feat(helm): update chart cilium ( 1.17.4 → 1.18.3 ) #79

renovate · 2025-06-24T06:43:19Z

This PR contains the following updates:

Package	Update	Change
cilium (source)	minor	`1.17.4` -> `1.18.3`

Release Notes

cilium/cilium (cilium)

`v1.18.3`

Compare Source

`v1.18.2`: 1.18.2

Compare Source

Summary of Changes

Minor Changes:

Fix validation bug where namespaced CiliumNetworkPolicies with nodeSelector in specs array were silently accepted but ignored. Now properly rejected with validation error. (Backport PR #41365, Upstream PR #40702, @pillai-ashwin)
lbipam: do not reallocate IPs in LB IPAM on operator restart (Backport PR #41267, Upstream PR #41147, @marseel)
lbipam: widening CIDR range or updating selector of CiliumLoadBalancerIPPool does no longer reassign IPs (Backport PR #41267, Upstream PR #41122, @marseel)

Bugfixes:

Add option to configure BGP origin attribute for LoadBalancer IPs in BGP Control Plane v2, allowing smoother migration from MetalLB integration. (Backport PR #41479, Upstream PR #41231, @hanapedia)
Add toleration for 'node.cloudprovider.kubernetes.io/uninitialized' to Cilium Operator (Backport PR #41267, Upstream PR #41098, @guettli)
bgpv2: Avoid modifying CiliumBGPPeerConfig in resource store (Backport PR #41267, Upstream PR #41088, @rastislavs)
bpf: add support for delinearized ARP packets (Backport PR #41365, Upstream PR #41233, @vsinitsyn)
ctmap/gc: continue interval time on partial GC pass. (Backport PR #41591, Upstream PR #41258, @tommyp1ckles)
Disable unnecessary headless service watching to reduce API server load in clusters not using the Gateway API or Ingress features. (Backport PR #41479, Upstream PR #40844, @moscicky)
Fix "Error while correcting L4 checksum" dropped packets for ICMP destination unreachable error packets. (Backport PR #41591, Upstream PR #40194, @br4243)
Fix "No mapping for NAT masquerade" flakes in the CI, make NAT LRU fallbacks more robust. (Backport PR #41365, Upstream PR #40971, @gentoo-root)
Fix --exclude-local-address with eBPF Host-Routing (Backport PR #41365, Upstream PR #41275, @antonipp)
Fix a BGP bug where the routerID specified in a CiliumBGPNodeConfigOverride was not correctly updated in RouterIDIPPool mode. (Backport PR #41267, Upstream PR #40340, @liyihuang)
Fix a bug that would cause NodePort requests to be sent to the wrong backends when using KPR and Clustermesh with two identical, non-global NodePort services on different clusters. (Backport PR #41591, Upstream PR #41337, @pchaigno)
Fix a bug where cilium-agent would report "Link not found" for an endpoint deleted during state restore after cilium-agent restart. (Backport PR #41267, Upstream PR #40568, @fristonio)
Fix a regression where enabling unknown Hubble metrics would crash the cilium agent (Backport PR #41479, Upstream PR #41368, @devodev)
Fix agent config initContainer unable to hit apiservers in apiServerURLs by passing as container arg (Backport PR #41267, Upstream PR #41110, @JJGadgets)
Fix bug that would cause error messages when disabling agent health checks (Backport PR #41479, Upstream PR #41297, @HadrienPatte)
Fix issue in Local Redirect Policies where traffic was dropped when no local pods were available to be redirected to. In these scenarios the traffic should have been processed as if the Local Redirect Policy did not exist. (Backport PR #41591, Upstream PR #41463, @joamaki)
Fix issue where Local Redirect Policy (LRP) services with a single named port did not create a local redirect service entry. (Backport PR #41591, Upstream PR #41534, @aditighag)
Fix the bug local redirect policy not doing filter based destination port (Backport PR #41479, Upstream PR #41411, @liyihuang)
Fixes a cosmetic bug where the cilium_bpf_map_ops_total error count was incorrectly being incremented for map cilium_lb_affinity_match. (Backport PR #41479, Upstream PR #41378, @squeed)
Fixes an issue in NodeManager where restored cluster nodes can be pruned before the initial node listing completes. (Backport PR #41267, Upstream PR #41039, @0xch4z)
Helm: Ensure consistent default labels for all ServiceMonitor resources (Backport PR #41267, Upstream PR #41240, @baurmatt)
iptables: Fix IPv6 SNAT for L7 proxy upstream traffic (Backport PR #41249, Upstream PR #41034, @gentoo-root)
loadbalancer/writer: add support for SetIsServiceHealthCheckedFunc (Backport PR #41267, Upstream PR #41092, @mhofstetter)
neighbor: Fix bug where neighbor discovery subsystem reports unhealthy when it is healthy (Backport PR #41365, Upstream PR #41186, @mhofstetter)
pkg/ipam: fix nil dereference during pool shrink operation (Backport PR #41365, Upstream PR #41198, @alimehrabikoshki)
policy: fix agent crash due to policy cache update-delete race (Backport PR #41267, Upstream PR #41079, @fristonio)

CI Changes:

.github/actions: fix boolean condition check in post-logic action (Backport PR #41479, Upstream PR #41395, @aanm)
.github/worfklows: copy cilium-cli binary from container (Backport PR #41591, Upstream PR #41524, @aanm)
.github/workflows: add proper suffix for scale-test-egw (Backport PR #41591, Upstream PR #41477, @aanm)
.github/workflows: add timeout to Install node local DNS step (Backport PR #41267, Upstream PR #41120, @aanm)
.github/workflows: separate feature json files in different dirs (Backport PR #41479, Upstream PR #41403, @aanm)
.github/workflows: simplify ginkgo workflow (Backport PR #41479, Upstream PR #41396, @aanm)
.github/workflows: simplify ginkgo workflow (Backport PR #41591, Upstream PR #41396, @aanm)
.github: fix upload artifacts for features.json (Backport PR #41365, Upstream PR #41119, @aanm)
add missing extraArgs in CI (Backport PR #41365, Upstream PR #41005, @aanm)
checkpatch: bump checkpatch version, and minor adaptations (Backport PR #41365, Upstream PR #41290, @giorio94)
ci: Re-enable go caches for privileged tests (Backport PR #41267, Upstream PR #41102, @rastislavs)
ci: simplify scheduled test (Backport PR #41262, Upstream PR #41261, @brlbil)
Fix multiple workflows with missing features and steps (Backport PR #41479, Upstream PR #41398, @aanm)
gh: e2e-upgrade: skip even more steps when not downgrading (Backport PR #41591, Upstream PR #41468, @julianwiedmann)
gha: run checkpatch check only on PR events (Backport PR #41365, Upstream PR #41308, @giorio94)
ipsec: fix xfrm privileged tests (Backport PR #41365, Upstream PR #41279, @smagnani96)
node:tests: fix privileged (#41281, @smagnani96)
operator/bgpv2: Avoid race in TestRouterIDAllocation test (Backport PR #41591, Upstream PR #41499, @rastislavs)
pkg/metrics: define default CIDR policies values (Backport PR #41479, Upstream PR #41422, @aanm)
testutils: differentiate {Test,Benchmark}Privileged and fix benchmarks (Backport PR #41267, Upstream PR #41007, @smagnani96)
workflows/ipsec: yet another fix for downgrade (Backport PR #41365, Upstream PR #41260, @smagnani96)

Misc Changes:

.github/workflows: add step 5 as part of the image build process (Backport PR #41177, Upstream PR #41113, @aanm)
bpf: fix svc annotation handling (Backport PR #41365, Upstream PR #41310, @borkmann)
bpf: wireguard: re-add IPv6 fragment check in from-wireguard (Backport PR #41479, Upstream PR #41451, @julianwiedmann)
build-images-release: specify main branch on reusable jobs (Backport PR #41177, Upstream PR #41530, @aanm)
checkpatch: Update image digest (Backport PR #41479, Upstream PR #41360, @HadrienPatte)
chore(deps): update actions/labeler action to v6.0.1 (v1.18) (#41565, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#41351, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#41660, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.18) (#41126, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.18) (#41350, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.18) (#41439, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.18) (#41509, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.18) (#41612, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v32.1 (v1.18) (#41659, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.6 docker digest to 714ad64 (v1.18) (#41349, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.6 docker digest to 8d9e57c (v1.18) (#41437, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.7 docker digest to 5e9d14d (v1.18) (#41656, @cilium-renovate[bot])
chore(deps): update go to v1.24.7 (v1.18) (#41566, @cilium-renovate[bot])
chore(deps): update module github.com/go-viper/mapstructure/v2 to v2.4.0 [security] (v1.18) (#41319, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.34.6-1756960514-59def10827e2fdea04b289bb00128526bde9d3c1 (v1.18) (#41516, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.34.6-1757072375-ebd79127b3d1f27212d5426619daccdd15ad9e28 (v1.18) (#41567, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.34.7-1757592137-1a52bb680a956879722f48c591a2ca90f7791324 (v1.18) (#41657, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#41438, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#41658, @cilium-renovate[bot])
ci: Update workflow permissions (Backport PR #41479, Upstream PR #41383, @kyle-c-simmons)
doc: use correct policy-default-local-cluster inspect command in example (Backport PR #41365, Upstream PR #41118, @Preisschild)
docs: Add missing dsrDispatch parameter to annotation-based DSR examples (Backport PR #41479, Upstream PR #40873, @gitsofaryan)
docs: add table DSR Dispatch Mode following Routing Mode (Backport PR #41591, Upstream PR #41431, @alagoutte)
docs: document portmap binary requirements (Backport PR #41365, Upstream PR #41300, @nbusseneau)
Fix release script steps (Backport PR #41177, Upstream PR #41502, @aanm)
Helm: Only insert nodePort for cilium-ingress-service if specified (Backport PR #41267, Upstream PR #41107, @baurmatt)
install: bump startup script version (Backport PR #41365, Upstream PR #41299, @Artyop)
kvstore: fix overly verbose debug log and error message (Backport PR #41267, Upstream PR #41148, @giorio94)
loadbalancer: Fixes to test flakes (Backport PR #41267, Upstream PR #41085, @joamaki)
Log kube-proxy replacement config before starting kube-proxy replacement (Backport PR #41479, Upstream PR #41133, @liyihuang)
lower log severity for stale metadata to avoid CI issue (Backport PR #41479, Upstream PR #41389, @liyihuang)
metrics/features: Fix counter metrics to use Set() instead of Add() (Backport PR #41479, Upstream PR #41382, @aanm)
metrics/features: remove aws-vpc-cni (Backport PR #41591, Upstream PR #41498, @aanm)
node/manager: Do not prune the local node on restart (Backport PR #41591, Upstream PR #41544, @joamaki)
Prevent cilium-dbg from panicing when /sys is not mounted (Backport PR #41365, Upstream PR #41287, @HadrienPatte)
Support extending cilium-agent dnsPolicy as a downstream packager (Backport PR #41267, Upstream PR #41010, @devodev)
Update all github action dependencies (v1.18) (#41216, @cilium-renovate[bot])
Update dependency protocolbuffers/protobuf to v32 (v1.18) (#41217, @cilium-renovate[bot])
Update docker.io/library/golang:1.24.6 Docker digest to a18e9e0 (v1.18) (#41214, @cilium-renovate[bot])
Update stable lvh-images (v1.18) (patch) (#41215, @cilium-renovate[bot])
workflows/conformance-ginkgo: fix steps for stable branches (Backport PR #41591, Upstream PR #41599, @aanm)
xds: fix NACK logging after slog migration (Backport PR #41267, Upstream PR #41171, @mhofstetter)

Other Changes:

[v1.18] envoy: Start serving listeners only after clusters have been ACKed (#41605, @jrajahalme)
docs: Add new IAM permissions requirements to upgrade notes (#41374, @HadrienPatte)
install: Update image digests for v1.18.1 (#41182, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.2@sha256:858f807ea4e20e85e3ea3240a762e1f4b29f1cb5bbd0463b8aa77e7b097c0667
quay.io/cilium/cilium:stable@sha256:858f807ea4e20e85e3ea3240a762e1f4b29f1cb5bbd0463b8aa77e7b097c0667

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.2@sha256:cd689a07bfc7622e812fef023cb277fdc695b60a960d36f32f93614177a7a0f6
quay.io/cilium/clustermesh-apiserver:stable@sha256:cd689a07bfc7622e812fef023cb277fdc695b60a960d36f32f93614177a7a0f6

docker-plugin

quay.io/cilium/docker-plugin:v1.18.2@sha256:be578aaae7274ef7155bd0a6d2f7c2d91085642aea4fdb24451ee9cab4ca2e5d
quay.io/cilium/docker-plugin:stable@sha256:be578aaae7274ef7155bd0a6d2f7c2d91085642aea4fdb24451ee9cab4ca2e5d

hubble-relay

quay.io/cilium/hubble-relay:v1.18.2@sha256:6079308ee15e44dff476fb522612732f7c5c4407a1017bc3470916242b0405ac
quay.io/cilium/hubble-relay:stable@sha256:6079308ee15e44dff476fb522612732f7c5c4407a1017bc3470916242b0405ac

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.2@sha256:612b1d94c179cd8ae239e571e96ebd95662bb5cccb62aacfdf79355aa9cdddc8
quay.io/cilium/operator-alibabacloud:stable@sha256:612b1d94c179cd8ae239e571e96ebd95662bb5cccb62aacfdf79355aa9cdddc8

operator-aws

quay.io/cilium/operator-aws:v1.18.2@sha256:1cb856fbe265dfbcfe816bd6aa4acaf006ecbb22dcc989116a1a81bb269ea328
quay.io/cilium/operator-aws:stable@sha256:1cb856fbe265dfbcfe816bd6aa4acaf006ecbb22dcc989116a1a81bb269ea328

operator-azure

quay.io/cilium/operator-azure:v1.18.2@sha256:9696e9b8219b9a5c16987e072eda2da378d42a32f9305375e56d7380a0c2ba8e
quay.io/cilium/operator-azure:stable@sha256:9696e9b8219b9a5c16987e072eda2da378d42a32f9305375e56d7380a0c2ba8e

operator-generic

quay.io/cilium/operator-generic:v1.18.2@sha256:cb4e4ffc5789fd5ff6a534e3b1460623df61cba00f5ea1c7b40153b5efb81805
quay.io/cilium/operator-generic:stable@sha256:cb4e4ffc5789fd5ff6a534e3b1460623df61cba00f5ea1c7b40153b5efb81805

operator

quay.io/cilium/operator:v1.18.2@sha256:0f234ce2ab0f30c09f4f9fe1b9c6323f0c6b66d789bef5e958fce7cff85960f3
quay.io/cilium/operator:stable@sha256:0f234ce2ab0f30c09f4f9fe1b9c6323f0c6b66d789bef5e958fce7cff85960f3

`v1.18.1`: 1.18.1

Compare Source

Summary of Changes

Minor Changes:

Add kernel_version, endpoint_routes_enabled, strict_mode_enabled and kubernetes_version feature metrics. (Backport PR #41078, Upstream PR #41003, @aanm)
eni: improve logging and speed up ipam reconciliation in case of node scale-downs (Backport PR #40979, Upstream PR #40852, @marseel)
kvstore: Cilium Agent no longer fails health-check if operator is unavailable (Backport PR #40979, Upstream PR #40920, @marseel)
operator: CRDs are updated in series instead of in parallel now during Cilium upgrades. This should lower the pressure on the k8s control plane (Backport PR #40847, Upstream PR #40322, @marseel)

Bugfixes:

Add missing safeguards to topology-aware routing: use all backends when no suitable one matching the zone hints are found or a backend exists without a zone hint. (#41116, @joamaki)
aws/eni: Don't use subnet tags to filter ENIs for GC (Backport PR #40979, Upstream PR #40656, @HadrienPatte)
clustermesh: fix regression possibly causing cross-cluster connections disruption if the clustermesh-apiserver is restarted at the same time as Cilium agents. (Backport PR #40979, Upstream PR #40786, @giorio94)
clustermesh: fix regression preventing global services with unnamed ports from including remote backends (Backport PR #40865, Upstream PR #40848, @giorio94)
Fix bug where the presence of a label called "ingress" causes incorrect assignment of identities to workloads, affecting policy enforcement. (Backport PR #40847, Upstream PR #40791, @christarazi)
Fix skipping of LoadBalancer services when IPMode is not set to VIP (KEP-1860) (Backport PR #40979, Upstream PR #40915, @joamaki)
fix(GH-37724): Sync policies on startup (Backport PR #40847, Upstream PR #40357, @anubhabMajumdar)
fix: create policy snapshot only for sdp (Backport PR #40979, Upstream PR #40785, @vipul-21)
Fixes a bug where the Cilium agent may segfault when starting. (Backport PR #40847, Upstream PR #40824, @squeed)
Fixes an error where the Ingress controller, when run in host network, created an invalid Service. (Backport PR #41078, Upstream PR #40232, @rtheobald)
helm: Create envoy-config ConfigMap for preflight (Backport PR #41078, Upstream PR #40875, @sayboras)
install/kubernetes: fix clustermesh-apiserver extraEnv (Backport PR #41078, Upstream PR #41021, @aanm)
loadbalancer: Fix backend state in REST API (Backport PR #40847, Upstream PR #40780, @mhofstetter)

CI Changes:

.github/actions: only upload files with features-tested prefix (Backport PR #40979, Upstream PR #40975, @aanm)
Add TESTOWNERS file (#40864, @joestringer)
ci: Add Cleanup Disk space step into conformance-runtime (Backport PR #40979, Upstream PR #40973, @rastislavs)
ci: Fix CI-Fuzz Build failures (Backport PR #40979, Upstream PR #40728, @lomackie)
ci: Reuse connectivity test flags in proxy-embedded (Backport PR #41078, Upstream PR #41036, @joestringer)
endpoint: Avoid unnecessarily logging a warning during endpoint deletion (Backport PR #40979, Upstream PR #40927, @christarazi)
Fix GKE cluster creation failures when branch names exceed 63-byte label limit by implementing automatic truncation with hash-based uniqueness preservation. (Backport PR #40847, Upstream PR #40725, @pillai-ashwin)
Improved test failure attribution on stable branches by using TESTOWNERS files to route failures to appropriate code quality teams rather than generic CI infrastructure teams. (Backport PR #40847, Upstream PR #40776, @pillai-ashwin)
ipsec: fix privileged tests (Backport PR #41078, Upstream PR #41006, @smagnani96)
tools/testowners: de-duplicate error logs (Backport PR #40847, Upstream PR #40778, @tklauser)
workflows/ipsec: Fix leak detection for IPv6-only in e2e downgrade (Backport PR #40979, Upstream PR #40881, @smagnani96)

Misc Changes:

.github/workflows: bump build-images-base timeout to 60 minutes (Backport PR #40979, Upstream PR #40919, @aanm)
.github/workflows: print open file descriptors (Backport PR #40979, Upstream PR #40941, @aanm)
.github: fix removal of all files in /mnt (Backport PR #40847, Upstream PR #40818, @aanm)
.github: remove all contents of /mnt in build images CI (Backport PR #40847, Upstream PR #40814, @aanm)
chore(deps): update actions/download-artifact action to v5 (v1.18) (#41055, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#40901, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.18) (#41056, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.18) (#40900, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.18.6 (v1.18) (#40898, @cilium-renovate[bot])
chore(deps): update go to v1.24.6 (v1.18) (#40993, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#40899, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.18) (patch) (#41054, @cilium-renovate[bot])
ci: add/change runner labels (Backport PR #40979, Upstream PR #40972, @Artyop)
daemon/test: explicitly wait for identities synchronization (Backport PR #40847, Upstream PR #40811, @giorio94)
docs: Remove references to v1.15 (Backport PR #41078, Upstream PR #41033, @joestringer)
Fix loadbalancer handling of backends with ClusterID set (Backport PR #41078, Upstream PR #40968, @giorio94)
Fix race condition issues (Backport PR #40979, Upstream PR #40949, @aanm)
fix(deps): update module github.com/docker/docker to v28.3.3+incompatible [security] (v1.18) (#40793, @cilium-renovate[bot])
loadbalancer: Raise default retry duration to 1 second (Backport PR #41078, Upstream PR #40997, @joamaki)
loadbalancer: Use unique for L3n4Addr (Backport PR #40847, Upstream PR #40633, @joamaki)
Makefile: Fix multi codeowner detection (Backport PR #40847, Upstream PR #40923, @joestringer)
Reduced memory usage by roughly 10% for large EndpointSlices by sharing identical objects. (Backport PR #41078, Upstream PR #40987, @joamaki)
values(.yaml.tmpl): Add Geneve (Class Option) to dsrDispatch paramater (Backport PR #40847, Upstream PR #40625, @alagoutte)
vendor: Bump to StateDB v0.4.5 (Backport PR #40979, Upstream PR #40783, @joamaki)

Other Changes:

ci: reduce gke failures (#41070, @brlbil)
install: Update image digests for v1.18.0 (#40782, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.18.1@sha256:65ab17c052d8758b2ad157ce766285e04173722df59bdee1ea6d5fda7149f0e9
quay.io/cilium/cilium:stable@sha256:65ab17c052d8758b2ad157ce766285e04173722df59bdee1ea6d5fda7149f0e9

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.18.1@sha256:87ab85f33dc7e895ed6257564bf1a255d12399d9e8a075a8fc400910ff94cbeb
quay.io/cilium/clustermesh-apiserver:stable@sha256:87ab85f33dc7e895ed6257564bf1a255d12399d9e8a075a8fc400910ff94cbeb

docker-plugin

quay.io/cilium/docker-plugin:v1.18.1@sha256:fb1c6ecb6dc180c97488b8ea45d81275237db14d50e22a1eff3dbfaf9f6f93f3
quay.io/cilium/docker-plugin:stable@sha256:fb1c6ecb6dc180c97488b8ea45d81275237db14d50e22a1eff3dbfaf9f6f93f3

hubble-relay

quay.io/cilium/hubble-relay:v1.18.1@sha256:7e2fd4877387c7e112689db7c2b153a4d5c77d125b8d50d472dbe81fc1b139b0
quay.io/cilium/hubble-relay:stable@sha256:7e2fd4877387c7e112689db7c2b153a4d5c77d125b8d50d472dbe81fc1b139b0

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.18.1@sha256:e2bdc8236acec0d1ef1552c831a7cd2277624031066fbdfac884a31a4126a32a
quay.io/cilium/operator-alibabacloud:stable@sha256:e2bdc8236acec0d1ef1552c831a7cd2277624031066fbdfac884a31a4126a32a

operator-aws

quay.io/cilium/operator-aws:v1.18.1@sha256:de522223ecd73bc06b48042fa59f78f7b3b8f2fff4f8f30a61687516798c5042
quay.io/cilium/operator-aws:stable@sha256:de522223ecd73bc06b48042fa59f78f7b3b8f2fff4f8f30a61687516798c5042

operator-azure

quay.io/cilium/operator-azure:v1.18.1@sha256:682058e6734e397e7939e92bb463da3c1b5d8b7a7ce408c3b7a62aadb9ce4f06
quay.io/cilium/operator-azure:stable@sha256:682058e6734e397e7939e92bb463da3c1b5d8b7a7ce408c3b7a62aadb9ce4f06

operator-generic

quay.io/cilium/operator-generic:v1.18.1@sha256:97f4553afa443465bdfbc1cc4927c93f16ac5d78e4dd2706736e7395382201bc
quay.io/cilium/operator-generic:stable@sha256:97f4553afa443465bdfbc1cc4927c93f16ac5d78e4dd2706736e7395382201bc

operator

quay.io/cilium/operator:v1.18.1@sha256:f3b8d90f945167c1ac4324a0f02a9d381f83076d5ce828fab452014f9335a47e
quay.io/cilium/operator:stable@sha256:f3b8d90f945167c1ac4324a0f02a9d381f83076d5ce828fab452014f9335a47e

`v1.18.0`: 1.18.0

Compare Source

We are excited to announce the Cilium 1.18.0 release!

A total of 3298 new commits have been contributed to this release by a growing community of over 955 developers and over 22,000 GitHub stars! ⭐

To keep up to date with all the latest Cilium releases, see Announcements

Here's what's new in v1.18.0:

🚠 Networking

⚖️ Load Balancing Redesign: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features (cilium/cilium#38469 and others, @joamaki, @DamianSawicki, @brb)
🔌 Virtual Network Devices: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels (cilium/cilium#37723, @ldelossa; cilium/cilium#37346, @gyutaeb)
Ⓜ️ Multiple Egress Gateways: Egress Gateways policies can now direct traffic towards multiple gateway nodes (cilium/cilium#39304, @carlos-abad)
🚦 Ingress Rate Limiting: The bandwidth manager now supports ingress rate limiting (cilium/cilium#36351, @l1b0k)
📢 Multi-Device L2 Announcements: The L2 pod announcement feature now supports multiple devices (cilium/cilium#38198, @dylandreimerink)
🏢 Neighbor Subsystem Rework: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state (cilium/cilium#39987, @dylandreimerink)

🌐 IPv6

🚇 Tunneling Underlay: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption (cilium/cilium#38296, cilium/cilium#39497, @pchaigno)
💬 Kube Proxy Replacement: Cilium now implements service translation when running on an IPv6 underlay (cilium/cilium#39074, @pchaigno)
📋 Delegated IPAM: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 (cilium/cilium#38249, @caorui-io, @kadevu)
📦 IP Fragment Support: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality (cilium/cilium#38110, @gentoo-root)
🚪 Egress gateway policies can now match IPv6 address ranges (cilium/cilium#38452, @rgo3)

🛡️ Policy & Observability

🏷️ Policy Names in Hubble-CLI: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble (cilium/cilium#39453, @antonipp)
📝 Policy Log Fields: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching (cilium/cilium#39902, @squeed)
🛰️ Encapsulated Traffic Decoding: Hubble decodes encapsulated traffic for deeper introspection into traffic flows (cilium/cilium#37634, @kaworu)
🏰 ClusterMesh Policy Restriction: A new option allows the cluster entity to apply only to the local cluster in ClusterMesh environment (cilium/cilium#39338, @MrFreezeex)
✨ Enhanced Policy Dashboard: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions (cilium/cilium#36492, cilium/cilium#37445, @squeed)

🌅 Performance

📊 Scale Test Results: Cilium implements policies and services up to 45% faster in higher scale environments (Various; @marseel, cilium/cilium#40227)
📦 Image Size Reduction: Docker image sizes are reduced by 32% on arm64 architecture images (cilium/cilium#40005, @marseel)
⚡ Improved Policy Performance: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized (cilium/cilium#39340, @squeed; cilium/cilium#40414, @marseel)
🪞 EndpointSlice Mirroring for Multi-Cluster Services: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller (cilium/cilium#38596, @MrFreezeex)
🌐 KVStoreMesh Optimization: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value (cilium/cilium#36471, @HadrienPatte)
🧠 Egress Gateway Processing: Egress gateway policy processing is significantly improved when matching a large number of pods (cilium/cilium#37714, @giorio94)
🗑️ Optimized Garbage Collection for Connection Tracking: Cilium leverages batched iterators for CTMap GC (cilium/cilium#36288, @tommyp1ckles)

⚙️ Operations

📈 API Server Connections at Scale: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations (cilium/cilium#37601, @aditighag; cilium/cilium#38031, @orange30; cilium/cilium#36648, @wedaly)
🔄 ConfigMap Synchronization: New option to

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2025-06-24T06:43:45Z

--- kubernetes/apps/kube-system/cilium/app Kustomization: kube-system/cilium HelmRelease: kube-system/cilium

+++ kubernetes/apps/kube-system/cilium/app Kustomization: kube-system/cilium HelmRelease: kube-system/cilium

@@ -13,13 +13,13 @@

     spec:
       chart: cilium
       sourceRef:
         kind: HelmRepository
         name: cilium
         namespace: kube-system
-      version: 1.17.4
+      version: 1.18.3
   install:
     remediation:
       retries: -1
   interval: 1h
   upgrade:
     cleanupOnFail: true

github-actions · 2025-06-24T06:43:47Z

--- HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

+++ HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

@@ -27,13 +27,13 @@

     spec:
       securityContext:
         appArmorProfile:
           type: Unconfined
       containers:
       - name: cilium-agent
-        image: quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a
+        image: quay.io/cilium/cilium:v1.17.6@sha256:544de3d4fed7acba72758413812780a4972d47c39035f2a06d6145d8644a3353
         imagePullPolicy: IfNotPresent
         command:
         - cilium-agent
         args:
         - --config-dir=/tmp/cilium/config-map
         startupProbe:
@@ -194,13 +194,13 @@

         - name: xtables-lock
           mountPath: /run/xtables.lock
         - name: tmp
           mountPath: /tmp
       initContainers:
       - name: config
-        image: quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a
+        image: quay.io/cilium/cilium:v1.17.6@sha256:544de3d4fed7acba72758413812780a4972d47c39035f2a06d6145d8644a3353
         imagePullPolicy: IfNotPresent
         command:
         - cilium-dbg
         - build-config
         env:
         - name: K8S_NODE_NAME
@@ -219,13 +219,13 @@

           value: '7445'
         volumeMounts:
         - name: tmp
           mountPath: /tmp
         terminationMessagePolicy: FallbackToLogsOnError
       - name: mount-cgroup
-        image: quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a
+        image: quay.io/cilium/cilium:v1.17.6@sha256:544de3d4fed7acba72758413812780a4972d47c39035f2a06d6145d8644a3353
         imagePullPolicy: IfNotPresent
         env:
         - name: CGROUP_ROOT
           value: /sys/fs/cgroup
         - name: BIN_PATH
           value: /opt/cni/bin
@@ -251,13 +251,13 @@

             - SYS_ADMIN
             - SYS_CHROOT
             - SYS_PTRACE
             drop:
             - ALL
       - name: apply-sysctl-overwrites
-        image: quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a
+        image: quay.io/cilium/cilium:v1.17.6@sha256:544de3d4fed7acba72758413812780a4972d47c39035f2a06d6145d8644a3353
         imagePullPolicy: IfNotPresent
         env:
         - name: BIN_PATH
           value: /opt/cni/bin
         command:
         - sh
@@ -281,13 +281,13 @@

             - SYS_ADMIN
             - SYS_CHROOT
             - SYS_PTRACE
             drop:
             - ALL
       - name: mount-bpf-fs
-        image: quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a
+        image: quay.io/cilium/cilium:v1.17.6@sha256:544de3d4fed7acba72758413812780a4972d47c39035f2a06d6145d8644a3353
         imagePullPolicy: IfNotPresent
         args:
         - mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf
         command:
         - /bin/bash
         - -c
@@ -297,13 +297,13 @@

           privileged: true
         volumeMounts:
         - name: bpf-maps
           mountPath: /sys/fs/bpf
           mountPropagation: Bidirectional
       - name: clean-cilium-state
-        image: quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a
+        image: quay.io/cilium/cilium:v1.17.6@sha256:544de3d4fed7acba72758413812780a4972d47c39035f2a06d6145d8644a3353
         imagePullPolicy: IfNotPresent
         command:
         - /init-container.sh
         env:
         - name: CILIUM_ALL_STATE
           valueFrom:
@@ -345,13 +345,13 @@

         - name: cilium-cgroup
           mountPath: /sys/fs/cgroup
           mountPropagation: HostToContainer
         - name: cilium-run
           mountPath: /var/run/cilium
       - name: install-cni-binaries
-        image: quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a
+        image: quay.io/cilium/cilium:v1.17.6@sha256:544de3d4fed7acba72758413812780a4972d47c39035f2a06d6145d8644a3353
         imagePullPolicy: IfNotPresent
         command:
         - /install-plugin.sh
         resources:
           requests:
             cpu: 100m
--- HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

+++ HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

@@ -29,13 +29,13 @@

         name: cilium-operator
         app.kubernetes.io/part-of: cilium
         app.kubernetes.io/name: cilium-operator
     spec:
       containers:
       - name: cilium-operator
-        image: quay.io/cilium/operator-generic:v1.17.4@sha256:a3906412f477b09904f46aac1bed28eb522bef7899ed7dd81c15f78b7aa1b9b5
+        image: quay.io/cilium/operator-generic:v1.17.6@sha256:91ac3bf7be7bed30e90218f219d4f3062a63377689ee7246062fa0cc3839d096
         imagePullPolicy: IfNotPresent
         command:
         - cilium-operator-generic
         args:
         - --config-dir=/tmp/cilium/config-map
         - --debug=$(CILIUM_DEBUG)

renovate bot added renovate/helm type/patch labels Jun 24, 2025

renovate bot force-pushed the renovate/cilium-1.x branch 4 times, most recently from 97b03f2 to 8568cb1 Compare July 5, 2025 00:45

renovate bot force-pushed the renovate/cilium-1.x branch 5 times, most recently from 2b07d4c to fb5e89c Compare July 13, 2025 09:41

renovate bot force-pushed the renovate/cilium-1.x branch 6 times, most recently from 735a5dd to 91e6784 Compare July 19, 2025 13:41

renovate bot changed the title ~~fix(helm): update chart cilium ( 1.17.4 → 1.17.5 )~~ fix(helm): update chart cilium ( 1.17.4 → 1.17.6 ) Jul 19, 2025

renovate bot force-pushed the renovate/cilium-1.x branch 6 times, most recently from 92dd783 to d206e15 Compare July 27, 2025 08:48

renovate bot force-pushed the renovate/cilium-1.x branch 4 times, most recently from 47d8fc3 to ca13abb Compare July 29, 2025 12:00

renovate bot force-pushed the renovate/cilium-1.x branch 4 times, most recently from 13d6db2 to d93a1df Compare September 23, 2025 01:30

renovate bot force-pushed the renovate/cilium-1.x branch 5 times, most recently from 14f0cd1 to 9631572 Compare October 4, 2025 17:12

renovate bot force-pushed the renovate/cilium-1.x branch 7 times, most recently from 8d47dd8 to a5d4172 Compare October 12, 2025 17:01

renovate bot force-pushed the renovate/cilium-1.x branch 6 times, most recently from dcc9f89 to ac32927 Compare October 20, 2025 05:45

renovate bot force-pushed the renovate/cilium-1.x branch 4 times, most recently from b1bda7e to 16d6300 Compare October 26, 2025 21:08

renovate bot changed the title ~~feat(helm): update chart cilium ( 1.17.4 → 1.18.2 )~~ feat(helm): update chart cilium ( 1.17.4 → 1.18.3 ) Oct 26, 2025

renovate bot force-pushed the renovate/cilium-1.x branch from 16d6300 to f38a941 Compare October 27, 2025 05:26

feat(helm): update chart cilium ( 1.17.4 → 1.18.3 )

a501555

renovate bot force-pushed the renovate/cilium-1.x branch from f38a941 to a501555 Compare October 27, 2025 10:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(helm): update chart cilium ( 1.17.4 → 1.18.3 ) #79

feat(helm): update chart cilium ( 1.17.4 → 1.18.3 ) #79

renovate bot commented Jun 24, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Jun 24, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Jun 24, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

feat(helm): update chart cilium ( 1.17.4 → 1.18.3 ) #79

Are you sure you want to change the base?

feat(helm): update chart cilium ( 1.17.4 → 1.18.3 ) #79

Conversation

renovate bot commented Jun 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.18.3

v1.18.2: 1.18.2

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.18.1: 1.18.1

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.18.0: 1.18.0

🚠 Networking

🌐 IPv6

🛡️ Policy & Observability

🌅 Performance

⚙️ Operations

Configuration

Uh oh!

github-actions bot commented Jun 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jun 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Jun 24, 2025 •

edited

Loading

`v1.18.3`

`v1.18.2`: 1.18.2

`v1.18.1`: 1.18.1

`v1.18.0`: 1.18.0

github-actions bot commented Jun 24, 2025 •

edited

Loading

github-actions bot commented Jun 24, 2025 •

edited

Loading