cilium/cilium v1.20.1

1.20.1

on GitHub

Summary of Changes

Major Changes:

• docs/clustermesh: overhaul Cluster Mesh documentation with a new introduction, improved load-balancing guidance, and Helm-first setup and certificate configuration instructions (Backport PR #47615, Upstream PR #47351, @MrFreezeex)

Minor Changes:

• envoy: demote stale ADS endpoint warning (Backport PR #47805, Upstream PR #47148, @nezdolik)
• Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR #47881, Upstream PR #47529, @julianwiedmann)

Bugfixes:

• azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR #47690, Upstream PR #47449, @jaredledvina)
• bpf: dsr: don't look for TCP header on fragmented packets (Backport PR #47881, Upstream PR #47640, @julianwiedmann)
• bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR #47621, Upstream PR #47343, @smagnani96)
• clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR #47885, Upstream PR #47824, @MrFreezeex)
• datapath: turn ARP off on the base devices before bringing them up (Backport PR #47885, Upstream PR #47838, @aanm)
• endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR #47690, Upstream PR #47625, @christarazi)
• endpoint: Fix silent CIDR policy bypass and traffic drops after agent restart (Backport PR #47954, Upstream PR #47880, @weizhoublue)
• envoy.httpUpstreamLingerTimeout accepts 0 as a chart value and templates into configmap. (Backport PR #47885, Upstream PR #47741, @jdw6359)
• envoy: restore http-idle-timeout as the route idle timeout source (Backport PR #47690, Upstream PR #47583, @aanm)
• Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR #47805, Upstream PR #47765, @julianwiedmann)
• Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR #47967, Upstream PR #47802, @bimmlerd)
• Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR #47805, Upstream PR #47727, @aanm)
• Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR #47690, Upstream PR #47295, @aanm)
• Fix abnormal ip allocation caused by hostnetwork pod (Backport PR #47690, Upstream PR #47552, @haozhangami)
• Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR #47881, Upstream PR #47593, @julianwiedmann)
• fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR #47885, Upstream PR #47754, @weizhoublue)
• Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with NotAllowedByListeners when the TCP listener had an explicit AllowedRoutes.Kinds restriction. (Backport PR #47690, Upstream PR #46842, @pidreher)
• gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR #47954, Upstream PR #47840, @mhofstetter)
• gateway-api: mark unresolved backend service ports in route status (Backport PR #47885, Upstream PR #47766, @mhofstetter)
• gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR #47690, Upstream PR #46696, @thorn3r)
• gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR #47690, Upstream PR #47457, @asauber)
• gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR #47805, Upstream PR #47702, @mhofstetter)
• gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR #47690, Upstream PR #47627, @mhofstetter)
• ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR #47885, Upstream PR #47208, @iwanhae)
• l2announcer: re-evaluate services on frontend changes (Backport PR #47690, Upstream PR #47579, @mhofstetter)
• Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR #47954, Upstream PR #47826, @mehrdadbn9)
• operator: Emit startup logs in the configured log format (Backport PR #47954, Upstream PR #47890, @HadrienPatte)
• Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR #47885, Upstream PR #47844, @bimmlerd)
• standalone-dns-proxy: return an error when no endpoint is found (Backport PR #47954, Upstream PR #47791, @vipul-21)
• wireguard: Unsubscribe node handler on shutdown (Backport PR #47805, Upstream PR #47614, @HadrienPatte)

CI Changes:

• .github: add python3-scapy for BPF unit tests (Backport PR #47690, Upstream PR #47535, @msune)
• .github: run all quarantined EKS tests in a single tolerated step (Backport PR #47690, Upstream PR #47534, @aanm)
• .github: Run envoy image check against PR content (Backport PR #47805, Upstream PR #47792, @joestringer)
• .github: Simplify permissions for image linter workflow (Backport PR #47805, Upstream PR #47753, @joestringer)
• .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR #47690, Upstream PR #47470, @atykhyy)
• .github: test the default ENI behaviour on the EKS pull request leg (Backport PR #47690, Upstream PR #47569, @aanm)
• ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR #47805, Upstream PR #47743, @giorio94)
• bpf/complexity-tests: Cover L7 LB (Backport PR #47805, Upstream PR #47060, @pchaigno)
• ci: build race images on push events so conformance-race works on stable branches (Backport PR #47609, Upstream PR #47608, @aanm)
• ci: build race images on push in the stable image builders (Backport PR #47609, Upstream PR #47616, @aanm)
• ci: draft renovate PRs until ciliumbot auto-approval (Backport PR #47805, Upstream PR #47364, @mhofstetter)
• ci: fix filtering out md files in bpf checks (Backport PR #47690, Upstream PR #47605, @nebril)
• ci: migrate set-commit-status to cilium/actions (Backport PR #47805, Upstream PR #47771, @bogdankrasko)
• ci: skip etcd log fetch when kvstore was never started (Backport PR #47885, Upstream PR #47801, @aanm)
• Fix missing events_map_rate_limit complexity coverage (Backport PR #47805, Upstream PR #47691, @pchaigno)
• gha/kubespray: run on schedule, rather than on every push (Backport PR #47731, Upstream PR #47719, @giorio94)
• gha/lvh-kind: respect Kind image version also when config is provided (Backport PR #47731, Upstream PR #47703, @giorio94)
• gha: don't install LLVM and Clang in integration tests workflow (Backport PR #47731, Upstream PR #47717, @giorio94)
• gha: fix checkout of trusted branch in smoke and k8s-kind workflows (Backport PR #47731, Upstream PR #47724, @giorio94)
• images/scripts: Validate Envoy image vars against sed injection (Backport PR #47805, Upstream PR #47205, @MasloMaslane)
• Revert "gha: don't install LLVM and Clang in integration tests workflow" (Backport PR #47885, Upstream PR #47780, @giorio94)
• test(bpf): parallelize eBPF test compilation (Backport PR #47954, Upstream PR #47426, @lconnery)
• test/cyclonus: log the JUnit XML instead of copying it from a dead pod (Backport PR #47805, Upstream PR #47725, @aanm)
• test: allowlist the leader election read timeout in ginkgo log check (Backport PR #47690, Upstream PR #47612, @aanm)

Misc Changes:

• Added documentation for running Cilium in CNI chaining mode on Oracle Kubernetes Engine (OKE) with VCN-Native Pod Networking. (Backport PR #47690, Upstream PR #46116, @amaanx86)
• allocator: fix flake in TestWatchRemoteKVStore (Backport PR #47690, Upstream PR #47455, @giorio94)
• bpf/nat: Move IPv6 nat entry to map (Backport PR #47805, Upstream PR #47762, @pchaigno)
• bpf: conntrack: Reduce stack usage of ct_create{4,6} (Backport PR #47805, Upstream PR #47582, @dylandreimerink)
• bpf: dsr: only require DSR-info on SYN packet (Backport PR #47881, Upstream PR #47592, @julianwiedmann)
• bpf: dsr: re-use TCP SYN flag from CT lookup in remote-backend path (Backport PR #47881, Upstream PR #47388, @julianwiedmann)
• bpf: lb: use dedicated new_backend bool (Backport PR #47881, Upstream PR #47841, @julianwiedmann)
• chore(deps): update all github action dependencies (v1.20) (#47991, @cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.20) (#48008, @cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.20) (#47678, @cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.7 (v1.20) (#47576, @cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) (#47988, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.5 docker digest to 705e964 (v1.20) (#47949, @cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.26.5 docker digest to 7caba52 (v1.20) (#47864, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) (#47899, @cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) (#47989, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#47865, @cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.20) (patch) (#47990, @cilium-renovate[bot])
• clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR #47962, Upstream PR #47932, @giorio94)
• docs: clarify GAMMA DROP_EP_NOT_READY events (Backport PR #47885, Upstream PR #47587, @thorn3r)
• docs: Fix a bug that caused all versions to be treated as pre-release and rendering previous releases in the upgrade guide. (Backport PR #47690, Upstream PR #47600, @41ks)
• docs: Remove "not stable" installation instructions (Backport PR #47798, Upstream PR #47646, @joestringer)
• docs: update Gateway API conformance badge (Backport PR #47690, Upstream PR #47581, @arybolovlev)
• docs: Update Gateway API installation guide (Backport PR #47690, Upstream PR #47446, @arybolovlev)
• Gateway API: the Gateway address status no longer reports a bogus "" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR #47690, Upstream PR #47466, @locker95)
• gateway-api: remove unnecessary TLSRoute support checks (Backport PR #47885, Upstream PR #47758, @mhofstetter)
• gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR #47690, Upstream PR #47599, @mhofstetter)
• gateway-api: return route check errors directly (Backport PR #47805, Upstream PR #47607, @mhofstetter)
• gateway-api: unify Gateway API listener parentRef matching (Backport PR #47690, Upstream PR #46670, @arybolovlev)
• gateway-api: validate gRPCRoute header modifiers in status (Backport PR #47805, Upstream PR #47606, @mhofstetter)
• operator: Replace reflect.DeepEqual with assert.Equal in tests (Backport PR #47690, Upstream PR #47424, @HadrienPatte)
• Update all github action dependencies (v1.20) (#47656, @cilium-renovate[bot])
• Update all github action dependencies (v1.20) (#47675, @cilium-renovate[bot])
• Update docker.io/library/busybox:1.38.0 Docker digest to dc2d74b (v1.20) (#47655, @cilium-renovate[bot])
• Update documentation dependencies (Backport PR #47798, Upstream PR #47750, @joestringer)
• Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) (#47657, @cilium-renovate[bot])
• Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) (#47659, @cilium-renovate[bot])
• Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) (#47658, @cilium-renovate[bot])

Other Changes:

• install: Update image digests for v1.20.0 (#47584, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.20.1@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b
quay.io/cilium/cilium:stable@sha256:ae9ea21f7427fe24bc6ea7247eb552157a1b0a431744045d3f641545ca71d11b

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.20.1@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5
quay.io/cilium/clustermesh-apiserver:stable@sha256:d905d614a332b2058cb81c193e481d1f460902b903f4eb57cc9764640b750fb5

hubble-relay

quay.io/cilium/hubble-relay:v1.20.1@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4
quay.io/cilium/hubble-relay:stable@sha256:59be0ae7d475ab9011a5e954618c0f27b5778b17140381425b308b55ba4917f4

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.20.1@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c
quay.io/cilium/operator-alibabacloud:stable@sha256:2af5dd3d85649ea36d365363b8eca82ad06116c6259c4aace700a7c036348e4c

operator-aws

quay.io/cilium/operator-aws:v1.20.1@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7
quay.io/cilium/operator-aws:stable@sha256:7cf0cb0e6584f72ca8de951a1be03829f69fcaeba69dc6c7856fc4470545acd7

operator-azure

quay.io/cilium/operator-azure:v1.20.1@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031
quay.io/cilium/operator-azure:stable@sha256:13746a479ca60395df8d83580b49464c6c975cca6fdb21ba4791a076ab01b031

operator-generic

quay.io/cilium/operator-generic:v1.20.1@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf
quay.io/cilium/operator-generic:stable@sha256:6c3885fc7b629099fdbe2a5c87869c86feb825fa18fae299eac0f61918d16ecf

operator

quay.io/cilium/operator:v1.20.1@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d
quay.io/cilium/operator:stable@sha256:67adaf5575902dcce31dc36ba5b5acad397a8b40ec986b55696c94f80b6d861d