Cilium Files

Summary of Changes

Minor Changes: * helm: KPR subflag changes (Backport PR [#40222], Upstream PR [#39721], @brb)

Bugfixes: * Deny policies are now synced to Envoy so that they can be enforced for Ingress policies. (Backport PR [#40187], Upstream PR [#39736], @jrajahalme) * Do not fail the agent startup in case IPv6 support is enabled and the node does not have an IPv6 address assigned yet (Backport PR [#40205], Upstream PR [#40143], @pippolo84) * Fix bug preventing a global service from including remote backends, if the local service has no selector, and the remote one gets removed and then added again. ([#40361], @giorio94) * Fix data race involving DumpReliablyWithCallback map operation. (Backport PR [#40094], Upstream PR [#38590], @aditighag) * Fix IPAM IP release racing condition when IP reassigned back to ENI (Backport PR [#40289], Upstream PR [#40019], @victorcq) * hubble automatically pick the hubble-prefer-ipv6 to true if ipv4 not enabled (Backport PR [#40289], Upstream PR [#40210], @chengjoey) * LBIPAM: Fix deletion of CiliumLoadBalancerIPPool with multiple IP blocks that led to an operator crash (Backport PR [#40094], Upstream PR [#40013], @pippolo84) * pkg/egressgateway: ensure gateway IP is IPv4 (Backport PR [#40332], Upstream PR [#40209], @rgo3) * policy: fix error handling for selector policy resolution ([#40404], @fristonio)

CI Changes: * ci: do not run north-south conn disrupt tests for 5.4 kernels ([#39443], @ldelossa) * ci: fix north-south conn disrupt for 5.4 kernel ([#40434], @smagnani96)

Misc Changes: * .github/workflows: remove reviewers if ciliumbot approved PR (Backport PR [#40094], Upstream PR [#39989], @aanm) * auto-approve: add repository as part command (Backport PR [#40094], Upstream PR [#40050], @aanm) * auto-approve: add repository as part command (Backport PR [#40332], Upstream PR [#40089], @aanm) * chore(deps): update all github action dependencies (v1.17) ([#40158], @cilium-renovate[bot]) * chore(deps): update all-dependencies (v1.17) ([#40044], @cilium-renovate[bot]) * chore(deps): update all-dependencies (v1.17) ([#40458], @cilium-renovate[bot]) * chore(deps): update dependency cilium/cilium-cli to v0.18.5 (v1.17) ([#39948], @cilium-renovate[bot]) * chore(deps): update go to v1.24.5 (v1.17) ([#40424], @cilium-renovate[bot]) * chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.33.4-1752151664-7c2edb0b44cf95f326d628b837fcdd845102ba68 (v1.17) ([#40466], @cilium-renovate[bot]) * chore(deps): update stable lvh-images (v1.17) (patch) ([#40157], @cilium-renovate[bot]) * cilium: fix socket termination for v4-in-v6 clients (Backport PR [#40295], Upstream PR [#39994], @borkmann) * contrib/git: add merge drivers to automate post-merge commands (Backport PR [#40289], Upstream PR [#40189], @aanm) * disk-cleanup: parallelize cleanup process to speed up step (Backport PR [#40094], Upstream PR [#40054], @aanm) * doc:ipsec:kvstore: explicit limitations that could lead to staling XFRM states and no connectivity (Backport PR [#40176], Upstream PR [#39719], @smagnani96) * docs/ipsec: Fix incorrect statement on hostns encryption (Backport PR [#40176], Upstream PR [#40133], @pchaigno) * Makefile: Require API generation commands to succeed (Backport PR [#40205], Upstream PR [#40199], @joestringer) * operator/secretsync: silence reconciliation logs (Backport PR [#40289], Upstream PR [#40217], @tklauser) * proxy: Use upstream envoy control plane API (Backport PR [#40216], Upstream PR [#39672], @sayboras) * v1.17: helm: Restore hostPort.enabled flag ([#40480], @brb)

Other Changes: * [v1.17] deps: Update cilium-envoy image to 1.33.x ([#40088], @sayboras) * Backport: kube-proxy-healthz to return 503 if node terminating ([#40317], @tamilmani1989) * Bpf datapath TCP conntrack entries are (re)created only in the forward direction, solving an issue with freezing proxy connections when backend connection is re-opened. ([#40448], @jrajahalme) * envoy: Bump cilium-envoy to the latest v1.33.x ([#40368], @sayboras) * install: Update image digests for v1.17.5 ([#40117], @cilium-release-bot[bot]) * proxy: Bump envoy version to the latest v1.33.x ([#40181], @sayboras) * v1.17: docs: Document encapsulation options ([#40471], @pchaigno)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.17.6@sha256:544de3d4fed7acba72758413812780a4972d47c39035f2a06d6145d8644a3353 quay.io/cilium/cilium:stable@sha256:544de3d4fed7acba72758413812780a4972d47c39035f2a06d6145d8644a3353

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.6@sha256:f619e97432db427e1511bf91af3be8ded418c53a353a09629e04c5880659d1df quay.io/cilium/clustermesh-apiserver:stable@sha256:f619e97432db427e1511bf91af3be8ded418c53a353a09629e04c5880659d1df

docker-plugin

quay.io/cilium/docker-plugin:v1.17.6@sha256:2d6175582c036dde241448b2b937353ce304d7a30eec9b66e96279b4b39c4f36 quay.io/cilium/docker-plugin:stable@sha256:2d6175582c036dde241448b2b937353ce304d7a30eec9b66e96279b4b39c4f36

hubble-relay

quay.io/cilium/hubble-relay:v1.17.6@sha256:7d17ec10b3d37341c18ca56165b2f29a715cb8ee81311fd07088d8bf68c01e60 quay.io/cilium/hubble-relay:stable@sha256:7d17ec10b3d37341c18ca56165b2f29a715cb8ee81311fd07088d8bf68c01e60

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.6@sha256:5352e670719dc61f059c1e1a04bc0563c2144738386fa7236dc167ff3fef4c64 quay.io/cilium/operator-alibabacloud:stable@sha256:5352e670719dc61f059c1e1a04bc0563c2144738386fa7236dc167ff3fef4c64

operator-aws

quay.io/cilium/operator-aws:v1.17.6@sha256:24db5c811e24e51e7ce166e8e056967875bf3544cc2ead6984f34f705fe71847 quay.io/cilium/operator-aws:stable@sha256:24db5c811e24e51e7ce166e8e056967875bf3544cc2ead6984f34f705fe71847

operator-azure

quay.io/cilium/operator-azure:v1.17.6@sha256:1b7e193ccbc718f723993a0f11eb8fbf16376e822fe8c4dc792d7696701d57c8 quay.io/cilium/operator-azure:stable@sha256:1b7e193ccbc718f723993a0f11eb8fbf16376e822fe8c4dc792d7696701d57c8

operator-generic

quay.io/cilium/operator-generic:v1.17.6@sha256:91ac3bf7be7bed30e90218f219d4f3062a63377689ee7246062fa0cc3839d096 quay.io/cilium/operator-generic:stable@sha256:91ac3bf7be7bed30e90218f219d4f3062a63377689ee7246062fa0cc3839d096

operator

quay.io/cilium/operator:v1.17.6@sha256:e7b41cdba20875f8a6595eca1baf1cff1b8367417cffa99be7b1b9b0a11ab677 quay.io/cilium/operator:stable@sha256:e7b41cdba20875f8a6595eca1baf1cff1b8367417cffa99be7b1b9b0a11ab677