chore(deps): update helm release cilium to v1.19.0

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
cilium (source)	helm_release	minor	1.16.5 → 1.19.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

cilium/cilium (cilium)

v1.19.0: 1.19.0

Compare Source

🎉 Release Announcement 🎉: We are excited to announce the Cilium 1.19.0 release!

A total of 2934 new commits have been contributed to this release by a growing community of over 1010 developers and over 23,600 GitHub stars! 🤩

⚠️ You may need to take action during upgrade to Cilium v1.19 if you use Network Policies, Cluster Mesh, LoadBalancer IPAM or BGP. See the Upgrade Guide for more details.

The full changelog can be found here.

Here are some of the highlights:

• 🛡️ Network Policy

  • 🃏 Multi-Level DNS Matches: DNS Policies match pattern now support a wildcard prefix(**.) to match multilevel subdomain as pattern prefix. (cilium/cilium#43420, @​fristonio)
  • 📡 Match New Protocols: You can now match VRRP and IGMP protocols in host firewall rules. (cilium/cilium#39872, @​aditighag; cilium/cilium#41949, @​kyounghunJang)
  • ⛔ Actively Deny Connections: When Network Policies deny a connection, Cilium can return ICMPv4 "Destination unreachable" messages for a friendlier deny. (cilium/cilium#41406, @​antonipp)
  • 🌐 Select Clusters Explicitly: When network policy selectors don't explicitly define a cluster for communication to be allowed, they will now default to only allowing the local cluster. (cilium/cilium#40609, @​MrFreezeex)
  • 🔧 Unlock Future Work: This release brings several internal improvements to the network policy engine in preparation for features planned in the next Cilium minor release (cilium/cilium#39906, @​vipul-21; cilium/cilium#42784, cilium/cilium#42896, @​jrajahalme)
  • ⚠️ Deprecate underutilized features: To focus on solving common problems Cilium users face, this release deprecates the Kafka protocol match fields (beta), as well as the ToRequires and FromRequires policy fields. (cilium/cilium#43167, @​sayboras; cilium/cilium#40967, @​TheBeeZee)

• 🔒 Encryption & Authentication

  • 🔐 Encryption Strict Modes: Both IPsec and WireGuard transparent encryption modes now support a "strict mode" to require traffic to be encrypted between nodes. Unencrypted traffic will be dropped in this mode. (cilium/cilium#39239, cilium/cilium#42115, @​rgo3, @​julianwiedmann)
  • 🚇 Ztunnel Beta: You can enroll namespaces into Ztunnel, which enables TCP connections between workloads to be transparently encrypted and authenticated. (cilium/cilium#42766, cilium/cilium#42819, cilium/cilium#43227 and others, @​ldelossa, @​rgo3, @​nddq)
  • 👥 Mutual Authentication: The out-of-band Mutual Authentication feature is now disabled by default, pending community feedback. If you have a requirement for mTLS, consider trying the new Ztunnel integration. (cilium/cilium#42665, @​christarazi)
  • ↪️ Accelerate IPsec: The IPsec encryption mode now supports BPF Host Routing for faster route lookups (cilium/cilium#41997, @​pchaigno)

• 🚠 Networking

  • 🚀 BIG TCP in Tunnels: Leverage upcoming Linux support for BIG TCP when communicating over UDP-based tunnels such as VXLAN and Geneve. (cilium/cilium#43416, @​gentoo-root)
  • 🥌 Packetization-Layer Path MTU Discovery: Detect maximum transmission unit (MTU) sizes for network paths using TCP. (cilium/cilium#42012, cilium/cilium#43710, @​tommyp1ckles)
  • 🚆 IPv6 Underlay: You can now choose IPv6 for the tunnel underlay address family on dual-stack clusters. (cilium/cilium#40324, @​pchaigno)
  • 🏷️ Multi-Pool IPAM is ready for wider use: Update the Multi-Pool IPAM feature to work with IPsec and direct routing modes, and promote it from Beta to Stable. (cilium/cilium#40460, cilium/cilium#42191, @​pippolo84)
  • 🎭 More Configurable Masquerade: IP Masquerade configuration can now be customized for traffic sent to nodes in other IP subnets, and addresses in IPAM pools can be excluded from masquerade (cilium/cilium#37568, @​behzad-mir; cilium/cilium#43380, @​alimehrabikoshki)

• 🕸️ Services and Service Mesh

  • 📣 Layer-2 Announcements: Add support for Neighbor Discovery Advertisements for IPv6 Layer-2 Announcements. (cilium/cilium#39648, @​msune)
  • 🔁 IPv6 Service Loopback: Pods can now connect to themselves via a Kubernetes "loopback service" using IPv6. (cilium/cilium#39594, @​saiaunghlyanhtet)
  • ⛩️ Gateway API Enhancements: Cilium's GAMMA support now includes support for using GRPCRoute as well as HTTPRoute. (cilium/cilium#41936, @​youngnick)

• 🛣️ Border Gateway Protocol (BGP)

  • 🔌 Advertise Addresses from Interfaces: There's a new Interface BGP advertisement type that allows advertisement of IPs assigned on local interfaces. This can be useful for example in multi-homing setups, where a common node's loopback address can be advertised via multiple BGP sessions over different network interfaces. (cilium/cilium#42469, @​rastislavs)
  • ✉️ Override Source IP addresses: You can override the auto-generated BGP session source IP with the IP address applied on the configured sourceInterface to allow binding the BGP connection to the loopback address which is not tied to the specific physical interface's lifecycle (cilium/cilium#42583, @​rastislavs)
  • 🔁 Withdraw Empty Routes: Optionally withdraw BGP routes when a service has 0 endpoints, to allow balancing to a different DC/cluster with externalTrafficPolicy=Cluster (cilium/cilium#40717, @​oblazek)
  • ⚠️ Move to cilium.io/v2 API: The support for the older CiliumBGPPeeringPolicy v1 API is now removed and should be replaced with v2 APIs. (cilium/cilium#42278, @​rastislavs)

• 🛰️ Observability

  • 🔬 Trace IP Options: Configure Cilium and Hubble to trace specific packets through the cluster using IP Options. (cilium/cilium#41306, @​Bigdelle)
  • 🚩 Filter Encrypted Flows: Filter flows when using the hubble command line to understand the encryption status of the traffic, either --encrypted or --unencrypted. (cilium/cilium#43096, @​SRodi)
  • 🔖 Tag Drops with Policy Names: Hubble v1.Events drop messages now include which Network Policy caused the drop. (cilium/cilium#41693, @​41ks)

• 🌅 Performance and Scale

  • ⚡ Faster Network Policy Computation: Improve Cilium resource usage for handling selectors in network policies. (cilium/cilium#42008, @​jrajahalme; cilium/cilium#42580, @​odinuge)
  • 🔌 More Efficient Connection Tracking: Several improvements have been made to reduce the number of connections being tracked by Cilium, particularly when using Geneve, VXLAN or WireGuard. (cilium/cilium#38782, @​BenoitKnecht; cilium/cilium#41990, @​bersoare)
  • 💾 Better Scale in AWS: Reduce memory usage for cilium-operator in large AWS environments with many resources. (cilium/cilium#42529, @​liyihuang)

• ⚙️ Operations

  • 📦 Access Helm charts via Registry: Helm charts are also available under quay.io/cilium/charts/cilium (cilium/cilium#43624, @​aanm)
  • 📊 Metrics Encryption: Add TLS/mTLS support for Prometheus metrics exposed by the Cilium Operator. (cilium/cilium#42077, @​phuhung273)
  • 🤖 Easier Multi-Cluster install: There's now support for auto-installing the Custom Resource Definitions (CRDs) for Multi-Cluster Services (MCS). (cilium/cilium#40729, @​MrFreezeex)
  • 📜 Simpler Certificate Management: Streamline Cluster Mesh and Hubble certificate generation when using GitOps approaches. (cilium/cilium#42298, @​MrFreezeex)
  • 🛠️ Cilium dependencies were updated to Kubernetes v1.35, Envoy v1.35, Gateway API v1.4, and GoBGP v3.37. (cilium/cilium#43422, @​aanm; cilium/cilium#40569, @​sayboras; cilium/cilium#41936, @​youngnick; cilium/cilium#42824, @​rastislavs).

• 🏠 Community

  • ❤️ Production Case Studies: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback!
  • 📰 See studies with Airbnb, Cloudera, Cybozu, ESnet, Nutanix, OVHcloud, TikTok, University of Wisconsin–Madison.
  • 🇺🇸 Atlanta Events: The community gathered at CiliumCon and the Cilium Developer Summit in Atlanta.
  • 🇳🇱 Amsterdam Events: Meet us at the upcoming CiliumCon and Cilium Developer Summit in Amsterdam, March 23-27. Read more about where to find Cilium during the show.
  • 🔟 Cilium is 10: Read the 2025 Cilium Annual Report to see the latest project milestones, a decade on from its first commit.

To keep up to date with all the latest Cilium releases, join #release 🎉

🎂❤️❤️❤️🎂
This is a very special release for Cilium, as it celebrates 10 years since the first commit. We couldn’t be more proud of what this project has accomplished. All the GitHub issues, pull requests, reviews, stars, forks, Docker pulls, Helm installs, Kubernetes applies, CI runs, bug reports, design docs, discussions, meetings, Slack messages, YouTube streams, eCHO episodes, conference talks, blog posts, demos, and presentations have made the project the success it is today.
🎂❤️❤️❤️🎂

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.0@​sha256:be9f8571c2e114b3e12e41f785f2356ade703b2eac936aa878805565f0468c60

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.0@​sha256:0e3b89fdb116eb0f5579fe8ee3fabb1a7c4d97987a1ae927491d9185785d4a49

docker-plugin

quay.io/cilium/docker-plugin:v1.19.0@​sha256:35727047384f3d7a2684885003b266bf7a7add8fc66ca564b222f71c16057f50

hubble-relay

quay.io/cilium/hubble-relay:v1.19.0@​sha256:7f17e5bb51a9f35bbc8e7a9ad5e347f03ff8003c2e5cc81171e8727a10bf03b4

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.0@​sha256:5cb3d6981c233616037f3e13b5bc0020d114ad8db1b7360618b224e4c0b02ef0

operator-aws

quay.io/cilium/operator-aws:v1.19.0@​sha256:7a236ae256a4fbd3f72d516921131eba5b43f401ba37cdee5cd0e8c26f9263e6

operator-azure

quay.io/cilium/operator-azure:v1.19.0@​sha256:6ae7e0d75c74836af3600b775201c89ea7fcc13d6e08fdb0c52927309f31cd2a

operator-generic

quay.io/cilium/operator-generic:v1.19.0@​sha256:5b04006015e5800307dc6314676edc4c0bb7ac2fc7848be2b94b43bb030ab648

operator

quay.io/cilium/operator:v1.19.0@​sha256:deca84f442752dca0745dd09b13e8004569414839019ad79ac58f9fcaa3b9d65

v1.18.6: 1.18.6

Compare Source

Summary of Changes

Major Changes:

• Publish Helm charts to OCI registries (Backport PR #​43689, Upstream PR #​43624, @​aanm)

Minor Changes:

• Cilium Preflight check no longer includes Envoy Configmaps, making it easier to correctly run. (Backport PR #​43290, Upstream PR #​43153, @​youngnick)
• runtime: Add libatomic1 for cilium-envoy dependency (Backport PR #​43642, Upstream PR #​43292, @​sayboras)

Bugfixes:

• bpf:wireguard: delivery host packets to bpf_host for ingress policies (Backport PR #​43690, Upstream PR #​42892, @​smagnani96)
• cgroup: don't start watch if KPRConfig.EnableSocketLB is disabled (Backport PR #​43290, Upstream PR #​43256, @​mhofstetter)
• Fix a bug with local redirect service entries being created when backend pods weren't ready. (Backport PR #​43425, Upstream PR #​43095, @​aditighag)
• Fix an issue in proxy NOTRACK iptables rule for aws-cni chaining mode which causes proxy->upstream(outside cluster) traffic not being SNAT'd. (Backport PR #​43676, Upstream PR #​43566, @​fristonio)
• Fix GC of possible duplicated identities in kvstore mode (Backport PR #​43425, Upstream PR #​43287, @​giorio94)
• Fixes a deadlock that was causing endpoint to be stuck without progressing with any updates. (Backport PR #​43290, Upstream PR #​43242, @​marseel)
• gateway-api: correctly handle CiliumGatewayClassConfig as a namespaced resource. (Backport PR #​43290, Upstream PR #​43254, @​youngnick)
• xds: fix nil-pointer in processRequestStream (Backport PR #​43612, Upstream PR #​43609, @​mhofstetter)

CI Changes:

• bpf: tests: egressgw: enable HostFW (Backport PR #​43337, Upstream PR #​42955, @​julianwiedmann)
• bpf: tests: egressgw: install ipcache_v6_add_world_entry() (Backport PR #​43337, Upstream PR #​42988, @​julianwiedmann)
• chore: comment job to use generated token instead of PAT (Backport PR #​43612, Upstream PR #​43148, @​sekhar-isovalent)
• ci: Use newer lvh image for privileged tests (Backport PR #​43490, Upstream PR #​41082, @​rastislavs)

Misc Changes:

• .github/workflows: remove auto-requested reviewers (Backport PR #​43425, Upstream PR #​42952, @​aanm)
• Add documentation and examples for using the egressDeny field in CiliumNetworkPolicy (Backport PR #​43425, Upstream PR #​40272, @​syedazeez337)
• bpf: clear mark content before storing the cluster ID (Backport PR #​43290, Upstream PR #​43159, @​giorio94)
• bpf: prevent cluster ID from being incorrectly retrieved from mark when aliased (Backport PR #​43290, Upstream PR #​43258, @​giorio94)
• chore(deps): update all github action dependencies (v1.18) (#​43467, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​43665, @​cilium-renovate[bot])
• chore(deps): update anchore/sbom-action action to v0.21.0 (v1.18) (#​43512, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.18) (#​43543, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.18) (#​43664, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.37.0 docker digest to 2383baa (v1.18) (#​43662, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.11 docker digest to 54528d1 (v1.18) (#​43464, @​cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.7 (v1.18) (#​43465, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.34.12-1767177245-7935d4d711cb6f8020385a50c996b90896e16a71 (v1.18) (#​43539, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9 (v1.18) (#​43638, @​cilium-renovate[bot])
• chore(deps): update rhysd/actionlint docker tag to v1.7.10 (v1.18) (#​43541, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​43466, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​43542, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​43571, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​43663, @​cilium-renovate[bot])
• cmapisrv/test: miscellaneous fixes to the ciliumidentities script test (Backport PR #​43425, Upstream PR #​43372, @​giorio94)
• docs: Add missing IPv6 fragmentation BPF map reference (Backport PR #​43290, Upstream PR #​43161, @​doniacld)
• Fix a regression in the new services control plane where loadBalancerSourceRanges was applied by default to all service types. (Backport PR #​43575, Upstream PR #​42351, @​borkmann)
• operator: the K8s Secret synchronization process now resynchronizes after an hour for synced Secrets. (Backport PR #​43425, Upstream PR #​42414, @​youngnick)
• release: change OCI registry (Backport PR #​43689, Upstream PR #​43646, @​aanm)
• route: install ingress proxy routes with WireGuard and L7Proxy (Backport PR #​43434, Upstream PR #​42835, @​smagnani96)

Other Changes:

• [v1.18] bpf:hubble: support policy verdict from L3 devices (#​43381, @​smagnani96)
• [v1.18] deps: bump CNI plugins version to v1.9.0 (#​43593, @​diyi0926)
• install: Update image digests for v1.18.5 (#​43400, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.6@​sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4
quay.io/cilium/cilium:stable@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.6@​sha256:8ee142912a0e261850c0802d9256ddbe3729e1cd35c6bea2d93077f334c3cf3b
quay.io/cilium/clustermesh-apiserver:stable@sha256:8ee142912a0e261850c0802d9256ddbe3729e1cd35c6bea2d93077f334c3cf3b

docker-plugin

quay.io/cilium/docker-plugin:v1.18.6@​sha256:7931555ad713a48a28e4bf097402e0e398461dbf51b81cb8192558c5cb0dc48f
quay.io/cilium/docker-plugin:stable@sha256:7931555ad713a48a28e4bf097402e0e398461dbf51b81cb8192558c5cb0dc48f

hubble-relay

quay.io/cilium/hubble-relay:v1.18.6@​sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e
quay.io/cilium/hubble-relay:stable@sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.6@​sha256:212c4cbe27da3772bcb952b8f8cbaa0b0eef72488b52edf90ad2b32072a3ca4c
quay.io/cilium/operator-alibabacloud:stable@sha256:212c4cbe27da3772bcb952b8f8cbaa0b0eef72488b52edf90ad2b32072a3ca4c

operator-aws

quay.io/cilium/operator-aws:v1.18.6@​sha256:47dbc1a5bd483fec170dab7fb0bf2cca3585a4893675b0324d41d97bac8be5eb
quay.io/cilium/operator-aws:stable@sha256:47dbc1a5bd483fec170dab7fb0bf2cca3585a4893675b0324d41d97bac8be5eb

operator-azure

quay.io/cilium/operator-azure:v1.18.6@​sha256:a57aff47aeb32eccfedaa2a49d1af984d996d6d6de79609c232e0c4cf9ce97a1
quay.io/cilium/operator-azure:stable@sha256:a57aff47aeb32eccfedaa2a49d1af984d996d6d6de79609c232e0c4cf9ce97a1

operator-generic

quay.io/cilium/operator-generic:v1.18.6@​sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af
quay.io/cilium/operator-generic:stable@sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af

operator

quay.io/cilium/operator:v1.18.6@​sha256:0e8903aa092025918761d24ae9a91af35baa5b6910b5d0e3feac91ab8a2bc65b
quay.io/cilium/operator:stable@sha256:0e8903aa092025918761d24ae9a91af35baa5b6910b5d0e3feac91ab8a2bc65b

v1.18.5: 1.18.5

Compare Source

Summary of Changes

Minor Changes:

• [v1.18] proxy: Bump envoy version to v1.34.11 (#​43143, @​sayboras)
• Change the sidecar etcd instance of the Cluster Mesh API Server listen on all IP addresses (Backport PR #​42948, Upstream PR #​42818, @​giorio94)

Bugfixes:

• allow missing verbs for cilium-agent cluster role when readSecretsOnlyFromSecretsNamespace is false (Backport PR #​42948, Upstream PR #​42790, @​kraashen)
• AWS EC2: Fix ENI attachment on multi-network card instances with high-performance networking (EFA) setups (Backport PR #​42745, Upstream PR #​42512, @​41ks)
• CiliumEnvoyConfig proxy ports are now restored on agent restarts. (Backport PR #​43117, Upstream PR #​43108, @​jrajahalme)
• Cleanup FQDNs that have leaked into the global FQDN cache (Backport PR #​42864, Upstream PR #​42485, @​sjohnsonpal)
• Do not opt-out Endpoint ID 1 from dnsproxy transparent mode. (Backport PR #​42948, Upstream PR #​42887, @​jrajahalme)
• ENI: Fix panic on nil subnet (Backport PR #​43117, Upstream PR #​43023, @​HadrienPatte)
• Ensure cilium-agent gracefully does fallbacks when etcd is in a bad state. (Backport PR #​43059, Upstream PR #​42977, @​odinuge)
• Fix a bug that would cause Cilium to not report L4 checksum update errors when the length attribute is missing in ICMP Error messages with TCP inner packets. (Backport PR #​42828, Upstream PR #​42426, @​yushoyamaguchi)
• Fix a bug that would cause IPsec logs to incorrectly report the XFRM rules being processed as "Ingress" rules. (Backport PR #​42828, Upstream PR #​42640, @​sjohnsonpal)
• Fix agent local identity leak (Backport PR #​43117, Upstream PR #​42662, @​odinuge)
• Fix bug that could cause the agent to fail to add XFRM states when IPsec is enabled, thus preventing a proper startup. (Backport PR #​42948, Upstream PR #​42666, @​pchaigno)
• Fix GC of per-cluster ctmap entries (Backport PR #​43294, Upstream PR #​43160, @​giorio94)
• Fix ipcache issues causing severe issues with the fqdn subsystem (Backport PR #​42864, Upstream PR #​42815, @​odinuge)
• Fix issue where endpoints got stuck in "waiting-to-regenerate" (Backport PR #​42948, Upstream PR #​42856, @​odinuge)
• Fix leak in the policy subsystem (Backport PR #​43117, Upstream PR #​42661, @​odinuge)
• Fix rare kvstore issue where cilium continues to use an expired lease causing kvstore operations to fail consistently (Backport PR #​42745, Upstream PR #​42709, @​odinuge)
• fqdn: Fix fqdn subsystem correctness issues causing packet drops and inconsistent ipcache (Backport PR #​43117, Upstream PR #​42500, @​odinuge)
• In rare cases, the cilium-operator losing the lead of the HA deployment could continue acting as if leading for at most a minute, leading to split-brain problems such as double allocation of pod CIDRs. (Backport PR #​43059, Upstream PR #​42920, @​bimmlerd)
• KVStoreMesh now correctly respects the CA bundle setting when validating remote cluster certificates (Backport PR #​42828, Upstream PR #​42726, @​giorio94)
• policy: Fix rare Endpoint Selector Policy Deadlock causing policies to not be updated with new identities (Backport PR #​42864, Upstream PR #​42306, @​odinuge)
• Recreate CiliumEndpoints (k8s resource) if they are accidentally deleted. (Backport PR #​43117, Upstream PR #​42877, @​aanm)
• redirectpolicy: Avoid recomputing on pod changes that do not change resulting redirect backends (Backport PR #​42948, Upstream PR #​42814, @​joamaki)

CI Changes:

• bpf: test: add BPF Masq tests for unknown / handled protocols (Backport PR #​42711, Upstream PR #​42144, @​julianwiedmann)
• bpf: test: egressgw: fix up ENABLE_MASQUERADE (Backport PR #​42966, Upstream PR #​42912, @​julianwiedmann)
• bpf: tests: add BPF MASQ test for ICMP ECHOs (Backport PR #​42711, Upstream PR #​42656, @​julianwiedmann)
• bpf: tests: set ENABLE_MASQUERADE_IPV6 for EGW XDP test (Backport PR #​43059, Upstream PR #​42962, @​julianwiedmann)
• bpf:test: cover host endpoint case in tc_nodeport_l3_dev.h (Backport PR #​43059, Upstream PR #​42983, @​smagnani96)
• Delete .github/workflows/build-images-hotfixes.yaml (Backport PR #​42966, Upstream PR #​42958, @​sekhar-isovalent)
• gh: conn-disrupt: fix XFRM error checks (Backport PR #​42764, Upstream PR #​42724, @​julianwiedmann)
• gh: ipsec-e2e: fix flaky connection disruptivity test (Backport PR #​42823, Upstream PR #​42780, @​julianwiedmann)
• gha: additionally cleanup disk space in clustermesh upgrade workflow (Backport PR #​42948, Upstream PR #​42862, @​giorio94)
• gha: don't filter lint-build-commits steps when workflow is modified (Backport PR #​42948, Upstream PR #​42844, @​giorio94)
• gha: wait for cert-manager CRDs to be ready in conformance clustermesh (Backport PR #​42966, Upstream PR #​42947, @​giorio94)
• makefile: More reliable update-helm-values (Backport PR #​42828, Upstream PR #​42736, @​devodev)

Misc Changes:

• .github/workflows: make adjustments for new GitHub workflow behavior (#​43219, @​aanm)
• [v1.18] deps: bump x/crypto to v0.45.0 (#​43114, @​ferozsalam)
• [v1.18] vendor: Bump to StateDB v0.4.6 (#​42953, @​joamaki)
• chore(deps): update all github action dependencies (v1.18) (#​42783, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​42937, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​43036, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​43181, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​43268, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (#​43317, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.18) (patch) (#​43314, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.18) (#​42804, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.18) (#​43037, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.18.9 (v1.18) (#​43182, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.28 (v1.18) (#​42771, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v33.1 (v1.18) (#​42805, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v33.2 (v1.18) (#​43184, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.11 (v1.18) (#​43315, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.37.0 docker digest to d80cd69 (v1.18) (#​43312, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.10 docker digest to 7b13449 (v1.18) (#​42935, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.10 docker digest to 83d7392 (v1.18) (#​42802, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.24.11 docker digest to e3fb71a (v1.18) (#​43313, @​cilium-renovate[bot])
• chore(deps): update gcr.io/distroless/static:nonroot docker digest to 2b7c93f (v1.18) (#​43135, @​cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.6 (v1.18) (#​42936, @​cilium-renovate[bot])
• chore(deps): update github artifact actions (v1.18) (#​43318, @​cilium-renovate[bot])
• chore(deps): update go to v1.24.11 (v1.18) (#​43183, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.3.1 (v1.18) (#​43052, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​42803, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.18) (patch) (#​43316, @​cilium-renovate[bot])
• docs: Add limitation about LB to same backend via multiple VIPs (Backport PR #​42745, Upstream PR #​42632, @​brb)
• Documentation: host firewall: document emergency recovery (Backport PR #​42948, Upstream PR #​42776, @​squeed)
• fqdn: rewrite name manager test to use real ipcache (Backport PR #​42948, Upstream PR #​42820, @​odinuge)
• Minor improvements around certificate validation in etcd/clustermesh troubleshoot commands (Backport PR #​42948, Upstream PR #​42782, @​giorio94)
• node/manager: TestNodesStartupPruning poll state (Backport PR #​42948, Upstream PR #​41648, @​0xch4z)
• policy: Marshal L4Filter marshalling errors into json (Backport PR #​42948, Upstream PR #​42834, @​joestringer)
• xds: Do not log an error on a done context (Backport PR #​43117, Upstream PR #​42990, @​jrajahalme)

Other Changes:

• [v1.18] Add periodic resync for secret-sync controller (#​43356, @​youngnick)
• [v1.18] bpf: lxc: transfer source identity for lxc-to-host policy (#​42821, @​julianwiedmann)
• [v1.18] ipcache: Fix leak in CIDR metadata consolidation logic (#​43354, @​christarazi)
• [v1.18] lb: Implement Hybrid-DSR via annotation infrastructure (#​43056, @​julianwiedmann)
• [v1.18] proxy: Bump envoy version to v1.34.12 (#​43259, @​sayboras)
• install: Update image digests for v1.18.4 (#​42735, @​cilium-release-bot[bot])
• Kubernetes endpoints that are terminating are retained in the backends BPF state regardless of the "serving" condition to avoid connection disruptions when a pod no longer signals readiness to process new connections. (#​42708, @​joamaki)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.5@​sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628
quay.io/cilium/cilium:stable@sha256:2c92fb05962a346eaf0ce11b912ba434dc10bd54b9989e970416681f4a069628

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.5@​sha256:952f07c30390847e4d9dfaa19a76c4eca946251ffbc4f6459946570f93ee72f1
quay.io/cilium/clustermesh-apiserver:stable@sha256:952f07c30390847e4d9dfaa19a76c4eca946251ffbc4f6459946570f93ee72f1

docker-plugin

quay.io/cilium/docker-plugin:v1.18.5@​sha256:db81fda86653d96ea40687dc314985f5f23d5b57719dd1cb0d151be2c7c8789f
quay.io/cilium/docker-plugin:stable@sha256:db81fda86653d96ea40687dc314985f5f23d5b57719dd1cb0d151be2c7c8789f

hubble-relay

quay.io/cilium/hubble-relay:v1.18.5@​sha256:17212962c92ff52384f94e407ffe3698714fcbd35c7575f67f24032d6224e446
quay.io/cilium/hubble-relay:stable@sha256:17212962c92ff52384f94e407ffe3698714fcbd35c7575f67f24032d6224e446

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.5@​sha256:2e60f635495eb2837296ced5475875c281a05765d5ddd644a05e126bbb080b3c
quay.io/cilium/operator-alibabacloud:stable@sha256:2e60f635495eb2837296ced5475875c281a05765d5ddd644a05e126bbb080b3c

operator-aws

quay.io/cilium/operator-aws:v1.18.5@​sha256:7608025d8b727a10f21d924d8e4f40beb176cefd690320433452816ad8776f52
quay.io/cilium/operator-aws:stable@sha256:7608025d8b727a10f21d924d8e4f40beb176cefd690320433452816ad8776f52

operator-azure

quay.io/cilium/operator-azure:v1.18.5@​sha256:126667e000267f893cb81042bf8a710ad2f219619eb9ce06e8949333bd325ac6
quay.io/cilium/operator-azure:stable@sha256:126667e000267f893cb81042bf8a710ad2f219619eb9ce06e8949333bd325ac6

operator-generic

quay.io/cilium/operator-generic:v1.18.5@​sha256:36c3f6f14c8ced7f45b40b0a927639894b44269dd653f9528e7a0dc363a4eb99
quay.io/cilium/operator-generic:stable@sha256:36c3f6f14c8ced7f45b40b0a927639894b44269dd653f9528e7a0dc363a4eb99

operator

quay.io/cilium/operator:v1.18.5@​sha256:c6806ee97ef35a79aa72d411bc7f12745a1ea684208853e7d13c8e7f84cbb606
quay.io/cilium/operator:stable@sha256:c6806ee97ef35a79aa72d411bc7f12745a1ea684208853e7d13c8e7f84cbb606

v1.18.4: 1.18.4

Compare Source

Security Advisories

This release addresses GHSA-38pp-6gcp-rqvm.

Summary of Changes

Minor Changes:

• fix indentation for certgen resources in helm templates (Backport PR #​42450, Upstream PR #​42412, @​sdickhoven)

Bugfixes:

• bpf: Do not accidentally update IPcache in cluster-aware routing (Backport PR #​42577, Upstream PR #​42472, @​brb)
• cilium-operator: ciliumendpoints are not garbage collected until a minimum age is reached (5m by default) (Backport PR #​42577, Upstream PR #​42413, @​zhouhaibing089)
• controller: avoid spurious errors when RemoveControllerAndWait is invoked when the controller does not exist (Backport PR #​42617, Upstream PR #​41384, @​asdfmi)
• encrypt status: also check tcx attachment on interfaces (Backport PR #​42450, Upstream PR #​42328, @​bersoare)
• envoy: pass stream idle timeout from Helm to configmap (Backport PR #​42617, Upstream PR #​42499, @​mhofstetter)
• Fix BGP operator crash

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.