deps: update cilium to v1.19.4

[Alex Castilio (alexcastilio)]

Summary

Upgrade github.com/cilium/cilium from v1.19.3 to v1.19.4 to remediate CVE-2026-53935 in Retina's Go binaries.

Cilium's advisory identifies v1.19.0 through v1.19.3 as affected and v1.19.4 as patched. Users who can create CiliumLocalRedirectPolicy resources can otherwise use addressMatcher to hijack traffic to services in other namespaces. The advisory lists no workaround.

Advisory: GHSA-q6h5-q3q6-f87x

Changes

• Upgrade github.com/cilium/cilium to v1.19.4 and refresh transitive module checksums.
• Add Cilium's ztunnel.Cell alongside auth.Cell in the reduced Retina operator graph.
• Keep ztunnel disabled through Cilium's default configuration.
• Add a focused Hive population test that verifies the graph resolves the ztunnel configuration and auth identity provider.

The ztunnel cell is required because Cilium v1.19.4's SPIRE client now depends on operator/pkg/ztunnel/config.Config. Without the provider, the operator compiles but fails while Hive populates the graph, preventing Cilium CRD registration and eventually causing Retina agents to restart after their Kubernetes synchronization timeout. Adding the configuration cell satisfies the dependency without enabling ztunnel or removing the no-op auth identity provider required by identity GC.

CVE validation

Scans used Trivy with --ignore-unfixed --scanners vuln against equivalent locally built Linux/amd64 agent images before and after the Cilium upgrade.

Target	Before (Cilium v1.19.3)	After (Cilium v1.19.4)
retina/captureworkload	1 (CVE-2026-53935)	0
retina/controller	1 (CVE-2026-53935)	0
Hubble CLI	14	14
Total	16	14

The remaining findings belong to the separately downloaded Hubble CLI and are not affected by Retina's Cilium Go module version.

Testing

• go test ./operator/cmd/cilium-crds ./operator/cmd -count=1
• go mod verify
• Built the Linux/amd64 agent image from controller/Dockerfile
• Scanned the before and after agent images with Trivy

Checklist

• I have read the contributing documentation.
• I signed and signed-off the commits (git commit -S -s ...). See this documentation on signing commits.
• I have correctly attributed the author(s) of the code.
• I have tested the changes locally.
• I have followed the project's style guidelines.
• I have updated the documentation, if necessary.
• I have added tests, if applicable.

Screenshots (if applicable) or Testing Completed

Please add any relevant screenshots or GIFs to showcase the changes made.

Additional Notes

Add any additional notes or context about the pull request here.

---

Please refer to the CONTRIBUTING.md file for more information on how to contribute to this project.

[github-actions]

Retina Code Coverage Report

Total coverage no change

Increased diff

Impacted Files	Coverage
operator/cmd/cilium-crds/lifecycle.go	0.0% ... 33.3% (33.3%)	⬆️