helm/cilium/cilium 1.19.8 on Artifact Hub

Summary of Changes

Bugfixes:

aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes. (Backport PR #48604, Upstream PR #48193, @41ks)
bpf: Fix agent crash when dumping map events (Backport PR #48379, Upstream PR #48273, @joestringer)
bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR #47620, Upstream PR #47343, @smagnani96)
datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (Backport PR #48552, Upstream PR #46861, @fdomain)
Fix Hubble Relay remains running during termination (Backport PR #48552, Upstream PR #47942, @xandau)
Fix missing config setup for 'enable-non-default-deny-policies' flag (Backport PR #48552, Upstream PR #48391, @fristonio)
Fix nodeport egress tuple reuse for closed connections (Backport PR #48413, Upstream PR #48306, @fristonio)
Fix restored ENI endpoints routing rule configuration when masquerading config changes (#48422, @fristonio)
fix(socketlb): only detach Cilium-owned cgroup programs (Backport PR #48552, Upstream PR #44066, @puwun)
Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed. (Backport PR #48214, Upstream PR #47915, @giorio94)
Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max. (Backport PR #48433, Upstream PR #47635, @aanm)
hubble: fix four config knobs that never reach their sink (Backport PR #48433, Upstream PR #47637, @aanm)
operator: Emit startup logs in the configured log format (Backport PR #48018, Upstream PR #47890, @HadrienPatte)
standalone-dns-proxy: return an error when no endpoint is found (Backport PR #48018, Upstream PR #47791, @vipul-21)
Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values (Backport PR #48413, Upstream PR #48015, @giorio94)

CI Changes:

[v1.19] golangci-lint: Do not run the modernize linter (#48399, @aanm)
.github: Bump cilium/reusable-workflows to v0.1.1 (Backport PR #48552, Upstream PR #48462, @joestringer)
BPF: Refactor nat tests to use scapy fixtures and add checksum coverage (Backport PR #48123, Upstream PR #47222, @tommyp1ckles)
bpf: tests: collapse more tests (Backport PR #48063, Upstream PR #46374, @julianwiedmann)
bpf: tests: collapse XDP DSR tests (Backport PR #48063, Upstream PR #46174, @julianwiedmann)
bpf: tests: condense a bunch of LB tests (Backport PR #48063, Upstream PR #46358, @julianwiedmann)
ci: replace unsupported LLVM installation action (Backport PR #48413, Upstream PR #47776, @bogdankrasko)
ci: resolve renovate PR metadata in base image workflows (Backport PR #48214, Upstream PR #47964, @mhofstetter)
ci: stop asking a PHP app for the AKS runner IP (Backport PR #48552, Upstream PR #48371, @aanm)
ci: use GitHub App client ID in v1.19 image workflow (Backport PR #48214, Upstream PR #47786, @bogdankrasko)
gha/conformance-aks: add a timeout to the cluster create step (Backport PR #48552, Upstream PR #48545, @aanm)
gha/conformance-aks: give the nodes a 64 GiB OS disk (Backport PR #48552, Upstream PR #48481, @aanm)
gha/kubespray: don't wait for CoreDNS before Cilium is installed (Backport PR #48214, Upstream PR #48048, @aanm)
gha: bound the LLVM prereq apt step with a 5m timeout (Backport PR #48214, Upstream PR #48069, @aanm)
gha: compute the ginkgo cache key once, before the matrix (Backport PR #48214, Upstream PR #48127, @aanm)
gha: move GCP auth pin past the STS token exchange retry fix (Backport PR #48413, Upstream PR #48352, @aanm)
gha: publish the external target hostnames as FQDNs (Backport PR #48552, Upstream PR #48478, @aanm)
gha: stop JUnit reports being destroyed by same-name legs (Backport PR #48433, Upstream PR #48203, @aanm)
Migrate Conformance Cluster Mesh workflow to use fake external targets (Backport PR #48655, Upstream PR #48250, @giorio94)
Revert 48442 - disable local accounts on AKS clusters (#48525, @aanm)
test(bpf): parallelize eBPF test execution (Backport PR #48214, Upstream PR #47427, @lconnery)
test/k8s: wait for the L7 visibility policy to be realized (Backport PR #48413, Upstream PR #48365, @aanm)
test: fix the never-taken retry on a partially read JSON line (Backport PR #48633, Upstream PR #48190, @aanm)
tools: complexity: de-couple StackDepth from kernel version (Backport PR #48266, Upstream PR #48236, @julianwiedmann)
workflows: disable local accounts on AKS clusters (#48442, @nbusseneau)

Misc Changes:

Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes (Backport PR #48633, Upstream PR #48421, @0xch4z)
bpf: nodeport: remove Ingress HostFW Policy between RevSNAT and RevDNAT (Backport PR #48285, Upstream PR #46232, @julianwiedmann)
chore(deps): update all external docker images dependencies to v0.13.6 (v1.19) (#48678, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#48332, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#48509, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.19) (#48681, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#48155, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#48331, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.19) (#48620, @cilium-renovate[bot])
chore(deps): update base-images (v1.19) (#48151, @cilium-renovate[bot])
chore(deps): update base-images to v1.26.8 (v1.19) (#48731, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.19) (#48345, @cilium-renovate[bot])
chore(deps): update dependency go to v1.25.14 (v1.19) (#48208, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v36 (v1.19) (#48333, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.19) (#48508, @cilium-renovate[bot])
chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.19) (#48518, @cilium-renovate[bot])
chore(deps): update golangci/golangci-lint docker tag to v2.13.2 (v1.19) (#48732, @cilium-renovate[bot])
chore(deps): update google/cloud-sdk docker tag to v581 (v1.19) (#48156, @cilium-renovate[bot])
chore(deps): update helm/kind-action action to v1.15.0 (v1.19) (#48592, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/certgen docker tag to v0.4.11 (v1.19) (#48152, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.10-1787983435-8f34575affde33ad364d1e669b953993bf1f4125 (v1.19) (#48328, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1788432471-d053be1912db91dc0e031d7676a7cbbf31b67fe2 (v1.19) (#48452, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82 (v1.19) (#48679, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#48153, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#48329, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#48507, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.19) (patch) (#48680, @cilium-renovate[bot])
docs: Improve build process (Backport PR #48552, Upstream PR #47751, @joestringer)
docs: remove outdated tip about disabling hubble before enabling UI (Backport PR #48633, Upstream PR #48487, @ekoops)
docs: Remove v1.18 ipsec documentation (Backport PR #48413, Upstream PR #48224, @joestringer)
Document that Gateway API needs iptables and the netfilter TPROXY modules on nodes when bpf.tproxy is disabled (the default). (Backport PR #48552, Upstream PR #48428, @marcus-chae)
Documentation: document mesh security model (Backport PR #48413, Upstream PR #47912, @bimmlerd)
Fix byte ordering of TCP fields in BPF integration tests. (Backport PR #48063, Upstream PR #44336, @ajmmm)
Fix Component Overview doc link rendering (Backport PR #48633, Upstream PR #48537, @eneiss)
fix(deps): update k8s.io patch updates stable to v0.35.8 (v1.19) (#48330, @cilium-renovate[bot])
fix(deps): update module k8s.io/apimachinery to v0.35.8 (v1.19) (#48154, @cilium-renovate[bot])
Fixed broken Slack link on Community page. (Backport PR #48413, Upstream PR #48021, @ps-mir)
Fixes: Update node-cache image version to 1.26.5 (Backport PR #48633, Upstream PR #48270, @zyue110026)
gha: authenticate release images with OIDC (Backport PR #48598, Upstream PR #48062, @aanm)
gha: authenticate stable Image CI to quay.io with OIDC (Backport PR #48059, Upstream PR #48061, @aanm)
gha: correct and move the OIDC subject comments (Backport PR #48059, Upstream PR #48370, @aanm)
gha: raise the Docker Hub OIDC token lifetime for release builds (Backport PR #48598, Upstream PR #48535, @aanm)
helm: add general busybox image values for substitution (Backport PR #48413, Upstream PR #47973, @0xch4z)
vendor: Bump StateDB to v0.5.10 (#48247, @joamaki)

Other Changes:

Fix verifier error "detect support for FnSetRetval for program type CGroupSock" during feature probing (#48376, @borkmann)
install: Update image digests for v1.19.7 (#48040, @cilium-release-bot[bot])
proxy: Bump envoy to v1.37.x (#48310, @sayboras)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.8@sha256:e9f7ee1f2f3a41e44339612e3b6b88170bdde7679c9c9461f287bb27702a8ecf

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.8@sha256:9c44205b9e6eafed719803682669f63e0a68c549025344c0af520a94b2f3e4bc

docker-plugin

quay.io/cilium/docker-plugin:v1.19.8@sha256:e876814edd154a8f4a2a8a8ac47a10614f7bb9a717d8cee9df352d060242e3a4

hubble-relay

quay.io/cilium/hubble-relay:v1.19.8@sha256:f78768be216b5c00137c7d4da440724d0b49986805d361e7458cc8fe9ff976ff

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.8@sha256:cb4a8685fc74fef8f3e97c3370faf338ba1a8b29a7d5cdc718f3926ae0093b99

operator-aws

quay.io/cilium/operator-aws:v1.19.8@sha256:de1cfe6e9962664e69e021f1cc07ea3b4f973d4ce341d7aebabf97616dd27982

operator-azure

quay.io/cilium/operator-azure:v1.19.8@sha256:b67fcc053fe8caa5ae5f12158c8dc568b3d16201cdea17bb78f3b61b7c1f02d7

operator-generic

quay.io/cilium/operator-generic:v1.19.8@sha256:786ec9bb1a9344435e3e3f994bc4ed3a4a85afa6a314e98681af241f8be79833

operator

quay.io/cilium/operator:v1.19.8@sha256:618fe8acacaa682509b19670b1228fd8184c2c4c1478e23d505ba6502e8bcf3a