🚀 Gateway API v1.6.1: Cilium moves from Gateway API v1.4 to v1.6.1, bringing support for capabilities that graduated across both upstream releases. (cilium/cilium#45251, @youngnick; cilium/cilium#46827, cilium/cilium#47274, @arybolovlev)
👥 Delegate Gateway Listeners: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. (cilium/cilium#46303, cilium/cilium#46785, @asauber)
🔏 Encrypt Traffic to Backends: Gateway API BackendTLSPolicy support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. (cilium/cilium#43045, @youngnick)
🔀 TCPRoute and UDPRoute: Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic. (cilium/cilium#46184, cilium/cilium#46970, @eminaktas; cilium/cilium#4
TLSRoute support is already mandatory, but the Gateway API controller still carried helper functions and conditional logic for treating it as optional. Remove the obsolete HasTLSRouteSupport helper and the remaining reconcile branches that skipped TLSRoute listing and status updates when the CRD was not present. This keeps the implementation aligned with the
## Summary - replace the deprecated `app-id` input with `client-id` in the v1.17 image workflow - use `AUTO_COMMENT_CLIENT_APP_ID` for the corresponding GitHub App credential ## Why The v1.17 workflow on `main` handles pull requests targeting the v1.17 branch. Keeping this change isolated allows the same one-file patch to be backported only to v1.17, where t
## Summary - replace the deprecated `app-id` input with `client-id` in the v1.18 image workflow - use `AUTO_COMMENT_CLIENT_APP_ID` for the corresponding GitHub App credential ## Why The v1.18 workflow on `main` handles pull requests targeting the v1.18 branch. Keeping this change isolated allows the same one-file patch to be backported only to v1.18, where t
## Summary - replace the deprecated `app-id` input with `client-id` in the v1.19 image workflow - use `AUTO_COMMENT_CLIENT_APP_ID` for the corresponding GitHub App credential ## Why The v1.19 workflow on `main` handles pull requests targeting the v1.19 branch. Keeping this change isolated allows the same one-file patch to be backported only to v1.19, where t
## Summary - replace the deprecated `app-id` input with `client-id` in the v1.20 image workflow - use `AUTO_COMMENT_CLIENT_APP_ID` for the corresponding GitHub App credential ## Why The v1.20 workflow on `main` handles pull requests targeting the v1.20 branch. Keeping this change isolated allows the same one-file patch to be backported only to v1.20, where t
## Summary - replace `hramos/needs-attention` with pinned `actions/github-script@v9` logic - preserve the existing issue-label transition: when the issue author replies to an issue labeled `need-more-info`, remove that label and add `info-completed` - configure `actions/create-github-app-token` in the image workflow with its `client-id` input and the `AUTO_C
The clustermesh conformance job fails check-log-errors on the IPv6 native-routing legs with one warning from a freshly booted agent: "failed to find valid IPv6 address for cilium_net". setupVethPair brings cilium_host and cilium_net up before setupBaseDevice turns ARP off on them, so the kernel runs duplicate address detection on the link-locals it generates
When a GAMMA HTTPRoute is deleted and recreated with the same name, the generated CiliumEnvoyConfig is updated in place. Before this change, ensureEnvoyConfig() only replaced the spec and left the previous OwnerReferences unchanged. That meant the CEC could still be owned by the old route UID after the new route had been reconciled. In delete-and-recreate fl
Update the change introduced by 64527fb1c31e ("bpf: dsr: always forward DSR info to newly selected remote backend"), and transport the `new_backend` information via a dedicated bool. This seems to help with BPF program complexity.
Each CiliumNode creates 4 triggers today, and one of them exists only to call another one: the "-retry" trigger's entire body is `poolMaintainer.Trigger()`, rate limited to one call per minute. That is one goroutine and one timer per node, which on a large enough production cluster where the majority of goroutine count is driven by node count, amounts to a q
### Is your proposed feature related to a problem? Yes and it has been reported [here as well](https://github.com/cilium/cilium/issues/35404). I hit this running: Cilium v1.19.4, EKS, ENI IPAM mode, cilium-operator with `eni.subnetTagsFilter`. During a big scale-up, 348→432 instances in ~2 min, 5 freshly launched nodes were stuck permanently with `available=
### Is your proposed feature related to a problem? Currently, verifying connectivity or debugging policy drops between specific running endpoints in a Kubernetes cluster is either reactive or intrusive: - **Reactive**: Hubble provides excellent observability, but it relies on existing application traffic. If an app is silent or failing to initiate connection
### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.20.0 and lower than v1.21.0 ### What happened? I built a new single node cluster using "modern Cilium settings" and Tailscale Operator. The specific problematic settings are the combination of: - `bpf.datapathMode=netkit` - `endpointRoutes.e
### Is there an existing issue for this? - [x] I have searched the existing issues ### Version equal or higher than v1.20.0 and lower than v1.21.0 ### What happened? ### the bug When `NewIDPool(minID, maxID)` is called in `pkg/idpool/idpool.go`: - It immediately creates and populates a hash map (`map[ID]struct{}`) for all IDs in the range `[minID, maxID]`. -
### Is there an existing issue for this? - [X] I have searched the existing issues Closest matches are #47400 / #46260 / #26584, but those are about **ingress** traffic to L7LB frontends being dropped at TC on specific device types. This issue is different: ingress reaches Envoy fine — it is Envoy's **upstream replies from same-node backends** that are lost,
When Podman is used as Docker's drop-in replacement, it mounts volumes owned by user inaccessible by root inside the container, and the recursive chown fails. Don't try to go inside the mountpoints when fixing the ownership of /home/ubuntu. Fixes: 65cdb42f3ff6 ("contrib: chown ~/.cache in builder.sh") ```release-note Follow-up bugfixes for builder.sh. ```
Please ensure your pull request adheres to the following guidelines: - [ ] For first time contributors, read [Submitting a pull request](https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#submitting-a-pull-request) - [ ] All code is covered by unit and/or runtime tests where feasible. - [ ] All commits contain a well written commit
## Summary Adds **BGP Monitoring Protocol (BMP, [RFC 7854](https://datatracker.ietf.org/doc/html/rfc7854))** support to the Cilium BGP Control Plane. Cilium nodes can stream the state of their BGP instances to one or more external BMP monitoring stations, giving operators a real-time, read-only view of what each node receives and advertises over BGP — withou
Reimplement the `--vlan-bpf-bypass` allowlist using five load-time config slots instead of the compile-time `VLAN_FILTER` preprocessor macro, as proposed in #38721. The macro was generated from the VLAN subinterfaces present at agent startup. Subinterfaces created later were never added to the filter and their tagged frames were dropped until an agent restar
<!-- Description of change --> This is a Go map concurrent read data race bug. The core issue is that a new goroutine is spawned to perform `e.isPropertyLocked()` instead of calling the API on the original goroutine ``` go func() { if !e.isPropertyLocked(endpointtypes.PropertyFakeEndpoint) { e.scrubIPsInConntrackTable() } close(datapathRegenCtxt.ctCleaned) }
With https://github.com/cilium/cilium/pull/44507 this case should no longer require SocketLB, any KPR configuration will do (so that the service access is translated at the source node).
This PR contains some enhancements to the eBPF execution step to help improve the eBPF test suite speed discussed in #45133. Currently the eBPF tests are executed serially when running `make run_bpf_tests`. Each eBPF test file (.o) is loaded independently and does not share any state across the file boundary. So the test runner can be updated to load/execute
Pods keep showing up in Hubble as dropping their own ICMPv6 traffic with "Invalid source ip". The source is always the link local address that the kernel gives the pod interface, and the messages are the MLD reports and router solicitations that the kernel sends on its own. The from container path lets neighbour solicitation and neighbour advertisement past
Mark backend references with unknown Service ports as unresolved during shared Gateway API route validation. So far, shared backend validation only checked whether the referenced backend Service exists. If the Service was present but the referenced `backendRef.port` was not exposed by that Service, the route could still end up with `ResolvedRefs=True` and th
The Fetch artifacts step runs on any failure, including a failure of the step that brings up the cluster. On kvstore matrix legs it then runs kubectl -n kube-system logs kvstore with no cluster to talk to, so it exits 1 with "connection to the server localhost:8080 was refused" and one real failure becomes two red steps. Legs without kvstore stay green, beca
The `ErrDumpInterrupted` pattern has been `(Handle\.)?("AddrList|BridgeVlanList|...` since it was introduced. The double quote character makes the first alternative `"AddrList`, which cannot match anything, so `netlink.AddrList` and `netlink.Handle.AddrList` have never been flagged. Fixing this surfaces three new previously accidentally ignored findings. Thi
A CIDR which disappears from the CiliumNode CRD spec while IPs are allocated from it is marked as removed: we keep its allocator to hold on to the in-use IPs, stop allocating from it, and keep advertising it as allocated to signal to the operator that we want the CIDR back. But nothing ever cleared that mark, so the CIDR stayed unallocatable for the lifetime
Added OpenChoreo entry with details on network security and observability. Please ensure your pull request adheres to the following guidelines: - [ ] For first time contributors, read [Submitting a pull request] - [ ] All code is covered by unit and/or runtime tests where feasible. - [ ] All commits contain a well written commit description including a title
Testing changes that are included in: https://github.com/cilium/cilium/pull/47787 https://github.com/cilium/cilium/pull/47786 https://github.com/cilium/cilium/pull/47785 https://github.com/cilium/cilium/pull/47784
## Summary Preserve the original IPv4 or IPv6 client address in `TRACE_TO_OVERLAY` when tunneled NodePort or LoadBalancer traffic is SNATed. Hubble can then show the client address in `source` and the SNAT address in `source_xlated`. Flows without SNAT and other encapsulation paths are unchanged. ## Testing - Overlay NodePort BPF runtime tests - Hubble parse
Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular
- [X] For first time contributors, read [Submitting a pull request] - [X] All code is covered by unit and/or runtime tests where feasible. - [X] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular GitHub issue. - [X] If your commit description contains a `Fixes: <c
Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, read [Submitting a pull request] - [x] All code is covered by unit and/or runtime tests where feasible. - [x] All commits contain a well written commit description including a title, description and a `Fixes: #XXX` line if the commit addresses a particular
`cilium connectivity perf` always reports "Cilium version: 0.0.0" in its info banner, regardless of the actual Cilium version running in the cluster. `setupAndValidatePerf()`, the setup path used by the `perf` subcommand, never calls `initCiliumPods()`/`detectCiliumVersion()`, unlike `setupAndValidate()` (used by `connectivity test`). `CiliumVersion` is ther
The gRPC health server is started as part of Server.Serve(), but Server.Stop() only stops the main gRPC server. This leaves the health listener running and keeps Serve() blocked in errgroup.Wait(). Stop the gRPC health server during shutdown and add a test that verifies Serve() returns after Stop(). Please ensure your pull request adheres to the following gu
This extension of the Helm chart allows setting `ipFamilyPolicy` and `ipFamilies` for the LoadBalancer service when using shared mode. This makes it possible to create a shared dual-stack LoadBalancer service with the following Helm values: ```yaml ingressController: enabled: true loadbalancerMode: shared service: ipFamilies: - IPv4 - IPv6 ipFamilyPolicy: Re
Commit dfa42c75c409 ("bpf: Fix kube-apiserver policy drop in tunneling") fixed a temporary packet disruption issue during upgrade from v1.11 to v1.12 by overriding a security identity lookup for node-to-node traffic using the locally constructed ipcache. The code for that case was intended to be temporary to ensure hitless upgrade at the time, and that code