Skip to content

feat(helm): update cilium group (minor) - #2789

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/cilium
Open

feat(helm): update cilium group (minor)#2789
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/cilium

Conversation

@renovate

@renovate renovate Bot commented Feb 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
cilium (source) HelmChart minor 1.18.10 → 1.20.3
cilium (source) HelmChart minor 1.18.13 → 1.20.3
cilium (source) minor 1.18.10 → 1.20.3
cilium (source) minor 1.18.13 → 1.20.3
quay.io/cilium/cilium minor v1.18.10 → v1.20.3
quay.io/cilium/hubble-relay minor v1.18.10 → v1.20.3
quay.io/cilium/operator-generic minor v1.18.10 → v1.20.3

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

cilium/cilium (cilium)

v1.20.3: 1.20.3

Compare Source

Summary of Changes

Minor Changes:

  • alibabacloud: support IMDSv2 (token-based) instance metadata access (Backport PR #​49336, Upstream PR #​49182, @​4n4nd)
  • Fix conntrack garbage collection deleting CT entries that the datapath reopened between the GC batch read and the delete, which could cascade into NAT mapping deletion and SNAT source-port reallocation for live connections. (Backport PR #​49119, Upstream PR #​46750, @​gyutaeb)
  • operator: prevent CNPs with nodeSelector from silently enforcing nothing (Backport PR #​49173, Upstream PR #​47882, @​weizhoublue)

Bugfixes:

  • azure: Fixed an issue where an interface with an empty MAC field would be reported back the the cilium agent causing it to crash on startup when trying to configure the routes. (Backport PR #​49336, Upstream PR #​48648, @​41ks)
  • bpf: icmp: use 576 byte of inner packet to avoid partial csum floor (Backport PR #​48907, Upstream PR #​48578, @​tommyp1ckles)
  • cilium-dbg: Print port numbers correctly for map cilium_lb*_reverse_sk (Backport PR #​49336, Upstream PR #​47134, @​jayl1e)
  • daemon: fix a bug where L7 DNS policies could remain loaded in the datapath during agent shutdown, causing pods under a wildcard toFQDNs policy to lose DNS resolution for the duration of the restart. (Backport PR #​48907, Upstream PR #​48747, @​41ks)
  • endpoint/restore: skip cleanup for reserved internal endpoints (Backport PR #​48999, Upstream PR #​48272, @​fristonio)
  • envoy: handle listener additional address changes (Backport PR #​48917, Upstream PR #​48712, @​nezdolik)
  • envoy: handle listener address changes in ADS (Backport PR #​48917, Upstream PR #​48798, @​nezdolik)
  • envoy: track coalesced ADS snapshot updates (Backport PR #​48917, Upstream PR #​48631, @​nezdolik)
  • Fix Gateway API ExternalAuth dropping request bodies when allowedResponseHeaders is unset (Backport PR #​49189, Upstream PR #​48770, @​kirgene)
  • Fix incorrect deletion of new endpoint during GC iteration when reusing ID from a previously GC'd endpoint (Backport PR #​49189, Upstream PR #​48905, @​fristonio)
  • Fix ip6tables chain rename errors being silently ignored during iptables rule reconciliation. (Backport PR #​49336, Upstream PR #​49024, @​maxskokov)
  • Fix panic in agent when CiliumLocalRedirectPolicy redirectBackend.toPorts is declared as an empty array. The agent will now reject such a policy. (Backport PR #​48907, Upstream PR #​48491, @​ajmmm)
  • Fix PMTU/ICMP replies for IPIP/Geneve DSR for GRO skbs (Backport PR #​49189, Upstream PR #​48489, @​borkmann)
  • Fix rare data race in selector cache that could lead to agent panic (Backport PR #​49189, Upstream PR #​47733, @​odinuge)
  • Fix restoration of terminating backends. If a terminating backend become active again during restart the backend was incorrectly kept as quarantined. (Backport PR #​48797, Upstream PR #​48763, @​joamaki)
  • Fixes a bug where Hubble flows may list the incorrect policy that allowed or denied a flow (Backport PR #​49189, Upstream PR #​49086, @​tsotne95)
  • Fixes a bug where the helm value hubble.tls.auto.privateKey settings are no longer ignored in Hubble cert-manager certificates (Backport PR #​49189, Upstream PR #​49114, @​byxorna)
  • Fixes an issue where CiliumCIDRGroups with zero-length cidrs (i.e. 0.0.0.0/0) inadvertently selected no traffic. (Backport PR #​49336, Upstream PR #​48366, @​squeed)
  • gateway-api: filter CEC controls from infrastructure metadata (Backport PR #​48984, Upstream PR #​47732, @​nezdolik)
  • gateway-api: make HTTP route ordering deterministic (Backport PR #​49336, Upstream PR #​48951, @​abduu11aahh)
  • gateway-api: Support system CA certificates in BackendTLSPolicy. (Backport PR #​49336, Upstream PR #​48895, @​shreyasrajiv327)
  • infraendpoints: Release the health IPv4 when the IPv6 allocation fails (Backport PR #​48907, Upstream PR #​48816, @​HadrienPatte)
  • k8s/resource: fix leaked event finalizer on unobserved delete (Backport PR #​48907, Upstream PR #​48785, @​tklauser)
  • L7 conformance CI fixes (Backport PR #​48999, Upstream PR #​47517, @​fristonio)
  • operator: Do not emit warning when deleting already deleted unmanaged pod (Backport PR #​48907, Upstream PR #​48765, @​gandro)
  • operator: fix metrics list default address to work on IPv6-only clusters with dual stack nodes by trying both IPv4 and IPv6 loopback addresses (Backport PR #​48907, Upstream PR #​48780, @​41ks)
  • Set ipv6 routing rules when dual stack is enabled (Backport PR #​49336, Upstream PR #​49188, @​fcrespofastly)
  • Sockets are no longer destroyed when a Service backend is terminated unless they are still connected to that backend. Unconnected UDP sockets, and sockets that have since disconnected or moved to another backend, used to have their local port silently changed. (Backport PR #​49189, Upstream PR #​48725, @​maxskokov)

CI Changes:

Misc Changes:

Other Changes:

Docker Manifests
cilium

quay.io/cilium/cilium:v1.20.3@sha256:95cfa5c2427cc6b452c00908778d0566311f572589284af949d06a013db1a849
quay.io/cilium/cilium:stable@sha256:95cfa5c2427cc6b452c00908778d0566311f572589284af949d06a013db1a849

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.3@sha256:5c8dca0d0b77bb593df157be39f6c9c868dc08922bbd0540ac0a56815341b227
quay.io/cilium/clustermesh-apiserver:stable@sha256:5c8dca0d0b77bb593df157be39f6c9c868dc08922bbd0540ac0a56815341b227

hubble-relay

quay.io/cilium/hubble-relay:v1.20.3@sha256:c6f819d9c5e0b35ccac63b9f2f1ae213fd9be50588e15d5a444d5d305ad317b5
quay.io/cilium/hubble-relay:stable@sha256:c6f819d9c5e0b35ccac63b9f2f1ae213fd9be50588e15d5a444d5d305ad317b5

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.3@sha256:615f8c2995e437320571d6f61e623d6848ed3ea357cdaa886ac95bbff29a0b52
quay.io/cilium/operator-alibabacloud:stable@sha256:615f8c2995e437320571d6f61e623d6848ed3ea357cdaa886ac95bbff29a0b52

operator-aws

quay.io/cilium/operator-aws:v1.20.3@sha256:49bdd1d54bdf3da2740848c4662854d0d41c0df25cffe8575d71723db08cc0d1
quay.io/cilium/operator-aws:stable@sha256:49bdd1d54bdf3da2740848c4662854d0d41c0df25cffe8575d71723db08cc0d1

operator-azure

quay.io/cilium/operator-azure:v1.20.3@sha256:7132b3ff7e33a076ea9fadaa6e4f2b364937ed7b118b92928bdb4706921a2ffa
quay.io/cilium/operator-azure:stable@sha256:7132b3ff7e33a076ea9fadaa6e4f2b364937ed7b118b92928bdb4706921a2ffa

operator-generic

quay.io/cilium/operator-generic:v1.20.3@sha256:efdd8d89d6d8f63d21a065fa2f9e17614a2b3ac9371b221af9355f63829e2dbc
quay.io/cilium/operator-generic:stable@sha256:efdd8d89d6d8f63d21a065fa2f9e17614a2b3ac9371b221af9355f63829e2dbc

operator

quay.io/cilium/operator:v1.20.3@sha256:c40996c8a413f57db75715e683abc550e7849904aa20b8730822ba532f9b783c
quay.io/cilium/operator:stable@sha256:c40996c8a413f57db75715e683abc550e7849904aa20b8730822ba532f9b783c

v1.20.2: 1.20.2

Compare Source

Summary of Changes

Minor Changes:

Bugfixes:

  • aws/ipam: Fixed a bug where the operator in ENI IPAM mode would try to release prefix IPs as individual IPs even when they were in use. (Backport PR #​48418, Upstream PR #​48125, @​41ks)
  • aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #​48418, Upstream PR #​48193, @​41ks)
  • bpf: Fix agent crash when dumping map events (Backport PR #​48378, Upstream PR #​48273, @​joestringer)
  • bpf: Fixed a bug where enabling policy-deny-response: icmp would cause metrics for policy denied drops on egress to stop getting reported. (Backport PR #​48550, Upstream PR #​48407, @​41ks)
  • Cluster Mesh: fix extremely rare race condition that may cause a removed remote cluster to not be correctly disconnected (Backport PR #​48418, Upstream PR #​48262, @​giorio94)
  • datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR #​48550, Upstream PR #​46861, @​fdomain)
  • endpoint: preserve concurrent policy updates for new endpoints (Backport PR #​48213, Upstream PR #​48195, @​jrajahalme)
  • ENI IPv6: Fix IPv6 routing for health check endpoint, ingress address and for IPSec on ENI interfaces. (Backport PR #​48213, Upstream PR #​47034, @​41ks)
  • Fix a pod created immediately after a network policy change reporting a stale policy revision for up to two minutes. (Backport PR #​48418, Upstream PR #​47642, @​aanm)
  • Fix agent crash on startup in ENI IPAM mode when ipv4NativeRoutingCIDR is set to a secondary VPC CIDR association (Backport PR #​48024, Upstream PR #​47874, @​bryanhorstmann)
  • Fix BGP defaultGateway peer auto-discovery selecting a default route from a non-main routing table, such as the default via cilium_host route Cilium installs in the from-proxy table, instead of the node's real default gateway. (Backport PR #​48418, Upstream PR #​47971, @​ecbaldwin)
  • Fix bug where identities may linger for double the amount of the expected time (Backport PR #​48418, Upstream PR #​48032, @​christarazi)
  • Fix dropping traffic L2Announcement with externalTrafficPolicy: Local (Backport PR #​48550, Upstream PR #​46399, @​yuito-it)
  • Fix Gateway API static IPv6 addresses being reported as unusable when the Gateway and Service use different textual representations of the same address. (Backport PR #​48017, Upstream PR #​47943, @​taaahaaa)
  • Fix HTTPRoute ExternalAuth to fail closed when its backend reference is invalid or cannot be resolved. (Backport PR #​48017, Upstream PR #​47929, @​shreyasrajiv327)
  • Fix Hubble Relay remains running during termination (Backport PR #​48550, Upstream PR #​47942, @​xandau)
  • Fix ICMP error packet handling by adding the missing checksum recalculation performed during NAT for SNATed load-balanced traffic. (Backport PR #​48418, Upstream PR #​48086, @​julianwiedmann)
  • Fix IPv6 Router Solicitations and Router Advertisements being dropped with "Unsupported protocol for NAT masquerade" on nodes whose BPF masquerade address is a link-local address. (Backport PR #​48418, Upstream PR #​48094, @​ecbaldwin)
  • Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR #​48418, Upstream PR #​48391, @​fristonio)
  • Fix multiple regressions in Cilium LocalRedirectPolicy (Backport PR #​48634, Upstream PR #​46638, @​ajmmm)
  • Fix node-init startup on GKE 1.36.2-gke.2064000 nodes by detecting GKE from the kubelet path instead of container runtime configuration. (Backport PR #​48213, Upstream PR #​47945, @​dlanov)
  • Fix nodeport egress tuple reuse for closed connections (Backport PR #​48418, Upstream PR #​48306, @​fristonio)
  • Fix restored ENI endpoints routing rule configuration when masquerading config changes (#​48417, @​fristonio)
  • fix(envoyconfig): retry port allocation on duplicate-address rejections (Backport PR #​48735, Upstream PR #​48624, @​kokhlo)
  • Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR #​48213, Upstream PR #​47915, @​giorio94)
  • Fixed a cilium-agent crash (fatal error: concurrent map iteration and map write) when an endpoint's policy was recomputed while incremental policy map changes were applied concurrently. Most commonly triggered by named-port policies under pod churn. (Backport PR #​48735, Upstream PR #​48098, @​nashant)
  • Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (Backport PR #​48434, Upstream PR #​47635, @​aanm)
  • Fixes a bug where clusters originally created in v1.15 or earlier failed to upgrade due to dropping the CRD version CiliumNodeConfig v2alpha1. (Backport PR #​48213, Upstream PR #​48087, @​squeed)
  • Fragmented UDP packets were potentially mis-classified as Cilium Wireguard traffic. (Backport PR #​48213, Upstream PR #​48139, @​julianwiedmann)
  • gateway-api: fix listener programmed status update (Backport PR #​48213, Upstream PR #​48013, @​mhofstetter)
  • gateway-api: propgate listenerset status update errors (Backport PR #​48581, Upstream PR #​48130, @​mhofstetter)
  • hubble: fix four config knobs that never reach their sink (Backport PR #​48434, Upstream PR #​47637, @​aanm)
  • Improve reliability for fast recovery of disrupted TCP connections that access a DSR-enabled Service. (Backport PR #​48465, Upstream PR #​48254, @​julianwiedmann)
  • lb (fix): require active state for backend when using topology hints (Backport PR #​48550, Upstream PR #​47054, @​CarrySauce)
  • nodediscovery: Reduced EC2 IMDS load and made ENI node registration more resilient by fetching the instance metadata once instead of on every CiliumNode update. (Backport PR #​48603, Upstream PR #​48218, @​41ks)
  • operator/ipam: Restore fatal exit when the IPAM node watcher fails (Backport PR #​48213, Upstream PR #​47778, @​HadrienPatte)
  • Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR #​48213, Upstream PR #​48015, @​giorio94)
  • The BPF NAT engine now drops ICMP error packets which contain a fragmented TCP/UDP/SCTP packet. (Backport PR #​48418, Upstream PR #​48174, @​julianwiedmann)
  • When using DSR with --bpf-lb-dsr-dispatch set to "opt" or "geneve" in combination with --enable-pmtu-discovery, fix the outer source IP of the ICMP error message which is generated when a forwarded DSR request exceeds the network interface's MTU. (Backport PR #​48114, Upstream PR #​48053, @​julianwiedmann)

CI Changes:

Misc Changes:

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Moscow)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title feat(container): update image quay.io/cilium/hubble-relay ( v1.18.5 → v1.19.0 ) feat(container): update cilium group ( v1.18.5 → v1.19.0 ) (minor) Feb 4, 2026
@renovate
renovate Bot force-pushed the renovate/cilium branch 2 times, most recently from eab2b89 to 927a4bb Compare February 4, 2026 04:41
@renovate renovate Bot changed the title feat(container): update cilium group ( v1.18.5 → v1.19.0 ) (minor) feat(helm): update cilium group (minor) Feb 4, 2026
@mglants-bot

mglants-bot Bot commented Feb 4, 2026 •
edited
Loading

Copy link
Copy Markdown 
--- kubernetes/berries/apps/kube-system/cilium/app Kustomization: flux-system/cluster-apps-cilium HelmRelease: kube-system/cilium

+++ kubernetes/berries/apps/kube-system/cilium/app Kustomization: flux-system/cluster-apps-cilium HelmRelease: kube-system/cilium

@@ -13,13 +13,13 @@

       chart: cilium
       interval: 30m
       sourceRef:
         kind: HelmRepository
         name: cilium-charts
         namespace: flux-system
-      version: 1.18.13
+      version: 1.20.3
   interval: 30m
   values:
     bgp:
       enabled: false
     bgpControlPlane:
       enabled: true

@mglants-bot

mglants-bot Bot commented Feb 4, 2026 •
edited
Loading

Copy link
Copy Markdown 
--- kubernetes/subterra/apps/kube-system/cilium/app Kustomization: flux-system/cluster-apps-cilium HelmRelease: kube-system/cilium

+++ kubernetes/subterra/apps/kube-system/cilium/app Kustomization: flux-system/cluster-apps-cilium HelmRelease: kube-system/cilium

@@ -13,13 +13,13 @@

       chart: cilium
       interval: 30m
       sourceRef:
         kind: HelmRepository
         name: cilium-charts
         namespace: flux-system
-      version: 1.18.10
+      version: 1.20.3
   interval: 30m
   values:
     bgp:
       enabled: false
     bgpControlPlane:
       enabled: true

@renovate
renovate Bot force-pushed the renovate/cilium branch 2 times, most recently from dc65dd3 to b031d11 Compare February 17, 2026 19:32
@renovate
renovate Bot force-pushed the renovate/cilium branch from b031d11 to 54192a7 Compare February 25, 2026 23:47
@renovate
renovate Bot force-pushed the renovate/cilium branch from 54192a7 to dc8ac0f Compare March 13, 2026 16:43
@renovate
renovate Bot force-pushed the renovate/cilium branch from dc8ac0f to a2fbc34 Compare March 23, 2026 14:01
@renovate
renovate Bot force-pushed the renovate/cilium branch from a2fbc34 to a5fc92d Compare March 30, 2026 14:06
@renovate
renovate Bot force-pushed the renovate/cilium branch from a5fc92d to fe028e7 Compare April 16, 2026 12:41
@renovate
renovate Bot force-pushed the renovate/cilium branch from fe028e7 to 53ed368 Compare April 29, 2026 11:09
@renovate
renovate Bot force-pushed the renovate/cilium branch 2 times, most recently from 9691cf6 to 9f140df Compare May 18, 2026 19:55
@renovate
renovate Bot force-pushed the renovate/cilium branch from 9f140df to 287c829 Compare May 28, 2026 20:01
@renovate
renovate Bot force-pushed the renovate/cilium branch 3 times, most recently from 4aa51cb to 2cb99ec Compare June 16, 2026 19:18
@renovate
renovate Bot force-pushed the renovate/cilium branch from 2cb99ec to 0b60a5a Compare June 22, 2026 17:54
@renovate
renovate Bot force-pushed the renovate/cilium branch 3 times, most recently from 382677e to e7f87ad Compare July 20, 2026 23:20
@renovate
renovate Bot force-pushed the renovate/cilium branch from e7f87ad to f446295 Compare July 29, 2026 18:46
@renovate
renovate Bot force-pushed the renovate/cilium branch 2 times, most recently from 0a08a30 to 9dd017e Compare August 18, 2026 15:16
@renovate
renovate Bot force-pushed the renovate/cilium branch from 9dd017e to 4154972 Compare August 26, 2026 11:04
@renovate
renovate Bot force-pushed the renovate/cilium branch 3 times, most recently from 2a04b05 to 2af3b29 Compare September 7, 2026 17:21
@renovate
renovate Bot force-pushed the renovate/cilium branch 4 times, most recently from c7c7fa0 to 5a23560 Compare September 16, 2026 10:07
@renovate
renovate Bot force-pushed the renovate/cilium branch from 76281ba to e1d1d84 Compare October 5, 2026 13:06
@renovate
feat(helm): update cilium group
da6a1b8 
| datasource | package                         | from     | to      |
| ---------- | ------------------------------- | -------- | ------- |
| helm       | cilium                          | 1.18.10  | 1.20.3  |
| helm       | cilium                          | 1.18.13  | 1.20.3  |
| docker     | quay.io/cilium/cilium           | v1.18.10 | v1.20.3 |
| docker     | quay.io/cilium/hubble-relay     | v1.18.10 | v1.20.3 |
| docker     | quay.io/cilium/operator-generic | v1.18.10 | v1.20.3 |
@renovate
renovate Bot force-pushed the renovate/cilium branch from e1d1d84 to da6a1b8 Compare October 15, 2026 16:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/kubernetes cluster/berries cluster/subterra renovate/container type/minor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants