[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
cilium (source)	helm_release	minor	1.16.5 → 1.20.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

cilium/cilium (cilium)

v1.20.4: 1.20.4

Compare Source

Security patch release

Out-of-band security patch release to fix CVE-2026-111943 (golang/go#82345): upgrades Go to 1.26.10 so that the compromised eMudhra intermediate CA certificates are no longer trusted, and updates all dependencies to their latest patch versions.

Summary of Changes

Minor Changes:

• alibabacloud: support RRSA (RAM Roles for Service Accounts) credentials in the IPAM allocator, alongside static AccessKeys and ECS instance RAM roles (Backport PR #​49474, Upstream PR #​49093, @​4n4nd)

Bugfixes:

• Allow wildcard CIDR selectors to match nodes when --policy-cidr-match-mode=nodes is configured (Backport PR #​49474, Upstream PR #​47828, @​TheBeeZee)
• bpf: nat: fix outer ICMP checksum for ICMP/SCTP NAT error packets (Backport PR #​49474, Upstream PR #​48819, @​fds7280)
• CiliumEnvoyConfig now only redirects Services in its own namespace, as documented; service references in CiliumClusterwideEnvoyConfig without a namespace default to "default" again. (Backport PR #​49474, Upstream PR #​49076, @​maxskokov)
• datapath: Fix NAT46x64 gateway prefix conversion panic (Backport PR #​49474, Upstream PR #​49177, @​HadrienPatte)
• Fix an issue where terminating backends were evicted from BPF maps when trafficDistribution was enabled. (Backport PR #​49474, Upstream PR #​48349, @​taesung320)
• Fix invalid L4 checksum on IPv6 ClusterIP reverse NAT for CHECKSUM_PARTIAL packets on kernels < 6.12, affecting the case when packets are bridged/tunneled from the client pod to a remote host (Backport PR #​49474, Upstream PR #​49204, @​liuyuan10)
• Fix regression in Cilium 1.20.3 where the Gateway API implementation would incorrectly handle BackendTLSPolicy configurations, leading to high Cilium CPU usage and inability to forward traffic. (Backport PR #​49568, Upstream PR #​49525, @​youngnick)
• Fixes an issue in LBIPAM where on service upsert, if IP allocations are not changed the sharing index is not updated. (Backport PR #​49474, Upstream PR #​48938, @​0xch4z)
• nodediscovery: in IPAM ENI and Azure modes the operator now treats nodes as running in multi-pool mode from the very first event. (Backport PR #​49390, Upstream PR #​49242, @​41ks)
• Reduce transient DNS SERVFAIL/REFUSED for pods that query immediately at startup by pushing/applying Standalone DNS Proxy policy snapshots more frequently (Backport PR #​49474, Upstream PR #​49112, @​QxBytes)
• Remove the unused pebble binary from the cilium image to clear its Go standard library vulnerability findings. (Backport PR #​49474, Upstream PR #​49380, @​aanm)

CI Changes:

• [v1.20] ci: ignore transient xDS mode drift during downgrade (#​49515, @​jrajahalme)
• ci: Pass the auto-committer secrets to the base images workflow (Backport PR #​49467, Upstream PR #​49453, @​aanm)
• renovate: Open one trusted PR per branch (Backport PR #​49416, Upstream PR #​49381, @​aanm)

Misc Changes:

• chore(deps): update auto-merge-trusted-deps (v1.20) (#​49319, @​cilium-renovate[bot])
• chore(deps): update auto-merge-trusted-deps (v1.20) (#​49445, @​cilium-renovate[bot])
• chore(deps): update dependency sphinxcontrib-openapi to v0.10.0 (v1.20) (#​49438, @​cilium-renovate[bot])
• clarify co sign documentation to use minimum version to verify signing key (Backport PR #​49474, Upstream PR #​49401, @​mfahlandt)
• Fix Envoy xDS listener handling across restoration, address changes, and rejected updates (Backport PR #​49383, Upstream PR #​48897, @​jrajahalme)

Other Changes:

• install: Update image digests for v1.20.3 (#​49392, @​cilium-release-bot[bot])
• route-reconciler: add prune exclusion logic and use it in the linuxNodeHandler (#​49170, @​andreaterzolo)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.4@sha256:20fe92e4c86641233a450098c158d2d29085f3419931ab6bf681d2485dedf16e
quay.io/cilium/cilium:stable@sha256:20fe92e4c86641233a450098c158d2d29085f3419931ab6bf681d2485dedf16e

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.4@sha256:aeac78ae77d166b86630310f2eb53fbc92014eda36ada8e6b2d7f2b8f2dadbfa
quay.io/cilium/clustermesh-apiserver:stable@sha256:aeac78ae77d166b86630310f2eb53fbc92014eda36ada8e6b2d7f2b8f2dadbfa

hubble-relay

quay.io/cilium/hubble-relay:v1.20.4@sha256:cb23408209697ed30d2bc462e1f01eb622ea4423a891458f78bc88d7255bbfc1
quay.io/cilium/hubble-relay:stable@sha256:cb23408209697ed30d2bc462e1f01eb622ea4423a891458f78bc88d7255bbfc1

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.4@sha256:163a08ee4438780638899742e95521e1a37edeb676c6e5c924d320c4c0bd09ad
quay.io/cilium/operator-alibabacloud:stable@sha256:163a08ee4438780638899742e95521e1a37edeb676c6e5c924d320c4c0bd09ad

operator-aws

quay.io/cilium/operator-aws:v1.20.4@sha256:caab27c6e3286a596d502f76aa6cffe2efab6e8a92234a0d10d2eed3eda85c7c
quay.io/cilium/operator-aws:stable@sha256:caab27c6e3286a596d502f76aa6cffe2efab6e8a92234a0d10d2eed3eda85c7c

operator-azure

quay.io/cilium/operator-azure:v1.20.4@sha256:0669c35e9f1638bbdd6cf5c64163e7ee4ea4ef440e223050e60665811369b4ec
quay.io/cilium/operator-azure:stable@sha256:0669c35e9f1638bbdd6cf5c64163e7ee4ea4ef440e223050e60665811369b4ec

operator-generic

quay.io/cilium/operator-generic:v1.20.4@sha256:7a7a3489dc66ad67e420d285c8a8d2e169b0957ad15e120f593d27081bf38d82
quay.io/cilium/operator-generic:stable@sha256:7a7a3489dc66ad67e420d285c8a8d2e169b0957ad15e120f593d27081bf38d82

operator

quay.io/cilium/operator:v1.20.4@sha256:f94e9812f191e0c31b5cfe6cb1f38f5c349d4f159f2030e621d179d826257263
quay.io/cilium/operator:stable@sha256:f94e9812f191e0c31b5cfe6cb1f38f5c349d4f159f2030e621d179d826257263

v1.20.3: 1.20.3

Compare Source

Summary of Changes

Minor Changes:

• alibabacloud: support IMDSv2 (token-based) instance metadata access (Backport PR #​49336, Upstream PR #​49182, @​4n4nd)
• Fix conntrack garbage collection deleting CT entries that the datapath reopened between the GC batch read and the delete, which could cascade into NAT mapping deletion and SNAT source-port reallocation for live connections. (Backport PR #​49119, Upstream PR #​46750, @​gyutaeb)
• operator: prevent CNPs with nodeSelector from silently enforcing nothing (Backport PR #​49173, Upstream PR #​47882, @​weizhoublue)

Bugfixes:

• azure: Fixed an issue where an interface with an empty MAC field would be reported back the the cilium agent causing it to crash on startup when trying to configure the routes. (Backport PR #​49336, Upstream PR #​48648, @​41ks)
• bpf: icmp: use 576 byte of inner packet to avoid partial csum floor (Backport PR #​48907, Upstream PR #​48578, @​tommyp1ckles)
• cilium-dbg: Print port numbers correctly for map cilium_lb*_reverse_sk (Backport PR #​49336, Upstream PR #​47134, @​jayl1e)
• daemon: fix a bug where L7 DNS policies could remain loaded in the datapath during agent shutdown, causing pods under a wildcard toFQDNs policy to lose DNS resolution for the duration of the restart. (Backport PR #​48907, Upstream PR #​48747, @​41ks)
• endpoint/restore: skip cleanup for reserved internal endpoints (Backport PR #​48999, Upstream PR #​48272, @​fristonio)
• envoy: handle listener additional address changes (Backport PR #​48917, Upstream PR #​48712, @​nezdolik)
• envoy: handle listener address changes in ADS (Backport PR #​48917, Upstream PR #​48798, @​nezdolik)
• envoy: track coalesced ADS snapshot updates (Backport PR #​48917, Upstream PR #​48631, @​nezdolik)
• Fix Gateway API ExternalAuth dropping request bodies when allowedResponseHeaders is unset (Backport PR #​49189, Upstream PR #​48770, @​kirgene)
• Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint (Backport PR #​49189, Upstream PR #​48905, @​fristonio)
• Fix ip6tables chain rename errors being silently ignored during iptables rule reconciliation. (Backport PR #​49336, Upstream PR #​49024, @​maxskokov)
• Fix panic in agent when CiliumLocalRedirectPolicy redirectBackend.toPorts is declared as an empty array. The agent will now reject such a policy. (Backport PR #​48907, Upstream PR #​48491, @​ajmmm)
• Fix PMTU/ICMP replies for IPIP/Geneve DSR for GRO skbs (Backport PR #​49189, Upstream PR #​48489, @​borkmann)
• Fix rare data race in selector cache that could lead to agent panic (Backport PR #​49189, Upstream PR #​47733, @​odinuge)
• Fix restoration of terminating backends. If a terminating backend become active again during restart the backend was incorrectly kept as quarantined. (Backport PR #​48797, Upstream PR #​48763, @​joamaki)
• Fixes a bug where Hubble flows may list the incorrect policy that allowed or denied a flow (Backport PR #​49189, Upstream PR #​49086, @​tsotne95)
• Fixes a bug where the helm value hubble.tls.auto.privateKey settings are no longer ignored in Hubble cert-manager certificates (Backport PR #​49189, Upstream PR #​49114, @​byxorna)
• Fixes an issue where CiliumCIDRGroups with zero-length cidrs (i.e. 0.0.0.0/0) inadvertently selected no traffic. (Backport PR #​49336, Upstream PR #​48366, @​squeed)
• gateway-api: filter CEC controls from infrastructure metadata (Backport PR #​48984, Upstream PR #​47732, @​nezdolik)
• gateway-api: make HTTP route ordering deterministic (Backport PR #​49336, Upstream PR #​48951, @​abduu11aahh)
• gateway-api: Support system CA certificates in BackendTLSPolicy. (Backport PR #​49336, Upstream PR #​48895, @​shreyasrajiv327)
• infraendpoints: Release the health IPv4 when the IPv6 allocation fails (Backport PR #​48907, Upstream PR #​48816, @​HadrienPatte)
• k8s/resource: fix leaked event finalizer on unobserved delete (Backport PR #​48907, Upstream PR #​48785, @​tklauser)
• L7 conformance CI fixes (Backport PR #​48999, Upstream PR #​47517, @​fristonio)
• operator: Do not emit warning when deleting already deleted unmanaged pod (Backport PR #​48907, Upstream PR #​48765, @​gandro)
• operator: fix metrics list default address to work on IPv6-only clusters with dual stack nodes by trying both IPv4 and IPv6 loopback addresses (Backport PR #​48907, Upstream PR #​48780, @​41ks)
• Set ipv6 routing rules when dual stack is enabled (Backport PR #​49336, Upstream PR #​49188, @​fcrespofastly)
• Sockets are no longer destroyed when a Service backend is terminated unless they are still connected to that backend. Unconnected UDP sockets, and sockets that have since disconnected or moved to another backend, used to have their local port silently changed. (Backport PR #​49189, Upstream PR #​48725, @​maxskokov)

CI Changes:

• [ci] fix escaping in conformance ginkgo (Backport PR #​49189, Upstream PR #​48991, @​nebril)
• [v1.20] .github: Remove the EKS cluster pool workflows (#​49084, @​aanm)
• ci: Add support for OIDC (Backport PR #​49317, Upstream PR #​49007, @​aanm)
• ci: cleanup disk space in documentation workflow (Backport PR #​48907, Upstream PR #​48427, @​tklauser)
• ci: Drop the empty floating tag line from CI image digests (Backport PR #​49189, Upstream PR #​49070, @​aanm)
• ci: fix CNI setup and readiness checks in the kubespray job (Backport PR #​49336, Upstream PR #​48927, @​aanm)
• ci: Give Envoy Embedded conformance a bigger runner (Backport PR #​49189, Upstream PR #​49018, @​aanm)
• ci: keep UDPRouteWeightedRouting skipped in the profile job (Backport PR #​49189, Upstream PR #​49005, @​aanm)
• ci: login to docker registry for downgrade image wait (Backport PR #​49189, Upstream PR #​48983, @​nebril)
• ci: Name runner variables after their Ubuntu release and let Renovate bump them (Backport PR #​49317, Upstream PR #​49065, @​aanm)
• ci: Skip redundant setup when base images already exist (Backport PR #​49317, Upstream PR #​47209, @​HadrienPatte)
• ci: Stop passing secrets to the base images workflow (Backport PR #​49317, Upstream PR #​49082, @​aanm)
• gha/conformance-multi-pool: use the local fake external targets (Backport PR #​48986, Upstream PR #​48558, @​aanm)
• gha/e2e-upgrade: gate the after-agent-restart conn-disrupt check (Backport PR #​48437, Upstream PR #​47440, @​aanm)
• gha/setup-aks-cluster: Retry a create that never starts (Backport PR #​49317, Upstream PR #​48924, @​aanm)
• gha: Derive the LVH package cache key once per run (Backport PR #​48986, Upstream PR #​48656, @​aanm)
• gha: don't fail PR tests on reporting errors (Backport PR #​49317, Upstream PR #​48740, @​aanm)
• gha: Grant id-token to the post-release call of release.yaml (Backport PR #​49317, Upstream PR #​49323, @​aanm)
• gha: make external fake targets image configurable (Backport PR #​49189, Upstream PR #​48941, @​giorio94)
• gha: Retry stalled kind image pulls before the install wait expires (Backport PR #​49336, Upstream PR #​48989, @​aanm)
• gha: Skip the duplicate CI image build on push to main (Backport PR #​48986, Upstream PR #​48736, @​aanm)
• gha: survive a GKE zone running out of capacity (Backport PR #​48986, Upstream PR #​48184, @​aanm)
• gha: Tolerate cosign and SBOM failures on pull requests (Backport PR #​48986, Upstream PR #​48737, @​aanm)
• ginkgo: remove Test NodePort with L7 policy tests (Backport PR #​49067, Upstream PR #​46499, @​smagnani96)
• loadbalancer/tests: Fix the graceful termination test restart (Backport PR #​49317, Upstream PR #​48939, @​aanm)
• Migrate Conformance Cluster Mesh workflow to use fake external targets (Backport PR #​48654, Upstream PR #​48250, @​giorio94)
• nodeinit: wait for the kubelet wrapper before writing the bootstrap file (Backport PR #​49189, Upstream PR #​48739, @​aanm)

Misc Changes:

• bpf: lxc: switch cilium_nodeport_nat_buffer to auxvar (Backport PR #​48741, Upstream PR #​48543, @​julianwiedmann)
• build: handle git worktrees in documentation make targets (Backport PR #​49189, Upstream PR #​48966, @​utaal)
• chore(deps): update all github action dependencies (v1.20) (#​48881, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#​49039, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#​49152, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#​49277, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#​48882, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#​49153, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#​49275, @​cilium-renovate[bot])
• chore(deps): update base-images to v1.26.9 (v1.20) (#​49262, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.20.1 (v1.20) (#​48978, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.31 (v1.20) (#​48788, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v36.2 (v1.20) (#​49038, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.38.0 docker digest to fd7dc98 (v1.20) (#​49035, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.8 docker digest to 0f063af (v1.20) (#​49149, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.8 docker digest to 6c2a553 (v1.20) (#​48879, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.9 docker digest to d772206 (v1.20) (#​49298, @​cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.7.2 (v1.20) (#​49036, @​cilium-renovate[bot])
• chore(deps): update helm/kind-action action to v1.15.1 (v1.20) (#​49289, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.4-1790671085-c3a2a1ff726f00f5b5c0886cab3ad345f97f35b9 (v1.20) (#​49111, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1790882336-b64c7306085409b95fb5626db2d2bb7a200b9432 (v1.20) (#​49123, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.5-1791291190-5ec36181d464cd75b35b45395a722226cbdd2888 (v1.20) (#​49194, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791350265-ae0327a34850b7d1849e8332dbefd4d5bebabe10 (v1.20) (#​49216, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.38.6-1791537840-00e749f11f69334c625e53fc1ce2fc6c7f34a51f (v1.20) (#​49276, @​cilium-renovate[bot])
• chore(deps): update security updates to v1.45.0 [security] (v1.20) (#​48814, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#​48880, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#​49037, @​cilium-renovate[bot])
• ciliumendpointslice: Report no CID when the CEP has none (Backport PR #​49189, Upstream PR #​48933, @​aanm)
• connectivity-check: move echo-b to the lower NodePort band (Backport PR #​49189, Upstream PR #​48926, @​aanm)
• docs: note on eBPF ClusterIP translation vs Docker raw-table protection (Backport PR #​49189, Upstream PR #​47782, @​Verbano-Tech)
• envoy: add standalone NPDS unsubscribe regression test (Backport PR #​48917, Upstream PR #​47818, @​nezdolik)
• fix(deps): update k8s.io patch updates stable to v0.36.5 (v1.20) (#​49151, @​cilium-renovate[bot])
• fix(deps): update module golang.org/x/net to v0.60.0 [security] (v1.20) (#​49253, @​cilium-renovate[bot])
• fix(deps): update security updates [security] (v1.20) (#​48808, @​cilium-renovate[bot])
• gateway-api: centralize Gateway validation (Backport PR #​48907, Upstream PR #​48602, @​arybolovlev)
• loadbalancer/writer: add support for SetFrontendSourceRangesFunc (Backport PR #​49336, Upstream PR #​49068, @​0xch4z)

Other Changes:

• [v1.20] deps: update gateway api to v1.6.3 (#​49305, @​mhofstetter)
• [v1.20] node_neighbor_discovery: fix ID in delete query (#​48912, @​nobleess)
• [v1.20] routing: fix dual-stack ENI router startup with native routing CIDRs (#​48709, @​monta-riahi)
• install: Update image digests for v1.20.2 (#​48751, @​cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.3@sha256:95cfa5c2427cc6b452c00908778d0566311f572589284af949d06a013db1a849
quay.io/cilium/cilium:stable@sha256:95cfa5c2427cc6b452c00908778d0566311f572589284af949d06a013db1a849

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.3@sha256:5c8dca0d0b77bb593df157be39f6c9c868dc08922bbd0540ac0a56815341b227
quay.io/cilium/clustermesh-apiserver:stable@sha256:5c8dca0d0b77bb593df157be39f6c9c868dc08922bbd0540ac0a56815341b227

hubble-relay

quay.io/cilium/hubble-relay:v1.20.3@sha256:c6f819d9c5e0b35ccac63b9f2f1ae213fd9be50588e15d5a444d5d305ad317b5
quay.io/cilium/hubble-relay:stable@sha256:c6f819d9c5e0b35ccac63b9f2f1ae213fd9be50588e15d5a444d5d305ad317b5

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.3@sha256:615f8c2995e437320571d6f61e623d6848ed3ea357cdaa886ac95bbff29a0b52
quay.io/cilium/operator-alibabacloud:stable@sha256:615f8c2995e437320571d6f61e623d6848ed3ea357cdaa886ac95bbff29a0b52

operator-aws

quay.io/cilium/operator-aws:v1.20.3@sha256:49bdd1d54bdf3da2740848c4662854d0d41c0df25cffe8575d71723db08cc0d1
quay.io/cilium/operator-aws:stable@sha256:49bdd1d54bdf3da2740848c4662854d0d41c0df25cffe8575d71723db08cc0d1

operator-azure

quay.io/cilium/operator-azure:v1.20.3@sha256:7132b3ff7e33a076ea9fadaa6e4f2b364937ed7b118b92928bdb4706921a2ffa
quay.io/cilium/operator-azure:stable@sha256:7132b3ff7e33a076ea9fadaa6e4f2b364937ed7b118b92928bdb4706921a2ffa

operator-generic

quay.io/cilium/operator-generic:v1.20.3@sha256:efdd8d89d6d8f63d21a065fa2f9e17614a2b3ac9371b221af9355f63829e2dbc
quay.io/cilium/operator-generic:stable@sha256:efdd8d89d6d8f63d21a065fa2f9e17614a2b3ac9371b221af9355f63829e2dbc

operator

quay.io/cilium/operator:v1.20.3@sha256:c40996c8a413f57db75715e683abc550e7849904aa20b8730822ba532f9b783c
quay.io/cilium/operator:stable@sha256:c40996c8a413f57db75715e683abc550e7849904aa20b8730822ba532f9b783c

v1.20.2: 1.20.2

Compare Source

Summary of Changes

Minor Changes:

• gateway-api: node label selector for when hostNetwork is enabled (Backport PR #​48636, Upstream PR #​47463, @​xtineskim)

Bugfixes:

• aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR #​48418, Upstream PR #​48125, @​41ks)
• aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #​48418, Upstream PR #​48193, @​41ks)
• bpf: Fix agent crash when dumping map events (Backport PR #​48378, Upstream PR #​48273, @​joestringer)
• bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (Backport PR #​48550, Upstream PR #​48407, @​41ks)
• Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (Backport PR #​48418, Upstream PR #​48262, @​giorio94)
• datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR #​48550, Upstream PR #​46861, @​fdomain)
• endpoint: preserve concurrent policy updates for new endpoints (Backport PR #​48213, Upstream PR #​48195, @​jrajahalme)
• ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. (Backport PR #​48213, Upstream PR #​47034, @​41ks)
• Fix a pod created immediately after a network policy change reporting a stale policy revision for up to two minutes. (Backport PR #​48418, Upstream PR #​47642, @​aanm)
• Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association (Backport PR #​48024, Upstream PR #​47874, @​bryanhorstmann)
• Fix BGP defaultGateway peer auto-discovery selecting a default route from a non-main routing table, such as the default via cilium_host route Cilium installs in the from-proxy table, instead of the node's real default gateway. (Backport PR #​48418, Upstream PR #​47971, @​ecbaldwin)
• Fix bug where identities may linger for double the amount of the expected time (Backport PR #​48418, Upstream PR #​48032, @​christarazi)
• Fix dropping traffic L2Announcement with externalTrafficPolicy: Local (Backport PR #​48550, Upstream PR #​46399, @​yuito-it)
• Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. (Backport PR #​48017, Upstream PR #​47943, @​taaahaaa)
• Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. (Backport PR #​48017, Upstream PR #​47929, @​shreyasrajiv327)
• Fix Hubble Relay remains running during termination (Backport PR #​48550, Upstream PR #​47942, @​xandau)
• Fix ICMP error packet handling by adding the missing checksum recalculation performed during NAT for SNATed load-balanced traffic. (Backport PR #​48418, Upstream PR #​48086, @​julianwiedmann)
• Fix IPv6 Router Solicitations and Router Advertisements being dropped with "Unsupported protocol for NAT masquerade" on nodes whose BPF masquerade address is a link-local address. (Backport PR #​48418, Upstream PR #​48094, @​ecbaldwin)
• Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR #​48418, Upstream PR #​48391, @​fristonio)
• Fix multiple regressions in Cilium LocalRedirectPolicy (Backport PR #​48634, Upstream PR #​46638, @​ajmmm)
• Fix node-init startup on GKE 1.36.2-gke.2064000 nodes by detecting GKE from the kubelet path instead of container runtime configuration. (Backport PR #​48213, Upstream PR #​47945, @​dlanov)
• Fix nodeport egress tuple reuse for closed connections (Backport PR #​48418, Upstream PR #​48306, @​fristonio)
• Fix restored ENI endpoints routing rule configuration when masquerading config changes (#​48417, @​fristonio)
• fix(envoyconfig): retry port allocation on duplicate-address rejections (Backport PR #​48735, Upstream PR #​48624, @​kokhlo)
• Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR #​48213, Upstream PR #​47915, @​giorio94)
• Fixed a cilium-agent crash (fatal error: concurrent map iteration and map write) when an endpoint's policy was recomputed while incremental policy map changes were applied concurrently. Most commonly triggered by named-port policies under pod churn. (Backport PR #​48735, Upstream PR #​48098, @​nashant)
• Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (Backport PR #​48434, Upstream PR #​47635, @​aanm)
• Fixes a bug where clusters originally created in v1.15 or earlier failed to upgrade due to dropping the CRD version CiliumNodeConfig v2alpha1. (Backport PR #​48213, Upstream PR #​48087, @​squeed)
• Fragmented UDP packets were potentially mis-classified as Cilium Wireguard traffic. (Backport PR #​48213, Upstream PR #​48139, @​julianwiedmann)
• gateway-api: fix listener programmed status update (Backport PR #​48213, Upstream PR #​48013, @​mhofstetter)
• gateway-api: propgate listenerset status update errors (Backport PR #​48581, Upstream PR #​48130, @​mhofstetter)
• hubble: fix four config knobs that never reach their sink (Backport PR #​48434, Upstream PR #​47637, @​aanm)
• Improve reliability for fast recovery of disrupted TCP connections that access a DSR-enabled Service. (Backport PR #​48465, Upstream PR #​48254, @​julianwiedmann)
• lb (fix): require active state for backend when using topology hints (Backport PR #​48550, Upstream PR #​47054, @​CarrySauce)
• nodediscovery: Reduced EC2 IMDS load and made ENI node registration more resilient by fetching the instance metadata once instead of on every CiliumNode update. (Backport PR #​48603, Upstream PR #​48218, @​41ks)
• operator/ipam: Restore fatal exit when the IPAM node watcher fails (Backport PR #​48213, Upstream PR #​47778, @​HadrienPatte)
• Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR #​48213, Upstream PR #​48015, @​giorio94)
• The BPF NAT engine now drops ICMP error packets which contain a fragmented TCP/UDP/SCTP packet. (Backport PR #​48418, Upstream PR #​48174, @​julianwiedmann)
• When using DSR with --bpf-lb-dsr-dispatch set to "opt" or "geneve" in combination with --enable-pmtu-discovery, fix the outer source IP of the ICMP error message which is generated when a forwarded DSR request exceeds the network interface's MTU. (Backport PR #​48114, Upstream PR #​48053, @​julianwiedmann)

CI Changes:

• [v1.20] golangci-lint: Do not run the modernize linter (#​48398, @​aanm)
• .github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR #​48550, Upstream PR #​48462, @​joestringer)
• BPF: Refactor nat tests to use scapy fixtures and add checksum coverage (Backport PR #​48213, Upstream PR #​47222, @​tommyp1ckles)
• bpf: tests: fix up prog type in ipv6_test (Backport PR #​48213, Upstream PR #​47736, @​julianwiedmann)
• bpf: tests: use PROG_TYPE (Backport PR #​48213, Upstream PR #​47714, @​julianwiedmann)
• bpf: tests: validate CT entry for DSR connection (Backport PR #​48418, Upstream PR #​48219, @​julianwiedmann)
• ci: replace unsupported LLVM installation action (Backport PR #​48418, Upstream PR #​47776, @​bogdankrasko)
• ci: resolve renovate PR metadata in base image workflows (Backport PR #​48213, Upstream PR #​47964, @​mhofstetter)
• ci: stop asking a PHP app for the AKS runner IP (Backport PR #​48418, Upstream PR #​48371, @​aanm)
• ci: use GitHub App client ID in v1.20 image workflow (Backport PR #​48213, Upstream PR #​47787, @​bogdankrasko)
• datapath/loader: fix missing complexity coverage for enable_identity_mark (Backport PR #​48213, Upstream PR #​48037, @​tklauser)
• gh: verifier: test PR branch before base branch (Backport PR #​48418, Upstream PR #​47928, @​julianwiedmann)
• gha/conformance-aks: add a timeout

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.