chore(deps): update helm release cilium to v1.19.1

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
cilium (source)	HelmChart	patch	1.19.0-pre.3 → 1.19.1

---

Release Notes

cilium/cilium (cilium)

v1.19.1: 1.19.1

Compare Source

Summary of Changes

Bugfixes:

• clustermesh: fix CRD update permission for MCS-API CRD install (Backport PR #​44280, Upstream PR #​44224, @​Preisschild)
• Fix panic during datapath reinitialization if DirectRouting device is required but missing (Backport PR #​44280, Upstream PR #​44219, @​fristonio)
• helm: Fixed RBAC errors with operator.enabled=false by aligning cilium-tlsinterception-secrets Role/RoleBinding conditionals (Backport PR #​44280, Upstream PR #​44159, @​puwun)
• Reduces rtnl_mutex contention on SR-IOV nodes by not requesting VF information in netlink RTM_GETLINK operations (Backport PR #​44280, Upstream PR #​43517, @​pasteley)

CI Changes:

• ci: e2e: add kernel to workflow job names (Backport PR #​44127, Upstream PR #​44291, @​smagnani96)
• gh: ariane: don't run cloud workflows for LVH kernel updates (Backport PR #​44147, Upstream PR #​44109, @​julianwiedmann)
• gh: ariane: skip more workflows for LVH kernel updates (Backport PR #​44147, Upstream PR #​44115, @​julianwiedmann)

Misc Changes:

• chore(deps): update all github action dependencies (v1.19) (#​44248, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​44368, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#​44363, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#​44247, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium-cli action to v0.19.1 (v1.19) (#​44343, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.1 (v1.19) (#​44400, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.37.0 docker digest to b3255e7 (v1.19) (#​44242, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.7 docker digest to 85c0ab0 (v1.19) (#​44364, @​cilium-renovate[bot])
• chore(deps): update gcr.io/distroless/static:nonroot docker digest to f9f84bd (v1.19) (#​44243, @​cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.8 (v1.19) (#​44365, @​cilium-renovate[bot])
• chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260206102632-39e3d06a2850 (v1.19) (#​44244, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1770265024-9828c064a10df81f1939b692b01203d88bb439e4 (v1.19) (#​44245, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1770554954-8ce3bb4eca04188f4a0a1bfbd0a06a40f90883de (v1.19) (#​44262, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663 (v1.19) (#​44366, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.19) (patch) (#​44246, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.19) (patch) (#​44367, @​cilium-renovate[bot])
• ci: e2e: improve GitHub action readability (Backport PR #​44127, Upstream PR #​44126, @​smagnani96)
• docs: Update docsearch to v4.5.4 (Backport PR #​44272, Upstream PR #​44233, @​joestringer)
• endpoint/watchdog: fetch all endpoints without programs loaded (Backport PR #​44280, Upstream PR #​44111, @​mhofstetter)
• gateway-apis: Correct supported versions in docs (#​44217, @​youngnick)
• Policy Tiers: feature-flagging, add fuzzer, fix corner cases (Backport PR #​44267, Upstream PR #​43893, @​jrajahalme)
• Policy: Fix rule origin for ordered policies (Backport PR #​44280, Upstream PR #​44178, @​jrajahalme)

Other Changes:

• install: Update image digests for v1.19.0 (#​44172, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.1@​sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.1@​sha256:56d6c3dc13b50126b80ecb571707a0ea97f6db694182b9d61efd386d04e5bb28

docker-plugin

quay.io/cilium/docker-plugin:v1.19.1@​sha256:6edfbf46ca484b1ed961f3c7382159ba7f0227e7af692159e99e8d4810ecaf34

hubble-relay

quay.io/cilium/hubble-relay:v1.19.1@​sha256:d8c4e13bc36a56179292bb52bc6255379cb94cb873700d316ea3139b1bdb8165

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.1@​sha256:837b12f4239e88ea5b4b5708ab982c319a94ee05edaecaafe5fd0e5b1962f554

operator-aws

quay.io/cilium/operator-aws:v1.19.1@​sha256:18913d05a6c4d205f0b7126c4723bb9ccbd4dc24403da46ed0f9f4bf2a142804

operator-azure

quay.io/cilium/operator-azure:v1.19.1@​sha256:82bce78603056e709d4c4e9f9ebb25c222c36d8a07f8c05381c2372d9078eca8

operator-generic

quay.io/cilium/operator-generic:v1.19.1@​sha256:e7278d763e448bf6c184b0682cf98cdca078d58a27e1b2f3c906792670aa211a

operator

quay.io/cilium/operator:v1.19.1@​sha256:93a6306d4543f1d8eccd79d6770c00ef4d4791f66326d97f9851f9d316e70141

v1.19.0: 1.19.0

Compare Source

🎉 Release Announcement 🎉: We are excited to announce the Cilium 1.19.0 release!

A total of 2934 new commits have been contributed to this release by a growing community of over 1010 developers and over 23,600 GitHub stars! 🤩

⚠️ You may need to take action during upgrade to Cilium v1.19 if you use Network Policies, Cluster Mesh, LoadBalancer IPAM or BGP. See the Upgrade Guide for more details.

The full changelog can be found here.

Here are some of the highlights:

• 🛡️ Network Policy

  • 🃏 Multi-Level DNS Matches: DNS Policies match pattern now support a wildcard prefix(**.) to match multilevel subdomain as pattern prefix. (cilium/cilium#43420, @​fristonio)
  • 📡 Match New Protocols: You can now match VRRP and IGMP protocols in host firewall rules. (cilium/cilium#39872, @​aditighag; cilium/cilium#41949, @​kyounghunJang)
  • ⛔ Actively Deny Connections: When Network Policies deny a connection, Cilium can return ICMPv4 "Destination unreachable" messages for a friendlier deny. (cilium/cilium#41406, @​antonipp)
  • 🌐 Select Clusters Explicitly: When network policy selectors don't explicitly define a cluster for communication to be allowed, they will now default to only allowing the local cluster. (cilium/cilium#40609, @​MrFreezeex)
  • 🔧 Unlock Future Work: This release brings several internal improvements to the network policy engine in preparation for features planned in the next Cilium minor release (cilium/cilium#39906, @​vipul-21; cilium/cilium#42784, cilium/cilium#42896, @​jrajahalme)
  • ⚠️ Deprecate underutilized features: To focus on solving common problems Cilium users face, this release deprecates the Kafka protocol match fields (beta), as well as the ToRequires and FromRequires policy fields. (cilium/cilium#43167, @​sayboras; cilium/cilium#40967, @​TheBeeZee)

• 🔒 Encryption & Authentication

  • 🔐 Encryption Strict Modes: Both IPsec and WireGuard transparent encryption modes now support a "strict mode" to require traffic to be encrypted between nodes. Unencrypted traffic will be dropped in this mode. (cilium/cilium#39239, cilium/cilium#42115, @​rgo3, @​julianwiedmann)
  • 🚇 Ztunnel Beta: You can enroll namespaces into Ztunnel, which enables TCP connections between workloads to be transparently encrypted and authenticated. (cilium/cilium#42766, cilium/cilium#42819, cilium/cilium#43227 and others, @​ldelossa, @​rgo3, @​nddq)
  • 👥 Mutual Authentication: The out-of-band Mutual Authentication feature is now disabled by default, pending community feedback. If you have a requirement for mTLS, consider trying the new Ztunnel integration. (cilium/cilium#42665, @​christarazi)
  • ↪️ Accelerate IPsec: The IPsec encryption mode now supports BPF Host Routing for faster route lookups (cilium/cilium#41997, @​pchaigno)

• 🚠 Networking

  • 🚀 BIG TCP in Tunnels: Leverage upcoming Linux support for BIG TCP when communicating over UDP-based tunnels such as VXLAN and Geneve. (cilium/cilium#43416, @​gentoo-root)
  • 🥌 Packetization-Layer Path MTU Discovery: Detect maximum transmission unit (MTU) sizes for network paths using TCP. (cilium/cilium#42012, cilium/cilium#43710, @​tommyp1ckles)
  • 🚆 IPv6 Underlay: You can now choose IPv6 for the tunnel underlay address family on dual-stack clusters. (cilium/cilium#40324, @​pchaigno)
  • 🏷️ Multi-Pool IPAM is ready for wider use: Update the Multi-Pool IPAM feature to work with IPsec and direct routing modes, and promote it from Beta to Stable. (cilium/cilium#40460, cilium/cilium#42191, @​pippolo84)
  • 🎭 More Configurable Masquerade: IP Masquerade configuration can now be customized for traffic sent to nodes in other IP subnets, and addresses in IPAM pools can be excluded from masquerade (cilium/cilium#37568, @​behzad-mir; cilium/cilium#43380, @​alimehrabikoshki)

• 🕸️ Services and Service Mesh

  • 📣 Layer-2 Announcements: Add support for Neighbor Discovery Advertisements for IPv6 Layer-2 Announcements. (cilium/cilium#39648, @​msune)
  • 🔁 IPv6 Service Loopback: Pods can now connect to themselves via a Kubernetes "loopback service" using IPv6. (cilium/cilium#39594, @​saiaunghlyanhtet)
  • ⛩️ Gateway API Enhancements: Cilium's GAMMA support now includes support for using GRPCRoute as well as HTTPRoute. (cilium/cilium#41936, @​youngnick)

• 🛣️ Border Gateway Protocol (BGP)

  • 🔌 Advertise Addresses from Interfaces: There's a new Interface BGP advertisement type that allows advertisement of IPs assigned on local interfaces. This can be useful for example in multi-homing setups, where a common node's loopback address can be advertised via multiple BGP sessions over different network interfaces. (cilium/cilium#42469, @​rastislavs)
  • ✉️ Override Source IP addresses: You can override the auto-generated BGP session source IP with the IP address applied on the configured sourceInterface to allow binding the BGP connection to the loopback address which is not tied to the specific physical interface's lifecycle (cilium/cilium#42583, @​rastislavs)
  • 🔁 Withdraw Empty Routes: Optionally withdraw BGP routes when a service has 0 endpoints, to allow balancing to a different DC/cluster with externalTrafficPolicy=Cluster (cilium/cilium#40717, @​oblazek)
  • ⚠️ Move to cilium.io/v2 API: The support for the older CiliumBGPPeeringPolicy v1 API is now removed and should be replaced with v2 APIs. (cilium/cilium#42278, @​rastislavs)

• 🛰️ Observability

  • 🔬 Trace IP Options: Configure Cilium and Hubble to trace specific packets through the cluster using IP Options. (cilium/cilium#41306, @​Bigdelle)
  • 🚩 Filter Encrypted Flows: Filter flows when using the hubble command line to understand the encryption status of the traffic, either --encrypted or --unencrypted. (cilium/cilium#43096, @​SRodi)
  • 🔖 Tag Drops with Policy Names: Hubble v1.Events drop messages now include which Network Policy caused the drop. (cilium/cilium#41693, @​41ks)

• 🌅 Performance and Scale

  • ⚡ Faster Network Policy Computation: Improve Cilium resource usage for handling selectors in network policies. (cilium/cilium#42008, @​jrajahalme; cilium/cilium#42580, @​odinuge)
  • 🔌 More Efficient Connection Tracking: Several improvements have been made to reduce the number of connections being tracked by Cilium, particularly when using Geneve, VXLAN or WireGuard. (cilium/cilium#38782, @​BenoitKnecht; cilium/cilium#41990, @​bersoare)
  • 💾 Better Scale in AWS: Reduce memory usage for cilium-operator in large AWS environments with many resources. (cilium/cilium#42529, @​liyihuang)

• ⚙️ Operations

  • 📦 Access Helm charts via Registry: Helm charts are also available under quay.io/cilium/charts/cilium (cilium/cilium#43624, @​aanm)
  • 📊 Metrics Encryption: Add TLS/mTLS support for Prometheus metrics exposed by the Cilium Operator. (cilium/cilium#42077, @​phuhung273)
  • 🤖 Easier Multi-Cluster install: There's now support for auto-installing the Custom Resource Definitions (CRDs) for Multi-Cluster Services (MCS). (cilium/cilium#40729, @​MrFreezeex)
  • 📜 Simpler Certificate Management: Streamline Cluster Mesh and Hubble certificate generation when using GitOps approaches. (cilium/cilium#42298, @​MrFreezeex)
  • 🛠️ Cilium dependencies were updated to Kubernetes v1.35, Envoy v1.35, Gateway API v1.4, and GoBGP v3.37. (cilium/cilium#43422, @​aanm; cilium/cilium#40569, @​sayboras; cilium/cilium#41936, @​youngnick; cilium/cilium#42824, @​rastislavs).

• 🏠 Community

  • ❤️ Production Case Studies: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback!
  • 📰 See studies with Airbnb, Cloudera, Cybozu, ESnet, Nutanix, OVHcloud, TikTok, University of Wisconsin–Madison.
  • 🇺🇸 Atlanta Events: The community gathered at CiliumCon and the Cilium Developer Summit in Atlanta.
  • 🇳🇱 Amsterdam Events: Meet us at the upcoming CiliumCon and Cilium Developer Summit in Amsterdam, March 23-27. Read more about where to find Cilium during the show.
  • 🔟 Cilium is 10: Read the 2025 Cilium Annual Report to see the latest project milestones, a decade on from its first commit.

To keep up to date with all the latest Cilium releases, join #release 🎉

🎂❤️❤️❤️🎂
This is a very special release for Cilium, as it celebrates 10 years since the first commit. We couldn’t be more proud of what this project has accomplished. All the GitHub issues, pull requests, reviews, stars, forks, Docker pulls, Helm installs, Kubernetes applies, CI runs, bug reports, design docs, discussions, meetings, Slack messages, YouTube streams, eCHO episodes, conference talks, blog posts, demos, and presentations have made the project the success it is today.
🎂❤️❤️❤️🎂

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.0@​sha256:be9f8571c2e114b3e12e41f785f2356ade703b2eac936aa878805565f0468c60

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.0@​sha256:0e3b89fdb116eb0f5579fe8ee3fabb1a7c4d97987a1ae927491d9185785d4a49

docker-plugin

quay.io/cilium/docker-plugin:v1.19.0@​sha256:35727047384f3d7a2684885003b266bf7a7add8fc66ca564b222f71c16057f50

hubble-relay

quay.io/cilium/hubble-relay:v1.19.0@​sha256:7f17e5bb51a9f35bbc8e7a9ad5e347f03ff8003c2e5cc81171e8727a10bf03b4

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.0@​sha256:5cb3d6981c233616037f3e13b5bc0020d114ad8db1b7360618b224e4c0b02ef0

operator-aws

quay.io/cilium/operator-aws:v1.19.0@​sha256:7a236ae256a4fbd3f72d516921131eba5b43f401ba37cdee5cd0e8c26f9263e6

operator-azure

quay.io/cilium/operator-azure:v1.19.0@​sha256:6ae7e0d75c74836af3600b775201c89ea7fcc13d6e08fdb0c52927309f31cd2a

operator-generic

quay.io/cilium/operator-generic:v1.19.0@​sha256:5b04006015e5800307dc6314676edc4c0bb7ac2fc7848be2b94b43bb030ab648

operator

quay.io/cilium/operator:v1.19.0@​sha256:deca84f442752dca0745dd09b13e8004569414839019ad79ac58f9fcaa3b9d65

v1.19.0-rc.1: 1.19.0-rc.1

Compare Source

Summary of Changes

Minor Changes:

• auth: Disable by default (Backport PR #​44003, Upstream PR #​42665, @​christarazi)
• Exclude topology.kubernetes.io labels from security labels by default (Backport PR #​43780, Upstream PR #​43725, @​moscicky)
• hubble-relay: Add hubble.relay.logOptions.format and hubble.relay.logOptions.level Helm values to configure log format (text, text-ts, json, json-ts) and level (debug, info, warn, error) (Backport PR #​44003, Upstream PR #​43644, @​puwun)
• Split selector cache to reduce cpu usage and reduce lock contention in the selector cache (Backport PR #​44025, Upstream PR #​42580, @​odinuge)

Bugfixes:

• Add support for specifying plpmtud (mtu discovery) settings for Pod endpoints, with the default now being "1" (blackhole-detected). (Backport PR #​44025, Upstream PR #​43710, @​tommyp1ckles)
• bpf: Correct refinement of inner packet L4 checksum detection (Backport PR #​43922, Upstream PR #​43868, @​br4243)
• bpf: Fix marker to skip nodeport when punting to proxy (Backport PR #​43866, Upstream PR #​43069, @​borkmann)
• clustermesh: correctly phase out not ready/not service endpoints from global services (Backport PR #​44025, Upstream PR #​43807, @​MrFreezeex)
• endpoint/manager: wait for completed endpoint restoration before starting periodic GC & regeneration controllers (Backport PR #​43866, Upstream PR #​43776, @​mhofstetter)
• endpoint/mgr: don't register periodic regeneration if interval is 0 (Backport PR #​43866, Upstream PR #​43790, @​mhofstetter)
• Fix a bug where removed addresses from EndpointSlices might be missed if multiple EndpointSlices share the same name (Backport PR #​44025, Upstream PR #​43999, @​EmilyShepherd)
• fix: incorrect schema entries for cpu limits (Backport PR #​43780, Upstream PR #​43735, @​jcpunk)
• gateway api: fix for multiple listeners on a gateway check (Backport PR #​43922, Upstream PR #​43802, @​xtineskim)
• Hubble Export FieldMask - Introduce functionality to specify multiple 'oneof' variants like l4.TCP/l4.UDP Hubble Export Aggregation - Enrich aggregated flow logs with timestamp to preserve temporal context (Backport PR #​44003, Upstream PR #​43924, @​mereta)
• Make BIG TCP initialization flow more robust and fix bugs. (Backport PR #​44025, Upstream PR #​43891, @​gentoo-root)

CI Changes:

• .github/ariane-config: schedule runs on conformance-ipsec.yaml (Backport PR #​44003, Upstream PR #​43907, @​aanm)
• .github/workflows: k8s-kind-network-e2e: add shorter timeout (Backport PR #​43922, Upstream PR #​43908, @​aanm)
• .github/workflows: re-add workflow_dispatch to tests-e2e-upgrade (Backport PR #​43922, Upstream PR #​43906, @​aanm)
• ci: fix tests-datapath-verifier on 1.19 (Backport PR #​44003, Upstream PR #​43931, @​marseel)
• cyclonus: add higher timeout and retries to avoid flakes (Backport PR #​44003, Upstream PR #​43909, @​aanm)
• gateway-api: Skip MeshHTTPRouteMatching to stabilize CI (Backport PR #​44003, Upstream PR #​43890, @​joestringer)
• gh: e2e-upgrade: test patch releases (Backport PR #​43751, Upstream PR #​43627, @​julianwiedmann)
• gha: let CiliumEndpointSlice migration be run nightly on stable branches (Backport PR #​44003, Upstream PR #​43921, @​giorio94)
• gke: lower scope of ESP firewall rule (Backport PR #​43866, Upstream PR #​43691, @​marseel)

Misc Changes:

• .github/actions: login with cosign to sign helm OCI charts (Backport PR #​43866, Upstream PR #​43782, @​aanm)
• bpf: subnet: make subnet map read-only (Backport PR #​44025, Upstream PR #​43948, @​julianwiedmann)
• chore(deps): update all github action dependencies (v1.19) (#​43838, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​43978, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#​43833, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#​43972, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#​43834, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#​43977, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.37.0 docker digest to e226d63 (v1.19) (#​43973, @​cilium-renovate[bot])
• chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260114104534-18147eee9c49 (v1.19) (#​43835, @​cilium-renovate[bot])
• chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260123105127-470c3a315f3a (v1.19) (#​43974, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1768610924-2528359430c6adba1ab20fc8396b4effe491ed96 (v1.19) (#​43836, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1768828720-c6e4827ebca9c47af2a3a6540c563c30947bae29 (v1.19) (#​43975, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.19) (patch) (#​43837, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.19) (patch) (#​43976, @​cilium-renovate[bot])
• Clarify the upgrade notes for v1.19 (Backport PR #​43957, Upstream PR #​43913, @​joestringer)
• clustermesh: add missing reason in mcs condition metrics (Backport PR #​43866, Upstream PR #​43775, @​MrFreezeex)
• daemon: fix version for deprecated encryption strict egress mode flags (Backport PR #​43866, Upstream PR #​43731, @​rgo3)
• docs(observability): Add tutorial for IP option tracing (Backport PR #​44025, Upstream PR #​43961, @​Bigdelle)
• docs: add helm underlayProtocol value to documentation (Backport PR #​44025, Upstream PR #​43934, @​aanm)
• docs: add operator prometheus TLS (Backport PR #​44025, Upstream PR #​43997, @​phuhung273)
• docs: Add upgrade note about wildcard service entries. (Backport PR #​44025, Upstream PR #​44013, @​ajmmm)
• docs: adjust URL to latest stable Hubble CLI version (Backport PR #​43780, Upstream PR #​43745, @​tklauser)
• endpoint/restore: introduce metrics (Backport PR #​43866, Upstream PR #​43748, @​mhofstetter)
• endpoint/restore: remove special handling for host endpoint in case of ipsec (Backport PR #​43922, Upstream PR #​43757, @​mhofstetter)
• Fix BPF IPv6 neighbor discovery code to fully pull in skb data into linear section. (Backport PR #​43922, Upstream PR #​43873, @​borkmann)
• install: Quieten noisy build output (Backport PR #​44003, Upstream PR #​43960, @​joestringer)

Other Changes:

• install: Update image digests for v1.19.0-rc.0 (#​43772, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.0-rc.1@​sha256:2df92477f0c53137c5238ca07844b9888167fa75906d281a21182d5c57b119ab

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.0-rc.1@​sha256:83c971b855a632d5964b13a575a122f26e87532f15f23864906f0da70b72c4ee

docker-plugin

quay.io/cilium/docker-plugin:v1.19.0-rc.1@​sha256:307c60a773100c81486e153df2c6aafac939be1f6ac1dcb192c4227d099adafb

hubble-relay

quay.io/cilium/hubble-relay:v1.19.0-rc.1@​sha256:1e85dc30d3b5f6ef577b97078bc940400f3ea9e47c2151aa449047aba30e3f30

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.0-rc.1@​sha256:b4feb092d5ddcfcdbba6917253a2d0cc3821a0df26f721e072e7e64d3b7e88b3

operator-aws

quay.io/cilium/operator-aws:v1.19.0-rc.1@​sha256:c6fcac287b32747565f0ea10aa03a15eeaf69bd1792cc5df6248c07fd5c65b15

operator-azure

quay.io/cilium/operator-azure:v1.19.0-rc.1@​sha256:e157421eb980cfe3b80b85117704e3d932211c367e13f207eea30c0fd8a4f39f

operator-generic

quay.io/cilium/operator-generic:v1.19.0-rc.1@​sha256:8b9dc8107ee0d808a0a75b66455402e860529528de5968df21c11f8ce7627771

operator

quay.io/cilium/operator:v1.19.0-rc.1@​sha256:ecf08e6c428aac38d658044bfdcdea161c278fdde8c6cdb0957f8f03090acd3a

v1.19.0-rc.0: 1.19.0-rc.0

Compare Source

Summary of Changes

Major Changes:

• Publish Helm charts to OCI registries (#​43624, @​aanm)

Minor Changes:

• Add Strict Mode Ingress Encryption Support for Wireguard (#​39239, @​rgo3)
• helm: add SYSLOG capability for Cilium Agent (#​43201, @​marseel)
• policy: Mark FromRequires and ToRequires as deprecated (#​43167, @​TheBeeZee)
• Remove deprecated l2-pod-announcements-interface flag (#​43063, @​dylandreimerink)
• renovate: Allow cilium-envoy 1.35.x for v1.18 (#​43623, @​sayboras)
• Support BIG TCP in tunneling mode, provided that kernel supports BIG TCP for UDP tunnels. (#​43416, @​gentoo-root)

Bugfixes:

• bpf:wireguard: delivery host packets to bpf_host for ingress policies (#​42892, @​smagnani96)
• Fix an issue in proxy NOTRACK iptables rule for aws-cni chaining mode which causes proxy->upstream(outside cluster) traffic not being SNAT'd. (#​43566, @​fristonio)
• Fix bug in LoadBalancer that would cause node connectivity faults if Service LoadBalancer VIPs are allocated with Node-IPAM. (#​43565, @​ajmmm)
• Fix ICMP error packet handling by adding the missing checksum recalculation performed during RevNAT for SNATed load-balanced traffic. (#​43196, @​yushoyamaguchi)
• fix: incorrect schema entries for cpu limits (#​43735, @​jcpunk)
• Fixed a race condition while trying to create per endpoint routes which could result in connectivity issues (#​42915, @​dylandreimerink)
• loadbalancer: Fix GetInstancesOfService to avoid removing an endpoint from Service A causes all requests to Service B to fail if the name of Service A is the prefix of Service B (#​43620, @​imroc)
• pkg/azure/api : Fixed an issue where public IP assignment would permanently fail on Azure VMSS VMs. (#​43598, @​41ks)
• pkg/loadbalancer: further restrict use of wildcard svc entries (#​43721, @​ajmmm)
• xds: fix nil-pointer in processRequestStream (#​43609, @​mhofstetter)

CI Changes:

• bgp: Add component test for DefaultGateway auto-discovery (#​43430, @​rastislavs)
• bpf: tests: IGMP improvements (#​43684, @​julianwiedmann)
• chore: comment job to use generated token instead of PAT (pull_request_target) (#​43655, @​sekhar-isovalent)
• ci: Fix CIFuzz build by enabling Go module downloads for dependencies not in vendor directory (#​43504, @​puwun)
• ci: fix gke public api endpoint restriction (#​43685, @​Artyop)
• conformance-{l3-l4,l7}: add scheduled runs (#​43718, @​aanm)
• fix: add get-runner-ip step with error chechking and https url (#​43654, @​sekhar-isovalent)
• fix: azure aks apiserver hardening (#​43633, @​sekhar-isovalent)
• gh: cilium-config: encryption-strict-egress is also supported for IPsec (#​43634, @​julianwiedmann)
• gh: introduce testing with kernel 6.18 (#​43639, @​julianwiedmann)

Misc Changes:

• .github/workflows: add missing permissions for cosign (#​43715, @​aanm)
• .github/workflows: include_conn_disrupt_test_l7_traffic conditionally (#​43724, @​aanm)
• .github/workflows: remove leftover files on charts directories (#​43716, @​aanm)
• Add OCI-helm documentation (#​43641, @​aanm)
• bpf,readme: how to run tests using lvh (#​42570, @​viktor-kurchenko)
• bpf: nodeport: evaluate svc hostport check prior to DNAT (#​43611, @​julianwiedmann)
• bpf: wireguard: use set_decrypt_mark() (#​43686, @​julianwiedmann)
• chore(deps): update all github action dependencies (main) (#​43660, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (main) (#​43682, @​cilium-renovate[bot])
• chore(deps): update all lvh-images main (main) (patch) (#​43657, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (#​43700, @​cilium-renovate[bot])
• chore(deps): update base-images (main) (#​43659, @​cilium-renovate[bot])
• chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260109151746-62264808e5f3 (main) (#​43658, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9 (main) (#​43637, @​cilium-renovate[bot])
• ci: bump eks cluster pool cleanup timeout (#​43733, @​Artyop)
• CODEOWNERS: add missing codeowners entries (#​43692, @​aanm)
• CODEOWNERS: fine-tune sig-datapath ownership (#​42959, @​julianwiedmann)
• docs: add ztunnel documentation page (#​42819, @​rgo3)
• Enable renovate to manage Documentation requirements (#​43433, @​HadrienPatte)
• fix(deps): update all go dependencies main (main) (#​43661, @​cilium-renovate[bot])
• fix: update helm lint to only look for yaml files in examples/crds (#​43616, @​sekhar-isovalent)
• Improve crdcheck tool performance and error handling (#​43590, @​noexecstack)
• lb: Do not populate NodePort Frontends if KPR is disabled (#​43599, @​rastislavs)
• node/address: don't use global functions in each other (#​43621, @​mhofstetter)
• node: remove node.GetNodeAddressing (#​43482, @​mhofstetter)
• node: remove unnecessary test setup with SetTestLocalNodeStore (#​43601, @​mhofstetter)
• Policy pass fixes (#​43589, @​jrajahalme)
• Prepare for release v1.19.0-pre.4 (#​43596, @​cilium-release-bot[bot])
• Prepare for v1.20 development cycle (#​43706, @​joestringer)
• Prepare v1.19 stable branch (#​43709, @​joestringer)
• proxy/accesslogger: use LocalNodeStore to retrieve node IPs (#​43600, @​mhofstetter)
• README: Update releases (#​43604, @​aanm)
• README: Update releases (#​43736, @​jrajahalme)
• release: change OCI registry (#​43646, @​aanm)
• renovate: Allow cilium-envoy minor upgrade for stable branches (#​43640, @​sayboras)
• renovate: Fix python dependency updates (#​43695, @​HadrienPatte)
• Replace Index{,Byte} with Cut,Contains (#​43708, @​joestringer)
• Updating USERS.md to include Celonis (#​43740, @​tchellomello)
• v1.19 branch fixes (#​43764, @​aanm)
• workflows: Add id-token permission to call-publish-helm job (#​43717, @​aanm)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.0-rc.0@​sha256:080f976afe1a4f1d6bfa50a7c050320dfbf6c5d6699fa1ba9288dacffcf8f453

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.0-rc.0@​sha256:ef88eca6382020d435d99aeddd20cd0b53e24a339a247839632bcb0cef55d553

docker-plugin

quay.io/cilium/docker-plugin:v1.19.0-rc.0@​sha256:943cfb90213c8d344bafd5b8489d603afb1a8b088a532de9cdfe9aa0f3c46422

hubble-relay

quay.io/cilium/hubble-relay:v1.19.0-rc.0@​sha256:5a44c7c37329e97e92da7674a9ae266b9763288df9a55466ace74b184b7499de

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.0-rc.0@​sha256:15ce9c466505d5ed9a163fb9388c17aafbfeb61a289d2184280a06a32b3aaa68

operator-aws

`quay.io/c

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.