Cilium

bpf: fib: let fib_lookup_v*() handle the tbid processing

De-dup the setup code for a FIB lookup which uses the `tbid` parameter.

bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT

``` This HostFW hook lives in bpf_host's `from-netdev` program. It operates on packets that have been successfully RevSNATed (otherwise we would have bailed out earlier). And ipv*_host_policy_ingress() only takes action for packets where the RevSNATed destination IP is mapped as HOST_ID - otherwise it returns immediately. The next step in the program chain i

bpf: pass LWT encap back to kernel

For "various reasons", I am running a custom LWT based Geneve overlay that needs to intersect with our Cilium deployment. I noticed that traffic was not routing into the overlay, and through the pure magic that is `cilium monitor --type drop -v` I was able to get this message: ``` xx drop (FIB lookup failed, 6) flow 0x0 to endpoint 0, ifindex 1344, file bpf_

gateway-api: report all route validation errors in status

`ValidateHeaderModifier` write an `Accepted=False` condition. But `ValidateMatchRegexps` writes the same condition type, and `helpers.MergeConditions` matches by type and replaces in place. In `setHTTPRouteStatuses` in gateway_reconcile.go both run in one loop, so the regex message overwrites the header modifier message. `setGRPCRouteStatuses` has the same l

health/client: replace deprecated http.Transport.Dial with DialContext

`http.Transport.Dial` has been deprecated since Go 1.7 (`SA1019`) in favor of `DialContext`, which allows the transport to cancel dials as soon as they are no longer needed. Per the Go docs, if both fields are set `DialContext` takes priority — so the current code is effectively opting out of context-aware dialing on every request the Cilium health checker's

chore(deps): update docker.io/library/golang:1.25.12 docker digest to 2c7ebca (v1.18)

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [docker.io/library/golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | stage | digest | `9006890` → `2c7ebca` | | [docker.io/library/golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.co

fix: stale CEC owner UID lets GC delete the in-use Envoy config

The name of a CiliumEnvoyConfig is derived from the Gateway name ·cilium-gateway-<name>·, so a recreated Gateway with the same name necessarily maps to the same CiliumEnvoyConfig object. Since Gateway has no finalizer, deleting a Gateway relies entirely on Kubernetes garbage collection for cleanup, which is asynchronous and may take seconds or longer. When a

pkg/idpool: lazy allocate idCache maps

When `NewIDPool` creates an ID pool, it used to fill a map with every single ID right away. For a pool of 1,000,000 IDs, this took ~37.8 MB of memory and ~141 ms of setup time upfront before any IDs were even used. This change switches to allocating IDs on demand using a `nextID` counter. It only adds IDs to maps when they are released or inserted, saving me

fix(gateway): fail closed on invalid ExternalAuth

## Description of change Make HTTPRoute ExternalAuth fail closed when the backend reference is invalid or cannot be resolved. Previously, an invalid ExternalAuth backend reference could cause the filter to be omitted while the route remained active, effectively allowing requests to bypass external authentication. This change: - Fails closed with HTTP 500 whe

gateway-api: compare static Gateway addresses as parsed IPs

`setStaticAddressStatus` compared addresses from `Gateway.spec.addresses` with the generated Service status as strings. Equivalent IPv6 addresses can use different textual representations, causing an allocated and working static address to be reported as unusable. Parse both sides with `netip.ParseAddr` and compare the resulting addresses. Hostname-only Serv

hubble: add optional protocol and port labels to policy metrics

Add opt-in protocol and destination port labels to hubble_policy_verdicts_total. Both labels are disabled by default to preserve the existing metric label set. The destination port label may increase metric cardinality depending on the traffic pattern. Please ensure your pull request adheres to the following guidelines: - [x] For first time contributors, rea

install: detect containerd from GKE kubelet config

Newer GKE node images configure `containerRuntimeEndpoint` in `/home/kubernetes/kubelet-config.yaml` instead of `/etc/default/kubelet`. This causes the existing GKE containerd detection in node-init to miss the GKE-specific path and fall through to the generic kubelet handling. This change: * preserves the existing legacy GKE/containerd detection; * recogniz

bandwidth: support DSCP marking for Pod egress traffic

This PR adds support for setting DSCP marks on Pod egress traffic through the Bandwidth Manager. Pods can configure the DSCP value with the `bandwidth.cilium.io/egress-dscp` annotation. The annotation accepts values in the `0-63` range. The BPF datapath preserves the existing ECN bits while rewriting the IPv4 TOS or IPv6 Traffic Class field. The feature is h

[POC] CEL based policy endpoint selectors

.github: Support other versions in bug report template

Sometimes users report issues against the latest pre-release. Sometimes they are also reporting a bug on a different version but the template is too restrictive so they file the bug with the wrong version then add the version later on in the bug report. We already make it clear to the reporter that they should upgrade if the version is not listed, but I woul

v1.18 Backports 2026-08-10

* [x] #47780 (@giorio94) :warning: resolved conflicts * [ ] #47208 (@iwanhae) :warning: resolved conflicts * [x] #47801 (@aanm) :warning: resolved conflicts Once this PR is merged, a GitHub action will update the labels of these PRs: ```upstream-prs 47780 47208 47801 ```