feat(helm): update cilium group (minor) by renovate[bot] · Pull Request #2789 · mglants/gitops

renovate · 2026-02-03T21:56:31Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
cilium (source)	HelmChart	minor	`1.18.10` → `1.19.6`
cilium (source)		minor	`1.18.10` → `1.19.6`
quay.io/cilium/cilium		minor	`v1.18.10` → `v1.19.6`
quay.io/cilium/hubble-relay		minor	`v1.18.10` → `v1.19.6`
quay.io/cilium/operator-generic		minor	`v1.18.10` → `v1.19.6`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

cilium/cilium (cilium)

`v1.19.6`: 1.19.6

Compare Source

Summary of Changes

Minor Changes:

datapath/l2responder: use l3 sockets for solicited node multicast signaling (Backport PR #46845, Upstream PR #46332, @bersoare)
gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR #46933, Upstream PR #46403, @arybolovlev)

Bugfixes:

[v1.19] Fix policy service label selector handling (#46946, @fristonio)
bpf: fix ipv6 neighbor solicitation handling in host firewall (Backport PR #46669, Upstream PR #46325, @atykhyy)
doublewrite: Don't run CRD backend with real handler when reading from KVStore (Backport PR #47181, Upstream PR #47144, @HadrienPatte)
endpoint: Fix race when reading endpoint properties (Backport PR #47181, Upstream PR #46991, @gandro)
Fix cilium_operator_unmanaged_pods gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (Backport PR #46975, Upstream PR #46668, @Suyash1700)
Fix a bug which could lead to stale hostport entries if a pod was deleted and immediately recreated in host network. (Backport PR #46793, Upstream PR #46747, @giorio94)
Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (Backport PR #46974, Upstream PR #46927, @aanm)
Fix allowedRoute namespace and kind restrictions on multi-listener Gateways. (Backport PR #46826, Upstream PR #45693, @eufriction)
Fix bug that left the host firewall enabled in the live ConfigMap when disabling hostFirewall.enabled (toggling it from true to false) via Helm. (Backport PR #46669, Upstream PR #44748, @shibaPuppy)
Fix ClusterMesh service affinity annotation service.cilium.io/affinity: "none" incorrectly dropping all remote backends, causing traffic blackhole when no local endpoints exist. (Backport PR #46691, Upstream PR #46635, @mkamadeus)
Fix ctmap gc duration metric recording (Backport PR #46975, Upstream PR #46873, @fristonio)
Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR #47002, Upstream PR #46821, @fristonio)
Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR #47181, Upstream PR #46967, @ysksuzuki)
Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service (Backport PR #47181, Upstream PR #46444, @giorio94)
Fix the UDP tunnel check in the BIG TCP probe. (Backport PR #46793, Upstream PR #46710, @gentoo-root)
Fixes a bug where Hubble policy correlation does not work for port ranges. (Backport PR #46793, Upstream PR #46643, @squeed)
gateway-api: Add Gateway check for when hostNetwork is enabled (Backport PR #46837, Upstream PR #46350, @xtineskim)
gateway-api: Each HTTPS and TLS passthrough port now receives its own Envoy listener and RouteConfiguration. (Backport PR #46826, Upstream PR #44889, @eufriction)
ipam/multi-pool: Do now wait for zero prealloc request (Backport PR #47181, Upstream PR #46867, @pippolo84)
operator: Fix nil-pointer panic in CiliumNode GC (Backport PR #47181, Upstream PR #47127, @HadrienPatte)

CI Changes:

.github: Generate CI binaries with correct module version (Backport PR #47099, Upstream PR #46742, @joestringer)
chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR #46920, Upstream PR #46840, @sekhar-isovalent)
ci: Auth to image registry in clustermesh upgrade workflow (Backport PR #46691, Upstream PR #46632, @nebril)
ci: Remove merge_group from tests-smoke-conformance.yaml (Backport PR #46888, Upstream PR #46451, @nebril)
Fix workflow change detection for single-commit PRs to main (Backport PR #46793, Upstream PR #46684, @Demiserular)
Further GC ratchet test fix races (Backport PR #47224, Upstream PR #43075, @tommyp1ckles)

Misc Changes:

(minor) docs: update reference to aws-cli image (Backport PR #46975, Upstream PR #46923, @squeed)
.github: allow fork PR checkout with actions/checkout v7 (Backport PR #47135, Upstream PR #47133, @aanm)
[v1.19] - .github/workflows: unpin cilium/cilium self-references to track main (#46613, @aanm)
[v1.19] - Reapply ".github/workflows: do not use deployments for environments" (#46574, @aanm)
[v1.19] vendor: bump github.com/cilium/statedb to v0.5.9 (#47083, @giorio94)
bgp: fix status condition reporting: update reasons to accurately reflect current condition state (Backport PR #46920, Upstream PR #46383, @martonra)
bpf: Condition ICMP SNAT on BPF masquerading and inter-cluster SNAT (Backport PR #47181, Upstream PR #47021, @pchaigno)
chore(deps): update all github action dependencies (v1.19) (#46658, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46908, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#47109, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#46906, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#47045, @cilium-renovate[bot])
chore(deps): update aws-actions/configure-aws-credentials action to v6.2.2 (v1.19) (#47124, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#46774, @cilium-renovate[bot])
chore(deps): update base-images to v1.25.12 (v1.19) (#46982, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.5 (v1.19) (#46726, @cilium-renovate[bot])
chore(deps): update docker.io/library/alpine docker tag to v3.23.5 (v1.19) (#46773, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.11 docker digest to 00feed3 (v1.19) (#46657, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.4.6 (v1.19) (#47039, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc (v1.19) (#46700, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/image-tester docker tag to v1783861476 (v1.19) (#47122, @cilium-renovate[bot])
chore: BYOCNI loopback for cilium (Backport PR #46691, Upstream PR #46646, @sekhar-isovalent)
chore: optimize building gops and cni/loopback (Backport PR #46845, Upstream PR #46781, @sekhar-isovalent)
ci: always set fail-fast to false on image builds (Backport PR #47181, Upstream PR #47064, @aanm)
ci: remove non-ariane workflows from config (Backport PR #46845, Upstream PR #46787, @nebril)
clustermesh: add reusable backend selector constructor (Backport PR #46691, Upstream PR #45648, @viktor-kurchenko)
docs: clarify Hubble static/dynamic exporter file rotation settings (Backport PR #47181, Upstream PR #47026, @maksymbilokur-cisco)
docs: fix note about ipv4-native-routing-cidr default value (Backport PR #46793, Upstream PR #46603, @rptaylor)
Egress Gateway: handle nil events (Backport PR #47181, Upstream PR #46476, @tommyp1ckles)
endpoint: reap restart-preserved policy map entries once ready (Backport PR #47063, Upstream PR #47062, @aanm)
endpoint: sync desired policy before reload on the restore path (restore-path hardening) (Backport PR #47076, Upstream PR #47075, @aanm)
Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR #46793, Upstream PR #46388, @tommyp1ckles)
Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR #46845, Upstream PR #46388, @tommyp1ckles)
fix(deps): update k8s.io/utils digest to be93311 (v1.19) (#46907, @cilium-renovate[bot])
fix(deps): update k8s.io/utils digest to cf1189d (v1.19) (#47115, @cilium-renovate[bot])
Fixed Gateway API reconciler incorrectly reporting "Accepted HTTPRoute" in the status condition message for GRPCRoute and TLSRoute resources. (Backport PR #46826, Upstream PR #44962, @eufriction)
gateway-api: return model from Gateway API ingestion (Backport PR #46933, Upstream PR #46450, @arybolovlev)
gha: fail fast in external-target provisioning scripts instead of swallowing failures (Backport PR #47181, Upstream PR #47085, @aanm)
Improve cilium-dbg status output of module health (Backport PR #46845, Upstream PR #46739, @joestringer)
loadbalancer: proxy ports are now resolved per frontend instead of per service, preventing one port from losing its L7 redirect when multiple listeners share a service. (Backport PR #46826, Upstream PR #45949, @eufriction)
loadbalancer: validate DSR dispatch configuration globally (Backport PR #46793, Upstream PR #45545, @FelipeYepez)
Makefile: Generate full Cilium version in worktree (Backport PR #46793, Upstream PR #46737, @joestringer)
Revert restore-path policy map changes (#46927, #47062, #47075) (Backport PR #47213, Upstream PR #47202, @aanm)
Upgraded cilium/ebpf to version v0.22.0 (Backport PR #46845, Upstream PR #46783, @dylandreimerink)

Other Changes:

install: Update image digests for v1.19.5 (#46593, @cilium-release-bot[bot])
v1.19: gateway-api: fix sds secrets in golden tests (#47229, @0xch4z)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.6@sha256:accab5fe6ab7134fcd6f916acc9e4c785382a022128ae5495ec4a45fbe18c9a6

docker-plugin

quay.io/cilium/docker-plugin:v1.19.6@sha256:81a8d37e541edfff4016037373853e8e875f1ea0433c58b9ab54b314c305b9ec

hubble-relay

quay.io/cilium/hubble-relay:v1.19.6@sha256:6782a49e3f28eba015701c4410a5ec7fa096fe9a562f879b4372dbecd827ea44

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.6@sha256:031e332cdec61a9ebaca42f044e7e2f5b876ba96ac0ccf1d42acd5954779efaf

operator-aws

quay.io/cilium/operator-aws:v1.19.6@sha256:546d13ac511cf82441b5e9e99e03d0e054b788513ceb1a883e620b8284d5ccc3

operator-azure

quay.io/cilium/operator-azure:v1.19.6@sha256:e555430b7f5e4c407daab1afbec3c431ec016a53f1f1b848f67b9242cd3adedd

operator-generic

quay.io/cilium/operator-generic:v1.19.6@sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665

operator

quay.io/cilium/operator:v1.19.6@sha256:37e36840be5a0882a9a065b2308859785e960a742aed0aeac794e0ac4aabdf90

`v1.19.5`: 1.19.5

Compare Source

Summary of Changes

Minor Changes:

Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR #46554, Upstream PR #46516, @giorio94)
helm: Remove loadBalancer.standalone option (Backport PR #46170, Upstream PR #46070, @joestringer)
wireguard:mtu: fix mtu calculation with potential padding (Backport PR #46170, Upstream PR #45940, @smagnani96)

Bugfixes:

Always add cluster label to node when nodeSelectorLabels is enabled to fix CiliumNetworkPolicy with fromNodes/toNodes with policy-default-local-cluster enabled (enabled by default in 1.19+) (Backport PR #46170, Upstream PR #46068, @MrFreezeex)
azure: Fix public IP reassignment failure loop on operator restart (Backport PR #46289, Upstream PR #46240, @HadrienPatte)
bgp: Don't provide default_gateway reconciler when disabled (Backport PR #46024, Upstream PR #45911, @YutaroHayakawa)
bgp: Reduce amount of soft peer resets by service reconciliation and fix potentially missed incorrect metadata update upon failed reconciliation. (Backport PR #46245, Upstream PR #45927, @rastislavs)
bpf: fix host proxy packet routing to pods (Backport PR #46024, Upstream PR #45916, @atykhyy)
bug: fixed weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API (Backport PR #46170, Upstream PR #45937, @nickolaev)
datapath/mtu: add altname to mark cilium owned interfaces and do skip changing MTU on interfaces not managed by cilium (Backport PR #46028, Upstream PR #45799, @bersoare)
Fix a bug that causes the NamespaceSelector field in a CiliumEgressGatewayPolicy to be corrupted, and no longer effective. (Backport PR #46024, Upstream PR #45926, @julianwiedmann)
Fix a rare bug in clustermesh-apiserver that triggers incorrect deletion of a valid endpoint entry from the etcd under high pod churn (Backport PR #46170, Upstream PR #45780, @adamwathieu)
Fix BGP PeerConfig status cleanup so it no longer times out when there are no managed conditions to remove. (Backport PR #46170, Upstream PR #45967, @ysksuzuki)
Fix bug that would disrupt node connectivity when ClusterIP/LoadBalancer VIPs overlapped with node-local IP addresses. (Backport PR #46024, Upstream PR #45572, @ajmmm)
Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName. (Backport PR #45966, Upstream PR #45371, @syedazeez337)
Fix wildcard namespace bypass for selectorless ipBlock rules (Backport PR #46456, Upstream PR #46305, @TheBeeZee)
fix(gateway-api): Prevent controller panic during Gateway reconciliation when GatewayClass has an invalid or malformed spec.parametersRef. (Backport PR #46400, Upstream PR #46340, @arybolovlev)
fix(gateway-api): set ready condition in endpointSlice to true (Backport PR #46400, Upstream PR #46237, @ulrichgiraud)
fix: nil pointer dereference panic due to uninitialized logger (Backport PR #46170, Upstream PR #45782, @weizhoublue)
Fixed a race where a reused endpoint ID could have its BPF state directory removed by the outgoing endpoint (Backport PR #46554, Upstream PR #46091, @eyupcanakman)
Fixed unsolicited IPv6 L2 announcements ignored by receiving hosts, as not conformant to RFC 4861 (Backport PR #46170, Upstream PR #46079, @giorio94)
Fixes a bug where policymap pressure was incorrectly being reported as 0. (Backport PR #46024, Upstream PR #45791, @squeed)
gateway-api/ingress: set service label on EndpointSlices (Backport PR #46400, Upstream PR #46242, @mhofstetter)
gateway-api: fix GatewayClass field index (Backport PR #46289, Upstream PR #46127, @thorn3r)
gateway-api: prune stale Gateway API route parent statuses (Backport PR #46400, Upstream PR #46296, @mhofstetter)
Improve robustness of kvstore keys construction to prevent possible surprising behavior in rare circumstances (Backport PR #46554, Upstream PR #46412, @giorio94)
iptables: match wireguard packets by proto+port instead of packet mark (Backport PR #46289, Upstream PR #45974, @bersoare)
multipool: Fix retries for CiliumNode Get errors (Backport PR #46408, Upstream PR #46124, @pippolo84)
sockets: fix nil pointer dereference in filterAndDestroySockets (Backport PR #46024, Upstream PR #44843, @umut-polat)
The internal representation of load-balancing backends has been refactored to efficiently support thousands of services referencing a shared backend. (#46462, @joamaki)

CI Changes:

chore(deps): update lvh-images for conformance-runtime (Backport PR #46025, Upstream PR #45922, @julianwiedmann)
ci:bpftrace: fail curl with corrupted binary download (Backport PR #46024, Upstream PR #45948, @smagnani96)
fix the race condition for the TestRouterIDAllocation bgp test case (Backport PR #46289, Upstream PR #44545, @liyihuang)
gha: make conformance kubespray runner configurable (Backport PR #46289, Upstream PR #46171, @giorio94)
helm: add tmpl files to .helmignore (Backport PR #46554, Upstream PR #46445, @sekhar-isovalent)
helm: allow overriding of registry_prefix in charts (Backport PR #46289, Upstream PR #46217, @sekhar-isovalent)
ipam: Deflake TestMarkForReleaseNoAllocate (Backport PR #46289, Upstream PR #46188, @pippolo84)
Move pull_request triggered workflows to ariane (Backport PR #46452, Upstream PR #45363, @nebril)
Reapply "ci: Log in for image registry pulls" (Backport PR #46495, Upstream PR #46376, @nebril)

Misc Changes:

[v1.19] - chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 7… (#46578, @aanm)
[v1.19] Backport health command fixes from 46102 (#46250, @joamaki)
[v1.19] deps: bump various go packages (#46185, @ferozsalam)
[v1.19] loadbalancer: return correct IP family for IPv6 ClusterIP addresses (#46425, @tklauser)
bpf: local_delivery: add CB flag for "use_redirect_peer" (Backport PR #46204, Upstream PR #46169, @julianwiedmann)
bpf: local_delivery: condense usage of skb cb slots (Backport PR #46204, Upstream PR #46064, @julianwiedmann)
bpf: local_delivery: use CB_DELIVERY_FLAGS to transfer proxy state (Backport PR #46554, Upstream PR #46291, @julianwiedmann)
chore(deps): update all github action dependencies (v1.19) (#45994, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46016, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46117, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46268, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46280, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46395, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#46538, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#45468, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#46581, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#45995, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#46164, @cilium-renovate[bot])
chore(deps): update base-images to v1.25.11 (v1.19) (#46342, @cilium-renovate[bot])
chore(deps): update cilium/cilium digest to 0fc1dd3 (v1.19) (#46153, @cilium-renovate[bot])
chore(deps): update cilium/cilium digest to 11ecd4e (v1.19) (#46277, @cilium-renovate[bot])
chore(deps): update cilium/cilium digest to cd47774 (v1.19) (#46137, @cilium-renovate[bot])
chore(deps): update cilium/cilium digest to e1b3ec8 (v1.19) (#46007, @cilium-renovate[bot])
chore(deps): update cilium/cilium-cli action to v0.19.3 (v1.19) (#46120, @cilium-renovate[bot])
chore(deps): update dependency bufbuild/buf to v1.70.0 (v1.19) (#46267, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.19.4 (v1.19) (#46150, @cilium-renovate[bot])
chore(deps): update dependency cilium/little-vm-helper to v0.0.30 (v1.19) (#46266, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v35.1 (v1.19) (#46570, @cilium-renovate[bot])
chore(deps): update docker.io/library/busybox:1.37.0 docker digest to 9532d8c (v1.19) (#46535, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.10 docker digest to cd05a37 (v1.19) (#46138, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.25.11 docker digest to 379065f (v1.19) (#46536, @cilium-renovate[bot])
chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.12 (v1.19) (#46560, @cilium-renovate[bot])
chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260518104151-5ebe05f9440b (v1.19) (#46139, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.4.5 (v1.19) (#46561, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752 (v1.19) (#46377, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#45392, @cilium-renovate[bot])
docs: Add caveats on Kubernetes versions when using host L7 DNS policies (Backport PR #46289, Upstream PR #45843, @atykhyy)
docs: Document BTF as a requirement (Backport PR #46289, Upstream PR #46063, @pchaigno)
docs: fix Markdown-style hyperlink in mutual-authentication.rst (Backport PR #46024, Upstream PR #45751, @bitflicker64)
Fix broken gateway-api documentation links (Backport PR #46554, Upstream PR #46527, @0xch4z)
Fix pointer-address comparison for Gateway API Route ParentReference status handling (Backport PR #46400, Upstream PR #46355, @weizhoublue)
fix(deps): update k8s.io patch updates stable to v0.35.5 (v1.19) (#46140, @cilium-renovate[bot])
fix(deps): update k8s.io patch updates stable to v0.35.5 (v1.19) (patch) (#46015, @cilium-renovate[bot])
fix(deps): update k8s.io patch updates stable to v0.35.6 (v1.19) (#46562, @cilium-renovate[bot])
fix(deps): update k8s.io/utils digest to ff6756f (v1.19) (#45996, @cilium-renovate[bot])
fix(deps): update module k8s.io/apimachinery to v0.35.5 (v1.19) (#45997, @cilium-renovate[bot])
fix(deps): update module k8s.io/apimachinery to v0.35.6 (v1.19) (#46537, @cilium-renovate[bot])
Miscellaneous improvements to the fake client (Backport PR #46024, Upstream PR #45784, @giorio94)
operator: miscellaneous improvements to the troubleshoot clustermesh command (Backport PR #46554, Upstream PR #46502, @giorio94)
Remove defunct l2podAnnouncements.interface Helm value that rendered a configmap key the agent no longer recognises, causing crash-loops when L2 pod announcements were enabled. Users must use l2podAnnouncements.interfacePattern instead. (Backport PR #46170, Upstream PR #46093, @salamidrus)
Revert ".github/workflows: do not use deployments for environments" (Backport PR #46400, Upstream PR #46348, @aanm)

Other Changes:

[v1.19] proxy: Bump upstream version to v1.37.x (#46439, @sayboras)
install: Update image digests for v1.19.4 (#45961, @cilium-release-bot[bot])
v1.19: kvstore: Don't set fake pod CIDRs for remote nodes (#46361, @pchaigno)
vendor: bump statedb to v0.5.8 (#46505, @giorio94)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.5@sha256:5ed9334b2254315740f9e2a8b6645bf69920f79ef14f436931579d2038784f9b

docker-plugin

quay.io/cilium/docker-plugin:v1.19.5@sha256:4006d5558390120774a5a903a706dfd64089082bd653b7cb45e9e5a93ff4efea

hubble-relay

quay.io/cilium/hubble-relay:v1.19.5@sha256:24409bfa1bca075c92acb26ba4b49cd573d99d68d5370f7cc825078185222a0c

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.5@sha256:c9706343dde700804c2f50c09a2f8291797c707d1747fd50f70c939c23747c16

operator-aws

quay.io/cilium/operator-aws:v1.19.5@sha256:b8473618e8d2bf8a610da445c8c37e1d1e8221aecd05989456d87a7588d66707

operator-azure

quay.io/cilium/operator-azure:v1.19.5@sha256:8600299cb121f9df00fd32b93fa74de89ed49dd3a67e3d7301c07325c04c77f8

operator-generic

quay.io/cilium/operator-generic:v1.19.5@sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4

operator

quay.io/cilium/operator:v1.19.5@sha256:07a25f6a248d77f0c8417d21b5ea5424a81fe551421e4baf04dc79b1360e832e

`v1.19.4`: 1.19.4

Compare Source

Summary of Changes

Minor Changes:

cilium-agent: when --k8s-service-proxy-name is set, EndpointSlices are now filtered by the service.kubernetes.io/service-proxy-name label at the watch level, matching how Services are already filtered, operators with hand-managed EndpointSlices must stamp the matching label on those slices. (Backport PR #45755, Upstream PR #45504, @HadrienPatte)
iptables-based masquerading: Ensure iptables rules respect longest prefix match by sorting routes by mask length when enable-masquerade-to-route-source is enabled (Backport PR #45630, Upstream PR #45192, @liyihuang)
operator/spire: make SPIRE client configurable for ztunnel (Backport PR #45356, Upstream PR #44136, @nddq)
pkg/endpoint: skip logger rebuild on policy revision updates (Backport PR #45630, Upstream PR #45533, @sjohnsonpal)

Bugfixes:

bpf: egressgw: respect egress ifindex during FIB lookup (Backport PR #45695, Upstream PR #45661, @julianwiedmann)
bpf: host: fix source identity for IPsec trace in to-netdev (Backport PR #45594, Upstream PR #45588, @julianwiedmann)
cilium-dbg: cilium map list now displays "unknown" instead of 0 for maps that do not support cache-based entry counting. (Backport PR #45888, Upstream PR #44951, @skymensch)
cilium: Fix incorrect IPv6 BIG TCP display (Backport PR #45630, Upstream PR #45529, @pchaigno)
clustermesh: fails gracefully instead of crashing when EndpointSliceSync is not able to setup the EndpointSlice watch (Backport PR #45496, Upstream PR #45402, @MrFreezeex)
clustermesh: Fix Helm typo preventing to add annotations when setting clustermesh.apiserver.tls.auto.method: certmanager (Backport PR #45630, Upstream PR #45576, @owayss)
Fix cilium-agent crash when a transient network error occurs during CiliumNode update. The agent now retries instead of calling Fatal. (Backport PR #45673, Upstream PR #44526, @nebojsaj1726)
Fix CiliumLocalRedirectPolicy addressMatcher overriding an existing Service's frontend when its backend pods are not yet Ready. (Backport PR #45584, Upstream PR #45522, @ysksuzuki)
Fix dedicated Ingress reconciliation panic on invalid TLS passthrough rules (Backport PR #45888, Upstream PR #45737, @weizhoublue)
Fix host L7 policy operation (Backport PR #45496, Upstream PR #45030, @atykhyy)
Fix IPsec packet drops during rolling restart with key rotation by deferring SPI advertisement until XFRM states are ready (Backport PR #45630, Upstream PR #44701, @hbangT)
Fix issue where datapath reinitialization may get stuck when triggered from the local API (Backport PR #45630, Upstream PR #45557, @jrife)
Fix missing global service backends in Cluster Mesh when multiple service ports point to the same target port. (Backport PR #45356, Upstream PR [#45179](https://redi

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Moscow)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

mglants-bot · 2026-02-04T04:42:35Z

--- kubernetes/berries/apps/kube-system/cilium/app Kustomization: flux-system/cluster-apps-cilium HelmRelease: kube-system/cilium

+++ kubernetes/berries/apps/kube-system/cilium/app Kustomization: flux-system/cluster-apps-cilium HelmRelease: kube-system/cilium

@@ -13,13 +13,13 @@

       chart: cilium
       interval: 30m
       sourceRef:
         kind: HelmRepository
         name: cilium-charts
         namespace: flux-system
-      version: 1.18.10
+      version: 1.19.6
   interval: 30m
   values:
     bgp:
       enabled: false
     bgpControlPlane:
       enabled: true

mglants-bot · 2026-02-04T04:42:39Z

--- kubernetes/subterra/apps/kube-system/cilium/app Kustomization: flux-system/cluster-apps-cilium HelmRelease: kube-system/cilium

+++ kubernetes/subterra/apps/kube-system/cilium/app Kustomization: flux-system/cluster-apps-cilium HelmRelease: kube-system/cilium

@@ -13,13 +13,13 @@

       chart: cilium
       interval: 30m
       sourceRef:
         kind: HelmRepository
         name: cilium-charts
         namespace: flux-system
-      version: 1.18.10
+      version: 1.19.6
   interval: 30m
   values:
     bgp:
       enabled: false
     bgpControlPlane:
       enabled: true

| datasource | package | from | to | | ---------- | ------------------------------- | -------- | ------- | | helm | cilium | 1.18.10 | 1.19.6 | | docker | quay.io/cilium/cilium | v1.18.10 | v1.19.6 | | docker | quay.io/cilium/hubble-relay | v1.18.10 | v1.19.6 | | docker | quay.io/cilium/operator-generic | v1.18.10 | v1.19.6 |

renovate Bot added renovate/container type/minor labels Feb 3, 2026

mglants-bot Bot added area/kubernetes cluster/subterra cluster/berries labels Feb 3, 2026

renovate Bot changed the title ~~feat(container): update image quay.io/cilium/hubble-relay ( v1.18.5 → v1.19.0 )~~ feat(container): update cilium group ( v1.18.5 → v1.19.0 ) (minor) Feb 4, 2026

renovate Bot force-pushed the renovate/cilium branch 2 times, most recently from eab2b89 to 927a4bb Compare February 4, 2026 04:41

renovate Bot changed the title ~~feat(container): update cilium group ( v1.18.5 → v1.19.0 ) (minor)~~ feat(helm): update cilium group (minor) Feb 4, 2026

renovate Bot force-pushed the renovate/cilium branch 2 times, most recently from dc65dd3 to b031d11 Compare February 17, 2026 19:32

renovate Bot force-pushed the renovate/cilium branch from b031d11 to 54192a7 Compare February 25, 2026 23:47

renovate Bot force-pushed the renovate/cilium branch from 54192a7 to dc8ac0f Compare March 13, 2026 16:43

renovate Bot force-pushed the renovate/cilium branch from dc8ac0f to a2fbc34 Compare March 23, 2026 14:01

renovate Bot force-pushed the renovate/cilium branch from a2fbc34 to a5fc92d Compare March 30, 2026 14:06

renovate Bot force-pushed the renovate/cilium branch from a5fc92d to fe028e7 Compare April 16, 2026 12:41

renovate Bot force-pushed the renovate/cilium branch from fe028e7 to 53ed368 Compare April 29, 2026 11:09

renovate Bot force-pushed the renovate/cilium branch 2 times, most recently from 9691cf6 to 9f140df Compare May 18, 2026 19:55

renovate Bot force-pushed the renovate/cilium branch from 9f140df to 287c829 Compare May 28, 2026 20:01

renovate Bot force-pushed the renovate/cilium branch 3 times, most recently from 4aa51cb to 2cb99ec Compare June 16, 2026 19:18

renovate Bot force-pushed the renovate/cilium branch from 2cb99ec to 0b60a5a Compare June 22, 2026 17:54

renovate Bot force-pushed the renovate/cilium branch from 0b60a5a to d486af3 Compare July 16, 2026 16:17

renovate Bot force-pushed the renovate/cilium branch from d486af3 to 382677e Compare July 16, 2026 18:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(helm): update cilium group (minor)#2789

feat(helm): update cilium group (minor)#2789
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/cilium

renovate Bot commented Feb 3, 2026 •

edited

Loading

Uh oh!

mglants-bot Bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

mglants-bot Bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.19.6: 1.19.6

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.19.5: 1.19.5

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.19.4: 1.19.4

Summary of Changes

Configuration

Uh oh!

mglants-bot Bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mglants-bot Bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Feb 3, 2026 •

edited

Loading

`v1.19.6`: 1.19.6

`v1.19.5`: 1.19.5

`v1.19.4`: 1.19.4

mglants-bot Bot commented Feb 4, 2026 •

edited

Loading

mglants-bot Bot commented Feb 4, 2026 •

edited

Loading