chore(deps): update helm release cilium to v1.19.1 by samip5-bot[bot] · Pull Request #261 · samip5/k8s-dev-cluster

samip5-bot · 2025-07-29T16:08:56Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
cilium (source)	HelmChart	minor	`1.17.6` → `1.19.1`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

cilium/cilium (cilium)

`v1.19.1`: 1.19.1

Compare Source

Summary of Changes

Bugfixes:

clustermesh: fix CRD update permission for MCS-API CRD install (Backport PR #44280, Upstream PR #44224, @Preisschild)
Fix panic during datapath reinitialization if DirectRouting device is required but missing (Backport PR #44280, Upstream PR #44219, @fristonio)
helm: Fixed RBAC errors with operator.enabled=false by aligning cilium-tlsinterception-secrets Role/RoleBinding conditionals (Backport PR #44280, Upstream PR #44159, @puwun)
Reduces rtnl_mutex contention on SR-IOV nodes by not requesting VF information in netlink RTM_GETLINK operations (Backport PR #44280, Upstream PR #43517, @pasteley)

CI Changes:

ci: e2e: add kernel to workflow job names (Backport PR #44127, Upstream PR #44291, @smagnani96)
gh: ariane: don't run cloud workflows for LVH kernel updates (Backport PR #44147, Upstream PR #44109, @julianwiedmann)
gh: ariane: skip more workflows for LVH kernel updates (Backport PR #44147, Upstream PR #44115, @julianwiedmann)

Misc Changes:

chore(deps): update all github action dependencies (v1.19) (#44248, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#44368, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#44363, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#44247, @cilium-renovate[bot])
chore(deps): update cilium/cilium-cli action to v0.19.1 (v1.19) (#44343, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.1 (v1.19) (#44400, @cilium-renovate[bot])
chore(deps): update docker.io/library/busybox:1.37.0 docker digest to b3255e7 (v1.19) (#44242, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.7 docker digest to 85c0ab0 (v1.19) (#44364, @cilium-renovate[bot])
chore(deps): update gcr.io/distroless/static:nonroot docker digest to f9f84bd (v1.19) (#44243, @cilium-renovate[bot])
chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.8 (v1.19) (#44365, @cilium-renovate[bot])
chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260206102632-39e3d06a2850 (v1.19) (#44244, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1770265024-9828c064a10df81f1939b692b01203d88bb439e4 (v1.19) (#44245, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1770554954-8ce3bb4eca04188f4a0a1bfbd0a06a40f90883de (v1.19) (#44262, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663 (v1.19) (#44366, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#44246, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#44367, @cilium-renovate[bot])
ci: e2e: improve GitHub action readability (Backport PR #44127, Upstream PR #44126, @smagnani96)
docs: Update docsearch to v4.5.4 (Backport PR #44272, Upstream PR #44233, @joestringer)
endpoint/watchdog: fetch all endpoints without programs loaded (Backport PR #44280, Upstream PR #44111, @mhofstetter)
gateway-apis: Correct supported versions in docs (#44217, @youngnick)
Policy Tiers: feature-flagging, add fuzzer, fix corner cases (Backport PR #44267, Upstream PR #43893, @jrajahalme)
Policy: Fix rule origin for ordered policies (Backport PR #44280, Upstream PR #44178, @jrajahalme)

Other Changes:

install: Update image digests for v1.19.0 (#44172, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.1@sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.1@sha256:56d6c3dc13b50126b80ecb571707a0ea97f6db694182b9d61efd386d04e5bb28

docker-plugin

quay.io/cilium/docker-plugin:v1.19.1@sha256:6edfbf46ca484b1ed961f3c7382159ba7f0227e7af692159e99e8d4810ecaf34

hubble-relay

quay.io/cilium/hubble-relay:v1.19.1@sha256:d8c4e13bc36a56179292bb52bc6255379cb94cb873700d316ea3139b1bdb8165

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.1@sha256:837b12f4239e88ea5b4b5708ab982c319a94ee05edaecaafe5fd0e5b1962f554

operator-aws

quay.io/cilium/operator-aws:v1.19.1@sha256:18913d05a6c4d205f0b7126c4723bb9ccbd4dc24403da46ed0f9f4bf2a142804

operator-azure

quay.io/cilium/operator-azure:v1.19.1@sha256:82bce78603056e709d4c4e9f9ebb25c222c36d8a07f8c05381c2372d9078eca8

operator-generic

quay.io/cilium/operator-generic:v1.19.1@sha256:e7278d763e448bf6c184b0682cf98cdca078d58a27e1b2f3c906792670aa211a

operator

quay.io/cilium/operator:v1.19.1@sha256:93a6306d4543f1d8eccd79d6770c00ef4d4791f66326d97f9851f9d316e70141

`v1.19.0`: 1.19.0

Compare Source

🎉 Release Announcement 🎉: We are excited to announce the Cilium 1.19.0 release!

A total of 2934 new commits have been contributed to this release by a growing community of over 1010 developers and over 23,600 GitHub stars! 🤩

⚠️ You may need to take action during upgrade to Cilium v1.19 if you use Network Policies, Cluster Mesh, LoadBalancer IPAM or BGP. See the Upgrade Guide for more details.

The full changelog can be found here.

Here are some of the highlights:

🛡️ Network Policy
- 🃏 Multi-Level DNS Matches: DNS Policies match pattern now support a wildcard prefix(**.) to match multilevel subdomain as pattern prefix. (cilium/cilium#43420, @fristonio)
- 📡 Match New Protocols: You can now match VRRP and IGMP protocols in host firewall rules. (cilium/cilium#39872, @aditighag; cilium/cilium#41949, @kyounghunJang)
- ⛔ Actively Deny Connections: When Network Policies deny a connection, Cilium can return ICMPv4 "Destination unreachable" messages for a friendlier deny. (cilium/cilium#41406, @antonipp)
- 🌐 Select Clusters Explicitly: When network policy selectors don't explicitly define a cluster for communication to be allowed, they will now default to only allowing the local cluster. (cilium/cilium#40609, @MrFreezeex)
- 🔧 Unlock Future Work: This release brings several internal improvements to the network policy engine in preparation for features planned in the next Cilium minor release (cilium/cilium#39906, @vipul-21; cilium/cilium#42784, cilium/cilium#42896, @jrajahalme)
- ⚠️ Deprecate underutilized features: To focus on solving common problems Cilium users face, this release deprecates the Kafka protocol match fields (beta), as well as the ToRequires and FromRequires policy fields. (cilium/cilium#43167, @sayboras; cilium/cilium#40967, @TheBeeZee)
🔒 Encryption & Authentication
- 🔐 Encryption Strict Modes: Both IPsec and WireGuard transparent encryption modes now support a "strict mode" to require traffic to be encrypted between nodes. Unencrypted traffic will be dropped in this mode. (cilium/cilium#39239, cilium/cilium#42115, @rgo3, @julianwiedmann)
- 🚇 Ztunnel Beta: You can enroll namespaces into Ztunnel, which enables TCP connections between workloads to be transparently encrypted and authenticated. (cilium/cilium#42766, cilium/cilium#42819, cilium/cilium#43227 and others, @ldelossa, @rgo3, @nddq)
- 👥 Mutual Authentication: The out-of-band Mutual Authentication feature is now disabled by default, pending community feedback. If you have a requirement for mTLS, consider trying the new Ztunnel integration. (cilium/cilium#42665, @christarazi)
- ↪️ Accelerate IPsec: The IPsec encryption mode now supports BPF Host Routing for faster route lookups (cilium/cilium#41997, @pchaigno)
🚠 Networking
- 🚀 BIG TCP in Tunnels: Leverage upcoming Linux support for BIG TCP when communicating over UDP-based tunnels such as VXLAN and Geneve. (cilium/cilium#43416, @gentoo-root)
- 🥌 Packetization-Layer Path MTU Discovery: Detect maximum transmission unit (MTU) sizes for network paths using TCP. (cilium/cilium#42012, cilium/cilium#43710, @tommyp1ckles)
- 🚆 IPv6 Underlay: You can now choose IPv6 for the tunnel underlay address family on dual-stack clusters. (cilium/cilium#40324, @pchaigno)
- 🏷️ Multi-Pool IPAM is ready for wider use: Update the Multi-Pool IPAM feature to work with IPsec and direct routing modes, and promote it from Beta to Stable. (cilium/cilium#40460, cilium/cilium#42191, @pippolo84)
- 🎭 More Configurable Masquerade: IP Masquerade configuration can now be customized for traffic sent to nodes in other IP subnets, and addresses in IPAM pools can be excluded from masquerade (cilium/cilium#37568, @behzad-mir; cilium/cilium#43380, @alimehrabikoshki)
🕸️ Services and Service Mesh
- 📣 Layer-2 Announcements: Add support for Neighbor Discovery Advertisements for IPv6 Layer-2 Announcements. (cilium/cilium#39648, @msune)
- 🔁 IPv6 Service Loopback: Pods can now connect to themselves via a Kubernetes "loopback service" using IPv6. (cilium/cilium#39594, @saiaunghlyanhtet)
- ⛩️ Gateway API Enhancements: Cilium's GAMMA support now includes support for using GRPCRoute as well as HTTPRoute. (cilium/cilium#41936, @youngnick)
🛣️ Border Gateway Protocol (BGP)
- 🔌 Advertise Addresses from Interfaces: There's a new Interface BGP advertisement type that allows advertisement of IPs assigned on local interfaces. This can be useful for example in multi-homing setups, where a common node's loopback address can be advertised via multiple BGP sessions over different network interfaces. (cilium/cilium#42469, @rastislavs)
- ✉️ Override Source IP addresses: You can override the auto-generated BGP session source IP with the IP address applied on the configured sourceInterface to allow binding the BGP connection to the loopback address which is not tied to the specific physical interface's lifecycle (cilium/cilium#42583, @rastislavs)
- 🔁 Withdraw Empty Routes: Optionally withdraw BGP routes when a service has 0 endpoints, to allow balancing to a different DC/cluster with externalTrafficPolicy=Cluster (cilium/cilium#40717, @oblazek)
- ⚠️ Move to cilium.io/v2 API: The support for the older CiliumBGPPeeringPolicy v1 API is now removed and should be replaced with v2 APIs. (cilium/cilium#42278, @rastislavs)
🛰️ Observability
- 🔬 Trace IP Options: Configure Cilium and Hubble to trace specific packets through the cluster using IP Options. (cilium/cilium#41306, @Bigdelle)
- 🚩 Filter Encrypted Flows: Filter flows when using the hubble command line to understand the encryption status of the traffic, either --encrypted or --unencrypted. (cilium/cilium#43096, @SRodi)
- 🔖 Tag Drops with Policy Names: Hubble v1.Events drop messages now include which Network Policy caused the drop. (cilium/cilium#41693, @41ks)
🌅 Performance and Scale
- ⚡ Faster Network Policy Computation: Improve Cilium resource usage for handling selectors in network policies. (cilium/cilium#42008, @jrajahalme; cilium/cilium#42580, @odinuge)
- 🔌 More Efficient Connection Tracking: Several improvements have been made to reduce the number of connections being tracked by Cilium, particularly when using Geneve, VXLAN or WireGuard. (cilium/cilium#38782, @BenoitKnecht; cilium/cilium#41990, @bersoare)
- 💾 Better Scale in AWS: Reduce memory usage for cilium-operator in large AWS environments with many resources. (cilium/cilium#42529, @liyihuang)
⚙️ Operations
- 📦 Access Helm charts via Registry: Helm charts are also available under quay.io/cilium/charts/cilium (cilium/cilium#43624, @aanm)
- 📊 Metrics Encryption: Add TLS/mTLS support for Prometheus metrics exposed by the Cilium Operator. (cilium/cilium#42077, @phuhung273)
- 🤖 Easier Multi-Cluster install: There's now support for auto-installing the Custom Resource Definitions (CRDs) for Multi-Cluster Services (MCS). (cilium/cilium#40729, @MrFreezeex)
- 📜 Simpler Certificate Management: Streamline Cluster Mesh and Hubble certificate generation when using GitOps approaches. (cilium/cilium#42298, @MrFreezeex)
- 🛠️ Cilium dependencies were updated to Kubernetes v1.35, Envoy v1.35, Gateway API v1.4, and GoBGP v3.37. (cilium/cilium#43422, @aanm; cilium/cilium#40569, @sayboras; cilium/cilium#41936, @youngnick; cilium/cilium#42824, @rastislavs).
🏠 Community
- ❤️ Production Case Studies: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback!
- 📰 See studies with Airbnb, Cloudera, Cybozu, ESnet, Nutanix, OVHcloud, TikTok, University of Wisconsin–Madison.
- 🇺🇸 Atlanta Events: The community gathered at CiliumCon and the Cilium Developer Summit in Atlanta.
- 🇳🇱 Amsterdam Events: Meet us at the upcoming CiliumCon and Cilium Developer Summit in Amsterdam, March 23-27. Read more about where to find Cilium during the show.
- 🔟 Cilium is 10: Read the 2025 Cilium Annual Report to see the latest project milestones, a decade on from its first commit.

To keep up to date with all the latest Cilium releases, join #release 🎉

🎂❤️❤️❤️🎂
This is a very special release for Cilium, as it celebrates 10 years since the first commit. We couldn’t be more proud of what this project has accomplished. All the GitHub issues, pull requests, reviews, stars, forks, Docker pulls, Helm installs, Kubernetes applies, CI runs, bug reports, design docs, discussions, meetings, Slack messages, YouTube streams, eCHO episodes, conference talks, blog posts, demos, and presentations have made the project the success it is today.
🎂❤️❤️❤️🎂

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.0@sha256:be9f8571c2e114b3e12e41f785f2356ade703b2eac936aa878805565f0468c60

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.0@sha256:0e3b89fdb116eb0f5579fe8ee3fabb1a7c4d97987a1ae927491d9185785d4a49

docker-plugin

quay.io/cilium/docker-plugin:v1.19.0@sha256:35727047384f3d7a2684885003b266bf7a7add8fc66ca564b222f71c16057f50

hubble-relay

quay.io/cilium/hubble-relay:v1.19.0@sha256:7f17e5bb51a9f35bbc8e7a9ad5e347f03ff8003c2e5cc81171e8727a10bf03b4

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.0@sha256:5cb3d6981c233616037f3e13b5bc0020d114ad8db1b7360618b224e4c0b02ef0

operator-aws

quay.io/cilium/operator-aws:v1.19.0@sha256:7a236ae256a4fbd3f72d516921131eba5b43f401ba37cdee5cd0e8c26f9263e6

operator-azure

quay.io/cilium/operator-azure:v1.19.0@sha256:6ae7e0d75c74836af3600b775201c89ea7fcc13d6e08fdb0c52927309f31cd2a

operator-generic

quay.io/cilium/operator-generic:v1.19.0@sha256:5b04006015e5800307dc6314676edc4c0bb7ac2fc7848be2b94b43bb030ab648

operator

quay.io/cilium/operator:v1.19.0@sha256:deca84f442752dca0745dd09b13e8004569414839019ad79ac58f9fcaa3b9d65

`v1.18.7`: 1.18.7

Compare Source

Summary of Changes

Minor Changes:

Exclude topology.kubernetes.io labels from security labels by default (Backport PR #43777, Upstream PR #43725, @moscicky)
hubble-relay: Add hubble.relay.logOptions.format and hubble.relay.logOptions.level Helm values to configure log format (text, text-ts, json, json-ts) and level (debug, info, warn, error) (Backport PR #44004, Upstream PR #43644, @puwun)

Bugfixes:

Add permissions to the cilium-operator so that it can create EndpointSlices when the admission plugin OwnerReferencesPermissionEnforcement is activated (Backport PR #44034, Upstream PR #43912, @fgiloux)
bpf: Correct refinement of inner packet L4 checksum detection (Backport PR #43923, Upstream PR #43868, @br4243)
bpf: Fix marker to skip nodeport when punting to proxy (Backport PR #43886, Upstream PR #43069, @borkmann)
clustermesh: correctly phase out not ready/not service endpoints from global services (Backport PR #44056, Upstream PR #43807, @MrFreezeex)
Fix a bug with local redirect service entries being created when backend pods weren't ready. (Backport PR #43756, Upstream PR #43095, @aditighag)
Fix ICMP error packet handling by adding the missing checksum recalculation performed during RevNAT for SNATed load-balanced traffic. (Backport PR #43861, Upstream PR #43196, @yushoyamaguchi)
Grant permissions to the cilium-operator so that it can reconcile ingresses when the when the admission plugin OwnerReferencesPermissionEnforcement is activated (Backport PR #44034, Upstream PR #43949, @giorio94)
helm: Fixed RBAC errors with operator.enabled=false by aligning cilium-tlsinterception-secrets Role/RoleBinding conditionals (Backport PR #44281, Upstream PR #44159, @puwun)
loadbalancer: Fix GetInstancesOfService to avoid removing an endpoint from Service A causes all requests to Service B to fail if the name of Service A is the prefix of Service B (Backport PR #43777, Upstream PR #43620, @imroc)
Reduces rtnl_mutex contention on SR-IOV nodes by not requesting VF information in netlink RTM_GETLINK operations (Backport PR #44281, Upstream PR #43517, @pasteley)

CI Changes:

fix(ctmap/gc): fix race conditions and flakiness in TestGCEnableRatchet (Backport PR #44056, Upstream PR #42009, @AritraDey-Dev)
gh: ariane: don't run cloud workflows for LVH kernel updates (Backport PR #44148, Upstream PR #44109, @julianwiedmann)
gh: ariane: skip more workflows for LVH kernel updates (Backport PR #44148, Upstream PR #44115, @julianwiedmann)
gha: let CiliumEndpointSlice migration be run nightly on stable branches (Backport PR #44004, Upstream PR #43921, @giorio94)
gke: lower scope of ESP firewall rule (Backport PR #43865, Upstream PR #43691, @marseel)

Misc Changes:

.github/workflows: use proper directory structure for GH actions (#43760, @aanm)
chore(deps): update all github action dependencies (v1.18) (#43845, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#43984, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#44099, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#44253, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.18) (#43839, @cilium-renovate[bot])
chore(deps): update base-images (v1.18) (#43840, @cilium-renovate[bot])
chore(deps): update base-images (v1.18) (#43983, @cilium-renovate[bot])
chore(deps): update base-images (v1.18) (#44098, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.0 (v1.18) (#43844, @cilium-renovate[bot])
chore(deps): update docker.io/library/alpine docker tag to v3.22.3 (v1.18) (#44096, @cilium-renovate[bot])
chore(deps): update docker.io/library/busybox:1.37.0 docker digest to b3255e7 (v1.18) (#44249, @cilium-renovate[bot])
chore(deps): update docker.io/library/busybox:1.37.0 docker digest to e226d63 (v1.18) (#43979, @cilium-renovate[bot])
chore(deps): update docker.io/library/ubuntu:24.04 docker digest to cd1dba6 (v1.18) (#43980, @cilium-renovate[bot])
chore(deps): update gcr.io/distroless/static:nonroot docker digest to f9f84bd (v1.18) (#44250, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.3.2 (v1.18) (#43841, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1768610924-2528359430c6adba1ab20fc8396b4effe491ed96 (v1.18) (#43842, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1768828720-c6e4827ebca9c47af2a3a6540c563c30947bae29 (v1.18) (#43981, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1770265024-9828c064a10df81f1939b692b01203d88bb439e4 (v1.18) (#44251, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1770554954-8ce3bb4eca04188f4a0a1bfbd0a06a40f90883de (v1.18) (#44260, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#43843, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#43982, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#44097, @cilium-renovate[bot])
docs: add helm underlayProtocol value to documentation (Backport PR #44056, Upstream PR #43934, @aanm)
docs: adjust URL to latest stable Hubble CLI version (Backport PR #43777, Upstream PR #43745, @tklauser)
docs: Document hubble requirement on kernels with BPF_EVENTS compiled in (Backport PR #44056, Upstream PR #44042, @EmilyShepherd)
docs: Update docsearch to v4.5.4 (Backport PR #44273, Upstream PR #44233, @joestringer)
Documentation: Added Helm configuration instructions for enabling and customizing metrics. (Backport PR #44056, Upstream PR #43481, @suunj)
gitattributes: make install/kubernetes driver match more specific. (Backport PR #44056, Upstream PR #43943, @tommyp1ckles)
multicast: fix nil assignment to node configuration cell.Out map (Backport PR #43865, Upstream PR #40859, @ldelossa)
workflows: Add id-token permission to call-publish-helm job (Backport PR #43777, Upstream PR #43717, @aanm)

Other Changes:

.github/workflows: remove stable from v1.18 branch (#44153, @aanm)
[v1.18] Backport setup gke cluster (#43793, @Artyop)
install: Update image digests for v1.18.6 (#43714, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.7@sha256:99b029a0a7c2224dac8c1cc3b6b3ba52af00e2ff981d927e84260ee781e9753c

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.7@sha256:3d4512153afc5d8ceda3517f9b243619b55a67f9abaebcc92c4be2df94d43cfa

docker-plugin

quay.io/cilium/docker-plugin:v1.18.7@sha256:e9f15016c7247dffeb2a9216cccc2ab6d36345a2504d34e319c6e9a7873bf3e9

hubble-relay

quay.io/cilium/hubble-relay:v1.18.7@sha256:9bb9b2b1a4f4bef12a77738756cfbf970daa701e536e42f0a9c64a621bc7c9d5

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.7@sha256:ca3f0dd26a4b447524dce51ee8ef82485a08187b840c21ce4a1398c02b5174a0

operator-aws

quay.io/cilium/operator-aws:v1.18.7@sha256:fe56a6289afea7f6420f8de0218710ccaaa7af891df5fc180ddd33e6c7509b45

operator-azure

quay.io/cilium/operator-azure:v1.18.7@sha256:5fb753344c84ab0989d525f789738c874f3fa8f07fbb5cfce06034d027c9728f

operator-generic

quay.io/cilium/operator-generic:v1.18.7@sha256:244306c5e7c6b73dc7193424f46ed8a0530767b03f03baac80dd717a3a3f0ad7

operator

quay.io/cilium/operator:v1.18.7@sha256:8aa2bb32df776b8e8f6cfb57ab3eaed5a451bc9f20f1d62a2393840fc072678f

`v1.18.6`: 1.18.6

Compare Source

Summary of Changes

Major Changes:

Publish Helm charts to OCI registries (Backport PR #43689, Upstream PR #43624, @aanm)

Minor Changes:

Cilium Preflight check no longer includes Envoy Configmaps, making it easier to correctly run. (Backport PR #43290, Upstream PR #43153, @youngnick)
runtime: Add libatomic1 for cilium-envoy dependency (Backport PR #43642, Upstream PR #43292, @sayboras)

Bugfixes:

bpf:wireguard: delivery host packets to bpf_host for ingress policies (Backport PR #43690, Upstream PR #42892, @smagnani96)
cgroup: don't start watch if KPRConfig.EnableSocketLB is disabled (Backport PR #43290, Upstream PR #43256, @mhofstetter)
Fix a bug with local redirect service entries being created when backend pods weren't ready. (Backport PR #43425, Upstream PR #43095, @aditighag)
Fix an issue in proxy NOTRACK iptables rule for aws-cni chaining mode which causes proxy->upstream(outside cluster) traffic not being SNAT'd. (Backport PR #43676, Upstream PR #43566, @fristonio)
Fix GC of possible duplicated identities in kvstore mode (Backport PR #43425, Upstream PR #43287, @giorio94)
Fixes a deadlock that was causing endpoint to be stuck without progressing with any updates. (Backport PR #43290, Upstream PR #43242, @marseel)
gateway-api: correctly handle CiliumGatewayClassConfig as a namespaced resource. (Backport PR #43290, Upstream PR #43254, @youngnick)
xds: fix nil-pointer in processRequestStream (Backport PR #43612, Upstream PR #43609, @mhofstetter)

CI Changes:

bpf: tests: egressgw: enable HostFW (Backport PR #43337, Upstream PR #42955, @julianwiedmann)
bpf: tests: egressgw: install ipcache_v6_add_world_entry() (Backport PR #43337, Upstream PR #42988, @julianwiedmann)
chore: comment job to use generated token instead of PAT (Backport PR #43612, Upstream PR #43148, @sekhar-isovalent)
ci: Use newer lvh image for privileged tests (Backport PR #43490, Upstream PR #41082, @rastislavs)

Misc Changes:

.github/workflows: remove auto-requested reviewers (Backport PR #43425, Upstream PR #42952, @aanm)
Add documentation and examples for using the egressDeny field in CiliumNetworkPolicy (Backport PR #43425, Upstream PR #40272, @syedazeez337)
bpf: clear mark content before storing the cluster ID (Backport PR #43290, Upstream PR #43159, @giorio94)
bpf: prevent cluster ID from being incorrectly retrieved from mark when aliased (Backport PR #43290, Upstream PR #43258, @giorio94)
chore(deps): update all github action dependencies (v1.18) (#43467, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#43665, @cilium-renovate[bot])
chore(deps): update anchore/sbom-action action to v0.21.0 (v1.18) (#43512, @cilium-renovate[bot])
chore(deps): update base-images (v1.18) (#43543, @cilium-renovate[bot])
chore(deps): update base-images (v1.18) (#43664, @cilium-renovate[bot])
chore(deps): update docker.io/library/busybox:1.37.0 docker digest to 2383baa (v1.18) (#43662, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.11 docker digest to 54528d1 (v1.18) (#43464, @cilium-renovate[bot])
chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.7 (v1.18) (#43465, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.34.12-1767177245-7935d4d711cb6f8020385a50c996b90896e16a71 (v1.18) (#43539, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9 (v1.18) (#43638, @cilium-renovate[bot])
chore(deps): update rhysd/actionlint docker tag to v1.7.10 (v1.18) (#43541, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#43466, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#43542, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#43571, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#43663, @cilium-renovate[bot])
cmapisrv/test: miscellaneous fixes to the ciliumidentities script test (Backport PR #43425, Upstream PR #43372, @giorio94)
docs: Add missing IPv6 fragmentation BPF map reference (Backport PR #43290, Upstream PR #43161, @doniacld)
Fix a regression in the new services control plane where loadBalancerSourceRanges was applied by default to all service types. (Backport PR #43575, Upstream PR #42351, @borkmann)
operator: the K8s Secret synchronization process now resynchronizes after an hour for synced Secrets. (Backport PR #43425, Upstream PR #42414, @youngnick)
release: change OCI registry (Backport PR #43689, Upstream PR #43646, @aanm)
route: install ingress proxy routes with WireGuard and L7Proxy (Backport PR #43434, Upstream PR #42835, @smagnani96)

Other Changes:

[v1.18] bpf:hubble: support policy verdict from L3 devices (#43381, @smagnani96)
[v1.18] deps: bump CNI plugins version to v1.9.0 (#43593, @diyi0926)
install: Update image digests for v1.18.5 (#43400, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4
quay.io/cilium/cilium:stable@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.6@sha256:8ee142912a0e261850c0802d9256ddbe3729e1cd35c6bea2d93077f334c3cf3b
quay.io/cilium/clustermesh-apiserver:stable@sha256:8ee142912a0e261850c0802d9256ddbe3729e1cd35c6bea2d93077f334c3cf3b

docker-plugin

quay.io/cilium/docker-plugin:v1.18.6@sha256:7931555ad713a48a28e4bf097402e0e398461dbf51b81cb8192558c5cb0dc48f
quay.io/cilium/docker-plugin:stable@sha256:7931555ad713a48a28e4bf097402e0e398461dbf51b81cb8192558c5cb0dc48f

hubble-relay

quay.io/cilium/hubble-relay:v1.18.6@sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e
quay.io/cilium/hubble-relay:stable@sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.6@sha256:212c4cbe27da3772bcb952b8f8cbaa0b0eef72488b52edf90ad2b32072a3ca4c
quay.io/cilium/operator-alibabacloud:stable@sha256:212c4cbe27da3772bcb952b8f8cbaa0b0eef72488b52edf90ad2b32072a3ca4c

operator-aws

quay.io/cilium/operator-aws:v1.18.6@sha256:47dbc1a5bd483fec170dab7fb0bf2cca3585a4893675b0324d41d97bac8be5eb
quay.io/cilium/operator-aws:stable@sha256:47dbc1a5bd483fec170dab7fb0bf2cca3585a4893675b0324d41d97bac8be5eb

operator-azure

quay.io/cilium/operator-azure:v1.18.6@sha256:a57aff47aeb32eccfedaa2a49d1af984d996d6d6de79609c232e0c4cf9ce97a1
quay.io/cilium/operator-azure:stable@sha256:a57aff47aeb32eccfedaa2a49d1af984d996d6d6de79609c232e0c4cf9ce97a1

operator-generic

quay.io/cilium/operator-generic:v1.18.6@sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af
quay.io/cilium/operator-generic:stable@sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af

operator

quay.io/cilium/operator:v1.18.6@sha256:0e8903aa092025918761d24ae9a91af35baa5b6910b5d0e3feac91ab8a2bc65b
quay.io/cilium/operator:stable@sha256:0e8903aa092025918761d24ae9a91af35baa5b6910b5d0e3feac91ab8a2bc65b

`v1.18.5`: 1.18.5

Compare Source

Summary of Changes

Minor Changes:

[v1.18] proxy: Bump envoy version to v1.34.11 (#43143, @sayboras)
Change the sidecar etcd instance of the Cluster Mesh API Server listen on all IP addresses (Backport PR #42948, Upstream PR #42818, @giorio94)

Bugfixes:

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | helm | cilium | 1.17.6 | 1.19.1 |

samip5-bot Bot force-pushed the renovate/cilium-1.x branch from 9167de0 to a839406 Compare August 15, 2025 16:08

samip5-bot Bot changed the title ~~chore(deps): update helm release cilium to v1.18.0~~ chore(deps): update helm release cilium to v1.18.1 Aug 15, 2025

samip5-bot Bot force-pushed the renovate/cilium-1.x branch from a839406 to dcedd65 Compare September 17, 2025 20:07

samip5-bot Bot changed the title ~~chore(deps): update helm release cilium to v1.18.1~~ chore(deps): update helm release cilium to v1.18.2 Sep 17, 2025

samip5-bot Bot force-pushed the renovate/cilium-1.x branch from dcedd65 to 0856f3d Compare October 23, 2025 20:07

samip5-bot Bot changed the title ~~chore(deps): update helm release cilium to v1.18.2~~ chore(deps): update helm release cilium to v1.18.3 Oct 23, 2025

samip5-bot Bot force-pushed the renovate/cilium-1.x branch from 0856f3d to 5899fea Compare November 12, 2025 16:31

samip5-bot Bot changed the title ~~chore(deps): update helm release cilium to v1.18.3~~ chore(deps): update helm release cilium to v1.18.4 Nov 12, 2025

samip5-bot Bot force-pushed the renovate/cilium-1.x branch from 5899fea to a005793 Compare December 17, 2025 12:12

samip5-bot Bot changed the title ~~chore(deps): update helm release cilium to v1.18.4~~ chore(deps): update helm release cilium to v1.18.5 Dec 17, 2025

samip5-bot Bot force-pushed the renovate/cilium-1.x branch from a005793 to e96eab1 Compare January 13, 2026 12:13

samip5-bot Bot changed the title ~~chore(deps): update helm release cilium to v1.18.5~~ chore(deps): update helm release cilium to v1.18.6 Jan 13, 2026

samip5-bot Bot force-pushed the renovate/cilium-1.x branch from e96eab1 to aa1d6c6 Compare February 4, 2026 04:37

samip5-bot Bot changed the title ~~chore(deps): update helm release cilium to v1.18.6~~ chore(deps): update helm release cilium to v1.19.0 Feb 4, 2026

chore(deps): update helm release cilium to v1.19.1

5b47f50

| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | helm | cilium | 1.17.6 | 1.19.1 |

samip5-bot Bot force-pushed the renovate/cilium-1.x branch from aa1d6c6 to 5b47f50 Compare February 17, 2026 20:15

samip5-bot Bot changed the title ~~chore(deps): update helm release cilium to v1.19.0~~ chore(deps): update helm release cilium to v1.19.1 Feb 17, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update helm release cilium to v1.19.1 - #261

chore(deps): update helm release cilium to v1.19.1#261
samip5-bot[bot] wants to merge 1 commit into
mainfrom
renovate/cilium-1.x

samip5-bot Bot commented Jul 29, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

samip5-bot Bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.19.1: 1.19.1

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.19.0: 1.19.0

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.18.7: 1.18.7

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.18.6: 1.18.6

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.18.5: 1.18.5

Summary of Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

samip5-bot Bot commented Jul 29, 2025 •

edited

Loading

`v1.19.1`: 1.19.1

`v1.19.0`: 1.19.0

`v1.18.7`: 1.18.7

`v1.18.6`: 1.18.6

`v1.18.5`: 1.18.5