chore(deps): update helm release cilium to v1.19.6

[bde-dev]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
cilium (source)	minor	1.18.1 → 1.19.6

---

Release Notes

cilium/cilium (cilium)

v1.19.6: 1.19.6

Compare Source

Summary of Changes

Minor Changes:

• datapath/l2responder: use l3 sockets for solicited node multicast signaling (Backport PR #​46845, Upstream PR #​46332, @​bersoare)
• gateway-api: add support for configuring Gateway access logs through the new spec.telemetry.accessLogs field in CiliumGatewayClassConfig. (Backport PR #​46933, Upstream PR #​46403, @​arybolovlev)

Bugfixes:

• [v1.19] Fix policy service label selector handling (#​46946, @​fristonio)
• bpf: fix ipv6 neighbor solicitation handling in host firewall (Backport PR #​46669, Upstream PR #​46325, @​atykhyy)
• doublewrite: Don't run CRD backend with real handler when reading from KVStore (Backport PR #​47181, Upstream PR #​47144, @​HadrienPatte)
• endpoint: Fix race when reading endpoint properties (Backport PR #​47181, Upstream PR #​46991, @​gandro)
• Fix cilium_operator_unmanaged_pods gauge reporting 0 on reconcile cycles where an unmanaged pod is restarted. (Backport PR #​46975, Upstream PR #​46668, @​Suyash1700)
• Fix a bug which could lead to stale hostport entries if a pod was deleted and immediately recreated in host network. (Backport PR #​46793, Upstream PR #​46747, @​giorio94)
• Fix a regression that could cause established connections to a Pod to be briefly dropped during Cilium agent restart, upgrade, or downgrade, while the agent was restoring the Pod's network policy. (Backport PR #​46974, Upstream PR #​46927, @​aanm)
• Fix allowedRoute namespace and kind restrictions on multi-listener Gateways. (Backport PR #​46826, Upstream PR #​45693, @​eufriction)
• Fix bug that left the host firewall enabled in the live ConfigMap when disabling hostFirewall.enabled (toggling it from true to false) via Helm. (Backport PR #​46669, Upstream PR #​44748, @​shibaPuppy)
• Fix ClusterMesh service affinity annotation service.cilium.io/affinity: "none" incorrectly dropping all remote backends, causing traffic blackhole when no local endpoints exist. (Backport PR #​46691, Upstream PR #​46635, @​mkamadeus)
• Fix ctmap gc duration metric recording (Backport PR #​46975, Upstream PR #​46873, @​fristonio)
• Fix incorrect policy denials for traffic to L7 load balanced services when remote identity changes (Backport PR #​47002, Upstream PR #​46821, @​fristonio)
• Fix potential hangs caused by Netlink errors in filterAndDestroySockets. (Backport PR #​47181, Upstream PR #​46967, @​ysksuzuki)
• Fix regression preventing Cilium from starting when configured in kvstore mode with KPR enabled, if etcd is behind a Kubernetes service (Backport PR #​47181, Upstream PR #​46444, @​giorio94)
• Fix the UDP tunnel check in the BIG TCP probe. (Backport PR #​46793, Upstream PR #​46710, @​gentoo-root)
• Fixes a bug where Hubble policy correlation does not work for port ranges. (Backport PR #​46793, Upstream PR #​46643, @​squeed)
• gateway-api: Add Gateway check for when hostNetwork is enabled (Backport PR #​46837, Upstream PR #​46350, @​xtineskim)
• gateway-api: Each HTTPS and TLS passthrough port now receives its own Envoy listener and RouteConfiguration. (Backport PR #​46826, Upstream PR #​44889, @​eufriction)
• ipam/multi-pool: Do now wait for zero prealloc request (Backport PR #​47181, Upstream PR #​46867, @​pippolo84)
• operator: Fix nil-pointer panic in CiliumNode GC (Backport PR #​47181, Upstream PR #​47127, @​HadrienPatte)

CI Changes:

• .github: Generate CI binaries with correct module version (Backport PR #​47099, Upstream PR #​46742, @​joestringer)
• chore: check-cilium-envoy-image.sh should get values from Makefile.va… (Backport PR #​46920, Upstream PR #​46840, @​sekhar-isovalent)
• ci: Auth to image registry in clustermesh upgrade workflow (Backport PR #​46691, Upstream PR #​46632, @​nebril)
• ci: Remove merge_group from tests-smoke-conformance.yaml (Backport PR #​46888, Upstream PR #​46451, @​nebril)
• Fix workflow change detection for single-commit PRs to main (Backport PR #​46793, Upstream PR #​46684, @​Demiserular)
• Further GC ratchet test fix races (Backport PR #​47224, Upstream PR #​43075, @​tommyp1ckles)

Misc Changes:

• (minor) docs: update reference to aws-cli image (Backport PR #​46975, Upstream PR #​46923, @​squeed)
• .github: allow fork PR checkout with actions/checkout v7 (Backport PR #​47135, Upstream PR #​47133, @​aanm)
• [v1.19] - .github/workflows: unpin cilium/cilium self-references to track main (#​46613, @​aanm)
• [v1.19] - Reapply ".github/workflows: do not use deployments for environments" (#​46574, @​aanm)
• [v1.19] vendor: bump github.com/cilium/statedb to v0.5.9 (#​47083, @​giorio94)
• bgp: fix status condition reporting: update reasons to accurately reflect current condition state (Backport PR #​46920, Upstream PR #​46383, @​martonra)
• bpf: Condition ICMP SNAT on BPF masquerading and inter-cluster SNAT (Backport PR #​47181, Upstream PR #​47021, @​pchaigno)
• chore(deps): update all github action dependencies (v1.19) (#​46658, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46908, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​47109, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#​46906, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#​47045, @​cilium-renovate[bot])
• chore(deps): update aws-actions/configure-aws-credentials action to v6.2.2 (v1.19) (#​47124, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#​46774, @​cilium-renovate[bot])
• chore(deps): update base-images to v1.25.12 (v1.19) (#​46982, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.5 (v1.19) (#​46726, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/alpine docker tag to v3.23.5 (v1.19) (#​46773, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.11 docker digest to 00feed3 (v1.19) (#​46657, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.6 (v1.19) (#​47039, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc (v1.19) (#​46700, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/image-tester docker tag to v1783861476 (v1.19) (#​47122, @​cilium-renovate[bot])
• chore: BYOCNI loopback for cilium (Backport PR #​46691, Upstream PR #​46646, @​sekhar-isovalent)
• chore: optimize building gops and cni/loopback (Backport PR #​46845, Upstream PR #​46781, @​sekhar-isovalent)
• ci: always set fail-fast to false on image builds (Backport PR #​47181, Upstream PR #​47064, @​aanm)
• ci: remove non-ariane workflows from config (Backport PR #​46845, Upstream PR #​46787, @​nebril)
• clustermesh: add reusable backend selector constructor (Backport PR #​46691, Upstream PR #​45648, @​viktor-kurchenko)
• docs: clarify Hubble static/dynamic exporter file rotation settings (Backport PR #​47181, Upstream PR #​47026, @​maksymbilokur-cisco)
• docs: fix note about ipv4-native-routing-cidr default value (Backport PR #​46793, Upstream PR #​46603, @​rptaylor)
• Egress Gateway: handle nil events (Backport PR #​47181, Upstream PR #​46476, @​tommyp1ckles)
• endpoint: reap restart-preserved policy map entries once ready (Backport PR #​47063, Upstream PR #​47062, @​aanm)
• endpoint: sync desired policy before reload on the restore path (restore-path hardening) (Backport PR #​47076, Upstream PR #​47075, @​aanm)
• Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR #​46793, Upstream PR #​46388, @​tommyp1ckles)
• Fix instance of cilium having incorrect specified policy_change_total failure label "failure" value which caused unnecessary warnings. (Backport PR #​46845, Upstream PR #​46388, @​tommyp1ckles)
• fix(deps): update k8s.io/utils digest to be93311 (v1.19) (#​46907, @​cilium-renovate[bot])
• fix(deps): update k8s.io/utils digest to cf1189d (v1.19) (#​47115, @​cilium-renovate[bot])
• Fixed Gateway API reconciler incorrectly reporting "Accepted HTTPRoute" in the status condition message for GRPCRoute and TLSRoute resources. (Backport PR #​46826, Upstream PR #​44962, @​eufriction)
• gateway-api: return model from Gateway API ingestion (Backport PR #​46933, Upstream PR #​46450, @​arybolovlev)
• gha: fail fast in external-target provisioning scripts instead of swallowing failures (Backport PR #​47181, Upstream PR #​47085, @​aanm)
• Improve cilium-dbg status output of module health (Backport PR #​46845, Upstream PR #​46739, @​joestringer)
• loadbalancer: proxy ports are now resolved per frontend instead of per service, preventing one port from losing its L7 redirect when multiple listeners share a service. (Backport PR #​46826, Upstream PR #​45949, @​eufriction)
• loadbalancer: validate DSR dispatch configuration globally (Backport PR #​46793, Upstream PR #​45545, @​FelipeYepez)
• Makefile: Generate full Cilium version in worktree (Backport PR #​46793, Upstream PR #​46737, @​joestringer)
• Revert restore-path policy map changes (#​46927, #​47062, #​47075) (Backport PR #​47213, Upstream PR #​47202, @​aanm)
• Upgraded cilium/ebpf to version v0.22.0 (Backport PR #​46845, Upstream PR #​46783, @​dylandreimerink)

Other Changes:

• install: Update image digests for v1.19.5 (#​46593, @​cilium-release-bot[bot])
• v1.19: gateway-api: fix sds secrets in golden tests (#​47229, @​0xch4z)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.6@​sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.6@​sha256:accab5fe6ab7134fcd6f916acc9e4c785382a022128ae5495ec4a45fbe18c9a6

docker-plugin

quay.io/cilium/docker-plugin:v1.19.6@​sha256:81a8d37e541edfff4016037373853e8e875f1ea0433c58b9ab54b314c305b9ec

hubble-relay

quay.io/cilium/hubble-relay:v1.19.6@​sha256:6782a49e3f28eba015701c4410a5ec7fa096fe9a562f879b4372dbecd827ea44

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.6@​sha256:031e332cdec61a9ebaca42f044e7e2f5b876ba96ac0ccf1d42acd5954779efaf

operator-aws

quay.io/cilium/operator-aws:v1.19.6@​sha256:546d13ac511cf82441b5e9e99e03d0e054b788513ceb1a883e620b8284d5ccc3

operator-azure

quay.io/cilium/operator-azure:v1.19.6@​sha256:e555430b7f5e4c407daab1afbec3c431ec016a53f1f1b848f67b9242cd3adedd

operator-generic

quay.io/cilium/operator-generic:v1.19.6@​sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665

operator

quay.io/cilium/operator:v1.19.6@​sha256:37e36840be5a0882a9a065b2308859785e960a742aed0aeac794e0ac4aabdf90

v1.19.5: 1.19.5

Compare Source

Summary of Changes

Minor Changes:

• Extend the information reported by the troubleshoot kvstore and clustermesh commands (Backport PR #​46554, Upstream PR #​46516, @​giorio94)
• helm: Remove loadBalancer.standalone option (Backport PR #​46170, Upstream PR #​46070, @​joestringer)
• wireguard:mtu: fix mtu calculation with potential padding (Backport PR #​46170, Upstream PR #​45940, @​smagnani96)

Bugfixes:

• Always add cluster label to node when nodeSelectorLabels is enabled to fix CiliumNetworkPolicy with fromNodes/toNodes with policy-default-local-cluster enabled (enabled by default in 1.19+) (Backport PR #​46170, Upstream PR #​46068, @​MrFreezeex)
• azure: Fix public IP reassignment failure loop on operator restart (Backport PR #​46289, Upstream PR #​46240, @​HadrienPatte)
• bgp: Don't provide default_gateway reconciler when disabled (Backport PR #​46024, Upstream PR #​45911, @​YutaroHayakawa)
• bgp: Reduce amount of soft peer resets by service reconciliation and fix potentially missed incorrect metadata update upon failed reconciliation. (Backport PR #​46245, Upstream PR #​45927, @​rastislavs)
• bpf: fix host proxy packet routing to pods (Backport PR #​46024, Upstream PR #​45916, @​atykhyy)
• bug: fixed weighted backend traffic splitting for TLSRoute passthrough listeners in Gateway API (Backport PR #​46170, Upstream PR #​45937, @​nickolaev)
• datapath/mtu: add altname to mark cilium owned interfaces and do skip changing MTU on interfaces not managed by cilium (Backport PR #​46028, Upstream PR #​45799, @​bersoare)
• Fix a bug that causes the NamespaceSelector field in a CiliumEgressGatewayPolicy to be corrupted, and no longer effective. (Backport PR #​46024, Upstream PR #​45926, @​julianwiedmann)
• Fix a rare bug in clustermesh-apiserver that triggers incorrect deletion of a valid endpoint entry from the etcd under high pod churn (Backport PR #​46170, Upstream PR #​45780, @​adamwathieu)
• Fix BGP PeerConfig status cleanup so it no longer times out when there are no managed conditions to remove. (Backport PR #​46170, Upstream PR #​45967, @​ysksuzuki)
• Fix bug that would disrupt node connectivity when ClusterIP/LoadBalancer VIPs overlapped with node-local IP addresses. (Backport PR #​46024, Upstream PR #​45572, @​ajmmm)
• Fix TLS passthrough routes failing silently when a gateway has mixed HTTP, HTTPS, and TLS listeners and a TLSRoute with no sectionName. (Backport PR #​45966, Upstream PR #​45371, @​syedazeez337)
• Fix wildcard namespace bypass for selectorless ipBlock rules (Backport PR #​46456, Upstream PR #​46305, @​TheBeeZee)
• fix(gateway-api): Prevent controller panic during Gateway reconciliation when GatewayClass has an invalid or malformed spec.parametersRef. (Backport PR #​46400, Upstream PR #​46340, @​arybolovlev)
• fix(gateway-api): set ready condition in endpointSlice to true (Backport PR #​46400, Upstream PR #​46237, @​ulrichgiraud)
• fix: nil pointer dereference panic due to uninitialized logger (Backport PR #​46170, Upstream PR #​45782, @​weizhoublue)
• Fixed a race where a reused endpoint ID could have its BPF state directory removed by the outgoing endpoint (Backport PR #​46554, Upstream PR #​46091, @​eyupcanakman)
• Fixed unsolicited IPv6 L2 announcements ignored by receiving hosts, as not conformant to RFC 4861 (Backport PR #​46170, Upstream PR #​46079, @​giorio94)
• Fixes a bug where policymap pressure was incorrectly being reported as 0. (Backport PR #​46024, Upstream PR #​45791, @​squeed)
• gateway-api/ingress: set service label on EndpointSlices (Backport PR #​46400, Upstream PR #​46242, @​mhofstetter)
• gateway-api: fix GatewayClass field index (Backport PR #​46289, Upstream PR #​46127, @​thorn3r)
• gateway-api: prune stale Gateway API route parent statuses (Backport PR #​46400, Upstream PR #​46296, @​mhofstetter)
• Improve robustness of kvstore keys construction to prevent possible surprising behavior in rare circumstances (Backport PR #​46554, Upstream PR #​46412, @​giorio94)
• iptables: match wireguard packets by proto+port instead of packet mark (Backport PR #​46289, Upstream PR #​45974, @​bersoare)
• multipool: Fix retries for CiliumNode Get errors (Backport PR #​46408, Upstream PR #​46124, @​pippolo84)
• sockets: fix nil pointer dereference in filterAndDestroySockets (Backport PR #​46024, Upstream PR #​44843, @​umut-polat)
• The internal representation of load-balancing backends has been refactored to efficiently support thousands of services referencing a shared backend. (#​46462, @​joamaki)

CI Changes:

• chore(deps): update lvh-images for conformance-runtime (Backport PR #​46025, Upstream PR #​45922, @​julianwiedmann)
• ci:bpftrace: fail curl with corrupted binary download (Backport PR #​46024, Upstream PR #​45948, @​smagnani96)
• fix the race condition for the TestRouterIDAllocation bgp test case (Backport PR #​46289, Upstream PR #​44545, @​liyihuang)
• gha: make conformance kubespray runner configurable (Backport PR #​46289, Upstream PR #​46171, @​giorio94)
• helm: add tmpl files to .helmignore (Backport PR #​46554, Upstream PR #​46445, @​sekhar-isovalent)
• helm: allow overriding of registry_prefix in charts (Backport PR #​46289, Upstream PR #​46217, @​sekhar-isovalent)
• ipam: Deflake TestMarkForReleaseNoAllocate (Backport PR #​46289, Upstream PR #​46188, @​pippolo84)
• Move pull_request triggered workflows to ariane (Backport PR #​46452, Upstream PR #​45363, @​nebril)
• Reapply "ci: Log in for image registry pulls" (Backport PR #​46495, Upstream PR #​46376, @​nebril)

Misc Changes:

• [v1.19] - chore(deps): update docker.io/library/ubuntu:24.04 docker digest to 7… (#​46578, @​aanm)
• [v1.19] Backport health command fixes from 46102 (#​46250, @​joamaki)
• [v1.19] deps: bump various go packages (#​46185, @​ferozsalam)
• [v1.19] loadbalancer: return correct IP family for IPv6 ClusterIP addresses (#​46425, @​tklauser)
• bpf: local_delivery: add CB flag for "use_redirect_peer" (Backport PR #​46204, Upstream PR #​46169, @​julianwiedmann)
• bpf: local_delivery: condense usage of skb cb slots (Backport PR #​46204, Upstream PR #​46064, @​julianwiedmann)
• bpf: local_delivery: use CB_DELIVERY_FLAGS to transfer proxy state (Backport PR #​46554, Upstream PR #​46291, @​julianwiedmann)
• chore(deps): update all github action dependencies (v1.19) (#​45994, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46016, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46117, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46268, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46280, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46395, @​cilium-renovate[bot])
• chore(deps): update all github action dependencies (v1.19) (#​46538, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#​45468, @​cilium-renovate[bot])
• chore(deps): update all-dependencies (v1.19) (#​46581, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#​45995, @​cilium-renovate[bot])
• chore(deps): update base-images (v1.19) (#​46164, @​cilium-renovate[bot])
• chore(deps): update base-images to v1.25.11 (v1.19) (#​46342, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to 0fc1dd3 (v1.19) (#​46153, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to 11ecd4e (v1.19) (#​46277, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to cd47774 (v1.19) (#​46137, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium digest to e1b3ec8 (v1.19) (#​46007, @​cilium-renovate[bot])
• chore(deps): update cilium/cilium-cli action to v0.19.3 (v1.19) (#​46120, @​cilium-renovate[bot])
• chore(deps): update dependency bufbuild/buf to v1.70.0 (v1.19) (#​46267, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.19.4 (v1.19) (#​46150, @​cilium-renovate[bot])
• chore(deps): update dependency cilium/little-vm-helper to v0.0.30 (v1.19) (#​46266, @​cilium-renovate[bot])
• chore(deps): update dependency protocolbuffers/protobuf to v35.1 (v1.19) (#​46570, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/busybox:1.37.0 docker digest to 9532d8c (v1.19) (#​46535, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.10 docker digest to cd05a37 (v1.19) (#​46138, @​cilium-renovate[bot])
• chore(deps): update docker.io/library/golang:1.25.11 docker digest to 379065f (v1.19) (#​46536, @​cilium-renovate[bot])
• chore(deps): update gcr.io/etcd-development/etcd docker tag to v3.6.12 (v1.19) (#​46560, @​cilium-renovate[bot])
• chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260518104151-5ebe05f9440b (v1.19) (#​46139, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/certgen docker tag to v0.4.5 (v1.19) (#​46561, @​cilium-renovate[bot])
• chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752 (v1.19) (#​46377, @​cilium-renovate[bot])
• chore(deps): update stable lvh-images (v1.19) (patch) (#​45392, @​cilium-renovate[bot])
• docs: Add caveats on Kubernetes versions when using host L7 DNS policies (Backport PR #​46289, Upstream PR #​45843, @​atykhyy)
• docs: Document BTF as a requirement (Backport PR #​46289, Upstream PR #​46063, @​pchaigno)
• docs: fix Markdown-style hyperlink in mutual-authentication.rst (Backport PR #​46024, Upstream PR #​45751, @​bitflicker64)
• Fix broken gateway-api documentation links (Backport PR #​46554, Upstream PR #​46527, @​0xch4z)
• Fix pointer-address comparison for Gateway API Route ParentReference status handling (Backport PR #​46400, Upstream PR #​46355, @​weizhoublue)
• fix(deps): update k8s.io patch updates stable to v0.35.5 (v1.19) (#​46140, @​cilium-renovate[bot])
• fix(deps): update k8s.io patch updates stable to v0.35.5 (v1.19) (patch) (#​46015, @​cilium-renovate[bot])
• fix(deps): update k8s.io patch updates stable to v0.35.6 (v1.19) (#​46562, @​cilium-renovate[bot])
• fix(deps): update k8s.io/utils digest to ff6756f (v1.19) (#​45996, @​cilium-renovate[bot])
• fix(deps): update module k8s.io/apimachinery to v0.35.5 (v1.19) (#​45997, @​cilium-renovate[bot])
• fix(deps): update module k8s.io/apimachinery to v0.35.6 (v1.19) (#​46537, @​cilium-renovate[bot])
• Miscellaneous improvements to the fake client (Backport PR #​46024, Upstream PR #​45784, @​giorio94)
• operator: miscellaneous improvements to the troubleshoot clustermesh command (Backport PR #​46554, Upstream PR #​46502, @​giorio94)
• Remove defunct l2podAnnouncements.interface Helm value that rendered a configmap key the agent no longer recognises, causing crash-loops when L2 pod announcements were enabled. Users must use l2podAnnouncements.interfacePattern instead. (Backport PR #​46170, Upstream PR #​46093, @​salamidrus)
• Revert ".github/workflows: do not use deployments for environments" (Backport PR #​46400, Upstream PR #​46348, @​aanm)

Other Changes:

• [v1.19] proxy: Bump upstream version to v1.37.x (#​46439, @​sayboras)
• install: Update image digests for v1.19.4 (#​45961, @​cilium-release-bot[bot])
• v1.19: kvstore: Don't set fake pod CIDRs for remote nodes (#​46361, @​pchaigno)
• vendor: bump statedb to v0.5.8 (#​46505, @​giorio94)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.19.5@​sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.19.5@​sha256:5ed9334b2254315740f9e2a8b6645bf69920f79ef14f436931579d2038784f9b

docker-plugin

quay.io/cilium/docker-plugin:v1.19.5@​sha256:4006d5558390120774a5a903a706dfd64089082bd653b7cb45e9e5a93ff4efea

hubble-relay

quay.io/cilium/hubble-relay:v1.19.5@​sha256:24409bfa1bca075c92acb26ba4b49cd573d99d68d5370f7cc825078185222a0c

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.19.5@​sha256:c9706343dde700804c2f50c09a2f8291797c707d1747fd50f70c939c23747c16

operator-aws

quay.io/cilium/operator-aws:v1.19.5@​sha256:b8473618e8d2bf8a610da445c8c37e1d1e8221aecd05989456d87a7588d66707

operator-azure

quay.io/cilium/operator-azure:v1.19.5@​sha256:8600299cb121f9df00fd32b93fa74de89ed49dd3a67e3d7301c07325c04c77f8

operator-generic

quay.io/cilium/operator-generic:v1.19.5@​sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4

operator

quay.io/cilium/operator:v1.19.5@​sha256:07a25f6a248d77f0c8417d21b5ea5424a81fe551421e4baf04dc79b1360e832e

v1.19.4: 1.19.4

Compare Source

Summary of Changes

Minor Changes:

• cilium-agent: when --k8s-service-proxy-name is set, EndpointSlices are now filtered by the service.kubernetes.io/service-proxy-name label at the watch level, matching how Services are already filtered, operators with hand-managed EndpointSlices must stamp the matching label on those slices. (Backport PR #​45755, Upstream PR #​45504, @​HadrienPatte)
• iptables-based masquerading: Ensure iptables rules respect longest prefix match by sorting routes by mask length when enable-masquerade-to-route-source is enabled (Backport PR #​45630, Upstream PR #​45192, @​liyihuang)
• operator/spire: make SPIRE client configurable for ztunnel (Backport PR #​45356, Upstream PR #​44136, @​nddq)
• pkg/endpoint: skip logger rebuild on policy revision updates (Backport PR #​45630, Upstream PR #​45533, @​sjohnsonpal)

Bugfixes:

• bpf: egressgw: respect egress ifindex during FIB lookup (Backport PR #​45695, Upstream PR #​45661, @​julianwiedmann)
• bpf: host: fix source identity for IPsec trace in to-netdev (Backport PR #​45594, Upstream PR #​45588, @​julianwiedmann)
• cilium-dbg: cilium map list now displays "unknown" instead of 0 for maps that do not support cache-based entry counting. (Backport PR #​45888, Upstream PR #​44951, @​skymensch)
• cilium: Fix incorrect IPv6 BIG TCP display (Backport PR #​45630, Upstream PR #​45529, @​pchaigno)
• clustermesh: fails gracefully instead of crashing when EndpointSliceSync is not able to setup the EndpointSlice watch (Backport PR #​45496, Upstream PR #​45402, @​MrFreezeex)
• clustermesh: Fix Helm typo preventing to add annotations when setting clustermesh.apiserver.tls.auto.method: certmanager (Backport PR #​45630, Upstream PR #​45576, @​owayss)
• Fix cilium-agent crash when a transient network error occurs during CiliumNode update. The agent now retries instead of calling Fatal. (Backport PR #​45673, Upstream PR #​44526, @​nebojsaj1726)
• Fix CiliumLocalRedirectPolicy addressMatcher overriding an existing Service's frontend when its backend pods are not yet Ready. (Backport PR #​45584, Upstream PR #​45522, @​ysksuzuki)
• Fix dedicated Ingress reconciliation panic on invalid TLS passthrough rules (Backport PR #​45888, Upstream PR #​45737, @​weizhoublue)
• Fix host L7 policy operation (Backport PR #​45496, Upstream PR #​45030, @​atykhyy)
• Fix IPsec packet drops during rolling restart with key rotation by deferring SPI advertisement until XFRM states are ready (Backport PR #​45630, Upstream PR #​44701, @​hbangT)
• Fix issue where datapath reinitialization may get stuck when triggered from the local API (Backport PR #​45630, Upstream PR #​45557, @​jrife)
• Fix missing global service backends in Cluster Mesh when multiple service ports point to the same target port. (Backport PR #​45356, Upstream PR #​45179, @​RiccardoAtzori91)
• fix(egressGateway): skip unmatched gateways when using multiple gateway (Backport PR #​45630, Upstream PR #​44705, @​ieth0)
• fix(gateway-api): prevent silent disable on CRD discovery timeout (Backport PR #​45630, Upstream PR #​44662, [@​aslafy-z](http

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[bde-dev]

AI Assessment

Field	Value
Decision	NEEDS_REVIEW
Risk Level	HIGH
Update Type	MINOR
Component	cilium
Version	1.18.1 -> 1.19.0
Breaking Changes	true

Analysis

While this is a minor version update with many new features (Ztunnel beta, IPv6 improvements, encryption enhancements), it contains multiple breaking changes and deprecations that require explicit action during upgrade. The release notes explicitly warn of required actions for Network Policies, Cluster Mesh, LoadBalancer IPAM, and BGP. As Cilium is core infrastructure for the homelab's networking layer, any misconfiguration during upgrade could cause widespread connectivity issues. The v1.19.0 release is also very fresh (10th anniversary release with 2934 new commits) and may have undiscovered issues.

Recommendation

Manual review and testing required before merging. Steps: 1) Review the official Cilium v1.19 upgrade guide at https://docs.cilium.io/en/v1.19/operations/upgrade/ for your specific configuration 2) Check if your homelab uses Network Policies, Cluster Mesh, LoadBalancer IPAM, or BGP features that have breaking changes 3) Review deprecation notices for any deprecated features in use 4) Test the upgrade in a non-production environment first 5) Plan for potential downtime or service disruption 6) Have a rollback plan ready (revert to v1.18.x if issues occur)

---

Analyzed by n8n AI Agent using Claude

[bde-dev]

AI Assessment

Field	Value
Decision	NEEDS_REVIEW
Risk Level	MEDIUM
Update Type	MINOR
Component	Cilium CNI
Version	1.18.1 -> 1.19.3
Breaking Changes	false

Analysis

Cilium v1.19.3 is a MINOR version update that primarily delivers bugfixes including memory leak fixes, performance improvements, and critical connectivity fixes (NodePort DSR, IPSec key rotation, dual-stack IPAM). While no breaking changes are documented, Cilium is a core infrastructure component controlling all pod-to-pod networking. As such, any upgrade should be validated to ensure cluster stability. The update itself is production-ready and well-tested through multiple patch iterations (v1.19.1→v1.19.2→v1.19.3), but manual verification of pre-upgrade tests and rollback plan is prudent.

Recommendation

CONDITIONAL APPROVAL: This PR is safe to merge once: (1) pre-upgrade cluster health checks pass, (2) a rollback plan is documented, and (3) upgrade is scheduled during a maintenance window. The extensive bugfixes make this a valuable update. Consider automated merge if CI/CD pipeline includes Cilium-specific health validation tests.

---

Analyzed by n8n AI Agent using Claude