cilium/cilium v1.20.0-rc.0

1.20.0-rc.0

on GitHub

Summary of Changes

Minor Changes:

• Adds a new policy entity, cluster-mesh, which selects all endpoints in all meshed clusters. Also, makes the cluster and cluster-mesh create significantly fewer policy map entries. (#46813, @squeed)
• docs: add ListenerSet documentation (#46850, @asauber)
• The default CNI configuration version has been bumped from 0.3.1 to 1.0.0. Use the cni.customConf Helm value to set it back to 0.3.1 if needed. (#46971, @gandro)

Bugfixes:

• endpoint: Fix race when reading endpoint properties (#46991, @gandro)
• Fix cilium_operator_unmanaged_pods gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (#46668, @Suyash1700)
• Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (#46927, @aanm)
• Fix ctmap gc duration metric recording (#46873, @fristonio)
• Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (#46821, @fristonio)
• Fix regression preventing Cilium from starting when configured in kvstore mode with KPR disabled, if etcd is behind a Kubernetes service (#46444, @giorio94)
• fix: handle IPv6 subtraction borrow to avoid pool fragmentation (#47011, @weizhoublue)
• Fixes an issue where invalid regex on an HTTPRoute or GRPCRoute matcher is accepted but causes Envoy to NACK (#47005, @0xch4z)
• ipam/multi-pool: Do now wait for zero prealloc request (#46867, @pippolo84)

CI Changes:

• .github: Generate CI binaries with correct module version (#46742, @joestringer)
• .github: Revert pull_request_target to actions/checkout v6 (#46940, @joestringer)
• .github: Revert workflow_call to actions/checkout v6 (#46943, @joestringer)
• ariane: Fix v1.20 image build dependency (#47153, @joestringer)
• bpf/Makefile: Simplify and fix MAX_*_OPTIONS (#46852, @pchaigno)
• ci: Add ORGANIZATION_STAGING for stable tags (#46954, @nebril)
• ci: conditional on registry authentication (#47037, @Artyop)
• ci: keep AKS nodes-without-cilium ready to stop auto-repair reboots (#46942, @aanm)
• ci: reverse logic for docker auth requirement (#47081, @Artyop)
• ci: Run KCNP tests via conformance-kind-proxy-embedded (#45074, @jrajahalme)
• CI: some refactors for waiting images & conformance runtime (#46957, @Artyop)
• cilium/json-mock is updated to v1.4.1 to resolve ci test flakes. (#47058, @jrajahalme)
• Collect /proc/net/softnet_stat, /proc/net/snmp and /proc/net/netstat in sysdumps to help diagnose host-level packet drops. (#46985, @aanm)
• egressgw: add script testing for sysctl (#46988, @julianwiedmann)
• envoy: cleanup use_nphds in ads code (#46831, @nezdolik)
• gha/gateway-api: make the conformance job reliable (real skip + CRD-fetch retry) (#46978, @aanm)
• gha/net-perf-gke: fall back to other zones on GCE stockout (#46969, @aanm)
• gha/scale: fix scale-5/scale-100 GCE (kops zone + workload node join) (#46865, @aanm)
• gw-api-ci: Remove crd channel in matrix (#46679, @xtineskim)
• gw-api-conformance: unskip mesh tests (#47048, @xtineskim)
• Increase the timeout for the kvstore readiness wait in kind-based CI to avoid flakes on slow etcd image pulls. (#46882, @aanm)
• renovate: restore updates of docker images (#47022, @giorio94)
• test/cyclonus: capture logs of every job pod so a runner crash is diagnosable (#46980, @aanm)
• Use fake external targets on nodes without Cilium in EKS CI workflows for better stability. (#45246, @gentoo-root)

Misc Changes:

• (minor) docs: update reference to aws-cli image (#46923, @squeed)
• bpf/nat: Document needs_ct flag in code (#47017, @pchaigno)
• bpf: Condition ICMP SNAT on BPF masquerading and inter-cluster SNAT (#47021, @pchaigno)
• bpf: include drop_reasons.h directly where DROP_* constants are used (#46960, @tklauser)
• bpf: local_delivery: adopt new calling convention (#46205, @julianwiedmann)
• bpf: make validate_ethertype to accept const ptr (#46958, @aspsk)
• chore(deps): update all github action dependencies (main) (#46905, @cilium-renovate[bot])
• chore(deps): update all lvh-images main (main) (patch) (#46918, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (#46902, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (#47033, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (#47073, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (#47107, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (#47119, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (#47120, @cilium-renovate[bot])
• chore(deps): update all-dependencies (main) (#47121, @cilium-renovate[bot])
• chore(deps): update base-images to v1.26.5 (main) (#46981, @cilium-renovate[bot])
• chore(deps): update dependency renovatebot/renovate to v43.253.0 (main) (#47114, @cilium-renovate[bot])
• chore(deps): update dependency renovatebot/renovate to v43.253.1 (main) (#47118, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang docker tag to v1.26.4 (main) (#46903, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.5 docker digest to 079e598 (main) (#47108, @cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.7.0 (main) (#47029, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1782911245-7cffc778c923f68a77954a53b1a98d6b5353f004 (main) (#47028, @cilium-renovate[bot])
• ci: adjust condition for "Create imagePullSecret" (#46968, @mhofstetter)
• ci: always set fail-fast to false on image builds (#47064, @aanm)
• ci: kind add support for kubeadm.k8s.io/v1beta4 InitConfiguration patch (#47059, @viktor-kurchenko)
• Cilium bpf policy maps are renamed to "cilium_policy_v3_" prefix to account for the semantic change with policy identity aggregation. (#47080, @jrajahalme)
• cilium-cni: Fixed a bug where the CNI plugin would fail in ENI IPAM mode if IPv4 is disabled. (#46937, @41ks)
• docs/community: Add link to community calendar (#46999, @mauriciovasquezbernal)
• docs: add Gateway API access logs example. (#46926, @arybolovlev)
• docs: Align metrics reference with code implementation (#46887, @HadrienPatte)
• docs: clarify Hubble static/dynamic exporter file rotation settings (#47026, @maksymbilokur-cisco)
• docs: fix typos and grammar in documentation (#47056, @magic-peach)
• docs: Update ENI IPAM docs to add IPv6 beta support (#46925, @41ks)
• docs: update Gateway API version to 1.6.0 (#46961, @eminaktas)
• Egress Gateway: handle nil events (#46476, @tommyp1ckles)
• egressgw: populate egressIfIndex for IPv6-only CEGP with default selector (#46965, @julianwiedmann)
• endpoint: reap restart-preserved policy map entries once ready (#47062, @aanm)
• endpoint: sync desired policy before reload on the restore path (restore-path hardening) (#47075, @aanm)
• envoy/xdsnew: Fix completion callback queueing (#46885, @jrajahalme)
• envoy: demote warn log message to info (#46973, @nezdolik)
• envoy: fix cluster locality handling (#46976, @viktor-kurchenko)
• Fix a Cilium Operator shutdown deadlock between CiliumNode GC and node taint sync. (#47036, @ysksuzuki)
• Fix Envoy coalesced updates NACK (#46938, @jrajahalme)
• gateway-api: fix operator startup failures caused by registering optional Gateway API resources when their CRDs are not installed. (#46955, @arybolovlev)
• gateway-api: remove SetAllParentCondition route helpers (#47086, @0xch4z)
• gateway-api: update TCPRoute and UDPRoute to v1 (#46970, @eminaktas)
• gha/renovate: use actions/create-github-app-token from renovate envir… (#46994, @aanm)
• gha: fail fast in external-target provisioning scripts instead of swallowing failures (#47085, @aanm)
• github: bump ci-l7 test timeout (#46945, @jrajahalme)
• hubble: Remove dead Kafka L7 protocol handling (#46997, @sayboras)
• images/runtime: Update iptables-wrapper to upstream v3 (Go) (#46694, @HadrienPatte)
• ipam/service/allocator: fix IPv6 offset aliasing (#46952, @tklauser)
• policy/k8s: record processing start time for k8s NetworkPolicy updates (#46979, @aanm)
• policy: Consolidate policyCache into the policy compute cell (#46460, @christarazi)
• Prepare for release v1.20.0-pre.4 (#46889, @cilium-release-bot[bot])
• Prepare v1.20 stable branch (#47007, @joestringer)
• Revert "cilium-dbg: Add preflight validator for cilium-configmap" (#47052, @joestringer)
• update README.rst with v1.20.0-pre.4 (#46895, @aanm)
• vendor: bump github.com/cilium/statedb to v0.8.3 (#47082, @giorio94)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.0-rc.0@sha256:ab193b2335b06bf608b2ac987cca608b717d00f7d8f76ef50492c4e8ef059b5a

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.0-rc.0@sha256:87583396de788357b50dcc241194c312044692cf9cc86d89affa2503c4464b68

hubble-relay

quay.io/cilium/hubble-relay:v1.20.0-rc.0@sha256:586cb0a600616e99a917c59ef15f107fd051343f25302dab5d4c4aecf9da1f2b

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.0-rc.0@sha256:70d175146578da9f4cff3ac4419215bcea8c848188699c7b78c1febd8e3f2a80

operator-aws

quay.io/cilium/operator-aws:v1.20.0-rc.0@sha256:80cadb9f896c6dc0fa4f4078fdaebf8d8d53017411864c7cb2ff40a5b171c269

operator-azure

quay.io/cilium/operator-azure:v1.20.0-rc.0@sha256:f76e7ce8a396e9503fa34513e108c500b95052ff9f6d7c976a45c3c84b678a1b

operator-generic

quay.io/cilium/operator-generic:v1.20.0-rc.0@sha256:d6d4db70657d7fae197174f7c3d796eb23a54a6312658d85dfd42456ccc365bb

operator

quay.io/cilium/operator:v1.20.0-rc.0@sha256:b8fecbdc5123d765c26b50ca4738b8f6c47fd47f4d8d7214501d3e4dfefa3e21