Update Helm release cilium to v1.17.4 #126

vshn-renovate · 2024-07-24T17:07:48Z

This PR contains the following updates:

Package	Update	Change
cilium (source)	minor	`1.16.4` -> `1.17.4`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

cilium/cilium (cilium)

`v1.17.4`: 1.17.4

Compare Source

Summary of Changes

Minor Changes:

Add TRACE_{FROM/TO}_CRYPTO observation point and bpf metrics for packets forwarded-to/received-from Wireguard. (Backport PR #39260, Upstream PR #34958, @smagnani96)
Cilium Agent liveness probe no longer fails if Kubernetes apiserver cannot be reached. Earlier the agent was restarted if the apiserver could not be reached for approximately 5 minutes. This avoids traffic disruptions on apiserver downtime (e.g. due to maintenance) for features such as L7 and FQDN proxy that require cilium-agent to always be up. (Backport PR #38703, Upstream PR #38458, @joamaki)
Update kafka apiKey helm chart value to true (Backport PR #39214, Upstream PR #38963, @kyle-c-simmons)

Bugfixes:

bpf: nodeport: avoid accidental NAT46x64 clash in from-container (Backport PR #39214, Upstream PR #38916, @julianwiedmann)
Check the TLSRoute and HasServiceImportSupport through the CRD. (Backport PR #39377, Upstream PR #39122, @liyihuang)
Fix a bug where a CiliumNetworkPolicy/CiliumClusterwideNetworkPolicy containing invalid rules would not be reported with invalid status. (Backport PR #38948, Upstream PR #38801, @tklauser)
Fix a bug where services would fail to match wildcard protocols after switching to Local traffic policy with protocol differentiation enabled. (Backport PR #39404, Upstream PR #39360, @pasteley)
Fix a deadlock when a host has no IPv4 address. (Backport PR #39075, Upstream PR #38938, @EmilyShepherd)
Fix a panic happening in the ipset reconciler when a previous reconciliation failed. (Backport PR #39075, Upstream PR #38890, @pippolo84)
Fix bug that would cause the cilium-dbg encrypt status command to not list any decryption interfaces when KPR is enabled. (Backport PR #39214, Upstream PR #39170, @pchaigno)
Fixes a bug where layer-7 rules would override enableDefaultDeny: false, incorrectly dropping traffic. (Backport PR #39375, Upstream PR #38841, @nimishamehta5)
gateway-api: Fix Gateway reconciler failure when TLSRoute CRD is not installed (Backport PR #39377, Upstream PR #38874, @syedazeez337)
gateway-api: Fix parentRefMatched to check Group and Kind (Backport PR #39377, Upstream PR #39275, @syedazeez337)
helm: fix hubble dynamic metrics config conflict (Backport PR #39075, Upstream PR #38893, @devodev)
ipsec: Fix key derivation error in case of corrupted boot IDs (Backport PR #39214, Upstream PR #39059, @pchaigno)
k8s: Fixed a case when delete event for service endpointslices might have been missed if connectivity to k8s apiserver was broken causing stale service cache for service. (Backport PR #38948, Upstream PR #38779, @marseel)
wireguard:overlay: cleanup calls map when unused (Backport PR #38899, Upstream PR #38655, @smagnani96)
xds: Fix a case in which after cilium-agent we were not sending updated resources to Envoy (Backport PR #38977, Upstream PR #38654, @marseel)

CI Changes:

.github/workflows: Enable DualStack for conformance-kind-proxy-embedded (Backport PR #39377, Upstream PR #36398, @dylandreimerink)
[v1.17] l4lb: Support environments with existing veth (#39408, @joestringer)
Align main and stable branch workflows for availability of cilium-cli (Backport PR #38141, Upstream PR #38138, @joestringer)
bpf: tests: fix ethertype when building inner headers of VXLAN packet (Backport PR #39075, Upstream PR #39060, @julianwiedmann)
ci-aks: Enable dual-stack in Conformance AKS (Backport PR #39377, Upstream PR #37704, @gandro)
gateway-api: Add translation tests for GAMMA (Backport PR #39221, Upstream PR #39207, @sayboras)
gh: e2e-upgrade: check for unexpected drops from connectivity tests (Backport PR #39214, Upstream PR #39111, @julianwiedmann)
gh: e2e-upgrade: generate config matrix from file (Backport PR #39058, Upstream PR #38512, @julianwiedmann)
gh: e2e-upgrade: minor log output improvements (Backport PR #39058, Upstream PR #38011, @julianwiedmann)
gh: use e2e-upgrade for IPsec minor upgrade testing (Backport PR #39058, Upstream PR #38757, @julianwiedmann)
gha: always respect the given image tag in the wait-for-images action (Backport PR #38141, Upstream PR #37901, @giorio94)
rate: Disable TestStressRateLimiter (Backport PR #38896, Upstream PR #38877, @YutaroHayakawa)

Misc Changes:

[v1.17] deps: bump CNI plugins version (#39329, @ferozsalam)
[v1.17] deps: bump golang-jwt to 4.5.2 (#39491, @ferozsalam)
Add the doc for multi-pool ipam about how to update the existing ip pool (Backport PR #38948, Upstream PR #38539, @liyihuang)
bpf: host: use MARK_MAGIC_EGW_DONE-embedded identity in to-netdev (Backport PR #38948, Upstream PR #38768, @julianwiedmann)
bpf: nat: ICMP v4 improvements (Backport PR #39332, Upstream PR #36767, @julianwiedmann)
bpf:hubble: update trace/drop notify for L2-less packets (Backport PR #39263, Upstream PR #37097, @smagnani96)
chore(deps): update all github action dependencies (v1.17) (#39183, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.17) (#39316, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.23.8 docker digest to 87bb940 (v1.17) (#38908, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.23.8 docker digest to e54daaa (v1.17) (#39046, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.2 docker digest to 30baaea (v1.17) (#39314, @cilium-renovate[bot])
chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 6015f66 (v1.17) (#39379, @cilium-renovate[bot])
chore(deps): update go to v1.24.2 (v1.17) (#39113, @cilium-renovate[bot])
chore(deps): update go to v1.24.3 (v1.17) (#39380, @cilium-renovate[bot])
chore(deps): update google/cloud-sdk docker tag to v518 (v1.17) (#39048, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.5-1744328671-a8b58b35c03a3d100a2b026fc111417207183301 (v1.17) (#38909, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.5-1744798797-f7456c0c30336bbd437eff7743374370e415fc44 (v1.17) (#39047, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.5-1745916268-e485bbc0c95e30aa233cb06a753789375b12ad18 (v1.17) (#39226, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.5-1745971871-f98500f20b253684d483b783b29df2e4db05ea7c (v1.17) (#39248, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.5-1746405645-719d708b1802ce417568d3eaae4c0677dd60e128 (v1.17) (#39324, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.6-1746661844-0f602c28cb2aa57b29078195049fb257d5b5246c (v1.17) (#39413, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#38911, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#38970, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#39182, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#39315, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#39475, @cilium-renovate[bot])
chore: remove retention-days param in build-images-releases.yaml (Backport PR #39435, Upstream PR #39431, @sekhar-isovalent)
cilium: Fix device controller's dependency on netfilter (Backport PR #38948, Upstream PR #38777, @borkmann)
cilium: Fix ipip device mtu (Backport PR #38948, Upstream PR #38682, @borkmann)
contrib/scripts: Fix IndexError in stacktrace script (Backport PR #39214, Upstream PR #39101, @christarazi)
contrib: Remove kind.sh dependency on git (Backport PR #39377, Upstream PR #39154, @joestringer)
docs: Add good kernel versions for the L7 policy IPv6 bug (Backport PR #39377, Upstream PR #39212, @gentoo-root)
docs: add warning about l7 policy and EnableDefaultDeny (Backport PR #39075, Upstream PR #38675, @squeed)
docs: Document L7 policy IPv6 bug (Backport PR #38948, Upstream PR #38591, @gentoo-root)
docs: Document that traffic to the VPC in ENI mode is not masqueraded (#39156, @liyihuang)
docs: Fix casing and formatting in L3 examples section (Backport PR #39377, Upstream PR #39065, @mikejoh)
docs: Fix variable naming in EKS-to-EKS Clustermesh guide (Backport PR #39075, Upstream PR #38821, @zzuckerfrei)
docs: The Installation on OpenShift OKD document has been updated to link to maintained operators for Cilium (Isovalent Enterprise for Cilium). This operator is validated on all current versions of OpenShift. (Backport PR #39377, Upstream PR #38886, @auriaave)
docs: Update hubble-metrics flag documentation (Backport PR #39075, Upstream PR #38960, @HadrienPatte)
Documentation : Modification of eks-clustermesh-prep.rst (Backport PR #39214, Upstream PR #39025, @rwinieski)
documentation: fix get deployment cmd (Backport PR #39214, Upstream PR #39155, @g0gn)
dynamiclifecycle: fix goroutine leak (Backport PR #39214, Upstream PR #39149, @squeed)
exclude the dummy device type when evaluating MTU, ensuring that local traffic does not interfere with MTU calculations. (Backport PR #39214, Upstream PR #38992, @liyihuang)
Fix LRU maps to streamline distributed LRU flag implementation with map prealloc handling (Backport PR #39214, Upstream PR #39087, @borkmann)
Fix map recreation loop when distributed lru setting is enabled (Backport PR #39075, Upstream PR #38978, @borkmann)
hubble:monitor: align TraceNotify to DropNotify (Backport PR #39264, Upstream PR #38830, @smagnani96)
ipsec: include ipv6 in v1.18 upgrade leak detection (#38843, @ldelossa)
k8s/resource: Don't Add to WaitGroup asynchronously (Backport PR #38948, Upstream PR #38692, @joamaki)
make: fix golangci-lint version detection (Backport PR #39075, Upstream PR #38996, @mhofstetter)
Throw build bug when using TRACE_{FROM,TO}_CRYPTO from unexpected files and cleanup unevaluated build_bug_on. (Backport PR #39260, Upstream PR #38470, @smagnani96)
workflows: fix lint-workflows (Backport PR #39403, Upstream PR #39398, @aanm)

Other Changes:

[v1.17] k8s/statedb: Fix buffering order of objects (#38585, @joamaki)
[v1.17] Stop TLS Interception config being included in preflight (#39481, @youngnick)
bpf,encrypt: fixes the placement of a particular vxlan helper function (#39088, @ldelossa)
install: Update image digests for v1.17.3 (#38933, @cilium-release-bot[bot])
v1.17: Update Go version to 1.24 in go.mod (#39128, @pchaigno)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a
quay.io/cilium/cilium:stable@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.4@sha256:0b72f3046cf36ff9b113d53cc61185e893edb5fe728a2c9e561c1083f806453d
quay.io/cilium/clustermesh-apiserver:stable@sha256:0b72f3046cf36ff9b113d53cc61185e893edb5fe728a2c9e561c1083f806453d

docker-plugin

quay.io/cilium/docker-plugin:v1.17.4@sha256:d2e1caaf9e6c7194ec20d8044cfd6b0d513cdfd1552e70f41070f3c25206eefa
quay.io/cilium/docker-plugin:stable@sha256:d2e1caaf9e6c7194ec20d8044cfd6b0d513cdfd1552e70f41070f3c25206eefa

hubble-relay

quay.io/cilium/hubble-relay:v1.17.4@sha256:c16de12a64b8b56de62b15c1652d036253b40cd7fa643d7e1a404dc71dc66441
quay.io/cilium/hubble-relay:stable@sha256:c16de12a64b8b56de62b15c1652d036253b40cd7fa643d7e1a404dc71dc66441

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.4@sha256:eaa7b18b7cda65af1d454d54224d175fdb69a35199fa949ae7dfda2789c18dd6
quay.io/cilium/operator-alibabacloud:stable@sha256:eaa7b18b7cda65af1d454d54224d175fdb69a35199fa949ae7dfda2789c18dd6

operator-aws

quay.io/cilium/operator-aws:v1.17.4@sha256:3c31583e57648470fbf6646ac67122ac5896ce5f979ab824d9a38cfc7eafc753
quay.io/cilium/operator-aws:stable@sha256:3c31583e57648470fbf6646ac67122ac5896ce5f979ab824d9a38cfc7eafc753

operator-azure

quay.io/cilium/operator-azure:v1.17.4@sha256:d8d95049bfeab47cb1a3f995164e1ca2cdec8e6c7036c29799647999cdae07b1
quay.io/cilium/operator-azure:stable@sha256:d8d95049bfeab47cb1a3f995164e1ca2cdec8e6c7036c29799647999cdae07b1

operator-generic

quay.io/cilium/operator-generic:v1.17.4@sha256:a3906412f477b09904f46aac1bed28eb522bef7899ed7dd81c15f78b7aa1b9b5
quay.io/cilium/operator-generic:stable@sha256:a3906412f477b09904f46aac1bed28eb522bef7899ed7dd81c15f78b7aa1b9b5

operator

quay.io/cilium/operator:v1.17.4@sha256:d51d9f6958b23c48591e10194b62e217c1d3740cdfca1e293fd199d22db7f97f
quay.io/cilium/operator:stable@sha256:d51d9f6958b23c48591e10194b62e217c1d3740cdfca1e293fd199d22db7f97f

`v1.17.3`: 1.17.3

Compare Source

Summary of Changes

Minor Changes:

hubble: accurately report startup failure reason from cilium status (Backport PR #38526, Upstream PR #37567, @devodev)
Reject IPSec key rotation with mismatching key lengths to prevent IPv6 disruptions. (Backport PR #38399, Upstream PR #37936, @smagnani96)

Bugfixes:

Always detach BPF programs from cilium_wg0 when not needed. (Backport PR #38184, Upstream PR #38179, @smagnani96)
Avoid installing no-track rules when IP family is disabled (Backport PR #38526, Upstream PR #38438, @ysksuzuki)
bgpv2: Fix service reconciliation by BGP peer IP change (Backport PR #38700, Upstream PR #38620, @rastislavs)
bpf: wireguard: avoid ipcache lookup for source's security identity (Backport PR #38684, Upstream PR #38592, @julianwiedmann)
clustermesh: fix mcs-api count of clusters disagreeing with a conflict (the count was previously increased by one) (Backport PR #38298, Upstream PR #38267, @MrFreezeex)
Ensure that replies to world-to-pod ICMP in AWS ENI are routed via the correct parent interface. (Backport PR #38394, Upstream PR #38335, @gentoo-root)
Fix deadlock in compilation lock (Backport PR #38805, Upstream PR #38784, @dylandreimerink)
Fix panic caused in dual cluster setups where LRPs with skipRedirectFromBackend flag set to true are installed and IPv6 is disabled. (Backport PR #38700, Upstream PR #38656, @aditighag)
Fix the ipv6 only cluster doesn't work with multi pool in some k8s distribution(Openshift) (Backport PR #38526, Upstream PR #38472, @liyihuang)
Fix: cilium-operator no longer patches services on shutdown (Backport PR #38298, Upstream PR #37967, @rsafonseca)
Fixes an issue where the agent failed to start on clusters with large numbers of network policies. (Backport PR #38700, Upstream PR #38556, @squeed)
For configurations with --enable-identity-mark=false, don't attempt to retrieve the source identity from skb->mark. (Backport PR #38800, Upstream PR #38737, @julianwiedmann)
ingress: don't cleanup ingress status of unmanaged Ingress resources (Backport PR #38700, Upstream PR #38555, @mhofstetter)
ipam/aws: properly paginate Operator DescribeNetworkInterfaces AWS API calls in ENI IPAM mode in order to avoid throttling, timeouts and errors from the API (Backport PR #38298, Upstream PR #37983, @antonipp)
netkit: Fix issue where MAC addresses get changed by systemd in L2 mode causing health checks to fail (Backport PR #38526, Upstream PR #37812, @jrife)

CI Changes:

build: update golangci-lint to v2.0.0 (Backport PR #38629, Upstream PR #38473, @mhofstetter)
ci: build CI images within merge group (Backport PR #38526, Upstream PR #38065, @marseel)
ci: prepare CI Image build for being required (Backport PR #38526, Upstream PR #38320, @marseel)
cilium-cli: extend no-interrupted-connections to test Egress Gateway (Backport PR #38527, Upstream PR #38193, @ysksuzuki)
cilium-cli: extend no-interrupted-connections to test NodePort from outside (Backport PR #37797, Upstream PR #37294, @ysksuzuki)
Clear traced UDP v4/v6 connections on check-encryption-leak script. (Backport PR #38517, Upstream PR #38264, @smagnani96)
Ensure packet protocol before using L4 ports in the check-encryption-leak script. (Backport PR #38517, Upstream PR #38290, @smagnani96)
Extend tracing with IP length and whether src/dst pod are CiliumInternalIP in the check-encryption-leak script. (Backport PR #38740, Upstream PR #38281, @smagnani96)
Fix checked L4 port for UDP IPv6 packets in check-encryption-leak script. (Backport PR #38517, Upstream PR #38265, @smagnani96)
Fix endianness for WireGuard UDP traffic in the check-encryption-leak script. (Backport PR #38517, Upstream PR #38292, @smagnani96)
Fix erroneous TCP RST condition when no TCP packets in the check-encryption-leak script. (Backport PR #38517, Upstream PR #38291, @smagnani96)
gh: aws-cni: set --enable-identity-mark=false option (Backport PR #38800, Upstream PR #38738, @julianwiedmann)
gh: e2e-upgrade: also test NS & EGW disruptivity during downgrade (Backport PR #38527, Upstream PR #38511, @julianwiedmann)
gha: enable north/south conn-disrupt-test in clustermesh upgrade tests (Backport PR #38527, Upstream PR #38554, @giorio94)
Ignore encrypt interface field when validating option.Config after initialization (Backport PR #38298, Upstream PR #37184, @Artyop)
Introduce tracing log info for ICMP v4/v6 packets in the check-encryption-leak script. (Backport PR #38740, Upstream PR #38278, @smagnani96)
Manual encap checks for when $skb->encapsulation is unset in the check-encryption-leak script. (Backport PR #38517, Upstream PR #38293, @smagnani96)
Print skb pointer and correlate timestamp for subsequent trace logs in the check-encryption-leak script. (Backport PR #38740, Upstream PR #38266, @smagnani96)
proxy/proxyports: fix flake and data race in TestPortAllocator (Backport PR #38674, Upstream PR #38062, @tklauser)
proxy: fix flake in TestPortAllocator test (Backport PR #38674, Upstream PR #38646, @mhofstetter)
Refactoring and code comments for the check-encryption-leak script. (Backport PR #38740, Upstream PR #38263, @smagnani96)
Report masqueraded flow through proxy in the check-encryption-leak script. (Backport PR #38740, Upstream PR #38297, @smagnani96)
Shift header references when encap and move leak check on CiliumInternalIP in the check-encryption-leak script. (Backport PR #38517, Upstream PR #38280, @smagnani96)
Skip tracking DNS proxy connection with CiliumInternalIPs for IPSec in the check-encryption-leak script. (Backport PR #38517, Upstream PR #38289, @smagnani96)
Skip tracking DNS proxy connection with CiliumInternalIPs for IPSec in the check-encryption-leak script. (Backport PR #38526, Upstream PR #38289, @smagnani96)
Skip tracking TCP proxy connection with CiliumInternalIPs for IPSec in the check-encryption-leak script. (Backport PR #38517, Upstream PR #38287, @smagnani96)
Split TCP-related leak report into a separate log line with also seq/ack n. in the check-encryption-leak script. (Backport PR #38740, Upstream PR #38268, @smagnani96)
test: Update FQDN related domain and IP (Backport PR #38769, Upstream PR #38754, @sayboras)

Misc Changes:

[v1.17] bpf: host: ipsec: check whether destination has tunnel_endpoint (#38802, @julianwiedmann)
[v1.17] bpf: ipsec: improve handling of source security identity in encrypted-overlay code (#38594, @julianwiedmann)
[v1.17] deps: bump package x/oauth2 (#38403, @ferozsalam)
[v1.17] deps: bump x/net to v0.38.0 (#38780, @ferozsalam)
bpf: host: identify Cilium's Wireguard traffic as from HOST (Backport PR #38684, Upstream PR #37956, @julianwiedmann)
bpf: let MARK_MAGIC_EGW_DONE carry source identity (Backport PR #38684, Upstream PR #38430, @julianwiedmann)
bpf: nodeport: preserve monitor aggregation in egress path (Backport PR #38526, Upstream PR #38312, @julianwiedmann)
bugtool: collect more detailed link statistics (Backport PR #38526, Upstream PR #38391, @julianwiedmann)
chore(deps): update all github action dependencies (v1.17) (#38353, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.17) (#38436, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.17) (#38612, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#38303, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#38542, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.18.3 (v1.17) (#38730, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v30 (v1.17) (#38354, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v30.2 (v1.17) (#38611, @cilium-renovate[bot])
chore(deps): update docker.io/library/busybox:1.37.0 docker digest to 37f7b37 (v1.17) (#38350, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.23.7 docker digest to cb45cf7 (v1.17) (#38351, @cilium-renovate[bot])
chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.5.20 (v1.17) (#38434, @cilium-renovate[bot])
chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.5.21 (v1.17) (#38608, @cilium-renovate[bot])
chore(deps): update go to v1.23.8 (v1.17) (#38713, @cilium-renovate[bot])
chore(deps): update kindest/node docker tag to v1.29.14 (v1.17) (#38352, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.31.5-1742184290-6036296930bb05a4870ef40867ca33baec4489e6 (v1.17) (#38257, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.4-1742515734-d30064faed34d8936672353d4b6d6dbcfbaa7b2d (v1.17) (#38384, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.4-1742784301-90f2717e10fcd34f9aca97413fcd00ca2b8ccfee (v1.17) (#38441, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.5-1743506100-0821ef0acdf9f824d47d34e02932be522b3e7233 (v1.17) (#38671, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.5-1744108394-d3be7c547203cd80d0c4902e4b9deac09c727456 (v1.17) (#38773, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#38316, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#38435, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#38831, @cilium-renovate[bot])
cilium, status: Do not display annotations if KPR is disabled (Backport PR #38700, Upstream PR #38677, @borkmann)
doc(troubleshooting): add -verbose to cilium-health status (Backport PR #38298, Upstream PR #38169, @alagoutte)
doc: Envoy daemonset works on OpenShift (Backport PR #38298, Upstream PR #38236, @fgiloux)
docs: Add missing kernel options to system requirements documentation to help users with custom kernels. (Backport PR #38526, Upstream PR #38173, @yrsuthari)
docs: add per-node default pool example (Backport PR #38298, Upstream PR #38135, @acudovs)
docs: clarify hubble flow filter match semantics (Backport PR #38700, Upstream PR #38657, @devodev)
docs: Correct the envoy circuit-breaking example manifest (Backport PR #38298, Upstream PR #38158, @raphink)
docs: Document jitter applied to BGP ConnectRetryTimeSeconds (Backport PR #38526, Upstream PR #38231, @rastislavs)
docs: Update LLVM requirements to 18.1 (Backport PR #38526, Upstream PR #38294, @gentoo-root)
Documentation: "cilium config set" restarts by default (Backport PR #38298, Upstream PR #38114, @joamaki)
Documentation: fix mentions of per-node cilium-dbg tool (Backport PR #38298, Upstream PR #38276, @tklauser)
fix SBOM attestation documentation (Backport PR #38526, Upstream PR #38429, @jaehanbyun)
fix(Documentation/installationk0s.rst): adjust kuberouter naming in k0s documentation (Backport PR #38298, Upstream PR #38243, @RiRa12621)
images: bump distroless to static (Backport PR #38694, Upstream PR #38647, @kaworu)
ipcache: reduce labels map memory churn in resolveLabels a bit (Backport PR #38526, Upstream PR #38494, @tklauser)
maglev: Fix division by zero upon table recreation (Backport PR #38700, Upstream PR #38659, @borkmann)
pkg/controller: fix data race in update params locked (Backport PR #38526, Upstream PR #38327, @aanm)
pkg/endpoint: fix GetLabels data race access (Backport PR #38526, Upstream PR #38328, @aanm)
pkg/endpoint: fix race in unit test (Backport PR #38298, Upstream PR #38129, @squeed)
policy: sync policy map for fake endpoints (Backport PR #38526, Upstream PR #38367, @harsimran-pabla)
proxy: Fix data race in proxyports test (Backport PR #38674, Upstream PR #37890, @jrajahalme)
Removal logic for the new cil_from_wireguard program to handle Cilium Downgrades from v1.18. (#38187, @smagnani96)
remove the endpointRoutes for aws cni in the doc (Backport PR #38700, Upstream PR #38381, @liyihuang)
wireguard: cleanup cilium_calls map upon downgrading from v1.18 (#38595, @smagnani96)

Other Changes:

[v1.17] hubble/exporter: Fix logging exporter options as JSON (#38476, @devodev)
[v1.17] proxy: Bump envoy version to 1.32.x (#38306, @sayboras)
deps: Bump GoBGP to v3.35.0 (#38405, @rastislavs)
fix AWS ENI IPAM mode performance regression in the Operator when --update-ec2-adapter-limit-via-api is set to true (#38532, @antonipp)
Fix IPv6 for LocalRedirectPolicy with skipRedirectFromBackend option. (#38509, @julianwiedmann)
install: Update image digests for v1.17.2 (#38205, @cilium-release-bot[bot])
ipsec: backport minimal VinE support for upgrade scenarios (#37993, @ldelossa)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.17.3@sha256:1782794aeac951af139315c10eff34050aa7579c12827ee9ec376bb719b82873
quay.io/cilium/cilium:stable@sha256:1782794aeac951af139315c10eff34050aa7579c12827ee9ec376bb719b82873

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.3@sha256:98d5feaf67dd9b5d8d219ff5990de10539566eedc5412bcf52df75920896ad42
quay.io/cilium/clustermesh-apiserver:stable@sha256:98d5feaf67dd9b5d8d219ff5990de10539566eedc5412bcf52df75920896ad42

docker-plugin

quay.io/cilium/docker-plugin:v1.17.3@sha256:aece31ec01842f78ae30009b5ca42ab5abd4b042a6fff49b48d06f0f37eddef9
quay.io/cilium/docker-plugin:stable@sha256:aece31ec01842f78ae30009b5ca42ab5abd4b042a6fff49b48d06f0f37eddef9

hubble-relay

quay.io/cilium/hubble-relay:v1.17.3@sha256:f8674b5139111ac828a8818da7f2d344b4a5bfbaeb122c5dc9abed3e74000c55
quay.io/cilium/hubble-relay:stable@sha256:f8674b5139111ac828a8818da7f2d344b4a5bfbaeb122c5dc9abed3e74000c55

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.3@sha256:e9a9ab227c6e833985bde6537b4d1540b0907f21a84319de4b7d62c5302eed5c
quay.io/cilium/operator-alibabacloud:stable@sha256:e9a9ab227c6e833985bde6537b4d1540b0907f21a84319de4b7d62c5302eed5c

operator-aws

quay.io/cilium/operator-aws:v1.17.3@sha256:40f235111fb2bca209ee65b12f81742596e881a0a3ee4d159776d78e3091ba7f
quay.io/cilium/operator-aws:stable@sha256:40f235111fb2bca209ee65b12f81742596e881a0a3ee4d159776d78e3091ba7f

operator-azure

quay.io/cilium/operator-azure:v1.17.3@sha256:6a3294ec8a2107048254179c3ac5121866f90d20fccf12f1d70960e61f304713
quay.io/cilium/operator-azure:stable@sha256:6a3294ec8a2107048254179c3ac5121866f90d20fccf12f1d70960e61f304713

operator-generic

`quay.io/cilium/operator-generic:v1.17.3@sha256:8bd38d0e97a955b2d725929d60df0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

Signed-off-by: Renovate Bot <[email protected]>

vshn-renovate added the dependency label Jul 24, 2024

vshn-renovate force-pushed the commodore-renovate/cilium branch from 5cb3f6f to 19ab897 Compare August 14, 2024 13:09

vshn-renovate changed the title ~~Update Helm release cilium to v1.16.0~~ Update Helm release cilium to v1.16.1 Aug 14, 2024

vshn-renovate force-pushed the commodore-renovate/cilium branch from 19ab897 to 0966253 Compare September 26, 2024 12:09

vshn-renovate changed the title ~~Update Helm release cilium to v1.16.1~~ Update Helm release cilium to v1.16.2 Sep 26, 2024

vshn-renovate force-pushed the commodore-renovate/cilium branch from 0966253 to c0c9997 Compare October 15, 2024 09:27

vshn-renovate changed the title ~~Update Helm release cilium to v1.16.2~~ Update Helm release cilium to v1.16.3 Oct 15, 2024

vshn-renovate force-pushed the commodore-renovate/cilium branch from c0c9997 to c74d064 Compare November 20, 2024 10:09

vshn-renovate changed the title ~~Update Helm release cilium to v1.16.3~~ Update Helm release cilium to v1.16.4 Nov 20, 2024

vshn-renovate force-pushed the commodore-renovate/cilium branch from c74d064 to 2fbe2d8 Compare December 18, 2024 00:07

vshn-renovate changed the title ~~Update Helm release cilium to v1.16.4~~ Update Helm release cilium to v1.16.5 Dec 18, 2024

vshn-renovate force-pushed the commodore-renovate/cilium branch from 2fbe2d8 to 008c65f Compare January 22, 2025 01:09

vshn-renovate changed the title ~~Update Helm release cilium to v1.16.5~~ Update Helm release cilium to v1.16.6 Jan 22, 2025

vshn-renovate force-pushed the commodore-renovate/cilium branch from 008c65f to f25ad59 Compare February 4, 2025 15:51

vshn-renovate changed the title ~~Update Helm release cilium to v1.16.6~~ Update Helm release cilium to v1.17.0 Feb 4, 2025

vshn-renovate force-pushed the commodore-renovate/cilium branch from f25ad59 to 1ef1074 Compare February 6, 2025 15:50

vshn-renovate changed the title ~~Update Helm release cilium to v1.17.0~~ Update Helm release cilium to v1.17.1 Feb 13, 2025

vshn-renovate force-pushed the commodore-renovate/cilium branch from 1ef1074 to 3f323fc Compare February 13, 2025 09:49

vshn-renovate force-pushed the commodore-renovate/cilium branch from 3f323fc to 750411f Compare March 15, 2025 14:10

vshn-renovate changed the title ~~Update Helm release cilium to v1.17.1~~ Update Helm release cilium to v1.17.2 Mar 15, 2025

vshn-renovate force-pushed the commodore-renovate/cilium branch 2 times, most recently from c46685b to df0e9e3 Compare April 14, 2025 21:10

vshn-renovate changed the title ~~Update Helm release cilium to v1.17.2~~ Update Helm release cilium to v1.17.3 Apr 14, 2025

Update Helm release cilium to v1.17.4

a92e01c

Signed-off-by: Renovate Bot <[email protected]>

vshn-renovate force-pushed the commodore-renovate/cilium branch from df0e9e3 to a92e01c Compare May 15, 2025 18:51

vshn-renovate changed the title ~~Update Helm release cilium to v1.17.3~~ Update Helm release cilium to v1.17.4 May 15, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update Helm release cilium to v1.17.4 #126

Update Helm release cilium to v1.17.4 #126

Uh oh!

vshn-renovate commented Jul 24, 2024 •

edited

Loading

Uh oh!

Uh oh!

Update Helm release cilium to v1.17.4 #126

Are you sure you want to change the base?

Update Helm release cilium to v1.17.4 #126

Uh oh!

Conversation

vshn-renovate commented Jul 24, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.17.4: 1.17.4

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.17.3: 1.17.3

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

Configuration

Uh oh!

Uh oh!

vshn-renovate commented Jul 24, 2024 •

edited

Loading

`v1.17.4`: 1.17.4

`v1.17.3`: 1.17.3