Lumpiasty/klaster
0
1
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update Helm release cilium to v1.20.2 #428

Merged
Renovate merged 1 commits from renovate/cilium-1.x into fresh-start 2026-09-17 17:38:49 +00:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
Renovate commented 2026-09-17 17:38:47 +00:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Update Change
cilium (source) patch 1.20.1 → 1.20.2

Release Notes

cilium/cilium (cilium)

v1.20.2: 1.20.2

Compare Source

Summary of Changes

Minor Changes:

Bugfixes:

  • aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR #​48418, Upstream PR #​48125, @​41ks)
  • aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #​48418, Upstream PR #​48193, @​41ks)
  • bpf: Fix agent crash when dumping map events (Backport PR #​48378, Upstream PR #​48273, @​joestringer)
  • bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (Backport PR #​48550, Upstream PR #​48407, @​41ks)
  • Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (Backport PR #​48418, Upstream PR #​48262, @​giorio94)
  • datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR #​48550, Upstream PR #​46861, @​fdomain)
  • endpoint: preserve concurrent policy updates for new endpoints (Backport PR #​48213, Upstream PR #​48195, @​jrajahalme)
  • ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. (Backport PR #​48213, Upstream PR #​47034, @​41ks)
  • Fix a pod created immediately after a network policy change reporting a stale policy revision for up to two minutes. (Backport PR #​48418, Upstream PR #​47642, @​aanm)
  • Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association (Backport PR #​48024, Upstream PR #​47874, @​bryanhorstmann)
  • Fix BGP defaultGateway peer auto-discovery selecting a default route from a non-main routing table, such as the default via cilium_host route Cilium installs in the from-proxy table, instead of the node's real default gateway. (Backport PR #​48418, Upstream PR #​47971, @​ecbaldwin)
  • Fix bug where identities may linger for double the amount of the expected time (Backport PR #​48418, Upstream PR #​48032, @​christarazi)
  • Fix dropping traffic L2Announcement with externalTrafficPolicy: Local (Backport PR #​48550, Upstream PR #​46399, @​yuito-it)
  • Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. (Backport PR #​48017, Upstream PR #​47943, @​taaahaaa)
  • Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. (Backport PR #​48017, Upstream PR #​47929, @​shreyasrajiv327)
  • Fix Hubble Relay remains running during termination (Backport PR #​48550, Upstream PR #​47942, @​xandau)
  • Fix ICMP error packet handling by adding the missing checksum recalculation performed during NAT for SNATed load-balanced traffic. (Backport PR #​48418, Upstream PR #​48086, @​julianwiedmann)
  • Fix IPv6 Router Solicitations and Router Advertisements being dropped with "Unsupported protocol for NAT masquerade" on nodes whose BPF masquerade address is a link-local address. (Backport PR #​48418, Upstream PR #​48094, @​ecbaldwin)
  • Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR #​48418, Upstream PR #​48391, @​fristonio)
  • Fix multiple regressions in Cilium LocalRedirectPolicy (Backport PR #​48634, Upstream PR #​46638, @​ajmmm)
  • Fix node-init startup on GKE 1.36.2-gke.2064000 nodes by detecting GKE from the kubelet path instead of container runtime configuration. (Backport PR #​48213, Upstream PR #​47945, @​dlanov)
  • Fix nodeport egress tuple reuse for closed connections (Backport PR #​48418, Upstream PR #​48306, @​fristonio)
  • Fix restored ENI endpoints routing rule configuration when masquerading config changes (#​48417, @​fristonio)
  • fix(envoyconfig): retry port allocation on duplicate-address rejections (Backport PR #​48735, Upstream PR #​48624, @​kokhlo)
  • Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR #​48213, Upstream PR #​47915, @​giorio94)
  • Fixed a cilium-agent crash (fatal error: concurrent map iteration and map write) when an endpoint's policy was recomputed while incremental policy map changes were applied concurrently. Most commonly triggered by named-port policies under pod churn. (Backport PR #​48735, Upstream PR #​48098, @​nashant)
  • Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (Backport PR #​48434, Upstream PR #​47635, @​aanm)
  • Fixes a bug where clusters originally created in v1.15 or earlier failed to upgrade due to dropping the CRD version CiliumNodeConfig v2alpha1. (Backport PR #​48213, Upstream PR #​48087, @​squeed)
  • Fragmented UDP packets were potentially mis-classified as Cilium Wireguard traffic. (Backport PR #​48213, Upstream PR #​48139, @​julianwiedmann)
  • gateway-api: fix listener programmed status update (Backport PR #​48213, Upstream PR #​48013, @​mhofstetter)
  • gateway-api: propgate listenerset status update errors (Backport PR #​48581, Upstream PR #​48130, @​mhofstetter)
  • hubble: fix four config knobs that never reach their sink (Backport PR #​48434, Upstream PR #​47637, @​aanm)
  • Improve reliability for fast recovery of disrupted TCP connections that access a DSR-enabled Service. (Backport PR #​48465, Upstream PR #​48254, @​julianwiedmann)
  • lb (fix): require active state for backend when using topology hints (Backport PR #​48550, Upstream PR #​47054, @​CarrySauce)
  • nodediscovery: Reduced EC2 IMDS load and made ENI node registration more resilient by fetching the instance metadata once instead of on every CiliumNode update. (Backport PR #​48603, Upstream PR #​48218, @​41ks)
  • operator/ipam: Restore fatal exit when the IPAM node watcher fails (Backport PR #​48213, Upstream PR #​47778, @​HadrienPatte)
  • Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR #​48213, Upstream PR #​48015, @​giorio94)
  • The BPF NAT engine now drops ICMP error packets which contain a fragmented TCP/UDP/SCTP packet. (Backport PR #​48418, Upstream PR #​48174, @​julianwiedmann)
  • When using DSR with --bpf-lb-dsr-dispatch set to "opt" or "geneve" in combination with --enable-pmtu-discovery, fix the outer source IP of the ICMP error message which is generated when a forwarded DSR request exceeds the network interface's MTU. (Backport PR #​48114, Upstream PR #​48053, @​julianwiedmann)

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01
quay.io/cilium/cilium:stable@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.2@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce
quay.io/cilium/clustermesh-apiserver:stable@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce

hubble-relay

quay.io/cilium/hubble-relay:v1.20.2@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f
quay.io/cilium/hubble-relay:stable@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.2@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38
quay.io/cilium/operator-alibabacloud:stable@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38

operator-aws

quay.io/cilium/operator-aws:v1.20.2@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3
quay.io/cilium/operator-aws:stable@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3

operator-azure

quay.io/cilium/operator-azure:v1.20.2@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a
quay.io/cilium/operator-azure:stable@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a

operator-generic

quay.io/cilium/operator-generic:v1.20.2@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc
quay.io/cilium/operator-generic:stable@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc

operator

quay.io/cilium/operator:v1.20.2@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c
quay.io/cilium/operator:stable@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | patch | `1.20.1` → `1.20.2` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.20.2`](https://github.com/cilium/cilium/releases/tag/v1.20.2): 1.20.2 [Compare Source](https://github.com/cilium/cilium/compare/1.20.1...1.20.2) ## Summary of Changes **Minor Changes:** - gateway-api: node label selector for when hostNetwork is enabled (Backport PR [#&#8203;48636](https://github.com/cilium/cilium/issues/48636), Upstream PR [#&#8203;47463](https://github.com/cilium/cilium/issues/47463), [@&#8203;xtineskim](https://github.com/xtineskim)) **Bugfixes:** - aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48125](https://github.com/cilium/cilium/issues/48125), [@&#8203;41ks](https://github.com/41ks)) - aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48193](https://github.com/cilium/cilium/issues/48193), [@&#8203;41ks](https://github.com/41ks)) - bpf: Fix agent crash when dumping map events (Backport PR [#&#8203;48378](https://github.com/cilium/cilium/issues/48378), Upstream PR [#&#8203;48273](https://github.com/cilium/cilium/issues/48273), [@&#8203;joestringer](https://github.com/joestringer)) - bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48407](https://github.com/cilium/cilium/issues/48407), [@&#8203;41ks](https://github.com/41ks)) - Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48262](https://github.com/cilium/cilium/issues/48262), [@&#8203;giorio94](https://github.com/giorio94)) - datapath/linux/config: fix IPV4\_DIRECT\_ROUTING selection on lo device (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;46861](https://github.com/cilium/cilium/issues/46861), [@&#8203;fdomain](https://github.com/fdomain)) - endpoint: preserve concurrent policy updates for new endpoints (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48195](https://github.com/cilium/cilium/issues/48195), [@&#8203;jrajahalme](https://github.com/jrajahalme)) - ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47034](https://github.com/cilium/cilium/issues/47034), [@&#8203;41ks](https://github.com/41ks)) - Fix a pod created immediately after a network policy change reporting a stale policy revision for up to two minutes. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;47642](https://github.com/cilium/cilium/issues/47642), [@&#8203;aanm](https://github.com/aanm)) - Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association (Backport PR [#&#8203;48024](https://github.com/cilium/cilium/issues/48024), Upstream PR [#&#8203;47874](https://github.com/cilium/cilium/issues/47874), [@&#8203;bryanhorstmann](https://github.com/bryanhorstmann)) - Fix BGP `defaultGateway` peer auto-discovery selecting a default route from a non-main routing table, such as the `default via cilium_host` route Cilium installs in the from-proxy table, instead of the node's real default gateway. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;47971](https://github.com/cilium/cilium/issues/47971), [@&#8203;ecbaldwin](https://github.com/ecbaldwin)) - Fix bug where identities may linger for double the amount of the expected time (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48032](https://github.com/cilium/cilium/issues/48032), [@&#8203;christarazi](https://github.com/christarazi)) - Fix dropping traffic L2Announcement with externalTrafficPolicy: Local (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;46399](https://github.com/cilium/cilium/issues/46399), [@&#8203;yuito-it](https://github.com/yuito-it)) - Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. (Backport PR [#&#8203;48017](https://github.com/cilium/cilium/issues/48017), Upstream PR [#&#8203;47943](https://github.com/cilium/cilium/issues/47943), [@&#8203;taaahaaa](https://github.com/taaahaaa)) - Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. (Backport PR [#&#8203;48017](https://github.com/cilium/cilium/issues/48017), Upstream PR [#&#8203;47929](https://github.com/cilium/cilium/issues/47929), [@&#8203;shreyasrajiv327](https://github.com/shreyasrajiv327)) - Fix Hubble Relay remains running during termination (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;47942](https://github.com/cilium/cilium/issues/47942), [@&#8203;xandau](https://github.com/xandau)) - Fix ICMP error packet handling by adding the missing checksum recalculation performed during NAT for SNATed load-balanced traffic. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48086](https://github.com/cilium/cilium/issues/48086), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - Fix IPv6 Router Solicitations and Router Advertisements being dropped with "Unsupported protocol for NAT masquerade" on nodes whose BPF masquerade address is a link-local address. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48094](https://github.com/cilium/cilium/issues/48094), [@&#8203;ecbaldwin](https://github.com/ecbaldwin)) - Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48391](https://github.com/cilium/cilium/issues/48391), [@&#8203;fristonio](https://github.com/fristonio)) - Fix multiple regressions in Cilium LocalRedirectPolicy (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;46638](https://github.com/cilium/cilium/issues/46638), [@&#8203;ajmmm](https://github.com/ajmmm)) - Fix node-init startup on GKE 1.36.2-gke.2064000 nodes by detecting GKE from the kubelet path instead of container runtime configuration. (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47945](https://github.com/cilium/cilium/issues/47945), [@&#8203;dlanov](https://github.com/dlanov)) - Fix nodeport egress tuple reuse for closed connections (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48306](https://github.com/cilium/cilium/issues/48306), [@&#8203;fristonio](https://github.com/fristonio)) - Fix restored ENI endpoints routing rule configuration when masquerading config changes ([#&#8203;48417](https://github.com/cilium/cilium/issues/48417), [@&#8203;fristonio](https://github.com/fristonio)) - fix(envoyconfig): retry port allocation on duplicate-address rejections (Backport PR [#&#8203;48735](https://github.com/cilium/cilium/issues/48735), Upstream PR [#&#8203;48624](https://github.com/cilium/cilium/issues/48624), [@&#8203;kokhlo](https://github.com/kokhlo)) - Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47915](https://github.com/cilium/cilium/issues/47915), [@&#8203;giorio94](https://github.com/giorio94)) - Fixed a cilium-agent crash (`fatal error: concurrent map iteration and map write`) when an endpoint's policy was recomputed while incremental policy map changes were applied concurrently. Most commonly triggered by named-port policies under pod churn. (Backport PR [#&#8203;48735](https://github.com/cilium/cilium/issues/48735), Upstream PR [#&#8203;48098](https://github.com/cilium/cilium/issues/48098), [@&#8203;nashant](https://github.com/nashant)) - Fixed five configuration options that were accepted but silently ignored: `vtep-sync-interval`, `enable-xt-socket-fallback`, `eni-delete-on-termination` with a custom CNI configuration, the `enableIdentityMark` Helm value outside CNI chaining mode, and `lb-retry-backoff-max`. (Backport PR [#&#8203;48434](https://github.com/cilium/cilium/issues/48434), Upstream PR [#&#8203;47635](https://github.com/cilium/cilium/issues/47635), [@&#8203;aanm](https://github.com/aanm)) - Fixes a bug where clusters originally created in v1.15 or earlier failed to upgrade due to dropping the CRD version CiliumNodeConfig v2alpha1. (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48087](https://github.com/cilium/cilium/issues/48087), [@&#8203;squeed](https://github.com/squeed)) - Fragmented UDP packets were potentially mis-classified as Cilium Wireguard traffic. (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48139](https://github.com/cilium/cilium/issues/48139), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - gateway-api: fix listener programmed status update (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48013](https://github.com/cilium/cilium/issues/48013), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: propgate listenerset status update errors (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48130](https://github.com/cilium/cilium/issues/48130), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - hubble: fix four config knobs that never reach their sink (Backport PR [#&#8203;48434](https://github.com/cilium/cilium/issues/48434), Upstream PR [#&#8203;47637](https://github.com/cilium/cilium/issues/47637), [@&#8203;aanm](https://github.com/aanm)) - Improve reliability for fast recovery of disrupted TCP connections that access a DSR-enabled Service. (Backport PR [#&#8203;48465](https://github.com/cilium/cilium/issues/48465), Upstream PR [#&#8203;48254](https://github.com/cilium/cilium/issues/48254), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - lb (fix): require active state for backend when using topology hints (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;47054](https://github.com/cilium/cilium/issues/47054), [@&#8203;CarrySauce](https://github.com/CarrySauce)) - nodediscovery: Reduced EC2 IMDS load and made ENI node registration more resilient by fetching the instance metadata once instead of on every CiliumNode update. (Backport PR [#&#8203;48603](https://github.com/cilium/cilium/issues/48603), Upstream PR [#&#8203;48218](https://github.com/cilium/cilium/issues/48218), [@&#8203;41ks](https://github.com/41ks)) - operator/ipam: Restore fatal exit when the IPAM node watcher fails (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47778](https://github.com/cilium/cilium/issues/47778), [@&#8203;HadrienPatte](https://github.com/HadrienPatte)) - Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48015](https://github.com/cilium/cilium/issues/48015), [@&#8203;giorio94](https://github.com/giorio94)) - The BPF NAT engine now drops ICMP error packets which contain a fragmented TCP/UDP/SCTP packet. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48174](https://github.com/cilium/cilium/issues/48174), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - When using DSR with --bpf-lb-dsr-dispatch set to "opt" or "geneve" in combination with --enable-pmtu-discovery, fix the outer source IP of the ICMP error message which is generated when a forwarded DSR request exceeds the network interface's MTU. (Backport PR [#&#8203;48114](https://github.com/cilium/cilium/issues/48114), Upstream PR [#&#8203;48053](https://github.com/cilium/cilium/issues/48053), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) **CI Changes:** - \[v1.20] golangci-lint: Do not run the modernize linter ([#&#8203;48398](https://github.com/cilium/cilium/issues/48398), [@&#8203;aanm](https://github.com/aanm)) - .github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48462](https://github.com/cilium/cilium/issues/48462), [@&#8203;joestringer](https://github.com/joestringer)) - BPF: Refactor nat tests to use scapy fixtures and add checksum coverage (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47222](https://github.com/cilium/cilium/issues/47222), [@&#8203;tommyp1ckles](https://github.com/tommyp1ckles)) - bpf: tests: fix up prog type in ipv6\_test (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47736](https://github.com/cilium/cilium/issues/47736), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - bpf: tests: use PROG\_TYPE (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47714](https://github.com/cilium/cilium/issues/47714), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - bpf: tests: validate CT entry for DSR connection (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48219](https://github.com/cilium/cilium/issues/48219), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - ci: replace unsupported LLVM installation action (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;47776](https://github.com/cilium/cilium/issues/47776), [@&#8203;bogdankrasko](https://github.com/bogdankrasko)) - ci: resolve renovate PR metadata in base image workflows (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47964](https://github.com/cilium/cilium/issues/47964), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - ci: stop asking a PHP app for the AKS runner IP (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48371](https://github.com/cilium/cilium/issues/48371), [@&#8203;aanm](https://github.com/aanm)) - ci: use GitHub App client ID in v1.20 image workflow (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47787](https://github.com/cilium/cilium/issues/47787), [@&#8203;bogdankrasko](https://github.com/bogdankrasko)) - datapath/loader: fix missing complexity coverage for enable\_identity\_mark (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48037](https://github.com/cilium/cilium/issues/48037), [@&#8203;tklauser](https://github.com/tklauser)) - gh: verifier: test PR branch before base branch (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;47928](https://github.com/cilium/cilium/issues/47928), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - gha/conformance-aks: add a timeout to the cluster create step (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48545](https://github.com/cilium/cilium/issues/48545), [@&#8203;aanm](https://github.com/aanm)) - gha/conformance-aks: give the nodes a 64 GiB OS disk (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48481](https://github.com/cilium/cilium/issues/48481), [@&#8203;aanm](https://github.com/aanm)) - gha/kubespray: don't wait for CoreDNS before Cilium is installed (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48048](https://github.com/cilium/cilium/issues/48048), [@&#8203;aanm](https://github.com/aanm)) - gha: bound the LLVM prereq apt step with a 5m timeout (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48069](https://github.com/cilium/cilium/issues/48069), [@&#8203;aanm](https://github.com/aanm)) - gha: compute the ginkgo cache key once, before the matrix (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48127](https://github.com/cilium/cilium/issues/48127), [@&#8203;aanm](https://github.com/aanm)) - gha: move GCP auth pin past the STS token exchange retry fix (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48352](https://github.com/cilium/cilium/issues/48352), [@&#8203;aanm](https://github.com/aanm)) - gha: publish the external target hostnames as FQDNs (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48478](https://github.com/cilium/cilium/issues/48478), [@&#8203;aanm](https://github.com/aanm)) - gha: stop JUnit reports being destroyed by same-name legs (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48203](https://github.com/cilium/cilium/issues/48203), [@&#8203;aanm](https://github.com/aanm)) - logging: downgrade canceled response-body reads to info (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48202](https://github.com/cilium/cilium/issues/48202), [@&#8203;aanm](https://github.com/aanm)) - Makefile: Order the bpf codegen ahead of the Go builds (Backport PR [#&#8203;48735](https://github.com/cilium/cilium/issues/48735), Upstream PR [#&#8203;48644](https://github.com/cilium/cilium/issues/48644), [@&#8203;aanm](https://github.com/aanm)) - Revert 48441 - disable local accounts on AKS clusters ([#&#8203;48524](https://github.com/cilium/cilium/issues/48524), [@&#8203;aanm](https://github.com/aanm)) - test(bpf): parallelize eBPF test execution (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47427](https://github.com/cilium/cilium/issues/47427), [@&#8203;lconnery](https://github.com/lconnery)) - test/k8s: wait for the L7 visibility policy to be realized (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48365](https://github.com/cilium/cilium/issues/48365), [@&#8203;aanm](https://github.com/aanm)) - test: fix the never-taken retry on a partially read JSON line (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;48190](https://github.com/cilium/cilium/issues/48190), [@&#8203;aanm](https://github.com/aanm)) - tools: complexity: de-couple StackDepth from kernel version (Backport PR [#&#8203;48200](https://github.com/cilium/cilium/issues/48200), Upstream PR [#&#8203;48236](https://github.com/cilium/cilium/issues/48236), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - workflows: disable local accounts on AKS clusters ([#&#8203;48441](https://github.com/cilium/cilium/issues/48441), [@&#8203;nbusseneau](https://github.com/nbusseneau)) **Misc Changes:** - Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;48421](https://github.com/cilium/cilium/issues/48421), [@&#8203;0xch4z](https://github.com/0xch4z)) - bpf/lib/nat: rename icmpoff (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;47797](https://github.com/cilium/cilium/issues/47797), [@&#8203;tommyp1ckles](https://github.com/tommyp1ckles)) - bpf: dsr: use eth\_store\_proto() in dsr\_reply\_icmp\*() (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47392](https://github.com/cilium/cilium/issues/47392), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - bpf: icmp\*: fix up sample length (Backport PR [#&#8203;48114](https://github.com/cilium/cilium/issues/48114), Upstream PR [#&#8203;48020](https://github.com/cilium/cilium/issues/48020), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - bpf: misc cleanups (Backport PR [#&#8203;48350](https://github.com/cilium/cilium/issues/48350), Upstream PR [#&#8203;47879](https://github.com/cilium/cilium/issues/47879), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (Backport PR [#&#8203;48284](https://github.com/cilium/cilium/issues/48284), Upstream PR [#&#8203;46232](https://github.com/cilium/cilium/issues/46232), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - bpf: Reduce stack usage of send\_trace\_notify (Backport PR [#&#8203;48350](https://github.com/cilium/cilium/issues/48350), Upstream PR [#&#8203;47911](https://github.com/cilium/cilium/issues/47911), [@&#8203;joamaki](https://github.com/joamaki)) - chore(deps): update all external docker images dependencies (v1.20) (patch) ([#&#8203;48147](https://github.com/cilium/cilium/issues/48147), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all external docker images dependencies to v0.13.6 (v1.20) ([#&#8203;48673](https://github.com/cilium/cilium/issues/48673), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#&#8203;48326](https://github.com/cilium/cilium/issues/48326), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#&#8203;48506](https://github.com/cilium/cilium/issues/48506), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#&#8203;48677](https://github.com/cilium/cilium/issues/48677), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#&#8203;48149](https://github.com/cilium/cilium/issues/48149), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#&#8203;48325](https://github.com/cilium/cilium/issues/48325), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#&#8203;48619](https://github.com/cilium/cilium/issues/48619), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.20) ([#&#8203;48327](https://github.com/cilium/cilium/issues/48327), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.20) ([#&#8203;48672](https://github.com/cilium/cilium/issues/48672), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency bufbuild/buf to v1.73.0 (v1.20) ([#&#8203;48729](https://github.com/cilium/cilium/issues/48729), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.20) ([#&#8203;48344](https://github.com/cilium/cilium/issues/48344), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.20) ([#&#8203;48505](https://github.com/cilium/cilium/issues/48505), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency semver to v3.1.0 (v1.20) ([#&#8203;48730](https://github.com/cilium/cilium/issues/48730), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.20) ([#&#8203;48517](https://github.com/cilium/cilium/issues/48517), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update google/cloud-sdk docker tag to v581 (v1.20) ([#&#8203;48150](https://github.com/cilium/cilium/issues/48150), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update helm/kind-action action to v1.15.0 (v1.20) ([#&#8203;48591](https://github.com/cilium/cilium/issues/48591), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1787987562-ac0b61a4c0a45670a3654448d53bd6416b948f62 (v1.20) ([#&#8203;48323](https://github.com/cilium/cilium/issues/48323), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.20) ([#&#8203;48451](https://github.com/cilium/cilium/issues/48451), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.20) ([#&#8203;48674](https://github.com/cilium/cilium/issues/48674), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#&#8203;48148](https://github.com/cilium/cilium/issues/48148), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#&#8203;48324](https://github.com/cilium/cilium/issues/48324), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#&#8203;48504](https://github.com/cilium/cilium/issues/48504), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#&#8203;48675](https://github.com/cilium/cilium/issues/48675), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - ci: disable TCP/UDPRouteWeightedRouting gateway-api conformance tests (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48375](https://github.com/cilium/cilium/issues/48375), [@&#8203;0xch4z](https://github.com/0xch4z)) - datapath: move some feature probes into BPF (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47737](https://github.com/cilium/cilium/issues/47737), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - docs: fix extra closing parenthesis in hive.rst (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;48541](https://github.com/cilium/cilium/issues/48541), [@&#8203;logi74123](https://github.com/logi74123)) - docs: Improve build process (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;47751](https://github.com/cilium/cilium/issues/47751), [@&#8203;joestringer](https://github.com/joestringer)) - docs: remove outdated tip about disabling hubble before enabling UI (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;48487](https://github.com/cilium/cilium/issues/48487), [@&#8203;ekoops](https://github.com/ekoops)) - docs: Remove v1.18 ipsec documentation (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48224](https://github.com/cilium/cilium/issues/48224), [@&#8203;joestringer](https://github.com/joestringer)) - docs: Update kernel config requirements (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;48594](https://github.com/cilium/cilium/issues/48594), [@&#8203;pchaigno](https://github.com/pchaigno)) - Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48428](https://github.com/cilium/cilium/issues/48428), [@&#8203;marcus-chae](https://github.com/marcus-chae)) - Documentation: document mesh security model (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47912](https://github.com/cilium/cilium/issues/47912), [@&#8203;bimmlerd](https://github.com/bimmlerd)) - envoy: Clarify legacy UpdateEnvoyResources (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48066](https://github.com/cilium/cilium/issues/48066), [@&#8203;jrajahalme](https://github.com/jrajahalme)) - Fix (eBPF): Pointer-to-Pointer Misuse in IPv6 Trace Notifications (Backport PR [#&#8203;48350](https://github.com/cilium/cilium/issues/48350), Upstream PR [#&#8203;47908](https://github.com/cilium/cilium/issues/47908), [@&#8203;weizhoublue](https://github.com/weizhoublue)) - Fix Component Overview doc link rendering (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;48537](https://github.com/cilium/cilium/issues/48537), [@&#8203;eneiss](https://github.com/eneiss)) - fix(deps): update k8s.io patch updates stable to v0.36.4 (v1.20) ([#&#8203;48118](https://github.com/cilium/cilium/issues/48118), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module google.golang.org/grpc to v1.83.1 \[security] (v1.20) ([#&#8203;48388](https://github.com/cilium/cilium/issues/48388), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module sigs.k8s.io/gateway-api/conformance to v1.6.2 (v1.20) ([#&#8203;48676](https://github.com/cilium/cilium/issues/48676), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Fixed broken Slack link on Community page. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48021](https://github.com/cilium/cilium/issues/48021), [@&#8203;ps-mir](https://github.com/ps-mir)) - Fixes: Update node-cache image version to 1.26.5 (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;48270](https://github.com/cilium/cilium/issues/48270), [@&#8203;zyue110026](https://github.com/zyue110026)) - gateway-api: avoid logging missing GatewayClass as error (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48529](https://github.com/cilium/cilium/issues/48529), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: deduplicate condition merge helpers (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48122](https://github.com/cilium/cilium/issues/48122), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract BackendTLSPolicy status handling into BackendTLSPolicyStatusManager (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48068](https://github.com/cilium/cilium/issues/48068), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract gateway address status handling (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48129](https://github.com/cilium/cilium/issues/48129), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract index & load functionality from controller / reconcile (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;47837](https://github.com/cilium/cilium/issues/47837), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract listener status handling (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48103](https://github.com/cilium/cilium/issues/48103), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract route status handling into RouteStatusManager (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48023](https://github.com/cilium/cilium/issues/48023), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: make gateway-api reconciler client and scheme fields private (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48191](https://github.com/cilium/cilium/issues/48191), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: only load referenced services & serviceimports (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48469](https://github.com/cilium/cilium/issues/48469), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: put ctx first in route status API (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48074](https://github.com/cilium/cilium/issues/48074), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: remove duplicate gateway reconcile error logs (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48186](https://github.com/cilium/cilium/issues/48186), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: remove Gateway LBIPAM annotation warning (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48187](https://github.com/cilium/cilium/issues/48187), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: remove pre-filtered namespaces concept (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;47685](https://github.com/cilium/cilium/issues/47685), [@&#8203;asauber](https://github.com/asauber)) - gha/lint-ariane-config: let Renovate manage the Go version (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48467](https://github.com/cilium/cilium/issues/48467), [@&#8203;aanm](https://github.com/aanm)) - gha: authenticate release images with OIDC (Backport PR [#&#8203;48599](https://github.com/cilium/cilium/issues/48599), Upstream PR [#&#8203;48062](https://github.com/cilium/cilium/issues/48062), [@&#8203;aanm](https://github.com/aanm)) - gha: authenticate stable Image CI to quay.io with OIDC (Backport PR [#&#8203;48060](https://github.com/cilium/cilium/issues/48060), Upstream PR [#&#8203;48061](https://github.com/cilium/cilium/issues/48061), [@&#8203;aanm](https://github.com/aanm)) - gha: correct and move the OIDC subject comments (Backport PR [#&#8203;48060](https://github.com/cilium/cilium/issues/48060), Upstream PR [#&#8203;48370](https://github.com/cilium/cilium/issues/48370), [@&#8203;aanm](https://github.com/aanm)) - gha: raise the Docker Hub OIDC token lifetime for release builds (Backport PR [#&#8203;48599](https://github.com/cilium/cilium/issues/48599), Upstream PR [#&#8203;48535](https://github.com/cilium/cilium/issues/48535), [@&#8203;aanm](https://github.com/aanm)) - helm: add general busybox image values for substitution (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;47973](https://github.com/cilium/cilium/issues/47973), [@&#8203;0xch4z](https://github.com/0xch4z)) - vendor: Bump StateDB to v0.8.4 ([#&#8203;48248](https://github.com/cilium/cilium/issues/48248), [@&#8203;joamaki](https://github.com/joamaki)) **Other Changes:** - \[v1.20] bpf: Force-align IPv4 CT tuples used by revSNAT memcpy() ([#&#8203;48395](https://github.com/cilium/cilium/issues/48395), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - install: Update image digests for v1.20.1 ([#&#8203;48039](https://github.com/cilium/cilium/issues/48039), [@&#8203;cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01` `quay.io/cilium/cilium:stable@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.2@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce` `quay.io/cilium/clustermesh-apiserver:stable@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.2@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f` `quay.io/cilium/hubble-relay:stable@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.2@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38` `quay.io/cilium/operator-alibabacloud:stable@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.2@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3` `quay.io/cilium/operator-aws:stable@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.2@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a` `quay.io/cilium/operator-azure:stable@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.2@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc` `quay.io/cilium/operator-generic:stable@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc` ##### operator `quay.io/cilium/operator:v1.20.2@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c` `quay.io/cilium/operator:stable@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC45Ny4yIiwidXBkYXRlZEluVmVyIjoiNDQuOTcuMiIsInRhcmdldEJyYW5jaCI6ImZyZXNoLXN0YXJ0IiwibGFiZWxzIjpbXX0=-->
Renovate added 1 commit 2026-09-17 17:38:47 +00:00
Update Helm release cilium to v1.20.2 39750c765a
Renovate scheduled this pull request to auto merge when all checks succeed 2026-09-17 17:38:48 +00:00
Renovate merged commit db8ea7b1e7 into fresh-start 2026-09-17 17:38:49 +00:00
Renovate deleted branch renovate/cilium-1.x 2026-09-17 17:38:49 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Renovate Lumpiasty
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Lumpiasty/klaster#428