smig/nuc-talos

Watch

Fork 0

chore(deps): update helm release cilium to v1.20.1 #71

Merged

renovatebot merged 1 commit from renovate/cilium-1.x into main

2026-08-23 18:11:44 -04:00

renovatebot commented

2026-08-23 13:10:51 -04:00

Collaborator

This PR contains the following updates:

Package	Update	Change
cilium (source)	patch	`1.20.0` -> `1.20.1`

Release Notes

cilium/cilium (cilium)

`v1.20.1`: 1.20.1

Compare Source

Summary of Changes

Major Changes:

docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR #47615, Upstream PR #47351, @MrFreezeex)

Minor Changes:

envoy: demote stale ADS endpoint warning (Backport PR #47805, Upstream PR #47148, @nezdolik)
Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR #47881, Upstream PR #47529, @julianwiedmann)

Bugfixes:

azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR #47690, Upstream PR #47449, @jaredledvina)
bpf: dsr: don't look for TCP header on fragmented packets (Backport PR #47881, Upstream PR #47640, @julianwiedmann)
bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR #47621, Upstream PR #47343, @smagnani96)
clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR #47885, Upstream PR #47824, @MrFreezeex)
datapath: turn ARP off on the base devices before bringing them up (Backport PR #47885, Upstream PR #47838, @aanm)
endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR #47690, Upstream PR #47625, @christarazi)
endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR #47954, Upstream PR #47880, @weizhoublue)
envoy.httpUpstreamLingerTimeout accepts 0 as a chart value and templates into configmap. (Backport PR #47885, Upstream PR #47741, @jdw6359)
envoy: restore http-idle-timeout as the route idle timeout source (Backport PR #47690, Upstream PR #47583, @aanm)
Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR #47805, Upstream PR #47765, @julianwiedmann)
Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR #47967, Upstream PR #47802, @bimmlerd)
Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR #47805, Upstream PR #47727, @aanm)
Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR #47690, Upstream PR #47295, @aanm)
Fix abnormal ip allocation caused by hostnetwork pod (Backport PR #47690, Upstream PR #47552, @haozhangami)
Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR #47881, Upstream PR #47593, @julianwiedmann)
fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR #47885, Upstream PR #47754, @weizhoublue)
Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with NotAllowedByListeners when the TCP listener had an explicit AllowedRoutes.Kinds restriction. (Backport PR #47690, Upstream PR #46842, @pidreher)
gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR #47954, Upstream PR #47840, @mhofstetter)
gateway-api: mark unresolved backend service ports in route status (Backport PR #47885, Upstream PR #47766, @mhofstetter)
gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR #47690, Upstream PR #46696, @thorn3r)
gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR #47690, Upstream PR #47457, @asauber)
gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR #47805, Upstream PR #47702, @mhofstetter)
gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR #47690, Upstream PR #47627, @mhofstetter)
ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR #47885, Upstream PR #47208, @iwanhae)
l2announcer: re-evaluate services on frontend changes (Backport PR #47690, Upstream PR #47579, @mhofstetter)
Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR #47954, Upstream PR #47826, @mehrdadbn9)
operator: Emit startup logs in the configured log format (Backport PR #47954, Upstream PR #47890, @HadrienPatte)
Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR #47885, Upstream PR #47844, @bimmlerd)
standalone-dns-proxy: return an error when no endpoint is found (Backport PR #47954, Upstream PR #47791, @vipul-21)
wireguard: Unsubscribe node handler on shutdown (Backport PR #47805, Upstream PR #47614, @HadrienPatte)

CI Changes:

.github: add python3-scapy for BPF unit tests (Backport PR #47690, Upstream PR #47535, @msune)
.github: run all quarantined EKS tests in a single tolerated step (Backport PR #47690, Upstream PR #47534, @aanm)
.github: Run envoy image check against PR content (Backport PR #47805, Upstream PR #47792, @joestringer)
.github: Simplify permissions for image linter workflow (Backport PR #47805, Upstream PR #47753, @joestringer)
.github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR #47690, Upstream PR #47470, @atykhyy)
.github: test the default ENI behaviour on the EKS pull request leg (Backport PR #47690, Upstream PR #47569, @aanm)
ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR #47805, Upstream PR #47743, @giorio94)
bpf/complexity-tests: Cover L7 LB (Backport PR #47805, Upstream PR #47060, @pchaigno)
ci: build race images on push events so conformance-race works on stable branches (Backport PR #47609, Upstream PR #47608, @aanm)
ci: build race images on push in the stable image builders (Backport PR #47609, Upstream PR #47616, @aanm)
ci: draft renovate PRs until ciliumbot auto-approval (Backport PR #47805, Upstream PR #47364, @mhofstetter)
ci: fix filtering out md files in bpf checks (Backport PR #47690, Upstream PR #47605, @nebril)
ci: migrate set-commit-status to cilium/actions (Backport PR #47805, Upstream PR #47771, @bogdankrasko)
ci: skip etcd log fetch when kvstore was never started (Backport PR #47885, Upstream PR #47801, @aanm)
Fix missing events_map_rate_limit complexity coverage (Backport PR #47805, Upstream PR #47691, @pchaigno)
gha/kubespray: run on schedule, rather than on every push (Backport PR #47731, Upstream PR #47719, @giorio94)
gha/lvh-kind: respect Kind image version also when config is provided (Backport PR #47731, Upstream PR #47703, @giorio94)
gha: don't install LLVM and Clang in integration tests workflow (Backport PR #47731, Upstream PR #47717, @giorio94)
gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR #47731, Upstream PR #47724, @giorio94)
images/scripts: Validate Envoy image vars against sed injection (Backport PR #47805, Upstream PR #47205, @MasloMaslane)
Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR #47885, Upstream PR #47780, @giorio94)
test(bpf): parallelize eBPF test compilation (Backport PR #47954, Upstream PR #47426, @lconnery)
test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR #47805, Upstream PR #47725, @aanm)
test: allowlist the leader election read timeout in ginkgo log check (Backport PR #47690, Upstream PR #47612, @aanm)

Misc Changes:

Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR #47690, Upstream PR #46116, @amaanx86)
allocator: fix flake in TestWatchRemoteKVStore (Backport PR #47690, Upstream PR #47455, @giorio94)
bpf/nat: Move IPv6 nat entry to map (Backport PR #47805, Upstream PR #47762, @pchaigno)
bpf: conntrack: Reduce stack usage of ct_create{4,6} (Backport PR #47805, Upstream PR #47582, @dylandreimerink)
bpf: dsr: only require DSR-info on SYN packet (Backport PR #47881, Upstream PR #47592, @julianwiedmann)
bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR #47881, Upstream PR #47388, @julianwiedmann)
bpf: lb: use dedicated new_backend bool (Backport PR #47881, Upstream PR #47841, @julianwiedmann)
chore(deps): update all github action dependencies (v1.20) (#47991, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.20) (#48008, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.20) (#47678, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) (#47576, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) (#47988, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.26.5 docker digest to 705e964 (v1.20) (#47949, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.26.5 docker digest to 7caba52 (v1.20) (#47864, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) (#47899, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) (#47989, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.20) (patch) (#47865, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.20) (patch) (#47990, @cilium-renovate[bot])
clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR #47962, Upstream PR #47932, @giorio94)
docs: clarify GAMMA DROP_EP_NOT_READY events (Backport PR #47885, Upstream PR #47587, @thorn3r)
docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR #47690, Upstream PR #47600, @41ks)
docs: Remove "not stable" installation instructions (Backport PR #47798, Upstream PR #47646, @joestringer)
docs: update Gateway API conformance badge (Backport PR #47690, Upstream PR #47581, @arybolovlev)
docs: Update Gateway API installation guide (Backport PR #47690, Upstream PR #47446, @arybolovlev)
Gateway API: the Gateway address status no longer reports a bogus "" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR #47690, Upstream PR #47466, @locker95)
gateway-api: remove unnecessary TLSRoute support checks (Backport PR #47885, Upstream PR #47758, @mhofstetter)
gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR #47690, Upstream PR #47599, @mhofstetter)
gateway-api: return route check errors directly (Backport PR #47805, Upstream PR #47607, @mhofstetter)
gateway-api: unify Gateway API listener parentRef matching (Backport PR #47690, Upstream PR #46670, @arybolovlev)
gateway-api: validate gRPCRoute header modifiers in status (Backport PR #47805, Upstream PR #47606, @mhofstetter)
operator: Replace reflect.DeepEqual with assert.Equal in tests (Backport PR #47690, Upstream PR #47424, @HadrienPatte)
Update all github action dependencies (v1.20) (#47656, @cilium-renovate[bot])
Update all github action dependencies (v1.20) (#47675, @cilium-renovate[bot])
Update docker.io/library/busybox:1.38.0 Docker digest to dc2d74b (v1.20) (#47655, @cilium-renovate[bot])
Update documentation dependencies (Backport PR #47798, Upstream PR #47750, @joestringer)
Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) (#47657, @cilium-renovate[bot])
Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) (#47659, @cilium-renovate[bot])
Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) (#47658, @cilium-renovate[bot])

Other Changes:

install: Update image digests for v1.20.0 (#47584, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b
quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5
quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5

hubble-relay

quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4
quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c
quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c

operator-aws

quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7
quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7

operator-azure

quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031
quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031

operator-generic

quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf
quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf

operator

quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d
quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | patch | `1.20.0` -> `1.20.1` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.20.1`](https://github.com/cilium/cilium/releases/tag/v1.20.1): 1.20.1 [Compare Source](https://github.com/cilium/cilium/compare/1.20.0...1.20.1) ## Summary of Changes **Major Changes:** - docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR [#47615](https://github.com/cilium/cilium/issues/47615), Upstream PR [#47351](https://github.com/cilium/cilium/issues/47351), [@MrFreezeex](https://github.com/MrFreezeex)) **Minor Changes:** - envoy: demote stale ADS endpoint warning (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47148](https://github.com/cilium/cilium/issues/47148), [@nezdolik](https://github.com/nezdolik)) - Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR [#47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#47529](https://github.com/cilium/cilium/issues/47529), [@julianwiedmann](https://github.com/julianwiedmann)) **Bugfixes:** - azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47449](https://github.com/cilium/cilium/issues/47449), [@jaredledvina](https://github.com/jaredledvina)) - bpf: dsr: don't look for TCP header on fragmented packets (Backport PR [#47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#47640](https://github.com/cilium/cilium/issues/47640), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR [#47621](https://github.com/cilium/cilium/issues/47621), Upstream PR [#47343](https://github.com/cilium/cilium/issues/47343), [@smagnani96](https://github.com/smagnani96)) - clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47824](https://github.com/cilium/cilium/issues/47824), [@MrFreezeex](https://github.com/MrFreezeex)) - datapath: turn ARP off on the base devices before bringing them up (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47838](https://github.com/cilium/cilium/issues/47838), [@aanm](https://github.com/aanm)) - endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47625](https://github.com/cilium/cilium/issues/47625), [@christarazi](https://github.com/christarazi)) - endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR [#47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#47880](https://github.com/cilium/cilium/issues/47880), [@weizhoublue](https://github.com/weizhoublue)) - envoy.httpUpstreamLingerTimeout accepts `0` as a chart value and templates into configmap. (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47741](https://github.com/cilium/cilium/issues/47741), [@jdw6359](https://github.com/jdw6359)) - envoy: restore http-idle-timeout as the route idle timeout source (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47583](https://github.com/cilium/cilium/issues/47583), [@aanm](https://github.com/aanm)) - Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47765](https://github.com/cilium/cilium/issues/47765), [@julianwiedmann](https://github.com/julianwiedmann)) - Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR [#47967](https://github.com/cilium/cilium/issues/47967), Upstream PR [#47802](https://github.com/cilium/cilium/issues/47802), [@bimmlerd](https://github.com/bimmlerd)) - Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47727](https://github.com/cilium/cilium/issues/47727), [@aanm](https://github.com/aanm)) - Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47295](https://github.com/cilium/cilium/issues/47295), [@aanm](https://github.com/aanm)) - Fix abnormal ip allocation caused by hostnetwork pod (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47552](https://github.com/cilium/cilium/issues/47552), [@haozhangami](https://github.com/haozhangami)) - Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR [#47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#47593](https://github.com/cilium/cilium/issues/47593), [@julianwiedmann](https://github.com/julianwiedmann)) - fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47754](https://github.com/cilium/cilium/issues/47754), [@weizhoublue](https://github.com/weizhoublue)) - Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with `NotAllowedByListeners` when the TCP listener had an explicit `AllowedRoutes.Kinds` restriction. (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#46842](https://github.com/cilium/cilium/issues/46842), [@pidreher](https://github.com/pidreher)) - gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR [#47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#47840](https://github.com/cilium/cilium/issues/47840), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: mark unresolved backend service ports in route status (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47766](https://github.com/cilium/cilium/issues/47766), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#46696](https://github.com/cilium/cilium/issues/46696), [@thorn3r](https://github.com/thorn3r)) - gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47457](https://github.com/cilium/cilium/issues/47457), [@asauber](https://github.com/asauber)) - gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47702](https://github.com/cilium/cilium/issues/47702), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47627](https://github.com/cilium/cilium/issues/47627), [@mhofstetter](https://github.com/mhofstetter)) - ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47208](https://github.com/cilium/cilium/issues/47208), [@iwanhae](https://github.com/iwanhae)) - l2announcer: re-evaluate services on frontend changes (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47579](https://github.com/cilium/cilium/issues/47579), [@mhofstetter](https://github.com/mhofstetter)) - Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR [#47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#47826](https://github.com/cilium/cilium/issues/47826), [@mehrdadbn9](https://github.com/mehrdadbn9)) - operator: Emit startup logs in the configured log format (Backport PR [#47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#47890](https://github.com/cilium/cilium/issues/47890), [@HadrienPatte](https://github.com/HadrienPatte)) - Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47844](https://github.com/cilium/cilium/issues/47844), [@bimmlerd](https://github.com/bimmlerd)) - standalone-dns-proxy: return an error when no endpoint is found (Backport PR [#47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#47791](https://github.com/cilium/cilium/issues/47791), [@vipul-21](https://github.com/vipul-21)) - wireguard: Unsubscribe node handler on shutdown (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47614](https://github.com/cilium/cilium/issues/47614), [@HadrienPatte](https://github.com/HadrienPatte)) **CI Changes:** - .github: add python3-scapy for BPF unit tests (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47535](https://github.com/cilium/cilium/issues/47535), [@msune](https://github.com/msune)) - .github: run all quarantined EKS tests in a single tolerated step (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47534](https://github.com/cilium/cilium/issues/47534), [@aanm](https://github.com/aanm)) - .github: Run envoy image check against PR content (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47792](https://github.com/cilium/cilium/issues/47792), [@joestringer](https://github.com/joestringer)) - .github: Simplify permissions for image linter workflow (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47753](https://github.com/cilium/cilium/issues/47753), [@joestringer](https://github.com/joestringer)) - .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47470](https://github.com/cilium/cilium/issues/47470), [@atykhyy](https://github.com/atykhyy)) - .github: test the default ENI behaviour on the EKS pull request leg (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47569](https://github.com/cilium/cilium/issues/47569), [@aanm](https://github.com/aanm)) - ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47743](https://github.com/cilium/cilium/issues/47743), [@giorio94](https://github.com/giorio94)) - bpf/complexity-tests: Cover L7 LB (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47060](https://github.com/cilium/cilium/issues/47060), [@pchaigno](https://github.com/pchaigno)) - ci: build race images on push events so conformance-race works on stable branches (Backport PR [#47609](https://github.com/cilium/cilium/issues/47609), Upstream PR [#47608](https://github.com/cilium/cilium/issues/47608), [@aanm](https://github.com/aanm)) - ci: build race images on push in the stable image builders (Backport PR [#47609](https://github.com/cilium/cilium/issues/47609), Upstream PR [#47616](https://github.com/cilium/cilium/issues/47616), [@aanm](https://github.com/aanm)) - ci: draft renovate PRs until ciliumbot auto-approval (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47364](https://github.com/cilium/cilium/issues/47364), [@mhofstetter](https://github.com/mhofstetter)) - ci: fix filtering out md files in bpf checks (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47605](https://github.com/cilium/cilium/issues/47605), [@nebril](https://github.com/nebril)) - ci: migrate set-commit-status to cilium/actions (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47771](https://github.com/cilium/cilium/issues/47771), [@bogdankrasko](https://github.com/bogdankrasko)) - ci: skip etcd log fetch when kvstore was never started (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47801](https://github.com/cilium/cilium/issues/47801), [@aanm](https://github.com/aanm)) - Fix missing `events_map_rate_limit` complexity coverage (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47691](https://github.com/cilium/cilium/issues/47691), [@pchaigno](https://github.com/pchaigno)) - gha/kubespray: run on schedule, rather than on every push (Backport PR [#47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#47719](https://github.com/cilium/cilium/issues/47719), [@giorio94](https://github.com/giorio94)) - gha/lvh-kind: respect Kind image version also when config is provided (Backport PR [#47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#47703](https://github.com/cilium/cilium/issues/47703), [@giorio94](https://github.com/giorio94)) - gha: don't install LLVM and Clang in integration tests workflow (Backport PR [#47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#47717](https://github.com/cilium/cilium/issues/47717), [@giorio94](https://github.com/giorio94)) - gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR [#47731](https://github.com/cilium/cilium/issues/47731), Upstream PR [#47724](https://github.com/cilium/cilium/issues/47724), [@giorio94](https://github.com/giorio94)) - images/scripts: Validate Envoy image vars against sed injection (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47205](https://github.com/cilium/cilium/issues/47205), [@MasloMaslane](https://github.com/MasloMaslane)) - Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47780](https://github.com/cilium/cilium/issues/47780), [@giorio94](https://github.com/giorio94)) - test(bpf): parallelize eBPF test compilation (Backport PR [#47954](https://github.com/cilium/cilium/issues/47954), Upstream PR [#47426](https://github.com/cilium/cilium/issues/47426), [@lconnery](https://github.com/lconnery)) - test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47725](https://github.com/cilium/cilium/issues/47725), [@aanm](https://github.com/aanm)) - test: allowlist the leader election read timeout in ginkgo log check (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47612](https://github.com/cilium/cilium/issues/47612), [@aanm](https://github.com/aanm)) **Misc Changes:** - Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#46116](https://github.com/cilium/cilium/issues/46116), [@amaanx86](https://github.com/amaanx86)) - allocator: fix flake in TestWatchRemoteKVStore (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47455](https://github.com/cilium/cilium/issues/47455), [@giorio94](https://github.com/giorio94)) - bpf/nat: Move IPv6 nat entry to map (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47762](https://github.com/cilium/cilium/issues/47762), [@pchaigno](https://github.com/pchaigno)) - bpf: conntrack: Reduce stack usage of `ct_create{4,6}` (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47582](https://github.com/cilium/cilium/issues/47582), [@dylandreimerink](https://github.com/dylandreimerink)) - bpf: dsr: only require DSR-info on SYN packet (Backport PR [#47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#47592](https://github.com/cilium/cilium/issues/47592), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR [#47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#47388](https://github.com/cilium/cilium/issues/47388), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: lb: use dedicated new\_backend bool (Backport PR [#47881](https://github.com/cilium/cilium/issues/47881), Upstream PR [#47841](https://github.com/cilium/cilium/issues/47841), [@julianwiedmann](https://github.com/julianwiedmann)) - chore(deps): update all github action dependencies (v1.20) ([#47991](https://github.com/cilium/cilium/issues/47991), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#48008](https://github.com/cilium/cilium/issues/48008), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#47678](https://github.com/cilium/cilium/issues/47678), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) ([#47576](https://github.com/cilium/cilium/issues/47576), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) ([#47988](https://github.com/cilium/cilium/issues/47988), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`705e964`](https://github.com/cilium/cilium/commit/705e964) (v1.20) ([#47949](https://github.com/cilium/cilium/issues/47949), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.5 docker digest to [`7caba52`](https://github.com/cilium/cilium/commit/7caba52) (v1.20) ([#47864](https://github.com/cilium/cilium/issues/47864), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) ([#47899](https://github.com/cilium/cilium/issues/47899), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) ([#47989](https://github.com/cilium/cilium/issues/47989), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47865](https://github.com/cilium/cilium/issues/47865), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#47990](https://github.com/cilium/cilium/issues/47990), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR [#47962](https://github.com/cilium/cilium/issues/47962), Upstream PR [#47932](https://github.com/cilium/cilium/issues/47932), [@giorio94](https://github.com/giorio94)) - docs: clarify GAMMA DROP\_EP\_NOT\_READY events (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47587](https://github.com/cilium/cilium/issues/47587), [@thorn3r](https://github.com/thorn3r)) - docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47600](https://github.com/cilium/cilium/issues/47600), [@41ks](https://github.com/41ks)) - docs: Remove "not stable" installation instructions (Backport PR [#47798](https://github.com/cilium/cilium/issues/47798), Upstream PR [#47646](https://github.com/cilium/cilium/issues/47646), [@joestringer](https://github.com/joestringer)) - docs: update Gateway API conformance badge (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47581](https://github.com/cilium/cilium/issues/47581), [@arybolovlev](https://github.com/arybolovlev)) - docs: Update Gateway API installation guide (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47446](https://github.com/cilium/cilium/issues/47446), [@arybolovlev](https://github.com/arybolovlev)) - Gateway API: the Gateway address status no longer reports a bogus "<nil>" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47466](https://github.com/cilium/cilium/issues/47466), [@locker95](https://github.com/locker95)) - gateway-api: remove unnecessary TLSRoute support checks (Backport PR [#47885](https://github.com/cilium/cilium/issues/47885), Upstream PR [#47758](https://github.com/cilium/cilium/issues/47758), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47599](https://github.com/cilium/cilium/issues/47599), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: return route check errors directly (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47607](https://github.com/cilium/cilium/issues/47607), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: unify Gateway API listener parentRef matching (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#46670](https://github.com/cilium/cilium/issues/46670), [@arybolovlev](https://github.com/arybolovlev)) - gateway-api: validate gRPCRoute header modifiers in status (Backport PR [#47805](https://github.com/cilium/cilium/issues/47805), Upstream PR [#47606](https://github.com/cilium/cilium/issues/47606), [@mhofstetter](https://github.com/mhofstetter)) - operator: Replace `reflect.DeepEqual` with `assert.Equal` in tests (Backport PR [#47690](https://github.com/cilium/cilium/issues/47690), Upstream PR [#47424](https://github.com/cilium/cilium/issues/47424), [@HadrienPatte](https://github.com/HadrienPatte)) - Update all github action dependencies (v1.20) ([#47656](https://github.com/cilium/cilium/issues/47656), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update all github action dependencies (v1.20) ([#47675](https://github.com/cilium/cilium/issues/47675), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update docker.io/library/busybox:1.38.0 Docker digest to [`dc2d74b`](https://github.com/cilium/cilium/commit/dc2d74b) (v1.20) ([#47655](https://github.com/cilium/cilium/issues/47655), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update documentation dependencies (Backport PR [#47798](https://github.com/cilium/cilium/issues/47798), Upstream PR [#47750](https://github.com/cilium/cilium/issues/47750), [@joestringer](https://github.com/joestringer)) - Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) ([#47657](https://github.com/cilium/cilium/issues/47657), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) ([#47659](https://github.com/cilium/cilium/issues/47659), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) ([#47658](https://github.com/cilium/cilium/issues/47658), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) **Other Changes:** - install: Update image digests for v1.20.0 ([#47584](https://github.com/cilium/cilium/issues/47584), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` `quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` `quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` `quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` `quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` `quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` `quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` `quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf` ##### operator `quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` `quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d` </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovatebot added 1 commit

2026-08-23 13:10:51 -04:00

chore(deps): update helm release cilium to v1.20.1

Notify Mattermost on Renovate PR Merge / notify (pull_request) Successful in 1s

Details

d4f7f6f06f

renovatebot scheduled this pull request to auto merge when all checks succeed

2026-08-23 13:10:51 -04:00

renovatebot merged commit 13a45207d3 into main

2026-08-23 18:11:44 -04:00

renovatebot deleted branch renovate/cilium-1.x

2026-08-23 18:11:44 -04:00

renovatebot referenced this pull request from a commit

2026-08-23 18:11:45 -04:00

Merge pull request 'chore(deps): update helm release cilium to v1.20.1' (#71) from renovate/cilium-1.x into main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

smig/nuc-talos!71

No description provided.

Rows
Columns

chore(deps): update helm release cilium to v1.20.1 #71

Release Notes

v1.20.1: 1.20.1

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

Configuration

`v1.20.1`: 1.20.1