurations such as IPIP dispatch. ([cilium/cilium#45600](https://github.com/cilium/cilium/pull/45600), @brb)\r\n * π€ **Stable MCS API Support**: Cilium's implementation of the Kubernetes Multi-Cluster Services API is now stable and recommended for portable service discovery through ClusterMesh. ([cilium/cilium#45404](https://github.com/cilium/cilium/pull/45404), [cilium/cilium#46953](https://github.com/cilium/cilium/pull/46953), @MrFreezeex)\r\n\r\n\r\n* π **Encryption and Network Policy**\r\n * π **Improved Ztunnel Identity Management**: The ztunnel path now supports either an internal certificate authority or SPIRE-issued workload identities, alongside new Prometheus metrics for enrollment and connection health. It transparently encrypts enrolled pod-to-pod connections, including traffic between pods on the same node. ([cilium/cilium#43763](https://github.com/cilium/cilium/pull/43763), [cilium/cilium#44275](https://github.com/cilium/cilium/pull/44275), [cilium/cilium#44136](https://github.com/cilium/cilium/pull/44136), [cilium/cilium#45861](https://github.com/cilium/cilium/pull/45861), @nddq; [cilium/cilium#45096](https://github.com/cilium/cilium/pull/45096), @gokulMSFT)\r\n * π‘οΈ **Kubernetes ClusterNetworkPolicy (KCNP)**: Cilium now supports the upstream, cluster-scoped policy API, including Admin and Baseline policy tiers alongside namespaced Kubernetes NetworkPolicy. ([cilium/cilium#42338](https://github.com/cilium/cilium/pull/42338), @TheBeeZee; [cilium/cilium#46253](https://github.com/cilium/cilium/pull/46253), @aanm)\r\n * β **Friendlier IPv6 Policy Denials**: Cilium can return ICMPv6 Destination Unreachable responses when network policy denies IPv6 egress traffic, matching the IPv4 capability introduced in Cilium 1.19. ([cilium/cilium#44234](https://github.com/cilium/cilium/pull/44234), @Andreagit97)\r\n * π **Select the Entire Cluster Mesh**: The new `cluster-mesh` policy entity selects every endpoint across a mesh, making cross-cluster security policies easier to express. ([cilium/cilium#46813](https://github.com/cilium/cilium/pull/46813), @squeed)\r\n * βοΈ **Standardize AWS VPC Group Policies**: Policies that reference AWS VPC groups are now transformed into `CiliumCIDRGroup` resources, bringing external IP groups into the standard Cilium policy model. ([cilium/cilium#44704](https://github.com/cilium/cilium/pull/44704), @squeed)\r\n * π **Per-Pod Source IP Verification Control**: Trusted workloads that need to send traffic with non-local source addresses can disable source IP verification through a pod annotation, guarded by a namespace-level opt-in. ([cilium/cilium#43505](https://github.com/cilium/cilium/pull/43505), @zbb88888)\r\n\r\n\r\n* βοΈ **Day 2 Operations and Observability**\r\n * π§ **Detect Configuration Drift**: Cilium can expose how many ConfigMap settings an agent has not yet applied, making it easier to identify when a restart is required after a configuration change. ([cilium/cilium#44703](https://github.com/cilium/cilium/pull/44703), @PhilipSchmid)\r\n * β±οΈ **Understand Agent Start-Up Time**: New Hive lifecycle and Kubernetes resource-sync metrics show how long individual resources and components take to initialize. ([cilium/cilium#44802](https://github.com/cilium/cilium/pull/44802), [cilium/cilium#44639](https://github.com/cilium/cilium/pull/44639), @ILL1A)\r\n * π°οΈ **Correlate More Hubble Verdicts with Policies**: Hubble can now identify the policy responsible for audit verdicts. ([cilium/cilium#45373](https://github.com/cilium/cilium/pull/45373), @Rajneesh180)\r\n * π **Standalone DNS Proxy Metrics**: The Standalone DNS Proxy now exports DNS metrics back through Cilium, improving visibility when DNS policy processing runs outside the agent. ([cilium/cilium#45222](https://github.com/cilium/cilium/pull/45222), [cilium/cilium#44601](https://github.com/cilium/cilium/pull/44601), @vipul-21)\r\n\r\n\r\n* π
**Performance and Scale**\r\n * πΎ **Aggregated Load-Balancer State**: Cilium's internal backend representation has been flattened to efficiently support thousands of Services that share the same backends. ([cilium/cilium#44511](https://github.com/cilium/cilium/pull/44511), @joamaki)\r\n * π‘ **More Efficient Envoy Updates**: New ADS and Delta xDS modes provide consistent or incremental delivery of Envoy resources, reducing CPU usage and policy update latency. ([cilium/cilium#43887](https://github.com/cilium/cilium/pull/43887), @nezdolik; [cilium/cilium#45288](https://github.com/cilium/cilium/pull/45288), @jrajahalme)\r\n * ποΈ **Optimized BPF Policy Map Encoding**: Semantic wildcard identities for remote-node and world reduce BPF policy-map pressure, particularly in larger clusters. ([cilium/cilium#46438](https://github.com/cilium/cilium/pull/46438), @squeed)\r\n * π¦ **Smaller CNI Binary**: The `cilium-cni` binary has been reduced from roughly 77 MB to 16 MB, shrinking both the Cilium image and its footprint on every node. ([cilium/cilium#45845](https://github.com/cilium/cilium/pull/45845), @giorio94)\r\n * π οΈ **Updated Dependencies and Foundations**: Cilium 1.20 updates to Kubernetes v1.36, Envoy v1.37.x, Gateway API v1.6.1, GoBGP v4.6.1 and MCS API v0.5.2. Runtime and builder images now use Ubuntu 26.04, and the default CNI configuration version moves from 0.3.1 to 1.0.0. ([cilium/cilium#45499](https://github.com/cilium/cilium/pull/45499), [cilium/cilium#47215](https://github.com/cilium/cilium/pull/47215), @HadrienPatte; [cilium/cilium#45851](https://github.com/cilium/cilium/pull/45851), @sayboras; [cilium/cilium#47274](https://github.com/cilium/cilium/pull/47274), @arybolovlev; [cilium/cilium#45952](https://github.com/cilium/cilium/pull/45952), @rastislavs; [cilium/cilium#47166](https://github.com/cilium/cilium/pull/47166), @MrFreezeex; [cilium/cilium#46971](https://github.com/cilium/cilium/pull/46971), @gandro)\r\n\r\n\r\n* π **Community**\r\n * β€οΈ **Production Case Studies**: Many end-users have told their stories running Cilium in production. Read and watch more from: [Asana](https://www.youtube.com/watch?v=mxjiSCnrb3c), [Etraveli](https://www.youtube.com/watch?v=KWS-NaZd62M&list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ&index=7), [Michelin](https://www.cncf.io/case-studies/michelin-2/), [OpenAI](https://isovalent.com/blog/post/openai-isovalent-networking-kubernetes-case-study/), [Suse](https://www.youtube.com/watch?v=bgCg1tS72ME&list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ&index=8), [TelefΓ³nica's acens](https://blogs.cisco.com/sp/telefonicas-acens-and-cisco-driving-the-next-generation-of-cloud-native-services-with-isovalent), and [Zynga](https://www.cncf.io/case-studies/zynga/). If your company wants to submit their case studies let us know. We would love to hear your feedback!\r\n * π³π± **Amsterdam Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and [Cilium Developer Summit](https://github.com/cilium/dev-summits/tree/main/2026-EU) in Amsterdam. [Watch the talks](https://www.youtube.com/playlist?list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ) from CiliumCon.\r\n * πΊπΈ **Salt Lake City Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developer Summit at KubeCon + CloudNativeCon North America in Salt Lake City, November 9-12.\r\n * π€ **Generative AI Policy**: The Cilium community adopted a [Generative AI Policy](https://github.com/cilium/community/blob/main/AI-POLICY.md) that encourages community members to connect and communicate with one another without the use of AI, while recognizing that different people work best with their own tools of choice.\r\n * π **Cilium Books**: Two new books landed for readers at every level β _[Cilium: Up and Running](https://isovalent.com/books/cilium-up-and-running/)_ (O'Reilly), a practitioner's deep dive and _[Buzzing Beyond Clouds: The Illustrated Children's Guide to Cilium](https://isovalent.com/books/children-guide-to-cilium/)_, the follow-up to the eBPF children's guide.\r\n\r\nβ€οΈ **Thank You**: Cilium 1.20 was made possible by contributors, reviewers and maintainers from across the community, including engineers from Datadog, Google, Microsoft and many other organizations.\r\n\r\nTo keep up to date with all the latest Cilium releases, join #release π\r\n\r\n## Docker Manifests\r\n\r\n### cilium\r\n\r\n`quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93`\r\n`quay.io/cilium/cilium:stable@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93`\r\n\r\n### clustermesh-apiserver\r\n\r\n`quay.io/cilium/clustermesh-apiserver:v1.20.0@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92`\r\n`quay.io/cilium/clustermesh-apiserver:stable@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92`\r\n\r\n### hubble-relay\r\n\r\n`quay.io/cilium/hubble-relay:v1.20.0@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94`\r\n`quay.io/cilium/hubble-relay:stable@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94`\r\n\r\n### operator-alibabacloud\r\n\r\n`quay.io/cilium/operator-alibabacloud:v1.20.0@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9`\r\n`quay.io/cilium/operator-alibabacloud:stable@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9`\r\n\r\n### operator-aws\r\n\r\n`quay.io/cilium/operator-aws:v1.20.0@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa`\r\n`quay.io/cilium/operator-aws:stable@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa`\r\n\r\n### operator-azure\r\n\r\n`quay.io/cilium/operator-azure:v1.20.0@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c`\r\n`quay.io/cilium/operator-azure:stable@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c`\r\n\r\n### operator-generic\r\n\r\n`quay.io/cilium/operator-generic:v1.20.0@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3`\r\n`quay.io/cilium/operator-generic:stable@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3`\r\n\r\n### operator\r\n\r\n`quay.io/cilium/operator:v1.20.0@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c`\r\n`quay.io/cilium/operator:stable@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c`\r\n\r\n",
"highlights": [
"β©οΈ Gateway API",
"π Gateway API v1.6.1: Cilium moves from Gateway API v1.4 to v1.6.1, bringing support for capabilities that graduated across both upstream releases. (cilium/cilium#45251, @youngnick; cilium/cilium#46827, cilium/cilium#47274, @arybolovlev)",
"π₯ Delegate Gateway Listeners: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. (cilium/cilium#46303, cilium/cilium#46785, @asauber)",
"π Encrypt Traffic to Backends: Gateway API BackendTLSPolicy support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. (cilium/cilium#43045, @youngnick)",
"π TCPRoute and UDPRoute: Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic. (cilium/cilium#46184, cilium/cilium#46970, @eminaktas; cilium/cilium#4",
"π External Authorization: HTTPRoute requests can now be authenticated and authorized through an external service before they reach the application, using the Gateway API ExternalAuth filter from GEP-1494. (cilium/cilium#45739, @gauteoh)"
],
"prerelease": false
},
"upcoming": [
{
"repository": "cilium/cilium",
"kind": "prerelease",
"title": "1.21.0-pre.0",
"url": "https://github.com/cilium/cilium/releases/tag/v1.21.0-pre.0",
"description": "Summary of Changes\r\n------------------\r\n\r\n**Major Changes:**\r\n* Envoy resources (e.g., Listeners, Network Policies, etc.) can now be synchronized with Envoy incrementally, reducing CPU load and policy update latency. This is enabled by the new agent option value `--envoy-xds-mode=delta-split`. Corresponding Helm value is `envoy.xdsMode=delta-split`. (cilium/cilium#45288, @jrajahalme)\r\n* network driver: add agent side baseline driver and dummy device manager (cilium/cilium#47254, @bersoare)\r\n\r\n**Minor Changes:**\r\n* build: Update iptables from 1.8.8 to 1.8.11 (cilium/cilium#47623, @HadrienPatte)\r\n* clustermesh: no longer restart pods when changing remote clustermesh-apiserver IPs statically defined (without a DNS name) (cilium/cilium#47190, @MrFreezeex)\r\n* CT map adaptive GC interval calculation improvements (cilium/cilium#46796, @fristonio)\r\n* Deprecate WireGuard Node Encryption (cilium/cilium#47219, @pchaigno)\r\n* envoy: demote stale ADS endpoint warning (cilium/cilium#47148, @nezdolik)",
"tag": "v1.21.0-pre.0",
"publishedAt": "2026-08-03T19:58:45Z"
},
{
"repository": "cilium/cilium",
"kind": "milestone",
"title": "Network namespaces test consolidation",
"url": "https://github.com/cilium/cilium/milestone/44",
"description": "Work items related to revamping network namespace interactions.",
"progress": 50,
"openIssues": 1,
"closedIssues": 1
},
{
"repository": "cilium/cilium",
"kind": "milestone",
"title": "clang-free",
"url": "https://github.com/cilium/cilium/milestone/45",
"description": "Work contributing directly towards shipping a clang-free (or distroless) agent image.",
"progress": 83,
"openIssues": 5,
"closedIssues": 25
},
{
"repository": "cilium/cilium",
"kind": "milestone",
"title": "loader refactor",
"url": "https://github.com/cilium/cilium/milestone/46",
"description": "Address tech debt in package loader.",
"progress": 100,
"openIssues": 0,
"closedIssues": 7
},
{
"repository": "cilium/cilium",
"kind": "milestone",
"title": "ZTunnel Integration",
"url": "https://github.com/cilium/cilium/milestone/54",
"description": "This milestone tracks the integration with ZTunnel to support mTLS HBONE traffic between pods.",
"progress": 70,
"openIssues": 3,
"closedIssues": 7
},
{
"repository": "cilium/cilium",
"kind": "milestone",
"title": "1.22-feature-freeze",
"url": "https://github.com/cilium/cilium/milestone/56",
"description": "",
"progress": 0,
"openIssues": 1,
"closedIssues": 0
}
],
"communityDiscussions": []
},
"runs": [
{
"collectedAt": "2026-08-13T12:26:38.318Z",
"since": "2026-08-12T12:26:38.318Z",
"observedCount": 151,
"changedCount": 151
},
{
"collectedAt": "2026-08-13T13:48:00.446149Z",
"since": "2026-08-12T13:48:00.446149Z",
"observedCount": 150,
"changedCount": 150
},
{
"collectedAt": "2026-08-13T16:19:22.035158Z",
"since": "2026-08-12T16:19:22.035158Z",
"observedCount": 142,
"changedCount": 31
},
{
"collectedAt": "2026-08-13T17:43:20.785491Z",
"since": "2026-08-12T17:43:20.785491Z",
"observedCount": 141,
"changedCount": 14
},
{
"collectedAt": "2026-08-13T17:47:07.884300Z",
"since": "2026-08-12T17:47:07.884300Z",
"observedCount": 142,
"changedCount": 4
},
{
"collectedAt": "2026-08-13T18:01:55.420671Z",
"since": "2026-08-12T18:01:55.420671Z",
"observedCount": 140,
"changedCount": 4
}
],
"signals": [
{
"id": "github:cilium/cilium:issue:15051",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Replace stdlib net.Interface* with vishvananda/netlink to avoid blocked forever goroutines",
"text": "Netlink is not reliable protocol, and recv without a timeout might block infinitely. See https://github.com/cilium/cilium/issues/14710 and https://github.com/cilium/cilium/issues/14746#issuecomment-781811881 for more ctx. The Go's stdlib `net.Interface*()` function family when built for Linux (https://github.com/golang/go/blob/master/src/net/interface_linux.go) is using netlink socket w/o timeout to retrieve ifaces. Currently, we have the following `net.Interface*()` users in the code: ``` cilium@master > gg -l net.Interface pkg/mcastmanager/mcastmanager_test.go pkg/mtu/detect_linux.go pkg/multicast/multicast.go pkg/multicast/multicast_test.go vendor/github.com/google/gopacket/layers/sflow.go vendor/github.com/google/uuid/node_net.go vendor/github.com/shirou/gopsutil/net/net.go vendor/github.com/shirou/gopsutil/net/net_windows.go vendor/github.com/vishvananda/netns/README.md vendor/golang.org/x/net/icmp/helper_posix.go vendor/golang.org/x/net/icmp/interface.go vendor/golang.org/x/net/internal/socket/sys_posix.go vendor/golang.org/x/net/ipv4/dgramopt.go vendor/golang.org/x/net/ipv4/doc.go vendor/golang.org/x/net/ipv4/sockopt_posix.go vendor/golang.org/x/net/ipv4/sockopt_stub.go vendor/golang.org/x/net/ipv4/sys_asmreq.go vendor/golang.org/x/net/ipv4/sys_asmreq_stub.go vendor/golang.org/x/net/ipv4/sys_asmreqn.go vendor/golang.org/x/net/ipv4/sys_asmreqn_stub.go vendor/golang.org/x/net/ipv4/sys_ssmreq.go vendor/golang.org/x/net/ipv4/sys_ssmreq_stub.go vendor/golang.org/x/net/ipv6/dgramopt.go vendor/golang.org/x/net/ipv6/doc.go vendor/golang.org/x/net/ipv6/sockopt_posix.go vendor/golang.org/x/net/ipv6/sockopt_stub.go vendor/golang.org/x/net/ipv6/sys_asmreq.go vendor/golang.org/x/net/ipv6/sys_asmreq_stub.go vendor/golang.org/x/net/ipv6/sys_ssmreq.go vendor/golang.org/x/net/ipv6/sys_ssmreq_stub.go vendor/k8s.io/apimachinery/pkg/util/net/interface.go ``` Once #14710 has been resolved, switch to vishvananda/netlink to avoid the blocks.",
"url": "https://github.com/cilium/cilium/issues/15051",
"createdAt": "2021-02-22T09:25:59Z",
"updatedAt": "2026-08-13T17:12:25Z",
"timestamp": "2026-08-13T17:12:25Z",
"metrics": {
"reactions": 5,
"comments": 10
},
"labels": [
"kind/bug",
"area/daemon",
"pinned",
"area/agent"
],
"author": "brb",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:issue:33550",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Dependency Dashboard",
"text": "This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more. ## Repository Problems Renovate tried to run on this repository, but found these problems. - β οΈ WARN: Some release(s) did not have a releaseTimestamp, but as we're running with minimumReleaseAgeBehaviour=timestamp-optional, proceeding. See debug logs for more information ## Awaiting Schedule The following updates are awaiting their schedule. To get an update now, click on a checkbox below. - [ ] chore(deps): update docker.io/library/golang:1.26.5 docker digest to 705e964 (main) - [ ] chore(deps): update all lvh-images main (main) (patch) (`quay.io/lvh-images/complexity-test`, `quay.io/lvh-images/kind`) - [ ] chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.3-1786627113-2ad63f53be30e96fef56398067330444f78b28a9 (main) - [ ] fix(deps): update all go dependencies main (main) (`github.com/aws/aws-sdk-go-v2`, `github.com/aws/aws-sdk-go-v2/config`, `github.com/aws/aws-sdk-go-v2/feature/ec2/imds`, `github.com/aws/aws-sdk-go-v2/service/ec2`, `github.com/aws/smithy-go`, `github.com/cilium/charts`, `github.com/go-openapi/runtime`, `github.com/go-openapi/swag`, `github.com/go-openapi/swag/cmdutils`, `github.com/go-openapi/swag/conv`, `github.com/go-openapi/swag/jsonutils`, `github.com/go-openapi/swag/netutils`, `github.com/go-openapi/swag/typeutils`, `github.com/google/cel-go`, `github.com/klauspost/compress`, `github.com/osrg/gobgp/v4`, `github.com/prometheus/client_golang`, `github.com/prometheus/common`, `github.com/vishvananda/netlink`, `go.etcd.io/etcd/api/v3`, `go.etcd.io/etcd/client/pkg/v3`, `go.etcd.io/etcd/client/v3`, `go.opentelemetry.io/otel`, `go.opentelemetry.io/otel/trace`, `go.yaml.in/yaml/v3`, `google.golang.org/grpc`, `k8s.io/api`, `k8s.io/apiextensions-apiserver`, `k8s.io/apimachinery`, `k8s.io/cli-runtime`, `k8s.io/client-go`, `k8s.io/code-generator`, `k8s.io/component-base`, `k8s.io/dynamic-resource-allocation`, `k8s.io/endpointslice`, `k8s.io/kubectl`, `k8s.io/metrics`) - [ ] chore(deps): update docker.io/library/golang:1.26.5 docker digest to 705e964 (v1.20) - [ ] chore(deps): update stable lvh-images (v1.20) (patch) (`quay.io/lvh-images/complexity-test`, `quay.io/lvh-images/kind`) - [ ] chore(deps): update all github action dependencies (v1.20) (`actions/github-script`, `azure/login`, `cert-manager/cert-manager`, `docker/login-action`, `dorny/paths-filter`, `github/codeql-action`, `google/cloud-sdk`) - [ ] chore(deps): update docker.io/library/golang:1.25.12 docker digest to dbeddb5 (v1.19) - [ ] chore(deps): update stable lvh-images (v1.19) (patch) (`quay.io/lvh-images/complexity-test`, `quay.io/lvh-images/kind`) - [ ] chore(deps): update all github action dependencies (v1.19) (`actions/github-script`, `azure/login`, `docker/login-action`, `dorny/paths-filter`, `github/codeql-action`, `google/cloud-sdk`) - [ ] chore(deps): update docker.io/library/golang:1.25.12 docker digest to dbeddb5 (v1.18) - [ ] chore(deps): update stable lvh-images (v1.18) (patch) (`quay.io/lvh-images/complexity-test`, `quay.io/lvh-images/kind`) - [ ] chore(deps): update all github action dependencies (v1.18) (`actions/github-script`, `azure/login`, `dorny/paths-filter`, `google/cloud-sdk`) - [ ] π **Create all awaiting schedule PRs at once** π ## Open The following updates have all been created. To force a retry/rebase of any, click on a checkbox below. - [ ] [chore(deps): update all-dependencies (main)](../pull/47859) (`docker.io/alpine/socat`, `ghcr.io/renovatebot/renovate`, `quay.io/cilium/cilium-llvm`, `quay.io/cilium/test-connection-disruption`, `renovatebot/renovate`) - [ ] [chore(deps): update all github action dependencies (main)](../pull/47861) (`actions/github-script`, `azure/login`, `cert-manager/cert-manager`, `cilium/cilium`, `cilium/scale-tests-action`, `docker/login-action`, `dorny/paths-filter`, `github/codeql-action`, `google/cloud-sdk`, `https://github.com/cilium/scaffolding`, `renovatebot/github-action`) - [ ] [fix(deps): update module github.com/google/go-github/v89 to v90 (main)](../pull/47876) - [ ] **Click on this checkbox to rebase all open PRs at once** ## Detected Dependencies > [!NOTE] > Detected dependencies section has been truncated dockerfile (9)
cilium-cli/Dockerfile (2)
- `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `gcr.io/distroless/static latest@sha256:9197324ba51d9cd071af8505989365c006adf9d6d2067eada25aef00abbb5278` images/builder/Dockerfile (4)
- `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `quay.io/cilium/cilium-llvm 19.1.7-1782898005-bed4da5@sha256:270bf0e70853c388b72c2247e4ade91d35d74898e2ec12edd5b72ace9ee34333` β [Updates: `19.1.7-1785833026-d8383c5`] - `quay.io/cilium/cilium-runtime ddc2a59eaafa0c420b692d9a1e1be333eaccb2f6@sha256:f1fc9168c6491832eb6a175f37a8fdf4102b74311b46d7a1068bf669734cb8d1` - `quay.io/cilium/image-tester 1785710666-8cd4afc@sha256:fc644405b1fc62ffc009c27283307cddc5b210a7d42555b5f525b8285a163fb9` images/cache/Dockerfile (1)
- `docker.io/library/alpine 3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b` images/cilium/Dockerfile (4)
- `quay.io/cilium/cilium-envoy v1.38.3-1786448858-9326c1e0ad17d6449851ec3170611f2a66cb9035@sha256:159aa88485fb01f15397a4adc26be0586eeafe865965cadabedd63bebd445748` β [Updates: `v1.38.3-1786627113-2ad63f53be30e96fef56398067330444f78b28a9`] - `quay.io/cilium/cilium-builder a91a0712871eca5e96b4f47086ecdb53b1fd5a9f@sha256:1821eef577b7732600aaab3bddc753a4cf37b50d52ebd08b2014dce8076787dc` - `quay.io/cilium/cilium-runtime ddc2a59eaafa0c420b692d9a1e1be333eaccb2f6@sha256:f1fc9168c6491832eb6a175f37a8fdf4102b74311b46d7a1068bf669734cb8d1` - `quay.io/cilium/cilium-builder a91a0712871eca5e96b4f47086ecdb53b1fd5a9f@sha256:1821eef577b7732600aaab3bddc753a4cf37b50d52ebd08b2014dce8076787dc` images/clustermesh-apiserver/Dockerfile (4)
- `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `gcr.io/etcd-development/etcd v3.7.1@sha256:a9983dd6d9283138ab926daa307c6c25623636703ecf5645d5df4d666ce9eba2` - `gcr.io/distroless/static nonroot@sha256:f7f8f729987ad0fdf6b05eeeae94b26e6a0f613bdf46feea7fc40f7bd72953e6` images/hubble-relay/Dockerfile (3)
- `quay.io/cilium/cilium-builder a91a0712871eca5e96b4f47086ecdb53b1fd5a9f@sha256:1821eef577b7732600aaab3bddc753a4cf37b50d52ebd08b2014dce8076787dc` - `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `gcr.io/distroless/static nonroot@sha256:f7f8f729987ad0fdf6b05eeeae94b26e6a0f613bdf46feea7fc40f7bd72953e6` images/operator/Dockerfile (5)
- `quay.io/cilium/cilium-builder a91a0712871eca5e96b4f47086ecdb53b1fd5a9f@sha256:1821eef577b7732600aaab3bddc753a4cf37b50d52ebd08b2014dce8076787dc` - `docker.io/library/alpine 3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b` - `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `scratch unknown version` - `quay.io/cilium/cilium-builder a91a0712871eca5e96b4f47086ecdb53b1fd5a9f@sha256:1821eef577b7732600aaab3bddc753a4cf37b50d52ebd08b2014dce8076787dc` images/runtime/Dockerfile (4)
- `quay.io/cilium/cilium-llvm 19.1.7-1782898005-bed4da5@sha256:270bf0e70853c388b72c2247e4ade91d35d74898e2ec12edd5b72ace9ee34333` β [Updates: `19.1.7-1785833026-d8383c5`] - `quay.io/cilium/cilium-bpftool 7.7.0-1785833026-d8383c5@sha256:5ea5cf5bd61b8a41102b8ce7116fd2ba65993ee7006d86652bdeac428dbf001f` - `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `docker.io/library/ubuntu 26.04@sha256:678c6550cc43645e08669028bc177f50be4e7c5b8cca677067b1914d4afc7a03` images/standalone-dns-proxy/Dockerfile (1)
- `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`]
github-actions (73)
.github/actions/bpftrace/check/action.yaml (1)
- `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` .github/actions/bpftrace/start/action.yaml (2)
- `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` .github/actions/cosign/action.yaml (2)
- `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` .github/actions/gather-metrics/action.yaml (1)
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` .github/actions/get-runner-ip/action.yml (1)
- `actions/github-script v8.0.0@ed597411d8f924073f98dfc5c65a23a2325f34cd` β [Updates: `v9.0.0`] .github/actions/lvh-kind/action.yaml (2)
- `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` .github/actions/merge-artifacts/action.yaml (1)
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` .github/actions/post-logic/action.yaml (4)
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `aanm/junit2md v0.0.3@332ebf0fddd34e91b03a832cfafaa826306558f9` .github/actions/wait-for-images/action.yaml (1)
- `docker/login-action v4.1.0@4907a6ddec9925e35a0a9e82d7399ccc52663121` β [Updates: `v4.6.0`] .github/workflows/ariane-scheduled.yaml (2)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` .github/workflows/auto-approve.yaml (2)
- `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/auto-labeler-v1.18.yaml (6)
- `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/labeler v7@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/auto-labeler-v1.19.yaml (6)
- `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/labeler v7@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/auto-labeler-v1.20.yaml (6)
- `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/labeler v7@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/auto-labeler.yaml (6)
- `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/labeler v7@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-go-caches.yaml (3)
- `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` .github/workflows/build-images-base-v1.17.yaml (22)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-base-v1.18.yaml (19)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` .github/workflows/build-images-base-v1.19.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` .github/workflows/build-images-base-v1.20.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` .github/workflows/build-images-base.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` .github/workflows/build-images-beta.yaml (10)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-ci-v1.17.yaml (19)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-ci-v1.18.yaml (19)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-ci-v1.19.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-ci-v1.20.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-ci.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-docs-builder-v1.17.yaml (17)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-docs-builder-v1.18.yaml (17)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-docs-builder-v1.19.yaml (17)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-docs-builder-v1.20.yaml (17)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-docs-builder.yaml (17)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-releases.yaml (14)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/cilium main` β [Updates: `main`] - `cilium/cilium main` β [Updates: `main`] - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/call-backport-label-updater-v1.17.yaml (1)
- `cilium/cilium v1.19.6@9a8982433e18019e290b8199c0c4ad24f66befe8` β [Updates: `v1.20.0`] .github/workflows/call-backport-label-updater-v1.18.yaml (1)
- `cilium/cilium v1.19.6@9a8982433e18019e290b8199c0c4ad24f66befe8` β [Updates: `v1.20.0`] .github/workflows/call-backport-label-updater-v1.19.yaml (1)
- `cilium/cilium v1.19` β [Updates: `v1.20.0`] .github/workflows/call-backport-label-updater-v1.20.yaml (1)
- `cilium/cilium v1.20` .github/workflows/call-backport-label-updater.yaml (1)
- `cilium/cilium main` β [Updates: `main`] .github/workflows/ci-images-cache-cleaner.yaml (1)
- `ubuntu 24.04` .github/workflows/ci-images-garbage-collect.yaml (3)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `quay.io/cilium/scruffy v0.0.3@sha256:ca997451b739cbf03c204cb2523a671c31c61edc606aa5d20dc3560bc7f25bc7` - `ubuntu 24.04` .github/workflows/cilium-cli.yaml (5)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `ubuntu 24.04` - `go 1.26.5` .github/workflows/close-stale-issues.yaml (2)
- `actions/stale v11@4391f3da665fdf50b6810c1a66712fb9ba21aa93` - `ubuntu 24.04` .github/workflows/codeql.yaml (7)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81` β [Updates: `v4.37.6`] - `github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81` β [Updates: `v4.37.6`] - `github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81` β [Updates: `v4.37.6`] - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81` β [Updates: `v4.37.6`] - `ubuntu 24.04` .github/workflows/common-post-jobs.yaml (6)
- `cilium/cilium main` β [Updates: `main`] - `cilium/cilium main` β [Updates: `main`] - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-aks.yaml (15)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `azure/login v3.0.0@532459ea530d8321f2fb9bb10d1e0bcf23869a43` β [Updates: `v3.0.1`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `azure/login v3.0.0@532459ea530d8321f2fb9bb10d1e0bcf23869a43` β [Updates: `v3.0.1`] - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-aws-cni.yaml (15)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-clustermesh.yaml (9)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` .github/workflows/conformance-delegated-ipam.yaml (10)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-eks.yaml (15)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-gateway-api.yaml (16)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `go 1.26.5` .github/workflows/conformance-ginkgo.yaml (29)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `go 1.26.5` - `ubuntu 24.04` - `ubuntu 24.04` - `go 1.26.5` .github/workflows/conformance-gke.yaml (17)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `google-github-actions/auth v3.0.0@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093` - `google-github-actions/setup-gcloud v3.0.1@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `google-github-actions/auth v3.0.0@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093` - `google-github-actions/setup-gcloud v3.0.1@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-ingress.yaml (13)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-ipsec-e2e.yaml (13)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-ipsec.yaml (5)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-k8s-network-policies.yaml (8)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-kind-proxy-embedded.yaml (9)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-kpr-aks.yaml (5)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-kpr-eks.yaml (7)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-kpr-gke.yaml (5)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-kubespray.yaml (12)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-python v7.0.0@5fda3b95a4ea91299a34e894583c3862153e4b97` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `python 3.10` .github/workflows/conformance-l3-l4.yaml (5)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-l7.yaml (5)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-mcs-api.yaml (13)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `go 1.26.5` .github/workflows/conformance-multi-pool.yaml (13)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-race.yaml (4)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-runtime.yaml (22)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `aanm/junit2md v0.0.3@332ebf0fddd34e91b03a832cfafaa826306558f9` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-ztunnel-e2e.yaml (10)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/documentation.yaml (10)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `dorny/paths-filter v4.0.2@7b450fff21473bca461d4b92ce414b9d0420d706` β [Updates: `v4.0.3`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `quay.io/cilium/docs-builder e6773ed21ab03066c0f24e68f342f18804a8ee0a@sha256:d3beff6d6408c09f6e1dbc637f7e98962b7d1fd2a81bf1d2a27ff8817dafb51f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `go 1.26.5` .github/workflows/eks-cluster-delete.yaml (3)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `ubuntu 24.04` .github/workflows/eks-cluster-pool-manager.yaml (16)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/feature-summary-report.yaml (5)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/fqdn-perf.yaml (19)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `google-github-actions/auth v3.0.0@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093` - `google-github-actions/setup-gcloud v3.0.1@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `go 1.26.5`
![\"Image\"](\"https://github.com/user-attachments/assets/3467fdc9-8126-483a-9179-04babf034181\")
### Cilium Version v1.20.0 and main ### Kernel Version 6.18.42 on Talos 1.13.8 ### Kubernetes Version 1.36.2 ### Regression No known regression ### Sysdump Did not capture before developing the patch -- if this is truly important I can provide. ### Relevant log output ```shell `cilium-dbg monitor -v` with `Debug` and `DebugLB`. One flow, client ep 860 (`::7245`) β service `fd00:10:96::334c:3003`, backend ep 742 (`::8c2`): FROM 742 Attempting local delivery for container id 860 from seclabel 35952 FROM 860 CT lookup src=[::0:8c2]:3003 dst=[::0:7245]:34386 backend src FROM 860 CT verdict: Reply, revnat=42 FROM 860 Reverse NAT lookup, index=42 FROM 860 Performing reverse NAT, address.p4=4c330000 port=3003 -> endpoint 860 ... state reply ... [fd00:10:96::334c]:3003 -> ...:34386 FROM 860 Inheriting identity=35952 from stack FROM 860 CT lookup src=[::0:334c]:3003 dst=[::0:7245]:34386 service src FROM 860 CT verdict: New, revnat=42 FROM 860 Attempting local delivery for container id 860 from seclabel 21986 FROM 860 Conntrack create: proxy-port=0 revnat=0 src-identity=35952 -> endpoint 860 ... state new ... orig-ip fd00:10:96::334c The egress CT entry is created post-DNAT, keyed on the backend, so the service-addressed packet cannot match it: TCP OUT 172.31.32.4:59946 -> 172.31.32.140:3003 RevNAT=76 TCP SVC 172.31.32.4:59946 -> 10.111.71.201:3003 RevNAT=76 BackendID=160 ``` ### Anything else? _No response_ ### Cilium Users Document - [x] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47913",
"createdAt": "2026-08-12T09:28:06Z",
"updatedAt": "2026-08-12T21:44:48Z",
"timestamp": "2026-08-12T21:44:48Z",
"metrics": {
"reactions": 0,
"comments": 0
},
"labels": [
"kind/bug",
"area/datapath",
"kind/community-report"
],
"author": "evan314159",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:issue:47918",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Label Filters don't treat prefix as a regex when loaded from file",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.19.6 and lower than v1.20.0 ### What happened? When loading identity-related label filters via `label-prefix-file` the label can only be provided as a string prefix and not as a regex. [The documentation](https://docs.cilium.io/en/latest/operations/performance/scalability/identity-relevant-labels/) is quite light on details about this file-based approach so this might be expected behaviour but as the docs speak heavily about using regex for the label filters it seems like a mistake to me that the file-based approach doesn't follow the same logic. ### How can we reproduce the issue? 1. Create a file with the following contents: ```json { \"version\": 1, \"valid-prefixes\": [ {\"prefix\": \"app$\", \"source\": \"k8s\"}, {\"prefix\":\".*\",\"source\":\"reserved\"} ] } ``` 2. Pass this in to Cilium via the `label-prefix-file` configuration flag 3. Launch a pod with an `app` label defined 4. Observe that the `app` label isn't matched and included on the CiliumIdentity ### Cilium Version 1.19.1 ### Kernel Version 6.12.88 ### Kubernetes Version 1.34.9 ### Regression _No response_ ### Sysdump _No response_ ### Relevant log output ```shell ``` ### Anything else? _No response_ ### Cilium Users Document - [ ] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47918",
"createdAt": "2026-08-12T15:04:30Z",
"updatedAt": "2026-08-13T15:59:58Z",
"timestamp": "2026-08-13T15:59:58Z",
"metrics": {
"reactions": 0,
"comments": 4
},
"labels": [
"kind/bug",
"kind/community-report",
"area/agent"
],
"author": "AverageMarcus",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:issue:47921",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "CI: firewall-egress-to-fqdns fails 6% of the time: command terminated with exit code 28",
"text": "### Test Name firewall-egress-to-fqdns ### Test Failure Output ```shell β 1/8 tests failed (6/81 actions), 3 tests skipped, 0 scenarios skipped: Test [host-firewall-egress-to-fqdns]: π₯ host-firewall-egress-to-fqdns/host-to-world:http-to-fake.external.service.cilium-0: cilium-test-1/host-netns-8h6h4 (172.20.0.4) -> fake.external.service.cilium-http (fake.external.service.cilium:80): command \"curl --silent --fail --show-error --connect-timeout 2 --max-time 10 -4 -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code}\\n --output /dev/null http://fake.external.service.cilium:80\" failed: command failed (pod=cilium-test-1/host-netns-8h6h4, container=host-netns): command terminated with exit code 28 ``` βοΈ The following owners are responsible for reliability of the testsuite: - @cilium/sig-agent (host-to-world) - @cilium/ci-structure (.github/workflows/tests-e2e-upgrade.yaml) ### CI Build Link https://github.com/cilium/cilium/actions/runs/31601758510 ### Relevant Log Output ```shell ``` ### Sysdump / Zip File _No response_",
"url": "https://github.com/cilium/cilium/issues/47921",
"createdAt": "2026-08-12T22:48:35Z",
"updatedAt": "2026-08-13T16:13:10Z",
"timestamp": "2026-08-13T16:13:10Z",
"metrics": {
"reactions": 0,
"comments": 9
},
"labels": [
"area/CI",
"area/cli",
"ci/flake"
],
"author": "joestringer",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:issue:47925",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "pkg/idpool: use lazy map allocation in NewIDPool to reduce memory usage",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.20.0 and lower than v1.21.0 ### What happened? ### the bug When `NewIDPool(minID, maxID)` is called in `pkg/idpool/idpool.go`: - It immediately creates and populates a hash map (`map[ID]struct{}`) for all IDs in the range `[minID, maxID]`. - For large ranges (e.g. N = 1,000,000), this results in **~37.8 MB of heap memory** allocation and **~141 ms initialization delay** upfront. The affected code in `newIDCache`: ```go func newIDCache(minID ID, maxID ID) *idCache { n := max(int(maxID-minID+1), 0) c := &idCache{ ids: make(map[ID]struct{}, n), leased: make(map[ID]struct{}), } for id := minID; id < maxID+1; id++ { c.ids[id] = struct{}{} } return c } ``` ### Solution Replace `O(N)` hash map population in `newIDCache` with a Lazy Allocation Strategy: - **Allocation on demand (`nextID`)**: Keep `nextID` initialized to `minID` to issue unallocated IDs sequentially in `O(1)` time without pre-populating maps. - **Freed Map (`freed`)**: Store only IDs that are explicitly returned through `Release()` or added via `Insert()`. - **Removed Set (`removed`)**: Track unallocated IDs (`>= nextID`) that are explicitly removed via `Remove()`. | Pool Size | Time (Before) | Time (After) | Memory (Before) | Memory (After) | Heap Allocs (Before) | Heap Allocs (After) | | --- | --- | --- | --- | --- | --- | --- | | 100 | 2.12 us | 0.05 us | 2.34 KB | 144 B | 3 | 3 | | 10,000 | 282.42 us | 0.05 us | 295.55 KB | 144 B | 33 | 3 | | 1,000,000 | 141.07 ms | 0.05 us | 37.83 MB | 144 B | 4,097 | 3 | ### Summary Currently, `NewIDPool(minID, maxID)` upfront allocates and populates a hash map containing all `N = maxID - minID + 1` IDs upfront. For large ID pools (e.g. N = 1,000,000), this creates an O(N) initialization overhead of ~37.8 MB heap memory and ~141 ms latency. By switching `idCache` to lazy allocation (using a sequential `nextID` pointer and tracking freed/removed IDs on demand), `NewIDPool` initialization complexity drops from O(N) to O(1), consuming < 1 KB initial memory while preserving O(1) runtime allocation. ### How can we reproduce the issue? ### How to Reproduce 1. Add the following benchmark function to `pkg/idpool/idpool_test.go`: ```go func BenchmarkNewIDPool(b *testing.B) { benchmarks := []struct { name string size uint64 }{ {\"Size_100\", 100}, {\"Size_10000\", 10000}, {\"Size_1000000\", 1000000}, } for _, bm := range benchmarks { b.Run(bm.name, func(b *testing.B) { b.ReportAllocs() for i := 0; i < b.N; i++ { _ = NewIDPool(1, ID(bm.size)) } }) } } ``` 2. Run the command ```go test -bench=BenchmarkNewIDPool -benchmem ./pkg/idpool/...``` 3. the high heap memory allocations (B/op) and initialization execution time (ns/op) for large pool sizes ($N = 1,000,000$) can be observed ### Cilium Version 1.21.0-dev ### Kernel Version 6.6.87.2-microsoft-standard-WSL2 ### Kubernetes Version v1.34.1 ### Regression _No response_ ### Sysdump _No response_ ### Relevant log output ```shell ``` ### Anything else? _No response_ ### Cilium Users Document - [ ] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47925",
"createdAt": "2026-08-13T06:40:19Z",
"updatedAt": "2026-08-13T06:40:19Z",
"timestamp": "2026-08-13T06:40:19Z",
"metrics": {
"reactions": 0,
"comments": 0
},
"labels": [
"kind/bug",
"needs/triage",
"kind/community-report"
],
"author": "DARSHANR007",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:issue:47930",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Potential issue with usePrimaryAddress on a t3.small",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.19.6 and lower than v1.20.0 ### What happened? ## Potential issue with usePrimaryAddress ### Cilium v1.19.6, AWS `t3.small` On a `t3.small` instance using AWS ENI IPAM mode with `use-primary-address: true`, Cilium seems to cap max IPs at 9 when 11 is expected. This is based on a `t3.small`'s limits of 3 ENIs, 4 IPs per ENI = 11 pod IPs max (3, 4, 4 - one reserved). ```pwsh > (aws ec2 describe-instance-types --instance-types t3.small --region eu-west-2 | ConvertFrom-Json).InstanceTypes[0].NetworkInfo | Select-Object MaximumNetworkInterfaces, Ipv4AddressesPerInterface MaximumNetworkInterfaces Ipv4AddressesPerInterface ------------------------ ------------------------- 3 4 ``` ```pwsh > helm get values cilium -n kube-system ``` ```yaml USER-SUPPLIED VALUES: cni: configMap: cni-configuration customConf: true egressMasqueradeInterfaces: eth0 enableIPv4Masquerade: false enabled: true eni: awsReleaseExcessIPs: true enabled: true nodeSpec: usePrimaryAddress: true subnetTagsFilter: - ourLegitimate/redactedFilter externalIPs: enabled: true hostPort: enabled: true ipam: mode: eni kubeProxyReplacement: false nodeinit: enabled: true operator: enabled: true nodeSelector: avcosystems.com/node-type: burst kubernetes.io/arch: amd64 kubernetes.io/os: linux podDisruptionBudget: enabled: true maxUnavailable: 1 prometheus: enabled: true serviceMonitor: enabled: true resources: limits: cpu: 50m memory: 80Mi requests: cpu: 7m memory: 35Mi prometheus: enabled: true serviceMonitor: enabled: true namespace: monitoring resources: limits: cpu: 300m memory: null requests: cpu: 120m memory: 165Mi routingMode: native tunnelProtocol: \"\" upgradeCompatibility: \"1.10\" ``` Observing logs, a pod is attempted to be put onto the node that already has 9 pods, at which point it consistently errors with e.g. ```bash Warning FailedCreatePodFoo 15m kubelet Failed to create pod foo: rpc error: code = Unknown desc = failed to setup network for foo \"25cc25redacted\": plugin type=\"cilium-cni\" failed (add): unable to allocate IP via local cilium agent: [POST /ipam][502] postIpamFailure \"no IPs currently available on the node, allocation will be retried once Cilium Operator allocates more IPs\" Warning FailedCreatePodFoo 105s (x62 over 15m) kubelet (combined from similar events): Failed to create pod foo: rpc error: code = Unknown desc = failed to setup network for foo \"3d3a7redacted\": plugin type=\"cilium-cni\" failed (add): unable to allocate IP via local cilium agent: [POST /ipam][502] postIpamFailure \"no IPs currently available on the node, allocation will be retried once Cilium Operator allocates more IPs\" ``` with up to 9 pods currently active with assigned IPs. ```pwsh > kubectl get ciliumnode ip-17redacted.eu-west-2.compute.internal -o jsonpath='{.spec.ipam}' | jq { \"pool\": { \"ip1\": { \"resource\": \"eni-1-id\" }, \"ip2\": { \"resource\": \"eni-1-id\" }, \"ip3\": { \"resource\": \"eni-2-id\" }, \"ip4\": { \"resource\": \"eni-3-id\" }, \"ip5\": { \"resource\": \"eni-1-id\" }, \"ip6\": { \"resource\": \"eni-2-id\" }, \"ip7\": { \"resource\": \"eni-3-id\" }, \"ip8\": { \"resource\": \"eni-2-id\" }, \"ip9\": { \"resource\": \"eni-3-id\" } }, \"pools\": {}, \"pre-allocate\": 8 } ``` ```pwsh > kubectl get ciliumnode ip-17redacted.eu-west-2.compute.internal -o jsonpath='{.status.eni.enis}' | jq { \"eni-1-id\": { \"addresses\": [ \"ip1\", \"ip2\", \"ip5\"], \"id\": \"eni-1-id\", \"ip\": \"separate-ip\", \"mac\": \"mac1\", \"security-groups\": [ \"sg-redacto1\", \"sg-redacto2\", \"sg-redacto3\" ], \"subnet\": { \"cidr\": \"172.foo/19\", \"id\": \"subnet-redacted1\" }, \"tags\": { \"eks:cluster-name\": \"my-eks-redacted-name\", \"eks:nodegroup-name\": \"linux-web-5\" }, \"vpc\": { \"cidrs\": [ \"172.foo../16\" ], \"id\": \"vpc-id1\", \"primary-cidr\": \"172.bar/16\" } }, \"eni-2-id\": { \"addresses\": [ \"ip3\", \"ip8\", \"ip6\"], \"description\": \"Cilium-CNI (i-cni-id-1)\", \"id\": \"eni-2-id\", \"ip\": \"172.an.ip\", \"mac\": \"mac2\", \"number\": 2, \"security-groups\": [ \"sg-redacto4\", \"sg-redacto5\", \"sg-redacto6\" ], \"subnet\": { \"cidr\": \"172.foo/19\", \"id\": \"subnet-redacted1\" }, \"tags\": { \"io.cilium/cilium-managed\": \"true\", \"io.cilium/cluster-name\": \"my-eks-redacted-name\" }, \"vpc\": { \"cidrs\": [ \"172.foo../16\" ], \"id\": \"vpc-id1\", \"primary-cidr\": \"172.bar/16\" } }, \"eni-3-id\": { \"addresses\": [ \"ip4\", \"ip7\", \"ip9\"], \"description\": \"Cilium-CNI (i-cni-id-1)\", \"id\": \"eni-3-id\", \"ip\": \"172.an.ip\", \"mac\": \"mac3\", \"number\": 1, \"security-groups\": [ \"sg-redacto7\", \"sg-redacto8\", \"sg-redacto9\" ], \"subnet\": { \"cidr\": \"172.foo/19\", \"id\": \"subnet-redacted1\" }, \"tags\": { \"io.cilium/cilium-managed\": \"true\", \"io.cilium/cluster-name\": \"my-eks-redacted-name\" }, \"vpc\": { \"cidrs\": [ \"172.foo../16\" ], \"id\": \"vpc-id1\", \"primary-cidr\": \"172.bar/16\" } } } ``` `\"use-primary-address\": true,` is in the spec: ```pwsh > kubectl get ciliumnode ip-17redacted.eu-west-2.compute.internal -o jsonpath='{.spec.eni}' | jq { \"availability-zone\": \"eu-west-2b\", \"disable-prefix-delegation\": false, \"first-interface-index\": 0, \"instance-type\": \"t3.small\", \"node-subnet-id\": \"subnet-foo\", \"subnet-tags\": { \"thing/cilium\": \"foo\" }, \"use-primary-address\": true, \"vpc-id\": \"vpc-foo\" } ``` The kubelet config itself show as as 11 maxPods: ```pwsh > kubectl get --raw \"/api/v1/nodes/ip-17redacted.eu-west-2.compute.internal/proxy/configz\" | jq '.kubeletconfig.maxPods' 11 ``` ## Potential issue? `GetMinimumAllocatableIPv4()` () has the following: ```go // limits.IPv4 contains the primary IP which is not available for allocation maxPerInterface := max(limits.IPv4-1, 0) return min(minimum, (limits.Adapters-index)*maxPerInterface) ``` When Spec.ENI.UsePrimaryAddress is true, auxiliary ENIs (index > 0) can allocate their primary IP, making maxPerInterface equal to limits.IPv4 for those interfaces. Does this cause GetMinimumAllocatableIPv4() to undercalculate the instance pool capacity (e.g., reporting 9 instead of 11 for t3.small) or am I barking up the wrong tree and there's something else I'm missing as to why this is being limited to 9 IPs? ## Planning to try (but haven't yet) Setting preAllocation to 2 as opposed to the default of 8 and setting maxAboveWatermark to 2 as opposed to the default of 0. The last 'best guess' reason I have for that is: * With preAllocation = 8 and maxAboveWatermark = 0, Cilium calculates target pool size using the watermark equation: {Target Pool} = {Used Pod IPs} + {preAllocation} * maxAboveWatermark = 0 tells Cilium: \"Do not allocate any extra IPs beyond the minimum needed to satisfy preAllocation.\" * When Cilium attempts to allocate IPs for preAllocation = 8: It allocates eth0 (3 secondary IPs). Total = 3. It allocates eth1 (3 secondary IPs). Total = 6. It allocates eth2 (3 secondary IPs). Total = 9. * At 9 IPs, Cilium hits the limits.IPv4 - 1 limit across all 3 ENIs. Because maxAboveWatermark = 0, Cilium refuses to step above the watermark to allocate the primary IPs on auxiliary interfaces (eth1 and eth2). **(The guesstimate/leap I'm taking)** * Therefore, the pool freezes at 9 IPs, leaving the last 2 IP slots on eth1 and eth2 locked and unreachable. **guessing** Any ideas? ### How can we reproduce the issue? see main content ### Cilium Version v1.19.6 ### Kernel Version 6.12.94-123.192.amzn2023.x86_64 ### Kubernetes Version v1.34.9-eks-8f14419 ### Regression _No response_ ### Sysdump _No response_ ### Relevant log output ```shell ``` ### Anything else? _No response_ ### Cilium Users Document - [x] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47930",
"createdAt": "2026-08-13T08:19:40Z",
"updatedAt": "2026-08-13T16:40:27Z",
"timestamp": "2026-08-13T16:40:27Z",
"metrics": {
"reactions": 0,
"comments": 3
},
"labels": [
"kind/bug",
"kind/community-report",
"area/eni",
"info-completed"
],
"author": "joe-sm",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:issue:47940",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Gateway API: Envoy upstream replies from same-node backends lost (RST), nondeterministic across restarts β k3s/Ubuntu-raspi, not reproducible on kind",
"text": "### Is there an existing issue for this? - [X] I have searched the existing issues Closest matches are #47400 / #46260 / #26584, but those are about **ingress** traffic to L7LB frontends being dropped at TC on specific device types. This issue is different: ingress reaches Envoy fine β it is Envoy's **upstream replies from same-node backends** that are lost, and it is nondeterministic across agent restarts/node reboots. ### Version Reproduced on **v1.19.6** and **v1.20.0** (identical behavior). ### What happened? With Gateway API enabled, a `Gateway` + `HTTPRoute` pointing at a Deployment whose 2 replicas are spread across 2 nodes: requests through the gateway (ClusterIP or NodePort, from host netns or external clients) **alternate 200/503**. The failing half are the requests where per-request load balancing picks the backend pod on the **same node as the serving Envoy**; remote-node backends always work. Hubble for a failing request (Envoy upstream connection to the local backend): ``` 10.244.0.216:52632 (ingress) -> website/website-...:3000 (ID:7959) to-endpoint FORWARDED (TCP Flags: SYN) 10.244.0.216:52632 (host) <- website/website-...:3000 (ID:7959) to-stack FORWARDED (TCP Flags: SYN, ACK) 10.244.0.216:52632 (host) -> website/website-...:3000 (ID:7959) to-endpoint FORWARDED (TCP Flags: RST) ``` The backend's SYN-ACK goes `to-stack` **without the proxy mark**, the kernel finds no ordinary socket for the transparent-bound tuple and answers RST. `cilium-dbg monitor --type drop` shows nothing for these flows. Control-plane state is consistent the whole time: - `cilium-dbg shell -- db/show services` β `ProxyRedirect= (ports: [80])` present - `cilium-dbg shell -- db/show envoy-resources` β all `Done`, no errors - `cilium-dbg service list` β ClusterIP shows `1 => 127.0.0.1:/TCP (active)` - `CILIUM_PRE_mangle` TPROXY rule matches the current proxy port - Identical behavior with `bpf.tproxy=true` and `false` **Nondeterminism:** after certain agent restarts the same configuration served 8/8 *including* local backends for a few hours, then regressed to alternating after subsequent node reboots with zero config change. Health appears to depend on datapath programming order, suggesting a race. ### Eliminated during bisection - Gateway API CRD skew β fails with correctly pinned v1.3.0 (on 1.19.6) and v1.6.1 (on 1.20.0) - Kernel version skew β both nodes aligned to the same kernel build, no change - `devices` contents β fails with `{eth0,wlan0}` and `{eth0}` (transient improvement after the change, regressed after reboots) - `bpf.masquerade` true/false (iptables masquerade), `bpf.tproxy` true/false - AppArmor β zero denials involving cilium/envoy in kernel logs - systemd `MACAddressPolicy=persistent` β override to `none` for veth/vxlan applied, no change - Full `helm uninstall` + reinstall, plus clean reboots of both nodes (fresh bpffs) ### Environment (affected) - 2Γ Raspberry Pi 5, Ubuntu 26.04, kernel `7.0.0-1010-raspi` (also `1016`, aligned β no difference), arm64 - k3s `v1.35.4+k3s1` (`--flannel-backend=none --disable-network-policy --disable-kube-proxy --disable=servicelb --disable=traefik`) - Cilium via helm: `kubeProxyReplacement=true`, `routingMode=tunnel`, `tunnelProtocol=vxlan`, `ipam.mode=kubernetes`, `devices={eth0}`, `bpf.masquerade=false`, `MTU=1450`, `gatewayAPI.enabled=true`, external Envoy DaemonSet (defaults) - Node also has a second physical NIC (`wlan0`) outside `devices`, default route via it; inter-node traffic on `eth0` (/30) ### Not reproducible on kind (same versions, same values) The identical stack on kind serves local and remote backends 12/12, which is what makes the affected environment interesting. Full comparison recipe: ```bash cat > kind.yaml << 'K' kind: Cluster apiVersion: kind.x-k8s.io/v1alpha4 networking: {disableDefaultCNI: true, kubeProxyMode: none} nodes: [{role: control-plane}, {role: worker}, {role: worker}] K kind create cluster --config kind.yaml kubectl apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/experimental-install.yaml helm install cilium cilium/cilium -n kube-system --version 1.20.0 \\ --set kubeProxyReplacement=true --set k8sServiceHost=kind-control-plane --set k8sServicePort=6443 \\ --set ipam.mode=kubernetes --set routingMode=tunnel --set tunnelProtocol=vxlan \\ --set \"devices={eth0}\" --set bpf.masquerade=false --set bpf.tproxy=true \\ --set gatewayAPI.enabled=true --set l2announcements.enabled=true --set MTU=1450 # then: Gateway (class cilium) + HTTPRoute -> Deployment pinned to worker1, Service :80 # curl the gateway ClusterIP from worker1 (local case) and worker2 (remote case): both 100% OK on kind ``` On the affected k3s/raspi cluster the same manifests yield the alternating 200/503. ### Anything else? Happy to provide a `cilium sysdump` from the affected cluster, re-run any diagnostics, or test patches β the environment is available and the failure is easy to trigger there. Also happy to try a stock-Ubuntu k3s VM to further separate the k3s axis from the raspi kernel if that helps triage. ### Code of Conduct - [X] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47940",
"createdAt": "2026-08-13T14:50:30Z",
"updatedAt": "2026-08-13T14:50:30Z",
"timestamp": "2026-08-13T14:50:30Z",
"metrics": {
"reactions": 0,
"comments": 0
},
"labels": [],
"author": "thdxg",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:issue:47941",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Hubble Relay does not terminate, gRPC health server remains running",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.20.0 and lower than v1.21.0 ### What happened? Hubble Relay does not fully terminate after receiving SIGTERM. The Relay server shuts down and the log reports Server stopped, but the Relay process remains running until the Kubernetes termination grace period expires and the pod is killed with SIGTERM. The dedicated gRPC health server on port 4222 remains listening after the main Relay server has already stopped. ## Expected behavior Hubble Relay should fully terminate after SIGTERM once the server is stopped. The Kubernetes termination grace period should be a maximum shutdown deadline and should not expire before the Relay process exits. ## Cause `Server.Serve()` starts both the gRPC and the separate gRPC health Server and waits for all of them to return. The current Server.Stop() stops the main server with: `s.server.Stop()` but does not stop: `s.grpcHealthServer` This appears to leave the health server listening on port 4222, preventing `errgroup.Wait()` in `Server.Serve()` from returning. The health server appears to have been introduced in: [b1f246567b72 (\"hubble/relay: Update health server to check connectivity\")](https://github.com/cilium/cilium/commit/b1f246567b7233fdd9a3edcbbe102415d3911fe4) ### How can we reproduce the issue? Run Hubble Relay in Kubernetes. Start termination of the Relay pod, for example as part of a node drain. Observe the Relay logs: ``` Stopping server... Server stopped ``` The pod remains in Terminating and the container remains in a running state. Inspect the Relay process network namespace after Server stopped: `sudo nsenter -t \"$PID\" -n ss -ltnp` Port 4222 is still in LISTEN state while the main Relay listener is gone. A SIGQUIT stack dump taken showed Server.Serve() waiting in: ``` sync.(*WaitGroup).Wait golang.org/x/sync/errgroup.(*Group).Wait github.com/cilium/cilium/pkg/hubble/relay/server.(*Server).Serve ``` ### Cilium Version 1.20.0 ### Kernel Version 5.14.0 ### Kubernetes Version 1.36.3 ### Regression _No response_ ### Sysdump _No response_ ### Relevant log output ```shell sync.(*WaitGroup).Wait golang.org/x/sync/errgroup.(*Group).Wait github.com/cilium/cilium/pkg/hubble/relay/server.(*Server).Serve ``` ### Anything else? _No response_ ### Cilium Users Document - [ ] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47941",
"createdAt": "2026-08-13T15:11:30Z",
"updatedAt": "2026-08-13T15:37:23Z",
"timestamp": "2026-08-13T15:37:23Z",
"metrics": {
"reactions": 1,
"comments": 0
},
"labels": [
"kind/bug",
"needs/triage",
"kind/community-report"
],
"author": "xandau",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:44913",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: update CT entry when source security identity changes",
"text": "Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo) - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) - [x] Thanks for contributing! This adds logic to detect and handle stale source security identities in conntrack entries. For the ingress case when a CT entry exists but the source security identity has changed, update the entry in-place so the proxy sees the current identity. For egress, recreate CT entries if the stored identity is stale. To make stale identity detection work we populate src_sec_id in ct_state during CT lookup. Fixes: #44912 ```release-note bpf: update CT entry when source security identity changes ```",
"url": "https://github.com/cilium/cilium/pull/44913",
"createdAt": "2026-03-20T19:00:16Z",
"updatedAt": "2026-08-13T02:14:03Z",
"timestamp": "2026-08-13T02:14:03Z",
"metrics": {
"reactions": 0,
"comments": 11
},
"labels": [
"release-note/bug",
"dont-merge/needs-rebase",
"stale",
"kind/community-contribution",
"affects/v1.19",
"needs-backport/1.20"
],
"author": "alimehrabikoshki",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:45051",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "[envoy] Add HTTP CONNECT support",
"text": " Add support of HTTP CONNECT method for L7 policies. Fixes: #24276 ```release-note envoy: Add support for HTTP CONNECT ``` AI disclosure: testing code was developed with LLM assistance, but i fully understand and stand by the code.",
"url": "https://github.com/cilium/cilium/pull/45051",
"createdAt": "2026-03-30T10:03:46Z",
"updatedAt": "2026-08-12T14:23:10Z",
"timestamp": "2026-08-12T14:23:10Z",
"metrics": {
"reactions": 3,
"comments": 9
},
"labels": [
"release-note/minor",
"cilium-cli"
],
"author": "nezdolik",
"state": "open",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:45579",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "[41867][Part6] Hybrid Routing Route Installation",
"text": "This is the route installation piece of Hybrid Routing [CFP](https://github.com/cilium/design-cfps/blob/main/cilium/CFP-32810-hybrid-routing-mode.md), building on the prior parts that introduced the subnet BPF map + statedb table, the topology decoder, and the regeneration fence. What this PR adds 1. Subnet table wiring - linuxNodeHandler now takes the statedb SubnetTable and, on every node update in hybrid mode, inserts the node's pod CIDRs as subnet entries. This lets the DP LPM lookup a pod IP to its owning subnet group and decide tunnel vs direct 2. Route installation for hybrid mode. - nodeUpdate no longer treats tunnel and direct routing as mutually exclusive installTunnelRoutes = n.enableEncapsulation(newNode) installDirectRoutes = n.nodeConfig.EnableAutoDirectRouting && !installTunnelRoutes both paths are evaluated independently 4. Stale-route cleanup on mode transition. - In hybrid mode a peer node can flip between tunnel eligible and direct eligible over its lifetime. On every update (not just firstAddition), we now delete any stale tunnel routes when tunneling is off and any stale direct routes when direct routing is off. - deleteNodeRoute now treats ESRCH (route not present) as success Follow up PRs Delegated IPAM Fix: https://github.com/cilium/cilium/pull/47367 Helm Support: https://github.com/cilium/cilium/pull/47368 Please ensure your pull request adheres to the following guidelines: - [ ] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [ ] All code is covered by unit and/or runtime tests where feasible. - [ ] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [ ] All commits are signed off. See the section [Developerβs Certificate of Origin](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo) - [ ] Provide a title or release-note blurb suitable for the release notes. - [ ] Write a short paragraph that states whether you used machine learning models (including LLMs and other generative AI), and indicate the rating using [AI Influence Level](https://danielmiessler.com/blog/ai-influence-level-ail). Example: \"This PR was prepared with AIL:3. I personally reviewed each line of the submission prior to opening this PR.\" - [ ] Thanks for contributing! Fixes: #issue-number ```release-note ```",
"url": "https://github.com/cilium/cilium/pull/45579",
"createdAt": "2026-04-23T17:02:20Z",
"updatedAt": "2026-08-12T19:37:01Z",
"timestamp": "2026-08-12T19:37:01Z",
"metrics": {
"reactions": 2,
"comments": 12
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "vanessachammas",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:45608",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: populate fib lookup L4 tuple for ECMP path selection",
"text": "In the current context, Cilium native routing mode with ebpf host routing only uses a single NIC. This patch intends to leverage on multiple NICs to aggregate throughput. In my understanding, there were two issues previously. Firstly, ENABLE_SKIP_FIB bypassed bpf_fib_lookup() entirely β fib_redirect_v4(), fib_redirect_v6(), and fib_redirect() would skip the kernel FIB and hard-redirect to CONFIG(direct_routing_dev_ifindex) β a single device. ECMP was impossible. (This was addressed in #43277.) Secondly, L4 fields left as zeros β even when bpf_fib_lookup() was called (e.g. the nodeport.h paths didn't use ENABLE_SKIP_FIB), the sport/dport/l4_protocol fields were zero. With fib_multipath_hash_policy=1, all flows between the same pod pair produce identical hashes β same nexthop β single NIC. This patch populates l4_protocol, sport, and dport in BPF FIB lookups so ECMP has per-flow entropy instead of hashing only identical L3 inputs. This complements the ENABLE_SKIP_FIB removal by ensuring bpf_fib_lookup() can actually distribute same src/dst flows across ECMP nexthops. Fixes: #39121 ``` Leveraging on multiple NICs for ebpf host routing ```",
"url": "https://github.com/cilium/cilium/pull/45608",
"createdAt": "2026-04-25T01:22:52Z",
"updatedAt": "2026-08-13T02:32:36Z",
"timestamp": "2026-08-13T02:32:36Z",
"metrics": {
"reactions": 4,
"comments": 7
},
"labels": [
"stale",
"dont-merge/needs-release-note-label"
],
"author": "saiaunghlyanhtet",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:45627",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "helm: Support ipFamilyPolicy and ipFamilies for dual-stack in ingressController service",
"text": "This extension of the Helm chart allows setting `ipFamilyPolicy` and `ipFamilies` for the LoadBalancer service when using shared mode. This makes it possible to create a shared dual-stack LoadBalancer service with the following Helm values: ```yaml ingressController: enabled: true loadbalancerMode: shared service: ipFamilies: - IPv4 - IPv6 ipFamilyPolicy: RequireDualStack ``` Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [ ] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo) - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Write a short paragraph that states whether you used machine learning models (including LLMs and other generative AI), and indicate the rating using [AI Influence Level](https://danielmiessler.com/blog/ai-influence-level-ail). Example: \"This PR was prepared with AIL:3. I personally reviewed each line of the submission prior to opening this PR.\" - [x] Thanks for contributing!",
"url": "https://github.com/cilium/cilium/pull/45627",
"createdAt": "2026-04-27T05:19:20Z",
"updatedAt": "2026-08-13T02:14:01Z",
"timestamp": "2026-08-13T02:14:01Z",
"metrics": {
"reactions": 0,
"comments": 5
},
"labels": [
"stale",
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "heptalium",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:45656",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "contrib: Don't descend into ~/.cache subdirs when chowning in builder.sh",
"text": "When Podman is used as Docker's drop-in replacement, it mounts volumes owned by user inaccessible by root inside the container, and the recursive chown fails. Don't try to go inside the mountpoints when fixing the ownership of /home/ubuntu. Fixes: 65cdb42f3ff6 (\"contrib: chown ~/.cache in builder.sh\") ```release-note Follow-up bugfixes for builder.sh. ```",
"url": "https://github.com/cilium/cilium/pull/45656",
"createdAt": "2026-04-28T11:15:47Z",
"updatedAt": "2026-08-13T16:40:55Z",
"timestamp": "2026-08-13T16:40:55Z",
"metrics": {
"reactions": 0,
"comments": 9
},
"labels": [
"dont-merge/needs-rebase",
"release-note/misc"
],
"author": "gentoo-root",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:45670",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "[41867] Part 5: bpf: nat: skip SNAT for same subnet traffic in hybrid overlay mode",
"text": "# Description This PR implements Part 5 of the hybrid routing mode feature ([CFP-32810](https://github.com/cilium/design-cfps/blob/main/cilium/CFP-32810-hybrid-routing-mode.md)). It skips SNAT for same-subnet pod-to-remote-node traffic in hybrid overlay mode. ## Context In overlay mode, pod-to-remote-node traffic is normally masqueraded before leaving the host. In hybrid routing mode, traffic within the same subnet topology group is routed natively and should preserve the original Pod source IP. For both IPv4 and IPv6, this PR punts masquerading to the stack when hybrid routing is enabled and the source and destination have the same non-zero subnet ID. ## Key Changes 1. **BPF SNAT decision logic** (`bpf/lib/nat.h`) - Add the same-subnet check to the IPv4 and IPv6 remote-node masquerading paths. - Keep `enable_remote_node_masquerade` as the higher-priority explicit override. 2. **Shared subnet helpers** (`bpf/lib/subnet.h`) - Add `is_subnet_same_id4()` and `is_subnet_same_id6()`. - Avoid duplicate comparisons and skip the destination lookup when the source subnet ID is zero. - Reuse the helpers in the existing host and endpoint hybrid-routing paths. 3. **BPF tests** - Test the IPv4 and IPv6 SNAT decision functions directly. - Keep each test case and assertion visible in its `.c` file, while sharing configuration and setup helpers through `hybrid_snat_skip_v4.h` and `hybrid_snat_skip_v6.h`. ## Test Coverage | Scenario | Remote-node masquerade | IPv4 | IPv6 | Expected behavior | |----------|-------------------------|------|------|-------------------| | Same non-zero subnet ID | disabled | β
| β
| Punt SNAT to the stack | | Different subnet IDs | disabled | β
| β
| Continue through the normal NAT path | | Both subnet IDs zero | disabled | β
| β
| Continue through the normal NAT path | | Same non-zero subnet ID | enabled | β
| β
| `NAT_NEEDED`; explicit override wins | The four BPF test objects compile with the standard `-Werror` flags and pass the BPF verifier/test runner. ## Design Decisions 1. **Check ordering** ```text enable_remote_node_masquerade β NAT_NEEDED native routing mode β NAT_PUNT_TO_STACK hybrid + same subnet β NAT_PUNT_TO_STACK flag_skip_tunnel β NAT_PUNT_TO_STACK ``` `enable_remote_node_masquerade` represents explicit user intent and therefore takes precedence over the automatic same-subnet exclusion. 2. **Zero subnet ID** A subnet ID of zero means no matching subnet topology entry. Two zero IDs must not be treated as the same configured subnet, so normal masquerading behavior is retained. 3. **Separate compilation units** `ASSIGN_CONFIG` can assign a config variable only once per compilation unit. Separate `.c` files select `enable_remote_node_masquerade=true` or `false` and contain the applicable test cases, while the corresponding shared header provides common configuration and setup helpers. ## Prior PRs (merged) - Part 1: #41868 β BPF subnet map, lookup, and tunnel skip logic - Part 2: #43631 β BPF tests for skip-tunnel and subnet-based routing - Part 3: #43438 β Subnet topology control plane and BPF map reconciliation - Part 4: #45001 β Core hybrid routing infrastructure and BPF configuration wiring ## Follow-up PRs - Part 6: #45579 β Hybrid Routing Route Installation (open) - Part 7: #45580 β Hybrid Routing WireGuard (closed) --- - [x] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description and are signed off. - [x] Provide a title or release-note blurb suitable for the release notes. - [ ] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) Fixes: #41867 ```release-note In hybrid routing mode, skip SNAT for pod-to-remote-node traffic when source and destination belong to the same subnet topology group, preserving the original Pod source IP for same-subnet communication. ```",
"url": "https://github.com/cilium/cilium/pull/45670",
"createdAt": "2026-04-29T03:07:39Z",
"updatedAt": "2026-08-13T02:01:07Z",
"timestamp": "2026-08-13T02:01:07Z",
"metrics": {
"reactions": 1,
"comments": 7
},
"labels": [
"release-note/misc",
"kind/community-contribution"
],
"author": "OneSizeFitsQuorum",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:45672",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: sockLB: allow translation for L2-announced ExternalIPs",
"text": "Fixes #44348 ## Description `sock4_skip_xlate()` / `sock6_skip_xlate()` reject ExternalIPs whose ipcache identity is not `HOST_ID`. That check is the MITM mitigation against arbitrary remote endpoints claiming a service ExternalIP. L2-announced ExternalIPs (`CiliumL2AnnouncementPolicy`) are added to the selected leader node's primary interface so the kernel can answer ARP/NDP for the VIP. The address really is locally hosted, but in ipcache it resolves to world identity (or a CIDR identity), not `HOST_ID`. As a result, socket-LB translation is skipped for connections originating in the host network namespace (for example `hostNetwork` pods) that target an L2-announced ExternalIP, even though this node is the elected leader and genuinely owns the VIP. This matches @selfuryon's diagnosis in #44348 (and his follow-up comment from 2026-02-26 confirming the issue is specific to `bpf-lb-sock` translation being short-circuited). Without translation, the connection leaves the host with the VIP as the destination, the kernel routes it back via `lo`, and the service is never selected. UDP source-port rewriting / conntrack reply confusion follows from the same control-flow path. ## Fix Before returning `true` from the skip-xlate path, look up the destination address in the per-interface L2 responder BPF map (`cilium_l2_responder_v4` / `cilium_l2_responder_v6`) keyed by `(addr, interface_ifindex)`. A hit means this node is the elected L2 leader for the VIP, the address is legitimately local, and the MITM concern does not apply β so socket-LB translation can proceed. To make the L2 responder map usable from `bpf_sock.c`, the patch factors the key/value structs and map definitions out of `lib/l2_responder.h` into a new `lib/l2_responder_maps.h`. The full header (`l2_responder.h`) pulls in the ARP/NDP handler, which depends on helpers (`config_get`, `arp_validate`, `arp_respond`, the `icmp6_*` helpers, ...) that are not available in the sock program context. `bpf_sock.c` includes only the maps-only header; `l2_responder.h` includes the maps header and adds the handler on top, so existing callers (`bpf_host.c`) are unchanged. ## Production exposure This fix has been running in production at Blockcast on Cilium 1.19.x rebased onto v1.19.3 across a 4-node on-prem Talos cluster for several weeks with no regressions observed: hostNetwork pods on the elected L2 leader can now reach L2-announced ExternalIP services correctly. ## Reviewers cc @julianwiedmann (engaged on the original issue thread, datapath maintainer of record). ## AI disclosure This PR was prepared with AIL:3 β an AI assistant helped with editing and the writeup; a human authored, reviewed, and validated each line of the change in production prior to opening this PR. ```release-note sockLB: allow translation for L2-announced ExternalIPs on the elected leader node, fixing hostNetwork connectivity to ExternalIP services with CiliumL2AnnouncementPolicy. ```",
"url": "https://github.com/cilium/cilium/pull/45672",
"createdAt": "2026-04-29T06:56:29Z",
"updatedAt": "2026-08-13T02:13:56Z",
"timestamp": "2026-08-13T02:13:56Z",
"metrics": {
"reactions": 3,
"comments": 11
},
"labels": [
"release-note/minor",
"stale",
"kind/community-contribution",
"area/loadbalancing",
"feature/l2-announcement",
"feature/socket-lb"
],
"author": "kkroo",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:45713",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "hubble: refactor local node watcher as a cell",
"text": " Move the `LocalNodeWatcher` from `pkg/hubble/observer` into `pkg/hubble/parser` and inject it into the `PayloadParser` to populate `node_labels` and `NodeName` during flow parsing, rather than via observer hooks - Add a `Run` method for lifecycle management via `job.OneShot` - Set `node_labels` and `NodeName` at the two flow paths in `Decode()` - Derive `NodeName` from `LocalNode` using `Node.Fullname()` instead of `MonitorEvent.NodeName` - Remove the inline watcher creation from `hubbleintegration.go` Fixes: #40062 ```release-note hubble: Refactor the local node watcher as a hive cell ```",
"url": "https://github.com/cilium/cilium/pull/45713",
"createdAt": "2026-05-01T15:52:11Z",
"updatedAt": "2026-08-12T15:13:54Z",
"timestamp": "2026-08-12T15:13:54Z",
"metrics": {
"reactions": 2,
"comments": 7
},
"labels": [
"dont-merge/needs-rebase",
"release-note/misc",
"kind/community-contribution",
"area/hubble"
],
"author": "puwun",
"state": "open",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:45718",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "overlay: Remove unnecessary identity lookup",
"text": "Commit dfa42c75c409 (\"bpf: Fix kube-apiserver policy drop in tunneling\") fixed a temporary packet disruption issue during upgrade from v1.11 to v1.12 by overriding a security identity lookup for node-to-node traffic using the locally constructed ipcache. The code for that case was intended to be temporary to ensure hitless upgrade at the time, and that code can now be removed. Later on in commit 895630ba293d (\"bpf: Fix identity determination in bpf_overlay.c\"), support was added to perform an extra ipcache lookup in DSR scenarios. In short, for that specific scenario the original source IP is encoded in the nested packet, so we can use that original source IP for security identity lookup. By doing that, we can support ingress CIDR network policy using the original client IP. The comment for this case was a bit terse though, so this commit expands the comment to clarify why that logic is needed.",
"url": "https://github.com/cilium/cilium/pull/45718",
"createdAt": "2026-05-01T21:24:22Z",
"updatedAt": "2026-08-13T02:13:54Z",
"timestamp": "2026-08-13T02:13:54Z",
"metrics": {
"reactions": 0,
"comments": 5
},
"labels": [
"area/datapath",
"sig/policy",
"stale",
"release-note/misc",
"dont-merge/waiting-for-review"
],
"author": "joestringer",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:45815",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "k8s: Use upstream controller-tools",
"text": "We have been using a fork of `sigs.k8s.io/controller-tools` ever since we've been using controller-tools to generate our CRDs (#11607). The upstream project has evolved a lot in the last 5 years and now supports all the features we need, meaning we no longer need to use our forked version. See the following table for details of every single commit from our fork and explaination for why we don't need them anymore: | # | Commit | Description | Why it can be dropped | |---|--------|-------------|----------------------| | 1 | [`254b4d27`](https://github.com/cilium/controller-tools/commit/254b4d275e3ccbd87a7ddb5da96abfc610b1b86f) | Module rename (christarazi) | Superseded by commit 16 | | 2 | [`7956d027`](https://github.com/cilium/controller-tools/commit/7956d027c227403ad41234ff00284eb2a4a90213) | Revert custom-json | Upstream re-implemented with better logic checking `json.Marshaler` and `encoding.TextMarshaler` with proper fallthrough ([kubernetes-sigs/controller-tools#601](https://github.com/kubernetes-sigs/controller-tools/pull/601) and [kubernetes-sigs/controller-tools#1015](https://github.com/kubernetes-sigs/controller-tools/pull/1015)) | | 3 | [`f2dbd822`](https://github.com/cilium/controller-tools/commit/f2dbd8227099c8cc7ba845f2d330f840f718b848) | `+kubebuilder:validation:OneOf` | Replaced by upstream `+kubebuilder:validation:ExactlyOneOf`/`AtMostOneOf` (CEL-based). This PR updates cilium types to use the upstream markers ([kubernetes-sigs/controller-tools#1212](https://github.com/kubernetes-sigs/controller-tools/pull/1212)). | | 4 | [`7bb5deed`](https://github.com/cilium/controller-tools/commit/7bb5deed814de30225f0a6c8dc10ce5c80655c6b) | Use v1 `JSONSchemaProps` for OneOf | Upstream is v1-only, was only needed for commit 3 | | 5 | [`d944debc`](https://github.com/cilium/controller-tools/commit/d944debcff34ea02a9506bc5911b2bb64ee61dd6) | Type aliasing for basic types | Upstream handles aliases comprehensively, including Go 1.23 `*types.Alias` ([kubernetes-sigs/controller-tools#1061](https://github.com/kubernetes-sigs/controller-tools/pull/1061) and [kubernetes-sigs/controller-tools#1078](https://github.com/kubernetes-sigs/controller-tools/pull/1078)) | | 6 | [`8b730d5a`](https://github.com/cilium/controller-tools/commit/8b730d5adbe5bc668d102406bfa83c34c34a3170) | Revert status removal | Upstream strips status via `transformRemoveCRDStatus` ([kubernetes-sigs/controller-tools#630](https://github.com/kubernetes-sigs/controller-tools/pull/630)) | | 7 | [`f3a7f357`](https://github.com/cilium/controller-tools/commit/f3a7f35737411447256703e7c9288bdd5b852698) | Webhook `admissionregistration/v1` | Upstream has full v1 webhook support with `timeoutSeconds`, `reinvocationPolicy`, etc. ([kubernetes-sigs/controller-tools#534](https://github.com/kubernetes-sigs/controller-tools/pull/534)) | | 8 | [`924de437`](https://github.com/cilium/controller-tools/commit/924de43755fe3c3c505929f63caeff2733acacef) | `AdmissionReviewVersions` | Upstream has this as a required marker field | | 9 | [`4ef22c33`](https://github.com/cilium/controller-tools/commit/4ef22c3309666cf964534982e119685f9f46fe4f) | Remove defaults from `v1beta1` CRDs | Upstream dropped `v1beta1` CRD support entirely ([kubernetes-sigs/controller-tools#607](https://github.com/kubernetes-sigs/controller-tools/pull/607)) | | 10 | [`109db64f`](https://github.com/cilium/controller-tools/commit/109db64f53d447014e2ab7031440443babffcc1c) | Default `corev1.Protocol` to TCP | Cilium CRDs don't use `corev1.Protocol`, we use our own `api.L4Proto` type. This override had no effect for cilium. | | 11 | [`fb3e9530`](https://github.com/cilium/controller-tools/commit/fb3e953067dc5174b405ba3f4d8a0762ebc8f628) | Regenerate testdata | Testdata fully diverged, only existed to support commit 10 | | 12 | [`e0828e0b`](https://github.com/cilium/controller-tools/commit/e0828e0bacb236d2122d42b94c0788b3a0efc064) | `+kubebuilder:topleveldesc` marker | No cilium type uses the marker, generated CRDs don't contain it, and the runtime validator already warns users to stop using top-level `description` | | 13 | [`8a2263da`](https://github.com/cilium/controller-tools/commit/8a2263da57985328f420c331c9332aff9440d9b1) | `+kubebuilder:validation:AnyOf` | Same as commit 3: replaced by upstream `+kubebuilder:validation:AtLeastOneOf`. This PR updates cilium types to use the upstream markers ([kubernetes-sigs/controller-tools#1278](https://github.com/kubernetes-sigs/controller-tools/pull/1278)). | | 14 | [`7e668c1f`](https://github.com/cilium/controller-tools/commit/7e668c1fb4c2fcaa09afb05b77964d53503b6119) | `+kubebuilder:xpreserveunknownfields` | Cilium doesn't use this marker, it uses the upstream `+kubebuilder:pruning:PreserveUnknownFields` | | 15 | [`aa940491`](https://github.com/cilium/controller-tools/commit/aa94049173f871dc8fc58bce6aa39067250245ff) | Go 1.17 build tag format | Upstream already uses `//go:build` exclusively ([kubernetes-sigs/controller-tools#828](https://github.com/kubernetes-sigs/controller-tools/pull/828)) | | 16 | [`f2b7ff86`](https://github.com/cilium/controller-tools/commit/f2b7ff866fdedf2574906b62789d7bfbe3013f8c) | Module rename (cilium) | Only needed to make the fork functional, not needed if we switch back to upstream project. | Note: while this PR switches us back to using upstream controller-tools, we're temporarily using a pseudo-version as we need this PR https://github.com/kubernetes-sigs/controller-tools/pull/1375 that is not currently included in any tagged release. We'll be able to switch back to a properly tagged release version when the next one is created. The main visible change in the generated CRDs look like that and are functionnally noop: ```diff items: description: PortRuleDNS is a list of allowed DNS lookups. - oneOf: - - properties: - matchName: {} - required: - - matchName - - properties: - matchPattern: {} - required: - - matchPattern properties: matchName: description: |- @@ -806,6 +750,11 @@ spec: pattern: ^([-a-zA-Z0-9_*]+[.]?)+$ type: string type: object + x-kubernetes-validations: + - message: exactly one of the fields in [matchName + matchPattern] must be set + rule: '[has(self.matchName),has(self.matchPattern)].filter(x,x==true).size() + == 1' type: array ```",
"url": "https://github.com/cilium/cilium/pull/45815",
"createdAt": "2026-05-06T16:26:55Z",
"updatedAt": "2026-08-13T11:03:58Z",
"timestamp": "2026-08-13T11:03:58Z",
"metrics": {
"reactions": 1,
"comments": 8
},
"labels": [
"area/k8s",
"release-note/minor",
"sig/policy"
],
"author": "HadrienPatte",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:45915",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bandwidth: support DSCP marking for Pod egress traffic",
"text": "This PR adds support for setting DSCP marks on Pod egress traffic through the Bandwidth Manager. Pods can configure the DSCP value with the `bandwidth.cilium.io/egress-dscp` annotation. The annotation accepts values in the `0-63` range. The BPF datapath preserves the existing ECN bits while rewriting the IPv4 TOS or IPv6 Traffic Class field. The feature is held behind `--enable-dscp-marking` / `bandwidthManager.dscp.enabled`, and requires the Bandwidth Manager to be enabled. Then annotate a Pod, e.g. for Expedited Forwarding (DSCP 46): ```yaml metadata: annotations: bandwidth.cilium.io/egress-dscp: \"46\" ``` Follow ups: - Tunnel outer-header DSCP marking is not included in this PR and will be covered separately. - User-facing documentation will be added in a follow-up PR. Refs: #43150 ```release-note Add support for setting DSCP marks on Pod egress traffic through the Bandwidth Manager using the `bandwidth.cilium.io/egress-dscp` annotation. ```",
"url": "https://github.com/cilium/cilium/pull/45915",
"createdAt": "2026-05-12T06:49:14Z",
"updatedAt": "2026-08-13T02:13:53Z",
"timestamp": "2026-08-13T02:13:53Z",
"metrics": {
"reactions": 0,
"comments": 3
},
"labels": [
"stale",
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "jronak",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:45953",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "node/manager: Populate node table from manager",
"text": "We're on regular basis now encountering the situation where we would like to be able to fetch and watch information about individual Cilium nodes in the agent. Currently this requires implementing a `node.Handler` and subscribing with the `NodeManager` which is fair bit of boilerplate and annoying to test. It's even worse if all the rest of the code is interacting with StateDB tables. As a first small step towards https://github.com/cilium/cilium/issues/41744 and to allow new code to easily watch and look up nodes, change the `Table[*LocalNode]` into `Table[*Node]` and populate the remote nodes into this table from `NodeManager`. This PR tries to keep the changes to a minimum and local to `pkg/node` and hence uses adds a `type LocalNode = Node` alias and doesn't change the `LocalNodeStoreCell` structure. The runtime impact of this change without further cleanup is that we now temporarily have an additional index for remote Cilium nodes and we store`types.Node` twice (shallow clone, 296 bytes). The next step would be to refactor `NodeManager` to use `Table[*Node]` internally to avoid the duplicate indexing.",
"url": "https://github.com/cilium/cilium/pull/45953",
"createdAt": "2026-05-13T12:42:16Z",
"updatedAt": "2026-08-13T14:44:17Z",
"timestamp": "2026-08-13T14:44:17Z",
"metrics": {
"reactions": 2,
"comments": 8
},
"labels": [
"release-note/misc"
],
"author": "joamaki",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46049",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: fib: let fib_lookup_v*() handle the tbid processing",
"text": "De-dup the setup code for a FIB lookup which uses the `tbid` parameter.",
"url": "https://github.com/cilium/cilium/pull/46049",
"createdAt": "2026-05-19T10:51:55Z",
"updatedAt": "2026-08-13T02:13:48Z",
"timestamp": "2026-08-13T02:13:48Z",
"metrics": {
"reactions": 0,
"comments": 5
},
"labels": [
"area/datapath",
"kind/cleanup",
"stale",
"release-note/misc",
"feature/egress-gateway"
],
"author": "julianwiedmann",
"state": "open",
"assignees": [
"julianwiedmann"
]
},
{
"id": "github:cilium/cilium:pull_request:46112",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Pr/jwi/main/l7lb route",
"text": "Please ensure your pull request adheres to the following guidelines: - [ ] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [ ] All code is covered by unit and/or runtime tests where feasible. - [ ] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [ ] All commits are signed off. See the section [Developerβs Certificate of Origin](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo) - [ ] Provide a title or release-note blurb suitable for the release notes. - [ ] Write a short paragraph that states whether you used machine learning models (including LLMs and other generative AI), and indicate the rating using [AI Influence Level](https://danielmiessler.com/blog/ai-influence-level-ail). Example: \"This PR was prepared with AIL:3. I personally reviewed each line of the submission prior to opening this PR.\" - [ ] Thanks for contributing! Fixes: #issue-number ```release-note ```",
"url": "https://github.com/cilium/cilium/pull/46112",
"createdAt": "2026-05-22T09:19:13Z",
"updatedAt": "2026-08-13T02:13:45Z",
"timestamp": "2026-08-13T02:13:45Z",
"metrics": {
"reactions": 0,
"comments": 8
},
"labels": [
"area/datapath",
"stale",
"release-note/misc"
],
"author": "julianwiedmann",
"state": "open",
"assignees": [
"julianwiedmann"
]
},
{
"id": "github:cilium/cilium:pull_request:46199",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "[POC] CEL based policy endpoint selectors",
"url": "https://github.com/cilium/cilium/pull/46199",
"createdAt": "2026-05-27T02:35:40Z",
"updatedAt": "2026-08-13T02:13:43Z",
"timestamp": "2026-08-13T02:13:43Z",
"metrics": {
"reactions": 0,
"comments": 2
},
"labels": [
"release-note/major",
"sig/policy",
"stale"
],
"author": "fristonio",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46227",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: use bpf_redirect_peer() for local pod-to-pod delivery on veth",
"text": "``` Even when BPF Host Routing is disabled (and we only have ENABLE_ROUTING), a local pod-to-pod delivery via the pod's ingress policy tailcall can *always* use bpf_redirect_peer() to push the packet into the pod netns. This is preferable to a plain bpf_redirect() + veth traversal. In order to allow this, slightly refactor the should_redirect_peer() helper. Right now it implements checks for (1) kernel-level requirements *and* (2) datapath-internal consistency requirements. By splitting off the checks for (2), we can relax them for local pod-to-pod delivery. Also extend the redirect tests to cover this scenario. And instead of a service-hairpin connection (which is a very special case in the datapath), use a plain pod-to-pod connection. ``` Fixes: https://github.com/cilium/cilium/issues/46168",
"url": "https://github.com/cilium/cilium/pull/46227",
"createdAt": "2026-05-28T09:27:51Z",
"updatedAt": "2026-08-13T02:13:42Z",
"timestamp": "2026-08-13T02:13:42Z",
"metrics": {
"reactions": 0,
"comments": 12
},
"labels": [
"kind/enhancement",
"area/datapath",
"kind/performance",
"stale",
"release-note/misc"
],
"author": "julianwiedmann",
"state": "open",
"assignees": [
"julianwiedmann"
]
},
{
"id": "github:cilium/cilium:pull_request:46232",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT",
"text": "``` This HostFW hook lives in bpf_host's `from-netdev` program. It operates on packets that have been successfully RevSNATed (otherwise we would have bailed out earlier). And ipv*_host_policy_ingress() only takes action for packets where the RevSNATed destination IP is mapped as HOST_ID - otherwise it returns immediately. The next step in the program chain is to apply RevDNAT for the packet. *All* RevDNATed traffic is forwarded out of the node via either (1) the overlay network, or (2) a FIB lookup and BPF redirect. If we can't find a RevDNAT match, the packet recircles back through CILIUM_CALL_IPV*_FROM_NETDEV and hits the Ingress HostFW hook in handle_ipv*() - which is why we're marking it as ctx_skip_host_fw_set(), to avoid double enforcement. In other words - this hook is not necessary for packets that enter the local node (we can rely on the hook in handle_ipv*()). And packets that are forwarded out of the node will certainly not be targeting a destination with HOST_ID - and so the HostFW hook will not apply for them either. Consequently it seems fine to remove this hook, there's no type of traffic that actually requires it. ```",
"url": "https://github.com/cilium/cilium/pull/46232",
"createdAt": "2026-05-28T13:32:24Z",
"updatedAt": "2026-08-13T02:13:40Z",
"timestamp": "2026-08-13T02:13:40Z",
"metrics": {
"reactions": 0,
"comments": 4
},
"labels": [
"area/datapath",
"stale",
"release-note/misc",
"area/host-firewall",
"area/loadbalancing",
"dont-merge/waiting-for-review",
"area/kpr"
],
"author": "julianwiedmann",
"state": "open",
"assignees": [
"julianwiedmann"
]
},
{
"id": "github:cilium/cilium:pull_request:46239",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": ".github: Support other versions in bug report template",
"text": "Sometimes users report issues against the latest pre-release. Sometimes they are also reporting a bug on a different version but the template is too restrictive so they file the bug with the wrong version then add the version later on in the bug report. We already make it clear to the reporter that they should upgrade if the version is not listed, but I would rather that the top section of the template reports more accurately (such as 'Other' which suggests the version might be unmaintained) rather than have the reporter add a version number in this section which is wrong.",
"url": "https://github.com/cilium/cilium/pull/46239",
"createdAt": "2026-05-28T16:30:00Z",
"updatedAt": "2026-08-13T02:13:39Z",
"timestamp": "2026-08-13T02:13:39Z",
"metrics": {
"reactions": 0,
"comments": 3
},
"labels": [
"stale",
"release-note/misc"
],
"author": "joestringer",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46287",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "endpoint: gracefully degrade policy map overflow",
"text": "Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! Implemented the four heuristics proposed in #46189 to choose which entries to retain when the policy map is over capacity: 1. Entries with observed traffic (packet/byte counters > 0) 2. TCP/UDP entries over SCTP 3. Entries already present in the BPF map 4. Entries derived from CiliumClusterwideNetworkPolicy over CiliumNetworkPolicy Related: #46189 (Further heuristics can be added in future) This PR was prepared with AIL:2. ```release-note Policy map overflow applies a priority-based heuristic to retain the most important entries when the map is full, instead of dropping entries randomly. ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/46287",
"createdAt": "2026-05-31T19:23:14Z",
"updatedAt": "2026-08-13T02:13:37Z",
"timestamp": "2026-08-13T02:13:37Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"release-note/minor",
"stale",
"kind/community-contribution",
"dont-merge/discussion"
],
"author": "MdSaifAliMolla",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46290",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Hubble observer server hardening",
"text": "This change does not implement compile time cost limit for flow filter CEL Expressions. Currently the [flow proto types](https://github.com/fristonio/cilium/blob/0906ee16c4f4c01d98297cc520d0d5a821b6b085/api/v1/flow/flow.proto#L14) are not annotated with validation descriptors, so the size of strings/map/list are not known at compile time causing cost estimate to explode. In the context of this PR the cost limit is only enforced at runtime. For compile time protection against user provided CEL expression, a hard limit on the size of raw expression is enforced. Compile time cost limit enforcement will be implemented as a followup. For this we need to standardize the approach for annotating proto contracts with validation descriptors(either using [protoc-gen-validate](https://github.com/bufbuild/protoc-gen-validate) or [protovalidator](https://protovalidate.com/)) and close on the exact constraints for all flow proto types fields. This can then be consumed from a custom cost estimator.",
"url": "https://github.com/cilium/cilium/pull/46290",
"createdAt": "2026-06-01T06:31:23Z",
"updatedAt": "2026-08-13T02:13:36Z",
"timestamp": "2026-08-13T02:13:36Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"release-note/minor",
"stale",
"area/hubble"
],
"author": "fristonio",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46308",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "migrate IPV4_SNAT_CIDR/CIDR_length to runtime config",
"text": "**bpf: Migrate IPv4 SNAT exclusion destination CIDR and length to runtime config** Related: #38370 Signed-off-by: Anshul Chelapurath [achelapurath@google.com](mailto:achelapurath@google.com)",
"url": "https://github.com/cilium/cilium/pull/46308",
"createdAt": "2026-06-01T21:41:35Z",
"updatedAt": "2026-08-13T02:13:36Z",
"timestamp": "2026-08-13T02:13:36Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"stale",
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "amchelapurath2023",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46384",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: pass LWT encap back to kernel",
"text": "For \"various reasons\", I am running a custom LWT based Geneve overlay that needs to intersect with our Cilium deployment. I noticed that traffic was not routing into the overlay, and through the pure magic that is `cilium monitor --type drop -v` I was able to get this message: ``` xx drop (FIB lookup failed, 6) flow 0x0 to endpoint 0, ifindex 1344, file bpf_lxc.c:1332, , identity 16009->world: 10.255.33.32 -> 255.209.73.1 EchoRequest ``` Asking Claude to take a look at the code, it lead me to the `DROP_NO_FIB` handling, and this enum: ``` enum { BPF_FIB_LKUP_RET_SUCCESS, /* lookup successful */ BPF_FIB_LKUP_RET_BLACKHOLE, /* dest is blackholed; can be dropped */ BPF_FIB_LKUP_RET_UNREACHABLE, /* dest is unreachable; can be dropped */ BPF_FIB_LKUP_RET_PROHIBIT, /* dest not allowed; can be dropped */ BPF_FIB_LKUP_RET_NOT_FWDED, /* packet is not forwarded */ BPF_FIB_LKUP_RET_FWD_DISABLED, /* fwding is not enabled on ingress */ BPF_FIB_LKUP_RET_UNSUPP_LWT, /* fwd requires encapsulation */ BPF_FIB_LKUP_RET_NO_NEIGH, /* no neighbor entry for nh */ BPF_FIB_LKUP_RET_FRAG_NEEDED, /* fragmentation required to fwd */ }; ``` I artisanally patched the code in the PR by hand, and tested out the change and it seems to work. I realize at this point I should note that I'm using a `BPF_PROG_TYPE_LWT_XMIT` program, with the eBPF program attached to a route encap. I wonder if I'd been using a `BPF_PROG_TYPE_SCHED_CLS` with a `tc` `egress` hook program this may have just worked for free. Looking back at this `enum` though, I wonder if more of these should punt to the kernel logic, e.g. `BPF_FIB_LKUP_RET_FRAG_NEEDED` etc - so I'm looking for input on that. I also asked Claude about testing this change, and it seemed to suggest a *lot* of changes so I was looking for some input for that. ```release-note Fix: Punt unsupported LWT back to the kernel for processing. ```",
"url": "https://github.com/cilium/cilium/pull/46384",
"createdAt": "2026-06-05T17:38:29Z",
"updatedAt": "2026-08-13T02:13:34Z",
"timestamp": "2026-08-13T02:13:34Z",
"metrics": {
"reactions": 0,
"comments": 4
},
"labels": [
"stale",
"dont-merge/needs-release-note-label"
],
"author": "alxn",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46458",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: Migrate IPv6_SNAT_* to runtime config",
"text": "**bpf: Migrate IPv6 SNAT exclusion destination CIDR, CIDR mask, and CIDR length to runtime config** Related: #38370 Signed-off-by: Anshul Chelapurath [achelapurath@google.com](mailto:achelapurath@google.com)",
"url": "https://github.com/cilium/cilium/pull/46458",
"createdAt": "2026-06-10T01:28:29Z",
"updatedAt": "2026-08-13T02:13:32Z",
"timestamp": "2026-08-13T02:13:32Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"stale",
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "amchelapurath2023",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46473",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: host: pass IPv6 to the stack when the IPv6 datapath is disabled",
"text": "When the host firewall is enabled but the IPv6 datapath is compiled out (`enable-ipv6=false`), bpf_host drops all IPv6 packets on managed devices as `DROP_UNKNOWN_L3` (\"Unsupported L3 protocol\") β in both directions and before any policy evaluation. This breaks IPv6 neighbor discovery for the node and, with it, any node-level IPv6 connectivity, e.g. BGP unnumbered peering over link-local addresses on L3 fabrics. No host policy can allow the traffic back, since the drop happens before policy enforcement. Without the host firewall, the same packets are passed to the kernel stack. This PR restores that behavior for the IPv6 ethertype when `ENABLE_IPV6` is not compiled in: the host firewall cannot enforce policies on a protocol it cannot parse, and dropping it breaks the node instead of protecting it. The change mirrors the existing ARP passthrough cases in the same protocol switches (`do_netdev`, `cil_to_netdev`, `host_ingress_policy`, `from_host_to_lxc`). New BPF test `bpf/tests/host_hostfw_ipv6_disabled.c` (host firewall enabled, no IPv6 datapath) asserts that an ICMPv6 router advertisement from a peer (ingress) and a neighbor solicitation from the node (egress) reach the stack. Without the fix, both fail with exactly the \"Unsupported L3 protocol\" drop reported in #33155. This is not a theoretical setup: users of [Cozystack](https://github.com/cozystack/cozystack) (a CNCF project) run this exact combination β host firewall enabled, Cilium without the IPv6 datapath, nodes on IPv6/L3 fabrics β and confirm both the breakage and that the passthrough restores node connectivity ([cozystack/cozystack#2806](https://github.com/cozystack/cozystack/issues/2806)). This PR upstreams the patch we currently carry downstream in our Cilium image; we will drop the downstream copy once an equivalent fix is available upstream. This PR was prepared with AIL:3 β I defined the problem, the mechanism, and the fix design; an LLM produced the patch and the test under my direction. I personally reviewed the diff and ran the BPF tests: the new test fails without the fix and passes with it, and the neighboring host-firewall/IPv6 tests still compile. Fixes: #33155 ```release-note host-firewall: IPv6 traffic is passed to the kernel stack instead of being dropped when the IPv6 datapath is disabled. ```",
"url": "https://github.com/cilium/cilium/pull/46473",
"createdAt": "2026-06-10T16:59:56Z",
"updatedAt": "2026-08-12T14:55:05Z",
"timestamp": "2026-08-12T14:55:05Z",
"metrics": {
"reactions": 3,
"comments": 6
},
"labels": [
"release-note/minor",
"sig/policy",
"kind/community-contribution"
],
"author": "lexfrei",
"state": "closed",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:46577",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: Migrate SNAT retries to runtime config",
"text": "**bpf: Migrate SNAT collision retry to runtime config** Related: #38370 Signed-off-by: Anshul Chelapurath [achelapurath@google.com](mailto:achelapurath@google.com)",
"url": "https://github.com/cilium/cilium/pull/46577",
"createdAt": "2026-06-15T20:28:39Z",
"updatedAt": "2026-08-13T02:13:29Z",
"timestamp": "2026-08-13T02:13:29Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"stale",
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "amchelapurath2023",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46609",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "sysdump: contain WithFileSink output to the sysdump directory",
"text": "- [ ] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [ ] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! WithFileSink joins a caller-supplied name to the sysdump directory and opens it, with no containment check. SubmitCniConflistSubtask feeds it filenames taken from `ls -1` run inside a target pod, so the names are controlled by the pod rather than the CLI. - a name like `../../../../etc/foo` resolves outside the sysdump directory through AbsoluteTempPath - the collected file contents are then written to that path on the host running `cilium sysdump` - guarded WithFileSink itself so every caller is covered, reusing the prefix check the extractZip helper already applies Added a regression test covering a normal name and an escaping one. ```release-note sysdump: reject collected file names that resolve outside the sysdump directory ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/46609",
"createdAt": "2026-06-17T07:42:22Z",
"updatedAt": "2026-08-12T15:14:30Z",
"timestamp": "2026-08-12T15:14:30Z",
"metrics": {
"reactions": 2,
"comments": 6
},
"labels": [
"release-note/bug",
"kind/community-contribution",
"cilium-cli",
"cilium-cli-exclusive"
],
"author": "sage-mode-hunter",
"state": "open",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:46630",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bgp: add BGP Monitoring Protocol (BMP, RFC 7854) support",
"text": "## Summary Adds **BGP Monitoring Protocol (BMP, [RFC 7854](https://datatracker.ietf.org/doc/html/rfc7854))** support to the Cilium BGP Control Plane. Cilium nodes can stream the state of their BGP instances to one or more external BMP monitoring stations, giving operators a real-time, read-only view of what each node receives and advertises over BGP β without logging into nodes or attaching extra BGP peers that could influence route selection. For each configured station a node opens an outbound TCP session and sends an *Initiation* message (the node name is the `sysName`), *Peer Up/Down* notifications, *Route Monitoring* messages for the selected RIB view, and optional periodic *Statistics Reports*. BMP is a monitoring channel only β it never advertises routes back to Cilium and does not affect route selection or datapath programming. This builds on the GoBGP `AddBmp`/`DeleteBmp` API already vendored in the tree. ## Configuration Stations are configured per BGP instance via a new `bmpServers` field on `CiliumBGPClusterConfig`: ```yaml apiVersion: cilium.io/v2 kind: CiliumBGPClusterConfig metadata: name: cilium-bgp spec: nodeSelector: matchLabels: rack: rack0 bgpInstances: - name: \"instance-65000\" localASN: 65000 localPort: 179 peers: - name: \"peer-65000-tor1\" peerASN: 65000 peerAddress: fd00:10:0:0::1 peerConfigRef: name: \"cilium-peer\" bmpServers: - name: \"bmp-station\" peerAddress: \"10.0.0.5\" peerPort: 11019 # default monitoringPolicy: \"all\" # pre | post | both | local | all (default pre) statisticsTimeout: 30 # seconds, optional ``` ## What's included - **types**: `BMPServer`, `BMPMonitoringPolicy`, and `AddBMP`/`RemoveBMP` on the `Router` interface. - **gobgp**: implements `AddBMP`/`RemoveBMP` on top of the embedded GoBGP server. - **CRD** (`cilium.io/v2`): new `CiliumBGPBMPServer` plus the `bmpServers` list on `CiliumBGPInstance` and `CiliumBGPNodeInstance`. - **operator**: propagates `bmpServers` from the cluster config to the per-node `CiliumBGPNodeConfig`. - **reconciler**: `BMPReconciler` diffs desired vs. running stations and calls `Router.AddBMP`/`RemoveBMP`; registered in the reconciler cell. - regenerated deepcopy / deepequal / CRD manifests. - unit tests for the gobgp BMP path and the BMP reconciler. - docs page under the BGP Control Plane section, including an end-to-end tutorial and a no-code consumption pipeline. ## Testing - `go test ./pkg/bgp/gobgp/ -run TestAddBMP` β GoBGP emits a valid BMP Initiation message (v3, msgType 4) to a fake station. - `go test ./pkg/bgp/manager/reconciler/` β `Test_BMPReconciler` covers add / multi-station / in-place policy update / removal, each run twice for idempotency. - `go vet` clean on the operator and reconciler packages. ## Consuming the stream Cilium only produces the BMP stream; any RFC 7854 collector consumes it. A validated no-code, Grafana-native pipeline is `pmbmpd` (JSON) β Promtail β Loki β Grafana. The node name is carried in the BMP `sysName` so the collector can attribute every message to the originating node. --- - [x] All code is covered by unit tests where feasible. - [x] All commits contain a well written commit description including a title and description. - [x] All commits are signed off. - [x] Provided a release-note blurb below. - [x] AI disclosure provided below per the Cilium AI Policy. This PR was prepared with AIL:4: an AI assistant drafted the implementation, unit tests, and documentation under my direction. The unit tests were run locally and the end-to-end BMP pipeline was validated against a real collector (pmbmpd β Loki β Grafana). I have reviewed the changes before submitting. ```release-note bgp: add BGP Monitoring Protocol (BMP, RFC 7854) support, allowing nodes to stream their BGP RIB state to external BMP monitoring stations via a new bmpServers field on CiliumBGPClusterConfig. ```",
"url": "https://github.com/cilium/cilium/pull/46630",
"createdAt": "2026-06-18T07:13:57Z",
"updatedAt": "2026-08-13T02:13:27Z",
"timestamp": "2026-08-13T02:13:27Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"stale",
"dont-merge/needs-release-note-label"
],
"author": "nvibert",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46641",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "scaletozero: add datapath demand signalling for service scale-to-zero",
"text": "This is the datapath part of #44027. Cilium publishes demand, holds new connections while a service is cold, and an external autoscaler does the scaling. A service opts in with `service.cilium.io/scale-to-zero`. Cilium then exports a per-service gauge, `cilium_scale_to_zero_service_demand`, that an autoscaler such as KEDA reads to scale the workload to and from zero. While a tracked service sits at zero backends, the datapath holds new connections instead of rejecting them, so the first request survives the cold start. Off by default behind `--enable-scale-to-zero`. Demand is the service's live-connection count, floored to at least 1 for 90s after a datapath \"demand signal\" so the autoscaler can wake a service that is sitting at zero. How it works: - A pinned BPF hash (`cilium_scale_to_zero`, keyed by `rev_nat_index`) holds the opted-in services. The agent owns membership, the datapath only reads it and stamps a per-service, rate-limited (30s) timestamp. - The signal fires on the socket-LB forward path (every east-west translation, so short pod to ClusterIP traffic keeps demand warm) and at `lb{4,6}_local`'s `no_service` (zero-backend hit, so a cold service wakes). L7-LB services are gated out. - Holding: for a tracked, zero-backend service, `lb{4,6}_local` returns `DROP_SERVICE_SCALED_TO_ZERO` (-207) instead of `DROP_NO_SERVICE`, so callers skip the no-backend ICMP reply and the SYN is silently dropped; the client retransmits and connects once a backend appears. Socket-LB passes such connections through untranslated (`-ENXIO`) so the per-packet path performs the hold, and `ENABLE_SCALE_TO_ZERO` compiles in per-packet LB so that fallback exists under full socket-LB. Host netns keeps the fast reject, as it has no per-packet ClusterIP LB. - The controller drains signals and every 30s recomputes live connections from service conntrack (north-south) and the sock reverse-NAT map (east-west socket-LB). It checks each sock entry's cookie against live sockets, because those entries are never cleaned up on netns teardown, then publishes the gauge and prunes stale series. Limitations: - L7 (Ingress, Gateway API, `lb-l7`) not supported, Envoy bypasses the datapath lookup. - hostNetwork clients fast-reject instead of holding. ```release-note datapath: add scale-to-zero demand signalling for services behind --enable-scale-to-zero ``` AI disclosure: this PR was prepared with AIL:3. I wrote the original proof of concept by hand (attached in the CFP, #44027). I then used an AI agent to implement the hold-instead-of-reject datapath change, root-cause and fix the east-west socket-LB case (the `ENABLE_PER_PACKET_LB` gate), write the BPF and Go tests, and run the end-to-end validation on live kind clusters (KEDA and Prometheus, IPv4/IPv6, TCP/UDP/Postgres). I reviewed the code and ran the checks myself. https://github.com/user-attachments/assets/23114427-8d03-4a73-a7aa-8548f0a8997a",
"url": "https://github.com/cilium/cilium/pull/46641",
"createdAt": "2026-06-18T20:38:24Z",
"updatedAt": "2026-08-12T15:28:00Z",
"timestamp": "2026-08-12T15:28:00Z",
"metrics": {
"reactions": 3,
"comments": 5
},
"labels": [
"release-note/major",
"dont-merge/needs-rebase",
"kind/community-contribution"
],
"author": "isala404",
"state": "open",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:46695",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "WIP: pkg/kpr: Move into pkg/loadbalancer",
"url": "https://github.com/cilium/cilium/pull/46695",
"createdAt": "2026-06-23T14:57:15Z",
"updatedAt": "2026-08-13T02:13:23Z",
"timestamp": "2026-08-13T02:13:23Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"stale",
"release-note/misc",
"area/agent",
"area/loadbalancing"
],
"author": "brb",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46719",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "datapath: reimplement VLAN_FILTER using load-time config array",
"text": "Reimplement the `--vlan-bpf-bypass` allowlist using five load-time config slots instead of the compile-time `VLAN_FILTER` preprocessor macro, as proposed in #38721. The macro was generated from the VLAN subinterfaces present at agent startup. Subinterfaces created later were never added to the filter and their tagged frames were dropped until an agent restart (#45719). The slots are populated at load time and no longer depend on startup state. `allow_vlan()` and the `vlan_filter_id_*` slots move to `bpf/lib/vlan.h`. Each bpf_host object carries its own device's config, so the allowlist is per-device and the old ifindex keying is dropped. A slot of 0 allows all VLANs, 0xFFFF marks an unused slot. The five-slot limit is unchanged. Option parsing now rejects more than five entries or IDs outside 1-4094; previously this was only partially enforced. Prepared with AIL:2. I personally reviewed all changes. Fixes: #45719 Related: #38721 ```release-note --vlan-bpf-bypass now applies to VLAN subinterfaces created after the agent has started. ```",
"url": "https://github.com/cilium/cilium/pull/46719",
"createdAt": "2026-06-25T05:57:53Z",
"updatedAt": "2026-08-13T02:13:24Z",
"timestamp": "2026-08-13T02:13:24Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"stale",
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "skymensch",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46724",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "datapath: add a probe for numeric iterators",
"text": "Add a probe for numeric iterators and define the HAVE_BPF_ITER_NUM macro in features.h if the corresponding kfuncs are supported by the kernel. (This macro will be used by future patches.)",
"url": "https://github.com/cilium/cilium/pull/46724",
"createdAt": "2026-06-25T09:33:40Z",
"updatedAt": "2026-08-13T02:13:20Z",
"timestamp": "2026-08-13T02:13:20Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"stale",
"release-note/misc"
],
"author": "aspsk",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46736",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "dnsproxy: use portReleased channel to prevent EADDRINUSE on transparent mode",
"text": "## Description Under transparent DNS proxy mode (`dnsproxy-enable-transparent-mode: true`), the proxy binds upstream UDP sockets to the originating pod's `srcIP:srcPort`. Two bugs cause `EADDRINUSE` errors that cascade into DNS failures. ### Bug 1: kernel scheduling gap on port release When a `SharedClient` closes (refcount reaches zero), `conn.Close()` is called and the entry is deleted from the clients map. There is a kernel scheduling gap between `close(fd)` returning in userspace and the OS fully releasing the port. If a new request arrives during this window, it creates a new `SharedClient` for the same key and attempts to dial the same `srcIP:srcPort` β the kernel rejects the bind with `EADDRINUSE`. ### Bug 2: broken client persists in map under concurrent load When `DialContext` fails (e.g. due to Bug 1), the `SharedClient` is left in the map with `conn=nil`. Under concurrent load, multiple goroutines may have already grabbed the same client before any of them dialed. The first to detect the failure needs to evict the broken client immediately β otherwise new goroutines keep finding it in the map and failing too, cascading indefinitely. Both bugs cause: ``` level=error msg=\"Cannot forward proxied DNS lookup\" error=\"failed to dial connection to ...: dial udp srcIP:srcPort->dstIP:53: bind: address already in use\" ``` This increments `cilium_errors_warnings_total` and results in `EAI_AGAIN` in the affected pod. ## Fix ### Bug 1: `portReleased` channel Add a `portReleased` channel to `SharedClient`, closed by the closer func after `conn.Close()` completes and the entry is deleted from the map. When `GetSharedClient` finds a client with `refcount==0` (closing in progress), it waits on `portReleased` before retrying the map lookup. By the time `portReleased` is closed, the OS socket is gone and the new client can safely bind the same address. ### Bug 2: eager eviction of broken clients In `ExchangeContext`, when `DialContext` fails (`conn==nil` after exchange), immediately evict the broken client from the map via `evict()` regardless of how many concurrent holders exist. This prevents new callers from grabbing the broken client. Existing holders will also fail (they already grabbed it), but the cascade stops there. The `close(portReleased)` in the refcount==0 closer path is guarded with a `select` to prevent a panic when `evict()` has already closed it (which can happen when a concurrent holder detects failure before the last closer runs). ## Testing Three new unit tests in `shared_client_test.go`: **`TestSharedClientPortReleasedGracePeriod`** β verifies `portReleased` is not closed before the closer is called, and is closed after; verifies a subsequent client for the same key succeeds. **`TestSharedClientConcurrentSameLocalAddr`** β stress test: two goroutines hammer the same key concurrently with the same local address, verifying no EADDRINUSE errors and no deadlocks. **`TestSharedClientBrokenClientEviction`** β proves Bug 2 fix is necessary and sufficient: - Pre-acquires a dangling reference (refcount=2) before calling `sc.Exchange` - The Exchange decrements refcount 2β1 via its closer β without the fix, `dialFailedSole()` (which checked `refcount==1`) would still return false at check-time (refcount is 2 before `closer()` runs), so no eviction - Test asserts the broken client is gone from the map immediately after `Exchange` returns, not just after all closers run - Test fails with old `dialFailedSole` check; passes with new `dialFailed` check All existing `TestSharedClient*` tests continue to pass. Tests run with `-race` on Linux. Fixes #33912 ```release-note Fix cascading `bind: address already in use` errors in DNS proxy transparent mode. Two fixes: (1) a portReleased channel ensures new requests wait for the OS to fully release the previous socket before dialing; (2) broken clients (failed DialContext) are evicted from the shared-client map immediately so concurrent callers do not pile onto a permanently broken connection. ``` --- Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developer's Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. - [x] Thanks for contributing! This PR was prepared with AIL:3. I investigated the bug from production `cilium_errors_warnings_total` spikes, identified the race scenario from Cilium agent logs, traced the code path through `shared_client.go` and `proxy.go`, directed the fix implementation, reviewed all code and test changes, and verified correctness before submission. [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developer's Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/46736",
"createdAt": "2026-06-25T20:42:57Z",
"updatedAt": "2026-08-13T02:13:20Z",
"timestamp": "2026-08-13T02:13:20Z",
"metrics": {
"reactions": 2,
"comments": 14
},
"labels": [
"sig/policy",
"stale",
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "vandot",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46746",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "aws/ipam: retry prefix ENI in eligible sibling subnets before /32 falβ¦",
"text": "Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! Fixes: #46644 When ENI prefix delegation is enabled and CreateNetworkInterface fails with InsufficientCidrBlocks (subnet fragmented: free /32s but no contiguous /28 capacity), the operator previously fell back immediately to /32 in the same subnet without trying eligible sibling subnets in the same AZ. This PR refactors findSuitableSubnet to return an ordered slice of subnets (by AvailableAddresses descending) instead of a single best subnet. For non-PD cases, subnets[0] is used as before. For PD cases, CreateInterface loops through the slice attempting prefix creation on each subnet before falling back to /32 in the original subnet. - Add FindSubnetByIDsSorted and FindSubnetByTagsSorted to InstancesManager returning all matching subnets sorted by AvailableAddresses descending - Replace findSubnetInSameRouteTableWithNodeSubnet with findSubnetInSameRouteTableWithNodeSubnetSorted returning a sorted slice - In the NodeSubnetID branch, append route-table sibling subnets as retry candidates for PD fallback - Also ports the reporter's mock patch and test file to main and updates tests to assert correct post-fix behavior Automatic recovery for already-degraded nodes is deferred to a follow-up PR. AIL:3. I personally verified all code changes, test correctness, and the fix logic. ```release-note Fix ENI prefix delegation to retry sibling subnets before falling back to /32 allocation when a subnet is fragmented ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/46746",
"createdAt": "2026-06-26T09:54:18Z",
"updatedAt": "2026-08-12T18:00:44Z",
"timestamp": "2026-08-12T18:00:44Z",
"metrics": {
"reactions": 2,
"comments": 7
},
"labels": [
"area/eni",
"dont-merge/needs-release-note-label",
"kind/community-contribution",
"dont-merge/discussion"
],
"author": "nebojsaj1726",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46748",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Moved bgp config flags to bgp cell",
"text": "Decoupled BGP CP cell from the common daemon infra, moved bgp config flags from the common DaemonConfig to BGPConfig. Fixes: #45352 Signed-off-by: Dmytro Vachaiev ",
"url": "https://github.com/cilium/cilium/pull/46748",
"createdAt": "2026-06-26T10:56:16Z",
"updatedAt": "2026-08-13T02:13:17Z",
"timestamp": "2026-08-13T02:13:17Z",
"metrics": {
"reactions": 3,
"comments": 2
},
"labels": [
"stale",
"release-note/misc",
"kind/community-contribution"
],
"author": "dvachaiev",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46765",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gatewayapi: always populate listener supportedKinds in status",
"text": "## Description `validateListener` left the listener status `supportedKinds` field nil for listeners using an unsupported protocol. The Gateway API `ListenerStatus.SupportedKinds` field is serialized with `omitzero`, so a nil slice is dropped from the status entirely β the listener ended up with no `supportedKinds` key at all. The `allowedRoutes` and TLS-terminate paths already emit an explicit empty list, so the unsupported-protocol path was inconsistent. This PR: - Normalizes `supportedKinds` to an explicit (possibly empty) slice before returning, so it is always present in the listener status. - Reports the Accepted condition reason as `UnsupportedProtocol` instead of the generic `Invalid` when the protocol is not supported, per the Gateway API spec. Both the Gateway and ListenerSet reconcile paths call `validateListener`, so both are fixed. ## Testing Added `Test_gatewayReconciler_validateListener` (valid HTTP listener + unsupported-protocol listener). Full package passes: `go test ./operator/pkg/gateway-api/` β ok. ```release-note Fix Gateway API listener status to always report supportedKinds and use the UnsupportedProtocol reason for listeners with an unsupported protocol. ```",
"url": "https://github.com/cilium/cilium/pull/46765",
"createdAt": "2026-06-27T04:16:14Z",
"updatedAt": "2026-08-13T02:13:17Z",
"timestamp": "2026-08-13T02:13:17Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"stale",
"dont-merge/needs-release-note-label",
"kind/community-contribution",
"feature/k8s-gateway-api"
],
"author": "Adel-Ayoub",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46824",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Configurable FQDN DNS Proxy Redirection",
"text": "This PR makes DNS redirection to the proxy for FQDN network policies configurable and automatic, replacing hardcoded rules and manual configurations. Summary of Changes - Added new flags to specify how to locate DNS servers in the cluster (via namespace/pod labels, a list of IP addresses, or a custom port). - Implemented GetFQDNPolicyDNSSelectors (with tests) to translate the configuration flags into pod/namespace/CIDR selectors and L4 rules. - Updated KCNP parsing to use the new configurable DNS selectors instead of hardcoding kube-dns. - Auto-generate DNS egress rules for CNP/CCNP toFQDNs based on the CLI configuration, eliminating the need for users to write manual redirect policies. - (minor cleanup) Refactored kcnpParseProtocols to remove an unused error return. AI Disclosure: Parts of this pull request were authored or accelerated using Antigravity. All generated code has been fully reviewed, tested, and verified manually. I take full responsibility for the code soundness and license compliance per the Cilium AI Policy. Fixes: #46823 ```release-note Added CLI flags to configure automatic DNS redirection to the proxy for FQDN network policies. ```",
"url": "https://github.com/cilium/cilium/pull/46824",
"createdAt": "2026-06-30T20:41:39Z",
"updatedAt": "2026-08-13T10:01:39Z",
"timestamp": "2026-08-13T10:01:39Z",
"metrics": {
"reactions": 2,
"comments": 13
},
"labels": [
"release-note/minor",
"sig/policy"
],
"author": "TheBeeZee",
"state": "open",
"assignees": [
"squeed"
]
},
{
"id": "github:cilium/cilium:pull_request:46839",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "operator/ipam: recover nodes dropped from the instance cache during resync",
"text": "In ENI IPAM mode with `eni.subnetTagsFilter` set, a full ENI resync calls `DescribeNetworkInterfaces` and replaces the operator's entire instance cache with the ENIs discovered in the pod subnets. During a large scale-up, a freshly launched node whose pod subnet ENI has not been attached yet is not represented in that refreshed cache. Once the node disappears from the cache, `ResyncInterfacesAndIPs` returns \"instance not found\", `recalculate()` sets `NeededIPs=0` and stops trying to allocate, and the node stays stuck at `available=0` until the operator is restarted. This change re-triggers the node's existing per-instance `instanceSync` when a live node's instance is not in the instance cache, reusing the `HasInstance()` check that `Upsert` already performs. The check is done by the callers of `recalculate()`, where the `NodeManager` lock state is known: - `Resync` already holds the `NodeManager` mutex and passes the instances API readiness down to its `resyncNode` workers (calling `InstancesAPIIsReady()` from a worker would deadlock against the semaphore). - `MaintainIPPool` holds no locks and queries `InstancesAPIIsReady()` directly. The sync is re-triggered at most once while the instance stays missing and is re-armed by the next successful recalculation, or by a transient failure of the re-triggered sync itself. Recovery runs are tagged with a dedicated trigger reason (`instanceNotFoundSyncReason`) so that only their failures re-arm the re-trigger. If the per-instance sync authoritatively reports the instance as gone (`ErrInstanceNotFound`, e.g. Azure returning HTTP 404), the re-trigger is not re-armed; only transient failures retry. This prevents a sync retry loop for instances which were legitimately terminated but whose CiliumNode resource still exists: those get a single probe sync and then revert to the previous warn-only behavior. Unit tests exercise the recovery through the real `Resync`/`Upsert` entry points with timeout guards, acting as regression tests against re-introducing a deadlock on the `NodeManager` mutex. Fixes: #46513 _This PR was prepared with AIL:3 (AI-assisted, human-directed and verified). I reviewed the change and own it._ ```release-note operator/ipam: recover ENI IPAM nodes that were dropped from the instance cache by a full ENI resync, instead of requiring an operator restart ```",
"url": "https://github.com/cilium/cilium/pull/46839",
"createdAt": "2026-07-01T18:13:23Z",
"updatedAt": "2026-08-13T14:41:56Z",
"timestamp": "2026-08-13T14:41:56Z",
"metrics": {
"reactions": 2,
"comments": 9
},
"labels": [
"release-note/bug",
"ready-to-merge",
"kind/community-contribution",
"area/ipam",
"needs-backport/1.20"
],
"author": "ryanjwong",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46880",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ipam: Added ReservedRange To CiliumPodIPPool",
"text": "Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! CFP: https://github.com/cilium/design-cfps/pull/85 Fixes: #42466 ### **This PR includes** - Added `reservedRanges` support for `CiliumPodIPPool` CIDRs - Promote `CiliumPodIPPool` usage to the `cilium.io/v2` API. - Added a documentation for the migration flow using `reservedRanges` ### **Description** This allows operators to keep old CIDRs in a pool while preventing new allocations from those ranges during multi-pool IPAM migrations. The allocator skips any allocation CIDR that overlaps a configured reserved range This PR was prepared with AIL:2. I personally reviewed the changes and verified the reservedRanges behavior with unit tests and a kind cluster using locally rebuilt dev images. ```release-note CiliumPodIPPools now support reservedRanges for multi-pool IPAM. ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/46880",
"createdAt": "2026-07-03T08:51:36Z",
"updatedAt": "2026-08-13T16:08:15Z",
"timestamp": "2026-08-13T16:08:15Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"release-note/minor",
"kind/community-contribution",
"cilium-cli"
],
"author": "kyounghoonJang",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:46951",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "feat(endpoint): add managed endpoint table",
"text": "Add a StateDB table for Cilium-managed endpoint metadata. The table is populated from CEP/CES resources and kvstore IPIdentityPair updates, and it stores per-producer source assertions so doublewrite mode can merge equivalent CRD/CES and kvstore entries without guessing by IP, identity, or labels. Kvstore IPIdentityPair metadata now carries the CEP name written by the local endpoint. That gives kvstore entries a semantic bridge back to the CEP/CES endpoint key while preserving the existing global endpoint metadata as an alias for grouping kvstore IPv4/IPv6 entries. This is the first PR in the endpoint-table direction discussed in #46459. It intentionally stops before moving egress gateway onto the table; that consumer change will follow separately once the table shape is reviewed. Preview consumer branch, not an upstream PR: [EGW managed endpoint table consumer](https://github.com/pamelia/cilium/compare/codex%2Fmanaged-endpoint-table...codex%2Fegw-managed-endpoint-preview). The compare is against this PR's branch, so it shows only the follow-up egress gateway consumer changes. Related: #46459 ```release-note Cilium now maintains an internal StateDB table for Cilium-managed endpoint metadata from CEP/CES and kvstore sources. ``` This PR has no direct user-facing behavior change and is labeled `release-note/misc`. This PR was prepared with LLM assistance (AIL:4). I reviewed the resulting diff, kept the scope to the endpoint metadata/table layer, removed environment-specific test data, and ran focused package tests locally. Signed-off-by: Marcus Pamelia ",
"url": "https://github.com/cilium/cilium/pull/46951",
"createdAt": "2026-07-07T09:58:40Z",
"updatedAt": "2026-08-12T14:58:11Z",
"timestamp": "2026-08-12T14:58:11Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"sig/policy",
"release-note/misc",
"kind/community-contribution"
],
"author": "pamelia",
"state": "open",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:47020",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "RFC: bpf: dsr: carry DSR info on mid-flow packets that create the CT entry",
"text": "## Summary In DSR mode with Geneve dispatch, the Geneve option carrying the service VIP:port is attached only to the **SYN** of a TCP connection. A mid-flow packet that is re-routed to a **different LB node** (e.g. after an ECMP rehash on the upstream router when a BGP next-hop is added/removed) does `CT_NEW` on that new node, selects a backend via Maglev, and forwards the packet **without** the DSR option. If the Maglev table changed in the meantime, the packet reaches a backend whose node never saw the SYN and holds no reverse-xlate state. The pod replies (typically a **TCP RST** for an unknown connection); the reply takes the generic egress path, the NAT lookup misses, and the RST leaves with the **pod/node IP as source instead of the VIP**. The client silently drops it on a tuple mismatch and keeps retransmitting for the whole ECMP window instead of fast-failing. **Nothing is dropped anywhere** β every component does its job β so there is no `cilium monitor` drop event and no `cilium_drop_count_total` increment. It is a *misdelivery*, not a drop, and is invisible to the standard tooling. This is a long-standing, previously-reported behaviour: - #27730 β *\"DSR: Client can't receive RST when the backend is switched in long lived connection\"* (closed as stale). A maintainer diagnosed the exact root cause and proposed exactly this fix: *\"I think Cilium should set the dsr info into IP option or Geneve option for the non-syn packets.\"* - #32091 β *\"Cilium LB DSR reply with wrong src ip when syn packet is missed\"* (closed as stale), including a Geneve repro. The thread stalled on an MTU objection that this PR addresses below. ## What this PR does Attach the DSR info to the non-SYN packet that **creates** the CT service entry on the LB node, so the backend node can build the reverse-xlate state it never got from a SYN: - `struct ct_state` gains a `svc_entry_created` bit (from the `reserved` bitfield), set in the `CT_NEW` branch of `lb{4,6}_local()` right after a successful `ct_create{4,6}()`. - `nodeport_lb{4,6}()` propagates that bit to the DSR tail call via a new `CB_PORT_DSR_FORCE_OPT` flag stored in the high bits of `CB_PORT`. - `encap_geneve_dsr_opt{4,6}()` attaches the Geneve option when the packet is a SYN **or** when `force_opt` is set. Steady-state packets are unchanged, so there is **no extra wire cost**. - `nodeport_extract_dsr_v{4,6}()` reads the option on a non-SYN packet **only when there is no local DSR egress entry**, leaving the hot path untouched. ## Two variants / trade-offs I have two candidate implementations and would appreciate maintainer guidance on which is preferred: | | **This PR (`svc_entry_created`)** | **Alternative (option on every packet)** | |---|---|---| | Wire cost, steady state | **Zero** β option only on the entry-creating packet | +12 B/pkt (`geneve_dsr_opt4`) | | MTU budget | Unchanged | Already reserved: `DsrTunnelOverhead` in `pkg/mtu` is reserved **unconditionally**, so no change to the effective MTU | | Robustness | One-shot: if the marked packet is lost between LB and backend, no retry | Robust: any packet re-teaches the backend | | Complexity | New CT-state bit + CB flag plumbing | Removes the SYN guard; smaller diff | **On the MTU objection that stalled #32091:** for Geneve dispatch specifically, the option's 12 bytes are already accounted for unconditionally by `DsrTunnelOverhead`, so even the \"every packet\" variant does not change the MTU budget. The conservative variant in this PR costs nothing on the wire regardless. ## Test status - **Compile-verified**: `make -C bpf` builds clean in the pinned `cilium/cilium-builder` image with `-Werror -Wall -Wextra -Wshadow` and DSR enabled; `bpf_alignchecker` passes (the new `ct_state` bit does not perturb the struct layout). - BPF unit-test plan: extend the Geneve-DSR backend test (`bpf/tests/tc_nodeport_lb4_dsr_backend.c`) with a case where a **non-SYN** TCP packet carrying a Geneve DSR option arrives with **no pre-existing CT entry**, asserting that state is created and the reply is RevDNATed to the VIP (today it would early-return with no DSR info). Happy to add this in a follow-up commit here. - I have cross-node packet captures (LB node / backend node / client) demonstrating the freeze and the wrong-source RST; anonymized captures available on request. ## RFC Marking this **draft/RFC** to get direction on (a) which variant to land and (b) whether to include the test in this PR. Relates to #27730 and #32091.",
"url": "https://github.com/cilium/cilium/pull/47020",
"createdAt": "2026-07-09T10:01:55Z",
"updatedAt": "2026-08-13T02:13:12Z",
"timestamp": "2026-08-13T02:13:12Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"stale",
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "Olichous",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47034",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Add various routing fixes for ENI IPv6 support",
"text": "# What is this This PR fixes three issues with IPv6 on ENI. 1. Fixes a bug where if the health check endpoint IP is an IPv6, the ENI specific routing for IPv6 would not be configured. This removes this limitation by filling the routing table for IPv6 health endpoints. 2. When IPSec is enabled on EKS, the pod subnets are determined using the routing info CIDR. Previously only IPv4 CIDRs were parsed. Now both IPv4 and IPv6 pod subnets are filled. 3. When Ingress IP is used with IPv6 enabled, this change makes sure the routing rules are configured similar to how they are configured for IPv4. # Testing For the health check endpoint, I was able to validate that before the fix, on a node with only IPv6 enabled, the main v6 routing table was missing an entry for `lxc_health`. Following the fix, the table now shows the route to the health check endpoint: ```bash 1234:[...]::bded dev lxc_health proto kernel metric 1024 pref medium ``` And curling the endpoint shows it as reachable ```bash curl http://[1234:[...]::bded ]:4240/hello -v * Trying [1234:[...]::bded ]:4240... * Connected to 1234:[...]::bded (1234:[...]::bded ) port 4240 > GET /hello HTTP/1.1 > Host: [1234:[...]::bded ]:4240 > User-Agent: curl/8.5.0 > Accept: */* > < HTTP/1.1 200 OK < Content-Length: 0 < * Connection #0 to host 1234:[...]::bded left intact ``` For the IPSec bug, I couldn't really test it since we don't run this kind of setup. # Release note ```release-note ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. ``` This PR was prepared with AIL:2.",
"url": "https://github.com/cilium/cilium/pull/47034",
"createdAt": "2026-07-09T13:06:55Z",
"updatedAt": "2026-08-12T15:21:43Z",
"timestamp": "2026-08-12T15:21:43Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"release-note/minor",
"area/eni",
"feature/ipv6"
],
"author": "41ks",
"state": "open",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:47103",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Fix: data race for unlocked map read in regeneration goroutine",
"text": " This is a Go map concurrent read data race bug. The core issue is that a new goroutine is spawned to perform `e.isPropertyLocked()` instead of calling the API on the original goroutine ``` go func() { if !e.isPropertyLocked(endpointtypes.PropertyFakeEndpoint) { e.scrubIPsInConntrackTable() } close(datapathRegenCtxt.ctCleaned) }() ``` e.isPropertyLocked() reads e.properties (a map[string]any) without holding any lock: ``` func (e *Endpoint) isPropertyLocked(propertyKey string) bool { if v, ok := e.properties[propertyKey]; ok { ... } return false } ``` Go maps are not safe for concurrent access. If goroutine A writes e.properties while holding the lock, and this new goroutine reads e.properties without holding the lock, the Go runtime will panic with fatal error: concurrent map read and map write. The fix replaces it with e.IsProperty(), which acquires a read lock first: ``` func (e *Endpoint) IsProperty(propertyKey string) bool { e.mutex.RWMutex.RLock() defer e.mutex.RWMutex.RUnlock() return e.isPropertyLocked(propertyKey) } ``` This ensures all reads of e.properties are properly synchronized. Fixes: #issue-number ```release-note ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47103",
"createdAt": "2026-07-11T00:06:16Z",
"updatedAt": "2026-08-13T09:56:17Z",
"timestamp": "2026-08-13T09:56:17Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "weizhoublue",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47134",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "fix: Print port numbers correctly for map cilium_lb*_reverse_sk",
"text": "struct SockRevNat* is simply binary unmarshalled from ebpf map and seems to be read-only in agent, so I just keep Port network byte order Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! Fixes: #47131 ```release-note cilium-dbg: Print port numbers correctly for map cilium_lb*_reverse_sk ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47134",
"createdAt": "2026-07-13T10:01:30Z",
"updatedAt": "2026-08-12T13:53:39Z",
"timestamp": "2026-08-12T13:53:39Z",
"metrics": {
"reactions": 2,
"comments": 18
},
"labels": [
"release-note/bug",
"kind/community-contribution",
"needs-backport/1.20"
],
"author": "jayl1e",
"state": "open",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:47146",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "envoy: Support Delta ADS callbacks",
"text": "This is initial PR to add Delta ADS support in cilium proxy. Followup PR will wire up config option with delta-ads mode, update docs and helm charts and exercise new mode in ci. Forward Delta request and response callbacks through the callback chain and correlate responses by stream, type URL, and nonce. Use that state to resolve the correct pending completions for ACKs and NACKs while retaining updates across stream reconnects. Start NPHDS IPCache synchronization for Delta subscriptions. Please ensure your pull request adheres to the following guidelines: - [ ] For first time contributors, read [Submitting a pull request] - [ ] All code is covered by unit and/or runtime tests where feasible. - [ ] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [ ] All commits are signed off. See the section [Developerβs Certificate of Origin] - [ ] Provide a title or release-note blurb suitable for the release notes. - [ ] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [ ] Thanks for contributing! Fixes: #issue-number ```release-note ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47146",
"createdAt": "2026-07-13T13:30:12Z",
"updatedAt": "2026-08-13T02:13:10Z",
"timestamp": "2026-08-13T02:13:10Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"release-note/major",
"stale"
],
"author": "nezdolik",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47149",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "docs: wireguard: update Pod-to-remote-backend encryption requirements",
"text": "With https://github.com/cilium/cilium/pull/44507 this case should no longer require SocketLB, any KPR configuration will do (so that the service access is translated at the source node).",
"url": "https://github.com/cilium/cilium/pull/47149",
"createdAt": "2026-07-13T15:03:24Z",
"updatedAt": "2026-08-13T02:13:08Z",
"timestamp": "2026-08-13T02:13:08Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"area/documentation",
"stale",
"dont-merge/needs-release-note-label",
"area/loadbalancing",
"feature/wireguard",
"area/kpr"
],
"author": "julianwiedmann",
"state": "open",
"assignees": [
"julianwiedmann"
]
},
{
"id": "github:cilium/cilium:pull_request:47186",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "BPF Runtime Stats CLI",
"text": "Implementation of BPF runtime statistics reporting CLI under `cilium-dbg bpf stats report`. Enabling and disabling BPF stats collection in the kernel is done through the daemon configuration option `enable-bpf-stats`. Statistics collection is performed by querying active BPF programs attached to endpoints (mapped to Kubernetes pods), native devices, and the root cgroup using `link.QueryPrograms` (for TCX, Netkit, and cgroups), legacy TC filters, and XDP attachments. Output is returned in a formatted table or JSON (`--json`) with support for sorting and pod/device filtering. Usage: ``` $ kubectl exec -n kube-system ds/cilium -c cilium-agent -- cilium-dbg bpf stats report DEVICE POD BPF PROGRAM TYPE TOTAL RUNS TOTAL RUNTIME AVG RUNTIME lxc_health cil_from_container SchedCLS 390 0.02s 41498 ns cilium_host cil_from_host SchedCLS 2982 0.12s 41201 ns lxcadbbe9786f87 local-path-storage/local-path-provisioner-855c7b7774-6dp59 cil_from_container SchedCLS 117 0.00s 35282 ns lxceda861c714ff kube-system/coredns-589f44dc88-qc2h8 cil_from_container SchedCLS 1090 0.03s 30773 ns lxc93fdf7d05c9f kube-system/coredns-589f44dc88-b4z2p cil_from_container SchedCLS 1086 0.03s 30384 ns cilium_vxlan cil_from_overlay SchedCLS 366 0.01s 24838 ns eth0 cil_from_netdev SchedCLS 5302 0.13s 24084 ns cilium_host cil_to_host SchedCLS 170 0.00s 7566 ns cilium_vxlan cil_to_overlay SchedCLS 365 0.00s 1697 ns cilium_net cil_to_host SchedCLS 0 0.00s 0 ns ``` * https://github.com/cilium/design-cfps/pull/101 Related: #46760 ```release-note Add `cilium-dbg bpf stats report` command to collect and display eBPF program runtime statistics. ```",
"url": "https://github.com/cilium/cilium/pull/47186",
"createdAt": "2026-07-14T17:20:05Z",
"updatedAt": "2026-08-13T16:22:14Z",
"timestamp": "2026-08-13T16:22:14Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"area/datapath",
"release-note/minor",
"kind/community-contribution"
],
"author": "amchelapurath2023",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47208",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ipcache: fix CIDR reference counter to use canonical prefixes",
"text": "Policy CIDR identities are shared across namespaces via a single consolidated ipcache metadata entry, guarded only by `prefixRefCounter`. The counter was keyed by the *raw* prefix from the update, while the metadata store keys entries by the *canonical* (masked, unmapped) prefix. This mismatch lets one namespace's policy deletion release a CIDR identity that another namespace still uses. ## Reproduction - namespace-A: CiliumNetworkPolicy with `toCIDR: 10.0.0.1/24` - namespace-B: CiliumNetworkPolicy with `toCIDR: 10.0.0.0/24` (same network range, just different prefix) Counter holds `{10.0.0.1/24: 1, 10.0.0.0/24: 1}` but there is a single `10.0.0.0/24` metadata entry / identity. Deleting ns-A's policy drops its raw key to 0, tears down the shared entry, and releases the identity ns-B still references β ns-B loses traffic to `10.0.0.0/24`. The stale ns-B count also prevents recovery until an agent restart. This leads to silent traffic drops in production environments when overlapping CIDRs are deleted across namespaces. ## Changes - Key `prefixRefCounter` by `canonicalPrefix(upd.Prefix)` in both `UpsertMetadataBatch` and `RemoveMetadataBatch`, aligning it with the metadata store's existing canonical keying. - Add `TestIPCacheCIDRResourceConsolidationNonCanonical`, which fails without the fix (shared entry released after deleting one of two namespaces). ## Note This bug is introduced in this commit: 50d7f4530e first affected releases: v1.19.0, and v1.18.5",
"url": "https://github.com/cilium/cilium/pull/47208",
"createdAt": "2026-07-15T12:41:52Z",
"updatedAt": "2026-08-12T22:43:02Z",
"timestamp": "2026-08-12T22:43:02Z",
"metrics": {
"reactions": 3,
"comments": 4
},
"labels": [
"kind/bug",
"release-note/bug",
"sig/policy",
"kind/community-contribution",
"backport-done/1.18",
"backport-done/1.19",
"backport-done/1.20"
],
"author": "iwanhae",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47231",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "fix: Prevent Installation Failures When Hubble TLS Uses External Certificate Volumes",
"text": "PR #46688 introduces disableDefaultVolumes=true to let `extraVolumes/extraVolumeMounts` provide TLS certificates. Since Ciliumβs built-in certificates are no longer used, administrators do not need to configure `.Values.hubble.relay.tls.client.cert` and `.Values.hubble.relay.tls.client.key` Although these built-in secrets are no longer mounted into pod, their templates still attempt to render them. They still try to read empty `.Values.hubble.relay.tls.client.cert` and `.Values.hubble.relay.tls.client.key`, causing Secret rendering to fail: ``` kind: Secret metadata: name: hubble-relay-client-certs ... data: ca.crt: {{ .Values.tls.ca.cert }} tls.crt: {{ .Values.hubble.relay.tls.client.cert | required \"missing hubble.relay.tls.client.cert\" }} tls.key: {{ .Values.hubble.relay.tls.client.key | required \"missing hubble.relay.tls.client.key\" }} ``` Therefore, Secret generation should include a disableDefaultVolumes condition and skip these Secrets when external certificate volumes are enabled. Fixes: #issue-number ```release-note fix: Prevent Installation Failures When Hubble TLS Uses External Certificate Volumes ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47231",
"createdAt": "2026-07-16T02:31:35Z",
"updatedAt": "2026-08-12T18:38:15Z",
"timestamp": "2026-08-12T18:38:15Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"kind/bug",
"release-note/bug",
"ready-to-merge",
"area/helm",
"kind/community-contribution",
"area/hubble"
],
"author": "weizhoublue",
"state": "closed",
"assignees": [
"weizhoublue"
]
},
{
"id": "github:cilium/cilium:pull_request:47277",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Fix 5-tuple collision in conformance kind proxy embedded",
"text": "Fix test flake due to 5-tuple collision. The flake happens in `l7-lb` test that intentionally accesses the same backend via both L7-LB service and normal L3/4 load balancer service when the pod happens to use the same source port for both: 1. Access via L7-LB service works, Envoy keeps the upstream connection open on the 5-tuple with the source pod IP/port and the backend IP/port 2. Access via non-L7-LB service stalled due to CT entry keeping the `from_l7lb` flag from the previous L7-LB upstream connection, causing SYN/ACK to be redirected to Envoy. This is fixed by the bpf datapath change in the first commit. 3. Access via L7-LB service again fails due to the backend not having consistent TCP connection state with the Envoy upstream connection that is still open on the Envoy end. This is fixed by enabling retry timeouts and setting socket linger option to 0, causing the old upstream connection being closed synchronously after the timeout, so that the retry connection can re-use the same 5-tuple and negotiate a new connection with the backend This was confirmed in a local test that explicitly set the same source port for `curl`. AIL: 3 ```release-note Set `envoy.httpRetryTimeout` to one second and `envoy.httpUpstreamLingerTimeout` to zero to recover from 5-tuple collisions between L7-LB and non-L7-LB traffic. ```",
"url": "https://github.com/cilium/cilium/pull/47277",
"createdAt": "2026-07-17T11:42:40Z",
"updatedAt": "2026-08-13T14:23:16Z",
"timestamp": "2026-08-13T14:23:16Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"area/CI",
"area/proxy",
"release-note/ci",
"ci/flake",
"area/loadbalancing",
"feature/k8s-gateway-api"
],
"author": "jrajahalme",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47301",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: Enable extended masquerade port range for BPF masquerade",
"text": "Under heavy outbound egress traffic, pods undergoing BPF masquerading can experience SNAT port exhaustion when restricted to the standard port range (`32768-65535`). This is a particular concern for users migrating from Kubernetes ip-masq-agent to Cilium eBPF masquerade, because the two have different default source port ranges: - Cilium eBPF masquerade selects any port in `32768-65535` by default. - Kubernetes ip-masq-agent selects any port in `1024-65535` by default. This change introduces support for configuring an extended masquerade port range (`--node-port-nat-range-ext`, e.g. `1024,29999`) across IPv4 and IPv6 to achieve source port range parity: 1. Refactor NAT Port Ranges into Runtime Config: - Replaced compile-time `#define NODEPORT_PORT_MIN/MAX_NAT` with dynamic BPF runtime config variables (`nodeport_port_min_nat` and `nodeport_port_max_nat`). 2. Extended Masquerade Port Range Support: - Added `--node-port-nat-range-ext` CLI flag in Hive loadbalancer configuration and mapped it to Helm. - Enforced validation rules (range bounds checking, ensuring non-overlap with NodePort range and privileged ports). - Implemented random port range selection in BPF for outgoing SNAT flows. - Added automatic fallback to the alternative range if the selected port range encounters allocation exhaustion. Fixes: https://github.com/cilium/cilium/issues/23604 ```release-note bpf: Support configuring an extended masquerade port range (`--node-port-nat-range-ext`) for BPF SNAT masquerading. ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47301",
"createdAt": "2026-07-18T02:11:52Z",
"updatedAt": "2026-08-13T08:41:56Z",
"timestamp": "2026-08-13T08:41:56Z",
"metrics": {
"reactions": 2,
"comments": 10
},
"labels": [
"area/datapath",
"release-note/minor",
"kind/community-contribution"
],
"author": "yyyyyymmm",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47302",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": ".github: trigger workflow lint checks on merge_group",
"text": "Add a merge_group trigger and update the concurrency group to match other lint workflows such as lint-go.yaml. Fixes: #47262 Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47302",
"createdAt": "2026-07-18T04:06:27Z",
"updatedAt": "2026-08-12T14:52:47Z",
"timestamp": "2026-08-12T14:52:47Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"release-note/ci",
"kind/community-contribution",
"dont-merge/needs-ci-validation"
],
"author": "Avr8",
"state": "open",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:47305",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": ".github: skip embedded proxy CI for non-functional changes",
"text": "Please ensure your pull request adheres to the following guidelines: - [ ] For first time contributors, read [Submitting a pull request] - [ ] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! The `conformance-kind-proxy-embedded.yaml` Ariane workflow used a narrower `paths-ignore-regex` than comparable conformance jobs, so non-functional changes (e.g. CODEOWNERS-only changes, as seen on #46714) still triggered the workflow. This reuses the broader, comprehensive ignore pattern already used elsewhere in `ariane-config.yaml` so the embedded proxy conformance CI is skipped for changes that can't affect it. Fixes: #46716 This PR was prepared with AIL:3. I personally checked the resulting regex against the other conformance workflow filters in this file and confirmed it matches the change under `Fixes:` in issue #46716. ```release-note Skip embedded proxy conformance CI for non-functional changes ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47305",
"createdAt": "2026-07-18T09:17:33Z",
"updatedAt": "2026-08-12T14:52:19Z",
"timestamp": "2026-08-12T14:52:19Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution",
"dont-merge/needs-ci-validation"
],
"author": "AkashKumar7902",
"state": "open",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:47335",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Add zone locality info to envoy endpoints if service EndPointSlices have zone information.",
"text": "Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [ ] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! This patch adds support to cilium agent to push zone aware endpoints to the envoy configuration. It is a required step to achieve strict local zone routing with cross zone failover. Having a backend service defined as: ``` apiVersion: v1 kind: Service metadata: name: zone-consumer namespace: cilium-zone-test spec: trafficDistribution: PreferSameZone selector: app: zone-consumer ports: - port: 8080 targetPort: 8080 name: http ``` A simple CEC using this feature is the following ``` apiVersion: cilium.io/v2 kind: CiliumEnvoyConfig metadata: name: zone-locality-test namespace: cilium-zone-test spec: backendServices: - name: zone-consumer namespace: cilium-zone-test resources: - \"@type\": type.googleapis.com/envoy.config.cluster.v3.Cluster name: cilium-zone-test/zone-consumer type: EDS connect_timeout: 5s common_lb_config: zone_aware_lb_config: min_cluster_size: 2 eds_cluster_config: eds_config: resource_api_version: V3 api_config_source: api_type: GRPC transport_api_version: V3 grpc_services: - envoy_grpc: cluster_name: xds-grpc-cilium ``` The important part is the use of zone_aware_lb_config. Without this the zone info is added to EDS but cilium does not use it. The min_cluster_size is set to 2 so that even with a single instance zone awareness works The main part of the patch was is AIL2 but the testing is AIL3 [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47335",
"createdAt": "2026-07-19T11:53:57Z",
"updatedAt": "2026-08-13T05:21:08Z",
"timestamp": "2026-08-13T05:21:08Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "aristotelhs-md",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47388",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path",
"text": "When forwarding a DSR request to a remote backend, each egress path currently needs to have its own logic to extract the TCP flags and check for the SYN flag. But we already obtain the flag during the CT lookup. So let's just forward a \"need_dsr_info\" indication over the tailcall boundary, mixing it into the free part of the CB_PORT slot.",
"url": "https://github.com/cilium/cilium/pull/47388",
"createdAt": "2026-07-21T13:59:48Z",
"updatedAt": "2026-08-13T08:55:56Z",
"timestamp": "2026-08-13T08:55:56Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"release-note/misc",
"area/loadbalancing",
"feature/dsr",
"area/kpr",
"backport-done/1.20"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
]
},
{
"id": "github:cilium/cilium:pull_request:47394",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "feat(bgp): support BGP unnumbered peering (RFC 5549 / ENHE)",
"text": "- [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developer's Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! ## Description Adds interface-only (\"unnumbered\") BGP peering (RFC 5549 / ENHE) to the Cilium BGP control plane, driven through the `autoDiscovery` stanza on a peer. No `peerAddress` is configured: gobgp discovers the peer's IPv6 link-local address via ND on the interface and derives the local link-local source. This lets a Cilium node peer with a directly attached router (our case: FRR on a ToR) over a point-to-point link that carries no addressing beyond link-local. The interface can be named explicitly: ```yaml peers: - name: tor-switch peerASN: 65000 autoDiscovery: mode: Unnumbered unnumbered: interface: enp193s0f0np0 peerConfigRef: name: cilium-peer ``` For a fleet where the interface is not named the same everywhere β predictable names encode hardware location and change with the NIC model and driver, so one cluster config cannot name it, and pinning it with `CiliumBGPNodeConfigOverride` means one override object per node. For this case, we can discover using the default gateway: ```yaml peers: - name: tor-switch peerASN: 65000 autoDiscovery: mode: Unnumbered defaultGateway: addressFamily: ipv4 # \"ipv4\" or \"ipv6\" peerConfigRef: name: cilium-peer ``` Exactly one of `unnumbered` and `defaultGateway` is required with mode `Unnumbered`, enforced by CEL. In the `defaultGateway` form, only the *egress interface* of the default route is taken from the route β the peer address still comes from gobgp's ND on that interface. Two consequences worth calling out for review: - `addressFamily` selects which default route to follow, not the family the session runs over. The session is always IPv6 link-local, so following the IPv4 default route is a valid configuration. - Because the gateway address itself is unused, a link-local gateway (what an unnumbered peer usually advertises β `default via fe80::1`, or `default via 169.254.100.0`) and an on-link default route with no gateway at all are both usable here, unlike `DefaultGateway` mode. A peer whose interface cannot be derived yet β normally because the default route is not installed yet β is left unconfigured and logged at Warn once, rather than failing the reconciliation. If the route moves, the session reconciles onto the new interface. An address-less peer also needs plumbing on the agent side, included here: peer status is matched by name rather than by address (an unnumbered peer has no configured address, so address matching silently dropped it from `CiliumBGPNodeConfig` status), the address gobgp resolves is fed back into the route policies keyed on peer address (otherwise nothing is ever advertised to the peer), and `cilium bgp peers` prints the resolved zoned address without a meaningless `:port` suffix before resolution. ### Commits 1. **vendor: bump gobgp to v4.8.0 for unnumbered AddPeer fix.** the gRPC `AddPeer` path rejected interface-only neighbors, fixed upstream in [osrg/gobgp#3504](https://github.com/osrg/gobgp/pull/3504). 3. **fix(bgp): only auto-discover the default gateway from the main table.** Pre-existing `DefaultGateway` bug: a node's other tables carry default routes that are not the way off the node, often at a better metric. 4. **feat(bgp): add peerInterface field for IPv6 link-local peering.** The explicit-address counterpart to unnumbered peering β a `fe80::/10` `peerAddress` plus the interface it is reachable on, yielding a zoned neighbor. 5. **feat(bgp): support BGP unnumbered via autoDiscovery mode Unnumbered.** Routes interface-only peering through `autoDiscovery` rather than a standalone `peerInterface`, per the maintainer steer on #22132. 6. **feat(bgp): send IPv6 Router Advertisements on unnumbered interfaces.** FRR only keeps an unnumbered neighbor whose link-local it learned from that peer's RAs, and gobgp sends none. Also carries a datapath fix β RS/RA were dropped by `snat_v6_nat()` rather than punted to the stack like NS/NA. 7. **feat(bgp): discover the unnumbered interface from the default route.** The `defaultGateway` form of mode `Unnumbered`, described above. Docs for both `Unnumbered` forms, the peer-side requirements (FRR `neighbor interface remote-as `, RFC 8950 extended next hop for IPv4 over the IPv6 session), and sample `cilium bgp peers` output are in commits 2 and 6. The CRD schema version is bumped to 1.34.3. ### Testing Unit tests cover the new reconciler paths, CEL validation, conversions, status reporting and the RA reconciler. The end-to-end validation against a live cluster peered with FRR was done not from this branch but from the equivalent work backported to v1.19.x on my fork (`lab-backport-v1.19.4`). This main-targeted branch is the functional twin, adapted for main. The two are kept in deliberate lockstep: - Same behavior, adapted code β not a blind rebase. Each branch is adapted for its gobgp version and table API. - gobgp major version differs. The backport vendors the cilium/gobgp v3 fork (`vendor/.../gobgp/v3/...`) carrying the equivalent unnumbered fixes; main vendors upstream osrg/gobgp v4.8.0, which ships the `AddPeer` fix as released code. v4 keys `neighborMap` by `netip.MustParseAddr(addr)`, which parses the resolved zoned link-local correctly. - Table API rename. main uses `tables.DeviceByName`; the v1.19.x backport still uses `tables.DeviceNameIndex` / `DeviceIDIndex` (rename is main-only). This PR was prepared with AIL:2. I personally wrote or checked all code and validated the behavior end-to-end against a live cluster and DPU (on the v1.19.x backport). Fixes: #22132 ```release-note bgp: support unnumbered (interface-only, RFC 5549) BGP peering via `autoDiscovery.mode: Unnumbered`, with the peering interface either named explicitly or discovered per node from the default route, plus a `peerInterface` field for zoned IPv6 link-local peering. ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developer's Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47394",
"createdAt": "2026-07-21T16:51:52Z",
"updatedAt": "2026-08-13T14:35:55Z",
"timestamp": "2026-08-13T14:35:55Z",
"metrics": {
"reactions": 2,
"comments": 8
},
"labels": [
"dont-merge/needs-sign-off",
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "ecbaldwin",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47403",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: Add is_subnet_same_id helper",
"text": "Add is_subnet_same_id{4,6} helpers to reduce code duplication and also to skip an unneeded lookup if the first one already returns a zero id.",
"url": "https://github.com/cilium/cilium/pull/47403",
"createdAt": "2026-07-21T21:33:50Z",
"updatedAt": "2026-08-12T14:27:35Z",
"timestamp": "2026-08-12T14:27:35Z",
"metrics": {
"reactions": 4,
"comments": 1
},
"labels": [
"release-note/misc",
"kind/community-contribution"
],
"author": "mauriciovasquezbernal",
"state": "closed",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:47422",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "docs: warn that Ingress TLS termination does not support ALPN for gRPC",
"text": "Motivation: The Ingress TLS termination example does not configure ALPN protocol negotiation in the generated Envoy CiliumEnvoyConfig. gRPC requires ALPN to select the h2 protocol during the TLS handshake, so gRPC clients that correctly enforce ALPN (per the gRPC spec) fail to connect through a TLS-terminating Ingress with errors such as \"missing selected ALPN property\". The example previously worked only with `grpcurl`, which happened to mask the problem due to a grpc-go/grpc-core regression that has since been fixed upstream. A maintainer confirmed on the issue that Ingress support is being kept mostly as-is and that gRPC-over-TLS-termination should instead be documented as a Gateway API use case, since Cilium's Gateway API implementation already supports ALPN via `gatewayAPI.enableAlpn` (added in #32486). Adding equivalent ALPN support to the Ingress controller was explicitly declined for this issue. Approach: Update the Ingress TLS termination doc page to: - Note that ALPN negotiation is not supported for Ingress TLS termination, and link to the Gateway API gRPC example instead. - Remove the `grpcurl` gRPC-over-TLS-termination example snippets, since they only appeared to work due to the now-fixed grpc client bug and no longer represent a supported pattern. This is a documentation-only change; no user-visible runtime behavior changes, since Ingress TLS termination never negotiated ALPN in the first place. The change only prevents users from being misled by an example that appeared to work by accident. Validation: Manually reviewed the rendered RST for syntax consistency with other `.. Note::` blocks in Documentation/network/servicemesh/*.rst, and confirmed the `:ref:`gs_gateway_grpc`` target resolves to the label in Documentation/network/servicemesh/gateway-api/grpc.rst. Sphinx tooling (rstcheck/sphinx-build) was not available in this environment to run Documentation/check-build.sh directly. Fixes: #47206 ```release-note docs: Clarify that Ingress TLS termination does not support ALPN negotiation for gRPC, and point users to the Gateway API gRPC example instead. ``` Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> This PR was prepared with AIL:4 (AI-assisted drafting; human-directed and human-reviewed). I personally read the full rendered diff, verified the ALPN limitation described here matches the maintainer guidance in #47206 (keep Ingress as-is; point gRPC TLS-termination use cases at Gateway API), and confirmed the gs_gateway_grpc cross-reference target exists.",
"url": "https://github.com/cilium/cilium/pull/47422",
"createdAt": "2026-07-22T16:07:44Z",
"updatedAt": "2026-08-12T20:27:12Z",
"timestamp": "2026-08-12T20:27:12Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"release-note/misc",
"kind/community-contribution",
"needs-backport/1.20"
],
"author": "pujitha24",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47426",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "test(bpf): parallelize eBPF test compilation",
"text": "This PR contains some enhancements to the eBPF compilation step to help improve the eBPF test suite build time in CI (related conversation in #45133). This change updates the BPF Checks workflow step to utilize all available CPU cores in the Github Actions runner to reduce build times for eBPF test targets in CI. AI Level: 1 Fixes: nobug [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47426",
"createdAt": "2026-07-22T18:11:35Z",
"updatedAt": "2026-08-13T08:45:04Z",
"timestamp": "2026-08-13T08:45:04Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"area/datapath",
"release-note/ci",
"kind/community-contribution",
"needs-backport/1.20"
],
"author": "lconnery",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47427",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "test(bpf): parallelize eBPF test execution",
"text": "This PR contains some enhancements to the eBPF execution step to help improve the eBPF test suite speed discussed in #45133. Currently the eBPF tests are executed serially when running `make run_bpf_tests`. Each eBPF test file (.o) is loaded independently and does not share any state across the file boundary. So the test runner can be updated to load/execute these test targets in parallel to speed up the overall eBPF test suite runtime. These changes allow the tests to safely run in parallel, ensuring the test output and coverbee output do not get mixed up across goroutines. There was around an **11x improvement** in just the `go test` execution time (75 seconds vs 6 seconds). Here are some small numbers from my larger workstation (128 cpus). Commands Run: ``` # test targets were not re-built time make run_bpf_tests ``` | Strategy | Tests Execution Time (no compile) | | :--- | :--- | | Original | 1m25.520s | | Parallel Execution | 0m16.374s | The larger workstation that I am using makes these numbers look good but most workstations would see some speed up in execution time. Here is an example I created locally to show that the test debug output is not interleaved due to tests running in parallel. ``` --- FAIL: TestBPF (0.00s) --- FAIL: TestBPF/skip_lb_xlate_socket_lb.o (0.42s) bpf_test.go:354: Skipping program 'cil_sock6_sendmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock6_connect' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock_release' of type 'CGroupSock': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock4_recvmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock4_sendmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock6_recvmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock4_connect' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type --- FAIL: TestBPF/skip_lb_xlate_socket_lb.o/sock4_xlate_fwd (0.01s) bpf_test.go:605: skip_lb_xlate_socket_lb.c:92: ret: -6 bpf_test.go:605: skip_lb_xlate_socket_lb.c:93: pod_one [0100a8c0] -> svc_one [010a10ac] bpf_test.go:605: skip_lb_xlate_socket_lb.c:96: assert failed at skip_lb_xlate_socket_lb.c:96 --- FAIL: TestBPF/host_only_socket_lb_test.o (0.22s) bpf_test.go:354: Skipping program 'cil_sock4_recvmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock4_sendmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock6_connect' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock6_sendmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock4_connect' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock6_recvmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock_release' of type 'CGroupSock': BPF_PROG_RUN not supported on program type --- FAIL: TestBPF/host_only_socket_lb_test.o/sock4_xlate_fwd_test (0.01s) bpf_test.go:605: host_only_socket_lb_test.c:102: xlate_fwd: 0 bpf_test.go:605: host_only_socket_lb_test.c:103: ip 0100a8c0 bpf_test.go:605: host_only_socket_lb_test.c:104: port 7000 bpf_test.go:605: host_only_socket_lb_test.c:105: ret: 0 bpf_test.go:605: host_only_socket_lb_test.c:106: assert failed at host_only_socket_lb_test.c:106 FAIL FAIL github.com/cilium/cilium/bpf/tests/bpftest 6.062s FAIL ``` AI Level: 1 Fixes: nobug",
"url": "https://github.com/cilium/cilium/pull/47427",
"createdAt": "2026-07-22T18:11:51Z",
"updatedAt": "2026-08-13T12:14:42Z",
"timestamp": "2026-08-13T12:14:42Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"release-note/ci",
"kind/community-contribution"
],
"author": "lconnery",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47454",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "helm: reflect Socket LB override for kubeProxyReplacement",
"text": "### Description When `kubeProxyReplacement=true`, the runtime unconditionally enables Socket LB in `pkg/kpr/kpr.go`. However, the Helm chart currently renders `bpf-lb-sock` directly from `socketLB.enabled`, which defaults to `false`. As a result, the generated `cilium-config` ConfigMap can report: ```yaml bpf-lb-sock: \"false\" ``` even though Socket LB is enabled at runtime. This change updates the Helm template so that `bpf-lb-sock` is rendered as `\"true\"` whenever `kubeProxyReplacement=true`, keeping the rendered ConfigMap consistent with the runtime behavior. ### Validation Validated the rendered Helm templates locally. **Default configuration** ```bash helm template cilium ./install/kubernetes/cilium \\ | grep -E \"bpf-lb-sock|kube-proxy-replacement\" ``` Output: ```yaml kube-proxy-replacement: \"false\" bpf-lb-sock: \"false\" ``` **With `kubeProxyReplacement=true`** ```bash helm template cilium ./install/kubernetes/cilium \\ --set kubeProxyReplacement=true \\ --set socketLB.hostNamespaceOnly=true \\ --set cni.exclusive=false \\ | grep -E \"bpf-lb-sock|kube-proxy-replacement\" ``` Output: ```yaml kube-proxy-replacement: \"true\" bpf-lb-sock: \"true\" bpf-lb-sock-hostns-only: \"true\" ``` Fixes: #47417 ```release-note helm: render bpf-lb-sock as enabled when kubeProxyReplacement is enabled to match runtime behavior ``` AIL: 3. I used an LLM to help investigate the issue and review the proposed change. I manually inspected the relevant code, implemented the fix, and validated the rendered Helm templates locally.",
"url": "https://github.com/cilium/cilium/pull/47454",
"createdAt": "2026-07-24T04:09:44Z",
"updatedAt": "2026-08-13T07:30:39Z",
"timestamp": "2026-08-13T07:30:39Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "Valley-15",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47463",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api: nodeSelector with hostNetwork enabled",
"text": " As noted in #47456, the node addresses all get added when hostNetwork is enabled. If a user enables Cilium + GWAPI with hostnetwork enabled and labels a node or nodes, then only those address should populate the gateway ip address. Adding in test case to ensure functionality Fixes: #47456 ```release-note gateway-api: node label selector for when hostNetwork is enabled ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47463",
"createdAt": "2026-07-24T17:55:12Z",
"updatedAt": "2026-08-12T17:25:56Z",
"timestamp": "2026-08-12T17:25:56Z",
"metrics": {
"reactions": 2,
"comments": 6
},
"labels": [
"release-note/minor",
"dont-merge/needs-rebase",
"feature/k8s-gateway-api",
"needs-backport/1.18",
"needs-backport/1.19",
"needs-backport/1.20"
],
"author": "xtineskim",
"state": "open",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:47529",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: dsr: also send DSR info on first non-SYN packet towards new backend",
"text": "Consider scenarios where an established TCP connection switches to (a) [different backend](https://github.com/cilium/cilium/blob/d376efb53dd51c8355851ca8ddbec399bc5205f9/bpf/lib/lb.h#L2303), or (b) gets ECMP-routed through a different LB node. As we currently only send the DSR-info on the TCP-SYN packet, the newly selected backend has no way of replying with a correctly RevDNATed TCP RST. The connection therefore stalls until it times out / the client terminates it. Improve the recovery time by also sending the DSR info on a non-SYN packet, when it's going towards a newly selected backend. This is best-effort - if the DSR-info doesn't fit, we send an ICMP `FRAG_NEEDED` msg back to the client instead. ```release-note Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. ```",
"url": "https://github.com/cilium/cilium/pull/47529",
"createdAt": "2026-07-27T11:51:38Z",
"updatedAt": "2026-08-13T08:56:00Z",
"timestamp": "2026-08-13T08:56:00Z",
"metrics": {
"reactions": 3,
"comments": 12
},
"labels": [
"area/datapath",
"release-note/minor",
"feature/dsr",
"area/kpr",
"backport-done/1.20"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
]
},
{
"id": "github:cilium/cilium:pull_request:47558",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "network driver: use statedb to manage agent devices",
"text": "using statedb to manage the agent state for devices removed the map based state tracking for allocations, replacing it with a statedb table cilium-dbg output: ``` -- [ { \"Name\": \"dummy0\", \"Manager\": \"\\\"dummy\\\"\", \"Dev\": { \"Name\": \"dummy0\", \"HWAddr\": \"\", \"MTU\": 0, \"Flags\": \"\" }, \"Pool\": \"dt-dummy\", \"Attrs\": [ { \"k\": \"ifName\", \"v\": { \"string\": \"dummy0\" } }, { \"k\": \"kernelIfName\", \"v\": { \"string\": \"dummy0\" } } ], \"PodUID\": \"0fdc978d-c34b-40b9-9284-19506c5be5b0\", \"ClaimUID\": \"38d14248-58c3-4d0c-ba1c-60793681f656\", \"Config\": { \"podIfName\": \"dmy0\" } }, { \"Name\": \"dummy1\", \"Manager\": \"\\\"dummy\\\"\", \"Dev\": { \"Name\": \"dummy1\", \"HWAddr\": \"\", \"MTU\": 0, \"Flags\": \"\" }, \"Pool\": \"dt-dummy\", \"Attrs\": [ { \"k\": \"ifName\", \"v\": { \"string\": \"dummy1\" } }, { \"k\": \"kernelIfName\", \"v\": { \"string\": \"dummy1\" } } ], \"PodUID\": \"\", \"ClaimUID\": \"\", \"Config\": {} } ] ``` ```release-note network driver: use statedb to manage agent state ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail AIL3 - bot wrote code; human reviewed, adjusted and tested [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47558",
"createdAt": "2026-07-28T08:58:01Z",
"updatedAt": "2026-08-12T15:37:27Z",
"timestamp": "2026-08-12T15:37:27Z",
"metrics": {
"reactions": 2,
"comments": 13
},
"labels": [
"release-note/misc",
"dont-merge/discussion",
"area/dra-plugin"
],
"author": "bersoare",
"state": "open",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:47568",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "datapath/linux: return orphaned node ID to pool on partial remap",
"text": "- [x] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] All commits are signed off. See the section [Developer's Certificate of Origin](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#developer-s-certificate-of-origin) - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy](https://github.com/cilium/community/blob/main/AI-POLICY.md), and indicate the rating using [AI Influence Level](https://danielmiessler.com/blog/ai-influence-level-ail). This PR was prepared with **AIL:3** (AI Created, Human Full Structure) β I directed the investigation and the fix approach, and reviewed the diff, root-cause analysis, and test before submission. `allocateIDForNode`'s inconsistent-mapping recovery path unmaps all IPs of a node when it finds them pointing to different node IDs, then retries allocation. `unmapNodeID` removes the IP<>ID mappings but never returned the ID itself to the free pool once it had no IPs left, unlike `deallocateNodeIDLocked` (used only on full node deletion). This can happen whenever a node's `IPAddresses` contain an IP shared across nodes (e.g. a shared `--local-router-ipv4`), since it lets a later node's addresses resolve to an earlier node's ID and trigger the recovery path. Each occurrence orphans one node ID, so the ID pool (65535 entries) is silently exhausted over time, well before the actual node count would justify it β eventually logging `\"No more IDs available for nodes\"`, as reported in #47563. **Fix:** return the ID to the pool in `unmapNodeID` itself when it removes the last remaining IP for that ID. This covers the partial-remap path in addition to the existing full-deletion path (which already re-inserts the same ID again there, harmlessly, since `idpool.Insert` is a no-op on an ID that's already available). **Testing:** added `TestNodeIDLeakOnSharedRouterIP`, which reproduces the leak with a 2-ID pool: without the fix it fails with the same `\"no available node ID\"` error as the reported bug; with the fix, the orphaned ID is correctly freed and reused. Verified this locally (reverted the fix, confirmed the test fails with that exact error; restored it, confirmed it passes) before submitting. Fixes: #47563 ```release-note Fix a node ID leak that could exhaust the node ID pool over time when a node's IP addresses (e.g. a shared local router IP) caused the inconsistent-mapping recovery path in the node ID allocator to run. ```",
"url": "https://github.com/cilium/cilium/pull/47568",
"createdAt": "2026-07-28T14:36:31Z",
"updatedAt": "2026-08-13T16:01:47Z",
"timestamp": "2026-08-13T16:01:47Z",
"metrics": {
"reactions": 2,
"comments": 21
},
"labels": [
"release-note/bug",
"kind/community-contribution"
],
"author": "zanarellidev",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47571",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "operator: continue identity GC after update races",
"text": "Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo) - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Write a short paragraph that states whether you used machine learning models (including LLMs and other generative AI), and indicate the rating using [AI Influence Level](https://danielmiessler.com/blog/ai-influence-level-ail). - [x] Thanks for contributing! CRD identity GC first annotates an unused identity, then deletes it on a later pass. If that identity is updated, deleted, or replaced after it is read from the local store, the annotation update can return a conflict or not-found error. The current code aborts the entire GC pass, so frequent identity churn can prevent unrelated stale identities later in the scan from progressing toward deletion. This change treats those two recoverable races like the existing delete-conflict path: it logs a warning and defers only the raced identity to the next pass. Other API errors still fail the GC run, preserving the signal for systemic control-plane failures. Validation: - `go test ./operator/identitygc` - `gofmt` and `git diff --check` This PR was prepared with AIL:4. The resulting diff was reviewed against the existing GC conflict handling and validated with the focused unit test before submission. ```release-note Prevent concurrent CRD identity updates from aborting an entire identity garbage-collection pass. ```",
"url": "https://github.com/cilium/cilium/pull/47571",
"createdAt": "2026-07-28T18:01:25Z",
"updatedAt": "2026-08-12T15:16:38Z",
"timestamp": "2026-08-12T15:16:38Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "hbagdi",
"state": "open",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:47587",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "docs: clarify GAMMA DROP_EP_NOT_READY events",
"text": "During workload churn, Hubble may report `DROP_EP_NOT_READY` when Envoy upstream TCP connections outlive the source endpoint. The behavioral change submitted in https://github.com/cilium/cilium/pull/46508 would likely add too much complexity for a somewhat cosmetic issue. This PR instead adds a note to the GAMMA docs to mention this caveat. Related to: #41970",
"url": "https://github.com/cilium/cilium/pull/47587",
"createdAt": "2026-07-29T17:30:59Z",
"updatedAt": "2026-08-12T22:42:25Z",
"timestamp": "2026-08-12T22:42:25Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"area/documentation",
"ready-to-merge",
"release-note/misc",
"area/servicemesh",
"feature/k8s-gateway-api",
"backport-done/1.20"
],
"author": "thorn3r",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47592",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: dsr: only require DSR-info on SYN packet",
"text": "``` The DSR ingress path on a remote node currently expects DSR-info on both the SYN *and* the SYN-ACK. And clears the connection's DSR status if either of those packets doesn't carry DSR info. But it should actually be fine for the LB node to only send the DSR info on the SYN packet. So let's relax this check accordingly, and not require DSR info on the SYN-ACK. ``` https://github.com/cilium/cilium/pull/47594 highlighted this problematic part in the backend node's ingress path. If we patch this now, a future version of Cilium can stop inserting the DSR info in the SYN-ACK.",
"url": "https://github.com/cilium/cilium/pull/47592",
"createdAt": "2026-07-30T08:04:29Z",
"updatedAt": "2026-08-13T08:56:14Z",
"timestamp": "2026-08-13T08:56:14Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"area/datapath",
"release-note/misc",
"feature/dsr",
"area/kpr",
"backport-done/1.20"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
]
},
{
"id": "github:cilium/cilium:pull_request:47593",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: dsr: fix CT update in remote note's ingress path",
"text": "When a DSR-enabled node receives a TCP packet with SYN flag but *without* DSR info, it updates the connection's DSR status to 'false'. This addresses scenarios where a connection is re-opened by the same client, but this time directly towards the backend (without a service inbetween). But since we're using a CT tuple that hasn't been used for a CT lookup, its direction flag isn't set yet. And so the call to ct_update_dsr() is not effective, since it doesn't even find the expected CT entry. Fix this by setting the TUPLE_F_OUT manually. ```release-note Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. ```",
"url": "https://github.com/cilium/cilium/pull/47593",
"createdAt": "2026-07-30T08:33:23Z",
"updatedAt": "2026-08-13T08:56:11Z",
"timestamp": "2026-08-13T08:56:11Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"kind/bug",
"area/datapath",
"release-note/bug",
"ready-to-merge",
"backport/author",
"feature/dsr",
"area/kpr",
"backport-done/1.20"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
]
},
{
"id": "github:cilium/cilium:pull_request:47640",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: dsr: don't look for TCP header on fragmented packets",
"text": "Trying to parse TCP header flags from a fragmented packet will only return garbage.",
"url": "https://github.com/cilium/cilium/pull/47640",
"createdAt": "2026-07-31T13:59:48Z",
"updatedAt": "2026-08-13T08:56:09Z",
"timestamp": "2026-08-13T08:56:09Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"kind/bug",
"release-note/bug",
"backport/author",
"feature/dsr",
"area/kpr",
"backport-done/1.20"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
]
},
{
"id": "github:cilium/cilium:pull_request:47643",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "pkg/mtu: Add fallback to MTU of 1500 and identify the primary ENI by device index",
"text": "In ENI IPAM mode the MTU auto detection excludes the secondary ENIs, which are managed by Cilium, and derives the base MTU from the primary ENI only. The primary ENI was told apart from the secondary ones by comparing ENI.IP with the first NodeInternalIP of the CiliumNode. ENI.IP is the primary private IPv4 address of the ENI, as reported by the EC2 API, so on a node whose first NodeInternalIP is an IPv6 address no ENI ever matched and every device was excluded, including the primary one. With no device left, the base MTU stayed at its MaxMTU initializer and Cilium tried to configure an MTU of 65520, which the ENA driver rejects. Use the ENI device index instead, as the AWS IPAM code already does. It is address family agnostic and does not depend on the ordering of the node addresses. This also adds a fallback to the default Ethernet MTU (1500 bytes) when no device is left to detect the MTU from, so that a filtering mistake cannot result in an unusable MTU again. **This part impacts all IPAM modes not just ENI IPAM.** This PR was prepared with AIL:3. ```release-note pkg/mtu: Added a fallback to an MTU of 1500 bytes if no network devices are selected for MTU detection. Fixed a bug where Cilium would fail to find the appropriate MTU to use when in IPAM ENI mode with IPv6 enabled. ```",
"url": "https://github.com/cilium/cilium/pull/47643",
"createdAt": "2026-07-31T15:07:36Z",
"updatedAt": "2026-08-13T05:09:45Z",
"timestamp": "2026-08-13T05:09:45Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"release-note/bug"
],
"author": "41ks",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47651",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "policy: Implement Shared Policy LPM Trie map",
"text": "This patch implements a globally shared LPM Trie policy map (`cilium_policy_shared`) alongside a local overlay hash map (`cilium_policy_overlay`) mapping endpoint IDs to Rule Set IDs. This replaces legacy per-endpoint BPF policy maps, significantly reducing kernel control-plane memory footprint (~97.6% savings) and BPF map count (from O(Endpoints) to O(1)), preventing file descriptor exhaustion on large scale nodes. Key Features & Fixes: 1. Node-scoped shared LPM trie (`cilium_policy_shared`) and endpoint overlay map (`cilium_policy_overlay`). 2. eBPF lookup logic in `bpf/lib/policy.h` with multi-tier precedence evaluation and explicit zero-initialization for eBPF stack bitfield alignment. 3. User-space `RuleSetAllocator` in Go managing Rule Set ID allocations, refcounting, deduplication, and automatic cleanup of unused rule sets. 4. Complete skipping of per-endpoint `cilium_policy_v3_*` maps when `--enable-shared-policy=true` is enabled. 5. End-to-end support for L3/L4 selectors, L7 Envoy proxy redirection, Ingress Deny rules, Entity policies, FQDNs, CCNPs, K8s NetworkPolicies, Named Ports, and Port Ranges. Fixes: #45118 The core architecture, feature design, and implementation strategy for the Shared Policy LPM Trie map were made by me. AI assistance (Gemini / Antigravity) was utilized during development for some code support, test script generation, edge-case auditing, and live container datapath benchmark execution. All generated code, logic, and test results were carefully reviewed, audited, and verified by me.",
"url": "https://github.com/cilium/cilium/pull/47651",
"timestamp": "2026-08-12T12:42:37Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"dont-merge/needs-release-note-label"
],
"author": "tsotne95",
"assignees": [],
"change": "new"
},
{
"id": "github:cilium/cilium:pull_request:47677",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: stop dropping MLD and router solicitation sent from pods",
"text": "Pods keep showing up in Hubble as dropping their own ICMPv6 traffic with \"Invalid source ip\". The source is always the link local address that the kernel gives the pod interface, and the messages are the MLD reports and router solicitations that the kernel sends on its own. The from container path lets neighbour solicitation and neighbour advertisement past the source IP check and nothing else, so all of this gets treated as spoofed. The packets are link scoped and cannot reach anything anyway, so nothing is actually broken, but the drop counters and flow logs make it look like the pod is misbehaving. This change lets MLD and router solicitation through when the source is a link local or unspecified address and the destination is a link local scope multicast group. Those packets go to the stack instead of being routed anywhere. Router advertisement and redirect are deliberately left out, since a pod has no reason to send either one and both are useful to an attacker. There is a new BPF unit test with six cases, three that should now pass and three that must stay dropped. I checked it works both ways by reverting each half of the change and watching only the matching tests fail. Fixes: #47645 ```release-note Stop dropping MLD and router solicitation messages that pods send from their kernel assigned link local address when source IP verification is enabled ``` This PR was prepared with AIL:4. I reviewed the datapath change, and ran the BPF unit tests and checkpatch locally.",
"url": "https://github.com/cilium/cilium/pull/47677",
"createdAt": "2026-08-02T20:27:52Z",
"updatedAt": "2026-08-13T13:03:16Z",
"timestamp": "2026-08-13T13:03:16Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "ssam18",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47678",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "chore(deps): update all-dependencies (v1.20)",
"text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [docker.io/library/ubuntu](https://hub.docker.com/_/ubuntu) ([source](https://git.launchpad.net/cloud-images/+oci/ubuntu-base)) | final | digest | `3131b4c` β `678c655` | | quay.io/cilium/cilium-bpftool | stage | patch | `7.7.0-1782898005-bed4da5` β `7.7.0-1785833026-d8383c5` | | quay.io/cilium/cilium-llvm | stage | patch | `19.1.7-1782898005-bed4da5` β `19.1.7-1785833026-d8383c5` | | quay.io/cilium/image-tester | final | major | `1785158849-4e7b7fc` β `1785710666-8cd4afc` | | quay.io/cilium/iptables | stage | patch | `1.8.8-1-1782898005-bed4da5` β `1.8.8-1-1785833026-d8383c5` | --- ### Configuration π
**Schedule**: (UTC) - Branch creation - \"on sunday\" - Automerge - At any time (no schedule defined) π¦ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β» **Rebasing**: Never, or you tick the rebase/retry checkbox. π» **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). ",
"url": "https://github.com/cilium/cilium/pull/47678",
"createdAt": "2026-08-02T20:49:44Z",
"updatedAt": "2026-08-12T15:31:26Z",
"timestamp": "2026-08-12T15:31:26Z",
"metrics": {
"reactions": 2,
"comments": 18
},
"labels": [
"kind/enhancement",
"kind/backports",
"release-note/misc",
"kind/community-contribution",
"renovate/stop-updating",
"backport/1.20"
],
"author": "cilium-renovate[bot]",
"state": "closed",
"assignees": [
"joestringer"
],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:47679",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "chore(deps): update all-dependencies (v1.19)",
"text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [docker.io/library/ubuntu](https://hub.docker.com/_/ubuntu) ([source](https://git.launchpad.net/cloud-images/+oci/ubuntu-base)) | final | digest | `4fbb8e6` β `561618e` | | quay.io/cilium/cilium-bpftool | stage | patch | `7.7.0-1782898005-bed4da5` β `7.7.0-1785833026-d8383c5` | | quay.io/cilium/cilium-llvm | stage | patch | `19.1.7-1782898005-bed4da5` β `19.1.7-1785833026-d8383c5` | | quay.io/cilium/image-compilers | stage | major | `1782994507-725357c` β `1785833026-d8383c5` | | quay.io/cilium/image-tester | final | major | `1785158849-4e7b7fc` β `1785710666-8cd4afc` | | quay.io/cilium/iptables | stage | patch | `1.8.8-1-1782898005-bed4da5` β `1.8.8-1-1785833026-d8383c5` | --- ### Configuration π
**Schedule**: (UTC) - Branch creation - \"on sunday\" - Automerge - At any time (no schedule defined) π¦ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β» **Rebasing**: Never, or you tick the rebase/retry checkbox. π» **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). ",
"url": "https://github.com/cilium/cilium/pull/47679",
"createdAt": "2026-08-02T20:50:20Z",
"updatedAt": "2026-08-12T18:42:23Z",
"timestamp": "2026-08-12T18:42:23Z",
"metrics": {
"reactions": 2,
"comments": 9
},
"labels": [
"kind/enhancement",
"kind/backports",
"release-note/misc",
"kind/community-contribution",
"renovate/stop-updating",
"backport/1.19"
],
"author": "cilium-renovate[bot]",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47695",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "cilium-cli/connectivity: detect Cilium version in connectivity perf setup",
"text": "`cilium connectivity perf` always reports \"Cilium version: 0.0.0\" in its info banner, regardless of the actual Cilium version running in the cluster. `setupAndValidatePerf()`, the setup path used by the `perf` subcommand, never calls `initCiliumPods()`/`detectCiliumVersion()`, unlike `setupAndValidate()` (used by `connectivity test`). `CiliumVersion` is therefore left at its Go zero value, which prints as `0.0.0`. This calls the same two steps `setupAndValidate()` already uses, in the same order, so `CiliumVersion` is populated before it's printed in `connectivity.Run()`. Tested manually against an RKE2 cluster (Cilium v1.19.4): - before the fix, `cilium connectivity perf` reported \"Cilium version: 0.0.0\" - after the fix, it correctly reports \"Cilium version: 1.19.4\" ```release-note Fixed `cilium connectivity perf` always reporting `Cilium version: 0.0.0` instead of the actual detected Cilium version.",
"url": "https://github.com/cilium/cilium/pull/47695",
"createdAt": "2026-08-03T10:04:52Z",
"updatedAt": "2026-08-13T07:54:54Z",
"timestamp": "2026-08-13T07:54:54Z",
"metrics": {
"reactions": 2,
"comments": 8
},
"labels": [
"release-note/bug",
"kind/community-contribution",
"cilium-cli",
"cilium-cli-exclusive"
],
"author": "khaddict",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47732",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api: filter CEC controls from infrastructure metadata",
"text": "Gateway and GAMMA infrastructure annotations originate from user-controlled resources and are propagated to generated CiliumEnvoyConfig metadata. This allowed those resources to set reserved cec.cilium.io controls that affect proxy and policy behavior. Filter the complete CEC annotation namespace while decorating generated CECs. Preserve internally generated CEC annotations and leave the source map unchanged for the generated Service. Fixes: #issue-number [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47732",
"createdAt": "2026-08-04T12:50:18Z",
"updatedAt": "2026-08-13T04:03:39Z",
"timestamp": "2026-08-13T04:03:39Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"release-note/bug",
"ready-to-merge",
"feature/k8s-gateway-api"
],
"author": "nezdolik",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47741",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "address httpUpstreamLingerTimeout chart templating issues",
"text": " Fixes: #47740 ```release-note envoy.httpUpstreamLingerTimeout accepts `0` as a chart value and templates into configmap. ``` Changes: * Helm chart accepts a value of `0` for `envoy.httpUpstreamLingerTimeout` * Helm chart templates value of `0` into configmap cc @jrajahalme [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47741",
"createdAt": "2026-08-04T14:11:35Z",
"updatedAt": "2026-08-12T22:42:28Z",
"timestamp": "2026-08-12T22:42:28Z",
"metrics": {
"reactions": 3,
"comments": 6
},
"labels": [
"release-note/bug",
"ready-to-merge",
"area/helm",
"kind/community-contribution",
"backport-done/1.20"
],
"author": "jdw6359",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47754",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "fix: allow setting endpointPolicyUpdateTimeoutDuration in helm",
"text": "In helm, `endpointPolicyUpdateTimeoutDuration` defaulted to null , so the generated values.schema.json typed it as \"null\" only. Helm validates --set /values input against this schema before rendering, so any real duration string (e.g. \"30s\" ) was rejected on install/upgrade. so, widen the schema to string so an explicit duration reaches the ConfigMap template. ```release-note fix: allow setting endpointPolicyUpdateTimeoutDuration in helm ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47754",
"createdAt": "2026-08-05T00:42:57Z",
"updatedAt": "2026-08-12T22:42:26Z",
"timestamp": "2026-08-12T22:42:26Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"release-note/bug",
"ready-to-merge",
"area/helm",
"kind/community-contribution",
"backport-done/1.20"
],
"author": "weizhoublue",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47758",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api: remove unnecessary TLSRoute support checks",
"text": "TLSRoute support is already mandatory, but the Gateway API controller still carried helper functions and conditional logic for treating it as optional. Remove the obsolete HasTLSRouteSupport helper and the remaining reconcile branches that skipped TLSRoute listing and status updates when the CRD was not present. This keeps the implementation aligned with the current mandatory TLSRoute requirement and removes dead fallback logic.",
"url": "https://github.com/cilium/cilium/pull/47758",
"createdAt": "2026-08-05T07:08:28Z",
"updatedAt": "2026-08-12T22:42:31Z",
"timestamp": "2026-08-12T22:42:31Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"kind/bug",
"ready-to-merge",
"release-note/misc",
"area/servicemesh",
"feature/k8s-gateway-api",
"backport-done/1.20"
],
"author": "mhofstetter",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47763",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "egressgateway: react to local device/address changes",
"text": "Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. - [x] Thanks for contributing! ## Description of change As per the [docs](https://docs.cilium.io/en/latest/network/egress-gateway/egress-gateway/): > After Cilium has selected the network interface and Egress IP for an Egress Gateway policy (or failed to do so), it > does not automatically respond to a change in the gateway nodeβs network configuration (for example if an IP > address is added or deleted). You can force a fresh selection by re-applying the Egress Gateway policy. Cilium does not react to changes of Node interfaces/IPs, the code for this reconciliation is already present but only triggers on updates to `CiliumEgressGatewayPolicy`, `CiliumNode` and `CiliumEndpoint` changes, plus the initial k8s sync. This PR simply adds another trigger to this already existing reconciliation logic, by subscribing the egress manager to changes in the statedb `Device` table. With this in place, my testing shows that IPs added/removed from nodes are near instantly picked up and acted upon. ### Testing AI generated and verified tests: - `go build` / `go vet` on `pkg/egressgateway/` β clean. - New privileged test `TestPrivilegedDeviceTableTriggersReconcile`. AI generated but extensively human verified tests: - Validated on a live Talos cluster via A/B: A CEGP is created, a corresponding IP is added to the matching node but the `bpf egress list` continues to show `Egress IP 0.0.0.0`. Once I switch to an image built based on this PR, the IP change is detected by Cilium and the `bpf egress list` is updated accordingly. This testing has mainly been done with: [This script](https://github.com/cilium/cilium/issues/47761#issuecomment-5189815765) @joestringer says to `highlight any specific areas that you would like feedback from reviewers about`, this is a fairly small PR and I don't really have any such areas. Most important to me is that I want to deliver a PR that is as actionable and helpful to the dev team as possible. Fixes: #47761 ```release-note egressgateway: reconcile when a CiliumEgressGatewayPolicy's egress IP is added, removed, or moved between node interfaces,, so a CiliumEgressGatewayPolicy no longer stays black-holed until an unrelated event triggers a reconcile. ``` This PR was prepared with AIL:3. AI assistance was used to draft the implementation and the privileged test; I personally reviewed the code, confirmed it builds and vets, and validated the fix and its reproduction on a live Talos cluster via A/B testing against stock vs patched images and wrote this PR description. [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47763",
"createdAt": "2026-08-05T09:20:04Z",
"updatedAt": "2026-08-13T15:26:45Z",
"timestamp": "2026-08-13T15:26:45Z",
"metrics": {
"reactions": 2,
"comments": 7
},
"labels": [
"release-note/minor",
"kind/community-contribution"
],
"author": "farthinder",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47766",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api: mark unresolved backend service ports in route status",
"text": "Mark backend references with unknown Service ports as unresolved during shared Gateway API route validation. So far, shared backend validation only checked whether the referenced backend Service exists. If the Service was present but the referenced `backendRef.port` was not exposed by that Service, the route could still end up with `ResolvedRefs=True` and the failure would only surface later during translation or dataplane programming. Fix this by extending the shared backend validation to also verify that the referenced Service port exists on the resolved backend Service. When it does not, set `ResolvedRefs=False` with `BackendNotFound` and a message that points at the missing Service port. This keeps route status aligned with the actual backend resolution state across all route types that use the shared backend validation path.",
"url": "https://github.com/cilium/cilium/pull/47766",
"createdAt": "2026-08-05T11:13:16Z",
"updatedAt": "2026-08-12T22:42:34Z",
"timestamp": "2026-08-12T22:42:34Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"kind/bug",
"release-note/bug",
"ready-to-merge",
"area/servicemesh",
"feature/k8s-gateway-api",
"backport-done/1.20"
],
"author": "mhofstetter",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47776",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ci: replace unsupported LLVM installation action",
"text": "Replace the unsupported LLVM installer action in the lint and integration test workflows with a local Bash composite action. The local action preserves: - LLVM 19.1.7 installation - X64 and ARM64 archive selection - LLVM path and library environment exports - installed Clang version verification After #47780 restored LLVM and Clang installation in `integration-test.yaml`, this PR also migrates that restored occurrence to the local composite action. This PR intentionally contains only changes shared by the maintained stable branches so the patch can be backported cleanly to v1.17, v1.18, v1.19, and v1.20. Validation: - the composite action and both changed workflows parse successfully as YAML - `git diff --check` passes This is the backportable portion of the workflow migration originally submitted in #47738.",
"url": "https://github.com/cilium/cilium/pull/47776",
"createdAt": "2026-08-05T15:44:31Z",
"updatedAt": "2026-08-13T15:47:32Z",
"timestamp": "2026-08-13T15:47:32Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"release-note/ci",
"kind/community-contribution",
"affects/v1.17",
"needs-backport/1.18",
"needs-backport/1.19",
"dont-merge/needs-ci-validation",
"needs-backport/1.20"
],
"author": "bogdankrasko",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47780",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Revert \"gha: don't install LLVM and Clang in integration tests workflow\"",
"text": "This reverts commit c215742d866ef342303dcf224db69b29565c8885. The reverted commit removed the installation of LLVM and Clang from the integration tests workflow, under the assumption that they are not needed to run the Go based integration tests. However, it turns out that the TestObjectCache{,Parallel} tests actually invoke the compilation of a BPF program. Yet, I had not noticed it while testing the PR previously, as likely the GHA image includes Clang installed, and the version happens to be close enough to not cause failures. Let's restore the explicit LLVM and Clang installation step, to prevent the risk of breakages due to version changes, or if the GHA image doesn't include them. The \"Setup additional repositories\" steps is not restored though, as it was only needed for libtinfo5, and it is also fragile as it depends on runner names. AIL: 0",
"url": "https://github.com/cilium/cilium/pull/47780",
"createdAt": "2026-08-05T16:15:46Z",
"updatedAt": "2026-08-12T22:42:58Z",
"timestamp": "2026-08-12T22:42:58Z",
"metrics": {
"reactions": 2,
"comments": 7
},
"labels": [
"release-note/ci",
"backport-done/1.18",
"backport-done/1.19",
"backport-done/1.20"
],
"author": "giorio94",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47784",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ci: use GitHub App client ID in v1.17 image workflow",
"text": "## Summary - replace the deprecated `app-id` input with `client-id` in the v1.17 image workflow - use `AUTO_COMMENT_CLIENT_APP_ID` for the corresponding GitHub App credential ## Why The v1.17 workflow on `main` handles pull requests targeting the v1.17 branch. Keeping this change isolated allows the same one-file patch to be backported only to v1.17, where the corresponding workflow handles branch pushes. Requested backport target: `v1.17` only. ## Validation - changed workflow parses as valid YAML - `git diff --check`",
"url": "https://github.com/cilium/cilium/pull/47784",
"createdAt": "2026-08-05T17:51:36Z",
"updatedAt": "2026-08-13T07:23:53Z",
"timestamp": "2026-08-13T07:23:53Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"release-note/ci",
"kind/community-contribution",
"dont-merge/needs-ci-validation",
"area/renovate"
],
"author": "bogdankrasko",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47785",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ci: use GitHub App client ID in v1.18 image workflow",
"text": "## Summary - replace the deprecated `app-id` input with `client-id` in the v1.18 image workflow - use `AUTO_COMMENT_CLIENT_APP_ID` for the corresponding GitHub App credential ## Why The v1.18 workflow on `main` handles pull requests targeting the v1.18 branch. Keeping this change isolated allows the same one-file patch to be backported only to v1.18, where the corresponding workflow handles branch pushes. Requested backport target: `v1.18` only. ## Validation - changed workflow parses as valid YAML - `git diff --check`",
"url": "https://github.com/cilium/cilium/pull/47785",
"createdAt": "2026-08-05T17:52:00Z",
"updatedAt": "2026-08-13T09:25:57Z",
"timestamp": "2026-08-13T09:25:57Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"release-note/ci",
"kind/community-contribution",
"dont-merge/needs-ci-validation",
"area/renovate"
],
"author": "bogdankrasko",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47786",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ci: use GitHub App client ID in v1.19 image workflow",
"text": "## Summary - replace the deprecated `app-id` input with `client-id` in the v1.19 image workflow - use `AUTO_COMMENT_CLIENT_APP_ID` for the corresponding GitHub App credential ## Why The v1.19 workflow on `main` handles pull requests targeting the v1.19 branch. Keeping this change isolated allows the same one-file patch to be backported only to v1.19, where the corresponding workflow handles branch pushes. Requested backport target: `v1.19` only. ## Validation - changed workflow parses as valid YAML - `git diff --check`",
"url": "https://github.com/cilium/cilium/pull/47786",
"createdAt": "2026-08-05T17:52:08Z",
"updatedAt": "2026-08-13T09:25:33Z",
"timestamp": "2026-08-13T09:25:33Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"release-note/ci",
"kind/community-contribution",
"dont-merge/needs-ci-validation",
"area/renovate"
],
"author": "bogdankrasko",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47787",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ci: use GitHub App client ID in v1.20 image workflow",
"text": "## Summary - replace the deprecated `app-id` input with `client-id` in the v1.20 image workflow - use `AUTO_COMMENT_CLIENT_APP_ID` for the corresponding GitHub App credential ## Why The v1.20 workflow on `main` handles pull requests targeting the v1.20 branch. Keeping this change isolated allows the same one-file patch to be backported only to v1.20, where the corresponding workflow handles branch pushes. Requested backport target: `v1.20` only. ## Validation - changed workflow parses as valid YAML - `git diff --check`",
"url": "https://github.com/cilium/cilium/pull/47787",
"createdAt": "2026-08-05T17:52:24Z",
"updatedAt": "2026-08-13T09:36:07Z",
"timestamp": "2026-08-13T09:36:07Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"release-note/ci",
"kind/community-contribution",
"dont-merge/needs-ci-validation",
"area/renovate"
],
"author": "bogdankrasko",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47788",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ci: replace needs-attention action and use app client ID",
"text": "## Summary - replace `hramos/needs-attention` with pinned `actions/github-script@v9` logic - preserve the existing issue-label transition: when the issue author replies to an issue labeled `need-more-info`, remove that label and add `info-completed` - configure `actions/create-github-app-token` in the image workflow with its `client-id` input and the `AUTO_COMMENT_BOT_CLIENT_ID` secret ## Why Using `actions/github-script` makes the issue-author and label-transition behavior explicit in the workflow while moving the step to the current GitHub Actions runtime. The image workflow also needs to use the GitHub App client ID with the corresponding token-action input. These workflows apply only to `main` and no backport is needed. No stable-branch backport is required for this PR. ## Validation - both changed workflows parse as valid YAML - `git diff --check`",
"url": "https://github.com/cilium/cilium/pull/47788",
"createdAt": "2026-08-05T17:52:42Z",
"updatedAt": "2026-08-13T09:33:18Z",
"timestamp": "2026-08-13T09:33:18Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"release-note/ci",
"kind/community-contribution",
"dont-merge/needs-ci-validation",
"area/renovate"
],
"author": "bogdankrasko",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47791",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "standalone-dns-proxy: return an error when no endpoint is found",
"text": "`LookupRegisteredEndpoint` reported a lookup miss as (nil, false, nil). The shared `ServeDNS` caller only inspects the returned error before using the endpoint, so it dereferenced the nil endpoint and panicked the whole proxy: ``` panic: runtime error: invalid memory address or nil pointer dereference github.com/cilium/cilium/pkg/endpoint.(*Endpoint).StringID(...) pkg/endpoint/endpoint.go:848 github.com/cilium/cilium/pkg/fqdn/dnsproxy.(*DNSProxy).ServeDNS(...) pkg/fqdn/dnsproxy/proxy.go:983 ``` The IP to endpoint table is a snapshot replicated from the agent, so an endpoint can in principle send a DNS request before its IP has been received. This has not been observed in steady state, but it becomes likely during a burst of endpoint creation: starting a batch of pods selected by a `toFQDNs` policy on a single node reproduced it consistently, with the new pods' source IPs still absent from the table while they were already resolving. Because the panic takes down the proxy process, a single such request breaks DNS for every endpoint on the node. The agent's own implementation of this interface always returns a non-nil error when it cannot resolve an endpoint, which is why only the standalone DNS proxy was affected. Match that contract so a miss is reported as an error, and the request is answered with SERVFAIL instead of crashing. AIL: 2 ```release-note standalone-dns-proxy: return an error when no endpoint is found ```",
"url": "https://github.com/cilium/cilium/pull/47791",
"createdAt": "2026-08-05T21:01:09Z",
"updatedAt": "2026-08-12T19:23:55Z",
"timestamp": "2026-08-12T19:23:55Z",
"metrics": {
"reactions": 2,
"comments": 8
},
"labels": [
"kind/bug",
"release-note/bug",
"ready-to-merge",
"area/fqdn",
"affects/v1.19",
"needs-backport/1.19",
"needs-backport/1.20",
"affects/v1.20"
],
"author": "vipul-21",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47801",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ci: skip etcd log fetch when kvstore was never started",
"text": "The Fetch artifacts step runs on any failure, including a failure of the step that brings up the cluster. On kvstore matrix legs it then runs kubectl -n kube-system logs kvstore with no cluster to talk to, so it exits 1 with \"connection to the server localhost:8080 was refused\" and one real failure becomes two red steps. Legs without kvstore stay green, because there the guard makes the body a no-op. See kube-proxy-5 in https://github.com/cilium/cilium/actions/runs/30930670676/job/92064650443 failing where ipsec-6 in https://github.com/cilium/cilium/actions/runs/30930673513/job/92064622113 is green after the identical provisioning failure. Gate the step on Start Cilium KVStore having actually succeeded instead of on the matrix value, which also covers any other earlier failure that skips the kvstore step. This PR was prepared with AIL:3.",
"url": "https://github.com/cilium/cilium/pull/47801",
"createdAt": "2026-08-06T06:49:28Z",
"updatedAt": "2026-08-12T22:43:06Z",
"timestamp": "2026-08-12T22:43:06Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"release-note/ci",
"backport-done/1.18",
"backport-done/1.19",
"backport-done/1.20"
],
"author": "aanm",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47802",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ces: fix shutdown deadlock",
"text": "Integration test runs timed out due to a deadlock on shutting down the hive. When both queues are empty _and shutting down_ a `getQueue` call could get stuck waiting on the condition variable which was never broadcasted. AIL:2 - AI investigated CI logs and pointed towards the problem, I wrote the code. ```release-note Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. ```",
"url": "https://github.com/cilium/cilium/pull/47802",
"createdAt": "2026-08-06T07:05:02Z",
"updatedAt": "2026-08-12T18:05:28Z",
"timestamp": "2026-08-12T18:05:28Z",
"metrics": {
"reactions": 2,
"comments": 6
},
"labels": [
"kind/bug",
"release-note/bug",
"ready-to-merge",
"feature/ces",
"affects/v1.18",
"affects/v1.19",
"needs-backport/1.20"
],
"author": "bimmlerd",
"state": "closed",
"assignees": [
"bimmlerd"
]
},
{
"id": "github:cilium/cilium:pull_request:47820",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "fix(docs): make render-docs target work on macOS",
"text": "This is a small quality-of-life improvement for contributors working on the documentation on macOS. The alternative is to document a workaround, but that would require contributors to provide additional tar configuration manually. When `make render-docs` runs on macOS, BSD tar records the host-specific UID and GID in the Docker build context. These values can exceed the limits supported by the tar headers consumed by Linux Docker tooling, causing the build context to be parsed incorrectly and the image build to fail. This change normalizes the archive ownership to UID and GID 0, making the Docker build context portable across macOS and Linux. `make render-docs` failed on macOS because BSD tar included macOS-specific metadata in the Docker build context which exceeds the header limits imposed by tar on Linux. macOS adds ownership data that makes Linux tooling interpret the tail of the ownership metadata as the start of the Dockerfile which cause the build to fail. This change normalize the ownership so it pass on both OSs. Tests - make -C Documentation builder-image - make -C Documentation html SKIP_BUILDER_IMAGE=1 - make render-docs on macOS Don't own a Linux machine so that test would be valuable to run. This PR was prepared with AIL:3. I personally reviewed the change and verified the documentation build in a Linux Docker environment. Fixes: N/A ```release-note docs: Make `render-docs` work on macOS. ```",
"url": "https://github.com/cilium/cilium/pull/47820",
"createdAt": "2026-08-06T15:06:35Z",
"updatedAt": "2026-08-12T16:35:41Z",
"timestamp": "2026-08-12T16:35:41Z",
"metrics": {
"reactions": 2,
"comments": 11
},
"labels": [
"area/documentation",
"ready-to-merge",
"release-note/misc",
"area/build",
"kind/community-contribution"
],
"author": "eufriction",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47824",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "clustermesh: fix service export sync on missing CRDs",
"text": "The service export sync logic incorrectly finish the syncing process early when we weren't able to find the CRDs which could affect both CRD upgrade when the clustermesh-apiserver new version start before the cilium-operator had a chance to finish upgrading the CRDs or when enabling MCS-API on a running cluster with a similar configuration. This commit fixes that by ensuring that we retry launching the sync without actually setting the store as synced which both influence clustermesh-apiserver readiness and the resource sync marker. Used AIL-1 here Fixes #47793 ```release-note clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed ```",
"url": "https://github.com/cilium/cilium/pull/47824",
"createdAt": "2026-08-06T17:21:11Z",
"updatedAt": "2026-08-12T22:42:43Z",
"timestamp": "2026-08-12T22:42:43Z",
"metrics": {
"reactions": 2,
"comments": 6
},
"labels": [
"release-note/bug",
"ready-to-merge",
"area/clustermesh",
"affects/v1.18",
"affects/v1.19",
"backport-done/1.20",
"affects/v1.20"
],
"author": "MrFreezeex",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47826",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api: log the right route kind when listing TLSRoutes fails",
"text": "## Description `EnqueueRequestForBackendService` lists TLSRoutes immediately after HTTPRoutes, and the error path of the TLSRoute call was copied from the HTTPRoute one above it without changing the message. A failure to list TLSRoutes is reported as `Failed to get related HTTPRoutes`, which points anyone reading the log at the wrong index and the wrong CRD. That same line is also the only `List` error handler in `operator/pkg/gateway-api/watch-handlers` that calls `Error` rather than `ErrorContext`, so it drops the context from the log record while all fourteen of its neighbours keep it. The sibling handler `EnqueueRequestForBackendServiceImport` already logs this exact failure as `Failed to get related TLSRoutes`, so this just makes the two agree. Found while looking at #47819. That issue also asks for a `helpers.HasTLSRouteSupport` guard around these two `List` calls. I left that out on purpose: on `main`, `TLSRouteKind` is in `helpers.RequiredGVKs`, and `checkCRDs` disables Gateway API entirely when a required CRD is missing, so the guard cannot be false here and would be dead code. Only the log line is wrong on `main`. ```release-note Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service ```",
"url": "https://github.com/cilium/cilium/pull/47826",
"createdAt": "2026-08-06T19:15:38Z",
"updatedAt": "2026-08-13T17:53:48Z",
"timestamp": "2026-08-13T17:53:48Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"kind/bug",
"release-note/bug",
"ready-to-merge",
"area/servicemesh",
"kind/community-contribution",
"feature/k8s-gateway-api",
"needs-backport/1.20"
],
"author": "mehrdadbn9",
"state": "closed",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:47838",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "datapath: turn ARP off on the base devices before bringing them up",
"text": "The clustermesh conformance job fails check-log-errors on the IPv6 native-routing legs with one warning from a freshly booted agent: \"failed to find valid IPv6 address for cilium_net\". setupVethPair brings cilium_host and cilium_net up before setupBaseDevice turns ARP off on them, so the kernel runs duplicate address detection on the link-locals it generates for both ends, and it does not notify netlink subscribers about an address while detection is running. The devices table therefore has no IPv6 address for cilium_net during that window, and that link-local is the nexthop the from-proxy IPv6 routes use. The orchestrator's retry ten seconds later succeeds, but the warning alone fails the job. Turning ARP off before bringing the links up makes the kernel skip detection, so the address is created permanent and is visible immediately. That is the correct order regardless, since these are NOARP devices. Measured in a netns with the real setup sequence, the address goes from unusable for 750ms to usable within 5ms, and raising dad_transmits no longer widens the window. The added test fails ten out of ten runs against unpatched main. This PR was prepared with AIL:3.",
"url": "https://github.com/cilium/cilium/pull/47838",
"createdAt": "2026-08-07T09:21:21Z",
"updatedAt": "2026-08-12T22:42:39Z",
"timestamp": "2026-08-12T22:42:39Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"release-note/bug",
"backport-done/1.20"
],
"author": "aanm",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47840",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api/gamma: refresh CEC owner refs on route recreation",
"text": "When a GAMMA HTTPRoute is deleted and recreated with the same name, the generated CiliumEnvoyConfig is updated in place. Before this change, ensureEnvoyConfig() only replaced the spec and left the previous OwnerReferences unchanged. That meant the CEC could still be owned by the old route UID after the new route had been reconciled. In delete-and-recreate flows, Kubernetes garbage collection could then remove the CEC under the replacement route. Therefore, this commit updates the GAMMA CEC patch path to refresh OwnerReferences from the desired object as well. Note: it seemed as a pure golden input/output test wasn't ideal here to test the edge usecase",
"url": "https://github.com/cilium/cilium/pull/47840",
"createdAt": "2026-08-07T11:46:17Z",
"updatedAt": "2026-08-12T20:17:58Z",
"timestamp": "2026-08-12T20:17:58Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"kind/bug",
"release-note/bug",
"ready-to-merge",
"area/servicemesh",
"feature/k8s-gateway-api",
"needs-backport/1.20"
],
"author": "mhofstetter",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47841",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: lb: use dedicated new_backend bool",
"text": "Update the change introduced by 64527fb1c31e (\"bpf: dsr: always forward DSR info to newly selected remote backend\"), and transport the `new_backend` information via a dedicated bool. This seems to help with BPF program complexity.",
"url": "https://github.com/cilium/cilium/pull/47841",
"createdAt": "2026-08-07T11:51:10Z",
"updatedAt": "2026-08-13T08:56:17Z",
"timestamp": "2026-08-13T08:56:17Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"area/datapath",
"release-note/misc",
"kind/complexity-issue",
"area/loadbalancing",
"area/kpr",
"backport-done/1.20"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
]
},
{
"id": "github:cilium/cilium:pull_request:47843",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api: report all route validation errors in status",
"text": "`ValidateHeaderModifier` write an `Accepted=False` condition. But `ValidateMatchRegexps` writes the same condition type, and `helpers.MergeConditions` matches by type and replaces in place. In `setHTTPRouteStatuses` in gateway_reconcile.go both run in one loop, so the regex message overwrites the header modifier message. `setGRPCRouteStatuses` has the same loop, same defect. For example, a user creates the following invalid configuration: ``` apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: my-route namespace: default spec: parentRefs: - name: my-gateway rules: - matches: - path: type: RegularExpression value: \"/api/(v1\" # malformed regex filters: - type: RequestHeaderModifier requestHeaderModifier: set: - name: Host # rewriting the Host header is not allowed value: example.com backendRefs: - name: my-service port: 8080 ``` The resulting status is missing one of the errors: ``` status: parents: - parentRef: name: my-gateway conditions: - type: Accepted status: \"False\" reason: UnsupportedValue message: 'Invalid regular expression .... `/api/(v1`' ``` This should be improved to report both errors: ``` conditions: - type: Accepted status: \"False\" reason: UnsupportedValue message: 'Invalid HTTPRoute header modifier: \"Host\" header is not supported; use URLRewrite.hostname instead; Invalid regular expression in path match: error parsing regexp: missing closing ): `/api/(v1`' ``` Fixes: #issue-number ```release-note gateway-api: report all route validation errors in statu ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47843",
"createdAt": "2026-08-07T12:16:04Z",
"updatedAt": "2026-08-13T09:11:29Z",
"timestamp": "2026-08-13T09:11:29Z",
"metrics": {
"reactions": 1,
"comments": 0
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution",
"feature/k8s-gateway-api"
],
"author": "weizhoublue",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47844",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Fix endpoint panic when verbose policy logging is enabled",
"text": "The endpoint policy debug logging assumes that the `policyDebugLog` field is set unconditionally. However, we didn't set the field when restoring the endpoint from JSON, leading to nil pointer exceptions when verbose policy logging was enabled. Prepared using AIL:2 - had AI analyze the stack trace and implemented the fix myself. The test is AI generated though, so maybe AIL:3 actually? Fixes a commit by me, not cc'ing myself :grin: Fixes: #47777 ```release-note Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. ```",
"url": "https://github.com/cilium/cilium/pull/47844",
"createdAt": "2026-08-07T12:46:57Z",
"updatedAt": "2026-08-12T22:42:48Z",
"timestamp": "2026-08-12T22:42:48Z",
"metrics": {
"reactions": 4,
"comments": 3
},
"labels": [
"kind/bug",
"release-note/bug",
"sig/policy",
"ready-to-merge",
"backport-done/1.19",
"backport-done/1.20"
],
"author": "bimmlerd",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47845",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "policy: fix bug causing policies using label selectors of long namespace labels being dropped",
"text": "This PR ensures we correctly calculate the length of label selectors when doing validation, ensuring we support all valid kubernetes labels. See commit messages for more information. Also add a test to catch a potential regression. Fixes: #47817 ```release-note Fix bug causing policies using label selectors of long namespace labels being dropped ``` AIL 2/3: AI helped on the txtar test and I wrote the code and did the all the rest. [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47845",
"createdAt": "2026-08-07T13:09:51Z",
"updatedAt": "2026-08-12T16:31:32Z",
"timestamp": "2026-08-12T16:31:32Z",
"metrics": {
"reactions": 2,
"comments": 6
},
"labels": [
"release-note/bug",
"sig/policy"
],
"author": "odinuge",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47854",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "k8s: migrate from legacy config to ClusterInfo",
"text": "Migrate the functions exposed from the k8s package to use the ClusterInfo struct to depends less on the legacy config. Sorry for the many codeowners involved, those k8s functions are called in a bunch of places unfortunately :sweat_smile:. I prepared this commit using AIL-2",
"url": "https://github.com/cilium/cilium/pull/47854",
"createdAt": "2026-08-08T16:54:06Z",
"updatedAt": "2026-08-13T18:01:51Z",
"timestamp": "2026-08-13T18:01:51Z",
"metrics": {
"reactions": 2,
"comments": 11
},
"labels": [
"area/k8s",
"area/clustermesh",
"release-note/misc"
],
"author": "MrFreezeex",
"state": "open",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:47858",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "health/client: replace deprecated http.Transport.Dial with DialContext",
"text": "`http.Transport.Dial` has been deprecated since Go 1.7 (`SA1019`) in favor of `DialContext`, which allows the transport to cancel dials as soon as they are no longer needed. Per the Go docs, if both fields are set `DialContext` takes priority β so the current code is effectively opting out of context-aware dialing on every request the Cilium health checker's HTTP client makes. This PR migrates the two assignments in `configureTransport` (`pkg/health/client/client.go`) to `DialContext`, preserving existing behavior exactly: - **`unix` branch** β the existing closure is wrapped in the `DialContext` signature. The extra `context.Context` argument is intentionally ignored so the dial semantics do not change: it still targets the `proto`/`addr` values captured from the outer scope. - **fallback branch** β `(&net.Dialer{}).Dial` is swapped for its `DialContext` method value, which is the direct, semantically equivalent replacement. No behavior change is expected for callers of the health client. Ref: #32274 ## Testing - `go vet ./pkg/health/client/...` - `GOOS=linux go build ./pkg/health/...` - `GOOS=linux go test -c ./pkg/health/client` (verifies clean cross-compilation for the deployment target) - `go test ./pkg/health/client/...` (unit tests pass natively on darwin) ## AI usage This PR was prepared with AIL:3. I used LLM assistance to locate the remaining `tr.Dial` call sites in `pkg/health/client/client.go`, draft the minimal-scope diff, and prepare this description. I personally reviewed the diff, verified the replacement preserves existing semantics on both branches of `configureTransport`, and ran the validation commands above. ```release-note NONE",
"url": "https://github.com/cilium/cilium/pull/47858",
"createdAt": "2026-08-09T00:20:28Z",
"updatedAt": "2026-08-12T17:59:48Z",
"timestamp": "2026-08-12T17:59:48Z",
"metrics": {
"reactions": 1,
"comments": 1
},
"labels": [
"release-note/misc",
"kind/community-contribution"
],
"author": "uuditmisra",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47859",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "chore(deps): update all-dependencies (main)",
"text": "This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | docker.io/alpine/socat | | digest | `e7b1771` β `68b28fe` | | | [ghcr.io/renovatebot/renovate](https://renovatebot.com) ([source](https://redirect.github.com/renovatebot/renovate)) | | minor | [`44.11.4` β `44.24.3`](https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from=44.11.4&to=44.24.3) | | | quay.io/cilium/cilium-llvm | stage | patch | `19.1.7-1782898005-bed4da5` β `19.1.7-1785833026-d8383c5` | | | quay.io/cilium/test-connection-disruption | | patch | `v0.0.17` β `v0.0.18` | | | [renovatebot/renovate](https://redirect.github.com/renovatebot/renovate) | | minor | [`44.7.0` β `44.14.3`](https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from=44.7.0&to=44.14.3) | `44.24.3` (+31) | --- ### Release Notes renovatebot/renovate (ghcr.io/renovatebot/renovate)
### [`v44.24.3`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.24.3) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.24.2...44.24.3) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.84.3 (main) ([#45233](https://redirect.github.com/renovatebot/renovate/issues/45233)) ([8a6d27d](https://redirect.github.com/renovatebot/renovate/commit/8a6d27d78842d8335aebc516fd41b3a67d7275ad)) ##### Miscellaneous Chores - **deps:** update dependency [@containerbase/semantic-release-pnpm](https://redirect.github.com/containerbase/semantic-release-pnpm) to v1.4.3 (main) ([#45232](https://redirect.github.com/renovatebot/renovate/issues/45232)) ([923cc3f](https://redirect.github.com/renovatebot/renovate/commit/923cc3ffcaf7107b6aaf24105ec47ca2ab1b6659)) ### [`v44.24.2`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.24.2) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.24.1...44.24.2) ##### Bug Fixes - **terraform:** deduplicate provider lockfile hashes ([#45226](https://redirect.github.com/renovatebot/renovate/issues/45226)) ([2869cd3](https://redirect.github.com/renovatebot/renovate/commit/2869cd3a8bfc1673a4be784453bd677a515811c4)) ### [`v44.24.1`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.24.1) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.24.0...44.24.1) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.84.2 (main) ([#45223](https://redirect.github.com/renovatebot/renovate/issues/45223)) ([bbda046](https://redirect.github.com/renovatebot/renovate/commit/bbda04606c0254755c112008b2fa510fd9be3d24)) ##### Miscellaneous Chores - **deps:** update dependency [@biomejs/biome](https://redirect.github.com/biomejs/biome) to v2.5.7 (main) ([#45225](https://redirect.github.com/renovatebot/renovate/issues/45225)) ([e8568a2](https://redirect.github.com/renovatebot/renovate/commit/e8568a2611895ec34e6ac08f0d52dfc5190703ba)) ### [`v44.24.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.24.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.23.3...44.24.0) ##### Features - **manager/github-actions:** add support for Actions Lockfiles ([#45199](https://redirect.github.com/renovatebot/renovate/issues/45199)) ([fba1a9d](https://redirect.github.com/renovatebot/renovate/commit/fba1a9de307287e0c2138ccef938ffe4ba370b5c)) ##### Documentation - fix fenced blocks ([#45206](https://redirect.github.com/renovatebot/renovate/issues/45206)) ([3823ef8](https://redirect.github.com/renovatebot/renovate/commit/3823ef87427fe4d7e7107c230440ed018cf80e7c)) ##### Miscellaneous Chores - **deps:** update dependency memfs to v4.67.0 (main) ([#45193](https://redirect.github.com/renovatebot/renovate/issues/45193)) ([bfa0da8](https://redirect.github.com/renovatebot/renovate/commit/bfa0da839b52156a075244bc395615e59c9047ec)) ##### Code Refactoring - **manager:** add utility for creating Artifact Error messages ([#45218](https://redirect.github.com/renovatebot/renovate/issues/45218)) ([15d5414](https://redirect.github.com/renovatebot/renovate/commit/15d541461b6c3b915fd9bc1798c888af398b9e24)) ### [`v44.23.3`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.23.3) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.23.2...44.23.3) ##### Bug Fixes - **swift:** support Package Registry pins in Package.resolved ([#44358](https://redirect.github.com/renovatebot/renovate/issues/44358)) ([d735b9b](https://redirect.github.com/renovatebot/renovate/commit/d735b9b6b8a65d21a8fbd223bda4545e69a2f077)) ### [`v44.23.2`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.23.2) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.23.1...44.23.2) ##### Bug Fixes - keep HTTPS when resolving same origin URLs ([#45157](https://redirect.github.com/renovatebot/renovate/issues/45157)) ([728ce97](https://redirect.github.com/renovatebot/renovate/commit/728ce9752e0b7f5df3589bdcab7220b9df2c86b7)) ### [`v44.23.1`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.23.1) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.23.0...44.23.1) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.84.1 (main) ([#45209](https://redirect.github.com/renovatebot/renovate/issues/45209)) ([f4f7ea1](https://redirect.github.com/renovatebot/renovate/commit/f4f7ea1d736a8a8ad59471235fe0ab08cbbcd14c)) ### [`v44.23.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.23.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.22.0...44.23.0) ##### Features - add regex support for gitIgnoredAuthors configuration ([#43938](https://redirect.github.com/renovatebot/renovate/issues/43938)) ([65ee1f1](https://redirect.github.com/renovatebot/renovate/commit/65ee1f18b47478092f0a1a7216e948acd270064a)) ### [`v44.22.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.22.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.21.0...44.22.0) ##### Features - **vulnerabilities:** match OSV Packagist sub-ecosystems ([#45203](https://redirect.github.com/renovatebot/renovate/issues/45203)) ([a84e007](https://redirect.github.com/renovatebot/renovate/commit/a84e007f469995d53843f07173d59e34dd813e4e)) ### [`v44.21.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.21.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.20.1...44.21.0) ##### Features - **replacements:** add replacements for dev-facing Comet packages ([#45112](https://redirect.github.com/renovatebot/renovate/issues/45112)) ([b9b2755](https://redirect.github.com/renovatebot/renovate/commit/b9b275568507a59cab65f299254ded1105d1d806)) ### [`v44.20.1`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.20.1) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.20.0...44.20.1) ##### Bug Fixes - **cargo:** support fetching crates from git monorepo ([#45142](https://redirect.github.com/renovatebot/renovate/issues/45142)) ([4adc8f3](https://redirect.github.com/renovatebot/renovate/commit/4adc8f37257afbcc4d19647928ffca1d206abd86)) ##### Miscellaneous Chores - **deps:** update dependency pnpm to v11.20.0 (main) ([#45201](https://redirect.github.com/renovatebot/renovate/issues/45201)) ([3f20dca](https://redirect.github.com/renovatebot/renovate/commit/3f20dca6e0f397c7aaba678e232f0acddb0e9f32)) ### [`v44.20.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.20.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.19.0...44.20.0) ##### Features - **util/exec:** add support for `gh` tool ([#45192](https://redirect.github.com/renovatebot/renovate/issues/45192)) ([4537247](https://redirect.github.com/renovatebot/renovate/commit/45372476c8670d0cc3ac2b86976887112f9af748)), closes [#44753](https://redirect.github.com/renovatebot/renovate/issues/44753) [#45190](https://redirect.github.com/renovatebot/renovate/issues/45190) ##### Documentation - update references to renovate/renovate (main) ([#45196](https://redirect.github.com/renovatebot/renovate/issues/45196)) ([d584cf4](https://redirect.github.com/renovatebot/renovate/commit/d584cf45d90b72e18cd9b0939ba2a1c337a5b031)) ##### Code Refactoring - **workers/repository:** allow managers to opt out of digest pinning ([#45198](https://redirect.github.com/renovatebot/renovate/issues/45198)) ([7f40d43](https://redirect.github.com/renovatebot/renovate/commit/7f40d43179cfe937b38ce0c62e563ee37654b3c0)), closes [#45190](https://redirect.github.com/renovatebot/renovate/issues/45190) ### [`v44.19.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.19.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.18.0...44.19.0) ##### Features - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.84.0 (main) ([#45197](https://redirect.github.com/renovatebot/renovate/issues/45197)) ([197ad00](https://redirect.github.com/renovatebot/renovate/commit/197ad002894f4170282224601ea27ade517f9666)) ### [`v44.18.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.18.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.17.5...44.18.0) ##### Features - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.83.0 (main) ([#45195](https://redirect.github.com/renovatebot/renovate/issues/45195)) ([63f9e20](https://redirect.github.com/renovatebot/renovate/commit/63f9e20779a3cd64914057e439573c750efca39a)) ##### Miscellaneous Chores - **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.14.0 (main) ([#45194](https://redirect.github.com/renovatebot/renovate/issues/45194)) ([7275fcb](https://redirect.github.com/renovatebot/renovate/commit/7275fcb63228387ee2f8256a6cd19d86f78e97c1)) ### [`v44.17.5`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.17.5) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.17.4...44.17.5) ##### Bug Fixes - **git:** resolve child env before adding authentication ([#45184](https://redirect.github.com/renovatebot/renovate/issues/45184)) ([cca6227](https://redirect.github.com/renovatebot/renovate/commit/cca6227dfab416b9364214ff8543ce7b663389e8)) ### [`v44.17.4`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.17.4) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.17.3...44.17.4) ##### Bug Fixes - **versioning/cargo:** convert ranges to semver in subset and intersects ([#45146](https://redirect.github.com/renovatebot/renovate/issues/45146)) ([1f6546b](https://redirect.github.com/renovatebot/renovate/commit/1f6546b7a9e41c2c1bc6684d01e63674297bdd7f)) ### [`v44.17.3`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.17.3) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.17.2...44.17.3) ##### Bug Fixes - **manager/asdf,mise,proto:** use rust-version datasource for rust ([#45143](https://redirect.github.com/renovatebot/renovate/issues/45143)) ([a2d1b8c](https://redirect.github.com/renovatebot/renovate/commit/a2d1b8cf0af3bc7553bc4be872015b3ddf0cd92e)) - **manager/rust-toolchain:** report skipReason instead of dropping deps ([#45144](https://redirect.github.com/renovatebot/renovate/issues/45144)) ([183ee9c](https://redirect.github.com/renovatebot/renovate/commit/183ee9caacae80d2368e3533a77f73ff31f1d0c8)) ### [`v44.17.2`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.17.2) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.17.1...44.17.2) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.11 (main) ([#45187](https://redirect.github.com/renovatebot/renovate/issues/45187)) ([44e862a](https://redirect.github.com/renovatebot/renovate/commit/44e862a926a494145c3c0cc0319d345afd710d05)) ##### Documentation - update references to otel/opentelemetry-collector-contrib to v0.158.0 (main) ([#45180](https://redirect.github.com/renovatebot/renovate/issues/45180)) ([3952363](https://redirect.github.com/renovatebot/renovate/commit/3952363a57de0234404eff54cec865d4cc38865a)) - update references to python to [`3a9d2dd`](https://redirect.github.com/renovatebot/renovate/commit/3a9d2dd) (main) ([#45179](https://redirect.github.com/renovatebot/renovate/issues/45179)) ([5ca534a](https://redirect.github.com/renovatebot/renovate/commit/5ca534a0c85cfcbd24e1fbfc2f2f8932341e1d9d)) - update references to renovate/renovate (main) ([#45182](https://redirect.github.com/renovatebot/renovate/issues/45182)) ([742b3b3](https://redirect.github.com/renovatebot/renovate/commit/742b3b3213d716c450b98ba16c98d331d73fb3a5)) - update references to renovatebot/github-action to v46.2.2 (main) ([#45185](https://redirect.github.com/renovatebot/renovate/issues/45185)) ([8964a66](https://redirect.github.com/renovatebot/renovate/commit/8964a664b7bd8cc40adc95d53d4acaf52e6eba38)) ##### Miscellaneous Chores - **deps:** lock file maintenance (main) ([#45183](https://redirect.github.com/renovatebot/renovate/issues/45183)) ([21ae785](https://redirect.github.com/renovatebot/renovate/commit/21ae7852f4d450ca845eacd9648b306d1c9d965d)) - **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.13.20 (main) ([#45186](https://redirect.github.com/renovatebot/renovate/issues/45186)) ([2346d98](https://redirect.github.com/renovatebot/renovate/commit/2346d989ab32b46d1993917283f310f57fc7f19a)) - **deps:** update pnpm/setup action to v2.0.2 (main) ([#45178](https://redirect.github.com/renovatebot/renovate/issues/45178)) ([30cd3d8](https://redirect.github.com/renovatebot/renovate/commit/30cd3d8b8cb3355ea5a12d2409f1555734077281)) ### [`v44.17.1`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.17.1) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.17.0...44.17.1) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.10 (main) ([#45175](https://redirect.github.com/renovatebot/renovate/issues/45175)) ([ef843fd](https://redirect.github.com/renovatebot/renovate/commit/ef843fd3e1379f432fca4adbb686399269658ee0)) ##### Miscellaneous Chores - **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.13.19 (main) ([#45174](https://redirect.github.com/renovatebot/renovate/issues/45174)) ([4b27160](https://redirect.github.com/renovatebot/renovate/commit/4b271608155bae6c6411a63e00c9d59128b104cd)) ### [`v44.17.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.17.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.16.1...44.17.0) ##### Features - **presets:** add replacement for deprecated password pusher images ([#45172](https://redirect.github.com/renovatebot/renovate/issues/45172)) ([a484d01](https://redirect.github.com/renovatebot/renovate/commit/a484d01201a908f86db34bfcfd2034c2ad67260d)) ##### Miscellaneous Chores - **deps:** update dependency [@containerbase/istanbul-reports-html](https://redirect.github.com/containerbase/istanbul-reports-html) to v2.0.15 (main) ([#45173](https://redirect.github.com/renovatebot/renovate/issues/45173)) ([5e5dd4f](https://redirect.github.com/renovatebot/renovate/commit/5e5dd4f0d2bd2c272d184f6c51bd0ac01fdfa7ad)) - **deps:** update dependency vitest-mock-extended to v5.1.1 (main) ([#44856](https://redirect.github.com/renovatebot/renovate/issues/44856)) ([0243c9d](https://redirect.github.com/renovatebot/renovate/commit/0243c9d65d56d252955dab734bf365f4c869ead6)) ### [`v44.16.1`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.16.1) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.16.0...44.16.1) ##### Bug Fixes - **presets/monorepo:** add new datatables.net source repos ([#45090](https://redirect.github.com/renovatebot/renovate/issues/45090)) ([42cd249](https://redirect.github.com/renovatebot/renovate/commit/42cd249823d69524d57a2a7b954898a3307676dd)) ### [`v44.16.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.16.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.15.0...44.16.0) ##### Features - **presets:** add Flue monorepo ([#45137](https://redirect.github.com/renovatebot/renovate/issues/45137)) ([e869eec](https://redirect.github.com/renovatebot/renovate/commit/e869eecc4d4203eeffaba174c8820ee5c2f19922)) ##### Miscellaneous Chores - **deps:** update dependency [@types/semver](https://redirect.github.com/types/semver) to v7.8.0 (main) ([#45164](https://redirect.github.com/renovatebot/renovate/issues/45164)) ([2f1b951](https://redirect.github.com/renovatebot/renovate/commit/2f1b9514ae3513c2dc86753343682b355225588e)) ### [`v44.15.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.15.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.12...44.15.0) ##### Features - **data:** automatic update of static data ([#45163](https://redirect.github.com/renovatebot/renovate/issues/45163)) ([25a09ec](https://redirect.github.com/renovatebot/renovate/commit/25a09ecb7ec5c2a8328762475b0795127682311b)) ### [`v44.14.12`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.12) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.10...44.14.12) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.9 (main) ([#45156](https://redirect.github.com/renovatebot/renovate/issues/45156)) ([1b99a61](https://redirect.github.com/renovatebot/renovate/commit/1b99a61a38edd029d9679d25673aea389f8ceb2b)) ##### Miscellaneous Chores - **deps:** update dependency [@types/lodash](https://redirect.github.com/types/lodash) to v4.17.25 (main) ([#45151](https://redirect.github.com/renovatebot/renovate/issues/45151)) ([2f2dd98](https://redirect.github.com/renovatebot/renovate/commit/2f2dd98b44f70f1a52fba4385b5ae8dd9d714be3)) - **deps:** update dependency [@types/luxon](https://redirect.github.com/types/luxon) to v3.7.3 (main) ([#45154](https://redirect.github.com/renovatebot/renovate/issues/45154)) ([ecadb0c](https://redirect.github.com/renovatebot/renovate/commit/ecadb0c88ec4aa4c163499b48d19b6a9cc7c2b1a)) - **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.13.18 (main) ([#45155](https://redirect.github.com/renovatebot/renovate/issues/45155)) ([7a4aac6](https://redirect.github.com/renovatebot/renovate/commit/7a4aac6f03e1889d306ab602344f1fcb43799439)) ### [`v44.14.10`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.10) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.9...44.14.10) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.7 (main) ([#45149](https://redirect.github.com/renovatebot/renovate/issues/45149)) ([f306402](https://redirect.github.com/renovatebot/renovate/commit/f306402533b53348cd7c0519fd9ff87c4aaf29ea)) ##### Miscellaneous Chores - **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.13.17 (main) ([#45148](https://redirect.github.com/renovatebot/renovate/issues/45148)) ([b726beb](https://redirect.github.com/renovatebot/renovate/commit/b726beb7a71951d32c4e163533f935f48f507244)) ### [`v44.14.9`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.9) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.8...44.14.9) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.6 (main) ([#45147](https://redirect.github.com/renovatebot/renovate/issues/45147)) ([84ef069](https://redirect.github.com/renovatebot/renovate/commit/84ef069a60bea3f99fa8d8e6292df4d579f5ba45)) ##### Miscellaneous Chores - **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.13.16 (main) ([#45145](https://redirect.github.com/renovatebot/renovate/issues/45145)) ([4c492d3](https://redirect.github.com/renovatebot/renovate/commit/4c492d3ef02d6d5ea6c34fe23cb52f3b3e37ef3f)) ### [`v44.14.8`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.8) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.7...44.14.8) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.5 (main) ([#45141](https://redirect.github.com/renovatebot/renovate/issues/45141)) ([ee9e688](https://redirect.github.com/renovatebot/renovate/commit/ee9e68825668a16febf3e0e888ab7b0f37ab0df4)) ##### Miscellaneous Chores - **deps:** update dependency astral-sh/uv to v0.12.3 (main) ([#45139](https://redirect.github.com/renovatebot/renovate/issues/45139)) ([f1e08d3](https://redirect.github.com/renovatebot/renovate/commit/f1e08d3a1ab2df48545b2f9217d254289864602d)) - **deps:** update dependency uv to v0.12.3 (main) ([#45140](https://redirect.github.com/renovatebot/renovate/issues/45140)) ([58c581b](https://redirect.github.com/renovatebot/renovate/commit/58c581bd63120b5d4cb9098bb313b184e3b2195d)) ##### Code Refactoring - **types:** make return type for `getToolSettingsOptions` stricter ([#45133](https://redirect.github.com/renovatebot/renovate/issues/45133)) ([c92c7e2](https://redirect.github.com/renovatebot/renovate/commit/c92c7e2d3a83dd1d4483f859006778e15045db08)) ### [`v44.14.7`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.7) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.6...44.14.7) ##### Bug Fixes - **exec/docker:** single-quote the sidecar `bash` command ([b017c75](https://redirect.github.com/renovatebot/renovate/commit/b017c7548ad6cfde7fca9b36f4525999c5845155)) - **manager/deno:** quote allow-import host list in install command ([3793e3b](https://redirect.github.com/renovatebot/renovate/commit/3793e3bab97108a7c2309aa23980ae8635fc5815)) - **manager/gomod:** quote module path in import path update command ([c9cec1a](https://redirect.github.com/renovatebot/renovate/commit/c9cec1affb5938b99ed8cf5790c7b9f326b7aeb7)) - **manager/gradle-wrapper:** quote distribution URL in wrapper command ([b3f7846](https://redirect.github.com/renovatebot/renovate/commit/b3f7846c1609d9af420e5ef6647ce0d744947e0c)) - **manager/maven-wrapper:** quote distribution type in wrapper command ([7279744](https://redirect.github.com/renovatebot/renovate/commit/7279744cd6cc8ab96471a5abc75fb176c6257d6c)) - **manager/mix:** quote hex organization and token in auth command ([ff3e99e](https://redirect.github.com/renovatebot/renovate/commit/ff3e99ef53e057f83db4b2423eaf981011ae47ef)) - **manager/nix:** quote GitHub token in flake update command ([521d325](https://redirect.github.com/renovatebot/renovate/commit/521d325afdd1a3ca3e5385d85bb6b9715dd26cea)) - **manager/npm:** quote package spec in corepack command ([6d2fa81](https://redirect.github.com/renovatebot/renovate/commit/6d2fa815b72278f7547b0ff943cccf6788705424)) ##### Miscellaneous Chores - add `no-unquoted-exec-interpolation` linting rule ([e510b9a](https://redirect.github.com/renovatebot/renovate/commit/e510b9a64d4eaccaa376c6306d42e2c0c5a6f5fd)) ##### Code Refactoring - generate the list of templatable fields ([df7a014](https://redirect.github.com/renovatebot/renovate/commit/df7a014c91958d029e0002bd383df8574af96d11)) ### [`v44.14.6`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.6) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.5...44.14.6) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.4 (main) ([#45131](https://redirect.github.com/renovatebot/renovate/issues/45131)) ([d8aa95f](https://redirect.github.com/renovatebot/renovate/commit/d8aa95fe64a294a9572d226864c03c64f73c9761)) ##### Documentation - add link to Containerbase' \"new tool\" documentation ([#45127](https://redirect.github.com/renovatebot/renovate/issues/45127)) ([78fa7af](https://redirect.github.com/renovatebot/renovate/commit/78fa7af1d133845ec1d06ec08ac5f60367839ca8)) - Do not recommend to use prCreation=not-pending with automerge ([#45088](https://redirect.github.com/renovatebot/renovate/issues/45088)) ([0dac257](https://redirect.github.com/renovatebot/renovate/commit/0dac257b655b549218a58c58cf389fe4377148d1)) ##### Miscellaneous Chores - **deps:** update dependency nock to v14.0.17 (main) ([#45121](https://redirect.github.com/renovatebot/renovate/issues/45121)) ([2668a65](https://redirect.github.com/renovatebot/renovate/commit/2668a65daee615d3885b7a8faa858b1bb1c90f96)) - **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.13.15 (main) ([#45120](https://redirect.github.com/renovatebot/renovate/issues/45120)) ([3bcc84b](https://redirect.github.com/renovatebot/renovate/commit/3bcc84bb65bad8cce667508280807ceb260837d4)) - **deps:** update pnpm/setup action to v2.0.1 (main) ([#45129](https://redirect.github.com/renovatebot/renovate/issues/45129)) ([ed81456](https://redirect.github.com/renovatebot/renovate/commit/ed81456807c12d8a04fd0f2df0a57d4adc078b48)) ##### Code Refactoring - **types:** clarify `ToolSettings` has two levels of config ([#45125](https://redirect.github.com/renovatebot/renovate/issues/45125)) ([a28ecdc](https://redirect.github.com/renovatebot/renovate/commit/a28ecdc122c406dec8cf1476cf967327adb127d9)) ### [`v44.14.5`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.5) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.4...44.14.5) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.3 (main) ([#45122](https://redirect.github.com/renovatebot/renovate/issues/45122)) ([4230fe3](https://redirect.github.com/renovatebot/renovate/commit/4230fe3132d471d1e1e010b41967598791837e96)) ##### Miscellaneous Chores - **deps:** update dependency pnpm to v11.19.0 (main) ([#45128](https://redirect.github.com/renovatebot/renovate/issues/45128)) ([8126773](https://redirect.github.com/renovatebot/renovate/commit/8126773463589a501862a0925ce8ae3b247e623a)) ### [`v44.14.4`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.4) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.3...44.14.4) ##### Bug Fixes - **proxy:** sanitise password components in `HTTP_PROXY` variable(s) in logs ([#45117](https://redirect.github.com/renovatebot/renovate/issues/45117)) ([f88212b](https://redirect.github.com/renovatebot/renovate/commit/f88212be2e7b1a8d359b4852ae6f7e2d2a63be2b)) - **util/host-rules:** sanitise TLS credential fields in hostRules ([#45119](https://redirect.github.com/renovatebot/renovate/issues/45119)) ([54384ff](https://redirect.github.com/renovatebot/renovate/commit/54384ff3e52736b69fe2d7442b4d0ae887e63d7e)) ##### Miscellaneous Chores - **deps:** update dependency lint-staged to v17.3.0 (main) ([#45126](https://redirect.github.com/renovatebot/renovate/issues/45126)) ([4a62cda](https://redirect.github.com/renovatebot/renovate/commit/4a62cdaaa32ffa0db5ab5945210e5aead13c2d5a)) ### [`v44.14.3`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.3) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.2...44.14.3) ##### Bug Fixes - **workers/global:** sanitise `COREPACK_NPM_{TOKEN,PASSWORD}` in logs ([#45116](https://redirect.github.com/renovatebot/renovate/issues/45116)) ([244bfe1](https://redirect.github.com/renovatebot/renovate/commit/244bfe15a77ff5bf7870d0d3a007eac93a1ed70b)) ### [`v44.14.2`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.2) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.1...44.14.2) ##### Bug Fixes - **datasource/docker:** fetch all pages for cgr.dev ([#45114](https://redirect.github.com/renovatebot/renovate/issues/45114)) ([d7ce060](https://redirect.github.com/renovatebot/renovate/commit/d7ce0605b2032b2c2db72a5c40990a540c927a2b)) ##### Miscellaneous Chores - add linter rule for `shell: true` usage ([#45110](https://redirect.github.com/renovatebot/renovate/issues/45110)) ([52ff375](https://redirect.github.com/renovatebot/renovate/commit/52ff375f0a0dc12bfd5e3d98b5789262e81be7f9)) - **deps:** update actions/cache action to v6 (main) ([#45104](https://redirect.github.com/renovatebot/renovate/issues/45104)) ([ec7aadb](https://redirect.github.com/renovatebot/renovate/commit/ec7aadbca9f4dc795b17de756950015a44f8b98d)) - **deps:** update actions/checkout action to v7 (main) ([#45105](https://redirect.github.com/renovatebot/renovate/issues/45105)) ([db79937](https://redirect.github.com/renovatebot/renovate/commit/db7993707a688554c5248de9e556e26066fc8da2)) - **deps:** update codecov/codecov-action action to v7 (main) ([#45106](https://redirect.github.com/renovatebot/renovate/issues/45106)) ([0593955](https://redirect.github.com/renovatebot/renovate/commit/05939559c6f9aa61a5620669a925dafff1685613)) - **deps:** update dependency astral-sh/setup-uv to v9 (main) ([#45100](https://redirect.github.com/renovatebot/renovate/issues/45100)) ([7840681](https://redirect.github.com/renovatebot/renovate/commit/7840681f1311392a627d1a0df90d00f8e72242f1)) - **deps:** update dependency vite to v8.2.0 (main) ([#45115](https://redirect.github.com/renovatebot/renovate/issues/45115)) ([9d02537](https://redirect.github.com/renovatebot/renovate/commit/9d02537b431aaed3d382e5a33b42ce7bb1696164)) - **deps:** update slackapi/slack-github-action action to v4 (main) ([#45107](https://redirect.github.com/renovatebot/renovate/issues/45107)) ([0fb9ca8](https://redirect.github.com/renovatebot/renovate/commit/0fb9ca898283b1938be958e681a821ebdb165312)) - **manager/flux:** don't use shell execution to `flux install` ([#45109](https://redirect.github.com/renovatebot/renovate/issues/45109)) ([a36eed3](https://redirect.github.com/renovatebot/renovate/commit/a36eed33653803d5a19b88df49a053af576005da)) ### [`v44.14.1`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.1) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.0...44.14.1) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.2 (main) ([#45103](https://redirect.github.com/renovatebot/renovate/issues/45103)) ([c4756c3](https://redirect.github.com/renovatebot/renovate/commit/c4756c3de6845a5a8cc70cfdf0ab6963634bffe3)) ### [`v44.14.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.13.3...44.14.0) ##### Features - **github-actions:** add support for `pnpm/setup` ([#45094](https://redirect.github.com/renovatebot/renovate/issues/45094)) ([fa17e59](https://redirect.github.com/renovatebot/renovate/commit/fa17e599843023ff90bf7aca25fc175928af1087)) ##### Miscellaneous Chores - **deps:** update dependency npm-run-all2 to v9 (main) ([#45101](https://redirect.github.com/renovatebot/renovate/issues/45101)) ([5149a03](https://redirect.github.com/renovatebot/renovate/commit/5149a0319eed7a146cf8af9f5b6ffe12e37576d7)) - **deps:** update pnpm/setup action to v2 (main) ([#45102](https://redirect.github.com/renovatebot/renovate/issues/45102)) ([da0534a](https://redirect.github.com/renovatebot/renovate/commit/da0534a93216e1678ebecc936d27c025ff7ea79e)) ### [`v44.13.3`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.13.3) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.13.2...44.13.3) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.1 (main) ([#45099](https://redirect.github.com/renovatebot/renovate/issues/45099)) ([814c4dc](https://redirect.github.com/renovatebot/renovate/commit/814c4dc68938baab98c5264ea8229a89326a06f2)) ##### Miscellaneous Chores - **deps:** update dependency [@smithy/util-stream](https://redirect.github.com/smithy/util-stream) to v4.7.16 (main) ([#45095](https://redirect.github.com/renovatebot/renovate/issues/45095)) ([d7d23ac](https://redirect.github.com/renovatebot/renovate/commit/d7d23ac28590868e599abdf7418e22e3df5ddeaf)) - **deps:** update dependency astral-sh/uv to v0.12.2 (main) ([#45097](https://redirect.github.com/renovatebot/renovate/issues/45097)) ([09fb3c4](https://redirect.github.com/renovatebot/renovate/commit/09fb3c489e63f90de88591a5ef822bec45107a40)) - **deps:** update dependency uv to v0.12.2 (main) ([#45098](https://redirect.github.com/renovatebot/renovate/issues/45098)) ([dd657f3](https://redirect.github.com/renovatebot/renovate/commit/dd657f3f88129c0be3ce28c01e418e622e9d8684)) ##### Continuous Integration - migrate to `pnpm/setup` ([#45035](https://redirect.github.com/renovatebot/renovate/issues/45035)) ([144ba37](https://redirect.github.com/renovatebot/renovate/commit/144ba373a4ba02d54d4f74998c0bd7d01112c2b8)) ### [`v44.13.2`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.13.2) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.13.1...44.13.2) ##### Build System - **deps:** update dependency [@renovatebot/detect-tools](https://redirect.github.com/renovatebot/detect-tools) to v4.0.11 (main) ([#44979](https://redirect.github.com/renovatebot/renovate/issues/44979)) ([bce1f27](https://redirect.github.com/renovatebot/renovate/commit/bce1f27f9c9f43d2b8862d2a4c765799c6264818)) ### [`v44.13.1`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.13.1) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.13.0...44.13.1) ##### Build System - **deps:** update yarn monorepo (main) ([#45083](https://redirect.github.com/renovatebot/renovate/issues/45083)) ([ce414fb](https://redirect.github.com/renovatebot/renovate/commit/ce414fb3b02d3d91ff046ea101c8d168bd0d7403)) ### [`v44.13.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.13.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.12.0...44.13.0) ##### Features - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.0 (main) ([#45084](https://redirect.github.com/renovatebot/renovate/issues/45084)) ([6e9352c](https://redirect.github.com/renovatebot/renovate/commit/6e9352c5d5972499c1056b45a31e9caa508b6c04)) ##### Miscellaneous Chores - **deps:** update dependency pnpm to v11.18.0 (main) ([#45080](https://redirect.github.com/renovatebot/renovate/issues/45080)) ([6950cb2](https://redirect.github.com/renovatebot/renovate/commit/6950cb296c8a8207b4aeb6374be3d3631cd0067f)) ### [`v44.12.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.12.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.11.8...44.12.0) ##### Features - **config/validation:** validate object entries in the `repositories` array ([#43033](https://redirect.github.com/renovatebot/renovate/issues/43033)) ([527c141](https://redirect.github.com/renovatebot/renovate/commit/527c141b5ba03236ac1f88ed9fba15a0bd81efba)), closes [#43295](https://redirect.github.com/renovatebot/renovate/issues/43295) ### [`v44.11.8`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.11.8) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.11.7...44.11.8) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.81.6 (main) ([#45078](https://redirect.github.com/renovatebot/renovate/issues/45078)) ([7ae4708](https://redirect.github.com/renovatebot/renovate/commit/7ae47086de7b486811e6a342a75b280e9561bc89)) ### [`v44.11.7`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.11.7) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.11.6...44.11.7) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.81.5 (main) ([#45077](https://redirect.github.com/renovatebot/renovate/issues/45077)) ([7da69ea](https://redirect.github.com/renovatebot/renovate/commit/7da69eabade945e56ea13523cdcab47153271d26)) ### [`v44.11.6`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.11.6) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.11.5...44.11.6) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.81.4 (main) ([#45076](https://redirect.github.com/renovatebot/renovate/issues/45076)) ([374fa3f](https://redirect.github.com/renovatebot/renovate/commit/374fa3f315aa5ded6692c8d2bb346b414ff92e3c)) ### [`v44.11.5`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.11.5) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.11.4...44.11.5) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.81.3 (main) ([#45073](https://redirect.github.com/renovatebot/renovate/issues/45073)) ([7e67ccd](https://redirect.github.com/renovatebot/renovate/commit/7e67ccd871d5236072a5ff6077a4f9a82e1ca99e)) ##### Documentation - **config:** clarify how to use `repositories` ([#45061](https://redirect.github.com/renovatebot/renovate/issues/45061)) ([190f8d5](https://redirect.github.com/renovatebot/renovate/commit/190f8d54ae833afba6eeb78272fb8ac7e8f4ae91)) - validate JSONC and Javascript code blocks ([#45063](https://redirect.github.com/renovatebot/renovate/issues/45063)) ([8108714](https://redirect.github.com/renovatebot/renovate/commit/8108714fc3e643838438007bd650df487fd3c26e)) ##### Miscellaneous Chores - **deps:** update github/codeql-action action to v4.37.6 (main) ([#45066](https://redirect.github.com/renovatebot/renovate/issues/45066)) ([52c5ba2](https://redirect.github.com/renovatebot/renovate/commit/52c5ba26c865718560f8a72fcd755177ec7807f3)) ##### Tests - **config/validation:** ensure that `errors` and `warnings` are always checked and that we don't length check ([#45065](https://redirect.github.com/renovatebot/renovate/issues/45065)) ([23dd568](https://redirect.github.com/renovatebot/renovate/commit/23dd5682be2f38c69beb0bb0a882e0aa4d932c78)) --- ### Configuration π
**Schedule**: (UTC) - Branch creation - \"on sunday\" - Automerge - At any time (no schedule defined) π¦ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β» **Rebasing**: Never, or you tick the rebase/retry checkbox. π» **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). ",
"url": "https://github.com/cilium/cilium/pull/47859",
"createdAt": "2026-08-09T00:42:09Z",
"updatedAt": "2026-08-12T23:21:24Z",
"timestamp": "2026-08-12T23:21:24Z",
"metrics": {
"reactions": 2,
"comments": 8
},
"labels": [
"kind/enhancement",
"release-note/misc",
"dont-merge/blocked",
"kind/community-contribution",
"renovate/stop-updating",
"cilium-cli"
],
"author": "cilium-renovate[bot]",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47861",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "chore(deps): update all github action dependencies (main)",
"text": "This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [cert-manager/cert-manager](https://redirect.github.com/cert-manager/cert-manager) | | patch | `v1.21.0` β `v1.21.1` | | | [cilium/cilium](https://redirect.github.com/cilium/cilium) | action | minor | `v1.19` β `v1.20.0` | | | [cilium/cilium](https://redirect.github.com/cilium/cilium) | action | minor | `v1.19.6` β `v1.20.0` | | | [cilium/scale-tests-action](https://redirect.github.com/cilium/scale-tests-action) ([changelog](https://redirect.github.com/cilium/scale-tests-action/compare/d89fc21b123f4047828366d1505a8bb5d414c07d..7e3eae9de9542f1a7616ca797e2d5090e8f9f8ee)) | action | digest | `d89fc21` β `7e3eae9` | | | [docker/login-action](https://redirect.github.com/docker/login-action) | action | minor | `v4.5.2` β `v4.6.0` | | | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | patch | `v4.37.3` β `v4.37.5` | `v4.37.6` | | [renovatebot/github-action](https://redirect.github.com/renovatebot/github-action) | action | minor | `v46.1.21` β `v46.2.1` | | --- ### Release Notes cert-manager/cert-manager (cert-manager/cert-manager)
### [`v1.21.1`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.21.1) [Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities. All users should upgrade. #### Changes by Kind ##### Bug or Regression - Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#9038](https://redirect.github.com/cert-manager/cert-manager/issues/9038), [@sklirg](https://redirect.github.com/sklirg)) - Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#9083](https://redirect.github.com/cert-manager/cert-manager/issues/9083), [@SebTardif](https://redirect.github.com/SebTardif)) - Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#9037](https://redirect.github.com/cert-manager/cert-manager/issues/9037), [@wallrj-cyberark](https://redirect.github.com/wallrj-cyberark)) - Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#9012](https://redirect.github.com/cert-manager/cert-manager/issues/9012), [@mateenali66](https://redirect.github.com/mateenali66)) ##### Other (Cleanup or Flake) - Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#9039](https://redirect.github.com/cert-manager/cert-manager/issues/9039), [@wallrj-cyberark](https://redirect.github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#9063](https://redirect.github.com/cert-manager/cert-manager/issues/9063)) - Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#9072](https://redirect.github.com/cert-manager/cert-manager/issues/9072)) - Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#9073](https://redirect.github.com/cert-manager/cert-manager/issues/9073)) - Update distroless base images ([#9000](https://redirect.github.com/cert-manager/cert-manager/issues/9000), [#9025](https://redirect.github.com/cert-manager/cert-manager/issues/9025)) cilium/cilium (cilium/cilium)
### [`v1.20.0`](https://redirect.github.com/cilium/cilium/releases/tag/v1.20.0): 1.20.0 [Compare Source](https://redirect.github.com/cilium/cilium/compare/1.20.0...1.20.0) π **Release Announcement** π: We are excited to announce the [Cilium 1.20.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.20.0) release! More than **2,660 new commits** have landed in this release, supported by a community of over **1,100 contributors** and more than **24,800 GitHub stars**! π€© β οΈ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the `cilium.io/v2alpha1` `CiliumNodeConfig` API, the libnetwork integration, or a custom CNI configuration. See the [Upgrade Guide](https://docs.cilium.io/en/v1.20/operations/upgrade/#upgrade-notes) for details. The full changelog can be found [here](https://redirect.github.com/cilium/cilium/blob/v1.20/CHANGELOG.md). Here are some of the highlights: - β©οΈ **Gateway API** - π **Gateway API v1.6.1**: Cilium moves from Gateway API v1.4 to v1.6.1, bringing support for capabilities that graduated across both upstream releases. ([cilium/cilium#45251](https://redirect.github.com/cilium/cilium/pull/45251), [@youngnick](https://redirect.github.com/youngnick); [cilium/cilium#46827](https://redirect.github.com/cilium/cilium/pull/46827), [cilium/cilium#47274](https://redirect.github.com/cilium/cilium/pull/47274), [@arybolovlev](https://redirect.github.com/arybolovlev)) - π₯ **Delegate Gateway Listeners**: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. ([cilium/cilium#46303](https://redirect.github.com/cilium/cilium/pull/46303), [cilium/cilium#46785](https://redirect.github.com/cilium/cilium/pull/46785), [@asauber](https://redirect.github.com/asauber)) - π **Encrypt Traffic to Backends**: Gateway API `BackendTLSPolicy` support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. ([cilium/cilium#43045](https://redirect.github.com/cilium/cilium/pull/43045), [@youngnick](https://redirect.github.com/youngnick)) - π **TCPRoute and UDPRoute**: Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic. ([cilium/cilium#46184](https://redirect.github.com/cilium/cilium/pull/46184), [cilium/cilium#46970](https://redirect.github.com/cilium/cilium/pull/46970), [@eminaktas](https://redirect.github.com/eminaktas); [cilium/cilium#47381](https://redirect.github.com/cilium/cilium/pull/47381), [@arybolovlev](https://redirect.github.com/arybolovlev)) - π **External Authorization**: HTTPRoute requests can now be authenticated and authorized through an external service before they reach the application, using the Gateway API `ExternalAuth` filter from GEP-1494. ([cilium/cilium#45739](https://redirect.github.com/cilium/cilium/pull/45739), [@gauteoh](https://redirect.github.com/gauteoh)) - ποΈ **More HTTP Traffic Controls**: HTTPRoutes gain native CORS support and additional 303, 307 and 308 redirect codes. `CiliumGatewayClassConfig` can also overwrite, append or preserve the HTTP Server response header. ([cilium/cilium#45924](https://redirect.github.com/cilium/cilium/pull/45924), [@arybolovlev](https://redirect.github.com/arybolovlev); [cilium/cilium#47232](https://redirect.github.com/cilium/cilium/pull/47232), [@youngnick](https://redirect.github.com/youngnick); [cilium/cilium#46764](https://redirect.github.com/cilium/cilium/pull/46764), [@xtineskim](https://redirect.github.com/xtineskim)) - βοΈ **Configurable gRPC-Web Translation**: `CiliumGatewayClassConfig` can disable automatic gRPC-web translation for Gateways that need to pass the original traffic through unchanged. Translation remains enabled by default. ([cilium/cilium#45984](https://redirect.github.com/cilium/cilium/pull/45984), [@thorn3r](https://redirect.github.com/thorn3r)) - π **Networking** - π **Extensible Datapath**: Datapath plugins let cloud providers extend or instrument Cilium's eBPF datapath with independently versioned programs, without maintaining a Cilium fork. ([cilium/cilium#45028](https://redirect.github.com/cilium/cilium/pull/45028), [cilium/cilium#45429](https://redirect.github.com/cilium/cilium/pull/45429), [cilium/cilium#45558](https://redirect.github.com/cilium/cilium/pull/45558), [cilium/cilium#46673](https://redirect.github.com/cilium/cilium/pull/46673), [cilium/cilium#46872](https://redirect.github.com/cilium/cilium/pull/46872), [@jrife](https://redirect.github.com/jrife)) - π **Automatic Netkit Selection**: Set `bpf.datapathMode=auto` to use netkit automatically on supported kernels and fall back to veth on other nodes. The default remains veth. ([cilium/cilium#43062](https://redirect.github.com/cilium/cilium/pull/43062), [@ajmmm](https://redirect.github.com/ajmmm)) - π€ **Egress Gateway Improvements**: Dual-stack clusters can configure an explicit IPv6 egress IP. IPv4 Egress Gateway traffic also strictly honors the interface selected by the policy, matching the existing IPv6 behavior. ([cilium/cilium#44524](https://redirect.github.com/cilium/cilium/pull/44524), [@yykkibbb](https://redirect.github.com/yykkibbb); [cilium/cilium#45833](https://redirect.github.com/cilium/cilium/pull/45833), [@julianwiedmann](https://redirect.github.com/julianwiedmann)) - π **Better BGP Tooling and Reconciliation**: New Hive shell commands expose route policies and clearer peer output formats. The control plane moves to GoBGP v4.6.1 and optimizes route-policy reconciliation. ([cilium/cilium#45628](https://redirect.github.com/cilium/cilium/pull/45628), [cilium/cilium#45534](https://redirect.github.com/cilium/cilium/pull/45534), [@martonra](https://redirect.github.com/martonra); [cilium/cilium#45952](https://redirect.github.com/cilium/cilium/pull/45952), [cilium/cilium#46928](https://redirect.github.com/cilium/cilium/pull/46928), [@rastislavs](https://redirect.github.com/rastislavs)) - π **IPAM and IP Selection** - βοΈ **IPv6 for AWS ENI IPAM (Beta)**: Cilium can now allocate IPv6 prefixes to pods through AWS ENI IPAM, building on the move to the multi-pool allocator. ([cilium/cilium#46756](https://redirect.github.com/cilium/cilium/pull/46756), [cilium/cilium#46619](https://redirect.github.com/cilium/cilium/pull/46619), [@41ks](https://redirect.github.com/41ks); [cilium/cilium#45154](https://redirect.github.com/cilium/cilium/pull/45154), [cilium/cilium#45958](https://redirect.github.com/cilium/cilium/pull/45958), [@HadrienPatte](https://redirect.github.com/HadrienPatte)) - π **Migrate to Multi-Pool IPAM**: Existing clusters can move from cluster-pool IPAM to multi-pool IPAM without being rebuilt. ([cilium/cilium#46104](https://redirect.github.com/cilium/cilium/pull/46104), [@pippolo84](https://redirect.github.com/pippolo84)) - π§ **Dynamic NodePort Source Addresses**: NodePort can use the kernel FIB to select the preferred source address dynamically before SNATing north-south traffic, on supported kernels. ([cilium/cilium#44625](https://redirect.github.com/cilium/cilium/pull/44625), [@ldelossa](https://redirect.github.com/ldelossa)) - π΅ **Prefer IPv6 Consistently**: The new top-level `preferIpv6` option applies to both Cilium health probes and Hubble peer communication when IPv4 and IPv6 are available. ([cilium/cilium#45447](https://redirect.github.com/cilium/cilium/pull/45447), [@tibrezus](https://redirect.github.com/tibrezus)) - πΈοΈ **Services and Cluster Mesh** - π **Topology-Aware Service Traffic**: Cilium's service load balancer now supports the Kubernetes `PreferSameZone` and `PreferSameNode` traffic distribution hints. ([cilium/cilium#44771](https://redirect.github.com/cilium/cilium/pull/44771), [@raphink](https://redirect.github.com/raphink)) - βοΈ **Weighted Maglev Backends**: Maglev now honors the `service.cilium.io/weight` annotation on EndpointSlices. A weight of zero drains new connections while allowing existing connections to continue. ([cilium/cilium#46061](https://redirect.github.com/cilium/cilium/pull/46061), [@mhofstetter](https://redirect.github.com/mhofstetter)) - π **More Load-Balancing Options with VXLAN**: Clusters using VXLAN can use per-Service load-balancing mode annotations, including compatible DSR configurations such as IPIP dispatch. ([cilium/cilium#45600](https://redirect.github.com/cilium/cilium/pull/45600), [@brb](https://redirect.github.com/brb)) - π€ **Stable MCS API Support**: Cilium's implementation of the Kubernetes Multi-Cluster Services API is now stable and recommended for portable service discovery through ClusterMesh. ([cilium/cilium#45404](https://redirect.github.com/cilium/cilium/pull/45404), [cilium/cilium#46953](https://redirect.github.com/cilium/cilium/pull/46953), [@MrFreezeex](https://redirect.github.com/MrFreezeex)) - π **Encryption and Network Policy** - π **Improved Ztunnel Identity Management**: The ztunnel path now supports either an internal certificate authority or SPIRE-issued workload identities, alongside new Prometheus metrics for enrollment and connection health. It transparently encrypts enrolled pod-to-pod connections, including traffic between pods on the same node. ([cilium/cilium#43763](https://redirect.github.com/cilium/cilium/pull/43763), [cilium/cilium#44275](https://redirect.github.com/cilium/cilium/pull/44275), [cilium/cilium#44136](https://redirect.github.com/cilium/cilium/pull/44136), [cilium/cilium#45861](https://redirect.github.com/cilium/cilium/pull/45861), [@nddq](https://redirect.github.com/nddq); [cilium/cilium#45096](https://redirect.github.com/cilium/cilium/pull/45096), [@gokulMSFT](https://redirect.github.com/gokulMSFT)) - π‘οΈ **Kubernetes ClusterNetworkPolicy (KCNP)**: Cilium now supports the upstream, cluster-scoped policy API, including Admin and Baseline policy tiers alongside namespaced Kubernetes NetworkPolicy. ([cilium/cilium#42338](https://redirect.github.com/cilium/cilium/pull/42338), [@TheBeeZee](https://redirect.github.com/TheBeeZee); [cilium/cilium#46253](https://redirect.github.com/cilium/cilium/pull/46253), [@aanm](https://redirect.github.com/aanm)) - β **Friendlier IPv6 Policy Denials**: Cilium can return ICMPv6 Destination Unreachable responses when network policy denies IPv6 egress traffic, matching the IPv4 capability introduced in Cilium 1.19. ([cilium/cilium#44234](https://redirect.github.com/cilium/cilium/pull/44234), [@Andreagit97](https://redirect.github.com/Andreagit97)) - π **Select the Entire Cluster Mesh**: The new `cluster-mesh` policy entity selects every endpoint across a mesh, making cross-cluster security policies easier to express. ([cilium/cilium#46813](https://redirect.github.com/cilium/cilium/pull/46813), [@squeed](https://redirect.github.com/squeed)) - βοΈ **Standardize AWS VPC Group Policies**: Policies that reference AWS VPC groups are now transformed into `CiliumCIDRGroup` resources, bringing external IP groups into the standard Cilium policy model. ([cilium/cilium#44704](https://redirect.github.com/cilium/cilium/pull/44704), [@squeed](https://redirect.github.com/squeed)) - π **Per-Pod Source IP Verification Control**: Trusted workloads that need to send traffic with non-local source addresses can disable source IP verification through a pod annotation, guarded by a namespace-level opt-in. ([cilium/cilium#43505](https://redirect.github.com/cilium/cilium/pull/43505), [@zbb88888](https://redirect.github.com/zbb88888)) - βοΈ **Day 2 Operations and Observability** - π§ **Detect Configuration Drift**: Cilium can expose how many ConfigMap settings an agent has not yet applied, making it easier to identify when a restart is required after a configuration change. ([cilium/cilium#44703](https://redirect.github.com/cilium/cilium/pull/44703), [@PhilipSchmid](https://redirect.github.com/PhilipSchmid)) - β±οΈ **Understand Agent Start-Up Time**: New Hive lifecycle and Kubernetes resource-sync metrics show how long individual resources and components take to initialize. ([cilium/cilium#44802](https://redirect.github.com/cilium/cilium/pull/44802), [cilium/cilium#44639](https://redirect.github.com/cilium/cilium/pull/44639), [@ILL1A](https://redirect.github.com/ILL1A)) - π°οΈ **Correlate More Hubble Verdicts with Policies**: Hubble can now identify the policy responsible for audit verdicts. ([cilium/cilium#45373](https://redirect.github.com/cilium/cilium/pull/45373), [@Rajneesh180](https://redirect.github.com/Rajneesh180)) - π **Standalone DNS Proxy Metrics**: The Standalone DNS Proxy now exports DNS metrics back through Cilium, improving visibility when DNS policy processing runs outside the agent. ([cilium/cilium#45222](https://redirect.github.com/cilium/cilium/pull/45222), [cilium/cilium#44601](https://redirect.github.com/cilium/cilium/pull/44601), [@vipul-21](https://redirect.github.com/vipul-21)) - π
**Performance and Scale** - πΎ **Aggregated Load-Balancer State**: Cilium's internal backend representation has been flattened to efficiently support thousands of Services that share the same backends. ([cilium/cilium#44511](https://redirect.github.com/cilium/cilium/pull/44511), [@joamaki](https://redirect.github.com/joamaki)) - π‘ **More Efficient Envoy Updates**: New ADS and Delta xDS modes provide consistent or incremental delivery of Envoy resources, reducing CPU usage and policy update latency. ([cilium/cilium#43887](https://redirect.github.com/cilium/cilium/pull/43887), [@nezdolik](https://redirect.github.com/nezdolik); [cilium/cilium#45288](https://redirect.github.com/cilium/cilium/pull/45288), [@jrajahalme](https://redirect.github.com/jrajahalme)) - ποΈ **Optimized BPF Policy Map Encoding**: Semantic wildcard identities for remote-node and world reduce BPF policy-map pressure, particularly in larger clusters. ([cilium/cilium#46438](https://redirect.github.com/cilium/cilium/pull/46438), [@squeed](https://redirect.github.com/squeed)) - π¦ **Smaller CNI Binary**: The `cilium-cni` binary has been reduced from roughly 77 MB to 16 MB, shrinking both the Cilium image and its footprint on every node. ([cilium/cilium#45845](https://redirect.github.com/cilium/cilium/pull/45845), [@giorio94](https://redirect.github.com/giorio94)) - π οΈ **Updated Dependencies and Foundations**: Cilium 1.20 updates to Kubernetes v1.36, Envoy v1.37.x, Gateway API v1.6.1, GoBGP v4.6.1 and MCS API v0.5.2. Runtime and builder images now use Ubuntu 26.04, and the default CNI configuration version moves from 0.3.1 to 1.0.0. ([cilium/cilium#45499](https://redirect.github.com/cilium/cilium/pull/45499), [cilium/cilium#47215](https://redirect.github.com/cilium/cilium/pull/47215), [@HadrienPatte](https://redirect.github.com/HadrienPatte); [cilium/cilium#45851](https://redirect.github.com/cilium/cilium/pull/45851), [@sayboras](https://redirect.github.com/sayboras); [cilium/cilium#47274](https://redirect.github.com/cilium/cilium/pull/47274), [@arybolovlev](https://redirect.github.com/arybolovlev); [cilium/cilium#45952](https://redirect.github.com/cilium/cilium/pull/45952), [@rastislavs](https://redirect.github.com/rastislavs); [cilium/cilium#47166](https://redirect.github.com/cilium/cilium/pull/47166), [@MrFreezeex](https://redirect.github.com/MrFreezeex); [cilium/cilium#46971](https://redirect.github.com/cilium/cilium/pull/46971), [@gandro](https://redirect.github.com/gandro)) - π **Community** - β€οΈ **Production Case Studies**: Many end-users have told their stories running Cilium in production. Read and watch more from: [Asana](https://www.youtube.com/watch?v=mxjiSCnrb3c), [Etraveli](https://www.youtube.com/watch?v=KWS-NaZd62M\\&list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ\\&index=7), [Michelin](https://www.cncf.io/case-studies/michelin-2/), [OpenAI](https://isovalent.com/blog/post/openai-isovalent-networking-kubernetes-case-study/), [Suse](https://www.youtube.com/watch?v=bgCg1tS72ME\\&list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ\\&index=8), [TelefΓ³nica's acens](https://blogs.cisco.com/sp/telefonicas-acens-and-cisco-driving-the-next-generation-of-cloud-native-services-with-isovalent), and [Zynga](https://www.cncf.io/case-studies/zynga/). If your company wants to submit their case studies let us know. We would love to hear your feedback! - π³π± **Amsterdam Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and [Cilium Developer Summit](https://redirect.github.com/cilium/dev-summits/tree/main/2026-EU) in Amsterdam. [Watch the talks](https://www.youtube.com/playlist?list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ) from CiliumCon. - πΊπΈ **Salt Lake City Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developer Summit at KubeCon + CloudNativeCon North America in Salt Lake City, November 9-12. - π€ **Generative AI Policy**: The Cilium community adopted a [Generative AI Policy](https://redirect.github.com/cilium/community/blob/main/AI-POLICY.md) that encourages community members to connect and communicate with one another without the use of AI, while recognizing that different people work best with their own tools of choice. - π **Cilium Books**: Two new books landed for readers at every level β *[Cilium: Up and Running](https://isovalent.com/books/cilium-up-and-running/)* (O'Reilly), a practitioner's deep dive and *[Buzzing Beyond Clouds: The Illustrated Children's Guide to Cilium](https://isovalent.com/books/children-guide-to-cilium/)*, the follow-up to the eBPF children's guide. β€οΈ **Thank You**: Cilium 1.20 was made possible by contributors, reviewers and maintainers from across the community, including engineers from Datadog, Google, Microsoft and many other organizations. To keep up to date with all the latest Cilium releases, join #release π ##### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93` `quay.io/cilium/cilium:stable@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.0@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92` `quay.io/cilium/clustermesh-apiserver:stable@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.0@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94` `quay.io/cilium/hubble-relay:stable@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.0@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9` `quay.io/cilium/operator-alibabacloud:stable@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.0@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa` `quay.io/cilium/operator-aws:stable@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.0@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c` `quay.io/cilium/operator-azure:stable@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.0@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3` `quay.io/cilium/operator-generic:stable@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3` ##### operator `quay.io/cilium/operator:v1.20.0@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c` `quay.io/cilium/operator:stable@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c` ### [`v1.20.0`](https://redirect.github.com/cilium/cilium/releases/tag/v1.20.0): 1.20.0 [Compare Source](https://redirect.github.com/cilium/cilium/compare/1.19.6...1.20.0) π **Release Announcement** π: We are excited to announce the [Cilium 1.20.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.20.0) release! More than **2,660 new commits** have landed in this release, supported by a community of over **1,100 contributors** and more than **24,800 GitHub stars**! π€© β οΈ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the `cilium.io/v2alpha1` `CiliumNodeConfig` API, the libnetwork integration, or a custom CNI configuration. See the [Upgrade Guide](https://docs.cilium.io/en/v1.20/operations/upgrade/#upgrade-notes) for details. The full changelog can be found [here](https://redirect.github.com/cilium/cilium/blob/v1.20/CHANGELOG.md). Here are some of the highlights: - β©οΈ **Gateway API** - π **Gateway API v1.6.1**: Cilium moves from Gateway API v1.4 to v1.6.1, bringing support for capabilities that graduated across both upstream releases. ([cilium/cilium#45251](https://redirect.github.com/cilium/cilium/pull/45251), [@youngnick](https://redirect.github.com/youngnick); [cilium/cilium#46827](https://redirect.github.com/cilium/cilium/pull/46827), [cilium/cilium#47274](https://redirect.github.com/cilium/cilium/pull/47274), [@arybolovlev](https://redirect.github.com/arybolovlev)) - π₯ **Delegate Gateway Listeners**: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. ([cilium/cilium#46303](https://redirect.github.com/cilium/cilium/pull/46303), [cilium/cilium#46785](https://redirect.github.com/cilium/cilium/pull/46785), [@asauber](https://redirect.github.com/asauber)) - π **Encrypt Traffic to Backends**: Gateway API `BackendTLSPolicy` support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. ([cilium/cilium#43045](https://redirect.github.com/cilium/cilium/pull/43045), [@youngnick](https://redirect.github.com/youngnick)) - π **TCPRoute and UDPRoute**: Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic. ([cilium/cilium#46184](https://redirect.github.com/cilium/cilium/pull/46184), [cilium/cilium#46970](https://redirect.github.com/cilium/cilium/pull/46970), [@eminaktas](https://redirect.github.com/eminaktas); [cilium/cilium#47381](https://redirect.github.com/cilium/cilium/pull/47381), [@arybolovlev](https://redirect.github.com/arybolovlev)) - π **External Authorization**: HTTPRoute requests can now be authenticated and authorized through an external service before they reach the application, using the Gateway API `ExternalAuth` filter from GEP-1494. ([cilium/cilium#45739](https://redirect.github.com/cilium/cilium/pull/45739), [@gauteoh](https://redirect.github.com/gauteoh)) - ποΈ **More HTTP Traffic Controls**: HTTPRoutes gain native CORS support and additional 303, 307 and 308 redirect codes. `CiliumGatewayClassConfig` can also overwrite, append or preserve the HTTP Server response header. ([cilium/cilium#45924](https://redirect.github.com/cilium/cilium/pull/45924), [@arybolovlev](https://redirect.github.com/arybolovlev); [cilium/cilium#47232](https://redirect.github.com/cilium/cilium/pull/47232), [@youngnick](https://redirect.github.com/youngnick); [cilium/cilium#46764](https://redirect.github.com/cilium/cilium/pull/46764), [@xtineskim](https://redirect.github.com/xtineskim)) - βοΈ **Configurable gRPC-Web Translation**: `CiliumGatewayClassConfig` can disable automatic gRPC-web translation for Gateways that need to pass the original traffic through unchanged. Translation remains enabled by default. ([cilium/cilium#45984](https://redirect.github.com/cilium/cilium/pull/45984), [@thorn3r](https://redirect.github.com/thorn3r)) - π **Networking** - π **Extensible Datapath**: Datapath plugins let cloud providers extend or instrument Cilium's eBPF datapath with independently versioned programs, without maintaining a Cilium fork. ([cilium/cilium#45028](https://redirect.github.com/cilium/cilium/pull/45028), [cilium/cilium#45429](https://redirect.github.com/cilium/cilium/pull/45429), [cilium/cilium#45558](https://redirect.github.com/cilium/cilium/pull/45558), [cilium/cilium#46673](https://redirect.github.com/cilium/cilium/pull/46673), [cilium/cilium#46872](https://redirect.github.com/cilium/cilium/pull/46872), [@jrife](https://redirect.github.com/jrife)) - π **Automatic Netkit Selection**: Set `bpf.datapathMode=auto` to use netkit automatically on supported kernels and fall back to veth on other nodes. The default remains veth. ([cilium/cilium#43062](https://redirect.github.com/cilium/cilium/pull/43062), [@ajmmm](https://redirect.github.com/ajmmm)) - π€ **Egress Gateway Improvements**: Dual-stack clusters can configure an explicit IPv6 egress IP. IPv4 Egress Gateway traffic also strictly honors the interface selected by the policy, matching the existing IPv6 behavior. ([cilium/cilium#44524](https://redirect.github.com/cilium/cilium/pull/44524), [@yykkibbb](https://redirect.github.com/yykkibbb); [cilium/cilium#45833](https://redirect.github.com/cilium/cilium/pull/45833), [@julianwiedmann](https://redirect.github.com/julianwiedmann)) - π **Better BGP Tooling and Reconciliation**: New Hive shell commands expose route policies and clearer peer output formats. The control plane moves to GoBGP v4.6.1 and optimizes route-policy reconciliation. ([cilium/cilium#45628](https://redirect.github.com/cilium/cilium/pull/45628), [cilium/cilium#45534](https://redirect.github.com/cilium/cilium/pull/45534), [@martonra](https://redirect.github.com/martonra); [cilium/cilium#45952](https://redirect.github.com/cilium/cilium/pull/45952), [cilium/cilium#46928](https://redirect.github.com/cilium/cilium/pull/46928), [@rastislavs](https://redirect.github.com/rastislavs)) - π **IPAM and IP Selection** - βοΈ **IPv6 for AWS ENI IPAM (Beta)**: Cilium can now allocate IPv6 prefixes to pods through AWS ENI IPAM, building on the move to the multi-pool allocator. ([cilium/cilium#46756](https://redirect.github.com/cilium/cilium/pull/46756), [cilium/cilium#46619](https://redirect.github.com/cilium/cilium/pull/46619), [@41ks](https://redirect.github.com/41ks); [cilium/cilium#45154](https://redirect.github.com/cilium/cilium/pull/45154), [cilium/cilium#45958](https://redirect.github.com/cilium/cilium/pull/45958), [@HadrienPatte](https://redirect.github.com/HadrienPatte)) - π **Migrate to Multi-Pool IPAM**: Existing clusters can move from cluster-pool IPAM to multi-pool IPAM without being rebuilt. ([cilium/cilium#46104](https://redirect.github.com/cilium/cilium/pull/46104), [@pippolo84](https://redirect.github.com/pippolo84)) - π§ **Dynamic NodePort Source Addresses**: NodePort can use the kernel FIB to select the preferred source address dynamically before SNATing north-south traffic, on supported kernels. ([cilium/cilium#44625](https://redirect.github.com/cilium/cilium/pull/44625), [@ldelossa](https://redirect.github.com/ldelossa)) - π΅ **Prefer IPv6 Consistently**: The new top-level `preferIpv6` option applies to both Cilium health probes and Hubble peer communication when IPv4 and IPv6 are available. ([cilium/cilium#45447](https://redirect.github.com/cilium/cilium/pull/45447), [@tibrezus](https://redirect.github.com/tibrezus)) - πΈοΈ **Services and Cluster Mesh** - π **Topology-Aware Service Traffic**: Cilium's service load balancer now supports the Kubernetes `PreferSameZone` and `PreferSameNode` traffic distribution hints. ([cilium/cilium#44771](https://redirect.github.com/cilium/cilium/pull/44771), [@raphink](https://redirect.github.com/raphink)) - βοΈ **Weighted Maglev Backends**: Maglev now honors the `service.cilium.io/weight` annotation on EndpointSlices. A weight of zero drains new connections while allowing existing connections to continue. ([cilium/cilium#46061](https://redirect.github.com/cilium/cilium/pull/46061), [@mhofstetter](https://redirect.github.com/mhofstetter)) - π **More Load-Balancing Options with VXLAN**: Clusters using VXLAN can use per-Service load-balancing mode annotations, including compatible DSR configurations such as IPIP dispatch. ([cilium/cilium#45600](https://redirect.github.com/cilium/cilium/pull/45600), [@brb](https://redirect.github.com/brb)) - π€ **Stable MCS API Support**: Cilium's implementation of the Kubernetes Multi-Cluster Services API is now stable and recommended for portable service discovery through ClusterMesh. ([cilium/cilium#45404](https://redirect.github.com/cilium/cilium/pull/45404), [cilium/cilium#46953](https://redirect.github.com/cilium/cilium/pull/46953), [@MrFreezeex](https://redirect.github.com/MrFreezeex)) - π **Encryption and Network Policy** - π **Improved Ztunnel Identity Management**: The ztunnel path now supports either an internal certificate authority or SPIRE-issued workload identities, alongside new Prometheus metrics for enrollment and connection health. It transparently encrypts enrolled pod-to-pod connections, including traffic between pods on the same node. ([cilium/cilium#43763](https://redirect.github.com/cilium/cilium/pull/43763), [cilium/cilium#44275](https://redirect.github.com/cilium/cilium/pull/44275), [cilium/cilium#44136](https://redirect.github.com/cilium/cilium/pull/44136), [cilium/cilium#45861](https://redirect.github.com/cilium/cilium/pull/45861), [@nddq](https://redirect.github.com/nddq); [cilium/cilium#45096](https://redirect.github.com/cilium/cilium/pull/45096), [@gokulMSFT](https://redirect.github.com/gokulMSFT)) - π‘οΈ **Kubernetes ClusterNetworkPolicy (KCNP)**: Cilium now supports the upstream, cluster-scoped policy API, including Admin and Baseline policy tiers alongside namespaced Kubernetes NetworkPolicy. ([cilium/cilium#42338](https://redirect.github.com/cilium/cilium/pull/42338), [@TheBeeZee](https://redirect.github.com/TheBeeZee); [cilium/cilium#46253](https://redirect.github.com/cilium/cilium/pull/46253), [@aanm](https://redirect.github.com/aanm)) - β **Friendlier IPv6 Policy Denials**: Cilium can return ICMPv6 Destination Unreachable responses when network policy denies IPv6 egress traffic, matching the IPv4 capability introduced in Cilium 1.19. ([cilium/cilium#44234](https://redirect.github.com/cilium/cilium/pull/44234), [@Andreagit97](https://redirect.github.com/Andreagit97)) - π **Select the Entire Cluster Mesh**: The new `cluster-mesh` policy entity selects every endpoint across a mesh, making cross-cluster security policies easier to express. ([cilium/cilium#46813](https://redirect.github.com/cilium/cilium/pull/46813), [@squeed](https://redirect.github.com/squeed)) - βοΈ **Standardize AWS VPC Group Policies**: Policies that reference AWS VPC groups are now transformed into `CiliumCIDRGroup` resources, bringing external IP groups into the standard Cilium policy model. ([cilium/cilium#44704](https://redirect.github.com/cilium/cilium/pull/44704), [@squeed](https://redirect.github.com/squeed)) - π **Per-Pod Source IP Verification Control**: Trusted workloads that need to send traffic with non-local source addresses can disable source IP verification through a pod annotation, guarded by a namespace-level opt-in. ([cilium/cilium#43505](https://redirect.github.com/cilium/cilium/pull/43505), [@zbb88888](https://redirect.github.com/zbb88888)) - βοΈ **Day 2 Operations and Observability** - π§ **Detect Configuration Drift**: Cilium can expose how many ConfigMap settings an agent has not yet applied, making it easier to identify when a restart is required after a configuration change. ([cilium/cilium#44703](https://redirect.github.com/cilium/cilium/pull/44703), [@PhilipSchmid](https://redirect.github.com/PhilipSchmid)) - β±οΈ **Understand Agent Start-Up Time**: New Hive lifecycle and Kubernetes resource-sync metrics show how long individual resources and components take to initialize. ([cilium/cilium#44802](https://redirect.github.com/cilium/cilium/pull/44802), [cilium/cilium#44639](https://redirect.github.com/cilium/cilium/pull/44639), [@ILL1A](https://redirect.github.com/ILL1A)) - π°οΈ **Correlate More Hubble Verdicts with Policies**: Hubble can now identify the policy responsible for audit verdicts. ([cilium/cilium#45373](https://redirect.github.com/cilium/cilium/pull/45373), [@Rajneesh180](https://redirect.github.com/Rajneesh180)) - π **Standalone DNS Proxy Metrics**: The Standalone DNS Proxy now exports DNS metrics back through Cilium, improving visibility when DNS policy processing runs outside the agent. ([cilium/cilium#45222](https://redirect.github.com/cilium/cilium/pull/45222), [cilium/cilium#44601](https://redirect.github.com/cilium/cilium/pull/44601), [@vipul-21](https://redirect.github.com/vipul-21)) - π
**Performance and Scale** - πΎ **Aggregated Load-Balancer State**: Cilium's internal backend representation has been flattened to efficiently support thousands of Services that share the same backends. ([cilium/cilium#44511](https://redirect.github.com/cilium/cilium/pull/44511), [@joamaki](https://redirect.github.com/joamaki)) - π‘ **More Efficient Envoy Updates**: New ADS and Delta xDS modes provide consistent or incremental delivery of Envoy resources, reducing CPU usage and policy update latency. ([cilium/cilium#43887](https://redirect.github.com/cilium/cilium/pull/43887), [@nezdolik](https://redirect.github.com/nezdolik); [cilium/cilium#45288](https://redirect.github.com/cilium/cilium/pull/45288), [@jrajahalme](https://redirect.github.com/jrajahalme)) - ποΈ **Optimized BPF Policy Map Encoding**: Semantic wildcard identities for remote-node and world reduce BPF policy-map pressure, particularly in larger clusters. ([cilium/cilium#46438](https://redirect.github.com/cilium/cilium/pull/46438), [@squeed](https://redirect.github.com/squeed)) - π¦ **Smaller CNI Binary**: The `cilium-cni` binary has been reduced from roughly 77 MB to 16 MB, shrinking both the Cilium image and its footprint on every node. ([cilium/cilium#45845](https://redirect.github.com/cilium/cilium/pull/45845), [@giorio94](https://redirect.github.com/giorio94)) - π οΈ **Updated Dependencies and Foundations**: Cilium 1.20 updates to Kubernetes v1.36, Envoy v1.37.x, Gateway API v1.6.1, GoBGP v4.6.1 and MCS API v0.5.2. Runtime and builder images now use Ubuntu 26.04, and the default CNI configuration version moves from 0.3.1 to 1.0.0. ([cilium/cilium#45499](https://redirect.github.com/cilium/cilium/pull/45499), [cilium/cilium#47215](https://redirect.github.com/cilium/cilium/pull/47215), [@HadrienPatte](https://redirect.github.com/HadrienPatte); [cilium/cilium#45851](https://redirect.github.com/cilium/cilium/pull/45851), [@sayboras](https://redirect.github.com/sayboras); [cilium/cilium#47274](https://redirect.github.com/cilium/cilium/pull/47274), [@arybolovlev](https://redirect.github.com/arybolovlev); [cilium/cilium#45952](https://redirect.github.com/cilium/cilium/pull/45952), [@rastislavs](https://redirect.github.com/rastislavs); [cilium/cilium#47166](https://redirect.github.com/cilium/cilium/pull/47166), [@MrFreezeex](https://redirect.github.com/MrFreezeex); [cilium/cilium#46971](https://redirect.github.com/cilium/cilium/pull/46971), [@gandro](https://redirect.github.com/gandro)) - π **Community** - β€οΈ **Production Case Studies**: Many end-users have told their stories running Cilium in production. Read and watch more from: [Asana](https://www.youtube.com/watch?v=mxjiSCnrb3c), [Etraveli](https://www.youtube.com/watch?v=KWS-NaZd62M\\&list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ\\&index=7), [Michelin](https://www.cncf.io/case-studies/michelin-2/), [OpenAI](https://isovalent.com/blog/post/openai-isovalent-networking-kubernetes-case-study/), [Suse](https://www.youtube.com/watch?v=bgCg1tS72ME\\&list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ\\&index=8), [TelefΓ³nica's acens](https://blogs.cisco.com/sp/telefonicas-acens-and-cisco-driving-the-next-generation-of-cloud-native-services-with-isovalent), and [Zynga](https://www.cncf.io/case-studies/zynga/). If your company wants to submit their case studies let us know. We would love to hear your feedback! - π³π± **Amsterdam Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and [Cilium Developer Summit](https://redirect.github.com/cilium/dev-summits/tree/main/2026-EU) in Amsterdam. [Watch the talks](https://www.youtube.com/playlist?list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ) from CiliumCon. - πΊπΈ **Salt Lake City Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developer Summit at KubeCon + CloudNativeCon North America in Salt Lake City, November 9-12. - π€ **Generative AI Policy**: The Cilium community adopted a [Generative AI Policy](https://redirect.github.com/cilium/community/blob/main/AI-POLICY.md) that encourages community members to connect and communicate with one another without the use of AI, while recognizing that different people work best with their own tools of choice. - π **Cilium Books**: Two new books landed for readers at every level β *[Cilium: Up and Running](https://isovalent.com/books/cilium-up-and-running/)* (O'Reilly), a practitioner's deep dive and *[Buzzing Beyond Clouds: The Illustrated Children's Guide to Cilium](https://isovalent.com/books/children-guide-to-cilium/)*, the follow-up to the eBPF children's guide. β€οΈ **Thank You**: Cilium 1.20 was made possible by contributors, reviewers and maintainers from across the community, including engineers from Datadog, Google, Microsoft and many other organizations. To keep up to date with all the latest Cilium releases, join #release π ##### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93` `quay.io/cilium/cilium:stable@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.0@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92` `quay.io/cilium/clustermesh-apiserver:stable@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.0@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94` `quay.io/cilium/hubble-relay:stable@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.0@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9` `quay.io/cilium/operator-alibabacloud:stable@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.0@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa` `quay.io/cilium/operator-aws:stable@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.0@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c` `quay.io/cilium/operator-azure:stable@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.0@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3` `quay.io/cilium/operator-generic:stable@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3` ##### operator `quay.io/cilium/operator:v1.20.0@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c` `quay.io/cilium/operator:stable@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c` docker/login-action (docker/login-action)
### [`v4.6.0`](https://redirect.github.com/docker/login-action/releases/tag/v4.6.0) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.5.2...v4.6.0) - Harden buildx scoped config path handling by [@crazy-max](https://redirect.github.com/crazy-max) in [#1059](https://redirect.github.com/docker/login-action/pull/1059) - Bump [@aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) and [@aws-sdk/client-ecr-public](https://redirect.github.com/aws-sdk/client-ecr-public) to 3.1095.0 in [#1051](https://redirect.github.com/docker/login-action/pull/1051) - Bump js-yaml from 5.2.1 to 5.2.2 in [#1057](https://redirect.github.com/docker/login-action/pull/1057) - Bump postcss from 8.5.10 to 8.5.22 in [#1056](https://redirect.github.com/docker/login-action/pull/1056) **Full Changelog**: github/codeql-action (github/codeql-action)
### [`v4.37.5`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.5) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.4...v4.37.5) - Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://redirect.github.com/github/codeql-action/pull/4061) ### [`v4.37.4`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.4) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.3...v4.37.4) - This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://redirect.github.com/github/codeql-action/pull/4037) - Update default CodeQL bundle version to [2.26.2](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://redirect.github.com/github/codeql-action/pull/4051) renovatebot/github-action (renovatebot/github-action)
### [`v46.2.1`](https://redirect.github.com/renovatebot/github-action/releases/tag/v46.2.1) [Compare Source](https://redirect.github.com/renovatebot/github-action/compare/v46.2.0...v46.2.1) ##### Documentation - update references to renovatebot/github-action to v46.2.0 ([b48aa6c](https://redirect.github.com/renovatebot/github-action/commit/b48aa6c21875ffa00dc6215bc4453262b81eaf73)) ##### Miscellaneous Chores - **deps:** update dependency globals to v17.8.0 ([3e46bd7](https://redirect.github.com/renovatebot/github-action/commit/3e46bd72790497e1894cc90581626a83e91932c3)) - **deps:** update dependency lint-staged to v17.2.0 ([9c685f2](https://redirect.github.com/renovatebot/github-action/commit/9c685f2a9881f67e357e60b4b46e30576efcb139)) - **deps:** update node.js to v24.18.1 ([f525256](https://redirect.github.com/renovatebot/github-action/commit/f52525626d00279a6ce548e44d82c015c2be2f79)) ##### Build System - **deps:** lock file maintenance ([3d8211a](https://redirect.github.com/renovatebot/github-action/commit/3d8211a3c37e5b20e4d27ece75eadc95d43356c7)) ##### Continuous Integration - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.0.1 ([d471d52](https://redirect.github.com/renovatebot/github-action/commit/d471d52edecc92151b1deffeb3d01a4b80b59fa1)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.2.1 ([5cb64df](https://redirect.github.com/renovatebot/github-action/commit/5cb64df2a3bfd25b911705834f55758002b90753)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.2.2 ([a6b5808](https://redirect.github.com/renovatebot/github-action/commit/a6b5808d7b51494262c60fa1689b3d8f4a816e4e)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.2.3 ([ab4d1eb](https://redirect.github.com/renovatebot/github-action/commit/ab4d1eb1a432926c1bf6b4255c01787ae00df16c)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.3.0 ([a427843](https://redirect.github.com/renovatebot/github-action/commit/a427843f2d41af326ec66d7506b1a2513b511af9)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.3.3 ([2ac8329](https://redirect.github.com/renovatebot/github-action/commit/2ac8329d950b26e8aa6f8ee6b1b686b3babd64a2)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.4.0 ([7665449](https://redirect.github.com/renovatebot/github-action/commit/7665449ea26ebce5a6c734bda989ec3b42849d71)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.4.2 ([0166c9f](https://redirect.github.com/renovatebot/github-action/commit/0166c9f78c5ec89ce686465bc5442d5dbdee3940)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.4.3 ([8662b55](https://redirect.github.com/renovatebot/github-action/commit/8662b55bbc8cf88000457c38636441458d358c33)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.4.5 ([1e71262](https://redirect.github.com/renovatebot/github-action/commit/1e71262fc6711a19c74ce965b485f4aa64bde81d)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.4.6 ([7bec40c](https://redirect.github.com/renovatebot/github-action/commit/7bec40cad622ea16aab5758dee8ab4ba5d2ab9fa)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.5.0 ([d146e8b](https://redirect.github.com/renovatebot/github-action/commit/d146e8b14e30ae18a8c05b8db970466d7882c240)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.5.1 ([ddd5dca](https://redirect.github.com/renovatebot/github-action/commit/ddd5dcaccd40a1bc93ec009e31caefb2c82aea61)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.5.2 ([0731dab](https://redirect.github.com/renovatebot/github-action/commit/0731dab41dcfb74c0fe073fbe697d39b35602e53)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.5.3 ([700f3b5](https://redirect.github.com/renovatebot/github-action/commit/700f3b59b9d0fc6dffce45b564ee1f58869973b1)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.6.0 ([7edb80e](https://redirect.github.com/renovatebot/github-action/commit/7edb80eba67c17f75cebdf7b4259f1902b75032e)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.7.0 ([127e8ef](https://redirect.github.com/renovatebot/github-action/commit/127e8ef2a0d7b2fdd66445b332d46a93fe1310b3)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.7.1 ([f7532d1](https://redirect.github.com/renovatebot/github-action/commit/f7532d19871b25335df440d8029eba8f9c5e41f0)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.7.2 ([0fcd35b](https://redirect.github.com/renovatebot/github-action/commit/0fcd35be09a6f0873d63680d8123a868788a1245)) - **deps:** update ghcr.io/zizmorcore/zizmor docker tag to v1.29.0 ([#1068](https://redirect.github.com/renovatebot/github-action/issues/1068)) ([581f6ac](https://redirect.github.com/renovatebot/github-action/commit/581f6ac0a630038ab49d600de079abcbcee26c06)) - **deps:** update zizmorcore/zizmor-action action to v0.6.2 ([e36e81c](https://redirect.github.com/renovatebot/github-action/commit/e36e81c4ca010c6d7f888593b62de0cf6c2b0162)) ### [`v46.2.0`](https://redirect.github.com/renovatebot/github-action/releases/tag/v46.2.0) [Compare Source](https://redirect.github.com/renovatebot/github-action/compare/v46.1.21...v46.2.0) ##### Features - **deps:** Update ghcr.io/renovatebot/renovate Docker tag to v44 ([#1067](https://redirect.github.com/renovatebot/github-action/issues/1067)) ([efa6654](https://redirect.github.com/renovatebot/github-action/commit/efa66542b141f41a69921c360bd114828dede0d3)) ##### Documentation - update references to renovatebot/github-action to v46.1.21 ([66c62f6](https://redirect.github.com/renovatebot/github-action/commit/66c62f63f2c3421614d095425958eedf3cc04d5e)) ##### Miscellaneous Chores - **deps:** update dependency lint-staged to v17.1.1 ([403000c](https://redirect.github.com/renovatebot/github-action/commit/403000c150cbd7d4db2cb878ab66aa42ac6334cb)) - **deps:** update dependency prettier to v3.9.6 ([6787cf2](https://redirect.github.com/renovatebot/github-action/commit/6787cf234f64324b859ccc5e114502d2874c3132)) - **deps:** update dependency typescript-eslint to v8.65.0 ([656e12f](https://redirect.github.com/renovatebot/github-action/commit/656e12f088834d925552fc033316416ff08e0c64)) ##### Continuous Integration - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.283.0 ([560e916](https://redirect.github.com/renovatebot/github-action/commit/560e916d9c7cce71747db50c8a0bcc0afe51a1e0)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.284.0 ([92c373e](https://redirect.github.com/renovatebot/github-action/commit/92c373e9b7513cd0f5df722cb31278ca5ba5ed90)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.284.1 ([b0f9fee](https://redirect.github.com/renovatebot/github-action/commit/b0f9fee8f9e958e395896a25fb03ca676a70d1e2)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.285.0 ([bfb9d5d](https://redirect.github.com/renovatebot/github-action/commit/bfb9d5d946fb4cdf47c1cdd6ac1c862f594e9682)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.285.3 ([91ba9dc](https://redirect.github.com/renovatebot/github-action/commit/91ba9dcb5bb72c71271fc26c63091ef4cba219f9)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.285.4 ([e41061b](https://redirect.github.com/renovatebot/github-action/commit/e41061becfb2ab7ec537b00b7d7551fd58ed22f9)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.285.6 ([e8a7a1c](https://redirect.github.com/renovatebot/github-action/commit/e8a7a1cf58613503b896d69e0c35d616370b51d3)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.285.7 ([7a22a55](https://redirect.github.com/renovatebot/github-action/commit/7a22a554ffad16018e2fa2f53d38091ba9178177)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.286.0 ([7590e1e](https://redirect.github.com/renovatebot/github-action/commit/7590e1eb8e006917e8b8a312ab6f6c254bb796fd)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.286.1 ([cae6616](https://redirect.github.com/renovatebot/github-action/commit/cae6616a21e987edd1928b477910d377d07f3c45)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.287.0 ([#1066](https://redirect.github.com/renovatebot/github-action/issues/1066)) ([4f87158](https://redirect.github.com/renovatebot/github-action/commit/4f871588a5a0fc837cf0be6ffbad04c212656b37)) --- ### Configuration π
**Schedule**: (UTC) - Branch creation - \"on sunday\" - Automerge - At any time (no schedule defined) π¦ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. π» **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). ",
"url": "https://github.com/cilium/cilium/pull/47861",
"createdAt": "2026-08-09T00:42:34Z",
"updatedAt": "2026-08-12T23:25:01Z",
"timestamp": "2026-08-12T23:25:01Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"kind/enhancement",
"release-note/misc",
"kind/community-contribution",
"renovate/stop-updating",
"area/renovate"
],
"author": "cilium-renovate[bot]",
"state": "open",
"assignees": [
"joestringer"
]
},
{
"id": "github:cilium/cilium:pull_request:47869",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "chore(deps): update docker.io/library/golang:1.25.12 docker digest to 2c7ebca (v1.18)",
"text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [docker.io/library/golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | stage | digest | `9006890` β `2c7ebca` | | [docker.io/library/golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | final | digest | `9006890` β `2c7ebca` | --- ### Configuration π
**Schedule**: (UTC) - Branch creation - \"on sunday\" - Automerge - At any time (no schedule defined) π¦ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β» **Rebasing**: Never, or you tick the rebase/retry checkbox. π **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). ",
"url": "https://github.com/cilium/cilium/pull/47869",
"createdAt": "2026-08-09T01:03:34Z",
"updatedAt": "2026-08-12T19:51:13Z",
"timestamp": "2026-08-12T19:51:13Z",
"metrics": {
"reactions": 0,
"comments": 4
},
"labels": [
"kind/enhancement",
"ready-to-merge",
"kind/backports",
"release-note/misc",
"kind/community-contribution",
"renovate/stop-updating",
"backport/1.18"
],
"author": "cilium-renovate[bot]",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47874",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ipam: Accept native routing CIDR overlapping a secondary VPC CIDR",
"text": "ENI IPAM checks ipv4NativeRoutingCIDR against the VPC primary CIDR only. Pod subnets in a secondary CIDR association are rejected and every agent crash-loops on startup, with no way to disable the check. - Derive the secondary CIDR associations alongside the primary CIDR - Accept if the configured CIDR overlaps any of them; fatal only when none match - Subnets and supernets of a VPC CIDR stay accepted - Add the test coverage this validation never had This PR was prepared with `AIL:2`. Claude Code was used to debug initial failure condition and assistance in understanding existing conventions within the repo. It assisted in writing tests and once I completed initial code changes, I used the `/simplify` skill to assist in finding examples where I could simplify logic or re-use existing patterns. Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [ ] Thanks for contributing! Fixes: #47811 ```release-note Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47874",
"createdAt": "2026-08-09T09:25:47Z",
"updatedAt": "2026-08-13T07:31:12Z",
"timestamp": "2026-08-13T07:31:12Z",
"metrics": {
"reactions": 1,
"comments": 6
},
"labels": [
"kind/bug",
"release-note/bug",
"ready-to-merge",
"kind/regression",
"area/eni",
"kind/community-contribution",
"needs-backport/1.20"
],
"author": "bryanhorstmann",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47878",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "node: don't select IFA_F_DEPRECATED addresses as the node IP",
"text": "Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! `firstGlobalAddr()` ignores `IFA_F_DEPRECATED`, so an address whose preferred lifetime has expired can be picked as the node address. kube-vip in ARP mode parks its VIP with `preferred_lft 0`, so Cilium can end up claiming a floating VIP as the node's own address. #45868 filtered `IFA_F_TENTATIVE|IFA_F_DADFAILED` for the same class of bug, but deprecated is a different case. Tentative and dadfailed addresses cannot carry traffic; a deprecated one can. RFC 4862 only bars it for *new* communication, and under RFC 6724 rule 3 the kernel deprioritizes rather than excludes it. Adding the flag to that mask would take a node whose only address has deprecated, say because a router stopped advertising the prefix, from working to failing to select any address at all. So this prefers non-deprecated addresses instead of filtering deprecated ones. The existing search is unchanged and runs a second time allowing deprecated addresses, but only if the first pass found nothing. `errNoAddressFound` becomes a sentinel so that retry fires on \"nothing matched\" and not on a netlink error. One consequence worth flagging: the first pass completes the whole existing fallback ladder, including the all-interfaces stage, before the second begins. A non-deprecated address on another interface therefore beats a deprecated one on the requested interface. That is already how the ladder treats tentative and dadfailed addresses. Happy to invert it if you'd rather the requested interface always win. ### Not included The `Table[*Device]` path is untouched. `tables.DeviceAddress` does not carry the netlink flags, and unlike the DAD flags (which only ever clear) `IFA_F_DEPRECATED` gets set *after* the address is already in the table. The `RTM_NEWADDR` for that transition produces a byte-identical `DeviceAddress`, so a #45868-style ingest filter would be a silent no-op there. A proper fix needs a `Deprecated` field on `DeviceAddress` plus removal-on-update. I can file that separately. ### Testing `TestAddrUsableAsNodeIP` gains 4 cases, one of which checks that allowing deprecated addresses does not weaken the tentative/dadfailed rejection. `TestPrivilegedFirstGlobalV4AddrDeprecated` is new: it runs in a netns with a dummy device and an address added with `preferred_lft 0`, covering both \"deprecated skipped when a usable address exists\" and \"deprecated used when it is the only one\". Reverting just the flag check makes the first case fail with `got 21.0.0.1, want 192.168.0.1`, Cilium picking the deprecated public VIP over the usable private address. Fixes: #47853 ```release-note Don't select IPv4/IPv6 addresses flagged deprecated when determining the node address ``` This PR was prepared with AIL:2. I wrote the change itself; AI was used to get up to speed on this codebase and to draft the tests. I reviewed the full diff and verified it locally, including the revert check described above. [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47878",
"createdAt": "2026-08-10T04:18:56Z",
"updatedAt": "2026-08-13T10:33:38Z",
"timestamp": "2026-08-13T10:33:38Z",
"metrics": {
"reactions": 1,
"comments": 3
},
"labels": [
"kind/enhancement",
"release-note/minor",
"area/agent",
"kind/community-contribution"
],
"author": "arcusbuilds",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47881",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "[v1.20] bpf: dsr: various fixes",
"text": "Backport * [ ] #47388 * [ ] #47529 * [ ] #47593 * [ ] #47640 * [ ] #47592 * [ ] #47841 ```release-note Fix various aspects in the DSR feature: support TCP-RST after switching to a new backend, fix processing of fragmented TCP traffic, fix accidental RevDNAT of a connection which matches an earlier DSR connection. ``` ```upstream-prs 47388 47529 47593 47640 47592 47841 ```",
"url": "https://github.com/cilium/cilium/pull/47881",
"createdAt": "2026-08-10T08:02:13Z",
"updatedAt": "2026-08-13T08:54:27Z",
"timestamp": "2026-08-13T08:54:27Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"kind/backports",
"backport/1.20"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
]
},
{
"id": "github:cilium/cilium:pull_request:47882",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "operator: prevent CNPs with nodeSelector from silently enforcing nothing",
"text": " The Rule struct is shared by both CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy, and its NodeSelector field can only be used in CiliumClusterwideNetworkPolicies. ``` // https://github.com/cilium/cilium/blob/main/pkg/policy/api/rule.go#L76 type Rule struct { ... // NodeSelector selects all nodes which should be subject to this rule. // EndpointSelector and NodeSelector cannot be both empty and are mutually // exclusive. Can only be used in CiliumClusterwideNetworkPolicies. // // +kubebuilder:validation:OneOf NodeSelector EndpointSelector `json:\"nodeSelector,omitzero\"` } ``` When a user creates an instance like the following: ``` apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: namespace: foo name: host-policy spec: nodeSelector: matchLabels: node-role.kubernetes.io/worker: \"\" ingress: - fromEntities: [cluster] ``` nodeSelector is not allowed in a CiliumNetworkPolicy, but the operator currently does not validate it, while the cilium agent rejects such an instance and refuses to enforce it. ``` // https://github.com/cilium/cilium/blob/main/pkg/k8s/apis/cilium.io/v2/cnp_types.go#L199 if r.Spec.NodeSelector.LabelSelector != nil { return nil, NewErrParse(\"Invalid CiliumNetworkPolicy spec: rule cannot have NodeSelector\") } ``` As a result, this error is not surfaced in the status of the CiliumNetworkPolicy, so users are misled into believing the policy is in effect, even though the cilium agent has already reported an error. Fixes: #issue-number ```release-note operator: prevent CNPs with nodeSelector from silently enforcing nothing ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47882",
"createdAt": "2026-08-10T09:19:19Z",
"updatedAt": "2026-08-13T15:44:29Z",
"timestamp": "2026-08-13T15:44:29Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"release-note/bug",
"kind/community-contribution"
],
"author": "weizhoublue",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47885",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "v1.20 Backports 2026-08-10",
"text": "* [ ] #47587 (@thorn3r) * [x] #47780 (@giorio94) * [ ] #47208 (@iwanhae) * [ ] #47754 (@weizhoublue) * [ ] #47741 (@jdw6359) * [x] #47758 (@mhofstetter) * [x] #47766 (@mhofstetter) * [x] #47824 (@MrFreezeex) * [ ] #47838 (@aanm) * [x] #47844 (@bimmlerd) * [ ] #47801 (@aanm) Once this PR is merged, a GitHub action will update the labels of these PRs: ```upstream-prs 47587 47780 47208 47754 47741 47758 47766 47824 47838 47844 47801 ```",
"url": "https://github.com/cilium/cilium/pull/47885",
"createdAt": "2026-08-10T14:07:46Z",
"updatedAt": "2026-08-12T22:42:09Z",
"timestamp": "2026-08-12T22:42:09Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"kind/backports",
"feature/k8s-gateway-api",
"backport/1.20"
],
"author": "pippolo84",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47887",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "v1.18 Backports 2026-08-10",
"text": "* [x] #47780 (@giorio94) :warning: resolved conflicts * [ ] #47208 (@iwanhae) :warning: resolved conflicts * [x] #47801 (@aanm) :warning: resolved conflicts Once this PR is merged, a GitHub action will update the labels of these PRs: ```upstream-prs 47780 47208 47801 ```",
"url": "https://github.com/cilium/cilium/pull/47887",
"createdAt": "2026-08-10T14:53:04Z",
"updatedAt": "2026-08-12T22:42:48Z",
"timestamp": "2026-08-12T22:42:48Z",
"metrics": {
"reactions": 0,
"comments": 2
},
"labels": [
"kind/backports",
"backport/1.18"
],
"author": "pippolo84",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47888",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf, datapath: move IPv{6,4} direct routing address to runtime config",
"text": "This moves the `IPV{4,6}_DIRECT_ROUTING` params to runtime config. Please review per-commit. Related: https://github.com/cilium/cilium/issues/38370",
"url": "https://github.com/cilium/cilium/pull/47888",
"createdAt": "2026-08-10T18:38:01Z",
"updatedAt": "2026-08-12T19:24:22Z",
"timestamp": "2026-08-12T19:24:22Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"area/loader",
"area/datapath",
"release-note/misc"
],
"author": "viktor-kurchenko",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47895",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "images: update cilium-envoy",
"text": "Bumping cilium Envoy image to include the \"ADS policy map lifetime fix\" from [cilium/proxy#1982](https://github.com/cilium/proxy/pull/1982) for cilium 1.20 that fixes https://github.com/cilium/cilium/issues/47624",
"url": "https://github.com/cilium/cilium/pull/47895",
"createdAt": "2026-08-11T13:04:37Z",
"updatedAt": "2026-08-13T15:20:25Z",
"timestamp": "2026-08-13T15:20:25Z",
"metrics": {
"reactions": 3,
"comments": 3
},
"labels": [
"kind/backports",
"dont-merge/needs-rebase",
"backport/1.20"
],
"author": "nezdolik",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47902",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "golangci-lint: Forbid stdlib `net.Interface*` functions",
"text": "The Go stdlib `net.Interface*` family talks to the kernel over a netlink socket with no timeout, so it can block forever. This PR converts the two remaining offenders to `netlink/safenetlink` and add a forbidigo rule so new ones don't creep back in. Fixes: #15051",
"url": "https://github.com/cilium/cilium/pull/47902",
"createdAt": "2026-08-11T20:27:45Z",
"updatedAt": "2026-08-13T18:00:21Z",
"timestamp": "2026-08-13T18:00:21Z",
"metrics": {
"reactions": 4,
"comments": 1
},
"labels": [
"ready-to-merge",
"release-note/misc"
],
"author": "HadrienPatte",
"state": "closed",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:47903",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "golangci-lint: Fix `netlink.AddrList` escaping the forbidigo check",
"text": "The `ErrDumpInterrupted` pattern has been `(Handle\\.)?(\"AddrList|BridgeVlanList|...` since it was introduced. The double quote character makes the first alternative `\"AddrList`, which cannot match anything, so `netlink.AddrList` and `netlink.Handle.AddrList` have never been flagged. Fixing this surfaces three new previously accidentally ignored findings. This PR converts them to `safenetlink.AddrList`.",
"url": "https://github.com/cilium/cilium/pull/47903",
"createdAt": "2026-08-11T20:31:32Z",
"updatedAt": "2026-08-12T22:21:30Z",
"timestamp": "2026-08-12T22:21:30Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"ready-to-merge",
"release-note/misc"
],
"author": "HadrienPatte",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47906",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "hubble: Add Kubernetes Pod UID to flow endpoints",
"text": "Hubble currently identifies a Pod mainly by cluster, namespace, and name. Kubernetes permits a deleted objectβs name to be reused, while its UID uniquely identifies that specific object lifetime. This matters especially for StatefulSet Pods, but applies to any recreated Pod. Adding the UID to endpoints permits correct flow attribution and lets consumers distinguish Pod instances and possibly group by/correlate with other datasources. This also improves Cilium's correctness: - IPCache deletion now checks UID, preventing a delayed Pod, CEP, or CES deletion from removing metadata belonging to a replacement Pod. - UID-only Pod lifecycle changes are recognized instead of being skipped. - Drop k8s events (from the Hubble drop event emitter) use the UID captured in the flow instead of resolving whichever Pod currently owns that namespace/name. Also, UID remains optional when metadata is unavailable or components are running mixed versions. This PR was prepared with AIL:4. Codex + GPT 5.6 sol made the mechanical changes and I reviewed/revised some implementation details afterward. ```release-note Hubble flow endpoints now include the Kubernetes Pod UID. ```",
"url": "https://github.com/cilium/cilium/pull/47906",
"createdAt": "2026-08-11T23:04:50Z",
"updatedAt": "2026-08-12T16:02:53Z",
"timestamp": "2026-08-12T16:02:53Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"release-note/minor",
"sig/policy",
"area/hubble"
],
"author": "devodev",
"state": "open",
"assignees": [
"devodev"
],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:47912",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Documentation: document mesh security model",
"text": "There isn't currently an explicit mention of how cluster mesh affects the threat/security model of cilium. To clarify the assumptions the code already makes, make it explicit that there isn't a security boundary between clusters once meshed. We can think about \"improving\"/hardening, but fundamentally I do not believe it to be possible to fully withstand an adversarial meshed cluster any more than it is possible to withstand a compromised agent.",
"url": "https://github.com/cilium/cilium/pull/47912",
"createdAt": "2026-08-12T09:06:00Z",
"updatedAt": "2026-08-13T16:54:51Z",
"timestamp": "2026-08-13T16:54:51Z",
"metrics": {
"reactions": 5,
"comments": 1
},
"labels": [
"area/documentation",
"release-note/misc"
],
"author": "bimmlerd",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47914",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: don't reclassify an already reverse-NATed service reply",
"text": "- [X] For first time contributors, read [Submitting a pull request] - [X] All code is covered by unit and/or runtime tests where feasible. - [X] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [X] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [X] All commits are signed off. See the section [Developerβs Certificate of Origin] - [X] Provide a title or release-note blurb suitable for the release notes. - [X] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. - [X] Thanks for contributing! On netkit + endpointRoutes + per-packet LB, a service reply is evaluated twice on the client's ingress path. The first pass matches conntrack and reverse-NATs the source to the service address; the packet is then re-delivered and evaluated again, now carrying an address that doesn't match the backend-keyed CT entry, and gets classified CT_NEW. This produces a spurious CT entry, a false Hubble flow showing the client as its own destination on an ephemeral port, and, with an ingress policy on the client, Policy denied drops of established connections' replies. Set a flag on ctx->tc_index after lb{4,6}_rev_nat() reverse-NATs a CT_REPLY packet; cil_to_container() reads and clears it on re-entry and delivers directly instead of re-running ingress. tc_index is used because it's the only per-packet state that survives the re-entry: CB_DELIVERY_FLAGS is cleared by bpf_clear_meta() and skb->mark is consumed by inherit_identity_from_host(), both confirmed via cilium-dbg monitor -v with Debug/DebugLB enabled. Fixes: #47913 ```release-note bpf: fix spurious CT_NEW reclassification of service replies on netkit with endpoint routes and per-packet load balancing, which caused incorrect Hubble flows and could drop replies to established connections under an ingress CiliumNetworkPolicy. ``` This PR was prepared with AIL:4. I personally validated the resulting network flows with and without policies, both visually via Hubble and by testing the affected applications. I could not find an existing test in the suite combining netkit + endpointRoutes + per-packet LB. Every netkit test that I found has per_packet_lb=0. Three tests enable per-packet LB and exercise bpf_lxc (skip_lb_xlate_lrp_per_packet_lb.c, tc_nodeport_lb_fragments.h, tc_lb_external_ips.h), but all three are netkit=0, endpoint_routes=0. The problem is easily reproducible (see #47913) and the fix is only a few simple lines, so building out a full test harness for netkit=1, endpoint_routes=1 seems disproportionate in this case, and I don't have the background in the code to know that the test case would be right. It was very obvious that the fix addressed the problem without obviously creating new problems (via Hubble UI, policies and applications working again).",
"url": "https://github.com/cilium/cilium/pull/47914",
"createdAt": "2026-08-12T09:53:24Z",
"updatedAt": "2026-08-12T21:36:22Z",
"timestamp": "2026-08-12T21:36:22Z",
"metrics": {
"reactions": 1,
"comments": 3
},
"labels": [
"release-note/bug",
"kind/community-contribution"
],
"author": "evan314159",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47915",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "kvstore: let [UserEnforcePresence] additionally revoke stale roles",
"text": "The [UserEnforcePresence] function is responsible for creating the target user in etcd, if not present, and granting the specified roles. Let's extend it to additionally revoke any possible roles that had been previously granted to that user, and are not present in the list of roles anymore. While being there, let's also cover this logic with a dedicated unit test, to prevent possible regressions in the future. Overall, this addresses a limitation in the clustermesh users management logic, which would not have revoked a previously granted role upon config change. While this is not deemed to manifest as an actual problem in the vast majority of scenarios, given that the only role granted with that machinery is the `remote` one \\[1], it may still be problematic if users leveraged it for different purposes, and is potentially confusing. \\[1]: https://github.com/cilium/cilium/blob/6655160839b90f6c5277655a9a359dc791d89930/install/kubernetes/cilium/templates/clustermesh-apiserver/users-configmap.yaml#L26-L27 AIL: 0 Reported-by: Mike Molchanov ```release-note Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. ```",
"url": "https://github.com/cilium/cilium/pull/47915",
"createdAt": "2026-08-12T10:08:06Z",
"updatedAt": "2026-08-13T08:51:30Z",
"timestamp": "2026-08-13T08:51:30Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"kind/bug",
"release-note/bug",
"area/clustermesh",
"area/kvstore",
"needs-backport/1.18",
"needs-backport/1.19",
"needs-backport/1.20"
],
"author": "giorio94",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47916",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ipam/multi-pool: Allow regaining ownership of removed CIDRs",
"text": "A CIDR which disappears from the CiliumNode CRD spec while IPs are allocated from it is marked as removed: we keep its allocator to hold on to the in-use IPs, stop allocating from it, and keep advertising it as allocated to signal to the operator that we want the CIDR back. But nothing ever cleared that mark, so the CIDR stayed unallocatable for the lifetime of the agent, even after the operator advertised it again. Worse, `releaseExcessCIDRsMultiPool` counted the free IPs of removed CIDRs towards the free IPs of the pool, unlike `allocateNext`, `capacity` and `hasAvailableIPs`. this means it reported free IPs which were never handed out, which in turn suppressed the reclaim of released-but-still-advertised CIDRs added in https://github.com/cilium/cilium/commit/0e4e076b6da1a149fe4d2c3690a2fd5fea3f95bf. The pool then reported free IPs while failing every allocation with \"all CIDR ranges are exhausted\" until the agent was restarted. This PR clears the removed mark when the operator starts to advertise the CIDR again, and drops marks whose allocator is gone, and counts only allocatable CIDRs when deciding whether CIDRs must be reclaimed or released. Related: https://github.com/cilium/cilium/issues/47910",
"url": "https://github.com/cilium/cilium/pull/47916",
"timestamp": "2026-08-12T13:11:26Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"release-note/bug",
"area/ipam",
"needs-backport/1.20"
],
"author": "HadrienPatte",
"assignees": [],
"change": "new"
},
{
"id": "github:cilium/cilium:pull_request:47917",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: nat: extract inner IPv6 header from ICMP payload in-place",
"text": "Let's avoid having a full IPv6 header on the stack, that's only used for then copying values further into the CT tuple. And instead copy those values over into the right place.",
"url": "https://github.com/cilium/cilium/pull/47917",
"createdAt": "2026-08-12T12:11:05Z",
"updatedAt": "2026-08-13T12:10:25Z",
"timestamp": "2026-08-13T12:10:25Z",
"metrics": {
"reactions": 2,
"comments": 6
},
"labels": [
"area/datapath",
"release-note/misc",
"feature/ipv6",
"feature/snat"
],
"author": "julianwiedmann",
"state": "open",
"assignees": [
"julianwiedmann"
]
},
{
"id": "github:cilium/cilium:pull_request:47919",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Fixes #47918: Handle label filters as regex when loading from file",
"text": "Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! Updates the code that loads in label filters from a file via the `label-prefix-file` configuration flag to attempt to parse each prefix as a regex to align with passing them in via CLI flags. Claude Code was used to identify the problem and suggest where needed updating. I personally checked and updated all the code in this PR. Fixes: #47918 ```release-note Fix how label filters are handled when loading from a file so they are parsed as regex ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47919",
"createdAt": "2026-08-12T15:11:10Z",
"updatedAt": "2026-08-13T08:22:00Z",
"timestamp": "2026-08-13T08:22:00Z",
"metrics": {
"reactions": 1,
"comments": 2
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "AverageMarcus",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47920",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gh: run BPF tests in parallel",
"text": "Wire up the -j parameter to speed up compilation.",
"url": "https://github.com/cilium/cilium/pull/47920",
"createdAt": "2026-08-12T21:32:41Z",
"updatedAt": "2026-08-13T00:00:46Z",
"timestamp": "2026-08-13T00:00:46Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"dont-merge/needs-release-note-label"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47922",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: use memset() to 0-initialize IPv6 CT tuple",
"text": "This should produce slightly better code.",
"url": "https://github.com/cilium/cilium/pull/47922",
"createdAt": "2026-08-12T23:10:38Z",
"updatedAt": "2026-08-13T00:00:59Z",
"timestamp": "2026-08-13T00:00:59Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"dont-merge/needs-release-note-label"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47923",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "fix: stale CEC owner UID lets GC delete the in-use Envoy config",
"text": "The name of a CiliumEnvoyConfig is derived from the Gateway name Β·cilium-gateway-Β·, so a recreated Gateway with the same name necessarily maps to the same CiliumEnvoyConfig object. Since Gateway has no finalizer, deleting a Gateway relies entirely on Kubernetes garbage collection for cleanup, which is asynchronous and may take seconds or longer. When a user recreates a Gateway with the same name `kubectl delete gateway same-namespace && kubectl apply -f gateway.yaml`, the Cilium operator may adopt and update the old CiliumEnvoyConfig in place, refreshing its spec but keeping the owner reference that still points to the old Gateway UID, the owner UID is not updated. Eventually, the Kubernetes garbage collector finds that the owner UID no longer exists and deletes that CiliumEnvoyConfig. This defeats the Cilium in-place adoption mechanism. Fixes: #issue-number ```release-note fix: stale CEC owner UID lets GC delete the in-use Envoy config ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47923",
"createdAt": "2026-08-13T03:33:09Z",
"updatedAt": "2026-08-13T04:16:44Z",
"timestamp": "2026-08-13T04:16:44Z",
"metrics": {
"reactions": 1,
"comments": 1
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution",
"feature/k8s-gateway-api"
],
"author": "weizhoublue",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47924",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "docs: add OpenChoreo to USERS.md",
"text": "Added OpenChoreo entry with details on network security and observability. Please ensure your pull request adheres to the following guidelines: - [ ] For first time contributors, read [Submitting a pull request] - [ ] All code is covered by unit and/or runtime tests where feasible. - [ ] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [ ] All commits are signed off. See the section [Developerβs Certificate of Origin] - [ ] Provide a title or release-note blurb suitable for the release notes. - [ ] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [ ] Thanks for contributing! Fixes: #issue-number ```release-note ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47924",
"createdAt": "2026-08-13T04:56:28Z",
"updatedAt": "2026-08-13T15:22:37Z",
"timestamp": "2026-08-13T15:22:37Z",
"metrics": {
"reactions": 1,
"comments": 4
},
"labels": [
"release-note/misc",
"kind/community-contribution"
],
"author": "kavishkafernando",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47926",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "pkg/idpool: lazy allocate idCache maps",
"text": "When `NewIDPool` creates an ID pool, it used to fill a map with every single ID right away. For a pool of 1,000,000 IDs, this took ~37.8 MB of memory and ~141 ms of setup time upfront before any IDs were even used. This change switches to allocating IDs on demand using a `nextID` counter. It only adds IDs to maps when they are released or inserted, saving memory and eliminating the setup delay. ### Benchmark Results - **Setup Time**: Reduced from **~141 ms** to **~33 ns** per operation. - **Memory Usage**: Reduced from **~37.8 MB** to **0 B** upfront allocation. - **Tests**: All unit tests pass; added `TestLazyIDPoolAllocation` and `BenchmarkNewIDPool`. Fixes: #47925 --- Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked all code, benchmarks, and unit tests.\" - [x] Thanks for contributing! This PR was prepared with AIL:3. I personally checked all code, benchmarks, and unit tests. ```release-note pkg/idpool: Avoid allocating maps upfront during IDPool initialization to save memory and setup time.",
"url": "https://github.com/cilium/cilium/pull/47926",
"createdAt": "2026-08-13T06:48:29Z",
"updatedAt": "2026-08-13T06:48:44Z",
"timestamp": "2026-08-13T06:48:44Z",
"metrics": {
"reactions": 1,
"comments": 1
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "DARSHANR007",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47927",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "cilium-cli/connectivity: detect Cilium version in connectivity perf setup",
"text": "`cilium connectivity perf` always reports \"Cilium version: 0.0.0\" in its info banner, regardless of the actual Cilium version running in the cluster. `setupAndValidatePerf()`, the setup path used by the `perf` subcommand, never calls `initCiliumPods()`/`detectCiliumVersion()`, unlike `setupAndValidate()` (used by `connectivity test`). `CiliumVersion` is therefore left at its Go zero value, which prints as `0.0.0`. This calls the same two steps `setupAndValidate()` already uses, in the same order, so `CiliumVersion` is populated before it's printed in `connectivity.Run()`. Tested manually against an RKE2 cluster (Cilium v1.19.4): - before the fix, `cilium connectivity perf` reported \"Cilium version: 0.0.0\" - after the fix, it correctly reports \"Cilium version: 1.19.4\" ```release-note Fixed `cilium connectivity perf` always reporting `Cilium version: 0.0.0` instead of the actual detected Cilium version.",
"url": "https://github.com/cilium/cilium/pull/47927",
"createdAt": "2026-08-13T07:53:44Z",
"updatedAt": "2026-08-13T15:24:17Z",
"timestamp": "2026-08-13T15:24:17Z",
"metrics": {
"reactions": 1,
"comments": 2
},
"labels": [
"release-note/bug",
"kind/community-contribution",
"cilium-cli",
"cilium-cli-exclusive"
],
"author": "khaddict",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47928",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gh: verifier: test PR branch before base branch",
"text": "The PR branch is more likely to be broken than the base branch. Let's fail fast.",
"url": "https://github.com/cilium/cilium/pull/47928",
"createdAt": "2026-08-13T08:09:20Z",
"updatedAt": "2026-08-13T08:45:51Z",
"timestamp": "2026-08-13T08:45:51Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"area/CI",
"area/datapath",
"release-note/ci"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
]
},
{
"id": "github:cilium/cilium:pull_request:47929",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "fix(gateway): fail closed on invalid ExternalAuth",
"text": "## Description of change Make HTTPRoute ExternalAuth fail closed when the backend reference is invalid or cannot be resolved. Previously, an invalid ExternalAuth backend reference could cause the filter to be omitted while the route remained active, effectively allowing requests to bypass external authentication. This change: - Fails closed with HTTP 500 when the ExternalAuth backend reference is not permitted by a ReferenceGrant. - Fails closed when the ExternalAuth backend cannot be resolved. - Adds unit tests covering invalid cross-namespace references, missing backends, and valid ReferenceGrant configuration. Fixes: #47877 ```release-note Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. ``` This PR was prepared with AIL:3. I personally checked the implementation and unit tests. - [ ] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] All commits are signed off. See the section [Developer's Certificate of Origin](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo) - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy](https://github.com/cilium/community/blob/main/AI-POLICY.md), and indicate the rating using [AI Influence Level](https://danielmiessler.com/blog/ai-influence-level-ail). - [x] Thanks for contributing! [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47929",
"createdAt": "2026-08-13T08:15:04Z",
"updatedAt": "2026-08-13T15:15:29Z",
"timestamp": "2026-08-13T15:15:29Z",
"metrics": {
"reactions": 1,
"comments": 0
},
"labels": [
"kind/bug",
"release-note/bug",
"area/servicemesh",
"kind/community-contribution",
"feature/k8s-gateway-api",
"needs-backport/1.20"
],
"author": "shreyasrajiv327",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47931",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "cilium-cli: Skip HostToWorld if no external IPv6",
"text": "As with PodToWorld() we need to skip the IPv6 actions if ExternalTargetIPv6Capable parameter is not set.",
"url": "https://github.com/cilium/cilium/pull/47931",
"createdAt": "2026-08-13T08:20:52Z",
"updatedAt": "2026-08-13T14:43:40Z",
"timestamp": "2026-08-13T14:43:40Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"ready-to-merge",
"release-note/ci",
"cilium-cli",
"cilium-cli-exclusive"
],
"author": "joamaki",
"state": "closed",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47932",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "clustermesh/endpointslices: explicitly limit maximum decoder memory",
"text": "Explicitly configure a limit for the zstd decoder used to decode the ClusterEndpointSlice entries received over Cluster Mesh, to prevent the risk of unbounded memory usage in case of crafted payloads. I've marked the PR as `release-note/misc` because the logic ingesting ClusterEndpointSlices is incomplete and disabled behind a feature flag in v1.20. Reported-by: Secstant - Sigma Prime \\",
"url": "https://github.com/cilium/cilium/pull/47932",
"createdAt": "2026-08-13T08:30:58Z",
"updatedAt": "2026-08-13T17:55:53Z",
"timestamp": "2026-08-13T17:55:53Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"ready-to-merge",
"area/clustermesh",
"release-note/misc",
"needs-backport/1.20"
],
"author": "giorio94",
"state": "closed",
"assignees": [],
"change": "updated"
},
{
"id": "github:cilium/cilium:pull_request:47933",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "DONOTMERGE : test commit",
"text": "Testing changes that are included in: https://github.com/cilium/cilium/pull/47787 https://github.com/cilium/cilium/pull/47786 https://github.com/cilium/cilium/pull/47785 https://github.com/cilium/cilium/pull/47784",
"url": "https://github.com/cilium/cilium/pull/47933",
"createdAt": "2026-08-13T09:32:11Z",
"updatedAt": "2026-08-13T16:35:52Z",
"timestamp": "2026-08-13T16:35:52Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"dont-merge/needs-release-note-label"
],
"author": "Artyop",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47934",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: srv6: move SRv6 map structs to srv6.h",
"text": "A bit more untangling of the big common.h header.",
"url": "https://github.com/cilium/cilium/pull/47934",
"createdAt": "2026-08-13T09:57:55Z",
"updatedAt": "2026-08-13T11:25:25Z",
"timestamp": "2026-08-13T11:25:25Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"area/datapath",
"kind/cleanup",
"release-note/misc",
"feature/srv6"
],
"author": "julianwiedmann",
"state": "open",
"assignees": [
"julianwiedmann"
]
},
{
"id": "github:cilium/cilium:pull_request:47935",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: clean up 0-initializing for struct csum_offset",
"text": "Let csum_l4_offset_and_flags() take care of this when needed.",
"url": "https://github.com/cilium/cilium/pull/47935",
"createdAt": "2026-08-13T10:23:38Z",
"updatedAt": "2026-08-13T11:36:36Z",
"timestamp": "2026-08-13T11:36:36Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"dont-merge/needs-release-note-label"
],
"author": "julianwiedmann",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47936",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: preserve original source in NodePort tunnel traces",
"text": "## Summary Preserve the original IPv4 or IPv6 client address in `TRACE_TO_OVERLAY` when tunneled NodePort or LoadBalancer traffic is SNATed. Hubble can then show the client address in `source` and the SNAT address in `source_xlated`. Flows without SNAT and other encapsulation paths are unchanged. ## Testing - Overlay NodePort BPF runtime tests - Hubble parser tests - Full BPF build matrix",
"url": "https://github.com/cilium/cilium/pull/47936",
"createdAt": "2026-08-13T11:29:30Z",
"updatedAt": "2026-08-13T14:22:03Z",
"timestamp": "2026-08-13T14:22:03Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"dont-merge/needs-release-note-label"
],
"author": "darox",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47937",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "fix(deps): update all go dependencies main",
"text": "Manually bump the go dependencies, since renovate seems to be struggling.",
"url": "https://github.com/cilium/cilium/pull/47937",
"createdAt": "2026-08-13T12:54:23Z",
"updatedAt": "2026-08-13T14:32:32Z",
"timestamp": "2026-08-13T14:32:32Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"release-note/misc",
"dependencies"
],
"author": "julianwiedmann",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47938",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "[WIP] Runtime cloud-IPAM routing rules reconciliation",
"text": "-- WORK IN PROGRESS --",
"url": "https://github.com/cilium/cilium/pull/47938",
"createdAt": "2026-08-13T14:07:11Z",
"updatedAt": "2026-08-13T16:32:39Z",
"timestamp": "2026-08-13T16:32:39Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"dont-merge/preview-only",
"dont-merge/needs-release-note-label"
],
"author": "pippolo84",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47939",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "operator/ipam: Remove the per-node pool-maintainer retry trigger",
"text": "Each CiliumNode creates 4 triggers today, and one of them exists only to call another one: the \"-retry\" trigger's entire body is `poolMaintainer.Trigger()`, rate limited to one call per minute. That is one goroutine and one timer per node, which on a large enough production cluster where the majority of goroutine count is driven by node count, amounts to a quarter of the operator's parked trigger waiters. It exists only because of a skewed invariant. The two halves of `waitingForPoolMaintenance` live in different layers: the enqueue sites set it, and `MaintainIPPool` clears it on the one return path. Its early return for an unstable instances API returns with the flag still set, and the flag makes both `allocationNeeded()` and `releaseNeeded()` false, which gate the only two places that ever enqueue the maintainer. Nothing can re-drive the node, hence the retry trigger. This commit gives the flag a single owner instead. `MaintainIPPool` takes it on entry and releases it with a defer, so it is held for exactly the duration of a pass and released on every return path, and the enqueue sites only enqueue. The node reports its deficit again, so the interval based background resync re-drives it, and since that resync only reaches `Resync()` after a successful instances API resync, the node is picked up in the very iteration that observes the API recovering. While it is down the maintainer is re-triggered by node events rather than once per minute, but each of those is an early return that mutates nothing and is bounded by the backoff already applied to failed maintenance. This also fixes a latent strand on the second early return, taken while the instance has been stopped for less than a minute. Its comment says to wait for the custom resource to be updated as a sign of life, but that wait could never complete: `UpdatedResource()` marks the instance running and then consults `allocationNeeded()`, which was false because the flag was still set. A node that briefly stopped while in deficit stayed stranded until the operator restarted.",
"url": "https://github.com/cilium/cilium/pull/47939",
"createdAt": "2026-08-13T14:14:54Z",
"updatedAt": "2026-08-13T16:48:19Z",
"timestamp": "2026-08-13T16:48:19Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"dont-merge/needs-release-note-label"
],
"author": "HadrienPatte",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47942",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "hubble/relay: stop gRPC health server on shutdown",
"text": "The gRPC health server is started as part of Server.Serve(), but Server.Stop() only stops the main gRPC server. This leaves the health listener running and keeps Serve() blocked in errgroup.Wait(). Stop the gRPC health server during shutdown and add a test that verifies Serve() returns after Stop(). Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy]. This PR was prepared with AIL:3 I used AI to assist with investigating the shutdown behavior, reviewing the relevant source code, and developing the test approach. Fixes: #47941 ```release-note Fix Hubble Relay remains running during termination ``` [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47942",
"createdAt": "2026-08-13T15:23:08Z",
"updatedAt": "2026-08-13T15:50:59Z",
"timestamp": "2026-08-13T15:50:59Z",
"metrics": {
"reactions": 1,
"comments": 2
},
"labels": [
"kind/bug",
"release-note/bug",
"kind/community-contribution",
"needs-backport/1.17",
"area/hubble",
"needs-backport/1.18",
"needs-backport/1.19",
"needs-backport/1.20"
],
"author": "xandau",
"state": "open",
"assignees": [
"xandau"
]
},
{
"id": "github:cilium/cilium:pull_request:47943",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api: compare static Gateway addresses as parsed IPs",
"text": "`setStaticAddressStatus` compared addresses from `Gateway.spec.addresses` with the generated Service status as strings. Equivalent IPv6 addresses can use different textual representations, causing an allocated and working static address to be reported as unusable. Parse both sides with `netip.ParseAddr` and compare the resulting addresses. Hostname-only Service ingress entries are ignored. Add regression coverage for equivalent IPv6 representations, IPv4 addresses, and mismatched addresses. Tested with: ```text go test ./operator/pkg/gateway-api -count=1 ``` Fixes: #47857 ```release-note Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. ``` AIL:2 β Generative AI was used to assist with parts of the implementation, testing, and PR preparation. I reviewed and validated the changes.",
"url": "https://github.com/cilium/cilium/pull/47943",
"createdAt": "2026-08-13T15:45:28Z",
"updatedAt": "2026-08-13T15:56:42Z",
"timestamp": "2026-08-13T15:56:42Z",
"metrics": {
"reactions": 1,
"comments": 1
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution",
"feature/k8s-gateway-api"
],
"author": "taaahaaa",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47944",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "hubble: add optional protocol and port labels to policy metrics",
"text": "Add opt-in protocol and destination port labels to hubble_policy_verdicts_total. Both labels are disabled by default to preserve the existing metric label set. The destination port label may increase metric cardinality depending on the traffic pattern. Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [ ] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [ ] Thanks for contributing! Related: #34304 ```release-note Add opt-in `protocol` and destination `port` labels to `hubble_policy_verdicts_total`. Enable the additional labels with: ```yaml hubble: metrics: enabled: - \"policy:protocol;destination_port\" Both options are disabled by default to preserve the existing metric label set. The port option may increase metric cardinality depending on traffic patterns. ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47944",
"createdAt": "2026-08-13T15:58:47Z",
"updatedAt": "2026-08-13T16:54:24Z",
"timestamp": "2026-08-13T16:54:24Z",
"metrics": {
"reactions": 1,
"comments": 1
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "stias",
"state": "open",
"assignees": []
},
{
"id": "github:cilium/cilium:pull_request:47945",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "install: detect containerd from GKE kubelet config",
"text": "Newer GKE node images configure `containerRuntimeEndpoint` in `/home/kubernetes/kubelet-config.yaml` instead of `/etc/default/kubelet`. This causes the existing GKE containerd detection in node-init to miss the GKE-specific path and fall through to the generic kubelet handling. This change: * preserves the existing legacy GKE/containerd detection; * recognizes the newer `kubelet-config.yaml` layout when it points to containerd; * updates prestop detection as well so an installed kubelet wrapper can be reverted correctly. Legacy and generic node behavior remains unchanged. Testing performed: * `helm lint` * Helm template rendering with GKE/node-init values * `bash -n` on rendered startup and prestop scripts * runtime-endpoint regex tests * sandboxed scenarios covering legacy GKE, the new GKE layout with and without the `gke` marker, non-containerd endpoints, generic nodes, and a missing `/etc/default/kubelet` * `git diff --check` Claude was used to suggest the implementation. I manually reviewed the changes and validated the resulting behavior with the tests above. AIL:4 Fixes: #47884 ```release-note Fix node-init startup on newer GKE nodes that configure the container runtime endpoint in kubelet-config.yaml. ```",
"url": "https://github.com/cilium/cilium/pull/47945",
"createdAt": "2026-08-13T16:58:59Z",
"updatedAt": "2026-08-13T17:10:53Z",
"timestamp": "2026-08-13T17:10:53Z",
"metrics": {
"reactions": 1,
"comments": 0
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "dlanov",
"state": "open",
"assignees": []
}
],
"events": [
{
"id": "event:e7fa12258ad83e5b118c",
"signalId": "github:cilium/cilium:pull_request:47931",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47931",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "cilium-cli: Skip HostToWorld if no external IPv6",
"text": "As with PodToWorld() we need to skip the IPv6 actions if ExternalTargetIPv6Capable parameter is not set.",
"url": "https://github.com/cilium/cilium/pull/47931",
"createdAt": "2026-08-13T08:20:52Z",
"updatedAt": "2026-08-13T13:46:55Z",
"timestamp": "2026-08-13T13:46:55Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"ready-to-merge",
"release-note/ci",
"cilium-cli",
"cilium-cli-exclusive"
],
"author": "joamaki",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:bc0b257e31e85991d353",
"signalId": "github:cilium/cilium:pull_request:46839",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:46839",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "operator/ipam: recover nodes dropped from the instance cache during resync",
"text": "In ENI IPAM mode with `eni.subnetTagsFilter` set, a full ENI resync calls `DescribeNetworkInterfaces` and replaces the operator's entire instance cache with the ENIs discovered in the pod subnets. During a large scale-up, a freshly launched node whose pod subnet ENI has not been attached yet is not represented in that refreshed cache. Once the node disappears from the cache, `ResyncInterfacesAndIPs` returns \"instance not found\", `recalculate()` sets `NeededIPs=0` and stops trying to allocate, and the node stays stuck at `available=0` until the operator is restarted. This change re-triggers the node's existing per-instance `instanceSync` when a live node's instance is not in the instance cache, reusing the `HasInstance()` check that `Upsert` already performs. The check is done by the callers of `recalculate()`, where the `NodeManager` lock state is known: - `Resync` already holds the `NodeManager` mutex and passes the instances API readiness down to its `resyncNode` workers (calling `InstancesAPIIsReady()` from a worker would deadlock against the semaphore). - `MaintainIPPool` holds no locks and queries `InstancesAPIIsReady()` directly. The sync is re-triggered at most once while the instance stays missing and is re-armed by the next successful recalculation, or by a transient failure of the re-triggered sync itself. Recovery runs are tagged with a dedicated trigger reason (`instanceNotFoundSyncReason`) so that only their failures re-arm the re-trigger. If the per-instance sync authoritatively reports the instance as gone (`ErrInstanceNotFound`, e.g. Azure returning HTTP 404), the re-trigger is not re-armed; only transient failures retry. This prevents a sync retry loop for instances which were legitimately terminated but whose CiliumNode resource still exists: those get a single probe sync and then revert to the previous warn-only behavior. Unit tests exercise the recovery through the real `Resync`/`Upsert` entry points with timeout guards, acting as regression tests against re-introducing a deadlock on the `NodeManager` mutex. Fixes: #46513 _This PR was prepared with AIL:3 (AI-assisted, human-directed and verified). I reviewed the change and own it._ ```release-note operator/ipam: recover ENI IPAM nodes that were dropped from the instance cache by a full ENI resync, instead of requiring an operator restart ```",
"url": "https://github.com/cilium/cilium/pull/46839",
"createdAt": "2026-07-01T18:13:23Z",
"updatedAt": "2026-08-13T13:42:45Z",
"timestamp": "2026-08-13T13:42:45Z",
"metrics": {
"reactions": 2,
"comments": 9
},
"labels": [
"release-note/bug",
"kind/community-contribution",
"area/ipam",
"needs-backport/1.20"
],
"author": "ryanjwong",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:b20ac0b44258b2ddd08c",
"signalId": "github:cilium/cilium:pull_request:47937",
"event": "discovered",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47937",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "fix(deps): update all go dependencies main",
"text": "Manually bump the go dependencies, since renovate seems to be struggling.",
"url": "https://github.com/cilium/cilium/pull/47937",
"createdAt": "2026-08-13T12:54:23Z",
"updatedAt": "2026-08-13T13:38:10Z",
"timestamp": "2026-08-13T13:38:10Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"release-note/misc",
"dependencies"
],
"author": "julianwiedmann",
"state": "open",
"assignees": [],
"change": "new"
}
},
{
"id": "event:df249433b2a67e50db98",
"signalId": "github:cilium/cilium:pull_request:47929",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47929",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "fix(gateway): fail closed on invalid ExternalAuth",
"text": "## Description of change Make HTTPRoute ExternalAuth fail closed when the backend reference is invalid or cannot be resolved. Previously, an invalid ExternalAuth backend reference could cause the filter to be omitted while the route remained active, effectively allowing requests to bypass external authentication. This change: - Fails closed with HTTP 500 when the ExternalAuth backend reference is not permitted by a ReferenceGrant. - Fails closed when the ExternalAuth backend cannot be resolved. - Adds unit tests covering invalid cross-namespace references, missing backends, and valid ReferenceGrant configuration. Fixes: #47877 ```release-note Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. ``` This PR was prepared with AIL:3. I personally checked the implementation and unit tests. - [ ] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] All commits are signed off. See the section [Developer's Certificate of Origin](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo) - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy](https://github.com/cilium/community/blob/main/AI-POLICY.md), and indicate the rating using [AI Influence Level](https://danielmiessler.com/blog/ai-influence-level-ail). - [x] Thanks for contributing! [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47929",
"createdAt": "2026-08-13T08:15:04Z",
"updatedAt": "2026-08-13T13:37:07Z",
"timestamp": "2026-08-13T13:37:07Z",
"metrics": {
"reactions": 1,
"comments": 0
},
"labels": [
"kind/bug",
"release-note/bug",
"area/servicemesh",
"kind/community-contribution",
"feature/k8s-gateway-api",
"needs-backport/1.20"
],
"author": "shreyasrajiv327",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:0c05a93914c9830157b1",
"signalId": "github:cilium/cilium:issue:47921",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:issue:47921",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "CI: firewall-egress-to-fqdns fails 6% of the time: command terminated with exit code 28",
"text": "### Test Name firewall-egress-to-fqdns ### Test Failure Output ```shell β 1/8 tests failed (6/81 actions), 3 tests skipped, 0 scenarios skipped: Test [host-firewall-egress-to-fqdns]: π₯ host-firewall-egress-to-fqdns/host-to-world:http-to-fake.external.service.cilium-0: cilium-test-1/host-netns-8h6h4 (172.20.0.4) -> fake.external.service.cilium-http (fake.external.service.cilium:80): command \"curl --silent --fail --show-error --connect-timeout 2 --max-time 10 -4 -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code}\\n --output /dev/null http://fake.external.service.cilium:80\" failed: command failed (pod=cilium-test-1/host-netns-8h6h4, container=host-netns): command terminated with exit code 28 ``` βοΈ The following owners are responsible for reliability of the testsuite: - @cilium/sig-agent (host-to-world) - @cilium/ci-structure (.github/workflows/tests-e2e-upgrade.yaml) ### CI Build Link https://github.com/cilium/cilium/actions/runs/31601758510 ### Relevant Log Output ```shell ``` ### Sysdump / Zip File _No response_",
"url": "https://github.com/cilium/cilium/issues/47921",
"createdAt": "2026-08-12T22:48:35Z",
"updatedAt": "2026-08-13T13:13:47Z",
"timestamp": "2026-08-13T13:13:47Z",
"metrics": {
"reactions": 0,
"comments": 3
},
"labels": [
"area/CI",
"area/cli",
"ci/flake"
],
"author": "joestringer",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:6d68f0487581b9296b1c",
"signalId": "github:cilium/cilium:pull_request:47936",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47936",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: preserve original source in NodePort tunnel traces",
"text": "## Summary Preserve the original client IPv4 address in `TRACE_TO_OVERLAY` when tunneled NodePort traffic is SNATed. Hubble can then show the client address in `source` and the SNAT address in `source_xlated`. Non-SNAT and other encapsulation paths are unchanged. ## Why The trace previously contained only the post-SNAT packet address, so Hubble could not report the original client for this path.",
"url": "https://github.com/cilium/cilium/pull/47936",
"createdAt": "2026-08-13T11:29:30Z",
"updatedAt": "2026-08-13T13:08:19Z",
"timestamp": "2026-08-13T13:08:19Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"dont-merge/needs-release-note-label"
],
"author": "darox",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:5ff6d62414844db0c225",
"signalId": "github:cilium/cilium:pull_request:47677",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47677",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: stop dropping MLD and router solicitation sent from pods",
"text": "Pods keep showing up in Hubble as dropping their own ICMPv6 traffic with \"Invalid source ip\". The source is always the link local address that the kernel gives the pod interface, and the messages are the MLD reports and router solicitations that the kernel sends on its own. The from container path lets neighbour solicitation and neighbour advertisement past the source IP check and nothing else, so all of this gets treated as spoofed. The packets are link scoped and cannot reach anything anyway, so nothing is actually broken, but the drop counters and flow logs make it look like the pod is misbehaving. This change lets MLD and router solicitation through when the source is a link local or unspecified address and the destination is a link local scope multicast group. Those packets go to the stack instead of being routed anywhere. Router advertisement and redirect are deliberately left out, since a pod has no reason to send either one and both are useful to an attacker. There is a new BPF unit test with six cases, three that should now pass and three that must stay dropped. I checked it works both ways by reverting each half of the change and watching only the matching tests fail. Fixes: #47645 ```release-note Stop dropping MLD and router solicitation messages that pods send from their kernel assigned link local address when source IP verification is enabled ``` This PR was prepared with AIL:4. I reviewed the datapath change, and ran the BPF unit tests and checkpatch locally.",
"url": "https://github.com/cilium/cilium/pull/47677",
"createdAt": "2026-08-02T20:27:52Z",
"updatedAt": "2026-08-13T13:03:16Z",
"timestamp": "2026-08-13T13:03:16Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "ssam18",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:a931a4d21842ea7a3902",
"signalId": "github:cilium/cilium:pull_request:47933",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47933",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "DONOTMERGE : test commit",
"text": "Testing changes that are included in: https://github.com/cilium/cilium/pull/47787 https://github.com/cilium/cilium/pull/47786 https://github.com/cilium/cilium/pull/47785 https://github.com/cilium/cilium/pull/47784",
"url": "https://github.com/cilium/cilium/pull/47933",
"createdAt": "2026-08-13T09:32:11Z",
"updatedAt": "2026-08-13T12:59:51Z",
"timestamp": "2026-08-13T12:59:51Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"dont-merge/needs-release-note-label"
],
"author": "Artyop",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:753410e2eb5cee39528e",
"signalId": "github:cilium/cilium:pull_request:47924",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47924",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "docs: add OpenChoreo to USERS.md",
"text": "Added OpenChoreo entry with details on network security and observability. Please ensure your pull request adheres to the following guidelines: - [ ] For first time contributors, read [Submitting a pull request] - [ ] All code is covered by unit and/or runtime tests where feasible. - [ ] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [ ] All commits are signed off. See the section [Developerβs Certificate of Origin] - [ ] Provide a title or release-note blurb suitable for the release notes. - [ ] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [ ] Thanks for contributing! Fixes: #issue-number ```release-note ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47924",
"createdAt": "2026-08-13T04:56:28Z",
"updatedAt": "2026-08-13T12:26:05Z",
"timestamp": "2026-08-13T12:26:05Z",
"metrics": {
"reactions": 1,
"comments": 2
},
"labels": [
"release-note/misc",
"kind/community-contribution"
],
"author": "kavishkafernando",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:dda015fb9b1d46a193a7",
"signalId": "github:cilium/cilium:pull_request:47427",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47427",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "test(bpf): parallelize eBPF test execution",
"text": "This PR contains some enhancements to the eBPF execution step to help improve the eBPF test suite speed discussed in #45133. Currently the eBPF tests are executed serially when running `make run_bpf_tests`. Each eBPF test file (.o) is loaded independently and does not share any state across the file boundary. So the test runner can be updated to load/execute these test targets in parallel to speed up the overall eBPF test suite runtime. These changes allow the tests to safely run in parallel, ensuring the test output and coverbee output do not get mixed up across goroutines. There was around an **11x improvement** in just the `go test` execution time (75 seconds vs 6 seconds). Here are some small numbers from my larger workstation (128 cpus). Commands Run: ``` # test targets were not re-built time make run_bpf_tests ``` | Strategy | Tests Execution Time (no compile) | | :--- | :--- | | Original | 1m25.520s | | Parallel Execution | 0m16.374s | The larger workstation that I am using makes these numbers look good but most workstations would see some speed up in execution time. Here is an example I created locally to show that the test debug output is not interleaved due to tests running in parallel. ``` --- FAIL: TestBPF (0.00s) --- FAIL: TestBPF/skip_lb_xlate_socket_lb.o (0.42s) bpf_test.go:354: Skipping program 'cil_sock6_sendmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock6_connect' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock_release' of type 'CGroupSock': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock4_recvmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock4_sendmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock6_recvmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock4_connect' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type --- FAIL: TestBPF/skip_lb_xlate_socket_lb.o/sock4_xlate_fwd (0.01s) bpf_test.go:605: skip_lb_xlate_socket_lb.c:92: ret: -6 bpf_test.go:605: skip_lb_xlate_socket_lb.c:93: pod_one [0100a8c0] -> svc_one [010a10ac] bpf_test.go:605: skip_lb_xlate_socket_lb.c:96: assert failed at skip_lb_xlate_socket_lb.c:96 --- FAIL: TestBPF/host_only_socket_lb_test.o (0.22s) bpf_test.go:354: Skipping program 'cil_sock4_recvmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock4_sendmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock6_connect' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock6_sendmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock4_connect' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock6_recvmsg' of type 'CGroupSockAddr': BPF_PROG_RUN not supported on program type bpf_test.go:354: Skipping program 'cil_sock_release' of type 'CGroupSock': BPF_PROG_RUN not supported on program type --- FAIL: TestBPF/host_only_socket_lb_test.o/sock4_xlate_fwd_test (0.01s) bpf_test.go:605: host_only_socket_lb_test.c:102: xlate_fwd: 0 bpf_test.go:605: host_only_socket_lb_test.c:103: ip 0100a8c0 bpf_test.go:605: host_only_socket_lb_test.c:104: port 7000 bpf_test.go:605: host_only_socket_lb_test.c:105: ret: 0 bpf_test.go:605: host_only_socket_lb_test.c:106: assert failed at host_only_socket_lb_test.c:106 FAIL FAIL github.com/cilium/cilium/bpf/tests/bpftest 6.062s FAIL ``` AI Level: 1 Fixes: nobug",
"url": "https://github.com/cilium/cilium/pull/47427",
"createdAt": "2026-07-22T18:11:51Z",
"updatedAt": "2026-08-13T12:14:42Z",
"timestamp": "2026-08-13T12:14:42Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"release-note/ci",
"kind/community-contribution"
],
"author": "lconnery",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:d42b94d12e1946c94942",
"signalId": "github:cilium/cilium:pull_request:47917",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47917",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: nat: extract inner IPv6 header from ICMP payload in-place",
"text": "Let's avoid having a full IPv6 header on the stack, that's only used for then copying values further into the CT tuple. And instead copy those values over into the right place.",
"url": "https://github.com/cilium/cilium/pull/47917",
"createdAt": "2026-08-12T12:11:05Z",
"updatedAt": "2026-08-13T12:10:25Z",
"timestamp": "2026-08-13T12:10:25Z",
"metrics": {
"reactions": 2,
"comments": 6
},
"labels": [
"area/datapath",
"release-note/misc",
"feature/ipv6",
"feature/snat"
],
"author": "julianwiedmann",
"state": "open",
"assignees": [
"julianwiedmann"
],
"change": "updated"
}
},
{
"id": "event:974ea5a091861a47e680",
"signalId": "github:cilium/cilium:issue:47591",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:issue:47591",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "With Gateway API, the 3-way handshake fails when Envoy and the Backend Pod are running on the same Node.",
"text": "### Is there an existing issue for this? - https://github.com/cilium/cilium/issues/42325 ### Version equal or higher than v1.20.0 and lower than v1.21.0 ### What happened? It is structured as follows. When the backend Pod and the assigned Envoy are on the same Node, the 3-way handshake between the Envoy and the Pod fails. As a result, the Envoy returns a 503 error to the client. When the assigned Envoy and the backend Pod are on different Nodes, it works normally. ```mermaid flowchart TD A[Client 192.168.0.10] -->|to 10.1.1.66| B[bgp router] B --> C[Envoy] B --> D[Envoy] B --> E[Envoy] subgraph cilium_host 10.0.1.12 C -->|Failed| F[Backend 10.0.1.41] end subgraph cilium_host 10.0.2.183 D -->|Success| F end subgraph cilium_host 10.0.0.179 E -->|Success| F end ``` ### Failed Pattern: [Client] -> [Backend Pod Running Node] - hubble log ``` 10.0.1.12:54518 (ingress) -> default/whoami-5996d44689-hhnw4:80 (ID:47342) to-endpoint FORWARDED (TCP Flags: SYN) 10.0.1.12:54518 (host) <- default/whoami-5996d44689-hhnw4:80 (ID:47342) to-stack FORWARDED (TCP Flags: SYN, ACK) 192.168.0.10:40936 (ingress) -> default/cilium-gateway-default-gateway:80 (world) http-request FORWARDED (HTTP/1.1 GET http://whoami.example.test/) 192.168.0.10:40936 (ingress) <- default/cilium-gateway-default-gateway:80 (world) http-response FORWARDED (HTTP/1.1 503 4999ms (GET http://whoami.example.test/)) 10.0.1.12:54518 (host) <- default/whoami-5996d44689-hhnw4:80 (ID:47342) to-stack FORWARDED (TCP Flags: SYN, ACK) 10.0.1.12:54518 (host) -> default/whoami-5996d44689-hhnw4:80 (ID:47342) to-endpoint FORWARDED (TCP Flags: RST) ``` - tcpdump (With a debug container attached to the envoy pod) ``` 03:36:39.863257 eth0 In IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [S], seq 4261706409, win 64240, options [mss 1460,sackOK,TS val 451367369 ecr 0,nop,wscale 7], length 0 03:36:39.863267 cilium_net Out IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [S], seq 4261706409, win 64240, options [mss 1460,sackOK,TS val 451367369 ecr 0,nop,wscale 7], length 0 03:36:39.863270 cilium_host In IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [S], seq 4261706409, win 64240, options [mss 1460,sackOK,TS val 451367369 ecr 0,nop,wscale 7], length 0 03:36:39.863327 eth0 Out IP 10.1.1.66.80 > 192.168.0.10.52434: Flags [S.], seq 1339676486, ack 4261706410, win 65160, options [mss 1460,sackOK,TS val 94404898 ecr 451367369,nop,wscale 7], length 0 03:36:39.863873 eth0 In IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [.], ack 1, win 502, options [nop,nop,TS val 451367370 ecr 94404898], length 0 03:36:39.863876 cilium_net Out IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [.], ack 1, win 502, options [nop,nop,TS val 451367370 ecr 94404898], length 0 03:36:39.863878 eth0 In IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [P.], seq 1:84, ack 1, win 502, options [nop,nop,TS val 451367370 ecr 94404898], length 83: HTTP: GET / HTTP/1.1 03:36:39.863878 cilium_net Out IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [P.], seq 1:84, ack 1, win 502, options [nop,nop,TS val 451367370 ecr 94404898], length 83: HTTP: GET / HTTP/1.1 03:36:39.863879 cilium_host In IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [.], ack 1, win 502, options [nop,nop,TS val 451367370 ecr 94404898], length 0 03:36:39.863922 cilium_host In IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [P.], seq 1:84, ack 1, win 502, options [nop,nop,TS val 451367370 ecr 94404898], length 83: HTTP: GET / HTTP/1.1 03:36:39.863951 eth0 Out IP 10.1.1.66.80 > 192.168.0.10.52434: Flags [.], ack 84, win 509, options [nop,nop,TS val 94404899 ecr 451367370], length 0 03:36:39.865005 lxc9a5a9b98cc14 Out IP 10.0.1.12.53236 > 10.0.1.41.80: Flags [S], seq 3239086413, win 64480, options [mss 1240,sackOK,TS val 2510293579 ecr 0,nop,wscale 7], length 0 03:36:39.865026 lxc9a5a9b98cc14 In IP 10.0.1.41.80 > 10.0.1.12.53236: Flags [S.], seq 3547594077, ack 3239086414, win 65084, options [mss 1240,sackOK,TS val 1641961762 ecr 2510293579,nop,wscale 7], length 0 03:36:40.869815 lxc9a5a9b98cc14 Out IP 10.0.1.12.53236 > 10.0.1.41.80: Flags [S], seq 3239086413, win 64480, options [mss 1240,sackOK,TS val 2510294584 ecr 0,nop,wscale 7], length 0 03:36:40.869836 lxc9a5a9b98cc14 In IP 10.0.1.41.80 > 10.0.1.12.53236: Flags [S.], seq 3547594077, ack 3239086414, win 65084, options [mss 1240,sackOK,TS val 1641962767 ecr 2510293579,nop,wscale 7], length 0 03:36:40.869857 lxc9a5a9b98cc14 In IP 10.0.1.41.80 > 10.0.1.12.53236: Flags [S.], seq 3547594077, ack 3239086414, win 65084, options [mss 1240,sackOK,TS val 1641962767 ecr 2510293579,nop,wscale 7], length 0 03:36:41.893824 lxc9a5a9b98cc14 Out IP 10.0.1.12.53236 > 10.0.1.41.80: Flags [S], seq 3239086413, win 64480, options [mss 1240,sackOK,TS val 2510295608 ecr 0,nop,wscale 7], length 0 03:36:41.893870 lxc9a5a9b98cc14 In IP 10.0.1.41.80 > 10.0.1.12.53236: Flags [S.], seq 3547594077, ack 3239086414, win 65084, options [mss 1240,sackOK,TS val 1641963791 ecr 2510293579,nop,wscale 7], length 0 03:36:42.918755 lxc9a5a9b98cc14 Out IP 10.0.1.12.53236 > 10.0.1.41.80: Flags [S], seq 3239086413, win 64480, options [mss 1240,sackOK,TS val 2510296633 ecr 0,nop,wscale 7], length 0 03:36:42.918781 lxc9a5a9b98cc14 In IP 10.0.1.41.80 > 10.0.1.12.53236: Flags [S.], seq 3547594077, ack 3239086414, win 65084, options [mss 1240,sackOK,TS val 1641964816 ecr 2510293579,nop,wscale 7], length 0 03:36:43.941800 lxc9a5a9b98cc14 Out IP 10.0.1.12.53236 > 10.0.1.41.80: Flags [S], seq 3239086413, win 64480, options [mss 1240,sackOK,TS val 2510297656 ecr 0,nop,wscale 7], length 0 03:36:43.941828 lxc9a5a9b98cc14 In IP 10.0.1.41.80 > 10.0.1.12.53236: Flags [S.], seq 3547594077, ack 3239086414, win 65084, options [mss 1240,sackOK,TS val 1641965839 ecr 2510293579,nop,wscale 7], length 0 03:36:44.864884 eth0 Out IP 10.1.1.66.80 > 192.168.0.10.52434: Flags [P.], seq 1:226, ack 84, win 509, options [nop,nop,TS val 94409900 ecr 451367370], length 225: HTTP: HTTP/1.1 503 Service Unavailable 03:36:44.866262 eth0 In IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [.], ack 226, win 501, options [nop,nop,TS val 451372372 ecr 94409900], length 0 03:36:44.866268 cilium_net Out IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [.], ack 226, win 501, options [nop,nop,TS val 451372372 ecr 94409900], length 0 03:36:44.866270 cilium_host In IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [.], ack 226, win 501, options [nop,nop,TS val 451372372 ecr 94409900], length 0 03:36:44.866415 eth0 In IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [F.], seq 84, ack 226, win 501, options [nop,nop,TS val 451372373 ecr 94409900], length 0 03:36:44.866416 cilium_net Out IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [F.], seq 84, ack 226, win 501, options [nop,nop,TS val 451372373 ecr 94409900], length 0 03:36:44.866417 cilium_host In IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [F.], seq 84, ack 226, win 501, options [nop,nop,TS val 451372373 ecr 94409900], length 0 03:36:44.866484 eth0 Out IP 10.1.1.66.80 > 192.168.0.10.52434: Flags [F.], seq 226, ack 85, win 509, options [nop,nop,TS val 94409901 ecr 451372373], length 0 03:36:44.867113 eth0 In IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [.], ack 227, win 501, options [nop,nop,TS val 451372373 ecr 94409901], length 0 03:36:44.867116 cilium_net Out IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [.], ack 227, win 501, options [nop,nop,TS val 451372373 ecr 94409901], length 0 03:36:44.867118 cilium_host In IP 192.168.0.10.52434 > 10.1.1.66.80: Flags [.], ack 227, win 501, options [nop,nop,TS val 451372373 ecr 94409901], length 0 03:36:45.989774 lxc9a5a9b98cc14 In IP 10.0.1.41.80 > 10.0.1.12.53236: Flags [S.], seq 3547594077, ack 3239086414, win 65084, options [mss 1240,sackOK,TS val 1641967887 ecr 2510293579,nop,wscale 7], length 0 03:36:45.989834 lxc9a5a9b98cc14 Out IP 10.0.1.12.53236 > 10.0.1.41.80: Flags [R], seq 3239086414, win 0, length 0 ``` ### Success Pattern: [Client] -> [Other Node] -(vxlan)-> [Backend Pod Running Node] - hubble log ``` 10.0.2.89:38041 (ingress) <> default/whoami-5996d44689-hhnw4:80 (ID:47342) to-overlay FORWARDED (TCP Flags: SYN) 10.0.2.89:38041 (ingress) -> default/whoami-5996d44689-hhnw4:80 (ID:47342) to-endpoint FORWARDED (TCP Flags: SYN) 10.0.2.89:38041 (ingress) <- default/whoami-5996d44689-hhnw4:80 (ID:47342) to-overlay FORWARDED (TCP Flags: SYN, ACK) 10.0.2.89:38041 (ingress) <> default/whoami-5996d44689-hhnw4:80 (ID:47342) to-overlay FORWARDED (TCP Flags: ACK) 192.168.0.10:35352 (ingress) -> default/whoami-5996d44689-hhnw4:80 (ID:47342) http-request FORWARDED (HTTP/1.1 GET http://whoami.example.test/) 10.0.2.89:38041 (ingress) <> default/whoami-5996d44689-hhnw4:80 (ID:47342) to-overlay FORWARDED (TCP Flags: ACK, PSH) 10.0.2.89:38041 (ingress) -> default/whoami-5996d44689-hhnw4:80 (ID:47342) to-endpoint FORWARDED (TCP Flags: ACK) 10.0.2.89:38041 (ingress) -> default/whoami-5996d44689-hhnw4:80 (ID:47342) to-endpoint FORWARDED (TCP Flags: ACK, PSH) 10.0.2.89:38041 (ingress) <- default/whoami-5996d44689-hhnw4:80 (ID:47342) to-overlay FORWARDED (TCP Flags: ACK, PSH) 10.0.2.89:38041 (ingress) <> default/whoami-5996d44689-hhnw4:80 (ID:47342) to-overlay FORWARDED (TCP Flags: ACK) 192.168.0.10:35352 (ingress) <- default/whoami-5996d44689-hhnw4:80 (ID:47342) http-response FORWARDED (HTTP/1.1 200 2ms (GET http://whoami.example.test/)) ``` - tcpdump (With a debug container attached to the envoy pod) ``` 03:36:39.122650 cilium_vxlan P IP 10.0.2.89.35631 > 10.0.1.41.80: Flags [S], seq 3170010198, win 65450, options [mss 1190,sackOK,TS val 4192566623 ecr 0,nop,wscale 7], length 0 03:36:39.122727 lxc9a5a9b98cc14 In IP 10.0.1.41.80 > 10.0.2.89.35631: Flags [S.], seq 3994243639, ack 3170010199, win 64790, options [mss 1190,sackOK,TS val 420265790 ecr 4192566623,nop,wscale 7], length 0 03:36:39.122740 cilium_vxlan Out IP 10.0.1.41.80 > 10.0.2.89.35631: Flags [S.], seq 3994243639, ack 3170010199, win 64790, options [mss 1190,sackOK,TS val 420265790 ecr 4192566623,nop,wscale 7], length 0 03:36:39.123573 cilium_vxlan P IP 10.0.2.89.35631 > 10.0.1.41.80: Flags [.], ack 1, win 512, options [nop,nop,TS val 4192566624 ecr 420265790], length 0 03:36:39.123871 cilium_vxlan P IP 10.0.2.89.35631 > 10.0.1.41.80: Flags [P.], seq 1:216, ack 1, win 512, options [nop,nop,TS val 4192566625 ecr 420265790], length 215: HTTP: GET / HTTP/1.1 03:36:39.123901 lxc9a5a9b98cc14 In IP 10.0.1.41.80 > 10.0.2.89.35631: Flags [.], ack 216, win 505, options [nop,nop,TS val 420265792 ecr 4192566625], length 0 03:36:39.123907 cilium_vxlan Out IP 10.0.1.41.80 > 10.0.2.89.35631: Flags [.], ack 216, win 505, options [nop,nop,TS val 420265792 ecr 4192566625], length 0 03:36:39.124182 lxc9a5a9b98cc14 In IP 10.0.1.41.80 > 10.0.2.89.35631: Flags [P.], seq 1:462, ack 216, win 505, options [nop,nop,TS val 420265792 ecr 4192566625], length 461: HTTP: HTTP/1.1 200 OK 03:36:39.124197 cilium_vxlan Out IP 10.0.1.41.80 > 10.0.2.89.35631: Flags [P.], seq 1:462, ack 216, win 505, options [nop,nop,TS val 420265792 ecr 4192566625], length 461: HTTP: HTTP/1.1 200 OK 03:36:39.125517 cilium_vxlan P IP 10.0.2.89.35631 > 10.0.1.41.80: Flags [.], ack 462, win 509, options [nop,nop,TS val 4192566626 ecr 420265792], length 0 ``` ### How can we reproduce the issue? Using the Values below to deploy with Helm reproduces the issue 100% in my environment. In these Values, the elements specific to my environment that need to be communicated are.. The Node OS is AlmaLinux 10. Since the ip_tables module is not installed by default in AlmaLinux 10, I have installed kernel-modules-extra. I use k0s as my Kubernetes distribution. k0s features a function called \"node-local load balancer\". Using this feature, an Envoy-based load balancer is provided at the worker node's localhost:7443, providing redundancy for the KubeAPI ports of multiple control planes. ``` bgpControlPlane: enabled: true hubble: relay: enabled: true ui: enabled: true k8sServiceHost: localhost k8sServicePort: 7443 kubeProxyReplacement: true socketLB: enabled: true terminatePodConnections: true hostNamespaceOnly: true operator: replicas: 1 bpf: tproxy: true masquerade: true gatewayAPI: enabled: true ``` ### Cilium Version 1.20.0 ### Kernel Version 6.12.0-211.38.1.el10_2.x86_64_v2 #1 SMP PREEMPT_DYNAMIC Fri Jul 24 14:11:49 UTC 2026 x86_64 Linux ### Kubernetes Version v1.36.2+k0s ### Regression _No response_ ### Sysdump _No response_ ### Relevant log output ```shell ``` ### Anything else? _No response_ ### Cilium Users Document - [ ] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47591",
"createdAt": "2026-07-30T04:45:33Z",
"updatedAt": "2026-08-13T11:48:48Z",
"timestamp": "2026-08-13T11:48:48Z",
"metrics": {
"reactions": 0,
"comments": 4
},
"labels": [
"kind/bug",
"need-more-info",
"needs/triage",
"kind/community-report",
"feature/k8s-gateway-api"
],
"author": "chattytak",
"state": "open",
"assignees": [
"nezdolik"
],
"change": "updated"
}
},
{
"id": "event:3952ba58b4e3d66a2c5c",
"signalId": "github:cilium/cilium:pull_request:47935",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47935",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: clean up 0-initializing for struct csum_offset",
"text": "Let csum_l4_offset_and_flags() take care of this when needed.",
"url": "https://github.com/cilium/cilium/pull/47935",
"createdAt": "2026-08-13T10:23:38Z",
"updatedAt": "2026-08-13T11:36:36Z",
"timestamp": "2026-08-13T11:36:36Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"dont-merge/needs-release-note-label"
],
"author": "julianwiedmann",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:6aff6302d07881c3873b",
"signalId": "github:cilium/cilium:pull_request:45953",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:45953",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "node/manager: Populate node table from manager",
"text": "We're on regular basis now encountering the situation where we would like to be able to fetch and watch information about individual Cilium nodes in the agent. Currently this requires implementing a `node.Handler` and subscribing with the `NodeManager` which is fair bit of boilerplate and annoying to test. It's even worse if all the rest of the code is interacting with StateDB tables. As a first small step towards https://github.com/cilium/cilium/issues/41744 and to allow new code to easily watch and look up nodes, change the `Table[*LocalNode]` into `Table[*Node]` and populate the remote nodes into this table from `NodeManager`. This PR tries to keep the changes to a minimum and local to `pkg/node` and hence uses adds a `type LocalNode = Node` alias and doesn't change the `LocalNodeStoreCell` structure. The runtime impact of this change without further cleanup is that we now temporarily have an additional index for remote Cilium nodes and we store`types.Node` twice (shallow clone, 296 bytes). The next step would be to refactor `NodeManager` to use `Table[*Node]` internally to avoid the duplicate indexing.",
"url": "https://github.com/cilium/cilium/pull/45953",
"createdAt": "2026-05-13T12:42:16Z",
"updatedAt": "2026-08-13T11:35:00Z",
"timestamp": "2026-08-13T11:35:00Z",
"metrics": {
"reactions": 2,
"comments": 6
},
"labels": [
"release-note/misc"
],
"author": "joamaki",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:e3dbf0a977726870eeec",
"signalId": "github:cilium/cilium:pull_request:47934",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47934",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: srv6: move SRv6 map structs to srv6.h",
"text": "A bit more untangling of the big common.h header.",
"url": "https://github.com/cilium/cilium/pull/47934",
"createdAt": "2026-08-13T09:57:55Z",
"updatedAt": "2026-08-13T11:25:25Z",
"timestamp": "2026-08-13T11:25:25Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"area/datapath",
"kind/cleanup",
"release-note/misc",
"feature/srv6"
],
"author": "julianwiedmann",
"state": "open",
"assignees": [
"julianwiedmann"
],
"change": "updated"
}
},
{
"id": "event:5d1e9c1c4cddafa15311",
"signalId": "github:cilium/cilium:issue:43519",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:issue:43519",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Envoy NPDS not updated when new identities are added for GatewayAPI ingress endpoints doing hairpin traffic for (at least) wildcard matching policies",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.18.5 and lower than v1.19.0 ### What happened? When using Gateway API with L7LB services, hairpin traffic from cluster-internal workloads (e.g., uptime-kuma self-monitoring) to gateway endpoints is intermittently denied by Envoy with \"403 Access denied\". The issue will crop up sometimes after a cluster-internal workload being monitored is rescheduled. The new backend identity is correctly added to the Cilium agent's policy for the ingress endpoint (visible in `cilium-dbg endpoint get `), but the local Envoy's NPDS is not updated. Envoy denies traffic with: ``` cilium.network: No policy found for id: ``` **Expected behavior:** When a new identity is added to the selector cache, the ingress endpoint's Envoy NPDS should be updated to include the new identity, allowing traffic to flow. **Actual behavior:** The NPDS remains stale until either: 1. A config change triggers a full policy regeneration on the affected node 2. The cilium-agent pod is restarted 3. A policy change triggers an update of the `reserved:ingress` endpoint and up-to-date identities are pushed. ### How can we reproduce the issue? 1. Deploy Gateway API with HTTPRoutes pointing to backend services on Node A. I'm using Cilium LBIPAM to back the Gateway in this case. 2. Apply a ClusterwideCiliumPolicy that allows traffic from the ingress entity for all relevant workloads that uses an `endpointSelector: {}` selector (so that it ADDITIONALLY matches reserved:ingress). For example a wide-open policy like: ``` spec: egress: - toEntities: - world - remote-node - cluster - kube-apiserver - toEndpoints: - {} endpointSelector: {} ingress: - fromEntities: - world - cluster - remote-node - kube-apiserver - ingress - fromEndpoints: - {} ``` 3. Deploy a monitoring workload (e.g., uptime-kuma) on Node B that performs hairpin requests to services through the gateway's external IP 5. Scale down and up (or delete/recreate) a backend pod that the gateway routes to (e.g. migrate it from Node A to Node C) 6. The new backend pod gets a new identity 7. Hairpin traffic from the monitoring workload to the gateway is denied with 403. In this case I'll see something like the following running when running `cilium-dbg endpoint get [reserved:ingress's identity] |grep revision` on Node A: before restarting the backend: ``` \"proxy-policy-revision\": 25 \"policy-revision\": 25 ``` after restarting the backend: ``` \"proxy-policy-revision\": 25 \"policy-revision\": 26 ``` and the cilium-agent will have the new identities for the backend workload, but envoy will not have received them. However the issue does not always seem to trigger, probably because of other simultaneous changes that force envoy to be updated with the new identities. But it's often enough to be problematic beyond monitoring (e.g. cert-manager HTTP-01 lets-encrypt challenges' self-check before submission). ### Cilium Version ``` Client: 1.18.5 7d4d8932 2025-12-17T04:56:47+00:00 go version go1.24.11 linux/amd64 Daemon: 1.18.5 7d4d8932 2025-12-17T04:56:47+00:00 go version go1.24.11 linux/amd64 ``` But I have been having this issue intermittently since I began using Gateway API circa Cilium 1.16 ### Kernel Version ``` Linux 6.18.1-talos #1 SMP Wed Dec 17 10:07:33 UTC 2025 x86_64 Linux (Talos 1.12.0) ``` ### Kubernetes Version ``` Client Version: v1.35.0 Server Version: v1.35.0 ``` ### Regression _No response_ ### Sysdump _No response_ ### Relevant log output ```shell ``` ### Anything else? ### Root Cause Analysis Based on code analysis (thanks claude-code plus finally having enough free time to really dig in), the issue appears to be in `/pkg/endpoint/bpf.go` in `applyPolicyMapChangesLocked`: ```go // Line 1093-1094 updateEnvoy := hasNewPolicy // FALSE for incremental identity updates // Line 1115-1128 if !changes.Empty() { // updateEnvoy if there were any mapChanges, but only if the endpoint has Envoy // redirects, or is an Ingress endpoint updateEnvoy = updateEnvoy || hasEnvoyRedirect || e.isIngress } ``` The issue appears to be that `updateEnvoy` is only set to `true` if `!changes.Empty()` is TRUE **first**. For wildcard selectors, it seems no map changes are accumulated because of an early return in `/pkg/policy/l4.go`: ```go // Line 815-816 if cs.IsWildcard() { return // No AccumulateMapChanges called! } ``` The ingress endpoint appears to use wildcard selectors (via `wildcardRule` in `repository.go:463-470`). If this analysis is correct, when new identities are added: 1. `SelectorCache.UpdateIdentities` is called 2. The wildcard selector is notified via `IdentitySelectionUpdated` 3. Early return at line 815-816 because `cs.IsWildcard()` is true 4. No map changes are accumulated 5. In `applyPolicyMapChangesLocked`, `changes.Empty()` returns TRUE 6. `updateEnvoy` is never set despite `e.isIngress` being TRUE 7. `UpdateNetworkPolicy` is never called 8. Envoy NPDS remains stale There may be other factors contributing to this issue that contribute to the issue but haven't yet identified. ### Why this matters for L7LB/Gateway traffic L7LB services like GatewayAPI cause the hairpin traffic to be diverted to the source's **local** Envoy on the source node, which now potentially has stale identities. This means: - Traffic from a monitoring pod on node-A to the gateway IP is redirected to node-A's local Envoy - Node-A's Envoy checks the local ingress endpoint's (reserved:ingress) policy - If the backend's identity is missing from node-A's ingress endpoint NPDS, traffic is denied The ingress endpoint exists on every node with potentially different states if NPDS updates are not triggered. ### Possible Fix Direction If the analysis above is correct, one potential fix might be to modify the condition at line 1115-1128 to trigger Envoy updates for ingress endpoints when there's a new selector snapshot, regardless of whether map changes are empty. However, I don't pretend to understand the cilium architecture well enough; perhaps some other mechanism should also be updating envoy identity data and isn't being triggered in the case of hairpin traffic. ### Workaround Triggering any config change on the affected node's cilium-agent (e.g., toggling debug logging) causes a full policy regeneration which includes calling `UpdateNetworkPolicy` for the ingress endpoint, updating the NPDS with the new identities. ### Cilium Users Document - [x] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/43519",
"createdAt": "2025-12-29T08:49:27Z",
"updatedAt": "2026-08-13T11:05:07Z",
"timestamp": "2026-08-13T11:05:07Z",
"metrics": {
"reactions": 5,
"comments": 9
},
"labels": [
"kind/bug",
"sig/policy",
"kind/community-report",
"pinned",
"area/agent",
"area/servicemesh"
],
"author": "jackmaninov",
"state": "open",
"assignees": [
"nezdolik"
],
"change": "updated"
}
},
{
"id": "event:dfea7feeced7d0844599",
"signalId": "github:cilium/cilium:pull_request:45815",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:45815",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "k8s: Use upstream controller-tools",
"text": "We have been using a fork of `sigs.k8s.io/controller-tools` ever since we've been using controller-tools to generate our CRDs (#11607). The upstream project has evolved a lot in the last 5 years and now supports all the features we need, meaning we no longer need to use our forked version. See the following table for details of every single commit from our fork and explaination for why we don't need them anymore: | # | Commit | Description | Why it can be dropped | |---|--------|-------------|----------------------| | 1 | [`254b4d27`](https://github.com/cilium/controller-tools/commit/254b4d275e3ccbd87a7ddb5da96abfc610b1b86f) | Module rename (christarazi) | Superseded by commit 16 | | 2 | [`7956d027`](https://github.com/cilium/controller-tools/commit/7956d027c227403ad41234ff00284eb2a4a90213) | Revert custom-json | Upstream re-implemented with better logic checking `json.Marshaler` and `encoding.TextMarshaler` with proper fallthrough ([kubernetes-sigs/controller-tools#601](https://github.com/kubernetes-sigs/controller-tools/pull/601) and [kubernetes-sigs/controller-tools#1015](https://github.com/kubernetes-sigs/controller-tools/pull/1015)) | | 3 | [`f2dbd822`](https://github.com/cilium/controller-tools/commit/f2dbd8227099c8cc7ba845f2d330f840f718b848) | `+kubebuilder:validation:OneOf` | Replaced by upstream `+kubebuilder:validation:ExactlyOneOf`/`AtMostOneOf` (CEL-based). This PR updates cilium types to use the upstream markers ([kubernetes-sigs/controller-tools#1212](https://github.com/kubernetes-sigs/controller-tools/pull/1212)). | | 4 | [`7bb5deed`](https://github.com/cilium/controller-tools/commit/7bb5deed814de30225f0a6c8dc10ce5c80655c6b) | Use v1 `JSONSchemaProps` for OneOf | Upstream is v1-only, was only needed for commit 3 | | 5 | [`d944debc`](https://github.com/cilium/controller-tools/commit/d944debcff34ea02a9506bc5911b2bb64ee61dd6) | Type aliasing for basic types | Upstream handles aliases comprehensively, including Go 1.23 `*types.Alias` ([kubernetes-sigs/controller-tools#1061](https://github.com/kubernetes-sigs/controller-tools/pull/1061) and [kubernetes-sigs/controller-tools#1078](https://github.com/kubernetes-sigs/controller-tools/pull/1078)) | | 6 | [`8b730d5a`](https://github.com/cilium/controller-tools/commit/8b730d5adbe5bc668d102406bfa83c34c34a3170) | Revert status removal | Upstream strips status via `transformRemoveCRDStatus` ([kubernetes-sigs/controller-tools#630](https://github.com/kubernetes-sigs/controller-tools/pull/630)) | | 7 | [`f3a7f357`](https://github.com/cilium/controller-tools/commit/f3a7f35737411447256703e7c9288bdd5b852698) | Webhook `admissionregistration/v1` | Upstream has full v1 webhook support with `timeoutSeconds`, `reinvocationPolicy`, etc. ([kubernetes-sigs/controller-tools#534](https://github.com/kubernetes-sigs/controller-tools/pull/534)) | | 8 | [`924de437`](https://github.com/cilium/controller-tools/commit/924de43755fe3c3c505929f63caeff2733acacef) | `AdmissionReviewVersions` | Upstream has this as a required marker field | | 9 | [`4ef22c33`](https://github.com/cilium/controller-tools/commit/4ef22c3309666cf964534982e119685f9f46fe4f) | Remove defaults from `v1beta1` CRDs | Upstream dropped `v1beta1` CRD support entirely ([kubernetes-sigs/controller-tools#607](https://github.com/kubernetes-sigs/controller-tools/pull/607)) | | 10 | [`109db64f`](https://github.com/cilium/controller-tools/commit/109db64f53d447014e2ab7031440443babffcc1c) | Default `corev1.Protocol` to TCP | Cilium CRDs don't use `corev1.Protocol`, we use our own `api.L4Proto` type. This override had no effect for cilium. | | 11 | [`fb3e9530`](https://github.com/cilium/controller-tools/commit/fb3e953067dc5174b405ba3f4d8a0762ebc8f628) | Regenerate testdata | Testdata fully diverged, only existed to support commit 10 | | 12 | [`e0828e0b`](https://github.com/cilium/controller-tools/commit/e0828e0bacb236d2122d42b94c0788b3a0efc064) | `+kubebuilder:topleveldesc` marker | No cilium type uses the marker, generated CRDs don't contain it, and the runtime validator already warns users to stop using top-level `description` | | 13 | [`8a2263da`](https://github.com/cilium/controller-tools/commit/8a2263da57985328f420c331c9332aff9440d9b1) | `+kubebuilder:validation:AnyOf` | Same as commit 3: replaced by upstream `+kubebuilder:validation:AtLeastOneOf`. This PR updates cilium types to use the upstream markers ([kubernetes-sigs/controller-tools#1278](https://github.com/kubernetes-sigs/controller-tools/pull/1278)). | | 14 | [`7e668c1f`](https://github.com/cilium/controller-tools/commit/7e668c1fb4c2fcaa09afb05b77964d53503b6119) | `+kubebuilder:xpreserveunknownfields` | Cilium doesn't use this marker, it uses the upstream `+kubebuilder:pruning:PreserveUnknownFields` | | 15 | [`aa940491`](https://github.com/cilium/controller-tools/commit/aa94049173f871dc8fc58bce6aa39067250245ff) | Go 1.17 build tag format | Upstream already uses `//go:build` exclusively ([kubernetes-sigs/controller-tools#828](https://github.com/kubernetes-sigs/controller-tools/pull/828)) | | 16 | [`f2b7ff86`](https://github.com/cilium/controller-tools/commit/f2b7ff866fdedf2574906b62789d7bfbe3013f8c) | Module rename (cilium) | Only needed to make the fork functional, not needed if we switch back to upstream project. | Note: while this PR switches us back to using upstream controller-tools, we're temporarily using a pseudo-version as we need this PR https://github.com/kubernetes-sigs/controller-tools/pull/1375 that is not currently included in any tagged release. We'll be able to switch back to a properly tagged release version when the next one is created. The main visible change in the generated CRDs look like that and are functionnally noop: ```diff items: description: PortRuleDNS is a list of allowed DNS lookups. - oneOf: - - properties: - matchName: {} - required: - - matchName - - properties: - matchPattern: {} - required: - - matchPattern properties: matchName: description: |- @@ -806,6 +750,11 @@ spec: pattern: ^([-a-zA-Z0-9_*]+[.]?)+$ type: string type: object + x-kubernetes-validations: + - message: exactly one of the fields in [matchName + matchPattern] must be set + rule: '[has(self.matchName),has(self.matchPattern)].filter(x,x==true).size() + == 1' type: array ```",
"url": "https://github.com/cilium/cilium/pull/45815",
"createdAt": "2026-05-06T16:26:55Z",
"updatedAt": "2026-08-13T11:03:58Z",
"timestamp": "2026-08-13T11:03:58Z",
"metrics": {
"reactions": 1,
"comments": 8
},
"labels": [
"area/k8s",
"release-note/minor",
"sig/policy"
],
"author": "HadrienPatte",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:f506f3577d58b1e64717",
"signalId": "github:cilium/cilium:pull_request:47826",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47826",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api: log the right route kind when listing TLSRoutes fails",
"text": "## Description `EnqueueRequestForBackendService` lists TLSRoutes immediately after HTTPRoutes, and the error path of the TLSRoute call was copied from the HTTPRoute one above it without changing the message. A failure to list TLSRoutes is reported as `Failed to get related HTTPRoutes`, which points anyone reading the log at the wrong index and the wrong CRD. That same line is also the only `List` error handler in `operator/pkg/gateway-api/watch-handlers` that calls `Error` rather than `ErrorContext`, so it drops the context from the log record while all fourteen of its neighbours keep it. The sibling handler `EnqueueRequestForBackendServiceImport` already logs this exact failure as `Failed to get related TLSRoutes`, so this just makes the two agree. Found while looking at #47819. That issue also asks for a `helpers.HasTLSRouteSupport` guard around these two `List` calls. I left that out on purpose: on `main`, `TLSRouteKind` is in `helpers.RequiredGVKs`, and `checkCRDs` disables Gateway API entirely when a required CRD is missing, so the guard cannot be false here and would be dead code. Only the log line is wrong on `main`. ```release-note Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service ```",
"url": "https://github.com/cilium/cilium/pull/47826",
"createdAt": "2026-08-06T19:15:38Z",
"updatedAt": "2026-08-13T10:49:06Z",
"timestamp": "2026-08-13T10:49:06Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"kind/bug",
"release-note/bug",
"area/servicemesh",
"kind/community-contribution",
"feature/k8s-gateway-api",
"needs-backport/1.20"
],
"author": "mehrdadbn9",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:a8a4fb524bd832a6b2b3",
"signalId": "github:cilium/cilium:pull_request:47878",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47878",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "node: don't select IFA_F_DEPRECATED addresses as the node IP",
"text": "Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! `firstGlobalAddr()` ignores `IFA_F_DEPRECATED`, so an address whose preferred lifetime has expired can be picked as the node address. kube-vip in ARP mode parks its VIP with `preferred_lft 0`, so Cilium can end up claiming a floating VIP as the node's own address. #45868 filtered `IFA_F_TENTATIVE|IFA_F_DADFAILED` for the same class of bug, but deprecated is a different case. Tentative and dadfailed addresses cannot carry traffic; a deprecated one can. RFC 4862 only bars it for *new* communication, and under RFC 6724 rule 3 the kernel deprioritizes rather than excludes it. Adding the flag to that mask would take a node whose only address has deprecated, say because a router stopped advertising the prefix, from working to failing to select any address at all. So this prefers non-deprecated addresses instead of filtering deprecated ones. The existing search is unchanged and runs a second time allowing deprecated addresses, but only if the first pass found nothing. `errNoAddressFound` becomes a sentinel so that retry fires on \"nothing matched\" and not on a netlink error. One consequence worth flagging: the first pass completes the whole existing fallback ladder, including the all-interfaces stage, before the second begins. A non-deprecated address on another interface therefore beats a deprecated one on the requested interface. That is already how the ladder treats tentative and dadfailed addresses. Happy to invert it if you'd rather the requested interface always win. ### Not included The `Table[*Device]` path is untouched. `tables.DeviceAddress` does not carry the netlink flags, and unlike the DAD flags (which only ever clear) `IFA_F_DEPRECATED` gets set *after* the address is already in the table. The `RTM_NEWADDR` for that transition produces a byte-identical `DeviceAddress`, so a #45868-style ingest filter would be a silent no-op there. A proper fix needs a `Deprecated` field on `DeviceAddress` plus removal-on-update. I can file that separately. ### Testing `TestAddrUsableAsNodeIP` gains 4 cases, one of which checks that allowing deprecated addresses does not weaken the tentative/dadfailed rejection. `TestPrivilegedFirstGlobalV4AddrDeprecated` is new: it runs in a netns with a dummy device and an address added with `preferred_lft 0`, covering both \"deprecated skipped when a usable address exists\" and \"deprecated used when it is the only one\". Reverting just the flag check makes the first case fail with `got 21.0.0.1, want 192.168.0.1`, Cilium picking the deprecated public VIP over the usable private address. Fixes: #47853 ```release-note Don't select IPv4/IPv6 addresses flagged deprecated when determining the node address ``` This PR was prepared with AIL:2. I wrote the change itself; AI was used to get up to speed on this codebase and to draft the tests. I reviewed the full diff and verified it locally, including the revert check described above. [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47878",
"createdAt": "2026-08-10T04:18:56Z",
"updatedAt": "2026-08-13T10:33:38Z",
"timestamp": "2026-08-13T10:33:38Z",
"metrics": {
"reactions": 1,
"comments": 3
},
"labels": [
"kind/enhancement",
"release-note/minor",
"area/agent",
"kind/community-contribution"
],
"author": "arcusbuilds",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:7db0a301d49d16bca7d3",
"signalId": "github:cilium/cilium:pull_request:46824",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:46824",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Configurable FQDN DNS Proxy Redirection",
"text": "This PR makes DNS redirection to the proxy for FQDN network policies configurable and automatic, replacing hardcoded rules and manual configurations. Summary of Changes - Added new flags to specify how to locate DNS servers in the cluster (via namespace/pod labels, a list of IP addresses, or a custom port). - Implemented GetFQDNPolicyDNSSelectors (with tests) to translate the configuration flags into pod/namespace/CIDR selectors and L4 rules. - Updated KCNP parsing to use the new configurable DNS selectors instead of hardcoding kube-dns. - Auto-generate DNS egress rules for CNP/CCNP toFQDNs based on the CLI configuration, eliminating the need for users to write manual redirect policies. - (minor cleanup) Refactored kcnpParseProtocols to remove an unused error return. AI Disclosure: Parts of this pull request were authored or accelerated using Antigravity. All generated code has been fully reviewed, tested, and verified manually. I take full responsibility for the code soundness and license compliance per the Cilium AI Policy. Fixes: #46823 ```release-note Added CLI flags to configure automatic DNS redirection to the proxy for FQDN network policies. ```",
"url": "https://github.com/cilium/cilium/pull/46824",
"createdAt": "2026-06-30T20:41:39Z",
"updatedAt": "2026-08-13T10:01:39Z",
"timestamp": "2026-08-13T10:01:39Z",
"metrics": {
"reactions": 2,
"comments": 13
},
"labels": [
"release-note/minor",
"sig/policy"
],
"author": "TheBeeZee",
"state": "open",
"assignees": [
"squeed"
],
"change": "updated"
}
},
{
"id": "event:466e9491dfdfc5830ef5",
"signalId": "github:cilium/cilium:pull_request:47103",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47103",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Fix: data race for unlocked map read in regeneration goroutine",
"text": " This is a Go map concurrent read data race bug. The core issue is that a new goroutine is spawned to perform `e.isPropertyLocked()` instead of calling the API on the original goroutine ``` go func() { if !e.isPropertyLocked(endpointtypes.PropertyFakeEndpoint) { e.scrubIPsInConntrackTable() } close(datapathRegenCtxt.ctCleaned) }() ``` e.isPropertyLocked() reads e.properties (a map[string]any) without holding any lock: ``` func (e *Endpoint) isPropertyLocked(propertyKey string) bool { if v, ok := e.properties[propertyKey]; ok { ... } return false } ``` Go maps are not safe for concurrent access. If goroutine A writes e.properties while holding the lock, and this new goroutine reads e.properties without holding the lock, the Go runtime will panic with fatal error: concurrent map read and map write. The fix replaces it with e.IsProperty(), which acquires a read lock first: ``` func (e *Endpoint) IsProperty(propertyKey string) bool { e.mutex.RWMutex.RLock() defer e.mutex.RWMutex.RUnlock() return e.isPropertyLocked(propertyKey) } ``` This ensures all reads of e.properties are properly synchronized. Fixes: #issue-number ```release-note ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47103",
"createdAt": "2026-07-11T00:06:16Z",
"updatedAt": "2026-08-13T09:56:17Z",
"timestamp": "2026-08-13T09:56:17Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "weizhoublue",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:1bf6f7280d8b8ba4c877",
"signalId": "github:cilium/cilium:pull_request:47787",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47787",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ci: use GitHub App client ID in v1.20 image workflow",
"text": "## Summary - replace the deprecated `app-id` input with `client-id` in the v1.20 image workflow - use `AUTO_COMMENT_CLIENT_APP_ID` for the corresponding GitHub App credential ## Why The v1.20 workflow on `main` handles pull requests targeting the v1.20 branch. Keeping this change isolated allows the same one-file patch to be backported only to v1.20, where the corresponding workflow handles branch pushes. Requested backport target: `v1.20` only. ## Validation - changed workflow parses as valid YAML - `git diff --check`",
"url": "https://github.com/cilium/cilium/pull/47787",
"createdAt": "2026-08-05T17:52:24Z",
"updatedAt": "2026-08-13T09:36:07Z",
"timestamp": "2026-08-13T09:36:07Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"release-note/ci",
"kind/community-contribution",
"dont-merge/needs-ci-validation",
"area/renovate"
],
"author": "bogdankrasko",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:4c5385eeaaabee527f0c",
"signalId": "github:cilium/cilium:pull_request:47788",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47788",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ci: replace needs-attention action and use app client ID",
"text": "## Summary - replace `hramos/needs-attention` with pinned `actions/github-script@v9` logic - preserve the existing issue-label transition: when the issue author replies to an issue labeled `need-more-info`, remove that label and add `info-completed` - configure `actions/create-github-app-token` in the image workflow with its `client-id` input and the `AUTO_COMMENT_BOT_CLIENT_ID` secret ## Why Using `actions/github-script` makes the issue-author and label-transition behavior explicit in the workflow while moving the step to the current GitHub Actions runtime. The image workflow also needs to use the GitHub App client ID with the corresponding token-action input. These workflows apply only to `main` and no backport is needed. No stable-branch backport is required for this PR. ## Validation - both changed workflows parse as valid YAML - `git diff --check`",
"url": "https://github.com/cilium/cilium/pull/47788",
"createdAt": "2026-08-05T17:52:42Z",
"updatedAt": "2026-08-13T09:33:18Z",
"timestamp": "2026-08-13T09:33:18Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"release-note/ci",
"kind/community-contribution",
"dont-merge/needs-ci-validation",
"area/renovate"
],
"author": "bogdankrasko",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:6b24fe5db27e57c8e4f9",
"signalId": "github:cilium/cilium:pull_request:47785",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47785",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ci: use GitHub App client ID in v1.18 image workflow",
"text": "## Summary - replace the deprecated `app-id` input with `client-id` in the v1.18 image workflow - use `AUTO_COMMENT_CLIENT_APP_ID` for the corresponding GitHub App credential ## Why The v1.18 workflow on `main` handles pull requests targeting the v1.18 branch. Keeping this change isolated allows the same one-file patch to be backported only to v1.18, where the corresponding workflow handles branch pushes. Requested backport target: `v1.18` only. ## Validation - changed workflow parses as valid YAML - `git diff --check`",
"url": "https://github.com/cilium/cilium/pull/47785",
"createdAt": "2026-08-05T17:52:00Z",
"updatedAt": "2026-08-13T09:25:57Z",
"timestamp": "2026-08-13T09:25:57Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"release-note/ci",
"kind/community-contribution",
"dont-merge/needs-ci-validation",
"area/renovate"
],
"author": "bogdankrasko",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:110758ecb58f5b590fb6",
"signalId": "github:cilium/cilium:pull_request:47786",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47786",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ci: use GitHub App client ID in v1.19 image workflow",
"text": "## Summary - replace the deprecated `app-id` input with `client-id` in the v1.19 image workflow - use `AUTO_COMMENT_CLIENT_APP_ID` for the corresponding GitHub App credential ## Why The v1.19 workflow on `main` handles pull requests targeting the v1.19 branch. Keeping this change isolated allows the same one-file patch to be backported only to v1.19, where the corresponding workflow handles branch pushes. Requested backport target: `v1.19` only. ## Validation - changed workflow parses as valid YAML - `git diff --check`",
"url": "https://github.com/cilium/cilium/pull/47786",
"createdAt": "2026-08-05T17:52:08Z",
"updatedAt": "2026-08-13T09:25:33Z",
"timestamp": "2026-08-13T09:25:33Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"release-note/ci",
"kind/community-contribution",
"dont-merge/needs-ci-validation",
"area/renovate"
],
"author": "bogdankrasko",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:8ef53aad14904725b1be",
"signalId": "github:cilium/cilium:pull_request:47843",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47843",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api: report all route validation errors in status",
"text": "`ValidateHeaderModifier` write an `Accepted=False` condition. But `ValidateMatchRegexps` writes the same condition type, and `helpers.MergeConditions` matches by type and replaces in place. In `setHTTPRouteStatuses` in gateway_reconcile.go both run in one loop, so the regex message overwrites the header modifier message. `setGRPCRouteStatuses` has the same loop, same defect. For example, a user creates the following invalid configuration: ``` apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: my-route namespace: default spec: parentRefs: - name: my-gateway rules: - matches: - path: type: RegularExpression value: \"/api/(v1\" # malformed regex filters: - type: RequestHeaderModifier requestHeaderModifier: set: - name: Host # rewriting the Host header is not allowed value: example.com backendRefs: - name: my-service port: 8080 ``` The resulting status is missing one of the errors: ``` status: parents: - parentRef: name: my-gateway conditions: - type: Accepted status: \"False\" reason: UnsupportedValue message: 'Invalid regular expression .... `/api/(v1`' ``` This should be improved to report both errors: ``` conditions: - type: Accepted status: \"False\" reason: UnsupportedValue message: 'Invalid HTTPRoute header modifier: \"Host\" header is not supported; use URLRewrite.hostname instead; Invalid regular expression in path match: error parsing regexp: missing closing ): `/api/(v1`' ``` Fixes: #issue-number ```release-note gateway-api: report all route validation errors in statu ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47843",
"createdAt": "2026-08-07T12:16:04Z",
"updatedAt": "2026-08-13T09:11:29Z",
"timestamp": "2026-08-13T09:11:29Z",
"metrics": {
"reactions": 1,
"comments": 0
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution",
"feature/k8s-gateway-api"
],
"author": "weizhoublue",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:6ef1ac7a91cbc486d359",
"signalId": "github:cilium/cilium:pull_request:47912",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47912",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Documentation: document mesh security model",
"text": "There isn't currently an explicit mention of how cluster mesh affects the threat/security model of cilium. To clarify the assumptions the code already makes, make it explicit that there isn't a security boundary between clusters once meshed. We can think about \"improving\"/hardening, but fundamentally I do not believe it to be possible to fully withstand an adversarial meshed cluster any more than it is possible to withstand a compromised agent.",
"url": "https://github.com/cilium/cilium/pull/47912",
"createdAt": "2026-08-12T09:06:00Z",
"updatedAt": "2026-08-13T08:59:51Z",
"timestamp": "2026-08-13T08:59:51Z",
"metrics": {
"reactions": 5,
"comments": 1
},
"labels": [
"area/documentation",
"release-note/misc"
],
"author": "bimmlerd",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:fb71de83fd9a37c05863",
"signalId": "github:cilium/cilium:pull_request:47841",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47841",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: lb: use dedicated new_backend bool",
"text": "Update the change introduced by 64527fb1c31e (\"bpf: dsr: always forward DSR info to newly selected remote backend\"), and transport the `new_backend` information via a dedicated bool. This seems to help with BPF program complexity.",
"url": "https://github.com/cilium/cilium/pull/47841",
"createdAt": "2026-08-07T11:51:10Z",
"updatedAt": "2026-08-13T08:56:17Z",
"timestamp": "2026-08-13T08:56:17Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"area/datapath",
"release-note/misc",
"kind/complexity-issue",
"area/loadbalancing",
"area/kpr",
"backport-done/1.20"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
],
"change": "updated"
}
},
{
"id": "event:2305eb0954d9ed8df7aa",
"signalId": "github:cilium/cilium:pull_request:47592",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47592",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: dsr: only require DSR-info on SYN packet",
"text": "``` The DSR ingress path on a remote node currently expects DSR-info on both the SYN *and* the SYN-ACK. And clears the connection's DSR status if either of those packets doesn't carry DSR info. But it should actually be fine for the LB node to only send the DSR info on the SYN packet. So let's relax this check accordingly, and not require DSR info on the SYN-ACK. ``` https://github.com/cilium/cilium/pull/47594 highlighted this problematic part in the backend node's ingress path. If we patch this now, a future version of Cilium can stop inserting the DSR info in the SYN-ACK.",
"url": "https://github.com/cilium/cilium/pull/47592",
"createdAt": "2026-07-30T08:04:29Z",
"updatedAt": "2026-08-13T08:56:14Z",
"timestamp": "2026-08-13T08:56:14Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"area/datapath",
"release-note/misc",
"feature/dsr",
"area/kpr",
"backport-done/1.20"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
],
"change": "updated"
}
},
{
"id": "event:d0fd51e5adc6e9f42ee0",
"signalId": "github:cilium/cilium:pull_request:47593",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47593",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: dsr: fix CT update in remote note's ingress path",
"text": "When a DSR-enabled node receives a TCP packet with SYN flag but *without* DSR info, it updates the connection's DSR status to 'false'. This addresses scenarios where a connection is re-opened by the same client, but this time directly towards the backend (without a service inbetween). But since we're using a CT tuple that hasn't been used for a CT lookup, its direction flag isn't set yet. And so the call to ct_update_dsr() is not effective, since it doesn't even find the expected CT entry. Fix this by setting the TUPLE_F_OUT manually. ```release-note Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. ```",
"url": "https://github.com/cilium/cilium/pull/47593",
"createdAt": "2026-07-30T08:33:23Z",
"updatedAt": "2026-08-13T08:56:11Z",
"timestamp": "2026-08-13T08:56:11Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"kind/bug",
"area/datapath",
"release-note/bug",
"ready-to-merge",
"backport/author",
"feature/dsr",
"area/kpr",
"backport-done/1.20"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
],
"change": "updated"
}
},
{
"id": "event:a7379c3b181fd4d421a4",
"signalId": "github:cilium/cilium:pull_request:47640",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47640",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: dsr: don't look for TCP header on fragmented packets",
"text": "Trying to parse TCP header flags from a fragmented packet will only return garbage.",
"url": "https://github.com/cilium/cilium/pull/47640",
"createdAt": "2026-07-31T13:59:48Z",
"updatedAt": "2026-08-13T08:56:09Z",
"timestamp": "2026-08-13T08:56:09Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"kind/bug",
"release-note/bug",
"backport/author",
"feature/dsr",
"area/kpr",
"backport-done/1.20"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
],
"change": "updated"
}
},
{
"id": "event:d8fe9d0683b7d737c0ca",
"signalId": "github:cilium/cilium:pull_request:47529",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47529",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: dsr: also send DSR info on first non-SYN packet towards new backend",
"text": "Consider scenarios where an established TCP connection switches to (a) [different backend](https://github.com/cilium/cilium/blob/d376efb53dd51c8355851ca8ddbec399bc5205f9/bpf/lib/lb.h#L2303), or (b) gets ECMP-routed through a different LB node. As we currently only send the DSR-info on the TCP-SYN packet, the newly selected backend has no way of replying with a correctly RevDNATed TCP RST. The connection therefore stalls until it times out / the client terminates it. Improve the recovery time by also sending the DSR info on a non-SYN packet, when it's going towards a newly selected backend. This is best-effort - if the DSR-info doesn't fit, we send an ICMP `FRAG_NEEDED` msg back to the client instead. ```release-note Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. ```",
"url": "https://github.com/cilium/cilium/pull/47529",
"createdAt": "2026-07-27T11:51:38Z",
"updatedAt": "2026-08-13T08:56:00Z",
"timestamp": "2026-08-13T08:56:00Z",
"metrics": {
"reactions": 3,
"comments": 12
},
"labels": [
"area/datapath",
"release-note/minor",
"feature/dsr",
"area/kpr",
"backport-done/1.20"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
],
"change": "updated"
}
},
{
"id": "event:798e52316c87ef5a1b65",
"signalId": "github:cilium/cilium:pull_request:47388",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47388",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path",
"text": "When forwarding a DSR request to a remote backend, each egress path currently needs to have its own logic to extract the TCP flags and check for the SYN flag. But we already obtain the flag during the CT lookup. So let's just forward a \"need_dsr_info\" indication over the tailcall boundary, mixing it into the free part of the CB_PORT slot.",
"url": "https://github.com/cilium/cilium/pull/47388",
"createdAt": "2026-07-21T13:59:48Z",
"updatedAt": "2026-08-13T08:55:56Z",
"timestamp": "2026-08-13T08:55:56Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"release-note/misc",
"area/loadbalancing",
"feature/dsr",
"area/kpr",
"backport-done/1.20"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
],
"change": "updated"
}
},
{
"id": "event:9213f72ad612e26b3b15",
"signalId": "github:cilium/cilium:pull_request:47881",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47881",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "[v1.20] bpf: dsr: various fixes",
"text": "Backport * [ ] #47388 * [ ] #47529 * [ ] #47593 * [ ] #47640 * [ ] #47592 * [ ] #47841 ```release-note Fix various aspects in the DSR feature: support TCP-RST after switching to a new backend, fix processing of fragmented TCP traffic, fix accidental RevDNAT of a connection which matches an earlier DSR connection. ``` ```upstream-prs 47388 47529 47593 47640 47592 47841 ```",
"url": "https://github.com/cilium/cilium/pull/47881",
"createdAt": "2026-08-10T08:02:13Z",
"updatedAt": "2026-08-13T08:54:27Z",
"timestamp": "2026-08-13T08:54:27Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"kind/backports",
"backport/1.20"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
],
"change": "updated"
}
},
{
"id": "event:ffe5896a9c72fa489946",
"signalId": "github:cilium/cilium:pull_request:47932",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47932",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "clustermesh/endpointslices: explicitly limit maximum decoder memory",
"text": "Explicitly configure a limit for the zstd decoder used to decode the ClusterEndpointSlice entries received over Cluster Mesh, to prevent the risk of unbounded memory usage in case of crafted payloads. I've marked the PR as `release-note/misc` because the logic ingesting ClusterEndpointSlices is incomplete and disabled behind a feature flag in v1.20. Reported-by: Secstant - Sigma Prime \\",
"url": "https://github.com/cilium/cilium/pull/47932",
"createdAt": "2026-08-13T08:30:58Z",
"updatedAt": "2026-08-13T08:52:10Z",
"timestamp": "2026-08-13T08:52:10Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"area/clustermesh",
"release-note/misc",
"needs-backport/1.20"
],
"author": "giorio94",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:73454a6deea9e5cad00d",
"signalId": "github:cilium/cilium:pull_request:47915",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47915",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "kvstore: let [UserEnforcePresence] additionally revoke stale roles",
"text": "The [UserEnforcePresence] function is responsible for creating the target user in etcd, if not present, and granting the specified roles. Let's extend it to additionally revoke any possible roles that had been previously granted to that user, and are not present in the list of roles anymore. While being there, let's also cover this logic with a dedicated unit test, to prevent possible regressions in the future. Overall, this addresses a limitation in the clustermesh users management logic, which would not have revoked a previously granted role upon config change. While this is not deemed to manifest as an actual problem in the vast majority of scenarios, given that the only role granted with that machinery is the `remote` one \\[1], it may still be problematic if users leveraged it for different purposes, and is potentially confusing. \\[1]: https://github.com/cilium/cilium/blob/6655160839b90f6c5277655a9a359dc791d89930/install/kubernetes/cilium/templates/clustermesh-apiserver/users-configmap.yaml#L26-L27 AIL: 0 Reported-by: Mike Molchanov ```release-note Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. ```",
"url": "https://github.com/cilium/cilium/pull/47915",
"createdAt": "2026-08-12T10:08:06Z",
"updatedAt": "2026-08-13T08:51:30Z",
"timestamp": "2026-08-13T08:51:30Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"kind/bug",
"release-note/bug",
"area/clustermesh",
"area/kvstore",
"needs-backport/1.18",
"needs-backport/1.19",
"needs-backport/1.20"
],
"author": "giorio94",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:1f222e11b303ecb68bb8",
"signalId": "github:cilium/cilium:pull_request:47928",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47928",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gh: verifier: test PR branch before base branch",
"text": "The PR branch is more likely to be broken than the base branch. Let's fail fast.",
"url": "https://github.com/cilium/cilium/pull/47928",
"createdAt": "2026-08-13T08:09:20Z",
"updatedAt": "2026-08-13T08:45:51Z",
"timestamp": "2026-08-13T08:45:51Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"area/CI",
"area/datapath",
"release-note/ci"
],
"author": "julianwiedmann",
"state": "closed",
"assignees": [
"julianwiedmann"
],
"change": "updated"
}
},
{
"id": "event:43348e26934b4a0f8d7c",
"signalId": "github:cilium/cilium:pull_request:47426",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47426",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "test(bpf): parallelize eBPF test compilation",
"text": "This PR contains some enhancements to the eBPF compilation step to help improve the eBPF test suite build time in CI (related conversation in #45133). This change updates the BPF Checks workflow step to utilize all available CPU cores in the Github Actions runner to reduce build times for eBPF test targets in CI. AI Level: 1 Fixes: nobug [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47426",
"createdAt": "2026-07-22T18:11:35Z",
"updatedAt": "2026-08-13T08:45:04Z",
"timestamp": "2026-08-13T08:45:04Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"area/datapath",
"release-note/ci",
"kind/community-contribution",
"needs-backport/1.20"
],
"author": "lconnery",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:e014f466ee1d6fbc1719",
"signalId": "github:cilium/cilium:issue:47730",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:issue:47730",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Host datapath BPF programs leak on every device change, exhausting kernel executable memory",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.20.0 and lower than v1.21.0 ### What happened? A bonded interface on the node was being torn down and recreated every ~34s (unrelated host misconfiguration). The bond carries three VLAN sub-interfaces, so each cycle removes and re-adds three managed devices, producing two host-datapath reloads: ```bash 11:17:04 msg=\"Devices changed\" devices=\"[eno1 interconnect]\" 11:17:05 msg=\"Devices changed\" devices=\"[public.3212 public.3211 eno1 interconnect public.1537]\" 11:17:37 msg=\"Devices changed\" devices=\"[eno1 interconnect]\" 11:17:38 msg=\"Devices changed\" devices=\"[public.1537 public.3212 public.3211 eno1 interconnect]\" 11:18:11 msg=\"Devices changed\" devices=\"[eno1 interconnect]\" 11:18:12 msg=\"Devices changed\" devices=\"[public.1537 public.3212 public.3211 eno1 interconnect]\" ``` Each reload leaked a full generation of host datapath programs and their tail-call maps. After 21h uptime: ```bash $ bpftool prog show | grep -cE '^[0-9]+:' 74678 $ bpftool map show | grep -c prog_array 6034 ``` The leak is confined to the per-device path. There are 80 pods on this node, and every per-endpoint program count is exactly 80, while every per-device count is ~5950: ```bash $ bpftool prog show | awk '{for(i=1;i<=NF;i++) if($i==\"name\") print $(i+1)}' \\ | sort | uniq -c | sort -rn | head -20 6029 tail_no_service_ipv4 <-- leaked 6029 tail_nodeport_rev_dnat_ingress_ipv4 <-- leaked 5949 tail_handle_snat_fwd_ipv4 <-- leaked 5948 tail_handle_ipv4_from_netdev <-- leaked 5948 tail_handle_ipv4_from_host <-- leaked 80 tail_ipv4_to_endpoint <-- correct, == pod count 80 tail_ipv4_ct_ingress <-- correct 80 tail_handle_arp <-- correct ``` Each leaked generation has a distinct program tag, so these are separate compilations that were never released, not multiple references to one program. Reloads frequently abort part-way, because the device disappears while the agent is working on it. Programs are already loaded into the kernel at this point: ```bash level=warn msg=\"Failed to initialize datapath, retrying later\" module=agent.datapath.orchestrator error=\"failed to retrieve link public.1537 by name: Link not found\" ``` ### Impact we got JIT images are allocated from the kernel executable memory region (~1520 MiB on x86_64). The leaked programs filled it: ``` $ grep -E 'bpf_jit|execmem|bpf_prog_pack' /proc/vmallocinfo \\ | awk '{c=$3; sub(/\\+0x.*/,\"\",c); s[c]+=$2; n[c]++} \\ END {for (k in s) printf \"%10.2f MiB %6d %s\\n\", s[k]/1024/1024, n[k], k}' 987.84 MiB 492 bpf_prog_pack_alloc $ dmesg | grep -c 'execmem: unable to allocate memory' 12466 # in a 2.16-hour window ``` With `CONFIG_BPF_JIT_ALWAYS_ON=y` a failed JIT allocation cannot fall back to the interpreter and returns `-ENOTSUPP` (errno 524). Seccomp filter installation is the most frequent BPF load on a Kubernetes node, so **every container exec fails**: ``` containerd: msg=\"ExecSync for ... failed\" error=\"... OCI runtime exec failed: unable to init seccomp: error loading seccomp filter into kernel: error loading seccomp filter: errno 524\" ``` Exec probes then fail node-wide, pods never become ready, and the node is dead. Only a reboot recovers it. Measured rate: ~3400 leaked programs/hour, so the node dies roughly **one day after every boot** while device churn continues. ### How can we reproduce the issue? On a node with Cilium device auto-detection enabled: ```bash before_p=$(bpftool prog show | grep -cE '^[0-9]+:') before_m=$(bpftool map show | grep -c prog_array) for i in $(seq 1 20); do ip link add leakparent type dummy ip link set leakparent up n=1 for v in 1537 3211 3212; do ip link add link leakparent name leakparent.$v type vlan id $v ip addr add 10.99.$n.1/24 dev leakparent.$v ip link set leakparent.$v up n=$((n+1)) done sleep 5 # let the agent start reloading ip link del leakparent # all three managed devices vanish at once, mid-reload sleep 5 done sleep 30 echo \"delta: progs=$(( $(bpftool prog show | grep -cE '^[0-9]+:') - before_p ))\" echo \"delta: prog_arrays=$(( $(bpftool map show | grep -c prog_array) - before_m ))\" ``` Expected: both deltas return to ~0. Actual: they grow monotonically and never drop. A single dummy device added and removed cleanly does **not** leak β the device must disappear while a reload is in flight. ### Cilium Version Client: 1.17.18 Daemon: 1.17.18 Updated new found at: Client: 1.20.0 450c5314 2026-07-29T08:53:01+02:00 go version go1.26.5 linux/amd64 Daemon: 1.20.0 450c5314 2026-07-29T08:53:01+02:00 go version go1.26.5 linux/amd64 ### Kernel Version 6.12.92; 7.0.0-22-generic Both by default: CONFIG_BPF_JIT_ALWAYS_ON=y ### Kubernetes Version 1.33 ### Regression _No response_ ### Sysdump From latest cilium 1.20 test: [cilium-sysdump-20260805-141731.zip](https://github.com/user-attachments/files/30748085/cilium-sysdump-20260805-141731.zip) ### Relevant log output ```shell ``` ### Anything else? Related, but both are about *agent restarts* rather than device changes: #46065, #44194. The error reported when the executable memory region is exhausted is misleading and cost us significant debugging time. The agent presents `-ENOTSUPP` as a verifier rejection and prints a stack depth: ``` Verifier error: program tail_handle_snat_fwd_ipv4: load program: operation not supported: stack depth 272 ``` Nothing is wrong with the program or its stack usage. Distinguishing `ENOTSUPP` from an actual verifier rejection would help a lot. ### Cilium Users Document - [ ] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47730",
"createdAt": "2026-08-04T12:39:34Z",
"updatedAt": "2026-08-13T08:44:05Z",
"timestamp": "2026-08-13T08:44:05Z",
"metrics": {
"reactions": 0,
"comments": 2
},
"labels": [
"kind/bug",
"area/loader",
"area/datapath",
"needs/triage",
"kind/community-report",
"info-completed"
],
"author": "haosb",
"state": "open",
"assignees": [
"rgo3"
],
"change": "updated"
}
},
{
"id": "event:91bc691938bb7916355c",
"signalId": "github:cilium/cilium:pull_request:47301",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47301",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: Enable extended masquerade port range for BPF masquerade",
"text": "Under heavy outbound egress traffic, pods undergoing BPF masquerading can experience SNAT port exhaustion when restricted to the standard port range (`32768-65535`). This is a particular concern for users migrating from Kubernetes ip-masq-agent to Cilium eBPF masquerade, because the two have different default source port ranges: - Cilium eBPF masquerade selects any port in `32768-65535` by default. - Kubernetes ip-masq-agent selects any port in `1024-65535` by default. This change introduces support for configuring an extended masquerade port range (`--node-port-nat-range-ext`, e.g. `1024,29999`) across IPv4 and IPv6 to achieve source port range parity: 1. Refactor NAT Port Ranges into Runtime Config: - Replaced compile-time `#define NODEPORT_PORT_MIN/MAX_NAT` with dynamic BPF runtime config variables (`nodeport_port_min_nat` and `nodeport_port_max_nat`). 2. Extended Masquerade Port Range Support: - Added `--node-port-nat-range-ext` CLI flag in Hive loadbalancer configuration and mapped it to Helm. - Enforced validation rules (range bounds checking, ensuring non-overlap with NodePort range and privileged ports). - Implemented random port range selection in BPF for outgoing SNAT flows. - Added automatic fallback to the alternative range if the selected port range encounters allocation exhaustion. Fixes: https://github.com/cilium/cilium/issues/23604 ```release-note bpf: Support configuring an extended masquerade port range (`--node-port-nat-range-ext`) for BPF SNAT masquerading. ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47301",
"createdAt": "2026-07-18T02:11:52Z",
"updatedAt": "2026-08-13T08:41:56Z",
"timestamp": "2026-08-13T08:41:56Z",
"metrics": {
"reactions": 2,
"comments": 10
},
"labels": [
"area/datapath",
"release-note/minor",
"kind/community-contribution"
],
"author": "yyyyyymmm",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:d17e8863891e0f7a83b7",
"signalId": "github:cilium/cilium:pull_request:47927",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47927",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "cilium-cli/connectivity: detect Cilium version in connectivity perf setup",
"text": "`cilium connectivity perf` always reports \"Cilium version: 0.0.0\" in its info banner, regardless of the actual Cilium version running in the cluster. `setupAndValidatePerf()`, the setup path used by the `perf` subcommand, never calls `initCiliumPods()`/`detectCiliumVersion()`, unlike `setupAndValidate()` (used by `connectivity test`). `CiliumVersion` is therefore left at its Go zero value, which prints as `0.0.0`. This calls the same two steps `setupAndValidate()` already uses, in the same order, so `CiliumVersion` is populated before it's printed in `connectivity.Run()`. Tested manually against an RKE2 cluster (Cilium v1.19.4): - before the fix, `cilium connectivity perf` reported \"Cilium version: 0.0.0\" - after the fix, it correctly reports \"Cilium version: 1.19.4\" ```release-note Fixed `cilium connectivity perf` always reporting `Cilium version: 0.0.0` instead of the actual detected Cilium version.",
"url": "https://github.com/cilium/cilium/pull/47927",
"createdAt": "2026-08-13T07:53:44Z",
"updatedAt": "2026-08-13T08:39:57Z",
"timestamp": "2026-08-13T08:39:57Z",
"metrics": {
"reactions": 1,
"comments": 1
},
"labels": [
"release-note/bug",
"kind/community-contribution",
"cilium-cli",
"cilium-cli-exclusive"
],
"author": "khaddict",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:62f48af3db8ffe4ca17f",
"signalId": "github:cilium/cilium:pull_request:47919",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47919",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Fixes #47918: Handle label filters as regex when loading from file",
"text": "Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! Updates the code that loads in label filters from a file via the `label-prefix-file` configuration flag to attempt to parse each prefix as a regex to align with passing them in via CLI flags. Claude Code was used to identify the problem and suggest where needed updating. I personally checked and updated all the code in this PR. Fixes: #47918 ```release-note Fix how label filters are handled when loading from a file so they are parsed as regex ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47919",
"createdAt": "2026-08-12T15:11:10Z",
"updatedAt": "2026-08-13T08:22:00Z",
"timestamp": "2026-08-13T08:22:00Z",
"metrics": {
"reactions": 1,
"comments": 2
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "AverageMarcus",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:0e330946f2bb761aea8b",
"signalId": "github:cilium/cilium:issue:47930",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:issue:47930",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Potential issue with usePrimaryAddress on a t3.small",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.19.6 and lower than v1.20.0 ### What happened? ## Potential issue with usePrimaryAddress ### Cilium v1.19.6, AWS `t3.small` On a `t3.small` instance using AWS ENI IPAM mode with `use-primary-address: true`, Cilium seems to cap max IPs at 9 when 11 is expected. This is based on a `t3.small`'s limits of 3 ENIs, 4 IPs per ENI = 11 pod IPs max (3, 4, 4 - one reserved). ```pwsh > (aws ec2 describe-instance-types --instance-types t3.small --region eu-west-2 | ConvertFrom-Json).InstanceTypes[0].NetworkInfo | Select-Object MaximumNetworkInterfaces, Ipv4AddressesPerInterface MaximumNetworkInterfaces Ipv4AddressesPerInterface ------------------------ ------------------------- 3 4 ``` ```pwsh > helm get values cilium -n kube-system ``` ```yaml USER-SUPPLIED VALUES: cni: configMap: cni-configuration customConf: true egressMasqueradeInterfaces: eth0 enableIPv4Masquerade: false enabled: true eni: awsReleaseExcessIPs: true enabled: true nodeSpec: usePrimaryAddress: true subnetTagsFilter: - ourLegitimate/redactedFilter externalIPs: enabled: true hostPort: enabled: true ipam: mode: eni kubeProxyReplacement: false nodeinit: enabled: true operator: enabled: true nodeSelector: avcosystems.com/node-type: burst kubernetes.io/arch: amd64 kubernetes.io/os: linux podDisruptionBudget: enabled: true maxUnavailable: 1 prometheus: enabled: true serviceMonitor: enabled: true resources: limits: cpu: 50m memory: 80Mi requests: cpu: 7m memory: 35Mi prometheus: enabled: true serviceMonitor: enabled: true namespace: monitoring resources: limits: cpu: 300m memory: null requests: cpu: 120m memory: 165Mi routingMode: native tunnelProtocol: \"\" upgradeCompatibility: \"1.10\" ``` Observing logs, a pod is attempted to be put onto the node that already has 9 pods, at which point it consistently errors with e.g. ```bash Warning FailedCreatePodFoo 15m kubelet Failed to create pod foo: rpc error: code = Unknown desc = failed to setup network for foo \"25cc25redacted\": plugin type=\"cilium-cni\" failed (add): unable to allocate IP via local cilium agent: [POST /ipam][502] postIpamFailure \"no IPs currently available on the node, allocation will be retried once Cilium Operator allocates more IPs\" Warning FailedCreatePodFoo 105s (x62 over 15m) kubelet (combined from similar events): Failed to create pod foo: rpc error: code = Unknown desc = failed to setup network for foo \"3d3a7redacted\": plugin type=\"cilium-cni\" failed (add): unable to allocate IP via local cilium agent: [POST /ipam][502] postIpamFailure \"no IPs currently available on the node, allocation will be retried once Cilium Operator allocates more IPs\" ``` with up to 9 pods currently active with assigned IPs. ```pwsh > kubectl get ciliumnode ip-17redacted.eu-west-2.compute.internal -o jsonpath='{.spec.ipam}' | jq { \"pool\": { \"ip1\": { \"resource\": \"eni-1-id\" }, \"ip2\": { \"resource\": \"eni-1-id\" }, \"ip3\": { \"resource\": \"eni-2-id\" }, \"ip4\": { \"resource\": \"eni-3-id\" }, \"ip5\": { \"resource\": \"eni-1-id\" }, \"ip6\": { \"resource\": \"eni-2-id\" }, \"ip7\": { \"resource\": \"eni-3-id\" }, \"ip8\": { \"resource\": \"eni-2-id\" }, \"ip9\": { \"resource\": \"eni-3-id\" } }, \"pools\": {}, \"pre-allocate\": 8 } ``` ```pwsh > kubectl get ciliumnode ip-17redacted.eu-west-2.compute.internal -o jsonpath='{.status.eni.enis}' | jq { \"eni-1-id\": { \"addresses\": [ \"ip1\", \"ip2\", \"ip5\"], \"id\": \"eni-1-id\", \"ip\": \"separate-ip\", \"mac\": \"mac1\", \"security-groups\": [ \"sg-redacto1\", \"sg-redacto2\", \"sg-redacto3\" ], \"subnet\": { \"cidr\": \"172.foo/19\", \"id\": \"subnet-redacted1\" }, \"tags\": { \"eks:cluster-name\": \"my-eks-redacted-name\", \"eks:nodegroup-name\": \"linux-web-5\" }, \"vpc\": { \"cidrs\": [ \"172.foo../16\" ], \"id\": \"vpc-id1\", \"primary-cidr\": \"172.bar/16\" } }, \"eni-2-id\": { \"addresses\": [ \"ip3\", \"ip8\", \"ip6\"], \"description\": \"Cilium-CNI (i-cni-id-1)\", \"id\": \"eni-2-id\", \"ip\": \"172.an.ip\", \"mac\": \"mac2\", \"number\": 2, \"security-groups\": [ \"sg-redacto4\", \"sg-redacto5\", \"sg-redacto6\" ], \"subnet\": { \"cidr\": \"172.foo/19\", \"id\": \"subnet-redacted1\" }, \"tags\": { \"io.cilium/cilium-managed\": \"true\", \"io.cilium/cluster-name\": \"my-eks-redacted-name\" }, \"vpc\": { \"cidrs\": [ \"172.foo../16\" ], \"id\": \"vpc-id1\", \"primary-cidr\": \"172.bar/16\" } }, \"eni-3-id\": { \"addresses\": [ \"ip4\", \"ip7\", \"ip9\"], \"description\": \"Cilium-CNI (i-cni-id-1)\", \"id\": \"eni-3-id\", \"ip\": \"172.an.ip\", \"mac\": \"mac3\", \"number\": 1, \"security-groups\": [ \"sg-redacto7\", \"sg-redacto8\", \"sg-redacto9\" ], \"subnet\": { \"cidr\": \"172.foo/19\", \"id\": \"subnet-redacted1\" }, \"tags\": { \"io.cilium/cilium-managed\": \"true\", \"io.cilium/cluster-name\": \"my-eks-redacted-name\" }, \"vpc\": { \"cidrs\": [ \"172.foo../16\" ], \"id\": \"vpc-id1\", \"primary-cidr\": \"172.bar/16\" } } } ``` `\"use-primary-address\": true,` is in the spec: ```pwsh > kubectl get ciliumnode ip-17redacted.eu-west-2.compute.internal -o jsonpath='{.spec.eni}' | jq { \"availability-zone\": \"eu-west-2b\", \"disable-prefix-delegation\": false, \"first-interface-index\": 0, \"instance-type\": \"t3.small\", \"node-subnet-id\": \"subnet-foo\", \"subnet-tags\": { \"thing/cilium\": \"foo\" }, \"use-primary-address\": true, \"vpc-id\": \"vpc-foo\" } ``` The kubelet config itself show as as 11 maxPods: ```pwsh > kubectl get --raw \"/api/v1/nodes/ip-17redacted.eu-west-2.compute.internal/proxy/configz\" | jq '.kubeletconfig.maxPods' 11 ``` ## Potential issue? `GetMinimumAllocatableIPv4()` () has the following: ```go // limits.IPv4 contains the primary IP which is not available for allocation maxPerInterface := max(limits.IPv4-1, 0) return min(minimum, (limits.Adapters-index)*maxPerInterface) ``` When Spec.ENI.UsePrimaryAddress is true, auxiliary ENIs (index > 0) can allocate their primary IP, making maxPerInterface equal to limits.IPv4 for those interfaces. Does this cause GetMinimumAllocatableIPv4() to undercalculate the instance pool capacity (e.g., reporting 9 instead of 11 for t3.small) or am I barking up the wrong tree and there's something else I'm missing as to why this is being limited to 9 IPs? ## Planning to try (but haven't yet) Setting preAllocation to 2 as opposed to the default of 8 and setting maxAboveWatermark to 2 as opposed to the default of 0. The last 'best guess' reason I have for that is: * With preAllocation = 8 and maxAboveWatermark = 0, Cilium calculates target pool size using the watermark equation: {Target Pool} = {Used Pod IPs} + {preAllocation} * maxAboveWatermark = 0 tells Cilium: \"Do not allocate any extra IPs beyond the minimum needed to satisfy preAllocation.\" * When Cilium attempts to allocate IPs for preAllocation = 8: It allocates eth0 (3 secondary IPs). Total = 3. It allocates eth1 (3 secondary IPs). Total = 6. It allocates eth2 (3 secondary IPs). Total = 9. * At 9 IPs, Cilium hits the limits.IPv4 - 1 limit across all 3 ENIs. Because maxAboveWatermark = 0, Cilium refuses to step above the watermark to allocate the primary IPs on auxiliary interfaces (eth1 and eth2). **(The guesstimate/leap I'm taking)** * Therefore, the pool freezes at 9 IPs, leaving the last 2 IP slots on eth1 and eth2 locked and unreachable. **guessing** Any ideas? ### How can we reproduce the issue? see main content ### Cilium Version v1.19.6 ### Kernel Version 6.12.94-123.192.amzn2023.x86_64 ### Kubernetes Version v1.34.9-eks-8f14419 ### Regression _No response_ ### Sysdump _No response_ ### Relevant log output ```shell ``` ### Anything else? _No response_ ### Cilium Users Document - [x] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47930",
"createdAt": "2026-08-13T08:19:40Z",
"updatedAt": "2026-08-13T08:19:40Z",
"timestamp": "2026-08-13T08:19:40Z",
"metrics": {
"reactions": 0,
"comments": 0
},
"labels": [
"kind/bug",
"needs/triage",
"kind/community-report"
],
"author": "joe-sm",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:dee581f98af42ef9bb8a",
"signalId": "github:cilium/cilium:pull_request:47695",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47695",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "cilium-cli/connectivity: detect Cilium version in connectivity perf setup",
"text": "`cilium connectivity perf` always reports \"Cilium version: 0.0.0\" in its info banner, regardless of the actual Cilium version running in the cluster. `setupAndValidatePerf()`, the setup path used by the `perf` subcommand, never calls `initCiliumPods()`/`detectCiliumVersion()`, unlike `setupAndValidate()` (used by `connectivity test`). `CiliumVersion` is therefore left at its Go zero value, which prints as `0.0.0`. This calls the same two steps `setupAndValidate()` already uses, in the same order, so `CiliumVersion` is populated before it's printed in `connectivity.Run()`. Tested manually against an RKE2 cluster (Cilium v1.19.4): - before the fix, `cilium connectivity perf` reported \"Cilium version: 0.0.0\" - after the fix, it correctly reports \"Cilium version: 1.19.4\" ```release-note Fixed `cilium connectivity perf` always reporting `Cilium version: 0.0.0` instead of the actual detected Cilium version.",
"url": "https://github.com/cilium/cilium/pull/47695",
"createdAt": "2026-08-03T10:04:52Z",
"updatedAt": "2026-08-13T07:54:54Z",
"timestamp": "2026-08-13T07:54:54Z",
"metrics": {
"reactions": 2,
"comments": 8
},
"labels": [
"release-note/bug",
"kind/community-contribution",
"cilium-cli",
"cilium-cli-exclusive"
],
"author": "khaddict",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:8a830d1f2816edd1af63",
"signalId": "github:cilium/cilium:issue:33550",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:issue:33550",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Dependency Dashboard",
"text": "This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more. ## Repository Problems Renovate tried to run on this repository, but found these problems. - β οΈ WARN: Some release(s) did not have a releaseTimestamp, but as we're running with minimumReleaseAgeBehaviour=timestamp-optional, proceeding. See debug logs for more information ## Awaiting Schedule The following updates are awaiting their schedule. To get an update now, click on a checkbox below. - [ ] chore(deps): update docker.io/library/golang:1.26.5 docker digest to 705e964 (main) - [ ] chore(deps): update all lvh-images main (main) (patch) (`quay.io/lvh-images/complexity-test`, `quay.io/lvh-images/kind`) - [ ] chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.3-1786533216-ee4e5780e4c81825b047fe9927c015fd8a74b30f (main) - [ ] fix(deps): update all go dependencies main (main) (`github.com/aws/aws-sdk-go-v2`, `github.com/aws/aws-sdk-go-v2/config`, `github.com/aws/aws-sdk-go-v2/feature/ec2/imds`, `github.com/aws/aws-sdk-go-v2/service/ec2`, `github.com/aws/smithy-go`, `github.com/cilium/charts`, `github.com/go-openapi/runtime`, `github.com/go-openapi/swag`, `github.com/go-openapi/swag/cmdutils`, `github.com/go-openapi/swag/conv`, `github.com/go-openapi/swag/jsonutils`, `github.com/go-openapi/swag/netutils`, `github.com/go-openapi/swag/typeutils`, `github.com/google/cel-go`, `github.com/klauspost/compress`, `github.com/osrg/gobgp/v4`, `github.com/prometheus/client_golang`, `github.com/prometheus/common`, `github.com/vishvananda/netlink`, `go.etcd.io/etcd/api/v3`, `go.etcd.io/etcd/client/pkg/v3`, `go.etcd.io/etcd/client/v3`, `go.opentelemetry.io/otel`, `go.opentelemetry.io/otel/trace`, `go.yaml.in/yaml/v3`, `google.golang.org/grpc`, `k8s.io/api`, `k8s.io/apiextensions-apiserver`, `k8s.io/apimachinery`, `k8s.io/cli-runtime`, `k8s.io/client-go`, `k8s.io/code-generator`, `k8s.io/component-base`, `k8s.io/dynamic-resource-allocation`, `k8s.io/endpointslice`, `k8s.io/kubectl`, `k8s.io/metrics`) - [ ] chore(deps): update docker.io/library/golang:1.26.5 docker digest to 705e964 (v1.20) - [ ] chore(deps): update stable lvh-images (v1.20) (patch) (`quay.io/lvh-images/complexity-test`, `quay.io/lvh-images/kind`) - [ ] chore(deps): update all github action dependencies (v1.20) (`actions/github-script`, `azure/login`, `cert-manager/cert-manager`, `docker/login-action`, `dorny/paths-filter`, `github/codeql-action`, `google/cloud-sdk`) - [ ] chore(deps): update docker.io/library/golang:1.25.12 docker digest to dbeddb5 (v1.19) - [ ] chore(deps): update stable lvh-images (v1.19) (patch) (`quay.io/lvh-images/complexity-test`, `quay.io/lvh-images/kind`) - [ ] chore(deps): update all github action dependencies (v1.19) (`actions/github-script`, `azure/login`, `docker/login-action`, `dorny/paths-filter`, `github/codeql-action`, `google/cloud-sdk`) - [ ] chore(deps): update docker.io/library/golang:1.25.12 docker digest to dbeddb5 (v1.18) - [ ] chore(deps): update stable lvh-images (v1.18) (patch) (`quay.io/lvh-images/complexity-test`, `quay.io/lvh-images/kind`) - [ ] chore(deps): update all github action dependencies (v1.18) (`actions/github-script`, `azure/login`, `dorny/paths-filter`, `google/cloud-sdk`) - [ ] π **Create all awaiting schedule PRs at once** π ## Open The following updates have all been created. To force a retry/rebase of any, click on a checkbox below. - [ ] [chore(deps): update all-dependencies (main)](../pull/47859) (`docker.io/alpine/socat`, `ghcr.io/renovatebot/renovate`, `quay.io/cilium/cilium-llvm`, `quay.io/cilium/test-connection-disruption`, `renovatebot/renovate`) - [ ] [chore(deps): update all github action dependencies (main)](../pull/47861) (`actions/github-script`, `azure/login`, `cert-manager/cert-manager`, `cilium/cilium`, `cilium/scale-tests-action`, `docker/login-action`, `dorny/paths-filter`, `github/codeql-action`, `google/cloud-sdk`, `https://github.com/cilium/scaffolding`, `renovatebot/github-action`) - [ ] [fix(deps): update module github.com/google/go-github/v89 to v90 (main)](../pull/47876) - [ ] **Click on this checkbox to rebase all open PRs at once** ## Detected Dependencies > [!NOTE] > Detected dependencies section has been truncated dockerfile (9)
cilium-cli/Dockerfile (2)
- `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `gcr.io/distroless/static latest@sha256:9197324ba51d9cd071af8505989365c006adf9d6d2067eada25aef00abbb5278` images/builder/Dockerfile (4)
- `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `quay.io/cilium/cilium-llvm 19.1.7-1782898005-bed4da5@sha256:270bf0e70853c388b72c2247e4ade91d35d74898e2ec12edd5b72ace9ee34333` β [Updates: `19.1.7-1785833026-d8383c5`] - `quay.io/cilium/cilium-runtime ddc2a59eaafa0c420b692d9a1e1be333eaccb2f6@sha256:f1fc9168c6491832eb6a175f37a8fdf4102b74311b46d7a1068bf669734cb8d1` - `quay.io/cilium/image-tester 1785710666-8cd4afc@sha256:fc644405b1fc62ffc009c27283307cddc5b210a7d42555b5f525b8285a163fb9` images/cache/Dockerfile (1)
- `docker.io/library/alpine 3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b` images/cilium/Dockerfile (4)
- `quay.io/cilium/cilium-envoy v1.38.3-1786448858-9326c1e0ad17d6449851ec3170611f2a66cb9035@sha256:159aa88485fb01f15397a4adc26be0586eeafe865965cadabedd63bebd445748` β [Updates: `v1.38.3-1786533216-ee4e5780e4c81825b047fe9927c015fd8a74b30f`] - `quay.io/cilium/cilium-builder a91a0712871eca5e96b4f47086ecdb53b1fd5a9f@sha256:1821eef577b7732600aaab3bddc753a4cf37b50d52ebd08b2014dce8076787dc` - `quay.io/cilium/cilium-runtime ddc2a59eaafa0c420b692d9a1e1be333eaccb2f6@sha256:f1fc9168c6491832eb6a175f37a8fdf4102b74311b46d7a1068bf669734cb8d1` - `quay.io/cilium/cilium-builder a91a0712871eca5e96b4f47086ecdb53b1fd5a9f@sha256:1821eef577b7732600aaab3bddc753a4cf37b50d52ebd08b2014dce8076787dc` images/clustermesh-apiserver/Dockerfile (4)
- `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `gcr.io/etcd-development/etcd v3.7.1@sha256:a9983dd6d9283138ab926daa307c6c25623636703ecf5645d5df4d666ce9eba2` - `gcr.io/distroless/static nonroot@sha256:f7f8f729987ad0fdf6b05eeeae94b26e6a0f613bdf46feea7fc40f7bd72953e6` images/hubble-relay/Dockerfile (3)
- `quay.io/cilium/cilium-builder a91a0712871eca5e96b4f47086ecdb53b1fd5a9f@sha256:1821eef577b7732600aaab3bddc753a4cf37b50d52ebd08b2014dce8076787dc` - `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `gcr.io/distroless/static nonroot@sha256:f7f8f729987ad0fdf6b05eeeae94b26e6a0f613bdf46feea7fc40f7bd72953e6` images/operator/Dockerfile (5)
- `quay.io/cilium/cilium-builder a91a0712871eca5e96b4f47086ecdb53b1fd5a9f@sha256:1821eef577b7732600aaab3bddc753a4cf37b50d52ebd08b2014dce8076787dc` - `docker.io/library/alpine 3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b` - `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `scratch unknown version` - `quay.io/cilium/cilium-builder a91a0712871eca5e96b4f47086ecdb53b1fd5a9f@sha256:1821eef577b7732600aaab3bddc753a4cf37b50d52ebd08b2014dce8076787dc` images/runtime/Dockerfile (4)
- `quay.io/cilium/cilium-llvm 19.1.7-1782898005-bed4da5@sha256:270bf0e70853c388b72c2247e4ade91d35d74898e2ec12edd5b72ace9ee34333` β [Updates: `19.1.7-1785833026-d8383c5`] - `quay.io/cilium/cilium-bpftool 7.7.0-1785833026-d8383c5@sha256:5ea5cf5bd61b8a41102b8ce7116fd2ba65993ee7006d86652bdeac428dbf001f` - `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `docker.io/library/ubuntu 26.04@sha256:678c6550cc43645e08669028bc177f50be4e7c5b8cca677067b1914d4afc7a03` images/standalone-dns-proxy/Dockerfile (1)
- `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`]
github-actions (73)
.github/actions/bpftrace/check/action.yaml (1)
- `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` .github/actions/bpftrace/start/action.yaml (2)
- `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` .github/actions/cosign/action.yaml (2)
- `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` .github/actions/gather-metrics/action.yaml (1)
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` .github/actions/get-runner-ip/action.yml (1)
- `actions/github-script v8.0.0@ed597411d8f924073f98dfc5c65a23a2325f34cd` β [Updates: `v9.0.0`] .github/actions/lvh-kind/action.yaml (2)
- `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` .github/actions/merge-artifacts/action.yaml (1)
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` .github/actions/post-logic/action.yaml (4)
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `aanm/junit2md v0.0.3@332ebf0fddd34e91b03a832cfafaa826306558f9` .github/actions/wait-for-images/action.yaml (1)
- `docker/login-action v4.1.0@4907a6ddec9925e35a0a9e82d7399ccc52663121` β [Updates: `v4.6.0`] .github/workflows/ariane-scheduled.yaml (2)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` .github/workflows/auto-approve.yaml (2)
- `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/auto-labeler-v1.18.yaml (6)
- `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/labeler v7@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/auto-labeler-v1.19.yaml (6)
- `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/labeler v7@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/auto-labeler-v1.20.yaml (6)
- `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/labeler v7@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/auto-labeler.yaml (6)
- `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/labeler v7@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-go-caches.yaml (3)
- `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` .github/workflows/build-images-base-v1.17.yaml (22)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-base-v1.18.yaml (19)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` .github/workflows/build-images-base-v1.19.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` .github/workflows/build-images-base-v1.20.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` .github/workflows/build-images-base.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` .github/workflows/build-images-beta.yaml (10)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-ci-v1.17.yaml (19)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-ci-v1.18.yaml (19)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-ci-v1.19.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-ci-v1.20.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-ci.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-docs-builder-v1.17.yaml (17)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-docs-builder-v1.18.yaml (17)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-docs-builder-v1.19.yaml (17)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-docs-builder-v1.20.yaml (17)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-docs-builder.yaml (17)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-releases.yaml (14)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/cilium main` β [Updates: `main`] - `cilium/cilium main` β [Updates: `main`] - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/call-backport-label-updater-v1.17.yaml (1)
- `cilium/cilium v1.19.6@9a8982433e18019e290b8199c0c4ad24f66befe8` β [Updates: `v1.20.0`] .github/workflows/call-backport-label-updater-v1.18.yaml (1)
- `cilium/cilium v1.19.6@9a8982433e18019e290b8199c0c4ad24f66befe8` β [Updates: `v1.20.0`] .github/workflows/call-backport-label-updater-v1.19.yaml (1)
- `cilium/cilium v1.19` β [Updates: `v1.20.0`] .github/workflows/call-backport-label-updater-v1.20.yaml (1)
- `cilium/cilium v1.20` .github/workflows/call-backport-label-updater.yaml (1)
- `cilium/cilium main` β [Updates: `main`] .github/workflows/ci-images-cache-cleaner.yaml (1)
- `ubuntu 24.04` .github/workflows/ci-images-garbage-collect.yaml (3)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `quay.io/cilium/scruffy v0.0.3@sha256:ca997451b739cbf03c204cb2523a671c31c61edc606aa5d20dc3560bc7f25bc7` - `ubuntu 24.04` .github/workflows/cilium-cli.yaml (5)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `ubuntu 24.04` - `go 1.26.5` .github/workflows/close-stale-issues.yaml (2)
- `actions/stale v11@4391f3da665fdf50b6810c1a66712fb9ba21aa93` - `ubuntu 24.04` .github/workflows/codeql.yaml (7)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81` β [Updates: `v4.37.6`] - `github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81` β [Updates: `v4.37.6`] - `github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81` β [Updates: `v4.37.6`] - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81` β [Updates: `v4.37.6`] - `ubuntu 24.04` .github/workflows/common-post-jobs.yaml (6)
- `cilium/cilium main` β [Updates: `main`] - `cilium/cilium main` β [Updates: `main`] - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-aks.yaml (15)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `azure/login v3.0.0@532459ea530d8321f2fb9bb10d1e0bcf23869a43` β [Updates: `v3.0.1`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `azure/login v3.0.0@532459ea530d8321f2fb9bb10d1e0bcf23869a43` β [Updates: `v3.0.1`] - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-aws-cni.yaml (15)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-clustermesh.yaml (9)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` .github/workflows/conformance-delegated-ipam.yaml (10)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-eks.yaml (15)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-gateway-api.yaml (16)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `go 1.26.5` .github/workflows/conformance-ginkgo.yaml (29)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `go 1.26.5` - `ubuntu 24.04` - `ubuntu 24.04` - `go 1.26.5` .github/workflows/conformance-gke.yaml (17)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `google-github-actions/auth v3.0.0@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093` - `google-github-actions/setup-gcloud v3.0.1@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `google-github-actions/auth v3.0.0@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093` - `google-github-actions/setup-gcloud v3.0.1@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-ingress.yaml (13)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-ipsec-e2e.yaml (13)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-ipsec.yaml (5)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-k8s-network-policies.yaml (8)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-kind-proxy-embedded.yaml (9)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-kpr-aks.yaml (5)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-kpr-eks.yaml (7)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-kpr-gke.yaml (5)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-kubespray.yaml (12)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-python v7.0.0@5fda3b95a4ea91299a34e894583c3862153e4b97` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `python 3.10` .github/workflows/conformance-l3-l4.yaml (5)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-l7.yaml (5)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-mcs-api.yaml (13)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `go 1.26.5` .github/workflows/conformance-multi-pool.yaml (13)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-race.yaml (4)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-runtime.yaml (22)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `aanm/junit2md v0.0.3@332ebf0fddd34e91b03a832cfafaa826306558f9` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-ztunnel-e2e.yaml (10)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/documentation.yaml (10)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `dorny/paths-filter v4.0.2@7b450fff21473bca461d4b92ce414b9d0420d706` β [Updates: `v4.0.3`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `quay.io/cilium/docs-builder e6773ed21ab03066c0f24e68f342f18804a8ee0a@sha256:d3beff6d6408c09f6e1dbc637f7e98962b7d1fd2a81bf1d2a27ff8817dafb51f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `go 1.26.5` .github/workflows/eks-cluster-delete.yaml (3)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `ubuntu 24.04` .github/workflows/eks-cluster-pool-manager.yaml (16)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/feature-summary-report.yaml (5)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/fqdn-perf.yaml (19)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `google-github-actions/auth v3.0.0@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093` - `google-github-actions/setup-gcloud v3.0.1@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `go 1.26.5`
cert-manager/cert-manager (cert-manager/cert-manager)
### [`v1.21.1`](https://redirect.github.com/cert-manager/cert-manager/releases/tag/v1.21.1) [Compare Source](https://redirect.github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities. All users should upgrade. #### Changes by Kind ##### Bug or Regression - Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#9038](https://redirect.github.com/cert-manager/cert-manager/issues/9038), [@sklirg](https://redirect.github.com/sklirg)) - Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#9083](https://redirect.github.com/cert-manager/cert-manager/issues/9083), [@SebTardif](https://redirect.github.com/SebTardif)) - Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#9037](https://redirect.github.com/cert-manager/cert-manager/issues/9037), [@wallrj-cyberark](https://redirect.github.com/wallrj-cyberark)) - Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#9012](https://redirect.github.com/cert-manager/cert-manager/issues/9012), [@mateenali66](https://redirect.github.com/mateenali66)) ##### Other (Cleanup or Flake) - Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#9039](https://redirect.github.com/cert-manager/cert-manager/issues/9039), [@wallrj-cyberark](https://redirect.github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#9063](https://redirect.github.com/cert-manager/cert-manager/issues/9063)) - Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#9072](https://redirect.github.com/cert-manager/cert-manager/issues/9072)) - Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#9073](https://redirect.github.com/cert-manager/cert-manager/issues/9073)) - Update distroless base images ([#9000](https://redirect.github.com/cert-manager/cert-manager/issues/9000), [#9025](https://redirect.github.com/cert-manager/cert-manager/issues/9025)) cilium/cilium (cilium/cilium)
### [`v1.20.0`](https://redirect.github.com/cilium/cilium/releases/tag/v1.20.0): 1.20.0 [Compare Source](https://redirect.github.com/cilium/cilium/compare/1.20.0...1.20.0) π **Release Announcement** π: We are excited to announce the [Cilium 1.20.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.20.0) release! More than **2,660 new commits** have landed in this release, supported by a community of over **1,100 contributors** and more than **24,800 GitHub stars**! π€© β οΈ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the `cilium.io/v2alpha1` `CiliumNodeConfig` API, the libnetwork integration, or a custom CNI configuration. See the [Upgrade Guide](https://docs.cilium.io/en/v1.20/operations/upgrade/#upgrade-notes) for details. The full changelog can be found [here](https://redirect.github.com/cilium/cilium/blob/v1.20/CHANGELOG.md). Here are some of the highlights: - β©οΈ **Gateway API** - π **Gateway API v1.6.1**: Cilium moves from Gateway API v1.4 to v1.6.1, bringing support for capabilities that graduated across both upstream releases. ([cilium/cilium#45251](https://redirect.github.com/cilium/cilium/pull/45251), [@youngnick](https://redirect.github.com/youngnick); [cilium/cilium#46827](https://redirect.github.com/cilium/cilium/pull/46827), [cilium/cilium#47274](https://redirect.github.com/cilium/cilium/pull/47274), [@arybolovlev](https://redirect.github.com/arybolovlev)) - π₯ **Delegate Gateway Listeners**: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. ([cilium/cilium#46303](https://redirect.github.com/cilium/cilium/pull/46303), [cilium/cilium#46785](https://redirect.github.com/cilium/cilium/pull/46785), [@asauber](https://redirect.github.com/asauber)) - π **Encrypt Traffic to Backends**: Gateway API `BackendTLSPolicy` support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. ([cilium/cilium#43045](https://redirect.github.com/cilium/cilium/pull/43045), [@youngnick](https://redirect.github.com/youngnick)) - π **TCPRoute and UDPRoute**: Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic. ([cilium/cilium#46184](https://redirect.github.com/cilium/cilium/pull/46184), [cilium/cilium#46970](https://redirect.github.com/cilium/cilium/pull/46970), [@eminaktas](https://redirect.github.com/eminaktas); [cilium/cilium#47381](https://redirect.github.com/cilium/cilium/pull/47381), [@arybolovlev](https://redirect.github.com/arybolovlev)) - π **External Authorization**: HTTPRoute requests can now be authenticated and authorized through an external service before they reach the application, using the Gateway API `ExternalAuth` filter from GEP-1494. ([cilium/cilium#45739](https://redirect.github.com/cilium/cilium/pull/45739), [@gauteoh](https://redirect.github.com/gauteoh)) - ποΈ **More HTTP Traffic Controls**: HTTPRoutes gain native CORS support and additional 303, 307 and 308 redirect codes. `CiliumGatewayClassConfig` can also overwrite, append or preserve the HTTP Server response header. ([cilium/cilium#45924](https://redirect.github.com/cilium/cilium/pull/45924), [@arybolovlev](https://redirect.github.com/arybolovlev); [cilium/cilium#47232](https://redirect.github.com/cilium/cilium/pull/47232), [@youngnick](https://redirect.github.com/youngnick); [cilium/cilium#46764](https://redirect.github.com/cilium/cilium/pull/46764), [@xtineskim](https://redirect.github.com/xtineskim)) - βοΈ **Configurable gRPC-Web Translation**: `CiliumGatewayClassConfig` can disable automatic gRPC-web translation for Gateways that need to pass the original traffic through unchanged. Translation remains enabled by default. ([cilium/cilium#45984](https://redirect.github.com/cilium/cilium/pull/45984), [@thorn3r](https://redirect.github.com/thorn3r)) - π **Networking** - π **Extensible Datapath**: Datapath plugins let cloud providers extend or instrument Cilium's eBPF datapath with independently versioned programs, without maintaining a Cilium fork. ([cilium/cilium#45028](https://redirect.github.com/cilium/cilium/pull/45028), [cilium/cilium#45429](https://redirect.github.com/cilium/cilium/pull/45429), [cilium/cilium#45558](https://redirect.github.com/cilium/cilium/pull/45558), [cilium/cilium#46673](https://redirect.github.com/cilium/cilium/pull/46673), [cilium/cilium#46872](https://redirect.github.com/cilium/cilium/pull/46872), [@jrife](https://redirect.github.com/jrife)) - π **Automatic Netkit Selection**: Set `bpf.datapathMode=auto` to use netkit automatically on supported kernels and fall back to veth on other nodes. The default remains veth. ([cilium/cilium#43062](https://redirect.github.com/cilium/cilium/pull/43062), [@ajmmm](https://redirect.github.com/ajmmm)) - π€ **Egress Gateway Improvements**: Dual-stack clusters can configure an explicit IPv6 egress IP. IPv4 Egress Gateway traffic also strictly honors the interface selected by the policy, matching the existing IPv6 behavior. ([cilium/cilium#44524](https://redirect.github.com/cilium/cilium/pull/44524), [@yykkibbb](https://redirect.github.com/yykkibbb); [cilium/cilium#45833](https://redirect.github.com/cilium/cilium/pull/45833), [@julianwiedmann](https://redirect.github.com/julianwiedmann)) - π **Better BGP Tooling and Reconciliation**: New Hive shell commands expose route policies and clearer peer output formats. The control plane moves to GoBGP v4.6.1 and optimizes route-policy reconciliation. ([cilium/cilium#45628](https://redirect.github.com/cilium/cilium/pull/45628), [cilium/cilium#45534](https://redirect.github.com/cilium/cilium/pull/45534), [@martonra](https://redirect.github.com/martonra); [cilium/cilium#45952](https://redirect.github.com/cilium/cilium/pull/45952), [cilium/cilium#46928](https://redirect.github.com/cilium/cilium/pull/46928), [@rastislavs](https://redirect.github.com/rastislavs)) - π **IPAM and IP Selection** - βοΈ **IPv6 for AWS ENI IPAM (Beta)**: Cilium can now allocate IPv6 prefixes to pods through AWS ENI IPAM, building on the move to the multi-pool allocator. ([cilium/cilium#46756](https://redirect.github.com/cilium/cilium/pull/46756), [cilium/cilium#46619](https://redirect.github.com/cilium/cilium/pull/46619), [@41ks](https://redirect.github.com/41ks); [cilium/cilium#45154](https://redirect.github.com/cilium/cilium/pull/45154), [cilium/cilium#45958](https://redirect.github.com/cilium/cilium/pull/45958), [@HadrienPatte](https://redirect.github.com/HadrienPatte)) - π **Migrate to Multi-Pool IPAM**: Existing clusters can move from cluster-pool IPAM to multi-pool IPAM without being rebuilt. ([cilium/cilium#46104](https://redirect.github.com/cilium/cilium/pull/46104), [@pippolo84](https://redirect.github.com/pippolo84)) - π§ **Dynamic NodePort Source Addresses**: NodePort can use the kernel FIB to select the preferred source address dynamically before SNATing north-south traffic, on supported kernels. ([cilium/cilium#44625](https://redirect.github.com/cilium/cilium/pull/44625), [@ldelossa](https://redirect.github.com/ldelossa)) - π΅ **Prefer IPv6 Consistently**: The new top-level `preferIpv6` option applies to both Cilium health probes and Hubble peer communication when IPv4 and IPv6 are available. ([cilium/cilium#45447](https://redirect.github.com/cilium/cilium/pull/45447), [@tibrezus](https://redirect.github.com/tibrezus)) - πΈοΈ **Services and Cluster Mesh** - π **Topology-Aware Service Traffic**: Cilium's service load balancer now supports the Kubernetes `PreferSameZone` and `PreferSameNode` traffic distribution hints. ([cilium/cilium#44771](https://redirect.github.com/cilium/cilium/pull/44771), [@raphink](https://redirect.github.com/raphink)) - βοΈ **Weighted Maglev Backends**: Maglev now honors the `service.cilium.io/weight` annotation on EndpointSlices. A weight of zero drains new connections while allowing existing connections to continue. ([cilium/cilium#46061](https://redirect.github.com/cilium/cilium/pull/46061), [@mhofstetter](https://redirect.github.com/mhofstetter)) - π **More Load-Balancing Options with VXLAN**: Clusters using VXLAN can use per-Service load-balancing mode annotations, including compatible DSR configurations such as IPIP dispatch. ([cilium/cilium#45600](https://redirect.github.com/cilium/cilium/pull/45600), [@brb](https://redirect.github.com/brb)) - π€ **Stable MCS API Support**: Cilium's implementation of the Kubernetes Multi-Cluster Services API is now stable and recommended for portable service discovery through ClusterMesh. ([cilium/cilium#45404](https://redirect.github.com/cilium/cilium/pull/45404), [cilium/cilium#46953](https://redirect.github.com/cilium/cilium/pull/46953), [@MrFreezeex](https://redirect.github.com/MrFreezeex)) - π **Encryption and Network Policy** - π **Improved Ztunnel Identity Management**: The ztunnel path now supports either an internal certificate authority or SPIRE-issued workload identities, alongside new Prometheus metrics for enrollment and connection health. It transparently encrypts enrolled pod-to-pod connections, including traffic between pods on the same node. ([cilium/cilium#43763](https://redirect.github.com/cilium/cilium/pull/43763), [cilium/cilium#44275](https://redirect.github.com/cilium/cilium/pull/44275), [cilium/cilium#44136](https://redirect.github.com/cilium/cilium/pull/44136), [cilium/cilium#45861](https://redirect.github.com/cilium/cilium/pull/45861), [@nddq](https://redirect.github.com/nddq); [cilium/cilium#45096](https://redirect.github.com/cilium/cilium/pull/45096), [@gokulMSFT](https://redirect.github.com/gokulMSFT)) - π‘οΈ **Kubernetes ClusterNetworkPolicy (KCNP)**: Cilium now supports the upstream, cluster-scoped policy API, including Admin and Baseline policy tiers alongside namespaced Kubernetes NetworkPolicy. ([cilium/cilium#42338](https://redirect.github.com/cilium/cilium/pull/42338), [@TheBeeZee](https://redirect.github.com/TheBeeZee); [cilium/cilium#46253](https://redirect.github.com/cilium/cilium/pull/46253), [@aanm](https://redirect.github.com/aanm)) - β **Friendlier IPv6 Policy Denials**: Cilium can return ICMPv6 Destination Unreachable responses when network policy denies IPv6 egress traffic, matching the IPv4 capability introduced in Cilium 1.19. ([cilium/cilium#44234](https://redirect.github.com/cilium/cilium/pull/44234), [@Andreagit97](https://redirect.github.com/Andreagit97)) - π **Select the Entire Cluster Mesh**: The new `cluster-mesh` policy entity selects every endpoint across a mesh, making cross-cluster security policies easier to express. ([cilium/cilium#46813](https://redirect.github.com/cilium/cilium/pull/46813), [@squeed](https://redirect.github.com/squeed)) - βοΈ **Standardize AWS VPC Group Policies**: Policies that reference AWS VPC groups are now transformed into `CiliumCIDRGroup` resources, bringing external IP groups into the standard Cilium policy model. ([cilium/cilium#44704](https://redirect.github.com/cilium/cilium/pull/44704), [@squeed](https://redirect.github.com/squeed)) - π **Per-Pod Source IP Verification Control**: Trusted workloads that need to send traffic with non-local source addresses can disable source IP verification through a pod annotation, guarded by a namespace-level opt-in. ([cilium/cilium#43505](https://redirect.github.com/cilium/cilium/pull/43505), [@zbb88888](https://redirect.github.com/zbb88888)) - βοΈ **Day 2 Operations and Observability** - π§ **Detect Configuration Drift**: Cilium can expose how many ConfigMap settings an agent has not yet applied, making it easier to identify when a restart is required after a configuration change. ([cilium/cilium#44703](https://redirect.github.com/cilium/cilium/pull/44703), [@PhilipSchmid](https://redirect.github.com/PhilipSchmid)) - β±οΈ **Understand Agent Start-Up Time**: New Hive lifecycle and Kubernetes resource-sync metrics show how long individual resources and components take to initialize. ([cilium/cilium#44802](https://redirect.github.com/cilium/cilium/pull/44802), [cilium/cilium#44639](https://redirect.github.com/cilium/cilium/pull/44639), [@ILL1A](https://redirect.github.com/ILL1A)) - π°οΈ **Correlate More Hubble Verdicts with Policies**: Hubble can now identify the policy responsible for audit verdicts. ([cilium/cilium#45373](https://redirect.github.com/cilium/cilium/pull/45373), [@Rajneesh180](https://redirect.github.com/Rajneesh180)) - π **Standalone DNS Proxy Metrics**: The Standalone DNS Proxy now exports DNS metrics back through Cilium, improving visibility when DNS policy processing runs outside the agent. ([cilium/cilium#45222](https://redirect.github.com/cilium/cilium/pull/45222), [cilium/cilium#44601](https://redirect.github.com/cilium/cilium/pull/44601), [@vipul-21](https://redirect.github.com/vipul-21)) - π
**Performance and Scale** - πΎ **Aggregated Load-Balancer State**: Cilium's internal backend representation has been flattened to efficiently support thousands of Services that share the same backends. ([cilium/cilium#44511](https://redirect.github.com/cilium/cilium/pull/44511), [@joamaki](https://redirect.github.com/joamaki)) - π‘ **More Efficient Envoy Updates**: New ADS and Delta xDS modes provide consistent or incremental delivery of Envoy resources, reducing CPU usage and policy update latency. ([cilium/cilium#43887](https://redirect.github.com/cilium/cilium/pull/43887), [@nezdolik](https://redirect.github.com/nezdolik); [cilium/cilium#45288](https://redirect.github.com/cilium/cilium/pull/45288), [@jrajahalme](https://redirect.github.com/jrajahalme)) - ποΈ **Optimized BPF Policy Map Encoding**: Semantic wildcard identities for remote-node and world reduce BPF policy-map pressure, particularly in larger clusters. ([cilium/cilium#46438](https://redirect.github.com/cilium/cilium/pull/46438), [@squeed](https://redirect.github.com/squeed)) - π¦ **Smaller CNI Binary**: The `cilium-cni` binary has been reduced from roughly 77 MB to 16 MB, shrinking both the Cilium image and its footprint on every node. ([cilium/cilium#45845](https://redirect.github.com/cilium/cilium/pull/45845), [@giorio94](https://redirect.github.com/giorio94)) - π οΈ **Updated Dependencies and Foundations**: Cilium 1.20 updates to Kubernetes v1.36, Envoy v1.37.x, Gateway API v1.6.1, GoBGP v4.6.1 and MCS API v0.5.2. Runtime and builder images now use Ubuntu 26.04, and the default CNI configuration version moves from 0.3.1 to 1.0.0. ([cilium/cilium#45499](https://redirect.github.com/cilium/cilium/pull/45499), [cilium/cilium#47215](https://redirect.github.com/cilium/cilium/pull/47215), [@HadrienPatte](https://redirect.github.com/HadrienPatte); [cilium/cilium#45851](https://redirect.github.com/cilium/cilium/pull/45851), [@sayboras](https://redirect.github.com/sayboras); [cilium/cilium#47274](https://redirect.github.com/cilium/cilium/pull/47274), [@arybolovlev](https://redirect.github.com/arybolovlev); [cilium/cilium#45952](https://redirect.github.com/cilium/cilium/pull/45952), [@rastislavs](https://redirect.github.com/rastislavs); [cilium/cilium#47166](https://redirect.github.com/cilium/cilium/pull/47166), [@MrFreezeex](https://redirect.github.com/MrFreezeex); [cilium/cilium#46971](https://redirect.github.com/cilium/cilium/pull/46971), [@gandro](https://redirect.github.com/gandro)) - π **Community** - β€οΈ **Production Case Studies**: Many end-users have told their stories running Cilium in production. Read and watch more from: [Asana](https://www.youtube.com/watch?v=mxjiSCnrb3c), [Etraveli](https://www.youtube.com/watch?v=KWS-NaZd62M\\&list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ\\&index=7), [Michelin](https://www.cncf.io/case-studies/michelin-2/), [OpenAI](https://isovalent.com/blog/post/openai-isovalent-networking-kubernetes-case-study/), [Suse](https://www.youtube.com/watch?v=bgCg1tS72ME\\&list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ\\&index=8), [TelefΓ³nica's acens](https://blogs.cisco.com/sp/telefonicas-acens-and-cisco-driving-the-next-generation-of-cloud-native-services-with-isovalent), and [Zynga](https://www.cncf.io/case-studies/zynga/). If your company wants to submit their case studies let us know. We would love to hear your feedback! - π³π± **Amsterdam Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and [Cilium Developer Summit](https://redirect.github.com/cilium/dev-summits/tree/main/2026-EU) in Amsterdam. [Watch the talks](https://www.youtube.com/playlist?list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ) from CiliumCon. - πΊπΈ **Salt Lake City Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developer Summit at KubeCon + CloudNativeCon North America in Salt Lake City, November 9-12. - π€ **Generative AI Policy**: The Cilium community adopted a [Generative AI Policy](https://redirect.github.com/cilium/community/blob/main/AI-POLICY.md) that encourages community members to connect and communicate with one another without the use of AI, while recognizing that different people work best with their own tools of choice. - π **Cilium Books**: Two new books landed for readers at every level β *[Cilium: Up and Running](https://isovalent.com/books/cilium-up-and-running/)* (O'Reilly), a practitioner's deep dive and *[Buzzing Beyond Clouds: The Illustrated Children's Guide to Cilium](https://isovalent.com/books/children-guide-to-cilium/)*, the follow-up to the eBPF children's guide. β€οΈ **Thank You**: Cilium 1.20 was made possible by contributors, reviewers and maintainers from across the community, including engineers from Datadog, Google, Microsoft and many other organizations. To keep up to date with all the latest Cilium releases, join #release π ##### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93` `quay.io/cilium/cilium:stable@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.0@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92` `quay.io/cilium/clustermesh-apiserver:stable@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.0@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94` `quay.io/cilium/hubble-relay:stable@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.0@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9` `quay.io/cilium/operator-alibabacloud:stable@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.0@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa` `quay.io/cilium/operator-aws:stable@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.0@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c` `quay.io/cilium/operator-azure:stable@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.0@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3` `quay.io/cilium/operator-generic:stable@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3` ##### operator `quay.io/cilium/operator:v1.20.0@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c` `quay.io/cilium/operator:stable@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c` ### [`v1.20.0`](https://redirect.github.com/cilium/cilium/releases/tag/v1.20.0): 1.20.0 [Compare Source](https://redirect.github.com/cilium/cilium/compare/1.19.6...1.20.0) π **Release Announcement** π: We are excited to announce the [Cilium 1.20.0](https://redirect.github.com/cilium/cilium/releases/tag/v1.20.0) release! More than **2,660 new commits** have landed in this release, supported by a community of over **1,100 contributors** and more than **24,800 GitHub stars**! π€© β οΈ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the `cilium.io/v2alpha1` `CiliumNodeConfig` API, the libnetwork integration, or a custom CNI configuration. See the [Upgrade Guide](https://docs.cilium.io/en/v1.20/operations/upgrade/#upgrade-notes) for details. The full changelog can be found [here](https://redirect.github.com/cilium/cilium/blob/v1.20/CHANGELOG.md). Here are some of the highlights: - β©οΈ **Gateway API** - π **Gateway API v1.6.1**: Cilium moves from Gateway API v1.4 to v1.6.1, bringing support for capabilities that graduated across both upstream releases. ([cilium/cilium#45251](https://redirect.github.com/cilium/cilium/pull/45251), [@youngnick](https://redirect.github.com/youngnick); [cilium/cilium#46827](https://redirect.github.com/cilium/cilium/pull/46827), [cilium/cilium#47274](https://redirect.github.com/cilium/cilium/pull/47274), [@arybolovlev](https://redirect.github.com/arybolovlev)) - π₯ **Delegate Gateway Listeners**: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. ([cilium/cilium#46303](https://redirect.github.com/cilium/cilium/pull/46303), [cilium/cilium#46785](https://redirect.github.com/cilium/cilium/pull/46785), [@asauber](https://redirect.github.com/asauber)) - π **Encrypt Traffic to Backends**: Gateway API `BackendTLSPolicy` support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. ([cilium/cilium#43045](https://redirect.github.com/cilium/cilium/pull/43045), [@youngnick](https://redirect.github.com/youngnick)) - π **TCPRoute and UDPRoute**: Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic. ([cilium/cilium#46184](https://redirect.github.com/cilium/cilium/pull/46184), [cilium/cilium#46970](https://redirect.github.com/cilium/cilium/pull/46970), [@eminaktas](https://redirect.github.com/eminaktas); [cilium/cilium#47381](https://redirect.github.com/cilium/cilium/pull/47381), [@arybolovlev](https://redirect.github.com/arybolovlev)) - π **External Authorization**: HTTPRoute requests can now be authenticated and authorized through an external service before they reach the application, using the Gateway API `ExternalAuth` filter from GEP-1494. ([cilium/cilium#45739](https://redirect.github.com/cilium/cilium/pull/45739), [@gauteoh](https://redirect.github.com/gauteoh)) - ποΈ **More HTTP Traffic Controls**: HTTPRoutes gain native CORS support and additional 303, 307 and 308 redirect codes. `CiliumGatewayClassConfig` can also overwrite, append or preserve the HTTP Server response header. ([cilium/cilium#45924](https://redirect.github.com/cilium/cilium/pull/45924), [@arybolovlev](https://redirect.github.com/arybolovlev); [cilium/cilium#47232](https://redirect.github.com/cilium/cilium/pull/47232), [@youngnick](https://redirect.github.com/youngnick); [cilium/cilium#46764](https://redirect.github.com/cilium/cilium/pull/46764), [@xtineskim](https://redirect.github.com/xtineskim)) - βοΈ **Configurable gRPC-Web Translation**: `CiliumGatewayClassConfig` can disable automatic gRPC-web translation for Gateways that need to pass the original traffic through unchanged. Translation remains enabled by default. ([cilium/cilium#45984](https://redirect.github.com/cilium/cilium/pull/45984), [@thorn3r](https://redirect.github.com/thorn3r)) - π **Networking** - π **Extensible Datapath**: Datapath plugins let cloud providers extend or instrument Cilium's eBPF datapath with independently versioned programs, without maintaining a Cilium fork. ([cilium/cilium#45028](https://redirect.github.com/cilium/cilium/pull/45028), [cilium/cilium#45429](https://redirect.github.com/cilium/cilium/pull/45429), [cilium/cilium#45558](https://redirect.github.com/cilium/cilium/pull/45558), [cilium/cilium#46673](https://redirect.github.com/cilium/cilium/pull/46673), [cilium/cilium#46872](https://redirect.github.com/cilium/cilium/pull/46872), [@jrife](https://redirect.github.com/jrife)) - π **Automatic Netkit Selection**: Set `bpf.datapathMode=auto` to use netkit automatically on supported kernels and fall back to veth on other nodes. The default remains veth. ([cilium/cilium#43062](https://redirect.github.com/cilium/cilium/pull/43062), [@ajmmm](https://redirect.github.com/ajmmm)) - π€ **Egress Gateway Improvements**: Dual-stack clusters can configure an explicit IPv6 egress IP. IPv4 Egress Gateway traffic also strictly honors the interface selected by the policy, matching the existing IPv6 behavior. ([cilium/cilium#44524](https://redirect.github.com/cilium/cilium/pull/44524), [@yykkibbb](https://redirect.github.com/yykkibbb); [cilium/cilium#45833](https://redirect.github.com/cilium/cilium/pull/45833), [@julianwiedmann](https://redirect.github.com/julianwiedmann)) - π **Better BGP Tooling and Reconciliation**: New Hive shell commands expose route policies and clearer peer output formats. The control plane moves to GoBGP v4.6.1 and optimizes route-policy reconciliation. ([cilium/cilium#45628](https://redirect.github.com/cilium/cilium/pull/45628), [cilium/cilium#45534](https://redirect.github.com/cilium/cilium/pull/45534), [@martonra](https://redirect.github.com/martonra); [cilium/cilium#45952](https://redirect.github.com/cilium/cilium/pull/45952), [cilium/cilium#46928](https://redirect.github.com/cilium/cilium/pull/46928), [@rastislavs](https://redirect.github.com/rastislavs)) - π **IPAM and IP Selection** - βοΈ **IPv6 for AWS ENI IPAM (Beta)**: Cilium can now allocate IPv6 prefixes to pods through AWS ENI IPAM, building on the move to the multi-pool allocator. ([cilium/cilium#46756](https://redirect.github.com/cilium/cilium/pull/46756), [cilium/cilium#46619](https://redirect.github.com/cilium/cilium/pull/46619), [@41ks](https://redirect.github.com/41ks); [cilium/cilium#45154](https://redirect.github.com/cilium/cilium/pull/45154), [cilium/cilium#45958](https://redirect.github.com/cilium/cilium/pull/45958), [@HadrienPatte](https://redirect.github.com/HadrienPatte)) - π **Migrate to Multi-Pool IPAM**: Existing clusters can move from cluster-pool IPAM to multi-pool IPAM without being rebuilt. ([cilium/cilium#46104](https://redirect.github.com/cilium/cilium/pull/46104), [@pippolo84](https://redirect.github.com/pippolo84)) - π§ **Dynamic NodePort Source Addresses**: NodePort can use the kernel FIB to select the preferred source address dynamically before SNATing north-south traffic, on supported kernels. ([cilium/cilium#44625](https://redirect.github.com/cilium/cilium/pull/44625), [@ldelossa](https://redirect.github.com/ldelossa)) - π΅ **Prefer IPv6 Consistently**: The new top-level `preferIpv6` option applies to both Cilium health probes and Hubble peer communication when IPv4 and IPv6 are available. ([cilium/cilium#45447](https://redirect.github.com/cilium/cilium/pull/45447), [@tibrezus](https://redirect.github.com/tibrezus)) - πΈοΈ **Services and Cluster Mesh** - π **Topology-Aware Service Traffic**: Cilium's service load balancer now supports the Kubernetes `PreferSameZone` and `PreferSameNode` traffic distribution hints. ([cilium/cilium#44771](https://redirect.github.com/cilium/cilium/pull/44771), [@raphink](https://redirect.github.com/raphink)) - βοΈ **Weighted Maglev Backends**: Maglev now honors the `service.cilium.io/weight` annotation on EndpointSlices. A weight of zero drains new connections while allowing existing connections to continue. ([cilium/cilium#46061](https://redirect.github.com/cilium/cilium/pull/46061), [@mhofstetter](https://redirect.github.com/mhofstetter)) - π **More Load-Balancing Options with VXLAN**: Clusters using VXLAN can use per-Service load-balancing mode annotations, including compatible DSR configurations such as IPIP dispatch. ([cilium/cilium#45600](https://redirect.github.com/cilium/cilium/pull/45600), [@brb](https://redirect.github.com/brb)) - π€ **Stable MCS API Support**: Cilium's implementation of the Kubernetes Multi-Cluster Services API is now stable and recommended for portable service discovery through ClusterMesh. ([cilium/cilium#45404](https://redirect.github.com/cilium/cilium/pull/45404), [cilium/cilium#46953](https://redirect.github.com/cilium/cilium/pull/46953), [@MrFreezeex](https://redirect.github.com/MrFreezeex)) - π **Encryption and Network Policy** - π **Improved Ztunnel Identity Management**: The ztunnel path now supports either an internal certificate authority or SPIRE-issued workload identities, alongside new Prometheus metrics for enrollment and connection health. It transparently encrypts enrolled pod-to-pod connections, including traffic between pods on the same node. ([cilium/cilium#43763](https://redirect.github.com/cilium/cilium/pull/43763), [cilium/cilium#44275](https://redirect.github.com/cilium/cilium/pull/44275), [cilium/cilium#44136](https://redirect.github.com/cilium/cilium/pull/44136), [cilium/cilium#45861](https://redirect.github.com/cilium/cilium/pull/45861), [@nddq](https://redirect.github.com/nddq); [cilium/cilium#45096](https://redirect.github.com/cilium/cilium/pull/45096), [@gokulMSFT](https://redirect.github.com/gokulMSFT)) - π‘οΈ **Kubernetes ClusterNetworkPolicy (KCNP)**: Cilium now supports the upstream, cluster-scoped policy API, including Admin and Baseline policy tiers alongside namespaced Kubernetes NetworkPolicy. ([cilium/cilium#42338](https://redirect.github.com/cilium/cilium/pull/42338), [@TheBeeZee](https://redirect.github.com/TheBeeZee); [cilium/cilium#46253](https://redirect.github.com/cilium/cilium/pull/46253), [@aanm](https://redirect.github.com/aanm)) - β **Friendlier IPv6 Policy Denials**: Cilium can return ICMPv6 Destination Unreachable responses when network policy denies IPv6 egress traffic, matching the IPv4 capability introduced in Cilium 1.19. ([cilium/cilium#44234](https://redirect.github.com/cilium/cilium/pull/44234), [@Andreagit97](https://redirect.github.com/Andreagit97)) - π **Select the Entire Cluster Mesh**: The new `cluster-mesh` policy entity selects every endpoint across a mesh, making cross-cluster security policies easier to express. ([cilium/cilium#46813](https://redirect.github.com/cilium/cilium/pull/46813), [@squeed](https://redirect.github.com/squeed)) - βοΈ **Standardize AWS VPC Group Policies**: Policies that reference AWS VPC groups are now transformed into `CiliumCIDRGroup` resources, bringing external IP groups into the standard Cilium policy model. ([cilium/cilium#44704](https://redirect.github.com/cilium/cilium/pull/44704), [@squeed](https://redirect.github.com/squeed)) - π **Per-Pod Source IP Verification Control**: Trusted workloads that need to send traffic with non-local source addresses can disable source IP verification through a pod annotation, guarded by a namespace-level opt-in. ([cilium/cilium#43505](https://redirect.github.com/cilium/cilium/pull/43505), [@zbb88888](https://redirect.github.com/zbb88888)) - βοΈ **Day 2 Operations and Observability** - π§ **Detect Configuration Drift**: Cilium can expose how many ConfigMap settings an agent has not yet applied, making it easier to identify when a restart is required after a configuration change. ([cilium/cilium#44703](https://redirect.github.com/cilium/cilium/pull/44703), [@PhilipSchmid](https://redirect.github.com/PhilipSchmid)) - β±οΈ **Understand Agent Start-Up Time**: New Hive lifecycle and Kubernetes resource-sync metrics show how long individual resources and components take to initialize. ([cilium/cilium#44802](https://redirect.github.com/cilium/cilium/pull/44802), [cilium/cilium#44639](https://redirect.github.com/cilium/cilium/pull/44639), [@ILL1A](https://redirect.github.com/ILL1A)) - π°οΈ **Correlate More Hubble Verdicts with Policies**: Hubble can now identify the policy responsible for audit verdicts. ([cilium/cilium#45373](https://redirect.github.com/cilium/cilium/pull/45373), [@Rajneesh180](https://redirect.github.com/Rajneesh180)) - π **Standalone DNS Proxy Metrics**: The Standalone DNS Proxy now exports DNS metrics back through Cilium, improving visibility when DNS policy processing runs outside the agent. ([cilium/cilium#45222](https://redirect.github.com/cilium/cilium/pull/45222), [cilium/cilium#44601](https://redirect.github.com/cilium/cilium/pull/44601), [@vipul-21](https://redirect.github.com/vipul-21)) - π
**Performance and Scale** - πΎ **Aggregated Load-Balancer State**: Cilium's internal backend representation has been flattened to efficiently support thousands of Services that share the same backends. ([cilium/cilium#44511](https://redirect.github.com/cilium/cilium/pull/44511), [@joamaki](https://redirect.github.com/joamaki)) - π‘ **More Efficient Envoy Updates**: New ADS and Delta xDS modes provide consistent or incremental delivery of Envoy resources, reducing CPU usage and policy update latency. ([cilium/cilium#43887](https://redirect.github.com/cilium/cilium/pull/43887), [@nezdolik](https://redirect.github.com/nezdolik); [cilium/cilium#45288](https://redirect.github.com/cilium/cilium/pull/45288), [@jrajahalme](https://redirect.github.com/jrajahalme)) - ποΈ **Optimized BPF Policy Map Encoding**: Semantic wildcard identities for remote-node and world reduce BPF policy-map pressure, particularly in larger clusters. ([cilium/cilium#46438](https://redirect.github.com/cilium/cilium/pull/46438), [@squeed](https://redirect.github.com/squeed)) - π¦ **Smaller CNI Binary**: The `cilium-cni` binary has been reduced from roughly 77 MB to 16 MB, shrinking both the Cilium image and its footprint on every node. ([cilium/cilium#45845](https://redirect.github.com/cilium/cilium/pull/45845), [@giorio94](https://redirect.github.com/giorio94)) - π οΈ **Updated Dependencies and Foundations**: Cilium 1.20 updates to Kubernetes v1.36, Envoy v1.37.x, Gateway API v1.6.1, GoBGP v4.6.1 and MCS API v0.5.2. Runtime and builder images now use Ubuntu 26.04, and the default CNI configuration version moves from 0.3.1 to 1.0.0. ([cilium/cilium#45499](https://redirect.github.com/cilium/cilium/pull/45499), [cilium/cilium#47215](https://redirect.github.com/cilium/cilium/pull/47215), [@HadrienPatte](https://redirect.github.com/HadrienPatte); [cilium/cilium#45851](https://redirect.github.com/cilium/cilium/pull/45851), [@sayboras](https://redirect.github.com/sayboras); [cilium/cilium#47274](https://redirect.github.com/cilium/cilium/pull/47274), [@arybolovlev](https://redirect.github.com/arybolovlev); [cilium/cilium#45952](https://redirect.github.com/cilium/cilium/pull/45952), [@rastislavs](https://redirect.github.com/rastislavs); [cilium/cilium#47166](https://redirect.github.com/cilium/cilium/pull/47166), [@MrFreezeex](https://redirect.github.com/MrFreezeex); [cilium/cilium#46971](https://redirect.github.com/cilium/cilium/pull/46971), [@gandro](https://redirect.github.com/gandro)) - π **Community** - β€οΈ **Production Case Studies**: Many end-users have told their stories running Cilium in production. Read and watch more from: [Asana](https://www.youtube.com/watch?v=mxjiSCnrb3c), [Etraveli](https://www.youtube.com/watch?v=KWS-NaZd62M\\&list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ\\&index=7), [Michelin](https://www.cncf.io/case-studies/michelin-2/), [OpenAI](https://isovalent.com/blog/post/openai-isovalent-networking-kubernetes-case-study/), [Suse](https://www.youtube.com/watch?v=bgCg1tS72ME\\&list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ\\&index=8), [TelefΓ³nica's acens](https://blogs.cisco.com/sp/telefonicas-acens-and-cisco-driving-the-next-generation-of-cloud-native-services-with-isovalent), and [Zynga](https://www.cncf.io/case-studies/zynga/). If your company wants to submit their case studies let us know. We would love to hear your feedback! - π³π± **Amsterdam Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and [Cilium Developer Summit](https://redirect.github.com/cilium/dev-summits/tree/main/2026-EU) in Amsterdam. [Watch the talks](https://www.youtube.com/playlist?list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ) from CiliumCon. - πΊπΈ **Salt Lake City Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developer Summit at KubeCon + CloudNativeCon North America in Salt Lake City, November 9-12. - π€ **Generative AI Policy**: The Cilium community adopted a [Generative AI Policy](https://redirect.github.com/cilium/community/blob/main/AI-POLICY.md) that encourages community members to connect and communicate with one another without the use of AI, while recognizing that different people work best with their own tools of choice. - π **Cilium Books**: Two new books landed for readers at every level β *[Cilium: Up and Running](https://isovalent.com/books/cilium-up-and-running/)* (O'Reilly), a practitioner's deep dive and *[Buzzing Beyond Clouds: The Illustrated Children's Guide to Cilium](https://isovalent.com/books/children-guide-to-cilium/)*, the follow-up to the eBPF children's guide. β€οΈ **Thank You**: Cilium 1.20 was made possible by contributors, reviewers and maintainers from across the community, including engineers from Datadog, Google, Microsoft and many other organizations. To keep up to date with all the latest Cilium releases, join #release π ##### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93` `quay.io/cilium/cilium:stable@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.0@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92` `quay.io/cilium/clustermesh-apiserver:stable@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.0@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94` `quay.io/cilium/hubble-relay:stable@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.0@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9` `quay.io/cilium/operator-alibabacloud:stable@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.0@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa` `quay.io/cilium/operator-aws:stable@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.0@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c` `quay.io/cilium/operator-azure:stable@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.0@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3` `quay.io/cilium/operator-generic:stable@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3` ##### operator `quay.io/cilium/operator:v1.20.0@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c` `quay.io/cilium/operator:stable@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c` docker/login-action (docker/login-action)
### [`v4.6.0`](https://redirect.github.com/docker/login-action/releases/tag/v4.6.0) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.5.2...v4.6.0) - Harden buildx scoped config path handling by [@crazy-max](https://redirect.github.com/crazy-max) in [#1059](https://redirect.github.com/docker/login-action/pull/1059) - Bump [@aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) and [@aws-sdk/client-ecr-public](https://redirect.github.com/aws-sdk/client-ecr-public) to 3.1095.0 in [#1051](https://redirect.github.com/docker/login-action/pull/1051) - Bump js-yaml from 5.2.1 to 5.2.2 in [#1057](https://redirect.github.com/docker/login-action/pull/1057) - Bump postcss from 8.5.10 to 8.5.22 in [#1056](https://redirect.github.com/docker/login-action/pull/1056) **Full Changelog**: github/codeql-action (github/codeql-action)
### [`v4.37.5`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.5) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.4...v4.37.5) - Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://redirect.github.com/github/codeql-action/pull/4061) ### [`v4.37.4`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.4) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.3...v4.37.4) - This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://redirect.github.com/github/codeql-action/pull/4037) - Update default CodeQL bundle version to [2.26.2](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://redirect.github.com/github/codeql-action/pull/4051) renovatebot/github-action (renovatebot/github-action)
### [`v46.2.1`](https://redirect.github.com/renovatebot/github-action/releases/tag/v46.2.1) [Compare Source](https://redirect.github.com/renovatebot/github-action/compare/v46.2.0...v46.2.1) ##### Documentation - update references to renovatebot/github-action to v46.2.0 ([b48aa6c](https://redirect.github.com/renovatebot/github-action/commit/b48aa6c21875ffa00dc6215bc4453262b81eaf73)) ##### Miscellaneous Chores - **deps:** update dependency globals to v17.8.0 ([3e46bd7](https://redirect.github.com/renovatebot/github-action/commit/3e46bd72790497e1894cc90581626a83e91932c3)) - **deps:** update dependency lint-staged to v17.2.0 ([9c685f2](https://redirect.github.com/renovatebot/github-action/commit/9c685f2a9881f67e357e60b4b46e30576efcb139)) - **deps:** update node.js to v24.18.1 ([f525256](https://redirect.github.com/renovatebot/github-action/commit/f52525626d00279a6ce548e44d82c015c2be2f79)) ##### Build System - **deps:** lock file maintenance ([3d8211a](https://redirect.github.com/renovatebot/github-action/commit/3d8211a3c37e5b20e4d27ece75eadc95d43356c7)) ##### Continuous Integration - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.0.1 ([d471d52](https://redirect.github.com/renovatebot/github-action/commit/d471d52edecc92151b1deffeb3d01a4b80b59fa1)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.2.1 ([5cb64df](https://redirect.github.com/renovatebot/github-action/commit/5cb64df2a3bfd25b911705834f55758002b90753)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.2.2 ([a6b5808](https://redirect.github.com/renovatebot/github-action/commit/a6b5808d7b51494262c60fa1689b3d8f4a816e4e)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.2.3 ([ab4d1eb](https://redirect.github.com/renovatebot/github-action/commit/ab4d1eb1a432926c1bf6b4255c01787ae00df16c)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.3.0 ([a427843](https://redirect.github.com/renovatebot/github-action/commit/a427843f2d41af326ec66d7506b1a2513b511af9)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.3.3 ([2ac8329](https://redirect.github.com/renovatebot/github-action/commit/2ac8329d950b26e8aa6f8ee6b1b686b3babd64a2)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.4.0 ([7665449](https://redirect.github.com/renovatebot/github-action/commit/7665449ea26ebce5a6c734bda989ec3b42849d71)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.4.2 ([0166c9f](https://redirect.github.com/renovatebot/github-action/commit/0166c9f78c5ec89ce686465bc5442d5dbdee3940)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.4.3 ([8662b55](https://redirect.github.com/renovatebot/github-action/commit/8662b55bbc8cf88000457c38636441458d358c33)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.4.5 ([1e71262](https://redirect.github.com/renovatebot/github-action/commit/1e71262fc6711a19c74ce965b485f4aa64bde81d)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.4.6 ([7bec40c](https://redirect.github.com/renovatebot/github-action/commit/7bec40cad622ea16aab5758dee8ab4ba5d2ab9fa)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.5.0 ([d146e8b](https://redirect.github.com/renovatebot/github-action/commit/d146e8b14e30ae18a8c05b8db970466d7882c240)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.5.1 ([ddd5dca](https://redirect.github.com/renovatebot/github-action/commit/ddd5dcaccd40a1bc93ec009e31caefb2c82aea61)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.5.2 ([0731dab](https://redirect.github.com/renovatebot/github-action/commit/0731dab41dcfb74c0fe073fbe697d39b35602e53)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.5.3 ([700f3b5](https://redirect.github.com/renovatebot/github-action/commit/700f3b59b9d0fc6dffce45b564ee1f58869973b1)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.6.0 ([7edb80e](https://redirect.github.com/renovatebot/github-action/commit/7edb80eba67c17f75cebdf7b4259f1902b75032e)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.7.0 ([127e8ef](https://redirect.github.com/renovatebot/github-action/commit/127e8ef2a0d7b2fdd66445b332d46a93fe1310b3)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.7.1 ([f7532d1](https://redirect.github.com/renovatebot/github-action/commit/f7532d19871b25335df440d8029eba8f9c5e41f0)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v44.7.2 ([0fcd35b](https://redirect.github.com/renovatebot/github-action/commit/0fcd35be09a6f0873d63680d8123a868788a1245)) - **deps:** update ghcr.io/zizmorcore/zizmor docker tag to v1.29.0 ([#1068](https://redirect.github.com/renovatebot/github-action/issues/1068)) ([581f6ac](https://redirect.github.com/renovatebot/github-action/commit/581f6ac0a630038ab49d600de079abcbcee26c06)) - **deps:** update zizmorcore/zizmor-action action to v0.6.2 ([e36e81c](https://redirect.github.com/renovatebot/github-action/commit/e36e81c4ca010c6d7f888593b62de0cf6c2b0162)) ### [`v46.2.0`](https://redirect.github.com/renovatebot/github-action/releases/tag/v46.2.0) [Compare Source](https://redirect.github.com/renovatebot/github-action/compare/v46.1.21...v46.2.0) ##### Features - **deps:** Update ghcr.io/renovatebot/renovate Docker tag to v44 ([#1067](https://redirect.github.com/renovatebot/github-action/issues/1067)) ([efa6654](https://redirect.github.com/renovatebot/github-action/commit/efa66542b141f41a69921c360bd114828dede0d3)) ##### Documentation - update references to renovatebot/github-action to v46.1.21 ([66c62f6](https://redirect.github.com/renovatebot/github-action/commit/66c62f63f2c3421614d095425958eedf3cc04d5e)) ##### Miscellaneous Chores - **deps:** update dependency lint-staged to v17.1.1 ([403000c](https://redirect.github.com/renovatebot/github-action/commit/403000c150cbd7d4db2cb878ab66aa42ac6334cb)) - **deps:** update dependency prettier to v3.9.6 ([6787cf2](https://redirect.github.com/renovatebot/github-action/commit/6787cf234f64324b859ccc5e114502d2874c3132)) - **deps:** update dependency typescript-eslint to v8.65.0 ([656e12f](https://redirect.github.com/renovatebot/github-action/commit/656e12f088834d925552fc033316416ff08e0c64)) ##### Continuous Integration - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.283.0 ([560e916](https://redirect.github.com/renovatebot/github-action/commit/560e916d9c7cce71747db50c8a0bcc0afe51a1e0)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.284.0 ([92c373e](https://redirect.github.com/renovatebot/github-action/commit/92c373e9b7513cd0f5df722cb31278ca5ba5ed90)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.284.1 ([b0f9fee](https://redirect.github.com/renovatebot/github-action/commit/b0f9fee8f9e958e395896a25fb03ca676a70d1e2)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.285.0 ([bfb9d5d](https://redirect.github.com/renovatebot/github-action/commit/bfb9d5d946fb4cdf47c1cdd6ac1c862f594e9682)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.285.3 ([91ba9dc](https://redirect.github.com/renovatebot/github-action/commit/91ba9dcb5bb72c71271fc26c63091ef4cba219f9)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.285.4 ([e41061b](https://redirect.github.com/renovatebot/github-action/commit/e41061becfb2ab7ec537b00b7d7551fd58ed22f9)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.285.6 ([e8a7a1c](https://redirect.github.com/renovatebot/github-action/commit/e8a7a1cf58613503b896d69e0c35d616370b51d3)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.285.7 ([7a22a55](https://redirect.github.com/renovatebot/github-action/commit/7a22a554ffad16018e2fa2f53d38091ba9178177)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.286.0 ([7590e1e](https://redirect.github.com/renovatebot/github-action/commit/7590e1eb8e006917e8b8a312ab6f6c254bb796fd)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.286.1 ([cae6616](https://redirect.github.com/renovatebot/github-action/commit/cae6616a21e987edd1928b477910d377d07f3c45)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.287.0 ([#1066](https://redirect.github.com/renovatebot/github-action/issues/1066)) ([4f87158](https://redirect.github.com/renovatebot/github-action/commit/4f871588a5a0fc837cf0be6ffbad04c212656b37)) --- ### Configuration π
**Schedule**: (UTC) - Branch creation - \"on sunday\" - Automerge - At any time (no schedule defined) π¦ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β» **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. π» **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). ",
"url": "https://github.com/cilium/cilium/pull/47861",
"createdAt": "2026-08-09T00:42:34Z",
"updatedAt": "2026-08-12T23:25:01Z",
"timestamp": "2026-08-12T23:25:01Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"kind/enhancement",
"release-note/misc",
"kind/community-contribution",
"renovate/stop-updating",
"area/renovate"
],
"author": "cilium-renovate[bot]",
"state": "open",
"assignees": [
"joestringer"
],
"change": "updated"
}
},
{
"id": "event:7d3d471281500d99ff0a",
"signalId": "github:cilium/cilium:pull_request:47859",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47859",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "chore(deps): update all-dependencies (main)",
"text": "This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | docker.io/alpine/socat | | digest | `e7b1771` β `68b28fe` | | | [ghcr.io/renovatebot/renovate](https://renovatebot.com) ([source](https://redirect.github.com/renovatebot/renovate)) | | minor | [`44.11.4` β `44.24.3`](https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from=44.11.4&to=44.24.3) | | | quay.io/cilium/cilium-llvm | stage | patch | `19.1.7-1782898005-bed4da5` β `19.1.7-1785833026-d8383c5` | | | quay.io/cilium/test-connection-disruption | | patch | `v0.0.17` β `v0.0.18` | | | [renovatebot/renovate](https://redirect.github.com/renovatebot/renovate) | | minor | [`44.7.0` β `44.14.3`](https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from=44.7.0&to=44.14.3) | `44.24.3` (+31) | --- ### Release Notes renovatebot/renovate (ghcr.io/renovatebot/renovate)
### [`v44.24.3`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.24.3) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.24.2...44.24.3) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.84.3 (main) ([#45233](https://redirect.github.com/renovatebot/renovate/issues/45233)) ([8a6d27d](https://redirect.github.com/renovatebot/renovate/commit/8a6d27d78842d8335aebc516fd41b3a67d7275ad)) ##### Miscellaneous Chores - **deps:** update dependency [@containerbase/semantic-release-pnpm](https://redirect.github.com/containerbase/semantic-release-pnpm) to v1.4.3 (main) ([#45232](https://redirect.github.com/renovatebot/renovate/issues/45232)) ([923cc3f](https://redirect.github.com/renovatebot/renovate/commit/923cc3ffcaf7107b6aaf24105ec47ca2ab1b6659)) ### [`v44.24.2`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.24.2) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.24.1...44.24.2) ##### Bug Fixes - **terraform:** deduplicate provider lockfile hashes ([#45226](https://redirect.github.com/renovatebot/renovate/issues/45226)) ([2869cd3](https://redirect.github.com/renovatebot/renovate/commit/2869cd3a8bfc1673a4be784453bd677a515811c4)) ### [`v44.24.1`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.24.1) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.24.0...44.24.1) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.84.2 (main) ([#45223](https://redirect.github.com/renovatebot/renovate/issues/45223)) ([bbda046](https://redirect.github.com/renovatebot/renovate/commit/bbda04606c0254755c112008b2fa510fd9be3d24)) ##### Miscellaneous Chores - **deps:** update dependency [@biomejs/biome](https://redirect.github.com/biomejs/biome) to v2.5.7 (main) ([#45225](https://redirect.github.com/renovatebot/renovate/issues/45225)) ([e8568a2](https://redirect.github.com/renovatebot/renovate/commit/e8568a2611895ec34e6ac08f0d52dfc5190703ba)) ### [`v44.24.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.24.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.23.3...44.24.0) ##### Features - **manager/github-actions:** add support for Actions Lockfiles ([#45199](https://redirect.github.com/renovatebot/renovate/issues/45199)) ([fba1a9d](https://redirect.github.com/renovatebot/renovate/commit/fba1a9de307287e0c2138ccef938ffe4ba370b5c)) ##### Documentation - fix fenced blocks ([#45206](https://redirect.github.com/renovatebot/renovate/issues/45206)) ([3823ef8](https://redirect.github.com/renovatebot/renovate/commit/3823ef87427fe4d7e7107c230440ed018cf80e7c)) ##### Miscellaneous Chores - **deps:** update dependency memfs to v4.67.0 (main) ([#45193](https://redirect.github.com/renovatebot/renovate/issues/45193)) ([bfa0da8](https://redirect.github.com/renovatebot/renovate/commit/bfa0da839b52156a075244bc395615e59c9047ec)) ##### Code Refactoring - **manager:** add utility for creating Artifact Error messages ([#45218](https://redirect.github.com/renovatebot/renovate/issues/45218)) ([15d5414](https://redirect.github.com/renovatebot/renovate/commit/15d541461b6c3b915fd9bc1798c888af398b9e24)) ### [`v44.23.3`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.23.3) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.23.2...44.23.3) ##### Bug Fixes - **swift:** support Package Registry pins in Package.resolved ([#44358](https://redirect.github.com/renovatebot/renovate/issues/44358)) ([d735b9b](https://redirect.github.com/renovatebot/renovate/commit/d735b9b6b8a65d21a8fbd223bda4545e69a2f077)) ### [`v44.23.2`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.23.2) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.23.1...44.23.2) ##### Bug Fixes - keep HTTPS when resolving same origin URLs ([#45157](https://redirect.github.com/renovatebot/renovate/issues/45157)) ([728ce97](https://redirect.github.com/renovatebot/renovate/commit/728ce9752e0b7f5df3589bdcab7220b9df2c86b7)) ### [`v44.23.1`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.23.1) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.23.0...44.23.1) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.84.1 (main) ([#45209](https://redirect.github.com/renovatebot/renovate/issues/45209)) ([f4f7ea1](https://redirect.github.com/renovatebot/renovate/commit/f4f7ea1d736a8a8ad59471235fe0ab08cbbcd14c)) ### [`v44.23.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.23.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.22.0...44.23.0) ##### Features - add regex support for gitIgnoredAuthors configuration ([#43938](https://redirect.github.com/renovatebot/renovate/issues/43938)) ([65ee1f1](https://redirect.github.com/renovatebot/renovate/commit/65ee1f18b47478092f0a1a7216e948acd270064a)) ### [`v44.22.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.22.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.21.0...44.22.0) ##### Features - **vulnerabilities:** match OSV Packagist sub-ecosystems ([#45203](https://redirect.github.com/renovatebot/renovate/issues/45203)) ([a84e007](https://redirect.github.com/renovatebot/renovate/commit/a84e007f469995d53843f07173d59e34dd813e4e)) ### [`v44.21.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.21.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.20.1...44.21.0) ##### Features - **replacements:** add replacements for dev-facing Comet packages ([#45112](https://redirect.github.com/renovatebot/renovate/issues/45112)) ([b9b2755](https://redirect.github.com/renovatebot/renovate/commit/b9b275568507a59cab65f299254ded1105d1d806)) ### [`v44.20.1`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.20.1) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.20.0...44.20.1) ##### Bug Fixes - **cargo:** support fetching crates from git monorepo ([#45142](https://redirect.github.com/renovatebot/renovate/issues/45142)) ([4adc8f3](https://redirect.github.com/renovatebot/renovate/commit/4adc8f37257afbcc4d19647928ffca1d206abd86)) ##### Miscellaneous Chores - **deps:** update dependency pnpm to v11.20.0 (main) ([#45201](https://redirect.github.com/renovatebot/renovate/issues/45201)) ([3f20dca](https://redirect.github.com/renovatebot/renovate/commit/3f20dca6e0f397c7aaba678e232f0acddb0e9f32)) ### [`v44.20.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.20.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.19.0...44.20.0) ##### Features - **util/exec:** add support for `gh` tool ([#45192](https://redirect.github.com/renovatebot/renovate/issues/45192)) ([4537247](https://redirect.github.com/renovatebot/renovate/commit/45372476c8670d0cc3ac2b86976887112f9af748)), closes [#44753](https://redirect.github.com/renovatebot/renovate/issues/44753) [#45190](https://redirect.github.com/renovatebot/renovate/issues/45190) ##### Documentation - update references to renovate/renovate (main) ([#45196](https://redirect.github.com/renovatebot/renovate/issues/45196)) ([d584cf4](https://redirect.github.com/renovatebot/renovate/commit/d584cf45d90b72e18cd9b0939ba2a1c337a5b031)) ##### Code Refactoring - **workers/repository:** allow managers to opt out of digest pinning ([#45198](https://redirect.github.com/renovatebot/renovate/issues/45198)) ([7f40d43](https://redirect.github.com/renovatebot/renovate/commit/7f40d43179cfe937b38ce0c62e563ee37654b3c0)), closes [#45190](https://redirect.github.com/renovatebot/renovate/issues/45190) ### [`v44.19.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.19.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.18.0...44.19.0) ##### Features - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.84.0 (main) ([#45197](https://redirect.github.com/renovatebot/renovate/issues/45197)) ([197ad00](https://redirect.github.com/renovatebot/renovate/commit/197ad002894f4170282224601ea27ade517f9666)) ### [`v44.18.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.18.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.17.5...44.18.0) ##### Features - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.83.0 (main) ([#45195](https://redirect.github.com/renovatebot/renovate/issues/45195)) ([63f9e20](https://redirect.github.com/renovatebot/renovate/commit/63f9e20779a3cd64914057e439573c750efca39a)) ##### Miscellaneous Chores - **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.14.0 (main) ([#45194](https://redirect.github.com/renovatebot/renovate/issues/45194)) ([7275fcb](https://redirect.github.com/renovatebot/renovate/commit/7275fcb63228387ee2f8256a6cd19d86f78e97c1)) ### [`v44.17.5`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.17.5) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.17.4...44.17.5) ##### Bug Fixes - **git:** resolve child env before adding authentication ([#45184](https://redirect.github.com/renovatebot/renovate/issues/45184)) ([cca6227](https://redirect.github.com/renovatebot/renovate/commit/cca6227dfab416b9364214ff8543ce7b663389e8)) ### [`v44.17.4`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.17.4) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.17.3...44.17.4) ##### Bug Fixes - **versioning/cargo:** convert ranges to semver in subset and intersects ([#45146](https://redirect.github.com/renovatebot/renovate/issues/45146)) ([1f6546b](https://redirect.github.com/renovatebot/renovate/commit/1f6546b7a9e41c2c1bc6684d01e63674297bdd7f)) ### [`v44.17.3`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.17.3) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.17.2...44.17.3) ##### Bug Fixes - **manager/asdf,mise,proto:** use rust-version datasource for rust ([#45143](https://redirect.github.com/renovatebot/renovate/issues/45143)) ([a2d1b8c](https://redirect.github.com/renovatebot/renovate/commit/a2d1b8cf0af3bc7553bc4be872015b3ddf0cd92e)) - **manager/rust-toolchain:** report skipReason instead of dropping deps ([#45144](https://redirect.github.com/renovatebot/renovate/issues/45144)) ([183ee9c](https://redirect.github.com/renovatebot/renovate/commit/183ee9caacae80d2368e3533a77f73ff31f1d0c8)) ### [`v44.17.2`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.17.2) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.17.1...44.17.2) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.11 (main) ([#45187](https://redirect.github.com/renovatebot/renovate/issues/45187)) ([44e862a](https://redirect.github.com/renovatebot/renovate/commit/44e862a926a494145c3c0cc0319d345afd710d05)) ##### Documentation - update references to otel/opentelemetry-collector-contrib to v0.158.0 (main) ([#45180](https://redirect.github.com/renovatebot/renovate/issues/45180)) ([3952363](https://redirect.github.com/renovatebot/renovate/commit/3952363a57de0234404eff54cec865d4cc38865a)) - update references to python to [`3a9d2dd`](https://redirect.github.com/renovatebot/renovate/commit/3a9d2dd) (main) ([#45179](https://redirect.github.com/renovatebot/renovate/issues/45179)) ([5ca534a](https://redirect.github.com/renovatebot/renovate/commit/5ca534a0c85cfcbd24e1fbfc2f2f8932341e1d9d)) - update references to renovate/renovate (main) ([#45182](https://redirect.github.com/renovatebot/renovate/issues/45182)) ([742b3b3](https://redirect.github.com/renovatebot/renovate/commit/742b3b3213d716c450b98ba16c98d331d73fb3a5)) - update references to renovatebot/github-action to v46.2.2 (main) ([#45185](https://redirect.github.com/renovatebot/renovate/issues/45185)) ([8964a66](https://redirect.github.com/renovatebot/renovate/commit/8964a664b7bd8cc40adc95d53d4acaf52e6eba38)) ##### Miscellaneous Chores - **deps:** lock file maintenance (main) ([#45183](https://redirect.github.com/renovatebot/renovate/issues/45183)) ([21ae785](https://redirect.github.com/renovatebot/renovate/commit/21ae7852f4d450ca845eacd9648b306d1c9d965d)) - **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.13.20 (main) ([#45186](https://redirect.github.com/renovatebot/renovate/issues/45186)) ([2346d98](https://redirect.github.com/renovatebot/renovate/commit/2346d989ab32b46d1993917283f310f57fc7f19a)) - **deps:** update pnpm/setup action to v2.0.2 (main) ([#45178](https://redirect.github.com/renovatebot/renovate/issues/45178)) ([30cd3d8](https://redirect.github.com/renovatebot/renovate/commit/30cd3d8b8cb3355ea5a12d2409f1555734077281)) ### [`v44.17.1`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.17.1) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.17.0...44.17.1) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.10 (main) ([#45175](https://redirect.github.com/renovatebot/renovate/issues/45175)) ([ef843fd](https://redirect.github.com/renovatebot/renovate/commit/ef843fd3e1379f432fca4adbb686399269658ee0)) ##### Miscellaneous Chores - **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.13.19 (main) ([#45174](https://redirect.github.com/renovatebot/renovate/issues/45174)) ([4b27160](https://redirect.github.com/renovatebot/renovate/commit/4b271608155bae6c6411a63e00c9d59128b104cd)) ### [`v44.17.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.17.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.16.1...44.17.0) ##### Features - **presets:** add replacement for deprecated password pusher images ([#45172](https://redirect.github.com/renovatebot/renovate/issues/45172)) ([a484d01](https://redirect.github.com/renovatebot/renovate/commit/a484d01201a908f86db34bfcfd2034c2ad67260d)) ##### Miscellaneous Chores - **deps:** update dependency [@containerbase/istanbul-reports-html](https://redirect.github.com/containerbase/istanbul-reports-html) to v2.0.15 (main) ([#45173](https://redirect.github.com/renovatebot/renovate/issues/45173)) ([5e5dd4f](https://redirect.github.com/renovatebot/renovate/commit/5e5dd4f0d2bd2c272d184f6c51bd0ac01fdfa7ad)) - **deps:** update dependency vitest-mock-extended to v5.1.1 (main) ([#44856](https://redirect.github.com/renovatebot/renovate/issues/44856)) ([0243c9d](https://redirect.github.com/renovatebot/renovate/commit/0243c9d65d56d252955dab734bf365f4c869ead6)) ### [`v44.16.1`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.16.1) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.16.0...44.16.1) ##### Bug Fixes - **presets/monorepo:** add new datatables.net source repos ([#45090](https://redirect.github.com/renovatebot/renovate/issues/45090)) ([42cd249](https://redirect.github.com/renovatebot/renovate/commit/42cd249823d69524d57a2a7b954898a3307676dd)) ### [`v44.16.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.16.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.15.0...44.16.0) ##### Features - **presets:** add Flue monorepo ([#45137](https://redirect.github.com/renovatebot/renovate/issues/45137)) ([e869eec](https://redirect.github.com/renovatebot/renovate/commit/e869eecc4d4203eeffaba174c8820ee5c2f19922)) ##### Miscellaneous Chores - **deps:** update dependency [@types/semver](https://redirect.github.com/types/semver) to v7.8.0 (main) ([#45164](https://redirect.github.com/renovatebot/renovate/issues/45164)) ([2f1b951](https://redirect.github.com/renovatebot/renovate/commit/2f1b9514ae3513c2dc86753343682b355225588e)) ### [`v44.15.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.15.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.12...44.15.0) ##### Features - **data:** automatic update of static data ([#45163](https://redirect.github.com/renovatebot/renovate/issues/45163)) ([25a09ec](https://redirect.github.com/renovatebot/renovate/commit/25a09ecb7ec5c2a8328762475b0795127682311b)) ### [`v44.14.12`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.12) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.10...44.14.12) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.9 (main) ([#45156](https://redirect.github.com/renovatebot/renovate/issues/45156)) ([1b99a61](https://redirect.github.com/renovatebot/renovate/commit/1b99a61a38edd029d9679d25673aea389f8ceb2b)) ##### Miscellaneous Chores - **deps:** update dependency [@types/lodash](https://redirect.github.com/types/lodash) to v4.17.25 (main) ([#45151](https://redirect.github.com/renovatebot/renovate/issues/45151)) ([2f2dd98](https://redirect.github.com/renovatebot/renovate/commit/2f2dd98b44f70f1a52fba4385b5ae8dd9d714be3)) - **deps:** update dependency [@types/luxon](https://redirect.github.com/types/luxon) to v3.7.3 (main) ([#45154](https://redirect.github.com/renovatebot/renovate/issues/45154)) ([ecadb0c](https://redirect.github.com/renovatebot/renovate/commit/ecadb0c88ec4aa4c163499b48d19b6a9cc7c2b1a)) - **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.13.18 (main) ([#45155](https://redirect.github.com/renovatebot/renovate/issues/45155)) ([7a4aac6](https://redirect.github.com/renovatebot/renovate/commit/7a4aac6f03e1889d306ab602344f1fcb43799439)) ### [`v44.14.10`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.10) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.9...44.14.10) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.7 (main) ([#45149](https://redirect.github.com/renovatebot/renovate/issues/45149)) ([f306402](https://redirect.github.com/renovatebot/renovate/commit/f306402533b53348cd7c0519fd9ff87c4aaf29ea)) ##### Miscellaneous Chores - **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.13.17 (main) ([#45148](https://redirect.github.com/renovatebot/renovate/issues/45148)) ([b726beb](https://redirect.github.com/renovatebot/renovate/commit/b726beb7a71951d32c4e163533f935f48f507244)) ### [`v44.14.9`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.9) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.8...44.14.9) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.6 (main) ([#45147](https://redirect.github.com/renovatebot/renovate/issues/45147)) ([84ef069](https://redirect.github.com/renovatebot/renovate/commit/84ef069a60bea3f99fa8d8e6292df4d579f5ba45)) ##### Miscellaneous Chores - **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.13.16 (main) ([#45145](https://redirect.github.com/renovatebot/renovate/issues/45145)) ([4c492d3](https://redirect.github.com/renovatebot/renovate/commit/4c492d3ef02d6d5ea6c34fe23cb52f3b3e37ef3f)) ### [`v44.14.8`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.8) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.7...44.14.8) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.5 (main) ([#45141](https://redirect.github.com/renovatebot/renovate/issues/45141)) ([ee9e688](https://redirect.github.com/renovatebot/renovate/commit/ee9e68825668a16febf3e0e888ab7b0f37ab0df4)) ##### Miscellaneous Chores - **deps:** update dependency astral-sh/uv to v0.12.3 (main) ([#45139](https://redirect.github.com/renovatebot/renovate/issues/45139)) ([f1e08d3](https://redirect.github.com/renovatebot/renovate/commit/f1e08d3a1ab2df48545b2f9217d254289864602d)) - **deps:** update dependency uv to v0.12.3 (main) ([#45140](https://redirect.github.com/renovatebot/renovate/issues/45140)) ([58c581b](https://redirect.github.com/renovatebot/renovate/commit/58c581bd63120b5d4cb9098bb313b184e3b2195d)) ##### Code Refactoring - **types:** make return type for `getToolSettingsOptions` stricter ([#45133](https://redirect.github.com/renovatebot/renovate/issues/45133)) ([c92c7e2](https://redirect.github.com/renovatebot/renovate/commit/c92c7e2d3a83dd1d4483f859006778e15045db08)) ### [`v44.14.7`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.7) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.6...44.14.7) ##### Bug Fixes - **exec/docker:** single-quote the sidecar `bash` command ([b017c75](https://redirect.github.com/renovatebot/renovate/commit/b017c7548ad6cfde7fca9b36f4525999c5845155)) - **manager/deno:** quote allow-import host list in install command ([3793e3b](https://redirect.github.com/renovatebot/renovate/commit/3793e3bab97108a7c2309aa23980ae8635fc5815)) - **manager/gomod:** quote module path in import path update command ([c9cec1a](https://redirect.github.com/renovatebot/renovate/commit/c9cec1affb5938b99ed8cf5790c7b9f326b7aeb7)) - **manager/gradle-wrapper:** quote distribution URL in wrapper command ([b3f7846](https://redirect.github.com/renovatebot/renovate/commit/b3f7846c1609d9af420e5ef6647ce0d744947e0c)) - **manager/maven-wrapper:** quote distribution type in wrapper command ([7279744](https://redirect.github.com/renovatebot/renovate/commit/7279744cd6cc8ab96471a5abc75fb176c6257d6c)) - **manager/mix:** quote hex organization and token in auth command ([ff3e99e](https://redirect.github.com/renovatebot/renovate/commit/ff3e99ef53e057f83db4b2423eaf981011ae47ef)) - **manager/nix:** quote GitHub token in flake update command ([521d325](https://redirect.github.com/renovatebot/renovate/commit/521d325afdd1a3ca3e5385d85bb6b9715dd26cea)) - **manager/npm:** quote package spec in corepack command ([6d2fa81](https://redirect.github.com/renovatebot/renovate/commit/6d2fa815b72278f7547b0ff943cccf6788705424)) ##### Miscellaneous Chores - add `no-unquoted-exec-interpolation` linting rule ([e510b9a](https://redirect.github.com/renovatebot/renovate/commit/e510b9a64d4eaccaa376c6306d42e2c0c5a6f5fd)) ##### Code Refactoring - generate the list of templatable fields ([df7a014](https://redirect.github.com/renovatebot/renovate/commit/df7a014c91958d029e0002bd383df8574af96d11)) ### [`v44.14.6`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.6) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.5...44.14.6) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.4 (main) ([#45131](https://redirect.github.com/renovatebot/renovate/issues/45131)) ([d8aa95f](https://redirect.github.com/renovatebot/renovate/commit/d8aa95fe64a294a9572d226864c03c64f73c9761)) ##### Documentation - add link to Containerbase' \"new tool\" documentation ([#45127](https://redirect.github.com/renovatebot/renovate/issues/45127)) ([78fa7af](https://redirect.github.com/renovatebot/renovate/commit/78fa7af1d133845ec1d06ec08ac5f60367839ca8)) - Do not recommend to use prCreation=not-pending with automerge ([#45088](https://redirect.github.com/renovatebot/renovate/issues/45088)) ([0dac257](https://redirect.github.com/renovatebot/renovate/commit/0dac257b655b549218a58c58cf389fe4377148d1)) ##### Miscellaneous Chores - **deps:** update dependency nock to v14.0.17 (main) ([#45121](https://redirect.github.com/renovatebot/renovate/issues/45121)) ([2668a65](https://redirect.github.com/renovatebot/renovate/commit/2668a65daee615d3885b7a8faa858b1bb1c90f96)) - **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.13.15 (main) ([#45120](https://redirect.github.com/renovatebot/renovate/issues/45120)) ([3bcc84b](https://redirect.github.com/renovatebot/renovate/commit/3bcc84bb65bad8cce667508280807ceb260837d4)) - **deps:** update pnpm/setup action to v2.0.1 (main) ([#45129](https://redirect.github.com/renovatebot/renovate/issues/45129)) ([ed81456](https://redirect.github.com/renovatebot/renovate/commit/ed81456807c12d8a04fd0f2df0a57d4adc078b48)) ##### Code Refactoring - **types:** clarify `ToolSettings` has two levels of config ([#45125](https://redirect.github.com/renovatebot/renovate/issues/45125)) ([a28ecdc](https://redirect.github.com/renovatebot/renovate/commit/a28ecdc122c406dec8cf1476cf967327adb127d9)) ### [`v44.14.5`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.5) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.4...44.14.5) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.3 (main) ([#45122](https://redirect.github.com/renovatebot/renovate/issues/45122)) ([4230fe3](https://redirect.github.com/renovatebot/renovate/commit/4230fe3132d471d1e1e010b41967598791837e96)) ##### Miscellaneous Chores - **deps:** update dependency pnpm to v11.19.0 (main) ([#45128](https://redirect.github.com/renovatebot/renovate/issues/45128)) ([8126773](https://redirect.github.com/renovatebot/renovate/commit/8126773463589a501862a0925ce8ae3b247e623a)) ### [`v44.14.4`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.4) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.3...44.14.4) ##### Bug Fixes - **proxy:** sanitise password components in `HTTP_PROXY` variable(s) in logs ([#45117](https://redirect.github.com/renovatebot/renovate/issues/45117)) ([f88212b](https://redirect.github.com/renovatebot/renovate/commit/f88212be2e7b1a8d359b4852ae6f7e2d2a63be2b)) - **util/host-rules:** sanitise TLS credential fields in hostRules ([#45119](https://redirect.github.com/renovatebot/renovate/issues/45119)) ([54384ff](https://redirect.github.com/renovatebot/renovate/commit/54384ff3e52736b69fe2d7442b4d0ae887e63d7e)) ##### Miscellaneous Chores - **deps:** update dependency lint-staged to v17.3.0 (main) ([#45126](https://redirect.github.com/renovatebot/renovate/issues/45126)) ([4a62cda](https://redirect.github.com/renovatebot/renovate/commit/4a62cdaaa32ffa0db5ab5945210e5aead13c2d5a)) ### [`v44.14.3`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.3) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.2...44.14.3) ##### Bug Fixes - **workers/global:** sanitise `COREPACK_NPM_{TOKEN,PASSWORD}` in logs ([#45116](https://redirect.github.com/renovatebot/renovate/issues/45116)) ([244bfe1](https://redirect.github.com/renovatebot/renovate/commit/244bfe15a77ff5bf7870d0d3a007eac93a1ed70b)) ### [`v44.14.2`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.2) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.1...44.14.2) ##### Bug Fixes - **datasource/docker:** fetch all pages for cgr.dev ([#45114](https://redirect.github.com/renovatebot/renovate/issues/45114)) ([d7ce060](https://redirect.github.com/renovatebot/renovate/commit/d7ce0605b2032b2c2db72a5c40990a540c927a2b)) ##### Miscellaneous Chores - add linter rule for `shell: true` usage ([#45110](https://redirect.github.com/renovatebot/renovate/issues/45110)) ([52ff375](https://redirect.github.com/renovatebot/renovate/commit/52ff375f0a0dc12bfd5e3d98b5789262e81be7f9)) - **deps:** update actions/cache action to v6 (main) ([#45104](https://redirect.github.com/renovatebot/renovate/issues/45104)) ([ec7aadb](https://redirect.github.com/renovatebot/renovate/commit/ec7aadbca9f4dc795b17de756950015a44f8b98d)) - **deps:** update actions/checkout action to v7 (main) ([#45105](https://redirect.github.com/renovatebot/renovate/issues/45105)) ([db79937](https://redirect.github.com/renovatebot/renovate/commit/db7993707a688554c5248de9e556e26066fc8da2)) - **deps:** update codecov/codecov-action action to v7 (main) ([#45106](https://redirect.github.com/renovatebot/renovate/issues/45106)) ([0593955](https://redirect.github.com/renovatebot/renovate/commit/05939559c6f9aa61a5620669a925dafff1685613)) - **deps:** update dependency astral-sh/setup-uv to v9 (main) ([#45100](https://redirect.github.com/renovatebot/renovate/issues/45100)) ([7840681](https://redirect.github.com/renovatebot/renovate/commit/7840681f1311392a627d1a0df90d00f8e72242f1)) - **deps:** update dependency vite to v8.2.0 (main) ([#45115](https://redirect.github.com/renovatebot/renovate/issues/45115)) ([9d02537](https://redirect.github.com/renovatebot/renovate/commit/9d02537b431aaed3d382e5a33b42ce7bb1696164)) - **deps:** update slackapi/slack-github-action action to v4 (main) ([#45107](https://redirect.github.com/renovatebot/renovate/issues/45107)) ([0fb9ca8](https://redirect.github.com/renovatebot/renovate/commit/0fb9ca898283b1938be958e681a821ebdb165312)) - **manager/flux:** don't use shell execution to `flux install` ([#45109](https://redirect.github.com/renovatebot/renovate/issues/45109)) ([a36eed3](https://redirect.github.com/renovatebot/renovate/commit/a36eed33653803d5a19b88df49a053af576005da)) ### [`v44.14.1`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.1) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.14.0...44.14.1) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.2 (main) ([#45103](https://redirect.github.com/renovatebot/renovate/issues/45103)) ([c4756c3](https://redirect.github.com/renovatebot/renovate/commit/c4756c3de6845a5a8cc70cfdf0ab6963634bffe3)) ### [`v44.14.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.14.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.13.3...44.14.0) ##### Features - **github-actions:** add support for `pnpm/setup` ([#45094](https://redirect.github.com/renovatebot/renovate/issues/45094)) ([fa17e59](https://redirect.github.com/renovatebot/renovate/commit/fa17e599843023ff90bf7aca25fc175928af1087)) ##### Miscellaneous Chores - **deps:** update dependency npm-run-all2 to v9 (main) ([#45101](https://redirect.github.com/renovatebot/renovate/issues/45101)) ([5149a03](https://redirect.github.com/renovatebot/renovate/commit/5149a0319eed7a146cf8af9f5b6ffe12e37576d7)) - **deps:** update pnpm/setup action to v2 (main) ([#45102](https://redirect.github.com/renovatebot/renovate/issues/45102)) ([da0534a](https://redirect.github.com/renovatebot/renovate/commit/da0534a93216e1678ebecc936d27c025ff7ea79e)) ### [`v44.13.3`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.13.3) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.13.2...44.13.3) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.1 (main) ([#45099](https://redirect.github.com/renovatebot/renovate/issues/45099)) ([814c4dc](https://redirect.github.com/renovatebot/renovate/commit/814c4dc68938baab98c5264ea8229a89326a06f2)) ##### Miscellaneous Chores - **deps:** update dependency [@smithy/util-stream](https://redirect.github.com/smithy/util-stream) to v4.7.16 (main) ([#45095](https://redirect.github.com/renovatebot/renovate/issues/45095)) ([d7d23ac](https://redirect.github.com/renovatebot/renovate/commit/d7d23ac28590868e599abdf7418e22e3df5ddeaf)) - **deps:** update dependency astral-sh/uv to v0.12.2 (main) ([#45097](https://redirect.github.com/renovatebot/renovate/issues/45097)) ([09fb3c4](https://redirect.github.com/renovatebot/renovate/commit/09fb3c489e63f90de88591a5ef822bec45107a40)) - **deps:** update dependency uv to v0.12.2 (main) ([#45098](https://redirect.github.com/renovatebot/renovate/issues/45098)) ([dd657f3](https://redirect.github.com/renovatebot/renovate/commit/dd657f3f88129c0be3ce28c01e418e622e9d8684)) ##### Continuous Integration - migrate to `pnpm/setup` ([#45035](https://redirect.github.com/renovatebot/renovate/issues/45035)) ([144ba37](https://redirect.github.com/renovatebot/renovate/commit/144ba373a4ba02d54d4f74998c0bd7d01112c2b8)) ### [`v44.13.2`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.13.2) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.13.1...44.13.2) ##### Build System - **deps:** update dependency [@renovatebot/detect-tools](https://redirect.github.com/renovatebot/detect-tools) to v4.0.11 (main) ([#44979](https://redirect.github.com/renovatebot/renovate/issues/44979)) ([bce1f27](https://redirect.github.com/renovatebot/renovate/commit/bce1f27f9c9f43d2b8862d2a4c765799c6264818)) ### [`v44.13.1`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.13.1) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.13.0...44.13.1) ##### Build System - **deps:** update yarn monorepo (main) ([#45083](https://redirect.github.com/renovatebot/renovate/issues/45083)) ([ce414fb](https://redirect.github.com/renovatebot/renovate/commit/ce414fb3b02d3d91ff046ea101c8d168bd0d7403)) ### [`v44.13.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.13.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.12.0...44.13.0) ##### Features - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.82.0 (main) ([#45084](https://redirect.github.com/renovatebot/renovate/issues/45084)) ([6e9352c](https://redirect.github.com/renovatebot/renovate/commit/6e9352c5d5972499c1056b45a31e9caa508b6c04)) ##### Miscellaneous Chores - **deps:** update dependency pnpm to v11.18.0 (main) ([#45080](https://redirect.github.com/renovatebot/renovate/issues/45080)) ([6950cb2](https://redirect.github.com/renovatebot/renovate/commit/6950cb296c8a8207b4aeb6374be3d3631cd0067f)) ### [`v44.12.0`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.12.0) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.11.8...44.12.0) ##### Features - **config/validation:** validate object entries in the `repositories` array ([#43033](https://redirect.github.com/renovatebot/renovate/issues/43033)) ([527c141](https://redirect.github.com/renovatebot/renovate/commit/527c141b5ba03236ac1f88ed9fba15a0bd81efba)), closes [#43295](https://redirect.github.com/renovatebot/renovate/issues/43295) ### [`v44.11.8`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.11.8) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.11.7...44.11.8) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.81.6 (main) ([#45078](https://redirect.github.com/renovatebot/renovate/issues/45078)) ([7ae4708](https://redirect.github.com/renovatebot/renovate/commit/7ae47086de7b486811e6a342a75b280e9561bc89)) ### [`v44.11.7`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.11.7) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.11.6...44.11.7) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.81.5 (main) ([#45077](https://redirect.github.com/renovatebot/renovate/issues/45077)) ([7da69ea](https://redirect.github.com/renovatebot/renovate/commit/7da69eabade945e56ea13523cdcab47153271d26)) ### [`v44.11.6`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.11.6) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.11.5...44.11.6) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.81.4 (main) ([#45076](https://redirect.github.com/renovatebot/renovate/issues/45076)) ([374fa3f](https://redirect.github.com/renovatebot/renovate/commit/374fa3f315aa5ded6692c8d2bb346b414ff92e3c)) ### [`v44.11.5`](https://redirect.github.com/renovatebot/renovate/releases/tag/44.11.5) [Compare Source](https://redirect.github.com/renovatebot/renovate/compare/44.11.4...44.11.5) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.81.3 (main) ([#45073](https://redirect.github.com/renovatebot/renovate/issues/45073)) ([7e67ccd](https://redirect.github.com/renovatebot/renovate/commit/7e67ccd871d5236072a5ff6077a4f9a82e1ca99e)) ##### Documentation - **config:** clarify how to use `repositories` ([#45061](https://redirect.github.com/renovatebot/renovate/issues/45061)) ([190f8d5](https://redirect.github.com/renovatebot/renovate/commit/190f8d54ae833afba6eeb78272fb8ac7e8f4ae91)) - validate JSONC and Javascript code blocks ([#45063](https://redirect.github.com/renovatebot/renovate/issues/45063)) ([8108714](https://redirect.github.com/renovatebot/renovate/commit/8108714fc3e643838438007bd650df487fd3c26e)) ##### Miscellaneous Chores - **deps:** update github/codeql-action action to v4.37.6 (main) ([#45066](https://redirect.github.com/renovatebot/renovate/issues/45066)) ([52c5ba2](https://redirect.github.com/renovatebot/renovate/commit/52c5ba26c865718560f8a72fcd755177ec7807f3)) ##### Tests - **config/validation:** ensure that `errors` and `warnings` are always checked and that we don't length check ([#45065](https://redirect.github.com/renovatebot/renovate/issues/45065)) ([23dd568](https://redirect.github.com/renovatebot/renovate/commit/23dd5682be2f38c69beb0bb0a882e0aa4d932c78)) --- ### Configuration π
**Schedule**: (UTC) - Branch creation - \"on sunday\" - Automerge - At any time (no schedule defined) π¦ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β» **Rebasing**: Never, or you tick the rebase/retry checkbox. π» **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). ",
"url": "https://github.com/cilium/cilium/pull/47859",
"createdAt": "2026-08-09T00:42:09Z",
"updatedAt": "2026-08-12T23:21:24Z",
"timestamp": "2026-08-12T23:21:24Z",
"metrics": {
"reactions": 2,
"comments": 8
},
"labels": [
"kind/enhancement",
"release-note/misc",
"dont-merge/blocked",
"kind/community-contribution",
"renovate/stop-updating",
"cilium-cli"
],
"author": "cilium-renovate[bot]",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:b231df461b43fc3ec513",
"signalId": "github:cilium/cilium:pull_request:47801",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47801",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ci: skip etcd log fetch when kvstore was never started",
"text": "The Fetch artifacts step runs on any failure, including a failure of the step that brings up the cluster. On kvstore matrix legs it then runs kubectl -n kube-system logs kvstore with no cluster to talk to, so it exits 1 with \"connection to the server localhost:8080 was refused\" and one real failure becomes two red steps. Legs without kvstore stay green, because there the guard makes the body a no-op. See kube-proxy-5 in https://github.com/cilium/cilium/actions/runs/30930670676/job/92064650443 failing where ipsec-6 in https://github.com/cilium/cilium/actions/runs/30930673513/job/92064622113 is green after the identical provisioning failure. Gate the step on Start Cilium KVStore having actually succeeded instead of on the matrix value, which also covers any other earlier failure that skips the kvstore step. This PR was prepared with AIL:3.",
"url": "https://github.com/cilium/cilium/pull/47801",
"createdAt": "2026-08-06T06:49:28Z",
"updatedAt": "2026-08-12T22:43:06Z",
"timestamp": "2026-08-12T22:43:06Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"release-note/ci",
"backport-done/1.18",
"backport-done/1.19",
"backport-done/1.20"
],
"author": "aanm",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:b8de030ce62e2469b113",
"signalId": "github:cilium/cilium:pull_request:47208",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47208",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ipcache: fix CIDR reference counter to use canonical prefixes",
"text": "Policy CIDR identities are shared across namespaces via a single consolidated ipcache metadata entry, guarded only by `prefixRefCounter`. The counter was keyed by the *raw* prefix from the update, while the metadata store keys entries by the *canonical* (masked, unmapped) prefix. This mismatch lets one namespace's policy deletion release a CIDR identity that another namespace still uses. ## Reproduction - namespace-A: CiliumNetworkPolicy with `toCIDR: 10.0.0.1/24` - namespace-B: CiliumNetworkPolicy with `toCIDR: 10.0.0.0/24` (same network range, just different prefix) Counter holds `{10.0.0.1/24: 1, 10.0.0.0/24: 1}` but there is a single `10.0.0.0/24` metadata entry / identity. Deleting ns-A's policy drops its raw key to 0, tears down the shared entry, and releases the identity ns-B still references β ns-B loses traffic to `10.0.0.0/24`. The stale ns-B count also prevents recovery until an agent restart. This leads to silent traffic drops in production environments when overlapping CIDRs are deleted across namespaces. ## Changes - Key `prefixRefCounter` by `canonicalPrefix(upd.Prefix)` in both `UpsertMetadataBatch` and `RemoveMetadataBatch`, aligning it with the metadata store's existing canonical keying. - Add `TestIPCacheCIDRResourceConsolidationNonCanonical`, which fails without the fix (shared entry released after deleting one of two namespaces). ## Note This bug is introduced in this commit: 50d7f4530e first affected releases: v1.19.0, and v1.18.5",
"url": "https://github.com/cilium/cilium/pull/47208",
"createdAt": "2026-07-15T12:41:52Z",
"updatedAt": "2026-08-12T22:43:02Z",
"timestamp": "2026-08-12T22:43:02Z",
"metrics": {
"reactions": 3,
"comments": 4
},
"labels": [
"kind/bug",
"release-note/bug",
"sig/policy",
"kind/community-contribution",
"backport-done/1.18",
"backport-done/1.19",
"backport-done/1.20"
],
"author": "iwanhae",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:40e2df4d13ffa65c7e45",
"signalId": "github:cilium/cilium:pull_request:47780",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47780",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Revert \"gha: don't install LLVM and Clang in integration tests workflow\"",
"text": "This reverts commit c215742d866ef342303dcf224db69b29565c8885. The reverted commit removed the installation of LLVM and Clang from the integration tests workflow, under the assumption that they are not needed to run the Go based integration tests. However, it turns out that the TestObjectCache{,Parallel} tests actually invoke the compilation of a BPF program. Yet, I had not noticed it while testing the PR previously, as likely the GHA image includes Clang installed, and the version happens to be close enough to not cause failures. Let's restore the explicit LLVM and Clang installation step, to prevent the risk of breakages due to version changes, or if the GHA image doesn't include them. The \"Setup additional repositories\" steps is not restored though, as it was only needed for libtinfo5, and it is also fragile as it depends on runner names. AIL: 0",
"url": "https://github.com/cilium/cilium/pull/47780",
"createdAt": "2026-08-05T16:15:46Z",
"updatedAt": "2026-08-12T22:42:58Z",
"timestamp": "2026-08-12T22:42:58Z",
"metrics": {
"reactions": 2,
"comments": 7
},
"labels": [
"release-note/ci",
"backport-done/1.18",
"backport-done/1.19",
"backport-done/1.20"
],
"author": "giorio94",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:96d48ad4a38ad0083ee8",
"signalId": "github:cilium/cilium:pull_request:47887",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47887",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "v1.18 Backports 2026-08-10",
"text": "* [x] #47780 (@giorio94) :warning: resolved conflicts * [ ] #47208 (@iwanhae) :warning: resolved conflicts * [x] #47801 (@aanm) :warning: resolved conflicts Once this PR is merged, a GitHub action will update the labels of these PRs: ```upstream-prs 47780 47208 47801 ```",
"url": "https://github.com/cilium/cilium/pull/47887",
"createdAt": "2026-08-10T14:53:04Z",
"updatedAt": "2026-08-12T22:42:48Z",
"timestamp": "2026-08-12T22:42:48Z",
"metrics": {
"reactions": 0,
"comments": 2
},
"labels": [
"kind/backports",
"backport/1.18"
],
"author": "pippolo84",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:adc047909be4a3dea578",
"signalId": "github:cilium/cilium:pull_request:47844",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47844",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Fix endpoint panic when verbose policy logging is enabled",
"text": "The endpoint policy debug logging assumes that the `policyDebugLog` field is set unconditionally. However, we didn't set the field when restoring the endpoint from JSON, leading to nil pointer exceptions when verbose policy logging was enabled. Prepared using AIL:2 - had AI analyze the stack trace and implemented the fix myself. The test is AI generated though, so maybe AIL:3 actually? Fixes a commit by me, not cc'ing myself :grin: Fixes: #47777 ```release-note Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. ```",
"url": "https://github.com/cilium/cilium/pull/47844",
"createdAt": "2026-08-07T12:46:57Z",
"updatedAt": "2026-08-12T22:42:48Z",
"timestamp": "2026-08-12T22:42:48Z",
"metrics": {
"reactions": 4,
"comments": 3
},
"labels": [
"kind/bug",
"release-note/bug",
"sig/policy",
"ready-to-merge",
"backport-done/1.19",
"backport-done/1.20"
],
"author": "bimmlerd",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:747f0baf15c6a4540c44",
"signalId": "github:cilium/cilium:pull_request:47824",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47824",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "clustermesh: fix service export sync on missing CRDs",
"text": "The service export sync logic incorrectly finish the syncing process early when we weren't able to find the CRDs which could affect both CRD upgrade when the clustermesh-apiserver new version start before the cilium-operator had a chance to finish upgrading the CRDs or when enabling MCS-API on a running cluster with a similar configuration. This commit fixes that by ensuring that we retry launching the sync without actually setting the store as synced which both influence clustermesh-apiserver readiness and the resource sync marker. Used AIL-1 here Fixes #47793 ```release-note clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed ```",
"url": "https://github.com/cilium/cilium/pull/47824",
"createdAt": "2026-08-06T17:21:11Z",
"updatedAt": "2026-08-12T22:42:43Z",
"timestamp": "2026-08-12T22:42:43Z",
"metrics": {
"reactions": 2,
"comments": 6
},
"labels": [
"release-note/bug",
"ready-to-merge",
"area/clustermesh",
"affects/v1.18",
"affects/v1.19",
"backport-done/1.20",
"affects/v1.20"
],
"author": "MrFreezeex",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:b2a36ea42212022cb110",
"signalId": "github:cilium/cilium:pull_request:47838",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47838",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "datapath: turn ARP off on the base devices before bringing them up",
"text": "The clustermesh conformance job fails check-log-errors on the IPv6 native-routing legs with one warning from a freshly booted agent: \"failed to find valid IPv6 address for cilium_net\". setupVethPair brings cilium_host and cilium_net up before setupBaseDevice turns ARP off on them, so the kernel runs duplicate address detection on the link-locals it generates for both ends, and it does not notify netlink subscribers about an address while detection is running. The devices table therefore has no IPv6 address for cilium_net during that window, and that link-local is the nexthop the from-proxy IPv6 routes use. The orchestrator's retry ten seconds later succeeds, but the warning alone fails the job. Turning ARP off before bringing the links up makes the kernel skip detection, so the address is created permanent and is visible immediately. That is the correct order regardless, since these are NOARP devices. Measured in a netns with the real setup sequence, the address goes from unusable for 750ms to usable within 5ms, and raising dad_transmits no longer widens the window. The added test fails ten out of ten runs against unpatched main. This PR was prepared with AIL:3.",
"url": "https://github.com/cilium/cilium/pull/47838",
"createdAt": "2026-08-07T09:21:21Z",
"updatedAt": "2026-08-12T22:42:39Z",
"timestamp": "2026-08-12T22:42:39Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"release-note/bug",
"backport-done/1.20"
],
"author": "aanm",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:a935dbe70938070d8e78",
"signalId": "github:cilium/cilium:pull_request:47766",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47766",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api: mark unresolved backend service ports in route status",
"text": "Mark backend references with unknown Service ports as unresolved during shared Gateway API route validation. So far, shared backend validation only checked whether the referenced backend Service exists. If the Service was present but the referenced `backendRef.port` was not exposed by that Service, the route could still end up with `ResolvedRefs=True` and the failure would only surface later during translation or dataplane programming. Fix this by extending the shared backend validation to also verify that the referenced Service port exists on the resolved backend Service. When it does not, set `ResolvedRefs=False` with `BackendNotFound` and a message that points at the missing Service port. This keeps route status aligned with the actual backend resolution state across all route types that use the shared backend validation path.",
"url": "https://github.com/cilium/cilium/pull/47766",
"createdAt": "2026-08-05T11:13:16Z",
"updatedAt": "2026-08-12T22:42:34Z",
"timestamp": "2026-08-12T22:42:34Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"kind/bug",
"release-note/bug",
"ready-to-merge",
"area/servicemesh",
"feature/k8s-gateway-api",
"backport-done/1.20"
],
"author": "mhofstetter",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:88b3923889038fc823ea",
"signalId": "github:cilium/cilium:pull_request:47758",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47758",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api: remove unnecessary TLSRoute support checks",
"text": "TLSRoute support is already mandatory, but the Gateway API controller still carried helper functions and conditional logic for treating it as optional. Remove the obsolete HasTLSRouteSupport helper and the remaining reconcile branches that skipped TLSRoute listing and status updates when the CRD was not present. This keeps the implementation aligned with the current mandatory TLSRoute requirement and removes dead fallback logic.",
"url": "https://github.com/cilium/cilium/pull/47758",
"createdAt": "2026-08-05T07:08:28Z",
"updatedAt": "2026-08-12T22:42:31Z",
"timestamp": "2026-08-12T22:42:31Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"kind/bug",
"ready-to-merge",
"release-note/misc",
"area/servicemesh",
"feature/k8s-gateway-api",
"backport-done/1.20"
],
"author": "mhofstetter",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:a55e2452db1abf005804",
"signalId": "github:cilium/cilium:pull_request:47741",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47741",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "address httpUpstreamLingerTimeout chart templating issues",
"text": " Fixes: #47740 ```release-note envoy.httpUpstreamLingerTimeout accepts `0` as a chart value and templates into configmap. ``` Changes: * Helm chart accepts a value of `0` for `envoy.httpUpstreamLingerTimeout` * Helm chart templates value of `0` into configmap cc @jrajahalme [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47741",
"createdAt": "2026-08-04T14:11:35Z",
"updatedAt": "2026-08-12T22:42:28Z",
"timestamp": "2026-08-12T22:42:28Z",
"metrics": {
"reactions": 3,
"comments": 6
},
"labels": [
"release-note/bug",
"ready-to-merge",
"area/helm",
"kind/community-contribution",
"backport-done/1.20"
],
"author": "jdw6359",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:cc61d9a9e2eacc1f78f6",
"signalId": "github:cilium/cilium:pull_request:47754",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47754",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "fix: allow setting endpointPolicyUpdateTimeoutDuration in helm",
"text": "In helm, `endpointPolicyUpdateTimeoutDuration` defaulted to null , so the generated values.schema.json typed it as \"null\" only. Helm validates --set /values input against this schema before rendering, so any real duration string (e.g. \"30s\" ) was rejected on install/upgrade. so, widen the schema to string so an explicit duration reaches the ConfigMap template. ```release-note fix: allow setting endpointPolicyUpdateTimeoutDuration in helm ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47754",
"createdAt": "2026-08-05T00:42:57Z",
"updatedAt": "2026-08-12T22:42:26Z",
"timestamp": "2026-08-12T22:42:26Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"release-note/bug",
"ready-to-merge",
"area/helm",
"kind/community-contribution",
"backport-done/1.20"
],
"author": "weizhoublue",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:5e90f25434871b6f51c6",
"signalId": "github:cilium/cilium:pull_request:47587",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47587",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "docs: clarify GAMMA DROP_EP_NOT_READY events",
"text": "During workload churn, Hubble may report `DROP_EP_NOT_READY` when Envoy upstream TCP connections outlive the source endpoint. The behavioral change submitted in https://github.com/cilium/cilium/pull/46508 would likely add too much complexity for a somewhat cosmetic issue. This PR instead adds a note to the GAMMA docs to mention this caveat. Related to: #41970",
"url": "https://github.com/cilium/cilium/pull/47587",
"createdAt": "2026-07-29T17:30:59Z",
"updatedAt": "2026-08-12T22:42:25Z",
"timestamp": "2026-08-12T22:42:25Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"area/documentation",
"ready-to-merge",
"release-note/misc",
"area/servicemesh",
"feature/k8s-gateway-api",
"backport-done/1.20"
],
"author": "thorn3r",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:0c710a21fc7c59ed18e8",
"signalId": "github:cilium/cilium:pull_request:47885",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47885",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "v1.20 Backports 2026-08-10",
"text": "* [ ] #47587 (@thorn3r) * [x] #47780 (@giorio94) * [ ] #47208 (@iwanhae) * [ ] #47754 (@weizhoublue) * [ ] #47741 (@jdw6359) * [x] #47758 (@mhofstetter) * [x] #47766 (@mhofstetter) * [x] #47824 (@MrFreezeex) * [ ] #47838 (@aanm) * [x] #47844 (@bimmlerd) * [ ] #47801 (@aanm) Once this PR is merged, a GitHub action will update the labels of these PRs: ```upstream-prs 47587 47780 47208 47754 47741 47758 47766 47824 47838 47844 47801 ```",
"url": "https://github.com/cilium/cilium/pull/47885",
"createdAt": "2026-08-10T14:07:46Z",
"updatedAt": "2026-08-12T22:42:09Z",
"timestamp": "2026-08-12T22:42:09Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"kind/backports",
"feature/k8s-gateway-api",
"backport/1.20"
],
"author": "pippolo84",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:b3db9876377d159020c3",
"signalId": "github:cilium/cilium:pull_request:47903",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47903",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "golangci-lint: Fix `netlink.AddrList` escaping the forbidigo check",
"text": "The `ErrDumpInterrupted` pattern has been `(Handle\\.)?(\"AddrList|BridgeVlanList|...` since it was introduced. The double quote character makes the first alternative `\"AddrList`, which cannot match anything, so `netlink.AddrList` and `netlink.Handle.AddrList` have never been flagged. Fixing this surfaces three new previously accidentally ignored findings. This PR converts them to `safenetlink.AddrList`.",
"url": "https://github.com/cilium/cilium/pull/47903",
"createdAt": "2026-08-11T20:31:32Z",
"updatedAt": "2026-08-12T22:21:30Z",
"timestamp": "2026-08-12T22:21:30Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"ready-to-merge",
"release-note/misc"
],
"author": "HadrienPatte",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:9ec3f0c58e2b02bf567c",
"signalId": "github:cilium/cilium:issue:47913",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:issue:47913",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Netkit + endpointRoutes + hostNamespaceOnly reclassifies service replies as new flows",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.20.0 and lower than v1.21.0 ### What happened? I built a new single node cluster using \"modern Cilium settings\" and Tailscale Operator. The specific problematic settings are the combination of: - `bpf.datapathMode=netkit` - `endpointRoutes.enabled=true` - `socketLB.hostNamespaceOnly=true` ([required for Tailscale operator](https://tailscale.com/docs/kubernetes-operator/reference/compatibility#cilium-kube-proxy-replacement-mode)) The behaviours I saw included: - Hubble showing ephemeral source ports as destination ports - Cilium network policies would match the beginning of a connection (SYN) but not thereafter, causing traffic to fail unless I disabled network policies ### How can we reproduce the issue? Install cilium: ``` helm upgrade --install cilium cilium/cilium \\ --namespace kube-system \\ --version \"$CILIUM_VERSION\" \\ --wait --timeout 10m \\ --set image.repository=\"$CILIUM_IMAGE_REPO\" \\ --set image.tag=\"$CILIUM_IMAGE_TAG\" \\ --set image.useDigest=false \\ --set image.pullPolicy=Always \\ --set operator.image.repository=\"$CILIUM_OPERATOR_IMAGE_REPO\" \\ --set operator.image.tag=\"$CILIUM_IMAGE_TAG\" \\ --set operator.image.useDigest=false \\ --set ipam.mode=kubernetes \\ --set ipv6.enabled=true \\ --set ipv4.enabled=true \\ --set bpf.masquerade=true \\ --set bpf.datapathMode=netkit \\ --set bandwidthManager.enabled=true \\ --set bandwidthManager.bbr=true \\ --set bpf.distributedLRU.enabled=true \\ --set bpfClockProbe=true \\ --set endpointRoutes.enabled=true \\ --set routingMode=native \\ --set devices=enp2s0f0 \\ --set ipv4NativeRoutingCIDR=\"$NATIVE_ROUTING_CIDR_V4\" \\ --set ipv6NativeRoutingCIDR=\"$NATIVE_ROUTING_CIDR_V6\" \\ --set bgpControlPlane.enabled=true \\ --set nodePort.enabled=true \\ --set operator.replicas=1 \\ --set kubeProxyReplacement=true \\ --set socketLB.hostNamespaceOnly=true \\ --set securityContext.capabilities.ciliumAgent=\"{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}\" \\ --set securityContext.capabilities.cleanCiliumState=\"{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}\" \\ --set k8sServiceHost=localhost \\ --set k8sServicePort=7445 \\ --set cgroup.autoMount.enabled=false \\ --set cgroup.hostRoot=/sys/fs/cgroup \\ --set hubble.relay.enabled=true \\ --set hubble.relay.replicas=1 \\ --set hubble.ui.enabled=true \\ --set hubble.ui.replicas=1 \\ --set hubble.preferIpv6=true ``` 2. Deploy some containers. 3. Watch Hubble UI. Note how ingress traffic shows with destination port = ephemeral port ranges. These are the reply packets creating new sessions. 4. Add filters between components. A correctly designed strict filter will cause traffic to fail because the reply packets create new sessions. Please see attached screenshot from Hubble UI: ### Cilium Version v1.20.0 and main ### Kernel Version 6.18.42 on Talos 1.13.8 ### Kubernetes Version 1.36.2 ### Regression No known regression ### Sysdump Did not capture before developing the patch -- if this is truly important I can provide. ### Relevant log output ```shell `cilium-dbg monitor -v` with `Debug` and `DebugLB`. One flow, client ep 860 (`::7245`) β service `fd00:10:96::334c:3003`, backend ep 742 (`::8c2`): FROM 742 Attempting local delivery for container id 860 from seclabel 35952 FROM 860 CT lookup src=[::0:8c2]:3003 dst=[::0:7245]:34386 backend src FROM 860 CT verdict: Reply, revnat=42 FROM 860 Reverse NAT lookup, index=42 FROM 860 Performing reverse NAT, address.p4=4c330000 port=3003 -> endpoint 860 ... state reply ... [fd00:10:96::334c]:3003 -> ...:34386 FROM 860 Inheriting identity=35952 from stack FROM 860 CT lookup src=[::0:334c]:3003 dst=[::0:7245]:34386 service src FROM 860 CT verdict: New, revnat=42 FROM 860 Attempting local delivery for container id 860 from seclabel 21986 FROM 860 Conntrack create: proxy-port=0 revnat=0 src-identity=35952 -> endpoint 860 ... state new ... orig-ip fd00:10:96::334c The egress CT entry is created post-DNAT, keyed on the backend, so the service-addressed packet cannot match it: TCP OUT 172.31.32.4:59946 -> 172.31.32.140:3003 RevNAT=76 TCP SVC 172.31.32.4:59946 -> 10.111.71.201:3003 RevNAT=76 BackendID=160 ``` ### Anything else? _No response_ ### Cilium Users Document - [x] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47913",
"createdAt": "2026-08-12T09:28:06Z",
"updatedAt": "2026-08-12T21:44:48Z",
"timestamp": "2026-08-12T21:44:48Z",
"metrics": {
"reactions": 0,
"comments": 0
},
"labels": [
"kind/bug",
"area/datapath",
"kind/community-report"
],
"author": "evan314159",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:8b0f836d2d4f55440a91",
"signalId": "github:cilium/cilium:pull_request:47914",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47914",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: don't reclassify an already reverse-NATed service reply",
"text": "- [X] For first time contributors, read [Submitting a pull request] - [X] All code is covered by unit and/or runtime tests where feasible. - [X] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [X] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [X] All commits are signed off. See the section [Developerβs Certificate of Origin] - [X] Provide a title or release-note blurb suitable for the release notes. - [X] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. - [X] Thanks for contributing! On netkit + endpointRoutes + per-packet LB, a service reply is evaluated twice on the client's ingress path. The first pass matches conntrack and reverse-NATs the source to the service address; the packet is then re-delivered and evaluated again, now carrying an address that doesn't match the backend-keyed CT entry, and gets classified CT_NEW. This produces a spurious CT entry, a false Hubble flow showing the client as its own destination on an ephemeral port, and, with an ingress policy on the client, Policy denied drops of established connections' replies. Set a flag on ctx->tc_index after lb{4,6}_rev_nat() reverse-NATs a CT_REPLY packet; cil_to_container() reads and clears it on re-entry and delivers directly instead of re-running ingress. tc_index is used because it's the only per-packet state that survives the re-entry: CB_DELIVERY_FLAGS is cleared by bpf_clear_meta() and skb->mark is consumed by inherit_identity_from_host(), both confirmed via cilium-dbg monitor -v with Debug/DebugLB enabled. Fixes: #47913 ```release-note bpf: fix spurious CT_NEW reclassification of service replies on netkit with endpoint routes and per-packet load balancing, which caused incorrect Hubble flows and could drop replies to established connections under an ingress CiliumNetworkPolicy. ``` This PR was prepared with AIL:4. I personally validated the resulting network flows with and without policies, both visually via Hubble and by testing the affected applications. I could not find an existing test in the suite combining netkit + endpointRoutes + per-packet LB. Every netkit test that I found has per_packet_lb=0. Three tests enable per-packet LB and exercise bpf_lxc (skip_lb_xlate_lrp_per_packet_lb.c, tc_nodeport_lb_fragments.h, tc_lb_external_ips.h), but all three are netkit=0, endpoint_routes=0. The problem is easily reproducible (see #47913) and the fix is only a few simple lines, so building out a full test harness for netkit=1, endpoint_routes=1 seems disproportionate in this case, and I don't have the background in the code to know that the test case would be right. It was very obvious that the fix addressed the problem without obviously creating new problems (via Hubble UI, policies and applications working again).",
"url": "https://github.com/cilium/cilium/pull/47914",
"createdAt": "2026-08-12T09:53:24Z",
"updatedAt": "2026-08-12T21:36:22Z",
"timestamp": "2026-08-12T21:36:22Z",
"metrics": {
"reactions": 1,
"comments": 3
},
"labels": [
"release-note/bug",
"kind/community-contribution"
],
"author": "evan314159",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:ddce1a7162140a2afb91",
"signalId": "github:cilium/cilium:pull_request:47422",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47422",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "docs: warn that Ingress TLS termination does not support ALPN for gRPC",
"text": "Motivation: The Ingress TLS termination example does not configure ALPN protocol negotiation in the generated Envoy CiliumEnvoyConfig. gRPC requires ALPN to select the h2 protocol during the TLS handshake, so gRPC clients that correctly enforce ALPN (per the gRPC spec) fail to connect through a TLS-terminating Ingress with errors such as \"missing selected ALPN property\". The example previously worked only with `grpcurl`, which happened to mask the problem due to a grpc-go/grpc-core regression that has since been fixed upstream. A maintainer confirmed on the issue that Ingress support is being kept mostly as-is and that gRPC-over-TLS-termination should instead be documented as a Gateway API use case, since Cilium's Gateway API implementation already supports ALPN via `gatewayAPI.enableAlpn` (added in #32486). Adding equivalent ALPN support to the Ingress controller was explicitly declined for this issue. Approach: Update the Ingress TLS termination doc page to: - Note that ALPN negotiation is not supported for Ingress TLS termination, and link to the Gateway API gRPC example instead. - Remove the `grpcurl` gRPC-over-TLS-termination example snippets, since they only appeared to work due to the now-fixed grpc client bug and no longer represent a supported pattern. This is a documentation-only change; no user-visible runtime behavior changes, since Ingress TLS termination never negotiated ALPN in the first place. The change only prevents users from being misled by an example that appeared to work by accident. Validation: Manually reviewed the rendered RST for syntax consistency with other `.. Note::` blocks in Documentation/network/servicemesh/*.rst, and confirmed the `:ref:`gs_gateway_grpc`` target resolves to the label in Documentation/network/servicemesh/gateway-api/grpc.rst. Sphinx tooling (rstcheck/sphinx-build) was not available in this environment to run Documentation/check-build.sh directly. Fixes: #47206 ```release-note docs: Clarify that Ingress TLS termination does not support ALPN negotiation for gRPC, and point users to the Gateway API gRPC example instead. ``` Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> This PR was prepared with AIL:4 (AI-assisted drafting; human-directed and human-reviewed). I personally read the full rendered diff, verified the ALPN limitation described here matches the maintainer guidance in #47206 (keep Ingress as-is; point gRPC TLS-termination use cases at Gateway API), and confirmed the gs_gateway_grpc cross-reference target exists.",
"url": "https://github.com/cilium/cilium/pull/47422",
"createdAt": "2026-07-22T16:07:44Z",
"updatedAt": "2026-08-12T20:27:12Z",
"timestamp": "2026-08-12T20:27:12Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"release-note/misc",
"kind/community-contribution",
"needs-backport/1.20"
],
"author": "pujitha24",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:e56a1ecb6827639ec316",
"signalId": "github:cilium/cilium:pull_request:47840",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47840",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api/gamma: refresh CEC owner refs on route recreation",
"text": "When a GAMMA HTTPRoute is deleted and recreated with the same name, the generated CiliumEnvoyConfig is updated in place. Before this change, ensureEnvoyConfig() only replaced the spec and left the previous OwnerReferences unchanged. That meant the CEC could still be owned by the old route UID after the new route had been reconciled. In delete-and-recreate flows, Kubernetes garbage collection could then remove the CEC under the replacement route. Therefore, this commit updates the GAMMA CEC patch path to refresh OwnerReferences from the desired object as well. Note: it seemed as a pure golden input/output test wasn't ideal here to test the edge usecase",
"url": "https://github.com/cilium/cilium/pull/47840",
"createdAt": "2026-08-07T11:46:17Z",
"updatedAt": "2026-08-12T20:17:58Z",
"timestamp": "2026-08-12T20:17:58Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"kind/bug",
"release-note/bug",
"ready-to-merge",
"area/servicemesh",
"feature/k8s-gateway-api",
"needs-backport/1.20"
],
"author": "mhofstetter",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:fb661ec2c25f0bd2961c",
"signalId": "github:cilium/cilium:pull_request:47869",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47869",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "chore(deps): update docker.io/library/golang:1.25.12 docker digest to 2c7ebca (v1.18)",
"text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [docker.io/library/golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | stage | digest | `9006890` β `2c7ebca` | | [docker.io/library/golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | final | digest | `9006890` β `2c7ebca` | --- ### Configuration π
**Schedule**: (UTC) - Branch creation - \"on sunday\" - Automerge - At any time (no schedule defined) π¦ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β» **Rebasing**: Never, or you tick the rebase/retry checkbox. π **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). ",
"url": "https://github.com/cilium/cilium/pull/47869",
"createdAt": "2026-08-09T01:03:34Z",
"updatedAt": "2026-08-12T19:51:13Z",
"timestamp": "2026-08-12T19:51:13Z",
"metrics": {
"reactions": 0,
"comments": 4
},
"labels": [
"kind/enhancement",
"ready-to-merge",
"kind/backports",
"release-note/misc",
"kind/community-contribution",
"renovate/stop-updating",
"backport/1.18"
],
"author": "cilium-renovate[bot]",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:910449a1d8caa16ec9c5",
"signalId": "github:cilium/cilium:pull_request:45579",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:45579",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "[41867][Part6] Hybrid Routing Route Installation",
"text": "This is the route installation piece of Hybrid Routing [CFP](https://github.com/cilium/design-cfps/blob/main/cilium/CFP-32810-hybrid-routing-mode.md), building on the prior parts that introduced the subnet BPF map + statedb table, the topology decoder, and the regeneration fence. What this PR adds 1. Subnet table wiring - linuxNodeHandler now takes the statedb SubnetTable and, on every node update in hybrid mode, inserts the node's pod CIDRs as subnet entries. This lets the DP LPM lookup a pod IP to its owning subnet group and decide tunnel vs direct 2. Route installation for hybrid mode. - nodeUpdate no longer treats tunnel and direct routing as mutually exclusive installTunnelRoutes = n.enableEncapsulation(newNode) installDirectRoutes = n.nodeConfig.EnableAutoDirectRouting && !installTunnelRoutes both paths are evaluated independently 4. Stale-route cleanup on mode transition. - In hybrid mode a peer node can flip between tunnel eligible and direct eligible over its lifetime. On every update (not just firstAddition), we now delete any stale tunnel routes when tunneling is off and any stale direct routes when direct routing is off. - deleteNodeRoute now treats ESRCH (route not present) as success Follow up PRs Delegated IPAM Fix: https://github.com/cilium/cilium/pull/47367 Helm Support: https://github.com/cilium/cilium/pull/47368 Please ensure your pull request adheres to the following guidelines: - [ ] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [ ] All code is covered by unit and/or runtime tests where feasible. - [ ] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [ ] All commits are signed off. See the section [Developerβs Certificate of Origin](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo) - [ ] Provide a title or release-note blurb suitable for the release notes. - [ ] Write a short paragraph that states whether you used machine learning models (including LLMs and other generative AI), and indicate the rating using [AI Influence Level](https://danielmiessler.com/blog/ai-influence-level-ail). Example: \"This PR was prepared with AIL:3. I personally reviewed each line of the submission prior to opening this PR.\" - [ ] Thanks for contributing! Fixes: #issue-number ```release-note ```",
"url": "https://github.com/cilium/cilium/pull/45579",
"createdAt": "2026-04-23T17:02:20Z",
"updatedAt": "2026-08-12T19:37:01Z",
"timestamp": "2026-08-12T19:37:01Z",
"metrics": {
"reactions": 2,
"comments": 12
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "vanessachammas",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:f50def982fd098bcf00f",
"signalId": "github:cilium/cilium:pull_request:47902",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47902",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "golangci-lint: Forbid stdlib `net.Interface*` functions",
"text": "The Go stdlib `net.Interface*` family talks to the kernel over a netlink socket with no timeout, so it can block forever. This PR converts the two remaining offenders to `netlink/safenetlink` and add a forbidigo rule so new ones don't creep back in. Fixes: #15051",
"url": "https://github.com/cilium/cilium/pull/47902",
"createdAt": "2026-08-11T20:27:45Z",
"updatedAt": "2026-08-12T19:32:20Z",
"timestamp": "2026-08-12T19:32:20Z",
"metrics": {
"reactions": 3,
"comments": 1
},
"labels": [
"dont-merge/needs-release-note-label"
],
"author": "HadrienPatte",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:9719b550d12ce7b306a8",
"signalId": "github:cilium/cilium:pull_request:47888",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47888",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf, datapath: move IPv{6,4} direct routing address to runtime config",
"text": "This moves the `IPV{4,6}_DIRECT_ROUTING` params to runtime config. Please review per-commit. Related: https://github.com/cilium/cilium/issues/38370",
"url": "https://github.com/cilium/cilium/pull/47888",
"createdAt": "2026-08-10T18:38:01Z",
"updatedAt": "2026-08-12T19:24:22Z",
"timestamp": "2026-08-12T19:24:22Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"area/loader",
"area/datapath",
"release-note/misc"
],
"author": "viktor-kurchenko",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:f72c30e692e1bb0a821e",
"signalId": "github:cilium/cilium:pull_request:47791",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47791",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "standalone-dns-proxy: return an error when no endpoint is found",
"text": "`LookupRegisteredEndpoint` reported a lookup miss as (nil, false, nil). The shared `ServeDNS` caller only inspects the returned error before using the endpoint, so it dereferenced the nil endpoint and panicked the whole proxy: ``` panic: runtime error: invalid memory address or nil pointer dereference github.com/cilium/cilium/pkg/endpoint.(*Endpoint).StringID(...) pkg/endpoint/endpoint.go:848 github.com/cilium/cilium/pkg/fqdn/dnsproxy.(*DNSProxy).ServeDNS(...) pkg/fqdn/dnsproxy/proxy.go:983 ``` The IP to endpoint table is a snapshot replicated from the agent, so an endpoint can in principle send a DNS request before its IP has been received. This has not been observed in steady state, but it becomes likely during a burst of endpoint creation: starting a batch of pods selected by a `toFQDNs` policy on a single node reproduced it consistently, with the new pods' source IPs still absent from the table while they were already resolving. Because the panic takes down the proxy process, a single such request breaks DNS for every endpoint on the node. The agent's own implementation of this interface always returns a non-nil error when it cannot resolve an endpoint, which is why only the standalone DNS proxy was affected. Match that contract so a miss is reported as an error, and the request is answered with SERVFAIL instead of crashing. AIL: 2 ```release-note standalone-dns-proxy: return an error when no endpoint is found ```",
"url": "https://github.com/cilium/cilium/pull/47791",
"createdAt": "2026-08-05T21:01:09Z",
"updatedAt": "2026-08-12T19:23:55Z",
"timestamp": "2026-08-12T19:23:55Z",
"metrics": {
"reactions": 2,
"comments": 8
},
"labels": [
"kind/bug",
"release-note/bug",
"ready-to-merge",
"area/fqdn",
"affects/v1.19",
"needs-backport/1.19",
"needs-backport/1.20",
"affects/v1.20"
],
"author": "vipul-21",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:22f15b356bc6ba38d950",
"signalId": "github:cilium/cilium:pull_request:47679",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47679",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "chore(deps): update all-dependencies (v1.19)",
"text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [docker.io/library/ubuntu](https://hub.docker.com/_/ubuntu) ([source](https://git.launchpad.net/cloud-images/+oci/ubuntu-base)) | final | digest | `4fbb8e6` β `561618e` | | quay.io/cilium/cilium-bpftool | stage | patch | `7.7.0-1782898005-bed4da5` β `7.7.0-1785833026-d8383c5` | | quay.io/cilium/cilium-llvm | stage | patch | `19.1.7-1782898005-bed4da5` β `19.1.7-1785833026-d8383c5` | | quay.io/cilium/image-compilers | stage | major | `1782994507-725357c` β `1785833026-d8383c5` | | quay.io/cilium/image-tester | final | major | `1785158849-4e7b7fc` β `1785710666-8cd4afc` | | quay.io/cilium/iptables | stage | patch | `1.8.8-1-1782898005-bed4da5` β `1.8.8-1-1785833026-d8383c5` | --- ### Configuration π
**Schedule**: (UTC) - Branch creation - \"on sunday\" - Automerge - At any time (no schedule defined) π¦ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β» **Rebasing**: Never, or you tick the rebase/retry checkbox. π» **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). ",
"url": "https://github.com/cilium/cilium/pull/47679",
"createdAt": "2026-08-02T20:50:20Z",
"updatedAt": "2026-08-12T18:42:23Z",
"timestamp": "2026-08-12T18:42:23Z",
"metrics": {
"reactions": 2,
"comments": 9
},
"labels": [
"kind/enhancement",
"kind/backports",
"release-note/misc",
"kind/community-contribution",
"renovate/stop-updating",
"backport/1.19"
],
"author": "cilium-renovate[bot]",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:c533f77bf91737310c2f",
"signalId": "github:cilium/cilium:pull_request:47231",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47231",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "fix: Prevent Installation Failures When Hubble TLS Uses External Certificate Volumes",
"text": "PR #46688 introduces disableDefaultVolumes=true to let `extraVolumes/extraVolumeMounts` provide TLS certificates. Since Ciliumβs built-in certificates are no longer used, administrators do not need to configure `.Values.hubble.relay.tls.client.cert` and `.Values.hubble.relay.tls.client.key` Although these built-in secrets are no longer mounted into pod, their templates still attempt to render them. They still try to read empty `.Values.hubble.relay.tls.client.cert` and `.Values.hubble.relay.tls.client.key`, causing Secret rendering to fail: ``` kind: Secret metadata: name: hubble-relay-client-certs ... data: ca.crt: {{ .Values.tls.ca.cert }} tls.crt: {{ .Values.hubble.relay.tls.client.cert | required \"missing hubble.relay.tls.client.cert\" }} tls.key: {{ .Values.hubble.relay.tls.client.key | required \"missing hubble.relay.tls.client.key\" }} ``` Therefore, Secret generation should include a disableDefaultVolumes condition and skip these Secrets when external certificate volumes are enabled. Fixes: #issue-number ```release-note fix: Prevent Installation Failures When Hubble TLS Uses External Certificate Volumes ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47231",
"createdAt": "2026-07-16T02:31:35Z",
"updatedAt": "2026-08-12T18:38:15Z",
"timestamp": "2026-08-12T18:38:15Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"kind/bug",
"release-note/bug",
"ready-to-merge",
"area/helm",
"kind/community-contribution",
"area/hubble"
],
"author": "weizhoublue",
"state": "closed",
"assignees": [
"weizhoublue"
],
"change": "updated"
}
},
{
"id": "event:710178abfa173e0b96b5",
"signalId": "github:cilium/cilium:issue:47918",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:issue:47918",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Label Filters don't treat prefix as a regex when loaded from file",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.19.6 and lower than v1.20.0 ### What happened? When loading identity-related label filters via `label-prefix-file` the label can only be provided as a string prefix and not as a regex. [The documentation](https://docs.cilium.io/en/latest/operations/performance/scalability/identity-relevant-labels/) is quite light on details about this file-based approach so this might be expected behaviour but as the docs speak heavily about using regex for the label filters it seems like a mistake to me that the file-based approach doesn't follow the same logic. ### How can we reproduce the issue? 1. Create a file with the following contents: ```json { \"version\": 1, \"valid-prefixes\": [ {\"prefix\": \"app$\", \"source\": \"k8s\"}, {\"prefix\":\".*\",\"source\":\"reserved\"} ] } ``` 2. Pass this in to Cilium via the `label-prefix-file` configuration flag 3. Launch a pod with an `app` label defined 4. Observe that the `app` label isn't matched and included on the CiliumIdentity ### Cilium Version 1.19.1 ### Kernel Version 6.12.88 ### Kubernetes Version 1.34.9 ### Regression _No response_ ### Sysdump _No response_ ### Relevant log output ```shell ``` ### Anything else? _No response_ ### Cilium Users Document - [ ] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47918",
"createdAt": "2026-08-12T15:04:30Z",
"updatedAt": "2026-08-12T18:17:32Z",
"timestamp": "2026-08-12T18:17:32Z",
"metrics": {
"reactions": 0,
"comments": 1
},
"labels": [
"kind/bug",
"kind/community-report",
"area/agent"
],
"author": "AverageMarcus",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:aca5996829d47bbd4a8f",
"signalId": "github:cilium/cilium:pull_request:47802",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47802",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ces: fix shutdown deadlock",
"text": "Integration test runs timed out due to a deadlock on shutting down the hive. When both queues are empty _and shutting down_ a `getQueue` call could get stuck waiting on the condition variable which was never broadcasted. AIL:2 - AI investigated CI logs and pointed towards the problem, I wrote the code. ```release-note Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. ```",
"url": "https://github.com/cilium/cilium/pull/47802",
"createdAt": "2026-08-06T07:05:02Z",
"updatedAt": "2026-08-12T18:05:28Z",
"timestamp": "2026-08-12T18:05:28Z",
"metrics": {
"reactions": 2,
"comments": 6
},
"labels": [
"kind/bug",
"release-note/bug",
"ready-to-merge",
"feature/ces",
"affects/v1.18",
"affects/v1.19",
"needs-backport/1.20"
],
"author": "bimmlerd",
"state": "closed",
"assignees": [
"bimmlerd"
],
"change": "updated"
}
},
{
"id": "event:71621432ea7f42d05785",
"signalId": "github:cilium/cilium:pull_request:46746",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:46746",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "aws/ipam: retry prefix ENI in eligible sibling subnets before /32 falβ¦",
"text": "Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! Fixes: #46644 When ENI prefix delegation is enabled and CreateNetworkInterface fails with InsufficientCidrBlocks (subnet fragmented: free /32s but no contiguous /28 capacity), the operator previously fell back immediately to /32 in the same subnet without trying eligible sibling subnets in the same AZ. This PR refactors findSuitableSubnet to return an ordered slice of subnets (by AvailableAddresses descending) instead of a single best subnet. For non-PD cases, subnets[0] is used as before. For PD cases, CreateInterface loops through the slice attempting prefix creation on each subnet before falling back to /32 in the original subnet. - Add FindSubnetByIDsSorted and FindSubnetByTagsSorted to InstancesManager returning all matching subnets sorted by AvailableAddresses descending - Replace findSubnetInSameRouteTableWithNodeSubnet with findSubnetInSameRouteTableWithNodeSubnetSorted returning a sorted slice - In the NodeSubnetID branch, append route-table sibling subnets as retry candidates for PD fallback - Also ports the reporter's mock patch and test file to main and updates tests to assert correct post-fix behavior Automatic recovery for already-degraded nodes is deferred to a follow-up PR. AIL:3. I personally verified all code changes, test correctness, and the fix logic. ```release-note Fix ENI prefix delegation to retry sibling subnets before falling back to /32 allocation when a subnet is fragmented ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/46746",
"createdAt": "2026-06-26T09:54:18Z",
"updatedAt": "2026-08-12T18:00:44Z",
"timestamp": "2026-08-12T18:00:44Z",
"metrics": {
"reactions": 2,
"comments": 7
},
"labels": [
"area/eni",
"dont-merge/needs-release-note-label",
"kind/community-contribution",
"dont-merge/discussion"
],
"author": "nebojsaj1726",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:e2b2e901e587acc6070f",
"signalId": "github:cilium/cilium:pull_request:47858",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47858",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "health/client: replace deprecated http.Transport.Dial with DialContext",
"text": "`http.Transport.Dial` has been deprecated since Go 1.7 (`SA1019`) in favor of `DialContext`, which allows the transport to cancel dials as soon as they are no longer needed. Per the Go docs, if both fields are set `DialContext` takes priority β so the current code is effectively opting out of context-aware dialing on every request the Cilium health checker's HTTP client makes. This PR migrates the two assignments in `configureTransport` (`pkg/health/client/client.go`) to `DialContext`, preserving existing behavior exactly: - **`unix` branch** β the existing closure is wrapped in the `DialContext` signature. The extra `context.Context` argument is intentionally ignored so the dial semantics do not change: it still targets the `proto`/`addr` values captured from the outer scope. - **fallback branch** β `(&net.Dialer{}).Dial` is swapped for its `DialContext` method value, which is the direct, semantically equivalent replacement. No behavior change is expected for callers of the health client. Ref: #32274 ## Testing - `go vet ./pkg/health/client/...` - `GOOS=linux go build ./pkg/health/...` - `GOOS=linux go test -c ./pkg/health/client` (verifies clean cross-compilation for the deployment target) - `go test ./pkg/health/client/...` (unit tests pass natively on darwin) ## AI usage This PR was prepared with AIL:3. I used LLM assistance to locate the remaining `tr.Dial` call sites in `pkg/health/client/client.go`, draft the minimal-scope diff, and prepare this description. I personally reviewed the diff, verified the replacement preserves existing semantics on both branches of `configureTransport`, and ran the validation commands above. ```release-note NONE",
"url": "https://github.com/cilium/cilium/pull/47858",
"createdAt": "2026-08-09T00:20:28Z",
"updatedAt": "2026-08-12T17:59:48Z",
"timestamp": "2026-08-12T17:59:48Z",
"metrics": {
"reactions": 1,
"comments": 1
},
"labels": [
"release-note/misc",
"kind/community-contribution"
],
"author": "uuditmisra",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:f450b79026f2ff8fe53b",
"signalId": "github:cilium/cilium:pull_request:47820",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47820",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "fix(docs): make render-docs target work on macOS",
"text": "This is a small quality-of-life improvement for contributors working on the documentation on macOS. The alternative is to document a workaround, but that would require contributors to provide additional tar configuration manually. When `make render-docs` runs on macOS, BSD tar records the host-specific UID and GID in the Docker build context. These values can exceed the limits supported by the tar headers consumed by Linux Docker tooling, causing the build context to be parsed incorrectly and the image build to fail. This change normalizes the archive ownership to UID and GID 0, making the Docker build context portable across macOS and Linux. `make render-docs` failed on macOS because BSD tar included macOS-specific metadata in the Docker build context which exceeds the header limits imposed by tar on Linux. macOS adds ownership data that makes Linux tooling interpret the tail of the ownership metadata as the start of the Dockerfile which cause the build to fail. This change normalize the ownership so it pass on both OSs. Tests - make -C Documentation builder-image - make -C Documentation html SKIP_BUILDER_IMAGE=1 - make render-docs on macOS Don't own a Linux machine so that test would be valuable to run. This PR was prepared with AIL:3. I personally reviewed the change and verified the documentation build in a Linux Docker environment. Fixes: N/A ```release-note docs: Make `render-docs` work on macOS. ```",
"url": "https://github.com/cilium/cilium/pull/47820",
"createdAt": "2026-08-06T15:06:35Z",
"updatedAt": "2026-08-12T16:35:41Z",
"timestamp": "2026-08-12T16:35:41Z",
"metrics": {
"reactions": 2,
"comments": 11
},
"labels": [
"area/documentation",
"ready-to-merge",
"release-note/misc",
"area/build",
"kind/community-contribution"
],
"author": "eufriction",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:404183680f185c39c199",
"signalId": "github:cilium/cilium:pull_request:47845",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47845",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "policy: fix bug causing policies using label selectors of long namespace labels being dropped",
"text": "This PR ensures we correctly calculate the length of label selectors when doing validation, ensuring we support all valid kubernetes labels. See commit messages for more information. Also add a test to catch a potential regression. Fixes: #47817 ```release-note Fix bug causing policies using label selectors of long namespace labels being dropped ``` AIL 2/3: AI helped on the txtar test and I wrote the code and did the all the rest. [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47845",
"createdAt": "2026-08-07T13:09:51Z",
"updatedAt": "2026-08-12T16:31:32Z",
"timestamp": "2026-08-12T16:31:32Z",
"metrics": {
"reactions": 2,
"comments": 6
},
"labels": [
"release-note/bug",
"sig/policy"
],
"author": "odinuge",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:5320376e61d292272c7e",
"signalId": "github:cilium/cilium:pull_request:47854",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47854",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "k8s: migrate from legacy config to ClusterInfo",
"text": "Migrate the functions exposed from the k8s package to use the ClusterInfo struct to depends less on the legacy config. Sorry for the many codeowners involved, those k8s functions are called in a bunch of places unfortunately :sweat_smile:. I prepared this commit using AIL-2",
"url": "https://github.com/cilium/cilium/pull/47854",
"createdAt": "2026-08-08T16:54:06Z",
"updatedAt": "2026-08-12T16:30:47Z",
"timestamp": "2026-08-12T16:30:47Z",
"metrics": {
"reactions": 2,
"comments": 9
},
"labels": [
"area/k8s",
"area/clustermesh",
"release-note/misc"
],
"author": "MrFreezeex",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:64e3a9cf6e2f58dcbee4",
"signalId": "github:cilium/cilium:pull_request:47906",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47906",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "hubble: Add Kubernetes Pod UID to flow endpoints",
"text": "Hubble currently identifies a Pod mainly by cluster, namespace, and name. Kubernetes permits a deleted objectβs name to be reused, while its UID uniquely identifies that specific object lifetime. This matters especially for StatefulSet Pods, but applies to any recreated Pod. Adding the UID to endpoints permits correct flow attribution and lets consumers distinguish Pod instances and possibly group by/correlate with other datasources. This also improves Cilium's correctness: - IPCache deletion now checks UID, preventing a delayed Pod, CEP, or CES deletion from removing metadata belonging to a replacement Pod. - UID-only Pod lifecycle changes are recognized instead of being skipped. - Drop k8s events (from the Hubble drop event emitter) use the UID captured in the flow instead of resolving whichever Pod currently owns that namespace/name. Also, UID remains optional when metadata is unavailable or components are running mixed versions. This PR was prepared with AIL:4. Codex + GPT 5.6 sol made the mechanical changes and I reviewed/revised some implementation details afterward. ```release-note Hubble flow endpoints now include the Kubernetes Pod UID. ```",
"url": "https://github.com/cilium/cilium/pull/47906",
"createdAt": "2026-08-11T23:04:50Z",
"updatedAt": "2026-08-12T16:02:53Z",
"timestamp": "2026-08-12T16:02:53Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"release-note/minor",
"sig/policy",
"area/hubble"
],
"author": "devodev",
"state": "open",
"assignees": [
"devodev"
],
"change": "updated"
}
},
{
"id": "event:636f3defa709a50394fe",
"signalId": "github:cilium/cilium:pull_request:47463",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47463",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api: nodeSelector with hostNetwork enabled",
"text": " As noted in #47456, the node addresses all get added when hostNetwork is enabled. If a user enables Cilium + GWAPI with hostnetwork enabled and labels a node or nodes, then only those address should populate the gateway ip address. Adding in test case to ensure functionality Fixes: #47456 ```release-note gateway-api: node label selector for when hostNetwork is enabled ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47463",
"createdAt": "2026-07-24T17:55:12Z",
"updatedAt": "2026-08-12T17:25:56Z",
"timestamp": "2026-08-12T17:25:56Z",
"metrics": {
"reactions": 2,
"comments": 6
},
"labels": [
"release-note/minor",
"dont-merge/needs-rebase",
"feature/k8s-gateway-api",
"needs-backport/1.18",
"needs-backport/1.19",
"needs-backport/1.20"
],
"author": "xtineskim",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:f5db39feb4da6794e4c9",
"signalId": "github:cilium/cilium:pull_request:47558",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47558",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "network driver: use statedb to manage agent devices",
"text": "using statedb to manage the agent state for devices removed the map based state tracking for allocations, replacing it with a statedb table cilium-dbg output: ``` -- [ { \"Name\": \"dummy0\", \"Manager\": \"\\\"dummy\\\"\", \"Dev\": { \"Name\": \"dummy0\", \"HWAddr\": \"\", \"MTU\": 0, \"Flags\": \"\" }, \"Pool\": \"dt-dummy\", \"Attrs\": [ { \"k\": \"ifName\", \"v\": { \"string\": \"dummy0\" } }, { \"k\": \"kernelIfName\", \"v\": { \"string\": \"dummy0\" } } ], \"PodUID\": \"0fdc978d-c34b-40b9-9284-19506c5be5b0\", \"ClaimUID\": \"38d14248-58c3-4d0c-ba1c-60793681f656\", \"Config\": { \"podIfName\": \"dmy0\" } }, { \"Name\": \"dummy1\", \"Manager\": \"\\\"dummy\\\"\", \"Dev\": { \"Name\": \"dummy1\", \"HWAddr\": \"\", \"MTU\": 0, \"Flags\": \"\" }, \"Pool\": \"dt-dummy\", \"Attrs\": [ { \"k\": \"ifName\", \"v\": { \"string\": \"dummy1\" } }, { \"k\": \"kernelIfName\", \"v\": { \"string\": \"dummy1\" } } ], \"PodUID\": \"\", \"ClaimUID\": \"\", \"Config\": {} } ] ``` ```release-note network driver: use statedb to manage agent state ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail AIL3 - bot wrote code; human reviewed, adjusted and tested [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47558",
"createdAt": "2026-07-28T08:58:01Z",
"updatedAt": "2026-08-12T15:37:27Z",
"timestamp": "2026-08-12T15:37:27Z",
"metrics": {
"reactions": 2,
"comments": 13
},
"labels": [
"release-note/misc",
"dont-merge/discussion",
"area/dra-plugin"
],
"author": "bersoare",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:e66862e4617e100266ba",
"signalId": "github:cilium/cilium:pull_request:47678",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47678",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "chore(deps): update all-dependencies (v1.20)",
"text": "This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [docker.io/library/ubuntu](https://hub.docker.com/_/ubuntu) ([source](https://git.launchpad.net/cloud-images/+oci/ubuntu-base)) | final | digest | `3131b4c` β `678c655` | | quay.io/cilium/cilium-bpftool | stage | patch | `7.7.0-1782898005-bed4da5` β `7.7.0-1785833026-d8383c5` | | quay.io/cilium/cilium-llvm | stage | patch | `19.1.7-1782898005-bed4da5` β `19.1.7-1785833026-d8383c5` | | quay.io/cilium/image-tester | final | major | `1785158849-4e7b7fc` β `1785710666-8cd4afc` | | quay.io/cilium/iptables | stage | patch | `1.8.8-1-1782898005-bed4da5` β `1.8.8-1-1785833026-d8383c5` | --- ### Configuration π
**Schedule**: (UTC) - Branch creation - \"on sunday\" - Automerge - At any time (no schedule defined) π¦ **Automerge**: Disabled by config. Please merge this manually once you are satisfied. β» **Rebasing**: Never, or you tick the rebase/retry checkbox. π» **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). ",
"url": "https://github.com/cilium/cilium/pull/47678",
"createdAt": "2026-08-02T20:49:44Z",
"updatedAt": "2026-08-12T15:31:26Z",
"timestamp": "2026-08-12T15:31:26Z",
"metrics": {
"reactions": 2,
"comments": 18
},
"labels": [
"kind/enhancement",
"kind/backports",
"release-note/misc",
"kind/community-contribution",
"renovate/stop-updating",
"backport/1.20"
],
"author": "cilium-renovate[bot]",
"state": "closed",
"assignees": [
"joestringer"
],
"change": "updated"
}
},
{
"id": "event:d946685f7ddde717db44",
"signalId": "github:cilium/cilium:pull_request:46641",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:46641",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "scaletozero: add datapath demand signalling for service scale-to-zero",
"text": "This is the datapath part of #44027. Cilium publishes demand, holds new connections while a service is cold, and an external autoscaler does the scaling. A service opts in with `service.cilium.io/scale-to-zero`. Cilium then exports a per-service gauge, `cilium_scale_to_zero_service_demand`, that an autoscaler such as KEDA reads to scale the workload to and from zero. While a tracked service sits at zero backends, the datapath holds new connections instead of rejecting them, so the first request survives the cold start. Off by default behind `--enable-scale-to-zero`. Demand is the service's live-connection count, floored to at least 1 for 90s after a datapath \"demand signal\" so the autoscaler can wake a service that is sitting at zero. How it works: - A pinned BPF hash (`cilium_scale_to_zero`, keyed by `rev_nat_index`) holds the opted-in services. The agent owns membership, the datapath only reads it and stamps a per-service, rate-limited (30s) timestamp. - The signal fires on the socket-LB forward path (every east-west translation, so short pod to ClusterIP traffic keeps demand warm) and at `lb{4,6}_local`'s `no_service` (zero-backend hit, so a cold service wakes). L7-LB services are gated out. - Holding: for a tracked, zero-backend service, `lb{4,6}_local` returns `DROP_SERVICE_SCALED_TO_ZERO` (-207) instead of `DROP_NO_SERVICE`, so callers skip the no-backend ICMP reply and the SYN is silently dropped; the client retransmits and connects once a backend appears. Socket-LB passes such connections through untranslated (`-ENXIO`) so the per-packet path performs the hold, and `ENABLE_SCALE_TO_ZERO` compiles in per-packet LB so that fallback exists under full socket-LB. Host netns keeps the fast reject, as it has no per-packet ClusterIP LB. - The controller drains signals and every 30s recomputes live connections from service conntrack (north-south) and the sock reverse-NAT map (east-west socket-LB). It checks each sock entry's cookie against live sockets, because those entries are never cleaned up on netns teardown, then publishes the gauge and prunes stale series. Limitations: - L7 (Ingress, Gateway API, `lb-l7`) not supported, Envoy bypasses the datapath lookup. - hostNetwork clients fast-reject instead of holding. ```release-note datapath: add scale-to-zero demand signalling for services behind --enable-scale-to-zero ``` AI disclosure: this PR was prepared with AIL:3. I wrote the original proof of concept by hand (attached in the CFP, #44027). I then used an AI agent to implement the hold-instead-of-reject datapath change, root-cause and fix the east-west socket-LB case (the `ENABLE_PER_PACKET_LB` gate), write the BPF and Go tests, and run the end-to-end validation on live kind clusters (KEDA and Prometheus, IPv4/IPv6, TCP/UDP/Postgres). I reviewed the code and ran the checks myself. https://github.com/user-attachments/assets/23114427-8d03-4a73-a7aa-8548f0a8997a",
"url": "https://github.com/cilium/cilium/pull/46641",
"createdAt": "2026-06-18T20:38:24Z",
"updatedAt": "2026-08-12T15:28:00Z",
"timestamp": "2026-08-12T15:28:00Z",
"metrics": {
"reactions": 3,
"comments": 5
},
"labels": [
"release-note/major",
"dont-merge/needs-rebase",
"kind/community-contribution"
],
"author": "isala404",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:ea811cfb45f55d5892bc",
"signalId": "github:cilium/cilium:pull_request:47034",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47034",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Add various routing fixes for ENI IPv6 support",
"text": "# What is this This PR fixes three issues with IPv6 on ENI. 1. Fixes a bug where if the health check endpoint IP is an IPv6, the ENI specific routing for IPv6 would not be configured. This removes this limitation by filling the routing table for IPv6 health endpoints. 2. When IPSec is enabled on EKS, the pod subnets are determined using the routing info CIDR. Previously only IPv4 CIDRs were parsed. Now both IPv4 and IPv6 pod subnets are filled. 3. When Ingress IP is used with IPv6 enabled, this change makes sure the routing rules are configured similar to how they are configured for IPv4. # Testing For the health check endpoint, I was able to validate that before the fix, on a node with only IPv6 enabled, the main v6 routing table was missing an entry for `lxc_health`. Following the fix, the table now shows the route to the health check endpoint: ```bash 1234:[...]::bded dev lxc_health proto kernel metric 1024 pref medium ``` And curling the endpoint shows it as reachable ```bash curl http://[1234:[...]::bded ]:4240/hello -v * Trying [1234:[...]::bded ]:4240... * Connected to 1234:[...]::bded (1234:[...]::bded ) port 4240 > GET /hello HTTP/1.1 > Host: [1234:[...]::bded ]:4240 > User-Agent: curl/8.5.0 > Accept: */* > < HTTP/1.1 200 OK < Content-Length: 0 < * Connection #0 to host 1234:[...]::bded left intact ``` For the IPSec bug, I couldn't really test it since we don't run this kind of setup. # Release note ```release-note ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. ``` This PR was prepared with AIL:2.",
"url": "https://github.com/cilium/cilium/pull/47034",
"createdAt": "2026-07-09T13:06:55Z",
"updatedAt": "2026-08-12T15:21:43Z",
"timestamp": "2026-08-12T15:21:43Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"release-note/minor",
"area/eni",
"feature/ipv6"
],
"author": "41ks",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:f330bcde0b58fad2c0fe",
"signalId": "github:cilium/cilium:pull_request:47571",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47571",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "operator: continue identity GC after update races",
"text": "Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo) - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Write a short paragraph that states whether you used machine learning models (including LLMs and other generative AI), and indicate the rating using [AI Influence Level](https://danielmiessler.com/blog/ai-influence-level-ail). - [x] Thanks for contributing! CRD identity GC first annotates an unused identity, then deletes it on a later pass. If that identity is updated, deleted, or replaced after it is read from the local store, the annotation update can return a conflict or not-found error. The current code aborts the entire GC pass, so frequent identity churn can prevent unrelated stale identities later in the scan from progressing toward deletion. This change treats those two recoverable races like the existing delete-conflict path: it logs a warning and defers only the raced identity to the next pass. Other API errors still fail the GC run, preserving the signal for systemic control-plane failures. Validation: - `go test ./operator/identitygc` - `gofmt` and `git diff --check` This PR was prepared with AIL:4. The resulting diff was reviewed against the existing GC conflict handling and validated with the focused unit test before submission. ```release-note Prevent concurrent CRD identity updates from aborting an entire identity garbage-collection pass. ```",
"url": "https://github.com/cilium/cilium/pull/47571",
"createdAt": "2026-07-28T18:01:25Z",
"updatedAt": "2026-08-12T15:16:38Z",
"timestamp": "2026-08-12T15:16:38Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "hbagdi",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:095a6036fcd0fc9f7f7d",
"signalId": "github:cilium/cilium:pull_request:46609",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:46609",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "sysdump: contain WithFileSink output to the sysdump directory",
"text": "- [ ] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [ ] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! WithFileSink joins a caller-supplied name to the sysdump directory and opens it, with no containment check. SubmitCniConflistSubtask feeds it filenames taken from `ls -1` run inside a target pod, so the names are controlled by the pod rather than the CLI. - a name like `../../../../etc/foo` resolves outside the sysdump directory through AbsoluteTempPath - the collected file contents are then written to that path on the host running `cilium sysdump` - guarded WithFileSink itself so every caller is covered, reusing the prefix check the extractZip helper already applies Added a regression test covering a normal name and an escaping one. ```release-note sysdump: reject collected file names that resolve outside the sysdump directory ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/46609",
"createdAt": "2026-06-17T07:42:22Z",
"updatedAt": "2026-08-12T15:14:30Z",
"timestamp": "2026-08-12T15:14:30Z",
"metrics": {
"reactions": 2,
"comments": 6
},
"labels": [
"release-note/bug",
"kind/community-contribution",
"cilium-cli",
"cilium-cli-exclusive"
],
"author": "sage-mode-hunter",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:8c0706c9a4e27a1398af",
"signalId": "github:cilium/cilium:pull_request:45713",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:45713",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "hubble: refactor local node watcher as a cell",
"text": " Move the `LocalNodeWatcher` from `pkg/hubble/observer` into `pkg/hubble/parser` and inject it into the `PayloadParser` to populate `node_labels` and `NodeName` during flow parsing, rather than via observer hooks - Add a `Run` method for lifecycle management via `job.OneShot` - Set `node_labels` and `NodeName` at the two flow paths in `Decode()` - Derive `NodeName` from `LocalNode` using `Node.Fullname()` instead of `MonitorEvent.NodeName` - Remove the inline watcher creation from `hubbleintegration.go` Fixes: #40062 ```release-note hubble: Refactor the local node watcher as a hive cell ```",
"url": "https://github.com/cilium/cilium/pull/45713",
"createdAt": "2026-05-01T15:52:11Z",
"updatedAt": "2026-08-12T15:13:54Z",
"timestamp": "2026-08-12T15:13:54Z",
"metrics": {
"reactions": 2,
"comments": 7
},
"labels": [
"dont-merge/needs-rebase",
"release-note/misc",
"kind/community-contribution",
"area/hubble"
],
"author": "puwun",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:9eec97f79ad4d2357b8f",
"signalId": "github:cilium/cilium:pull_request:46951",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:46951",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "feat(endpoint): add managed endpoint table",
"text": "Add a StateDB table for Cilium-managed endpoint metadata. The table is populated from CEP/CES resources and kvstore IPIdentityPair updates, and it stores per-producer source assertions so doublewrite mode can merge equivalent CRD/CES and kvstore entries without guessing by IP, identity, or labels. Kvstore IPIdentityPair metadata now carries the CEP name written by the local endpoint. That gives kvstore entries a semantic bridge back to the CEP/CES endpoint key while preserving the existing global endpoint metadata as an alias for grouping kvstore IPv4/IPv6 entries. This is the first PR in the endpoint-table direction discussed in #46459. It intentionally stops before moving egress gateway onto the table; that consumer change will follow separately once the table shape is reviewed. Preview consumer branch, not an upstream PR: [EGW managed endpoint table consumer](https://github.com/pamelia/cilium/compare/codex%2Fmanaged-endpoint-table...codex%2Fegw-managed-endpoint-preview). The compare is against this PR's branch, so it shows only the follow-up egress gateway consumer changes. Related: #46459 ```release-note Cilium now maintains an internal StateDB table for Cilium-managed endpoint metadata from CEP/CES and kvstore sources. ``` This PR has no direct user-facing behavior change and is labeled `release-note/misc`. This PR was prepared with LLM assistance (AIL:4). I reviewed the resulting diff, kept the scope to the endpoint metadata/table layer, removed environment-specific test data, and ran focused package tests locally. Signed-off-by: Marcus Pamelia ",
"url": "https://github.com/cilium/cilium/pull/46951",
"createdAt": "2026-07-07T09:58:40Z",
"updatedAt": "2026-08-12T14:58:11Z",
"timestamp": "2026-08-12T14:58:11Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"sig/policy",
"release-note/misc",
"kind/community-contribution"
],
"author": "pamelia",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:51fbfc22867fd3eb8213",
"signalId": "github:cilium/cilium:pull_request:46473",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:46473",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: host: pass IPv6 to the stack when the IPv6 datapath is disabled",
"text": "When the host firewall is enabled but the IPv6 datapath is compiled out (`enable-ipv6=false`), bpf_host drops all IPv6 packets on managed devices as `DROP_UNKNOWN_L3` (\"Unsupported L3 protocol\") β in both directions and before any policy evaluation. This breaks IPv6 neighbor discovery for the node and, with it, any node-level IPv6 connectivity, e.g. BGP unnumbered peering over link-local addresses on L3 fabrics. No host policy can allow the traffic back, since the drop happens before policy enforcement. Without the host firewall, the same packets are passed to the kernel stack. This PR restores that behavior for the IPv6 ethertype when `ENABLE_IPV6` is not compiled in: the host firewall cannot enforce policies on a protocol it cannot parse, and dropping it breaks the node instead of protecting it. The change mirrors the existing ARP passthrough cases in the same protocol switches (`do_netdev`, `cil_to_netdev`, `host_ingress_policy`, `from_host_to_lxc`). New BPF test `bpf/tests/host_hostfw_ipv6_disabled.c` (host firewall enabled, no IPv6 datapath) asserts that an ICMPv6 router advertisement from a peer (ingress) and a neighbor solicitation from the node (egress) reach the stack. Without the fix, both fail with exactly the \"Unsupported L3 protocol\" drop reported in #33155. This is not a theoretical setup: users of [Cozystack](https://github.com/cozystack/cozystack) (a CNCF project) run this exact combination β host firewall enabled, Cilium without the IPv6 datapath, nodes on IPv6/L3 fabrics β and confirm both the breakage and that the passthrough restores node connectivity ([cozystack/cozystack#2806](https://github.com/cozystack/cozystack/issues/2806)). This PR upstreams the patch we currently carry downstream in our Cilium image; we will drop the downstream copy once an equivalent fix is available upstream. This PR was prepared with AIL:3 β I defined the problem, the mechanism, and the fix design; an LLM produced the patch and the test under my direction. I personally reviewed the diff and ran the BPF tests: the new test fails without the fix and passes with it, and the neighboring host-firewall/IPv6 tests still compile. Fixes: #33155 ```release-note host-firewall: IPv6 traffic is passed to the kernel stack instead of being dropped when the IPv6 datapath is disabled. ```",
"url": "https://github.com/cilium/cilium/pull/46473",
"createdAt": "2026-06-10T16:59:56Z",
"updatedAt": "2026-08-12T14:55:05Z",
"timestamp": "2026-08-12T14:55:05Z",
"metrics": {
"reactions": 3,
"comments": 6
},
"labels": [
"release-note/minor",
"sig/policy",
"kind/community-contribution"
],
"author": "lexfrei",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:9bdd4642afa3bcb48a10",
"signalId": "github:cilium/cilium:pull_request:47302",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47302",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": ".github: trigger workflow lint checks on merge_group",
"text": "Add a merge_group trigger and update the concurrency group to match other lint workflows such as lint-go.yaml. Fixes: #47262 Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47302",
"createdAt": "2026-07-18T04:06:27Z",
"updatedAt": "2026-08-12T14:52:47Z",
"timestamp": "2026-08-12T14:52:47Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"release-note/ci",
"kind/community-contribution",
"dont-merge/needs-ci-validation"
],
"author": "Avr8",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:746cdd99763baf462095",
"signalId": "github:cilium/cilium:pull_request:47305",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47305",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": ".github: skip embedded proxy CI for non-functional changes",
"text": "Please ensure your pull request adheres to the following guidelines: - [ ] For first time contributors, read [Submitting a pull request] - [ ] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! The `conformance-kind-proxy-embedded.yaml` Ariane workflow used a narrower `paths-ignore-regex` than comparable conformance jobs, so non-functional changes (e.g. CODEOWNERS-only changes, as seen on #46714) still triggered the workflow. This reuses the broader, comprehensive ignore pattern already used elsewhere in `ariane-config.yaml` so the embedded proxy conformance CI is skipped for changes that can't affect it. Fixes: #46716 This PR was prepared with AIL:3. I personally checked the resulting regex against the other conformance workflow filters in this file and confirmed it matches the change under `Fixes:` in issue #46716. ```release-note Skip embedded proxy conformance CI for non-functional changes ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47305",
"createdAt": "2026-07-18T09:17:33Z",
"updatedAt": "2026-08-12T14:52:19Z",
"timestamp": "2026-08-12T14:52:19Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution",
"dont-merge/needs-ci-validation"
],
"author": "AkashKumar7902",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:fd8eb7a20421103d57eb",
"signalId": "github:cilium/cilium:issue:47847",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:issue:47847",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "newly created mount at /sys/fs/bpf while cilium runs causes duplicate tcx links on restart",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version v1.18.6 ### What happened? After bouncing cilium on a k8s `Node`, I get duplicate bpf programs create for the same `tc.name`: ``` # bpftool -j net show dev eth5 | jq [ { \"xdp\": [], \"tc\": [ { \"devname\": \"eth5\", \"ifindex\": 27, \"kind\": \"tcx/ingress\", \"name\": \"cil_from_netdev\", \"prog_id\": 790, \"prog_flags\": [], \"link_id\": 36, \"link_flags\": [] }, { \"devname\": \"eth5\", \"ifindex\": 27, \"kind\": \"tcx/ingress\", \"name\": \"cil_from_netdev\", \"prog_id\": 9249, \"prog_flags\": [], \"link_id\": 314, \"link_flags\": [] }, { \"devname\": \"eth5\", \"ifindex\": 27, \"kind\": \"tcx/egress\", \"name\": \"cil_to_netdev\", \"prog_id\": 785, \"prog_flags\": [], \"link_id\": 37, \"link_flags\": [] }, { \"devname\": \"eth5\", \"ifindex\": 27, \"kind\": \"tcx/egress\", \"name\": \"cil_to_netdev\", \"prog_id\": 9256, \"prog_flags\": [], \"link_id\": 315, \"link_flags\": [] } ], \"flow_dissector\": [], \"netfilter\": [] } ] ``` ### How can we reproduce the issue? 1. Run cilium w/`bpf. autoMount.enabled` 2. Confirm only 1 bpf mount exists and 1 pair of unique tcx chains: ``` # findmnt /sys/fs/bpf -o TARGET,SOURCE,FSTYPE,OPTIONS TARGET SOURCE FSTYPE OPTIONS /sys/fs/bpf bpf bpf rw,nosuid,nodev,noexec,relatime,mode=700 # bpftool -j net show dev eth4 | jq '[.[0].tc[].name]' [ \"cil_from_netdev\", \"cil_to_netdev\" ] ``` 3. Add an extra mount /sys/fs/bpf mount while cilium is running: ``` mount -t bpf bpf_break_cilium /sys/fs/bpf ``` 3. Confirm we see 2 bpf mounts: ``` # findmnt /sys/fs/bpf -o TARGET,SOURCE,FSTYPE,OPTIONS TARGET SOURCE FSTYPE OPTIONS /sys/fs/bpf bpf bpf rw,relatime,mode=700 /sys/fs/bpf bpf_break_cilium bpf rw,relatime ``` 4. Bounce cilium-agent on the Node 5. Re-check tcx chains to confirm we now see duplicates: ``` # bpftool -j net show dev eth4 | jq '[.[0].tc[].name]' [ \"cil_from_netdev\", \"cil_from_netdev\", \"cil_to_netdev\", \"cil_to_netdev\" ] ``` ### Cilium Version ``` Client: 1.18.6 95896696 2026-01-12T16:56:04+00:00 go version go1.24.11 linux/amd64 Daemon: 1.18.6 95896696 2026-01-12T16:56:04+00:00 go version go1.24.11 linux/amd64 ``` ### Kernel Version ``` Linux kubw24 6.8.0-136-generic #136~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Fri Jul 3 16:29:11 UTC x86_64 x86_64 x86_64 GNU/Linux ``` ### Kubernetes Version `v1.32.8` ### Regression _No response_ ### Sysdump _No response_ ### Relevant log output ### Anything else? [This ticket](https://github.com/cilium/cilium/issues/44194) was closed due to not-planned, but describes similar behavior. ### Cilium Users Document - [x] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47847",
"createdAt": "2026-08-07T18:02:32Z",
"updatedAt": "2026-08-12T14:45:48Z",
"timestamp": "2026-08-12T14:45:48Z",
"metrics": {
"reactions": 0,
"comments": 6
},
"labels": [
"kind/bug",
"area/datapath",
"needs/triage",
"kind/community-report"
],
"author": "zbialik",
"state": "closed",
"assignees": [
"rgo3"
],
"change": "updated"
}
},
{
"id": "event:19e906c3304cbead7b2b",
"signalId": "github:cilium/cilium:issue:47827",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:issue:47827",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "policy-cidr-match-mode=nodes does not work for wildcard CIDR matches",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.19.6 and lower than v1.20.0 ### What happened? By default the following policy will block traffic from pods in the `some-ns` namespace to nodes. That's because CIDR policies by default do not match node IPs and the policy below enables an implicit defauly deny: ``` apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: some-policy namespace: some-ns spec: egress: - to: - namespaceSelector: {} podSelector: {} - to: - ipBlock: cidr: 0.0.0.0/0 except: - 192.168.1.0/24 policyTypes: - Egress ``` By enabling `--policy-cidr-match-mode=nodes`, we should be able to match nodes on the 0.0.0.0/0 rule and allow the traffic. But in Cilium 1.19 and Cilium 1.20 (and mainline), this does not work. It *does* work if the CIDR rule is narrower (i.e. not a wildcard). ### How can we reproduce the issue? Apply this policy: ``` apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: some-policy namespace: some-ns spec: egress: - to: - namespaceSelector: {} podSelector: {} - to: - ipBlock: cidr: 0.0.0.0/0 except: - 192.168.1.0/24 policyTypes: - Egress ``` Start a pod in `some-ns` namespace. Attempt to ping a node IP from the pod. Notice it fails. Restart cilium agent with `--policy-cidr-match-mode=nodes` and again attempt a ping from `some-ns` to a node and notice that it still fails. ### Cilium Version 1.19, 1.20, mainline ### Kernel Version N/A ### Kubernetes Version 1.36 ### Regression This works in 1.18. It was broken in 1.19 by commit f6c12bb4a1e230e700041943f58b3496e9f3dc6 and then again broken in 1.20 in a different way by commit 86d17c791a1e230e700041943f58b3496e9f3dc6. ### Sysdump _No response_ ### Relevant log output ```shell ``` ### Anything else? _No response_ ### Cilium Users Document - [ ] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47827",
"createdAt": "2026-08-06T21:32:16Z",
"updatedAt": "2026-08-12T14:36:06Z",
"timestamp": "2026-08-12T14:36:06Z",
"metrics": {
"reactions": 1,
"comments": 1
},
"labels": [
"kind/bug",
"sig/policy",
"kind/community-report",
"kind/regression",
"area/agent",
"affects/v1.19",
"affects/v1.20"
],
"author": "TheBeeZee",
"state": "open",
"assignees": [
"TheBeeZee"
],
"change": "updated"
}
},
{
"id": "event:0b7d6a34504899467947",
"signalId": "github:cilium/cilium:issue:46493",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:issue:46493",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Issue with backend remove in json state",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.19.4 and lower than v1.20.0 ### What happened? We use Cilium as standalone lb. in some cases, when we remove backends from the json state file, Cilium doesn't remove it from services ### How can we reproduce the issue? 1. Run cilium with options ``` cilium-agent \\ --bpf-lb-algorithm=maglev \\ --bpf-lb-mode=dsr \\ --bpf-lb-dsr-dispatch=ipip \\ --enable-ipip-termination=true \\ --bpf-lb-rss-ipv4-src-cidr 192.88.99.0/24 \\ --bpf-lb-maglev-hash-seed cmFlN3NpdWIwVWVi \\ --bpf-ct-global-tcp-max=16777216 \\ --routing-mode=native \\ --devices=agge \\ --enable-k8s=false \\ --kube-proxy-replacement=true \\ --enable-l7-proxy=false \\ --install-iptables-rules=false \\ --enable-local-redirect-policy=false \\ --enable-hubble=false \\ --enable-l7-proxy=false \\ --preallocate-bpf-maps=true \\ --disable-envoy-version-check=true \\ --auto-direct-node-routes=false \\ --bpf-lb-acceleration=native \\ --enable-ipv4=true \\ --enable-ipv4-masquerade=false \\ --enable-ipv6-masquerade=false \\ --ipv4-range=198.51.100.0/24 \\ --enable-ipv6=false \\ --mtu=1520 \\ --enable-bandwidth-manager=false \\ --enable-local-redirect-policy=false \\ --enable-hubble=false \\ --lb-state-file=/var/run/cilium/lbstate.json \\ --lb-state-file-interval=1s \\ --prometheus-serve-addr=127.0.0.1:9962 ``` 2. Create `/var/run/cilium/lbstate.json` with content from `lbstate_2_backens.json` 3. Check Cilium services, all good, 2 services with 2 backends each ``` cilium service list ID Frontend Service Type Backend 22 10.10.10.10:8080/TCP LoadBalancer 1 => 192.168.1.1:8080/TCP (active) 2 => 192.168.1.2:8080/TCP (active) 23 20.20.20.20:8080/TCP LoadBalancer 1 => 192.168.1.1:8080/TCP (active) 2 => 192.168.1.2:8080/TCP (active) ``` 4. Update `/var/run/cilium/lbstate.json` with content from `lbstate_1_backen.json`, first backend for service ` 20.20.20.20:8080` is removed in json 5. Check Cilium services, expected only one backend for service ` 20.20.20.20:8080` but still two: ``` cilium service list ID Frontend Service Type Backend 22 10.10.10.10:8080/TCP LoadBalancer 1 => 192.168.1.1:8080/TCP (active) 2 => 192.168.1.2:8080/TCP (active) 23 20.20.20.20:8080/TCP LoadBalancer 1 => 192.168.1.1:8080/TCP (active) 2 => 192.168.1.2:8080/TCP (active) ``` 6. Restart cilium 7. Check Cilium services, now the state is correct: ``` cilium service list ID Frontend Service Type Backend 22 10.10.10.10:8080/TCP LoadBalancer 1 => 192.168.1.1:8080/TCP (active) 2 => 192.168.1.2:8080/TCP (active) 23 20.20.20.20:8080/TCP LoadBalancer 2 => 192.168.1.2:8080/TCP (active) ``` [lbstate_1_backend.json](https://github.com/user-attachments/files/28833065/lbstate_1_backend.json) [lbstate_2_backens.json](https://github.com/user-attachments/files/28833066/lbstate_2_backens.json) ### Cilium Version 1.19.4 ### Kernel Version uname -a Linux cilium-lb2 6.8.0-124-generic #124~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue May 26 21:05:19 UTC x86_64 x86_64 x86_64 GNU/Linux ### Kubernetes Version standalone lb without k8s ### Regression _No response_ ### Sysdump _No response_ ### Relevant log output ```shell ``` ### Anything else? _No response_ ### Cilium Users Document - [ ] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/46493",
"createdAt": "2026-06-11T09:56:06Z",
"updatedAt": "2026-08-12T14:31:07Z",
"timestamp": "2026-08-12T14:31:07Z",
"metrics": {
"reactions": 0,
"comments": 14
},
"labels": [
"kind/bug",
"area/datapath",
"kind/community-report",
"feature/lb-only",
"area/loadbalancing",
"info-completed"
],
"author": "vanyasvl",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:1208eb2025d45a2621f5",
"signalId": "github:cilium/cilium:pull_request:47403",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47403",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: Add is_subnet_same_id helper",
"text": "Add is_subnet_same_id{4,6} helpers to reduce code duplication and also to skip an unneeded lookup if the first one already returns a zero id.",
"url": "https://github.com/cilium/cilium/pull/47403",
"createdAt": "2026-07-21T21:33:50Z",
"updatedAt": "2026-08-12T14:27:35Z",
"timestamp": "2026-08-12T14:27:35Z",
"metrics": {
"reactions": 4,
"comments": 1
},
"labels": [
"release-note/misc",
"kind/community-contribution"
],
"author": "mauriciovasquezbernal",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:c449e054c6318a678efb",
"signalId": "github:cilium/cilium:pull_request:45051",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:45051",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "[envoy] Add HTTP CONNECT support",
"text": " Add support of HTTP CONNECT method for L7 policies. Fixes: #24276 ```release-note envoy: Add support for HTTP CONNECT ``` AI disclosure: testing code was developed with LLM assistance, but i fully understand and stand by the code.",
"url": "https://github.com/cilium/cilium/pull/45051",
"createdAt": "2026-03-30T10:03:46Z",
"updatedAt": "2026-08-12T14:23:10Z",
"timestamp": "2026-08-12T14:23:10Z",
"metrics": {
"reactions": 3,
"comments": 9
},
"labels": [
"release-note/minor",
"cilium-cli"
],
"author": "nezdolik",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:962bc2f9b0417c2e5a04",
"signalId": "github:cilium/cilium:issue:47877",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:issue:47877",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "ExternalAuth filter fails unsafely if backendRef is missing a ReferenceGrant",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.20.0 and lower than v1.21.0 ### What happened? I experimented with using ExternalAuth to protect a HTTPRoute with Authentik forward auth. While setting that up, I noticed that the route seems to effectively ignore the ExternalAuth filter when it is installed but missing a ReferenceGrant for a backendRef to the external auth service. I believe the ExternalAuth filter should probably always fail safely and block all requests if the filter is misconfigured / not in a working state. From the Gateway API reference for [`HTTPRouteFilter.externalAuth`](https://gateway-api.sigs.k8s.io/reference/api-spec/main/spec/#httproutefilter): > ExternalAuth configures settings related to sending request details to an external auth service. The external service MUST authenticate the request, and MAY authorize the request as well. > > **If there is any problem communicating with the external service, this filter MUST fail closed.** ### How can we reproduce the issue? My guess would be, since ExternalAuth support is quite new, that this is an oversight with at least HTTP external auth in general and not specific to my setup. In that case this should be reproducible with any HTTPRoute using an ExternalAuth (HTTP) filter referencing a provider in another namespace. To give a simplified example: ``` apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: fails-open namespace: route-ns spec: parentRefs: - name: cilium-gateway namespace: kube-system sectionName: http rules: - matches: - path: type: PathPrefix value: / filters: - type: ExternalAuth externalAuth: protocol: HTTP backendRef: # auth-service lives in another namespace from this route, requiring a ReferenceGrant to access. # Without a ReferenceGrant, auth-service is not accessed, as expected. # But the ExternalAuth filter fails open instead of closed which is unexpected. # With a ReferenceGrant in place, the filter works as expected. name: auth-service namespace: auth-service-ns port: 80 backendRefs: - name: my-service port: 80 ``` --- For reference, here are the most relevant parts of my actual configuration. I'm happy to share more details if needed, but I tried to keep this somewhat compact here: ``` # Gateway apiVersion: gateway.networking.k8s.io/v1 kind: Gateway metadata: name: cilium-gateway namespace: kube-system spec: gatewayClassName: cilium listeners: - name: https hostname: test.example.org protocol: HTTPS port: 443 allowedRoutes: namespaces: from: All tls: mode: Terminate certificateRefs: - name: test-example-com-tls --- # Route apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: test-route namespace: test spec: parentRefs: - name: cilium-gateway namespace: kube-system sectionName: https hostnames: - test.example.org rules: - matches: - path: type: PathPrefix value: /outpost.goauthentik.io/ backendRefs: - name: authentik-server namespace: authentik port: 80 - matches: - path: type: PathPrefix value: / filters: - type: ExternalAuth externalAuth: protocol: HTTP backendRef: name: authentik-server namespace: authentik port: 80 http: path: /outpost.goauthentik.io/auth/envoy allowedHeaders: - Cookie - Accept - X-Forwarded-Host - X-Forwarded-Uri - X-Forwarded-For - X-Forwarded-Proto - X-Envoy-Original-Path - X-Envoy-Original-Method allowedResponseHeaders: - Set-Cookie - X-authentik-username - X-authentik-groups - X-authentik-entitlements - X-authentik-email - X-authentik-name - X-authentik-uid - X-authentik-jwt - X-authentik-meta-jwks - X-authentik-meta-outpost - X-authentik-meta-provider - X-authentik-meta-app - X-authentik-meta-version backendRefs: - name: test-service port: 80 ``` Cilium Helm values: ``` k8sServiceHost: localhost k8sServicePort: 7445 cgroup: autoMount: enabled: false hostRoot: /sys/fs/cgroup ipam: mode: kubernetes securityContext: capabilities: ciliumAgent: - CHOWN - KILL - NET_ADMIN - NET_RAW - IPC_LOCK - SYS_ADMIN - SYS_RESOURCE - DAC_OVERRIDE - FOWNER - SETGID - SETUID - SYSLOG cleanCiliumState: - NET_ADMIN - SYS_ADMIN - SYS_RESOURCE kubeProxyReplacement: true routingMode: tunnel tunnelProtocol: vxlan bpf: masquerade: true datapathMode: netkit distributedLRU: enabled: true mapDynamicSizeRatio: 0.005 bpfClockProbe: true l2announcements: enabled: true gatewayAPI: enabled: true enableAppProtocol: true enableAlpn: true ``` ### Cilium Version Cilium 1.20.0 ### Kernel Version 6.18.42 (Talos Linux 1.13.8) ### Kubernetes Version Kubernetes 1.36.2 Gateway API 1.6.1 experimental ### Regression _No response_ ### Sysdump _No response_ ### Relevant log output ```shell ``` ### Anything else? _No response_ ### Cilium Users Document - [ ] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47877",
"createdAt": "2026-08-09T23:50:31Z",
"updatedAt": "2026-08-12T14:22:34Z",
"timestamp": "2026-08-12T14:22:34Z",
"metrics": {
"reactions": 2,
"comments": 1
},
"labels": [
"kind/bug",
"kind/community-report",
"feature/k8s-gateway-api"
],
"author": "Jnosh",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:1e70b849bb3fe447f23e",
"signalId": "github:cilium/cilium:pull_request:47134",
"event": "changed",
"observedAt": "2026-08-13T13:48:00.446149Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47134",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "fix: Print port numbers correctly for map cilium_lb*_reverse_sk",
"text": "struct SockRevNat* is simply binary unmarshalled from ebpf map and seems to be read-only in agent, so I just keep Port network byte order Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! Fixes: #47131 ```release-note cilium-dbg: Print port numbers correctly for map cilium_lb*_reverse_sk ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47134",
"createdAt": "2026-07-13T10:01:30Z",
"updatedAt": "2026-08-12T13:53:39Z",
"timestamp": "2026-08-12T13:53:39Z",
"metrics": {
"reactions": 2,
"comments": 18
},
"labels": [
"release-note/bug",
"kind/community-contribution",
"needs-backport/1.20"
],
"author": "jayl1e",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:8746ae5d3dc7e18050d4",
"signalId": "github:cilium/cilium:pull_request:47944",
"event": "discovered",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47944",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "hubble: add optional protocol and port labels to policy metrics",
"text": "Add opt-in protocol and destination port labels to hubble_policy_verdicts_total. Both labels are disabled by default to preserve the existing metric label set. The destination port label may increase metric cardinality depending on the traffic pattern. Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [ ] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [ ] Thanks for contributing! Related: #34304 ```release-note Add opt-in `protocol` and destination `port` labels to `hubble_policy_verdicts_total`. Enable the additional labels with: ```yaml hubble: metrics: enabled: - \"policy:protocol;destination_port\" Both options are disabled by default to preserve the existing metric label set. The port option may increase metric cardinality depending on traffic patterns. ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47944",
"createdAt": "2026-08-13T15:58:47Z",
"updatedAt": "2026-08-13T16:18:41Z",
"timestamp": "2026-08-13T16:18:41Z",
"metrics": {
"reactions": 1,
"comments": 1
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "stias",
"state": "open",
"assignees": [],
"change": "new"
}
},
{
"id": "event:87ce374d1ebc39ded5e6",
"signalId": "github:cilium/cilium:pull_request:47826",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt",
"labels",
"state"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47826",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api: log the right route kind when listing TLSRoutes fails",
"text": "## Description `EnqueueRequestForBackendService` lists TLSRoutes immediately after HTTPRoutes, and the error path of the TLSRoute call was copied from the HTTPRoute one above it without changing the message. A failure to list TLSRoutes is reported as `Failed to get related HTTPRoutes`, which points anyone reading the log at the wrong index and the wrong CRD. That same line is also the only `List` error handler in `operator/pkg/gateway-api/watch-handlers` that calls `Error` rather than `ErrorContext`, so it drops the context from the log record while all fourteen of its neighbours keep it. The sibling handler `EnqueueRequestForBackendServiceImport` already logs this exact failure as `Failed to get related TLSRoutes`, so this just makes the two agree. Found while looking at #47819. That issue also asks for a `helpers.HasTLSRouteSupport` guard around these two `List` calls. I left that out on purpose: on `main`, `TLSRouteKind` is in `helpers.RequiredGVKs`, and `checkCRDs` disables Gateway API entirely when a required CRD is missing, so the guard cannot be false here and would be dead code. Only the log line is wrong on `main`. ```release-note Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service ```",
"url": "https://github.com/cilium/cilium/pull/47826",
"createdAt": "2026-08-06T19:15:38Z",
"updatedAt": "2026-08-13T16:15:56Z",
"timestamp": "2026-08-13T16:15:56Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"kind/bug",
"release-note/bug",
"ready-to-merge",
"area/servicemesh",
"kind/community-contribution",
"feature/k8s-gateway-api",
"needs-backport/1.20"
],
"author": "mehrdadbn9",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:dadd3d46b26bbe2d14f0",
"signalId": "github:cilium/cilium:issue:47921",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt",
"metrics"
],
"signal": {
"id": "github:cilium/cilium:issue:47921",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "CI: firewall-egress-to-fqdns fails 6% of the time: command terminated with exit code 28",
"text": "### Test Name firewall-egress-to-fqdns ### Test Failure Output ```shell β 1/8 tests failed (6/81 actions), 3 tests skipped, 0 scenarios skipped: Test [host-firewall-egress-to-fqdns]: π₯ host-firewall-egress-to-fqdns/host-to-world:http-to-fake.external.service.cilium-0: cilium-test-1/host-netns-8h6h4 (172.20.0.4) -> fake.external.service.cilium-http (fake.external.service.cilium:80): command \"curl --silent --fail --show-error --connect-timeout 2 --max-time 10 -4 -w %{local_ip}:%{local_port} -> %{remote_ip}:%{remote_port} = %{response_code}\\n --output /dev/null http://fake.external.service.cilium:80\" failed: command failed (pod=cilium-test-1/host-netns-8h6h4, container=host-netns): command terminated with exit code 28 ``` βοΈ The following owners are responsible for reliability of the testsuite: - @cilium/sig-agent (host-to-world) - @cilium/ci-structure (.github/workflows/tests-e2e-upgrade.yaml) ### CI Build Link https://github.com/cilium/cilium/actions/runs/31601758510 ### Relevant Log Output ```shell ``` ### Sysdump / Zip File _No response_",
"url": "https://github.com/cilium/cilium/issues/47921",
"createdAt": "2026-08-12T22:48:35Z",
"updatedAt": "2026-08-13T16:13:10Z",
"timestamp": "2026-08-13T16:13:10Z",
"metrics": {
"reactions": 0,
"comments": 9
},
"labels": [
"area/CI",
"area/cli",
"ci/flake"
],
"author": "joestringer",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:731e3c2907fcddb3d912",
"signalId": "github:cilium/cilium:pull_request:46880",
"event": "discovered",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:46880",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ipam: Added ReservedRange To CiliumPodIPPool",
"text": "Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! CFP: https://github.com/cilium/design-cfps/pull/85 Fixes: #42466 ### **This PR includes** - Added `reservedRanges` support for `CiliumPodIPPool` CIDRs - Promote `CiliumPodIPPool` usage to the `cilium.io/v2` API. - Added a documentation for the migration flow using `reservedRanges` ### **Description** This allows operators to keep old CIDRs in a pool while preventing new allocations from those ranges during multi-pool IPAM migrations. The allocator skips any allocation CIDR that overlaps a configured reserved range This PR was prepared with AIL:2. I personally reviewed the changes and verified the reservedRanges behavior with unit tests and a kind cluster using locally rebuilt dev images. ```release-note CiliumPodIPPools now support reservedRanges for multi-pool IPAM. ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/46880",
"createdAt": "2026-07-03T08:51:36Z",
"updatedAt": "2026-08-13T16:08:15Z",
"timestamp": "2026-08-13T16:08:15Z",
"metrics": {
"reactions": 2,
"comments": 5
},
"labels": [
"release-note/minor",
"kind/community-contribution",
"cilium-cli"
],
"author": "kyounghoonJang",
"state": "open",
"assignees": [],
"change": "new"
}
},
{
"id": "event:e6c4be8c6f38f61cd28c",
"signalId": "github:cilium/cilium:pull_request:47932",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47932",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "clustermesh/endpointslices: explicitly limit maximum decoder memory",
"text": "Explicitly configure a limit for the zstd decoder used to decode the ClusterEndpointSlice entries received over Cluster Mesh, to prevent the risk of unbounded memory usage in case of crafted payloads. I've marked the PR as `release-note/misc` because the logic ingesting ClusterEndpointSlices is incomplete and disabled behind a feature flag in v1.20. Reported-by: Secstant - Sigma Prime \\",
"url": "https://github.com/cilium/cilium/pull/47932",
"createdAt": "2026-08-13T08:30:58Z",
"updatedAt": "2026-08-13T16:06:28Z",
"timestamp": "2026-08-13T16:06:28Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"area/clustermesh",
"release-note/misc",
"needs-backport/1.20"
],
"author": "giorio94",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:55631346746f26f31058",
"signalId": "github:cilium/cilium:pull_request:47568",
"event": "discovered",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47568",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "datapath/linux: return orphaned node ID to pool on partial remap",
"text": "- [x] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] All commits are signed off. See the section [Developer's Certificate of Origin](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#developer-s-certificate-of-origin) - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy](https://github.com/cilium/community/blob/main/AI-POLICY.md), and indicate the rating using [AI Influence Level](https://danielmiessler.com/blog/ai-influence-level-ail). This PR was prepared with **AIL:3** (AI Created, Human Full Structure) β I directed the investigation and the fix approach, and reviewed the diff, root-cause analysis, and test before submission. `allocateIDForNode`'s inconsistent-mapping recovery path unmaps all IPs of a node when it finds them pointing to different node IDs, then retries allocation. `unmapNodeID` removes the IP<>ID mappings but never returned the ID itself to the free pool once it had no IPs left, unlike `deallocateNodeIDLocked` (used only on full node deletion). This can happen whenever a node's `IPAddresses` contain an IP shared across nodes (e.g. a shared `--local-router-ipv4`), since it lets a later node's addresses resolve to an earlier node's ID and trigger the recovery path. Each occurrence orphans one node ID, so the ID pool (65535 entries) is silently exhausted over time, well before the actual node count would justify it β eventually logging `\"No more IDs available for nodes\"`, as reported in #47563. **Fix:** return the ID to the pool in `unmapNodeID` itself when it removes the last remaining IP for that ID. This covers the partial-remap path in addition to the existing full-deletion path (which already re-inserts the same ID again there, harmlessly, since `idpool.Insert` is a no-op on an ID that's already available). **Testing:** added `TestNodeIDLeakOnSharedRouterIP`, which reproduces the leak with a 2-ID pool: without the fix it fails with the same `\"no available node ID\"` error as the reported bug; with the fix, the orphaned ID is correctly freed and reused. Verified this locally (reverted the fix, confirmed the test fails with that exact error; restored it, confirmed it passes) before submitting. Fixes: #47563 ```release-note Fix a node ID leak that could exhaust the node ID pool over time when a node's IP addresses (e.g. a shared local router IP) caused the inconsistent-mapping recovery path in the node ID allocator to run. ```",
"url": "https://github.com/cilium/cilium/pull/47568",
"createdAt": "2026-07-28T14:36:31Z",
"updatedAt": "2026-08-13T16:01:47Z",
"timestamp": "2026-08-13T16:01:47Z",
"metrics": {
"reactions": 2,
"comments": 21
},
"labels": [
"release-note/bug",
"kind/community-contribution"
],
"author": "zanarellidev",
"state": "closed",
"assignees": [],
"change": "new"
}
},
{
"id": "event:e1a622ca3ed67f43ab4d",
"signalId": "github:cilium/cilium:issue:47918",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt",
"metrics"
],
"signal": {
"id": "github:cilium/cilium:issue:47918",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Label Filters don't treat prefix as a regex when loaded from file",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.19.6 and lower than v1.20.0 ### What happened? When loading identity-related label filters via `label-prefix-file` the label can only be provided as a string prefix and not as a regex. [The documentation](https://docs.cilium.io/en/latest/operations/performance/scalability/identity-relevant-labels/) is quite light on details about this file-based approach so this might be expected behaviour but as the docs speak heavily about using regex for the label filters it seems like a mistake to me that the file-based approach doesn't follow the same logic. ### How can we reproduce the issue? 1. Create a file with the following contents: ```json { \"version\": 1, \"valid-prefixes\": [ {\"prefix\": \"app$\", \"source\": \"k8s\"}, {\"prefix\":\".*\",\"source\":\"reserved\"} ] } ``` 2. Pass this in to Cilium via the `label-prefix-file` configuration flag 3. Launch a pod with an `app` label defined 4. Observe that the `app` label isn't matched and included on the CiliumIdentity ### Cilium Version 1.19.1 ### Kernel Version 6.12.88 ### Kubernetes Version 1.34.9 ### Regression _No response_ ### Sysdump _No response_ ### Relevant log output ```shell ``` ### Anything else? _No response_ ### Cilium Users Document - [ ] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47918",
"createdAt": "2026-08-12T15:04:30Z",
"updatedAt": "2026-08-13T15:59:58Z",
"timestamp": "2026-08-13T15:59:58Z",
"metrics": {
"reactions": 0,
"comments": 4
},
"labels": [
"kind/bug",
"kind/community-report",
"area/agent"
],
"author": "AverageMarcus",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:e5cf6b5e80afcc4cb46b",
"signalId": "github:cilium/cilium:pull_request:47943",
"event": "discovered",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47943",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api: compare static Gateway addresses as parsed IPs",
"text": "`setStaticAddressStatus` compared addresses from `Gateway.spec.addresses` with the generated Service status as strings. Equivalent IPv6 addresses can use different textual representations, causing an allocated and working static address to be reported as unusable. Parse both sides with `netip.ParseAddr` and compare the resulting addresses. Hostname-only Service ingress entries are ignored. Add regression coverage for equivalent IPv6 representations, IPv4 addresses, and mismatched addresses. Tested with: ```text go test ./operator/pkg/gateway-api -count=1 ``` Fixes: #47857 ```release-note Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. ``` AIL:2 β Generative AI was used to assist with parts of the implementation, testing, and PR preparation. I reviewed and validated the changes.",
"url": "https://github.com/cilium/cilium/pull/47943",
"createdAt": "2026-08-13T15:45:28Z",
"updatedAt": "2026-08-13T15:56:42Z",
"timestamp": "2026-08-13T15:56:42Z",
"metrics": {
"reactions": 1,
"comments": 1
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution",
"feature/k8s-gateway-api"
],
"author": "taaahaaa",
"state": "open",
"assignees": [],
"change": "new"
}
},
{
"id": "event:0f0f45fa96ab425db1bb",
"signalId": "github:cilium/cilium:issue:47930",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt",
"metrics",
"labels"
],
"signal": {
"id": "github:cilium/cilium:issue:47930",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Potential issue with usePrimaryAddress on a t3.small",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.19.6 and lower than v1.20.0 ### What happened? ## Potential issue with usePrimaryAddress ### Cilium v1.19.6, AWS `t3.small` On a `t3.small` instance using AWS ENI IPAM mode with `use-primary-address: true`, Cilium seems to cap max IPs at 9 when 11 is expected. This is based on a `t3.small`'s limits of 3 ENIs, 4 IPs per ENI = 11 pod IPs max (3, 4, 4 - one reserved). ```pwsh > (aws ec2 describe-instance-types --instance-types t3.small --region eu-west-2 | ConvertFrom-Json).InstanceTypes[0].NetworkInfo | Select-Object MaximumNetworkInterfaces, Ipv4AddressesPerInterface MaximumNetworkInterfaces Ipv4AddressesPerInterface ------------------------ ------------------------- 3 4 ``` ```pwsh > helm get values cilium -n kube-system ``` ```yaml USER-SUPPLIED VALUES: cni: configMap: cni-configuration customConf: true egressMasqueradeInterfaces: eth0 enableIPv4Masquerade: false enabled: true eni: awsReleaseExcessIPs: true enabled: true nodeSpec: usePrimaryAddress: true subnetTagsFilter: - ourLegitimate/redactedFilter externalIPs: enabled: true hostPort: enabled: true ipam: mode: eni kubeProxyReplacement: false nodeinit: enabled: true operator: enabled: true nodeSelector: avcosystems.com/node-type: burst kubernetes.io/arch: amd64 kubernetes.io/os: linux podDisruptionBudget: enabled: true maxUnavailable: 1 prometheus: enabled: true serviceMonitor: enabled: true resources: limits: cpu: 50m memory: 80Mi requests: cpu: 7m memory: 35Mi prometheus: enabled: true serviceMonitor: enabled: true namespace: monitoring resources: limits: cpu: 300m memory: null requests: cpu: 120m memory: 165Mi routingMode: native tunnelProtocol: \"\" upgradeCompatibility: \"1.10\" ``` Observing logs, a pod is attempted to be put onto the node that already has 9 pods, at which point it consistently errors with e.g. ```bash Warning FailedCreatePodFoo 15m kubelet Failed to create pod foo: rpc error: code = Unknown desc = failed to setup network for foo \"25cc25redacted\": plugin type=\"cilium-cni\" failed (add): unable to allocate IP via local cilium agent: [POST /ipam][502] postIpamFailure \"no IPs currently available on the node, allocation will be retried once Cilium Operator allocates more IPs\" Warning FailedCreatePodFoo 105s (x62 over 15m) kubelet (combined from similar events): Failed to create pod foo: rpc error: code = Unknown desc = failed to setup network for foo \"3d3a7redacted\": plugin type=\"cilium-cni\" failed (add): unable to allocate IP via local cilium agent: [POST /ipam][502] postIpamFailure \"no IPs currently available on the node, allocation will be retried once Cilium Operator allocates more IPs\" ``` with up to 9 pods currently active with assigned IPs. ```pwsh > kubectl get ciliumnode ip-17redacted.eu-west-2.compute.internal -o jsonpath='{.spec.ipam}' | jq { \"pool\": { \"ip1\": { \"resource\": \"eni-1-id\" }, \"ip2\": { \"resource\": \"eni-1-id\" }, \"ip3\": { \"resource\": \"eni-2-id\" }, \"ip4\": { \"resource\": \"eni-3-id\" }, \"ip5\": { \"resource\": \"eni-1-id\" }, \"ip6\": { \"resource\": \"eni-2-id\" }, \"ip7\": { \"resource\": \"eni-3-id\" }, \"ip8\": { \"resource\": \"eni-2-id\" }, \"ip9\": { \"resource\": \"eni-3-id\" } }, \"pools\": {}, \"pre-allocate\": 8 } ``` ```pwsh > kubectl get ciliumnode ip-17redacted.eu-west-2.compute.internal -o jsonpath='{.status.eni.enis}' | jq { \"eni-1-id\": { \"addresses\": [ \"ip1\", \"ip2\", \"ip5\"], \"id\": \"eni-1-id\", \"ip\": \"separate-ip\", \"mac\": \"mac1\", \"security-groups\": [ \"sg-redacto1\", \"sg-redacto2\", \"sg-redacto3\" ], \"subnet\": { \"cidr\": \"172.foo/19\", \"id\": \"subnet-redacted1\" }, \"tags\": { \"eks:cluster-name\": \"my-eks-redacted-name\", \"eks:nodegroup-name\": \"linux-web-5\" }, \"vpc\": { \"cidrs\": [ \"172.foo../16\" ], \"id\": \"vpc-id1\", \"primary-cidr\": \"172.bar/16\" } }, \"eni-2-id\": { \"addresses\": [ \"ip3\", \"ip8\", \"ip6\"], \"description\": \"Cilium-CNI (i-cni-id-1)\", \"id\": \"eni-2-id\", \"ip\": \"172.an.ip\", \"mac\": \"mac2\", \"number\": 2, \"security-groups\": [ \"sg-redacto4\", \"sg-redacto5\", \"sg-redacto6\" ], \"subnet\": { \"cidr\": \"172.foo/19\", \"id\": \"subnet-redacted1\" }, \"tags\": { \"io.cilium/cilium-managed\": \"true\", \"io.cilium/cluster-name\": \"my-eks-redacted-name\" }, \"vpc\": { \"cidrs\": [ \"172.foo../16\" ], \"id\": \"vpc-id1\", \"primary-cidr\": \"172.bar/16\" } }, \"eni-3-id\": { \"addresses\": [ \"ip4\", \"ip7\", \"ip9\"], \"description\": \"Cilium-CNI (i-cni-id-1)\", \"id\": \"eni-3-id\", \"ip\": \"172.an.ip\", \"mac\": \"mac3\", \"number\": 1, \"security-groups\": [ \"sg-redacto7\", \"sg-redacto8\", \"sg-redacto9\" ], \"subnet\": { \"cidr\": \"172.foo/19\", \"id\": \"subnet-redacted1\" }, \"tags\": { \"io.cilium/cilium-managed\": \"true\", \"io.cilium/cluster-name\": \"my-eks-redacted-name\" }, \"vpc\": { \"cidrs\": [ \"172.foo../16\" ], \"id\": \"vpc-id1\", \"primary-cidr\": \"172.bar/16\" } } } ``` `\"use-primary-address\": true,` is in the spec: ```pwsh > kubectl get ciliumnode ip-17redacted.eu-west-2.compute.internal -o jsonpath='{.spec.eni}' | jq { \"availability-zone\": \"eu-west-2b\", \"disable-prefix-delegation\": false, \"first-interface-index\": 0, \"instance-type\": \"t3.small\", \"node-subnet-id\": \"subnet-foo\", \"subnet-tags\": { \"thing/cilium\": \"foo\" }, \"use-primary-address\": true, \"vpc-id\": \"vpc-foo\" } ``` The kubelet config itself show as as 11 maxPods: ```pwsh > kubectl get --raw \"/api/v1/nodes/ip-17redacted.eu-west-2.compute.internal/proxy/configz\" | jq '.kubeletconfig.maxPods' 11 ``` ## Potential issue? `GetMinimumAllocatableIPv4()` () has the following: ```go // limits.IPv4 contains the primary IP which is not available for allocation maxPerInterface := max(limits.IPv4-1, 0) return min(minimum, (limits.Adapters-index)*maxPerInterface) ``` When Spec.ENI.UsePrimaryAddress is true, auxiliary ENIs (index > 0) can allocate their primary IP, making maxPerInterface equal to limits.IPv4 for those interfaces. Does this cause GetMinimumAllocatableIPv4() to undercalculate the instance pool capacity (e.g., reporting 9 instead of 11 for t3.small) or am I barking up the wrong tree and there's something else I'm missing as to why this is being limited to 9 IPs? ## Planning to try (but haven't yet) Setting preAllocation to 2 as opposed to the default of 8 and setting maxAboveWatermark to 2 as opposed to the default of 0. The last 'best guess' reason I have for that is: * With preAllocation = 8 and maxAboveWatermark = 0, Cilium calculates target pool size using the watermark equation: {Target Pool} = {Used Pod IPs} + {preAllocation} * maxAboveWatermark = 0 tells Cilium: \"Do not allocate any extra IPs beyond the minimum needed to satisfy preAllocation.\" * When Cilium attempts to allocate IPs for preAllocation = 8: It allocates eth0 (3 secondary IPs). Total = 3. It allocates eth1 (3 secondary IPs). Total = 6. It allocates eth2 (3 secondary IPs). Total = 9. * At 9 IPs, Cilium hits the limits.IPv4 - 1 limit across all 3 ENIs. Because maxAboveWatermark = 0, Cilium refuses to step above the watermark to allocate the primary IPs on auxiliary interfaces (eth1 and eth2). **(The guesstimate/leap I'm taking)** * Therefore, the pool freezes at 9 IPs, leaving the last 2 IP slots on eth1 and eth2 locked and unreachable. **guessing** Any ideas? ### How can we reproduce the issue? see main content ### Cilium Version v1.19.6 ### Kernel Version 6.12.94-123.192.amzn2023.x86_64 ### Kubernetes Version v1.34.9-eks-8f14419 ### Regression _No response_ ### Sysdump _No response_ ### Relevant log output ```shell ``` ### Anything else? _No response_ ### Cilium Users Document - [x] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47930",
"createdAt": "2026-08-13T08:19:40Z",
"updatedAt": "2026-08-13T15:51:57Z",
"timestamp": "2026-08-13T15:51:57Z",
"metrics": {
"reactions": 0,
"comments": 1
},
"labels": [
"kind/bug",
"need-more-info",
"kind/community-report",
"area/eni"
],
"author": "joe-sm",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:767468a0e13051deda18",
"signalId": "github:cilium/cilium:pull_request:47942",
"event": "discovered",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47942",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "hubble/relay: stop gRPC health server on shutdown",
"text": "The gRPC health server is started as part of Server.Serve(), but Server.Stop() only stops the main gRPC server. This leaves the health listener running and keeps Serve() blocked in errgroup.Wait(). Stop the gRPC health server during shutdown and add a test that verifies Serve() returns after Stop(). Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy]. This PR was prepared with AIL:3 I used AI to assist with investigating the shutdown behavior, reviewing the relevant source code, and developing the test approach. Fixes: #47941 ```release-note Fix Hubble Relay remains running during termination ``` [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47942",
"createdAt": "2026-08-13T15:23:08Z",
"updatedAt": "2026-08-13T15:50:59Z",
"timestamp": "2026-08-13T15:50:59Z",
"metrics": {
"reactions": 1,
"comments": 2
},
"labels": [
"kind/bug",
"release-note/bug",
"kind/community-contribution",
"needs-backport/1.17",
"area/hubble",
"needs-backport/1.18",
"needs-backport/1.19",
"needs-backport/1.20"
],
"author": "xandau",
"state": "open",
"assignees": [
"xandau"
],
"change": "new"
}
},
{
"id": "event:9aff4481487b1c70b730",
"signalId": "github:cilium/cilium:pull_request:47776",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47776",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "ci: replace unsupported LLVM installation action",
"text": "Replace the unsupported LLVM installer action in the lint and integration test workflows with a local Bash composite action. The local action preserves: - LLVM 19.1.7 installation - X64 and ARM64 archive selection - LLVM path and library environment exports - installed Clang version verification After #47780 restored LLVM and Clang installation in `integration-test.yaml`, this PR also migrates that restored occurrence to the local composite action. This PR intentionally contains only changes shared by the maintained stable branches so the patch can be backported cleanly to v1.17, v1.18, v1.19, and v1.20. Validation: - the composite action and both changed workflows parse successfully as YAML - `git diff --check` passes This is the backportable portion of the workflow migration originally submitted in #47738.",
"url": "https://github.com/cilium/cilium/pull/47776",
"createdAt": "2026-08-05T15:44:31Z",
"updatedAt": "2026-08-13T15:47:32Z",
"timestamp": "2026-08-13T15:47:32Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"release-note/ci",
"kind/community-contribution",
"affects/v1.17",
"needs-backport/1.18",
"needs-backport/1.19",
"dont-merge/needs-ci-validation",
"needs-backport/1.20"
],
"author": "bogdankrasko",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:95ea799a3f98c69bdb13",
"signalId": "github:cilium/cilium:pull_request:47882",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt",
"metrics"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47882",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "operator: prevent CNPs with nodeSelector from silently enforcing nothing",
"text": " The Rule struct is shared by both CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy, and its NodeSelector field can only be used in CiliumClusterwideNetworkPolicies. ``` // https://github.com/cilium/cilium/blob/main/pkg/policy/api/rule.go#L76 type Rule struct { ... // NodeSelector selects all nodes which should be subject to this rule. // EndpointSelector and NodeSelector cannot be both empty and are mutually // exclusive. Can only be used in CiliumClusterwideNetworkPolicies. // // +kubebuilder:validation:OneOf NodeSelector EndpointSelector `json:\"nodeSelector,omitzero\"` } ``` When a user creates an instance like the following: ``` apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: namespace: foo name: host-policy spec: nodeSelector: matchLabels: node-role.kubernetes.io/worker: \"\" ingress: - fromEntities: [cluster] ``` nodeSelector is not allowed in a CiliumNetworkPolicy, but the operator currently does not validate it, while the cilium agent rejects such an instance and refuses to enforce it. ``` // https://github.com/cilium/cilium/blob/main/pkg/k8s/apis/cilium.io/v2/cnp_types.go#L199 if r.Spec.NodeSelector.LabelSelector != nil { return nil, NewErrParse(\"Invalid CiliumNetworkPolicy spec: rule cannot have NodeSelector\") } ``` As a result, this error is not surfaced in the status of the CiliumNetworkPolicy, so users are misled into believing the policy is in effect, even though the cilium agent has already reported an error. Fixes: #issue-number ```release-note operator: prevent CNPs with nodeSelector from silently enforcing nothing ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47882",
"createdAt": "2026-08-10T09:19:19Z",
"updatedAt": "2026-08-13T15:44:29Z",
"timestamp": "2026-08-13T15:44:29Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"release-note/bug",
"kind/community-contribution"
],
"author": "weizhoublue",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:a85ba98f18c3c0113812",
"signalId": "github:cilium/cilium:issue:47941",
"event": "discovered",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:issue:47941",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Hubble Relay does not terminate, gRPC health server remains running",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.20.0 and lower than v1.21.0 ### What happened? Hubble Relay does not fully terminate after receiving SIGTERM. The Relay server shuts down and the log reports Server stopped, but the Relay process remains running until the Kubernetes termination grace period expires and the pod is killed with SIGTERM. The dedicated gRPC health server on port 4222 remains listening after the main Relay server has already stopped. ## Expected behavior Hubble Relay should fully terminate after SIGTERM once the server is stopped. The Kubernetes termination grace period should be a maximum shutdown deadline and should not expire before the Relay process exits. ## Cause `Server.Serve()` starts both the gRPC and the separate gRPC health Server and waits for all of them to return. The current Server.Stop() stops the main server with: `s.server.Stop()` but does not stop: `s.grpcHealthServer` This appears to leave the health server listening on port 4222, preventing `errgroup.Wait()` in `Server.Serve()` from returning. The health server appears to have been introduced in: [b1f246567b72 (\"hubble/relay: Update health server to check connectivity\")](https://github.com/cilium/cilium/commit/b1f246567b7233fdd9a3edcbbe102415d3911fe4) ### How can we reproduce the issue? Run Hubble Relay in Kubernetes. Start termination of the Relay pod, for example as part of a node drain. Observe the Relay logs: ``` Stopping server... Server stopped ``` The pod remains in Terminating and the container remains in a running state. Inspect the Relay process network namespace after Server stopped: `sudo nsenter -t \"$PID\" -n ss -ltnp` Port 4222 is still in LISTEN state while the main Relay listener is gone. A SIGQUIT stack dump taken showed Server.Serve() waiting in: ``` sync.(*WaitGroup).Wait golang.org/x/sync/errgroup.(*Group).Wait github.com/cilium/cilium/pkg/hubble/relay/server.(*Server).Serve ``` ### Cilium Version 1.20.0 ### Kernel Version 5.14.0 ### Kubernetes Version 1.36.3 ### Regression _No response_ ### Sysdump _No response_ ### Relevant log output ```shell sync.(*WaitGroup).Wait golang.org/x/sync/errgroup.(*Group).Wait github.com/cilium/cilium/pkg/hubble/relay/server.(*Server).Serve ``` ### Anything else? _No response_ ### Cilium Users Document - [ ] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47941",
"createdAt": "2026-08-13T15:11:30Z",
"updatedAt": "2026-08-13T15:37:23Z",
"timestamp": "2026-08-13T15:37:23Z",
"metrics": {
"reactions": 0,
"comments": 0
},
"labels": [
"kind/bug",
"needs/triage",
"kind/community-report"
],
"author": "xandau",
"state": "open",
"assignees": [],
"change": "new"
}
},
{
"id": "event:c7e35cfc0798fe610ca7",
"signalId": "github:cilium/cilium:pull_request:47763",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47763",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "egressgateway: react to local device/address changes",
"text": "Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. - [x] Thanks for contributing! ## Description of change As per the [docs](https://docs.cilium.io/en/latest/network/egress-gateway/egress-gateway/): > After Cilium has selected the network interface and Egress IP for an Egress Gateway policy (or failed to do so), it > does not automatically respond to a change in the gateway nodeβs network configuration (for example if an IP > address is added or deleted). You can force a fresh selection by re-applying the Egress Gateway policy. Cilium does not react to changes of Node interfaces/IPs, the code for this reconciliation is already present but only triggers on updates to `CiliumEgressGatewayPolicy`, `CiliumNode` and `CiliumEndpoint` changes, plus the initial k8s sync. This PR simply adds another trigger to this already existing reconciliation logic, by subscribing the egress manager to changes in the statedb `Device` table. With this in place, my testing shows that IPs added/removed from nodes are near instantly picked up and acted upon. ### Testing AI generated and verified tests: - `go build` / `go vet` on `pkg/egressgateway/` β clean. - New privileged test `TestPrivilegedDeviceTableTriggersReconcile`. AI generated but extensively human verified tests: - Validated on a live Talos cluster via A/B: A CEGP is created, a corresponding IP is added to the matching node but the `bpf egress list` continues to show `Egress IP 0.0.0.0`. Once I switch to an image built based on this PR, the IP change is detected by Cilium and the `bpf egress list` is updated accordingly. This testing has mainly been done with: [This script](https://github.com/cilium/cilium/issues/47761#issuecomment-5189815765) @joestringer says to `highlight any specific areas that you would like feedback from reviewers about`, this is a fairly small PR and I don't really have any such areas. Most important to me is that I want to deliver a PR that is as actionable and helpful to the dev team as possible. Fixes: #47761 ```release-note egressgateway: reconcile when a CiliumEgressGatewayPolicy's egress IP is added, removed, or moved between node interfaces,, so a CiliumEgressGatewayPolicy no longer stays black-holed until an unrelated event triggers a reconcile. ``` This PR was prepared with AIL:3. AI assistance was used to draft the implementation and the privileged test; I personally reviewed the code, confirmed it builds and vets, and validated the fix and its reproduction on a live Talos cluster via A/B testing against stock vs patched images and wrote this PR description. [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47763",
"createdAt": "2026-08-05T09:20:04Z",
"updatedAt": "2026-08-13T15:26:45Z",
"timestamp": "2026-08-13T15:26:45Z",
"metrics": {
"reactions": 2,
"comments": 7
},
"labels": [
"release-note/minor",
"kind/community-contribution"
],
"author": "farthinder",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:d9a22d93c03d34b86398",
"signalId": "github:cilium/cilium:pull_request:47927",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt",
"metrics"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47927",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "cilium-cli/connectivity: detect Cilium version in connectivity perf setup",
"text": "`cilium connectivity perf` always reports \"Cilium version: 0.0.0\" in its info banner, regardless of the actual Cilium version running in the cluster. `setupAndValidatePerf()`, the setup path used by the `perf` subcommand, never calls `initCiliumPods()`/`detectCiliumVersion()`, unlike `setupAndValidate()` (used by `connectivity test`). `CiliumVersion` is therefore left at its Go zero value, which prints as `0.0.0`. This calls the same two steps `setupAndValidate()` already uses, in the same order, so `CiliumVersion` is populated before it's printed in `connectivity.Run()`. Tested manually against an RKE2 cluster (Cilium v1.19.4): - before the fix, `cilium connectivity perf` reported \"Cilium version: 0.0.0\" - after the fix, it correctly reports \"Cilium version: 1.19.4\" ```release-note Fixed `cilium connectivity perf` always reporting `Cilium version: 0.0.0` instead of the actual detected Cilium version.",
"url": "https://github.com/cilium/cilium/pull/47927",
"createdAt": "2026-08-13T07:53:44Z",
"updatedAt": "2026-08-13T15:24:17Z",
"timestamp": "2026-08-13T15:24:17Z",
"metrics": {
"reactions": 1,
"comments": 2
},
"labels": [
"release-note/bug",
"kind/community-contribution",
"cilium-cli",
"cilium-cli-exclusive"
],
"author": "khaddict",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:2cfcae0c6835e62ab7de",
"signalId": "github:cilium/cilium:pull_request:47924",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt",
"metrics"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47924",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "docs: add OpenChoreo to USERS.md",
"text": "Added OpenChoreo entry with details on network security and observability. Please ensure your pull request adheres to the following guidelines: - [ ] For first time contributors, read [Submitting a pull request] - [ ] All code is covered by unit and/or runtime tests where feasible. - [ ] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [ ] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [ ] All commits are signed off. See the section [Developerβs Certificate of Origin] - [ ] Provide a title or release-note blurb suitable for the release notes. - [ ] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [ ] Thanks for contributing! Fixes: #issue-number ```release-note ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47924",
"createdAt": "2026-08-13T04:56:28Z",
"updatedAt": "2026-08-13T15:22:37Z",
"timestamp": "2026-08-13T15:22:37Z",
"metrics": {
"reactions": 1,
"comments": 4
},
"labels": [
"release-note/misc",
"kind/community-contribution"
],
"author": "kavishkafernando",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:2ffeceea05dc3140f678",
"signalId": "github:cilium/cilium:pull_request:47895",
"event": "discovered",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47895",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "images: update cilium-envoy",
"text": "Bumping cilium Envoy image to include the \"ADS policy map lifetime fix\" from [cilium/proxy#1982](https://github.com/cilium/proxy/pull/1982) for cilium 1.20 that fixes https://github.com/cilium/cilium/issues/47624",
"url": "https://github.com/cilium/cilium/pull/47895",
"createdAt": "2026-08-11T13:04:37Z",
"updatedAt": "2026-08-13T15:20:25Z",
"timestamp": "2026-08-13T15:20:25Z",
"metrics": {
"reactions": 3,
"comments": 3
},
"labels": [
"kind/backports",
"dont-merge/needs-rebase",
"backport/1.20"
],
"author": "nezdolik",
"state": "open",
"assignees": [],
"change": "new"
}
},
{
"id": "event:a348c3c7029bd4a1d3a9",
"signalId": "github:cilium/cilium:pull_request:47929",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47929",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "fix(gateway): fail closed on invalid ExternalAuth",
"text": "## Description of change Make HTTPRoute ExternalAuth fail closed when the backend reference is invalid or cannot be resolved. Previously, an invalid ExternalAuth backend reference could cause the filter to be omitted while the route remained active, effectively allowing requests to bypass external authentication. This change: - Fails closed with HTTP 500 when the ExternalAuth backend reference is not permitted by a ReferenceGrant. - Fails closed when the ExternalAuth backend cannot be resolved. - Adds unit tests covering invalid cross-namespace references, missing backends, and valid ReferenceGrant configuration. Fixes: #47877 ```release-note Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. ``` This PR was prepared with AIL:3. I personally checked the implementation and unit tests. - [ ] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] All commits are signed off. See the section [Developer's Certificate of Origin](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo) - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy](https://github.com/cilium/community/blob/main/AI-POLICY.md), and indicate the rating using [AI Influence Level](https://danielmiessler.com/blog/ai-influence-level-ail). - [x] Thanks for contributing! [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47929",
"createdAt": "2026-08-13T08:15:04Z",
"updatedAt": "2026-08-13T15:15:29Z",
"timestamp": "2026-08-13T15:15:29Z",
"metrics": {
"reactions": 1,
"comments": 0
},
"labels": [
"kind/bug",
"release-note/bug",
"area/servicemesh",
"kind/community-contribution",
"feature/k8s-gateway-api",
"needs-backport/1.20"
],
"author": "shreyasrajiv327",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:cada47e0ca612b386a50",
"signalId": "github:cilium/cilium:issue:47940",
"event": "discovered",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:issue:47940",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Gateway API: Envoy upstream replies from same-node backends lost (RST), nondeterministic across restarts β k3s/Ubuntu-raspi, not reproducible on kind",
"text": "### Is there an existing issue for this? - [X] I have searched the existing issues Closest matches are #47400 / #46260 / #26584, but those are about **ingress** traffic to L7LB frontends being dropped at TC on specific device types. This issue is different: ingress reaches Envoy fine β it is Envoy's **upstream replies from same-node backends** that are lost, and it is nondeterministic across agent restarts/node reboots. ### Version Reproduced on **v1.19.6** and **v1.20.0** (identical behavior). ### What happened? With Gateway API enabled, a `Gateway` + `HTTPRoute` pointing at a Deployment whose 2 replicas are spread across 2 nodes: requests through the gateway (ClusterIP or NodePort, from host netns or external clients) **alternate 200/503**. The failing half are the requests where per-request load balancing picks the backend pod on the **same node as the serving Envoy**; remote-node backends always work. Hubble for a failing request (Envoy upstream connection to the local backend): ``` 10.244.0.216:52632 (ingress) -> website/website-...:3000 (ID:7959) to-endpoint FORWARDED (TCP Flags: SYN) 10.244.0.216:52632 (host) <- website/website-...:3000 (ID:7959) to-stack FORWARDED (TCP Flags: SYN, ACK) 10.244.0.216:52632 (host) -> website/website-...:3000 (ID:7959) to-endpoint FORWARDED (TCP Flags: RST) ``` The backend's SYN-ACK goes `to-stack` **without the proxy mark**, the kernel finds no ordinary socket for the transparent-bound tuple and answers RST. `cilium-dbg monitor --type drop` shows nothing for these flows. Control-plane state is consistent the whole time: - `cilium-dbg shell -- db/show services` β `ProxyRedirect= (ports: [80])` present - `cilium-dbg shell -- db/show envoy-resources` β all `Done`, no errors - `cilium-dbg service list` β ClusterIP shows `1 => 127.0.0.1:/TCP (active)` - `CILIUM_PRE_mangle` TPROXY rule matches the current proxy port - Identical behavior with `bpf.tproxy=true` and `false` **Nondeterminism:** after certain agent restarts the same configuration served 8/8 *including* local backends for a few hours, then regressed to alternating after subsequent node reboots with zero config change. Health appears to depend on datapath programming order, suggesting a race. ### Eliminated during bisection - Gateway API CRD skew β fails with correctly pinned v1.3.0 (on 1.19.6) and v1.6.1 (on 1.20.0) - Kernel version skew β both nodes aligned to the same kernel build, no change - `devices` contents β fails with `{eth0,wlan0}` and `{eth0}` (transient improvement after the change, regressed after reboots) - `bpf.masquerade` true/false (iptables masquerade), `bpf.tproxy` true/false - AppArmor β zero denials involving cilium/envoy in kernel logs - systemd `MACAddressPolicy=persistent` β override to `none` for veth/vxlan applied, no change - Full `helm uninstall` + reinstall, plus clean reboots of both nodes (fresh bpffs) ### Environment (affected) - 2Γ Raspberry Pi 5, Ubuntu 26.04, kernel `7.0.0-1010-raspi` (also `1016`, aligned β no difference), arm64 - k3s `v1.35.4+k3s1` (`--flannel-backend=none --disable-network-policy --disable-kube-proxy --disable=servicelb --disable=traefik`) - Cilium via helm: `kubeProxyReplacement=true`, `routingMode=tunnel`, `tunnelProtocol=vxlan`, `ipam.mode=kubernetes`, `devices={eth0}`, `bpf.masquerade=false`, `MTU=1450`, `gatewayAPI.enabled=true`, external Envoy DaemonSet (defaults) - Node also has a second physical NIC (`wlan0`) outside `devices`, default route via it; inter-node traffic on `eth0` (/30) ### Not reproducible on kind (same versions, same values) The identical stack on kind serves local and remote backends 12/12, which is what makes the affected environment interesting. Full comparison recipe: ```bash cat > kind.yaml << 'K' kind: Cluster apiVersion: kind.x-k8s.io/v1alpha4 networking: {disableDefaultCNI: true, kubeProxyMode: none} nodes: [{role: control-plane}, {role: worker}, {role: worker}] K kind create cluster --config kind.yaml kubectl apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/experimental-install.yaml helm install cilium cilium/cilium -n kube-system --version 1.20.0 \\ --set kubeProxyReplacement=true --set k8sServiceHost=kind-control-plane --set k8sServicePort=6443 \\ --set ipam.mode=kubernetes --set routingMode=tunnel --set tunnelProtocol=vxlan \\ --set \"devices={eth0}\" --set bpf.masquerade=false --set bpf.tproxy=true \\ --set gatewayAPI.enabled=true --set l2announcements.enabled=true --set MTU=1450 # then: Gateway (class cilium) + HTTPRoute -> Deployment pinned to worker1, Service :80 # curl the gateway ClusterIP from worker1 (local case) and worker2 (remote case): both 100% OK on kind ``` On the affected k3s/raspi cluster the same manifests yield the alternating 200/503. ### Anything else? Happy to provide a `cilium sysdump` from the affected cluster, re-run any diagnostics, or test patches β the environment is available and the failure is easy to trigger there. Also happy to try a stock-Ubuntu k3s VM to further separate the k3s axis from the raspi kernel if that helps triage. ### Code of Conduct - [X] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47940",
"createdAt": "2026-08-13T14:50:30Z",
"updatedAt": "2026-08-13T14:50:30Z",
"timestamp": "2026-08-13T14:50:30Z",
"metrics": {
"reactions": 0,
"comments": 0
},
"labels": [],
"author": "thdxg",
"state": "open",
"assignees": [],
"change": "new"
}
},
{
"id": "event:28b07c195d2f4e77057e",
"signalId": "github:cilium/cilium:pull_request:47939",
"event": "discovered",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47939",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "operator/ipam: Remove the per-node pool-maintainer retry trigger",
"text": "Each CiliumNode creates 4 triggers today, and one of them exists only to call another one: the \"-retry\" trigger's entire body is `poolMaintainer.Trigger()`, rate limited to one call per minute. That is one goroutine and one timer per node, which on a large enough production cluster where the majority of goroutine count is driven by node count, amounts to a quarter of the operator's parked trigger waiters. It exists only because of a skewed invariant. The two halves of `waitingForPoolMaintenance` live in different layers: the enqueue sites set it, and `MaintainIPPool` clears it on the one return path. Its early return for an unstable instances API returns with the flag still set, and the flag makes both `allocationNeeded()` and `releaseNeeded()` false, which gate the only two places that ever enqueue the maintainer. Nothing can re-drive the node, hence the retry trigger. This commit gives the flag a single owner instead. `MaintainIPPool` takes it on entry and releases it with a defer, so it is held for exactly the duration of a pass and released on every return path, and the enqueue sites only enqueue. The node reports its deficit again, so the interval based background resync re-drives it, and since that resync only reaches `Resync()` after a successful instances API resync, the node is picked up in the very iteration that observes the API recovering. While it is down the maintainer is re-triggered by node events rather than once per minute, but each of those is an early return that mutates nothing and is bounded by the backoff already applied to failed maintenance. This also fixes a latent strand on the second early return, taken while the instance has been stopped for less than a minute. Its comment says to wait for the custom resource to be updated as a sign of life, but that wait could never complete: `UpdatedResource()` marks the instance running and then consults `allocationNeeded()`, which was false because the flag was still set. A node that briefly stopped while in deficit stayed stranded until the operator restarted.",
"url": "https://github.com/cilium/cilium/pull/47939",
"createdAt": "2026-08-13T14:14:54Z",
"updatedAt": "2026-08-13T15:00:50Z",
"timestamp": "2026-08-13T15:00:50Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"dont-merge/needs-release-note-label"
],
"author": "HadrienPatte",
"state": "open",
"assignees": [],
"change": "new"
}
},
{
"id": "event:1c632f02beef558dc95c",
"signalId": "github:cilium/cilium:pull_request:47912",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47912",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Documentation: document mesh security model",
"text": "There isn't currently an explicit mention of how cluster mesh affects the threat/security model of cilium. To clarify the assumptions the code already makes, make it explicit that there isn't a security boundary between clusters once meshed. We can think about \"improving\"/hardening, but fundamentally I do not believe it to be possible to fully withstand an adversarial meshed cluster any more than it is possible to withstand a compromised agent.",
"url": "https://github.com/cilium/cilium/pull/47912",
"createdAt": "2026-08-12T09:06:00Z",
"updatedAt": "2026-08-13T14:44:48Z",
"timestamp": "2026-08-13T14:44:48Z",
"metrics": {
"reactions": 5,
"comments": 1
},
"labels": [
"area/documentation",
"release-note/misc"
],
"author": "bimmlerd",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:5643894ac3ea10030ecb",
"signalId": "github:cilium/cilium:pull_request:45953",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt",
"metrics"
],
"signal": {
"id": "github:cilium/cilium:pull_request:45953",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "node/manager: Populate node table from manager",
"text": "We're on regular basis now encountering the situation where we would like to be able to fetch and watch information about individual Cilium nodes in the agent. Currently this requires implementing a `node.Handler` and subscribing with the `NodeManager` which is fair bit of boilerplate and annoying to test. It's even worse if all the rest of the code is interacting with StateDB tables. As a first small step towards https://github.com/cilium/cilium/issues/41744 and to allow new code to easily watch and look up nodes, change the `Table[*LocalNode]` into `Table[*Node]` and populate the remote nodes into this table from `NodeManager`. This PR tries to keep the changes to a minimum and local to `pkg/node` and hence uses adds a `type LocalNode = Node` alias and doesn't change the `LocalNodeStoreCell` structure. The runtime impact of this change without further cleanup is that we now temporarily have an additional index for remote Cilium nodes and we store`types.Node` twice (shallow clone, 296 bytes). The next step would be to refactor `NodeManager` to use `Table[*Node]` internally to avoid the duplicate indexing.",
"url": "https://github.com/cilium/cilium/pull/45953",
"createdAt": "2026-05-13T12:42:16Z",
"updatedAt": "2026-08-13T14:44:17Z",
"timestamp": "2026-08-13T14:44:17Z",
"metrics": {
"reactions": 2,
"comments": 8
},
"labels": [
"release-note/misc"
],
"author": "joamaki",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:24bbd4cc54f27aea93d2",
"signalId": "github:cilium/cilium:pull_request:47931",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47931",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "cilium-cli: Skip HostToWorld if no external IPv6",
"text": "As with PodToWorld() we need to skip the IPv6 actions if ExternalTargetIPv6Capable parameter is not set.",
"url": "https://github.com/cilium/cilium/pull/47931",
"createdAt": "2026-08-13T08:20:52Z",
"updatedAt": "2026-08-13T14:43:40Z",
"timestamp": "2026-08-13T14:43:40Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"ready-to-merge",
"release-note/ci",
"cilium-cli",
"cilium-cli-exclusive"
],
"author": "joamaki",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:99e131bde2d36733cd27",
"signalId": "github:cilium/cilium:pull_request:46839",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt",
"labels",
"state"
],
"signal": {
"id": "github:cilium/cilium:pull_request:46839",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "operator/ipam: recover nodes dropped from the instance cache during resync",
"text": "In ENI IPAM mode with `eni.subnetTagsFilter` set, a full ENI resync calls `DescribeNetworkInterfaces` and replaces the operator's entire instance cache with the ENIs discovered in the pod subnets. During a large scale-up, a freshly launched node whose pod subnet ENI has not been attached yet is not represented in that refreshed cache. Once the node disappears from the cache, `ResyncInterfacesAndIPs` returns \"instance not found\", `recalculate()` sets `NeededIPs=0` and stops trying to allocate, and the node stays stuck at `available=0` until the operator is restarted. This change re-triggers the node's existing per-instance `instanceSync` when a live node's instance is not in the instance cache, reusing the `HasInstance()` check that `Upsert` already performs. The check is done by the callers of `recalculate()`, where the `NodeManager` lock state is known: - `Resync` already holds the `NodeManager` mutex and passes the instances API readiness down to its `resyncNode` workers (calling `InstancesAPIIsReady()` from a worker would deadlock against the semaphore). - `MaintainIPPool` holds no locks and queries `InstancesAPIIsReady()` directly. The sync is re-triggered at most once while the instance stays missing and is re-armed by the next successful recalculation, or by a transient failure of the re-triggered sync itself. Recovery runs are tagged with a dedicated trigger reason (`instanceNotFoundSyncReason`) so that only their failures re-arm the re-trigger. If the per-instance sync authoritatively reports the instance as gone (`ErrInstanceNotFound`, e.g. Azure returning HTTP 404), the re-trigger is not re-armed; only transient failures retry. This prevents a sync retry loop for instances which were legitimately terminated but whose CiliumNode resource still exists: those get a single probe sync and then revert to the previous warn-only behavior. Unit tests exercise the recovery through the real `Resync`/`Upsert` entry points with timeout guards, acting as regression tests against re-introducing a deadlock on the `NodeManager` mutex. Fixes: #46513 _This PR was prepared with AIL:3 (AI-assisted, human-directed and verified). I reviewed the change and own it._ ```release-note operator/ipam: recover ENI IPAM nodes that were dropped from the instance cache by a full ENI resync, instead of requiring an operator restart ```",
"url": "https://github.com/cilium/cilium/pull/46839",
"createdAt": "2026-07-01T18:13:23Z",
"updatedAt": "2026-08-13T14:41:56Z",
"timestamp": "2026-08-13T14:41:56Z",
"metrics": {
"reactions": 2,
"comments": 9
},
"labels": [
"release-note/bug",
"ready-to-merge",
"kind/community-contribution",
"area/ipam",
"needs-backport/1.20"
],
"author": "ryanjwong",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:1e96f0f0766f5503ecdb",
"signalId": "github:cilium/cilium:pull_request:47394",
"event": "discovered",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47394",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "feat(bgp): support BGP unnumbered peering (RFC 5549 / ENHE)",
"text": "- [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developer's Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [x] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [x] Thanks for contributing! ## Description Adds interface-only (\"unnumbered\") BGP peering (RFC 5549 / ENHE) to the Cilium BGP control plane, driven through the `autoDiscovery` stanza on a peer. No `peerAddress` is configured: gobgp discovers the peer's IPv6 link-local address via ND on the interface and derives the local link-local source. This lets a Cilium node peer with a directly attached router (our case: FRR on a ToR) over a point-to-point link that carries no addressing beyond link-local. The interface can be named explicitly: ```yaml peers: - name: tor-switch peerASN: 65000 autoDiscovery: mode: Unnumbered unnumbered: interface: enp193s0f0np0 peerConfigRef: name: cilium-peer ``` For a fleet where the interface is not named the same everywhere β predictable names encode hardware location and change with the NIC model and driver, so one cluster config cannot name it, and pinning it with `CiliumBGPNodeConfigOverride` means one override object per node. For this case, we can discover using the default gateway: ```yaml peers: - name: tor-switch peerASN: 65000 autoDiscovery: mode: Unnumbered defaultGateway: addressFamily: ipv4 # \"ipv4\" or \"ipv6\" peerConfigRef: name: cilium-peer ``` Exactly one of `unnumbered` and `defaultGateway` is required with mode `Unnumbered`, enforced by CEL. In the `defaultGateway` form, only the *egress interface* of the default route is taken from the route β the peer address still comes from gobgp's ND on that interface. Two consequences worth calling out for review: - `addressFamily` selects which default route to follow, not the family the session runs over. The session is always IPv6 link-local, so following the IPv4 default route is a valid configuration. - Because the gateway address itself is unused, a link-local gateway (what an unnumbered peer usually advertises β `default via fe80::1`, or `default via 169.254.100.0`) and an on-link default route with no gateway at all are both usable here, unlike `DefaultGateway` mode. A peer whose interface cannot be derived yet β normally because the default route is not installed yet β is left unconfigured and logged at Warn once, rather than failing the reconciliation. If the route moves, the session reconciles onto the new interface. An address-less peer also needs plumbing on the agent side, included here: peer status is matched by name rather than by address (an unnumbered peer has no configured address, so address matching silently dropped it from `CiliumBGPNodeConfig` status), the address gobgp resolves is fed back into the route policies keyed on peer address (otherwise nothing is ever advertised to the peer), and `cilium bgp peers` prints the resolved zoned address without a meaningless `:port` suffix before resolution. ### Commits 1. **vendor: bump gobgp to v4.8.0 for unnumbered AddPeer fix.** the gRPC `AddPeer` path rejected interface-only neighbors, fixed upstream in [osrg/gobgp#3504](https://github.com/osrg/gobgp/pull/3504). 3. **fix(bgp): only auto-discover the default gateway from the main table.** Pre-existing `DefaultGateway` bug: a node's other tables carry default routes that are not the way off the node, often at a better metric. 4. **feat(bgp): add peerInterface field for IPv6 link-local peering.** The explicit-address counterpart to unnumbered peering β a `fe80::/10` `peerAddress` plus the interface it is reachable on, yielding a zoned neighbor. 5. **feat(bgp): support BGP unnumbered via autoDiscovery mode Unnumbered.** Routes interface-only peering through `autoDiscovery` rather than a standalone `peerInterface`, per the maintainer steer on #22132. 6. **feat(bgp): send IPv6 Router Advertisements on unnumbered interfaces.** FRR only keeps an unnumbered neighbor whose link-local it learned from that peer's RAs, and gobgp sends none. Also carries a datapath fix β RS/RA were dropped by `snat_v6_nat()` rather than punted to the stack like NS/NA. 7. **feat(bgp): discover the unnumbered interface from the default route.** The `defaultGateway` form of mode `Unnumbered`, described above. Docs for both `Unnumbered` forms, the peer-side requirements (FRR `neighbor interface remote-as `, RFC 8950 extended next hop for IPv4 over the IPv6 session), and sample `cilium bgp peers` output are in commits 2 and 6. The CRD schema version is bumped to 1.34.3. ### Testing Unit tests cover the new reconciler paths, CEL validation, conversions, status reporting and the RA reconciler. The end-to-end validation against a live cluster peered with FRR was done not from this branch but from the equivalent work backported to v1.19.x on my fork (`lab-backport-v1.19.4`). This main-targeted branch is the functional twin, adapted for main. The two are kept in deliberate lockstep: - Same behavior, adapted code β not a blind rebase. Each branch is adapted for its gobgp version and table API. - gobgp major version differs. The backport vendors the cilium/gobgp v3 fork (`vendor/.../gobgp/v3/...`) carrying the equivalent unnumbered fixes; main vendors upstream osrg/gobgp v4.8.0, which ships the `AddPeer` fix as released code. v4 keys `neighborMap` by `netip.MustParseAddr(addr)`, which parses the resolved zoned link-local correctly. - Table API rename. main uses `tables.DeviceByName`; the v1.19.x backport still uses `tables.DeviceNameIndex` / `DeviceIDIndex` (rename is main-only). This PR was prepared with AIL:2. I personally wrote or checked all code and validated the behavior end-to-end against a live cluster and DPU (on the v1.19.x backport). Fixes: #22132 ```release-note bgp: support unnumbered (interface-only, RFC 5549) BGP peering via `autoDiscovery.mode: Unnumbered`, with the peering interface either named explicitly or discovered per node from the default route, plus a `peerInterface` field for zoned IPv6 link-local peering. ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developer's Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47394",
"createdAt": "2026-07-21T16:51:52Z",
"updatedAt": "2026-08-13T14:35:55Z",
"timestamp": "2026-08-13T14:35:55Z",
"metrics": {
"reactions": 2,
"comments": 8
},
"labels": [
"dont-merge/needs-sign-off",
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "ecbaldwin",
"state": "open",
"assignees": [],
"change": "new"
}
},
{
"id": "event:98d1193937619cb4428c",
"signalId": "github:cilium/cilium:pull_request:47937",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt",
"metrics"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47937",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "fix(deps): update all go dependencies main",
"text": "Manually bump the go dependencies, since renovate seems to be struggling.",
"url": "https://github.com/cilium/cilium/pull/47937",
"createdAt": "2026-08-13T12:54:23Z",
"updatedAt": "2026-08-13T14:32:32Z",
"timestamp": "2026-08-13T14:32:32Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"release-note/misc",
"dependencies"
],
"author": "julianwiedmann",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:b1edc861178984bdba05",
"signalId": "github:cilium/cilium:pull_request:47277",
"event": "discovered",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47277",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Fix 5-tuple collision in conformance kind proxy embedded",
"text": "Fix test flake due to 5-tuple collision. The flake happens in `l7-lb` test that intentionally accesses the same backend via both L7-LB service and normal L3/4 load balancer service when the pod happens to use the same source port for both: 1. Access via L7-LB service works, Envoy keeps the upstream connection open on the 5-tuple with the source pod IP/port and the backend IP/port 2. Access via non-L7-LB service stalled due to CT entry keeping the `from_l7lb` flag from the previous L7-LB upstream connection, causing SYN/ACK to be redirected to Envoy. This is fixed by the bpf datapath change in the first commit. 3. Access via L7-LB service again fails due to the backend not having consistent TCP connection state with the Envoy upstream connection that is still open on the Envoy end. This is fixed by enabling retry timeouts and setting socket linger option to 0, causing the old upstream connection being closed synchronously after the timeout, so that the retry connection can re-use the same 5-tuple and negotiate a new connection with the backend This was confirmed in a local test that explicitly set the same source port for `curl`. AIL: 3 ```release-note Set `envoy.httpRetryTimeout` to one second and `envoy.httpUpstreamLingerTimeout` to zero to recover from 5-tuple collisions between L7-LB and non-L7-LB traffic. ```",
"url": "https://github.com/cilium/cilium/pull/47277",
"createdAt": "2026-07-17T11:42:40Z",
"updatedAt": "2026-08-13T14:23:16Z",
"timestamp": "2026-08-13T14:23:16Z",
"metrics": {
"reactions": 2,
"comments": 3
},
"labels": [
"area/CI",
"area/proxy",
"release-note/ci",
"ci/flake",
"area/loadbalancing",
"feature/k8s-gateway-api"
],
"author": "jrajahalme",
"state": "open",
"assignees": [],
"change": "new"
}
},
{
"id": "event:40fa570ed922265d21a0",
"signalId": "github:cilium/cilium:pull_request:47936",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"text",
"updatedAt"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47936",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "bpf: preserve original source in NodePort tunnel traces",
"text": "## Summary Preserve the original IPv4 or IPv6 client address in `TRACE_TO_OVERLAY` when tunneled NodePort or LoadBalancer traffic is SNATed. Hubble can then show the client address in `source` and the SNAT address in `source_xlated`. Flows without SNAT and other encapsulation paths are unchanged. ## Testing - Overlay NodePort BPF runtime tests - Hubble parser tests - Full BPF build matrix",
"url": "https://github.com/cilium/cilium/pull/47936",
"createdAt": "2026-08-13T11:29:30Z",
"updatedAt": "2026-08-13T14:22:03Z",
"timestamp": "2026-08-13T14:22:03Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"dont-merge/needs-release-note-label"
],
"author": "darox",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:da05d67d217b60327677",
"signalId": "github:cilium/cilium:pull_request:47938",
"event": "discovered",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47938",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "[WIP] Runtime cloud-IPAM routing rules reconciliation",
"text": "-- WORK IN PROGRESS --",
"url": "https://github.com/cilium/cilium/pull/47938",
"createdAt": "2026-08-13T14:07:11Z",
"updatedAt": "2026-08-13T14:07:34Z",
"timestamp": "2026-08-13T14:07:34Z",
"metrics": {
"reactions": 2,
"comments": 0
},
"labels": [
"dont-merge/preview-only",
"dont-merge/needs-release-note-label"
],
"author": "pippolo84",
"state": "open",
"assignees": [],
"change": "new"
}
},
{
"id": "event:42ac5e1925b90a7d9f07",
"signalId": "github:cilium/cilium:pull_request:47902",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt",
"labels"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47902",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "golangci-lint: Forbid stdlib `net.Interface*` functions",
"text": "The Go stdlib `net.Interface*` family talks to the kernel over a netlink socket with no timeout, so it can block forever. This PR converts the two remaining offenders to `netlink/safenetlink` and add a forbidigo rule so new ones don't creep back in. Fixes: #15051",
"url": "https://github.com/cilium/cilium/pull/47902",
"createdAt": "2026-08-11T20:27:45Z",
"updatedAt": "2026-08-13T13:57:28Z",
"timestamp": "2026-08-13T13:57:28Z",
"metrics": {
"reactions": 3,
"comments": 1
},
"labels": [
"release-note/misc"
],
"author": "HadrienPatte",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:7f5ac577199e273504f6",
"signalId": "github:cilium/cilium:issue:46513",
"event": "changed",
"observedAt": "2026-08-13T16:19:22.035158Z",
"changedFields": [
"updatedAt",
"state"
],
"signal": {
"id": "github:cilium/cilium:issue:46513",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Operator/IPAM: recover nodes dropped from the instance cache by the full ENI resync",
"text": "### Is your proposed feature related to a problem? Yes and it has been reported [here as well](https://github.com/cilium/cilium/issues/35404). I hit this running: Cilium v1.19.4, EKS, ENI IPAM mode, cilium-operator with `eni.subnetTagsFilter`. During a big scale-up, 348β432 instances in ~2 min, 5 freshly launched nodes were stuck permanently with `available=0` until an operator restart, with 1000+ \"Instance not found!\" warnings per node over 2 days. 1. At CiliumNode creation, the one-shot per-instance sync succeeds and is now cached by the operator. 2. The node's primary ENI attaches but the pod subnet ENI does not get attached immediately due to \"Failed to update CiliumNode\" conflicts during big scale ups. 3. Before the pod subnet ENI is attached by the pool maintainer, the operator runs a re-sync. 4. When `eni.subnetTagsFilter` is set, this re-sync calls `DescribeNetworkInterfaces` where it then pulls all ENIS from the pod subnets and replaces the entire operator's cache. 5. Because our node doesn't have a pod subnet ENI yet, its not tracked in this newly replaced cache. 6. The operator never assigns an ENI to the node because this node is not tracked. A failed cache lookup means that the operator sets `NeededIPs=0`, which doesn't trigger the pool maintainer to retry to attach the ENI. Restarting the operator can as it re-triggers the one-shot per instance sync, where the node is re-cached and can then be assigned the pod subnet ENI, however this is not guaranteed as the re-sync could run before this happens, repeating the cycle. ### Describe the feature you'd like The operator should self-heal when a live node's instance disappears from the instance cache, instead of requiring a manual operator restart. Specifically when `ResyncInterfacesAndIPs` fails with instance-not-found for a node whose CiliumNode still exists, re-trigger the node's existing per-instance `instanceSync` trigger (rate-limited, and only while `InstancesAPIIsReady()` / `stableInstancesAPI` is true), rather than permanently setting `NeededIPs=0`. ### Notify relevant community channels @cilium/sig-ipam @cilium/aws ### (Optional) Describe your proposed solution I'd like to work on this issue! I plan to edit `operator/pkg/ipam/nodemanager/node.go` `recalculate()` so when a node is not found from the operator's re-sync, the node's `instanceSync.Trigger()` if the node is ready.",
"url": "https://github.com/cilium/cilium/issues/46513",
"createdAt": "2026-06-12T08:45:54Z",
"updatedAt": "2026-08-13T13:57:01Z",
"timestamp": "2026-08-13T13:57:01Z",
"metrics": {
"reactions": 0,
"comments": 1
},
"labels": [
"kind/feature",
"stale",
"area/eni",
"kind/cfp",
"area/ipam"
],
"author": "ryanjwong",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:6e03b37e4872d72a5379",
"signalId": "github:cilium/cilium:pull_request:47902",
"event": "changed",
"observedAt": "2026-08-13T17:43:20.785491Z",
"changedFields": [
"updatedAt",
"metrics",
"labels",
"state"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47902",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "golangci-lint: Forbid stdlib `net.Interface*` functions",
"text": "The Go stdlib `net.Interface*` family talks to the kernel over a netlink socket with no timeout, so it can block forever. This PR converts the two remaining offenders to `netlink/safenetlink` and add a forbidigo rule so new ones don't creep back in. Fixes: #15051",
"url": "https://github.com/cilium/cilium/pull/47902",
"createdAt": "2026-08-11T20:27:45Z",
"updatedAt": "2026-08-13T17:43:13Z",
"timestamp": "2026-08-13T17:43:13Z",
"metrics": {
"reactions": 4,
"comments": 1
},
"labels": [
"ready-to-merge",
"release-note/misc"
],
"author": "HadrienPatte",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:db3a630eac9ea1df2b29",
"signalId": "github:cilium/cilium:pull_request:47932",
"event": "changed",
"observedAt": "2026-08-13T17:43:20.785491Z",
"changedFields": [
"updatedAt",
"labels",
"state"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47932",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "clustermesh/endpointslices: explicitly limit maximum decoder memory",
"text": "Explicitly configure a limit for the zstd decoder used to decode the ClusterEndpointSlice entries received over Cluster Mesh, to prevent the risk of unbounded memory usage in case of crafted payloads. I've marked the PR as `release-note/misc` because the logic ingesting ClusterEndpointSlices is incomplete and disabled behind a feature flag in v1.20. Reported-by: Secstant - Sigma Prime \\",
"url": "https://github.com/cilium/cilium/pull/47932",
"createdAt": "2026-08-13T08:30:58Z",
"updatedAt": "2026-08-13T17:38:58Z",
"timestamp": "2026-08-13T17:38:58Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"ready-to-merge",
"area/clustermesh",
"release-note/misc",
"needs-backport/1.20"
],
"author": "giorio94",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:e2195e18ffbf95644233",
"signalId": "github:cilium/cilium:pull_request:47826",
"event": "changed",
"observedAt": "2026-08-13T17:43:20.785491Z",
"changedFields": [
"updatedAt"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47826",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "gateway-api: log the right route kind when listing TLSRoutes fails",
"text": "## Description `EnqueueRequestForBackendService` lists TLSRoutes immediately after HTTPRoutes, and the error path of the TLSRoute call was copied from the HTTPRoute one above it without changing the message. A failure to list TLSRoutes is reported as `Failed to get related HTTPRoutes`, which points anyone reading the log at the wrong index and the wrong CRD. That same line is also the only `List` error handler in `operator/pkg/gateway-api/watch-handlers` that calls `Error` rather than `ErrorContext`, so it drops the context from the log record while all fourteen of its neighbours keep it. The sibling handler `EnqueueRequestForBackendServiceImport` already logs this exact failure as `Failed to get related TLSRoutes`, so this just makes the two agree. Found while looking at #47819. That issue also asks for a `helpers.HasTLSRouteSupport` guard around these two `List` calls. I left that out on purpose: on `main`, `TLSRouteKind` is in `helpers.RequiredGVKs`, and `checkCRDs` disables Gateway API entirely when a required CRD is missing, so the guard cannot be false here and would be dead code. Only the log line is wrong on `main`. ```release-note Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service ```",
"url": "https://github.com/cilium/cilium/pull/47826",
"createdAt": "2026-08-06T19:15:38Z",
"updatedAt": "2026-08-13T17:38:45Z",
"timestamp": "2026-08-13T17:38:45Z",
"metrics": {
"reactions": 2,
"comments": 4
},
"labels": [
"kind/bug",
"release-note/bug",
"ready-to-merge",
"area/servicemesh",
"kind/community-contribution",
"feature/k8s-gateway-api",
"needs-backport/1.20"
],
"author": "mehrdadbn9",
"state": "closed",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:e413de2f04044aee5432",
"signalId": "github:cilium/cilium:issue:15051",
"event": "discovered",
"observedAt": "2026-08-13T17:43:20.785491Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:issue:15051",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Replace stdlib net.Interface* with vishvananda/netlink to avoid blocked forever goroutines",
"text": "Netlink is not reliable protocol, and recv without a timeout might block infinitely. See https://github.com/cilium/cilium/issues/14710 and https://github.com/cilium/cilium/issues/14746#issuecomment-781811881 for more ctx. The Go's stdlib `net.Interface*()` function family when built for Linux (https://github.com/golang/go/blob/master/src/net/interface_linux.go) is using netlink socket w/o timeout to retrieve ifaces. Currently, we have the following `net.Interface*()` users in the code: ``` cilium@master > gg -l net.Interface pkg/mcastmanager/mcastmanager_test.go pkg/mtu/detect_linux.go pkg/multicast/multicast.go pkg/multicast/multicast_test.go vendor/github.com/google/gopacket/layers/sflow.go vendor/github.com/google/uuid/node_net.go vendor/github.com/shirou/gopsutil/net/net.go vendor/github.com/shirou/gopsutil/net/net_windows.go vendor/github.com/vishvananda/netns/README.md vendor/golang.org/x/net/icmp/helper_posix.go vendor/golang.org/x/net/icmp/interface.go vendor/golang.org/x/net/internal/socket/sys_posix.go vendor/golang.org/x/net/ipv4/dgramopt.go vendor/golang.org/x/net/ipv4/doc.go vendor/golang.org/x/net/ipv4/sockopt_posix.go vendor/golang.org/x/net/ipv4/sockopt_stub.go vendor/golang.org/x/net/ipv4/sys_asmreq.go vendor/golang.org/x/net/ipv4/sys_asmreq_stub.go vendor/golang.org/x/net/ipv4/sys_asmreqn.go vendor/golang.org/x/net/ipv4/sys_asmreqn_stub.go vendor/golang.org/x/net/ipv4/sys_ssmreq.go vendor/golang.org/x/net/ipv4/sys_ssmreq_stub.go vendor/golang.org/x/net/ipv6/dgramopt.go vendor/golang.org/x/net/ipv6/doc.go vendor/golang.org/x/net/ipv6/sockopt_posix.go vendor/golang.org/x/net/ipv6/sockopt_stub.go vendor/golang.org/x/net/ipv6/sys_asmreq.go vendor/golang.org/x/net/ipv6/sys_asmreq_stub.go vendor/golang.org/x/net/ipv6/sys_ssmreq.go vendor/golang.org/x/net/ipv6/sys_ssmreq_stub.go vendor/k8s.io/apimachinery/pkg/util/net/interface.go ``` Once #14710 has been resolved, switch to vishvananda/netlink to avoid the blocks.",
"url": "https://github.com/cilium/cilium/issues/15051",
"createdAt": "2021-02-22T09:25:59Z",
"updatedAt": "2026-08-13T17:12:25Z",
"timestamp": "2026-08-13T17:12:25Z",
"metrics": {
"reactions": 5,
"comments": 10
},
"labels": [
"kind/bug",
"area/daemon",
"pinned",
"area/agent"
],
"author": "brb",
"state": "closed",
"assignees": [],
"change": "new"
}
},
{
"id": "event:b39f5adbbb9822b2479e",
"signalId": "github:cilium/cilium:pull_request:47945",
"event": "discovered",
"observedAt": "2026-08-13T17:43:20.785491Z",
"changedFields": [],
"signal": {
"id": "github:cilium/cilium:pull_request:47945",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "install: detect containerd from GKE kubelet config",
"text": "Newer GKE node images configure `containerRuntimeEndpoint` in `/home/kubernetes/kubelet-config.yaml` instead of `/etc/default/kubelet`. This causes the existing GKE containerd detection in node-init to miss the GKE-specific path and fall through to the generic kubelet handling. This change: * preserves the existing legacy GKE/containerd detection; * recognizes the newer `kubelet-config.yaml` layout when it points to containerd; * updates prestop detection as well so an installed kubelet wrapper can be reverted correctly. Legacy and generic node behavior remains unchanged. Testing performed: * `helm lint` * Helm template rendering with GKE/node-init values * `bash -n` on rendered startup and prestop scripts * runtime-endpoint regex tests * sandboxed scenarios covering legacy GKE, the new GKE layout with and without the `gke` marker, non-containerd endpoints, generic nodes, and a missing `/etc/default/kubelet` * `git diff --check` Claude was used to suggest the implementation. I manually reviewed the changes and validated the resulting behavior with the tests above. AIL:4 Fixes: #47884 ```release-note Fix node-init startup on newer GKE nodes that configure the container runtime endpoint in kubelet-config.yaml. ```",
"url": "https://github.com/cilium/cilium/pull/47945",
"createdAt": "2026-08-13T16:58:59Z",
"updatedAt": "2026-08-13T17:10:53Z",
"timestamp": "2026-08-13T17:10:53Z",
"metrics": {
"reactions": 1,
"comments": 0
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "dlanov",
"state": "open",
"assignees": [],
"change": "new"
}
},
{
"id": "event:ffec542d2882e43f43ad",
"signalId": "github:cilium/cilium:pull_request:47912",
"event": "changed",
"observedAt": "2026-08-13T17:43:20.785491Z",
"changedFields": [
"updatedAt"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47912",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "Documentation: document mesh security model",
"text": "There isn't currently an explicit mention of how cluster mesh affects the threat/security model of cilium. To clarify the assumptions the code already makes, make it explicit that there isn't a security boundary between clusters once meshed. We can think about \"improving\"/hardening, but fundamentally I do not believe it to be possible to fully withstand an adversarial meshed cluster any more than it is possible to withstand a compromised agent.",
"url": "https://github.com/cilium/cilium/pull/47912",
"createdAt": "2026-08-12T09:06:00Z",
"updatedAt": "2026-08-13T16:54:51Z",
"timestamp": "2026-08-13T16:54:51Z",
"metrics": {
"reactions": 5,
"comments": 1
},
"labels": [
"area/documentation",
"release-note/misc"
],
"author": "bimmlerd",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:e2883e3a46f42d431441",
"signalId": "github:cilium/cilium:pull_request:47944",
"event": "changed",
"observedAt": "2026-08-13T17:43:20.785491Z",
"changedFields": [
"updatedAt"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47944",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "hubble: add optional protocol and port labels to policy metrics",
"text": "Add opt-in protocol and destination port labels to hubble_policy_verdicts_total. Both labels are disabled by default to preserve the existing metric label set. The destination port label may increase metric cardinality depending on the traffic pattern. Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [x] If your commit description contains a `Fixes: ` tag, then please add the commit author[s] as reviewer[s] to this issue. - [x] All commits are signed off. See the section [Developerβs Certificate of Origin] - [x] Provide a title or release-note blurb suitable for the release notes. - [ ] Disclose use of machine learning models (including LLMs and other generative AI) in accordance with the [Cilium AI Policy], and indicate the rating using [AI Influence Level]. Example: \"This PR was prepared with AIL:3. I personally checked X.\" - [ ] Thanks for contributing! Related: #34304 ```release-note Add opt-in `protocol` and destination `port` labels to `hubble_policy_verdicts_total`. Enable the additional labels with: ```yaml hubble: metrics: enabled: - \"policy:protocol;destination_port\" Both options are disabled by default to preserve the existing metric label set. The port option may increase metric cardinality depending on traffic patterns. ``` [AI Influence Level]: https://danielmiessler.com/blog/ai-influence-level-ail [Cilium AI Policy]: https://github.com/cilium/community/blob/main/AI-POLICY.md [Developerβs Certificate of Origin]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#dev-coo [Submitting a pull request]: https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request",
"url": "https://github.com/cilium/cilium/pull/47944",
"createdAt": "2026-08-13T15:58:47Z",
"updatedAt": "2026-08-13T16:54:24Z",
"timestamp": "2026-08-13T16:54:24Z",
"metrics": {
"reactions": 1,
"comments": 1
},
"labels": [
"dont-merge/needs-release-note-label",
"kind/community-contribution"
],
"author": "stias",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:92bc634ecda085acb411",
"signalId": "github:cilium/cilium:pull_request:47939",
"event": "changed",
"observedAt": "2026-08-13T17:43:20.785491Z",
"changedFields": [
"updatedAt"
],
"signal": {
"id": "github:cilium/cilium:pull_request:47939",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "operator/ipam: Remove the per-node pool-maintainer retry trigger",
"text": "Each CiliumNode creates 4 triggers today, and one of them exists only to call another one: the \"-retry\" trigger's entire body is `poolMaintainer.Trigger()`, rate limited to one call per minute. That is one goroutine and one timer per node, which on a large enough production cluster where the majority of goroutine count is driven by node count, amounts to a quarter of the operator's parked trigger waiters. It exists only because of a skewed invariant. The two halves of `waitingForPoolMaintenance` live in different layers: the enqueue sites set it, and `MaintainIPPool` clears it on the one return path. Its early return for an unstable instances API returns with the flag still set, and the flag makes both `allocationNeeded()` and `releaseNeeded()` false, which gate the only two places that ever enqueue the maintainer. Nothing can re-drive the node, hence the retry trigger. This commit gives the flag a single owner instead. `MaintainIPPool` takes it on entry and releases it with a defer, so it is held for exactly the duration of a pass and released on every return path, and the enqueue sites only enqueue. The node reports its deficit again, so the interval based background resync re-drives it, and since that resync only reaches `Resync()` after a successful instances API resync, the node is picked up in the very iteration that observes the API recovering. While it is down the maintainer is re-triggered by node events rather than once per minute, but each of those is an early return that mutates nothing and is bounded by the backoff already applied to failed maintenance. This also fixes a latent strand on the second early return, taken while the instance has been stopped for less than a minute. Its comment says to wait for the custom resource to be updated as a sign of life, but that wait could never complete: `UpdatedResource()` marks the instance running and then consults `allocationNeeded()`, which was false because the flag was still set. A node that briefly stopped while in deficit stayed stranded until the operator restarted.",
"url": "https://github.com/cilium/cilium/pull/47939",
"createdAt": "2026-08-13T14:14:54Z",
"updatedAt": "2026-08-13T16:48:19Z",
"timestamp": "2026-08-13T16:48:19Z",
"metrics": {
"reactions": 2,
"comments": 2
},
"labels": [
"dont-merge/needs-release-note-label"
],
"author": "HadrienPatte",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:6851ebcd6d8999cbc719",
"signalId": "github:cilium/cilium:pull_request:45656",
"event": "changed",
"observedAt": "2026-08-13T17:43:20.785491Z",
"changedFields": [
"updatedAt",
"labels"
],
"signal": {
"id": "github:cilium/cilium:pull_request:45656",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "pull_request",
"title": "contrib: Don't descend into ~/.cache subdirs when chowning in builder.sh",
"text": "When Podman is used as Docker's drop-in replacement, it mounts volumes owned by user inaccessible by root inside the container, and the recursive chown fails. Don't try to go inside the mountpoints when fixing the ownership of /home/ubuntu. Fixes: 65cdb42f3ff6 (\"contrib: chown ~/.cache in builder.sh\") ```release-note Follow-up bugfixes for builder.sh. ```",
"url": "https://github.com/cilium/cilium/pull/45656",
"createdAt": "2026-04-28T11:15:47Z",
"updatedAt": "2026-08-13T16:40:55Z",
"timestamp": "2026-08-13T16:40:55Z",
"metrics": {
"reactions": 0,
"comments": 9
},
"labels": [
"dont-merge/needs-rebase",
"release-note/misc"
],
"author": "gentoo-root",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:aea45786b1061e8ee339",
"signalId": "github:cilium/cilium:issue:47930",
"event": "changed",
"observedAt": "2026-08-13T17:43:20.785491Z",
"changedFields": [
"updatedAt",
"metrics",
"labels"
],
"signal": {
"id": "github:cilium/cilium:issue:47930",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Potential issue with usePrimaryAddress on a t3.small",
"text": "### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.19.6 and lower than v1.20.0 ### What happened? ## Potential issue with usePrimaryAddress ### Cilium v1.19.6, AWS `t3.small` On a `t3.small` instance using AWS ENI IPAM mode with `use-primary-address: true`, Cilium seems to cap max IPs at 9 when 11 is expected. This is based on a `t3.small`'s limits of 3 ENIs, 4 IPs per ENI = 11 pod IPs max (3, 4, 4 - one reserved). ```pwsh > (aws ec2 describe-instance-types --instance-types t3.small --region eu-west-2 | ConvertFrom-Json).InstanceTypes[0].NetworkInfo | Select-Object MaximumNetworkInterfaces, Ipv4AddressesPerInterface MaximumNetworkInterfaces Ipv4AddressesPerInterface ------------------------ ------------------------- 3 4 ``` ```pwsh > helm get values cilium -n kube-system ``` ```yaml USER-SUPPLIED VALUES: cni: configMap: cni-configuration customConf: true egressMasqueradeInterfaces: eth0 enableIPv4Masquerade: false enabled: true eni: awsReleaseExcessIPs: true enabled: true nodeSpec: usePrimaryAddress: true subnetTagsFilter: - ourLegitimate/redactedFilter externalIPs: enabled: true hostPort: enabled: true ipam: mode: eni kubeProxyReplacement: false nodeinit: enabled: true operator: enabled: true nodeSelector: avcosystems.com/node-type: burst kubernetes.io/arch: amd64 kubernetes.io/os: linux podDisruptionBudget: enabled: true maxUnavailable: 1 prometheus: enabled: true serviceMonitor: enabled: true resources: limits: cpu: 50m memory: 80Mi requests: cpu: 7m memory: 35Mi prometheus: enabled: true serviceMonitor: enabled: true namespace: monitoring resources: limits: cpu: 300m memory: null requests: cpu: 120m memory: 165Mi routingMode: native tunnelProtocol: \"\" upgradeCompatibility: \"1.10\" ``` Observing logs, a pod is attempted to be put onto the node that already has 9 pods, at which point it consistently errors with e.g. ```bash Warning FailedCreatePodFoo 15m kubelet Failed to create pod foo: rpc error: code = Unknown desc = failed to setup network for foo \"25cc25redacted\": plugin type=\"cilium-cni\" failed (add): unable to allocate IP via local cilium agent: [POST /ipam][502] postIpamFailure \"no IPs currently available on the node, allocation will be retried once Cilium Operator allocates more IPs\" Warning FailedCreatePodFoo 105s (x62 over 15m) kubelet (combined from similar events): Failed to create pod foo: rpc error: code = Unknown desc = failed to setup network for foo \"3d3a7redacted\": plugin type=\"cilium-cni\" failed (add): unable to allocate IP via local cilium agent: [POST /ipam][502] postIpamFailure \"no IPs currently available on the node, allocation will be retried once Cilium Operator allocates more IPs\" ``` with up to 9 pods currently active with assigned IPs. ```pwsh > kubectl get ciliumnode ip-17redacted.eu-west-2.compute.internal -o jsonpath='{.spec.ipam}' | jq { \"pool\": { \"ip1\": { \"resource\": \"eni-1-id\" }, \"ip2\": { \"resource\": \"eni-1-id\" }, \"ip3\": { \"resource\": \"eni-2-id\" }, \"ip4\": { \"resource\": \"eni-3-id\" }, \"ip5\": { \"resource\": \"eni-1-id\" }, \"ip6\": { \"resource\": \"eni-2-id\" }, \"ip7\": { \"resource\": \"eni-3-id\" }, \"ip8\": { \"resource\": \"eni-2-id\" }, \"ip9\": { \"resource\": \"eni-3-id\" } }, \"pools\": {}, \"pre-allocate\": 8 } ``` ```pwsh > kubectl get ciliumnode ip-17redacted.eu-west-2.compute.internal -o jsonpath='{.status.eni.enis}' | jq { \"eni-1-id\": { \"addresses\": [ \"ip1\", \"ip2\", \"ip5\"], \"id\": \"eni-1-id\", \"ip\": \"separate-ip\", \"mac\": \"mac1\", \"security-groups\": [ \"sg-redacto1\", \"sg-redacto2\", \"sg-redacto3\" ], \"subnet\": { \"cidr\": \"172.foo/19\", \"id\": \"subnet-redacted1\" }, \"tags\": { \"eks:cluster-name\": \"my-eks-redacted-name\", \"eks:nodegroup-name\": \"linux-web-5\" }, \"vpc\": { \"cidrs\": [ \"172.foo../16\" ], \"id\": \"vpc-id1\", \"primary-cidr\": \"172.bar/16\" } }, \"eni-2-id\": { \"addresses\": [ \"ip3\", \"ip8\", \"ip6\"], \"description\": \"Cilium-CNI (i-cni-id-1)\", \"id\": \"eni-2-id\", \"ip\": \"172.an.ip\", \"mac\": \"mac2\", \"number\": 2, \"security-groups\": [ \"sg-redacto4\", \"sg-redacto5\", \"sg-redacto6\" ], \"subnet\": { \"cidr\": \"172.foo/19\", \"id\": \"subnet-redacted1\" }, \"tags\": { \"io.cilium/cilium-managed\": \"true\", \"io.cilium/cluster-name\": \"my-eks-redacted-name\" }, \"vpc\": { \"cidrs\": [ \"172.foo../16\" ], \"id\": \"vpc-id1\", \"primary-cidr\": \"172.bar/16\" } }, \"eni-3-id\": { \"addresses\": [ \"ip4\", \"ip7\", \"ip9\"], \"description\": \"Cilium-CNI (i-cni-id-1)\", \"id\": \"eni-3-id\", \"ip\": \"172.an.ip\", \"mac\": \"mac3\", \"number\": 1, \"security-groups\": [ \"sg-redacto7\", \"sg-redacto8\", \"sg-redacto9\" ], \"subnet\": { \"cidr\": \"172.foo/19\", \"id\": \"subnet-redacted1\" }, \"tags\": { \"io.cilium/cilium-managed\": \"true\", \"io.cilium/cluster-name\": \"my-eks-redacted-name\" }, \"vpc\": { \"cidrs\": [ \"172.foo../16\" ], \"id\": \"vpc-id1\", \"primary-cidr\": \"172.bar/16\" } } } ``` `\"use-primary-address\": true,` is in the spec: ```pwsh > kubectl get ciliumnode ip-17redacted.eu-west-2.compute.internal -o jsonpath='{.spec.eni}' | jq { \"availability-zone\": \"eu-west-2b\", \"disable-prefix-delegation\": false, \"first-interface-index\": 0, \"instance-type\": \"t3.small\", \"node-subnet-id\": \"subnet-foo\", \"subnet-tags\": { \"thing/cilium\": \"foo\" }, \"use-primary-address\": true, \"vpc-id\": \"vpc-foo\" } ``` The kubelet config itself show as as 11 maxPods: ```pwsh > kubectl get --raw \"/api/v1/nodes/ip-17redacted.eu-west-2.compute.internal/proxy/configz\" | jq '.kubeletconfig.maxPods' 11 ``` ## Potential issue? `GetMinimumAllocatableIPv4()` () has the following: ```go // limits.IPv4 contains the primary IP which is not available for allocation maxPerInterface := max(limits.IPv4-1, 0) return min(minimum, (limits.Adapters-index)*maxPerInterface) ``` When Spec.ENI.UsePrimaryAddress is true, auxiliary ENIs (index > 0) can allocate their primary IP, making maxPerInterface equal to limits.IPv4 for those interfaces. Does this cause GetMinimumAllocatableIPv4() to undercalculate the instance pool capacity (e.g., reporting 9 instead of 11 for t3.small) or am I barking up the wrong tree and there's something else I'm missing as to why this is being limited to 9 IPs? ## Planning to try (but haven't yet) Setting preAllocation to 2 as opposed to the default of 8 and setting maxAboveWatermark to 2 as opposed to the default of 0. The last 'best guess' reason I have for that is: * With preAllocation = 8 and maxAboveWatermark = 0, Cilium calculates target pool size using the watermark equation: {Target Pool} = {Used Pod IPs} + {preAllocation} * maxAboveWatermark = 0 tells Cilium: \"Do not allocate any extra IPs beyond the minimum needed to satisfy preAllocation.\" * When Cilium attempts to allocate IPs for preAllocation = 8: It allocates eth0 (3 secondary IPs). Total = 3. It allocates eth1 (3 secondary IPs). Total = 6. It allocates eth2 (3 secondary IPs). Total = 9. * At 9 IPs, Cilium hits the limits.IPv4 - 1 limit across all 3 ENIs. Because maxAboveWatermark = 0, Cilium refuses to step above the watermark to allocate the primary IPs on auxiliary interfaces (eth1 and eth2). **(The guesstimate/leap I'm taking)** * Therefore, the pool freezes at 9 IPs, leaving the last 2 IP slots on eth1 and eth2 locked and unreachable. **guessing** Any ideas? ### How can we reproduce the issue? see main content ### Cilium Version v1.19.6 ### Kernel Version 6.12.94-123.192.amzn2023.x86_64 ### Kubernetes Version v1.34.9-eks-8f14419 ### Regression _No response_ ### Sysdump _No response_ ### Relevant log output ```shell ``` ### Anything else? _No response_ ### Cilium Users Document - [x] Are you a user of Cilium? Please add yourself to the [Users doc](https://github.com/cilium/cilium/blob/main/USERS.md) ### Code of Conduct - [x] I agree to follow this project's Code of Conduct",
"url": "https://github.com/cilium/cilium/issues/47930",
"createdAt": "2026-08-13T08:19:40Z",
"updatedAt": "2026-08-13T16:40:27Z",
"timestamp": "2026-08-13T16:40:27Z",
"metrics": {
"reactions": 0,
"comments": 3
},
"labels": [
"kind/bug",
"kind/community-report",
"area/eni",
"info-completed"
],
"author": "joe-sm",
"state": "open",
"assignees": [],
"change": "updated"
}
},
{
"id": "event:8170cdd2413bf8fd0367",
"signalId": "github:cilium/cilium:issue:33550",
"event": "changed",
"observedAt": "2026-08-13T17:43:20.785491Z",
"changedFields": [
"text",
"updatedAt"
],
"signal": {
"id": "github:cilium/cilium:issue:33550",
"source": "github",
"group": "platform-infrastructure",
"project": "cilium/cilium",
"kind": "issue",
"title": "Dependency Dashboard",
"text": "This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more. ## Repository Problems Renovate tried to run on this repository, but found these problems. - β οΈ WARN: Some release(s) did not have a releaseTimestamp, but as we're running with minimumReleaseAgeBehaviour=timestamp-optional, proceeding. See debug logs for more information ## Awaiting Schedule The following updates are awaiting their schedule. To get an update now, click on a checkbox below. - [ ] chore(deps): update docker.io/library/golang:1.26.5 docker digest to 705e964 (main) - [ ] chore(deps): update all lvh-images main (main) (patch) (`quay.io/lvh-images/complexity-test`, `quay.io/lvh-images/kind`) - [ ] chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.3-1786627113-2ad63f53be30e96fef56398067330444f78b28a9 (main) - [ ] fix(deps): update all go dependencies main (main) (`github.com/aws/aws-sdk-go-v2`, `github.com/aws/aws-sdk-go-v2/config`, `github.com/aws/aws-sdk-go-v2/feature/ec2/imds`, `github.com/aws/aws-sdk-go-v2/service/ec2`, `github.com/aws/smithy-go`, `github.com/cilium/charts`, `github.com/go-openapi/runtime`, `github.com/go-openapi/swag`, `github.com/go-openapi/swag/cmdutils`, `github.com/go-openapi/swag/conv`, `github.com/go-openapi/swag/jsonutils`, `github.com/go-openapi/swag/netutils`, `github.com/go-openapi/swag/typeutils`, `github.com/google/cel-go`, `github.com/klauspost/compress`, `github.com/osrg/gobgp/v4`, `github.com/prometheus/client_golang`, `github.com/prometheus/common`, `github.com/vishvananda/netlink`, `go.etcd.io/etcd/api/v3`, `go.etcd.io/etcd/client/pkg/v3`, `go.etcd.io/etcd/client/v3`, `go.opentelemetry.io/otel`, `go.opentelemetry.io/otel/trace`, `go.yaml.in/yaml/v3`, `google.golang.org/grpc`, `k8s.io/api`, `k8s.io/apiextensions-apiserver`, `k8s.io/apimachinery`, `k8s.io/cli-runtime`, `k8s.io/client-go`, `k8s.io/code-generator`, `k8s.io/component-base`, `k8s.io/dynamic-resource-allocation`, `k8s.io/endpointslice`, `k8s.io/kubectl`, `k8s.io/metrics`) - [ ] chore(deps): update docker.io/library/golang:1.26.5 docker digest to 705e964 (v1.20) - [ ] chore(deps): update stable lvh-images (v1.20) (patch) (`quay.io/lvh-images/complexity-test`, `quay.io/lvh-images/kind`) - [ ] chore(deps): update all github action dependencies (v1.20) (`actions/github-script`, `azure/login`, `cert-manager/cert-manager`, `docker/login-action`, `dorny/paths-filter`, `github/codeql-action`, `google/cloud-sdk`) - [ ] chore(deps): update docker.io/library/golang:1.25.12 docker digest to dbeddb5 (v1.19) - [ ] chore(deps): update stable lvh-images (v1.19) (patch) (`quay.io/lvh-images/complexity-test`, `quay.io/lvh-images/kind`) - [ ] chore(deps): update all github action dependencies (v1.19) (`actions/github-script`, `azure/login`, `docker/login-action`, `dorny/paths-filter`, `github/codeql-action`, `google/cloud-sdk`) - [ ] chore(deps): update docker.io/library/golang:1.25.12 docker digest to dbeddb5 (v1.18) - [ ] chore(deps): update stable lvh-images (v1.18) (patch) (`quay.io/lvh-images/complexity-test`, `quay.io/lvh-images/kind`) - [ ] chore(deps): update all github action dependencies (v1.18) (`actions/github-script`, `azure/login`, `dorny/paths-filter`, `google/cloud-sdk`) - [ ] π **Create all awaiting schedule PRs at once** π ## Open The following updates have all been created. To force a retry/rebase of any, click on a checkbox below. - [ ] [chore(deps): update all-dependencies (main)](../pull/47859) (`docker.io/alpine/socat`, `ghcr.io/renovatebot/renovate`, `quay.io/cilium/cilium-llvm`, `quay.io/cilium/test-connection-disruption`, `renovatebot/renovate`) - [ ] [chore(deps): update all github action dependencies (main)](../pull/47861) (`actions/github-script`, `azure/login`, `cert-manager/cert-manager`, `cilium/cilium`, `cilium/scale-tests-action`, `docker/login-action`, `dorny/paths-filter`, `github/codeql-action`, `google/cloud-sdk`, `https://github.com/cilium/scaffolding`, `renovatebot/github-action`) - [ ] [fix(deps): update module github.com/google/go-github/v89 to v90 (main)](../pull/47876) - [ ] **Click on this checkbox to rebase all open PRs at once** ## Detected Dependencies > [!NOTE] > Detected dependencies section has been truncated dockerfile (9)
cilium-cli/Dockerfile (2)
- `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `gcr.io/distroless/static latest@sha256:9197324ba51d9cd071af8505989365c006adf9d6d2067eada25aef00abbb5278` images/builder/Dockerfile (4)
- `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `quay.io/cilium/cilium-llvm 19.1.7-1782898005-bed4da5@sha256:270bf0e70853c388b72c2247e4ade91d35d74898e2ec12edd5b72ace9ee34333` β [Updates: `19.1.7-1785833026-d8383c5`] - `quay.io/cilium/cilium-runtime ddc2a59eaafa0c420b692d9a1e1be333eaccb2f6@sha256:f1fc9168c6491832eb6a175f37a8fdf4102b74311b46d7a1068bf669734cb8d1` - `quay.io/cilium/image-tester 1785710666-8cd4afc@sha256:fc644405b1fc62ffc009c27283307cddc5b210a7d42555b5f525b8285a163fb9` images/cache/Dockerfile (1)
- `docker.io/library/alpine 3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b` images/cilium/Dockerfile (4)
- `quay.io/cilium/cilium-envoy v1.38.3-1786448858-9326c1e0ad17d6449851ec3170611f2a66cb9035@sha256:159aa88485fb01f15397a4adc26be0586eeafe865965cadabedd63bebd445748` β [Updates: `v1.38.3-1786627113-2ad63f53be30e96fef56398067330444f78b28a9`] - `quay.io/cilium/cilium-builder a91a0712871eca5e96b4f47086ecdb53b1fd5a9f@sha256:1821eef577b7732600aaab3bddc753a4cf37b50d52ebd08b2014dce8076787dc` - `quay.io/cilium/cilium-runtime ddc2a59eaafa0c420b692d9a1e1be333eaccb2f6@sha256:f1fc9168c6491832eb6a175f37a8fdf4102b74311b46d7a1068bf669734cb8d1` - `quay.io/cilium/cilium-builder a91a0712871eca5e96b4f47086ecdb53b1fd5a9f@sha256:1821eef577b7732600aaab3bddc753a4cf37b50d52ebd08b2014dce8076787dc` images/clustermesh-apiserver/Dockerfile (4)
- `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `gcr.io/etcd-development/etcd v3.7.1@sha256:a9983dd6d9283138ab926daa307c6c25623636703ecf5645d5df4d666ce9eba2` - `gcr.io/distroless/static nonroot@sha256:f7f8f729987ad0fdf6b05eeeae94b26e6a0f613bdf46feea7fc40f7bd72953e6` images/hubble-relay/Dockerfile (3)
- `quay.io/cilium/cilium-builder a91a0712871eca5e96b4f47086ecdb53b1fd5a9f@sha256:1821eef577b7732600aaab3bddc753a4cf37b50d52ebd08b2014dce8076787dc` - `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `gcr.io/distroless/static nonroot@sha256:f7f8f729987ad0fdf6b05eeeae94b26e6a0f613bdf46feea7fc40f7bd72953e6` images/operator/Dockerfile (5)
- `quay.io/cilium/cilium-builder a91a0712871eca5e96b4f47086ecdb53b1fd5a9f@sha256:1821eef577b7732600aaab3bddc753a4cf37b50d52ebd08b2014dce8076787dc` - `docker.io/library/alpine 3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b` - `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `scratch unknown version` - `quay.io/cilium/cilium-builder a91a0712871eca5e96b4f47086ecdb53b1fd5a9f@sha256:1821eef577b7732600aaab3bddc753a4cf37b50d52ebd08b2014dce8076787dc` images/runtime/Dockerfile (4)
- `quay.io/cilium/cilium-llvm 19.1.7-1782898005-bed4da5@sha256:270bf0e70853c388b72c2247e4ade91d35d74898e2ec12edd5b72ace9ee34333` β [Updates: `19.1.7-1785833026-d8383c5`] - `quay.io/cilium/cilium-bpftool 7.7.0-1785833026-d8383c5@sha256:5ea5cf5bd61b8a41102b8ce7116fd2ba65993ee7006d86652bdeac428dbf001f` - `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`] - `docker.io/library/ubuntu 26.04@sha256:678c6550cc43645e08669028bc177f50be4e7c5b8cca677067b1914d4afc7a03` images/standalone-dns-proxy/Dockerfile (1)
- `docker.io/library/golang 1.26.5@sha256:2005724102f45917a63e9d092fc0e4ea56ea575048ce147caad5f5f61502c365` β [Updates: `1.26.5`]
github-actions (73)
.github/actions/bpftrace/check/action.yaml (1)
- `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` .github/actions/bpftrace/start/action.yaml (2)
- `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` .github/actions/cosign/action.yaml (2)
- `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` .github/actions/gather-metrics/action.yaml (1)
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` .github/actions/get-runner-ip/action.yml (1)
- `actions/github-script v8.0.0@ed597411d8f924073f98dfc5c65a23a2325f34cd` β [Updates: `v9.0.0`] .github/actions/lvh-kind/action.yaml (2)
- `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` .github/actions/merge-artifacts/action.yaml (1)
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` .github/actions/post-logic/action.yaml (4)
- `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `aanm/junit2md v0.0.3@332ebf0fddd34e91b03a832cfafaa826306558f9` .github/actions/wait-for-images/action.yaml (1)
- `docker/login-action v4.1.0@4907a6ddec9925e35a0a9e82d7399ccc52663121` β [Updates: `v4.6.0`] .github/workflows/ariane-scheduled.yaml (2)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` .github/workflows/auto-approve.yaml (2)
- `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/auto-labeler-v1.18.yaml (6)
- `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/labeler v7@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/auto-labeler-v1.19.yaml (6)
- `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/labeler v7@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/auto-labeler-v1.20.yaml (6)
- `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/labeler v7@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/auto-labeler.yaml (6)
- `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/github-script v9.0.0@3a2844b7e9c422d3c10d287c895573f7108da1b3` - `actions/labeler v7@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-go-caches.yaml (3)
- `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` .github/workflows/build-images-base-v1.17.yaml (22)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-base-v1.18.yaml (19)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` .github/workflows/build-images-base-v1.19.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` .github/workflows/build-images-base-v1.20.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` .github/workflows/build-images-base.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/setup-qemu-action v4.2.0@96fe6ef7f33517b61c61be40b68a1882f3264fb8` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` .github/workflows/build-images-beta.yaml (10)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-ci-v1.17.yaml (19)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-ci-v1.18.yaml (19)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `sigstore/cosign-installer v4.1.2@6f9f17788090df1f26f669e9d70d6ae9567deba6` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `anchore/sbom-action v0.24.0@e22c389904149dbc22b58101806040fa8d37a610` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-ci-v1.19.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-ci-v1.20.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-ci.yaml (15)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-docs-builder-v1.17.yaml (17)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-docs-builder-v1.18.yaml (17)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-docs-builder-v1.19.yaml (17)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-docs-builder-v1.20.yaml (17)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-docs-builder.yaml (17)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `cilium/actions-app-token v0.21.1@61a6271ce92ba02f49bf81c755685d59fb25a59a` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/build-images-releases.yaml (14)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/setup-buildx-action v4.2.0@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/build-push-action v7.3.0@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `cilium/cilium main` β [Updates: `main`] - `cilium/cilium main` β [Updates: `main`] - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/call-backport-label-updater-v1.17.yaml (1)
- `cilium/cilium v1.19.6@9a8982433e18019e290b8199c0c4ad24f66befe8` β [Updates: `v1.20.0`] .github/workflows/call-backport-label-updater-v1.18.yaml (1)
- `cilium/cilium v1.19.6@9a8982433e18019e290b8199c0c4ad24f66befe8` β [Updates: `v1.20.0`] .github/workflows/call-backport-label-updater-v1.19.yaml (1)
- `cilium/cilium v1.19` β [Updates: `v1.20.0`] .github/workflows/call-backport-label-updater-v1.20.yaml (1)
- `cilium/cilium v1.20` .github/workflows/call-backport-label-updater.yaml (1)
- `cilium/cilium main` β [Updates: `main`] .github/workflows/ci-images-cache-cleaner.yaml (1)
- `ubuntu 24.04` .github/workflows/ci-images-garbage-collect.yaml (3)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `quay.io/cilium/scruffy v0.0.3@sha256:ca997451b739cbf03c204cb2523a671c31c61edc606aa5d20dc3560bc7f25bc7` - `ubuntu 24.04` .github/workflows/cilium-cli.yaml (5)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `ubuntu 24.04` - `go 1.26.5` .github/workflows/close-stale-issues.yaml (2)
- `actions/stale v11@4391f3da665fdf50b6810c1a66712fb9ba21aa93` - `ubuntu 24.04` .github/workflows/codeql.yaml (7)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81` β [Updates: `v4.37.6`] - `github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81` β [Updates: `v4.37.6`] - `github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81` β [Updates: `v4.37.6`] - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `github/codeql-action v4.37.3@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81` β [Updates: `v4.37.6`] - `ubuntu 24.04` .github/workflows/common-post-jobs.yaml (6)
- `cilium/cilium main` β [Updates: `main`] - `cilium/cilium main` β [Updates: `main`] - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-aks.yaml (15)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `azure/login v3.0.0@532459ea530d8321f2fb9bb10d1e0bcf23869a43` β [Updates: `v3.0.1`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `azure/login v3.0.0@532459ea530d8321f2fb9bb10d1e0bcf23869a43` β [Updates: `v3.0.1`] - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-aws-cni.yaml (15)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-clustermesh.yaml (9)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` .github/workflows/conformance-delegated-ipam.yaml (10)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-eks.yaml (15)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-gateway-api.yaml (16)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `go 1.26.5` .github/workflows/conformance-ginkgo.yaml (29)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `go 1.26.5` - `ubuntu 24.04` - `ubuntu 24.04` - `go 1.26.5` .github/workflows/conformance-gke.yaml (17)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `google-github-actions/auth v3.0.0@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093` - `google-github-actions/setup-gcloud v3.0.1@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `google-github-actions/auth v3.0.0@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093` - `google-github-actions/setup-gcloud v3.0.1@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-ingress.yaml (13)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-ipsec-e2e.yaml (13)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-ipsec.yaml (5)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-k8s-network-policies.yaml (8)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-kind-proxy-embedded.yaml (9)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-kpr-aks.yaml (5)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-kpr-eks.yaml (7)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-kpr-gke.yaml (5)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-kubespray.yaml (12)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-python v7.0.0@5fda3b95a4ea91299a34e894583c3862153e4b97` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `python 3.10` .github/workflows/conformance-l3-l4.yaml (5)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-l7.yaml (5)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-mcs-api.yaml (13)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `go 1.26.5` .github/workflows/conformance-multi-pool.yaml (13)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `helm/kind-action v1.14.0@ef37e7f390d99f746eb8b610417061a60e82a6cc` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-race.yaml (4)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-runtime.yaml (22)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `cilium/little-vm-helper v0.0.30@5ae749011735fd77f30f38add52f1a53a5568671` - `actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` - `aanm/junit2md v0.0.3@332ebf0fddd34e91b03a832cfafaa826306558f9` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/conformance-ztunnel-e2e.yaml (10)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/workflow-telemetry-action v2.2.0@b1a318f80a08acede58027afe1455d037379966f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/documentation.yaml (10)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `dorny/paths-filter v4.0.2@7b450fff21473bca461d4b92ce414b9d0420d706` β [Updates: `v4.0.3`] - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `quay.io/cilium/docs-builder e6773ed21ab03066c0f24e68f342f18804a8ee0a@sha256:d3beff6d6408c09f6e1dbc637f7e98962b7d1fd2a81bf1d2a27ff8817dafb51f` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `go 1.26.5` .github/workflows/eks-cluster-delete.yaml (3)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `ubuntu 24.04` .github/workflows/eks-cluster-pool-manager.yaml (16)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `aws-actions/configure-aws-credentials v6.2.3@e6de054238d6b7531b4efff3b6587d9aade6a06c` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/feature-summary-report.yaml (5)
- `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `ubuntu 24.04` - `ubuntu 24.04` .github/workflows/fqdn-perf.yaml (19)
- `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `cilium/actions main@fe0702f5df0d8e44d48f1baa226c023b73ff6b5e` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `docker/login-action v4.5.2@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c` β [Updates: `v4.6.0`] - `actions/setup-go v7.0.0@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e` - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `google-github-actions/auth v3.0.0@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093` - `google-github-actions/setup-gcloud v3.0.1@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db` - `actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1` - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `cilium/cilium-cli v0.19.7@7ca7fc53c20275f5c10ef5f3557076691fd1d720` - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `cilium/scale-tests-action main@d89fc21b123f4047828366d1505a8bb5d414c07d` β [Updates: `main`] - `ubuntu 24.04` - `ubuntu 24.04` - `ubuntu 24.04` - `go 1.26.5`