chore(deps): Update Helm release cilium to v1.20.4 #104

Merged

jakman85 merged 1 commits from renovate/cilium-1.x into main 2026-11-07 03:07:19 +00:00

Conversation 0 Commits 1 Files Changed 1

+1 -1

renovate-bot commented 2026-11-02 08:16:05 +00:00

Collaborator

Copy link

Copy source

This PR contains the following updates:

Package	Update	Change
cilium (source)	patch	1.20.1 → 1.20.4

---

Release Notes

cilium/cilium (cilium)

v1.20.4: 1.20.4

Compare Source

Security patch release

Out-of-band security patch release to fix CVE-2026-111943 (golang/go#82345): upgrades Go to 1.26.10 so that the compromised eMudhra intermediate CA certificates are no longer trusted, and updates all dependencies to their latest patch versions.

Summary of Changes

Minor Changes:

• alibabacloud: support RRSA (RAM Roles for Service Accounts) credentials in the IPAM allocator, alongside static AccessKeys and ECS instance RAM roles (Backport PR #​49474, Upstream PR #​49093, @​4n4nd)

Bugfixes:

• Allow wildcard CIDR selectors to match nodes when --policy-cidr-match-mode=nodes is configured (Backport PR #​49474, Upstream PR #​47828, @​TheBeeZee)
• bpf: nat: fix outer ICMP checksum for ICMP/SCTP NAT error packets (Backport PR #​49474, Upstream PR #​48819, @​fds7280)
• CiliumEnvoyConfig now only redirects Services in its own namespace, as documented; service references in CiliumClusterwideEnvoyConfig without a namespace default to "default" again. (Backport PR #​49474, Upstream PR #​49076, @​maxskokov)
• datapath: Fix NAT46x64 gateway prefix conversion panic (Backport PR #​49474, Upstream PR #​49177, @​HadrienPatte)
• Fix an issue where terminating backends were evicted from BPF maps when trafficDistribution was enabled. (Backport PR #​49474, Upstream PR #​48349, @​taesung320)
• Fix invalid L4 checksum on IPv6 ClusterIP reverse NAT for CHECKSUM_PARTIAL packets on kernels < 6.12, affecting the case when packets are bridged/tunneled from the client pod to a remote host (Backport PR #​49474, Upstream PR #​49204, @​liuyuan10)
• Fix regression in Cilium 1.20.3 where the Gateway API implementation would incorrectly handle BackendTLSPolicy configurations, leading to high Cilium CPU usage and inability to forward traffic. (Backport PR #​49568, Upstream PR #​49525, @​youngnick)
• Fixes an issue in LBIPAM where on service upsert, if IP allocations are not changed the sharing index is not updated. (Backport PR #​49474, Upstream PR #​48938, @​0xch4z)
• nodediscovery: in IPAM ENI and Azure modes the operator now treats nodes as running in multi-pool mode from the very first event. (Backport PR #​49390, Upstream PR #​49242, @​41ks)
• Reduce transient DNS SERVFAIL/REFUSED for pods that query immediately at startup by pushing/applying Standalone DNS Proxy policy snapshots more frequently (Backport PR #​49474, Upstream PR #​49112, @​QxBytes)
• Remove the unused pebble binary from the cilium image to clear its Go standard library vulnerability findings. (Backport PR #​49474, Upstream PR #​49380, @​aanm)

CI Changes:

• [v1.20] ci: ignore transient xDS mode drift during downgrade (#​49515, @​jrajahalme)
• ci: Pass the auto-committer secrets to the base images workflow (Backport PR #​49467, Upstream PR #​49453, @​aanm)
• renovate: Open one trusted PR per branch (Backport PR #​49416, Upstream PR #​49381, @​aanm)

Misc Changes:

• chore(deps): update auto-merge-trusted-deps (v1.20) (#​49319, @​cilium-renovate[bot])
• chore(deps): update auto-merge-trusted-deps (v1.20) (#​49445, @​cilium-renovate[bot])
• chore(deps): update dependency sphinxcontrib-openapi to v0.10.0 (v1.20) (#​49438, @​cilium-renovate[bot])
• clarify co sign documentation to use minimum version to verify signing key (Backport PR #​49474, Upstream PR #​49401, @​mfahlandt)
• Fix Envoy xDS listener handling across restoration, address changes, and rejected updates (Backport PR #​49383, Upstream PR #​48897, @​jrajahalme)

Other Changes:

• install: Update image digests for v1.20.3 (#​49392, @​cilium-release-bot[bot])
• route-reconciler: add prune exclusion logic and use it in the linuxNodeHandler (#​49170, @​andreaterzolo)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.4@sha256:20fe92e4c86641233a450098c158d2d29085f3419931ab6bf681d2485dedf16e
quay.io/cilium/cilium:stable@sha256:20fe92e4c86641233a450098c158d2d29085f3419931ab6bf681d2485dedf16e

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.4@sha256:aeac78ae77d166b86630310f2eb53fbc92014eda36ada8e6b2d7f2b8f2dadbfa
quay.io/cilium/clustermesh-apiserver:stable@sha256:aeac78ae77d166b86630310f2eb53fbc92014eda36ada8e6b2d7f2b8f2dadbfa

hubble-relay

quay.io/cilium/hubble-relay:v1.20.4@sha256:cb23408209697ed30d2bc462e1f01eb622ea4423a891458f78bc88d7255bbfc1
quay.io/cilium/hubble-relay:stable@sha256:cb23408209697ed30d2bc462e1f01eb622ea4423a891458f78bc88d7255bbfc1

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.4@sha256:163a08ee4438780638899742e95521e1a37edeb676c6e5c924d320c4c0bd09ad
quay.io/cilium/operator-alibabacloud:stable@sha256:163a08ee4438780638899742e95521e1a37edeb676c6e5c924d320c4c0bd09ad

operator-aws

quay.io/cilium/operator-aws:v1.20.4@sha256:caab27c6e3286a596d502f76aa6cffe2efab6e8a92234a0d10d2eed3eda85c7c
quay.io/cilium/operator-aws:stable@sha256:caab27c6e3286a596d502f76aa6cffe2efab6e8a92234a0d10d2eed3eda85c7c

operator-azure

quay.io/cilium/operator-azure:v1.20.4@sha256:0669c35e9f1638bbdd6cf5c64163e7ee4ea4ef440e223050e60665811369b4ec
quay.io/cilium/operator-azure:stable@sha256:0669c35e9f1638bbdd6cf5c64163e7ee4ea4ef440e223050e60665811369b4ec

operator-generic

quay.io/cilium/operator-generic:v1.20.4@sha256:7a7a3489dc66ad67e420d285c8a8d2e169b0957ad15e120f593d27081bf38d82
quay.io/cilium/operator-generic:stable@sha256:7a7a3489dc66ad67e420d285c8a8d2e169b0957ad15e120f593d27081bf38d82

operator

quay.io/cilium/operator:v1.20.4@sha256:f94e9812f191e0c31b5cfe6cb1f38f5c349d4f159f2030e621d179d826257263
quay.io/cilium/operator:stable@sha256:f94e9812f191e0c31b5cfe6cb1f38f5c349d4f159f2030e621d179d826257263

v1.20.3: 1.20.3

Compare Source

Summary of Changes

Minor Changes:

• alibabacloud: support IMDSv2 (token-based) instance metadata access (Backport PR #​49336, Upstream PR #​49182, @​4n4nd)
• Fix conntrack garbage collection deleting CT entries that the datapath reopened between the GC batch read and the delete, which could cascade into NAT mapping deletion and SNAT source-port reallocation for live connections. (Backport PR #​49119, Upstream PR #​46750, @​gyutaeb)
• operator: prevent CNPs with nodeSelector from silently enforcing nothing (Backport PR #​49173, Upstream PR #​47882, @​weizhoublue)

Bugfixes:

• azure: Fixed an issue where an interface with an empty MAC field would be reported back the the cilium agent causing it to crash on startup when trying to configure the routes. (Backport PR #​49336, Upstream PR #​48648, @​41ks)
• bpf: icmp: use 576 byte of inner packet to avoid partial csum floor (Backport PR #​48907, Upstream PR #​48578, @​tommyp1ckles)
• cilium-dbg: Print port numbers correctly for map cilium_lb*_reverse_sk (Backport PR #​49336, Upstream PR #​47134, @​jayl1e)
• daemon: fix a bug where L7 DNS policies could remain loaded in the datapath during agent shutdown, causing pods under a wildcard toFQDNs policy to lose DNS resolution for the duration of the restart. (Backport PR #​48907, Upstream PR #​48747, @​41ks)
• endpoint/restore: skip cleanup for reserved internal endpoints (Backport PR #​48999, Upstream PR #​48272, @​fristonio)
• envoy: handle listener additional address changes (Backport PR #​48917, Upstream PR #​48712, @​nezdolik)
• envoy: handle listener address changes in ADS (Backport PR #​48917, Upstream PR #​48798, @​nezdolik)
• envoy: track coalesced ADS snapshot updates (Backport PR #​48917, Upstream PR #​48631, @​nezdolik)
• Fix Gateway API ExternalAuth dropping request bodies when allowedResponseHeaders is unset (Backport PR #​49189, Upstream PR #​48770, @​kirgene)
• Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint (Backport PR #​49189, Upstream PR #​48905, @​fristonio)
• Fix ip6tables chain rename errors being silently ignored during iptables rule reconciliation. (Backport PR #​49336, Upstream PR #​49024, @​maxskokov)
• Fix panic in agent when CiliumLocalRedirectPolicy redirectBackend.toPorts is declared as an empty array. The agent will now reject such a policy. (Backport PR #​48907, Upstream PR #​48491, @​ajmmm)
• Fix PMTU/ICMP replies for IPIP/Geneve DSR for GRO skbs (Backport PR #​49189, Upstream PR #​48489, @​borkmann)
• Fix rare data race in selector cache that could lead to agent panic (Backport PR #​49189, Upstream PR #​47733, @​odinuge)
• Fix restoration of terminating backends. If a terminating backend become active again during restart the backend was incorrectly kept as quarantined. (Backport PR #​48797, Upstream PR #​48763, @​joamaki)
• Fixes a bug where Hubble flows may list the incorrect policy that allowed or denied a flow (Backport PR #​49189, Upstream PR #​49086, @​tsotne95)
• Fixes a bug where the helm value hubble.tls.auto.privateKey settings are no longer ignored in Hubble cert-manager certificates (Backport PR #​49189, Upstream PR #​49114, @​byxorna)
• Fixes an issue where CiliumCIDRGroups with zero-length cidrs (i.e. 0.0.0.0/0) inadvertently selected no traffic. (Backport PR #​49336, Upstream PR #​48366, @​squeed)
• gateway-api: filter CEC controls from infrastructure metadata (Backport PR #​48984, Upstream PR #​47732, @​nezdolik)
• gateway-api: make HTTP route ordering deterministic (Backport PR #​49336, Upstream PR #​48951, @​abduu11aahh)
• gateway-api: Support system CA certificates in BackendTLSPolicy. (Backport PR #​49336, Upstream PR #​48895, @​shreyasrajiv327)
• infraendpoints: Release the health IPv4 when the IPv6 allocation fails (Backport PR #​48907, Upstream PR #​48816, @​HadrienPatte)
• k8s/resource: fix leaked event finalizer on unobserved delete (Backport PR #​48907, Upstream PR #​48785, @​tklauser)
• L7 conformance CI fixes (Backport PR #​48999, Upstream PR #​47517, @​fristonio)
• operator: Do not emit warning when deleting already deleted unmanaged pod (Backport PR #​48907, Upstream PR #​48765, @​gandro)
• operator: fix metrics list default address to work on IPv6-only clusters with dual stack nodes by trying both IPv4 and IPv6 loopback addresses (Backport PR #​48907, Upstream PR #​48780, @​41ks)
• Set ipv6 routing rules when dual stack is enabled (Backport PR #​49336, Upstream PR #​49188, @​fcrespofastly)
• Sockets are no longer destroyed when a Service backend is terminated unless they are still connected to that backend. Unconnected UDP sockets, and sockets that have since disconnected or moved to another backend, used to have their local port silently changed. (Backport PR #​49189, Upstream PR #​48725, @​maxskokov)

CI Changes:

• [ci] fix escaping in conformance ginkgo (Backport PR #​49189, Upstream PR #​48991, @​nebril)
• [v1.20] .github: Remove the EKS cluster pool workflows (#​49084, @​aanm)
• ci: Add support for OIDC (Backport PR #​49317, Upstream PR #​49007, @​aanm)
• ci: cleanup disk space in documentation workflow (Backport PR #​48907, Upstream PR #​48427, @​tklauser)
• ci: Drop the empty floating tag line from CI image digests (Backport PR #​49189, Upstream PR #​49070, @​aanm)
• ci: fix CNI setup and readiness checks in the kubespray job (Backport PR #​49336, Upstream PR #​48927, @​aanm)
• ci: Give Envoy Embedded conformance a bigger runner (Backport PR #​49189, Upstream PR #​49018, @​aanm)
• ci: keep UDPRouteWeightedRouting skipped in the profile job (Backport PR #​49189, Upstream PR #​49005, @​aanm)
• ci: login to docker registry for downgrade image wait (Backport PR #​49189, Upstream PR #​48983, @​nebril)
• ci: Name runner variables after their Ubuntu release and let Renovate bump them (Backport PR #​49317, Upstream PR #​49065, @​aanm)
• ci: Skip redundant setup when base images already exist (Backport PR #​49317, Upstream PR #​47209, @​HadrienPatte)
• ci: Stop passing secrets to the base images workflow (Backport PR #​49317, Upstream PR #​49082, @​aanm)
• gha/conformance-multi-pool: use the local fake external targets (Backport PR #​48986, Upstream PR #​48558, @​aanm)
• gha/e2e-upgrade: gate the after-agent-restart conn-disrupt check (Backport PR #​48437, Upstream PR #​47440, @​aanm)
• gha/setup-aks-cluster: Retry a create that never starts (Backport PR #​49317, Upstream PR #​48924, @​aanm)
• gha: Derive the LVH package cache key once per run (Backport PR #​48986, Upstream PR #​48656, @​aanm)
• gha: don't fail PR tests on reporting errors (Backport PR #​49317, Upstream PR #​48740, @​aanm)
• gha: Grant id-token to the post-release call of release.yaml (Backport PR #​49317, Upstream PR #​49323, @​aanm)
• gha: make external fake targets image configurable (Backport PR #​49189, Upstream PR #​48941, @​giorio94)
• gha: Retry stalled kind image pulls before the install wait expires (Backport PR #​49336, Upstream PR #​48989, @​aanm)
• gha: Skip the duplicate CI image build on push to main (Backport PR #​48986, Upstream PR #​48736, @​aanm)
• gha: survive a GKE zone running out of capacity (Backport PR #​48986, Upstream PR #​48184, @​aanm)
• gha: Tolerate cosign and SBOM failures on pull requests (Backport PR #​48986, Upstream PR #​48737, @​aanm)
• ginkgo: remove Test NodePort with L7 policy tests (Backport PR #​49067, Upstream PR #​46499, @​smagnani96)
• loadbalancer/tests: Fix the graceful termination test restart (Backport PR #​49317, Upstream PR #​48939, @​aanm)
• Migrate Conformance Cluster Mesh workflow to use fake external targets (Backport PR #​48654, Upstream PR #​48250, @​giorio94)
• nodeinit: wait for the kubelet wrapper before writing the bootstrap file (Backport PR #​49189, Upstream PR #​48739, @​aanm)

Misc Changes:

• bpf: lxc: switch cilium_nodeport_nat_buffer to auxvar (Backport PR #​48741, Upstream PR #​48543, @​julianwiedmann)
• build: handle git worktrees in documentation make targets (Backport PR #​49189, Upstream PR #​48966, @​utaal)
• chore(deps): update all github action dependencies (v1.20) (#​48881, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#​49039, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#​49152, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#​49277, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#​48882, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#​49153, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#​49275, @​cilium-renovate[bot])
• chore(deps): update base-images to v1.26.9 (v1.20) (#​49262, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.20.1 (v1.20) (#​48978, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.31 (v1.20) (#​48788, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v36.2 (v1.20) (#​49038, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.38.0 docker digest to fd7dc98 (v1.20) (#​49035, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.8 docker digest to 0f063af (v1.20) (#​49149, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.8 docker digest to 6c2a553 (v1.20) (#​48879, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.9 docker digest to d772206 (v1.20) (#​49298, @​cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.7.2 (v1.20) (#​49036, @​cilium-renovate[bot])
• chore(deps): update helm/kind-action action to v1.15.1 (v1.20) (#​49289, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.4-1790671085-c3a2a1ff726f00f5b5c0886cab3ad345f97f35b9 (v1.20) (#​49111, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1790882336-b64c7306085409b95fb5626db2d2bb7a200b9432 (v1.20) (#​49123, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1791291190-5ec36181d464cd75b35b45395a722226cbdd2888 (v1.20) (#​49194, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791350265-ae0327a34850b7d1849e8332dbefd4d5bebabe10 (v1.20) (#​49216, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791537840-00e749f11f69334c625e53fc1ce2fc6c7f34a51f (v1.20) (#​49276, @​cilium-renovate[bot])
• chore(deps): update security updates to v1.45.0 [security] (v1.20) (#​48814, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#​48880, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#​49037, @​cilium-renovate[bot])
• ciliumendpointslice: Report no CID when the CEP has none (Backport PR #​49189, Upstream PR #​48933, @​aanm)
• connectivity-check: move echo-b to the lower NodePort band (Backport PR #​49189, Upstream PR #​48926, @​aanm)
• docs: note on eBPF ClusterIP translation vs Docker raw-table protection (Backport PR #​49189, Upstream PR #​47782, @​Verbano-Tech)
• envoy: add standalone NPDS unsubscribe regression test (Backport PR #​48917, Upstream PR #​47818, @​nezdolik)
• fix(deps): update k8s.io patch updates stable to v0.36.5 (v1.20) (#​49151, @​cilium-renovate[bot])
• fix(deps): update module golang.org/x/net to v0.60.0 [security] (v1.20) (#​49253, @​cilium-renovate[bot])
• fix(deps): update security updates [security] (v1.20) (#​48808, @​cilium-renovate[bot])
• gateway-api: centralize Gateway validation (Backport PR #​48907, Upstream PR #​48602, @​arybolovlev)
• loadbalancer/writer: add support for SetFrontendSourceRangesFunc (Backport PR #​49336, Upstream PR #​49068, @​0xch4z)

Other Changes:

• [v1.20] deps: update gateway api to v1.6.3 (#​49305, @​mhofstetter)
• [v1.20] node_neighbor_discovery: fix ID in delete query (#​48912, @​nobleess)
• [v1.20] routing: fix dual-stack ENI router startup with native routing CIDRs (#​48709, @​monta-riahi)
• install: Update image digests for v1.20.2 (#​48751, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.3@sha256:95cfa5c2427cc6b452c00908778d0566311f572589284af949d06a013db1a849
quay.io/cilium/cilium:stable@sha256:95cfa5c2427cc6b452c00908778d0566311f572589284af949d06a013db1a849

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.3@sha256:5c8dca0d0b77bb593df157be39f6c9c868dc08922bbd0540ac0a56815341b227
quay.io/cilium/clustermesh-apiserver:stable@sha256:5c8dca0d0b77bb593df157be39f6c9c868dc08922bbd0540ac0a56815341b227

hubble-relay

quay.io/cilium/hubble-relay:v1.20.3@sha256:c6f819d9c5e0b35ccac63b9f2f1ae213fd9be50588e15d5a444d5d305ad317b5
quay.io/cilium/hubble-relay:stable@sha256:c6f819d9c5e0b35ccac63b9f2f1ae213fd9be50588e15d5a444d5d305ad317b5

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.3@sha256:615f8c2995e437320571d6f61e623d6848ed3ea357cdaa886ac95bbff29a0b52
quay.io/cilium/operator-alibabacloud:stable@sha256:615f8c2995e437320571d6f61e623d6848ed3ea357cdaa886ac95bbff29a0b52

operator-aws

quay.io/cilium/operator-aws:v1.20.3@sha256:49bdd1d54bdf3da2740848c4662854d0d41c0df25cffe8575d71723db08cc0d1
quay.io/cilium/operator-aws:stable@sha256:49bdd1d54bdf3da2740848c4662854d0d41c0df25cffe8575d71723db08cc0d1

operator-azure

quay.io/cilium/operator-azure:v1.20.3@sha256:7132b3ff7e33a076ea9fadaa6e4f2b364937ed7b118b92928bdb4706921a2ffa
quay.io/cilium/operator-azure:stable@sha256:7132b3ff7e33a076ea9fadaa6e4f2b364937ed7b118b92928bdb4706921a2ffa

operator-generic

quay.io/cilium/operator-generic:v1.20.3@sha256:efdd8d89d6d8f63d21a065fa2f9e17614a2b3ac9371b221af9355f63829e2dbc
quay.io/cilium/operator-generic:stable@sha256:efdd8d89d6d8f63d21a065fa2f9e17614a2b3ac9371b221af9355f63829e2dbc

operator

quay.io/cilium/operator:v1.20.3@sha256:c40996c8a413f57db75715e683abc550e7849904aa20b8730822ba532f9b783c
quay.io/cilium/operator:stable@sha256:c40996c8a413f57db75715e683abc550e7849904aa20b8730822ba532f9b783c

v1.20.2: 1.20.2

Compare Source

Summary of Changes

Minor Changes:

• gateway-api: node label selector for when hostNetwork is enabled (Backport PR #​48636, Upstream PR #​47463, @​xtineskim)

Bugfixes:

• aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR #​48418, Upstream PR #​48125, @​41ks)
• aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #​48418, Upstream PR #​48193, @​41ks)
• bpf: Fix agent crash when dumping map events (Backport PR #​48378, Upstream PR #​48273, @​joestringer)
• bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (Backport PR #​48550, Upstream PR #​48407, @​41ks)
• Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (Backport PR #​48418, Upstream PR #​48262, @​giorio94)
• datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR #​48550, Upstream PR #​46861, @​fdomain)
• endpoint: preserve concurrent policy updates for new endpoints (Backport PR #​48213, Upstream PR #​48195, @​jrajahalme)
• ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. (Backport PR #​48213, Upstream PR #​47034, @​41ks)
• Fix a pod created immediately after a network policy change reporting a stale policy revision for up to two minutes. (Backport PR #​48418, Upstream PR #​47642, @​aanm)
• Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association (Backport PR #​48024, Upstream PR #​47874, @​bryanhorstmann)
• Fix BGP defaultGateway peer auto-discovery selecting a default route from a non-main routing table, such as the default via cilium_host route Cilium installs in the from-proxy table, instead of the node's real default gateway. (Backport PR #​48418, Upstream PR #​47971, @​ecbaldwin)
• Fix bug where identities may linger for double the amount of the expected time (Backport PR #​48418, Upstream PR #​48032, @​christarazi)
• Fix dropping traffic L2Announcement with externalTrafficPolicy: Local (Backport PR #​48550, Upstream PR #​46399, @​yuito-it)
• Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. (Backport PR #​48017, Upstream PR #​47943, @​taaahaaa)
• Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. (Backport PR #​48017, Upstream PR #​47929, @​shreyasrajiv327)
• Fix Hubble Relay remains running during termination (Backport PR #​48550, Upstream PR #​47942, @​xandau)
• Fix ICMP error packet handling by adding the missing checksum recalculation performed during NAT for SNATed load-balanced traffic. (Backport PR #​48418, Upstream PR #​48086, @​julianwiedmann)
• Fix IPv6 Router Solicitations and Router Advertisements being dropped with "Unsupported protocol for NAT masquerade" on nodes whose BPF masquerade address is a link-local address. (Backport PR #​48418, Upstream PR #​48094, @​ecbaldwin)
• Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR #​48418, Upstream PR #​48391, @​fristonio)
• Fix multiple regressions in Cilium LocalRedirectPolicy (Backport PR #​48634, Upstream PR #​46638, @​ajmmm)
• Fix node-init startup on GKE 1.36.2-gke.2064000 nodes by detecting GKE from the kubelet path instead of container runtime configuration. (Backport PR #​48213, Upstream PR #​47945, @​dlanov)
• Fix nodeport egress tuple reuse for closed connections (Backport PR #​48418, Upstream PR #​48306, @​fristonio)
• Fix restored ENI endpoints routing rule configuration when masquerading config changes (#​48417, @​fristonio)
• fix(envoyconfig): retry port allocation on duplicate-address rejections (Backport PR #​48735, Upstream PR #​48624, @​kokhlo)
• Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR #​48213, Upstream PR #​47915, @​giorio94)
• Fixed a cilium-agent crash (fatal error: concurrent map iteration and map write) when an endpoint's policy was recomputed while incremental policy map changes were applied concurrently. Most commonly triggered by named-port policies under pod churn. (Backport PR #​48735, Upstream PR #​48098, @​nashant)
• Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (Backport PR #​48434, Upstream PR #​47635, @​aanm)
• Fixes a bug where clusters originally created in v1.15 or earlier failed to upgrade due to dropping the CRD version CiliumNodeConfig v2alpha1. (Backport PR #​48213, Upstream PR #​48087, @​squeed)
• Fragmented UDP packets were potentially mis-classified as Cilium Wireguard traffic. (Backport PR #​48213, Upstream PR #​48139, @​julianwiedmann)
• gateway-api: fix listener programmed status update (Backport PR #​48213, Upstream PR #​48013, @​mhofstetter)
• gateway-api: propgate listenerset status update errors (Backport PR #​48581, Upstream PR #​48130, @​mhofstetter)
• hubble: fix four config knobs that never reach their sink (Backport PR #​48434, Upstream PR #​47637, @​aanm)
• Improve reliability for fast recovery of disrupted TCP connections that access a DSR-enabled Service. (Backport PR #​48465, Upstream PR #​48254, @​julianwiedmann)
• lb (fix): require active state for backend when using topology hints (Backport PR #​48550, Upstream PR #​47054, @​CarrySauce)
• nodediscovery: Reduced EC2 IMDS load and made ENI node registration more resilient by fetching the instance metadata once instead of on every CiliumNode update. (Backport PR #​48603, Upstream PR #​48218, @​41ks)
• operator/ipam: Restore fatal exit when the IPAM node watcher fails (Backport PR #​48213, Upstream PR #​47778, @​HadrienPatte)
• Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR #​48213, Upstream PR #​48015, @​giorio94)
• The BPF NAT engine now drops ICMP error packets which contain a fragmented TCP/UDP/SCTP packet. (Backport PR #​48418, Upstream PR #​48174, @​julianwiedmann)
• When using DSR with --bpf-lb-dsr-dispatch set to "opt" or "geneve" in combination with --enable-pmtu-discovery, fix the outer source IP of the ICMP error message which is generated when a forwarded DSR request exceeds the network interface's MTU. (Backport PR #​48114, Upstream PR #​48053, @​julianwiedmann)

CI Changes:

• [v1.20] golangci-lint: Do not run the modernize linter (#​48398, @​aanm)
• .github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR #​48550, Upstream PR #​48462, @​joestringer)
• BPF: Refactor nat tests to use scapy fixtures and add checksum coverage (Backport PR #​48213, Upstream PR #​47222, @​tommyp1ckles)
• bpf: tests: fix up prog type in ipv6_test (Backport PR #​48213, Upstream PR #​47736, @​julianwiedmann)
• bpf: tests: use PROG_TYPE (Backport PR #​48213, Upstream PR #​47714, @​julianwiedmann)
• bpf: tests: validate CT entry for DSR connection (Backport PR #​48418, Upstream PR #​48219, @​julianwiedmann)
• ci: replace unsupported LLVM installation action (Backport PR #​48418, Upstream PR #​47776, @​bogdankrasko)
• ci: resolve renovate PR metadata in base image workflows (Backport PR #​48213, Upstream PR #​47964, @​mhofstetter)
• ci: stop asking a PHP app for the AKS runner IP (Backport PR #​48418, Upstream PR #​48371, @​aanm)
• ci: use GitHub App client ID in v1.20 image workflow (Backport PR #​48213, Upstream PR #​47787, @​bogdankrasko)
• datapath/loader: fix missing complexity coverage for enable_identity_mark (Backport PR #​48213, Upstream PR #​48037, @​tklauser)
• gh: verifier: test PR branch before base branch (Backport PR #​48418, Upstream PR #​47928, @​julianwiedmann)
• gha/conformance-aks: add a timeout to the cluster create step (Backport PR #​48550, Upstream PR #​48545, @​aanm)
• gha/conformance-aks: give the nodes a 64 GiB OS disk (Backport PR #​48550, Upstream PR #​48481, @​aanm)
• gha/kubespray: don't wait for CoreDNS before Cilium is installed (Backport PR #​48213, Upstream PR #​48048, @​aanm)
• gha: bound the LLVM prereq apt step with a 5m timeout (Backport PR #​48213, Upstream PR #​48069, @​aanm)
• gha: compute the ginkgo cache key once, before the matrix (Backport PR #​48213, Upstream PR #​48127, @​aanm)
• gha: move GCP auth pin past the STS token exchange retry fix (Backport PR #​48418, Upstream PR #​48352, @​aanm)
• gha: publish the external target hostnames as FQDNs (Backport PR #​48550, Upstream PR #​48478, @​aanm)
• gha: stop JUnit reports being destroyed by same-name legs (Backport PR #​48418, Upstream PR #​48203, @​aanm)
• logging: downgrade canceled response-body reads to info (Backport PR #​48418, Upstream PR #​48202, @​aanm)
• Makefile: Order the bpf codegen ahead of the Go builds (Backport PR #​48735, Upstream PR #​48644, @​aanm)
• Revert 48441 - disable local accounts on AKS clusters (#​48524, @​aanm)
• test(bpf): parallelize eBPF test execution (Backport PR #​48213, Upstream PR #​47427, @​lconnery)
• test/k8s: wait for the L7 visibility policy to be realized (Backport PR #​48418, Upstream PR #​48365, @​aanm)
• test: fix the never-taken retry on a partially read JSON line (Backport PR #​48634, Upstream PR #​48190, @​aanm)
• tools: complexity: de-couple StackDepth from kernel version (Backport PR #​48200, Upstream PR #​48236, @​julianwiedmann)
• workflows: disable local accounts on AKS clusters (#​48441, @​nbusseneau)

Misc Changes:

• Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR #​48634, Upstream PR #​48421, @​0xch4z)
• bpf/lib/nat: rename icmpoff (Backport PR #​48418, Upstream PR #​47797, @​tommyp1ckles)
• bpf: dsr: use eth_store_proto() in dsr_reply_icmp*() (Backport PR #​48213, Upstream PR #​47392, @​julianwiedmann)
• bpf: icmp*: fix up sample length (Backport PR #​48114, Upstream PR #​48020, @​julianwiedmann)
• bpf: misc cleanups (Backport PR #​48350, Upstream PR #​47879, @​julianwiedmann)
• bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (Backport PR #​48284, Upstream PR #​46232, @​julianwiedmann)
• bpf: Reduce stack usage of send_trace_notify (Backport PR #​48350, Upstream PR #​47911, @​joamaki)
• chore(deps): update all external docker images dependencies (v1.20) (patch) (#​48147, @​cilium-renovate[bot])
• chore(deps): update all external docker images dependencies to v0.13.6 (v1.20) (#​48673, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#​48326, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#​48506, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#​48677, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#​48149, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#​48325, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#​48619, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.20) (#​48327, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.20) (#​48672, @​cilium-renovate[bot])
• chore(deps): update dependency bufbuild/buf to v1.73.0 (v1.20) (#​48729, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.20) (#​48344, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.20) (#​48505, @​cilium-renovate[bot])
• chore(deps): update dependency semver to v3.1.0 (v1.20) (#​48730, @​cilium-renovate[bot])
• chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.20) (#​48517, @​cilium-renovate[bot])
• chore(deps): update google/cloud-sdk docker tag to v581 (v1.20) (#​48150, @​cilium-renovate[bot])
• chore(deps): update helm/kind-action action to v1.15.0 (v1.20) (#​48591, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1787987562-ac0b61a4c0a45670a3654448d53bd6416b948f62 (v1.20) (#​48323, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.20) (#​48451, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.20) (#​48674, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#​48148, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#​48324, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#​48504, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#​48675, @​cilium-renovate[bot])
• ci: disable TCP/UDPRouteWeightedRouting gateway-api conformance tests (Backport PR #​48550, Upstream PR #​48375, @​0xch4z)
• datapath: move some feature probes into BPF (Backport PR #​48213, Upstream PR #​47737, @​julianwiedmann)
• docs: fix extra closing parenthesis in hive.rst (Backport PR #​48634, Upstream PR #​48541, @​logi74123)
• docs: Improve build process (Backport PR #​48550, Upstream PR #​47751, @​joestringer)
• docs: remove outdated tip about disabling hubble before enabling UI (Backport PR #​48634, Upstream PR #​48487, @​ekoops)
• docs: Remove v1.18 ipsec documentation (Backport PR #​48418, Upstream PR #​48224, @​joestringer)
• docs: Update kernel config requirements (Backport PR #​48634, Upstream PR #​48594, @​pchaigno)
• Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (Backport PR #​48550, Upstream PR #​48428, @​marcus-chae)
• Documentation: document mesh security model (Backport PR #​48213, Upstream PR #​47912, @​bimmlerd)
• envoy: Clarify legacy UpdateEnvoyResources (Backport PR #​48213, Upstream PR #​48066, @​jrajahalme)
• Fix (eBPF): Pointer-to-Pointer Misuse in IPv6 Trace Notifications (Backport PR #​48350, Upstream PR #​47908, @​weizhoublue)
• Fix Component Overview doc link rendering (Backport PR #​48634, Upstream PR #​48537, @​eneiss)
• fix(deps): update k8s.io patch updates stable to v0.36.4 (v1.20) (#​48118, @​cilium-renovate[bot])
• fix(deps): update module google.golang.org/grpc to v1.83.1 [security] (v1.20) (#​48388, @​cilium-renovate[bot])
• fix(deps): update module sigs.k8s.io/gateway-api/conformance to v1.6.2 (v1.20) (#​48676, @​cilium-renovate[bot])
• Fixed broken Slack link on Community page. (Backport PR #​48418, Upstream PR #​48021, @​ps-mir)
• Fixes: Update node-cache image version to 1.26.5 (Backport PR #​48634, Upstream PR #​48270, @​zyue110026)
• gateway-api: avoid logging missing GatewayClass as error (Backport PR #​48581, Upstream PR #​48529, @​mhofstetter)
• gateway-api: deduplicate condition merge helpers (Backport PR #​48581, Upstream PR #​48122, @​mhofstetter)
• gateway-api: extract BackendTLSPolicy status handling into BackendTLSPolicyStatusManager (Backport PR #​48581, Upstream PR #​48068, @​mhofstetter)
• gateway-api: extract gateway address status handling (Backport PR #​48581, Upstream PR #​48129, @​mhofstetter)
• gateway-api: extract index & load functionality from controller / reconcile (Backport PR #​48581, Upstream PR #​47837, @​mhofstetter)
• gateway-api: extract listener status handling (Backport PR #​48581, Upstream PR #​48103, @​mhofstetter)
• gateway-api: extract route status handling into RouteStatusManager (Backport PR #​48581, Upstream PR #​48023, @​mhofstetter)
• gateway-api: make gateway-api reconciler client and scheme fields private (Backport PR #​48581, Upstream PR #​48191, @​mhofstetter)
• gateway-api: only load referenced services & serviceimports (Backport PR #​48581, Upstream PR #​48469, @​mhofstetter)
• gateway-api: put ctx first in route status API (Backport PR #​48581, Upstream PR #​48074, @​mhofstetter)
• gateway-api: remove duplicate gateway reconcile error logs (Backport PR #​48581, Upstream PR #​48186, @​mhofstetter)
• gateway-api: remove Gateway LBIPAM annotation warning (Backport PR #​48581, Upstream PR #​48187, @​mhofstetter)
• gateway-api: remove pre-filtered namespaces concept (Backport PR #​48581, Upstream PR #​47685, @​asauber)
• gha/lint-ariane-config: let Renovate manage the Go version (Backport PR #​48550, Upstream PR #​48467, @​aanm)
• gha: authenticate release images with OIDC (Backport PR #​48599, Upstream PR #​48062, @​aanm)
• gha: authenticate stable Image CI to quay.io with OIDC (Backport PR #​48060, Upstream PR #​48061, @​aanm)
• gha: correct and move the OIDC subject comments (Backport PR #​48060, Upstream PR #​48370, @​aanm)
• gha: raise the Docker Hub OIDC token lifetime for release builds (Backport PR #​48599, Upstream PR #​48535, @​aanm)
• helm: add general busybox image values for substitution (Backport PR #​48418, Upstream PR #​47973, @​0xch4z)
• vendor: Bump StateDB to v0.8.4 (#​48248, @​joamaki)

Other Changes:

• [v1.20] bpf: Force-align IPv4 CT tuples used by revSNAT memcpy() (#​48395, @​julianwiedmann)
• install: Update image digests for v1.20.1 (#​48039, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01
quay.io/cilium/cilium:stable@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.2@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce
quay.io/cilium/clustermesh-apiserver:stable@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce

hubble-relay

quay.io/cilium/hubble-relay:v1.20.2@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f
quay.io/cilium/hubble-relay:stable@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.2@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38
quay.io/cilium/operator-alibabacloud:stable@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38

operator-aws

quay.io/cilium/operator-aws:v1.20.2@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3
quay.io/cilium/operator-aws:stable@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3

operator-azure

quay.io/cilium/operator-azure:v1.20.2@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a
quay.io/cilium/operator-azure:stable@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a

operator-generic

quay.io/cilium/operator-generic:v1.20.2@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc
quay.io/cilium/operator-generic:stable@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc

operator

quay.io/cilium/operator:v1.20.2@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c
quay.io/cilium/operator:stable@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "after 3am and before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | patch | `1.20.1` → `1.20.4` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.20.4`](https://github.com/cilium/cilium/releases/tag/v1.20.4): 1.20.4 [Compare Source](https://github.com/cilium/cilium/compare/1.20.3...1.20.4) ## Security patch release Out-of-band security patch release to fix CVE-2026-111943 ([golang/go#82345](https://github.com/golang/go/issues/82345)): upgrades Go to 1.26.10 so that the compromised eMudhra intermediate CA certificates are no longer trusted, and updates all dependencies to their latest patch versions. ## Summary of Changes **Minor Changes:** - alibabacloud: support RRSA (RAM Roles for Service Accounts) credentials in the IPAM allocator, alongside static AccessKeys and ECS instance RAM roles (Backport PR [#&#8203;49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#&#8203;49093](https://github.com/cilium/cilium/issues/49093), [@&#8203;4n4nd](https://github.com/4n4nd)) **Bugfixes:** - Allow wildcard CIDR selectors to match nodes when --policy-cidr-match-mode=nodes is configured (Backport PR [#&#8203;49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#&#8203;47828](https://github.com/cilium/cilium/issues/47828), [@&#8203;TheBeeZee](https://github.com/TheBeeZee)) - bpf: nat: fix outer ICMP checksum for ICMP/SCTP NAT error packets (Backport PR [#&#8203;49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#&#8203;48819](https://github.com/cilium/cilium/issues/48819), [@&#8203;fds7280](https://github.com/fds7280)) - CiliumEnvoyConfig now only redirects Services in its own namespace, as documented; service references in CiliumClusterwideEnvoyConfig without a namespace default to "default" again. (Backport PR [#&#8203;49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#&#8203;49076](https://github.com/cilium/cilium/issues/49076), [@&#8203;maxskokov](https://github.com/maxskokov)) - datapath: Fix NAT46x64 gateway prefix conversion panic (Backport PR [#&#8203;49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#&#8203;49177](https://github.com/cilium/cilium/issues/49177), [@&#8203;HadrienPatte](https://github.com/HadrienPatte)) - Fix an issue where terminating backends were evicted from BPF maps when trafficDistribution was enabled. (Backport PR [#&#8203;49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#&#8203;48349](https://github.com/cilium/cilium/issues/48349), [@&#8203;taesung320](https://github.com/taesung320)) - Fix invalid L4 checksum on IPv6 ClusterIP reverse NAT for CHECKSUM_PARTIAL packets on kernels < 6.12, affecting the case when packets are bridged/tunneled from the client pod to a remote host (Backport PR [#&#8203;49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#&#8203;49204](https://github.com/cilium/cilium/issues/49204), [@&#8203;liuyuan10](https://github.com/liuyuan10)) - Fix regression in Cilium 1.20.3 where the Gateway API implementation would incorrectly handle BackendTLSPolicy configurations, leading to high Cilium CPU usage and inability to forward traffic. (Backport PR [#&#8203;49568](https://github.com/cilium/cilium/issues/49568), Upstream PR [#&#8203;49525](https://github.com/cilium/cilium/issues/49525), [@&#8203;youngnick](https://github.com/youngnick)) - Fixes an issue in LBIPAM where on service upsert, if IP allocations are not changed the sharing index is not updated. (Backport PR [#&#8203;49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#&#8203;48938](https://github.com/cilium/cilium/issues/48938), [@&#8203;0xch4z](https://github.com/0xch4z)) - nodediscovery: in IPAM ENI and Azure modes the operator now treats nodes as running in multi-pool mode from the very first event. (Backport PR [#&#8203;49390](https://github.com/cilium/cilium/issues/49390), Upstream PR [#&#8203;49242](https://github.com/cilium/cilium/issues/49242), [@&#8203;41ks](https://github.com/41ks)) - Reduce transient DNS SERVFAIL/REFUSED for pods that query immediately at startup by pushing/applying Standalone DNS Proxy policy snapshots more frequently (Backport PR [#&#8203;49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#&#8203;49112](https://github.com/cilium/cilium/issues/49112), [@&#8203;QxBytes](https://github.com/QxBytes)) - Remove the unused pebble binary from the cilium image to clear its Go standard library vulnerability findings. (Backport PR [#&#8203;49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#&#8203;49380](https://github.com/cilium/cilium/issues/49380), [@&#8203;aanm](https://github.com/aanm)) **CI Changes:** - \[v1.20] ci: ignore transient xDS mode drift during downgrade ([#&#8203;49515](https://github.com/cilium/cilium/issues/49515), [@&#8203;jrajahalme](https://github.com/jrajahalme)) - ci: Pass the auto-committer secrets to the base images workflow (Backport PR [#&#8203;49467](https://github.com/cilium/cilium/issues/49467), Upstream PR [#&#8203;49453](https://github.com/cilium/cilium/issues/49453), [@&#8203;aanm](https://github.com/aanm)) - renovate: Open one trusted PR per branch (Backport PR [#&#8203;49416](https://github.com/cilium/cilium/issues/49416), Upstream PR [#&#8203;49381](https://github.com/cilium/cilium/issues/49381), [@&#8203;aanm](https://github.com/aanm)) **Misc Changes:** - chore(deps): update auto-merge-trusted-deps (v1.20) ([#&#8203;49319](https://github.com/cilium/cilium/issues/49319), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update auto-merge-trusted-deps (v1.20) ([#&#8203;49445](https://github.com/cilium/cilium/issues/49445), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency sphinxcontrib-openapi to v0.10.0 (v1.20) ([#&#8203;49438](https://github.com/cilium/cilium/issues/49438), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - clarify co sign documentation to use minimum version to verify signing key (Backport PR [#&#8203;49474](https://github.com/cilium/cilium/issues/49474), Upstream PR [#&#8203;49401](https://github.com/cilium/cilium/issues/49401), [@&#8203;mfahlandt](https://github.com/mfahlandt)) - Fix Envoy xDS listener handling across restoration, address changes, and rejected updates (Backport PR [#&#8203;49383](https://github.com/cilium/cilium/issues/49383), Upstream PR [#&#8203;48897](https://github.com/cilium/cilium/issues/48897), [@&#8203;jrajahalme](https://github.com/jrajahalme)) **Other Changes:** - install: Update image digests for v1.20.3 ([#&#8203;49392](https://github.com/cilium/cilium/issues/49392), [@&#8203;cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) - route-reconciler: add prune exclusion logic and use it in the linuxNodeHandler ([#&#8203;49170](https://github.com/cilium/cilium/issues/49170), [@&#8203;andreaterzolo](https://github.com/andreaterzolo)) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.4@sha256:20fe92e4c86641233a450098c158d2d29085f3419931ab6bf681d2485dedf16e` `quay.io/cilium/cilium:stable@sha256:20fe92e4c86641233a450098c158d2d29085f3419931ab6bf681d2485dedf16e` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.4@sha256:aeac78ae77d166b86630310f2eb53fbc92014eda36ada8e6b2d7f2b8f2dadbfa` `quay.io/cilium/clustermesh-apiserver:stable@sha256:aeac78ae77d166b86630310f2eb53fbc92014eda36ada8e6b2d7f2b8f2dadbfa` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.4@sha256:cb23408209697ed30d2bc462e1f01eb622ea4423a891458f78bc88d7255bbfc1` `quay.io/cilium/hubble-relay:stable@sha256:cb23408209697ed30d2bc462e1f01eb622ea4423a891458f78bc88d7255bbfc1` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.4@sha256:163a08ee4438780638899742e95521e1a37edeb676c6e5c924d320c4c0bd09ad` `quay.io/cilium/operator-alibabacloud:stable@sha256:163a08ee4438780638899742e95521e1a37edeb676c6e5c924d320c4c0bd09ad` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.4@sha256:caab27c6e3286a596d502f76aa6cffe2efab6e8a92234a0d10d2eed3eda85c7c` `quay.io/cilium/operator-aws:stable@sha256:caab27c6e3286a596d502f76aa6cffe2efab6e8a92234a0d10d2eed3eda85c7c` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.4@sha256:0669c35e9f1638bbdd6cf5c64163e7ee4ea4ef440e223050e60665811369b4ec` `quay.io/cilium/operator-azure:stable@sha256:0669c35e9f1638bbdd6cf5c64163e7ee4ea4ef440e223050e60665811369b4ec` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.4@sha256:7a7a3489dc66ad67e420d285c8a8d2e169b0957ad15e120f593d27081bf38d82` `quay.io/cilium/operator-generic:stable@sha256:7a7a3489dc66ad67e420d285c8a8d2e169b0957ad15e120f593d27081bf38d82` ##### operator `quay.io/cilium/operator:v1.20.4@sha256:f94e9812f191e0c31b5cfe6cb1f38f5c349d4f159f2030e621d179d826257263` `quay.io/cilium/operator:stable@sha256:f94e9812f191e0c31b5cfe6cb1f38f5c349d4f159f2030e621d179d826257263` ### [`v1.20.3`](https://github.com/cilium/cilium/releases/tag/v1.20.3): 1.20.3 [Compare Source](https://github.com/cilium/cilium/compare/1.20.2...1.20.3) ## Summary of Changes **Minor Changes:** - alibabacloud: support IMDSv2 (token-based) instance metadata access (Backport PR [#&#8203;49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#&#8203;49182](https://github.com/cilium/cilium/issues/49182), [@&#8203;4n4nd](https://github.com/4n4nd)) - Fix conntrack garbage collection deleting CT entries that the datapath reopened between the GC batch read and the delete, which could cascade into NAT mapping deletion and SNAT source-port reallocation for live connections. (Backport PR [#&#8203;49119](https://github.com/cilium/cilium/issues/49119), Upstream PR [#&#8203;46750](https://github.com/cilium/cilium/issues/46750), [@&#8203;gyutaeb](https://github.com/gyutaeb)) - operator: prevent CNPs with nodeSelector from silently enforcing nothing (Backport PR [#&#8203;49173](https://github.com/cilium/cilium/issues/49173), Upstream PR [#&#8203;47882](https://github.com/cilium/cilium/issues/47882), [@&#8203;weizhoublue](https://github.com/weizhoublue)) **Bugfixes:** - azure: Fixed an issue where an interface with an empty MAC field would be reported back the the cilium agent causing it to crash on startup when trying to configure the routes. (Backport PR [#&#8203;49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#&#8203;48648](https://github.com/cilium/cilium/issues/48648), [@&#8203;41ks](https://github.com/41ks)) - bpf: icmp: use 576 byte of inner packet to avoid partial csum floor (Backport PR [#&#8203;48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#&#8203;48578](https://github.com/cilium/cilium/issues/48578), [@&#8203;tommyp1ckles](https://github.com/tommyp1ckles)) - cilium-dbg: Print port numbers correctly for map cilium_lb\*\_reverse_sk (Backport PR [#&#8203;49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#&#8203;47134](https://github.com/cilium/cilium/issues/47134), [@&#8203;jayl1e](https://github.com/jayl1e)) - daemon: fix a bug where L7 DNS policies could remain loaded in the datapath during agent shutdown, causing pods under a wildcard toFQDNs policy to lose DNS resolution for the duration of the restart. (Backport PR [#&#8203;48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#&#8203;48747](https://github.com/cilium/cilium/issues/48747), [@&#8203;41ks](https://github.com/41ks)) - endpoint/restore: skip cleanup for reserved internal endpoints (Backport PR [#&#8203;48999](https://github.com/cilium/cilium/issues/48999), Upstream PR [#&#8203;48272](https://github.com/cilium/cilium/issues/48272), [@&#8203;fristonio](https://github.com/fristonio)) - envoy: handle listener additional address changes (Backport PR [#&#8203;48917](https://github.com/cilium/cilium/issues/48917), Upstream PR [#&#8203;48712](https://github.com/cilium/cilium/issues/48712), [@&#8203;nezdolik](https://github.com/nezdolik)) - envoy: handle listener address changes in ADS (Backport PR [#&#8203;48917](https://github.com/cilium/cilium/issues/48917), Upstream PR [#&#8203;48798](https://github.com/cilium/cilium/issues/48798), [@&#8203;nezdolik](https://github.com/nezdolik)) - envoy: track coalesced ADS snapshot updates (Backport PR [#&#8203;48917](https://github.com/cilium/cilium/issues/48917), Upstream PR [#&#8203;48631](https://github.com/cilium/cilium/issues/48631), [@&#8203;nezdolik](https://github.com/nezdolik)) - Fix Gateway API ExternalAuth dropping request bodies when allowedResponseHeaders is unset (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;48770](https://github.com/cilium/cilium/issues/48770), [@&#8203;kirgene](https://github.com/kirgene)) - Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;48905](https://github.com/cilium/cilium/issues/48905), [@&#8203;fristonio](https://github.com/fristonio)) - Fix ip6tables chain rename errors being silently ignored during iptables rule reconciliation. (Backport PR [#&#8203;49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#&#8203;49024](https://github.com/cilium/cilium/issues/49024), [@&#8203;maxskokov](https://github.com/maxskokov)) - Fix panic in agent when CiliumLocalRedirectPolicy `redirectBackend.toPorts` is declared as an empty array. The agent will now reject such a policy. (Backport PR [#&#8203;48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#&#8203;48491](https://github.com/cilium/cilium/issues/48491), [@&#8203;ajmmm](https://github.com/ajmmm)) - Fix PMTU/ICMP replies for IPIP/Geneve DSR for GRO skbs (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;48489](https://github.com/cilium/cilium/issues/48489), [@&#8203;borkmann](https://github.com/borkmann)) - Fix rare data race in selector cache that could lead to agent panic (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;47733](https://github.com/cilium/cilium/issues/47733), [@&#8203;odinuge](https://github.com/odinuge)) - Fix restoration of terminating backends. If a terminating backend become active again during restart the backend was incorrectly kept as quarantined. (Backport PR [#&#8203;48797](https://github.com/cilium/cilium/issues/48797), Upstream PR [#&#8203;48763](https://github.com/cilium/cilium/issues/48763), [@&#8203;joamaki](https://github.com/joamaki)) - Fixes a bug where Hubble flows may list the incorrect policy that allowed or denied a flow (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;49086](https://github.com/cilium/cilium/issues/49086), [@&#8203;tsotne95](https://github.com/tsotne95)) - Fixes a bug where the helm value `hubble.tls.auto.privateKey` settings are no longer ignored in Hubble cert-manager certificates (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;49114](https://github.com/cilium/cilium/issues/49114), [@&#8203;byxorna](https://github.com/byxorna)) - Fixes an issue where CiliumCIDRGroups with zero-length cidrs (i.e. 0.0.0.0/0) inadvertently selected no traffic. (Backport PR [#&#8203;49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#&#8203;48366](https://github.com/cilium/cilium/issues/48366), [@&#8203;squeed](https://github.com/squeed)) - gateway-api: filter CEC controls from infrastructure metadata (Backport PR [#&#8203;48984](https://github.com/cilium/cilium/issues/48984), Upstream PR [#&#8203;47732](https://github.com/cilium/cilium/issues/47732), [@&#8203;nezdolik](https://github.com/nezdolik)) - gateway-api: make HTTP route ordering deterministic (Backport PR [#&#8203;49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#&#8203;48951](https://github.com/cilium/cilium/issues/48951), [@&#8203;abduu11aahh](https://github.com/abduu11aahh)) - gateway-api: Support system CA certificates in BackendTLSPolicy. (Backport PR [#&#8203;49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#&#8203;48895](https://github.com/cilium/cilium/issues/48895), [@&#8203;shreyasrajiv327](https://github.com/shreyasrajiv327)) - infraendpoints: Release the health IPv4 when the IPv6 allocation fails (Backport PR [#&#8203;48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#&#8203;48816](https://github.com/cilium/cilium/issues/48816), [@&#8203;HadrienPatte](https://github.com/HadrienPatte)) - k8s/resource: fix leaked event finalizer on unobserved delete (Backport PR [#&#8203;48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#&#8203;48785](https://github.com/cilium/cilium/issues/48785), [@&#8203;tklauser](https://github.com/tklauser)) - L7 conformance CI fixes (Backport PR [#&#8203;48999](https://github.com/cilium/cilium/issues/48999), Upstream PR [#&#8203;47517](https://github.com/cilium/cilium/issues/47517), [@&#8203;fristonio](https://github.com/fristonio)) - operator: Do not emit warning when deleting already deleted unmanaged pod (Backport PR [#&#8203;48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#&#8203;48765](https://github.com/cilium/cilium/issues/48765), [@&#8203;gandro](https://github.com/gandro)) - operator: fix `metrics list` default address to work on IPv6-only clusters with dual stack nodes by trying both IPv4 and IPv6 loopback addresses (Backport PR [#&#8203;48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#&#8203;48780](https://github.com/cilium/cilium/issues/48780), [@&#8203;41ks](https://github.com/41ks)) - Set ipv6 routing rules when dual stack is enabled (Backport PR [#&#8203;49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#&#8203;49188](https://github.com/cilium/cilium/issues/49188), [@&#8203;fcrespofastly](https://github.com/fcrespofastly)) - Sockets are no longer destroyed when a Service backend is terminated unless they are still connected to that backend. Unconnected UDP sockets, and sockets that have since disconnected or moved to another backend, used to have their local port silently changed. (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;48725](https://github.com/cilium/cilium/issues/48725), [@&#8203;maxskokov](https://github.com/maxskokov)) **CI Changes:** - \[ci] fix escaping in conformance ginkgo (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;48991](https://github.com/cilium/cilium/issues/48991), [@&#8203;nebril](https://github.com/nebril)) - \[v1.20] .github: Remove the EKS cluster pool workflows ([#&#8203;49084](https://github.com/cilium/cilium/issues/49084), [@&#8203;aanm](https://github.com/aanm)) - ci: Add support for OIDC (Backport PR [#&#8203;49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#&#8203;49007](https://github.com/cilium/cilium/issues/49007), [@&#8203;aanm](https://github.com/aanm)) - ci: cleanup disk space in documentation workflow (Backport PR [#&#8203;48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#&#8203;48427](https://github.com/cilium/cilium/issues/48427), [@&#8203;tklauser](https://github.com/tklauser)) - ci: Drop the empty floating tag line from CI image digests (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;49070](https://github.com/cilium/cilium/issues/49070), [@&#8203;aanm](https://github.com/aanm)) - ci: fix CNI setup and readiness checks in the kubespray job (Backport PR [#&#8203;49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#&#8203;48927](https://github.com/cilium/cilium/issues/48927), [@&#8203;aanm](https://github.com/aanm)) - ci: Give Envoy Embedded conformance a bigger runner (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;49018](https://github.com/cilium/cilium/issues/49018), [@&#8203;aanm](https://github.com/aanm)) - ci: keep UDPRouteWeightedRouting skipped in the profile job (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;49005](https://github.com/cilium/cilium/issues/49005), [@&#8203;aanm](https://github.com/aanm)) - ci: login to docker registry for downgrade image wait (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;48983](https://github.com/cilium/cilium/issues/48983), [@&#8203;nebril](https://github.com/nebril)) - ci: Name runner variables after their Ubuntu release and let Renovate bump them (Backport PR [#&#8203;49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#&#8203;49065](https://github.com/cilium/cilium/issues/49065), [@&#8203;aanm](https://github.com/aanm)) - ci: Skip redundant setup when base images already exist (Backport PR [#&#8203;49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#&#8203;47209](https://github.com/cilium/cilium/issues/47209), [@&#8203;HadrienPatte](https://github.com/HadrienPatte)) - ci: Stop passing secrets to the base images workflow (Backport PR [#&#8203;49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#&#8203;49082](https://github.com/cilium/cilium/issues/49082), [@&#8203;aanm](https://github.com/aanm)) - gha/conformance-multi-pool: use the local fake external targets (Backport PR [#&#8203;48986](https://github.com/cilium/cilium/issues/48986), Upstream PR [#&#8203;48558](https://github.com/cilium/cilium/issues/48558), [@&#8203;aanm](https://github.com/aanm)) - gha/e2e-upgrade: gate the after-agent-restart conn-disrupt check (Backport PR [#&#8203;48437](https://github.com/cilium/cilium/issues/48437), Upstream PR [#&#8203;47440](https://github.com/cilium/cilium/issues/47440), [@&#8203;aanm](https://github.com/aanm)) - gha/setup-aks-cluster: Retry a create that never starts (Backport PR [#&#8203;49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#&#8203;48924](https://github.com/cilium/cilium/issues/48924), [@&#8203;aanm](https://github.com/aanm)) - gha: Derive the LVH package cache key once per run (Backport PR [#&#8203;48986](https://github.com/cilium/cilium/issues/48986), Upstream PR [#&#8203;48656](https://github.com/cilium/cilium/issues/48656), [@&#8203;aanm](https://github.com/aanm)) - gha: don't fail PR tests on reporting errors (Backport PR [#&#8203;49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#&#8203;48740](https://github.com/cilium/cilium/issues/48740), [@&#8203;aanm](https://github.com/aanm)) - gha: Grant id-token to the post-release call of release.yaml (Backport PR [#&#8203;49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#&#8203;49323](https://github.com/cilium/cilium/issues/49323), [@&#8203;aanm](https://github.com/aanm)) - gha: make external fake targets image configurable (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;48941](https://github.com/cilium/cilium/issues/48941), [@&#8203;giorio94](https://github.com/giorio94)) - gha: Retry stalled kind image pulls before the install wait expires (Backport PR [#&#8203;49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#&#8203;48989](https://github.com/cilium/cilium/issues/48989), [@&#8203;aanm](https://github.com/aanm)) - gha: Skip the duplicate CI image build on push to main (Backport PR [#&#8203;48986](https://github.com/cilium/cilium/issues/48986), Upstream PR [#&#8203;48736](https://github.com/cilium/cilium/issues/48736), [@&#8203;aanm](https://github.com/aanm)) - gha: survive a GKE zone running out of capacity (Backport PR [#&#8203;48986](https://github.com/cilium/cilium/issues/48986), Upstream PR [#&#8203;48184](https://github.com/cilium/cilium/issues/48184), [@&#8203;aanm](https://github.com/aanm)) - gha: Tolerate cosign and SBOM failures on pull requests (Backport PR [#&#8203;48986](https://github.com/cilium/cilium/issues/48986), Upstream PR [#&#8203;48737](https://github.com/cilium/cilium/issues/48737), [@&#8203;aanm](https://github.com/aanm)) - ginkgo: remove `Test NodePort with L7 policy` tests (Backport PR [#&#8203;49067](https://github.com/cilium/cilium/issues/49067), Upstream PR [#&#8203;46499](https://github.com/cilium/cilium/issues/46499), [@&#8203;smagnani96](https://github.com/smagnani96)) - loadbalancer/tests: Fix the graceful termination test restart (Backport PR [#&#8203;49317](https://github.com/cilium/cilium/issues/49317), Upstream PR [#&#8203;48939](https://github.com/cilium/cilium/issues/48939), [@&#8203;aanm](https://github.com/aanm)) - Migrate Conformance Cluster Mesh workflow to use fake external targets (Backport PR [#&#8203;48654](https://github.com/cilium/cilium/issues/48654), Upstream PR [#&#8203;48250](https://github.com/cilium/cilium/issues/48250), [@&#8203;giorio94](https://github.com/giorio94)) - nodeinit: wait for the kubelet wrapper before writing the bootstrap file (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;48739](https://github.com/cilium/cilium/issues/48739), [@&#8203;aanm](https://github.com/aanm)) **Misc Changes:** - bpf: lxc: switch cilium_nodeport_nat_buffer to auxvar (Backport PR [#&#8203;48741](https://github.com/cilium/cilium/issues/48741), Upstream PR [#&#8203;48543](https://github.com/cilium/cilium/issues/48543), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - build: handle git worktrees in documentation make targets (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;48966](https://github.com/cilium/cilium/issues/48966), [@&#8203;utaal](https://github.com/utaal)) - chore(deps): update all github action dependencies (v1.20) ([#&#8203;48881](https://github.com/cilium/cilium/issues/48881), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#&#8203;49039](https://github.com/cilium/cilium/issues/49039), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#&#8203;49152](https://github.com/cilium/cilium/issues/49152), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#&#8203;49277](https://github.com/cilium/cilium/issues/49277), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#&#8203;48882](https://github.com/cilium/cilium/issues/48882), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#&#8203;49153](https://github.com/cilium/cilium/issues/49153), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#&#8203;49275](https://github.com/cilium/cilium/issues/49275), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images to v1.26.9 (v1.20) ([#&#8203;49262](https://github.com/cilium/cilium/issues/49262), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.20.1 (v1.20) ([#&#8203;48978](https://github.com/cilium/cilium/issues/48978), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/little-vm-helper to v0.0.31 (v1.20) ([#&#8203;48788](https://github.com/cilium/cilium/issues/48788), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf to v36.2 (v1.20) ([#&#8203;49038](https://github.com/cilium/cilium/issues/49038), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/busybox:1.38.0 docker digest to [`fd7dc98`](https://github.com/cilium/cilium/commit/fd7dc98) (v1.20) ([#&#8203;49035](https://github.com/cilium/cilium/issues/49035), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.8 docker digest to [`0f063af`](https://github.com/cilium/cilium/commit/0f063af) (v1.20) ([#&#8203;49149](https://github.com/cilium/cilium/issues/49149), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.8 docker digest to [`6c2a553`](https://github.com/cilium/cilium/commit/6c2a553) (v1.20) ([#&#8203;48879](https://github.com/cilium/cilium/issues/48879), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker.io/library/golang:1.26.9 docker digest to [`d772206`](https://github.com/cilium/cilium/commit/d772206) (v1.20) ([#&#8203;49298](https://github.com/cilium/cilium/issues/49298), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.7.2 (v1.20) ([#&#8203;49036](https://github.com/cilium/cilium/issues/49036), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update helm/kind-action action to v1.15.1 (v1.20) ([#&#8203;49289](https://github.com/cilium/cilium/issues/49289), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.4-1790671085-c3a2a1ff726f00f5b5c0886cab3ad345f97f35b9 (v1.20) ([#&#8203;49111](https://github.com/cilium/cilium/issues/49111), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1790882336-b64c7306085409b95fb5626db2d2bb7a200b9432 (v1.20) ([#&#8203;49123](https://github.com/cilium/cilium/issues/49123), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1791291190-5ec36181d464cd75b35b45395a722226cbdd2888 (v1.20) ([#&#8203;49194](https://github.com/cilium/cilium/issues/49194), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791350265-ae0327a34850b7d1849e8332dbefd4d5bebabe10 (v1.20) ([#&#8203;49216](https://github.com/cilium/cilium/issues/49216), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791537840-00e749f11f69334c625e53fc1ce2fc6c7f34a51f (v1.20) ([#&#8203;49276](https://github.com/cilium/cilium/issues/49276), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update security updates to v1.45.0 \[security] (v1.20) ([#&#8203;48814](https://github.com/cilium/cilium/issues/48814), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#&#8203;48880](https://github.com/cilium/cilium/issues/48880), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#&#8203;49037](https://github.com/cilium/cilium/issues/49037), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - ciliumendpointslice: Report no CID when the CEP has none (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;48933](https://github.com/cilium/cilium/issues/48933), [@&#8203;aanm](https://github.com/aanm)) - connectivity-check: move echo-b to the lower NodePort band (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;48926](https://github.com/cilium/cilium/issues/48926), [@&#8203;aanm](https://github.com/aanm)) - docs: note on eBPF ClusterIP translation vs Docker raw-table protection (Backport PR [#&#8203;49189](https://github.com/cilium/cilium/issues/49189), Upstream PR [#&#8203;47782](https://github.com/cilium/cilium/issues/47782), [@&#8203;Verbano-Tech](https://github.com/Verbano-Tech)) - envoy: add standalone NPDS unsubscribe regression test (Backport PR [#&#8203;48917](https://github.com/cilium/cilium/issues/48917), Upstream PR [#&#8203;47818](https://github.com/cilium/cilium/issues/47818), [@&#8203;nezdolik](https://github.com/nezdolik)) - fix(deps): update k8s.io patch updates stable to v0.36.5 (v1.20) ([#&#8203;49151](https://github.com/cilium/cilium/issues/49151), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module golang.org/x/net to v0.60.0 \[security] (v1.20) ([#&#8203;49253](https://github.com/cilium/cilium/issues/49253), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update security updates \[security] (v1.20) ([#&#8203;48808](https://github.com/cilium/cilium/issues/48808), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - gateway-api: centralize Gateway validation (Backport PR [#&#8203;48907](https://github.com/cilium/cilium/issues/48907), Upstream PR [#&#8203;48602](https://github.com/cilium/cilium/issues/48602), [@&#8203;arybolovlev](https://github.com/arybolovlev)) - loadbalancer/writer: add support for SetFrontendSourceRangesFunc (Backport PR [#&#8203;49336](https://github.com/cilium/cilium/issues/49336), Upstream PR [#&#8203;49068](https://github.com/cilium/cilium/issues/49068), [@&#8203;0xch4z](https://github.com/0xch4z)) **Other Changes:** - \[v1.20] deps: update gateway api to v1.6.3 ([#&#8203;49305](https://github.com/cilium/cilium/issues/49305), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - \[v1.20] node_neighbor_discovery: fix ID in delete query ([#&#8203;48912](https://github.com/cilium/cilium/issues/48912), [@&#8203;nobleess](https://github.com/nobleess)) - \[v1.20] routing: fix dual-stack ENI router startup with native routing CIDRs ([#&#8203;48709](https://github.com/cilium/cilium/issues/48709), [@&#8203;monta-riahi](https://github.com/monta-riahi)) - install: Update image digests for v1.20.2 ([#&#8203;48751](https://github.com/cilium/cilium/issues/48751), [@&#8203;cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.3@sha256:95cfa5c2427cc6b452c00908778d0566311f572589284af949d06a013db1a849` `quay.io/cilium/cilium:stable@sha256:95cfa5c2427cc6b452c00908778d0566311f572589284af949d06a013db1a849` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.3@sha256:5c8dca0d0b77bb593df157be39f6c9c868dc08922bbd0540ac0a56815341b227` `quay.io/cilium/clustermesh-apiserver:stable@sha256:5c8dca0d0b77bb593df157be39f6c9c868dc08922bbd0540ac0a56815341b227` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.3@sha256:c6f819d9c5e0b35ccac63b9f2f1ae213fd9be50588e15d5a444d5d305ad317b5` `quay.io/cilium/hubble-relay:stable@sha256:c6f819d9c5e0b35ccac63b9f2f1ae213fd9be50588e15d5a444d5d305ad317b5` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.3@sha256:615f8c2995e437320571d6f61e623d6848ed3ea357cdaa886ac95bbff29a0b52` `quay.io/cilium/operator-alibabacloud:stable@sha256:615f8c2995e437320571d6f61e623d6848ed3ea357cdaa886ac95bbff29a0b52` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.3@sha256:49bdd1d54bdf3da2740848c4662854d0d41c0df25cffe8575d71723db08cc0d1` `quay.io/cilium/operator-aws:stable@sha256:49bdd1d54bdf3da2740848c4662854d0d41c0df25cffe8575d71723db08cc0d1` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.3@sha256:7132b3ff7e33a076ea9fadaa6e4f2b364937ed7b118b92928bdb4706921a2ffa` `quay.io/cilium/operator-azure:stable@sha256:7132b3ff7e33a076ea9fadaa6e4f2b364937ed7b118b92928bdb4706921a2ffa` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.3@sha256:efdd8d89d6d8f63d21a065fa2f9e17614a2b3ac9371b221af9355f63829e2dbc` `quay.io/cilium/operator-generic:stable@sha256:efdd8d89d6d8f63d21a065fa2f9e17614a2b3ac9371b221af9355f63829e2dbc` ##### operator `quay.io/cilium/operator:v1.20.3@sha256:c40996c8a413f57db75715e683abc550e7849904aa20b8730822ba532f9b783c` `quay.io/cilium/operator:stable@sha256:c40996c8a413f57db75715e683abc550e7849904aa20b8730822ba532f9b783c` ### [`v1.20.2`](https://github.com/cilium/cilium/releases/tag/v1.20.2): 1.20.2 [Compare Source](https://github.com/cilium/cilium/compare/1.20.1...1.20.2) ## Summary of Changes **Minor Changes:** - gateway-api: node label selector for when hostNetwork is enabled (Backport PR [#&#8203;48636](https://github.com/cilium/cilium/issues/48636), Upstream PR [#&#8203;47463](https://github.com/cilium/cilium/issues/47463), [@&#8203;xtineskim](https://github.com/xtineskim)) **Bugfixes:** - aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48125](https://github.com/cilium/cilium/issues/48125), [@&#8203;41ks](https://github.com/41ks)) - aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48193](https://github.com/cilium/cilium/issues/48193), [@&#8203;41ks](https://github.com/41ks)) - bpf: Fix agent crash when dumping map events (Backport PR [#&#8203;48378](https://github.com/cilium/cilium/issues/48378), Upstream PR [#&#8203;48273](https://github.com/cilium/cilium/issues/48273), [@&#8203;joestringer](https://github.com/joestringer)) - bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48407](https://github.com/cilium/cilium/issues/48407), [@&#8203;41ks](https://github.com/41ks)) - Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48262](https://github.com/cilium/cilium/issues/48262), [@&#8203;giorio94](https://github.com/giorio94)) - datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;46861](https://github.com/cilium/cilium/issues/46861), [@&#8203;fdomain](https://github.com/fdomain)) - endpoint: preserve concurrent policy updates for new endpoints (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48195](https://github.com/cilium/cilium/issues/48195), [@&#8203;jrajahalme](https://github.com/jrajahalme)) - ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47034](https://github.com/cilium/cilium/issues/47034), [@&#8203;41ks](https://github.com/41ks)) - Fix a pod created immediately after a network policy change reporting a stale policy revision for up to two minutes. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;47642](https://github.com/cilium/cilium/issues/47642), [@&#8203;aanm](https://github.com/aanm)) - Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association (Backport PR [#&#8203;48024](https://github.com/cilium/cilium/issues/48024), Upstream PR [#&#8203;47874](https://github.com/cilium/cilium/issues/47874), [@&#8203;bryanhorstmann](https://github.com/bryanhorstmann)) - Fix BGP `defaultGateway` peer auto-discovery selecting a default route from a non-main routing table, such as the `default via cilium_host` route Cilium installs in the from-proxy table, instead of the node's real default gateway. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;47971](https://github.com/cilium/cilium/issues/47971), [@&#8203;ecbaldwin](https://github.com/ecbaldwin)) - Fix bug where identities may linger for double the amount of the expected time (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48032](https://github.com/cilium/cilium/issues/48032), [@&#8203;christarazi](https://github.com/christarazi)) - Fix dropping traffic L2Announcement with externalTrafficPolicy: Local (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;46399](https://github.com/cilium/cilium/issues/46399), [@&#8203;yuito-it](https://github.com/yuito-it)) - Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. (Backport PR [#&#8203;48017](https://github.com/cilium/cilium/issues/48017), Upstream PR [#&#8203;47943](https://github.com/cilium/cilium/issues/47943), [@&#8203;taaahaaa](https://github.com/taaahaaa)) - Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. (Backport PR [#&#8203;48017](https://github.com/cilium/cilium/issues/48017), Upstream PR [#&#8203;47929](https://github.com/cilium/cilium/issues/47929), [@&#8203;shreyasrajiv327](https://github.com/shreyasrajiv327)) - Fix Hubble Relay remains running during termination (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;47942](https://github.com/cilium/cilium/issues/47942), [@&#8203;xandau](https://github.com/xandau)) - Fix ICMP error packet handling by adding the missing checksum recalculation performed during NAT for SNATed load-balanced traffic. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48086](https://github.com/cilium/cilium/issues/48086), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - Fix IPv6 Router Solicitations and Router Advertisements being dropped with "Unsupported protocol for NAT masquerade" on nodes whose BPF masquerade address is a link-local address. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48094](https://github.com/cilium/cilium/issues/48094), [@&#8203;ecbaldwin](https://github.com/ecbaldwin)) - Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48391](https://github.com/cilium/cilium/issues/48391), [@&#8203;fristonio](https://github.com/fristonio)) - Fix multiple regressions in Cilium LocalRedirectPolicy (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;46638](https://github.com/cilium/cilium/issues/46638), [@&#8203;ajmmm](https://github.com/ajmmm)) - Fix node-init startup on GKE 1.36.2-gke.2064000 nodes by detecting GKE from the kubelet path instead of container runtime configuration. (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47945](https://github.com/cilium/cilium/issues/47945), [@&#8203;dlanov](https://github.com/dlanov)) - Fix nodeport egress tuple reuse for closed connections (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48306](https://github.com/cilium/cilium/issues/48306), [@&#8203;fristonio](https://github.com/fristonio)) - Fix restored ENI endpoints routing rule configuration when masquerading config changes ([#&#8203;48417](https://github.com/cilium/cilium/issues/48417), [@&#8203;fristonio](https://github.com/fristonio)) - fix(envoyconfig): retry port allocation on duplicate-address rejections (Backport PR [#&#8203;48735](https://github.com/cilium/cilium/issues/48735), Upstream PR [#&#8203;48624](https://github.com/cilium/cilium/issues/48624), [@&#8203;kokhlo](https://github.com/kokhlo)) - Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47915](https://github.com/cilium/cilium/issues/47915), [@&#8203;giorio94](https://github.com/giorio94)) - Fixed a cilium-agent crash (`fatal error: concurrent map iteration and map write`) when an endpoint's policy was recomputed while incremental policy map changes were applied concurrently. Most commonly triggered by named-port policies under pod churn. (Backport PR [#&#8203;48735](https://github.com/cilium/cilium/issues/48735), Upstream PR [#&#8203;48098](https://github.com/cilium/cilium/issues/48098), [@&#8203;nashant](https://github.com/nashant)) - Fixed five configuration options that were accepted but silently ignored: `vtep-sync-interval`, `enable-xt-socket-fallback`, `eni-delete-on-termination` with a custom CNI configuration, the `enableIdentityMark` Helm value outside CNI chaining mode, and `lb-retry-backoff-max`. (Backport PR [#&#8203;48434](https://github.com/cilium/cilium/issues/48434), Upstream PR [#&#8203;47635](https://github.com/cilium/cilium/issues/47635), [@&#8203;aanm](https://github.com/aanm)) - Fixes a bug where clusters originally created in v1.15 or earlier failed to upgrade due to dropping the CRD version CiliumNodeConfig v2alpha1. (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48087](https://github.com/cilium/cilium/issues/48087), [@&#8203;squeed](https://github.com/squeed)) - Fragmented UDP packets were potentially mis-classified as Cilium Wireguard traffic. (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48139](https://github.com/cilium/cilium/issues/48139), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - gateway-api: fix listener programmed status update (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48013](https://github.com/cilium/cilium/issues/48013), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: propgate listenerset status update errors (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48130](https://github.com/cilium/cilium/issues/48130), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - hubble: fix four config knobs that never reach their sink (Backport PR [#&#8203;48434](https://github.com/cilium/cilium/issues/48434), Upstream PR [#&#8203;47637](https://github.com/cilium/cilium/issues/47637), [@&#8203;aanm](https://github.com/aanm)) - Improve reliability for fast recovery of disrupted TCP connections that access a DSR-enabled Service. (Backport PR [#&#8203;48465](https://github.com/cilium/cilium/issues/48465), Upstream PR [#&#8203;48254](https://github.com/cilium/cilium/issues/48254), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - lb (fix): require active state for backend when using topology hints (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;47054](https://github.com/cilium/cilium/issues/47054), [@&#8203;CarrySauce](https://github.com/CarrySauce)) - nodediscovery: Reduced EC2 IMDS load and made ENI node registration more resilient by fetching the instance metadata once instead of on every CiliumNode update. (Backport PR [#&#8203;48603](https://github.com/cilium/cilium/issues/48603), Upstream PR [#&#8203;48218](https://github.com/cilium/cilium/issues/48218), [@&#8203;41ks](https://github.com/41ks)) - operator/ipam: Restore fatal exit when the IPAM node watcher fails (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47778](https://github.com/cilium/cilium/issues/47778), [@&#8203;HadrienPatte](https://github.com/HadrienPatte)) - Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48015](https://github.com/cilium/cilium/issues/48015), [@&#8203;giorio94](https://github.com/giorio94)) - The BPF NAT engine now drops ICMP error packets which contain a fragmented TCP/UDP/SCTP packet. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48174](https://github.com/cilium/cilium/issues/48174), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - When using DSR with --bpf-lb-dsr-dispatch set to "opt" or "geneve" in combination with --enable-pmtu-discovery, fix the outer source IP of the ICMP error message which is generated when a forwarded DSR request exceeds the network interface's MTU. (Backport PR [#&#8203;48114](https://github.com/cilium/cilium/issues/48114), Upstream PR [#&#8203;48053](https://github.com/cilium/cilium/issues/48053), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) **CI Changes:** - \[v1.20] golangci-lint: Do not run the modernize linter ([#&#8203;48398](https://github.com/cilium/cilium/issues/48398), [@&#8203;aanm](https://github.com/aanm)) - .github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48462](https://github.com/cilium/cilium/issues/48462), [@&#8203;joestringer](https://github.com/joestringer)) - BPF: Refactor nat tests to use scapy fixtures and add checksum coverage (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47222](https://github.com/cilium/cilium/issues/47222), [@&#8203;tommyp1ckles](https://github.com/tommyp1ckles)) - bpf: tests: fix up prog type in ipv6_test (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47736](https://github.com/cilium/cilium/issues/47736), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - bpf: tests: use PROG_TYPE (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47714](https://github.com/cilium/cilium/issues/47714), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - bpf: tests: validate CT entry for DSR connection (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48219](https://github.com/cilium/cilium/issues/48219), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - ci: replace unsupported LLVM installation action (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;47776](https://github.com/cilium/cilium/issues/47776), [@&#8203;bogdankrasko](https://github.com/bogdankrasko)) - ci: resolve renovate PR metadata in base image workflows (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47964](https://github.com/cilium/cilium/issues/47964), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - ci: stop asking a PHP app for the AKS runner IP (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48371](https://github.com/cilium/cilium/issues/48371), [@&#8203;aanm](https://github.com/aanm)) - ci: use GitHub App client ID in v1.20 image workflow (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47787](https://github.com/cilium/cilium/issues/47787), [@&#8203;bogdankrasko](https://github.com/bogdankrasko)) - datapath/loader: fix missing complexity coverage for enable_identity_mark (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48037](https://github.com/cilium/cilium/issues/48037), [@&#8203;tklauser](https://github.com/tklauser)) - gh: verifier: test PR branch before base branch (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;47928](https://github.com/cilium/cilium/issues/47928), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - gha/conformance-aks: add a timeout to the cluster create step (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48545](https://github.com/cilium/cilium/issues/48545), [@&#8203;aanm](https://github.com/aanm)) - gha/conformance-aks: give the nodes a 64 GiB OS disk (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48481](https://github.com/cilium/cilium/issues/48481), [@&#8203;aanm](https://github.com/aanm)) - gha/kubespray: don't wait for CoreDNS before Cilium is installed (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48048](https://github.com/cilium/cilium/issues/48048), [@&#8203;aanm](https://github.com/aanm)) - gha: bound the LLVM prereq apt step with a 5m timeout (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48069](https://github.com/cilium/cilium/issues/48069), [@&#8203;aanm](https://github.com/aanm)) - gha: compute the ginkgo cache key once, before the matrix (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48127](https://github.com/cilium/cilium/issues/48127), [@&#8203;aanm](https://github.com/aanm)) - gha: move GCP auth pin past the STS token exchange retry fix (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48352](https://github.com/cilium/cilium/issues/48352), [@&#8203;aanm](https://github.com/aanm)) - gha: publish the external target hostnames as FQDNs (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48478](https://github.com/cilium/cilium/issues/48478), [@&#8203;aanm](https://github.com/aanm)) - gha: stop JUnit reports being destroyed by same-name legs (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48203](https://github.com/cilium/cilium/issues/48203), [@&#8203;aanm](https://github.com/aanm)) - logging: downgrade canceled response-body reads to info (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48202](https://github.com/cilium/cilium/issues/48202), [@&#8203;aanm](https://github.com/aanm)) - Makefile: Order the bpf codegen ahead of the Go builds (Backport PR [#&#8203;48735](https://github.com/cilium/cilium/issues/48735), Upstream PR [#&#8203;48644](https://github.com/cilium/cilium/issues/48644), [@&#8203;aanm](https://github.com/aanm)) - Revert 48441 - disable local accounts on AKS clusters ([#&#8203;48524](https://github.com/cilium/cilium/issues/48524), [@&#8203;aanm](https://github.com/aanm)) - test(bpf): parallelize eBPF test execution (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47427](https://github.com/cilium/cilium/issues/47427), [@&#8203;lconnery](https://github.com/lconnery)) - test/k8s: wait for the L7 visibility policy to be realized (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48365](https://github.com/cilium/cilium/issues/48365), [@&#8203;aanm](https://github.com/aanm)) - test: fix the never-taken retry on a partially read JSON line (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;48190](https://github.com/cilium/cilium/issues/48190), [@&#8203;aanm](https://github.com/aanm)) - tools: complexity: de-couple StackDepth from kernel version (Backport PR [#&#8203;48200](https://github.com/cilium/cilium/issues/48200), Upstream PR [#&#8203;48236](https://github.com/cilium/cilium/issues/48236), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - workflows: disable local accounts on AKS clusters ([#&#8203;48441](https://github.com/cilium/cilium/issues/48441), [@&#8203;nbusseneau](https://github.com/nbusseneau)) **Misc Changes:** - Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;48421](https://github.com/cilium/cilium/issues/48421), [@&#8203;0xch4z](https://github.com/0xch4z)) - bpf/lib/nat: rename icmpoff (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;47797](https://github.com/cilium/cilium/issues/47797), [@&#8203;tommyp1ckles](https://github.com/tommyp1ckles)) - bpf: dsr: use eth_store_proto() in dsr_reply_icmp\*() (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47392](https://github.com/cilium/cilium/issues/47392), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - bpf: icmp\*: fix up sample length (Backport PR [#&#8203;48114](https://github.com/cilium/cilium/issues/48114), Upstream PR [#&#8203;48020](https://github.com/cilium/cilium/issues/48020), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - bpf: misc cleanups (Backport PR [#&#8203;48350](https://github.com/cilium/cilium/issues/48350), Upstream PR [#&#8203;47879](https://github.com/cilium/cilium/issues/47879), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (Backport PR [#&#8203;48284](https://github.com/cilium/cilium/issues/48284), Upstream PR [#&#8203;46232](https://github.com/cilium/cilium/issues/46232), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - bpf: Reduce stack usage of send_trace_notify (Backport PR [#&#8203;48350](https://github.com/cilium/cilium/issues/48350), Upstream PR [#&#8203;47911](https://github.com/cilium/cilium/issues/47911), [@&#8203;joamaki](https://github.com/joamaki)) - chore(deps): update all external docker images dependencies (v1.20) (patch) ([#&#8203;48147](https://github.com/cilium/cilium/issues/48147), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all external docker images dependencies to v0.13.6 (v1.20) ([#&#8203;48673](https://github.com/cilium/cilium/issues/48673), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#&#8203;48326](https://github.com/cilium/cilium/issues/48326), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#&#8203;48506](https://github.com/cilium/cilium/issues/48506), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all github action dependencies (v1.20) ([#&#8203;48677](https://github.com/cilium/cilium/issues/48677), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#&#8203;48149](https://github.com/cilium/cilium/issues/48149), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#&#8203;48325](https://github.com/cilium/cilium/issues/48325), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update all-dependencies (v1.20) ([#&#8203;48619](https://github.com/cilium/cilium/issues/48619), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.20) ([#&#8203;48327](https://github.com/cilium/cilium/issues/48327), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update base-images (v1.20) ([#&#8203;48672](https://github.com/cilium/cilium/issues/48672), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency bufbuild/buf to v1.73.0 (v1.20) ([#&#8203;48729](https://github.com/cilium/cilium/issues/48729), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.20) ([#&#8203;48344](https://github.com/cilium/cilium/issues/48344), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.20) ([#&#8203;48505](https://github.com/cilium/cilium/issues/48505), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update dependency semver to v3.1.0 (v1.20) ([#&#8203;48730](https://github.com/cilium/cilium/issues/48730), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.20) ([#&#8203;48517](https://github.com/cilium/cilium/issues/48517), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update google/cloud-sdk docker tag to v581 (v1.20) ([#&#8203;48150](https://github.com/cilium/cilium/issues/48150), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update helm/kind-action action to v1.15.0 (v1.20) ([#&#8203;48591](https://github.com/cilium/cilium/issues/48591), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1787987562-ac0b61a4c0a45670a3654448d53bd6416b948f62 (v1.20) ([#&#8203;48323](https://github.com/cilium/cilium/issues/48323), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.20) ([#&#8203;48451](https://github.com/cilium/cilium/issues/48451), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.20) ([#&#8203;48674](https://github.com/cilium/cilium/issues/48674), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#&#8203;48148](https://github.com/cilium/cilium/issues/48148), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#&#8203;48324](https://github.com/cilium/cilium/issues/48324), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#&#8203;48504](https://github.com/cilium/cilium/issues/48504), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - chore(deps): update stable lvh-images (v1.20) (patch) ([#&#8203;48675](https://github.com/cilium/cilium/issues/48675), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - ci: disable TCP/UDPRouteWeightedRouting gateway-api conformance tests (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48375](https://github.com/cilium/cilium/issues/48375), [@&#8203;0xch4z](https://github.com/0xch4z)) - datapath: move some feature probes into BPF (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47737](https://github.com/cilium/cilium/issues/47737), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - docs: fix extra closing parenthesis in hive.rst (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;48541](https://github.com/cilium/cilium/issues/48541), [@&#8203;logi74123](https://github.com/logi74123)) - docs: Improve build process (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;47751](https://github.com/cilium/cilium/issues/47751), [@&#8203;joestringer](https://github.com/joestringer)) - docs: remove outdated tip about disabling hubble before enabling UI (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;48487](https://github.com/cilium/cilium/issues/48487), [@&#8203;ekoops](https://github.com/ekoops)) - docs: Remove v1.18 ipsec documentation (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48224](https://github.com/cilium/cilium/issues/48224), [@&#8203;joestringer](https://github.com/joestringer)) - docs: Update kernel config requirements (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;48594](https://github.com/cilium/cilium/issues/48594), [@&#8203;pchaigno](https://github.com/pchaigno)) - Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48428](https://github.com/cilium/cilium/issues/48428), [@&#8203;marcus-chae](https://github.com/marcus-chae)) - Documentation: document mesh security model (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;47912](https://github.com/cilium/cilium/issues/47912), [@&#8203;bimmlerd](https://github.com/bimmlerd)) - envoy: Clarify legacy UpdateEnvoyResources (Backport PR [#&#8203;48213](https://github.com/cilium/cilium/issues/48213), Upstream PR [#&#8203;48066](https://github.com/cilium/cilium/issues/48066), [@&#8203;jrajahalme](https://github.com/jrajahalme)) - Fix (eBPF): Pointer-to-Pointer Misuse in IPv6 Trace Notifications (Backport PR [#&#8203;48350](https://github.com/cilium/cilium/issues/48350), Upstream PR [#&#8203;47908](https://github.com/cilium/cilium/issues/47908), [@&#8203;weizhoublue](https://github.com/weizhoublue)) - Fix Component Overview doc link rendering (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;48537](https://github.com/cilium/cilium/issues/48537), [@&#8203;eneiss](https://github.com/eneiss)) - fix(deps): update k8s.io patch updates stable to v0.36.4 (v1.20) ([#&#8203;48118](https://github.com/cilium/cilium/issues/48118), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module google.golang.org/grpc to v1.83.1 \[security] (v1.20) ([#&#8203;48388](https://github.com/cilium/cilium/issues/48388), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - fix(deps): update module sigs.k8s.io/gateway-api/conformance to v1.6.2 (v1.20) ([#&#8203;48676](https://github.com/cilium/cilium/issues/48676), [@&#8203;cilium-renovate](https://github.com/cilium-renovate)\[bot]) - Fixed broken Slack link on Community page. (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;48021](https://github.com/cilium/cilium/issues/48021), [@&#8203;ps-mir](https://github.com/ps-mir)) - Fixes: Update node-cache image version to 1.26.5 (Backport PR [#&#8203;48634](https://github.com/cilium/cilium/issues/48634), Upstream PR [#&#8203;48270](https://github.com/cilium/cilium/issues/48270), [@&#8203;zyue110026](https://github.com/zyue110026)) - gateway-api: avoid logging missing GatewayClass as error (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48529](https://github.com/cilium/cilium/issues/48529), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: deduplicate condition merge helpers (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48122](https://github.com/cilium/cilium/issues/48122), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract BackendTLSPolicy status handling into BackendTLSPolicyStatusManager (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48068](https://github.com/cilium/cilium/issues/48068), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract gateway address status handling (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48129](https://github.com/cilium/cilium/issues/48129), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract index & load functionality from controller / reconcile (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;47837](https://github.com/cilium/cilium/issues/47837), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract listener status handling (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48103](https://github.com/cilium/cilium/issues/48103), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: extract route status handling into RouteStatusManager (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48023](https://github.com/cilium/cilium/issues/48023), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: make gateway-api reconciler client and scheme fields private (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48191](https://github.com/cilium/cilium/issues/48191), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: only load referenced services & serviceimports (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48469](https://github.com/cilium/cilium/issues/48469), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: put ctx first in route status API (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48074](https://github.com/cilium/cilium/issues/48074), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: remove duplicate gateway reconcile error logs (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48186](https://github.com/cilium/cilium/issues/48186), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: remove Gateway LBIPAM annotation warning (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;48187](https://github.com/cilium/cilium/issues/48187), [@&#8203;mhofstetter](https://github.com/mhofstetter)) - gateway-api: remove pre-filtered namespaces concept (Backport PR [#&#8203;48581](https://github.com/cilium/cilium/issues/48581), Upstream PR [#&#8203;47685](https://github.com/cilium/cilium/issues/47685), [@&#8203;asauber](https://github.com/asauber)) - gha/lint-ariane-config: let Renovate manage the Go version (Backport PR [#&#8203;48550](https://github.com/cilium/cilium/issues/48550), Upstream PR [#&#8203;48467](https://github.com/cilium/cilium/issues/48467), [@&#8203;aanm](https://github.com/aanm)) - gha: authenticate release images with OIDC (Backport PR [#&#8203;48599](https://github.com/cilium/cilium/issues/48599), Upstream PR [#&#8203;48062](https://github.com/cilium/cilium/issues/48062), [@&#8203;aanm](https://github.com/aanm)) - gha: authenticate stable Image CI to quay.io with OIDC (Backport PR [#&#8203;48060](https://github.com/cilium/cilium/issues/48060), Upstream PR [#&#8203;48061](https://github.com/cilium/cilium/issues/48061), [@&#8203;aanm](https://github.com/aanm)) - gha: correct and move the OIDC subject comments (Backport PR [#&#8203;48060](https://github.com/cilium/cilium/issues/48060), Upstream PR [#&#8203;48370](https://github.com/cilium/cilium/issues/48370), [@&#8203;aanm](https://github.com/aanm)) - gha: raise the Docker Hub OIDC token lifetime for release builds (Backport PR [#&#8203;48599](https://github.com/cilium/cilium/issues/48599), Upstream PR [#&#8203;48535](https://github.com/cilium/cilium/issues/48535), [@&#8203;aanm](https://github.com/aanm)) - helm: add general busybox image values for substitution (Backport PR [#&#8203;48418](https://github.com/cilium/cilium/issues/48418), Upstream PR [#&#8203;47973](https://github.com/cilium/cilium/issues/47973), [@&#8203;0xch4z](https://github.com/0xch4z)) - vendor: Bump StateDB to v0.8.4 ([#&#8203;48248](https://github.com/cilium/cilium/issues/48248), [@&#8203;joamaki](https://github.com/joamaki)) **Other Changes:** - \[v1.20] bpf: Force-align IPv4 CT tuples used by revSNAT memcpy() ([#&#8203;48395](https://github.com/cilium/cilium/issues/48395), [@&#8203;julianwiedmann](https://github.com/julianwiedmann)) - install: Update image digests for v1.20.1 ([#&#8203;48039](https://github.com/cilium/cilium/issues/48039), [@&#8203;cilium-release-bot](https://github.com/cilium-release-bot)\[bot]) #### Docker Manifests ##### cilium `quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01` `quay.io/cilium/cilium:stable@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01` ##### clustermesh-apiserver `quay.io/cilium/clustermesh-apiserver:v1.20.2@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce` `quay.io/cilium/clustermesh-apiserver:stable@sha256:e9ffc79baf76bb98efb87c01be3bca8da998779f4ccdafc97c74132b307305ce` ##### hubble-relay `quay.io/cilium/hubble-relay:v1.20.2@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f` `quay.io/cilium/hubble-relay:stable@sha256:d309c977870e9dbede7122a10eee09a4c9d66685e8d52af62d9c3c113f815b0f` ##### operator-alibabacloud `quay.io/cilium/operator-alibabacloud:v1.20.2@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38` `quay.io/cilium/operator-alibabacloud:stable@sha256:3c1536f099595c3d967d17d7f2ce290c6adea93777a514081e84a9d82e271e38` ##### operator-aws `quay.io/cilium/operator-aws:v1.20.2@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3` `quay.io/cilium/operator-aws:stable@sha256:0df92d10d2ec548052678b67809c1e613429931b2d5c1d6741fcef096bb0d2a3` ##### operator-azure `quay.io/cilium/operator-azure:v1.20.2@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a` `quay.io/cilium/operator-azure:stable@sha256:b304dc1ad8dd06abb2103bdb91c87dcc302d904e1e4cbe0afd231885d1f0194a` ##### operator-generic `quay.io/cilium/operator-generic:v1.20.2@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc` `quay.io/cilium/operator-generic:stable@sha256:64d8798350e8569b8e7622563fed6e44dce2625f311e4651b774816516c744fc` ##### operator `quay.io/cilium/operator:v1.20.2@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c` `quay.io/cilium/operator:stable@sha256:3ca39a5cb69798d8ffcdea3615cb396074b34b9013799685724b00ab4bf26a0c` </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - "after 3am and before 6am" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjcuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE2Ny4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJhdXRvbWF0ZWQtdXBkYXRlIiwiYmxhc3QtcmFkaXVzIiwiZGVwZW5kZW5jaWVzIiwibmVlZHMtcmV2aWV3Il19-->

renovate-bot added the needs-reviewblast-radiusdependenciesautomated-update labels 2026-11-02 08:16:05 +00:00

renovate-bot added 1 commit 2026-11-02 08:16:05 +00:00

chore(deps): Update Helm release cilium to v1.20.4 3bab498ee6

renovate-bot force-pushed renovate/cilium-1.x from 3bab498ee6 to 38076f1cff 2026-11-05 08:15:54 +00:00 Compare

jakman85 merged commit 5b484f6b78 into main 2026-11-07 03:07:19 +00:00

jakman85 referenced this issue from a commit 2026-11-07 03:07:20 +00:00

Merge pull request 'chore(deps): Update Helm release cilium to v1.20.4' (#104) from renovate/cilium-1.x into main

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

agent

automated-update

blast-radius

breaking

ci-tooling

dependencies

needs-review

own-image

range-widen

No labels automated-update blast-radius dependencies needs-review

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

gitea-admin jakman85 (Keith Jackson) pm-agent renovate-bot

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Home-Network/home-network-k3s-impl#104