smig/nuc-talos

Watch

Fork 0

chore(deps): update helm release cilium to v1.20.2 #84

Merged

renovatebot merged 1 commit from renovate/cilium-1.x into main

2026-09-16 20:44:55 -04:00

renovatebot commented

2026-09-16 00:04:05 -04:00

Collaborator

This PR contains the following updates:

Package	Update	Change
cilium (source)	patch	`1.20.1` -> `1.20.2`

Release Notes

cilium/cilium (cilium)

`v1.20.2`: 1.20.2

Compare Source

Summary of Changes

Minor Changes:

gateway-api: node label selector for when hostNetwork is enabled (Backport PR #48636, Upstream PR #47463, @xtineskim)

Bugfixes:

aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR #48418, Upstream PR #48125, @41ks)
aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #48418, Upstream PR #48193, @41ks)
bpf: Fix agent crash when dumping map events (Backport PR #48378, Upstream PR #48273, @joestringer)
bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (Backport PR #48550, Upstream PR #48407, @41ks)
Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (Backport PR #48418, Upstream PR #48262, @giorio94)
datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR #48550, Upstream PR #46861, @fdomain)
endpoint: preserve concurrent policy updates for new endpoints (Backport PR #48213, Upstream PR #48195, @jrajahalme)
ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. (Backport PR #48213, Upstream PR #47034, @41ks)
Fix a pod created immediately after a network policy change reporting a stale policy revision for up to two minutes. (Backport PR #48418, Upstream PR #47642, @aanm)
Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association (Backport PR #48024, Upstream PR #47874, @bryanhorstmann)
Fix BGP defaultGateway peer auto-discovery selecting a default route from a non-main routing table, such as the default via cilium_host route Cilium installs in the from-proxy table, instead of the node's real default gateway. (Backport PR #48418, Upstream PR #47971, @ecbaldwin)
Fix bug where identities may linger for double the amount of the expected time (Backport PR #48418, Upstream PR #48032, @christarazi)
Fix dropping traffic L2Announcement with externalTrafficPolicy: Local (Backport PR #48550, Upstream PR #46399, @yuito-it)
Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. (Backport PR #48017, Upstream PR #47943, @taaahaaa)
Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. (Backport PR #48017, Upstream PR #47929, @shreyasrajiv327)
Fix Hubble Relay remains running during termination (Backport PR #48550, Upstream PR #47942, @xandau)
Fix ICMP error packet handling by adding the missing checksum recalculation performed during NAT for SNATed load-balanced traffic. (Backport PR #48418, Upstream PR #48086, @julianwiedmann)
Fix IPv6 Router Solicitations and Router Advertisements being dropped with "Unsupported protocol for NAT masquerade" on nodes whose BPF masquerade address is a link-local address. (Backport PR #48418, Upstream PR #48094, @ecbaldwin)
Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR #48418, Upstream PR #48391, @fristonio)
Fix multiple regressions in Cilium LocalRedirectPolicy (Backport PR #48634, Upstream PR #46638, @ajmmm)
Fix node-init startup on GKE 1.36.2-gke.2064000 nodes by detecting GKE from the kubelet path instead of container runtime configuration. (Backport PR #48213, Upstream PR #47945, @dlanov)
Fix nodeport egress tuple reuse for closed connections (Backport PR #48418, Upstream PR #48306, @fristonio)
Fix restored ENI endpoints routing rule configuration when masquerading config changes (#48417, @fristonio)
fix(envoyconfig): retry port allocation on duplicate-address rejections (Backport PR #48735, Upstream PR #48624, @kokhlo)
Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR #48213, Upstream PR #47915, @giorio94)
Fixed a cilium-agent crash (fatal error: concurrent map iteration and map write) when an endpoint's policy was recomputed while incremental policy map changes were applied concurrently. Most commonly triggered by named-port policies under pod churn. (Backport PR #48735, Upstream PR #48098, @nashant)
Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (Backport PR #48434, Upstream PR #47635, @aanm)
Fixes a bug where clusters originally created in v1.15 or earlier failed to upgrade due to dropping the CRD version CiliumNodeConfig v2alpha1. (Backport PR #48213, Upstream PR #48087, @squeed)
Fragmented UDP packets were potentially mis-classified as Cilium Wireguard traffic. (Backport PR #48213, Upstream PR #48139, @julianwiedmann)
gateway-api: fix listener programmed status update (Backport PR #48213, Upstream PR #48013, @mhofstetter)
gateway-api: propgate listenerset status update errors (Backport PR #48581, Upstream PR #48130, @mhofstetter)
hubble: fix four config knobs that never reach their sink (Backport PR #48434, Upstream PR #47637, @aanm)
Improve reliability for fast recovery of disrupted TCP connections that access a DSR-enabled Service. (Backport PR #48465, Upstream PR #48254, @julianwiedmann)
lb (fix): require active state for backend when using topology hints (Backport PR #48550, Upstream PR #47054, @CarrySauce)
nodediscovery: Reduced EC2 IMDS load and made ENI node registration more resilient by fetching the instance metadata once instead of on every CiliumNode update. (Backport PR #48603, Upstream PR #48218, @41ks)
operator/ipam: Restore fatal exit when the IPAM node watcher fails (Backport PR #48213, Upstream PR #47778, @HadrienPatte)
Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR #48213, Upstream PR #48015, @giorio94)
The BPF NAT engine now drops ICMP error packets which contain a fragmented TCP/UDP/SCTP packet. (Backport PR #48418, Upstream PR #48174, @julianwiedmann)
When using DSR with --bpf-lb-dsr-dispatch set to "opt" or "geneve" in combination with --enable-pmtu-discovery, fix the outer source IP of the ICMP error message which is generated when a forwarded DSR request exceeds the network interface's MTU. (Backport PR #48114, Upstream PR #48053, @julianwiedmann)

CI Changes:

[v1.20] golangci-lint: Do not run the modernize linter (#48398, @aanm)
.github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR #48550, Upstream PR #48462, @joestringer)
BPF: Refactor nat tests to use scapy fixtures and add checksum coverage (Backport PR #48213, Upstream PR #47222, @tommyp1ckles)
bpf: tests: fix up prog type in ipv6_test (Backport PR #48213, Upstream PR #47736, @julianwiedmann)
bpf: tests: use PROG_TYPE (Backport PR #48213, Upstream PR #47714, @julianwiedmann)
bpf: tests: validate CT entry for DSR connection (Backport PR #48418, Upstream PR #48219, @julianwiedmann)
ci: replace unsupported LLVM installation action (Backport PR #48418, Upstream PR #47776, @bogdankrasko)
ci: resolve renovate PR metadata in base image workflows (Backport PR #48213, Upstream PR #47964, @mhofstetter)
ci: stop asking a PHP app for the AKS runner IP (Backport PR #48418, Upstream PR #48371, @aanm)
ci: use GitHub App client ID in v1.20 image workflow (Backport PR #48213, Upstream PR #47787, @bogdankrasko)
datapath/loader: fix missing complexity coverage for enable_identity_mark (Backport PR #48213, Upstream PR #48037, @tklauser)
gh: verifier: test PR branch before base branch (Backport PR #48418, Upstream PR #47928, @julianwiedmann)
gha/conformance-aks: add a timeout to the cluster create step (Backport PR #48550, Upstream PR #48545, @aanm)
gha/conformance-aks: give the nodes a 64 GiB OS disk (Backport PR #48550, Upstream PR #48481, @aanm)
gha/kubespray: don't wait for CoreDNS before Cilium is installed (Backport PR #48213, Upstream PR #48048, @aanm)
gha: bound the LLVM prereq apt step with a 5m timeout (Backport PR #48213, Upstream PR #48069, @aanm)
gha: compute the ginkgo cache key once, before the matrix (Backport PR #48213, Upstream PR #48127, @aanm)
gha: move GCP auth pin past the STS token exchange retry fix (Backport PR #48418, Upstream PR #48352, @aanm)
gha: publish the external target hostnames as FQDNs (Backport PR #48550, Upstream PR #48478, @aanm)
gha: stop JUnit reports being destroyed by same-name legs (Backport PR #48418, Upstream PR #48203, @aanm)
logging: downgrade canceled response-body reads to info (Backport PR #48418, Upstream PR #48202, @aanm)
Makefile: Order the bpf codegen ahead of the Go builds (Backport PR #48735, Upstream PR #48644, @aanm)
Revert 48441 - disable local accounts on AKS clusters (#48524, @aanm)
test(bpf): parallelize eBPF test execution (Backport PR #48213, Upstream PR #47427, @lconnery)
test/k8s: wait for the L7 visibility policy to be realized (Backport PR #48418, Upstream PR #48365, @aanm)
test: fix the never-taken retry on a partially read JSON line (Backport PR #48634, Upstream PR #48190, @aanm)
tools: complexity: de-couple StackDepth from kernel version (Backport PR #48200, Upstream PR #48236, @julianwiedmann)
workflows: disable local accounts on AKS clusters (#48441, @nbusseneau)

Misc Changes:

Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR #48634, Upstream PR #48421, @0xch4z)
bpf/lib/nat: rename icmpoff (Backport PR #48418, Upstream PR #47797, @tommyp1ckles)
bpf: dsr: use eth_store_proto() in dsr_reply_icmp*() (Backport PR #48213, Upstream PR #47392, @julianwiedmann)
bpf: icmp*: fix up sample length (Backport PR #48114, Upstream PR #48020, @julianwiedmann)
bpf: misc cleanups (Backport PR #48350, Upstream PR #47879, @julianwiedmann)
bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (Backport PR #48284, Upstream PR #46232, @julianwiedmann)
bpf: Reduce stack usage of send_trace_notify (Backport PR #48350, Upstream PR #47911, @joamaki)
chore(deps): update all external docker images dependencies (v1.20) (patch) (#48147, @cilium-renovate[bot])
chore(deps): update all external docker images dependencies to v0.13.6 (v1.20) (#48673, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.20) (#48326, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.20) (#48506, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.20) (#48677, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.20) (#48149, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.20) (#48325, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.20) (#48619, @cilium-renovate[bot])
chore(deps): update base-images (v1.20) (#48327, @cilium-renovate[bot])
chore(deps): update base-images (v1.20) (#48672, @cilium-renovate[bot])
chore(deps): update dependency bufbuild/buf to v1.73.0 (v1.20) (#48729, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.20) (#48344, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.20) (#48505, @cilium-renovate[bot])
chore(deps): update dependency semver to v3.1.0 (v1.20) (#48730, @cilium-renovate[bot])
chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.20) (#48517, @cilium-renovate[bot])
chore(deps): update google/cloud-sdk docker tag to v581 (v1.20) (#48150, @cilium-renovate[bot])
chore(deps): update helm/kind-action action to v1.15.0 (v1.20) (#48591, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1787987562-ac0b61a4c0a45670a3654448d53bd6416b948f62 (v1.20) (#48323, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.20) (#48451, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.20) (#48674, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.20) (patch) (#48148, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.20) (patch) (#48324, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.20) (patch) (#48504, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.20) (patch) (#48675, @cilium-renovate[bot])
ci: disable TCP/UDPRouteWeightedRouting gateway-api conformance tests (Backport PR #48550, Upstream PR #48375, @0xch4z)
datapath: move some feature probes into BPF (Backport PR #48213, Upstream PR #47737, @julianwiedmann)
docs: fix extra closing parenthesis in hive.rst (Backport PR #48634, Upstream PR #48541, @logi74123)
docs: Improve build process (Backport PR #48550, Upstream PR #47751, @joestringer)
docs: remove outdated tip about disabling hubble before enabling UI (Backport PR #48634, Upstream PR #48487, @ekoops)
docs: Remove v1.18 ipsec documentation (Backport PR #48418, Upstream PR #48224, @joestringer)
docs: Update kernel config requirements (Backport PR #48634, Upstream PR #48594, @pchaigno)
Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (Backport PR #48550, Upstream PR #48428, @marcus-chae)
Documentation: document mesh security model (Backport PR #48213, Upstream PR #47912, @bimmlerd)
envoy: Clarify legacy UpdateEnvoyResources (Backport PR #48213, Upstream PR #48066, @jrajahalme)
Fix (eBPF): Pointer-to-Pointer Misuse in IPv6 Trace Notifications (Backport PR #48350, Upstream PR #47908, @weizhoublue)
Fix Component Overview doc link rendering (Backport PR #48634, Upstream PR #48537, @eneiss)
fix(deps): update k8s.io patch updates stable to v0.36.4 (v1.20) (#48118, @cilium-renovate[bot])
fix(deps): update module google.golang.org/grpc to v1.83.1 [security] (v1.20) (#48388, @cilium-renovate[bot])
fix(deps): update module sigs.k8s.io/gateway-api/conformance to v1.6.2 (v1.20) (#48676, @cilium-renovate[bot])
Fixed broken Slack link on Community page. (Backport PR #48418, Upstream PR #48021, @ps-mir)
Fixes: Update node-cache image version to 1.26.5 (Backport PR #48634, Upstream PR #48270, @zyue110026)
gateway-api: avoid logging missing GatewayClass as error (Backport PR #48581, Upstream PR #48529, @mhofstetter)
gateway-api: deduplicate condition merge helpers (Backport PR #48581, Upstream PR #48122, @mhofstetter)
gateway-api: extract BackendTLSPolicy status handling into BackendTLSPolicyStatusManager (Backport PR #48581, Upstream PR #48068, @mhofstetter)
gateway-api: extract gateway address status handling (Backport PR #48581, Upstream PR #48129, @mhofstetter)
gateway-api: extract index & load functionality from controller / reconcile (Backport PR #48581, Upstream PR #47837, @mhofstetter)
gateway-api: extract listener status handling (Backport PR #48581, Upstream PR #48103, @mhofstetter)
gateway-api: extract route status handling into RouteStatusManager (Backport PR #48581, Upstream PR #48023, @mhofstetter)
gateway-api: make gateway-api reconciler client and scheme fields private (Backport PR #48581, Upstream PR #48191, @mhofstetter)
gateway-api: only load referenced services & serviceimports (Backport PR #48581, Upstream PR #48469, @mhofstetter)
gateway-api: put ctx first in route status API (Backport PR #48581, Upstream PR #48074, @mhofstetter)
gateway-api: remove duplicate gateway reconcile error logs (Backport PR #48581, Upstream PR #48186, @mhofstetter)
gateway-api: remove Gateway LBIPAM annotation warning (Backport PR #48581, Upstream PR #48187, @mhofstetter)
gateway-api: remove pre-filtered namespaces concept (Backport PR #48581, Upstream PR #47685, @asauber)
gha/lint-ariane-config: let Renovate manage the Go version (Backport PR #48550, Upstream PR #48467, @aanm)
gha: authenticate release images with OIDC (Backport PR #48599, Upstream PR #48062, @aanm)
gha: authenticate stable Image CI to quay.io with OIDC (Backport PR #48060, Upstream PR #48061, @aanm)
gha: correct and move the OIDC subject comments (Backport PR #48060, Upstream PR #48370, @aanm)
gha: raise the Docker Hub OIDC token lifetime for release builds (Backport PR #48599, Upstream PR #48535, @aanm)
helm: add general busybox image values for substitution (Backport PR #48418, Upstream PR #47973, @0xch4z)
vendor: Bump StateDB to v0.8.4 (#48248, @joamaki)

Other Changes:

[v1.20] bpf: Force-align IPv4 CT tuples used by revSNAT memcpy() (#48395, @julianwiedmann)
install: Update image digests for v1.20.1 (#48039, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01
quay.io/cilium/cilium:stable@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.2@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce
quay.io/cilium/clustermesh-apiserver:stable@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce

hubble-relay

quay.io/cilium/hubble-relay:v1.20.2@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f
quay.io/cilium/hubble-relay:stable@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.2@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38
quay.io/cilium/operator-alibabacloud:stable@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38

operator-aws

quay.io/cilium/operator-aws:v1.20.2@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3
quay.io/cilium/operator-aws:stable@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3

operator-azure

quay.io/cilium/operator-azure:v1.20.2@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a
quay.io/cilium/operator-azure:stable@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a

operator-generic

quay.io/cilium/operator-generic:v1.20.2@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc
quay.io/cilium/operator-generic:stable@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc

operator

quay.io/cilium/operator:v1.20.2@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c
quay.io/cilium/operator:stable@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | patch | `1.20.1` -> `1.20.2` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.20.2`](https://github.com/cilium/cilium/releases/tag/v1.20.2): 1.20.2 [Compare Source](https://github.com/cilium/cilium/compare/1.20.1...1.20.2) ## Summary of Changes **Minor Changes:** - gateway-api: node label selector for when hostNetwork is enabled (Backport PR [#48636](https://github.com/cilium/cilium/issues/48636), Upstream PR [#47463](https://github.com/cilium/cilium/issues/47463), [@xtineskim](https://github.com/xtineskim)) **Bugfixes:** - aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48125](https://github.com/cilium/cilium/issues/48125), [@41ks](https://github.com/41ks)) - aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48193](https://github.com/cilium/cilium/issues/48193), [@41ks](https://github.com/41ks)) - bpf: Fix agent crash when dumping map events (Backport PR [#48378](https://github.com/cilium/cilium/issues/48378), Upstream PR [#48273](https://github.com/cilium/cilium/issues/48273), [@joestringer](https://github.com/joestringer)) - bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48407](https://github.com/cilium/cilium/issues/48407), [@41ks](https://github.com/41ks)) - Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48262](https://github.com/cilium/cilium/issues/48262), [@giorio94](https://github.com/giorio94)) - datapath/linux/config: fix IPV4\_DIRECT\_ROUTING selection on lo device (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#46861](https://github.com/cilium/cilium/issues/46861), [@fdomain](https://github.com/fdomain)) - endpoint: preserve concurrent policy updates for new endpoints (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48195](https://github.com/cilium/cilium/issues/48195), [@jrajahalme](https://github.com/jrajahalme)) - ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47034](https://github.com/cilium/cilium/issues/47034), [@41ks](https://github.com/41ks)) - Fix a pod created immediately after a network policy change reporting a stale policy revision for up to two minutes. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#47642](https://github.com/cilium/cilium/issues/47642), [@aanm](https://github.com/aanm)) - Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association (Backport PR [#48024](https://github.com/cilium/cilium/issues/48024), Upstream PR [#47874](https://github.com/cilium/cilium/issues/47874), [@bryanhorstmann](https://github.com/bryanhorstmann)) - Fix BGP `defaultGateway` peer auto-discovery selecting a default route from a non-main routing table, such as the `default via cilium_host` route Cilium installs in the from-proxy table, instead of the node's real default gateway. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#47971](https://github.com/cilium/cilium/issues/47971), [@ecbaldwin](https://github.com/ecbaldwin)) - Fix bug where identities may linger for double the amount of the expected time (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48032](https://github.com/cilium/cilium/issues/48032), [@christarazi](https://github.com/christarazi)) - Fix dropping traffic L2Announcement with externalTrafficPolicy: Local (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#46399](https://github.com/cilium/cilium/issues/46399), [@yuito-it](https://github.com/yuito-it)) - Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. (Backport PR [#48017](https://github.com/cilium/cilium/issues/48017), Upstream PR [#47943](https://github.com/cilium/cilium/issues/47943), [@taaahaaa](https://github.com/taaahaaa)) - Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. (Backport PR [#48017](https://github.com/cilium/cilium/issues/48017), Upstream PR [#47929](https://github.com/cilium/cilium/issues/47929), [@shreyasrajiv327](https://github.com/shreyasrajiv327)) - Fix Hubble Relay remains running during termination (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#47942](https://github.com/cilium/cilium/issues/47942), [@xandau](https://github.com/xandau)) - Fix ICMP error packet handling by adding the missing checksum recalculation performed during NAT for SNATed load-balanced traffic. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48086](https://github.com/cilium/cilium/issues/48086), [@julianwiedmann](https://github.com/julianwiedmann)) - Fix IPv6 Router Solicitations and Router Advertisements being dropped with "Unsupported protocol for NAT masquerade" on nodes whose BPF masquerade address is a link-local address. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48094](https://github.com/cilium/cilium/issues/48094), [@ecbaldwin](https://github.com/ecbaldwin)) - Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48391](https://github.com/cilium/cilium/issues/48391), [@fristonio](https://github.com/fristonio)) - Fix multiple regressions in Cilium LocalRedirectPolicy (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#46638](https://github.com/cilium/cilium/issues/46638), [@ajmmm](https://github.com/ajmmm)) - Fix node-init startup on GKE 1.36.2-gke.2064000 nodes by detecting GKE from the kubelet path instead of container runtime configuration. (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47945](https://github.com/cilium/cilium/issues/47945), [@dlanov](https://github.com/dlanov)) - Fix nodeport egress tuple reuse for closed connections (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48306](https://github.com/cilium/cilium/issues/48306), [@fristonio](https://github.com/fristonio)) - Fix restored ENI endpoints routing rule configuration when masquerading config changes ([#48417](https://github.com/cilium/cilium/issues/48417), [@fristonio](https://github.com/fristonio)) - fix(envoyconfig): retry port allocation on duplicate-address rejections (Backport PR [#48735](https://github.com/cilium/cilium/issues/48735), Upstream PR [#48624](https://github.com/cilium/cilium/issues/48624), [@kokhlo](https://github.com/kokhlo)) - Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47915](https://github.com/cilium/cilium/issues/47915), [@giorio94](https://github.com/giorio94)) - Fixed a cilium-agent crash (`fatal error: concurrent map iteration and map write`) when an endpoint's policy was recomputed while incremental policy map changes were applied concurrently. Most commonly triggered by named-port policies under pod churn. (Backport PR [#48735](https://github.com/cilium/cilium/issues/48735), Upstream PR [#48098](https://github.com/cilium/cilium/issues/48098), [@nashant](https://github.com/nashant)) - Fixed five configuration options that were accepted but silently ignored: `vtep-sync-interval`, `enable-xt-socket-fallback`, `eni-delete-on-termination` with a custom CNI configuration, the `enableIdentityMark` Helm value outside CNI chaining mode, and `lb-retry-backoff-max`. (Backport PR [#48434](https://github.com/cilium/cilium/issues/48434), Upstream PR [#47635](https://github.com/cilium/cilium/issues/47635), [@aanm](https://github.com/aanm)) - Fixes a bug where clusters originally created in v1.15 or earlier failed to upgrade due to dropping the CRD version CiliumNodeConfig v2alpha1. (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48087](https://github.com/cilium/cilium/issues/48087), [@squeed](https://github.com/squeed)) - Fragmented UDP packets were potentially mis-classified as Cilium Wireguard traffic. (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48139](https://github.com/cilium/cilium/issues/48139), [@julianwiedmann](https://github.com/julianwiedmann)) - gateway-api: fix listener programmed status update (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48013](https://github.com/cilium/cilium/issues/48013), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: propgate listenerset status update errors (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48130](https://github.com/cilium/cilium/issues/48130), [@mhofstetter](https://github.com/mhofstetter)) - hubble: fix four config knobs that never reach their sink (Backport PR [#48434](https://github.com/cilium/cilium/issues/48434), Upstream PR [#47637](https://github.com/cilium/cilium/issues/47637), [@aanm](https://github.com/aanm)) - Improve reliability for fast recovery of disrupted TCP connections that access a DSR-enabled Service. (Backport PR [#48465](https://github.com/cilium/cilium/issues/48465), Upstream PR [#48254](https://github.com/cilium/cilium/issues/48254), [@julianwiedmann](https://github.com/julianwiedmann)) - lb (fix): require active state for backend when using topology hints (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#47054](https://github.com/cilium/cilium/issues/47054), [@CarrySauce](https://github.com/CarrySauce)) - nodediscovery: Reduced EC2 IMDS load and made ENI node registration more resilient by fetching the instance metadata once instead of on every CiliumNode update. (Backport PR [#48603](https://github.com/cilium/cilium/issues/48603), Upstream PR [#48218](https://github.com/cilium/cilium/issues/48218), [@41ks](https://github.com/41ks)) - operator/ipam: Restore fatal exit when the IPAM node watcher fails (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47778](https://github.com/cilium/cilium/issues/47778), [@HadrienPatte](https://github.com/HadrienPatte)) - Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48015](https://github.com/cilium/cilium/issues/48015), [@giorio94](https://github.com/giorio94)) - The BPF NAT engine now drops ICMP error packets which contain a fragmented TCP/UDP/SCTP packet. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48174](https://github.com/cilium/cilium/issues/48174), [@julianwiedmann](https://github.com/julianwiedmann)) - When using DSR with --bpf-lb-dsr-dispatch set to "opt" or "geneve" in combination with --enable-pmtu-discovery, fix the outer source IP of the ICMP error message which is generated when a forwarded DSR request exceeds the network interface's MTU. (Backport PR [#48114](https://github.com/cilium/cilium/issues/48114), Upstream PR [#48053](https://github.com/cilium/cilium/issues/48053), [@julianwiedmann](https://github.com/julianwiedmann)) **CI Changes:** - \[v1.20] golangci-lint: Do not run the modernize linter ([#48398](https://github.com/cilium/cilium/issues/48398), [@aanm](https://github.com/aanm)) - .github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48462](https://github.com/cilium/cilium/issues/48462), [@joestringer](https://github.com/joestringer)) - BPF: Refactor nat tests to use scapy fixtures and add checksum coverage (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47222](https://github.com/cilium/cilium/issues/47222), [@tommyp1ckles](https://github.com/tommyp1ckles)) - bpf: tests: fix up prog type in ipv6\_test (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47736](https://github.com/cilium/cilium/issues/47736), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: tests: use PROG\_TYPE (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47714](https://github.com/cilium/cilium/issues/47714), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: tests: validate CT entry for DSR connection (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48219](https://github.com/cilium/cilium/issues/48219), [@julianwiedmann](https://github.com/julianwiedmann)) - ci: replace unsupported LLVM installation action (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#47776](https://github.com/cilium/cilium/issues/47776), [@bogdankrasko](https://github.com/bogdankrasko)) - ci: resolve renovate PR metadata in base image workflows (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47964](https://github.com/cilium/cilium/issues/47964), [@mhofstetter](https://github.com/mhofstetter)) - ci: stop asking a PHP app for the AKS runner IP (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48371](https://github.com/cilium/cilium/issues/48371), [@aanm](https://github.com/aanm)) - ci: use GitHub App client ID in v1.20 image workflow (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47787](https://github.com/cilium/cilium/issues/47787), [@bogdankrasko](https://github.com/bogdankrasko)) - datapath/loader: fix missing complexity coverage for enable\_identity\_mark (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48037](https://github.com/cilium/cilium/issues/48037), [@tklauser](https://github.com/tklauser)) - gh: verifier: test PR branch before base branch (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#47928](https://github.com/cilium/cilium/issues/47928), [@julianwiedmann](https://github.com/julianwiedmann)) - gha/conformance-aks: add a timeout to the cluster create step (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48545](https://github.com/cilium/cilium/issues/48545), [@aanm](https://github.com/aanm)) - gha/conformance-aks: give the nodes a 64 GiB OS disk (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48481](https://github.com/cilium/cilium/issues/48481), [@aanm](https://github.com/aanm)) - gha/kubespray: don't wait for CoreDNS before Cilium is installed (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48048](https://github.com/cilium/cilium/issues/48048), [@aanm](https://github.com/aanm)) - gha: bound the LLVM prereq apt step with a 5m timeout (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48069](https://github.com/cilium/cilium/issues/48069), [@aanm](https://github.com/aanm)) - gha: compute the ginkgo cache key once, before the matrix (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48127](https://github.com/cilium/cilium/issues/48127), [@aanm](https://github.com/aanm)) - gha: move GCP auth pin past the STS token exchange retry fix (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48352](https://github.com/cilium/cilium/issues/48352), [@aanm](https://github.com/aanm)) - gha: publish the external target hostnames as FQDNs (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48478](https://github.com/cilium/cilium/issues/48478), [@aanm](https://github.com/aanm)) - gha: stop JUnit reports being destroyed by same-name legs (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48203](https://github.com/cilium/cilium/issues/48203), [@aanm](https://github.com/aanm)) - logging: downgrade canceled response-body reads to info (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48202](https://github.com/cilium/cilium/issues/48202), [@aanm](https://github.com/aanm)) - Makefile: Order the bpf codegen ahead of the Go builds (Backport PR [#48735](https://github.com/cilium/cilium/issues/48735), Upstream PR [#48644](https://github.com/cilium/cilium/issues/48644), [@aanm](https://github.com/aanm)) - Revert 48441 - disable local accounts on AKS clusters ([#48524](https://github.com/cilium/cilium/issues/48524), [@aanm](https://github.com/aanm)) - test(bpf): parallelize eBPF test execution (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47427](https://github.com/cilium/cilium/issues/47427), [@lconnery](https://github.com/lconnery)) - test/k8s: wait for the L7 visibility policy to be realized (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48365](https://github.com/cilium/cilium/issues/48365), [@aanm](https://github.com/aanm)) - test: fix the never-taken retry on a partially read JSON line (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#48190](https://github.com/cilium/cilium/issues/48190), [@aanm](https://github.com/aanm)) - tools: complexity: de-couple StackDepth from kernel version (Backport PR [#48200](https://github.com/cilium/cilium/issues/48200), Upstream PR [#48236](https://github.com/cilium/cilium/issues/48236), [@julianwiedmann](https://github.com/julianwiedmann)) - workflows: disable local accounts on AKS clusters ([#48441](https://github.com/cilium/cilium/issues/48441), [@nbusseneau](https://github.com/nbusseneau)) **Misc Changes:** - Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#48421](https://github.com/cilium/cilium/issues/48421), [@0xch4z](https://github.com/0xch4z)) - bpf/lib/nat: rename icmpoff (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#47797](https://github.com/cilium/cilium/issues/47797), [@tommyp1ckles](https://github.com/tommyp1ckles)) - bpf: dsr: use eth\_store\_proto() in dsr\_reply\_icmp\*() (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47392](https://github.com/cilium/cilium/issues/47392), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: icmp\*: fix up sample length (Backport PR [#48114](https://github.com/cilium/cilium/issues/48114), Upstream PR [#48020](https://github.com/cilium/cilium/issues/48020), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: misc cleanups (Backport PR [#48350](https://github.com/cilium/cilium/issues/48350), Upstream PR [#47879](https://github.com/cilium/cilium/issues/47879), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (Backport PR [#48284](https://github.com/cilium/cilium/issues/48284), Upstream PR [#46232](https://github.com/cilium/cilium/issues/46232), [@julianwiedmann](https://github.com/julianwiedmann)) - bpf: Reduce stack usage of send\_trace\_notify (Backport PR [#48350](https://github.com/cilium/cilium/issues/48350), Upstream PR [#47911](https://github.com/cilium/cilium/issues/47911), [@joamaki](https://github.com/joamaki)) - chore(deps): update all external docker images dependencies (v1.20) (patch) ([#48147](https://github.com/cilium/cilium/issues/48147), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all external docker images dependencies to v0.13.6 (v1.20) ([#48673](https://github.com/cilium/cilium/issues/48673), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#48326](https://github.com/cilium/cilium/issues/48326), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#48506](https://github.com/cilium/cilium/issues/48506), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#48677](https://github.com/cilium/cilium/issues/48677), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#48149](https://github.com/cilium/cilium/issues/48149), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#48325](https://github.com/cilium/cilium/issues/48325), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#48619](https://github.com/cilium/cilium/issues/48619), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.20) ([#48327](https://github.com/cilium/cilium/issues/48327), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.20) ([#48672](https://github.com/cilium/cilium/issues/48672), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency bufbuild/buf to v1.73.0 (v1.20) ([#48729](https://github.com/cilium/cilium/issues/48729), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.20) ([#48344](https://github.com/cilium/cilium/issues/48344), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.20) ([#48505](https://github.com/cilium/cilium/issues/48505), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency semver to v3.1.0 (v1.20) ([#48730](https://github.com/cilium/cilium/issues/48730), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.20) ([#48517](https://github.com/cilium/cilium/issues/48517), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update google/cloud-sdk docker tag to v581 (v1.20) ([#48150](https://github.com/cilium/cilium/issues/48150), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update helm/kind-action action to v1.15.0 (v1.20) ([#48591](https://github.com/cilium/cilium/issues/48591), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1787987562-ac0b61a4c0a45670a3654448d53bd6416b948f62 (v1.20) ([#48323](https://github.com/cilium/cilium/issues/48323), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.20) ([#48451](https://github.com/cilium/cilium/issues/48451), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.20) ([#48674](https://github.com/cilium/cilium/issues/48674), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#48148](https://github.com/cilium/cilium/issues/48148), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#48324](https://github.com/cilium/cilium/issues/48324), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#48504](https://github.com/cilium/cilium/issues/48504), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#48675](https://github.com/cilium/cilium/issues/48675), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - ci: disable TCP/UDPRouteWeightedRouting gateway-api conformance tests (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48375](https://github.com/cilium/cilium/issues/48375), [@0xch4z](https://github.com/0xch4z)) - datapath: move some feature probes into BPF (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47737](https://github.com/cilium/cilium/issues/47737), [@julianwiedmann](https://github.com/julianwiedmann)) - docs: fix extra closing parenthesis in hive.rst (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#48541](https://github.com/cilium/cilium/issues/48541), [@logi74123](https://github.com/logi74123)) - docs: Improve build process (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#47751](https://github.com/cilium/cilium/issues/47751), [@joestringer](https://github.com/joestringer)) - docs: remove outdated tip about disabling hubble before enabling UI (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#48487](https://github.com/cilium/cilium/issues/48487), [@ekoops](https://github.com/ekoops)) - docs: Remove v1.18 ipsec documentation (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48224](https://github.com/cilium/cilium/issues/48224), [@joestringer](https://github.com/joestringer)) - docs: Update kernel config requirements (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#48594](https://github.com/cilium/cilium/issues/48594), [@pchaigno](https://github.com/pchaigno)) - Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48428](https://github.com/cilium/cilium/issues/48428), [@marcus-chae](https://github.com/marcus-chae)) - Documentation: document mesh security model (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#47912](https://github.com/cilium/cilium/issues/47912), [@bimmlerd](https://github.com/bimmlerd)) - envoy: Clarify legacy UpdateEnvoyResources (Backport PR [#48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#48066](https://github.com/cilium/cilium/issues/48066), [@jrajahalme](https://github.com/jrajahalme)) - Fix (eBPF): Pointer-to-Pointer Misuse in IPv6 Trace Notifications (Backport PR [#48350](https://github.com/cilium/cilium/issues/48350), Upstream PR [#47908](https://github.com/cilium/cilium/issues/47908), [@weizhoublue](https://github.com/weizhoublue)) - Fix Component Overview doc link rendering (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#48537](https://github.com/cilium/cilium/issues/48537), [@eneiss](https://github.com/eneiss)) - fix(deps): update k8s.io patch updates stable to v0.36.4 (v1.20) ([#48118](https://github.com/cilium/cilium/issues/48118), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module google.golang.org/grpc to v1.83.1 \[security] (v1.20) ([#48388](https://github.com/cilium/cilium/issues/48388), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module sigs.k8s.io/gateway-api/conformance to v1.6.2 (v1.20) ([#48676](https://github.com/cilium/cilium/issues/48676), [@cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Fixed broken Slack link on Community page. (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#48021](https://github.com/cilium/cilium/issues/48021), [@ps-mir](https://github.com/ps-mir)) - Fixes: Update node-cache image version to 1.26.5 (Backport PR [#48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#48270](https://github.com/cilium/cilium/issues/48270), [@zyue110026](https://github.com/zyue110026)) - gateway-api: avoid logging missing GatewayClass as error (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48529](https://github.com/cilium/cilium/issues/48529), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: deduplicate condition merge helpers (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48122](https://github.com/cilium/cilium/issues/48122), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract BackendTLSPolicy status handling into BackendTLSPolicyStatusManager (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48068](https://github.com/cilium/cilium/issues/48068), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract gateway address status handling (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48129](https://github.com/cilium/cilium/issues/48129), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract index & load functionality from controller / reconcile (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#47837](https://github.com/cilium/cilium/issues/47837), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract listener status handling (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48103](https://github.com/cilium/cilium/issues/48103), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract route status handling into RouteStatusManager (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48023](https://github.com/cilium/cilium/issues/48023), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: make gateway-api reconciler client and scheme fields private (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48191](https://github.com/cilium/cilium/issues/48191), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: only load referenced services & serviceimports (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48469](https://github.com/cilium/cilium/issues/48469), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: put ctx first in route status API (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48074](https://github.com/cilium/cilium/issues/48074), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: remove duplicate gateway reconcile error logs (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48186](https://github.com/cilium/cilium/issues/48186), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: remove Gateway LBIPAM annotation warning (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#48187](https://github.com/cilium/cilium/issues/48187), [@mhofstetter](https://github.com/mhofstetter)) - gateway-api: remove pre-filtered namespaces concept (Backport PR [#48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#47685](https://github.com/cilium/cilium/issues/47685), [@asauber](https://github.com/asauber)) - gha/lint-ariane-config: let Renovate manage the Go version (Backport PR [#48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#48467](https://github.com/cilium/cilium/issues/48467), [@aanm](https://github.com/aanm)) - gha: authenticate release images with OIDC (Backport PR [#48599](https://github.com/cilium/cilium/issues/48599), Upstream PR [#48062](https://github.com/cilium/cilium/issues/48062), [@aanm](https://github.com/aanm)) - gha: authenticate stable Image CI to quay.io with OIDC (Backport PR [#48060](https://github.com/cilium/cilium/issues/48060), Upstream PR [#48061](https://github.com/cilium/cilium/issues/48061), [@aanm](https://github.com/aanm)) - gha: correct and move the OIDC subject comments (Backport PR [#48060](https://github.com/cilium/cilium/issues/48060), Upstream PR [#48370](https://github.com/cilium/cilium/issues/48370), [@aanm](https://github.com/aanm)) - gha: raise the Docker Hub OIDC token lifetime for release builds (Backport PR [#48599](https://github.com/cilium/cilium/issues/48599), Upstream PR [#48535](https://github.com/cilium/cilium/issues/48535), [@aanm](https://github.com/aanm)) - helm: add general busybox image values for substitution (Backport PR [#48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#47973](https://github.com/cilium/cilium/issues/47973), [@0xch4z](https://github.com/0xch4z)) - vendor: Bump StateDB to v0.8.4 ([#48248](https://github.com/cilium/cilium/issues/48248), [@joamaki](https://github.com/joamaki)) **Other Changes:** - \[v1.20] bpf: Force-align IPv4 CT tuples used by revSNAT memcpy() ([#48395](https://github.com/cilium/cilium/issues/48395), [@julianwiedmann](https://github.com/julianwiedmann)) - install: Update image digests for v1.20.1 ([#48039](https://github.com/cilium/cilium/issues/48039), [@cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01` `quay.io/cilium/cilium:stable@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.2@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce` `quay.io/cilium/clustermesh-apiserver:stable@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.2@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f` `quay.io/cilium/hubble-relay:stable@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.2@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38` `quay.io/cilium/operator-alibabacloud:stable@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.2@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3` `quay.io/cilium/operator-aws:stable@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.2@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a` `quay.io/cilium/operator-azure:stable@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.2@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc` `quay.io/cilium/operator-generic:stable@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc` ##### operator `quay.io/cilium/operator:v1.20.2@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c` `quay.io/cilium/operator:stable@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c` </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovatebot added 1 commit

2026-09-16 00:04:05 -04:00

chore(deps): update helm release cilium to v1.20.2

Notify Mattermost on Renovate PR Merge / notify (pull_request) Successful in 1s

Details

8e9016464a

renovatebot scheduled this pull request to auto merge when all checks succeed

2026-09-16 00:04:06 -04:00

renovatebot merged commit fc4d8e5c07 into main

2026-09-16 20:44:55 -04:00

renovatebot deleted branch renovate/cilium-1.x

2026-09-16 20:44:55 -04:00

renovatebot referenced this pull request from a commit

2026-09-16 20:44:56 -04:00

Merge pull request 'chore(deps): update helm release cilium to v1.20.2' (#84) from renovate/cilium-1.x into main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

smig/nuc-talos!84

No description provided.

Rows
Columns

chore(deps): update helm release cilium to v1.20.2 #84

Release Notes

v1.20.2: 1.20.2

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

Configuration

`v1.20.2`: 1.20.2