Summary of Changes
Major Changes:
- Envoy resources (e.g., Listeners, Network Policies, etc.) can now be synchronized with Envoy incrementally, reducing CPU load and policy update latency. This is enabled by the new agent option value
--envoy-xds-mode=delta-split. Corresponding Helm value isenvoy.xdsMode=delta-split. (#45288, @jrajahalme) - network driver: add agent side baseline driver and dummy device manager (#47254, @bersoare)
Minor Changes:
- build: Update iptables from 1.8.8 to 1.8.11 (#47623, @HadrienPatte)
- clustermesh: no longer restart pods when changing remote clustermesh-apiserver IPs statically defined (without a DNS name) (#47190, @MrFreezeex)
- CT map adaptive GC interval calculation improvements (#46796, @fristonio)
- Deprecate WireGuard Node Encryption (#47219, @pchaigno)
- envoy: demote stale ADS endpoint warning (#47148, @nezdolik)
- Fix external traffic drops/inconsistencies on secondary ENIs with masquerade enabled (#47008, @monta-riahi)
- helm: Add extraInitContainers and disableDefaultVolumes to support external certificate management for Hubble and ClusterMesh components. (#46688, @alaashehab-m)
- helm: add GatewayAPI HTTPRoute support for hubble-ui (#46792, @SchulteMK)
- helm: add value to configure clustermesh apiserver service port (#47375, @crealte)
- network driver: add Cilium Network Driver CRDs, helm values and CRD chart entries (#46238, @bersoare)
- network driver: add cluster roles and mounts for the network driver feature (#46995, @bersoare)
- Removed the deprecated
cidrfield fromCiliumNode.Status.Azureinterfaces and the deprecatedsubnetfield from their addresses; useinterfaces[].subnet.{id,cidr}instead. (#47461, @jaredledvina) - Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (#47529, @julianwiedmann)
Bugfixes:
- azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (#47449, @jaredledvina)
- bpf: hostfw: tolerate unknown CT protocols and rely on policies (#47343, @smagnani96)
- datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device (#46861, @fdomain)
- endpoint/watchdog: Avoid warning about endpoints being deleted (#47625, @christarazi)
- envoy: restore http-idle-timeout as the route idle timeout source (#47583, @aanm)
- Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (#47295, @aanm)
- Fix abnormal ip allocation caused by hostnetwork pod (#47552, @haozhangami)
- Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (#47593, @julianwiedmann)
- Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with
NotAllowedByListenerswhen the TCP listener had an explicitAllowedRoutes.Kindsrestriction. (#46842, @pidreher) - gateway-api: preserve duplicate HTTPRoute rule precedence (#46696, @thorn3r)
- gateway-api: prevent conflicted listeners from reaching ingestion (#47457, @asauber)
- gateway-api: sync ListenerSet TLS secrets on ListenerSet events (#47627, @mhofstetter)
- hubble: fix four config knobs that never reach their sink (#47637, @aanm)
- hubble: Fixed false-positive increments of the
hubble_ring_bufferlost events metric. (#46585, @chez-shanpu) - ipam: wait for pool readiness on fresh multi-pool allocation (#47497, @fr4nsyz)
- l2announcer: re-evaluate services on frontend changes (#47579, @mhofstetter)
- operator/endpointslice: Fix races on slim controller (#47228, @mauriciovasquezbernal)
- wireguard: Unsubscribe node handler on shutdown (#47614, @HadrienPatte)
CI Changes:
- .github: add python3-scapy for BPF unit tests (#47535, @msune)
- .github: quarantine outside-to-nodeport L7 test on non-PD EKS legs (#47390, @aanm)
- .github: recalibrate CL2 scale thresholds for policy delay and agent memory (#47170, @aanm)
- .github: run all quarantined EKS tests in a single tolerated step (#47534, @aanm)
- .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (#47470, @atykhyy)
- .github: test the default ENI behaviour on the EKS pull request leg (#47569, @aanm)
- bpf/complexity-tests: Cover L7 LB (#47060, @pchaigno)
- bpf/tests: remove stale make run references (#47556, @msune)
- bpf: tests: egressgw: be explicit about CT tuple type (#47183, @julianwiedmann)
- ci: Bump Renovate to 43.288.0 to restore commit sign-off (#47689, @HadrienPatte)
- ci: fix filtering out md files in bpf checks (#47605, @nebril)
- ci: helm override failsafe in ginkgo workflow (#47348, @Artyop)
- ci: Separate Go major upgrades into their own Renovate PR (#47382, @HadrienPatte)
- ci: Skip redundant setup when base images already exist (#47209, @HadrienPatte)
- Improve coverage of TrafficPolicy configuration permutations in the loadbalancer control plane. (#47362, @ajmmm)
- loader/test: Add endpoint-routes to overlay/wg (#47525, @brb)
- loader/test: Add endpoint-routes to test permutations (#47077, @brb)
- test: allowlist the leader election read timeout in ginkgo log check (#47612, @aanm)
Misc Changes:
- .github: allow fork PR checkout in v1.20 build-images workflows (#47243, @aanm)
- .github: don't drop ciliumbot's approval when pruning reviewers (#47138, @aanm)
- Add cilium-io reviewers and committers to CODEOWNERS (#47236, @xmulligan)
- Add helm option to configure envoy static runtime config (#46820, @fristonio)
- Add PayPal as a user of Cilium in USERS.md (#47380, @dpaks)
- Add scope and disclosure information to SECURITY.md (#47180, @ferozsalam)
- Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (#46116, @amaanx86)
- allocator: fix flake in TestWatchRemoteKVStore (#47455, @giorio94)
- bgp: register route-policy statedb only when BGP control plane enabled (#47447, @martonra)
- bgp: remove bgp-operator-crd-storage-version-migrator job (#47248, @martonra)
- bgp: Use GoBGP configuration directly in script test (#47152, @YutaroHayakawa)
- bpf,datapath: move MONITOR_AGGREGATION to runtime config (#47366, @viktor-kurchenko)
- bpf,datapath: move RSS source prefixes to runtime config (#47363, @viktor-kurchenko)
- bpf,datapath: move STRICT_IPV4_NET[_SIZE] macros to runtime config (#47358, @viktor-kurchenko)
- bpf: conntrack: don't report SYN-ACK as 'observed SYN' (#47448, @julianwiedmann)
- bpf: conntrack: Reduce stack usage of
ct_create{4,6}(#47582, @dylandreimerink) - bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (#47388, @julianwiedmann)
- bpf: dsr: use eth_store_proto() in dsr_reply_icmp*() (#47392, @julianwiedmann)
- chore(datapath): remove unused CILIUM_LB_SOURCE_RANGE_MAP_MAX_ENTRIES (#47093, @lconnery)
- chore(deps): update all github action dependencies (main) (#46944, @cilium-renovate[bot])
- chore(deps): update all github action dependencies (main) (#47309, @cilium-renovate[bot])
- chore(deps): update all github action dependencies (main) (#47481, @cilium-renovate[bot])
- chore(deps): update all github action dependencies (main) (patch) (#47476, @cilium-renovate[bot])
- chore(deps): update all lvh-images main (main) (patch) (#47312, @cilium-renovate[bot])
- chore(deps): update all lvh-images main (main) (patch) (#47477, @cilium-renovate[bot])
- chore(deps): update all-dependencies (main) (#47310, @cilium-renovate[bot])
- chore(deps): update all-dependencies (main) (#47475, @cilium-renovate[bot])
- chore(deps): update all-dependencies (main) (#47499, @cilium-renovate[bot])
- chore(deps): update cilium/cilium-cli action to v0.19.6 (main) (#47337, @cilium-renovate[bot])
- chore(deps): update cilium/cilium-cli action to v0.19.7 (main) (#47575, @cilium-renovate[bot])
- chore(deps): update dependency bufbuild/buf to v1.72.0 (main) (#47479, @cilium-renovate[bot])
- chore(deps): update dependency renovatebot/renovate to v43.272.9 (main) (#47501, @cilium-renovate[bot])
- chore(deps): update dependency renovatebot/renovate to v43.273.0 (main) (#47502, @cilium-renovate[bot])
- chore(deps): update dependency renovatebot/renovate to v43.274.0 (main) (#47507, @cilium-renovate[bot])
- chore(deps): update dependency renovatebot/renovate to v43.275.0 (main) (#47508, @cilium-renovate[bot])
- chore(deps): update docker.io/library/golang:1.26.5 docker digest to 3aff665 (main) (#47311, @cilium-renovate[bot])
- chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.7.1 (main) (#47478, @cilium-renovate[bot])
- chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43.281.1 (main) (#47515, @cilium-renovate[bot])
- chore(deps): update github/codeql-action action to v4.37.2 (main) (#47506, @cilium-renovate[bot])
- chore(deps): update google/cloud-sdk docker tag to v576 (main) (#47336, @cilium-renovate[bot])
- chore(deps): update google/cloud-sdk docker tag to v577 (main) (#47509, @cilium-renovate[bot])
- chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1784087459-5c6d365aae12510675d55f3576539472045d6b03 (main) (#47313, @cilium-renovate[bot])
- chore(deps): update quay.io/goswagger/swagger docker tag to v0.35.0 (main) (#47030, @cilium-renovate[bot])
- chore(deps): update quay.io/goswagger/swagger docker tag to v0.35.3 (main) (#47472, @cilium-renovate[bot])
- clustermesh: MCS-API endpoint slice mirror simplification (#47123, @MrFreezeex)
- clustermesh: move service, service export, endpointslice sync to clustermesh-apiserver pkg (#46738, @MrFreezeex)
- clustermesh: remove legacy labels/annotations fields (#47217, @MrFreezeex)
- CODEOWNERS: Update codeowners for security rename (#47432, @joestringer)
- contrib: fix lock-check pattern matching (#47458, @ILL1A)
- Convert the etcd debug (troubleshoot) dialer from net.IP to netip.Addr. (#47428, @Wise-Wizard)
- datapath/linux/device: remove unused ops fields (#46836, @tklauser)
- docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (#47600, @41ks)
- docs: fix broken hive/cell pkg.go.dev link (#47105, @mailnike)
- docs: fix version string typo in CRD documentation (#47057, @magic-peach)
- docs: Remove "not stable" installation instructions (#47646, @joestringer)
- docs: update Gateway API conformance badge (#47581, @arybolovlev)
- docs: Update Gateway API installation guide (#47446, @arybolovlev)
- egressgw: remove deprecated IPv4 policy map (#46053, @julianwiedmann)
- envoy/xds: use netip.ParseAddr to validate the node IP (#47516, @Atishyy27)
- fix(deps): update all go dependencies main (main) (#47473, @cilium-renovate[bot])
- fix(deps): update all go dependencies main (main) (#47498, @cilium-renovate[bot])
- fix(deps): update all go dependencies main (major) (main) (major) (#47393, @cilium-renovate[bot])
- fix(deps): update module github.com/go-openapi/loads to v0.25.0 (main) (#47480, @cilium-renovate[bot])
- fix(deps): update module google.golang.org/grpc to v1.82.1 [security] (main) (#47420, @cilium-renovate[bot])
- Gateway API: the Gateway address status no longer reports a bogus "" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (#47466, @locker95)
- gateway-api: report invalid HTTPRoute header modifiers in status (#47599, @mhofstetter)
- gateway-api: unify Gateway API listener parentRef matching (#46670, @arybolovlev)
- gh: Add Delta xDS test run (#47211, @jrajahalme)
- gitattributes: Restore rST syntax highlighting for upgrade notes (#47467, @HadrienPatte)
- ipam: Migrate
PoolCIDRandUpsertPoolto netip (#47338, @HadrienPatte) - loadbalancer: clustermesh: wire clustermesh epslice to lb reflector (#46627, @MrFreezeex)
- Migrate
Node.IPv{4,6}HealthIPandRoutingInfo.Configureto netip (#47001, @HadrienPatte) - Node IPAM now logs at info level the Nodes it excludes from load balancer selection (deletion, autoscaler taint, or exclude-from-external-load-balancers label). (#46893, @icarosapucaia)
- node: Add transitional Prefix type for kvstore-safe netip migration (#46929, @HadrienPatte)
- node: Migrate Node alloc-CIDR fields from
*cidr.CIDRto netip (#47253, @HadrienPatte) - operator/endpointslice: context-related fixes (#47189, @mauriciovasquezbernal)
- operator: Replace
reflect.DeepEqualwithassert.Equalin tests (#47424, @HadrienPatte) - pkg/bpf: introduce [bpf.IterableMap] interface to simplify mock testing (#47084, @giorio94)
- plugins, examples: Remove extra whitespace from example files (#47398, @jrife)
- policy: Reject bare IP addresses in CIDR policy fields (#47150, @HadrienPatte)
- Prepare for v1.21 development cycle (#46962, @joestringer)
- README: Update releases (#47161, @joestringer)
- README: Update releases (#47263, @joestringer)
- README: Update releases (#47407, @joestringer)
- README: Update releases (#47585, @aanm)
- Remove Algolia reference from the docs (#46876, @xmulligan)
- Remove stale TODO comment in daemon/cmd/daemon_main.go (#47399, @vanessachammas)
- Revert "bpf: conntrack: don't report SYN-ACK as 'observed SYN'" (#47594, @julianwiedmann)
- secretsync: modernize annotation copy and fix codeowners (#47207, @nezdolik)
- Update all github action dependencies (main) (#47653, @cilium-renovate[bot])
- Update all github action dependencies (main) (#47674, @cilium-renovate[bot])
- Update all-dependencies (main) (#47654, @cilium-renovate[bot])
- Update all-dependencies (main) (#47669, @cilium-renovate[bot])
- Update quay.io/goswagger/swagger Docker tag to v0.36.1 (main) (#47652, @cilium-renovate[bot])
Known issues
The installation docs for this version contain the following installation command, which does not work:
$ cilium install 1.21.0-pre.0
To install correctly, please use the following command.
$ cilium install --version 1.21.0-pre.0
Docker Manifests
cilium
quay.io/cilium/cilium:v1.21.0-pre.0@sha256:86081047ee204fd4a720fdd8a6620efa0e13929f6c5376fb7ac73aea08de0f48
clustermesh-apiserver
quay.io/cilium/clustermesh-apiserver:v1.21.0-pre.0@sha256:b860bf0b0fd04a651f7d51ec0bf2c9d6068f3d466acfe43aa960017f60b054a6
hubble-relay
quay.io/cilium/hubble-relay:v1.21.0-pre.0@sha256:a2512b80359d21eedf16286ff9bbee811f7f42ab9219174f16a43b09faa10058
operator-alibabacloud
quay.io/cilium/operator-alibabacloud:v1.21.0-pre.0@sha256:e9f2a024f08213838f565decb2f28c64f50ce4efee68cced1a489568be84ecb1
operator-aws
quay.io/cilium/operator-aws:v1.21.0-pre.0@sha256:6c1902db9b43c6200b963ba103271a87bed91b852eb268ad784d1b89d43b5a72
operator-azure
quay.io/cilium/operator-azure:v1.21.0-pre.0@sha256:75212a2fa8170cad45aded7bdc54890643f95ad22a15354cc7af5a21cc5523d7
operator-generic
quay.io/cilium/operator-generic:v1.21.0-pre.0@sha256:b99e5621eec1c9f8b8306a494762b5efe906be1b84eba6704d70386d0142e24f
operator
quay.io/cilium/operator:v1.21.0-pre.0@sha256:791b25ac5fe32c850b8078c6c185027016bda7748e3658aab144d16ac6bb87e4