Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR #47881, Upstream PR #47529, @julianwiedmann)
Bugfixes:
azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR #47690, Upstream PR #47449, @jaredledvina)
bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR #47621, Upstream PR #47343, @smagnani96)
clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR #47885, Upstream PR #47824, @MrFreezeex)
datapath: turn ARP off on the base devices before bringing them up (Backport PR #47885, Upstream PR #47838, @aanm)
endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR #47690, Upstream PR #47625, @christarazi)
endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR #47954, Upstream PR #47880, @weizhoublue)
envoy.httpUpstreamLingerTimeout accepts 0 as a chart value and templates into configmap. (Backport PR #47885, Upstream PR #47741, @jdw6359)
envoy: restore http-idle-timeout as the route idle timeout source (Backport PR #47690, Upstream PR #47583, @aanm)
Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR #47805, Upstream PR #47765, @julianwiedmann)
Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR #47967, Upstream PR #47802, @bimmlerd)
Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR #47805, Upstream PR #47727, @aanm)
Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR #47690, Upstream PR #47295, @aanm)
Fix abnormal ip allocation caused by hostnetwork pod (Backport PR #47690, Upstream PR #47552, @haozhangami)
Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR #47881, Upstream PR #47593, @julianwiedmann)
Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with NotAllowedByListeners when the TCP listener had an explicit AllowedRoutes.Kinds restriction. (Backport PR #47690, Upstream PR #46842, @pidreher)
Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR #47954, Upstream PR #47826, @mehrdadbn9)
operator: Emit startup logs in the configured log format (Backport PR #47954, Upstream PR #47890, @HadrienPatte)
Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR #47885, Upstream PR #47844, @bimmlerd)
standalone-dns-proxy: return an error when no endpoint is found (Backport PR #47954, Upstream PR #47791, @vipul-21)
test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR #47805, Upstream PR #47725, @aanm)
test: allowlist the leader election read timeout in ginkgo log check (Backport PR #47690, Upstream PR #47612, @aanm)
Misc Changes:
Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR #47690, Upstream PR #46116, @amaanx86)
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) (#47899, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) (#47989, @cilium-renovate[bot])
docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR #47690, Upstream PR #47600, @41ks)
Gateway API: the Gateway address status no longer reports a bogus "" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR #47690, Upstream PR #47466, @locker95)
🎉Release Announcement🎉: We are excited to announce the Cilium 1.20.0 release!
More than 2,660 new commits have landed in this release, supported by a community of over 1,100 contributors and more than 24,800 GitHub stars! 🤩
⚠️ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the cilium.io/v2alpha1CiliumNodeConfig API, the libnetwork integration, or a custom CNI configuration. See the Upgrade Guide for details.
👥Delegate Gateway Listeners: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. (cilium/cilium#46303, cilium/cilium#46785, @asauber)
🔏Encrypt Traffic to Backends: Gateway API BackendTLSPolicy support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. (cilium/cilium#43045, @youngnick)
🔐External Authorization: HTTPRoute requests can now be authenticated and authorized through an external service before they reach the application, using the Gateway API ExternalAuth filter from GEP-1494. (cilium/cilium#45739, @gauteoh)
↔️Configurable gRPC-Web Translation: CiliumGatewayClassConfig can disable automatic gRPC-web translation for Gateways that need to pass the original traffic through unchanged. Translation remains enabled by default. (cilium/cilium#45984, @thorn3r)
🚄Automatic Netkit Selection: Set bpf.datapathMode=auto to use netkit automatically on supported kernels and fall back to veth on other nodes. The default remains veth. (cilium/cilium#43062, @ajmmm)
📤Egress Gateway Improvements: Dual-stack clusters can configure an explicit IPv6 egress IP. IPv4 Egress Gateway traffic also strictly honors the interface selected by the policy, matching the existing IPv6 behavior. (cilium/cilium#44524, @yykkibbb; cilium/cilium#45833, @julianwiedmann)
🔄Migrate to Multi-Pool IPAM: Existing clusters can move from cluster-pool IPAM to multi-pool IPAM without being rebuilt. (cilium/cilium#46104, @pippolo84)
🧭Dynamic NodePort Source Addresses: NodePort can use the kernel FIB to select the preferred source address dynamically before SNATing north-south traffic, on supported kernels. (cilium/cilium#44625, @ldelossa)
🔵Prefer IPv6 Consistently: The new top-level preferIpv6 option applies to both Cilium health probes and Hubble peer communication when IPv4 and IPv6 are available. (cilium/cilium#45447, @tibrezus)
🕸️Services and Cluster Mesh
📍Topology-Aware Service Traffic: Cilium's service load balancer now supports the Kubernetes PreferSameZone and PreferSameNode traffic distribution hints. (cilium/cilium#44771, @raphink)
⚖️Weighted Maglev Backends: Maglev now honors the service.cilium.io/weight annotation on EndpointSlices. A weight of zero drains new connections while allowing existing connections to continue. (cilium/cilium#46061, @mhofstetter)
🌉More Load-Balancing Options with VXLAN: Clusters using VXLAN can use per-Service load-balancing mode annotations, including compatible DSR configurations such as IPIP dispatch. (cilium/cilium#45600, @brb)
🤖Stable MCS API Support: Cilium's implementation of the Kubernetes Multi-Cluster Services API is now stable and recommended for portable service discovery through ClusterMesh. (cilium/cilium#45404, cilium/cilium#46953, @MrFreezeex)
🔒Encryption and Network Policy
🚇Improved Ztunnel Identity Management: The ztunnel path now supports either an internal certificate authority or SPIRE-issued workload identities, alongside new Prometheus metrics for enrollment and connection health. It transparently encrypts enrolled pod-to-pod connections, including traffic between pods on the same node. (cilium/cilium#43763, cilium/cilium#44275, cilium/cilium#44136, cilium/cilium#45861, @nddq; cilium/cilium#45096, @gokulMSFT)
🛡️Kubernetes ClusterNetworkPolicy (KCNP): Cilium now supports the upstream, cluster-scoped policy API, including Admin and Baseline policy tiers alongside namespaced Kubernetes NetworkPolicy. (cilium/cilium#42338, @TheBeeZee; cilium/cilium#46253, @aanm)
⛔Friendlier IPv6 Policy Denials: Cilium can return ICMPv6 Destination Unreachable responses when network policy denies IPv6 egress traffic, matching the IPv4 capability introduced in Cilium 1.19. (cilium/cilium#44234, @Andreagit97)
🌐Select the Entire Cluster Mesh: The new cluster-mesh policy entity selects every endpoint across a mesh, making cross-cluster security policies easier to express. (cilium/cilium#46813, @squeed)
☁️Standardize AWS VPC Group Policies: Policies that reference AWS VPC groups are now transformed into CiliumCIDRGroup resources, bringing external IP groups into the standard Cilium policy model. (cilium/cilium#44704, @squeed)
🛂Per-Pod Source IP Verification Control: Trusted workloads that need to send traffic with non-local source addresses can disable source IP verification through a pod annotation, guarded by a namespace-level opt-in. (cilium/cilium#43505, @zbb88888)
⚙️Day 2 Operations and Observability
🔧Detect Configuration Drift: Cilium can expose how many ConfigMap settings an agent has not yet applied, making it easier to identify when a restart is required after a configuration change. (cilium/cilium#44703, @PhilipSchmid)
⏱️Understand Agent Start-Up Time: New Hive lifecycle and Kubernetes resource-sync metrics show how long individual resources and components take to initialize. (cilium/cilium#44802, cilium/cilium#44639, @ILL1A)
🛰️Correlate More Hubble Verdicts with Policies: Hubble can now identify the policy responsible for audit verdicts. (cilium/cilium#45373, @Rajneesh180)
📊Standalone DNS Proxy Metrics: The Standalone DNS Proxy now exports DNS metrics back through Cilium, improving visibility when DNS policy processing runs outside the agent. (cilium/cilium#45222, cilium/cilium#44601, @vipul-21)
🌅Performance and Scale
💾Aggregated Load-Balancer State: Cilium's internal backend representation has been flattened to efficiently support thousands of Services that share the same backends. (cilium/cilium#44511, @joamaki)
🗂️Optimized BPF Policy Map Encoding: Semantic wildcard identities for remote-node and world reduce BPF policy-map pressure, particularly in larger clusters. (cilium/cilium#46438, @squeed)
📦Smaller CNI Binary: The cilium-cni binary has been reduced from roughly 77 MB to 16 MB, shrinking both the Cilium image and its footprint on every node. (cilium/cilium#45845, @giorio94)
❤️Production Case Studies: Many end-users have told their stories running Cilium in production. Read and watch more from: Asana, Etraveli, Michelin, OpenAI, Suse, Telefónica's acens, and Zynga. If your company wants to submit their case studies let us know. We would love to hear your feedback!
🇺🇸Salt Lake City Events: Meet us at the upcoming CiliumCon and Cilium Developer Summit at KubeCon + CloudNativeCon North America in Salt Lake City, November 9-12.
🤖Generative AI Policy: The Cilium community adopted a Generative AI Policy that encourages community members to connect and communicate with one another without the use of AI, while recognizing that different people work best with their own tools of choice.
❤️Thank You: Cilium 1.20 was made possible by contributors, reviewers and maintainers from across the community, including engineers from Datadog, Google, Microsoft and many other organizations.
To keep up to date with all the latest Cilium releases, join #release 🎉
envoy: restore http-idle-timeout as the route idle timeout source (Backport PR #47688, Upstream PR #47583, @aanm)
Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR #47723, Upstream PR #47765, @julianwiedmann)
Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR #47545, Upstream PR #47295, @aanm)
Fix abnormal ip allocation caused by hostnetwork pod (Backport PR #47688, Upstream PR #47552, @haozhangami)
Fix BPF LB map key collision where HostPort/NodePort expansion could overwrite a LoadBalancer frontend when the node IP matches the LoadBalancer external IP (e.g. k3s/RKE2 L2 ServiceLB). Also fix a ~30-minute NodePort outage that occurred after deleting a LoadBalancer whose external IP was a node address with a port in the NodePort range. (Backport PR #47414, Upstream PR #45314, @syedazeez337)
Fix bug causing Cilium to intercept traffic towards LoadBalancer VIPs when KPR is disabled, when the traffic should be delegated to kube-proxy. (Backport PR #47414, Upstream PR #47204, @ajmmm)
Fix redirection of egressing traffic that falls in scope of a CiliumEgressGatewayPolicy, when the initial interface is a L3 interface. (Backport PR #47757, Upstream PR #45703, @julianwiedmann)
Fix: Cilium Ingress now automatically reallocates ports and retries when cilium-envoy fails to bind due to port conflicts (Backport PR #47410, Upstream PR #42859, @inerplat)
Fixes an issue where invalid regex on an HTTPRoute or GRPCRoute matcher is accepted but causes Envoy to NACK (Backport PR #47468, Upstream PR #47005, @0xch4z)
fqdn/service: prune SDP identity->IP mapping on delete using newID (Backport PR #47545, Upstream PR #47100, @vipul-21)
gateway-api: GAMMA Routes are now filtered correctly before being passed to model ingestion. (Backport PR #47468, Upstream PR #45294, @youngnick)
ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR #47886, Upstream PR #47208, @iwanhae)
lbipam: prevent reassigning Service LoadBalancer IPs on operator restart when the existing IP belongs to a compatible sharing key group. (Backport PR #46559, Upstream PR #46262, @ieth0)
Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR #47886, Upstream PR #47844, @bimmlerd)
ci: skip etcd log fetch when kvstore was never started (Backport PR #47886, Upstream PR #47801, @aanm)
Collect /proc/net/softnet_stat, /proc/net/snmp and /proc/net/netstat in sysdumps to help diagnose host-level packet drops. (Backport PR #47290, Upstream PR #46985, @aanm)
complexity-diff: Compute percentages of diffs against original values (Backport PR #47836, Upstream PR #45657, @pchaigno)
images/scripts: Validate Envoy image vars against sed injection (Backport PR #47804, Upstream PR #47205, @MasloMaslane)
Increase the timeout for the kvstore readiness wait in kind-based CI to avoid flakes on slow etcd image pulls. (Backport PR #47290, Upstream PR #46882, @aanm)
loader: Reduce number of permutations for load-time configs (Backport PR #47721, Upstream PR #44409, @pchaigno)
loader: Support max stack depth in verifier logs (Backport PR #47836, Upstream PR #46109, @pchaigno)
chore(deps): update github/codeql-action action to v4.37.2 (v1.19) (#47504, @cilium-renovate[bot])
chore(deps): update google/cloud-sdk docker tag to v577 (v1.19) (#47511, @cilium-renovate[bot])
chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260716143926-092fe0c72997 (v1.19) (#47487, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.4.8 (v1.19) (#47323, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1784803288-cf56df1cccc09d7afde2847ff9e6e853dde50b77 (v1.19) (#47488, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1786864149-07e8503ff34b9190d7bbe4e57d4e185c4ef8b1de (v1.19) (#48000, @cilium-renovate[bot])
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | minor | `1.19.6` → `1.20.1` |
---
### Release Notes
<details>
<summary>cilium/cilium (cilium)</summary>
### [`v1.20.1`](https://github.com/cilium/cilium/releases/tag/v1.20.1): 1.20.1
[Compare Source](https://github.com/cilium/cilium/compare/1.20.0...1.20.1)
## Summary of Changes
**Major Changes:**
- docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR [#​47615](https://github.com/cilium/cilium/issues/47615), Upstream PR [#​47351](https://github.com/cilium/cilium/issues/47351), [@​MrFreezeex](https://github.com/MrFreezeex))
**Minor Changes:**
- envoy: demote stale ADS endpoint warning (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47148](https://github.com/cilium/cilium/issues/47148), [@​nezdolik](https://github.com/nezdolik))
- Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR [#​47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#​47529](https://github.com/cilium/cilium/issues/47529), [@​julianwiedmann](https://github.com/julianwiedmann))
**Bugfixes:**
- azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47449](https://github.com/cilium/cilium/issues/47449), [@​jaredledvina](https://github.com/jaredledvina))
- bpf: dsr: don't look for TCP header on fragmented packets (Backport PR [#​47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#​47640](https://github.com/cilium/cilium/issues/47640), [@​julianwiedmann](https://github.com/julianwiedmann))
- bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR [#​47621](https://github.com/cilium/cilium/issues/47621), Upstream PR [#​47343](https://github.com/cilium/cilium/issues/47343), [@​smagnani96](https://github.com/smagnani96))
- clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR [#​47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#​47824](https://github.com/cilium/cilium/issues/47824), [@​MrFreezeex](https://github.com/MrFreezeex))
- datapath: turn ARP off on the base devices before bringing them up (Backport PR [#​47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#​47838](https://github.com/cilium/cilium/issues/47838), [@​aanm](https://github.com/aanm))
- endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47625](https://github.com/cilium/cilium/issues/47625), [@​christarazi](https://github.com/christarazi))
- endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR [#​47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#​47880](https://github.com/cilium/cilium/issues/47880), [@​weizhoublue](https://github.com/weizhoublue))
- envoy.httpUpstreamLingerTimeout accepts `0` as a chart value and templates into configmap. (Backport PR [#​47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#​47741](https://github.com/cilium/cilium/issues/47741), [@​jdw6359](https://github.com/jdw6359))
- envoy: restore http-idle-timeout as the route idle timeout source (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47583](https://github.com/cilium/cilium/issues/47583), [@​aanm](https://github.com/aanm))
- Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47765](https://github.com/cilium/cilium/issues/47765), [@​julianwiedmann](https://github.com/julianwiedmann))
- Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR [#​47967](https://github.com/cilium/cilium/issues/47967), Upstream PR [#​47802](https://github.com/cilium/cilium/issues/47802), [@​bimmlerd](https://github.com/bimmlerd))
- Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47727](https://github.com/cilium/cilium/issues/47727), [@​aanm](https://github.com/aanm))
- Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47295](https://github.com/cilium/cilium/issues/47295), [@​aanm](https://github.com/aanm))
- Fix abnormal ip allocation caused by hostnetwork pod (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47552](https://github.com/cilium/cilium/issues/47552), [@​haozhangami](https://github.com/haozhangami))
- Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR [#​47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#​47593](https://github.com/cilium/cilium/issues/47593), [@​julianwiedmann](https://github.com/julianwiedmann))
- fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR [#​47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#​47754](https://github.com/cilium/cilium/issues/47754), [@​weizhoublue](https://github.com/weizhoublue))
- Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with `NotAllowedByListeners` when the TCP listener had an explicit `AllowedRoutes.Kinds` restriction. (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​46842](https://github.com/cilium/cilium/issues/46842), [@​pidreher](https://github.com/pidreher))
- gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR [#​47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#​47840](https://github.com/cilium/cilium/issues/47840), [@​mhofstetter](https://github.com/mhofstetter))
- gateway-api: mark unresolved backend service ports in route status (Backport PR [#​47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#​47766](https://github.com/cilium/cilium/issues/47766), [@​mhofstetter](https://github.com/mhofstetter))
- gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​46696](https://github.com/cilium/cilium/issues/46696), [@​thorn3r](https://github.com/thorn3r))
- gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47457](https://github.com/cilium/cilium/issues/47457), [@​asauber](https://github.com/asauber))
- gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47702](https://github.com/cilium/cilium/issues/47702), [@​mhofstetter](https://github.com/mhofstetter))
- gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47627](https://github.com/cilium/cilium/issues/47627), [@​mhofstetter](https://github.com/mhofstetter))
- ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR [#​47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#​47208](https://github.com/cilium/cilium/issues/47208), [@​iwanhae](https://github.com/iwanhae))
- l2announcer: re-evaluate services on frontend changes (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47579](https://github.com/cilium/cilium/issues/47579), [@​mhofstetter](https://github.com/mhofstetter))
- Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR [#​47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#​47826](https://github.com/cilium/cilium/issues/47826), [@​mehrdadbn9](https://github.com/mehrdadbn9))
- operator: Emit startup logs in the configured log format (Backport PR [#​47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#​47890](https://github.com/cilium/cilium/issues/47890), [@​HadrienPatte](https://github.com/HadrienPatte))
- Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR [#​47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#​47844](https://github.com/cilium/cilium/issues/47844), [@​bimmlerd](https://github.com/bimmlerd))
- standalone-dns-proxy: return an error when no endpoint is found (Backport PR [#​47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#​47791](https://github.com/cilium/cilium/issues/47791), [@​vipul-21](https://github.com/vipul-21))
- wireguard: Unsubscribe node handler on shutdown (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47614](https://github.com/cilium/cilium/issues/47614), [@​HadrienPatte](https://github.com/HadrienPatte))
**CI Changes:**
- .github: add python3-scapy for BPF unit tests (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47535](https://github.com/cilium/cilium/issues/47535), [@​msune](https://github.com/msune))
- .github: run all quarantined EKS tests in a single tolerated step (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47534](https://github.com/cilium/cilium/issues/47534), [@​aanm](https://github.com/aanm))
- .github: Run envoy image check against PR content (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47792](https://github.com/cilium/cilium/issues/47792), [@​joestringer](https://github.com/joestringer))
- .github: Simplify permissions for image linter workflow (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47753](https://github.com/cilium/cilium/issues/47753), [@​joestringer](https://github.com/joestringer))
- .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47470](https://github.com/cilium/cilium/issues/47470), [@​atykhyy](https://github.com/atykhyy))
- .github: test the default ENI behaviour on the EKS pull request leg (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47569](https://github.com/cilium/cilium/issues/47569), [@​aanm](https://github.com/aanm))
- ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47743](https://github.com/cilium/cilium/issues/47743), [@​giorio94](https://github.com/giorio94))
- bpf/complexity-tests: Cover L7 LB (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47060](https://github.com/cilium/cilium/issues/47060), [@​pchaigno](https://github.com/pchaigno))
- ci: build race images on push events so conformance-race works on stable branches (Backport PR [#​47609](https://github.com/cilium/cilium/issues/47609), Upstream PR [#​47608](https://github.com/cilium/cilium/issues/47608), [@​aanm](https://github.com/aanm))
- ci: build race images on push in the stable image builders (Backport PR [#​47609](https://github.com/cilium/cilium/issues/47609), Upstream PR [#​47616](https://github.com/cilium/cilium/issues/47616), [@​aanm](https://github.com/aanm))
- ci: draft renovate PRs until ciliumbot auto-approval (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47364](https://github.com/cilium/cilium/issues/47364), [@​mhofstetter](https://github.com/mhofstetter))
- ci: fix filtering out md files in bpf checks (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47605](https://github.com/cilium/cilium/issues/47605), [@​nebril](https://github.com/nebril))
- ci: migrate set-commit-status to cilium/actions (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47771](https://github.com/cilium/cilium/issues/47771), [@​bogdankrasko](https://github.com/bogdankrasko))
- ci: skip etcd log fetch when kvstore was never started (Backport PR [#​47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#​47801](https://github.com/cilium/cilium/issues/47801), [@​aanm](https://github.com/aanm))
- Fix missing `events_map_rate_limit` complexity coverage (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47691](https://github.com/cilium/cilium/issues/47691), [@​pchaigno](https://github.com/pchaigno))
- gha/kubespray: run on schedule, rather than on every push (Backport PR [#​47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#​47719](https://github.com/cilium/cilium/issues/47719), [@​giorio94](https://github.com/giorio94))
- gha/lvh-kind: respect Kind image version also when config is provided (Backport PR [#​47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#​47703](https://github.com/cilium/cilium/issues/47703), [@​giorio94](https://github.com/giorio94))
- gha: don't install LLVM and Clang in integration tests workflow (Backport PR [#​47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#​47717](https://github.com/cilium/cilium/issues/47717), [@​giorio94](https://github.com/giorio94))
- gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR [#​47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#​47724](https://github.com/cilium/cilium/issues/47724), [@​giorio94](https://github.com/giorio94))
- images/scripts: Validate Envoy image vars against sed injection (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47205](https://github.com/cilium/cilium/issues/47205), [@​MasloMaslane](https://github.com/MasloMaslane))
- Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR [#​47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#​47780](https://github.com/cilium/cilium/issues/47780), [@​giorio94](https://github.com/giorio94))
- test(bpf): parallelize eBPF test compilation (Backport PR [#​47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#​47426](https://github.com/cilium/cilium/issues/47426), [@​lconnery](https://github.com/lconnery))
- test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47725](https://github.com/cilium/cilium/issues/47725), [@​aanm](https://github.com/aanm))
- test: allowlist the leader election read timeout in ginkgo log check (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47612](https://github.com/cilium/cilium/issues/47612), [@​aanm](https://github.com/aanm))
**Misc Changes:**
- Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​46116](https://github.com/cilium/cilium/issues/46116), [@​amaanx86](https://github.com/amaanx86))
- allocator: fix flake in TestWatchRemoteKVStore (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47455](https://github.com/cilium/cilium/issues/47455), [@​giorio94](https://github.com/giorio94))
- bpf/nat: Move IPv6 nat entry to map (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47762](https://github.com/cilium/cilium/issues/47762), [@​pchaigno](https://github.com/pchaigno))
- bpf: conntrack: Reduce stack usage of `ct_create{4,6}` (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47582](https://github.com/cilium/cilium/issues/47582), [@​dylandreimerink](https://github.com/dylandreimerink))
- bpf: dsr: only require DSR-info on SYN packet (Backport PR [#​47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#​47592](https://github.com/cilium/cilium/issues/47592), [@​julianwiedmann](https://github.com/julianwiedmann))
- bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR [#​47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#​47388](https://github.com/cilium/cilium/issues/47388), [@​julianwiedmann](https://github.com/julianwiedmann))
- bpf: lb: use dedicated new\_backend bool (Backport PR [#​47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#​47841](https://github.com/cilium/cilium/issues/47841), [@​julianwiedmann](https://github.com/julianwiedmann))
- chore(deps): update all github action dependencies (v1.20) ([#​47991](https://github.com/cilium/cilium/issues/47991), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update all github action dependencies (v1.20) ([#​48008](https://github.com/cilium/cilium/issues/48008), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update all-dependencies (v1.20) ([#​47678](https://github.com/cilium/cilium/issues/47678), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) ([#​47576](https://github.com/cilium/cilium/issues/47576), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) ([#​47988](https://github.com/cilium/cilium/issues/47988), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`705e964`](https://github.com/cilium/cilium/commit/705e964) (v1.20) ([#​47949](https://github.com/cilium/cilium/issues/47949), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`7caba52`](https://github.com/cilium/cilium/commit/7caba52) (v1.20) ([#​47864](https://github.com/cilium/cilium/issues/47864), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) ([#​47899](https://github.com/cilium/cilium/issues/47899), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) ([#​47989](https://github.com/cilium/cilium/issues/47989), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update stable lvh-images (v1.20) (patch) ([#​47865](https://github.com/cilium/cilium/issues/47865), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update stable lvh-images (v1.20) (patch) ([#​47990](https://github.com/cilium/cilium/issues/47990), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR [#​47962](https://github.com/cilium/cilium/issues/47962), Upstream PR [#​47932](https://github.com/cilium/cilium/issues/47932), [@​giorio94](https://github.com/giorio94))
- docs: clarify GAMMA DROP\_EP\_NOT\_READY events (Backport PR [#​47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#​47587](https://github.com/cilium/cilium/issues/47587), [@​thorn3r](https://github.com/thorn3r))
- docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47600](https://github.com/cilium/cilium/issues/47600), [@​41ks](https://github.com/41ks))
- docs: Remove "not stable" installation instructions (Backport PR [#​47798](https://github.com/cilium/cilium/issues/47798), Upstream PR [#​47646](https://github.com/cilium/cilium/issues/47646), [@​joestringer](https://github.com/joestringer))
- docs: update Gateway API conformance badge (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47581](https://github.com/cilium/cilium/issues/47581), [@​arybolovlev](https://github.com/arybolovlev))
- docs: Update Gateway API installation guide (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47446](https://github.com/cilium/cilium/issues/47446), [@​arybolovlev](https://github.com/arybolovlev))
- Gateway API: the Gateway address status no longer reports a bogus "<nil>" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47466](https://github.com/cilium/cilium/issues/47466), [@​locker95](https://github.com/locker95))
- gateway-api: remove unnecessary TLSRoute support checks (Backport PR [#​47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#​47758](https://github.com/cilium/cilium/issues/47758), [@​mhofstetter](https://github.com/mhofstetter))
- gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47599](https://github.com/cilium/cilium/issues/47599), [@​mhofstetter](https://github.com/mhofstetter))
- gateway-api: return route check errors directly (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47607](https://github.com/cilium/cilium/issues/47607), [@​mhofstetter](https://github.com/mhofstetter))
- gateway-api: unify Gateway API listener parentRef matching (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​46670](https://github.com/cilium/cilium/issues/46670), [@​arybolovlev](https://github.com/arybolovlev))
- gateway-api: validate gRPCRoute header modifiers in status (Backport PR [#​47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#​47606](https://github.com/cilium/cilium/issues/47606), [@​mhofstetter](https://github.com/mhofstetter))
- operator: Replace `reflect.DeepEqual` with `assert.Equal` in tests (Backport PR [#​47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#​47424](https://github.com/cilium/cilium/issues/47424), [@​HadrienPatte](https://github.com/HadrienPatte))
- Update all github action dependencies (v1.20) ([#​47656](https://github.com/cilium/cilium/issues/47656), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- Update all github action dependencies (v1.20) ([#​47675](https://github.com/cilium/cilium/issues/47675), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- Update docker.io/library/busybox:1.38.0 Docker digest to [`dc2d74b`](https://github.com/cilium/cilium/commit/dc2d74b) (v1.20) ([#​47655](https://github.com/cilium/cilium/issues/47655), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- Update documentation dependencies (Backport PR [#​47798](https://github.com/cilium/cilium/issues/47798), Upstream PR [#​47750](https://github.com/cilium/cilium/issues/47750), [@​joestringer](https://github.com/joestringer))
- Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) ([#​47657](https://github.com/cilium/cilium/issues/47657), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) ([#​47659](https://github.com/cilium/cilium/issues/47659), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) ([#​47658](https://github.com/cilium/cilium/issues/47658), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
**Other Changes:**
- install: Update image digests for v1.20.0 ([#​47584](https://github.com/cilium/cilium/issues/47584), [@​cilium-release-bot](https://github.com/cilium-release-bot)\[bot])
#### Docker Manifests
##### cilium
`quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b`
`quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b`
##### clustermesh-apiserver
`quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5`
`quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5`
##### hubble-relay
`quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4`
`quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4`
##### operator-alibabacloud
`quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c`
`quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c`
##### operator-aws
`quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7`
`quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7`
##### operator-azure
`quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031`
`quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031`
##### operator-generic
`quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf`
`quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf`
##### operator
`quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d`
`quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d`
### [`v1.20.0`](https://github.com/cilium/cilium/releases/tag/v1.20.0): 1.20.0
[Compare Source](https://github.com/cilium/cilium/compare/1.19.7...1.20.0)
🎉 **Release Announcement** 🎉: We are excited to announce the [Cilium 1.20.0](https://github.com/cilium/cilium/releases/tag/v1.20.0) release!
More than **2,660 new commits** have landed in this release, supported by a community of over **1,100 contributors** and more than **24,800 GitHub stars**! 🤩
⚠️ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the `cilium.io/v2alpha1` `CiliumNodeConfig` API, the libnetwork integration, or a custom CNI configuration. See the [Upgrade Guide](https://docs.cilium.io/en/v1.20/operations/upgrade/#upgrade-notes) for details.
The full changelog can be found [here](https://github.com/cilium/cilium/blob/v1.20/CHANGELOG.md).
Here are some of the highlights:
- ⛩️ **Gateway API**
- 🚀 **Gateway API v1.6.1**: Cilium moves from Gateway API v1.4 to v1.6.1, bringing support for capabilities that graduated across both upstream releases. ([cilium/cilium#45251](https://github.com/cilium/cilium/pull/45251), [@​youngnick](https://github.com/youngnick); [cilium/cilium#46827](https://github.com/cilium/cilium/pull/46827), [cilium/cilium#47274](https://github.com/cilium/cilium/pull/47274), [@​arybolovlev](https://github.com/arybolovlev))
- 👥 **Delegate Gateway Listeners**: ListenerSets let application teams attach and manage their own listeners while the platform team retains ownership of the shared Gateway. ([cilium/cilium#46303](https://github.com/cilium/cilium/pull/46303), [cilium/cilium#46785](https://github.com/cilium/cilium/pull/46785), [@​asauber](https://github.com/asauber))
- 🔏 **Encrypt Traffic to Backends**: Gateway API `BackendTLSPolicy` support lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. ([cilium/cilium#43045](https://github.com/cilium/cilium/pull/43045), [@​youngnick](https://github.com/youngnick))
- 🔀 **TCPRoute and UDPRoute**: Databases, DNS servers, game servers and other non-HTTP services can now be managed through the same Gateway API model as HTTP and gRPC traffic. ([cilium/cilium#46184](https://github.com/cilium/cilium/pull/46184), [cilium/cilium#46970](https://github.com/cilium/cilium/pull/46970), [@​eminaktas](https://github.com/eminaktas); [cilium/cilium#47381](https://github.com/cilium/cilium/pull/47381), [@​arybolovlev](https://github.com/arybolovlev))
- 🔐 **External Authorization**: HTTPRoute requests can now be authenticated and authorized through an external service before they reach the application, using the Gateway API `ExternalAuth` filter from GEP-1494. ([cilium/cilium#45739](https://github.com/cilium/cilium/pull/45739), [@​gauteoh](https://github.com/gauteoh))
- 🎛️ **More HTTP Traffic Controls**: HTTPRoutes gain native CORS support and additional 303, 307 and 308 redirect codes. `CiliumGatewayClassConfig` can also overwrite, append or preserve the HTTP Server response header. ([cilium/cilium#45924](https://github.com/cilium/cilium/pull/45924), [@​arybolovlev](https://github.com/arybolovlev); [cilium/cilium#47232](https://github.com/cilium/cilium/pull/47232), [@​youngnick](https://github.com/youngnick); [cilium/cilium#46764](https://github.com/cilium/cilium/pull/46764), [@​xtineskim](https://github.com/xtineskim))
- ↔️ **Configurable gRPC-Web Translation**: `CiliumGatewayClassConfig` can disable automatic gRPC-web translation for Gateways that need to pass the original traffic through unchanged. Translation remains enabled by default. ([cilium/cilium#45984](https://github.com/cilium/cilium/pull/45984), [@​thorn3r](https://github.com/thorn3r))
- 🚠 **Networking**
- 🔌 **Extensible Datapath**: Datapath plugins let cloud providers extend or instrument Cilium's eBPF datapath with independently versioned programs, without maintaining a Cilium fork. ([cilium/cilium#45028](https://github.com/cilium/cilium/pull/45028), [cilium/cilium#45429](https://github.com/cilium/cilium/pull/45429), [cilium/cilium#45558](https://github.com/cilium/cilium/pull/45558), [cilium/cilium#46673](https://github.com/cilium/cilium/pull/46673), [cilium/cilium#46872](https://github.com/cilium/cilium/pull/46872), [@​jrife](https://github.com/jrife))
- 🚄 **Automatic Netkit Selection**: Set `bpf.datapathMode=auto` to use netkit automatically on supported kernels and fall back to veth on other nodes. The default remains veth. ([cilium/cilium#43062](https://github.com/cilium/cilium/pull/43062), [@​ajmmm](https://github.com/ajmmm))
- 📤 **Egress Gateway Improvements**: Dual-stack clusters can configure an explicit IPv6 egress IP. IPv4 Egress Gateway traffic also strictly honors the interface selected by the policy, matching the existing IPv6 behavior. ([cilium/cilium#44524](https://github.com/cilium/cilium/pull/44524), [@​yykkibbb](https://github.com/yykkibbb); [cilium/cilium#45833](https://github.com/cilium/cilium/pull/45833), [@​julianwiedmann](https://github.com/julianwiedmann))
- 🔍 **Better BGP Tooling and Reconciliation**: New Hive shell commands expose route policies and clearer peer output formats. The control plane moves to GoBGP v4.6.1 and optimizes route-policy reconciliation. ([cilium/cilium#45628](https://github.com/cilium/cilium/pull/45628), [cilium/cilium#45534](https://github.com/cilium/cilium/pull/45534), [@​martonra](https://github.com/martonra); [cilium/cilium#45952](https://github.com/cilium/cilium/pull/45952), [cilium/cilium#46928](https://github.com/cilium/cilium/pull/46928), [@​rastislavs](https://github.com/rastislavs))
- 🌐 **IPAM and IP Selection**
- ☁️ **IPv6 for AWS ENI IPAM (Beta)**: Cilium can now allocate IPv6 prefixes to pods through AWS ENI IPAM, building on the move to the multi-pool allocator. ([cilium/cilium#46756](https://github.com/cilium/cilium/pull/46756), [cilium/cilium#46619](https://github.com/cilium/cilium/pull/46619), [@​41ks](https://github.com/41ks); [cilium/cilium#45154](https://github.com/cilium/cilium/pull/45154), [cilium/cilium#45958](https://github.com/cilium/cilium/pull/45958), [@​HadrienPatte](https://github.com/HadrienPatte))
- 🔄 **Migrate to Multi-Pool IPAM**: Existing clusters can move from cluster-pool IPAM to multi-pool IPAM without being rebuilt. ([cilium/cilium#46104](https://github.com/cilium/cilium/pull/46104), [@​pippolo84](https://github.com/pippolo84))
- 🧭 **Dynamic NodePort Source Addresses**: NodePort can use the kernel FIB to select the preferred source address dynamically before SNATing north-south traffic, on supported kernels. ([cilium/cilium#44625](https://github.com/cilium/cilium/pull/44625), [@​ldelossa](https://github.com/ldelossa))
- 🔵 **Prefer IPv6 Consistently**: The new top-level `preferIpv6` option applies to both Cilium health probes and Hubble peer communication when IPv4 and IPv6 are available. ([cilium/cilium#45447](https://github.com/cilium/cilium/pull/45447), [@​tibrezus](https://github.com/tibrezus))
- 🕸️ **Services and Cluster Mesh**
- 📍 **Topology-Aware Service Traffic**: Cilium's service load balancer now supports the Kubernetes `PreferSameZone` and `PreferSameNode` traffic distribution hints. ([cilium/cilium#44771](https://github.com/cilium/cilium/pull/44771), [@​raphink](https://github.com/raphink))
- ⚖️ **Weighted Maglev Backends**: Maglev now honors the `service.cilium.io/weight` annotation on EndpointSlices. A weight of zero drains new connections while allowing existing connections to continue. ([cilium/cilium#46061](https://github.com/cilium/cilium/pull/46061), [@​mhofstetter](https://github.com/mhofstetter))
- 🌉 **More Load-Balancing Options with VXLAN**: Clusters using VXLAN can use per-Service load-balancing mode annotations, including compatible DSR configurations such as IPIP dispatch. ([cilium/cilium#45600](https://github.com/cilium/cilium/pull/45600), [@​brb](https://github.com/brb))
- 🤖 **Stable MCS API Support**: Cilium's implementation of the Kubernetes Multi-Cluster Services API is now stable and recommended for portable service discovery through ClusterMesh. ([cilium/cilium#45404](https://github.com/cilium/cilium/pull/45404), [cilium/cilium#46953](https://github.com/cilium/cilium/pull/46953), [@​MrFreezeex](https://github.com/MrFreezeex))
- 🔒 **Encryption and Network Policy**
- 🚇 **Improved Ztunnel Identity Management**: The ztunnel path now supports either an internal certificate authority or SPIRE-issued workload identities, alongside new Prometheus metrics for enrollment and connection health. It transparently encrypts enrolled pod-to-pod connections, including traffic between pods on the same node. ([cilium/cilium#43763](https://github.com/cilium/cilium/pull/43763), [cilium/cilium#44275](https://github.com/cilium/cilium/pull/44275), [cilium/cilium#44136](https://github.com/cilium/cilium/pull/44136), [cilium/cilium#45861](https://github.com/cilium/cilium/pull/45861), [@​nddq](https://github.com/nddq); [cilium/cilium#45096](https://github.com/cilium/cilium/pull/45096), [@​gokulMSFT](https://github.com/gokulMSFT))
- 🛡️ **Kubernetes ClusterNetworkPolicy (KCNP)**: Cilium now supports the upstream, cluster-scoped policy API, including Admin and Baseline policy tiers alongside namespaced Kubernetes NetworkPolicy. ([cilium/cilium#42338](https://github.com/cilium/cilium/pull/42338), [@​TheBeeZee](https://github.com/TheBeeZee); [cilium/cilium#46253](https://github.com/cilium/cilium/pull/46253), [@​aanm](https://github.com/aanm))
- ⛔ **Friendlier IPv6 Policy Denials**: Cilium can return ICMPv6 Destination Unreachable responses when network policy denies IPv6 egress traffic, matching the IPv4 capability introduced in Cilium 1.19. ([cilium/cilium#44234](https://github.com/cilium/cilium/pull/44234), [@​Andreagit97](https://github.com/Andreagit97))
- 🌐 **Select the Entire Cluster Mesh**: The new `cluster-mesh` policy entity selects every endpoint across a mesh, making cross-cluster security policies easier to express. ([cilium/cilium#46813](https://github.com/cilium/cilium/pull/46813), [@​squeed](https://github.com/squeed))
- ☁️ **Standardize AWS VPC Group Policies**: Policies that reference AWS VPC groups are now transformed into `CiliumCIDRGroup` resources, bringing external IP groups into the standard Cilium policy model. ([cilium/cilium#44704](https://github.com/cilium/cilium/pull/44704), [@​squeed](https://github.com/squeed))
- 🛂 **Per-Pod Source IP Verification Control**: Trusted workloads that need to send traffic with non-local source addresses can disable source IP verification through a pod annotation, guarded by a namespace-level opt-in. ([cilium/cilium#43505](https://github.com/cilium/cilium/pull/43505), [@​zbb88888](https://github.com/zbb88888))
- ⚙️ **Day 2 Operations and Observability**
- 🔧 **Detect Configuration Drift**: Cilium can expose how many ConfigMap settings an agent has not yet applied, making it easier to identify when a restart is required after a configuration change. ([cilium/cilium#44703](https://github.com/cilium/cilium/pull/44703), [@​PhilipSchmid](https://github.com/PhilipSchmid))
- ⏱️ **Understand Agent Start-Up Time**: New Hive lifecycle and Kubernetes resource-sync metrics show how long individual resources and components take to initialize. ([cilium/cilium#44802](https://github.com/cilium/cilium/pull/44802), [cilium/cilium#44639](https://github.com/cilium/cilium/pull/44639), [@​ILL1A](https://github.com/ILL1A))
- 🛰️ **Correlate More Hubble Verdicts with Policies**: Hubble can now identify the policy responsible for audit verdicts. ([cilium/cilium#45373](https://github.com/cilium/cilium/pull/45373), [@​Rajneesh180](https://github.com/Rajneesh180))
- 📊 **Standalone DNS Proxy Metrics**: The Standalone DNS Proxy now exports DNS metrics back through Cilium, improving visibility when DNS policy processing runs outside the agent. ([cilium/cilium#45222](https://github.com/cilium/cilium/pull/45222), [cilium/cilium#44601](https://github.com/cilium/cilium/pull/44601), [@​vipul-21](https://github.com/vipul-21))
- 🌅 **Performance and Scale**
- 💾 **Aggregated Load-Balancer State**: Cilium's internal backend representation has been flattened to efficiently support thousands of Services that share the same backends. ([cilium/cilium#44511](https://github.com/cilium/cilium/pull/44511), [@​joamaki](https://github.com/joamaki))
- 📡 **More Efficient Envoy Updates**: New ADS and Delta xDS modes provide consistent or incremental delivery of Envoy resources, reducing CPU usage and policy update latency. ([cilium/cilium#43887](https://github.com/cilium/cilium/pull/43887), [@​nezdolik](https://github.com/nezdolik); [cilium/cilium#45288](https://github.com/cilium/cilium/pull/45288), [@​jrajahalme](https://github.com/jrajahalme))
- 🗂️ **Optimized BPF Policy Map Encoding**: Semantic wildcard identities for remote-node and world reduce BPF policy-map pressure, particularly in larger clusters. ([cilium/cilium#46438](https://github.com/cilium/cilium/pull/46438), [@​squeed](https://github.com/squeed))
- 📦 **Smaller CNI Binary**: The `cilium-cni` binary has been reduced from roughly 77 MB to 16 MB, shrinking both the Cilium image and its footprint on every node. ([cilium/cilium#45845](https://github.com/cilium/cilium/pull/45845), [@​giorio94](https://github.com/giorio94))
- 🛠️ **Updated Dependencies and Foundations**: Cilium 1.20 updates to Kubernetes v1.36, Envoy v1.37.x, Gateway API v1.6.1, GoBGP v4.6.1 and MCS API v0.5.2. Runtime and builder images now use Ubuntu 26.04, and the default CNI configuration version moves from 0.3.1 to 1.0.0. ([cilium/cilium#45499](https://github.com/cilium/cilium/pull/45499), [cilium/cilium#47215](https://github.com/cilium/cilium/pull/47215), [@​HadrienPatte](https://github.com/HadrienPatte); [cilium/cilium#45851](https://github.com/cilium/cilium/pull/45851), [@​sayboras](https://github.com/sayboras); [cilium/cilium#47274](https://github.com/cilium/cilium/pull/47274), [@​arybolovlev](https://github.com/arybolovlev); [cilium/cilium#45952](https://github.com/cilium/cilium/pull/45952), [@​rastislavs](https://github.com/rastislavs); [cilium/cilium#47166](https://github.com/cilium/cilium/pull/47166), [@​MrFreezeex](https://github.com/MrFreezeex); [cilium/cilium#46971](https://github.com/cilium/cilium/pull/46971), [@​gandro](https://github.com/gandro))
- 🏠 **Community**
- ❤️ **Production Case Studies**: Many end-users have told their stories running Cilium in production. Read and watch more from: [Asana](https://www.youtube.com/watch?v=mxjiSCnrb3c), [Etraveli](https://www.youtube.com/watch?v=KWS-NaZd62M\&list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ\&index=7), [Michelin](https://www.cncf.io/case-studies/michelin-2/), [OpenAI](https://isovalent.com/blog/post/openai-isovalent-networking-kubernetes-case-study/), [Suse](https://www.youtube.com/watch?v=bgCg1tS72ME\&list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ\&index=8), [Telefónica's acens](https://blogs.cisco.com/sp/telefonicas-acens-and-cisco-driving-the-next-generation-of-cloud-native-services-with-isovalent), and [Zynga](https://www.cncf.io/case-studies/zynga/). If your company wants to submit their case studies let us know. We would love to hear your feedback!
- 🇳🇱 **Amsterdam Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and [Cilium Developer Summit](https://github.com/cilium/dev-summits/tree/main/2026-EU) in Amsterdam. [Watch the talks](https://www.youtube.com/playlist?list=PLDg_GiBbAx-mSQHa1y9Z9sjBYUmG2FBCZ) from CiliumCon.
- 🇺🇸 **Salt Lake City Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developer Summit at KubeCon + CloudNativeCon North America in Salt Lake City, November 9-12.
- 🤖 **Generative AI Policy**: The Cilium community adopted a [Generative AI Policy](https://github.com/cilium/community/blob/main/AI-POLICY.md) that encourages community members to connect and communicate with one another without the use of AI, while recognizing that different people work best with their own tools of choice.
- 📚 **Cilium Books**: Two new books landed for readers at every level — *[Cilium: Up and Running](https://isovalent.com/books/cilium-up-and-running/)* (O'Reilly), a practitioner's deep dive and *[Buzzing Beyond Clouds: The Illustrated Children's Guide to Cilium](https://isovalent.com/books/children-guide-to-cilium/)*, the follow-up to the eBPF children's guide.
❤️ **Thank You**: Cilium 1.20 was made possible by contributors, reviewers and maintainers from across the community, including engineers from Datadog, Google, Microsoft and many other organizations.
To keep up to date with all the latest Cilium releases, join #release 🎉
#### Docker Manifests
##### cilium
`quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93`
`quay.io/cilium/cilium:stable@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93`
##### clustermesh-apiserver
`quay.io/cilium/clustermesh-apiserver:v1.20.0@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92`
`quay.io/cilium/clustermesh-apiserver:stable@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92`
##### hubble-relay
`quay.io/cilium/hubble-relay:v1.20.0@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94`
`quay.io/cilium/hubble-relay:stable@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94`
##### operator-alibabacloud
`quay.io/cilium/operator-alibabacloud:v1.20.0@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9`
`quay.io/cilium/operator-alibabacloud:stable@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9`
##### operator-aws
`quay.io/cilium/operator-aws:v1.20.0@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa`
`quay.io/cilium/operator-aws:stable@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0fa`
##### operator-azure
`quay.io/cilium/operator-azure:v1.20.0@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c`
`quay.io/cilium/operator-azure:stable@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0c`
##### operator-generic
`quay.io/cilium/operator-generic:v1.20.0@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3`
`quay.io/cilium/operator-generic:stable@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3`
##### operator
`quay.io/cilium/operator:v1.20.0@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c`
`quay.io/cilium/operator:stable@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58c`
### [`v1.19.7`](https://github.com/cilium/cilium/releases/tag/v1.19.7): 1.19.7
[Compare Source](https://github.com/cilium/cilium/compare/1.19.6...1.19.7)
## Summary of Changes
**Bugfixes:**
- envoy: restore http-idle-timeout as the route idle timeout source (Backport PR [#​47688](https://github.com/cilium/cilium/issues/47688), Upstream PR [#​47583](https://github.com/cilium/cilium/issues/47583), [@​aanm](https://github.com/aanm))
- Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR [#​47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#​47765](https://github.com/cilium/cilium/issues/47765), [@​julianwiedmann](https://github.com/julianwiedmann))
- Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR [#​47545](https://github.com/cilium/cilium/issues/47545), Upstream PR [#​47295](https://github.com/cilium/cilium/issues/47295), [@​aanm](https://github.com/aanm))
- Fix abnormal ip allocation caused by hostnetwork pod (Backport PR [#​47688](https://github.com/cilium/cilium/issues/47688), Upstream PR [#​47552](https://github.com/cilium/cilium/issues/47552), [@​haozhangami](https://github.com/haozhangami))
- Fix BPF LB map key collision where HostPort/NodePort expansion could overwrite a LoadBalancer frontend when the node IP matches the LoadBalancer external IP (e.g. k3s/RKE2 L2 ServiceLB). Also fix a \~30-minute NodePort outage that occurred after deleting a LoadBalancer whose external IP was a node address with a port in the NodePort range. (Backport PR [#​47414](https://github.com/cilium/cilium/issues/47414), Upstream PR [#​45314](https://github.com/cilium/cilium/issues/45314), [@​syedazeez337](https://github.com/syedazeez337))
- Fix bug causing Cilium to intercept traffic towards LoadBalancer VIPs when KPR is disabled, when the traffic should be delegated to kube-proxy. (Backport PR [#​47414](https://github.com/cilium/cilium/issues/47414), Upstream PR [#​47204](https://github.com/cilium/cilium/issues/47204), [@​ajmmm](https://github.com/ajmmm))
- Fix redirection of egressing traffic that falls in scope of a CiliumEgressGatewayPolicy, when the initial interface is a L3 interface. (Backport PR [#​47757](https://github.com/cilium/cilium/issues/47757), Upstream PR [#​45703](https://github.com/cilium/cilium/issues/45703), [@​julianwiedmann](https://github.com/julianwiedmann))
- Fix: Cilium Ingress now automatically reallocates ports and retries when cilium-envoy fails to bind due to port conflicts (Backport PR [#​47410](https://github.com/cilium/cilium/issues/47410), Upstream PR [#​42859](https://github.com/cilium/cilium/issues/42859), [@​inerplat](https://github.com/inerplat))
- Fixes an issue where invalid regex on an HTTPRoute or GRPCRoute matcher is accepted but causes Envoy to NACK (Backport PR [#​47468](https://github.com/cilium/cilium/issues/47468), Upstream PR [#​47005](https://github.com/cilium/cilium/issues/47005), [@​0xch4z](https://github.com/0xch4z))
- fqdn/service: prune SDP identity->IP mapping on delete using newID (Backport PR [#​47545](https://github.com/cilium/cilium/issues/47545), Upstream PR [#​47100](https://github.com/cilium/cilium/issues/47100), [@​vipul-21](https://github.com/vipul-21))
- gateway-api: GAMMA Routes are now filtered correctly before being passed to model ingestion. (Backport PR [#​47468](https://github.com/cilium/cilium/issues/47468), Upstream PR [#​45294](https://github.com/cilium/cilium/issues/45294), [@​youngnick](https://github.com/youngnick))
- ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR [#​47886](https://github.com/cilium/cilium/issues/47886), Upstream PR [#​47208](https://github.com/cilium/cilium/issues/47208), [@​iwanhae](https://github.com/iwanhae))
- lbipam: prevent reassigning Service LoadBalancer IPs on operator restart when the existing IP belongs to a compatible sharing key group. (Backport PR [#​46559](https://github.com/cilium/cilium/issues/46559), Upstream PR [#​46262](https://github.com/cilium/cilium/issues/46262), [@​ieth0](https://github.com/ieth0))
- Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR [#​47886](https://github.com/cilium/cilium/issues/47886), Upstream PR [#​47844](https://github.com/cilium/cilium/issues/47844), [@​bimmlerd](https://github.com/bimmlerd))
- wireguard: Unsubscribe node handler on shutdown (Backport PR [#​47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#​47614](https://github.com/cilium/cilium/issues/47614), [@​HadrienPatte](https://github.com/HadrienPatte))
**CI Changes:**
- .github: fail smoke IPv6 closed when the test job does not succeed (Backport PR [#​47545](https://github.com/cilium/cilium/issues/47545), Upstream PR [#​47441](https://github.com/cilium/cilium/issues/47441), [@​aanm](https://github.com/aanm))
- .github: retry CLI and binary downloads over transient network errors (Backport PR [#​47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#​47167](https://github.com/cilium/cilium/issues/47167), [@​aanm](https://github.com/aanm))
- .github: Run envoy image check against PR content (Backport PR [#​47886](https://github.com/cilium/cilium/issues/47886), Upstream PR [#​47792](https://github.com/cilium/cilium/issues/47792), [@​joestringer](https://github.com/joestringer))
- .github: Simplify permissions for image linter workflow (Backport PR [#​47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#​47753](https://github.com/cilium/cilium/issues/47753), [@​joestringer](https://github.com/joestringer))
- .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR [#​47688](https://github.com/cilium/cilium/issues/47688), Upstream PR [#​47470](https://github.com/cilium/cilium/issues/47470), [@​atykhyy](https://github.com/atykhyy))
- \[v1.19] ariane: remove reference to the non-existing lint-ariane-config workflow ([#​47701](https://github.com/cilium/cilium/issues/47701), [@​giorio94](https://github.com/giorio94))
- ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR [#​47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#​47743](https://github.com/cilium/cilium/issues/47743), [@​giorio94](https://github.com/giorio94))
- bpf/tests: support pkt sizes 1036-1518 bytes (Backport PR [#​47443](https://github.com/cilium/cilium/issues/47443), Upstream PR [#​44314](https://github.com/cilium/cilium/issues/44314), [@​msune](https://github.com/msune))
- chore: use GH\_RUNNER\_CILIUM\_BASE\_AMD64/ARM64 vars for integration-test runners (Backport PR [#​47545](https://github.com/cilium/cilium/issues/47545), Upstream PR [#​47182](https://github.com/cilium/cilium/issues/47182), [@​bogdankrasko](https://github.com/bogdankrasko))
- ci: build race images on push events so conformance-race works on stable branches (Backport PR [#​47610](https://github.com/cilium/cilium/issues/47610), Upstream PR [#​47608](https://github.com/cilium/cilium/issues/47608), [@​aanm](https://github.com/aanm))
- ci: build race images on push in the stable image builders (Backport PR [#​47610](https://github.com/cilium/cilium/issues/47610), Upstream PR [#​47616](https://github.com/cilium/cilium/issues/47616), [@​aanm](https://github.com/aanm))
- ci: draft renovate PRs until ciliumbot auto-approval (Backport PR [#​47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#​47364](https://github.com/cilium/cilium/issues/47364), [@​mhofstetter](https://github.com/mhofstetter))
- ci: fix filtering out md files in bpf checks (Backport PR [#​47688](https://github.com/cilium/cilium/issues/47688), Upstream PR [#​47605](https://github.com/cilium/cilium/issues/47605), [@​nebril](https://github.com/nebril))
- ci: fix three renovate-PR CI flakes (kubectl download retry, merge-upload ref, EKS pool zones) (Backport PR [#​47541](https://github.com/cilium/cilium/issues/47541), Upstream PR [#​47357](https://github.com/cilium/cilium/issues/47357), [@​aanm](https://github.com/aanm))
- CI: fixed external-target readiness gating and ensured sig-network E2E JUnit reports are uploaded on failure. (Backport PR [#​47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#​46860](https://github.com/cilium/cilium/issues/46860), [@​aanm](https://github.com/aanm))
- ci: migrate set-commit-status to cilium/actions (Backport PR [#​47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#​47771](https://github.com/cilium/cilium/issues/47771), [@​bogdankrasko](https://github.com/bogdankrasko))
- ci: skip etcd log fetch when kvstore was never started (Backport PR [#​47886](https://github.com/cilium/cilium/issues/47886), Upstream PR [#​47801](https://github.com/cilium/cilium/issues/47801), [@​aanm](https://github.com/aanm))
- Collect /proc/net/softnet\_stat, /proc/net/snmp and /proc/net/netstat in sysdumps to help diagnose host-level packet drops. (Backport PR [#​47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#​46985](https://github.com/cilium/cilium/issues/46985), [@​aanm](https://github.com/aanm))
- complexity-diff: Compute percentages of diffs against original values (Backport PR [#​47836](https://github.com/cilium/cilium/issues/47836), Upstream PR [#​45657](https://github.com/cilium/cilium/issues/45657), [@​pchaigno](https://github.com/pchaigno))
- complexity-diff: Display results on scheduled runs (Backport PR [#​47721](https://github.com/cilium/cilium/issues/47721), Upstream PR [#​45595](https://github.com/cilium/cilium/issues/45595), [@​pchaigno](https://github.com/pchaigno))
- conformance-aws-cni: skip l7 and fqdn tests by name on chaining mode (Backport PR [#​47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#​47269](https://github.com/cilium/cilium/issues/47269), [@​aanm](https://github.com/aanm))
- datapath/loader: Fix stack depth parsing for programs with functions (Backport PR [#​47814](https://github.com/cilium/cilium/issues/47814), Upstream PR [#​44963](https://github.com/cilium/cilium/issues/44963), [@​dylandreimerink](https://github.com/dylandreimerink))
- Decrease CI costs on AWS (Backport PR [#​47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#​46615](https://github.com/cilium/cilium/issues/46615), [@​aanm](https://github.com/aanm))
- Fix stack depth reporting in verifier test (Backport PR [#​47836](https://github.com/cilium/cilium/issues/47836), Upstream PR [#​46182](https://github.com/cilium/cilium/issues/46182), [@​pchaigno](https://github.com/pchaigno))
- gateway-api: fix gatewayclassconfig-nodeport test (Backport PR [#​47468](https://github.com/cilium/cilium/issues/47468), Upstream PR [#​47255](https://github.com/cilium/cilium/issues/47255), [@​0xch4z](https://github.com/0xch4z))
- gha/e2e: cover etcd behind a service (Backport PR [#​47410](https://github.com/cilium/cilium/issues/47410), Upstream PR [#​47235](https://github.com/cilium/cilium/issues/47235), [@​giorio94](https://github.com/giorio94))
- gha/kubespray: run on schedule, rather than on every push (Backport PR [#​47734](https://github.com/cilium/cilium/issues/47734), Upstream PR [#​47719](https://github.com/cilium/cilium/issues/47719), [@​giorio94](https://github.com/giorio94))
- gha/lvh-kind: respect Kind image version also when config is provided (Backport PR [#​47734](https://github.com/cilium/cilium/issues/47734), Upstream PR [#​47703](https://github.com/cilium/cilium/issues/47703), [@​giorio94](https://github.com/giorio94))
- gha: don't install LLVM and Clang in integration tests workflow (Backport PR [#​47734](https://github.com/cilium/cilium/issues/47734), Upstream PR [#​47717](https://github.com/cilium/cilium/issues/47717), [@​giorio94](https://github.com/giorio94))
- gha: dump nodegroup CloudFormation failure events on create failure (Backport PR [#​47410](https://github.com/cilium/cilium/issues/47410), Upstream PR [#​47298](https://github.com/cilium/cilium/issues/47298), [@​aanm](https://github.com/aanm))
- gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR [#​47734](https://github.com/cilium/cilium/issues/47734), Upstream PR [#​47724](https://github.com/cilium/cilium/issues/47724), [@​giorio94](https://github.com/giorio94))
- gha: stop scheduled runs emitting spurious artifact warnings (Backport PR [#​47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#​46989](https://github.com/cilium/cilium/issues/46989), [@​aanm](https://github.com/aanm))
- images/scripts: Validate Envoy image vars against sed injection (Backport PR [#​47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#​47205](https://github.com/cilium/cilium/issues/47205), [@​MasloMaslane](https://github.com/MasloMaslane))
- Increase the timeout for the kvstore readiness wait in kind-based CI to avoid flakes on slow etcd image pulls. (Backport PR [#​47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#​46882](https://github.com/cilium/cilium/issues/46882), [@​aanm](https://github.com/aanm))
- loader: Reduce number of permutations for load-time configs (Backport PR [#​47721](https://github.com/cilium/cilium/issues/47721), Upstream PR [#​44409](https://github.com/cilium/cilium/issues/44409), [@​pchaigno](https://github.com/pchaigno))
- loader: Support max stack depth in verifier logs (Backport PR [#​47836](https://github.com/cilium/cilium/issues/47836), Upstream PR [#​46109](https://github.com/cilium/cilium/issues/46109), [@​pchaigno](https://github.com/pchaigno))
- loader: Support newer verifier logs (Backport PR [#​47836](https://github.com/cilium/cilium/issues/47836), Upstream PR [#​45880](https://github.com/cilium/cilium/issues/45880), [@​pchaigno](https://github.com/pchaigno))
- pkg/loadbalancer: fix loadbalancer nodeport collision test (Backport PR [#​47414](https://github.com/cilium/cilium/issues/47414), Upstream PR [#​46087](https://github.com/cilium/cilium/issues/46087), [@​ajmmm](https://github.com/ajmmm))
- pkg/rate: fix TestMaxParallelRequests flake under CI load (Backport PR [#​47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#​46856](https://github.com/cilium/cilium/issues/46856), [@​aanm](https://github.com/aanm))
- Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR [#​47886](https://github.com/cilium/cilium/issues/47886), Upstream PR [#​47780](https://github.com/cilium/cilium/issues/47780), [@​giorio94](https://github.com/giorio94))
- test/cyclonus: capture logs of every job pod so a runner crash is diagnosable (Backport PR [#​47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#​46980](https://github.com/cilium/cilium/issues/46980), [@​aanm](https://github.com/aanm))
- test/cyclonus: drop --fail-fast so a policy failure can't crash the run (Backport PR [#​47410](https://github.com/cilium/cilium/issues/47410), Upstream PR [#​47272](https://github.com/cilium/cilium/issues/47272), [@​aanm](https://github.com/aanm))
- test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR [#​47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#​47725](https://github.com/cilium/cilium/issues/47725), [@​aanm](https://github.com/aanm))
- workflows/verifier: Fail on high complexity, stack depth or map count (Backport PR [#​47721](https://github.com/cilium/cilium/issues/47721), Upstream PR [#​45659](https://github.com/cilium/cilium/issues/45659), [@​pchaigno](https://github.com/pchaigno))
- workflows/verifier: Fix again always-passing workflow status (Backport PR [#​47721](https://github.com/cilium/cilium/issues/47721), Upstream PR [#​45899](https://github.com/cilium/cilium/issues/45899), [@​pchaigno](https://github.com/pchaigno))
- workflows/verifier: Fix always-passing workflow status (Backport PR [#​47721](https://github.com/cilium/cilium/issues/47721), Upstream PR [#​45835](https://github.com/cilium/cilium/issues/45835), [@​pchaigno](https://github.com/pchaigno))
- workflows/verifier: Fix commit status (Backport PR [#​47721](https://github.com/cilium/cilium/issues/47721), Upstream PR [#​46382](https://github.com/cilium/cilium/issues/46382), [@​pchaigno](https://github.com/pchaigno))
- workflows/verifier: Wait for `complexity-diff` to set workflow status (Backport PR [#​47721](https://github.com/cilium/cilium/issues/47721), Upstream PR [#​45681](https://github.com/cilium/cilium/issues/45681), [@​pchaigno](https://github.com/pchaigno))
**Misc Changes:**
- allocator: fix flake in TestWatchRemoteKVStore (Backport PR [#​47688](https://github.com/cilium/cilium/issues/47688), Upstream PR [#​47455](https://github.com/cilium/cilium/issues/47455), [@​giorio94](https://github.com/giorio94))
- bpf, testing: define scapy buffers as canonical C variables. (Backport PR [#​47443](https://github.com/cilium/cilium/issues/47443), Upstream PR [#​44893](https://github.com/cilium/cilium/issues/44893), [@​ldelossa](https://github.com/ldelossa))
- bpf/analyze: Always visit global functions (Backport PR [#​47804](https://github.com/cilium/cilium/issues/47804), Upstream PR [#​45917](https://github.com/cilium/cilium/issues/45917), [@​pchaigno](https://github.com/pchaigno))
- bpf/lxc: Never allocate `ct_buffers` on stack (Backport PR [#​47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#​45603](https://github.com/cilium/cilium/issues/45603), [@​pchaigno](https://github.com/pchaigno))
- bpf/nat: Move IPv6 nat entry to map (Backport PR [#​47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#​47762](https://github.com/cilium/cilium/issues/47762), [@​pchaigno](https://github.com/pchaigno))
- bpf: conntrack: Reduce stack usage of `ct_create{4,6}` (Backport PR [#​47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#​47582](https://github.com/cilium/cilium/issues/47582), [@​dylandreimerink](https://github.com/dylandreimerink))
- bpf: encap: move & use DSR-GENEVE helpers (Backport PR [#​47460](https://github.com/cilium/cilium/issues/47460), Upstream PR [#​45526](https://github.com/cilium/cilium/issues/45526), [@​julianwiedmann](https://github.com/julianwiedmann))
- bpf: Make `ipv6_hdrlen_with_fraginfo` function global (Backport PR [#​47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#​46295](https://github.com/cilium/cilium/issues/46295), [@​pchaigno](https://github.com/pchaigno))
- bpf: Never allocate `ct_buffers` on the stack (Backport PR [#​47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#​45589](https://github.com/cilium/cilium/issues/45589), [@​pchaigno](https://github.com/pchaigno))
- bpf: Reduce stack size for `tail_handle_snat_fwd_ipv6` (Backport PR [#​47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#​46360](https://github.com/cilium/cilium/issues/46360), [@​pchaigno](https://github.com/pchaigno))
- bpf: rename `aux.h` to avoid malformed file path error upon `go get` (Backport PR [#​47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#​45804](https://github.com/cilium/cilium/issues/45804), [@​tklauser](https://github.com/tklauser))
- bugtool: collect snmp6 and dev\_snmp6 for IPv6 host packet drops (Backport PR [#​47410](https://github.com/cilium/cilium/issues/47410), Upstream PR [#​47353](https://github.com/cilium/cilium/issues/47353), [@​aanm](https://github.com/aanm))
- chore(deps): update all github action dependencies (v1.19) ([#​47324](https://github.com/cilium/cilium/issues/47324), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update all github action dependencies (v1.19) ([#​47490](https://github.com/cilium/cilium/issues/47490), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update all github action dependencies (v1.19) ([#​47867](https://github.com/cilium/cilium/issues/47867), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update all github action dependencies (v1.19) ([#​47993](https://github.com/cilium/cilium/issues/47993), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update all github action dependencies (v1.19) ([#​48009](https://github.com/cilium/cilium/issues/48009), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update all-dependencies (v1.19) ([#​47679](https://github.com/cilium/cilium/issues/47679), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update base-images (v1.19) ([#​47489](https://github.com/cilium/cilium/issues/47489), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update base-images (v1.19) ([#​47950](https://github.com/cilium/cilium/issues/47950), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update dependency cilium/cilium-cli to v0.19.6 (v1.19) ([#​47340](https://github.com/cilium/cilium/issues/47340), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.19) ([#​47577](https://github.com/cilium/cilium/issues/47577), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update docker.io/library/golang:1.25.12 docker digest to [`d2e20dc`](https://github.com/cilium/cilium/commit/d2e20dc) (v1.19) ([#​47321](https://github.com/cilium/cilium/issues/47321), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update docker.io/library/golang:1.25.12 docker digest to [`fe5d57d`](https://github.com/cilium/cilium/commit/fe5d57d) (v1.19) ([#​47866](https://github.com/cilium/cilium/issues/47866), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update gcr.io/distroless/static:nonroot docker digest to [`f7f8f72`](https://github.com/cilium/cilium/commit/f7f8f72) (v1.19) ([#​47322](https://github.com/cilium/cilium/issues/47322), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update github/codeql-action action to v4.37.2 (v1.19) ([#​47504](https://github.com/cilium/cilium/issues/47504), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update google/cloud-sdk docker tag to v577 (v1.19) ([#​47511](https://github.com/cilium/cilium/issues/47511), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260716143926-092fe0c72997 (v1.19) ([#​47487](https://github.com/cilium/cilium/issues/47487), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update quay.io/cilium/certgen docker tag to v0.4.8 (v1.19) ([#​47323](https://github.com/cilium/cilium/issues/47323), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1784803288-cf56df1cccc09d7afde2847ff9e6e853dde50b77 (v1.19) ([#​47488](https://github.com/cilium/cilium/issues/47488), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1786864149-07e8503ff34b9190d7bbe4e57d4e185c4ef8b1de (v1.19) ([#​48000](https://github.com/cilium/cilium/issues/48000), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update stable lvh-images (v1.19) (patch) ([#​46316](https://github.com/cilium/cilium/issues/46316), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update stable lvh-images (v1.19) (patch) ([#​47868](https://github.com/cilium/cilium/issues/47868), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- chore(deps): update stable lvh-images (v1.19) (patch) ([#​47992](https://github.com/cilium/cilium/issues/47992), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- docs/clustermesh: remove obsolete reference to service cache (Backport PR [#​47410](https://github.com/cilium/cilium/issues/47410), Upstream PR [#​47195](https://github.com/cilium/cilium/issues/47195), [@​giorio94](https://github.com/giorio94))
- docs: add context on recommended CEC and CCEC permissions (Backport PR [#​47545](https://github.com/cilium/cilium/issues/47545), Upstream PR [#​45056](https://github.com/cilium/cilium/issues/45056), [@​ferozsalam](https://github.com/ferozsalam))
- docs: Fix DOCS\_BUILDER\_REPO env variable for BSD sed compatibility (Backport PR [#​47829](https://github.com/cilium/cilium/issues/47829), Upstream PR [#​46033](https://github.com/cilium/cilium/issues/46033), [@​arybolovlev](https://github.com/arybolovlev))
- docs: Update docs-builder for Makefile usage (Backport PR [#​47829](https://github.com/cilium/cilium/issues/47829), Upstream PR [#​45774](https://github.com/cilium/cilium/issues/45774), [@​joestringer](https://github.com/joestringer))
- fix(deps): update k8s.io patch updates stable to v0.35.7 (v1.19) ([#​47521](https://github.com/cilium/cilium/issues/47521), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- fix(deps): update module k8s.io/apimachinery to v0.35.7 (v1.19) ([#​47474](https://github.com/cilium/cilium/issues/47474), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- Fixed the conformance-ginkgo feature status report not being uploaded as an artifact. (Backport PR [#​47541](https://github.com/cilium/cilium/issues/47541), Upstream PR [#​47174](https://github.com/cilium/cilium/issues/47174), [@​aanm](https://github.com/aanm))
- gateway-api: remove SetAllParentCondition route helpers (Backport PR [#​47468](https://github.com/cilium/cilium/issues/47468), Upstream PR [#​47086](https://github.com/cilium/cilium/issues/47086), [@​0xch4z](https://github.com/0xch4z))
- gha: capture per-pod diagnostics for sig-network conntrack UDP NodePort failures (Backport PR [#​47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#​47140](https://github.com/cilium/cilium/issues/47140), [@​aanm](https://github.com/aanm))
- gha: let auto-approve match on re-runs (Backport PR [#​47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#​46832](https://github.com/cilium/cilium/issues/46832), [@​aanm](https://github.com/aanm))
- images ci: free preinstalled toolchains on tight runners before building (Backport PR [#​47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#​47141](https://github.com/cilium/cilium/issues/47141), [@​aanm](https://github.com/aanm))
- Introduce BPF auxiliary variables (Backport PR [#​47723](https://github.com/cilium/cilium/issues/47723), Upstream PR [#​45081](https://github.com/cilium/cilium/issues/45081), [@​dylandreimerink](https://github.com/dylandreimerink))
- policy/k8s: record processing start time for k8s NetworkPolicy updates (Backport PR [#​47290](https://github.com/cilium/cilium/issues/47290), Upstream PR [#​46979](https://github.com/cilium/cilium/issues/46979), [@​aanm](https://github.com/aanm))
- Update all github action dependencies (v1.19) ([#​47661](https://github.com/cilium/cilium/issues/47661), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- Update all github action dependencies (v1.19) ([#​47676](https://github.com/cilium/cilium/issues/47676), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- Update docker.io/library/busybox:1.37.0 Docker digest to [`9db7b59`](https://github.com/cilium/cilium/commit/9db7b59) (v1.19) ([#​47660](https://github.com/cilium/cilium/issues/47660), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- Update documentation dependencies (Backport PR [#​47829](https://github.com/cilium/cilium/issues/47829), Upstream PR [#​47750](https://github.com/cilium/cilium/issues/47750), [@​joestringer](https://github.com/joestringer))
- Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.19) ([#​47662](https://github.com/cilium/cilium/issues/47662), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
- Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.19) ([#​47663](https://github.com/cilium/cilium/issues/47663), [@​cilium-renovate](https://github.com/cilium-renovate)\[bot])
**Other Changes:**
- \[v1.19] Add DNS request checking prior to qname extraction ([#​47383](https://github.com/cilium/cilium/issues/47383), [@​ferozsalam](https://github.com/ferozsalam))
- install: Update image digests for v1.19.6 ([#​47252](https://github.com/cilium/cilium/issues/47252), [@​cilium-release-bot](https://github.com/cilium-release-bot)\[bot])
#### Docker Manifests
##### cilium
`quay.io/cilium/cilium:v1.19.7@sha256:1b58bcb81c723cf130a0dd2fb2e1132c57f8fbc2ef7bdb85519cfcc36111c77e`
##### clustermesh-apiserver
`quay.io/cilium/clustermesh-apiserver:v1.19.7@sha256:17186e4639900fcaa7c38260bb8ac622ee56b3b805e2452f24b824e84db9e5e6`
##### docker-plugin
`quay.io/cilium/docker-plugin:v1.19.7@sha256:1b29323ca48d785946a16c312c983d41bb058e6ebd1e3172f45b25051c1254e7`
##### hubble-relay
`quay.io/cilium/hubble-relay:v1.19.7@sha256:db4b384d0f6aba261e809d58bee54885c70a7e958173a125ebb215391af55e74`
##### operator-alibabacloud
`quay.io/cilium/operator-alibabacloud:v1.19.7@sha256:22f36b3bf2ec9ae0bdd2ca943f7a18b8a36704dce6959d2ac0eef6527ec3b400`
##### operator-aws
`quay.io/cilium/operator-aws:v1.19.7@sha256:7218d710e1b3dbc2039cb3bcf285d3cdd7a89ca482f8be0c868362d14824dd3e`
##### operator-azure
`quay.io/cilium/operator-azure:v1.19.7@sha256:572f7f69b470fda8ce068a5acb0961b29b8754bb35f95f27f7f2d838b08c3971`
##### operator-generic
`quay.io/cilium/operator-generic:v1.19.7@sha256:61e773bfc25a448f1ad3ead605af94b3ef176ba2925cf4bd1b11e09794b72bed`
##### operator
`quay.io/cilium/operator:v1.19.7@sha256:283dddce1845b4375e4a733494ae742acd85fef4d4b1b303338b21898a6e386e`
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODguMCIsInVwZGF0ZWRJblZlciI6IjQ0LjMzLjIiLCJ0YXJnZXRCcmFuY2giOiJmcmVzaC1zdGFydCIsImxhYmVscyI6W119-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
1.19.6→1.20.1Release Notes
cilium/cilium (cilium)
v1.20.1: 1.20.1Compare Source
Summary of Changes
Major Changes:
Minor Changes:
Bugfixes:
0as a chart value and templates into configmap. (Backport PR #47885, Upstream PR #47741, @jdw6359)NotAllowedByListenerswhen the TCP listener had an explicitAllowedRoutes.Kindsrestriction. (Backport PR #47690, Upstream PR #46842, @pidreher)CI Changes:
events_map_rate_limitcomplexity coverage (Backport PR #47805, Upstream PR #47691, @pchaigno)Misc Changes:
ct_create{4,6}(Backport PR #47805, Upstream PR #47582, @dylandreimerink)705e964(v1.20) (#47949, @cilium-renovate[bot])7caba52(v1.20) (#47864, @cilium-renovate[bot])reflect.DeepEqualwithassert.Equalin tests (Backport PR #47690, Upstream PR #47424, @HadrienPatte)dc2d74b(v1.20) (#47655, @cilium-renovate[bot])Other Changes:
Docker Manifests
cilium
quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11bquay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11bclustermesh-apiserver
quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5hubble-relay
quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4operator-alibabacloud
quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4cquay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4coperator-aws
quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7operator-azure
quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031operator-generic
quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecfquay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecfoperator
quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861dquay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861dv1.20.0: 1.20.0Compare Source
🎉 Release Announcement 🎉: We are excited to announce the Cilium 1.20.0 release!
More than 2,660 new commits have landed in this release, supported by a community of over 1,100 contributors and more than 24,800 GitHub stars! 🤩
⚠️ You may need to take action during the upgrade if you use legacy Mutual Authentication, Envoy Go extensions or Kafka-aware policies, the
cilium.io/v2alpha1CiliumNodeConfigAPI, the libnetwork integration, or a custom CNI configuration. See the Upgrade Guide for details.The full changelog can be found here.
Here are some of the highlights:
⛩️ Gateway API
BackendTLSPolicysupport lets operators configure TLS and backend certificate validation for traffic between the gateway and application services. (cilium/cilium#43045, @youngnick)ExternalAuthfilter from GEP-1494. (cilium/cilium#45739, @gauteoh)CiliumGatewayClassConfigcan also overwrite, append or preserve the HTTP Server response header. (cilium/cilium#45924, @arybolovlev; cilium/cilium#47232, @youngnick; cilium/cilium#46764, @xtineskim)CiliumGatewayClassConfigcan disable automatic gRPC-web translation for Gateways that need to pass the original traffic through unchanged. Translation remains enabled by default. (cilium/cilium#45984, @thorn3r)🚠 Networking
bpf.datapathMode=autoto use netkit automatically on supported kernels and fall back to veth on other nodes. The default remains veth. (cilium/cilium#43062, @ajmmm)🌐 IPAM and IP Selection
preferIpv6option applies to both Cilium health probes and Hubble peer communication when IPv4 and IPv6 are available. (cilium/cilium#45447, @tibrezus)🕸️ Services and Cluster Mesh
PreferSameZoneandPreferSameNodetraffic distribution hints. (cilium/cilium#44771, @raphink)service.cilium.io/weightannotation on EndpointSlices. A weight of zero drains new connections while allowing existing connections to continue. (cilium/cilium#46061, @mhofstetter)🔒 Encryption and Network Policy
cluster-meshpolicy entity selects every endpoint across a mesh, making cross-cluster security policies easier to express. (cilium/cilium#46813, @squeed)CiliumCIDRGroupresources, bringing external IP groups into the standard Cilium policy model. (cilium/cilium#44704, @squeed)⚙️ Day 2 Operations and Observability
🌅 Performance and Scale
cilium-cnibinary has been reduced from roughly 77 MB to 16 MB, shrinking both the Cilium image and its footprint on every node. (cilium/cilium#45845, @giorio94)🏠 Community
❤️ Thank You: Cilium 1.20 was made possible by contributors, reviewers and maintainers from across the community, including engineers from Datadog, Google, Microsoft and many other organizations.
To keep up to date with all the latest Cilium releases, join #release 🎉
Docker Manifests
cilium
quay.io/cilium/cilium:v1.20.0@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93quay.io/cilium/cilium:stable@sha256:383968cd5e8873f7976fa76aa6196045643558f4cc9518a207b9335cb24a0e93clustermesh-apiserver
quay.io/cilium/clustermesh-apiserver:v1.20.0@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92quay.io/cilium/clustermesh-apiserver:stable@sha256:c791d0c334d4515d40041b2660d50a1b94b0179ef1d3c120bd350aebc9115e92hubble-relay
quay.io/cilium/hubble-relay:v1.20.0@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94quay.io/cilium/hubble-relay:stable@sha256:2ca16981c7eb98df0ba9c9d18896bb9ca628b5cbd40dc9801339f4741f91ee94operator-alibabacloud
quay.io/cilium/operator-alibabacloud:v1.20.0@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9quay.io/cilium/operator-alibabacloud:stable@sha256:52535dba067abf5b1cce2a666ee3f9430a1682ade3bf11db5f118436e84ad2e9operator-aws
quay.io/cilium/operator-aws:v1.20.0@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0faquay.io/cilium/operator-aws:stable@sha256:a0e50fa611fa3e2e8b1c9521a3e813576034a0b3d626e9c128ac01f8f7dfd0faoperator-azure
quay.io/cilium/operator-azure:v1.20.0@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0cquay.io/cilium/operator-azure:stable@sha256:4506f8d0c9f2dd187313f71b37a789986c1c1699f59c52973941df9eb5ccae0coperator-generic
quay.io/cilium/operator-generic:v1.20.0@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3quay.io/cilium/operator-generic:stable@sha256:80744a8cc7c91c2f9e6347629406844eb35d79b30a732c6d41c15b17232a74f3operator
quay.io/cilium/operator:v1.20.0@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58cquay.io/cilium/operator:stable@sha256:5dc67f7a0f1ad0f51813563366885cd8d4ee255cc49a65be5cf45d5e9810d58cv1.19.7: 1.19.7Compare Source
Summary of Changes
Bugfixes:
CI Changes:
complexity-diffto set workflow status (Backport PR #47721, Upstream PR #45681, @pchaigno)Misc Changes:
ct_bufferson stack (Backport PR #47723, Upstream PR #45603, @pchaigno)ct_create{4,6}(Backport PR #47723, Upstream PR #47582, @dylandreimerink)ipv6_hdrlen_with_fraginfofunction global (Backport PR #47723, Upstream PR #46295, @pchaigno)ct_bufferson the stack (Backport PR #47723, Upstream PR #45589, @pchaigno)tail_handle_snat_fwd_ipv6(Backport PR #47723, Upstream PR #46360, @pchaigno)aux.hto avoid malformed file path error upongo get(Backport PR #47723, Upstream PR #45804, @tklauser)d2e20dc(v1.19) (#47321, @cilium-renovate[bot])fe5d57d(v1.19) (#47866, @cilium-renovate[bot])f7f8f72(v1.19) (#47322, @cilium-renovate[bot])9db7b59(v1.19) (#47660, @cilium-renovate[bot])Other Changes:
Docker Manifests
cilium
quay.io/cilium/cilium:v1.19.7@sha256:1b58bcb81c723cf130a0dd2fb2e1132c57f8fbc2ef7bdb85519cfcc36111c77eclustermesh-apiserver
quay.io/cilium/clustermesh-apiserver:v1.19.7@sha256:17186e4639900fcaa7c38260bb8ac622ee56b3b805e2452f24b824e84db9e5e6docker-plugin
quay.io/cilium/docker-plugin:v1.19.7@sha256:1b29323ca48d785946a16c312c983d41bb058e6ebd1e3172f45b25051c1254e7hubble-relay
quay.io/cilium/hubble-relay:v1.19.7@sha256:db4b384d0f6aba261e809d58bee54885c70a7e958173a125ebb215391af55e74operator-alibabacloud
quay.io/cilium/operator-alibabacloud:v1.19.7@sha256:22f36b3bf2ec9ae0bdd2ca943f7a18b8a36704dce6959d2ac0eef6527ec3b400operator-aws
quay.io/cilium/operator-aws:v1.19.7@sha256:7218d710e1b3dbc2039cb3bcf285d3cdd7a89ca482f8be0c868362d14824dd3eoperator-azure
quay.io/cilium/operator-azure:v1.19.7@sha256:572f7f69b470fda8ce068a5acb0961b29b8754bb35f95f27f7f2d838b08c3971operator-generic
quay.io/cilium/operator-generic:v1.19.7@sha256:61e773bfc25a448f1ad3ead605af94b3ef176ba2925cf4bd1b11e09794b72bedoperator
quay.io/cilium/operator:v1.19.7@sha256:283dddce1845b4375e4a733494ae742acd85fef4d4b1b303338b21898a6e386eConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
43add6498fto29d9cfbcbfUpdate Helm release cilium to v1.20.0to Update Helm release cilium to v1.20.1