fix(helm): update cilium ( 1.17.4 → 1.17.9 ) #796

renovate · 2025-06-21T00:32:09Z

This PR contains the following updates:

Package	Update	Change
cilium (source)	patch	`1.17.4` -> `1.17.9`

Release Notes

cilium/cilium (cilium)

`v1.17.9`

Compare Source

`v1.17.8`: 1.17.8

Compare Source

Summary of Changes

Bugfixes:

Fix "No mapping for NAT masquerade" flakes in the CI, make NAT LRU fallbacks more robust. (Backport PR #41369, Upstream PR #40971, @gentoo-root)

CI Changes:

.github/worfklows: copy cilium-cli binary from container (Backport PR #41618, Upstream PR #41524, @aanm)
.github/workflows: add timeout to Install node local DNS step (Backport PR #41266, Upstream PR #41120, @aanm)
.github/workflows: simplify ginkgo workflow (Backport PR #41618, Upstream PR #41396, @aanm)
.github: fix upload artifacts for features.json (Backport PR #41369, Upstream PR #41119, @aanm)
add missing extraArgs in CI (Backport PR #41369, Upstream PR #41005, @aanm)
checkpatch: bump checkpatch version, and minor adaptations (Backport PR #41369, Upstream PR #41290, @giorio94)
ci-aks: Fix concurrency for ipsec tests (#41161, @joestringer)
ci: Fix Scheduled Test (#41235, @brlbil)
ci: simplify scheduled test (Backport PR #41265, Upstream PR #41261, @brlbil)
gha: run checkpatch check only on PR events (Backport PR #41369, Upstream PR #41308, @giorio94)
pkg/metrics: define default CIDR policies values (Backport PR #41476, Upstream PR #41422, @aanm)

Misc Changes:

.github/workflows: add step 5 as part of the image build process (Backport PR #41178, Upstream PR #41113, @aanm)
build-images-release: specify main branch on reusable jobs (Backport PR #41178, Upstream PR #41530, @aanm)
checkpatch: Update image digest (Backport PR #41476, Upstream PR #41360, @HadrienPatte)
chore(deps): update all github action dependencies (v1.17) (#41569, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#41127, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#41341, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#41440, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#41510, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#41613, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#41717, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v32 (v1.17) (#41221, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v32.1 (v1.17) (#41664, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.6 docker digest to 8d9e57c (v1.17) (#41352, @cilium-renovate[bot])
chore(deps): update go to v1.24.7 (v1.17) (#41568, @cilium-renovate[bot])
chore(deps): update google/cloud-sdk docker tag to v535 (v1.17) (#41353, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.33.7-1756004918-79963736ba1b039ff10f7dcb65fa43c5dd6556ed (v1.17) (#41377, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.33.8-1756960543-c60e96750d287b709de24243dd71a769147da7d1 (v1.17) (#41517, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.33.9-1757593597-298d4cf0a4058d027aa846ef3647123e8411d2b0 (v1.17) (#41662, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-llvm docker tag to v1755973935 (v1.17) (#41356, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#41441, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#41663, @cilium-renovate[bot])
ci: Update workflow permissions (Backport PR #41476, Upstream PR #41383, @kyle-c-simmons)
docs: document portmap binary requirements (Backport PR #41369, Upstream PR #41300, @nbusseneau)
Fix release script steps (Backport PR #41178, Upstream PR #41502, @aanm)
install: bump startup script version (Backport PR #41369, Upstream PR #41299, @Artyop)
lower log severity for stale metadata to avoid CI issue (Backport PR #41476, Upstream PR #41389, @liyihuang)
metrics/features: remove aws-vpc-cni (Backport PR #41624, Upstream PR #41498, @aanm)
Support extending cilium-agent dnsPolicy as a downstream packager (Backport PR #41266, Upstream PR #41010, @devodev)
Update all github action dependencies (v1.17) (#41220, @cilium-renovate[bot])
Update docker.io/library/golang:1.24.6 Docker digest to e155b51 (v1.17) (#41218, @cilium-renovate[bot])
Update stable lvh-images (v1.17) (patch) (#41219, @cilium-renovate[bot])
workflows/conformance-ginkgo: fix steps for stable branches (Backport PR #41618, Upstream PR #41599, @aanm)

Other Changes:

[v1.17] envoy: Start serving listeners only after clusters have been ACKed (#41606, @jrajahalme)
[v1.17] workflows/release: add secrets for step 4 and 5 (#41734, @jrajahalme)
Fix a bug that caused the kernel verifier on pre-v5.7 kernels to reject the bpf_sock program with "invalid func unknown#122" when the LocalRedirectPolicy feature is enabled. (#41449, @julianwiedmann)
GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service. (#41257, @youngnick)
install: Update image digests for v1.17.7 (#41181, @cilium-release-bot[bot])

Docker Manifests

cilium

quay.io/cilium/cilium:v1.17.8@sha256:6d7ea72ed311eeca4c75a1f17617a3d596fb6038d30d00799090679f82a01636

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.8@sha256:3ac210d94d37a77ec010f9ac4c705edc8f15f22afa2b9a6f0e2a7d64d2360586

docker-plugin

quay.io/cilium/docker-plugin:v1.17.8@sha256:0c06b8bfa91d0fe79f7ad0e1bc30b910d530a6d36a977571b6038c7b12b9e7c1

hubble-relay

quay.io/cilium/hubble-relay:v1.17.8@sha256:2e576bf7a02291c07bffbc1ca0a66a6c70f4c3eb155480e5b3ac027bedd2858b

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.8@sha256:72c25a405ad8e58d2cf03f7ea2b6696ed1edcfb51716b5f85e45c6c4fcaa6056

operator-aws

quay.io/cilium/operator-aws:v1.17.8@sha256:28012f7d0f4f23e9f6c7d6a5dd931afa326bbac3e8103f3f6f22b9670847dffa

operator-azure

quay.io/cilium/operator-azure:v1.17.8@sha256:619f9febf3efef2724a26522b253e4595cd33c274f5f49925e29a795fdc2d2d7

operator-generic

quay.io/cilium/operator-generic:v1.17.8@sha256:5468807b9c31997f3a1a14558ec7c20c5b962a2df6db633b7afbe2f45a15da1c

operator

quay.io/cilium/operator:v1.17.8@sha256:31ff7c28d2cc96f97c5246fa03d4e31a089600f0d896e7e16a48e83090ee83bc

`v1.17.7`: 1.17.7

Compare Source

Summary of Changes

Minor Changes:

Add kernel_version, endpoint_routes_enabled, strict_mode_enabled and kubernetes_version feature metrics. (Backport PR #41074, Upstream PR #41003, @aanm)

Bugfixes:

Added cleanup of deprecated cilium_policy_v1 maps (Backport PR #40578, Upstream PR #39400, @pasteley)
bgp: Use private fork of the GoBGP to fix BGP MD5 auth (Backport PR #40578, Upstream PR #40566, @YutaroHayakawa)
bpf/nat: fix header offset while reverse nat-ing icmp6 pkt too big. (Backport PR #40387, Upstream PR #40002, @tommyp1ckles)
Enable protocol differentiation by default on the operator, matching the agent (#40643, @dylandreimerink)
Fix a bug where Cilium leaks stale routes when IPsec is enabled. (Backport PR #40664, Upstream PR #40653, @pippolo84)
fix(helm): fix values.schema.json types for bpf.events.default.{rateLimit,burstLimit} (Backport PR #40578, Upstream PR #40543, @vchirikov)
fix: kube-proxy healthz panic on port 10256 (#40590, @tamilmani1989)
Helm: Correct seccompProfile for cilium-agent pods (Backport PR #40578, Upstream PR #40476, @jcpunk)
install/kubernetes: fix clustermesh-apiserver extraEnv (Backport PR #41074, Upstream PR #41021, @aanm)
pkg/ipam: fix multi-pool allocator not releasing un-used /32 and /128 CIDRs (Backport PR #40578, Upstream PR #40393, @alimehrabikoshki)
service: Only set algorithm annotation when requested (#40845, @tsotne95)

CI Changes:

.github/actions: only upload files with features-tested prefix (Backport PR #40988, Upstream PR #40975, @aanm)
.github: Don't overwrite junit results (Backport PR #41014, Upstream PR #39159, @joestringer)
.github: Run final steps when tests aren't skipped (Backport PR #41014, Upstream PR #40180, @joestringer)
[v1.17] .github: Remove use of cosign attest --recursive (#40699, @YutaroHayakawa)
[v1.17] ci: Revert build_commits runner to ubuntu-22.04 (#40837, @rastislavs)
builder: Add tparse,junit tooling (Backport PR #41014, Upstream PR #39092, @joestringer)
Centralize dynamic test ownership configuration (Backport PR #41014, Upstream PR #38045, @joestringer)
ci: conformance-eks token extended to 8h (Backport PR #40578, Upstream PR #40474, @mathpl)
ci: more powerful runners for go linting (Backport PR #40765, Upstream PR #40582, @mathpl)
CLI: Attribute tests to codeowners (Backport PR #41014, Upstream PR #37027, @joestringer)
Emit junit output from BPF unit tests (Backport PR #41014, Upstream PR #39099, @joestringer)
Fix GKE cluster creation failures when branch names exceed 63-byte label limit by implementing automatic truncation with hash-based uniqueness preservation. (Backport PR #40849, Upstream PR #40725, @pillai-ashwin)
Improved test failure attribution on stable branches by using TESTOWNERS files to route failures to appropriate code quality teams rather than generic CI infrastructure teams. (Backport PR #41014, Upstream PR #40776, @pillai-ashwin)
pkg/egw: Add missing waitForReconciliationRun (Backport PR #40578, Upstream PR #40355, @aditighag)
spire: Fix unreliable test (Backport PR #40664, Upstream PR #40561, @joestringer)
tools/testowners: de-duplicate error logs (Backport PR #41074, Upstream PR #40778, @tklauser)
Upload junit results for Go unit test runs (Backport PR #41014, Upstream PR #39015, @joestringer)

Misc Changes:

.github/workflows: bump build-images-base timeout to 60 minutes (Backport PR #40988, Upstream PR #40919, @aanm)
.github: fix removal of all files in /mnt (Backport PR #40849, Upstream PR #40818, @aanm)
.github: fix upload artifacts for features.json (#41091, @aanm)
.github: remove all contents of /mnt in build images CI (Backport PR #40849, Upstream PR #40814, @aanm)
.github: remove stable tag from v1.17 branches (#40772, @aanm)
certloader: Add client variants of watched TLS configs (Backport PR #40624, Upstream PR #40399, @devodev)
chore(deps): update actions/download-artifact action to v5 (v1.17) (#41058, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.17) (#40746, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.17) (#40905, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.17) (#41059, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#40744, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#40984, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.18.6 (v1.17) (#40902, @cilium-renovate[bot])
chore(deps): update dependency cilium/little-vm-helper to v0.0.26 (v1.17) (#40646, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.5 docker digest to ef5b4be (v1.17) (#40745, @cilium-renovate[bot])
chore(deps): update go to v1.24.6 (v1.17) (#40994, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.33.6-1753919866-df8077dbd3932edccb59f1c5c70e01f2c1f63741 (v1.17) (#40903, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#40673, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#40904, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#41057, @cilium-renovate[bot])
ci: add/change runner labels (Backport PR #40988, Upstream PR #40972, @Artyop)
cli: Load code owners dynamically via --code-owners (Backport PR #41014, Upstream PR #38044, @joestringer)
daemon/test: explicitly wait for identities synchronization (Backport PR #40849, Upstream PR #40811, @giorio94)
doc:monitor: clarify direction traced with default aggregation level (Backport PR #40578, Upstream PR #40398, @smagnani96)
docs: Add missing IPAM modes to configuration page (Backport PR #40664, Upstream PR #40540, @RayyanSeliya)
docs: Add warning about changing an IP pool (Backport PR #40664, Upstream PR #40567, @sorrison)
docs: remove l7 EnableDefaultDeny callout (Backport PR #40578, Upstream PR #40441, @squeed)
Fix race condition issues (Backport PR #40988, Upstream PR #40949, @aanm)
Makefile: Fix multi codeowner detection (Backport PR #41014, Upstream PR #40923, @joestringer)
Makefile: Improve tparse,junit output handling (Backport PR #41014, Upstream PR #39098, @joestringer)
Support extending cilium-agent volumes as a downstream packager (Backport PR #40578, Upstream PR #40401, @devodev)
tools: Move codeowners library from cilium-cli dir (Backport PR #41014, Upstream PR #40253, @joestringer)

Other Changes:

Fix bug where LocalRedirectPolicy forwarding would break if you enable bpf-lb-algorithm-annotation (#40246, @tarabrind)
images: update cilium-{runtime,builder} (#40839, @aanm)
install: Update image digests for v1.17.6 (#40546, @cilium-release-bot[bot])
vendor: Bump to StateDB v0.4.5 (#40850, @joamaki)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.17.7@sha256:b22440f49c61195171aca585c7a57c6a8867271e43a5abc38f2a2f561436ff86

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.7@sha256:2852feca0d0d936ed0333cd64859f3c5ece2db582ba5fed848f57aff786be4a6

docker-plugin

quay.io/cilium/docker-plugin:v1.17.7@sha256:1b7c8d64f01b309521f13ab2a15239a688b9f545bb97058d383ad3bb55e42e67

hubble-relay

quay.io/cilium/hubble-relay:v1.17.7@sha256:9394312ce65c3c253a8c26a6c292f58736e75c78d1446ecfcd244f1418bebe77

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.7@sha256:271e64d6c91019a1a4815b4c78294962bf51c9f764c680fdfacb2adb6e9d0c4d

operator-aws

quay.io/cilium/operator-aws:v1.17.7@sha256:ce37d2ccf921761a4171a507748a06a204592890e6f8cf7d1c354648e098c830

operator-azure

quay.io/cilium/operator-azure:v1.17.7@sha256:9c1db11de2e0cdcaba522c8f396b9a643738f3d3f958fa9b4d62f57bac5daafb

operator-generic

quay.io/cilium/operator-generic:v1.17.7@sha256:a610be2562d0f5a8945a27df7d5681711263ce92e09947e867fc37fc9ab08788

operator

quay.io/cilium/operator:v1.17.7@sha256:122e49fce82df90693f8981e5d9013b6a9248284db17226259e39364ba9a211d

`v1.17.6`: 1.17.6

Compare Source

Summary of Changes

Minor Changes:

helm: KPR subflag changes (Backport PR #40222, Upstream PR #39721, @brb)

Bugfixes:

Deny policies are now synced to Envoy so that they can be enforced for Ingress policies. (Backport PR #40187, Upstream PR #39736, @jrajahalme)
Do not fail the agent startup in case IPv6 support is enabled and the node does not have an IPv6 address assigned yet (Backport PR #40205, Upstream PR #40143, @pippolo84)
Fix bug preventing a global service from including remote backends, if the local service has no selector, and the remote one gets removed and then added again. (#40361, @giorio94)
Fix data race involving DumpReliablyWithCallback map operation. (Backport PR #40094, Upstream PR #38590, @aditighag)
Fix IPAM IP release racing condition when IP reassigned back to ENI (Backport PR #40289, Upstream PR #40019, @victorcq)
hubble automatically pick the hubble-prefer-ipv6 to true if ipv4 not enabled (Backport PR #40289, Upstream PR #40210, @chengjoey)
LBIPAM: Fix deletion of CiliumLoadBalancerIPPool with multiple IP blocks that led to an operator crash (Backport PR #40094, Upstream PR #40013, @pippolo84)
pkg/egressgateway: ensure gateway IP is IPv4 (Backport PR #40332, Upstream PR #40209, @rgo3)
policy: fix error handling for selector policy resolution (#40404, @fristonio)

CI Changes:

ci: do not run north-south conn disrupt tests for 5.4 kernels (#39443, @ldelossa)
ci: fix north-south conn disrupt for 5.4 kernel (#40434, @smagnani96)

Misc Changes:

.github/workflows: remove reviewers if ciliumbot approved PR (Backport PR #40094, Upstream PR #39989, @aanm)
auto-approve: add repository as part command (Backport PR #40094, Upstream PR #40050, @aanm)
auto-approve: add repository as part command (Backport PR #40332, Upstream PR #40089, @aanm)
chore(deps): update all github action dependencies (v1.17) (#40158, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#40044, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#40458, @cilium-renovate[bot])
chore(deps): update dependency cilium/cilium-cli to v0.18.5 (v1.17) (#39948, @cilium-renovate[bot])
chore(deps): update go to v1.24.5 (v1.17) (#40424, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.33.4-1752151664-7c2edb0b44cf95f326d628b837fcdd845102ba68 (v1.17) (#40466, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#40157, @cilium-renovate[bot])
cilium: fix socket termination for v4-in-v6 clients (Backport PR #40295, Upstream PR #39994, @borkmann)
contrib/git: add merge drivers to automate post-merge commands (Backport PR #40289, Upstream PR #40189, @aanm)
disk-cleanup: parallelize cleanup process to speed up step (Backport PR #40094, Upstream PR #40054, @aanm)
doc:ipsec:kvstore: explicit limitations that could lead to staling XFRM states and no connectivity (Backport PR #40176, Upstream PR #39719, @smagnani96)
docs/ipsec: Fix incorrect statement on hostns encryption (Backport PR #40176, Upstream PR #40133, @pchaigno)
Makefile: Require API generation commands to succeed (Backport PR #40205, Upstream PR #40199, @joestringer)
operator/secretsync: silence reconciliation logs (Backport PR #40289, Upstream PR #40217, @tklauser)
proxy: Use upstream envoy control plane API (Backport PR #40216, Upstream PR #39672, @sayboras)
v1.17: helm: Restore hostPort.enabled flag (#40480, @brb)

Other Changes:

[v1.17] deps: Update cilium-envoy image to 1.33.x (#40088, @sayboras)
Backport: kube-proxy-healthz to return 503 if node terminating (#40317, @tamilmani1989)
Bpf datapath TCP conntrack entries are (re)created only in the forward direction, solving an issue with freezing proxy connections when backend connection is re-opened. (#40448, @jrajahalme)
envoy: Bump cilium-envoy to the latest v1.33.x (#40368, @sayboras)
install: Update image digests for v1.17.5 (#40117, @cilium-release-bot[bot])
proxy: Bump envoy version to the latest v1.33.x (#40181, @sayboras)
v1.17: docs: Document encapsulation options (#40471, @pchaigno)

Docker Manifests

cilium

quay.io/cilium/cilium:v1.17.6@sha256:544de3d4fed7acba72758413812780a4972d47c39035f2a06d6145d8644a3353
quay.io/cilium/cilium:stable@sha256:544de3d4fed7acba72758413812780a4972d47c39035f2a06d6145d8644a3353

clustermesh-apiserver

quay.io/cilium/clustermesh-apiserver:v1.17.6@sha256:f619e97432db427e1511bf91af3be8ded418c53a353a09629e04c5880659d1df
quay.io/cilium/clustermesh-apiserver:stable@sha256:f619e97432db427e1511bf91af3be8ded418c53a353a09629e04c5880659d1df

docker-plugin

quay.io/cilium/docker-plugin:v1.17.6@sha256:2d6175582c036dde241448b2b937353ce304d7a30eec9b66e96279b4b39c4f36
quay.io/cilium/docker-plugin:stable@sha256:2d6175582c036dde241448b2b937353ce304d7a30eec9b66e96279b4b39c4f36

hubble-relay

quay.io/cilium/hubble-relay:v1.17.6@sha256:7d17ec10b3d37341c18ca56165b2f29a715cb8ee81311fd07088d8bf68c01e60
quay.io/cilium/hubble-relay:stable@sha256:7d17ec10b3d37341c18ca56165b2f29a715cb8ee81311fd07088d8bf68c01e60

operator-alibabacloud

quay.io/cilium/operator-alibabacloud:v1.17.6@sha256:5352e670719dc61f059c1e1a04bc0563c2144738386fa7236dc167ff3fef4c64
quay.io/cilium/operator-alibabacloud:stable@sha256:5352e670719dc61f059c1e1a04bc0563c2144738386fa7236dc167ff3fef4c64

operator-aws

quay.io/cilium/operator-aws:v1.17.6@sha256:24db5c811e24e51e7ce166e8e056967875bf3544cc2ead6984f34f705fe71847
quay.io/cilium/operator-aws:stable@sha256:24db5c811e24e51e7ce166e8e056967875bf3544cc2ead6984f34f705fe71847

operator-azure

quay.io/cilium/operator-azure:v1.17.6@sha256:1b7e193ccbc718f723993a0f11eb8fbf16376e822fe8c4dc792d7696701d57c8
quay.io/cilium/operator-azure:stable@sha256:1b7e193ccbc718f723993a0f11eb8fbf16376e822fe8c4dc792d7696701d57c8

operator-generic

quay.io/cilium/operator-generic:v1.17.6@sha256:91ac3bf7be7bed30e90218f219d4f3062a63377689ee7246062fa0cc3839d096
quay.io/cilium/operator-generic:stable@sha256:91ac3bf7be7bed30e90218f219d4f3062a63377689ee7246062fa0cc3839d096

operator

quay.io/cilium/operator:v1.17.6@sha256:e7b41cdba20875f8a6595eca1baf1cff1b8367417cffa99be7b1b9b0a11ab677
quay.io/cilium/operator:stable@sha256:e7b41cdba20875f8a6595eca1baf1cff1b8367417cffa99be7b1b9b0a11ab677

`v1.17.5`: 1.17.5

Compare Source

Summary of Changes

Bugfixes:

aws/ENI: Only use pagination when not specifying IDs (Backport PR #39564, Upstream PR #39120, @HadrienPatte)
Fix connections to deleted service backends not getting terminated in certain cases involving services with multiple protocol ports. (Backport PR #39564, Upstream PR #37745, @foyerunix)
Fix handle_policy_egress programs not being cleaned up during endpoint teardown (Backport PR #39685, Upstream PR #39560, @ti-mo)
Fixed bug where datapath is unable to compile when active connection tracking and IPv6 are enabled at the same time. (Backport PR #39564, Upstream PR #39509, @dylandreimerink)
Fixes a bug where a CIDRRule of 0.0.0.0/0 would not select all external traffic. (Backport PR #39765, Upstream PR #39693, @squeed)
gateway-api: Use original source address for GAMMA (Backport PR #39685, Upstream PR #39206, @sayboras)
helm/hubble: Fix wrong value for metrics server tls existingSecret (Backport PR #39685, Upstream PR #39668, @devodev)
install/kubernetes: change mapDynamicSizeRatio from number to string (Backport PR #39963, Upstream PR #39834, @aanm)
operator: skip retry of node taint update when node not found (Backport PR #39564, Upstream PR #39517, @jshr-w)
Persist parent interface index of endpoint across agent restarts (Backport PR #39765, Upstream PR #39575, @dylandreimerink)
Policy updates to Envoy no longer consider a single selector as an L3 wildcard. Cilium bpf datapath policy enforcement is not done for Cilium Ingress policy enforcement so the L3 identity needs to be enforced in all cases. (Backport PR #39564, Upstream PR #39511, @jrajahalme)

CI Changes:

bpf: test: fix up mis-spelled HAVE_NETNS_COOKIE (Backport PR #39564, Upstream PR #39420, @julianwiedmann)
call for metrics in smoke tests from runner instead of installing apt/curl on cilium pod (Backport PR #39862, Upstream PR #37362, @Artyop)
gh: e2e: enable secondary-network LB testing for all KPR=true configs (Backport PR #39780, Upstream PR #39718, @julianwiedmann)
gh: eks: restore concurrent execution of connectivity tests (Backport PR #39685, Upstream PR #39673, @julianwiedmann)
Re-optimize CI build process (Backport PR #39862, Upstream PR #39802, @aanm)

Misc Changes:

.github/workflows: remove cilium-cli from build-go-caches (#39801, @aanm)
[v1.17] bpf: host: don't detect WG traffic in from-netdev@cilium_wg0 (#38233, @julianwiedmann)
Add a section to talk about the native routing masquerading in the cloud environment. (Backport PR #39564, Upstream PR #39343, @liyihuang)
bpf: host: flag Cilium's ESP traffic as TRACE_REASON_ENCRYPTED (Backport PR #39685, Upstream PR #39558, @julianwiedmann)
bpf: Skip lxc src IP check for proxy traffic (Backport PR #39564, Upstream PR #39530, @sayboras)
bpf:wireguard: reuse MARK_MAGIC_ENCRYPT for encrypted packets (Backport PR #39652, Upstream PR #39651, @smagnani96)
chore(deps): update all github action dependencies (v1.17) (#39476, @cilium-renovate[bot])
chore(deps): update all github action dependencies (v1.17) (#39704, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#39570, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#39687, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#39821, @cilium-renovate[bot])
chore(deps): update all-dependencies (v1.17) (#39879, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v31 (v1.17) (#39607, @cilium-renovate[bot])
chore(deps): update dependency protocolbuffers/protobuf to v31.1 (v1.17) (#39951, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.3 docker digest to 4c0a181 (v1.17) (#39725, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.3 docker digest to 81bf592 (v1.17) (#39822, @cilium-renovate[bot])
chore(deps): update docker.io/library/golang:1.24.3 docker digest to 86b4cff (v1.17) (#39605, @cilium-renovate[bot])
chore(deps): update gcr.io/distroless/static:nonroot docker digest to 188ddfb (v1.17) (#39606, @cilium-renovate[bot])
chore(deps): update go to v1.24.4 (v1.17) (#39949, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.6-1749031919-98c55b1d0c1154fb6c9e760583c2dcd7778686e2 (v1.17) (#39886, @cilium-renovate[bot])
chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.32.6-1749271279-0864395884b263913eac200ee2048fd985f8e626 (v1.17) (#39935, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#39703, @cilium-renovate[bot])
chore(deps): update stable lvh-images (v1.17) (patch) (#39950, @cilium-renovate[bot])
HELM: Adding Label Support to clustermesh apiserver service (Backport PR #39564, Upstream PR #39520, @camrossi)
mtu/endpoint_updater.go: Check for unix.EINVAL not os.ErrInvalid (Backport PR #39862, Upstream PR #39658, @dylandreimerink)
mtu: Catch expected error in endpoint MTU updater (Backport PR #39685, Upstream PR #36596, @dylandreimerink)
pkg/fswatcher: Rewrite without underlying use of fsnotify (Backport PR #39963, Upstream PR #38537, @glibsm)

Other Changes:

[v1.17] chore(deps): revert etcd bump to v3.6.0 (#39628, @giorio94)
[v1.17] vendor: Bump Hive and StateDB (#39689, [@joamaki](h

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2025-06-21T00:32:31Z

--- kubernetes/apps/kube-system/cilium/app Kustomization: flux-system/cilium HelmRelease: kube-system/cilium

+++ kubernetes/apps/kube-system/cilium/app Kustomization: flux-system/cilium HelmRelease: kube-system/cilium

@@ -13,13 +13,13 @@

     spec:
       chart: cilium
       sourceRef:
         kind: HelmRepository
         name: cilium
         namespace: flux-system
-      version: 1.17.4
+      version: 1.17.9
   install:
     remediation:
       retries: 3
   interval: 30m
   upgrade:
     cleanupOnFail: true

github-actions · 2025-06-21T00:32:36Z

--- HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

+++ HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

@@ -29,15 +29,17 @@

         helm.toolkit.fluxcd.io/name: cilium
         helm.toolkit.fluxcd.io/namespace: kube-system
     spec:
       securityContext:
         appArmorProfile:
           type: Unconfined
+        seccompProfile:
+          type: Unconfined
       containers:
       - name: cilium-agent
-        image: quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a
+        image: quay.io/cilium/cilium:v1.17.9@sha256:6792747da10f8daf2ae7f028713bc4f4cff335451fa70bfb211557e95cb1e6a5
         imagePullPolicy: IfNotPresent
         command:
         - cilium-agent
         args:
         - --config-dir=/tmp/cilium/config-map
         startupProbe:
@@ -203,13 +205,13 @@

           mountPath: /var/lib/cilium/tls/hubble
           readOnly: true
         - name: tmp
           mountPath: /tmp
       initContainers:
       - name: config
-        image: quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a
+        image: quay.io/cilium/cilium:v1.17.9@sha256:6792747da10f8daf2ae7f028713bc4f4cff335451fa70bfb211557e95cb1e6a5
         imagePullPolicy: IfNotPresent
         command:
         - cilium-dbg
         - build-config
         env:
         - name: K8S_NODE_NAME
@@ -228,13 +230,13 @@

           value: '7445'
         volumeMounts:
         - name: tmp
           mountPath: /tmp
         terminationMessagePolicy: FallbackToLogsOnError
       - name: mount-cgroup
-        image: quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a
+        image: quay.io/cilium/cilium:v1.17.9@sha256:6792747da10f8daf2ae7f028713bc4f4cff335451fa70bfb211557e95cb1e6a5
         imagePullPolicy: IfNotPresent
         env:
         - name: CGROUP_ROOT
           value: /sys/fs/cgroup
         - name: BIN_PATH
           value: /opt/cni/bin
@@ -260,13 +262,13 @@

             - SYS_ADMIN
             - SYS_CHROOT
             - SYS_PTRACE
             drop:
             - ALL
       - name: apply-sysctl-overwrites
-        image: quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a
+        image: quay.io/cilium/cilium:v1.17.9@sha256:6792747da10f8daf2ae7f028713bc4f4cff335451fa70bfb211557e95cb1e6a5
         imagePullPolicy: IfNotPresent
         env:
         - name: BIN_PATH
           value: /opt/cni/bin
         command:
         - sh
@@ -290,13 +292,13 @@

             - SYS_ADMIN
             - SYS_CHROOT
             - SYS_PTRACE
             drop:
             - ALL
       - name: mount-bpf-fs
-        image: quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a
+        image: quay.io/cilium/cilium:v1.17.9@sha256:6792747da10f8daf2ae7f028713bc4f4cff335451fa70bfb211557e95cb1e6a5
         imagePullPolicy: IfNotPresent
         args:
         - mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf
         command:
         - /bin/bash
         - -c
@@ -306,13 +308,13 @@

           privileged: true
         volumeMounts:
         - name: bpf-maps
           mountPath: /sys/fs/bpf
           mountPropagation: Bidirectional
       - name: clean-cilium-state
-        image: quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a
+        image: quay.io/cilium/cilium:v1.17.9@sha256:6792747da10f8daf2ae7f028713bc4f4cff335451fa70bfb211557e95cb1e6a5
         imagePullPolicy: IfNotPresent
         command:
         - /init-container.sh
         env:
         - name: CILIUM_ALL_STATE
           valueFrom:
@@ -354,13 +356,13 @@

         - name: cilium-cgroup
           mountPath: /sys/fs/cgroup
           mountPropagation: HostToContainer
         - name: cilium-run
           mountPath: /var/run/cilium
       - name: install-cni-binaries
-        image: quay.io/cilium/cilium:v1.17.4@sha256:24a73fe795351cf3279ac8e84918633000b52a9654ff73a6b0d7223bcff4a67a
+        image: quay.io/cilium/cilium:v1.17.9@sha256:6792747da10f8daf2ae7f028713bc4f4cff335451fa70bfb211557e95cb1e6a5
         imagePullPolicy: IfNotPresent
         command:
         - /install-plugin.sh
         resources:
           requests:
             cpu: 100m
--- HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

+++ HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

@@ -33,13 +33,13 @@

         app.kubernetes.io/name: cilium-operator
         helm.toolkit.fluxcd.io/name: cilium
         helm.toolkit.fluxcd.io/namespace: kube-system
     spec:
       containers:
       - name: cilium-operator
-        image: quay.io/cilium/operator-generic:v1.17.4@sha256:a3906412f477b09904f46aac1bed28eb522bef7899ed7dd81c15f78b7aa1b9b5
+        image: quay.io/cilium/operator-generic:v1.17.9@sha256:f6efc077c738e28973d66c5c1d361a9f385c6323fec49518f565c7267a1b7d3a
         imagePullPolicy: IfNotPresent
         command:
         - cilium-operator-generic
         args:
         - --config-dir=/tmp/cilium/config-map
         - --debug=$(CILIUM_DEBUG)
--- HelmRelease: kube-system/cilium Deployment: kube-system/hubble-relay

+++ HelmRelease: kube-system/cilium Deployment: kube-system/hubble-relay

@@ -38,13 +38,13 @@

           capabilities:
             drop:
             - ALL
           runAsGroup: 65532
           runAsNonRoot: true
           runAsUser: 65532
-        image: quay.io/cilium/hubble-relay:v1.17.4@sha256:c16de12a64b8b56de62b15c1652d036253b40cd7fa643d7e1a404dc71dc66441
+        image: quay.io/cilium/hubble-relay:v1.17.9@sha256:9bcd61931abe81202d52c3757f00fa229cd93f7e9d571409975d01278ab6feb0
         imagePullPolicy: IfNotPresent
         command:
         - hubble-relay
         args:
         - serve
         ports:
--- HelmRelease: kube-system/cilium Deployment: kube-system/hubble-ui

+++ HelmRelease: kube-system/cilium Deployment: kube-system/hubble-ui

@@ -36,13 +36,13 @@

         runAsUser: 1001
       priorityClassName: null
       serviceAccountName: hubble-ui
       automountServiceAccountToken: true
       containers:
       - name: frontend
-        image: quay.io/cilium/hubble-ui:v0.13.2@sha256:9e37c1296b802830834cc87342a9182ccbb71ffebb711971e849221bd9d59392
+        image: quay.io/cilium/hubble-ui:v0.13.3@sha256:661d5de7050182d495c6497ff0b007a7a1e379648e60830dd68c4d78ae21761d
         imagePullPolicy: IfNotPresent
         ports:
         - name: http
           containerPort: 8081
         livenessProbe:
           httpGet:
@@ -57,13 +57,13 @@

           mountPath: /etc/nginx/conf.d/default.conf
           subPath: nginx.conf
         - name: tmp-dir
           mountPath: /tmp
         terminationMessagePolicy: FallbackToLogsOnError
       - name: backend
-        image: quay.io/cilium/hubble-ui-backend:v0.13.2@sha256:a034b7e98e6ea796ed26df8f4e71f83fc16465a19d166eff67a03b822c0bfa15
+        image: quay.io/cilium/hubble-ui-backend:v0.13.3@sha256:db1454e45dc39ca41fbf7cad31eec95d99e5b9949c39daaad0fa81ef29d56953
         imagePullPolicy: IfNotPresent
         env:
         - name: EVENTS_SERVER_PORT
           value: '8090'
         - name: FLOWS_API_ADDR
           value: hubble-relay:80

renovate bot added renovate/helm type/patch labels Jun 21, 2025

github-actions bot added area/kubernetes area/templates labels Jun 21, 2025

renovate bot force-pushed the renovate/cilium-1.17.x branch from 0666b03 to 443991d Compare July 16, 2025 12:31

renovate bot changed the title ~~fix(helm): update cilium ( 1.17.4 → 1.17.5 )~~ fix(helm): update cilium ( 1.17.4 → 1.17.6 ) Jul 16, 2025

renovate bot force-pushed the renovate/cilium-1.17.x branch 2 times, most recently from d5aace1 to 63b7f4d Compare August 15, 2025 14:09

renovate bot changed the title ~~fix(helm): update cilium ( 1.17.4 → 1.17.6 )~~ fix(helm): update cilium ( 1.17.4 → 1.17.7 ) Aug 15, 2025

renovate bot force-pushed the renovate/cilium-1.17.x branch from 63b7f4d to e10bf9f Compare September 22, 2025 12:32

renovate bot changed the title ~~fix(helm): update cilium ( 1.17.4 → 1.17.7 )~~ fix(helm): update cilium ( 1.17.4 → 1.17.8 ) Sep 22, 2025

renovate bot force-pushed the renovate/cilium-1.17.x branch from e10bf9f to e74050c Compare October 21, 2025 17:10

fix(helm): update cilium ( 1.17.4 → 1.17.9 )

81220d0

renovate bot force-pushed the renovate/cilium-1.17.x branch from e74050c to 81220d0 Compare October 23, 2025 20:42

renovate bot changed the title ~~fix(helm): update cilium ( 1.17.4 → 1.17.8 )~~ fix(helm): update cilium ( 1.17.4 → 1.17.9 ) Oct 23, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(helm): update cilium ( 1.17.4 → 1.17.9 ) #796

fix(helm): update cilium ( 1.17.4 → 1.17.9 ) #796

Uh oh!

renovate bot commented Jun 21, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Jun 21, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Jun 21, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

fix(helm): update cilium ( 1.17.4 → 1.17.9 ) #796

Are you sure you want to change the base?

fix(helm): update cilium ( 1.17.4 → 1.17.9 ) #796

Uh oh!

Conversation

renovate bot commented Jun 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.17.9

v1.17.8: 1.17.8

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.17.7: 1.17.7

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.17.6: 1.17.6

Summary of Changes

Docker Manifests

cilium

clustermesh-apiserver

docker-plugin

hubble-relay

operator-alibabacloud

operator-aws

operator-azure

operator-generic

operator

v1.17.5: 1.17.5

Summary of Changes

Configuration

Uh oh!

github-actions bot commented Jun 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jun 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Jun 21, 2025 •

edited

Loading

`v1.17.9`

`v1.17.8`: 1.17.8

`v1.17.7`: 1.17.7

`v1.17.6`: 1.17.6

`v1.17.5`: 1.17.5

github-actions bot commented Jun 21, 2025 •

edited

Loading

github-actions bot commented Jun 21, 2025 •

edited

Loading