Summary of Changes
Major Changes:
- Add support for VRRP and IGMP protocols in host firewall (Backport PR #47619, Upstream PR #39872, @aditighag)
Bugfixes:
- bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR #47619, Upstream PR #47343, @smagnani96)
- Fix abnormal ip allocation caused by hostnetwork pod (Backport PR #47687, Upstream PR #47552, @haozhangami)
- Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR #47799, Upstream PR #46967, @ysksuzuki)
- ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR #47887, Upstream PR #47208, @iwanhae)
CI Changes:
- .github: retry CLI and binary downloads over transient network errors (Backport PR #47289, Upstream PR #47167, @aanm)
- bpf: test: improve network policy testing (Backport PR #47619, Upstream PR #41906, @julianwiedmann)
- bpf: tests: IGMP improvements (Backport PR #47619, Upstream PR #43684, @julianwiedmann)
- chore: use GH_RUNNER_CILIUM_BASE_AMD64/ARM64 vars for integration-test runners (Backport PR #47547, Upstream PR #47182, @bogdankrasko)
- ci: build race images on push in the stable image builders (Backport PR #47618, Upstream PR #47616, @aanm)
- ci: draft renovate PRs until ciliumbot auto-approval (Backport PR #47803, Upstream PR #47364, @mhofstetter)
- ci: fix three renovate-PR CI flakes (kubectl download retry, merge-upload ref, EKS pool zones) (Backport PR #47540, Upstream PR #47357, @aanm)
- CI: fixed external-target readiness gating and ensured sig-network E2E JUnit reports are uploaded on failure. (Backport PR #47289, Upstream PR #46860, @aanm)
- ci: migrate set-commit-status to cilium/actions (Backport PR #47803, Upstream PR #47771, @bogdankrasko)
- ci: skip etcd log fetch when kvstore was never started (Backport PR #47887, Upstream PR #47801, @aanm)
- Collect /proc/net/softnet_stat, /proc/net/snmp and /proc/net/netstat in sysdumps to help diagnose host-level packet drops. (Backport PR #47289, Upstream PR #46985, @aanm)
- conformance-aws-cni: skip l7 and fqdn tests by name on chaining mode (Backport PR #47289, Upstream PR #47269, @aanm)
- Decrease CI costs on AWS (Backport PR #47289, Upstream PR #46615, @aanm)
- gha/e2e: cover etcd behind a service (Backport PR #47411, Upstream PR #47235, @giorio94)
- gha/kubespray: run on schedule, rather than on every push (Backport PR #47735, Upstream PR #47719, @giorio94)
- gha/lvh-kind: respect Kind image version also when config is provided (Backport PR #47735, Upstream PR #47703, @giorio94)
- gha: don't install LLVM and Clang in integration tests workflow (Backport PR #47735, Upstream PR #47717, @giorio94)
- gha: stop scheduled runs emitting spurious artifact warnings (Backport PR #47289, Upstream PR #46989, @aanm)
- images/scripts: Validate Envoy image vars against sed injection (Backport PR #47803, Upstream PR #47205, @MasloMaslane)
- Increase the timeout for the kvstore readiness wait in kind-based CI to avoid flakes on slow etcd image pulls. (Backport PR #47289, Upstream PR #46882, @aanm)
- pkg/rate: fix TestMaxParallelRequests flake under CI load (Backport PR #47289, Upstream PR #46856, @aanm)
- Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR #47887, Upstream PR #47780, @giorio94)
- test/cyclonus: capture logs of every job pod so a runner crash is diagnosable (Backport PR #47289, Upstream PR #46980, @aanm)
- test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR #47803, Upstream PR #47725, @aanm)
Misc Changes:
- allocator: fix flake in TestWatchRemoteKVStore (Backport PR #47687, Upstream PR #47455, @giorio94)
- bpf: Condition ICMP SNAT on BPF masquerading and inter-cluster SNAT (Backport PR #47557, Upstream PR #47021, @pchaigno)
- bugtool: collect snmp6 and dev_snmp6 for IPv6 host packet drops (Backport PR #47411, Upstream PR #47353, @aanm)
- chore(deps): update all github action dependencies (v1.18) (#47329, @cilium-renovate[bot])
- chore(deps): update all github action dependencies (v1.18) (#47494, @cilium-renovate[bot])
- chore(deps): update all github action dependencies (v1.18) (#47522, @cilium-renovate[bot])
- chore(deps): update all github action dependencies (v1.18) (#47871, @cilium-renovate[bot])
- chore(deps): update base-images (v1.18) (#47493, @cilium-renovate[bot])
- chore(deps): update dependency cilium/cilium-cli to v0.19.6 (v1.18) (#47341, @cilium-renovate[bot])
- chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.18) (#47578, @cilium-renovate[bot])
- chore(deps): update dependency go to v1.25.13 (v1.18) (#48004, @cilium-renovate[bot])
- chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.18) (#47994, @cilium-renovate[bot])
- chore(deps): update docker.io/library/golang docker tag to v1.25.13 (v1.18) (#47951, @cilium-renovate[bot])
- chore(deps): update docker.io/library/golang:1.25.12 docker digest to 2c7ebca (v1.18) (#47869, @cilium-renovate[bot])
- chore(deps): update docker.io/library/golang:1.25.12 docker digest to d2e20dc (v1.18) (#47325, @cilium-renovate[bot])
- chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 561618e (v1.18) (#47870, @cilium-renovate[bot])
- chore(deps): update gcr.io/distroless/static:nonroot docker digest to f7f8f72 (v1.18) (#47326, @cilium-renovate[bot])
- chore(deps): update google/cloud-sdk docker tag to v577 (v1.18) (#47512, @cilium-renovate[bot])
- chore(deps): update quay.io/cilium/certgen docker tag to v0.4.8 (v1.18) (#47327, @cilium-renovate[bot])
- chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1784803288-cf56df1cccc09d7afde2847ff9e6e853dde50b77 (v1.18) (#47491, @cilium-renovate[bot])
- chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1786864149-07e8503ff34b9190d7bbe4e57d4e185c4ef8b1de (v1.18) (#48001, @cilium-renovate[bot])
- chore(deps): update stable lvh-images (v1.18) (patch) (#47328, @cilium-renovate[bot])
- chore(deps): update stable lvh-images (v1.18) (patch) (#47492, @cilium-renovate[bot])
- chore(deps): update stable lvh-images (v1.18) (patch) (#47872, @cilium-renovate[bot])
- chore(deps): update stable lvh-images (v1.18) (patch) (#47995, @cilium-renovate[bot])
- docs/clustermesh: remove obsolete reference to service cache (Backport PR #47411, Upstream PR #47195, @giorio94)
- docs: Fix DOCS_BUILDER_REPO env variable for BSD sed compatibility (Backport PR #47830, Upstream PR #46033, @arybolovlev)
- docs: Update docs-builder for Makefile usage (Backport PR #47830, Upstream PR #45774, @joestringer)
- fix(deps): update module google.golang.org/grpc to v1.82.1 [security] (v1.18) (#47434, @cilium-renovate[bot])
- Fixed the conformance-ginkgo feature status report not being uploaded as an artifact. (Backport PR #47540, Upstream PR #47174, @aanm)
- gha: capture per-pod diagnostics for sig-network conntrack UDP NodePort failures (Backport PR #47289, Upstream PR #47140, @aanm)
- gha: let auto-approve match on re-runs (Backport PR #47289, Upstream PR #46832, @aanm)
- policy/k8s: record processing start time for k8s NetworkPolicy updates (Backport PR #47289, Upstream PR #46979, @aanm)
- Update all github action dependencies (v1.18) (#47670, @cilium-renovate[bot])
- Update docker.io/library/busybox:1.37.0 Docker digest to 9db7b59 (v1.18) (#47664, @cilium-renovate[bot])
- Update documentation dependencies (Backport PR #47830, Upstream PR #47750, @joestringer)
- Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.18) (#47665, @cilium-renovate[bot])
Other Changes:
- [v1.18] Add DNS request checking prior to qname extraction (#47385, @ferozsalam)
- install: Update image digests for v1.18.12 (#47251, @cilium-release-bot[bot])
Docker Manifests
cilium
quay.io/cilium/cilium:v1.18.13@sha256:6e6e6a82a6a2a6d0bfe6dd7e36cb0222fa48135ad139ddc979b5c3c841e2db1a
clustermesh-apiserver
quay.io/cilium/clustermesh-apiserver:v1.18.13@sha256:15891681a6c7e743a6180a132bd70eb66ba9d9097e66cd6630fd22b73bcceb9d
docker-plugin
quay.io/cilium/docker-plugin:v1.18.13@sha256:6420c3a70b3adaad0d18698d1653b4505fc40263507e8a6bf13727e4d1477252
hubble-relay
quay.io/cilium/hubble-relay:v1.18.13@sha256:039c374b59cf4be4ecee1b3e1ec11316180a82c1eb33a55b4ee00a0da4999ad3
operator-alibabacloud
quay.io/cilium/operator-alibabacloud:v1.18.13@sha256:b5604ded38c0b0d758d3b11013f4ed0f21a59b3a1535e6232b2b6a98904a93fa
operator-aws
quay.io/cilium/operator-aws:v1.18.13@sha256:bc24b51a0d3af69fead1693e853a0466118b236cc0a098f3c1fa6c6c4b307fc8
operator-azure
quay.io/cilium/operator-azure:v1.18.13@sha256:c0e9fddeb9080bc3e403b4ed25d216961807fecfe9f643afb514a09268966350
operator-generic
quay.io/cilium/operator-generic:v1.18.13@sha256:2041417ad2ebd8b3e7d80b63dd81810d405fa29f12926ddbe78321a74781993b
operator
quay.io/cilium/operator:v1.18.13@sha256:fc72348ee2d5818a432901795fd77dbf35c1a8887db72d73546b9ee404551725