wireguard:mtu: fix mtu calculation with potential padding (Backport PR #46170, Upstream PR #45940, @smagnani96)
Bugfixes:
Always add cluster label to node when nodeSelectorLabels is enabled to fix CiliumNetworkPolicy with fromNodes/toNodes with policy-default-local-cluster enabled (enabled by default in 1.19+) (Backport PR #46170, Upstream PR #46068, @MrFreezeex)
azure: Fix public IP reassignment failure loop on operator restart (Backport PR #46289, Upstream PR #46240, @HadrienPatte)
bgp: Don't provide default_gateway reconciler when disabled (Backport PR #46024, Upstream PR #45911, @YutaroHayakawa)
bgp: Reduce amount of soft peer resets by service reconciliation and fix potentially missed incorrect metadata update upon failed reconciliation. (Backport PR #46245, Upstream PR #45927, @rastislavs)
bug: fixed weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API (Backport PR #46170, Upstream PR #45937, @nickolaev)
datapath/mtu: add altname to mark cilium owned interfaces and do skip changing MTU on interfaces not managed by cilium (Backport PR #46028, Upstream PR #45799, @bersoare)
Fix a bug that causes the NamespaceSelector field in a CiliumEgressGatewayPolicy to be corrupted, and no longer effective. (Backport PR #46024, Upstream PR #45926, @julianwiedmann)
Fix a rare bug in clustermesh-apiserver that triggers incorrect deletion of a valid endpoint entry from the etcd under high pod churn (Backport PR #46170, Upstream PR #45780, @adamwathieu)
Fix BGP PeerConfig status cleanup so it no longer times out when there are no managed conditions to remove. (Backport PR #46170, Upstream PR #45967, @ysksuzuki)
Fix bug that would disrupt node connectivity when ClusterIP/LoadBalancer VIPs overlapped with node-local IP addresses. (Backport PR #46024, Upstream PR #45572, @ajmmm)
Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName. (Backport PR #45966, Upstream PR #45371, @syedazeez337)
fix(gateway-api): Prevent controller panic during Gateway reconciliation when GatewayClass has an invalid or malformed spec.parametersRef. (Backport PR #46400, Upstream PR #46340, @arybolovlev)
fix(gateway-api): set ready condition in endpointSlice to true (Backport PR #46400, Upstream PR #46237, @ulrichgiraud)
fix: nil pointer dereference panic due to uninitialized logger (Backport PR #46170, Upstream PR #45782, @weizhoublue)
Fixed a race where a reused endpoint ID could have its BPF state directory removed by the outgoing endpoint (Backport PR #46554, Upstream PR #46091, @eyupcanakman)
Fixed unsolicited IPv6 L2 announcements ignored by receiving hosts, as not conformant to RFC 4861 (Backport PR #46170, Upstream PR #46079, @giorio94)
Fixes a bug where policymap pressure was incorrectly being reported as 0. (Backport PR #46024, Upstream PR #45791, @squeed)
gateway-api/ingress: set service label on EndpointSlices (Backport PR #46400, Upstream PR #46242, @mhofstetter)
gateway-api: fix GatewayClass field index (Backport PR #46289, Upstream PR #46127, @thorn3r)
gateway-api: prune stale Gateway API route parent statuses (Backport PR #46400, Upstream PR #46296, @mhofstetter)
Improve robustness of kvstore keys construction to prevent possible surprising behavior in rare circumstances (Backport PR #46554, Upstream PR #46412, @giorio94)
iptables: match wireguard packets by proto+port instead of packet mark (Backport PR #46289, Upstream PR #45974, @bersoare)
multipool: Fix retries for CiliumNode Get errors (Backport PR #46408, Upstream PR #46124, @pippolo84)
The internal representation of load-balancing backends has been refactored to efficiently support thousands of services referencing a shared backend. (#46462, @joamaki)
chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.12 (v1.19) (#46560, @cilium-renovate[bot])
chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260518104151-5ebe05f9440b (v1.19) (#46139, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.4.5 (v1.19) (#46561, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752 (v1.19) (#46377, @cilium-renovate[bot])
fix(deps): update module k8s.io/apimachinery to v0.35.5 (v1.19) (#45997, @cilium-renovate[bot])
fix(deps): update module k8s.io/apimachinery to v0.35.6 (v1.19) (#46537, @cilium-renovate[bot])
Miscellaneous improvements to the fake client (Backport PR #46024, Upstream PR #45784, @giorio94)
operator: miscellaneous improvements to the troubleshoot clustermesh command (Backport PR #46554, Upstream PR #46502, @giorio94)
Remove defunct l2podAnnouncements.interface Helm value that rendered a configmap key the agent no longer recognises, causing crash-loops when L2 pod announcements were enabled. Users must use l2podAnnouncements.interfacePattern instead. (Backport PR #46170, Upstream PR #46093, @salamidrus)
Revert ".github/workflows: do not use deployments for environments" (Backport PR #46400, Upstream PR #46348, @aanm)
Other Changes:
[v1.19] proxy: Bump upstream version to v1.37.x (#46439, @sayboras)
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
1.19.4→1.19.5Release Notes
cilium/cilium (cilium)
v1.19.5: 1.19.5Compare Source
Summary of Changes
Minor Changes:
Bugfixes:
nodeSelectorLabelsis enabled to fix CiliumNetworkPolicy withfromNodes/toNodeswithpolicy-default-local-clusterenabled (enabled by default in 1.19+) (Backport PR #46170, Upstream PR #46068, @MrFreezeex)CI Changes:
pull_requesttriggered workflows to ariane (Backport PR #46452, Upstream PR #45363, @nebril)Misc Changes:
0fc1dd3(v1.19) (#46153, @cilium-renovate[bot])11ecd4e(v1.19) (#46277, @cilium-renovate[bot])cd47774(v1.19) (#46137, @cilium-renovate[bot])e1b3ec8(v1.19) (#46007, @cilium-renovate[bot])9532d8c(v1.19) (#46535, @cilium-renovate[bot])cd05a37(v1.19) (#46138, @cilium-renovate[bot])379065f(v1.19) (#46536, @cilium-renovate[bot])ff6756f(v1.19) (#45996, @cilium-renovate[bot])l2podAnnouncements.interfaceHelm value that rendered a configmap key the agent no longer recognises, causing crash-loops when L2 pod announcements were enabled. Users must usel2podAnnouncements.interfacePatterninstead. (Backport PR #46170, Upstream PR #46093, @salamidrus)Other Changes:
Docker Manifests
cilium
quay.io/cilium/cilium:v1.19.5@​sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732clustermesh-apiserver
quay.io/cilium/clustermesh-apiserver:v1.19.5@​sha256:5ed9334b2254315740f9e2a8b6645bf69920f79ef14f436931579d2038784f9bdocker-plugin
quay.io/cilium/docker-plugin:v1.19.5@​sha256:4006d5558390120774a5a903a706dfd64089082bd653b7cb45e9e5a93ff4efeahubble-relay
quay.io/cilium/hubble-relay:v1.19.5@​sha256:24409bfa1bca075c92acb26ba4b49cd573d99d68d5370f7cc825078185222a0coperator-alibabacloud
quay.io/cilium/operator-alibabacloud:v1.19.5@​sha256:c9706343dde700804c2f50c09a2f8291797c707d1747fd50f70c939c23747c16operator-aws
quay.io/cilium/operator-aws:v1.19.5@​sha256:b8473618e8d2bf8a610da445c8c37e1d1e8221aecd05989456d87a7588d66707operator-azure
quay.io/cilium/operator-azure:v1.19.5@​sha256:8600299cb121f9df00fd32b93fa74de89ed49dd3a67e3d7301c07325c04c77f8operator-generic
quay.io/cilium/operator-generic:v1.19.5@​sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4operator
quay.io/cilium/operator:v1.19.5@​sha256:07a25f6a248d77f0c8417d21b5ea5424a81fe551421e4baf04dc79b1360e832eConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.